@remodex/rmx 1.0.3 → 1.0.4

package/src/codex/inject.ts

@@ -778,6 +778,8 @@ export function chooseCatalogPathForInjection(
 
 export interface CodexInjectResult {
   success: boolean;
+  /** Whether plain Codex routing in the main config.toml is owned by Remodex. */
+  routingApplied?: boolean;
   message: string;
   status?: "skipped";
   skippedReason?: "desired_disabled" | "desired_enabled";
@@ -842,6 +844,7 @@ export async function injectCodexConfig(
     if (!shouldSyncCodexOnStart(loadConfig())) {
       return {
         success: true,
+        routingApplied: false,
         status: "skipped",
         skippedReason: "desired_disabled",
         message: "Codex integration is OFF; no Codex config, catalog, cache, or history was changed.",
@@ -868,10 +871,12 @@ export async function injectCodexConfig(
       : undefined;
     return {
       success: true,
+      routingApplied: false,
       ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
       message:
         `${adoptedProviderMessage}` +
         `Codex config preserved byte-for-byte with external model_provider ${tomlString(activeProvider)}.\n` +
+        `  This is why the main ${CODEX_CONFIG_PATH} did not change.\n` +
         `  Remodex Codex profile: ${CODEX_PROFILE_PATH} (codex --profile opencodex)\n` +
         (profileCatalogPath
           ? `  Codex model catalog: ${profileCatalogPath}\n`
@@ -1267,6 +1272,7 @@ export async function injectCodexConfig(
   if (keptUserBaseUrl) {
     return {
       success: true,
+      routingApplied: false,
       ...(nativeSubagentDefaultsWarning
         ? { nativeSubagentDefaultsWarning }
         : {}),
@@ -1275,7 +1281,7 @@ export async function injectCodexConfig(
         catalogMessage +
         historyMessage +
         managedDefaultsMessage +
-        `  To route plain codex through the proxy, remove your openai_base_url line from ~/.codex/config.toml and rerun 'rmx start'.\n` +
+        `  To route plain codex through the proxy, remove your openai_base_url line from ${CODEX_CONFIG_PATH} and rerun 'rmx sync'.\n` +
         `  Reference config: ${CODEX_PROFILE_PATH}`,
     };
   }
@@ -1284,6 +1290,7 @@ export async function injectCodexConfig(
     : `Pointed Codex's built-in openai provider at the Remodex proxy (openai_base_url).\n`;
   return {
     success: true,
+    routingApplied: true,
     ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
     message:
       headline +

package/src/codex/sync.ts

@@ -25,6 +25,8 @@ export interface CodexSyncResult {
   catalogExists: boolean;
   catalogWritten: boolean;
   cacheSynced: boolean;
+  /** Whether plain Codex routing in config.toml is owned by Remodex. */
+  routingApplied?: boolean;
   message: string;
   warning?: string;
   comboOmissions?: ComboCatalogOmission[];
@@ -226,6 +228,7 @@ export async function syncModelsToCodex(
     catalogExists,
     catalogWritten,
     cacheSynced,
+    ...(result.routingApplied !== undefined ? { routingApplied: result.routingApplied } : {}),
     message: result.message,
     ...(warning ? { warning } : {}),
     ...(comboOmissions.length > 0 ? { comboOmissions } : {}),

package/src/server/management/android-remote-routes.ts

@@ -134,7 +134,7 @@ async function statusDTO(
     ? await controller.cloudflareConfiguration()
     : {
         mode: state.settings.tunnelMode,
-        ...(state.settings.namedTunnelHostname
+        ...(state.settings.tunnelMode === "named" && state.settings.namedTunnelHostname
           ? { namedHostname: state.settings.namedTunnelHostname }
           : {}),
         hasNamedTunnelToken: false,

package/src/server/management/config-routes.ts

@@ -377,86 +377,6 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     return jsonResponse({ ok: true, job });
   }
 
