@parall/daemon 1.36.0 → 1.37.0

package/dist/update-health-gate.d.ts

@@ -0,0 +1,66 @@
+import type { GatewayLogger } from '@parall/agent-core';
+import type { DaemonUpdater } from './updater.js';
+type TimerHandle = {
+    unref?: () => void;
+};
+type TimerApi = {
+    setTimeout(callback: () => void, ms: number): TimerHandle;
+    clearTimeout(handle: TimerHandle): void;
+};
+/**
+ * Canary gate for a freshly self-updated daemon. Centralizes the "is the new
+ * version healthy enough to confirm?" policy in ONE place so it isn't smeared
+ * across the supervisor's WS handlers.
+ *
+ * A pending update is confirmed only when BOTH hold:
+ *   - the control-plane handshake (machine.hello) is seen at least once, AND
+ *   - the process + supervisor then stay up for `stabilityWindowMs` without the
+ *     supervisor soft-crashing or the process exiting.
+ *
+ * Lifecycle:
+ *   - `onMachineHello()` — the first hello with a pending update arms the
+ *     stability timer. The timer is process-level (lives in this gate, which the
+ *     process owns), so it survives WS reconnects; a disconnect does NOT cancel
+ *     it.
+ *   - timer elapses with the process still alive → `confirmVersion()`. (A
+ *     process exit/crash before the timer means it simply never fires.)
+ *   - `onSupervisorEnded()` — the supervisor instance stopped (clean shutdown OR
+ *     a runForever-caught soft crash). Cancel the timer so a stale timer can't
+ *     confirm across supervisor instances; the next supervisor's machine.hello
+ *     re-arms it. This RESETS the health window but NEVER records a rollback
+ *     failure — soft crashes are not rollback signals. Rollback `boot_count` is
+ *     incremented only by process-level unclean exits (crash / kill / power loss
+ *     / uncaught fatal exit), tracked via the `daemon-running` marker in
+ *     `index.ts`, not here. A pure in-process soft-crash loop is therefore left
+ *     to runForever backoff + observability, by design.
+ *
+ * The updater is unaware of all this: it only exposes `hasPendingActivation()` +
+ * `confirmVersion()` and never learns what a "supervisor soft crash" is. Agent
+ * child / clip / browser workload failures never reach this gate and never count
+ * as rollback failures.
+ */
+export declare class PendingUpdateHealthGate {
+    private readonly updater;
+    private readonly stabilityWindowMs;
+    private readonly log;
+    private readonly timers;
+    private timer;
+    private confirmed;
+    constructor(updater: DaemonUpdater, stabilityWindowMs: number, log: GatewayLogger, timers?: TimerApi);
+    /**
+     * Control-plane handshake. Arms the stability timer on the first hello that
+     * sees a pending (unconfirmed) update. No-op once confirmed, while a timer is
+     * already running, or when there is nothing pending to confirm.
+     */
+    onMachineHello(): void;
+    /**
+     * The current supervisor instance ended — a clean shutdown or a
+     * runForever-caught soft crash. Reset the health window (cancel the pending
+     * confirm timer) without recording any rollback failure; the next supervisor
+     * re-arms via `onMachineHello`.
+     */
+    onSupervisorEnded(): void;
+    private confirm;
+}
+export {};
+//# sourceMappingURL=update-health-gate.d.ts.map

package/dist/update-health-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-health-gate.d.ts","sourceRoot":"","sources":["../src/update-health-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,KAAK,WAAW,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAE1C,KAAK,QAAQ,GAAG;IACd,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAAC;IAC1D,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;CACzC,CAAC;AAOF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,uBAAuB;IAKhC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,SAAS,CAAS;gBAGP,OAAO,EAAE,aAAa,EACtB,iBAAiB,EAAE,MAAM,EACzB,GAAG,EAAE,aAAa,EAClB,MAAM,GAAE,QAAqB;IAGhD;;;;OAIG;IACH,cAAc,IAAI,IAAI;IActB;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAOzB,OAAO,CAAC,OAAO;CAShB"}

