evolcore 0.0.35 → 0.0.36

package/dist/utils/error-utils.js

@@ -2,7 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { logger } from './logger.js';
-import { isSandboxInitializationFailure } from '../core/permission/sandbox-runtime.js';
+import { CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR, CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE, isClaudeSandboxDependencyFailure, isCodexSandboxUserNamespaceFailure, isSandboxInitializationFailure, } from '../core/permission/sandbox-runtime.js';
 /** A deadline imposed by an outer executor, handled by the ordinary task timeout path. */
 export class ExecutionTimeoutError extends Error {
     reason;
@@ -87,6 +87,8 @@ export var ErrorType;
     ErrorType["MODEL_UNAVAILABLE"] = "model_unavailable";
     ErrorType["SESSION_UNAVAILABLE"] = "session_unavailable";
     ErrorType["SANDBOX_INITIALIZATION_FAILED"] = "sandbox_initialization_failed";
+    ErrorType["SANDBOX_DEPENDENCIES_MISSING"] = "sandbox_dependencies_missing";
+    ErrorType["CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE"] = "codex_sandbox_userns_unavailable";
     ErrorType["CLAUDE_STARTUP_ARGUMENTS_TOO_LONG"] = "claude_startup_arguments_too_long";
     ErrorType["CLAUDE_CODE_STARTUP_FAILED"] = "claude_code_startup_failed";
     ErrorType["UNKNOWN"] = "unknown";
@@ -440,6 +442,16 @@ function hasRetryableHttpStatus(text) {
 export function classifyError(error) {
     if (error?.code === 'RUNNER_INTERRUPT_UNCONFIRMED')
         return ErrorType.SESSION_UNAVAILABLE;
+    if (isClaudeSandboxDependencyFailure(error))
+        return ErrorType.SANDBOX_DEPENDENCIES_MISSING;
+    if (error?.code === CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR
+        || error?.code === CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE
+        || (isCodexSandboxUserNamespaceFailure(error)
+            && /\b(?:bwrap|bubblewrap)\b/i.test(String(error?.message ?? error)))) {
+        return ErrorType.CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE;
+    }
+    if (isSandboxInitializationFailure(error))
+        return ErrorType.SANDBOX_INITIALIZATION_FAILED;
     const msg = (error?.message || '').toLowerCase();
     // A damaged ecagent JSONL transcript is deterministic local state. Retrying
     // the provider request cannot repair it and can append more entries to the
@@ -481,9 +493,6 @@ export function classifyError(error) {
         || /api error: 404\b/.test(msg)) {
         return ErrorType.MODEL_UNAVAILABLE;
     }
-    if (isSandboxInitializationFailure(error)) {
-        return ErrorType.SANDBOX_INITIALIZATION_FAILED;
-    }
     if (msg.includes('401') || msg.includes('authentication_error') || msg.includes('unauthorized')) {
         return ErrorType.AUTH_ERROR;
     }
@@ -509,6 +518,8 @@ export function classifyError(error) {
 export function isRetryableError(error) {
     if (error?.code === 'RUNNER_INTERRUPT_UNCONFIRMED')
         return false;
+    if (isClaudeSandboxDependencyFailure(error) || isSandboxInitializationFailure(error))
+        return false;
     // Replaying the same request does not increase its output budget.
     if (isOutputTokenLimitError(error))
         return false;
@@ -530,6 +541,28 @@ export function isRetryableError(error) {
         return true;
     return false;
 }
+function sandboxInitializationErrorMessage(error, prefix) {
+    const stderr = typeof error?.stderr === 'string'
+        ? [error.stderr]
+        : Array.isArray(error?.stderr) ? error.stderr.filter((line) => typeof line === 'string') : [];
+    const diagnostic = [error?.message ?? String(error ?? ''), ...stderr].join('\n')
+        .match(/bwrap:\s*[^\r\n]+: read-only file system/i)?.[0];
+    if (error?.code === CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR
+        || /codex_sandbox_userns_disabled_by_apparmor/i.test(String(error?.message ?? ''))
+        || (isCodexSandboxUserNamespaceFailure({ message: error?.message, stderr })
+            && /apparmor_restrict_unprivileged_userns\s*=\s*1|apparmor/i.test([error?.message ?? '', ...stderr].join('\n')))) {
+        return `${prefix}Codex Linux 沙箱无法创建 user namespace（${CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR}），当前操作未执行；请让宿主为该 EvolCore/Codex 服务配置受限的 AppArmor 允许规则，或使用等价隔离后端。不要关闭沙箱或自动降级为全权限，并运行 ec diagnose 获取探针结果`;
+    }
+    if (error?.code === CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE
+        || isCodexSandboxUserNamespaceFailure({ message: error?.message, stderr })) {
