codex-overleaf-link 2.5.1 → 2.6.5

package/extension/bootstrap/manifest.template.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Codex Overleaf Link",
-  "version": "2.5.1",
+  "version": "2.6.5",
   "description": "Connect the active Overleaf project to a local Codex bridge.",
   "icons": {
     "16": "assets/icons/icon16.png",

package/extension/src/background.js

@@ -66,6 +66,8 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
   'use strict';
 
   const HOST_NAME = 'com.codex.overleaf';
+  const NATIVE_PING_TIMEOUT_MS = 20000;
+  const NATIVE_REQUEST_TIMEOUT_MS = 60000;
   const MANAGED_UPDATE_STATE_KEY = 'codex-overleaf-managed-update-state-v1';
   const MANAGED_UPDATE_CONSENT_KEY = 'codex-overleaf-update-consent-v1';
   const MANAGED_UPDATE_TABS_KEY = 'codex-overleaf-managed-update-tabs-v1';
@@ -189,6 +191,17 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
         .catch(error => sendResponse({ ok: false, journals: [], error: getErrorMessage(error, 'Journal read failed.') }));
       return true;
     }
+    if (message?.type === 'codex-overleaf/run-journal/known') {
+      if (!isAllowedOverleafSender(sender)) {
+        sendResponse({ ok: false, known: [] });
+        return undefined;
+      }
+      knownRunJournals(Array.isArray(message.requestIds) ? message.requestIds.map(String).slice(0, 64) : [],
+        Array.isArray(message.owners) ? message.owners.slice(0, 64) : [])
+        .then(result => sendResponse({ ok: true, ...result }))
+        .catch(error => sendResponse({ ok: false, known: [], error: getErrorMessage(error, 'Journal read failed.') }));
+      return true;
+    }
     if (message?.type === 'codex-overleaf/run-journal/ack') {
       if (!isAllowedOverleafSender(sender)) {
         sendResponse({ ok: false });
@@ -266,6 +279,9 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
         return;
       }
       if (message.type === 'release') {
+        const current = ownerBindings.get(portConnection);
+        if (!current || ['requestId', 'projectKey', 'clientRunId', 'sessionId'].some(key => current[key] !== message[key])
+          || (current.browserOnly && current.ownerToken !== message.ownerToken)) return;
         ownerBindings.delete(portConnection);
         clearTimeout(ownerCancelTimers.get(requestId));
         ownerCancelTimers.delete(requestId);
@@ -278,9 +294,20 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
           documentId: String(portConnection.sender?.documentId || ''),
           tabId: portConnection.sender?.tab?.id,
           clientRunId: String(message.clientRunId || ''),
-          sessionId: String(message.sessionId || '')
+          sessionId: String(message.sessionId || ''),
+          browserOnly: message.browserOnly === true,
+          ownerToken: String(message.ownerToken || '')
         };
+        if (binding.browserOnly && (!binding.projectKey || !binding.clientRunId || !binding.sessionId || !binding.ownerToken)) return;
+        if (binding.browserOnly && managedUpdateExecutionLocked) {
+          try { portConnection.postMessage?.({ type: 'bound', ...binding, ok: false }); } catch (_error) { /* port disconnected */ }
+          return;
+        }
         ownerBindings.set(portConnection, binding);
+        if (binding.browserOnly) {
+          try { portConnection.postMessage?.({ type: 'bound', ...binding }); } catch (_error) { /* port disconnected */ }
+          return;
+        }
         restoreRunJournal(binding).then(journal => {
           if (ownerBindings.get(portConnection) !== binding || !journal || runJournals.get(requestId) !== journal) return;
           clearTimeout(ownerCancelTimers.get(requestId));
@@ -295,7 +322,7 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
     portConnection.onDisconnect.addListener(() => {
       const binding = ownerBindings.get(portConnection);
       ownerBindings.delete(portConnection);
-      if (!binding?.requestId) {
+      if (!binding?.requestId || binding.browserOnly) {
         return;
       }
       const timer = setTimeout(() => interruptOwnerlessRun(binding), 150);
@@ -373,11 +400,18 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
         method: request.method,
         retryClass: getNativeRetryClass(request.method),
         retryCount: 0,
+        deadlineTimer: null,
         nativePort: null,
         finalResponseReceived: false,
         eventForwarded: false
       };
       pending.set(id, pendingRequest);
+      const timeoutMs = getNativeRequestTimeoutMs(request.method);
+      if (timeoutMs) {
+        pendingRequest.deadlineTimer = setTimeout(() => {
+          expireNativeRequest(id, pendingRequest);
+        }, timeoutMs);
+      }
       if (request.method === 'codex.run') {
         createRunJournal(id, pendingRequest);
       }
@@ -390,12 +424,71 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
     });
   }
 
