@timurproko/a1 0.1.8-dev.536 → 0.1.8-dev.544

package/bin/update-recovery.js

@@ -5,7 +5,7 @@
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const SCHEMA = "a1-update-recovery-v1";
@@ -200,9 +200,15 @@ async function readCapsule(path) {
   const packageRoot = await realpath(value.packageRoot).catch(() => resolve(value.packageRoot));
   const expectedPackage = resolve(globalRoot, ...value.packageName.split("/"));
   if (!samePath(packageRoot, expectedPackage) || !containedBy(globalRoot, packageRoot)) throw new Error("A1 update recovery package root escapes npm global root");
-  const expectedNpmArguments = ["install", "--global", "--loglevel=error", "--no-fund", "--no-audit", `${value.packageName}@${value.targetVersion}`];
-  if (JSON.stringify(value.npmArguments) !== JSON.stringify(expectedNpmArguments)) throw new Error("A1 update recovery npm arguments are invalid");
+  const prefix = npmPrefixForGlobalRoot(globalRoot);
+  const expectedNpmArguments = ["install", "--global", "--prefix", prefix, "--loglevel=error", "--no-fund", "--no-audit", `${value.packageName}@${value.targetVersion}`];
+  const legacyNpmArguments = ["install", "--global", "--loglevel=error", "--no-fund", "--no-audit", `${value.packageName}@${value.targetVersion}`];
+  if (![expectedNpmArguments, legacyNpmArguments].some(arguments_ => sameArguments(value.npmArguments, arguments_))) {
+    throw new Error("A1 update recovery npm arguments are invalid");
+  }
   const launcherRoot = resolve(value.launcherRoot);
+  const expectedLauncherRoot = process.platform === "win32" ? prefix : resolve(prefix, "bin");
+  if (!samePath(launcherRoot, expectedLauncherRoot)) throw new Error("A1 update recovery launcher root is invalid");
   const expectedLaunchers = process.platform === "win32"
     ? [resolve(launcherRoot, "a1"), resolve(launcherRoot, "a1.cmd"), resolve(launcherRoot, "a1.ps1")]
     : [resolve(launcherRoot, "a1")];
@@ -306,6 +312,22 @@ async function writeJson(path, value) {
   await rename(temporary, path);
 }
 
+/** @param {string} globalRoot */
+function npmPrefixForGlobalRoot(globalRoot) {
+  const root = resolve(globalRoot);
+  const nodeModules = process.platform === "win32" ? basename(root).toLowerCase() === "node_modules" : basename(root) === "node_modules";
+  if (!nodeModules) throw new Error("A1 update recovery npm global root layout is invalid");
+  if (process.platform === "win32") return dirname(root);
+  const libraryRoot = dirname(root);
+  if (basename(libraryRoot) !== "lib") throw new Error("A1 update recovery npm global root layout is invalid");
+  return dirname(libraryRoot);
+}
+
+/** @param {string[]} left @param {string[]} right */
+function sameArguments(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+
 /**
  * @param {string} left
  * @param {string} right

package/dist/foundation/release/index.d.ts

@@ -21,11 +21,11 @@ export type { RestartSeal, RestartValidationEvent } from "./restart-certificatio
 export { STABLE_RELEASE_SCHEMA, createStableReleaseEvidence, verifyStableRegistry } from "./stable-release.js";
 export type { StableRegistryState, StableRegistryVerificationOptions, StableReleaseEvidence, StableReleaseEvidenceInput } from "./stable-release.js";
 export { PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, planUpdateOwnership, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
-export type { ProcessRequest, ProcessResult, SelfUpdateOptions, UpdateActivationPhase, UpdateChannel, UpdateFileSystem, UpdateLifecycleCoordinator, UpdateMaterializationProgress, UpdateMeasuredPhase, UpdateOutput, UpdateOwnershipAction, UpdatePackageReplacementInput, UpdatePerformanceEvidence, UpdatePhaseTimingEvent, UpdateProcessRunner, UpdateTransactionJournal, } from "./update.js";
+export type { ProcessRequest, ProcessResult, SelfUpdateOptions, UpdateActivationPhase, UpdateChannel, UpdateFileMetadata, UpdateFileSystem, UpdateLifecycleCoordinator, UpdateMaterializationProgress, UpdateMeasuredPhase, UpdateOutput, UpdateOwnershipAction, UpdatePackageReplacementInput, UpdatePerformanceEvidence, UpdatePhaseTimingEvent, UpdateProcessRunner, UpdateTransactionJournal, } from "./update.js";
 export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
 export type { UpdateActivationCallbacks, UpdateActivationEvent, UpdateActivationRequest } from "./update-activation.js";
 export { selectSupervisorLaunchReleaseId, selectUpdateLaunchRelease } from "./update-launch.js";
-export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, runProtectedPackageReplacement, updateLauncherPaths, } from "./update-recovery.js";
+export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, npmPrefixForGlobalRoot, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
 export type { ProtectedPackageReplacementOptions, ProtectedPackageReplacementResult, UpdateRecoveryCapsule, UpdateRecoveryResult } from "./update-recovery.js";
 export { UPDATE_JOURNAL_SCHEMA, UpdateTransactionStore } from "./update-transaction.js";
 export type { UpdateRecoveryState, UpdateTransaction, UpdateTransactionPhase } from "./update-transaction.js";

