@whyvix/remote 0.3.19 → 0.3.21

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@whyvix/remote",
-      "version": "0.3.19",
+      "version": "0.3.21",
       "dependencies": {
         "@modelcontextprotocol/ext-apps": "^2.0.0",
         "@modelcontextprotocol/sdk": "^1.30.0",

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "private": false,
   "type": "module",
   "files": [
     "packages/agent/src",
     "packages/cli/index.js",
+    "packages/cli/update-supervisor.js",
     "packages/cli/browser.js",
     "packages/cli/presenter.js",
     "packages/protocol/src",
@@ -28,7 +29,7 @@
     "test:r10-gui-window-focus": "node scripts/r10-gui-window-action-contract-test.js && node scripts/r10-gui-window-action-source-test.js && node scripts/r10-gui-window-action-agent-capability-test.js && node scripts/r10-gui-window-action-authorization-test.js && node scripts/r10-gui-window-action-loader-test.js && node scripts/r10-gui-window-action-mcp-schema-test.js && node scripts/r10-gui-window-action-cli-wiring-test.js && node scripts/r10-deployment-certify-authorization-test.js && node scripts/r10-deployment-certify-protocol-test.js && node scripts/r10-deployment-activation-response-test.js",
     "test:r10-documents": "node scripts/r10-precision-document-inspect-test.js && node scripts/r10-precision-document-compare-test.js && node scripts/r10-precision-docx-mutation-test.js && node scripts/r10-precision-xlsx-mutation-test.js && node scripts/r10-precision-pptx-mutation-test.js",
     "test:r10-observability": "node scripts/r10-write-preview-test.js && node scripts/r10-cli-presentation-test.js && node scripts/r10-usage-metering-test.js",
-    "test:r10-self-update": "node scripts/r10-self-update-manager-test.js && node scripts/r10-update-supervisor-test.js && node scripts/r10-update-lifecycle-test.js && node scripts/r10-update-activation-plan-test.js && node scripts/r10-update-bootstrap-executor-test.js && node scripts/r10-update-supervisor-host-test.js && node scripts/r10-update-archive-policy-test.js && node scripts/r10-update-persistence-test.js"
+    "test:r10-self-update": "node scripts/r10-self-update-manager-test.js && node scripts/r10-update-supervisor-test.js && node scripts/r10-update-lifecycle-test.js && node scripts/r10-update-activation-plan-test.js && node scripts/r10-update-bootstrap-executor-test.js && node scripts/r10-update-supervisor-host-test.js && node scripts/r10-update-archive-policy-test.js && node scripts/r10-update-persistence-test.js && node scripts/r10-rollback-runtime-snapshot-test.js && node scripts/r10-windows-detached-survival-test.js"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^2.0.0",