-  /**
-   * Native desktop releases are deliberately separate from the npm runtime
-   * updater above.  The manifest/check/download state is shared with the
-   * Tauri tray through `desktop-update.json`; a normal browser can inspect it
-   * and check GitHub. Installer launch never crosses this management route;
-   * only the exact-origin Tauri bridge can request it.
-   */
-  if (url.pathname === "/api/desktop-update/check" && req.method === "GET") {
-    const checkDesktopReleaseUpdate = deps.checkDesktopReleaseUpdate
-      ?? (await import("../../update/desktop-release")).checkDesktopReleaseUpdate;
-    const rawChannel = url.searchParams.get("channel");
-    if (rawChannel && rawChannel !== "latest" && rawChannel !== "preview") {
-      return jsonResponse({ error: "channel must be latest or preview" }, 400, req, config);
-    }
-    return jsonResponse(
-      await checkDesktopReleaseUpdate(
-        rawChannel === "preview" ? "preview" : "latest",
-        // A management request is never proof that a verified native shell
-        // initiated it. Browser callers may check and download only; the
-        // Tauri bridge owns installation.
-        { desktopShell: () => false },
-      ),
-      200,
-      req,
-      config,
-    );
-  }
-
-  if (url.pathname === "/api/desktop-update/run" && req.method === "POST") {
-    const desktopRelease = await import("../../update/desktop-release");
-    const startDesktopUpdateJob = deps.startDesktopUpdateJob
-      ?? desktopRelease.startDesktopUpdateJob;
-    let body: unknown;
-    try {
-      body = await readManagementJsonBody(req);
-    } catch (error) {
-      rethrowManagementBodyTooLarge(error);
-      return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
-    }
-    if (!body || typeof body !== "object" || Array.isArray(body)) {
-      return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
-    }
-    const update = body as { channel?: unknown; install?: unknown };
-    if (update.channel !== undefined && update.channel !== "latest" && update.channel !== "preview") {
-      return jsonResponse({ error: "channel must be latest or preview" }, 400, req, config);
-    }
-    if (update.install !== undefined && typeof update.install !== "boolean") {
-      return jsonResponse({ error: "install boolean is required" }, 400, req, config);
-    }
-    if (update.install === true) {
-      return jsonResponse(
-        {
-          error: "Open the Remodex desktop application to install this update.",
-          code: "desktop_required",
-        },
-        409,
-        req,
-        config,
-      );
-    }
-    try {
-      const job = startDesktopUpdateJob(
-        update.channel === "preview" ? "preview" : "latest",
-        { install: false },
-      );
-      return jsonResponse({ ok: true, state: job }, 202, req, config);
-    } catch (error) {
-      if (error instanceof desktopRelease.DesktopUpdateError) {
-        return jsonResponse({ error: error.message, code: error.code }, error.status, req, config);
-      }
-      return jsonResponse({ error: "desktop update could not start", code: "download_failed" }, 500, req, config);
-    }
-  }
-
-  if (url.pathname === "/api/desktop-update/status" && req.method === "GET") {
-    const readDesktopUpdateState = deps.readDesktopUpdateState
-      ?? (await import("../../update/desktop-release")).readDesktopUpdateState;
-    return jsonResponse({ ok: true, state: readDesktopUpdateState() }, 200, req, config);
-  }
-
   if (url.pathname === "/api/sidecar-settings" && req.method === "GET") {
     const ws = config.webSearchSidecar ?? {};
     const vs = config.visionSidecar ?? {};

package/src/server/management/context.ts

@@ -12,10 +12,6 @@ import type { AndroidRemoteGatewayController } from "../../android-remote/gatewa
 import type { AndroidRemoteCloudflareProvisioner } from "../../android-remote/cloudflare-provisioning";
 
 export interface ManagementApiDeps {
-  /** Native desktop-update seams keep route tests off the network and real owner state. */
-  checkDesktopReleaseUpdate?: typeof import("../../update/desktop-release").checkDesktopReleaseUpdate;
-  startDesktopUpdateJob?: typeof import("../../update/desktop-release").startDesktopUpdateJob;
-  readDesktopUpdateState?: typeof import("../../update/desktop-release").readDesktopUpdateState;
   /** Android Remote persistence seam. Tests inject an in-memory store. */
   androidRemoteStore?: AndroidRemoteStore;
   /** Shared Android Remote gateway. Production and management routes use one controller. */

