create-principles-disciple 1.121.7 → 1.121.9

package/console/dist/server/routes/owner-identity.js

@@ -0,0 +1,76 @@
+import { resolveOwnerIdentity, readOwnerIdentityFile, writeOwnerIdentityFile, deleteOwnerIdentityFile, } from '@principles/core/runtime-v2';
+import { sendSuccess, sendError, sendBadRequest, sendMethodNotAllowed } from '../utils/response.js';
+import { resolveOwnerConfigSnapshot } from './governance.js';
+const MAX_BODY_SIZE = 16 * 1024;
+async function readJson(req) {
+    const chunks = [];
+    let totalSize = 0;
+    for await (const chunk of req) {
+        const buf = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+        totalSize += buf.length;
+        if (totalSize > MAX_BODY_SIZE)
+            throw new Error('payload_too_large');
+        chunks.push(buf);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf-8'));
+}
+/* eslint-disable @typescript-eslint/max-params */
+export async function handleOwnerIdentityRoute(req, res, homeDir, subPath, authConfig) {
+    if (subPath !== '' && subPath !== '/') {
+        sendError(res, 404, 'not_found', 'Unknown owner identity endpoint.', { nextAction: 'Use GET / POST / DELETE /api/v1/owner-identity.' });
+        return;
+    }
+    const method = req.method ?? 'GET';
+    if (method === 'GET') {
+        const file = readOwnerIdentityFile(homeDir);
+        const resolved = resolveOwnerIdentity(process.env, homeDir);
+        const view = {
+            resolved,
+            fileRecord: file.record,
+            ...(file.error === undefined ? {} : { fileError: file.error }),
+            governance: resolveOwnerConfigSnapshot(authConfig, resolved),
+        };
+        sendSuccess(res, view);
+        return;
+    }
+    if (method === 'POST') {
+        let body;
+        try {
+            body = await readJson(req);
+        }
+        catch {
+            sendBadRequest(res, 'Invalid JSON body or payload too large.');
+            return;
+        }
+        const value = body;
+        const ownerId = typeof value?.ownerId === 'string' ? value.ownerId : '';
+        const credentialId = typeof value?.credentialId === 'string' ? value.credentialId : '';
+        const result = writeOwnerIdentityFile(homeDir, { ownerId, credentialId });
+        if (!result.ok) {
+            sendBadRequest(res, result.error);
+            return;
+        }
+        const resolved = resolveOwnerIdentity(process.env, homeDir);
+        sendSuccess(res, {
+            record: result.record,
+            source: 'file',
+            governance: resolveOwnerConfigSnapshot(authConfig, resolved),
+        });
+        return;
+    }
+    if (method === 'DELETE') {
+        const result = deleteOwnerIdentityFile(homeDir);
+        if (!result.ok) {
+            sendError(res, 500, 'owner_identity_delete_failed', result.error);
+            return;
+        }
+        const resolved = resolveOwnerIdentity(process.env, homeDir);
+        sendSuccess(res, {
+            ok: true,
+            source: 'none',
+            governance: resolveOwnerConfigSnapshot(authConfig, resolved),
+        });
+        return;
+    }
+    sendMethodNotAllowed(res);
+}

package/console/dist/server/routes/update-history.d.ts

@@ -1,11 +1,16 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare const UPDATE_HISTORY_KINDS: readonly ['update', 'reinstall', 'legacy_migration', 'rollback', 'refusal', 'failure', 'recovery', 'unknown'];
+export type UpdateHistoryKind = (typeof UPDATE_HISTORY_KINDS)[number];
 interface UpdateHistoryEntry {
     id: string;
     timestamp: string;
     fromVersion: string;
     toVersion: string;
     success: boolean;
+    kind: UpdateHistoryKind;
     backupPath?: string;
+    reason?: string;
+    nextAction?: string;
 }
 export declare function appendUpdateHistory(workspaceDir: string, entry: Omit<UpdateHistoryEntry, 'id' | 'timestamp'>): void;
