@whyvix/remote 0.3.20 → 0.3.21

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@whyvix/remote",
-      "version": "0.3.20",
+      "version": "0.3.21",
       "dependencies": {
         "@modelcontextprotocol/ext-apps": "^2.0.0",
         "@modelcontextprotocol/sdk": "^1.30.0",

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "private": false,
   "type": "module",
   "files": [
     "packages/agent/src",
     "packages/cli/index.js",
+    "packages/cli/update-supervisor.js",
     "packages/cli/browser.js",
     "packages/cli/presenter.js",
     "packages/protocol/src",
@@ -28,7 +29,7 @@
     "test:r10-gui-window-focus": "node scripts/r10-gui-window-action-contract-test.js && node scripts/r10-gui-window-action-source-test.js && node scripts/r10-gui-window-action-agent-capability-test.js && node scripts/r10-gui-window-action-authorization-test.js && node scripts/r10-gui-window-action-loader-test.js && node scripts/r10-gui-window-action-mcp-schema-test.js && node scripts/r10-gui-window-action-cli-wiring-test.js && node scripts/r10-deployment-certify-authorization-test.js && node scripts/r10-deployment-certify-protocol-test.js && node scripts/r10-deployment-activation-response-test.js",
     "test:r10-documents": "node scripts/r10-precision-document-inspect-test.js && node scripts/r10-precision-document-compare-test.js && node scripts/r10-precision-docx-mutation-test.js && node scripts/r10-precision-xlsx-mutation-test.js && node scripts/r10-precision-pptx-mutation-test.js",
     "test:r10-observability": "node scripts/r10-write-preview-test.js && node scripts/r10-cli-presentation-test.js && node scripts/r10-usage-metering-test.js",
-    "test:r10-self-update": "node scripts/r10-self-update-manager-test.js && node scripts/r10-update-supervisor-test.js && node scripts/r10-update-lifecycle-test.js && node scripts/r10-update-activation-plan-test.js && node scripts/r10-update-bootstrap-executor-test.js && node scripts/r10-update-supervisor-host-test.js && node scripts/r10-update-archive-policy-test.js && node scripts/r10-update-persistence-test.js && node scripts/r10-windows-detached-survival-test.js"
+    "test:r10-self-update": "node scripts/r10-self-update-manager-test.js && node scripts/r10-update-supervisor-test.js && node scripts/r10-update-lifecycle-test.js && node scripts/r10-update-activation-plan-test.js && node scripts/r10-update-bootstrap-executor-test.js && node scripts/r10-update-supervisor-host-test.js && node scripts/r10-update-archive-policy-test.js && node scripts/r10-update-persistence-test.js && node scripts/r10-rollback-runtime-snapshot-test.js && node scripts/r10-windows-detached-survival-test.js"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^2.0.0",