package/src/tray/windows-tray.ps1

@@ -109,7 +109,7 @@ function Start-OcxCommand([string[]]$CommandArgs, [switch]$TrackExit) {
     return $true
   } catch {
     Write-ActionLog "launch failed: $($_.Exception.GetType().Name)"
-    $notify.ShowBalloonTip(5000, "Remodex action failed", "The action could not start. Open the logs folder or run rmx doctor.", [System.Windows.Forms.ToolTipIcon]::Error)
+    $notify.ShowBalloonTip(5000, "Remodex action failed", "The action could not start. Run rmx doctor for details.", [System.Windows.Forms.ToolTipIcon]::Error)
     return $false
   }
 }
@@ -152,20 +152,27 @@ function Read-JsonUrl([string]$Url) {
 
 $notify = New-Object System.Windows.Forms.NotifyIcon
 $menu = New-Object System.Windows.Forms.ContextMenuStrip
-$statusItem = New-Object System.Windows.Forms.ToolStripMenuItem
-$statusItem.Enabled = $false
-$safetyItem = New-Object System.Windows.Forms.ToolStripMenuItem
-$safetyItem.Enabled = $false
-$openItem = $menu.Items.Add("Open Dashboard")
-$startItem = $menu.Items.Add("Start Proxy")
-$stopItem = $menu.Items.Add("Stop Proxy and Restore Native Routing")
-$restartItem = $menu.Items.Add("Restart Proxy")
+$statusItem = $menu.Items.Add("🔴 Offline · Refresh")
+$openItem = $menu.Items.Add("Open dashboard")
 [void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
-[void]$menu.Items.Add($statusItem)
-[void]$menu.Items.Add($safetyItem)
-$logsItem = $menu.Items.Add("Open Logs Folder")
+$proxyLifecycleItem = $menu.Items.Add("Start Proxy")
+$applyChangesItem = $menu.Items.Add("Apply Changes")
+$restartCodexItem = $menu.Items.Add("Restart Codex")
+$restartRemodexItem = $menu.Items.Add("Restart Remodex")
 [void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
-$exitItem = $menu.Items.Add("Exit Tray")
+$restartDesktopItem = $menu.Items.Add("Restart desktop application (advanced)…")
+$checkUpdateItem = $menu.Items.Add("Check package updates")
+[void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
+$exitItem = $menu.Items.Add("Quit desktop shell")
+
+$actionItems = @(
+  $proxyLifecycleItem,
+  $applyChangesItem,
+  $restartCodexItem,
+  $restartRemodexItem,
+  $restartDesktopItem,
+  $checkUpdateItem
+)
 
 $script:online = $false
 $script:port = 10100
@@ -175,8 +182,29 @@ $script:pendingStarted = 0L
 $script:pendingDeadline = 0L
 $script:pendingOldProxyPid = $null
 $script:pendingProcess = $null
+$script:pendingExpectation = $null
+$script:pendingItem = $null
+
+function Reset-ActionLabels {
+  $proxyLifecycleItem.Text = if ($script:online) { "Stop Proxy" } else { "Start Proxy" }
+  $applyChangesItem.Text = "Apply Changes"
+  $restartCodexItem.Text = "Restart Codex"
+  $restartRemodexItem.Text = "Restart Remodex"
+  $restartDesktopItem.Text = "Restart desktop application (advanced)…"
+  $checkUpdateItem.Text = "Check package updates"
+}
+
+function Update-ActionAvailability {
+  $busy = $null -ne $script:pendingAction
+  foreach ($item in $actionItems) { $item.Enabled = -not $busy }
+}
 
