botmux 3.18.4 → 3.18.6

package/dist/core/binary-install-shape.d.ts

@@ -0,0 +1,77 @@
+/**
+ * How the running compiled binary was installed, and therefore who owns updating it.
+ *
+ *  · `npm-binary`   — inside an npm/pnpm/Bun platform subpackage
+ *                     (`botmux-<plat>-<arch>[-musl]`). The manager owns the file;
+ *                     update by re-running it.
+ *  · `curl-binary`  — the standalone location install.sh writes. We own the file;
+ *                     update by replacing it.
+ *  · `unknown`      — anywhere else (a hand-copied binary, a distro package, a dev
+ *                     build run straight out of dist-bin/), or not a compiled
+ *                     binary at all. Fail closed.
+ */
+export type BinaryInstallShape = 'npm-binary' | 'curl-binary' | 'unknown';
+/**
+ * Classify a binary path. Pure — the caller passes the path and the relevant
+ * environment, so every shape is unit-testable without a real install.
+ *
+ * @param execPath  the running executable (`process.execPath`)
+ * @param env       consulted for `BOTMUX_INSTALL_DIR` (install.sh honours it)
+ * @param home      the home directory, for the default install dir
+ */
+export declare function classifyBinaryInstall(execPath: string, env?: NodeJS.ProcessEnv, home?: string): BinaryInstallShape;
+/** Classify the running process. `unknown` for a non-compiled (Node) run, whose
+ *  updates go through the package-manager path instead. */
+export declare function currentBinaryInstallShape(): BinaryInstallShape;
+/**
+ * Map a platform-subpackage binary path to the MAIN `botmux` package root beside
+ * it (`…/node_modules/botmux-linux-x64/botmux` → `…/node_modules/botmux`).
+ *
+ * WHY GO THROUGH THE MAIN PACKAGE instead of computing an npm `--prefix` here:
+ * `resolveGlobalInstallPlan` already classifies that path shape into the right
+ * manager and builds the right command — including pnpm's `--global-dir`, Bun's
+ * env pinning, and the POSIX-vs-Windows prefix difference — and all of it is
+ * unit-tested. Re-deriving a prefix here would be a second, diverging
+ * implementation of the same rules. It also means `pnpm i -g` / `bun add -g`
+ * installs keep resolving to THEIR manager rather than being forced onto npm.
+ *
+ * Returns null when the shape does not match, so callers fail closed.
+ */
+export declare function mainPackageRootForSubpackageBinary(execPath: string): string | null;
+/**
+ * How the running process should update itself.
+ *
+ *  · `package-manager` — hand off to npm/pnpm/Bun for `packageRoot`. Covers both a
+ *    plain Node install AND a compiled binary living inside a package manager's
+ *    tree (the manager owns that file).
+ *  · `self-replace`    — download the release asset and swap the binary.
+ *  · `unsupported`     — could not identify the install; callers keep their
+ *                        existing "unsupported install" behaviour.
+ */
+export type UpdateStrategy = {
+    kind: 'package-manager';
+    packageRoot: string;
+} | {
+    kind: 'self-replace';
+    target: string;
+} | {
+    kind: 'unsupported';
+    reason: 'unknown-binary-location';
+};
+/**
+ * Decide the update strategy. Pure over its inputs so every branch is testable
+ * without a compiled binary.
+ *
+ * The Node path is deliberately left EXACTLY as it was: when this is not a
+ * standalone binary we return the running install root and callers resolve it
+ * through `resolveGlobalInstallPlan` as before — no behaviour change for npm
+ * `dist/cli.js` deployments or source checkouts.
+ *
+ * @param standalone   is this a compiled single-file executable?
+ * @param execPath     the running executable
+ * @param installRoot  `botmuxInstallRoot()` — only meaningful when NOT standalone
+ */
+export declare function resolveUpdateStrategy(standalone: boolean, execPath: string, installRoot: string, env?: NodeJS.ProcessEnv, home?: string): UpdateStrategy;
+/** Production wiring for {@link resolveUpdateStrategy}. */
+export declare function currentUpdateStrategy(installRoot: string): UpdateStrategy;
+//# sourceMappingURL=binary-install-shape.d.ts.map

package/dist/core/binary-install-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-install-shape.d.ts","sourceRoot":"","sources":["../../src/core/binary-install-shape.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,aAAa,GAAG,SAAS,CAAC;AAO1E;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,MAAkB,GACvB,kBAAkB,CAyBpB;AAED;2DAC2D;AAC3D,wBAAgB,yBAAyB,IAAI,kBAAkB,CAG9D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,MAAkB,GACvB,cAAc,CAYhB;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAEzE"}

package/dist/core/binary-install-shape.js

@@ -0,0 +1,117 @@
+/**
+ * WHERE the running compiled binary lives — the pure, dependency-free half of the
+ * self-update story.
