@vantaloom/cli 0.14.18 → 0.15.30

package/bin/vantaloom.mjs

@@ -5,5 +5,9 @@ import { main } from "../src/cli.mjs"
 main(process.argv.slice(2)).catch((error) => {
   const message = error instanceof Error ? error.message : String(error)
   console.error(`vantaloom: ${message}`)
-  process.exit(1)
+  // Set the code and let the loop drain instead of process.exit(): after any
+  // registry fetch, undici still has sockets mid-close, and killing the process
+  // then trips a libuv assertion on Windows ("UV_HANDLE_CLOSING"), which buries
+  // the real error under a crash dump and returns 0xC0000409 instead of 1.
+  process.exitCode = 1
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/cli",
-  "version": "0.14.18",
+  "version": "0.15.30",
   "private": false,
   "type": "module",
   "description": "Vantaloom local runtime manager.",

package/src/cli.mjs

@@ -10,8 +10,6 @@ import path from "node:path"
 import {
   cliRoot,
   defaultNpmRegistry,
-  defaultRepo,
-  defaultReleaseTag,
   fallbackNpmRegistries,
 } from "./lib/constants.mjs"
 import {
@@ -32,20 +30,15 @@ import {
   findSourceRoot,
   tryFindSourceRoot,
   tryAssertSourceRoot,
-  gitRemoteUrl,
-  inferGitHubRepo,
   readInstalledConfig,
   writeRuntimePackageMetadata,
   ensureInPath,
 } from "./lib/install.mjs"
 import { buildRuntimePackage } from "./lib/package.mjs"
 import {
-  detectNpmRegistry,
   resolveNpmPackageWithFallback,
   downloadNpmTarball,
-  downloadReleaseAsset,
   findExtractedNpmPackage,
-  findExtractedPackage,
 } from "./lib/registry.mjs"
 import {
   runCtl,
@@ -97,8 +90,6 @@ export async function main(argv) {
         await installFromPackage({ ...options, update: false })
       } else if (shouldUseSourceInstall(options)) {
         await installFromSource(options)
-      } else if (shouldUseReleaseSync(options)) {
-        await syncFromRelease(options, "install")
       } else {
         await syncFromNpmRegistry(options, "install")
       }
@@ -108,8 +99,6 @@ export async function main(argv) {
         await installFromPackage({ ...options, update: true })
       } else if (shouldUseSourceInstall(options)) {
         await installFromSource({ ...options, update: true })
-      } else if (shouldUseReleaseSync(options)) {
-        await syncFromRelease(options, "update")
       } else {
         await syncFromNpmRegistry(options, "update")
       }
@@ -227,7 +216,12 @@ async function syncFromNpmRegistry(options, action) {
   const runtimePackage = options.runtimePackage || runtimePackageName(platformId())
   const runtimeVersion = options.runtimeVersion || installedConfig.runtimeVersion || "latest"
   const explicitRegistry = options.npmRegistry || installedConfig.npmRegistry
-  const registry = normalizeRegistry(explicitRegistry || detectNpmRegistry() || defaultNpmRegistry)
+  // Resolve against npmjs.org — the registry the runtime packages are published
+  // to. Ambient mirror config (npm_config_registry / .npmrc) is deliberately NOT
+  // adopted: mirrors lag on dist-tags (npmmirror still served "latest" = 0.6.12
+  // months after 0.15.x shipped), and trusting one turns an update into a silent
+  // rollback. Mirrors stay in the fallback chain for unreachable-network cases.
+  const registry = normalizeRegistry(explicitRegistry || defaultNpmRegistry)
   const tempRoot = mkdtempSync(path.join(os.tmpdir(), "vantaloom-npm-"))
 
   try {
@@ -240,6 +234,7 @@ async function syncFromNpmRegistry(options, action) {
       name: runtimePackage,
       version: runtimeVersion,
     })
+    assertNotDowngrade({ prefix, resolved, runtimePackage, options, action })
     await downloadNpmTarball({
       tarballUrl: resolved.tarball,
       target: archive,
@@ -268,56 +263,63 @@ async function syncFromNpmRegistry(options, action) {
   }
 }
 
