create-principles-disciple 1.133.13 → 1.134.1

package/release-manager/dist/installer.d.ts

@@ -17,6 +17,54 @@ export declare const CONVERSATION_ACCESS_CONFIG_KEY: 'allowConversationAccess';
 export declare function ensureConversationAccess(config: Record<string, unknown>): Record<string, unknown>;
 export declare function resolveConsolePortBase(): number;
 export declare function mergeInstallManifestHosts(current: unknown, host: HostTarget): ('codex' | 'openclaw')[];
+/**
+ * PRI-709 P0-2 — active record commit point (ADR-0024 D-2).
+ *
+ * `~/.pd/active.json` is the deployment identity source: it records WHAT is
+ * actually deployed, keyed to the transaction that deployed it. Before PRI-709
+ * the installer never wrote it (the only writer was legacy-migration.ts), so
+ * every real install and every ReleaseManager apply left active.json absent or
+ * stale — the PRI-698 audit finding F-2.
+ *
+ * Identity is taken from the transaction, never recomputed here: the journal
+ * was opened with the payload's own identity (`_release/manifest.json` digest
+ * when the self-contained asset ships one), and active.json must agree with
+ * the journal of the transaction that produced it. A divergent second
+ * computation would break the audit trail.
+ *
+ * Ordering: journal-first. The caller appends `confirmed` and only then calls
+ * this, so a crash between the two is recoverable from the journal (the
+ * reverse order would leave an unjournaled active.json).
+ *
+ * Failure policy — Tier 2: this runs AFTER the backup was discarded, so the
+ * install is already committed and must not be failed here. A write failure is
+ * reported loud (rc-9) and returned to the caller; it never bricks the
+ * installation.
+ */
+export interface ActiveRecordCommitResult {
+    readonly written: boolean;
+    readonly activeRecordPath: string;
+    readonly generation: number;
+    readonly previousReleaseId: string | null;
+    /** Set when the record could not be written or the previous one was unreadable. */
+    readonly reason?: string;
+}
+export declare function commitInstallerActiveRecord(journal: InstallerJournal): ActiveRecordCommitResult;
+/**
+ * PRI-709 P0-1 — installer supply path for the release metadata source.
+ *
+ * The installer is the only component that legitimately knows the metadata
+ * repository at install time, so it persists `PD_RELEASE_METADATA_URL` into
+ * `~/.pd/install.json` (the durable `install_config` tier). Without this the
+ * variable had to be exported in every shell that wanted a governed update
+ * check (PRI-698 audit F-4).
+ *
+ * Absent env is a no-op — an install with no metadata source stays
+ * unconfigured rather than persisting a guessed URL. A malformed env value is
+ * reported and skipped: it must never be written into install.json, where the
+ * strict reader would then fail loud and mark the install corrupt.
+ */
+export declare function persistReleaseMetadataSource(): void;
 /**
  * 验证原生模块：better-sqlite3 随发布资产携带 prebuilt 二进制
  * (prebuilds/*.node)，node-gyp-build 在 require 时解析——无需（也没有）
@@ -161,6 +209,27 @@ export declare function ensureBundledPdCliResolution(pdCliRoot: string): void;
 export declare function runLegacyRuleContractPreflight(pluginDir: string, workspaceDir: string, runScan?: LegacyRulePreflightRunner): Promise<LegacyRulePreflightOutcome>;
 export declare function checkBuiltPlugin(pluginDir: string): Promise<void>;
 export declare function installPluginToStaging(pluginDir: string, language: SkillLanguage): Promise<void>;
+/**
+ * PRI-711: materialize node_modules links for the INSTALLED codex-adapter so
+ * its declared `file:../<component>` dependencies resolve under ESM realpath
+ * rules. The adapter's dist imports @principles/host-runtime and
+ * @principles/core, and pd-cli's eager import graph (health-codex) statically
+ * imports the adapter — without these links every pd command dies with
+ * ERR_MODULE_NOT_FOUND at startup (observed 2026-09-09: the 1.231.2 full
+ * update swapped in Slice-D pd-cli while the deployed adapter, laid down by
+ * older installers, had no node_modules at all).
