@roamcode.ai/server 1.0.0 → 1.0.2

package/dist/managed-update-helper.js

@@ -1,34 +1,639 @@
 #!/usr/bin/env node
-import { readFileSync, unlinkSync } from "node:fs";
-import { installManagedRelease, writeManagedStatus } from "./managed-runtime.js";
-async function main() {
-    const configPath = process.argv[2];
-    if (!configPath)
-        throw new Error("managed updater config path is required");
-    const config = JSON.parse(readFileSync(configPath, "utf8"));
+#!/usr/bin/env node
+
+// src/managed-update-helper.ts
+import { readFileSync as readFileSync3, unlinkSync as unlinkSync2 } from "fs";
+
+// src/managed-runtime.ts
+import { spawn } from "child_process";
+import { randomUUID } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  closeSync,
+  readdirSync,
+  readFileSync as readFileSync2,
+  realpathSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir as homedir2, tmpdir } from "os";
+import { basename, dirname as dirname2, join as join2, relative, resolve } from "path";
+
+// src/service-install.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir, platform } from "os";
+import { dirname, join } from "path";
+import { spawnSync } from "child_process";
+function escapeXml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function quoteSystemd(value) {
+  return /[\s\"\\]/.test(value) ? `"${value.replace(/\\/g, "\\\\").replace(/\"/g, '\\"')}"` : value;
+}
+function buildServicePath(nodePath, home) {
+  return [
+    dirname(nodePath),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    join(home, ".local", "bin"),
+    join(home, ".local", "share", "pnpm"),
+    join(home, "Library", "pnpm"),
+    "/usr/bin",
+    "/bin"
+  ].join(":");
+}
+function programArguments(opts) {
+  if (opts.executablePath) return [opts.executablePath];
+  if (opts.nodePath && opts.cliPath) return [opts.nodePath, opts.cliPath];
+  throw new Error("service requires executablePath or nodePath + cliPath");
+}
+function renderLaunchdPlist(opts) {
+  const args = programArguments(opts).map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n");
+  const pathEntry = opts.servicePath ? `
+    <key>PATH</key>
+    <string>${escapeXml(opts.servicePath)}</string>` : "";
+  const installEntry = opts.installRoot ? `
+    <key>ROAMCODE_INSTALL_ROOT</key>
+    <string>${escapeXml(opts.installRoot)}</string>` : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapeXml(opts.label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>ROAMCODE_DATA_DIR</key>
+    <string>${escapeXml(opts.dataDir)}</string>${installEntry}${pathEntry}
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(join(opts.dataDir, "roamcode.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(join(opts.dataDir, "roamcode.err.log"))}</string>
+</dict>
+</plist>
+`;
+}
+function renderSystemdUnit(opts) {
+  const command = programArguments(opts).map(quoteSystemd).join(" ");
+  const pathLine = opts.servicePath ? `
+Environment=PATH=${opts.servicePath}` : "";
+  const installLine = opts.installRoot ? `
+Environment=ROAMCODE_INSTALL_ROOT=${opts.installRoot}` : "";
+  return `[Unit]
+Description=roamcode \u2014 operate Claude Code or Codex sessions remotely
+After=network-online.target
+
+[Service]
+ExecStart=${command}
+Environment=ROAMCODE_DATA_DIR=${opts.dataDir}${installLine}${pathLine}
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+`;
+}
+function persistRecord(dataDir, record) {
+  mkdirSync(dataDir, { recursive: true, mode: 448 });
+  const path = join(dataDir, "service.json");
+  writeFileSync(path, JSON.stringify(record, null, 2) + "\n", { mode: 384 });
+  chmodSync(path, 384);
+}
+function installService(ctx) {
+  const home = ctx.home ?? homedir();
+  const os = ctx.os ?? platform();
+  const servicePath = buildServicePath(ctx.nodePath, home);
+  if (os === "darwin") {
+    const label = ctx.label ?? "com.roamcode";
+    const dir = join(home, "Library", "LaunchAgents");