-async function syncFromRelease(options, action) {
-  const prefix = safeDirectory(options.prefix ?? defaultPrefix())
-  const installedConfig = readInstalledConfig(prefix)
-  const sourceRoot = installedConfig.sourceRoot
-    ? tryAssertSourceRoot(installedConfig.sourceRoot)
-    : tryFindSourceRoot()
-  const sourceRemote = sourceRoot ? gitRemoteUrl(sourceRoot) : ""
-  const repo = options.repo || installedConfig.repo || inferGitHubRepo(options.remote ?? installedConfig.remote ?? sourceRemote) || defaultRepo
-  const releaseTag = options.releaseTag || installedConfig.releaseTag || defaultReleaseTag
-  const tempRoot = mkdtempSync(path.join(os.tmpdir(), "vantaloom-update-"))
+// A registry mirror can answer "latest" with a version far older than the one
+// already installed (npmmirror did exactly that: 0.6.12 long after 0.15.x
+// shipped), turning an update into a silent rollback. Refuse it unless the
+// caller asked for that exact version or opted in explicitly.
+function assertNotDowngrade({ prefix, resolved, runtimePackage, options, action }) {
+  if (action !== "update" || options.runtimeVersion || options.allowDowngrade) {
+    return
+  }
+  const installed = readRuntimeVersion(prefix)
+  if (!isOlderVersion(resolved.version, installed)) {
+    return
+  }
+  throw new Error(
+    `${resolved.registry} offers ${runtimePackage}@${resolved.version}, older than the installed ${installed}.\n` +
+    `  A mirror whose dist-tags lag behind npmjs.org is the usual cause.\n` +
+    `  Retry with --npm-registry https://registry.npmjs.org/, or pass --allow-downgrade to install it anyway.`
+  )
+}
 
+// Installed runtime version ("" when absent/unreadable — never block on it).
+function readRuntimeVersion(prefix) {
   try {
-    const extractRoot = path.join(tempRoot, "extract")
-    const archive = path.join(tempRoot, `vantaloom-${platformId()}.tar.gz`)
-    mkdirSync(extractRoot, { recursive: true })
-
-    await downloadReleaseAsset({
-      repo,
-      releaseTag,
-      assetName: `vantaloom-${platformId()}.tar.gz`,
-      target: archive,
-      token: options.githubToken,
-    })
-    run("tar", ["-xzf", archive, "-C", extractRoot])
-
-    const packageRoot = findExtractedPackage(extractRoot, platformId())
-    const version = await applyPackage(packageRoot, prefix, {
-      noStart: options.noStart,
-      sourceRoot: installedConfig.sourceRoot,
-      update: action === "update",
-    })
+    return readFileSync(path.join(prefix, "VERSION"), "utf8").trim()
+  } catch {
+    return ""
+  }
+}
 
-    console.log(`${action === "update" ? "updated" : "installed"} Vantaloom: ${prefix}`)
-    console.log(`version: ${version}`)
-    console.log(`source: ${repo}@${releaseTag}`)
-    ensureInPath(prefix)
-    console.log(`run: ${displayCommand(prefix)} status`)
-  } finally {
-    removeKnownPath(tempRoot, os.tmpdir())
+// candidate < installed on the X.Y.Z triple (a -/+ suffix on patch is ignored).
+// Non-semver on either side → false: never block a locally built or unversioned
+// install from being replaced.
+function isOlderVersion(candidate, installed) {
+  const parse = (value) => {
+    const parts = String(value).split(".")
+    if (parts.length < 3) {
+      return null
+    }
+    const triple = [parts[0], parts[1], parts.slice(2).join(".").split(/[-+]/)[0]].map(Number)
+    return triple.every(Number.isInteger) ? triple : null
+  }
+  const found = parse(candidate)
+  const current = parse(installed)
+  if (!found || !current) {
+    return false
+  }
+  for (let index = 0; index < 3; index += 1) {
+    if (found[index] !== current[index]) {
+      return found[index] < current[index]
+    }
   }
+  return false
 }
 
 function shouldUseSourceInstall(options) {
   return Boolean(options.local || options.source || options.buildWeb)
 }
 
-function shouldUseReleaseSync(options) {
-  return Boolean(options.repo || options.remote || options.releaseTag || options.githubToken)
-}
-
 function printPaths(options) {
   const sourceRoot = findSourceRoot(options.source)
   const prefix = safeDirectory(options.prefix ?? defaultPrefix())
@@ -338,10 +340,6 @@ function parseOptions(args) {
       case "component":
       case "package":
       case "output":
-      case "repo":
-      case "remote":
-      case "release-tag":
-      case "github-token":
       case "runtime-package":
       case "runtime-version":
       case "npm-registry":
@@ -380,6 +378,9 @@ function parseOptions(args) {
       case "no-strict-ssl":
         options.noStrictSsl = true
         break
+      case "allow-downgrade":
+        options.allowDowngrade = true
+        break
       default:
         throw new Error(`unknown option --${key}`)
     }
@@ -393,7 +394,7 @@ function printHelp() {
 Usage:
   vantaloom install   [--prefix <dir>] [--runtime-version <version>] [--npm-registry <url>] [--package <dir>] [--no-start]
   vantaloom install   --local [--prefix <dir>] [--source <repo>] [--build-web] [--no-start]
-  vantaloom update    [--prefix <dir>] [--runtime-version <version>] [--npm-registry <url>] [--no-start]
+  vantaloom update    [--prefix <dir>] [--runtime-version <version>] [--npm-registry <url>] [--no-start] [--allow-downgrade]
   vantaloom update    --local [--prefix <dir>] [--source <repo>] [--build-web] [--no-start]
   vantaloom uninstall [--prefix <dir>]
   vantaloom package   [--source <repo>] [--output <dir>] [--build-web] [--archive] [--npm-package] [--target <platform>]