+ *
+ * Split out of `binary-self-update.ts` so it can be imported from
+ * `utils/global-install.ts` without closing an import cycle: the self-update
+ * module needs `restart-report` (for the repo slug) which reaches
+ * `utils/install-info.ts`, and `global-install.ts` is itself imported by
+ * `install-diagnostics.ts`. This file imports nothing but `node:os`/`node:path`
+ * plus the standalone check, so it is safe to depend on from anywhere.
+ *
+ * See `binary-self-update.ts` for the full rationale — in short: both installers
+ * ship the SAME compiled binary, so the module graph cannot tell them apart (both
+ * report an install root of `/`), and `process.execPath` can.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { isStandaloneBinary } from './self-spawn.js';
+/** Default standalone install dir, matching install.sh's own default. */
+function defaultInstallDir(home) {
+    return join(home, '.botmux', 'bin');
+}
+/**
+ * Classify a binary path. Pure — the caller passes the path and the relevant
+ * environment, so every shape is unit-testable without a real install.
+ *
+ * @param execPath  the running executable (`process.execPath`)
+ * @param env       consulted for `BOTMUX_INSTALL_DIR` (install.sh honours it)
+ * @param home      the home directory, for the default install dir
+ */
+export function classifyBinaryInstall(execPath, env = process.env, home = homedir()) {
+    const path = execPath.replace(/\\/g, '/').replace(/\/+$/, '');
+    if (!path)
+        return 'unknown';
+    // Platform subpackage: <anything>/node_modules/botmux-<plat>-<arch>[-musl]/botmux
+    // Anchored on `/node_modules/` so a user directory that merely happens to be
+    // named `botmux-linux-x64` is not mistaken for a package-manager-owned tree.
+    if (/\/node_modules\/botmux-(?:linux|darwin)-(?:x64|arm64)(?:-musl)?\/botmux$/.test(path)) {
+        return 'npm-binary';
+    }
+    // The standalone install location. `BOTMUX_INSTALL_DIR` is what install.sh
+    // honours, so an install that used it is recognised WHEN THAT VARIABLE IS STILL
+    // EXPORTED at runtime. ⚠️ It usually is not: `BOTMUX_INSTALL_DIR=/opt/bm sh
+    // install.sh` sets it for the installer only, so a later `botmux update` sees a
+    // bare environment and this falls through to `unknown` — fail-closed, so nothing
+    // is damaged, but self-update is unavailable for that install. Do not describe
+    // custom dirs as unconditionally covered; making them work without the variable
+    // would need a persisted install record, which is out of scope here.
+    for (const raw of [env.BOTMUX_INSTALL_DIR, defaultInstallDir(home)]) {
+        if (!raw)
+            continue;
+        const dir = raw.replace(/\\/g, '/').replace(/\/+$/, '');
+        if (dir && path === `${dir}/botmux`)
+            return 'curl-binary';
+    }
+    return 'unknown';
+}
+/** Classify the running process. `unknown` for a non-compiled (Node) run, whose
+ *  updates go through the package-manager path instead. */
+export function currentBinaryInstallShape() {
+    if (!isStandaloneBinary())
+        return 'unknown';
+    return classifyBinaryInstall(process.execPath);
+}
+/**
+ * Map a platform-subpackage binary path to the MAIN `botmux` package root beside
+ * it (`…/node_modules/botmux-linux-x64/botmux` → `…/node_modules/botmux`).
+ *
+ * WHY GO THROUGH THE MAIN PACKAGE instead of computing an npm `--prefix` here:
+ * `resolveGlobalInstallPlan` already classifies that path shape into the right
+ * manager and builds the right command — including pnpm's `--global-dir`, Bun's
+ * env pinning, and the POSIX-vs-Windows prefix difference — and all of it is
+ * unit-tested. Re-deriving a prefix here would be a second, diverging
+ * implementation of the same rules. It also means `pnpm i -g` / `bun add -g`
+ * installs keep resolving to THEIR manager rather than being forced onto npm.