+        return `${prefix}Codex Linux 沙箱无法创建 user namespace（${CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE}），当前操作未执行；请检查内核/AppArmor/容器策略并运行 ec diagnose。不会关闭沙箱或自动降级为全权限`;
+    }
+    if (diagnostic) {
+        const target = /mkdir parents for/i.test(diagnostic) ? '挂载目标的父目录' : '挂载目标';
+        return `${prefix}执行沙箱文件系统挂载失败（sandbox_initialization_failed），当前操作未执行；只读文件系统阻止创建${target}，请检查文件系统挂载规则`;
+    }
+    return `${prefix}执行沙箱启动失败（sandbox_initialization_failed），当前操作未执行；请查看原始诊断并运行 ec diagnose 排查`;
+}
 export function getErrorMessage(error, terminalReason, includeEmoji = true) {
     if (error?.code === 'RUNNER_INTERRUPT_UNCONFIRMED')
         return `${includeEmoji ? '⚠️ ' : ''}${error.message}`;
@@ -566,7 +599,9 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
             case 'permission_denied':
                 return `${prefix}权限被拒绝，操作已取消`;
             case 'sandbox_initialization_failed':
-                return `${warnPrefix}执行沙箱启动失败（sandbox_initialization_failed），当前操作未执行；请检查文件系统挂载规则及 user namespace/seccomp 配置`;
+                return sandboxInitializationErrorMessage(error, warnPrefix);
+            case 'sandbox_dependencies_missing':
+                return `${warnPrefix}Claude 执行沙箱缺少系统依赖（sandbox_dependencies_missing），当前操作未执行；请安装 bubblewrap 和 socat 后运行 ec diagnose。不会自动关闭沙箱或安装系统包`;
             case 'claude_startup_arguments_too_long':
                 return `${warnPrefix}当前 Claude 启动参数过长，任务未执行`;
             case 'claude_code_startup_failed':
@@ -580,6 +615,9 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
     const msg = resolveErrorMessage(error);
     const warnPrefix = includeEmoji ? '⚠️ ' : '';
     const errPrefix = includeEmoji ? '❌ ' : '';
+    if (isClaudeSandboxDependencyFailure(error)) {
+        return `${warnPrefix}Claude 执行沙箱缺少系统依赖（sandbox_dependencies_missing），当前操作未执行；请安装 bubblewrap 和 socat 后运行 ec diagnose。不会自动关闭沙箱或安装系统包`;
+    }
     if (/invalid (?:jsonl )?session file/i.test(msg)) {
         return `${errPrefix}ecagent 会话文件损坏，已停止自动重试；请使用 /repair 或 /new 恢复会话`;
     }
@@ -605,7 +643,7 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
             : `${warnPrefix}上下文过长，自动压缩失败，请手动输入 /compact 重试`;
     }
     if (isSandboxInitializationFailure(error)) {
-        return `${warnPrefix}执行沙箱启动失败（sandbox_initialization_failed），当前操作未执行；请检查文件系统挂载规则及 user namespace/seccomp 配置`;
+        return sandboxInitializationErrorMessage(error, warnPrefix);
     }
     if (msg.includes('401') || msg.includes('authentication_error') || msg.toLowerCase().includes('unauthorized')) {
         return `${errPrefix}API Key 无效，请检查密钥配置。使用 /status 查看当前配置`;

package/dist/utils/instance-registry.js

@@ -16,6 +16,7 @@ import { isProcessRunning, killProcess, isWindows, findProcessesWithCommandLine
 import { getProcessStartTime, startTimeMatches } from './process-introspect.js';
 import { isConfirmedLeakedTestDaemon, runtimeHomeFromEnv } from './restart-safety.js';
 import { decodeWindowsOutput } from './windows-output.js';
+import { atomicWriteJson } from './atomic-write.js';
 // ── Helpers ──
 function instanceDir() {
     return resolvePaths().instanceDir;
@@ -58,7 +59,7 @@ export function writeMain(launchedBy) {
         runMode: isDevMode() ? 'dev' : 'install',
     };
     const filePath = path.join(dir, mainFileName(process.pid));
-    writeAtomic(filePath, JSON.stringify(record, null, 2));
+    atomicWriteJson(filePath, record);
     return filePath;
 }
 export function removeMain(pid) {
@@ -99,7 +100,7 @@ export function isMainWinner() {
 function restartMonitorFileName(pid) {
     return `restart-monitor-${pid}.json`;
 }
-export function writeRestartMonitor() {
+export function writeRestartMonitor(requestId, phase) {
     const dir = instanceDir();
     fs.mkdirSync(dir, { recursive: true });
     const startedAt = getProcessStartTime(process.pid) ?? Date.now();
@@ -108,11 +109,20 @@ export function writeRestartMonitor() {
         startedAt,
         startedAtIso: new Date(startedAt).toISOString(),
         launchedBy: 'restart-monitor',
+        ...(requestId ? { requestId } : {}),
+        ...(phase ? { phase } : {}),
     };
     const filePath = path.join(dir, restartMonitorFileName(process.pid));
     writeAtomic(filePath, JSON.stringify(record, null, 2));
     return filePath;
 }
+export function updateRestartMonitorPhase(pid, phase) {
+    const filePath = path.join(instanceDir(), restartMonitorFileName(pid));
+    const record = safeParseJson(filePath);
+    if (!record)
+        return;
+    atomicWriteJson(filePath, { ...record, phase });