-function Set-PendingAction([string]$Action, [int]$TimeoutSeconds) {
+function Set-PendingAction(
+  [string]$Action,
+  [int]$TimeoutSeconds,
+  [ValidateSet("online", "offline", "restarted", "process")][string]$Expectation,
+  [System.Windows.Forms.ToolStripMenuItem]$Item
+) {
   if ($null -ne $script:pendingAction) {
     Write-ActionLog "$Action ignored because $($script:pendingAction) is still pending"
     return $false
@@ -193,6 +221,9 @@ function Set-PendingAction([string]$Action, [int]$TimeoutSeconds) {
   $script:pendingStarted = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
   $script:pendingDeadline = $script:pendingStarted + ($TimeoutSeconds * 1000)
   $script:pendingOldProxyPid = $script:proxyPid
+  $script:pendingExpectation = $Expectation
+  $script:pendingItem = $Item
+  Update-ActionAvailability
   return $true
 }
 
@@ -200,6 +231,8 @@ function Complete-PendingAction([bool]$Success) {
   if ($null -eq $script:pendingAction) { return }
   $action = $script:pendingAction
   $script:pendingAction = $null
+  $script:pendingExpectation = $null
+  $script:pendingItem = $null
   if ($null -ne $script:pendingProcess) {
     try {
       $script:pendingProcess.Dispose()
@@ -213,7 +246,29 @@ function Complete-PendingAction([bool]$Success) {
     $notify.ShowBalloonTip(2500, "Remodex", "$action completed.", [System.Windows.Forms.ToolTipIcon]::Info)
   } else {
     Write-ActionLog "$action failed to reach the expected state"
-    $notify.ShowBalloonTip(5000, "Remodex action failed", "$action did not reach the expected state. Open the logs folder or run rmx doctor.", [System.Windows.Forms.ToolTipIcon]::Error)
+    $notify.ShowBalloonTip(5000, "Remodex action failed", "$action did not reach the expected state. Run rmx doctor for details.", [System.Windows.Forms.ToolTipIcon]::Error)
+  }
+  Reset-ActionLabels
+  Update-ActionAvailability
+}
+
+function Start-PendingCommand(
+  [string]$Action,
+  [string]$ProgressLabel,
+  [string[]]$CommandArgs,
+  [int]$TimeoutSeconds,
+  [ValidateSet("online", "offline", "restarted", "process")][string]$Expectation,
+  [System.Windows.Forms.ToolStripMenuItem]$Item
+) {
+  if (-not (Set-PendingAction -Action $Action -TimeoutSeconds $TimeoutSeconds -Expectation $Expectation -Item $Item)) {
+    return
+  }
+  $Item.Text = $ProgressLabel
+  $pending = Start-OcxCommand $CommandArgs -TrackExit
+  if ($pending -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $pending
+  } else {
+    Complete-PendingAction $false
   }
 }
 