package/packages/agent/src/rollback-runtime-snapshot.js

@@ -0,0 +1,40 @@
+import path from "node:path";
+import crypto from "node:crypto";
+import { access, readFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+
+function fail(code,message){throw Object.assign(new Error(message),{code});}
+function sha256(bytes){return crypto.createHash("sha256").update(bytes).digest("hex");}
+function inside(root,file){const rel=path.relative(path.resolve(root),path.resolve(file));return rel&&!rel.startsWith("..")&&!path.isAbsolute(rel);}
+
+export class RollbackRuntimeSnapshot{
+  constructor({homeDir,nodeExecPath=process.execPath,spawnFn=spawn,audit=()=>{}}={}){
+    if(!homeDir)fail("UPDATE_SNAPSHOT_INVALID","Home directory is required");
+    this.homeDir=homeDir;this.nodeExecPath=nodeExecPath;this.spawnFn=spawnFn;this.audit=audit;
+  }
+  snapshotPath(version){return path.join(this.homeDir,".whyvix-remote","updates",String(version),"runtime-snapshot.json");}
+  async verify({version}={}){
+    const file=this.snapshotPath(version);let snapshot;
+    try{snapshot=JSON.parse(await readFile(file,"utf8"));}catch{fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime snapshot is missing or invalid");}
+    if(snapshot?.schema!==1||snapshot.version!==version||!snapshot.packageRoot||!snapshot.launcher||!snapshot.packageLock||!snapshot.packageLockSha256||!snapshot.criticalFiles)fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime snapshot identity is invalid");
+    if(!inside(snapshot.sourceRoot,snapshot.packageRoot)||!inside(snapshot.packageRoot,snapshot.launcher)||!inside(snapshot.sourceRoot,snapshot.packageLock))fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime snapshot paths escape their trusted roots");
+    const lock=await readFile(snapshot.packageLock);if(sha256(lock)!==snapshot.packageLockSha256)fail("UPDATE_SNAPSHOT_TAMPERED","Rollback runtime lockfile hash mismatch");
+    const meta=JSON.parse(await readFile(path.join(snapshot.packageRoot,"package.json"),"utf8"));
+    if(meta?.name!=="@whyvix/remote"||meta?.version!==version||meta?.bin?.["whyvix-remote"]!=="packages/cli/index.js")fail("UPDATE_SNAPSHOT_INVALID","Rollback runtime package identity is invalid");
+    const modulesRoot=path.join(snapshot.sourceRoot,"node_modules");for(const name of Object.keys(meta.dependencies||{})){const parts=name.startsWith("@")?name.split("/"): [name];try{await access(path.join(modulesRoot,...parts));}catch{fail("UPDATE_SNAPSHOT_DEPENDENCY_MISSING",`Rollback runtime dependency is missing: ${name}`);}}
+    for(const [relative,expected] of Object.entries(snapshot.criticalFiles)){
+      const target=path.resolve(snapshot.packageRoot,relative);if(!inside(snapshot.packageRoot,target))fail("UPDATE_SNAPSHOT_INVALID","Rollback critical file escapes package root");
+      const bytes=await readFile(target);if(sha256(bytes)!==expected)fail("UPDATE_SNAPSHOT_TAMPERED",`Rollback runtime critical file changed: ${relative}`);
+    }
+    await access(snapshot.launcher);
+    const fingerprint=sha256(Buffer.from(JSON.stringify({schema:snapshot.schema,version:snapshot.version,sourceRoot:snapshot.sourceRoot,packageRoot:snapshot.packageRoot,launcher:snapshot.launcher,packageLock:snapshot.packageLock,packageLockSha256:snapshot.packageLockSha256,criticalFiles:snapshot.criticalFiles})));
+    return{...snapshot,fingerprint};
+  }
+  async launch({version,cwd=process.cwd()}={}){
+    const snapshot=await this.verify({version});
+    const child=this.spawnFn(this.nodeExecPath,[snapshot.launcher,"remote"],{cwd,windowsHide:true,shell:false,detached:true,stdio:"ignore",env:{...process.env}});
+    if(!Number.isInteger(child?.pid)||child.pid<=0)fail("UPDATE_ROLLBACK_START_FAILED","Rollback runtime did not return a valid pid");
+    child.unref?.();this.audit({event:"update.rollback_runtime_started",version,pid:child.pid,fingerprint:snapshot.fingerprint});
+    return{version,pid:child.pid,launcher:snapshot.launcher,snapshotFingerprint:snapshot.fingerprint};
+  }
+}

package/packages/agent/src/update-activation-plan.js

@@ -7,18 +7,18 @@ function semver(value){const v=String(value||"").trim();if(!/^(?:0|[1-9]\d*)\.(?
 function canonical(value){return JSON.stringify(value,Object.keys(value).sort());}
 