+  function getNativeRequestTimeoutMs(method) {
+    if (method === 'bridge.ping') return NATIVE_PING_TIMEOUT_MS;
+    switch (method) {
+      case 'mirror.status':
+      case 'codex.models':
+      case 'codex.providers.list':
+      case 'codex.providers.upsert':
+      case 'codex.providers.activate':
+      case 'codex.providers.clear-secret':
+      case 'codex.providers.delete':
+      case 'writing-style.get':
+      case 'writing-style.set':
+      case 'skills.list':
+      case 'asset.readChunk':
+      case 'update.status':
+      case 'update.check':
+      case 'update.canApply':
+        return NATIVE_REQUEST_TIMEOUT_MS;
+      default:
+        return 0;
+    }
+  }
+
+  function expireNativeRequest(id, pendingRequest) {
+    if (pending.get(id) !== pendingRequest || pendingRequest.finalResponseReceived) return;
+    pending.delete(id);
+    clearTimeout(pendingRequest.deadlineTimer);
+    pendingRequest.finalResponseReceived = true;
+    pendingRequest.resolve({
+      id,
+      ok: false,
+      error: {
+        code: 'native_request_timeout',
+        message: 'The local service did not respond.'
+      }
+    });
+    if (pendingRequest.method !== 'bridge.ping') return;
+    const failedPort = pendingRequest.nativePort;
+    if (!failedPort) return;
+    const hasActiveWork = Array.from(pending.values()).some(request => (
+      request.nativePort === failedPort && (
+        request.retryClass === 'safe_sync_retry' ||
+        (request.retryClass === 'no_silent_retry' && !getNativeRequestTimeoutMs(request.method))
+      )
+    ));
+    // A failed diagnostic ping must not abort execution or mirror writes.
+    if (hasActiveWork) return;
+    if (port === failedPort) port = null;
+    // A hung Host is retired without replaying requests or reconnecting until
+    // the next caller asks, only when no execution or mirror write owns it.
+    for (const [pendingId, interrupted] of Array.from(pending.entries())) {
+      if (interrupted.nativePort === failedPort) {
+        rejectInterruptedNativeRequest(pendingId, interrupted, 'The local service did not respond.');
+      }
+    }
+    try { failedPort.disconnect(); } catch (_error) { /* The port is already retired. */ }
+  }
+
   async function requestManagedInternal(payload) {
     if (managedBootstrapRuntime && ['update.status', 'update.confirm'].includes(payload?.method)) {
       payload = { ...payload, params: { ...payload.params,
         bootstrapRevision: String(globalThis.__CODEX_OVERLEAF_BOOTSTRAP_REVISION__ || '') } };
     }
-    if (managedBootstrapRuntime && payload?.method === 'update.apply') {
+    if (managedBootstrapRuntime && (payload?.method === 'update.apply'
+      || (payload?.method === 'update.rollback' && payload?.params?.reasonCode === 'update_user_rollback'))) {
       const gate = await verifyManagedUpdateSafety();
       if (!gate.ok) {
         return gate;
@@ -450,6 +543,7 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
     }
     const pendingState = globalThis.CodexOverleafNativeBridge?.getPendingState?.() || {};
     const backgroundBlockers = Number(pendingState.executionRequests || 0) > 0
+      || Array.from(ownerBindings.values()).some(binding => binding.browserOnly)
       ? ['background_execution_pending']
       : [];
     const blockers = [
@@ -813,6 +907,7 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
         return;
       }
       pendingRequest.finalResponseReceived = true;
+      clearTimeout(pendingRequest.deadlineTimer);
       pending.delete(id);
       finalizeRunJournal(id, message).catch(() => {}).finally(() => {
         pendingRequest.resolve(message);
@@ -874,6 +969,7 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
 