+}
 export function removeRestartMonitor(pid) {
     const target = pid ?? process.pid;
     const filePath = path.join(instanceDir(), restartMonitorFileName(target));

package/dist/utils/npm-ops.js

@@ -64,6 +64,33 @@ function resolveNpmInvocation() {
     }
     return { command: fs.existsSync(sibling) ? sibling : 'npm', argsPrefix: [] };
 }
+function npmConfigArgs(config = {}) {
+    return [
+        ...(config.cacheDir ? ['--cache', config.cacheDir] : []),
+        ...(config.userConfig ? ['--userconfig', config.userConfig] : []),
+        ...(config.globalConfig ? ['--globalconfig', config.globalConfig] : []),
+    ];
+}
+function normalizeNpmPath(value) {
+    if (!value || /^(?:https?|file):/i.test(value) || ['false', 'undefined', 'null'].includes(value))
+        return undefined;
+    return path.resolve(value);
+}
+async function readNpmConfigValue(key, signal) {
+    const npm = resolveNpmInvocation();
+    try {
+        const result = await execFileAsync(npm.command, [...npm.argsPrefix, 'config', 'get', key === 'cacheDir' ? 'cache' : key === 'userConfig' ? 'userconfig' : 'globalconfig'], {
+            timeout: 5000,
+            windowsHide: isWindows,
+            signal,
+        });
+        const value = String(result.stdout ?? '').trim();
+        return normalizeNpmPath(value);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Read the effective registry from the npm belonging to the current Node.
  * An empty value means npm has no explicit registry and uses the public
@@ -72,6 +99,8 @@ function resolveNpmInvocation() {
  */
 export async function resolveUpgradeRegistry(signal) {
     const npm = resolveNpmInvocation();
+    let registry = DEFAULT_NPM_REGISTRY;
+    let useNpmCli = false;
     try {
         const result = await execFileAsync(npm.command, [...npm.argsPrefix, 'config', 'get', 'registry'], {
             timeout: 5000,
@@ -79,22 +108,27 @@ export async function resolveUpgradeRegistry(signal) {
             signal,
         });
         const value = String(result.stdout ?? '').trim();
-        if (!value || value === 'undefined' || value === 'null') {
-            return { registry: DEFAULT_NPM_REGISTRY, useNpmCli: false };
+        if (value && value !== 'undefined' && value !== 'null') {
+            registry = normalizeRegistry(value);
+            useNpmCli = true;
         }
-        return { registry: normalizeRegistry(value), useNpmCli: true };
-    }
-    catch {
-        return { registry: DEFAULT_NPM_REGISTRY, useNpmCli: false };
     }
+    catch { }
+    const [cacheDir, userConfig, globalConfig] = await Promise.all([
+        readNpmConfigValue('cacheDir', signal),
+        readNpmConfigValue('userConfig', signal),
+        readNpmConfigValue('globalConfig', signal),
+    ]);
+    const npmConfig = { ...(cacheDir ? { cacheDir } : {}), ...(userConfig ? { userConfig } : {}), ...(globalConfig ? { globalConfig } : {}) };
+    return { registry, useNpmCli, npmConfig };
 }
-async function checkLatestVersionViaNpm(pkg, timeoutMs, signal, registry) {
+async function checkLatestVersionViaNpm(pkg, timeoutMs, signal, registry, distTag = 'latest') {
     const npm = resolveNpmInvocation();
     try {
         const result = await execFileAsync(npm.command, [
             ...npm.argsPrefix,
             'view',
-            `${pkg}@latest`,
+            `${pkg}@${distTag}`,
             'version',
             '--json',
             '--registry',
@@ -160,7 +194,7 @@ async function canSudoNonInteractively() {
 export async function npmInstallGlobal(pkg, options = {}) {
     const npm = resolveNpmInvocation();
     const registry = options.registry ? normalizeRegistry(options.registry) : undefined;
-    const npmArgs = ['install', '-g', pkg, ...(registry ? ['--registry', registry] : [])];
+    const npmArgs = ['install', '-g', pkg, ...(registry ? ['--registry', registry] : []), ...npmConfigArgs(options.npmConfig), ...(options.preferOffline ? ['--prefer-offline'] : [])];
     try {
         await execFileAsync(npm.command, [...npm.argsPrefix, ...npmArgs], {
             timeout: options.timeoutMs ?? 180000,
@@ -179,7 +213,8 @@ export async function npmInstallGlobal(pkg, options = {}) {
                 const registryArg = registry ? ` --registry ${registry}` : '';
                 throw new Error(`权限不足，且 sudo 需要密码（当前进程无法交互输入）。请使用当前 Node 对应的 npm 手动执行: sudo npm install -g ${pkg}${registryArg}`);
             }
-            await execFileAsync('sudo', ['-n', npm.command, ...npm.argsPrefix, ...npmArgs], {