+ *
+ * Data-driven from the deployed adapter manifest: every dependency whose ref
+ * starts with `file:../` names a sibling runtime component directory. An
+ * existing correct link is kept; a stale physical copy (self-contained
+ * payloads ship materialized node_modules) or a wrong-target link is
+ * replaced with the canonical junction/symlink, mirroring syncPdCli.
+ * Idempotent. MUST run after installBundledCodexAdapter AND the
+ * core/host-runtime/install-layout installs — the manifest declares all
+ * three as file:../ siblings, and a missing sibling means a corrupted
+ * payload or a call-order regression, which fails the install loudly.
+ */
+export declare function ensureCodexAdapterResolution(): void;
 export interface InstallResult {
     success: boolean;
     workspaceDir: string;

package/release-manager/dist/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAmBL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAExB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAsB,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAGnF,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQtF,OAAO,EAA2B,KAAK,2BAA2B,EAAE,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnI,iFAAiF;AACjF,eAAO,MAAM,8BAA8B,EAAG,yBAAkC,CAAC;AAMjF;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCjG;AAeD,wBAAgB,sBAAsB,IAAI,MAAM,CAU/C;AAgCD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,OAAO,GAAG,UAAU,CAAC,EAAE,CAUtG;AAqGD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAW5E;AAKD,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpC,YAAY,OAAO,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,EAOA;CACF;AAOD;;;;;;;;;;;GAWG;AACH,KAAK,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AA2DjE;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,CAIhF;AAOD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,OAAO,CAE1D;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CACvD,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAwDf;AAWD,wBAAsB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCxF;AAYD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAOpF;AAiDD,UAAU,YAAY;IACpB,IAAI,EAAE,aAAa,GAAG,WAAW,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CA+B7C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,UAAuB,GAAG,YAAY,CA0BjF;AAuHD;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,aAAa,GACb,mBAAmB,GACnB,aAAa,GACb,kBAAkB,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,MAAM,yBAAyB,GAAG,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAkDzC;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,0BAA0B,CAgCxF;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CA0BpE;AAiCD,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,yBAA4D,GACpE,OAAO,CAAC,0BAA0B,CAAC,CAyErC;AA0BD,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCvE;AAED,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtG;AAm7BD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,eAAe,CAAC;IAC5B,YAAY,EAAE,kBAAkB,CAAC;IACjC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0FACsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAClC;+EAC2E;IAC3E,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;6CAEyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAoCD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAsBD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,6HAA6H;IAC7H,QAAQ,CAAC,2BAA2B,EAAE,2BAA2B,CAAC;IAClE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACpC;AA0CD,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAMzE;AAED;;;;GAIG;AAEH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,gBAAgB,GAAG,IAAI,EAC7B,EAAE,EAAE,gBAAgB,EACpB,MAAM,EAAE,MAAM,GACb,IAAI,CAiBN;AAED,oFAAoF;AAEpF,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,gBAAgB,GAAG,IAAI,EAC7B,EAAE,EAAE,gBAAgB,EACpB,MAAM,EAAE,MAAM,GACb,IAAI,CAYN;AAQD,wBAAsB,OAAO,CAC3B,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,EAMzB,WAAW,CAAC,EAAE,gBAAgB,GAC7B,OAAO,CAAC,aAAa,CAAC,CAwlBxB"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAmBL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAExB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAsB,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAGnF,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AActF,OAAO,EAKL,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAEzC,iFAAiF;AACjF,eAAO,MAAM,8BAA8B,EAAG,yBAAkC,CAAC;AAMjF;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCjG;AAeD,wBAAgB,sBAAsB,IAAI,MAAM,CAU/C;AAgCD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,OAAO,GAAG,UAAU,CAAC,EAAE,CAUtG;AA+CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,GAAG,wBAAwB,CAiD/F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAWnD;AAmED