package/src/lib/constants.mjs

@@ -4,8 +4,9 @@ import { fileURLToPath } from "node:url"
 export const cliRoot = path.resolve(fileURLToPath(import.meta.url), "..", "..", "..")
 export const repoCandidate = path.resolve(cliRoot, "..", "..")
 export const installedConfigPath = path.join(cliRoot, "config.json")
-export const defaultReleaseTag = "runtime-latest"
-export const defaultRepo = "Timefiles404/Vantaloom-next"
+// Runtime packages are published to npmjs.org (see docs/deployment.md). The
+// mirror is a LAST-RESORT network fallback only — its dist-tags lag, so it must
+// never be the primary source for resolving "latest".
 export const defaultNpmRegistry = "https://registry.npmjs.org"
 export const fallbackNpmRegistries = [
   "https://registry.npmmirror.com",

package/src/lib/install.mjs

@@ -10,7 +10,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs"
-import { cp, writeFile } from "node:fs/promises"
+import { cp, readdir, rm, writeFile } from "node:fs/promises"
 import { spawnSync } from "node:child_process"
 import os from "node:os"
 import path from "node:path"
@@ -19,8 +19,6 @@ import {
   cliRoot,
   repoCandidate,
   installedConfigPath,
-  defaultReleaseTag,
-  defaultRepo,
   defaultNpmRegistry,
 } from "./constants.mjs"
 import {
@@ -36,6 +34,7 @@ import {
   platformToGoEnv,
 } from "./platform.mjs"
 import {
+  killBrowserSidecarProcess,
   killTrayProcess,
   uninstallLegacyMeshOnce,
 } from "./legacy-cleanup.mjs"
@@ -135,6 +134,10 @@ export async function applyPackage(packageRoot, prefix, options) {
   // Kill lingering tray process that may hold locks on bin/ (older versions
   // don't write tray.pid, so vantaloomctl stop won't find them).
   killTrayProcess(prefix)
+  // 0.14.26: the browser moved into the official plugin — stop a pre-plugin
+  // install's orphaned vantaloom-browser sidecar + obscura engine and delete
+  // their stale bin/ binaries (nothing manages them anymore).
+  killBrowserSidecarProcess(prefix)
 
   // Windows releases a stopped process's file handles asynchronously; copying
   // bin/ the instant after `stop` can still hit the old exe's lock (EPERM). Give
@@ -262,7 +265,7 @@ export function readInstalledConfig(prefix) {
 
 export function mergeRuntimeConfig(packageConfig, existingConfig, overrides) {
   const merged = { ...packageConfig }
-  for (const key of ["sourceRoot", "remote", "repo", "releaseTag", "runtimePackage", "runtimeVersion", "npmRegistry"]) {
+  for (const key of ["sourceRoot", "runtimePackage", "runtimeVersion", "npmRegistry"]) {
     if (!merged[key] && existingConfig[key]) {
       merged[key] = existingConfig[key]
     }
@@ -279,12 +282,6 @@ export function mergeRuntimeConfig(packageConfig, existingConfig, overrides) {
   if (overrides.npmRegistry) {
     merged.npmRegistry = overrides.npmRegistry
   }
-  if (!merged.repo) {
-    merged.repo = defaultRepo
-  }
-  if (!merged.releaseTag) {
-    merged.releaseTag = defaultReleaseTag
-  }
   // Always force runtimePackage to match the running platform — a cross-compiled
   // package may carry a config for a different platform (e.g. win32 inside darwin).
   merged.runtimePackage = runtimePackageName(platformId())
@@ -294,36 +291,25 @@ export function mergeRuntimeConfig(packageConfig, existingConfig, overrides) {
   if (!merged.npmRegistry) {
     merged.npmRegistry = defaultNpmRegistry
   }
+  // Drop keys left by the removed GitHub-release channel (0.15.29). Nothing
+  // reads them any more; leaving them in config.json only invites the next
+  // reader to believe there is a second update channel.
+  for (const legacy of ["repo", "releaseTag", "remote"]) {
+    delete merged[legacy]
+  }
   return merged
 }
 