package/dist/update-health-gate.js

@@ -0,0 +1,93 @@
+const realTimers = {
+    setTimeout: (callback, ms) => setTimeout(callback, ms),
+    clearTimeout: (handle) => clearTimeout(handle),
+};
+/**
+ * Canary gate for a freshly self-updated daemon. Centralizes the "is the new
+ * version healthy enough to confirm?" policy in ONE place so it isn't smeared
+ * across the supervisor's WS handlers.
+ *
+ * A pending update is confirmed only when BOTH hold:
+ *   - the control-plane handshake (machine.hello) is seen at least once, AND
+ *   - the process + supervisor then stay up for `stabilityWindowMs` without the
+ *     supervisor soft-crashing or the process exiting.
+ *
+ * Lifecycle:
+ *   - `onMachineHello()` — the first hello with a pending update arms the
+ *     stability timer. The timer is process-level (lives in this gate, which the
+ *     process owns), so it survives WS reconnects; a disconnect does NOT cancel
+ *     it.
+ *   - timer elapses with the process still alive → `confirmVersion()`. (A
+ *     process exit/crash before the timer means it simply never fires.)
+ *   - `onSupervisorEnded()` — the supervisor instance stopped (clean shutdown OR
+ *     a runForever-caught soft crash). Cancel the timer so a stale timer can't
+ *     confirm across supervisor instances; the next supervisor's machine.hello
+ *     re-arms it. This RESETS the health window but NEVER records a rollback
+ *     failure — soft crashes are not rollback signals. Rollback `boot_count` is
+ *     incremented only by process-level unclean exits (crash / kill / power loss
+ *     / uncaught fatal exit), tracked via the `daemon-running` marker in
+ *     `index.ts`, not here. A pure in-process soft-crash loop is therefore left
+ *     to runForever backoff + observability, by design.
+ *
+ * The updater is unaware of all this: it only exposes `hasPendingActivation()` +
+ * `confirmVersion()` and never learns what a "supervisor soft crash" is. Agent
+ * child / clip / browser workload failures never reach this gate and never count
+ * as rollback failures.
+ */
+export class PendingUpdateHealthGate {
+    updater;
+    stabilityWindowMs;
+    log;
+    timers;
+    timer = null;
+    confirmed = false;
+    constructor(updater, stabilityWindowMs, log, timers = realTimers) {
+        this.updater = updater;
+        this.stabilityWindowMs = stabilityWindowMs;
+        this.log = log;
+        this.timers = timers;
+    }
+    /**
+     * Control-plane handshake. Arms the stability timer on the first hello that
+     * sees a pending (unconfirmed) update. No-op once confirmed, while a timer is
+     * already running, or when there is nothing pending to confirm.
+     */
+    onMachineHello() {
+        if (this.confirmed || this.timer)
+            return;
+        if (!this.updater.hasPendingActivation())
+            return;
+        if (this.stabilityWindowMs <= 0) {
+            this.confirm();
+            return;
+        }
+        this.timer = this.timers.setTimeout(() => {
+            this.timer = null;
+            this.confirm();
+        }, this.stabilityWindowMs);
+        this.timer.unref?.();
+    }
+    /**
+     * The current supervisor instance ended — a clean shutdown or a
+     * runForever-caught soft crash. Reset the health window (cancel the pending
+     * confirm timer) without recording any rollback failure; the next supervisor
+     * re-arms via `onMachineHello`.
+     */
+    onSupervisorEnded() {
+        if (this.timer) {
+            this.timers.clearTimeout(this.timer);
+            this.timer = null;
+        }
+    }
+    confirm() {
+        if (this.confirmed)
+            return;
+        try {
+            this.updater.confirmVersion();
+            this.confirmed = true;
+        }
+        catch (err) {
+            this.log.warn(`update: confirmVersion failed: ${String(err)}`);
+        }
+    }
+}

package/dist/updater-manifest.d.ts

@@ -35,7 +35,8 @@ export declare function verifyManifestSignature(manifest: RemoteManifest, public
  *
  * Prerelease ordering follows SemVer 2.0: a version with prerelease has
  * lower precedence than the same version without prerelease. Prerelease
- * identifiers are compared lexicographically when both present.
+ * identifiers are compared per SemVer §11.4 when both are present: dot
+ * separated, numeric identifiers numerically, non-numeric lexically.
  */
 export declare function semverCompare(a: string, b: string): number | null;
 //# sourceMappingURL=updater-manifest.d.ts.map