 export declare function handleUpdateHistoryRoute(req: IncomingMessage, res: ServerResponse, workspaceDir: string, _subPath: string): Promise<void>;

package/console/dist/server/routes/update-history.js

@@ -1,6 +1,52 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { sendSuccess, sendMethodNotAllowed } from '../utils/response.js';
+export const UPDATE_HISTORY_KINDS = [
+    'update',
+    'reinstall',
+    'legacy_migration',
+    'rollback',
+    'refusal',
+    'failure',
+    'recovery',
+    'unknown',
+];
+function isHistoryKind(value) {
+    return typeof value === 'string' && UPDATE_HISTORY_KINDS.includes(value);
+}
+function parseHistoryEntry(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    const raw = value;
+    if (typeof raw.id !== 'string' ||
+        typeof raw.timestamp !== 'string' ||
+        typeof raw.fromVersion !== 'string' ||
+        typeof raw.toVersion !== 'string' ||
+        typeof raw.success !== 'boolean')
+        return undefined;
+    if (raw.kind !== undefined && !isHistoryKind(raw.kind))
+        return undefined;
+    if (raw.reason !== undefined && typeof raw.reason !== 'string')
+        return undefined;
+    if (raw.nextAction !== undefined && typeof raw.nextAction !== 'string')
+        return undefined;
+    if (raw.backupPath !== undefined && typeof raw.backupPath !== 'string')
+        return undefined;
+    return {
+        id: raw.id,
+        timestamp: raw.timestamp,
+        fromVersion: raw.fromVersion,
+        toVersion: raw.toVersion,
+        success: raw.success,
+        // Pre-Phase-0 records did not identify their operation. The operation is
+        // UNKNOWN — labeling them legacy_migration would claim a migration
+        // happened, which the record cannot prove (unknown ≠ legacy_migration).
+        kind: raw.kind === undefined ? 'unknown' : raw.kind,
+        ...(typeof raw.backupPath === 'string' ? { backupPath: raw.backupPath } : {}),
+        ...(typeof raw.reason === 'string' ? { reason: raw.reason } : {}),
+        ...(typeof raw.nextAction === 'string' ? { nextAction: raw.nextAction } : {}),
+    };
+}
 function getHistoryPath(workspaceDir) {
     return path.join(workspaceDir, '.pd', 'update-history.json');
 }
@@ -10,10 +56,10 @@ function loadHistory(historyPath) {
             const raw = fs.readFileSync(historyPath, 'utf-8');
             const parsed = JSON.parse(raw);
             if (Array.isArray(parsed)) {
-                return parsed.filter((e) => typeof e === 'object' && e !== null &&
-                    typeof e.fromVersion === 'string' &&
-                    typeof e.toVersion === 'string' &&
-                    typeof e.success === 'boolean');
+                return parsed.flatMap((entry) => {
+                    const parsedEntry = parseHistoryEntry(entry);
+                    return parsedEntry === undefined ? [] : [parsedEntry];
+                });
             }
         }
         catch (err) {

package/console/dist/server/routes/update.js

@@ -8,6 +8,7 @@ import { appendUpdateHistory } from './update-history.js';
 import { checkOpenClawGateway, stopOpenClawGateway, restartOpenClawGateway, } from '../utils/gateway.js';
 import { migrateLegacyExtensionBackups, reservePdBackupDestination, resolvePdBackupsRoot, } from '../utils/pd-backups.js';
 import { ActivationCompatibilityReadModel } from '@principles/core/runtime-v2';
+import { getInstallLayoutPaths, resolveInstallLayout } from '@principles/install-layout';
 /**
  * Legacy rule contract preflight (2026-08-19): refuse to swap the runtime
  * while an ACTIVE owner-approved rule still depends on a RuleHost contract
@@ -68,8 +69,48 @@ function resolveOpenclawHome() {
 function resolveExtensionsDir() {
     return path.join(resolveOpenclawHome(), 'extensions');