   function rejectInterruptedNativeRequest(pendingId, pendingRequest, errorMessage) {
     pending.delete(pendingId);
+    clearTimeout(pendingRequest.deadlineTimer);
     finalizeRunJournal(pendingId, {
       ok: false,
       error: {
@@ -910,6 +1006,7 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
     if (pending.size === 1) {
       const [pendingId, pendingRequest] = pending.entries().next().value;
       pendingRequest.finalResponseReceived = true;
+      clearTimeout(pendingRequest.deadlineTimer);
       pendingRequest.resolve({
         ...message,
         id: pendingId
@@ -995,6 +1092,9 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
       clientRunId: String(params.clientRunId || ''),
       sessionId: String(params.clientSessionId || ''),
       task: sanitizeJournalString(params.task).slice(0, 12000),
+      ...(params.operation === 'compact' ? {
+        operation: 'compact', threadId: String(params.threadId || '').slice(0, 160)
+      } : {}),
       mode: String(params.mode || ''),
       model: String(params.model || ''),
       ownerTabId: pendingRequest.tabId,
@@ -1176,6 +1276,51 @@ if (!globalThis.CodexOverleafBackgroundUpdateSafety) {
     return entries.slice(-16).map(([_key, value]) => value);
   }
 
+  // Browser-only retries outlive their original Native journal. Protect only
+  // a live port whose request/project/session/run matches the queried record.
+  async function knownRunJournals(requestIds, owners = []) {
+    await Promise.allSettled(Array.from(journalLoads.values(), load => load.promise));
+    await Promise.allSettled(Array.from(journalWrites.values()));
+    const storage = chrome.storage?.session;
+    if (!storage) throw new Error('Run journal storage is unavailable.');
+    const values = requestIds.length ? await storage.get(requestIds.map(id => RUN_JOURNAL_PREFIX + id)) : {};
+    // A persisted startup snapshot may lag behind its owner's Native dispatch.
+    // Keep that same project/session/run alive through the request-id transition.
+    const matches = (candidate, binding) => (candidate?.preDispatch === true
+      ? ['projectKey', 'clientRunId', 'sessionId'] : ['requestId', 'projectKey', 'clientRunId', 'sessionId'])
+      .every(key => Boolean(candidate?.[key]) && candidate[key] === binding?.[key]);
+    const known = requestIds.filter(id => runJournals.has(id) || Boolean(values?.[RUN_JOURNAL_PREFIX + id])
+      || owners.some(candidate => candidate?.requestId === id && Array.from(ownerBindings.values()).some(binding => matches(candidate, binding))));
+    const missing = owners.filter(candidate => requestIds.includes(candidate?.requestId) && !known.includes(candidate.requestId));
+    if (!missing.length) return { known, ownersChecked: true, preDispatchChecked: true };
+    // A worker restart drops ports before hidden pages can process reconnect
+    // timers. The page's existing health receiver can still report its binding.
+    const unknown = () => ({ known, ownersChecked: false, preDispatchChecked: false, retryAfterMs: 1000 });
+    const tabs = await chrome.tabs.query({ url: MANAGED_OVERLEAF_MATCHES }).catch(() => null);
+    if (!Array.isArray(tabs)) return unknown();
+    const projects = new Set(missing.map(candidate => candidate.projectKey));
+    const relevant = tabs.filter(tab => isManagedEditorTab(tab) && !tab.discarded && tab.status !== 'unloaded'
+      && projects.has(new URL(tab.url).pathname.split('/')[2]));
+    const responses = await Promise.all(relevant.map(async tab => {
+      let timer;
+      try {
+        return await Promise.race([
+          chrome.tabs.sendMessage(tab.id, { type: 'codex-overleaf/runtime-health-probe' }, { frameId: 0 }),
+          new Promise(resolve => { timer = setTimeout(() => resolve(null), 1500); })
+        ]);
+      } catch (_error) { return null; }
+      finally { clearTimeout(timer); }
+    }));
+    const needsStartupInventory = missing.some(candidate => candidate.preDispatch === true);
+    if (responses.some(response => response?.ok !== true || ![1, 2].includes(response.runOwnerProtocol)
+      || (needsStartupInventory && response.runOwnerProtocol !== 2) || !Array.isArray(response.runOwners))) return unknown();
+    for (const candidate of missing) {
+      if (responses.some(response => response.runOwners.some(binding => matches(candidate, binding)))
+        || Array.from(ownerBindings.values()).some(binding => matches(candidate, binding))) known.push(candidate.requestId);
+    }
+    return { known, ownersChecked: true, preDispatchChecked: true };
+  }
+
   function pruneInMemoryRunJournals() {
     if (runJournals.size <= 16) {
       return;