package/dist/updater-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updater-manifest.d.ts","sourceRoot":"","sources":["../src/updater-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUlD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBjE"}
+{"version":3,"file":"updater-manifest.d.ts","sourceRoot":"","sources":["../src/updater-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUlD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAejE"}

package/dist/updater-manifest.js

@@ -38,7 +38,8 @@ export function verifyManifestSignature(manifest, publicKey) {
  *
  * Prerelease ordering follows SemVer 2.0: a version with prerelease has
  * lower precedence than the same version without prerelease. Prerelease
- * identifiers are compared lexicographically when both present.
+ * identifiers are compared per SemVer §11.4 when both are present: dot
+ * separated, numeric identifiers numerically, non-numeric lexically.
  */
 export function semverCompare(a, b) {
     const pa = parseSemver(a);
@@ -59,12 +60,8 @@ export function semverCompare(a, b) {
         return 1;
     if (!pb.pre)
         return -1;
-    // Both have prerelease: lexicographic comparison
-    if (pa.pre < pb.pre)
-        return -1;
-    if (pa.pre > pb.pre)
-        return 1;
-    return 0;
+    // Both have prerelease: compare dot-separated identifiers per SemVer §11.4.
+    return comparePrerelease(pa.pre, pb.pre);
 }
 function parseSemver(v) {
     // Split off prerelease at the first hyphen in the patch component.
@@ -92,3 +89,37 @@ function parseSemver(v) {
         return null;
     return { nums: [major, minor, patch], pre };
 }
+/**
+ * Compare two prerelease strings per SemVer 2.0 §11.4: dot-separated identifiers
+ * left-to-right — numeric identifiers compared numerically, alphanumeric ones by
+ * ASCII order, a numeric identifier always lower precedence than an alphanumeric
+ * one, and (all prior identifiers equal) the longer set outranks the shorter.
+ */
+function comparePrerelease(a, b) {
+    const aIds = a.split('.');
+    const bIds = b.split('.');
+    const len = Math.min(aIds.length, bIds.length);
+    for (let i = 0; i < len; i++) {
+        const ai = aIds[i];
+        const bi = bIds[i];
+        const aNum = /^\d+$/.test(ai);
+        const bNum = /^\d+$/.test(bi);
+        if (aNum && bNum) {
+            const diff = Number(ai) - Number(bi);
+            if (diff !== 0)
+                return diff < 0 ? -1 : 1;
+        }
+        else if (aNum) {
+            return -1; // numeric identifiers have lower precedence than alphanumeric
+        }
+        else if (bNum) {
+            return 1;
+        }
+        else if (ai !== bi) {
+            return ai < bi ? -1 : 1;
+        }
+    }
+    if (aIds.length === bIds.length)
+        return 0;
+    return aIds.length < bIds.length ? -1 : 1;
+}

package/dist/updater.d.ts

@@ -24,10 +24,12 @@ export declare class DaemonUpdater {
     triggerUpdate(targetVersion: string, mandatory: boolean): Promise<boolean>;
     /**
      * Check if we need to roll back from a failed update.
-     * Call on every daemon startup, before bootstrap.
+     * Call on every daemon startup, before bootstrap. `uncleanPrevExit` is true
+     * when the previous run did not exit cleanly (crash / kill / power loss) — the
+     * only signal that counts toward the rollback threshold.
      * Returns true if rollback was performed (caller should exit immediately).
      */
-    checkRollback(): boolean;
+    checkRollback(uncleanPrevExit: boolean): boolean;
     /**
      * Confirm the current version after successful health check.
      * Clears pending state so rollback won't trigger.
@@ -37,6 +39,12 @@ export declare class DaemonUpdater {
      * Get the current local manifest version (for heartbeat reporting).
      */
     getLocalVersion(): string | undefined;
+    /**
+     * Whether an update has been applied but not yet confirmed healthy. The health
+     * gate only arms its stability timer when this is true — a daemon already
+     * running a confirmed version needs no canary.
+     */
+    hasPendingActivation(): boolean;
     /**
      * Check CDN for available update without downloading.
      * Returns remote version info for CLI --check display.
@@ -53,6 +61,9 @@ export declare class DaemonUpdater {
     loadLocalManifest(): LocalManifest | null;
     private loadUpdateState;
     private saveUpdateState;
+    private fsyncDir;
+    private isRedirect;
+    private resolveRedirectUrl;
     private httpGet;
     private downloadFile;
     private cleanDir;