+ *
+ * Returns null when the shape does not match, so callers fail closed.
+ */
+export function mainPackageRootForSubpackageBinary(execPath) {
+    const path = execPath.replace(/\\/g, '/').replace(/\/+$/, '');
+    const m = /^(.*\/node_modules)\/botmux-(?:linux|darwin)-(?:x64|arm64)(?:-musl)?\/botmux$/.exec(path);
+    return m ? `${m[1]}/botmux` : null;
+}
+/**
+ * Decide the update strategy. Pure over its inputs so every branch is testable
+ * without a compiled binary.
+ *
+ * The Node path is deliberately left EXACTLY as it was: when this is not a
+ * standalone binary we return the running install root and callers resolve it
+ * through `resolveGlobalInstallPlan` as before — no behaviour change for npm
+ * `dist/cli.js` deployments or source checkouts.
+ *
+ * @param standalone   is this a compiled single-file executable?
+ * @param execPath     the running executable
+ * @param installRoot  `botmuxInstallRoot()` — only meaningful when NOT standalone
+ */
+export function resolveUpdateStrategy(standalone, execPath, installRoot, env = process.env, home = homedir()) {
+    if (!standalone)
+        return { kind: 'package-manager', packageRoot: installRoot };
+    const shape = classifyBinaryInstall(execPath, env, home);
+    if (shape === 'npm-binary') {
+        const root = mainPackageRootForSubpackageBinary(execPath);
+        // The regex that produced `npm-binary` is the same one used here, so `root`
+        // cannot be null in practice; keep the guard so a future loosening of one
+        // pattern degrades to "unsupported" instead of dereferencing null.
+        if (root)
+            return { kind: 'package-manager', packageRoot: root };
+    }
+    if (shape === 'curl-binary')
+        return { kind: 'self-replace', target: execPath };
+    return { kind: 'unsupported', reason: 'unknown-binary-location' };
+}
+/** Production wiring for {@link resolveUpdateStrategy}. */
+export function currentUpdateStrategy(installRoot) {
+    return resolveUpdateStrategy(isStandaloneBinary(), process.execPath, installRoot);
+}
+//# sourceMappingURL=binary-install-shape.js.map

package/dist/core/binary-install-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-install-shape.js","sourceRoot":"","sources":["../../src/core/binary-install-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAgBrD,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,kFAAkF;IAClF,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1F,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,2EAA2E;IAC3E,gFAAgF;IAChF,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG,GAAG,SAAS;YAAE,OAAO,aAAa,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,yBAAyB;IACvC,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAAgB;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,+EAA+E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAiBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAmB,EACnB,QAAgB,EAChB,WAAmB,EACnB,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAe,OAAO,EAAE;IAExB,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;QAC1D,4EAA4E;QAC5E,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;AACpE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,qBAAqB,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACpF,CAAC"}

package/dist/core/binary-self-update.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Where the running compiled binary lives, and therefore who owns updating it.
+ * The pure location classifier lives in `binary-install-shape.ts` so
+ * `utils/global-install.ts` can import it without closing an import cycle through
+ * this module (which reaches install-info via restart-report). Re-exported here so
+ * callers have one obvious import site for the whole self-update surface.
+ */
+export { classifyBinaryInstall, currentBinaryInstallShape, mainPackageRootForSubpackageBinary, resolveUpdateStrategy, currentUpdateStrategy, type BinaryInstallShape, type UpdateStrategy, } from './binary-install-shape.js';
+/**
+ * Is this a musl libc host (Alpine and most slim Docker images)?
+ *
+ * WHY IT MATTERS: a glibc-linked binary does not run on musl at all — it dies in
+ * the loader with a message naming no cause. Downloading the wrong one turns a
+ * working install into a binary that cannot start, which is strictly worse than
+ * refusing to update.
+ *
+ * Mirrors the probe order in `scripts/postinstall-bin.mjs` and install.sh, and is
+ * deliberately conservative: only claim musl when positively observed, so a glibc
+ * box is never pushed onto the musl asset. Node's `process.report` header is a
+ * NEGATIVE signal only — measured on node:22-alpine it carries neither
+ * `glibcVersionRuntime` nor any musl key, so it can confirm glibc but never musl.