+    const path = join(dir, `${label}.plist`);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(
+      path,
+      renderLaunchdPlist({
+        label,
+        nodePath: ctx.nodePath,
+        cliPath: ctx.cliPath,
+        executablePath: ctx.executablePath,
+        dataDir: ctx.dataDir,
+        installRoot: ctx.installRoot,
+        servicePath
+      })
+    );
+    chmodSync(path, 420);
+    const record = {
+      manager: "launchd",
+      label,
+      path,
+      ...ctx.executablePath ? { launcherPath: ctx.executablePath } : {},
+      ...ctx.installRoot ? { installRoot: ctx.installRoot } : {}
+    };
+    persistRecord(ctx.dataDir, record);
+    return {
+      path,
+      record,
+      instructions: `launchctl load -w "${path}"   # start now + at login
+launchctl unload -w "${path}"  # stop`
+    };
+  }
+  if (os === "linux") {
+    const label = ctx.label ?? "roamcode";
+    const dir = join(home, ".config", "systemd", "user");
+    const path = join(dir, `${label}.service`);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(
+      path,
+      renderSystemdUnit({
+        nodePath: ctx.nodePath,
+        cliPath: ctx.cliPath,
+        executablePath: ctx.executablePath,
+        dataDir: ctx.dataDir,
+        installRoot: ctx.installRoot,
+        servicePath
+      })
+    );
+    chmodSync(path, 420);
+    const record = {
+      manager: "systemd",
+      label,
+      path,
+      ...ctx.executablePath ? { launcherPath: ctx.executablePath } : {},
+      ...ctx.installRoot ? { installRoot: ctx.installRoot } : {}
+    };
+    persistRecord(ctx.dataDir, record);
+    return {
+      path,
+      record,
+      instructions: [
+        "systemctl --user daemon-reload",
+        `systemctl --user enable --now ${label}   # start now + at login`,
+        `systemctl --user disable --now ${label}  # stop`,
+        "(run 'loginctl enable-linger $USER' so it runs without an active login session)"
+      ].join("\n")
+    };
+  }
+  throw new Error(`unsupported platform: ${os} \u2014 run roamcode manually or under a user-level supervisor`);
+}
+function readServiceRecord(dataDir) {
+  try {
+    const parsed = JSON.parse(readFileSync(join(dataDir, "service.json"), "utf8"));
+    if (parsed.manager !== "launchd" && parsed.manager !== "systemd" || typeof parsed.label !== "string") {
+      return void 0;
+    }
+    const fallbackPath = parsed.manager === "launchd" ? join(homedir(), "Library", "LaunchAgents", `${parsed.label}.plist`) : join(homedir(), ".config", "systemd", "user", `${parsed.label}.service`);
+    return { ...parsed, path: typeof parsed.path === "string" ? parsed.path : fallbackPath };
+  } catch {
+    return void 0;
+  }
+}
+function migrateServiceToLauncher(opts) {
+  const current = readServiceRecord(opts.dataDir);
+  if (!current) return void 0;
+  return installService({
+    nodePath: opts.nodePath,
+    executablePath: opts.launcherPath,
+    dataDir: opts.dataDir,
+    installRoot: opts.installRoot,
+    os: current.manager === "launchd" ? "darwin" : "linux",
+    label: current.label
+  }).record;
+}
+function restartService(record) {
+  if (!existsSync(record.path)) return { ok: false, error: `service file not found: ${record.path}` };
+  if (record.manager === "launchd") {
+    spawnSync("launchctl", ["unload", record.path], { stdio: "ignore" });
+    const res = spawnSync("launchctl", ["load", "-w", record.path], { encoding: "utf8" });
+    return res.status === 0 ? { ok: true } : { ok: false, error: res.stderr || "launchctl load failed" };
+  }
+  const reload = spawnSync("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
+  if (reload.status !== 0) return { ok: false, error: reload.stderr || "systemctl daemon-reload failed" };
+  const restart = spawnSync("systemctl", ["--user", "restart", record.label], { encoding: "utf8" });