package/dist/foundation/release/index.js

@@ -12,6 +12,6 @@ export { STABLE_RELEASE_SCHEMA, createStableReleaseEvidence, verifyStableRegistr
 export { PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, planUpdateOwnership, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
 export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
 export { selectSupervisorLaunchReleaseId, selectUpdateLaunchRelease } from "./update-launch.js";
-export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, runProtectedPackageReplacement, updateLauncherPaths, } from "./update-recovery.js";
+export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, npmPrefixForGlobalRoot, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
 export { UPDATE_JOURNAL_SCHEMA, UpdateTransactionStore } from "./update-transaction.js";
 export { warmMaterializedRelease } from "./warmup.js";

package/dist/foundation/release/update-recovery.d.ts

@@ -39,6 +39,8 @@ export interface UpdateRecoveryResult {
 export interface ProtectedPackageReplacementOptions {
     readonly dataDir: string;
     readonly globalRoot: string;
+    /** Root used only to locate the active npm implementation; installation remains pinned to globalRoot. */
+    readonly npmCliRoot?: string;
     readonly packageRoot: string;
     readonly transaction: UpdateTransaction;
     readonly priorRelease: {
@@ -58,7 +60,11 @@ export interface ProtectedPackageReplacementOptions {
 export interface ProtectedPackageReplacementResult extends UpdateRecoveryResult {
     readonly recovery: UpdateRecoveryState;
 }
-/** Resolve the complete public launcher set npm owns for the active platform. */
+/** Derive the only npm prefix that can own a platform's canonical global package root. */
+export declare function npmPrefixForGlobalRoot(globalRoot: string, platform?: NodeJS.Platform): string;
+/** Fixed replacement arguments pin npm to the installation that owns the invoked launcher. */
+export declare function updateNpmInstallArguments(globalRoot: string, targetVersion: string, platform?: NodeJS.Platform): readonly string[];
+/** Resolve the complete public launcher set npm owns for the selected platform and prefix. */
 export declare function updateLauncherPaths(globalRoot: string, platform?: NodeJS.Platform): readonly string[];
 /** Validate transaction-scoped recovery authority without trusting npm temporary names. */
 export declare function readUpdateRecoveryCapsule(manifestPath: string, platform?: NodeJS.Platform): Promise<UpdateRecoveryCapsule>;