package/packages/agent/src/rollback-runtime-snapshot.js

@@ -0,0 +1,40 @@
+import path from "node:path";
+import crypto from "node:crypto";
+import { access, readFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+
+function fail(code,message){throw Object.assign(new Error(message),{code});}
+function sha256(bytes){return crypto.createHash("sha256").update(bytes).digest("hex");}
+function inside(root,file){const rel=path.relative(path.resolve(root),path.resolve(file));return rel&&!rel.startsWith("..")&&!path.isAbsolute(rel);}
+
+export class RollbackRuntimeSnapshot{
+  constructor({homeDir,nodeExecPath=process.execPath,spawnFn=spawn,audit=()=>{}}={}){
+    if(!homeDir)fail("UPDATE_SNAPSHOT_INVALID","Home directory is required");
+    this.homeDir=homeDir;this.nodeExecPath=nodeExecPath;this.spawnFn=spawnFn;this.audit=audit;
+  }
+  snapshotPath(version){return path.join(this.homeDir,".whyvix-remote","updates",String(version),"runtime-snapshot.json");}
+  async verify({version}={}){
+    const file=this.snapshotPath(version);let snapshot;
+    try{snapshot=JSON.parse(await readFile(file,"utf8"));}catch{fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime snapshot is missing or invalid");}
+    if(snapshot?.schema!==1||snapshot.version!==version||!snapshot.packageRoot||!snapshot.launcher||!snapshot.packageLock||!snapshot.packageLockSha256||!snapshot.criticalFiles)fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime snapshot identity is invalid");
+    if(!inside(snapshot.sourceRoot,snapshot.packageRoot)||!inside(snapshot.packageRoot,snapshot.launcher)||!inside(snapshot.sourceRoot,snapshot.packageLock))fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime snapshot paths escape their trusted roots");
+    const lock=await readFile(snapshot.packageLock);if(sha256(lock)!==snapshot.packageLockSha256)fail("UPDATE_SNAPSHOT_TAMPERED","Rollback runtime lockfile hash mismatch");
+    const meta=JSON.parse(await readFile(path.join(snapshot.packageRoot,"package.json"),"utf8"));
+    if(meta?.name!=="@whyvix/remote"||meta?.version!==version||meta?.bin?.["whyvix-remote"]!=="packages/cli/index.js")fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime package identity is invalid");
+    const modulesRoot=path.join(snapshot.sourceRoot,"node_modules");for(const name of Object.keys(meta.dependencies||{})){const parts=name.startsWith("@")?name.split("/"): [name];try{await access(path.join(modulesRoot,...parts));}catch{fail("UPDATE_SNAPSHOT_DEPENDENCY_MISSING",`Rollback runtime dependency is missing: ${name}`);}}
+    for(const [relative,expected] of Object.entries(snapshot.criticalFiles)){
+      const target=path.resolve(snapshot.packageRoot,relative);if(!inside(snapshot.packageRoot,target))fail("UPDATE_SNAPSHOT_INVALID","Rollback critical file escapes package root");
+      const bytes=await readFile(target);if(sha256(bytes)!==expected)fail("UPDATE_SNAPSHOT_TAMPERED",`Rollback runtime critical file changed: ${relative}`);
+    }
+    await access(snapshot.launcher);
+    const fingerprint=sha256(Buffer.from(JSON.stringify({schema:snapshot.schema,version:snapshot.version,sourceRoot:snapshot.sourceRoot,packageRoot:snapshot.packageRoot,launcher:snapshot.launcher,packageLock:snapshot.packageLock,packageLockSha256:snapshot.packageLockSha256,criticalFiles:snapshot.criticalFiles})));
+    return{...snapshot,fingerprint};
+  }
+  async launch({version,cwd=process.cwd()}={}){
+    const snapshot=await this.verify({version});
+    const child=this.spawnFn(this.nodeExecPath,[snapshot.launcher,"remote"],{cwd,windowsHide:true,shell:false,detached:true,stdio:"ignore",env:{...process.env}});
+    if(!Number.isInteger(child?.pid)||child.pid<=0)fail("UPDATE_ROLLBACK_START_FAILED","Rollback runtime did not return a valid pid");
+    child.unref?.();this.audit({event:"update.rollback_runtime_started",version,pid:child.pid,fingerprint:snapshot.fingerprint});
+    return{version,pid:child.pid,launcher:snapshot.launcher,snapshotFingerprint:snapshot.fingerprint};
+  }
+}

package/packages/agent/src/self-update-manager.js

@@ -2,10 +2,10 @@ import os from "node:os";
 import path from "node:path";
 import crypto from "node:crypto";
 import { gunzipSync } from "node:zlib";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { spawn, execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { readUpdateTarEntries, validateUpdateArchiveEntries } from "./update-archive-policy.js";
+import { extractValidatedUpdateTar } from "./update-archive-policy.js";
 const execFileAsync=promisify(execFile);
 
 const PACKAGE_NAME="@whyvix/remote";
@@ -15,6 +15,10 @@ const VERSION=/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 function safeVersion(value){const version=String(value||"").trim();if(!VERSION.test(version))fail("UPDATE_VERSION_INVALID","Explicit semver version is required");return version;}
 function digest(buffer){return crypto.createHash("sha512").update(buffer).digest("base64");}
+async function resolveNpmCli(nodeExecPath){
+  const cli=path.join(path.dirname(nodeExecPath),"node_modules","npm","bin","npm-cli.js");
+  try{await access(cli);return cli;}catch{fail("UPDATE_NPM_UNAVAILABLE","Trusted npm CLI was not found beside the active Node runtime");}
+}
 