package/dist/updater.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updater.d.ts","sourceRoot":"","sources":["../src/updater.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,uBAAuB,CAAC;AAsB/B,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAA+B;gBAGjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,aAAa,EAClB,cAAc,EAAE,OAAO;IAK1C;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU5C,iBAAiB,IAAI,IAAI;IAOzB;;;OAGG;IACG,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D;;OAEG;IACG,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQhF;;;;OAIG;IACH,aAAa,IAAI,OAAO;IA6CxB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAYtB;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAIrC;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;YAuBY,QAAQ;IA4HtB,OAAO,CAAC,UAAU;IAmClB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,gBAAgB;IAmBxB,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAUzC,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,OAAO;IA8Bf,OAAO,CAAC,YAAY;IAoCpB,OAAO,CAAC,QAAQ;CAKjB"}
+{"version":3,"file":"updater.d.ts","sourceRoot":"","sources":["../src/updater.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,uBAAuB,CAAC;AA2B/B,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAA+B;gBAGjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,aAAa,EAClB,cAAc,EAAE,OAAO;IAK1C;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU5C,iBAAiB,IAAI,IAAI;IAOzB;;;OAGG;IACG,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D;;OAEG;IACG,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQhF;;;;;;OAMG;IACH,aAAa,CAAC,eAAe,EAAE,OAAO,GAAG,OAAO;IAqDhD;;;OAGG;IACH,cAAc,IAAI,IAAI;IAYtB;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAIrC;;;;OAIG;IACH,oBAAoB,IAAI,OAAO;IAM/B;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;YAuBY,QAAQ;IAmJtB,OAAO,CAAC,UAAU;IAmClB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,gBAAgB;IAmBxB,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAUzC,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,eAAe;IA+BvB,OAAO,CAAC,QAAQ;IAYhB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,OAAO;IAuCf,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,QAAQ;CAKjB"}