+// npmRegistry is pinned to npmjs.org rather than sniffed from the ambient npm
+// config: baking a mirror in here made every later `vantaloom update` treat it
+// as an explicit choice (skipping the fallback chain) and resolve "latest" from
+// dist-tags that lag months behind. Only --npm-registry should change it.
 export function runtimeConfigFromSource(sourceRoot) {
-  const remote = gitRemoteUrl(sourceRoot)
-  const repo = inferGitHubRepo(remote) || defaultRepo
-  // Inline registry detection to avoid circular dep with registry.mjs
-  let npmRegistry = ""
-  if (process.env.NPM_CONFIG_REGISTRY) {
-    npmRegistry = process.env.npm_config_registry || process.env.NPM_CONFIG_REGISTRY
-  } else if (process.env.npm_config_registry) {
-    npmRegistry = process.env.npm_config_registry
-  } else {
-    try {
-      const npmrcPath = path.join(os.homedir(), ".npmrc")
-      if (existsSync(npmrcPath)) {
-        const content = readFileSync(npmrcPath, "utf8")
-        const match = content.match(/^\s*registry\s*=\s*(.+)/m)
-        if (match) npmRegistry = match[1].trim()
-      }
-    } catch {}
-  }
   return {
     ...(process.env.GITHUB_ACTIONS ? {} : { sourceRoot }),
-    ...(remote ? { remote } : {}),
-    repo,
-    releaseTag: defaultReleaseTag,
     runtimePackage: runtimePackageName(platformId()),
     runtimeVersion: "latest",
-    npmRegistry: npmRegistry || defaultNpmRegistry,
+    npmRegistry: defaultNpmRegistry,
   }
 }
 
@@ -366,31 +352,6 @@ export function assertSourceRoot(sourceRoot) {
   return sourceRoot
 }
 
-export function gitRemoteUrl(sourceRoot) {
-  const result = spawnSync("git", ["remote", "get-url", "origin"], {
-    cwd: sourceRoot,
-    encoding: "utf8",
-    windowsHide: true,
-  })
-  if (result.status === 0) {
-    return result.stdout.trim()
-  }
-  return ""
-}
-
-export function inferGitHubRepo(remote) {
-  if (!remote) {
-    return ""
-  }
-  const normalized = remote.replace(/\.git$/, "")
-  const httpsMatch = normalized.match(/github\.com[:/]([^/]+\/[^/]+)$/)
-  if (httpsMatch) {
-    return httpsMatch[1]
-  }
-  const sshMatch = normalized.match(/^[^:]+:([^/]+\/[^/]+)$/)
-  return sshMatch?.[1] ?? ""
-}
-
 export async function copyStaticWeb(sourceRoot, buildWeb) {
   const exportRoot = path.join(sourceRoot, "apps", "vantaloom", "out")
   if (!existsSync(exportRoot)) {
@@ -401,6 +362,25 @@ export async function copyStaticWeb(sourceRoot, buildWeb) {
 
   removeKnownPath(buildWeb, path.dirname(buildWeb))
   await copyDir(exportRoot, buildWeb)
+  // Source maps never ship in a published runtime package. Next 不产浏览器
+  // source map，但它自带的 polyfill chunk 会漏一个 .map 进静态导出（0.15.16
+  // 实测：a6dad97d…js.map，内容是 Next 自己的 polyfill-nomodule）。那一个碰巧
+  // 只含第三方代码，但「碰巧无害」不是标准——公开 APK 的 web/ 门禁早就规定
+  // source map 一律不当无害编译产物（sourcesContent 能内嵌完整源码），npm 包
+  // 与 Docker 镜像理应同一条纪律。在打包出口统一剥掉，整类问题终结。
+  await removeFilesByExtension(buildWeb, ".map")
+}
+
+async function removeFilesByExtension(root, extension) {
+  const entries = await readdir(root, { withFileTypes: true })
+  for (const entry of entries) {
+    const full = path.join(root, entry.name)
+    if (entry.isDirectory()) {
+      await removeFilesByExtension(full, extension)
+    } else if (entry.name.endsWith(extension)) {
+      await rm(full, { force: true })
+    }
+  }
 }
 
 export async function copyCliDirectory(target, sourceRoot, config) {
@@ -528,6 +508,10 @@ export function buildGo(sourceRoot, buildBin, name, targetPlatform) {
   let ldflags = "-s -w"
   const args = ["build"]
   args.push(
+    // -trimpath：不把构建机的绝对路径写进二进制。没有它，每个发布出去的
+    // 二进制里都是上千处 D:/Projects/…（0.15.16 实测 1954 处）——纯元数据
+    // 泄露（构建机目录结构），且路径逐台机器不同也破坏可复现构建。
+    "-trimpath",
     "-ldflags", ldflags,
     "-o", path.join(buildBin, `${name}${ext}`),
     `./apps/api/cmd/${name}`