@@ -226,34 +281,27 @@ function Update-TrayState {
   $pidMatches = $null -eq $target.pid -or [int]$target.pid -eq [int]$health.pid
   $script:online = $null -ne $health -and $health.status -eq "ok" -and $health.service -eq "opencodex" -and [int]$health.port -eq $script:port -and $pidMatches
   $script:proxyPid = if ($script:online) { [int]$health.pid } else { $null }
+  $degraded = $false
   if ($script:online) {
-    $statusItem.Text = "Proxy: Online (port $($script:port))"
     $notify.Text = "Remodex: Online"
-    $startItem.Enabled = $false
-    $stopItem.Enabled = $true
-    $restartItem.Enabled = $true
     try {
       $startup = Read-JsonUrl "$origin/api/startup-health"
-      $label = if ($startup.status -eq "at-risk") { "At risk" } elseif ($startup.status -eq "protected") { "Protected" } else { "Native routing" }
-      $safetyItem.Text = "Restart safety: $label"
-      $notify.Icon = if ($startup.status -eq "at-risk") { $warningIcon } else { $onlineIcon }
+      $degraded = $startup.status -eq "at-risk"
+      $notify.Icon = if ($degraded) { $warningIcon } else { $onlineIcon }
     } catch {
-      $safetyItem.Text = "Restart safety: unavailable"
+      $degraded = $true
       $notify.Icon = $warningIcon
     }
+    $dot = if ($degraded) { "🟠" } else { "🟢" }
+    $label = if ($degraded) { "Degraded" } else { "Ready" }
+    $statusItem.Text = "$dot $label · port $($script:port) · PID $($script:proxyPid) · Refresh"
   } else {
-    $statusItem.Text = "Proxy: Offline"
-    $safetyItem.Text = "Restart safety: start the proxy to inspect"
+    $statusItem.Text = "🔴 Offline · Refresh"
     $notify.Text = "Remodex: Offline"
     $notify.Icon = $offlineIcon
-    $startItem.Enabled = $true
-    $stopItem.Enabled = $false
-    $restartItem.Enabled = $false
   }
   if ($null -ne $script:pendingAction) {
-    $startItem.Enabled = $false
-    $stopItem.Enabled = $false
-    $restartItem.Enabled = $false
+    $statusItem.Text = "🟡 $($script:pendingAction)…"
   }
   $heartbeat = @{ pid = $PID; timestamp = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() }
   if ($HostPid -gt 0) { $heartbeat.hostPid = $HostPid }
@@ -263,13 +311,15 @@ function Update-TrayState {
   if ($null -ne $script:pendingAction) {
     $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
     $elapsed = $now - $script:pendingStarted
-    $reached = ($script:pendingAction -eq "Start Proxy" -and $script:online) -or
-      ($script:pendingAction -eq "Stop Proxy" -and -not $script:online) -or
-      ($script:pendingAction -eq "Restart Proxy" -and $elapsed -gt 3000 -and $script:online -and $script:proxyPid -ne $script:pendingOldProxyPid)
+    $reached = ($script:pendingExpectation -eq "online" -and $script:online) -or
+      ($script:pendingExpectation -eq "offline" -and -not $script:online) -or
+      ($script:pendingExpectation -eq "restarted" -and $elapsed -gt 3000 -and $script:online -and $script:proxyPid -ne $script:pendingOldProxyPid)
     $commandFailed = $false
+    $commandComplete = $false
     if ($null -ne $script:pendingProcess) {
       try {
-        $commandFailed = $script:pendingProcess.HasExited -and $script:pendingProcess.ExitCode -ne 0
+        $commandComplete = $script:pendingProcess.HasExited
+        $commandFailed = $commandComplete -and $script:pendingProcess.ExitCode -ne 0
       } catch {
         Write-ActionLog "pending process result inspection failed: $($_.Exception.GetType().Name)"
         # If we cannot inspect the tracked command, we cannot prove it is still
@@ -279,52 +329,45 @@ function Update-TrayState {
       }
     }
     if ($commandFailed) { Complete-PendingAction $false }
+    elseif ($script:pendingExpectation -eq "process" -and $commandComplete) { Complete-PendingAction $true }
     elseif ($reached) { Complete-PendingAction $true }
     elseif ($now -gt $script:pendingDeadline) { Complete-PendingAction $false }
   }
+  if ($null -eq $script:pendingAction) { Reset-ActionLabels }
+  Update-ActionAvailability
 }
 