 export class SelfUpdateManager{
   constructor({fetchFn=fetch,spawnFn=spawn,nodeExecPath=process.execPath,homeDir=os.homedir(),registry=REGISTRY,audit=()=>{}}={}){
@@ -56,15 +60,15 @@ export class SelfUpdateManager{
   async materialize({version}={}){
     const prepared=await this.verifyPrepared({version});version=prepared.version;
     const root=this.updateRoot(version),extractRoot=path.join(root,"extracted");
-    validateUpdateArchiveEntries(readUpdateTarEntries(gunzipSync(await readFile(prepared.artifact))));
+    const tarBytes=gunzipSync(await readFile(prepared.artifact));
     await rm(extractRoot,{recursive:true,force:true});await mkdir(extractRoot,{recursive:true,mode:0o700});
-    try{await execFileAsync("tar",["-xzf",prepared.artifact,"-C",extractRoot],{windowsHide:true,maxBuffer:1024*1024});}
-    catch{await rm(extractRoot,{recursive:true,force:true});fail("UPDATE_EXTRACT_FAILED","Verified package could not be extracted");}
+    try{await extractValidatedUpdateTar(tarBytes,extractRoot);}
+    catch(error){await rm(extractRoot,{recursive:true,force:true});if(String(error?.code||"").startsWith("UPDATE_ARCHIVE_"))throw error;fail("UPDATE_EXTRACT_FAILED","Verified package could not be extracted");}
     const packageRoot=path.join(extractRoot,"package"),meta=JSON.parse(await readFile(path.join(packageRoot,"package.json"),"utf8"));
     if(meta?.name!==PACKAGE_NAME||meta?.version!==version||meta?.bin?.["whyvix-remote"]!=="packages/cli/index.js"){await rm(extractRoot,{recursive:true,force:true});fail("UPDATE_PACKAGE_INVALID","Extracted package identity or launcher is invalid");}
     const launcher=path.join(packageRoot,"packages","cli","index.js");await readFile(launcher);
-    try{await execFileAsync("npm",["ci","--omit=dev","--ignore-scripts","--no-audit","--no-fund"],{cwd:packageRoot,windowsHide:true,maxBuffer:4*1024*1024});}
-    catch{await rm(extractRoot,{recursive:true,force:true});fail("UPDATE_DEPENDENCIES_FAILED","Verified package dependencies could not be installed deterministically");}
+    try{const npmCli=await resolveNpmCli(this.nodeExecPath);await execFileAsync(this.nodeExecPath,[npmCli,"ci","--omit=dev","--ignore-scripts","--no-audit","--no-fund"],{cwd:packageRoot,windowsHide:true,maxBuffer:4*1024*1024});}
+    catch(error){await rm(extractRoot,{recursive:true,force:true});if(error?.code==="UPDATE_NPM_UNAVAILABLE")throw error;fail("UPDATE_DEPENDENCIES_FAILED","Verified package dependencies could not be installed deterministically");}
     this.audit({event:"update.materialized",version});return{...prepared,packageRoot,launcher};
   }
   launchReplacement({version,cwd=process.cwd()}={}){

package/packages/agent/src/update-activation-plan.js

@@ -7,18 +7,18 @@ function semver(value){const v=String(value||"").trim();if(!/^(?:0|[1-9]\d*)\.(?
 function canonical(value){return JSON.stringify(value,Object.keys(value).sort());}
 