package/dist/updater.js

@@ -5,6 +5,10 @@ import * as http from 'node:http';
 import { createHash } from 'node:crypto';
 import { verifyManifestSignature, semverCompare, } from './updater-manifest.js';
 const UPDATE_EXIT_CODE = 42;
+// Number of UNCLEAN boots (crash / kill / power loss) a pending update may
+// accumulate before the daemon reverts to the previous version. Clean restarts
+// and offline-but-healthy restarts don't count — see checkRollback().
+const ROLLBACK_BOOT_THRESHOLD = 3;
 // Ed25519 public key for verifying daemon bundle manifests.
 // The corresponding private key lives in GitHub Actions secrets (DAEMON_BUNDLE_SIGNING_KEY).
 const DEFAULT_SIGNING_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
@@ -75,19 +79,29 @@ export class DaemonUpdater {
     }
     /**
      * Check if we need to roll back from a failed update.
-     * Call on every daemon startup, before bootstrap.
+     * Call on every daemon startup, before bootstrap. `uncleanPrevExit` is true
+     * when the previous run did not exit cleanly (crash / kill / power loss) — the
+     * only signal that counts toward the rollback threshold.
      * Returns true if rollback was performed (caller should exit immediately).
      */
-    checkRollback() {
+    checkRollback(uncleanPrevExit) {
         const state = this.loadUpdateState();
         const current = this.loadLocalManifest();
         if (!state || !current)
             return false;
         if (!state.pending_version || state.pending_version !== current.version)
             return false;
-        state.boot_count = (state.boot_count ?? 0) + 1;
-        this.saveUpdateState(state);
-        if (state.boot_count < 3)
+        // Count this boot toward the rollback threshold ONLY if the previous run
+        // ended abnormally (crash / kill / power loss — index.ts left the running
+        // marker behind). A clean shutdown or an offline-but-healthy restart must
+        // not push a working version toward rollback: a healthy version that simply
+        // can't reach the server (so confirmVersion never fires) would otherwise be
+        // reverted after a few normal reboots (the offline-churn bug).
+        if (uncleanPrevExit) {
+            state.boot_count = (state.boot_count ?? 0) + 1;
+            this.saveUpdateState(state);
+        }
+        if ((state.boot_count ?? 0) < ROLLBACK_BOOT_THRESHOLD)
             return false;
         if (!state.previous_version)
             return false;
@@ -141,6 +155,16 @@ export class DaemonUpdater {
     getLocalVersion() {
         return this.loadLocalManifest()?.version;
     }
+    /**
+     * Whether an update has been applied but not yet confirmed healthy. The health
+     * gate only arms its stability timer when this is true — a daemon already
+     * running a confirmed version needs no canary.
+     */
+    hasPendingActivation() {
+        const state = this.loadUpdateState();
+        const current = this.loadLocalManifest();
+        return !!state?.pending_version && !!current && state.pending_version === current.version;
+    }
     /**
      * Check CDN for available update without downloading.
      * Returns remote version info for CLI --check display.
@@ -169,6 +193,15 @@ export class DaemonUpdater {
     // --- Internal ---
     async doUpdate(targetVersion) {
         const local = this.loadLocalManifest();
+        const state = this.loadUpdateState();
+        // Keep the canary state machine single-flight: while the currently running
+        // bundle is still pending health confirmation, do not stack another update
+        // on top of it. Rollback must always target the last confirmed version, not
+        // an unconfirmed intermediate bundle.
+        if (state?.pending_version && local?.version === state.pending_version) {
+            this.log.info(`update: ${local.version} is still pending activation — skipping new update until confirmed`);
+            return false;
+        }
         const manifestUrl = targetVersion
             ? `${this.cdnBaseUrl}/${targetVersion}/manifest.json`
             : `${this.cdnBaseUrl}/latest/manifest.json`;
@@ -195,7 +228,6 @@ export class DaemonUpdater {
                 return false;
         }
         // Skip versions we already rolled back from
-        const state = this.loadUpdateState();
         if (state?.rollback_from === remote.version) {
             this.log.info(`update: skipping ${remote.version} (previously rolled back)`);
             return false;
@@ -255,17 +287,29 @@ export class DaemonUpdater {
         }
         // Write manifest to staging
         fs.writeFileSync(path.join(stagingDir, 'manifest.json'), JSON.stringify(remote, null, 2));
-        // Atomic swap
-        this.atomicSwap(stagingDir, remote.version);
-        // Record pending update state
+        // Record the pending update state BEFORE swapping `current`. The state
+        // write and the swap are two separate filesystem operations, not one atomic
+        // unit, so a crash can land between them — order them so either landing is
+        // safe (crash-consistency):
+        //   - crash after saveUpdateState, before swap → `current` still points at
+        //     the OLD version while state names the new one as pending. On next boot
+        //     checkRollback() sees pending_version !== current.version and does
+        //     nothing; a later check simply re-attempts the update.
+        //   - crash after swap → `current` is the NEW version AND state already has
+        //     the matching pending_version, so rollback protection is intact.
+        // The reverse order (swap first) could leave `current` on the new version
+        // with no matching pending_version, silently voiding rollback.