+            const preserveEnv = ['NPM_TOKEN', 'NODE_AUTH_TOKEN'].filter(key => process.env[key]);
+            await execFileAsync('sudo', ['-n', ...(preserveEnv.length ? [`--preserve-env=${preserveEnv.join(',')}`] : []), npm.command, ...npm.argsPrefix, ...npmArgs], {
                 timeout: options.timeoutMs ?? 180000,
                 windowsHide: false,
                 signal: options.signal,
@@ -295,7 +330,7 @@ export function getLocalVersion() {
 }
 /**
  * 解析全局安装包的已装版本（通过 `npm root -g` 定位全局 node_modules）。
- * 用于 EC Web 这类独立全局命令包——它们不在主包的依赖树里。
+ * EC Web 从 EvolCore 固定依赖解析；开发链接时使用同仓 ecweb 子项目。
  * 未安装或查询失败返回 null。
  */
 export function resolveGlobalPkg(pkgName) {
@@ -304,8 +339,15 @@ export function resolveGlobalPkg(pkgName) {
         const globalRoot = execFileSync(npm.command, [...npm.argsPrefix, 'root', '-g'], {
             encoding: 'utf-8', timeout: 10000, windowsHide: true,
         }).trim();
-        const pkgPath = path.join(globalRoot, ...pkgName.split('/'), 'package.json');
-        if (fs.existsSync(pkgPath)) {
+        const packagePaths = pkgName === WEB_PACKAGE_NAME
+            ? [
+                ...(isLinkedInstall() ? [path.join(getPackageRoot(), 'ecweb', 'package.json')] : []),
+                path.join(globalRoot, MAIN_PACKAGE_NAME, 'node_modules', ...pkgName.split('/'), 'package.json'),
+            ]
+            : [path.join(globalRoot, ...pkgName.split('/'), 'package.json')];
+        for (const pkgPath of packagePaths) {
+            if (!fs.existsSync(pkgPath))
+                continue;
             const data = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
             return { version: data.version, path: pkgPath };
         }
@@ -318,7 +360,7 @@ export function resolveGlobalPkg(pkgName) {
  * 使用 HTTP fetch 直接查 registry API，不依赖 npm CLI。
  * 超时 10 秒，失败返回 null。
  */
-async function fetchLatestVersion(pkg = 'evolcore', timeoutMs = 10000, signal, registry = DEFAULT_NPM_REGISTRY) {
+async function fetchLatestVersion(pkg = 'evolcore', timeoutMs = 10000, signal, registry = DEFAULT_NPM_REGISTRY, distTag = 'latest') {
     const controller = new AbortController();
     const abort = () => controller.abort();
     if (signal?.aborted)
@@ -327,7 +369,7 @@ async function fetchLatestVersion(pkg = 'evolcore', timeoutMs = 10000, signal, r
         signal?.addEventListener('abort', abort, { once: true });
     const timer = setTimeout(abort, timeoutMs);
     try {
-        const res = await fetch(`${normalizeRegistry(registry)}/${encodeURIComponent(pkg)}/latest`, {
+        const res = await fetch(`${normalizeRegistry(registry)}/${encodeURIComponent(pkg)}/${distTag}`, {
             signal: controller.signal,
             headers: { 'Accept': 'application/json' },
         });
@@ -344,18 +386,49 @@ async function fetchLatestVersion(pkg = 'evolcore', timeoutMs = 10000, signal, r
         signal?.removeEventListener('abort', abort);
     }
 }
+export async function preparePackageCache(target, registry, options = {}) {
+    if (!isPackageVersion(target) || normalizeVersionRegistry(registry) !== registry)
+        throw new Error('Invalid cache target');
+    const npm = resolveNpmInvocation();
+    const spec = `${MAIN_PACKAGE_NAME}@${target}`;
+    const run = (args) => new Promise((resolve, reject) => {
+        let failure = null;
+        let output = '';
+        const child = execFile(npm.command, [...npm.argsPrefix, ...args, '--registry', registry, ...npmConfigArgs(options.npmConfig), '--ignore-scripts'], {
+            timeout: 180_000, windowsHide: isWindows, signal: options.signal, maxBuffer: 8 * 1024 * 1024,
+        }, (error, stdout) => { failure = error; output = String(stdout ?? ''); });
+        child.once('error', error => { failure = error; });
+        child.once('close', code => {
+            if (failure || code !== 0 || options.signal?.aborted)
+                reject(new Error(options.signal?.aborted
+                    ? 'Package cache preparation timed out or was cancelled' : 'npm cache preparation failed; check registry connectivity, credentials, disk space and permissions'));
+            else
+                resolve(output);
+        });
+    });
+    options.onPhase?.('downloading');
+    await run(['cache', 'add', spec, '--prefer-offline']);
+    options.onPhase?.('tarball-check');
+    const metadata = JSON.parse(await run(['view', spec, 'name', 'version', 'dist', '--json', '--offline']));
+    const [packed] = JSON.parse(await run(['pack', spec, '--dry-run', '--json', '--offline']));