 export class UpdateActivationPlan{
-  constructor({manager,homeDir,now=()=>Date.now(),audit=()=>{}}={}){
+  constructor({manager,rollbackRuntime=null,homeDir,now=()=>Date.now(),audit=()=>{}}={}){
     if(!manager)fail("UPDATE_MANAGER_REQUIRED","Self-update manager is required");
-    this.manager=manager;this.homeDir=homeDir||manager.homeDir;this.now=now;this.audit=audit;
+    this.manager=manager;this.rollbackRuntime=rollbackRuntime;this.homeDir=homeDir||manager.homeDir;this.now=now;this.audit=audit;
   }
   planPath(){return path.join(this.homeDir,".whyvix-remote","activation-plan.json");}
   async create({currentVersion,targetVersion,deviceId}={}){
     currentVersion=semver(currentVersion);targetVersion=semver(targetVersion);
     if(currentVersion===targetVersion)fail("UPDATE_TARGET_SAME","Target version must differ from current version");
     if(!String(deviceId||"").trim())fail("UPDATE_DEVICE_INVALID","Device id is required");
-    const current=await this.manager.verifyPrepared({version:currentVersion});
+    const current=this.rollbackRuntime?await this.rollbackRuntime.verify({version:currentVersion}):await this.manager.verifyPrepared({version:currentVersion});
     const target=await this.manager.verifyPrepared({version:targetVersion});
-    const plan={schema:1,deviceId:String(deviceId),currentVersion,targetVersion,currentIntegrity:current.integrity,targetIntegrity:target.integrity,createdAt:this.now()};
+    const plan={schema:this.rollbackRuntime?2:1,deviceId:String(deviceId),currentVersion,targetVersion,currentIntegrity:current.integrity||null,currentSnapshotFingerprint:current.fingerprint||null,targetIntegrity:target.integrity,createdAt:this.now()};
     const fingerprint=crypto.createHash("sha256").update(canonical(plan)).digest("hex");
     const envelope={...plan,fingerprint};
     await writeJsonAtomic(this.planPath(),envelope);
@@ -29,13 +29,15 @@ export class UpdateActivationPlan{
     const envelope=await readJsonStrict(this.planPath(),{missing:null,invalidCode:"UPDATE_PLAN_INVALID"});
     if(!envelope)fail("UPDATE_PLAN_INVALID","Activation plan is missing");
     const {fingerprint,...plan}=envelope;
-    if(plan.schema!==1||!String(plan.deviceId||"").trim())fail("UPDATE_PLAN_INVALID","Activation plan identity is invalid");
+    if(![1,2].includes(plan.schema)||!String(plan.deviceId||"").trim())fail("UPDATE_PLAN_INVALID","Activation plan identity is invalid");
     plan.currentVersion=semver(plan.currentVersion);plan.targetVersion=semver(plan.targetVersion);
     const expected=crypto.createHash("sha256").update(canonical(plan)).digest("hex");
     if(fingerprint!==expected)fail("UPDATE_PLAN_INVALID","Activation plan fingerprint mismatch");
-    const current=await this.manager.verifyPrepared({version:plan.currentVersion});
+    const current=plan.schema===2&&this.rollbackRuntime?await this.rollbackRuntime.verify({version:plan.currentVersion}):await this.manager.verifyPrepared({version:plan.currentVersion});
     const target=await this.manager.verifyPrepared({version:plan.targetVersion});
-    if(current.integrity!==plan.currentIntegrity||target.integrity!==plan.targetIntegrity)fail("UPDATE_PLAN_INVALID","Prepared package integrity no longer matches activation plan");
+    if(plan.schema===2&&current.fingerprint!==plan.currentSnapshotFingerprint)fail("UPDATE_PLAN_INVALID","Rollback runtime snapshot no longer matches activation plan");
+    if(plan.schema===1&&current.integrity!==plan.currentIntegrity)fail("UPDATE_PLAN_INVALID","Prepared current package integrity no longer matches activation plan");
+    if(target.integrity!==plan.targetIntegrity)fail("UPDATE_PLAN_INVALID","Prepared target package integrity no longer matches activation plan");
     return envelope;
   }
 }

package/packages/agent/src/update-archive-policy.js

@@ -1,3 +1,6 @@
+import path from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 
 export function validateUpdateArchiveEntries(entries){
@@ -13,7 +16,7 @@ export function validateUpdateArchiveEntries(entries){
   return{valid:true,count:entries.length};
 }
 