package/dist/foundation/release/update-recovery.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { processIsAlive } from "./process-cleanup.js";
@@ -9,9 +9,29 @@ import { PRIVATE_LAUNCH_CONTRACT, assertCurrentLaunchContract } from "../launch-
 export const UPDATE_RECOVERY_SCHEMA = "a1-update-recovery-v1";
 const WORKER_TIMEOUT_MS = 15 * 60 * 1_000;
 const POLL_MS = 50;
-/** Resolve the complete public launcher set npm owns for the active platform. */
+/** Derive the only npm prefix that can own a platform's canonical global package root. */
+export function npmPrefixForGlobalRoot(globalRoot, platform = process.platform) {
+    const root = resolve(globalRoot);
+    if (!sameSegment(basename(root), "node_modules", platform))
+        throw new Error(`npm global root has an unsupported layout: ${globalRoot}`);
+    if (platform === "win32")
+        return dirname(root);
+    const libraryRoot = dirname(root);
+    if (!sameSegment(basename(libraryRoot), "lib", platform))
+        throw new Error(`npm global root has an unsupported layout: ${globalRoot}`);
+    return dirname(libraryRoot);
+}
+/** Fixed replacement arguments pin npm to the installation that owns the invoked launcher. */
+export function updateNpmInstallArguments(globalRoot, targetVersion, platform = process.platform) {
+    return [
+        "install", "--global", "--prefix", npmPrefixForGlobalRoot(globalRoot, platform),
+        "--loglevel=error", "--no-fund", "--no-audit", `${PRODUCT_TEXT.packageName}@${targetVersion}`,
+    ];
+}
+/** Resolve the complete public launcher set npm owns for the selected platform and prefix. */
 export function updateLauncherPaths(globalRoot, platform = process.platform) {
-    const launcherRoot = platform === "win32" ? dirname(globalRoot) : resolve(globalRoot, "..", "..", "bin");
+    const prefix = npmPrefixForGlobalRoot(globalRoot, platform);
+    const launcherRoot = platform === "win32" ? prefix : resolve(prefix, "bin");
     return platform === "win32"
         ? [resolve(launcherRoot, "a1"), resolve(launcherRoot, "a1.cmd"), resolve(launcherRoot, "a1.ps1")]
         : [resolve(launcherRoot, "a1")];
@@ -33,9 +53,11 @@ export async function readUpdateRecoveryCapsule(manifestPath, platform = process
     const expectedPackage = resolve(canonicalGlobal, ...capsule.packageName.split("/"));
     if (!samePath(canonicalPackage, expectedPackage) || !containedBy(canonicalGlobal, canonicalPackage))
         throw new Error("recovery package root is outside npm global root");
-    const expectedNpmArguments = ["install", "--global", "--loglevel=error", "--no-fund", "--no-audit", `${capsule.packageName}@${capsule.targetVersion}`];
-    if (JSON.stringify(capsule.npmArguments) !== JSON.stringify(expectedNpmArguments))
-        throw new Error("recovery npm arguments differ from the selected target");
+    const expectedNpmArguments = updateNpmInstallArguments(canonicalGlobal, capsule.targetVersion, platform);
+    const legacyNpmArguments = ["install", "--global", "--loglevel=error", "--no-fund", "--no-audit", `${capsule.packageName}@${capsule.targetVersion}`];
+    if (![expectedNpmArguments, legacyNpmArguments].some(arguments_ => sameArguments(capsule.npmArguments, arguments_))) {
+        throw new Error("recovery npm arguments differ from the selected target and prefix");
+    }
     const expectedLaunchers = updateLauncherPaths(canonicalGlobal, platform);
     if (JSON.stringify(capsule.launchers.map(path => resolve(path))) !== JSON.stringify(expectedLaunchers.map(path => resolve(path)))) {
         throw new Error("recovery launcher set differs from the canonical npm launcher set");
@@ -94,8 +116,10 @@ export async function prepareUpdateRecoveryCapsule(options) {
         await chmod(candidateEntry, 0o500);
         const canonicalGlobal = await realpath(options.globalRoot);
         const platform = options.platform ?? process.platform;
-        const launcherRoot = platform === "win32" ? dirname(canonicalGlobal) : resolve(canonicalGlobal, "..", "..", "bin");
-        const npmCli = await resolveNpmCli(canonicalGlobal, options.environment ?? process.env);
+        const prefix = npmPrefixForGlobalRoot(canonicalGlobal, platform);
+        const launcherRoot = platform === "win32" ? prefix : resolve(prefix, "bin");
+        const npmCliRoot = await realpath(options.npmCliRoot ?? canonicalGlobal);
+        const npmCli = await resolveNpmCli(npmCliRoot, options.environment ?? process.env);
         const capsule = {
             schema: UPDATE_RECOVERY_SCHEMA,
             launchContract: PRIVATE_LAUNCH_CONTRACT,
@@ -114,7 +138,7 @@ export async function prepareUpdateRecoveryCapsule(options) {
             recoveryEntryDigest: createHash("sha256").update(entryBytes).digest("hex"),
             nodeExecutable: process.execPath,
             npmCli,
-            npmArguments: ["install", "--global", "--loglevel=error", "--no-fund", "--no-audit", `${PRODUCT_TEXT.packageName}@${options.transaction.targetVersion}`],
+            npmArguments: updateNpmInstallArguments(canonicalGlobal, options.transaction.targetVersion, platform),
             cancellationPath: resolve(finalRoot, "cancel.json"),
             resultPath: resolve(finalRoot, "result.json"),
             ownerPath: resolve(finalRoot, "owner.json"),
@@ -341,6 +365,12 @@ async function readJson(path) { return JSON.parse(await readFile(path, "utf8"));
 function samePath(left, right) {
     return process.platform === "win32" ? resolve(left).toLowerCase() === resolve(right).toLowerCase() : resolve(left) === resolve(right);
 }
+function sameSegment(left, right, platform) {
+    return platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+function sameArguments(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
 function containedBy(parent, child) {
     const fromParent = relative(parent, child);
     return fromParent.length > 0 && fromParent !== ".." && !fromParent.startsWith(`..${sep}`) && !isAbsolute(fromParent);