 export class UpdateActivationPlan{
-  constructor({manager,homeDir,now=()=>Date.now(),audit=()=>{}}={}){
+  constructor({manager,rollbackRuntime=null,homeDir,now=()=>Date.now(),audit=()=>{}}={}){
     if(!manager)fail("UPDATE_MANAGER_REQUIRED","Self-update manager is required");
-    this.manager=manager;this.homeDir=homeDir||manager.homeDir;this.now=now;this.audit=audit;
+    this.manager=manager;this.rollbackRuntime=rollbackRuntime;this.homeDir=homeDir||manager.homeDir;this.now=now;this.audit=audit;
   }
   planPath(){return path.join(this.homeDir,".whyvix-remote","activation-plan.json");}
   async create({currentVersion,targetVersion,deviceId}={}){
     currentVersion=semver(currentVersion);targetVersion=semver(targetVersion);
     if(currentVersion===targetVersion)fail("UPDATE_TARGET_SAME","Target version must differ from current version");
     if(!String(deviceId||"").trim())fail("UPDATE_DEVICE_INVALID","Device id is required");
-    const current=await this.manager.verifyPrepared({version:currentVersion});
+    const current=this.rollbackRuntime?await this.rollbackRuntime.verify({version:currentVersion}):await this.manager.verifyPrepared({version:currentVersion});
     const target=await this.manager.verifyPrepared({version:targetVersion});
-    const plan={schema:1,deviceId:String(deviceId),currentVersion,targetVersion,currentIntegrity:current.integrity,targetIntegrity:target.integrity,createdAt:this.now()};
+    const plan={schema:this.rollbackRuntime?2:1,deviceId:String(deviceId),currentVersion,targetVersion,currentIntegrity:current.integrity||null,currentSnapshotFingerprint:current.fingerprint||null,targetIntegrity:target.integrity,createdAt:this.now()};
     const fingerprint=crypto.createHash("sha256").update(canonical(plan)).digest("hex");
     const envelope={...plan,fingerprint};
     await writeJsonAtomic(this.planPath(),envelope);
@@ -29,13 +29,15 @@ export class UpdateActivationPlan{
     const envelope=await readJsonStrict(this.planPath(),{missing:null,invalidCode:"UPDATE_PLAN_INVALID"});
     if(!envelope)fail("UPDATE_PLAN_INVALID","Activation plan is missing");
     const {fingerprint,...plan}=envelope;
-    if(plan.schema!==1||!String(plan.deviceId||"").trim())fail("UPDATE_PLAN_INVALID","Activation plan identity is invalid");
+    if(![1,2].includes(plan.schema)||!String(plan.deviceId||"").trim())fail("UPDATE_PLAN_INVALID","Activation plan identity is invalid");
     plan.currentVersion=semver(plan.currentVersion);plan.targetVersion=semver(plan.targetVersion);
     const expected=crypto.createHash("sha256").update(canonical(plan)).digest("hex");
     if(fingerprint!==expected)fail("UPDATE_PLAN_INVALID","Activation plan fingerprint mismatch");
-    const current=await this.manager.verifyPrepared({version:plan.currentVersion});
+    const current=plan.schema===2&&this.rollbackRuntime?await this.rollbackRuntime.verify({version:plan.currentVersion}):await this.manager.verifyPrepared({version:plan.currentVersion});
     const target=await this.manager.verifyPrepared({version:plan.targetVersion});
-    if(current.integrity!==plan.currentIntegrity||target.integrity!==plan.targetIntegrity)fail("UPDATE_PLAN_INVALID","Prepared package integrity no longer matches activation plan");
+    if(plan.schema===2&&current.fingerprint!==plan.currentSnapshotFingerprint)fail("UPDATE_PLAN_INVALID","Rollback runtime snapshot no longer matches activation plan");
+    if(plan.schema===1&&current.integrity!==plan.currentIntegrity)fail("UPDATE_PLAN_INVALID","Prepared current package integrity no longer matches activation plan");
+    if(target.integrity!==plan.targetIntegrity)fail("UPDATE_PLAN_INVALID","Prepared target package integrity no longer matches activation plan");
     return envelope;
   }
 }

package/packages/agent/src/update-bootstrap-executor.js

@@ -6,9 +6,9 @@ import { acquireExclusiveLock, recoverStaleExclusiveLock } from "./update-persis
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 
 export class UpdateBootstrapExecutor{
-  constructor({manager,activationPlan,supervisor,waitStable,recoverLock=recoverStaleExclusiveLock,audit=()=>{}}={}){
+  constructor({manager,activationPlan,supervisor,rollbackRuntime=null,waitStable,recoverLock=recoverStaleExclusiveLock,audit=()=>{}}={}){
     if(!manager||!activationPlan||!supervisor||!waitStable)fail("UPDATE_BOOTSTRAP_INVALID","Complete bootstrap dependencies are required");
-    Object.assign(this,{manager,activationPlan,supervisor,waitStable,recoverLock,audit});
+    Object.assign(this,{manager,activationPlan,supervisor,rollbackRuntime,waitStable,recoverLock,audit});
   }
   async execute(){
     const lockPath=path.join(this.manager.homeDir,".whyvix-remote","update-activation.lock");
@@ -31,7 +31,7 @@ export class UpdateBootstrapExecutor{
       startCandidate:({version})=>this.manager.launchReplacement({version}),
       waitRegistered:({version,candidate})=>this.manager.waitForRegistration({version,candidate,planFingerprint:plan.fingerprint}),
       waitStable:args=>this.waitStable(args),
-      startRollback:({version})=>this.manager.launchReplacement({version}),
+      startRollback:({version,authority})=>authority==="runtime_snapshot"&&this.rollbackRuntime?this.rollbackRuntime.launch({version}):this.manager.launchReplacement({version}),
       audit:this.audit
     });
     this.audit({event:"update.bootstrap_started",currentVersion:plan.currentVersion,targetVersion:plan.targetVersion,deviceId:plan.deviceId});

package/packages/agent/src/update-supervisor-host.js

@@ -5,14 +5,16 @@ import { SelfUpdateManager } from "./self-update-manager.js";
 import { UpdateSupervisor } from "./update-supervisor.js";
 import { UpdateActivationPlan } from "./update-activation-plan.js";
 import { UpdateBootstrapExecutor } from "./update-bootstrap-executor.js";
+import { RollbackRuntimeSnapshot } from "./rollback-runtime-snapshot.js";
 