 $openItem.add_Click({ Start-OcxCommand @("gui") })
-$startItem.add_Click({
-  if (-not (Set-PendingAction "Start Proxy" 75)) { return }
-  $statusItem.Text = "Proxy: Starting..."
-  # service start can spend 20s and the CLI then observes health for another 40s.
-  $startProcess = Start-OcxCommand @("__tray-start") -TrackExit
-  if ($startProcess -is [System.Diagnostics.Process]) {
-    $script:pendingProcess = $startProcess
-  } else {
-    Complete-PendingAction $false
-  }
+$statusItem.add_Click({
+  $statusItem.Text = "↻ Checking runtime…"
+  Update-TrayState
 })
-$stopItem.add_Click({
-  if (-not (Set-PendingAction "Stop Proxy" 15)) { return }
-  $statusItem.Text = "Proxy: Stopping..."
-  $stopProcess = Start-OcxCommand @("stop") -TrackExit
-  if ($stopProcess -is [System.Diagnostics.Process]) {
-    $script:pendingProcess = $stopProcess
+$proxyLifecycleItem.add_Click({
+  if ($script:online) {
+    Start-PendingCommand -Action "Stop Proxy" -ProgressLabel "Stopping Proxy…" -CommandArgs @("stop") -TimeoutSeconds 20 -Expectation "offline" -Item $proxyLifecycleItem
   } else {
-    Complete-PendingAction $false
+    # service start can spend 20s and the CLI then observes health for another 40s.
+    Start-PendingCommand -Action "Start Proxy" -ProgressLabel "Starting Proxy…" -CommandArgs @("__tray-start") -TimeoutSeconds 75 -Expectation "online" -Item $proxyLifecycleItem
   }
 })
-$restartItem.add_Click({
-  if (-not (Set-PendingAction "Restart Proxy" 160)) { return }
-  $statusItem.Text = "Proxy: Restarting..."
+$applyChangesItem.add_Click({
+  Start-PendingCommand -Action "Apply Changes" -ProgressLabel "Applying changes…" -CommandArgs @("sync") -TimeoutSeconds 180 -Expectation "process" -Item $applyChangesItem
+})
+$restartCodexItem.add_Click({
+  Start-PendingCommand -Action "Restart Codex" -ProgressLabel "Restarting Codex…" -CommandArgs @("__desktop-restart-codex") -TimeoutSeconds 60 -Expectation "process" -Item $restartCodexItem
+})
+$restartRemodexItem.add_Click({
   # /api/system/restart may drain active work for 60s and then spend up to 70s
   # handing off to an identity-verified replacement. The tray observes health/PID
   # rather than the detached CLI exit, so keep a watchdog margin around that shared
   # lifecycle budget. The CLI remains the lifecycle owner; the tray never kills.
-  $restartProcess = Start-OcxCommand @("__tray-restart") -TrackExit
-  if ($restartProcess -is [System.Diagnostics.Process]) {
-    $script:pendingProcess = $restartProcess
-  } else {
-    Complete-PendingAction $false
-  }
+  Start-PendingCommand -Action "Restart Remodex" -ProgressLabel "Restarting Remodex…" -CommandArgs @("__tray-restart") -TimeoutSeconds 160 -Expectation "restarted" -Item $restartRemodexItem
+})
+$restartDesktopItem.add_Click({
+  Start-PendingCommand -Action "Restart desktop application" -ProgressLabel "Restarting desktop application…" -CommandArgs @("__desktop-restart-client") -TimeoutSeconds 60 -Expectation "process" -Item $restartDesktopItem
 })
-$logsItem.add_Click({
-  $psi = New-Object System.Diagnostics.ProcessStartInfo
-  $psi.FileName = $OpenCodexHome
-  $psi.UseShellExecute = $true
-  [void][System.Diagnostics.Process]::Start($psi)
+$checkUpdateItem.add_Click({
+  Start-PendingCommand -Action "Open package updater" -ProgressLabel "Opening package updater…" -CommandArgs @("gui", "--update") -TimeoutSeconds 90 -Expectation "process" -Item $checkUpdateItem
 })
 $exitItem.add_Click({ [System.Windows.Forms.Application]::Exit() })
 $notify.add_DoubleClick({ Start-OcxCommand @("gui") })

package/src/tray/windows.ts

@@ -647,7 +647,13 @@ export function installWindowsTray(startNow = true): WindowsTrayStatus {
   try {
     const hardenedDir = hardenSecretDir(getConfigDir(), { required: true });
     if (!hardenedDir.ok) throw new Error("Windows tray directory ACL hardening did not complete; refusing to install persistence.");
-    replaceWindowsTrayOwnedFile(entry.script, readFileSync(sourceScript));
+    // Windows PowerShell 5.1 treats a BOM-less script as the active ANSI code
+    // page. The parity menu deliberately uses the same Unicode status dots and
+    // ellipsis as the desktop shell, so install the trusted source as UTF-8 BOM.
+    replaceWindowsTrayOwnedFile(
+      entry.script,
+      Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), readFileSync(sourceScript)]),
+    );
     for (const pair of iconPairs) replaceWindowsTrayOwnedFile(pair.installed, readFileSync(pair.source));
     replaceWindowsTrayOwnedFile(launcherPath, Buffer.from("\uFEFF" + buildWindowsTrayLauncherScript(entry), "utf16le"));
     runRegistry(["add", RUN_KEY, "/v", runValue, "/t", "REG_SZ", "/d", runCommand, "/f", "/reg:64"]);

package/src/update/job.ts

@@ -43,7 +43,7 @@ import {
   type NpmCachePreflightReason,
 } from "./npm-cache-preflight.mjs";
 