+ */
+export declare function isMuslHost(platform?: NodeJS.Platform, probes?: {
+    glibcRuntime?: () => string | undefined;
+    listDir?: (dir: string) => string[];
+    exists?: (path: string) => boolean;
+}): boolean;
+/**
+ * The release asset name for a platform, matching the names release.yml uploads
+ * (`botmux-<os>-<arch>[-musl]`) and install.sh downloads. Returns null for a
+ * platform/arch with no published build rather than inventing a name that 404s.
+ */
+export declare function releaseAssetName(platform?: NodeJS.Platform, arch?: string, musl?: boolean): string | null;
+/** Download base for a release tag, mirroring install.sh's URL construction. */
+export declare function releaseAssetBaseUrl(version: string): string;
+export interface BinarySelfUpdateResult {
+    /** The asset that was installed. */
+    asset: string;
+    /** Absolute path that was replaced. */
+    target: string;
+    /** Bytes written. */
+    bytes: number;
+}
+export interface BinarySelfUpdateDeps {
+    /** Fetch a URL as a readable stream (injected for tests). */
+    fetchStream?: (url: string) => Promise<NodeJS.ReadableStream>;
+    /** Read the published checksum for `asset`, or null when none is published. */
+    fetchChecksum?: (url: string) => Promise<string | null>;
+}
+/**
+ * Replace the running standalone binary with `version`'s published asset.
+ *
+ * ── WHY A RENAME AND NOT A WRITE (do not "simplify" this) ─────────────────────
+ * MEASURED on Linux with a real ELF:
+ *
+ *   open(target,'r+b').write(…)  → OSError 26 ETXTBSY "Text file busy"
+ *   rename(new, target)          → succeeds; the running process keeps executing
+ *                                  the old inode and finishes normally
+ *
+ * So the update MUST land as a rename over the path, never an in-place write:
+ * the kernel refuses to let us scribble on the executable of a live process, and
+ * a rename is also what makes the swap atomic for anything about to `exec` it.
+ * The temp file is created in the SAME directory as the target so the rename is
+ * within one filesystem (a cross-device rename fails with EXDEV, and copying
+ * would reintroduce the torn-file window this avoids).
+ *
+ * Checksum verification happens BEFORE the rename, so a truncated or tampered
+ * download is discarded while the working binary is still in place. A release
+ * that publishes no `.sha256` is a warning, not a failure — matching install.sh,
+ * which has always tolerated that.
+ *
+ * ── WHY NO `realpathSync(target)` ─────────────────────────────────────────────
+ * Renaming over a SYMLINK replaces the link itself and orphans its target
+ * (measured). That would matter if `target` could be a symlink — but the default
+ * target is `process.execPath`, which the OS has already resolved: MEASURED with a
+ * compiled binary invoked through a symlink, `process.execPath` reports the real
+ * file, never the link. So the symlink case is unreachable on the production path,
+ * and resolving again would only add a failure mode of its own (an unreadable
+ * parent dir). install.sh's plain `mv` has the same semantics.
+ */
+export declare function replaceStandaloneBinary(version: string, target?: string, deps?: BinarySelfUpdateDeps): Promise<BinarySelfUpdateResult>;
+//# sourceMappingURL=binary-self-update.d.ts.map

package/dist/core/binary-self-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-self-update.d.ts","sourceRoot":"","sources":["../../src/core/binary-self-update.ts"],"names":[],"mappings":"AA0EA;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,2BAA2B,CAAC;AAInC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CACxB,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,MAAM,GAAE;IACN,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACpC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CAC/B,GACL,OAAO,CAoBT;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAqB,EAC3B,IAAI,GAAE,OAA8B,GACnC,MAAM,GAAG,IAAI,CAMf;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAYD,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9D,+EAA+E;IAC/E,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAyB,EACjC,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAoDjC"}

package/dist/core/binary-self-update.js

@@ -0,0 +1,239 @@
+/**
+ * How the RUNNING compiled binary was installed, and how to update it.