 }
+function resolveUpdateLayout() {
+    const homeDir = os.homedir();
+    const paths = getInstallLayoutPaths(homeDir);
+    const legacyPluginDir = path.join(resolveExtensionsDir(), 'principles-disciple');
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(paths.manifest, 'utf8'));
+    }
+    catch {
+        manifest = undefined;
+    }
+    const resolution = resolveInstallLayout({
+        homeDir,
+        manifest,
+        canonicalRuntimeExists: fs.existsSync(paths.runtimeDir),
+        legacyExtensionExists: fs.existsSync(legacyPluginDir),
+    });
+    if (resolution.mode === 'missing')
+        return undefined;
+    if (resolution.mode === 'canonical') {
+        return {
+            pluginDir: paths.pluginDir,
+            consoleDir: paths.consoleDir,
+            coreDir: paths.coreDir,
+            hostRuntimeDir: paths.hostRuntimeDir,
+            pdCliDir: paths.pdCliDir,
+            installLayoutDir: paths.installLayoutDir,
+            hosts: resolution.manifest?.hosts ?? [],
+        };
+    }
+    return {
+        pluginDir: legacyPluginDir,
+        consoleDir: path.join(legacyPluginDir, 'console'),
+        coreDir: path.join(legacyPluginDir, 'core'),
+        hostRuntimeDir: path.join(legacyPluginDir, 'host-runtime'),
+        pdCliDir: path.join(legacyPluginDir, 'pd-cli'),
+        installLayoutDir: path.join(legacyPluginDir, 'install-layout'),
+        hosts: ['openclaw'],
+    };
+}
 function resolvePluginDir(_workspaceDir) {
-    return path.join(resolveExtensionsDir(), 'principles-disciple');
+    return resolveUpdateLayout()?.pluginDir ?? path.join(resolveExtensionsDir(), 'principles-disciple');
 }
 function readCurrentVersion(pluginDir) {
     const pkgPath = path.join(pluginDir, 'package.json');
@@ -480,6 +521,26 @@ async function doApplyUpdate(options, workspaceDir) {
         const toVersion = typeof data.version === 'string' ? data.version : undefined;
         if (!toVersion)
             return { success: false, message: 'Missing version in registry response' };
+        const advancesInstalled = fromVersion !== 'unknown' &&
+            semver.valid(fromVersion) !== null &&
+            semver.valid(toVersion) !== null &&
+            semver.gt(toVersion, fromVersion);
+        if (!advancesInstalled) {
+            appendUpdateHistory(workspaceDir, {
+                fromVersion,
+                toVersion,
+                success: false,
+                kind: 'refusal',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+            });
+            return {
+                success: false,
+                message: 'Installed version would not advance — the update source is stale or malformed.',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+            };
+        }
         const dist = typeof data.dist === 'object' && data.dist !== null ? data.dist : null;
         const tarball = dist && typeof dist.tarball === 'string' ? dist.tarball : undefined;
         if (!tarball)
@@ -559,6 +620,7 @@ async function doApplyUpdate(options, workspaceDir) {
             fromVersion,
             toVersion,
             success: true,
+            kind: 'update',
             backupPath,
         });
         return {
@@ -620,6 +682,7 @@ async function doRollbackUpdate(options, workspaceDir) {
             fromVersion: 'rolled-back',
             toVersion: readCurrentVersion(targetDir) ?? 'unknown',
             success: true,
+            kind: 'rollback',
             backupPath: backupDir,
         });
         return { success: true, message: 'Rollback completed successfully' };
@@ -676,14 +739,20 @@ function depsMeaningfullyChanged(oldDeps, newDeps) {
  * Returns undefined on success, or an error message (rc-9: observable, never
  * silent — a missing link means the updated console cannot start).
