alexandr 0.3.2 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexandr",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Run the alexandr workspace runtime locally (npx alexandr up), and develop alexandr apps against a workspace (alexandr app link | dev | build | deploy).",
   "type": "module",
   "bin": {

package/src/commands.js

@@ -616,6 +616,9 @@ export async function update(flags) {
     stampUpdaterEnv(inst);
   }
   const prevImage = readEnv(inst.dir).ALEXANDR_IMAGE || `${IMAGE_BASE}:latest`;
+  // What `.previous-image` said BEFORE this run — restored if the pull fails (see below).
+  const pointerPath = path.join(inst.dir, ".previous-image");
+  const priorPointer = fs.existsSync(pointerPath) ? fs.readFileSync(pointerPath, "utf8") : null;
   const base = kernelUrl(kernelPort(inst.dir));
   const before = (await kVersion(base))?.version ?? "?";
 
@@ -662,6 +665,21 @@ export async function update(flags) {
       pull = compose(inst.dir, inst.projectName, ["pull", "kernel"]);
     }
     if (pull.status !== 0) {
+      // ⚠ PUT THE PIN BACK. The new tag was written into .env before the pull so compose would
+      // pull it; a failed pull must not leave the box pointing at an image it does not have —
+      // the next `up` would then boot the new version behind the operator's back, which is
+      // exactly what the first sidecar press on aos did (2026-09-08). `.previous-image` is
+      // restored too, so a later `--rollback` still means what it says.
+      setEnv(inst.dir, "ALEXANDR_IMAGE", prevImage);
+      if (priorPointer === null) {
+        try {
+          fs.unlinkSync(pointerPath);
+        } catch {
+          /* nothing was recorded before this run either */
+        }
+      } else {
+        fs.writeFileSync(pointerPath, priorPointer);
+      }
       fail("Pull failed — check your network / the image tag.", EXIT.RUNTIME);
     }
   }

package/src/probe.js

@@ -1,7 +1,17 @@
 // Health/version probing of a running kernel over its loopback port. Uses the
 // global fetch (Node 18+). All probes are best-effort and never throw.
 
-export const kernelUrl = (port = 3030) => `http://127.0.0.1:${port}`;
+/**
+ * Where the kernel answers from HERE. On the host that is the loopback port compose mapped;
+ * inside the updater sidecar 127.0.0.1 is the sidecar itself, so the compose file sets
+ * `ALEXANDR_KERNEL_URL=http://kernel:3030` (the service name on the project network) — without
+ * it the recipe's health wait could not see the kernel from inside and reported `? → ?`
+ * (the first sidecar press on aos, 2026-09-08).
+ */
+export const kernelUrl = (port = 3030, env = process.env) => {
+  const explicit = (env.ALEXANDR_KERNEL_URL || "").trim();
+  return explicit ? explicit.replace(/\/+$/, "") : `http://127.0.0.1:${port}`;
+};
 
 async function getJson(url, timeoutMs = 2500) {
   const ctrl = new AbortController();

package/templates/docker-compose.yml

@@ -48,6 +48,9 @@ services:
       ALEXANDR_INSTANCE_DIR: ${ALEXANDR_INSTANCE_DIR:-/nonexistent}
       ALEXANDR_COMPOSE_PROJECT: ${ALEXANDR_COMPOSE_PROJECT:-alexandr}
       ALEXANDR_UPDATER_SOCKET: /run/alexandr/updater.sock
+      # The kernel, by its service name: from inside this container 127.0.0.1 is the sidecar
+      # itself, and the recipe's health wait must see the kernel come back.
+      ALEXANDR_KERNEL_URL: http://kernel:3030
     env_file:
       - path: ./.env
         required: false            # ALEXANDR_CP_URL / ALEXANDR_RELEASES_URL → the feed it reads