package/src/lib/legacy-cleanup.mjs

@@ -51,6 +51,54 @@ export function killTrayProcess(prefix) {
   }
 }
 
+// killBrowserSidecarProcess (0.14.26) stops a pre-plugin install's
+// vantaloom-browser HTTP sidecar (port 8782) + its obscura engine processes,
+// and deletes the stale bin/ binaries the runtime no longer ships. The browser
+// moved into the official PLUGIN (@vantaloom/browser-plugin-*); without this,
+// an updated runtime would leave the orphaned sidecar+engine running until
+// reboot (nothing manages them anymore) and ~170MB of dead binaries in bin/.
+// Best-effort + idempotent, mirrors killTrayProcess.
+export function killBrowserSidecarProcess(prefix) {
+  if (process.platform === "win32") {
+    const pidFile = path.join(prefix, "runtime", "browser.pid")
+    if (existsSync(pidFile)) {
+      const pid = readFileSync(pidFile, "utf8").trim()
+      if (pid) {
+        spawnSync("taskkill", ["/T", "/F", "/PID", pid], { stdio: "ignore", windowsHide: true })
+      }
+      try { rmSync(pidFile, { force: true }) } catch {}
+    }
+    for (const image of ["vantaloom-browser.exe", "obscura.exe", "obscura-worker.exe"]) {
+      const result = spawnSync("tasklist", ["/FI", `IMAGENAME eq ${image}`, "/FO", "CSV", "/NH"], {
+        encoding: "utf8",
+        windowsHide: true,
+      })
+      if (result.stdout) {
+        for (const line of result.stdout.split("\n")) {
+          const match = line.match(/"[^"]+","(\d+)"/)
+          if (match) {
+            spawnSync("taskkill", ["/T", "/F", "/PID", match[1]], { stdio: "ignore", windowsHide: true })
+          }
+        }
+      }
+    }
+  } else {
+    spawnSync("pkill", ["-f", "vantaloom-browser"], { stdio: "ignore", windowsHide: true })
+    spawnSync("pkill", ["-f", "obscura"], { stdio: "ignore", windowsHide: true })
+  }
+  // Stale files: the sidecar/engine binaries + its port file (bin/ copies are
+  // overlay-only on update, they'd linger forever otherwise).
+  const binDir = path.join(prefix, "bin")
+  for (const name of [
+    "vantaloom-browser.exe", "vantaloom-browser",
+    "obscura.exe", "obscura",
+    "obscura-worker.exe", "obscura-worker",
+  ]) {
+    try { rmSync(path.join(binDir, name), { force: true }) } catch {}
+  }
+  try { rmSync(path.join(prefix, "runtime", "browser.port"), { force: true }) } catch {}
+}
+
 // meshServiceRunningOrInstalled reports whether the Windows service exists at
 // all (running or stopped), so removeMeshService only prompts for elevation
 // when there is actually something to remove.

package/src/lib/lifecycle.mjs

@@ -21,6 +21,7 @@ import {
 } from "./platform.mjs"
 import {
   removeMeshService,
+  killBrowserSidecarProcess,
   killTrayProcess,
 } from "./legacy-cleanup.mjs"
 
@@ -151,6 +152,7 @@ export async function uninstallRuntime(options) {
     spawnSync(ctlBin, ["stop", "--prefix", prefix], { stdio: "inherit", windowsHide: true })
   }
   killTrayProcess(prefix)
+  killBrowserSidecarProcess(prefix)
 
   // 2. Remove a legacy privileged mesh service if this install predates 0.13
   // (releases the TUN adapter + file locks). A no-op on any install that