package/extension/src/backgroundSharedSessions.js

@@ -16,6 +16,7 @@
   const clone = value => value === undefined ? undefined : JSON.parse(JSON.stringify(value));
   const equal = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   const failure = (code, message) => Object.assign(new Error(message), { code });
+  const conflict = () => failure('shared_session_conflict', 'The same session was edited in another tab. Refresh its history before retrying; the local draft was kept.');
   function part(value) {
     if (typeof value !== 'string' || !value.trim() || value.length > 256 || /[\0\r\n]/.test(value))
       throw failure('shared_store_scope_invalid', 'The shared session identity is invalid.');
@@ -71,7 +72,59 @@
       }
       return result;
     }
-    throw failure('shared_session_conflict', 'The same session was edited in another tab. Refresh its history before retrying; the local draft was kept.');
+    throw conflict();
+  }
+
+  function titleValue(record) {
+    return { title: record.title || '', titleSource: record.titleSource === 'manual' ? 'manual' : 'auto' };
+  }
+  function manualTitleChange(base, next) {
+    return next.titleSource === 'manual' ? next.title !== base.title : base.titleSource === 'manual';
+  }
+  function mergeTitle(base, current, incoming) {
+    const before = titleValue(base), stored = titleValue(current), proposed = titleValue(incoming);
+    if (equal(proposed, before)) return stored;
+    if (equal(stored, before) || equal(stored, proposed)) return proposed;
+    // Auto derivations (including legacy normalization) carry no rename intent.
+    if (!manualTitleChange(before, proposed)) return stored;
+    if (!manualTitleChange(before, stored)) return proposed;
+    // The pair is one intent; merging its scalar members separately could
+    // combine a peer rename with this page's reset to auto.
+    throw conflict();
+  }
+  function draftConsumption(record) {
+    const marker = record.draftConsumption;
+    return record.task === '' && typeof marker?.task === 'string' && marker.task
+      && typeof marker.runId === 'string' && marker.runId
+      && (record.runs || []).some(run => run.id === marker.runId && !run.forkSnapshot
+        && run.runProjectId === record.projectId) ? marker : null;
+  }
+  function mergeSession(base, current, incoming) {
+    const currentConsumption = draftConsumption(current), incomingConsumption = draftConsumption(incoming);
+    const consumed = marker => marker && marker.task === base.task && !equal(marker, base.draftConsumption);
+    let task;
+    if (equal(incoming.task, base.task)) task = current.task;
+    else if (equal(current.task, base.task) || equal(current.task, incoming.task)) task = incoming.task;
+    else if (consumed(incomingConsumption)) task = current.task;
+    else if (consumed(currentConsumption)) task = incoming.task;
+    else task = mergeValue(base.task, current.task, incoming.task, 'task');
+
+    const result = { ...mergeTitle(base, current, incoming) };
+    if (task !== undefined) result.task = clone(task);
+    // Summaries are derived metadata, never a second draft edit. Prefer the
+    // stored summary when both sides have the winning task (including legacy forms).
+    const taskOwner = equal(task, current.task) ? current : incoming;
+    if (taskOwner.safeTaskSummary !== undefined) result.safeTaskSummary = clone(taskOwner.safeTaskSummary);
+    if (task === '' && (incomingConsumption || currentConsumption))
+      result.draftConsumption = clone(consumed(incomingConsumption)
+        ? incomingConsumption : currentConsumption || incomingConsumption);
+    const derived = new Set(['title', 'titleSource', 'task', 'safeTaskSummary', 'draftConsumption', 'sharedRevision']);
+    for (const key of new Set([...Object.keys(base), ...Object.keys(current), ...Object.keys(incoming)])) {
+      if (derived.has(key)) continue;
+      const value = mergeValue(base[key], current[key], incoming[key], key);
+      if (value !== undefined) Object.defineProperty(result, key, { value, enumerable: true, configurable: true, writable: true });
+    }
+    return result;
   }
 