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAW5E;AAKD,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpC,YAAY,OAAO,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,EAOA;CACF;AAOD;;;;;;;;;;;GAWG;AACH,KAAK,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AA2DjE;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,CAIhF;AAOD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,OAAO,CAE1D;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CACvD,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAwDf;AAWD,wBAAsB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCxF;AAYD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAOpF;AAiDD,UAAU,YAAY;IACpB,IAAI,EAAE,aAAa,GAAG,WAAW,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CA+B7C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,UAAuB,GAAG,YAAY,CA0BjF;AAuHD;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,aAAa,GACb,mBAAmB,GACnB,aAAa,GACb,kBAAkB,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,MAAM,yBAAyB,GAAG,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAkDzC;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,0BAA0B,CAgCxF;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CA0BpE;AAiCD,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,yBAA4D,GACpE,OAAO,CAAC,0BAA0B,CAAC,CAyErC;AA0BD,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCvE;AAED,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtG;AAgfD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAuDnD;AAqcD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,eAAe,CAAC;IAC5B,YAAY,EAAE,kBAAkB,CAAC;IACjC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0FACsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAClC;+EAC2E;IAC3E,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;6CAEyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAoCD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAsBD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,6HAA6H;IAC7H,QAAQ,CAAC,2BAA2B,EAAE,2BAA2B,CAAC;IAClE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACpC;AAsDD,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAMzE;AAED;;;;GAIG;AAEH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,gBAAgB,GAAG,IAAI,EAC7B,EAAE,EAAE,gBAAgB,EACpB,MAAM,EAAE,MAAM,GACb,IAAI,CAiBN;AAED,oFAAoF;AAEpF,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,gBAAgB,GAAG,IAAI,EAC7B,EAAE,EAAE,gBAAgB,EACpB,MAAM,EAAE,MAAM,GACb,IAAI,CAYN;AAQD,wBAAsB,OAAO,CAC3B,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,EAMzB,WAAW,CAAC,EAAE,gBAAgB,GAC7B,OAAO,CAAC,aAAa,CAAC,CAmmBxB"}

package/release-manager/dist/installer.js

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, statSync, readFileSync, writeFileSync, mkdirSync, rmSync, copyFileSync, cpSync, renameSync, chmodSync, symlinkSync } from 'fs';
+import { existsSync, lstatSync, readdirSync, realpathSync, statSync, readFileSync, writeFileSync, mkdirSync, rmSync, copyFileSync, cpSync, renameSync, chmodSync, symlinkSync } from 'fs';
 import { createHash, randomUUID } from 'node:crypto';
 import { pathToFileURL } from 'node:url';
 import fse from 'fs-extra';
@@ -16,7 +16,9 @@ import { mergeInstallManifestWorkspaces, parseInstallManifest } from '@principle
 import { detectOpenClawMainWorkspaceDivergence } from './utils/workspace-divergence.js';
 import { applySkillLanguageSelection } from './skill-language.js';
 import { parseReleaseAssetIdentity, parseReleaseAssetManifest, ReleaseAssetManifestError, verifyReleaseAssetManifestAsync, verifyReleaseAssetTarget, } from './update/release-asset-manifest.js';
-import { appendJournalTransition } from './update/transaction-journal.js';
+import { mergeIntoInstallJson, readInstallJsonRecord, resolvePdHomePaths, } from './update/install-layout.js';
+import { RELEASE_METADATA_URL_ENV, normalizeReleaseMetadataUrl } from './update/release-metadata-source.js';
+import { appendJournalTransition, readActiveRecord, writeActiveRecord, } from './update/transaction-journal.js';
 /** PRI-343: Keep in sync with @principles/core CONVERSATION_ACCESS_CONFIG_KEY */
 export const CONVERSATION_ACCESS_CONFIG_KEY = 'allowConversationAccess';
 function isRecord(value) {
@@ -155,7 +157,90 @@ function resolveInstallManifestWorkspaces(workspaceDir) {
 }
 function writeInstallManifest(hosts, workspaces) {
     mkdirSync(getPdDir(), { recursive: true });
-    writeFileSync(getInstallManifestPath(), JSON.stringify({ layoutVersion: 1, mode: 'canonical', hosts, workspaces }, null, 2) + '\n', 'utf8');
+    // PRI-709 P0-1: merge into the existing record. This file has more than one
+    // writer (the update side owns `channel` / `autoCheck` / `releaseMetadataUrl`);
+    // a wholesale replace silently deleted those fields.