package/src/lib/package.mjs

@@ -1,98 +1,56 @@
-import { existsSync, mkdirSync } from "node:fs"
-import { cp } from "node:fs/promises"
-import path from "node:path"
-import { platformId, removeKnownPath, runPnpm } from "./platform.mjs"
-import {
-  buildGo,
-  copyStaticWeb,
-  copyCliDirectory,
-  writeBuildManifest,
-  writeRuntimePackageMetadata,
-  runtimeConfigFromSource,
-  gitVersion,
-  npmPackageVersion,
-} from "./install.mjs"
-
-export async function buildRuntimePackage(sourceRoot, packageRoot, options) {
-  // Every build — npm release AND local/dev — stamps VERSION/manifest with the
-  // npm package version. There is exactly ONE product version (the npm semver);
-  // the git hash is recorded separately as manifest `commit` for diagnostics.
-  // History: pre-0.13.5 local builds stamped the git hash into VERSION, which
-  // split the version universe in two (the desktop shell read VERSION, the
-  // settings page read cli/package.json) and broke update prompts both ways.
-  const version = npmPackageVersion(sourceRoot)
-  const commit = gitVersion(sourceRoot)
-  const platform = options.target ?? platformId()
-  const buildBin = path.join(packageRoot, "bin")
-  const buildWeb = path.join(packageRoot, "web")
-
-  removeKnownPath(packageRoot, path.dirname(packageRoot))
-  mkdirSync(buildBin, { recursive: true })
-
-  buildGo(sourceRoot, buildBin, "vantaloom-api", platform)
-  buildGo(sourceRoot, buildBin, "vantaloom-agent", platform)
-  buildGo(sourceRoot, buildBin, "vantaloomctl", platform)
-  // Official "Vantaloom 浏览器" extension sidecar. Pure-Go (chromedp/CDP, no
-  // CGO), cross-compiles for every target. Ships dormant: it's only started by
-  // the api when the user installs+enables the browser extension (the heavy
-  // Chromium binary is downloaded on demand, NOT bundled here).
-  buildGo(sourceRoot, buildBin, "vantaloom-browser", platform)
-  // The Windows system-tray app (vantaloom-tray) was removed — it crash-looped
-  // on some Windows 11 builds and got respawned until OOM. No longer built.
-
-  // Bundle the Obscura headless browser (the official "Vantaloom 浏览器" engine,
-  // driven by the vantaloom-browser sidecar over CDP) for the target platform.
-  await copyObscura(sourceRoot, buildBin, platform)
-
-  if (options.buildWeb) {
-    runPnpm(["--filter", "vantaloom-app", "build"], { cwd: sourceRoot })
-  }
-
-  await copyStaticWeb(sourceRoot, buildWeb)
-  await copyCliDirectory(path.join(packageRoot, "cli"), sourceRoot, runtimeConfigFromSource(sourceRoot))
-  writeBuildManifest(packageRoot, version, platform, commit)
-
-  return { platform, version }
-}
-
-// copyObscura bundles the vendored Obscura headless-browser binaries
-// (obscura + obscura-worker, .exe on Windows) for the target platform into the
-// package bin/ dir. Obscura is the official "Vantaloom 浏览器" engine: a
-// CDP-compatible, V8-backed headless browser the vantaloom-browser sidecar
-// launches via `obscura serve` and drives over CDP. Warns + skips if the
-// vendor dir is absent (a cleaned vendor/ silently ships a runtime with no
-// browser engine).
-export async function copyObscura(sourceRoot, buildBin, platform) {
-  const vendorMap = {
-    "win32-x64": "windows-x86_64",
-    "darwin-arm64": "macos-aarch64",
-    "linux-x64": "linux-x86_64",
-  }
-  const vendorName = vendorMap[platform]
-  if (!vendorName) {
-    console.warn(`  warning: no Obscura mapping for ${platform}; browser engine disabled for this platform`)
-    return
-  }
-  const srcDir = path.join(sourceRoot, "vendor", "obscura", vendorName)
-  if (!existsSync(srcDir)) {
-    console.warn(`  warning: Obscura binaries not found at ${srcDir}; run vendor download first`)
-    return
-  }
-  const isWin = platform.startsWith("win32")
-  const exe = isWin ? ".exe" : ""
-  // Both binaries MUST ship together: obscura is the CLI/CDP server, obscura-worker
-  // is the V8 render worker it spawns. Without the worker, `obscura serve` cannot
-  // open pages.
-  const files = [`obscura${exe}`, `obscura-worker${exe}`]
-  let copied = 0
-  for (const f of files) {
-    const src = path.join(srcDir, f)
-    if (!existsSync(src)) {
-      console.warn(`  warning: Obscura file missing: ${f}`)
-      continue
-    }
-    await cp(src, path.join(buildBin, f), { force: true })
-    copied++
-  }
-  console.log(`  bundled Obscura ${vendorName} (${copied} files)`)
-}
+import { mkdirSync } from "node:fs"
+import path from "node:path"
+import { platformId, removeKnownPath, runPnpm } from "./platform.mjs"
+import {
+  buildGo,
+  copyStaticWeb,
+  copyCliDirectory,
+  writeBuildManifest,
+  writeRuntimePackageMetadata,
+  runtimeConfigFromSource,
+  gitVersion,
+  npmPackageVersion,
+} from "./install.mjs"
+
+export async function buildRuntimePackage(sourceRoot, packageRoot, options) {
+  // Every build — npm release AND local/dev — stamps VERSION/manifest with the
+  // npm package version. There is exactly ONE product version (the npm semver);
+  // the git hash is recorded separately as manifest `commit` for diagnostics.
+  // History: pre-0.13.5 local builds stamped the git hash into VERSION, which
+  // split the version universe in two (the desktop shell read VERSION, the
+  // settings page read cli/package.json) and broke update prompts both ways.
+  const version = npmPackageVersion(sourceRoot)
+  const commit = gitVersion(sourceRoot)
+  const platform = options.target ?? platformId()
+  const buildBin = path.join(packageRoot, "bin")
+  const buildWeb = path.join(packageRoot, "web")
+
+  removeKnownPath(packageRoot, path.dirname(packageRoot))
+  mkdirSync(buildBin, { recursive: true })
+
+  buildGo(sourceRoot, buildBin, "vantaloom-api", platform)
+  buildGo(sourceRoot, buildBin, "vantaloom-agent", platform)
+  buildGo(sourceRoot, buildBin, "vantaloomctl", platform)
+  // vantaloom-mcp：跨机执行信道的 MCP 服务端（agent-bridge）。随 runtime bin 分发，
+  // 外部 agent（Claude Code / Codex / Cursor）配置指向它即可驱动整个组网。
+  buildGo(sourceRoot, buildBin, "vantaloom-mcp", platform)
+  // 0.14.26: the browser moved into the official optional PLUGIN
+  // (@vantaloom/browser-plugin-<platform>, built by scripts/build-browser-plugin.ps1) —
+  // the runtime no longer builds the vantaloom-browser sidecar nor bundles the
+  // Obscura engine. The Windows system-tray app (vantaloom-tray) was removed
+  // earlier — it crash-looped on some Windows 11 builds. Neither is built here.
+
+  if (options.buildWeb) {
+    runPnpm(["--filter", "vantaloom-app", "build"], { cwd: sourceRoot })
+  }
+
+  await copyStaticWeb(sourceRoot, buildWeb)
+  await copyCliDirectory(path.join(packageRoot, "cli"), sourceRoot, runtimeConfigFromSource(sourceRoot))
+  writeBuildManifest(packageRoot, version, platform, commit)
+
+  return { platform, version }
+}
+
+// copyObscura was removed in 0.14.26: the Obscura engine ships inside the
+// official browser PLUGIN packages (scripts/build-browser-plugin.ps1), not the
+// runtime.