+    if (metadata?.name !== MAIN_PACKAGE_NAME || metadata.version !== target || packed?.name !== MAIN_PACKAGE_NAME || packed.version !== target
+        || !(typeof metadata.dist?.integrity === 'string' ? packed.integrity === metadata.dist.integrity
+            : typeof metadata.dist?.shasum === 'string' && packed.shasum === metadata.dist.shasum)) {
+        throw new Error('Cached package identity or integrity does not match the selected EvolCore version');
+    }
+}
 /** Query an already selected source, retaining npm proxy/CA/auth behavior. */
-export async function queryPackageVersion(pkg, selection, signal) {
+export async function queryPackageVersion(pkg, selection, signal, distTag = 'latest') {
     const registry = normalizeVersionRegistry(selection.registry);
-    if (!registry)
+    if (!registry || !['latest', 'test'].includes(distTag))
         return null;
     const version = selection.useNpmCli
-        ? await checkLatestVersionViaNpm(pkg, 10000, signal, registry)
-        : await fetchLatestVersion(pkg, 10000, signal, registry);
-    return isPackageVersion(version) ? { version, registry } : null;
+        ? await checkLatestVersionViaNpm(pkg, 10000, signal, registry, distTag)
+        : await fetchLatestVersion(pkg, 10000, signal, registry, distTag);
+    return isPackageVersion(version) ? { version, registry, npmConfig: selection.npmConfig } : null;
 }
 /** No registry lookup: callers must validate cache freshness before each install. */
-export async function installExactPackageVersion(pkg, target, registry, resolveInstalled) {
+export async function installExactPackageVersion(pkg, target, registry, resolveInstalled, npmConfig) {
     if (![MAIN_PACKAGE_NAME, WEB_PACKAGE_NAME].includes(pkg)
         || !isPackageVersion(target) || normalizeVersionRegistry(registry) !== registry) {
         return { status: 'failed', error: 'Invalid cached install target' };
@@ -374,7 +447,7 @@ export async function installExactPackageVersion(pkg, target, registry, resolveI
         }
         for (let attempt = 0; attempt < 2; attempt++) {
             try {
-                await npmInstallGlobal(`${pkg}@${target}`, { registry });
+                await npmInstallGlobal(`${pkg}@${target}`, { registry, preferOffline: true, npmConfig });
                 const actual = resolveInstalled()?.version;
                 if (!actual || !isPackageVersion(actual) || comparePackageVersions(actual, target) < 0) {
                     throw new Error('Installed version did not reach the cached target');
@@ -407,7 +480,7 @@ async function checkLatestVersionWithFallback(pkg, timeoutMs, signal, explicitRe
     const version = selection.useNpmCli
         ? await checkLatestVersionViaNpm(pkg, timeoutMs, signal, selection.registry)
         : await fetchLatestVersion(pkg, timeoutMs, signal, selection.registry);
-    return version ? { version, registry: selection.registry } : null;
+    return version ? { version, registry: selection.registry, npmConfig: selection.npmConfig } : null;
 }
 /**
  * Query the registry selected from the running Node/npm configuration, or the
@@ -434,7 +507,7 @@ export async function tryUpgrade(options = {}) {
     }
     const { version: remoteVer, registry } = checked;
     // 版本比较
-    if (compareVersions(localVer, remoteVer) >= 0) {
+    if (comparePackageVersions(localVer, remoteVer) >= 0) {
         return { status: 'no-update', from: localVer };
     }
     // 有新版本，执行升级（失败重试一次）
@@ -447,10 +520,11 @@ export async function tryUpgrade(options = {}) {
                     timeoutMs: options.installTimeoutMs,
                     signal: options.signal,
                     registry,
+                    npmConfig: checked.npmConfig,
                 });
                 installedVer = getLocalVersion();
             });
-            if (!installedVer || compareVersions(installedVer, remoteVer) < 0) {
+            if (!installedVer || comparePackageVersions(installedVer, remoteVer) < 0) {
                 throw new Error(`npm install completed but evolcore is still ${installedVer ?? 'not installed'} (target ${remoteVer})`);
             }
             return { status: 'upgraded', from: localVer, to: installedVer };
@@ -484,7 +558,7 @@ export async function tryUpgradeGlobalPkg(resolveInstalled, pkgName, options = {
             : { status: 'skipped', error: 'Failed to check remote version' };
     }
     const { version: remoteVer, registry } = checked;
-    if (compareVersions(localVer, remoteVer) >= 0) {