-const RELEASE_NOTES_URL = "https://github.com/ESCANOR-001/remodex-android/releases/latest";
+const RELEASES_URL = "https://github.com/ESCANOR-001/remodex-android/releases";
 const UPDATE_JOB_FILENAME = "update-job.json";
 const UPDATE_TIMEOUT_MS = 180_000;
 const RESTART_TIMEOUT_MS = 60_000;
@@ -65,6 +65,8 @@ export interface UpdateCheckResult {
   canUpdate: boolean;
   command: string;
   releaseNotesUrl: string;
+  /** Local time recorded after this exact runtime version was installed. */
+  lastInstalledAt?: string;
   reason?: string;
 }
 
@@ -81,6 +83,10 @@ export interface UpdateJobState {
   command: string;
   releaseNotesUrl: string;
   log: string[];
+  /** Exact package version whose installer completed successfully. */
+  installedVersion?: string;
+  /** Local installation event, persisted as an ISO-8601 timestamp. */
+  installedAt?: string;
   pid?: number;
   error?: string;
   exitCode?: number | null;
@@ -98,6 +104,7 @@ export interface UpdateCheckDeps {
   currentVersion: () => string;
   detectInstall: () => Installer;
   latestVersion: (tag: Channel) => string | null;
+  readUpdateJob?: () => UpdateJobState | null;
 }
 
 interface UpdateWorkerProcess {
@@ -280,6 +287,27 @@ function isVersionLike(value: unknown): value is string {
     && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(value);
 }
 
+/** Only timestamps written by this updater may cross the management API boundary. */
+function normalizedUpdateTimestamp(value: unknown): string | null {
+  if (typeof value !== "string" || value.length > 40) return null;
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed)) return null;
+  const canonical = new Date(parsed).toISOString();
+  return canonical === value ? canonical : null;
+}
+
+function releaseNotesUrlForVersion(version: unknown): string {
+  return isVersionLike(version)
+    ? `${RELEASES_URL}/tag/v${version}`
+    : RELEASES_URL;
+}
+
+function isTrustedReleaseNotesUrl(value: unknown): value is string {
+  if (value === RELEASES_URL) return true;
+  if (typeof value !== "string" || !value.startsWith(`${RELEASES_URL}/tag/v`)) return false;
+  return releaseNotesUrlForVersion(value.slice(`${RELEASES_URL}/tag/v`.length)) === value;
+}
+
 function withheldSummary(error: unknown): string {
   // `error.name` is writable, so it is external text like the message. A fixed classification
   // is the only part of an unknown error we can state without repeating something we were
@@ -319,7 +347,7 @@ function withheldSummary(error: unknown): string {
  */
 function brandOwnComposedText(key: string, value: unknown): unknown {
   if (key === "releaseNotesUrl") {
-    return value === RELEASE_NOTES_URL ? value : "";
+    return isTrustedReleaseNotesUrl(value) ? value : "";
   }
   if (key === "command") {
     // Render the command shape first, then apply the same path test as every other field. The
@@ -412,6 +440,11 @@ export function readUpdateJob(jobId?: string | null): UpdateJobState | null {
     const parsed = JSON.parse(readFileSync(updateJobPath(), "utf8")) as UpdateJobState;
     if (jobId && parsed.id !== jobId) return null;
     if (!parsed || typeof parsed.id !== "string" || typeof parsed.status !== "string") return null;
+    if (parsed.installedAt !== undefined) {
+      const installedAt = normalizedUpdateTimestamp(parsed.installedAt);
+      if (installedAt) parsed.installedAt = installedAt;
+      else delete parsed.installedAt;
+    }
     return parsed;
   } catch {
     return null;
@@ -511,6 +544,12 @@ export function checkForUpdate(
     reason = "already_latest";
   }
 