package/src/lib/registry.mjs

@@ -1,48 +1,10 @@
 import {
   existsSync,
-  readFileSync,
   readdirSync,
 } from "node:fs"
 import { writeFile } from "node:fs/promises"
-import os from "node:os"
 import path from "node:path"
 
-export function detectNpmRegistry() {
-  // 1. NPM_CONFIG_REGISTRY env var (highest priority, set by npm/npx when running)
-  if (process.env.NPM_CONFIG_REGISTRY) {
-    return process.env.npm_config_registry || process.env.NPM_CONFIG_REGISTRY
-  }
-  // npm also sets the lowercase variant
-  if (process.env.npm_config_registry) {
-    return process.env.npm_config_registry
-  }
-
-  // 2. Read user .npmrc
-  try {
-    const npmrcPaths = [
-      path.join(os.homedir(), ".npmrc"),
-    ]
-    // Also check project-level .npmrc
-    const localNpmrc = path.resolve(".npmrc")
-    if (localNpmrc !== npmrcPaths[0]) {
-      npmrcPaths.unshift(localNpmrc)
-    }
-    for (const npmrcPath of npmrcPaths) {
-      if (existsSync(npmrcPath)) {
-        const content = readFileSync(npmrcPath, "utf8")
-        const match = content.match(/^\s*registry\s*=\s*(.+)/m)
-        if (match) {
-          return match[1].trim()
-        }
-      }
-    }
-  } catch {
-    // Ignore .npmrc read errors
-  }
-
-  return ""
-}
-
 export async function resolveNpmPackageWithFallback({ registries, name, version }) {
   const errors = []
   for (const registry of registries) {
@@ -133,91 +95,51 @@ export async function resolveNpmPackage({ registry, name, version }) {
   }
 }
 