+ *
+ * ── WHY THIS EXISTS ────────────────────────────────────────────────────────────
+ * Every pre-existing update path (`botmux update`, the dashboard's
+ * `/api/update/run`, the scheduled maintenance auto-update) asks
+ * `resolveGlobalInstallPlan(botmuxInstallRoot())` which package manager owns the
+ * install. That question is answered by looking at the install ROOT — the
+ * directory holding `package.json` — and classifying its path shape
+ * (`…/lib/node_modules/botmux` ⇒ npm, `…/.pnpm/…` ⇒ pnpm, …).
+ *
+ * A compiled single-file executable has NO package.json on disk: the module graph
+ * lives in the virtual read-only `/$bunfs/`, so `packageRoot()` walks up to `/`
+ * and stops. MEASURED on the real published v3.18.4 binary and on a locally
+ * compiled probe — identical in both:
+ *
+ *     botmuxInstallRoot()            → "/"
+ *     detectGlobalInstallManager("/") → "unknown"
+ *     resolveGlobalInstallPlan("/")   → throws UnsupportedGlobalInstallError
+ *     botmuxCliEntry()                → "/dist/cli.js"  (does not exist)
+ *
+ * So on the real shipped artifact `botmux update` printed
+ * “无法安全识别当前安装方式（unknown）” and exited, the dashboard button greyed out
+ * with “supports npm/pnpm/Bun global installs only”, and the scheduled
+ * auto-update failed every single day (fail-safe — it never restarts onto a stale
+ * version — but it marks the day done, so it does not even retry).
+ *
+ * ── THE KEY INSIGHT: BOTH INSTALLERS SHIP THE SAME BINARY ─────────────────────
+ * It is tempting to think “npm users update with npm, curl users update with
+ * curl”, i.e. that the two installers produce different artifacts. They do not.
+ * `npm i -g botmux` has NO `bin` field any more (removed in #1047): it downloads
+ * a platform subpackage and its postinstall writes `~/.botmux/bin/botmux` as a
+ * launcher that `exec`s that subpackage's compiled binary. `install.sh` downloads
+ * the very same compiled binary from the GitHub Release. Same bytes, different
+ * location — which is exactly why classifying by MODULE GRAPH cannot work (both
+ * report `/`) and classifying by LOCATION can.
+ *
+ * `process.execPath` is the location of the running executable, and it is the one
+ * thing that still differs. MEASURED, compiled binaries invoked through each
+ * installer's own launcher:
+ *
+ *   npm  → /usr/lib/node_modules/botmux-linux-x64/botmux       (subpackage dir)
+ *   curl → ~/.botmux/bin/botmux                                (BOTMUX_INSTALL_DIR)
+ *
+ * Note it is the REAL binary path in both cases, not the launcher's: the launcher
+ * `exec`s the binary, so the process's execPath is the target. Verified by
+ * running a compiled probe through a launcher of exactly the shape postinstall
+ * writes.
+ *
+ * ── WHAT EACH SHAPE DOES TO UPDATE ─────────────────────────────────────────────
+ *  · npm  → hand back to npm (`npm i -g botmux@latest`). npm replaces the
+ *           subpackage and re-runs postinstall, which re-points the launcher. We
+ *           must NOT rewrite the binary ourselves: npm owns that tree, and a
+ *           hand-written file there would be clobbered (or worse, left behind at
+ *           a version npm's metadata disagrees with).
+ *  · curl → replace the binary in place, the same way install.sh does: download
+ *           the matching asset, verify its published SHA-256, then atomically
+ *           rename over the target. Nothing else owns that path.
+ *
+ * A shape we cannot positively identify returns null, and every caller keeps its
+ * existing "unsupported install" behaviour. Fail closed: guessing wrong here
+ * means either writing into a tree npm owns, or downloading a binary for the
+ * wrong libc.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync, chmodSync, } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { GITHUB_REPO } from './restart-report.js';
+import { getReleaseStream, resolveHttpProxy } from './release-download.js';
+/**
+ * Where the running compiled binary lives, and therefore who owns updating it.
+ * The pure location classifier lives in `binary-install-shape.ts` so
+ * `utils/global-install.ts` can import it without closing an import cycle through
+ * this module (which reaches install-info via restart-report). Re-exported here so
+ * callers have one obvious import site for the whole self-update surface.
+ */
+export { classifyBinaryInstall, currentBinaryInstallShape, mainPackageRootForSubpackageBinary, resolveUpdateStrategy, currentUpdateStrategy, } from './binary-install-shape.js';
+// ── Release asset selection ────────────────────────────────────────────────────
+/**
+ * Is this a musl libc host (Alpine and most slim Docker images)?