   function createService(options = {}) {
@@ -232,7 +285,7 @@
                   if (!base) throw failure('shared_session_conflict', 'Reload the session before updating existing history.');
                   // Keep the established first-durable-review-decision policy.
                   const reviewed = options.mergeSessionReviewState?.(candidate, existing.record, message.reviewRunIds || []) || candidate;
-                  next = mergeValue(base, existing.record, reviewed);
+                  next = mergeSession(base, existing.record, reviewed);
                 } else if (base && !importing) {
                   throw failure('shared_session_deleted', 'The session no longer exists.');
                 }

package/extension/src/backgroundUpdateCoordinator.js

@@ -37,8 +37,11 @@
     'codex-overleaf/consent-update-cancel',
     'codex-overleaf/consent-update-recover',
     'codex-overleaf/consent-update-dismiss',
-    'codex-overleaf/consent-update-reload'
+    'codex-overleaf/consent-update-reload',
+    'codex-overleaf/consent-update-rollback'
   ]);
+  const USER_ROLLBACK_REASON = 'update_user_rollback';
+  const RECOVERABLE_TRANSACTION_STATES = new Set(['awaiting_health', 'bootstrap_pending', 'bootstrap_rolling_back']);
 
   const policy = root.CodexOverleafUpdateConsent;
   const revocation = root.CodexOverleafUpdateRevocation;
@@ -156,6 +159,8 @@
         return dismissCompletedUpdate();
       case 'codex-overleaf/consent-update-reload':
         return reloadInstalledRuntime();
+      case 'codex-overleaf/consent-update-rollback':
+        return restorePreviousVersion();
       default:
         throw codedError('unknown_update_action', 'Unknown update action.');
     }
@@ -174,14 +179,14 @@
         code: '', message: '', blocker: '', blockers: [], cooldownUntil: 0, postponeUntil: LEGACY_GUARD }, { operation });
       try {
         const result = await withTimeout(requestNative('update.check', {
-          operationId: operation.id, currentVersion: currentVersion(), etag: currentState.etag || ''
+          operationId: operation.id, currentVersion: currentVersion(), etag: currentState.etag || '', manual: manual === true
         }), CHECK_REQUEST_TIMEOUT_MS, codedError('update_check_timeout', 'The managed update check did not complete in time.'));
         assertOperation(operation);
         const checkedAt = Date.now();
         if (result.available) {
           const latestVersion = result.latestVersion || currentState.latestVersion;
           await setConsentState({ ...consent,
-            ...(latestVersion !== consent.snoozedVersion ? { snoozedVersion: '', snoozedUntil: 0 } : {}),