package/dist/foundation/release/update.d.ts

@@ -13,9 +13,15 @@ export interface ProcessResult {
     stderr?: string;
 }
 export type UpdateProcessRunner = (command: string, arguments_: readonly string[], request: ProcessRequest) => Promise<ProcessResult>;
+export interface UpdateFileMetadata {
+    readonly mode: number;
+    isFile(): boolean;
+    isSymbolicLink(): boolean;
+}
 export interface UpdateFileSystem {
     readFile(path: string): Promise<string>;
     realpath(path: string): Promise<string>;
+    lstat?(path: string): Promise<UpdateFileMetadata>;
     access?(path: string): Promise<void>;
 }
 export interface UpdateOutput {
@@ -85,6 +91,7 @@ export interface UpdateTransactionJournal {
 export interface UpdatePackageReplacementInput {
     readonly dataDir: string;
     readonly globalRoot: string;
+    readonly npmCliRoot: string;
     readonly packageRoot: string;
     readonly transaction: UpdateTransaction;
     readonly priorRelease: {

package/dist/foundation/release/update.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
-import { access, readFile, realpath } from "node:fs/promises";
+import { access, lstat, readFile, realpath } from "node:fs/promises";
 import { connect } from "node:net";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import crossSpawn from "cross-spawn";
 import { valid as validSemver } from "semver";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
@@ -15,12 +15,13 @@ import { materializeRelease, readMaterializedRelease } from "./release-store.js"
 import { scheduleReleaseCleanup } from "./release-gc.js";
 import { UPDATE_ACTIVATION_CONTRACT, activateInstalledRelease, delegateActivation, readActivationContracts, } from "./update-activation.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
-import { removeUpdateRecoveryCapsule, runProtectedPackageReplacement } from "./update-recovery.js";
+import { npmPrefixForGlobalRoot, removeUpdateRecoveryCapsule, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
 export const PRODUCT_PACKAGE = PRODUCT_TEXT.packageName;
 const UPDATE_DIST_TAGS = { stable: "latest", next: "next" };
 const defaultFileSystem = {
     async readFile(path) { return await readFile(path, "utf8"); },
     realpath,
+    lstat,
     access,
 };
 const defaultOutput = {
@@ -308,6 +309,106 @@ async function resolveRequestedPreview(runner, requested, output) {
     output.stderr(`${PRODUCT_TEXT.diagnostic(`published no preview for ${requested}.`)}\n`);
     return { version: null, exitCode: 1 };
 }
+async function resolveManagedNpmInstallation(requestedPackageRoot, fileSystem, runner, output) {
+    const rootLookup = await runNpm(runner, ["root", "--global"], true, output, "resolve npm's global package root");
+    if (rootLookup.result === null)
+        return { installation: null, exitCode: rootLookup.exitCode };
+    const activeRootText = rootLookup.result.stdout.trim();
+    if (activeRootText.length === 0) {
+        output.stderr(`${PRODUCT_TEXT.diagnostic("could not verify its installation because npm returned an empty global package root.")}\n`);
+        return { installation: null, exitCode: 1 };
+    }
+    let packageRoot;
+    let activeGlobalRoot;
+    try {
+        [packageRoot, activeGlobalRoot] = await Promise.all([fileSystem.realpath(requestedPackageRoot), fileSystem.realpath(activeRootText)]);
+    }
+    catch (error) {
+        output.stderr(`${PRODUCT_TEXT.diagnostic(`could not canonicalize the running and global npm paths: ${errorMessage(error)}`)}\n`);
+        return { installation: null, exitCode: 1 };
+    }
+    const expectedActivePackage = resolve(activeGlobalRoot, ...PRODUCT_PACKAGE.split("/"));
+    if (samePath(packageRoot, expectedActivePackage)) {
+        try {
+            npmPrefixForGlobalRoot(activeGlobalRoot);
+            return {
+                installation: {
+                    packageRoot,
+                    globalRoot: activeGlobalRoot,
+                    npmCliRoot: activeGlobalRoot,
+                },
+                exitCode: 0,
+            };
+        }
+        catch (error) {
+            output.stderr(`${PRODUCT_TEXT.diagnostic(`could not verify npm's active global package layout: ${errorMessage(error)}`)}\n`);
+            return { installation: null, exitCode: 1 };
+        }
+    }