+    if (comparePackageVersions(localVer, remoteVer) >= 0) {
         return { status: 'no-update', from: localVer };
     }
     let lastError;
@@ -496,10 +570,11 @@ export async function tryUpgradeGlobalPkg(resolveInstalled, pkgName, options = {
                     timeoutMs: options.installTimeoutMs,
                     signal: options.signal,
                     registry,
+                    npmConfig: checked.npmConfig,
                 });
                 installedVer = resolveInstalled()?.version;
             });
-            if (!installedVer || compareVersions(installedVer, remoteVer) < 0) {
+            if (!installedVer || comparePackageVersions(installedVer, remoteVer) < 0) {
                 throw new Error(`npm install completed but ${pkgName} is still ${installedVer ?? 'not installed'} (target ${remoteVer})`);
             }
             return { status: 'upgraded', from: localVer, to: installedVer };

package/dist/utils/package-version-info.js

@@ -2,13 +2,20 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { MAIN_PACKAGE_NAME, WEB_PACKAGE_NAME, TARGET_PACKAGE_ROOT_ENV } from '../product.js';
-import { getLocalVersion, isLinkedInstall, resolveGlobalPkg, resolveUpgradeRegistry, queryPackageVersion, installExactPackageVersion, } from './npm-ops.js';
+import { DEFAULT_NPM_REGISTRY, getLocalVersion, isLinkedInstall, resolveGlobalPkg, resolveUpgradeRegistry, queryPackageVersion, installExactPackageVersion, } from './npm-ops.js';
 import { comparePackageVersions, isPackageVersion, normalizeVersionRegistry } from './npm-ops.js';
 import { atomicReplaceJson, withFileLock } from './atomic-write.js';
+import { loadDaemonConfig } from '../config-store.js';
 export const VERSION_INFO_TTL_MS = 24 * 60 * 60 * 1000;
+export const VERSION_INFO_SCHEMA_VERSION = 2;
 export const VERSION_INFO_PACKAGES = [MAIN_PACKAGE_NAME, WEB_PACKAGE_NAME, '@agentunion/fastaun'];
-export const AUTO_UPGRADE_PACKAGES = [MAIN_PACKAGE_NAME, WEB_PACKAGE_NAME];
-const empty = () => ({ $schema_version: 1, packages: {} });
+export const AUTO_UPGRADE_PACKAGES = [MAIN_PACKAGE_NAME];
+export function resolveUpgradeDistTag() {
+    return loadDaemonConfig().upgrade?.testPackages === true ? 'test' : 'latest';
+}
+const linkedInstallSelection = { registry: DEFAULT_NPM_REGISTRY, useNpmCli: false, npmConfig: {} };
+const snapshotKey = (name, registry, distTag) => JSON.stringify([name, registry, distTag]);
+const empty = () => ({ $schema_version: VERSION_INFO_SCHEMA_VERSION, packages: {} });
 const timestamp = (value) => typeof value === 'string' ? Date.parse(value) : NaN;
 const allowed = (name) => VERSION_INFO_PACKAGES.includes(name);
 const filePath = () => path.join(resolvePaths().dataDir, 'package-version-info.json');
@@ -17,10 +24,22 @@ const writeLockPath = () => `${filePath()}.lock`;
 export function readPackageVersionInfo() {
     try {
         const raw = JSON.parse(fs.readFileSync(filePath(), 'utf8'));
-        if (raw?.$schema_version !== 1 || !raw.packages || Array.isArray(raw.packages)
+        if (raw?.$schema_version !== VERSION_INFO_SCHEMA_VERSION || !raw.packages || Array.isArray(raw.packages)
             || typeof raw.packages !== 'object' || Object.keys(raw.packages).some(name => !allowed(name)))
             return empty();
         const result = empty();
+        if (raw.snapshots && typeof raw.snapshots === 'object' && !Array.isArray(raw.snapshots)) {
+            result.snapshots = {};
+            for (const [key, value] of Object.entries(raw.snapshots)) {
+                const entry = value;
+                if (entry && allowed(entry.packageName) && entry.registry && normalizeVersionRegistry(entry.registry) === entry.registry
+                    && ['latest', 'test'].includes(entry.distTag ?? 'latest')
+                    && key === snapshotKey(entry.packageName, entry.registry, entry.distTag ?? 'latest')
+                    && (entry.currentVersion === null || isPackageVersion(entry.currentVersion))
+                    && (entry.latestVersion == null || isPackageVersion(entry.latestVersion)))
+                    result.snapshots[key] = entry;
+            }
+        }
         for (const [name, value] of Object.entries(raw.packages)) {
             const entry = value;
             if (!entry || entry.packageName !== name || !['ok', 'unavailable', 'skipped', 'not-installed'].includes(entry.lastAttemptStatus)
@@ -46,11 +65,12 @@ export async function readPackageVersionInfoConsistent(timeoutMs = 30000) {
     }