+// The runtime tarball is tens of MB (Go binaries + the exported web bundle), so
+// the budget has to cover a slow link end to end — the old 120s cap aborted
+// mid-body on ordinary connections and made updates fail for anyone far from
+// npmjs.org.
+const TARBALL_DOWNLOAD_TIMEOUT_MS = 15 * 60 * 1000
+
 export async function downloadNpmTarball({ tarballUrl, target, packageName, version }) {
   console.log(`  downloading ${packageName}@${version}...`)
-  let response
+  // One deadline for headers AND body: the abort fires during arrayBuffer() far
+  // more often than during fetch(), so both live inside the same try — otherwise
+  // the failure escapes as a bare "The operation was aborted due to timeout"
+  // with no hint of what was being downloaded or what to do about it.
   try {
-    response = await fetch(tarballUrl, {
+    const response = await fetch(tarballUrl, {
       headers: {
         "User-Agent": "vantaloom-cli",
       },
-      signal: AbortSignal.timeout(120000),
+      signal: AbortSignal.timeout(TARBALL_DOWNLOAD_TIMEOUT_MS),
     })
+    if (!response.ok) {
+      const detail = await response.text().catch(() => "")
+      throw new Error(`failed to download ${packageName}@${version}: HTTP ${response.status}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
+    }
+    const buffer = Buffer.from(await response.arrayBuffer())
+    await writeFile(target, buffer)
+    console.log(`  downloaded ${(buffer.length / 1024 / 1024).toFixed(1)} MB`)
   } catch (error) {
+    if (error instanceof Error && error.message.startsWith("failed to download")) {
+      throw error
+    }
     const causeCode = error?.cause?.code || ""
-    const causeMsg = causeCode || error?.cause?.message || error.message || ""
+    const causeMsg = causeCode || error?.cause?.message || error?.message || ""
     const isSsl = causeCode.includes("CERT") || causeCode === "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
-    const hint = isSsl ? `\n  Fix: run with --no-strict-ssl` : ""
+    const isTimeout = error?.name === "TimeoutError" || /aborted due to timeout/i.test(String(error?.message))
+    let hint = ""
+    if (isSsl) {
+      hint = `\n  Fix: run with --no-strict-ssl`
+    } else if (isTimeout) {
+      hint =
+        `\n  The transfer exceeded ${TARBALL_DOWNLOAD_TIMEOUT_MS / 60000} minutes.` +
+        `\n  Retry, or fetch the same version from a closer mirror:` +
+        `\n    vantaloom update --runtime-version ${version} --npm-registry https://registry.npmmirror.com/`
+    }
     throw new Error(`failed to download ${packageName}@${version} from ${tarballUrl}: ${causeMsg}${hint}`)
   }
-  if (!response.ok) {
-    const detail = await response.text().catch(() => "")
-    throw new Error(`failed to download ${packageName}@${version}: HTTP ${response.status}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
-  }
-
-  const buffer = Buffer.from(await response.arrayBuffer())
-  await writeFile(target, buffer)
-  console.log(`  downloaded ${(buffer.length / 1024 / 1024).toFixed(1)} MB`)
-}
-
-export async function downloadReleaseAsset({ repo, releaseTag, assetName, target, token }) {
-  const releaseUrl = `https://api.github.com/repos/${repo}/releases/tags/${releaseTag}`
-  const headers = {
-    "User-Agent": "vantaloom-cli",
-  }
-  const githubToken = token || process.env.VANTALOOM_GITHUB_TOKEN || process.env.GITHUB_TOKEN
-  if (githubToken) {
-    headers.Authorization = `Bearer ${githubToken}`
-  }
-
-  const releaseResponse = await fetch(releaseUrl, { headers })
-  if (!releaseResponse.ok) {
-    const detail = await releaseResponse.text().catch(() => "")
-    const authHint = releaseResponse.status === 404 || releaseResponse.status === 403
-      ? " If the repository is private, set VANTALOOM_GITHUB_TOKEN to a GitHub token that can read releases."
-      : ""
-    throw new Error(`failed to inspect ${repo}@${releaseTag}: HTTP ${releaseResponse.status}.${authHint}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
-  }
-
-  const release = await releaseResponse.json()
-  const asset = release.assets?.find((asset) => asset.name === assetName)
-  if (!asset) {
-    const names = release.assets?.map((asset) => asset.name).join(", ") || "none"
-    throw new Error(`missing release asset ${assetName} in ${repo}@${releaseTag}; available assets: ${names}`)
-  }
-
-  const response = await fetch(asset.url, {
-    headers: {
-      ...headers,
-      Accept: "application/octet-stream",
-    },
-  })
-  if (!response.ok) {
-    const detail = await response.text().catch(() => "")
-    const authHint = response.status === 404 || response.status === 403
-      ? " If the repository is private, set VANTALOOM_GITHUB_TOKEN to a GitHub token that can read releases."
-      : ""
-    throw new Error(`failed to download ${assetName} from ${repo}@${releaseTag}: HTTP ${response.status}.${authHint}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
-  }
-
-  const buffer = Buffer.from(await response.arrayBuffer())
-  await writeFile(target, buffer)
-}
-
-export function findExtractedPackage(extractRoot, platform) {
-  const expected = path.join(extractRoot, `vantaloom-${platform}`)
-  if (existsSync(expected)) {
-    return expected
-  }
-
-  const directories = readdirSync(extractRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => path.join(extractRoot, entry.name))
-  if (directories.length === 1) {
-    return directories[0]
-  }
-
-  throw new Error(`could not find extracted Vantaloom package in ${extractRoot}`)
 }
 
 export function findExtractedNpmPackage(extractRoot) {