+    let candidateGlobalRoot = packageRoot;
+    for (const _segment of PRODUCT_PACKAGE.split("/"))
+        candidateGlobalRoot = dirname(candidateGlobalRoot);
+    let candidatePrefix;
+    try {
+        candidatePrefix = npmPrefixForGlobalRoot(candidateGlobalRoot);
+    }
+    catch {
+        reportUnmanagedInstallation(output, packageRoot, activeGlobalRoot);
+        return { installation: null, exitCode: 1 };
+    }
+    if (!samePath(packageRoot, resolve(candidateGlobalRoot, ...PRODUCT_PACKAGE.split("/")))) {
+        reportUnmanagedInstallation(output, packageRoot, activeGlobalRoot);
+        return { installation: null, exitCode: 1 };
+    }
+    const confirmation = await runNpm(runner, ["root", "--global", "--prefix", candidatePrefix], true, output, "confirm npm ownership of the running installation");
+    if (confirmation.result === null)
+        return { installation: null, exitCode: confirmation.exitCode };
+    const confirmedRootText = confirmation.result.stdout.trim();
+    if (confirmedRootText.length === 0) {
+        output.stderr(`${PRODUCT_TEXT.diagnostic("could not verify its installation because npm returned an empty global package root for the inferred prefix.")}\n`);
+        return { installation: null, exitCode: 1 };
+    }
+    let confirmedRoot;
+    try {
+        confirmedRoot = await fileSystem.realpath(confirmedRootText);
+    }
+    catch (error) {
+        output.stderr(`${PRODUCT_TEXT.diagnostic(`could not canonicalize npm's confirmed global package root: ${errorMessage(error)}`)}\n`);
+        return { installation: null, exitCode: 1 };
+    }
+    if (!samePath(confirmedRoot, candidateGlobalRoot)
+        || !await launchersOwnPackage(candidateGlobalRoot, fileSystem)) {
+        reportUnmanagedInstallation(output, packageRoot, activeGlobalRoot);
+        return { installation: null, exitCode: 1 };
+    }
+    return {
+        installation: {
+            packageRoot,
+            globalRoot: candidateGlobalRoot,
+            npmCliRoot: activeGlobalRoot,
+        },
+        exitCode: 0,
+    };
+}
+async function launchersOwnPackage(globalRoot, fileSystem) {
+    const token = `node_modules/${PRODUCT_PACKAGE}/bin/cli.js`;
+    try {
+        for (const launcher of updateLauncherPaths(globalRoot)) {
+            const metadata = await (fileSystem.lstat ?? lstat)(launcher);
+            if (!metadata.isFile() || metadata.isSymbolicLink() || (process.platform !== "win32" && (metadata.mode & 0o111) === 0))
+                return false;
+            if (!(await fileSystem.readFile(launcher)).replaceAll("\\", "/").includes(token))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function reportUnmanagedInstallation(output, packageRoot, activeGlobalRoot) {
+    output.stderr(`${PRODUCT_TEXT.diagnostic(`refused to update automatically because ${packageRoot} could not be verified as an npm-managed ${PRODUCT_PACKAGE} installation; npm's active global package root is ${activeGlobalRoot}. Run npm install --global ${PRODUCT_PACKAGE} to install it manually.`)}\n`);
+}
 export async function runSelfUpdate(options) {
     const fileSystem = options.fileSystem ?? defaultFileSystem;
     const output = options.output ?? defaultOutput;
@@ -328,6 +429,8 @@ export async function runSelfUpdate(options) {
     try {
         const packageJson = JSON.parse(await measure("package-version", async () => await fileSystem.readFile(resolve(options.packageRoot, "package.json"))));
         const parsedVersion = typeof packageJson.version === "string" ? validSemver(packageJson.version) : null;
+        if (packageJson.name !== PRODUCT_PACKAGE)
+            throw new Error(`package.json does not identify ${PRODUCT_PACKAGE}`);
         if (parsedVersion === null)
             throw new Error("package.json does not contain a valid semantic version");
         runningVersion = parsedVersion;
@@ -347,26 +450,10 @@ export async function runSelfUpdate(options) {
     // and a trailing one reads as part of the version rather than as punctuation.
     output.stdout(`${PRODUCT_TEXT.commandName} update: ${runningVersion} → ${targetVersion}\n`);
     const progress = createUpdateProgress(output, options.progress ?? (options.output === undefined && process.stdout.isTTY === true));