+    const existing = readInstallJsonRecord(getInstallManifestPath());
+    const payload = {
+        ...(existing ?? {}),
+        layoutVersion: 1,
+        mode: 'canonical',
+        hosts,
+        workspaces,
+    };
+    writeFileSync(getInstallManifestPath(), JSON.stringify(payload, null, 2) + '\n', 'utf8');
+}
+export function commitInstallerActiveRecord(journal) {
+    const paths = resolvePdHomePaths(getPdDir());
+    let previous = null;
+    let previousWarning = null;
+    try {
+        previous = readActiveRecord(paths.activeRecordPath);
+    }
+    catch (error) {
+        // A corrupt previous record must not block committing the new identity —
+        // overwriting it with a valid record is strictly an improvement.
+        previousWarning = error instanceof Error ? error.message : String(error);
+        logger.warn(`active.json was unreadable and is being replaced (${paths.activeRecordPath}): ${previousWarning}`);
+    }
+    // Generation continuity: never move backwards. A standalone install already
+    // carries generation 1, but re-installing over an existing deployment must
+    // advance past it — otherwise the deployment identity source would regress.
+    const generation = Math.max(journal.generation, previous === null ? 1 : previous.generation + 1);
+    try {
+        writeActiveRecord(paths.activeRecordPath, {
+            generation,
+            releaseId: journal.releaseId,
+            releaseMetadataDigest: journal.releaseMetadataDigest,
+            previousReleaseId: previous?.releaseId ?? null,
+            transactionId: journal.transactionId,
+            productVersion: journal.productVersion,
+        });
+        return {
+            written: true,
+            activeRecordPath: paths.activeRecordPath,
+            generation,
+            previousReleaseId: previous?.releaseId ?? null,
+            ...(previousWarning !== null ? { reason: `previous_record_unreadable: ${previousWarning}` } : {}),
+        };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        logger.error(`active.json could not be written after a committed install (${paths.activeRecordPath}): ${reason}. `
+            + `Deployment identity is out of sync with the transaction ${journal.transactionId}; re-run the installer to repair it.`);
+        return {
+            written: false,
+            activeRecordPath: paths.activeRecordPath,
+            generation,
+            previousReleaseId: previous?.releaseId ?? null,
+            reason,
+        };
+    }
+}
+/**
+ * PRI-709 P0-1 — installer supply path for the release metadata source.
+ *
+ * The installer is the only component that legitimately knows the metadata
+ * repository at install time, so it persists `PD_RELEASE_METADATA_URL` into
+ * `~/.pd/install.json` (the durable `install_config` tier). Without this the
+ * variable had to be exported in every shell that wanted a governed update
+ * check (PRI-698 audit F-4).
+ *
+ * Absent env is a no-op — an install with no metadata source stays
+ * unconfigured rather than persisting a guessed URL. A malformed env value is
+ * reported and skipped: it must never be written into install.json, where the
+ * strict reader would then fail loud and mark the install corrupt.
+ */
+export function persistReleaseMetadataSource() {
+    const raw = process.env[RELEASE_METADATA_URL_ENV];
+    if (raw === undefined || raw.trim().length === 0)
+        return;
+    const normalized = normalizeReleaseMetadataUrl(raw);
+    if (normalized === null) {
+        logger.warn(`${RELEASE_METADATA_URL_ENV} is not a valid http(s) URL and was not persisted to install.json: ${JSON.stringify(raw)}. Release metadata source stays unconfigured.`);
+        return;
+    }
+    mergeIntoInstallJson(getInstallManifestPath(), { releaseMetadataUrl: normalized });
 }
 function installBundledLayoutPackage(pluginDir) {
     const source = path.join(pluginDir, 'install-layout');
@@ -1444,6 +1529,85 @@ function installBundledCodexAdapter(pluginDir) {
     rmSync(codexAdapterDest, { recursive: true, force: true });
     cpSync(codexAdapterSrc, codexAdapterDest, { recursive: true });
 }
+/**
+ * PRI-711: materialize node_modules links for the INSTALLED codex-adapter so
+ * its declared `file:../<component>` dependencies resolve under ESM realpath
+ * rules. The adapter's dist imports @principles/host-runtime and
+ * @principles/core, and pd-cli's eager import graph (health-codex) statically
+ * imports the adapter — without these links every pd command dies with
+ * ERR_MODULE_NOT_FOUND at startup (observed 2026-09-09: the 1.231.2 full
+ * update swapped in Slice-D pd-cli while the deployed adapter, laid down by
+ * older installers, had no node_modules at all).
