@remodex/rmx 1.0.2 → 1.0.4

package/src/update/job.ts

@@ -43,7 +43,7 @@ import {
   type NpmCachePreflightReason,
 } from "./npm-cache-preflight.mjs";
 
-const RELEASE_NOTES_URL = "https://github.com/ESCANOR-001/remodex-android/releases/latest";
+const RELEASES_URL = "https://github.com/ESCANOR-001/remodex-android/releases";
 const UPDATE_JOB_FILENAME = "update-job.json";
 const UPDATE_TIMEOUT_MS = 180_000;
 const RESTART_TIMEOUT_MS = 60_000;
@@ -65,6 +65,8 @@ export interface UpdateCheckResult {
   canUpdate: boolean;
   command: string;
   releaseNotesUrl: string;
+  /** Local time recorded after this exact runtime version was installed. */
+  lastInstalledAt?: string;
   reason?: string;
 }
 
@@ -81,6 +83,10 @@ export interface UpdateJobState {
   command: string;
   releaseNotesUrl: string;
   log: string[];
+  /** Exact package version whose installer completed successfully. */
+  installedVersion?: string;
+  /** Local installation event, persisted as an ISO-8601 timestamp. */
+  installedAt?: string;
   pid?: number;
   error?: string;
   exitCode?: number | null;
@@ -98,6 +104,7 @@ export interface UpdateCheckDeps {
   currentVersion: () => string;
   detectInstall: () => Installer;
   latestVersion: (tag: Channel) => string | null;
+  readUpdateJob?: () => UpdateJobState | null;
 }
 
 interface UpdateWorkerProcess {
@@ -212,7 +219,7 @@ async function waitForGhostListenClear(
   return { ok: false, accessDenied };
 }
 
-function packageLauncherPath(): string {
+export function packageLauncherPath(): string {
   // This module lives at src/update/job.ts — the launcher is <pkg-root>/bin/ocx.mjs.
   // After `npm install -g`, import.meta.url can still point at npm's renamed temp
   // tree (`@remodex/.rmx-*` or the legacy `@bitkyc08/.opencodex-*`). Prefer the
@@ -280,6 +287,27 @@ function isVersionLike(value: unknown): value is string {
     && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(value);
 }
 
+/** Only timestamps written by this updater may cross the management API boundary. */
+function normalizedUpdateTimestamp(value: unknown): string | null {
+  if (typeof value !== "string" || value.length > 40) return null;
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed)) return null;
+  const canonical = new Date(parsed).toISOString();
+  return canonical === value ? canonical : null;
+}
+
+function releaseNotesUrlForVersion(version: unknown): string {
+  return isVersionLike(version)
+    ? `${RELEASES_URL}/tag/v${version}`
+    : RELEASES_URL;
+}
+
+function isTrustedReleaseNotesUrl(value: unknown): value is string {
+  if (value === RELEASES_URL) return true;
+  if (typeof value !== "string" || !value.startsWith(`${RELEASES_URL}/tag/v`)) return false;
+  return releaseNotesUrlForVersion(value.slice(`${RELEASES_URL}/tag/v`.length)) === value;
+}
+
 function withheldSummary(error: unknown): string {
   // `error.name` is writable, so it is external text like the message. A fixed classification
   // is the only part of an unknown error we can state without repeating something we were
@@ -319,7 +347,7 @@ function withheldSummary(error: unknown): string {
  */
 function brandOwnComposedText(key: string, value: unknown): unknown {
   if (key === "releaseNotesUrl") {
-    return value === RELEASE_NOTES_URL ? value : "";
+    return isTrustedReleaseNotesUrl(value) ? value : "";
   }
   if (key === "command") {
     // Render the command shape first, then apply the same path test as every other field. The
@@ -374,8 +402,8 @@ function renderSafeCommand(value: string): string {
       part === "$" || part === "<path>"
       || /^(?:npm|bun|pnpm|yarn|node)$/.test(part)
       || /^-{1,2}[\w-]+$/.test(part)
-      || /^(?:install|add|update|i)$/.test(part)
-      || /^opencodex(?:@[\w.\-]+)?$/.test(part)
+      || /^(?:install|add|update|i|__exact-update)$/.test(part)
+      || /^(?:@remodex\/rmx|opencodex)(?:@[\w.\-]+)?$/.test(part)
       || /^(?:latest|preview|next|beta)$/.test(part)
       || /^\d[\w.\-]*$/.test(part));
     if (allowed) return rendered.join(" ");
@@ -412,6 +440,11 @@ export function readUpdateJob(jobId?: string | null): UpdateJobState | null {
     const parsed = JSON.parse(readFileSync(updateJobPath(), "utf8")) as UpdateJobState;
     if (jobId && parsed.id !== jobId) return null;
     if (!parsed || typeof parsed.id !== "string" || typeof parsed.status !== "string") return null;
+    if (parsed.installedAt !== undefined) {
+      const installedAt = normalizedUpdateTimestamp(parsed.installedAt);
+      if (installedAt) parsed.installedAt = installedAt;
+      else delete parsed.installedAt;
+    }
     return parsed;
   } catch {
     return null;
@@ -445,9 +478,12 @@ export function updateExecutionCommand(
 ): { bin: string; args: string[]; display: string } {
   if (installer === "npm") {
     const bin = nodeBin();
-    const args = [launcher, "update", "--tag", channel];
-    // The Node launcher self-update re-resolves the tag at its own time — a residual
-    // divergence window this path cannot close (documented, not claimed immutable).
+    const args = resolvedVersion
+      ? [launcher, "__exact-update", resolvedVersion]
+      : [launcher, "update", "--tag", channel];
+    // A scheduled update passes a registry-resolved version through the hidden exact
+    // launcher path. Interactive/dashboard updates without a resolved target retain
+    // the historical tag-based launcher behavior.
     return { bin, args, display: formatCommand(bin, args) };
   }
   if (installer === "bun") {
@@ -508,6 +544,12 @@ export function checkForUpdate(
     reason = "already_latest";
   }
 