-export function readUpdateTarEntries(buffer){
+function readUpdateTarEntryDetails(buffer){
   if(!Buffer.isBuffer(buffer)||buffer.length<512)fail("UPDATE_ARCHIVE_INVALID","Tar archive bytes are required");
   const entries=[];
   for(let offset=0;offset+512<=buffer.length;){
@@ -25,11 +28,30 @@ export function readUpdateTarEntries(buffer){
     if(!Number.isFinite(size)||size<0)fail("UPDATE_ARCHIVE_INVALID","Tar entry size is invalid");
     const typeFlag=String.fromCharCode(header[156]||48);
     if(!["0","1","2","5","\u0000"].includes(typeFlag))fail("UPDATE_ARCHIVE_TYPE_DENIED",`Unsupported tar entry type: ${typeFlag}`);
+    const checksumText=text(148,8).trim();const expectedChecksum=checksumText?Number.parseInt(checksumText,8):NaN;
+    const checksumHeader=Buffer.from(header);checksumHeader.fill(32,148,156);let actualChecksum=0;for(const byte of checksumHeader)actualChecksum+=byte;
+    if(!Number.isFinite(expectedChecksum)||expectedChecksum!==actualChecksum)fail("UPDATE_ARCHIVE_INVALID","Tar header checksum is invalid");
     const type=typeFlag==="2"?"symlink":typeFlag==="1"?"hardlink":typeFlag==="5"?"directory":"file";
-    entries.push({name:full,type});
+    const dataOffset=offset+512;if(dataOffset+size>buffer.length)fail("UPDATE_ARCHIVE_INVALID","Tar entry payload is truncated");
+    entries.push({name:full,type,size,dataOffset});
     offset+=512+Math.ceil(size/512)*512;
   }
   if(entries.length<1)fail("UPDATE_ARCHIVE_INVALID","Tar archive has no entries");
   return entries;
 }
 
+export function readUpdateTarEntries(buffer){return readUpdateTarEntryDetails(buffer).map(({name,type})=>({name,type}));}
+
+export async function extractValidatedUpdateTar(buffer,destination){
+  const entries=readUpdateTarEntryDetails(buffer);validateUpdateArchiveEntries(entries);
+  const root=path.resolve(destination);await mkdir(root,{recursive:true,mode:0o700});
+  for(const entry of entries){
+    const target=path.resolve(root,...entry.name.replaceAll("\\","/").split("/").filter(Boolean));
+    if(target!==root&&!target.startsWith(root+path.sep))fail("UPDATE_ARCHIVE_PATH_DENIED","Archive entry escapes extraction root");
+    if(entry.type==="directory"){await mkdir(target,{recursive:true,mode:0o700});continue;}
+    await mkdir(path.dirname(target),{recursive:true,mode:0o700});
+    await writeFile(target,buffer.subarray(entry.dataOffset,entry.dataOffset+entry.size),{flag:"wx",mode:0o600});
+  }
+  return{count:entries.length};
+}
+

package/packages/agent/src/update-bootstrap-executor.js

@@ -1,18 +1,27 @@
 import path from "node:path";
 import { rm } from "node:fs/promises";
 import { UpdateLifecycle } from "./update-lifecycle.js";
-import { acquireExclusiveLock } from "./update-persistence.js";
+import { acquireExclusiveLock, recoverStaleExclusiveLock } from "./update-persistence.js";
 