+  const previousJob = (deps.readUpdateJob ?? readUpdateJob)();
+  const installedVersion = previousJob?.installedVersion ?? previousJob?.latestVersion;
+  const lastInstalledAt = installedVersion === current
+    ? normalizedUpdateTimestamp(previousJob?.installedAt)
+    : null;
+
   return {
     currentVersion: current,
     latestVersion: latest,
@@ -519,7 +558,8 @@ export function checkForUpdate(
     updateAvailable,
     canUpdate: installer !== "source" && updateAvailable,
     command,
-    releaseNotesUrl: RELEASE_NOTES_URL,
+    releaseNotesUrl: releaseNotesUrlForVersion(latest ?? current),
+    ...(lastInstalledAt ? { lastInstalledAt } : {}),
     ...(reason ? { reason } : {}),
   };
 }
@@ -1745,6 +1785,8 @@ export interface GuiUpdateWorkerIo {
   checkForUpdateFn?: (channel: Channel) => ReturnType<typeof checkForUpdate>;
   /** Bypass the registry integrity probe, which runs before the cache gate and needs network. */
   integrityFn?: (version: string | null) => ReturnType<typeof checkUpdatePackageIntegrity>;
+  /** Clock seam for deterministic install-event records in tests. */
+  now?: () => string;
   /**
    * Immutable target selected by a caller that already resolved a registry version.
    * npm uses the hidden Node-launcher path so the package manager cannot re-resolve a
@@ -1767,7 +1809,7 @@ export async function runGuiUpdateWorker(
 ): Promise<void> {
   let job = readUpdateJob(jobId);
   const check = (io.checkForUpdateFn ?? checkForUpdate)(channel);
-  const now = new Date().toISOString();
+  const now = io.now ?? (() => new Date().toISOString());
   // Capture the live listen target BEFORE the update command runs: the stop-first update
   // flow clears pid/runtime state, so this is the last moment the real port is knowable.
   // Only trust runtime-port.json when its pid matches the live pidfile process.
@@ -1789,8 +1831,8 @@ export async function runGuiUpdateWorker(
     job = {
       id: jobId,
       status: "running",
-      startedAt: now,
-      updatedAt: now,
+      startedAt: now(),
+      updatedAt: now(),
       currentVersion: check.currentVersion,
       latestVersion: check.latestVersion,
       channel: check.channel,
@@ -1885,6 +1927,12 @@ export async function runGuiUpdateWorker(
       return;
     }
 
+    const installedVersion = io.exactVersion ?? check.latestVersion;
+    job = updateJob(job, {
+      ...(installedVersion ? { installedVersion } : {}),
+      installedAt: now(),
+    }, `Package ${installedVersion ?? "update"} installed successfully.`);
+
     if (trayWasInstalled) {
       const trayArgs = [process.argv[1], ...planWindowsTrayUpdate({ installed: trayWasInstalled, running: trayWasRunning }).installArgs];
       const tray = runLoggedCommand(job, process.execPath, trayArgs, 20_000);

package/src/update/notify.ts

@@ -16,7 +16,7 @@ import {
 
 const VERSION_FILENAME = "version.json";
 const REFRESH_INTERVAL_MS = 20 * 60 * 60 * 1000; // 20h, matching codex-rs
-const RELEASE_NOTES_URL = "https://github.com/ESCANOR-001/remodex-android/releases/latest";
+const RELEASES_URL = "https://github.com/ESCANOR-001/remodex-android/releases";
 
 export interface VersionCache {
   latest_version: string;
@@ -210,7 +210,7 @@ function renderPrompt(current: string, latest: string, channel: Channel): string
     "",
     `  \x1b[38;5;141m✨ Update available!\x1b[0m  \x1b[2m${current} -> ${latest}\x1b[0m`,
     "",
-    `  \x1b[2mRelease notes:\x1b[0m ${RELEASE_NOTES_URL}`,
+    `  \x1b[2mRelease notes:\x1b[0m ${RELEASES_URL}/tag/v${latest}`,
     "",
     `  1) Update now (runs \`${command}\`)`,
     "  2) Skip",