+        const rollbackVersion = state?.confirmed_version ?? local?.version;
         const newState = {
-            confirmed_version: local?.version ?? state?.confirmed_version,
-            previous_version: local?.version,
+            confirmed_version: rollbackVersion,
+            previous_version: rollbackVersion,
             pending_version: remote.version,
             pending_at: new Date().toISOString(),
             boot_count: 0,
         };
         this.saveUpdateState(newState);
+        // Atomic swap — only after the pending state is durably recorded.
+        this.atomicSwap(stagingDir, remote.version);
         this.log.info(`update: ${local?.version ?? 'unknown'} → ${remote.version} applied, restarting`);
         return true;
     }
@@ -350,17 +394,72 @@ export class DaemonUpdater {
     }
     saveUpdateState(state) {
         const statePath = path.join(this.bundleDir, 'update-state.json');
-        fs.mkdirSync(path.dirname(statePath), { recursive: true });
-        fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
+        const stateDir = path.dirname(statePath);
+        fs.mkdirSync(stateDir, { recursive: true });
+        // Atomic write: stage to a unique temp file in the same directory, then
+        // rename(2) over the target (atomic on POSIX). A crash mid-write can never
+        // leave a truncated update-state.json — a reader sees either the old or the
+        // new content, never a half-written mix.
+        const tmpPath = `${statePath}.tmp-${process.pid}-${Date.now()}`;
+        let fd;
+        try {
+            fd = fs.openSync(tmpPath, 'w');
+            fs.writeFileSync(fd, JSON.stringify(state, null, 2));
+            fs.fsyncSync(fd);
+            fs.closeSync(fd);
+            fd = undefined;
+            fs.renameSync(tmpPath, statePath);
+            this.fsyncDir(stateDir);
+        }
+        catch (err) {
+            if (fd !== undefined) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { }
+            }
+            try {
+                fs.unlinkSync(tmpPath);
+            }
+            catch { }
+            throw err;
+        }
+    }
+    fsyncDir(dir) {
+        if (process.platform === 'win32')
+            return;
+        const fd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
     }
     // --- HTTP helpers ---
+    isRedirect(statusCode) {
+        return statusCode === 301 || statusCode === 302 || statusCode === 307 || statusCode === 308;
+    }
+    resolveRedirectUrl(location, fromUrl) {
+        return new URL(location, fromUrl).toString();
+    }
     httpGet(url, maxRedirects = 5) {
         return new Promise((resolve, reject) => {
             const mod = url.startsWith('https') ? https : http;
             const req = mod.get(url, (res) => {
-                if (res.statusCode === 301 || res.statusCode === 302) {
+                if (this.isRedirect(res.statusCode)) {
                     if (res.headers.location && maxRedirects > 0) {
-                        this.httpGet(res.headers.location, maxRedirects - 1).then(resolve, reject);
+                        let redirectUrl;
+                        try {
+                            redirectUrl = this.resolveRedirectUrl(res.headers.location, url);
+                        }
+                        catch (err) {
+                            res.resume();
+                            reject(new Error(`invalid redirect location for ${url}: ${String(err)}`));
+                            return;
+                        }
+                        res.resume();
+                        this.httpGet(redirectUrl, maxRedirects - 1).then(resolve, reject);
                         return;
                     }
                     res.resume();
@@ -387,9 +486,19 @@ export class DaemonUpdater {
         return new Promise((resolve, reject) => {
             const mod = url.startsWith('https') ? https : http;
             const req = mod.get(url, (res) => {
-                if (res.statusCode === 301 || res.statusCode === 302) {
+                if (this.isRedirect(res.statusCode)) {
                     if (res.headers.location && maxRedirects > 0) {
-                        this.downloadFile(res.headers.location, dest, maxRedirects - 1).then(resolve, reject);
+                        let redirectUrl;
+                        try {
+                            redirectUrl = this.resolveRedirectUrl(res.headers.location, url);
+                        }
+                        catch (err) {
+                            res.resume();
+                            reject(new Error(`invalid redirect location for ${url}: ${String(err)}`));
+                            return;
+                        }
+                        res.resume();
+                        this.downloadFile(redirectUrl, dest, maxRedirects - 1).then(resolve, reject);
                         return;
                     }
                     res.resume();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/daemon",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "Parall local agent runtime — daemon supervisor + bridge runtimes, bundled as standalone JS files",
   "license": "MIT",
   "repository": {
@@ -32,11 +32,11 @@
   "dependencies": {
     "@aws-sdk/client-s3": "3.984.0",
     "@pinixai/bb-browser-pro": "0.15.0",
-    "@parall/sdk": "1.36.0",
-    "@parall/claude-agent": "1.36.0",
-    "@parall/openclaw-agent": "1.36.0",
-    "@parall/agent-core": "1.36.0",
-    "@parall/codex-agent": "1.36.0"
+    "@parall/agent-core": "1.37.0",
+    "@parall/sdk": "1.37.0",
+    "@parall/claude-agent": "1.37.0",
+    "@parall/codex-agent": "1.37.0",
+    "@parall/openclaw-agent": "1.37.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",