  */
-function ensureHostRuntimeResolutionLinks(extDir) {
-    const hostRuntimeDir = path.join(extDir, 'host-runtime');
+function ensureRuntimeResolutionLinks(layout) {
     const links = [
-        { linkPath: path.join(extDir, 'console', 'node_modules', '@principles', 'host-runtime'), target: hostRuntimeDir, unixTarget: '../../../host-runtime' },
-        { linkPath: path.join(extDir, 'pd-cli', 'node_modules', '@principles', 'host-runtime'), target: hostRuntimeDir, unixTarget: '../../../host-runtime' },
-        { linkPath: path.join(extDir, 'console', 'node_modules', 'principles-disciple'), target: extDir, unixTarget: '../../' },
+        { linkPath: path.join(layout.consoleDir, 'node_modules', '@principles', 'host-runtime'), target: layout.hostRuntimeDir },
+        { linkPath: path.join(layout.pdCliDir, 'node_modules', '@principles', 'host-runtime'), target: layout.hostRuntimeDir },
+        { linkPath: path.join(layout.consoleDir, 'node_modules', '@principles', 'install-layout'), target: layout.installLayoutDir },
+        { linkPath: path.join(layout.pdCliDir, 'node_modules', '@principles', 'install-layout'), target: layout.installLayoutDir },
+        // host-runtime depends on @principles/install-layout at runtime; /apply-full
+        // skips npm install, so its node_modules must self-provision the link too.
+        { linkPath: path.join(layout.hostRuntimeDir, 'node_modules', '@principles', 'install-layout'), target: layout.installLayoutDir },
+        { linkPath: path.join(layout.consoleDir, 'node_modules', 'principles-disciple'), target: layout.pluginDir },
     ];
-    for (const { linkPath, target, unixTarget } of links) {
+    for (const { linkPath, target } of links) {
+        if (!fs.existsSync(target))
+            continue;
         if (fs.existsSync(linkPath))
             continue;
         try {
@@ -692,17 +761,27 @@ function ensureHostRuntimeResolutionLinks(extDir) {
                 fs.symlinkSync(target, linkPath, 'junction');
             }
             else {
-                fs.symlinkSync(unixTarget, linkPath, 'dir');
+                fs.symlinkSync(path.relative(path.dirname(linkPath), target), linkPath, 'dir');
             }
         }
         catch (error) {
-            return `Failed to create host-runtime resolution link at ${linkPath}: ${error instanceof Error ? error.message : String(error)}`;
+            return `Failed to create runtime resolution link at ${linkPath}: ${error instanceof Error ? error.message : String(error)}`;
         }
     }
     return undefined;
 }
 async function doInlineFullUpdate(workspaceDir) {
-    const extDir = resolvePluginDir(workspaceDir);
+    const layout = resolveUpdateLayout();
+    if (!layout) {
+        return {
+            success: false,
+            message: 'PD install runtime could not be resolved.',
+            reason: 'install_runtime_missing',
+            nextAction: 'Run npx create-principles-disciple to install or repair PD, then retry the update.',
+            requiresRestart: false,
+        };
+    }
+    const extDir = layout.pluginDir;
     // Legacy-contract preflight BEFORE stopping the gateway or touching files:
     // refuse while an active rule still uses a removed RuleHost contract
     // symbol — the running installation stays exactly as it was.
@@ -716,23 +795,16 @@ async function doInlineFullUpdate(workspaceDir) {
             requiresRestart: false,
         };
     }
-    // 1. Stop gateway (releases native module locks held by the gateway process)
-    const gatewayStatus = await checkOpenClawGateway();
+    // gatewayWasStopped records whether we had to stop an OpenClaw gateway to
+    // release native module locks. It is only ever set after candidate
+    // verification, in the host-aware stop below.
     let gatewayWasStopped = false;
-    if (gatewayStatus.isRunning) {
-        const stopRes = stopOpenClawGateway();
-        if (stopRes.ok)
-            gatewayWasStopped = true;
-    }
-    // Capture version before changes
+    // Capture installed facts before staging any candidate release.
     const fromVersion = readCurrentVersion(extDir) ?? 'unknown';
     // Capture the installed skill language before the tarball's manifest
     // overwrites it (PR #1332 companion — see reapplySkillLanguage).
     const skillLanguage = detectInstalledSkillLanguage(extDir);
     let tempDir;
-    // Heal legacy installs: move old backups out of the extensions dir so
-    // OpenClaw discovery stops reporting a duplicate plugin (see pd-backups.ts).