+ *
+ * WHY IT MATTERS: a glibc-linked binary does not run on musl at all — it dies in
+ * the loader with a message naming no cause. Downloading the wrong one turns a
+ * working install into a binary that cannot start, which is strictly worse than
+ * refusing to update.
+ *
+ * Mirrors the probe order in `scripts/postinstall-bin.mjs` and install.sh, and is
+ * deliberately conservative: only claim musl when positively observed, so a glibc
+ * box is never pushed onto the musl asset. Node's `process.report` header is a
+ * NEGATIVE signal only — measured on node:22-alpine it carries neither
+ * `glibcVersionRuntime` nor any musl key, so it can confirm glibc but never musl.
+ */
+export function isMuslHost(platform = process.platform, probes = {}) {
+    if (platform !== 'linux')
+        return false;
+    const glibcRuntime = probes.glibcRuntime ?? (() => {
+        try {
+            return process.report?.getReport?.()
+                ?.header?.glibcVersionRuntime;
+        }
+        catch {
+            return undefined;
+        }
+    });
+    const listDir = probes.listDir ?? ((dir) => {
+        try {
+            return readdirSync(dir);
+        }
+        catch {
+            return [];
+        }
+    });
+    const exists = probes.exists ?? ((p) => {
+        try {
+            return existsSync(p);
+        }
+        catch {
+            return false;
+        }
+    });
+    if (glibcRuntime())
+        return false; // a reported glibc runtime settles it
+    for (const dir of ['/lib', '/usr/lib']) {
+        if (listDir(dir).some(f => f.startsWith('ld-musl-')))
+            return true;
+    }
+    return exists('/etc/alpine-release');
+}
+/**
+ * The release asset name for a platform, matching the names release.yml uploads
+ * (`botmux-<os>-<arch>[-musl]`) and install.sh downloads. Returns null for a
+ * platform/arch with no published build rather than inventing a name that 404s.
+ */
+export function releaseAssetName(platform = process.platform, arch = process.arch, musl = isMuslHost(platform)) {
+    const os = platform === 'linux' ? 'linux' : platform === 'darwin' ? 'darwin' : null;
+    const cpu = arch === 'x64' ? 'x64' : arch === 'arm64' ? 'arm64' : null;
+    if (!os || !cpu)
+        return null;
+    // Only linux ships musl variants; darwin has no such split.
+    return `botmux-${os}-${cpu}${os === 'linux' && musl ? '-musl' : ''}`;
+}
+/** Download base for a release tag, mirroring install.sh's URL construction. */
+export function releaseAssetBaseUrl(version) {
+    return `https://github.com/${GITHUB_REPO}/releases/download/v${version.replace(/^v/i, '')}`;
+}
+// ── The self-update itself ─────────────────────────────────────────────────────
+const SELF_UPDATE_UA = 'botmux-self-update';
+async function sha256File(path) {
+    const hash = createHash('sha256');
+    await pipeline(createReadStream(path), hash);
+    return hash.digest('hex');
+}
+/**
+ * Replace the running standalone binary with `version`'s published asset.
+ *
+ * ── WHY A RENAME AND NOT A WRITE (do not "simplify" this) ─────────────────────
+ * MEASURED on Linux with a real ELF:
+ *
+ *   open(target,'r+b').write(…)  → OSError 26 ETXTBSY "Text file busy"
+ *   rename(new, target)          → succeeds; the running process keeps executing
+ *                                  the old inode and finishes normally
+ *
+ * So the update MUST land as a rename over the path, never an in-place write:
+ * the kernel refuses to let us scribble on the executable of a live process, and
+ * a rename is also what makes the swap atomic for anything about to `exec` it.
+ * The temp file is created in the SAME directory as the target so the rename is
+ * within one filesystem (a cross-device rename fails with EXDEV, and copying
+ * would reintroduce the torn-file window this avoids).
+ *
+ * Checksum verification happens BEFORE the rename, so a truncated or tampered
+ * download is discarded while the working binary is still in place. A release
+ * that publishes no `.sha256` is a warning, not a failure — matching install.sh,
+ * which has always tolerated that.