+  return restart.status === 0 ? { ok: true } : { ok: false, error: restart.stderr || "systemctl restart failed" };
+}
+
+// src/managed-runtime.ts
+var VERSION_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var LOCK_STALE_MS = 30 * 6e4;
+var NPM_INSTALL_POLICY = `${JSON.stringify(
+  {
+    private: true,
+    allowScripts: {
+      "better-sqlite3@12.11.1": true,
+      "node-pty@1.1.0": true
+    }
+  },
+  null,
+  2
+)}
+`;
+function managedPaths(root) {
+  return {
+    root,
+    releases: join2(root, "releases"),
+    staging: join2(root, "staging"),
+    current: join2(root, "current"),
+    previous: join2(root, "previous"),
+    bin: join2(root, "bin"),
+    launcher: join2(root, "bin", "roamcode"),
+    lock: join2(root, "update.lock")
+  };
+}
+function isStableVersion(value) {
+  return VERSION_RE.test(value);
+}
+function atomicWrite(path, value, mode = 384) {
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  writeFileSync2(temp, value, { mode });
+  chmodSync2(temp, mode);
+  renameSync(temp, path);
+}
+function renderManagedLauncher(root, nodePath) {
+  const q = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+  return [
+    "#!/bin/sh",
+    "set -eu",
+    `ROOT=${q(root)}`,
+    `NODE=${q(nodePath)}`,
+    'if [ ! -x "$NODE" ]; then NODE="$(command -v node || true)"; fi',
+    'if [ -z "$NODE" ]; then echo "Node.js >= 24 is required" >&2; exit 1; fi',
+    'ENTRY="$ROOT/current/node_modules/roamcode/dist/index.js"',
+    'if [ ! -f "$ENTRY" ]; then',
+    '  echo "roamcode managed runtime is missing; run: npx --yes --allow-scripts=better-sqlite3,node-pty roamcode@latest install" >&2',
+    "  exit 1",
+    "fi",
+    'export ROAMCODE_INSTALL_ROOT="$ROOT"',
+    'export ROAMCODE_MANAGED_EXEC="1"',
+    'exec "$NODE" "$ENTRY" "$@"',
+    ""
+  ].join("\n");
+}
+function writeManagedLauncher(root, nodePath = process.execPath) {
+  const paths = managedPaths(root);
+  mkdirSync2(paths.bin, { recursive: true, mode: 448 });
+  atomicWrite(paths.launcher, renderManagedLauncher(root, nodePath), 448);
+  return paths.launcher;
+}
+function versionFromReleaseDir(dir) {
+  try {
+    const manifest = JSON.parse(readFileSync2(join2(dir, "release.json"), "utf8"));
+    if (typeof manifest.version === "string" && isStableVersion(manifest.version)) return manifest.version;
+  } catch {
+  }
+  try {
+    const pkg = JSON.parse(readFileSync2(join2(dir, "node_modules", "roamcode", "package.json"), "utf8"));
+    return typeof pkg.version === "string" && isStableVersion(pkg.version) ? pkg.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function integrityFromReleaseDir(dir) {
+  try {
+    const manifest = JSON.parse(readFileSync2(join2(dir, "release.json"), "utf8"));
+    return typeof manifest.integrity === "string" ? manifest.integrity : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readActiveVersion(root) {
+  const current = managedPaths(root).current;
+  try {
+    return versionFromReleaseDir(realpathSync(current));
+  } catch {
+    return void 0;
+  }
+}
+function acquireLock(path, now) {
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  try {
+    const fd = openSync(path, "wx", 384);
+    writeFileSync2(fd, JSON.stringify({ pid: process.pid, at: now }) + "\n");
+    closeSync(fd);
+  } catch {
+    try {
+      if (now - lstatSync(path).mtimeMs > LOCK_STALE_MS) {
+        unlinkSync(path);
+        return acquireLock(path, now);
+      }
+    } catch {
+      try {
+        return acquireLock(path, now);
+      } catch {
+      }
+    }
+    throw new Error("an update is already in progress");
+  }
+  return () => {
     try {
-        await installManagedRelease({
-            version: config.version,
-            installRoot: config.installRoot,
-            dataDir: config.dataDir,
-            operationId: config.operationId,
-            expectedIntegrity: config.expectedIntegrity,