-    logLegacyBackupMigration('pd-update-full');
     try {
         // 2. Fetch installer package info from npm
         const response = await fetchWithRetry(NPM_REGISTRY_INSTALLER, 'Installer registry check');
@@ -740,6 +812,32 @@ async function doInlineFullUpdate(workspaceDir) {
         if (!isRecord(rawData))
             return { success: false, message: 'Invalid registry response', requiresRestart: false };
         const toVersion = typeof rawData.version === 'string' ? rawData.version : undefined;
+        const bundledPluginVersion = isRecord(rawData.pd) && typeof rawData.pd.bundledPluginVersion === 'string'
+            ? rawData.pd.bundledPluginVersion
+            : undefined;
+        if (bundledPluginVersion !== undefined) {
+            const advancesInstalled = fromVersion !== 'unknown' &&
+                semver.valid(fromVersion) !== null &&
+                semver.valid(bundledPluginVersion) !== null &&
+                semver.gt(bundledPluginVersion, fromVersion);
+            if (!advancesInstalled) {
+                appendUpdateHistory(workspaceDir, {
+                    fromVersion,
+                    toVersion: bundledPluginVersion,
+                    success: false,
+                    kind: 'refusal',
+                    reason: 'installer_bundle_stale',
+                    nextAction: 'Wait for a newer installer release, then retry the update.',
+                });
+                return {
+                    success: false,
+                    message: 'Installed version would not advance — the update source is stale or malformed.',
+                    reason: 'installer_bundle_stale',
+                    nextAction: 'Wait for a newer installer release, then retry the update.',
+                    requiresRestart: false,
+                };
+            }
+        }
         const dist = isRecord(rawData.dist) ? rawData.dist : null;
         const tarball = dist && typeof dist.tarball === 'string' ? dist.tarball : undefined;
         if (!tarball)
@@ -754,10 +852,53 @@ async function doInlineFullUpdate(workspaceDir) {
         // shell syntax (Mimosa command-injection finding, 2026-08-22).
         execFileSync('tar', ['xzf', tarballPath, '-C', tempDir, '--strip-components=1'], { stdio: 'pipe' });
         fs.unlinkSync(tarballPath);
+        // The tarball, not the installer package version, is the release we are
+        // about to activate. Prove it advances the installed plugin BEFORE the
+        // gateway is stopped or any production file is copied.
+        const newPkgPath = path.join(tempDir, 'plugin', 'package.json');
+        const stagedVersion = readCurrentVersion(path.join(tempDir, 'plugin'));
+        const progressed = fromVersion !== 'unknown' &&
+            stagedVersion !== undefined &&
+            semver.valid(fromVersion) !== null &&
+            semver.valid(stagedVersion) !== null &&
+            semver.gt(stagedVersion, fromVersion) &&
+            (bundledPluginVersion === undefined || bundledPluginVersion === stagedVersion);
+        if (!progressed) {
+            if (tempDir && fs.existsSync(tempDir)) {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+            appendUpdateHistory(workspaceDir, {
+                fromVersion,
+                toVersion: stagedVersion ?? 'unknown',
+                success: false,
+                kind: 'refusal',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+            });
+            return {
+                success: false,
+                message: 'Installed version would not advance — the update source is stale or malformed.',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+                requiresRestart: false,
+            };
+        }
+        // Only a verified advancing release may cause host interruption or touch
+        // the production installation.
+        const gatewayStatus = layout.hosts.includes('openclaw')
+            ? await checkOpenClawGateway()
+            : { isRunning: false };
+        if (gatewayStatus.isRunning) {
+            const stopRes = stopOpenClawGateway();
+            if (stopRes.ok)
+                gatewayWasStopped = true;
+        }
+        // Heal legacy installs only after candidate verification. This writes
+        // outside the release tree, so it must not happen for a refused release.