     return readPackageVersionInfo();
 }
-export function isPackageVersionInfoFresh(entry, now = Date.now(), ttlMs = VERSION_INFO_TTL_MS, registry) {
+export function isPackageVersionInfoFresh(entry, now = Date.now(), ttlMs = VERSION_INFO_TTL_MS, registry, distTag = 'latest') {
     if (!entry || !allowed(entry.packageName) || !isPackageVersion(entry.currentVersion)
         || !isPackageVersion(entry.latestVersion) || !entry.registry
         || normalizeVersionRegistry(entry.registry) !== entry.registry
-        || (registry !== undefined && entry.registry !== registry))
+        || (registry !== undefined && entry.registry !== registry)
+        || (entry.distTag ?? 'latest') !== distTag)
         return false;
     const checked = timestamp(entry.checkedAt);
     const observed = timestamp(entry.currentVersionObservedAt);
@@ -69,7 +89,9 @@ export async function mergePackageVersionInfo(patch) {
     const file = filePath();
     return withFileLock(writeLockPath(), async () => {
         const data = readPackageVersionInfo();
-        const previous = data.packages[patch.packageName];
+        const key = patch.registry ? snapshotKey(patch.packageName, patch.registry, patch.distTag ?? 'latest') : undefined;
+        const previous = key ? data.snapshots?.[key] ?? ((data.packages[patch.packageName]?.distTag ?? 'latest') === (patch.distTag ?? 'latest')
+            && data.packages[patch.packageName]?.registry === patch.registry ? data.packages[patch.packageName] : undefined) : data.packages[patch.packageName];
         const entry = previous ? { ...previous } : {
             packageName: patch.packageName, currentVersion: null, lastAttemptStatus: patch.lastAttemptStatus,
         };
@@ -83,6 +105,8 @@ export async function mergePackageVersionInfo(patch) {
             entry.latestVersion = patch.latestVersion;
             entry.checkedAt = patch.checkedAt;
             entry.registry = patch.registry;
+            entry.distTag = patch.distTag ?? 'latest';
+            entry.npmConfig = patch.npmConfig;
         }
         if (newer(patch.lastAttemptAt, entry.lastAttemptAt)) {
             entry.lastAttemptStatus = patch.lastAttemptStatus;
@@ -95,6 +119,15 @@ export async function mergePackageVersionInfo(patch) {
         if (patch.lastUpgrade && newer(patch.lastUpgrade.at, entry.lastUpgrade?.at))
             entry.lastUpgrade = patch.lastUpgrade;
         data.packages[patch.packageName] = entry;
+        if (key) {
+            entry.registry = patch.registry;
+            entry.distTag = patch.distTag ?? 'latest';
+            data.snapshots ??= {};
+            data.snapshots[key] = entry;
+            const keys = Object.keys(data.snapshots);
+            for (const expired of keys.sort((left, right) => timestamp(data.snapshots[left].lastAttemptAt) - timestamp(data.snapshots[right].lastAttemptAt)).slice(0, Math.max(0, keys.length - 48)))
+                delete data.snapshots[expired];
+        }
         await atomicReplaceJson(file, data);
         return entry;
     });
@@ -115,8 +148,8 @@ export function resolveVersionInfoPackage(name) {
         return null;
     }
 }
-function hasUpdate(entry, registry, now = Date.now()) {
-    return isPackageVersionInfoFresh(entry, now, VERSION_INFO_TTL_MS, registry)
+function hasUpdate(entry, registry, now = Date.now(), distTag = 'latest') {
+    return isPackageVersionInfoFresh(entry, now, VERSION_INFO_TTL_MS, registry, distTag)
         && comparePackageVersions(entry.currentVersion, entry.latestVersion) < 0;
 }
 async function checkPackage(name, force, options) {
@@ -124,37 +157,44 @@ async function checkPackage(name, force, options) {
         throw new Error('Unmanaged package');
     const now = options.now ?? Date.now();
     const at = new Date(now).toISOString();
-    const old = (await readPackageVersionInfoConsistent()).packages[name];
+    const distTag = options.distTag ?? resolveUpgradeDistTag();
+    const selection = options.selection ?? (isLinkedInstall() && !options.includeUninstalled
+        ? linkedInstallSelection
+        : await resolveUpgradeRegistry(options.signal));
+    const registry = normalizeVersionRegistry(selection.registry);
+    const data = await readPackageVersionInfoConsistent();
+    const legacy = data.packages[name];
+    const old = registry ? data.snapshots?.[snapshotKey(name, registry, distTag)]
+        ?? (legacy?.registry === registry && (legacy.distTag ?? 'latest') === distTag ? legacy : undefined) : undefined;
     const observed = {