+            ...(manual || latestVersion !== consent.snoozedVersion ? { snoozedVersion: '', snoozedUntil: 0 } : {}),
             lastPromptedVersion: latestVersion,
             lastPromptedAt: manual ? checkedAt : consent.lastPromptedAt
           }, { operation });
@@ -198,7 +203,8 @@
             currentVersion: result.currentVersion || currentVersion(), latestVersion: result.latestVersion,
             managed: true, etag: result.etag || currentState.etag || '', lastCheckedAt: checkedAt,
             postponeUntil: LEGACY_GUARD, code: result.reason === 'prerelease_promotion_requires_manual_update'
-              ? result.reason : 'update_bootstrap_upgrade_required', message: '', cooldownUntil: 0,
+              ? result.reason : result.code === 'update_bootstrap_source_mismatch'
+                ? result.code : 'update_bootstrap_upgrade_required', message: '', cooldownUntil: 0,
             manualReason: result.manualInstall?.reason || {}, cancelRequested: false
           }, { operation });
         } else {
@@ -207,9 +213,11 @@
             latestVersion: result.latestVersion || result.currentVersion || currentVersion(),
             // A 304 without a verified Native candidate is a cache miss. Drop
             // its validator so the next normal check can obtain fresh bytes.
-            etag: result.reason === 'not_modified' ? '' : result.etag || currentState.etag || '', lastCheckedAt: checkedAt,
+            // A skipped version also needs fresh bytes when checked explicitly.
+            etag: ['not_modified', 'cooldown'].includes(result.reason) ? '' : result.etag || currentState.etag || '', lastCheckedAt: checkedAt,
             postponeUntil: LEGACY_GUARD, transactionId: '',
-            code: result.reason === 'cooldown' ? 'update_cooldown' : '',
+            code: result.reason === 'cooldown'
+              ? (result.cooldownReason === USER_ROLLBACK_REASON ? 'update_skipped_after_rollback' : 'update_cooldown') : '',
             cooldownUntil: result.reason === 'cooldown' ? Number(result.cooldownUntil || 0) : 0,
             manualReason: {}, message: '', cancelRequested: false
           }, { operation });
@@ -508,7 +516,7 @@
   async function cancelUpdateCore() {
     const [state, consent] = await Promise.all([getUpdateState(), getConsentState()]);
     if (['applying', 'awaiting_health', 'rolling_back'].includes(state.state)
-      || activeOperation?.phase === 'applying' || state.recoveryPending) {
+      || ['applying', 'rolling_back'].includes(activeOperation?.phase) || state.recoveryPending) {
       throw codedError('update_revoke_too_late', 'The update is being installed or recovered.');
     }
     const operation = activeOperation;
@@ -563,6 +571,7 @@
 