+        logLegacyBackupMigration('pd-update-full');
         // 4. Detect dependency changes (informational — logged but not blocking;
         //    the .js files are still updated; node_modules stays as-is)
         let depsChanged = false;
-        const newPkgPath = path.join(tempDir, 'plugin', 'package.json');
         const oldPkgPath = path.join(extDir, 'package.json');
         if (fs.existsSync(newPkgPath) && fs.existsSync(oldPkgPath)) {
             try {
@@ -785,17 +926,22 @@ async function doInlineFullUpdate(workspaceDir) {
         //        console that does not import it, so skipping is consistent for
         //        them. On fresh installs this is an overlay refresh + link no-op.
         const hostRuntimeSrc = path.join(tempDir, 'host-runtime');
-        const hostRuntimeDest = path.join(extDir, 'host-runtime');
+        const hostRuntimeDest = layout.hostRuntimeDir;
         if (fs.existsSync(hostRuntimeSrc) &&
             fs.existsSync(path.join(hostRuntimeSrc, 'package.json')) &&
             fs.existsSync(path.join(hostRuntimeSrc, 'dist'))) {
             copyDirRecursive(hostRuntimeSrc, hostRuntimeDest, SKIP_DIRS);
-            const linkError = ensureHostRuntimeResolutionLinks(extDir);
+            const installLayoutSrc = path.join(tempDir, 'install-layout');
+            if (fs.existsSync(path.join(installLayoutSrc, 'package.json')) && fs.existsSync(path.join(installLayoutSrc, 'dist'))) {
+                copyDirRecursive(installLayoutSrc, layout.installLayoutDir, SKIP_DIRS);
+            }
+            const linkError = ensureRuntimeResolutionLinks(layout);
             if (linkError) {
                 appendUpdateHistory(workspaceDir, {
                     fromVersion,
                     toVersion: 'failed',
                     success: false,
+                    kind: 'failure',
                 });
                 return {
                     success: false,
@@ -818,20 +964,20 @@ async function doInlineFullUpdate(workspaceDir) {
         //       console/node_modules/ may contain locked native modules like
         //       better-sqlite3 that the running console process holds via dlopen)
         const consoleSrc = path.join(tempDir, 'console');
-        const consoleDest = path.join(extDir, 'console');
+        const consoleDest = layout.consoleDir;
         if (fs.existsSync(consoleSrc)) {
             copyDirRecursive(consoleSrc, consoleDest, SKIP_DIRS);
         }
         //    c. core/ → extDir/core/ (overwrite, skip node_modules for safety)
         const coreSrc = path.join(tempDir, 'core');
-        const coreDest = path.join(extDir, 'core');
+        const coreDest = layout.coreDir;
         if (fs.existsSync(coreSrc)) {
             copyDirRecursive(coreSrc, coreDest, SKIP_DIRS);
         }
         //    d. pd-cli/dist + package.json → extDir/pd-cli/ (overwrite only,
         //       do NOT rmSync — preserves node_modules symlinks created at install)
         const pdCliSrc = path.join(tempDir, 'pd-cli');
-        const pdCliDest = path.join(extDir, 'pd-cli');
+        const pdCliDest = layout.pdCliDir;
         if (fs.existsSync(pdCliSrc)) {
             const distSrc = path.join(pdCliSrc, 'dist');
             const distDest = path.join(pdCliDest, 'dist');
@@ -857,11 +1003,8 @@ async function doInlineFullUpdate(workspaceDir) {
         // false "update available". Detect that and fail loud (rc-9) instead of
         // reporting a false success.
         const newVersion = readCurrentVersion(extDir) ?? toVersion ?? 'unknown';
-        const progressed = fromVersion !== 'unknown' &&
-            semver.valid(fromVersion) !== null &&
-            semver.valid(newVersion) !== null &&
-            semver.gt(newVersion, fromVersion);
-        if (!progressed) {
+        const installedExpectedRelease = newVersion === stagedVersion;
+        if (!installedExpectedRelease) {
             // Files were already rewritten to the same (or lower) version. Record a
             // FAILED history entry so the operator sees why, and return a structured
             // error with nextAction.