-            expectedIntegrities: config.expectedIntegrities,
-            nodePath: config.nodePath,
-            restart: config.restart,
-            onStatus: (status) => writeManagedStatus(config.dataDir, status),
-        });
-    }
-    finally {
-        try {
-            unlinkSync(configPath);
+      unlinkSync(path);
+    } catch {
+    }
+  };
+}
+async function runLogged(command, args, opts) {
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(command, args, {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.stdout?.on("data", (chunk) => opts.log(chunk.toString()));
+    child.stderr?.on("data", (chunk) => opts.log(chunk.toString()));
+    child.on("error", reject);
+    child.on(
+      "close",
+      (code) => code === 0 ? resolvePromise() : reject(new Error(`${basename(command)} exited ${code}`))
+    );
+  });
+}
+function npmInvocation(npmCommand, args, nodePath) {
+  if (npmCommand.endsWith(".js") || npmCommand.endsWith(".cjs"))
+    return { command: nodePath, args: [npmCommand, ...args] };
+  return { command: npmCommand, args };
+}
+function npmProjectEnv(env = process.env) {
+  const clean = { ...env };
+  for (const key of Object.keys(clean)) {
+    if (key.toLowerCase() === "npm_config_allow_scripts") delete clean[key];
+  }
+  return clean;
+}
+async function npmIntegrity(npmCommand, packageName, version, nodePath, log) {
+  let output = "";
+  const invocation = npmInvocation(
+    npmCommand,
+    ["view", `${packageName}@${version}`, "dist.integrity", "--json"],
+    nodePath
+  );
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(invocation.command, invocation.args, {
+      env: npmProjectEnv(),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.stdout?.on("data", (chunk) => output += chunk.toString());
+    child.stderr?.on("data", (chunk) => log(chunk.toString()));
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolvePromise() : reject(new Error(`npm view exited ${code}`)));
+  });
+  const parsed = JSON.parse(output);
+  if (typeof parsed !== "string" || !parsed.startsWith("sha512-")) throw new Error("npm returned no package integrity");
+  return parsed;
+}
+async function smokeServer(serverEntry, dataDir, nodePath, log) {
+  const smokeDir = join2(tmpdir(), `roamcode-smoke-${process.pid}-${randomUUID()}`);
+  mkdirSync2(smokeDir, { recursive: true, mode: 448 });
+  let output = "";
+  const child = spawn(nodePath, [serverEntry], {
+    env: {
+      ...process.env,
+      PORT: "0",
+      BIND_ADDRESS: "127.0.0.1",
+      ACCESS_TOKEN: `rc-smoke-${randomUUID()}`,
+      ROAMCODE_DATA_DIR: smokeDir,
+      RC_TMUX_SOCKET: `rc-smoke-${process.pid}`,
+      ROAMCODE_INSTALL_ROOT: ""
+    },
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const collect = (chunk) => {
+    const text = chunk.toString();
+    output += text;
+    log(text);
+  };
+  child.stdout?.on("data", collect);
+  child.stderr?.on("data", collect);
+  try {
+    const url = await new Promise((resolveUrl, reject) => {
+      const deadline = setTimeout(() => reject(new Error("new release did not start within 25s")), 25e3);
+      const poll = setInterval(() => {
+        const match = output.match(/listening on (http:\/\/127\.0\.0\.1:\d+)/);
+        if (match?.[1]) {
+          clearInterval(poll);
+          clearTimeout(deadline);
+          resolveUrl(match[1]);
         }
-        catch {
-            // best effort; config contains no secret, but should not accumulate
+      }, 100);
+      child.once("exit", (code) => {
+        clearInterval(poll);
+        clearTimeout(deadline);
+        reject(new Error(`new release exited before health check (${code})`));
+      });
+    });
+    const healthy = await fetch(`${url}/health`, { signal: AbortSignal.timeout(5e3) });
+    if (!healthy.ok) throw new Error(`new release health check returned ${healthy.status}`);
+  } finally {
+    child.kill("SIGTERM");