 
   function reconcileRecoveryState() {
+    if (activeOperation?.phase === 'rolling_back') return getUpdateState();
     if (recoveryPromise) return recoveryPromise;
     recoveryPromise = (async () => {
       if (!await waitForBootstrapOwnership()) return getUpdateState();
@@ -652,10 +661,35 @@
         if (transaction?.state === 'rolled_back' && status.installedAligned
           && status.activeVersion === transaction.sourceVersion
           && (!state.transactionId || transaction.id === state.transactionId)) {
-          const restored = await setUpdateState({ state: 'rolled_back', currentVersion: transaction.sourceVersion,
+          const userRestore = transaction.reasonCode === USER_ROLLBACK_REASON;
+          if ((userRestore || state.code === 'update_rollback_unconfirmed')
+            && !root.CodexOverleafUpdateRuntimeIdentity?.verifiedRollback(status)) {
+            throw codedError('update_rollback_unconfirmed', 'Rollback returned incomplete evidence.');
+          }
+          if (userRestore) {
+            const pending = (await chrome.storage.local.get(MANUAL_RELOAD_TABS_KEY))?.[MANUAL_RELOAD_TABS_KEY];
+            const tabs = await chrome.tabs.query({ url: OVERLEAF_MATCHES });
+            await assertRecoveryOwner(recoveryOwner);
+            await chrome.storage.local.set({ [UPDATE_RELOAD_TABS_KEY]: [],
+              [MANUAL_RELOAD_TABS_KEY]: pending?.targetVersion === transaction.sourceVersion ? pending : {
+                targetVersion: transaction.sourceVersion, tabIds: tabs.filter(isUsableEditorTab).map(tab => tab.id)
+              } });
+          }
+          const value = { state: 'rolled_back', currentVersion: transaction.sourceVersion,
             transactionId: transaction.id, recoveryPending: false, cancelRequested: false,
             code: transaction.reasonCode || 'update_rolled_back', message: 'The previous version has been restored.'
-          }, recoveryOptions);
+          };
+          const restored = userRestore
+            ? (await setUpdateAndConsentState({ ...value, latestVersion: transaction.targetVersion,
+              postponeUntil: LEGACY_GUARD, etag: '', cooldownUntil: 0
+            }, policy.normalizeConsentState({ snoozedVersion: transaction.targetVersion,
+              snoozedUntil: Date.now() + SNOOZE_MS }), recoveryOptions)).updateState
+            : await setUpdateState(value, recoveryOptions);
+          runtimeStatus = null;
+          if (userRestore) {
+            try { await requireReloadSafePoint(); } catch (_error) { return restored; }
+          }
+          if (recoveryOwner.generation !== operationGeneration) return getUpdateState();
           setTimeout(() => chrome.runtime.reload(), 0);
           return restored;
         }
@@ -765,9 +799,15 @@
       now: Date.now()
     });
     view.runtime = runtime;
+    // Native decides availability: a committed pair with its source still on
+    // disk, or any unsettled installation that recovery must finish anyway.
+    view.restorePrevious = !state.cancelRequested && !activeOperation
+      && (runtime.rollbackAvailable?.sourceVersion || (state.recoveryPending && state.transactionId))
+      ? { version: runtime.rollbackAvailable?.sourceVersion || '' } : null;
+    view.actions = { ...view.actions, restorePrevious: Boolean(view.restorePrevious) };
     const pending = (await chrome.storage.local.get(MANUAL_RELOAD_TABS_KEY))?.[MANUAL_RELOAD_TABS_KEY];
     const pagesPending = runtime.state === 'aligned' && pending?.targetVersion === runtime.installedVersion && pending.tabIds?.length;
-    if (runtime.state === 'reload_required' || pagesPending) {
+    if (!state.recoveryPending && (runtime.state === 'reload_required' || pagesPending)) {
       view.showPanel = true;
       view.state = { ...state, state: pagesPending ? 'reload_tabs_required' : 'reload_required',
         currentVersion: runtime.extensionVersion, latestVersion: runtime.installedVersion,
@@ -784,9 +824,9 @@
     runtimeStatusRead = withTimeout(requestNative('update.status'), 4000,
       codedError('update_status_timeout', 'Installed version inspection timed out.')).then(status => {
       runtimeStatusAt = Date.now();
-      runtimeStatus = root.CodexOverleafUpdateRuntimeIdentity.inspectInstalledRuntime(status, {
+      runtimeStatus = { ...root.CodexOverleafUpdateRuntimeIdentity.inspectInstalledRuntime(status, {
         extensionVersion: chrome.runtime.getManifest().version, runtimeVersion: currentVersion()
-      });
+      }), rollbackAvailable: status.rollbackAvailable || null };
       return runtimeStatus;
     }).catch(() => ({ state: 'unknown' })).finally(() => { runtimeStatusRead = null; });
     return runtimeStatusRead;
@@ -808,6 +848,9 @@
   }
 