@@ -869,6 +1012,7 @@ async function doInlineFullUpdate(workspaceDir) {
                 fromVersion,
                 toVersion: newVersion,
                 success: false,
+                kind: 'failure',
             });
             return {
                 success: false,
@@ -883,6 +1027,7 @@ async function doInlineFullUpdate(workspaceDir) {
             fromVersion,
             toVersion: newVersion,
             success: true,
+            kind: 'update',
         });
         return {
             success: true,
@@ -908,6 +1053,7 @@ async function doInlineFullUpdate(workspaceDir) {
             fromVersion,
             toVersion: 'failed',
             success: false,
+            kind: 'failure',
         });
         if (isLockError) {
             return {
@@ -990,6 +1136,14 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
             }
             // createBackup is a boolean (default false)
             const createBackup = typeof body.createBackup === 'boolean' ? body.createBackup : false;
+            // The Console updater owns only the installed PD runtime selected at
+            // process start. A caller-supplied path inside a workspace may be a
+            // development checkout; accepting it lets a registry package overwrite
+            // source files and makes version history describe the wrong product.
+            if (path.resolve(targetDir) !== path.resolve(pluginDir)) {
+                sendError(res, 400, 'update_target_not_installed', 'Updates may only target the installed PD runtime.', { nextAction: 'Run the official installer to repair the installation, then retry from Console.' });
+                return;
+            }
             // Path traversal validation
             if (!validatePathInWorkspace(targetDir, workspaceDir)) {
                 sendBadRequest(res, 'targetDir must be within workspace or extensions directory');

package/console/dist/shared/feedback-channel-ids.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Feedback channel identity constants — PRI-613.
+ *
+ * Kept in a dependency-free module so the browser bundle can import the
+ * runtime const WITHOUT pulling @sinclair/typebox in (the schema module
+ * imports typebox; importing it at runtime from UI code would add ~850KB to
+ * the browser bundle — measured, SPEC §10.5 stop condition). The schema
+ * module derives its literal union from this const; the UI derives its
+ * runtime channel-ID check from the same const. One authority, two safe
+ * import contexts.
+ */
+export declare const FEEDBACK_CHANNEL_IDS: readonly ['ingest', 'github', 'email', 'file'];
+export type FeedbackChannelId = (typeof FEEDBACK_CHANNEL_IDS)[number];

package/console/dist/shared/feedback-channel-ids.js

@@ -0,0 +1,12 @@
+/**
+ * Feedback channel identity constants — PRI-613.
+ *
+ * Kept in a dependency-free module so the browser bundle can import the
+ * runtime const WITHOUT pulling @sinclair/typebox in (the schema module
+ * imports typebox; importing it at runtime from UI code would add ~850KB to
+ * the browser bundle — measured, SPEC §10.5 stop condition). The schema
+ * module derives its literal union from this const; the UI derives its
+ * runtime channel-ID check from the same const. One authority, two safe
+ * import contexts.
+ */
+export const FEEDBACK_CHANNEL_IDS = ['ingest', 'github', 'email', 'file'];

package/console/dist/shared/feedback-contract.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Feedback submit-ladder shared contract — PRI-613 Schema→Type→Validator pilot.
+ *
+ * Canonical authority for the wire shapes shared by server and UI. The
+ * TypeBox schemas here are the single source: the server's ChannelStatus
+ * derives from them (type-only import), and the UI's validator data shapes
+ * derive via `import type` — the browser bundle must NOT import this module
+ * at runtime (it would bundle @sinclair/typebox, ~850KB; see
+ * feedback-channel-ids.ts for the runtime-safe const).