+ *
+ * ── WHY NO `realpathSync(target)` ─────────────────────────────────────────────
+ * Renaming over a SYMLINK replaces the link itself and orphans its target
+ * (measured). That would matter if `target` could be a symlink — but the default
+ * target is `process.execPath`, which the OS has already resolved: MEASURED with a
+ * compiled binary invoked through a symlink, `process.execPath` reports the real
+ * file, never the link. So the symlink case is unreachable on the production path,
+ * and resolving again would only add a failure mode of its own (an unreadable
+ * parent dir). install.sh's plain `mv` has the same semantics.
+ */
+export async function replaceStandaloneBinary(version, target = process.execPath, deps = {}) {
+    const asset = releaseAssetName();
+    if (!asset) {
+        throw new Error(`当前平台没有发布二进制（${process.platform}-${process.arch}）`);
+    }
+    const base = releaseAssetBaseUrl(version);
+    const proxy = resolveHttpProxy();
+    const fetchStream = deps.fetchStream
+        ?? (async (url) => await getReleaseStream(url, proxy, SELF_UPDATE_UA));
+    const fetchChecksum = deps.fetchChecksum ?? (async (url) => {
+        try {
+            const res = await getReleaseStream(url, proxy, SELF_UPDATE_UA);
+            const chunks = [];
+            for await (const chunk of res)
+                chunks.push(Buffer.from(chunk));
+            // The file is "<sha256>  <filename>"; take the first field.
+            const first = Buffer.concat(chunks).toString('utf-8').trim().split(/\s+/)[0] ?? '';
+            return /^[0-9a-f]{64}$/i.test(first) ? first.toLowerCase() : null;
+        }
+        catch {
+            return null; // no checksum published (or unreachable) → warn, don't fail
+        }
+    });
+    // Same directory as the target: keeps the rename intra-filesystem (EXDEV).
+    const dir = dirname(target);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.botmux-update.${process.pid}.${randomBytes(4).toString('hex')}.tmp`);
+    try {
+        const res = await fetchStream(`${base}/${asset}`);
+        await pipeline(res, createWriteStream(tmp));
+        const expected = await fetchChecksum(`${base}/${asset}.sha256`);
+        if (expected) {
+            const actual = await sha256File(tmp);
+            if (actual !== expected) {
+                throw new Error(`${asset} SHA-256 校验不通过（期望 ${expected}，实际 ${actual}）`);
+            }
+        }
+        const bytes = statSync(tmp).size;
+        // A truncated download that still passed (no checksum published) would leave
+        // an unrunnable binary in place of a working one. The real assets are ~100MB+;
+        // anything under a megabyte is a GitHub error page, not an executable.
+        if (bytes < 1_000_000) {
+            throw new Error(`${asset} 下载内容异常（仅 ${bytes} 字节，疑似错误页而非二进制）`);
+        }
+        chmodSync(tmp, 0o755);
+        // Atomic swap. NOT a write to `target` — that is ETXTBSY (see header).
+        renameSync(tmp, target);
+        return { asset, target, bytes };
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=binary-self-update.js.map

package/dist/core/binary-self-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-self-update.js","sourceRoot":"","sources":["../../src/core/binary-self-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EACvE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GACxC,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE3E;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,2BAA2B,CAAC;AAEnC,kFAAkF;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACxB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,SAII,EAAE;IAEN,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE;QAChD,IAAI,CAAC;YACH,OAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAoD;gBACrF,EAAE,MAAM,EAAE,mBAAmB,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE;QACjD,IAAI,CAAC;YAAC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE;QAC7C,IAAI,CAAC;YAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,sCAAsC;IACxE,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,CAAC,IAAI,EAC3B,OAAgB,UAAU,CAAC,QAAQ,CAAC;IAEpC,MAAM,EAAE,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,MAAM,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,OAAO,UAAU,EAAE,IAAI,GAAG,GAAG,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,sBAAsB,WAAW,uBAAuB,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,kFAAkF;AAElF,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAE5C,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,SAAiB,OAAO,CAAC,QAAQ,EACjC,OAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW;WAC/B,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,CAAC;YACzE,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnF,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,4DAA4D;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,QAAQ,OAAO,MAAM,GAAG,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACjC,6EAA6E;QAC7E,+EAA+E;QAC/E,uEAAuE;QACvE,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,KAAK,iBAAiB,CAAC,CAAC;QAC/D,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,uEAAuE;QACvE,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}