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 
 export async function runUpdateSupervisorHost({homeDir,nodeExecPath=process.execPath,spawnFn=spawn,graceMs=15000,pollMs=250,audit=()=>{}}={}){
   const manager=new SelfUpdateManager({homeDir,nodeExecPath,spawnFn,audit});
-  const activationPlan=new UpdateActivationPlan({manager,homeDir,audit});
-  const supervisor=new UpdateSupervisor({manager,homeDir,audit});
+  const rollbackRuntime=new RollbackRuntimeSnapshot({homeDir:homeDir||manager.homeDir,nodeExecPath,spawnFn,audit});
+  const activationPlan=new UpdateActivationPlan({manager,rollbackRuntime,homeDir,audit});
+  const supervisor=new UpdateSupervisor({manager,rollbackRuntime,homeDir,audit});
   const waitStable=async({candidate})=>{
     const pid=Number(candidate?.pid);
     if(!Number.isInteger(pid)||pid<=0)fail("UPDATE_PID_INVALID","Candidate pid is required for stability monitoring");
@@ -23,7 +25,7 @@ export async function runUpdateSupervisorHost({homeDir,nodeExecPath=process.exec
     }
     return true;
   };
-  return new UpdateBootstrapExecutor({manager,activationPlan,supervisor,waitStable,audit}).execute();
+  return new UpdateBootstrapExecutor({manager,activationPlan,supervisor,rollbackRuntime,waitStable,audit}).execute();
 }
 
 export function launchDetachedUpdateSupervisorHost({nodeExecPath=process.execPath,spawnFn=spawn}={}){

package/packages/agent/src/update-supervisor.js

@@ -5,9 +5,9 @@ function fail(code,message){throw Object.assign(new Error(message),{code});}
 function version(value){const v=String(value||"").trim();if(!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/.test(v))fail("UPDATE_VERSION_INVALID","Explicit semver version is required");return v;}
 
 export class UpdateSupervisor{
-  constructor({manager,homeDir,audit=()=>{},now=()=>Date.now()}={}){
+  constructor({manager,rollbackRuntime=null,homeDir,audit=()=>{},now=()=>Date.now()}={}){
     if(!manager)fail("UPDATE_MANAGER_REQUIRED","Self-update manager is required");
-    this.manager=manager;this.homeDir=homeDir||manager.homeDir;this.audit=audit;this.now=now;
+    this.manager=manager;this.rollbackRuntime=rollbackRuntime;this.homeDir=homeDir||manager.homeDir;this.audit=audit;this.now=now;
   }
   statePath(){return path.join(this.homeDir,".whyvix-remote","update-state.json");}
   async readState(){return readJsonStrict(this.statePath(),{missing:null,invalidCode:"UPDATE_STATE_INVALID"});}
@@ -15,7 +15,7 @@ export class UpdateSupervisor{
   async arm({currentVersion,targetVersion}={}){
     currentVersion=version(currentVersion);targetVersion=version(targetVersion);
     if(currentVersion===targetVersion)fail("UPDATE_TARGET_SAME","Target version must differ from current version");
-    await this.manager.verifyPrepared({version:currentVersion});
+    if(this.rollbackRuntime)await this.rollbackRuntime.verify({version:currentVersion});else await this.manager.verifyPrepared({version:currentVersion});
     await this.manager.verifyPrepared({version:targetVersion});
     const state={status:"armed",currentVersion,targetVersion,armedAt:this.now()};
     await this.writeState(state);this.audit({event:"update.armed",currentVersion,targetVersion});return state;
@@ -43,10 +43,10 @@ export class UpdateSupervisor{
   async rollbackPlan(){
     const state=await this.readState();
     if(!state?.currentVersion)fail("UPDATE_ROLLBACK_UNAVAILABLE","No rollback version is recorded");
-    await this.manager.verifyPrepared({version:state.currentVersion});
+    if(this.rollbackRuntime)await this.rollbackRuntime.verify({version:state.currentVersion});else await this.manager.verifyPrepared({version:state.currentVersion});
     const reason=state.status||"unknown";
     await this.writeState({...state,status:"rollback_started",rollbackVersion:state.currentVersion,rollbackStartedAt:this.now()});
     this.audit({event:"update.rollback_planned",version:state.currentVersion,reason});
-    return{version:state.currentVersion,reason};
+    return{version:state.currentVersion,reason,authority:this.rollbackRuntime?"runtime_snapshot":"prepared_package"};
   }
 }

package/packages/cli/update-supervisor.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { runUpdateSupervisorHost } from "../agent/src/update-supervisor-host.js";
+
+runUpdateSupervisorHost().then(
+  ()=>process.exit(0),
+  error=>{console.error("[update-supervisor]",error?.code||"UPDATE_FAILED",error?.message||String(error));process.exit(1);}
+);