+ *
+ * Data-driven from the deployed adapter manifest: every dependency whose ref
+ * starts with `file:../` names a sibling runtime component directory. An
+ * existing correct link is kept; a stale physical copy (self-contained
+ * payloads ship materialized node_modules) or a wrong-target link is
+ * replaced with the canonical junction/symlink, mirroring syncPdCli.
+ * Idempotent. MUST run after installBundledCodexAdapter AND the
+ * core/host-runtime/install-layout installs — the manifest declares all
+ * three as file:../ siblings, and a missing sibling means a corrupted
+ * payload or a call-order regression, which fails the install loudly.
+ */
+export function ensureCodexAdapterResolution() {
+    const codexAdapterDir = getInstalledCodexAdapterDir();
+    const manifestPath = path.join(codexAdapterDir, 'package.json');
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+    }
+    catch (error) {
+        throw new Error(`Installed @principles/codex-adapter package.json is missing or malformed (${manifestPath}): ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    if (!isRecord(manifest)) {
+        throw new Error(`Installed @principles/codex-adapter package.json must contain an object (${manifestPath}).`);
+    }
+    if (manifest.dependencies !== undefined && !isRecord(manifest.dependencies)) {
+        throw new Error(`Installed @principles/codex-adapter package.json dependencies must be an object (${manifestPath}).`);
+    }
+    const runtimeDir = getPdRuntimeDir();
+    for (const [name, ref] of Object.entries(manifest.dependencies ?? {})) {
+        if (typeof ref !== 'string' || !ref.startsWith('file:../'))
+            continue;
+        const siblingName = ref.slice('file:../'.length);
+        // rc-1: the manifest is untrusted input — only accept single-path segment
+        // siblings so a crafted ref cannot escape the runtime dir.
+        if (!/^[A-Za-z0-9._-]+$/.test(siblingName) || siblingName === '.' || siblingName === '..') {
+            throw new Error(`Installed @principles/codex-adapter declares an unsupported file dependency ref "${ref}" for ${name}.`);
+        }
+        const siblingDir = path.join(runtimeDir, siblingName);
+        if (!existsSync(siblingDir)) {
+            throw new Error(`@principles/codex-adapter depends on ${ref} but the sibling runtime component is missing: ${siblingDir}`);
+        }
+        const linkPath = path.join(codexAdapterDir, 'node_modules', name);
+        let stat;
+        try {
+            stat = lstatSync(linkPath);
+        }
+        catch {
+            stat = undefined; // ENOENT — create below
+        }
+        if (stat !== undefined) {
+            if (stat.isSymbolicLink()) {
+                try {
+                    if (realpathSync(linkPath) === realpathSync(siblingDir))
+                        continue;
+                }
+                catch {
+                    // Unreadable link target — fall through to replace.
+                }
+            }
+            rmSync(linkPath, { recursive: stat.isDirectory() && !stat.isSymbolicLink(), force: true });
+        }
+        mkdirSync(path.dirname(linkPath), { recursive: true });
+        if (isWindows()) {
+            symlinkSync(siblingDir, linkPath, 'junction');
+        }
+        else {
+            symlinkSync(path.relative(path.dirname(linkPath), siblingDir), linkPath, 'dir');
+        }
+    }
+}
 function ensureCoreDependency(_targetDir) {
     const coreDir = getInstalledCoreDir();
     if (!existsSync(coreDir)) {
@@ -1888,6 +2052,18 @@ async function runHostInstallers(host, ctx) {
 function sha256File(filePath) {
     return createHash('sha256').update(readFileSync(filePath)).digest('hex');
 }
+function readPackageVersion(pkgPath) {
+    if (!existsSync(pkgPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        return typeof parsed.version === 'string' && parsed.version.length > 0 ? parsed.version : null;
+    }
+    catch {
+        // Identity falls back; journaling must not brick install.