+  const previousJob = (deps.readUpdateJob ?? readUpdateJob)();
+  const installedVersion = previousJob?.installedVersion ?? previousJob?.latestVersion;
+  const lastInstalledAt = installedVersion === current
+    ? normalizedUpdateTimestamp(previousJob?.installedAt)
+    : null;
+
   return {
     currentVersion: current,
     latestVersion: latest,
@@ -516,7 +558,8 @@ export function checkForUpdate(
     updateAvailable,
     canUpdate: installer !== "source" && updateAvailable,
     command,
-    releaseNotesUrl: RELEASE_NOTES_URL,
+    releaseNotesUrl: releaseNotesUrlForVersion(latest ?? current),
+    ...(lastInstalledAt ? { lastInstalledAt } : {}),
     ...(reason ? { reason } : {}),
   };
 }
@@ -1742,6 +1785,14 @@ export interface GuiUpdateWorkerIo {
   checkForUpdateFn?: (channel: Channel) => ReturnType<typeof checkForUpdate>;
   /** Bypass the registry integrity probe, which runs before the cache gate and needs network. */
   integrityFn?: (version: string | null) => ReturnType<typeof checkUpdatePackageIntegrity>;
+  /** Clock seam for deterministic install-event records in tests. */
+  now?: () => string;
+  /**
+   * Immutable target selected by a caller that already resolved a registry version.
+   * npm uses the hidden Node-launcher path so the package manager cannot re-resolve a
+   * moving dist-tag between the check and install.
+   */
+  exactVersion?: string;
   runCommandFn?: (
     job: UpdateJobState,
     bin: string,
@@ -1758,7 +1809,7 @@ export async function runGuiUpdateWorker(
 ): Promise<void> {
   let job = readUpdateJob(jobId);
   const check = (io.checkForUpdateFn ?? checkForUpdate)(channel);
-  const now = new Date().toISOString();
+  const now = io.now ?? (() => new Date().toISOString());
   // Capture the live listen target BEFORE the update command runs: the stop-first update
   // flow clears pid/runtime state, so this is the last moment the real port is knowable.
   // Only trust runtime-port.json when its pid matches the live pidfile process.
@@ -1780,8 +1831,8 @@ export async function runGuiUpdateWorker(
     job = {
       id: jobId,
       status: "running",
-      startedAt: now,
-      updatedAt: now,
+      startedAt: now(),
+      updatedAt: now(),
       currentVersion: check.currentVersion,
       latestVersion: check.latestVersion,
       channel: check.channel,
@@ -1811,7 +1862,9 @@ export async function runGuiUpdateWorker(
       ? `Integrity pre-flight skipped: ${integrity.reason}. Proceeding best-effort.`
       : `Verified ${PKG}@${check.latestVersion} integrity metadata ${integrity.integrity.slice(0, 24)}…`;
 
-    const cmd = updateExecutionCommand(check.installer, channel, undefined, check.latestVersion);
+    const cmd = io.exactVersion === undefined
+      ? updateExecutionCommand(check.installer, channel, undefined, check.latestVersion)
+      : updateExecutionCommand(check.installer, channel, undefined, io.exactVersion);
     job = updateJob(job, {
       currentVersion: check.currentVersion,
       latestVersion: check.latestVersion,
@@ -1874,6 +1927,12 @@ export async function runGuiUpdateWorker(
       return;
     }
 
+    const installedVersion = io.exactVersion ?? check.latestVersion;
+    job = updateJob(job, {
+      ...(installedVersion ? { installedVersion } : {}),
+      installedAt: now(),
+    }, `Package ${installedVersion ?? "update"} installed successfully.`);
+
     if (trayWasInstalled) {
       const trayArgs = [process.argv[1], ...planWindowsTrayUpdate({ installed: trayWasInstalled, running: trayWasRunning }).installArgs];
       const tray = runLoggedCommand(job, process.execPath, trayArgs, 20_000);

package/src/update/notify.ts

@@ -16,7 +16,7 @@ import {
 
 const VERSION_FILENAME = "version.json";
 const REFRESH_INTERVAL_MS = 20 * 60 * 60 * 1000; // 20h, matching codex-rs
-const RELEASE_NOTES_URL = "https://github.com/ESCANOR-001/remodex-android/releases/latest";
+const RELEASES_URL = "https://github.com/ESCANOR-001/remodex-android/releases";
 
 export interface VersionCache {
   latest_version: string;
@@ -210,7 +210,7 @@ function renderPrompt(current: string, latest: string, channel: Channel): string
     "",
     `  \x1b[38;5;141m✨ Update available!\x1b[0m  \x1b[2m${current} -> ${latest}\x1b[0m`,
     "",
-    `  \x1b[2mRelease notes:\x1b[0m ${RELEASE_NOTES_URL}`,
+    `  \x1b[2mRelease notes:\x1b[0m ${RELEASES_URL}/tag/v${latest}`,
     "",
     `  1) Update now (runs \`${command}\`)`,
     "  2) Skip",