   async function reloadInstalledRuntime() {
+    if ((await getUpdateState()).recoveryPending) {
+      throw codedError('update_rollback_unconfirmed', 'Confirm update recovery before reloading.');
+    }
     const runtime = await readRuntimeStatus(true);
     if (runtime.state === 'aligned') { await finishManualRuntimeReload(); return getView(); }
     if (runtime.state !== 'reload_required') throw codedError('update_reload_unavailable', 'No verified installed update is awaiting reload.');
@@ -819,7 +862,80 @@
     return getView();
   }
 
+  // Returns a committed update, or an update whose installation or recovery is
+  // unsettled, to the source pair Native still holds. Native owns the decision;
+  // the browser only supplies the transaction it observed and reloads after an
+  // exact readback.
+  async function restorePreviousVersion() {
+    if (activeOperation || cancellationPromise) {
+      throw codedError('update_transaction_in_progress', 'Another update operation is in progress.');
+    }
+    const operation = beginOperation();
+    operation.phase = 'rolling_back';
+    try {
+      const status = await requestNative('update.status');
+      assertOperation(operation);
+      const transaction = status.transaction;
+      const committed = transaction?.state === 'committed' && status.rollbackAvailable?.transactionId === transaction.id;
+      if (!transaction?.id || (!committed && !RECOVERABLE_TRANSACTION_STATES.has(transaction.state))) {
+        throw codedError('update_rollback_unavailable', 'No installed update can be restored to its previous version.');
+      }
+      // Page refresh happens after restoration, so it waits for the same saved
+      // and idle point as a reload of an installed update.
+      const tabs = await requireReloadSafePoint();
+      assertOperation(operation);
+      const generation = operation.generation;
+      clearIdleRetryTimer();
+      await setUpdateState({ state: 'rolling_back', transactionId: transaction.id,
+        currentVersion: transaction.targetVersion, latestVersion: transaction.targetVersion,
+        recoveryPending: false, cancelRequested: false, operationId: '', code: '', message: ''
+      }, { observed: true, generation });
+      try {
+        // Old source runtimes consume this key through their saved/idle check.
+        // The fixed Bootstrap's legacy list would refresh tabs unconditionally.
+        await chrome.storage.local.set({ [UPDATE_RELOAD_TABS_KEY]: [],
+          [MANUAL_RELOAD_TABS_KEY]: { targetVersion: transaction.sourceVersion, tabIds: tabs.map(tab => tab.id) } });
+        assertOperation(operation);
+        const rolledBack = await requestNative('update.rollback', { transactionId: transaction.id,
+          expectedState: transaction.state, reasonCode: USER_ROLLBACK_REASON });
+        assertOperation(operation);
+        const readback = await requestNative('update.status');
+        assertOperation(operation);
+        if (rolledBack.transactionId !== transaction.id || rolledBack.state !== 'rolled_back'
+          || rolledBack.version !== transaction.sourceVersion || readback.transaction?.id !== transaction.id
+          || readback.transaction.sourceVersion !== transaction.sourceVersion
+          || readback.transaction.targetVersion !== transaction.targetVersion
+          || !root.CodexOverleafUpdateRuntimeIdentity?.verifiedRollback({ ...readback,
+            transaction: { ...readback.transaction, bootstrapRevision: transaction.bootstrapRevision } })
+          || !['extensionVersion', 'nativeVersion', 'extensionSha256', 'nativeSha256', 'bootstrapSha256']
+            .every(key => readback.restoredPair[key] === rolledBack.restoredPair?.[key])) {
+          throw codedError('update_rollback_unconfirmed', 'Rollback returned incomplete evidence.');
+        }
+      } catch (error) {
+        await setUpdateState({ state: 'failed', transactionId: transaction.id, recoveryPending: true,
+          cancelRequested: false, code: safeCode(error), message: safeMessage(error)
+        }, { observed: true, generation }).catch(() => {});
+        throw error;
+      }
+      await setUpdateAndConsentState({ state: 'rolled_back', transactionId: transaction.id,
+        currentVersion: transaction.sourceVersion, latestVersion: transaction.targetVersion,
+        recoveryPending: false, cancelRequested: false, blocker: '', blockers: [],
+        postponeUntil: LEGACY_GUARD, etag: '', cooldownUntil: 0,
+        code: USER_ROLLBACK_REASON, message: 'You restored the previous version.'
+      }, policy.normalizeConsentState({ snoozedVersion: transaction.targetVersion,
+        snoozedUntil: Date.now() + SNOOZE_MS }), { observed: true, generation });
+      runtimeStatus = null;
+      // The disk restore is complete even if new work now prevents a reload.
+      // Keep the existing Reload action available without attempting rollback again.
+      try { await requireReloadSafePoint(); } catch (_error) { return getView(); }
+      assertOperation(operation);
+      setTimeout(() => chrome.runtime.reload(), 0);
+      return getView();
+    } finally { finishOperation(operation); }
+  }
+
   async function finishManualRuntimeReload() {
+    if ((await getUpdateState()).recoveryPending) return;
     const pending = (await chrome.storage.local.get(MANUAL_RELOAD_TABS_KEY))?.[MANUAL_RELOAD_TABS_KEY];
     if (!pending || !Array.isArray(pending.tabIds)) return;
     const runtime = await readRuntimeStatus(true);