+    rmSync(smokeDir, { recursive: true, force: true });
+    void dataDir;
+  }
+}
+function replaceSymlink(link, target) {
+  const temp = `${link}.${process.pid}.${randomUUID()}.new`;
+  try {
+    unlinkSync(temp);
+  } catch {
+  }
+  const parent = realpathSync(dirname2(link));
+  const canonicalTarget = realpathSync(target);
+  symlinkSync(relative(parent, canonicalTarget), temp, "dir");
+  renameSync(temp, link);
+}
+function trimLog(log) {
+  return log.split("\n").slice(-20).join("\n").slice(-8e3);
+}
+async function installManagedRelease(opts) {
+  if (!isStableVersion(opts.version)) throw new Error(`invalid release version: ${opts.version}`);
+  const now = opts.now ?? Date.now;
+  const operationId = opts.operationId ?? randomUUID();
+  const nodePath = opts.nodePath ?? process.execPath;
+  const npmCommand = opts.npmCommand ?? process.env.npm_execpath ?? "npm";
+  const expectedIntegrities = opts.expectedIntegrities ?? (opts.expectedIntegrity ? { roamcode: opts.expectedIntegrity } : {});
+  const rootIntegrity = expectedIntegrities.roamcode;
+  const paths = managedPaths(opts.installRoot);
+  mkdirSync2(paths.releases, { recursive: true, mode: 448 });
+  mkdirSync2(paths.staging, { recursive: true, mode: 448 });
+  const release = join2(paths.releases, opts.version);
+  const stage = join2(paths.staging, `${opts.version}-${process.pid}-${randomUUID()}`);
+  let logText = "";
+  const log = (line) => {
+    logText += line.endsWith("\n") ? line : `${line}
+`;
+    mkdirSync2(opts.dataDir, { recursive: true, mode: 448 });
+    writeFileSync2(join2(opts.dataDir, "update.log"), line.endsWith("\n") ? line : `${line}
+`, { flag: "a" });
+  };
+  const fromVersion = readActiveVersion(opts.installRoot);
+  const status = (state, phase, error) => {
+    opts.onStatus?.({
+      operationId,
+      state,
+      phase,
+      target: opts.version,
+      ...fromVersion ? { fromVersion } : {},
+      ...error ? { error } : {},
+      log: trimLog(logText),
+      updatedAt: now()
+    });
+  };
+  const releaseLock = acquireLock(paths.lock, now());
+  let activated = false;
+  try {
+    status("starting", "preparing");
+    const reusableRelease = existsSync2(release) && versionFromReleaseDir(release) === opts.version && (!rootIntegrity || integrityFromReleaseDir(release) === rootIntegrity);
+    if (!reusableRelease) {
+      if (Object.keys(expectedIntegrities).length > 0) {
+        status("downloading", "checking package integrity");
+        for (const [packageName, expected] of Object.entries(expectedIntegrities)) {
+          const actual = await npmIntegrity(npmCommand, packageName, opts.version, nodePath, log);
+          if (actual !== expected) throw new Error(`GitHub release and npm integrity do not match for ${packageName}`);
         }
+      }
+      status("installing", "installing package");
+      mkdirSync2(stage, { recursive: true, mode: 448 });
+      atomicWrite(join2(stage, "package.json"), NPM_INSTALL_POLICY);
+      const invocation = npmInvocation(
+        npmCommand,
+        [
+          "install",
+          "--prefix",
+          stage,
+          "--omit=dev",
+          "--no-audit",
+          "--no-fund",
+          "--package-lock=false",
+          `roamcode@${opts.version}`
+        ],
+        nodePath
+      );
+      await runLogged(invocation.command, invocation.args, { env: npmProjectEnv(), log });
+      const installed = versionFromReleaseDir(stage);
+      if (installed !== opts.version)
+        throw new Error(`installed roamcode ${installed ?? "unknown"}, expected ${opts.version}`);
+      const serverEntry = join2(stage, "node_modules", "@roamcode.ai", "server", "dist", "start.js");
+      if (!existsSync2(serverEntry)) throw new Error("published package is missing @roamcode.ai/server/dist/start.js");
+      status("verifying", "boot smoke");