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 
 export class UpdateBootstrapExecutor{
-  constructor({manager,activationPlan,supervisor,waitStable,audit=()=>{}}={}){
+  constructor({manager,activationPlan,supervisor,rollbackRuntime=null,waitStable,recoverLock=recoverStaleExclusiveLock,audit=()=>{}}={}){
     if(!manager||!activationPlan||!supervisor||!waitStable)fail("UPDATE_BOOTSTRAP_INVALID","Complete bootstrap dependencies are required");
-    Object.assign(this,{manager,activationPlan,supervisor,waitStable,audit});
+    Object.assign(this,{manager,activationPlan,supervisor,rollbackRuntime,waitStable,recoverLock,audit});
   }
   async execute(){
     const lockPath=path.join(this.manager.homeDir,".whyvix-remote","update-activation.lock");
-    const release=await acquireExclusiveLock(lockPath);
+    let release;
+    try{release=await acquireExclusiveLock(lockPath);}
+    catch(error){
+      if(error?.code!=="UPDATE_BUSY")throw error;
+      const stateFile=path.join(this.manager.homeDir,".whyvix-remote","update-state.json");
+      const recovery=await this.recoverLock(lockPath,{stateFile});
+      if(!recovery.recovered)throw error;
+      this.audit({event:"update.stale_lock_recovered",reason:recovery.reason});
+      release=await acquireExclusiveLock(lockPath);
+    }
     try{
     const plan=await this.activationPlan.verify();
     const readyFile=path.join(this.manager.updateRoot(plan.targetVersion),"registered.json");
@@ -22,7 +31,7 @@ export class UpdateBootstrapExecutor{
       startCandidate:({version})=>this.manager.launchReplacement({version}),
       waitRegistered:({version,candidate})=>this.manager.waitForRegistration({version,candidate,planFingerprint:plan.fingerprint}),
       waitStable:args=>this.waitStable(args),
-      startRollback:({version})=>this.manager.launchReplacement({version}),
+      startRollback:({version,authority})=>authority==="runtime_snapshot"&&this.rollbackRuntime?this.rollbackRuntime.launch({version}):this.manager.launchReplacement({version}),
       audit:this.audit
     });
     this.audit({event:"update.bootstrap_started",currentVersion:plan.currentVersion,targetVersion:plan.targetVersion,deviceId:plan.deviceId});

package/packages/agent/src/update-persistence.js

@@ -23,6 +23,19 @@ export async function writeJsonAtomic(file,value){
   return value;
 }
 
+export function isProcessAlive(pid,{probe=process.kill}={}){
+  if(!Number.isInteger(pid)||pid<=0)return false;
+  try{probe(pid,0);return true;}catch{return false;}
+}
+
+export async function recoverStaleExclusiveLock(file,{stateFile,probe=process.kill}={}){
+  const lock=await readJsonStrict(file,{missing:null,invalidCode:"UPDATE_LOCK_INVALID"});if(!lock)return{recovered:false,reason:"missing"};
+  if(isProcessAlive(Number(lock.pid),{probe}))return{recovered:false,reason:"owner_alive"};
+  const state=stateFile?await readJsonStrict(stateFile,{missing:null,invalidCode:"UPDATE_STATE_INVALID"}):null;
+  if(["candidate_started","registered","rollback_started"].includes(String(state?.status||"")))fail("UPDATE_RECOVERY_REQUIRED","Stale lock belongs to an interrupted activation transition");
+  await rm(file,{force:true});return{recovered:true,reason:"owner_dead"};
+}
+
 export async function acquireExclusiveLock(file,{busyCode="UPDATE_BUSY"}={}){
   await mkdir(path.dirname(file),{recursive:true,mode:0o700});
   let handle;

package/packages/agent/src/update-supervisor-host.js

@@ -5,14 +5,16 @@ import { SelfUpdateManager } from "./self-update-manager.js";
 import { UpdateSupervisor } from "./update-supervisor.js";
 import { UpdateActivationPlan } from "./update-activation-plan.js";
 import { UpdateBootstrapExecutor } from "./update-bootstrap-executor.js";
+import { RollbackRuntimeSnapshot } from "./rollback-runtime-snapshot.js";
 