+ *
+ * UI validators (ui/utils/validators.ts) are a machine-enforced mirror:
+ * tests/integration/feedback-contract.test.ts asserts schema-vs-validator
+ * equivalence on an accept/reject matrix, so drift is CI-detectable without
+ * shipping typebox to the browser.
+ *
+ * Single direction: Schema → Static type. Do NOT add a parallel interface
+ * next to these schemas.
+ */
+import { type Static } from '@sinclair/typebox';
+export declare const FeedbackChannelStatusSchema: import("@sinclair/typebox").TObject<{
+    id: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"email" | "file" | "github" | "ingest">[]>;
+    available: import("@sinclair/typebox").TBoolean;
+    reason: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    nextAction: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+}>;
+export type FeedbackChannelStatus = Static<typeof FeedbackChannelStatusSchema>;
+export declare const FeedbackChannelsDataSchema: import("@sinclair/typebox").TObject<{
+    channels: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        id: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"email" | "file" | "github" | "ingest">[]>;
+        available: import("@sinclair/typebox").TBoolean;
+        reason: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+        nextAction: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    }>>;
+}>;
+export type FeedbackChannelsData = Static<typeof FeedbackChannelsDataSchema>;
+export declare const FeedbackSubmitResultSchema: import("@sinclair/typebox").TObject<{
+    ok: import("@sinclair/typebox").TBoolean;
+    alreadySubmitted: import("@sinclair/typebox").TBoolean;
+    status: import("@sinclair/typebox").TString;
+    submittedVia: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    trackingId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    externalUrl: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    writeBackFailed: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    nextAction: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+}>;
+export type FeedbackSubmitResult = Static<typeof FeedbackSubmitResultSchema>;

package/console/dist/shared/feedback-contract.js

@@ -0,0 +1,45 @@
+/**
+ * Feedback submit-ladder shared contract — PRI-613 Schema→Type→Validator pilot.
+ *
+ * Canonical authority for the wire shapes shared by server and UI. The
+ * TypeBox schemas here are the single source: the server's ChannelStatus
+ * derives from them (type-only import), and the UI's validator data shapes
+ * derive via `import type` — the browser bundle must NOT import this module
+ * at runtime (it would bundle @sinclair/typebox, ~850KB; see
+ * feedback-channel-ids.ts for the runtime-safe const).
+ *
+ * UI validators (ui/utils/validators.ts) are a machine-enforced mirror:
+ * tests/integration/feedback-contract.test.ts asserts schema-vs-validator
+ * equivalence on an accept/reject matrix, so drift is CI-detectable without
+ * shipping typebox to the browser.
+ *
+ * Single direction: Schema → Static type. Do NOT add a parallel interface
+ * next to these schemas.
+ */
+import { Type } from '@sinclair/typebox';
+import { FEEDBACK_CHANNEL_IDS } from './feedback-channel-ids.js';
+/**
+ * Optional explanation fields are `string | null` on the wire: absent means
+ * "no reason to show"; explicit null is accepted and normalized to absent by
+ * the UI validator (legacy readNullableString semantics).
+ */
+const optionalNullableString = Type.Optional(Type.Union([Type.String(), Type.Null()]));
+export const FeedbackChannelStatusSchema = Type.Object({
+    id: Type.Union(FEEDBACK_CHANNEL_IDS.map((id) => Type.Literal(id))),
+    available: Type.Boolean(),
+    reason: optionalNullableString,
+    nextAction: optionalNullableString,
+});
+export const FeedbackChannelsDataSchema = Type.Object({
+    channels: Type.Array(FeedbackChannelStatusSchema),
+});
+export const FeedbackSubmitResultSchema = Type.Object({
+    ok: Type.Boolean(),
+    alreadySubmitted: Type.Boolean(),
+    status: Type.String(),
+    submittedVia: optionalNullableString,
+    trackingId: optionalNullableString,
+    externalUrl: optionalNullableString,
+    writeBackFailed: Type.Optional(Type.Boolean()),
+    nextAction: optionalNullableString,
+});