+        return null;
+    }
+}
 /**
  * Identity of the payload being installed. Prefers the self-contained asset
  * manifest (covers the whole payload); falls back to the bundled pd-cli
@@ -1896,20 +2072,19 @@ function sha256File(filePath) {
  * legacy-migration.ts). The last-resort fallback hashes the literal reason
  * string only to satisfy the journal's 64-hex format requirement; it is not
  * part of any release-metadata identity chain.
+ *
+ * PRI-709 P0-2 (PRI-698 audit F-1): `productVersion` is the PRODUCT version —
+ * the plugin package manifest. It previously read `pd-cli/package.json`, but
+ * the two packages version independently (on the Owner machine: plugin
+ * 1.230.2 vs pd-cli 1.147.5), so every confirmed journal recorded a version
+ * that no runtime state could ever match. That is why active.json could not
+ * serve as the deployment identity source.
  */
 function resolveInstallerPayloadIdentity(pluginDir) {
-    let productVersion = 'unknown';
+    const productVersion = readPackageVersion(path.join(pluginDir, 'package.json'))
+        ?? readPackageVersion(path.join(pluginDir, 'pd-cli', 'package.json'))
+        ?? 'unknown';
     const pdCliPkgPath = path.join(pluginDir, 'pd-cli', 'package.json');
-    if (existsSync(pdCliPkgPath)) {
-        try {
-            const parsed = JSON.parse(readFileSync(pdCliPkgPath, 'utf8'));
-            if (typeof parsed.version === 'string' && parsed.version.length > 0)
-                productVersion = parsed.version;
-        }
-        catch {
-            // Identity falls back to 'unknown'; journaling must not brick install.
-        }
-    }
     const assetManifestPath = path.join(pluginDir, '_release', 'manifest.json');
     let releaseMetadataDigest;
     let releaseMetadataDigestSource;
@@ -2213,6 +2388,11 @@ transaction) {
         installBundledCodexAdapter(pluginDir);
         stepIndex++;
         installBundledLayoutPackage(pluginDir);
+        // PRI-711: the adapter's own file: deps must resolve or pd-cli's eager
+        // import graph crashes on every command. Runs only once ALL adapter
+        // siblings exist — the manifest declares file:../core, file:../host-runtime
+        // AND file:../install-layout, and install-layout lands just above.
+        ensureCodexAdapterResolution();
         if (spinner)
             updateProgress(spinner, stepIndex, 'Installing release-manager authority module...');
         installBundledReleaseManagerPackage(pluginDir);
@@ -2405,6 +2585,9 @@ transaction) {
             throw new Error(`Host installation failed: ${hostFailures.join(' | ')}`);
         }
         writeInstallManifest(installManifestHosts, resolveInstallManifestWorkspaces(options.workspaceDir));
+        // PRI-709 P0-1: persist the metadata source after the manifest write, so
+        // the durable tier cannot be clobbered by the same install.
+        persistReleaseMetadataSource();
         // ADR-0024 D-2: host installers completed and the install manifest is
         // written — the new installation is fully activated (backups not yet
         // discarded, so a crash here still recovers via the backup).
@@ -2412,6 +2595,9 @@ transaction) {
         cleanupBackup(backupDir, runtimeBackupDir);
         // ADR-0024 D-2: backup cleanup is the commit point of the transaction.
         journalInstallerTransitionDegrading(journal, journal.lastState, 'confirmed', 'backup cleaned up; install complete');
+        // PRI-709 P0-2: active.json is the deployment identity source, written
+        // journal-first — after `confirmed`, never before it.
+        commitInstallerActiveRecord(journal);
         if (spinner) {
             spinner.succeed('Install complete!');
         }