+      await smokeServer(serverEntry, opts.dataDir, nodePath, log);
+      atomicWrite(
+        join2(stage, "release.json"),
+        JSON.stringify(
+          {
+            version: opts.version,
+            installedAt: now(),
+            package: `roamcode@${opts.version}`,
+            ...rootIntegrity ? { integrity: rootIntegrity } : {}
+          },
+          null,
+          2
+        ) + "\n"
+      );
+      if (existsSync2(release)) rmSync(release, { recursive: true, force: true });
+      renameSync(stage, release);
+    } else {
+      const serverEntry = join2(release, "node_modules", "@roamcode.ai", "server", "dist", "start.js");
+      if (!existsSync2(serverEntry)) throw new Error(`managed release ${opts.version} is incomplete`);
+      status("verifying", "verifying installed release");
+      await smokeServer(serverEntry, opts.dataDir, nodePath, log);
+    }
+    status("activating", "activating release");
+    let oldTarget;
+    try {
+      oldTarget = realpathSync(paths.current);
+    } catch {
+      oldTarget = void 0;
+    }
+    if (oldTarget && resolve(oldTarget) !== resolve(release)) replaceSymlink(paths.previous, oldTarget);
+    replaceSymlink(paths.current, release);
+    activated = true;
+    const launcherPath = writeManagedLauncher(opts.installRoot, nodePath);
+    const existingService = readServiceRecord(opts.dataDir);
+    const record = existingService ? migrateServiceToLauncher({
+      dataDir: opts.dataDir,
+      installRoot: opts.installRoot,
+      launcherPath,
+      nodePath
+    }) : void 0;
+    if (opts.restart && record) {
+      status("restarting", "restarting service");
+      const restarted = restartService(record);
+      if (!restarted.ok) throw new Error(restarted.error ?? "service restart failed");
+    }
+    status("done", "done");
+    const keep = new Set([opts.version, fromVersion].filter((value) => !!value));
+    for (const name of readdirSync(paths.releases)) {
+      if (isStableVersion(name) && !keep.has(name))
+        rmSync(join2(paths.releases, name), { recursive: true, force: true });
+    }
+    return {
+      version: opts.version,
+      ...fromVersion ? { previousVersion: fromVersion } : {},
+      releaseDir: release,
+      launcherPath
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    log(`FAILED: ${message}`);
+    if (activated) {
+      try {
+        const previous = realpathSync(paths.previous);
+        replaceSymlink(paths.current, previous);
+      } catch {
+      }
+    }
+    status("failed", "failed", message);
+    throw error;
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+    releaseLock();
+  }
+}
+function writeManagedStatus(dataDir, status) {
+  atomicWrite(join2(dataDir, "update-status.json"), JSON.stringify(status, null, 2) + "\n", 384);
+}
+
+// src/managed-update-helper.ts
+async function main() {
+  const configPath = process.argv[2];
+  if (!configPath) throw new Error("managed updater config path is required");
+  const config = JSON.parse(readFileSync3(configPath, "utf8"));
+  try {
+    await installManagedRelease({
+      version: config.version,
+      installRoot: config.installRoot,
+      dataDir: config.dataDir,
+      operationId: config.operationId,
+      expectedIntegrity: config.expectedIntegrity,
+      expectedIntegrities: config.expectedIntegrities,
+      nodePath: config.nodePath,
+      restart: config.restart,
+      onStatus: (status) => writeManagedStatus(config.dataDir, status)
+    });
+  } finally {
+    try {
+      unlinkSync2(configPath);
+    } catch {
     }
+  }
 }
 void main().catch((error) => {
-    process.stderr.write(`roamcode updater failed: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
-    process.exitCode = 1;
+  process.stderr.write(
+    `roamcode updater failed: ${error instanceof Error ? error.stack ?? error.message : String(error)}
+`
+  );
+  process.exitCode = 1;
 });