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 
 export async function runUpdateSupervisorHost({homeDir,nodeExecPath=process.execPath,spawnFn=spawn,graceMs=15000,pollMs=250,audit=()=>{}}={}){
   const manager=new SelfUpdateManager({homeDir,nodeExecPath,spawnFn,audit});
-  const activationPlan=new UpdateActivationPlan({manager,homeDir,audit});
-  const supervisor=new UpdateSupervisor({manager,homeDir,audit});
+  const rollbackRuntime=new RollbackRuntimeSnapshot({homeDir:homeDir||manager.homeDir,nodeExecPath,spawnFn,audit});
+  const activationPlan=new UpdateActivationPlan({manager,rollbackRuntime,homeDir,audit});
+  const supervisor=new UpdateSupervisor({manager,rollbackRuntime,homeDir,audit});
   const waitStable=async({candidate})=>{
     const pid=Number(candidate?.pid);
     if(!Number.isInteger(pid)||pid<=0)fail("UPDATE_PID_INVALID","Candidate pid is required for stability monitoring");
@@ -23,7 +25,7 @@ export async function runUpdateSupervisorHost({homeDir,nodeExecPath=process.exec
     }
     return true;
   };
-  return new UpdateBootstrapExecutor({manager,activationPlan,supervisor,waitStable,audit}).execute();
+  return new UpdateBootstrapExecutor({manager,activationPlan,supervisor,rollbackRuntime,waitStable,audit}).execute();
 }
 
 export function launchDetachedUpdateSupervisorHost({nodeExecPath=process.execPath,spawnFn=spawn}={}){

package/packages/agent/src/update-supervisor.js

@@ -5,9 +5,9 @@ function fail(code,message){throw Object.assign(new Error(message),{code});}
 function version(value){const v=String(value||"").trim();if(!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/.test(v))fail("UPDATE_VERSION_INVALID","Explicit semver version is required");return v;}
 
 export class UpdateSupervisor{
-  constructor({manager,homeDir,audit=()=>{},now=()=>Date.now()}={}){
+  constructor({manager,rollbackRuntime=null,homeDir,audit=()=>{},now=()=>Date.now()}={}){
     if(!manager)fail("UPDATE_MANAGER_REQUIRED","Self-update manager is required");
-    this.manager=manager;this.homeDir=homeDir||manager.homeDir;this.audit=audit;this.now=now;
+    this.manager=manager;this.rollbackRuntime=rollbackRuntime;this.homeDir=homeDir||manager.homeDir;this.audit=audit;this.now=now;
   }
   statePath(){return path.join(this.homeDir,".whyvix-remote","update-state.json");}
   async readState(){return readJsonStrict(this.statePath(),{missing:null,invalidCode:"UPDATE_STATE_INVALID"});}
@@ -15,7 +15,7 @@ export class UpdateSupervisor{
   async arm({currentVersion,targetVersion}={}){
     currentVersion=version(currentVersion);targetVersion=version(targetVersion);
     if(currentVersion===targetVersion)fail("UPDATE_TARGET_SAME","Target version must differ from current version");
-    await this.manager.verifyPrepared({version:currentVersion});
+    if(this.rollbackRuntime)await this.rollbackRuntime.verify({version:currentVersion});else await this.manager.verifyPrepared({version:currentVersion});
     await this.manager.verifyPrepared({version:targetVersion});
     const state={status:"armed",currentVersion,targetVersion,armedAt:this.now()};
     await this.writeState(state);this.audit({event:"update.armed",currentVersion,targetVersion});return state;
@@ -43,10 +43,10 @@ export class UpdateSupervisor{
   async rollbackPlan(){
     const state=await this.readState();
     if(!state?.currentVersion)fail("UPDATE_ROLLBACK_UNAVAILABLE","No rollback version is recorded");
-    await this.manager.verifyPrepared({version:state.currentVersion});
+    if(this.rollbackRuntime)await this.rollbackRuntime.verify({version:state.currentVersion});else await this.manager.verifyPrepared({version:state.currentVersion});
     const reason=state.status||"unknown";
     await this.writeState({...state,status:"rollback_started",rollbackVersion:state.currentVersion,rollbackStartedAt:this.now()});
     this.audit({event:"update.rollback_planned",version:state.currentVersion,reason});
-    return{version:state.currentVersion,reason};
+    return{version:state.currentVersion,reason,authority:this.rollbackRuntime?"runtime_snapshot":"prepared_package"};
   }
 }

package/packages/cli/update-supervisor.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { runUpdateSupervisorHost } from "../agent/src/update-supervisor-host.js";
+
+runUpdateSupervisorHost().then(
+  ()=>process.exit(0),
+  error=>{console.error("[update-supervisor]",error?.code||"UPDATE_FAILED",error?.message||String(error));process.exit(1);}
+);