-    const rootLookup = await measure("global-root", async () => await runNpm(runner, ["root", "--global"], true, output, "resolve npm's global package root"));
-    if (rootLookup.result === null)
-        return rootLookup.exitCode;
-    if (rootLookup.result.stdout.trim().length === 0) {
-        output.stderr(`${PRODUCT_TEXT.diagnostic("could not verify its installation because npm returned an empty global package root.")}\n`);
-        return 1;
-    }
-    let packageRoot;
-    let globalRoot;
-    try {
-        [packageRoot, globalRoot] = await Promise.all([fileSystem.realpath(options.packageRoot), fileSystem.realpath(rootLookup.result.stdout.trim())]);
-    }
-    catch (error) {
-        output.stderr(`${PRODUCT_TEXT.diagnostic(`could not canonicalize the running and global npm paths: ${errorMessage(error)}`)}\n`);
-        return 1;
-    }
-    if (!isContainedBy(globalRoot, packageRoot)) {
-        output.stderr(`${PRODUCT_TEXT.diagnostic(`refused to update automatically because ${packageRoot} is not managed beneath npm's global package root ${globalRoot}.`)}\n`);
-        return 1;
-    }
+    const managed = await measure("global-root", async () => await resolveManagedNpmInstallation(options.packageRoot, fileSystem, runner, output));
+    if (managed.installation === null)
+        return managed.exitCode;
+    const { packageRoot, globalRoot, npmCliRoot } = managed.installation;
     const environment = options.environment ?? process.env;
     const paths = resolveProductPaths(environment);
     const lifecycle = options.lifecycle ?? createUpdateLifecycleCoordinator(environment, fileSystem, output);
@@ -427,6 +514,7 @@ export async function runSelfUpdate(options) {
                 const replacement = await measure("npm-install", async () => await (options.packageReplacement ?? runProtectedPackageReplacement)({
                     dataDir: paths.dataDir,
                     globalRoot,
+                    npmCliRoot,
                     packageRoot,
                     transaction: replacementTransaction,
                     priorRelease,
@@ -453,7 +541,7 @@ export async function runSelfUpdate(options) {
                 }
             }
             else {
-                const installation = await measure("npm-install", async () => await runNpm(runner, ["install", "--global", "--loglevel=error", "--no-fund", "--no-audit", `${PRODUCT_PACKAGE}@${targetVersion}`], true, output, "start the global npm installation", false));
+                const installation = await measure("npm-install", async () => await runNpm(runner, updateNpmInstallArguments(globalRoot, targetVersion), true, output, "start the global npm installation", false));
                 if (installation.result === null)
                     throw new UpdateFailure(installation.exitCode, "npm process failed");
                 if (installation.result.code !== 0) {
@@ -624,6 +712,9 @@ async function canonicalImmutableRoot(dataDir, releaseRoot) {
         return false;
     }
 }
+function samePath(left, right) {
+    return process.platform === "win32" ? resolve(left).toLowerCase() === resolve(right).toLowerCase() : resolve(left) === resolve(right);
+}
 function isContainedBy(parent, child) {
     const pathFromParent = relative(parent, child);
     return pathFromParent.length > 0 && pathFromParent !== ".." && !pathFromParent.startsWith(`..${sep}`) && !isAbsolute(pathFromParent);

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-09-22T17:55:39.177Z",
+  "builtAt": "2026-09-22T19:10:19.352Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "9db1726bbe3fc2e8292f2ead1e7e9d0fd4d7d0dc9217b372582bf354b0f565dc",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-22T17:55:47.994Z",
+  "builtAt": "2026-09-22T19:10:09.829Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "d8cda6b0c7cb36c0cc41e90802aceebf6c02eaebbc08a83d7d963d2e918dbd7a",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-22T17:56:18.215Z",
+  "builtAt": "2026-09-22T19:10:51.843Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "50626418cdc7a539611dca682b0adc3a806f7aa93930007c96244f2a9aac156e",
+    "sha256": "cdef023b39a9328a308f1bcb293d2345240fb063af044e7948154113a3746c73",
     "size": 177664
   },
   "provenance": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.536",
+  "version": "0.1.8-dev.544",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",