         packageName: name, currentVersion: null, currentVersionObservedAt: at,
         lastAttemptStatus: 'unavailable',
+        distTag, npmConfig: selection.npmConfig, ...(registry ? { registry } : {}),
     };
     const log = (message) => options.log?.(`[${options.source ?? 'version-check'}] ${name}: ${message}`);
     let source = 'refresh';
     try {
         const linked = isLinkedInstall();
-        const local = linked && name !== MAIN_PACKAGE_NAME ? null : resolveVersionInfoPackage(name);
+        const local = resolveVersionInfoPackage(name);
         if (local && !isPackageVersion(local.version))
             throw new Error('Invalid installed package version');
         observed.currentVersion = local?.version ?? null;
-        if (linked)
+        if (linked && !options.includeUninstalled)
             observed.lastAttemptStatus = 'skipped';
-        else if (!local)
+        else if (!local && !options.includeUninstalled)
             observed.lastAttemptStatus = 'not-installed';
         else {
-            const selection = options.selection ?? await resolveUpgradeRegistry(options.signal);
-            const registry = normalizeVersionRegistry(selection.registry);
             if (!registry)
                 throw new Error('Registry configuration is not safe for version caching');
-            if (!force && isPackageVersionInfoFresh(old, now, VERSION_INFO_TTL_MS, registry)) {
+            if (!force && isPackageVersionInfoFresh(old, now, VERSION_INFO_TTL_MS, registry, distTag)) {
                 source = 'cache';
                 observed.lastAttemptStatus = 'ok';
                 const entry = await mergePackageVersionInfo(observed);
                 log(`Using cached version information (age ${Math.floor((now - timestamp(old.checkedAt)) / 60000)}m)`);
-                return { packageName: name, status: 'ok', source, entry, hasUpdate: hasUpdate(entry, registry, now) };
+                return { packageName: name, status: 'ok', source, entry, hasUpdate: hasUpdate(entry, registry, now, distTag), npmConfig: selection.npmConfig };
             }
             log(force ? 'Refreshing version information' : 'Version information missing/invalid/expired; refreshing');
-            const checked = await queryPackageVersion(name, selection, options.signal);
+            const checked = await queryPackageVersion(name, selection, options.signal, distTag);
             if (!checked)
                 throw new Error('Version registry unavailable or returned an invalid version');
             observed.latestVersion = checked.version;
@@ -167,7 +207,7 @@ async function checkPackage(name, force, options) {
     }
     catch {
         observed.lastAttemptStatus = 'unavailable';
-        observed.lastError = 'Version refresh failed; continuing with current version';
+        observed.lastError = `Cannot resolve ${name}@${distTag}; registry unavailable, tag missing or invalid version`;
         log(observed.lastError);
     }
     observed.lastAttemptAt = at;
@@ -181,20 +221,25 @@ async function checkPackage(name, force, options) {
     }
     return {
         packageName: name, source, entry, status: observed.lastAttemptStatus,
-        hasUpdate: observed.lastAttemptStatus === 'ok' && hasUpdate(entry, observed.registry, now),
+        hasUpdate: observed.lastAttemptStatus === 'ok' && hasUpdate(entry, observed.registry, now, distTag),
         ...(observed.lastError ? { error: observed.lastError } : {}),
+        npmConfig: selection.npmConfig,
     };
 }
 export async function refreshPackageVersionInfo(name, options = {}) {
     return checkPackage(name, true, options);
 }
 export async function ensureFreshPackageVersionInfo(names = AUTO_UPGRADE_PACKAGES, options = {}) {
-    const selection = options.selection ?? (isLinkedInstall() ? undefined : await resolveUpgradeRegistry(options.signal));
-    return Promise.all(names.map(name => checkPackage(name, false, { ...options, selection })));
+    const selection = options.selection ?? (isLinkedInstall() && !options.includeUninstalled
+        ? linkedInstallSelection
+        : await resolveUpgradeRegistry(options.signal));
+    const distTag = options.distTag ?? resolveUpgradeDistTag();
+    return Promise.all(names.map(name => checkPackage(name, false, { ...options, selection, distTag })));
 }
 export async function refreshManagedPackageVersions(names = AUTO_UPGRADE_PACKAGES, options = {}) {
-    const selection = options.selection ?? (isLinkedInstall() ? undefined : await resolveUpgradeRegistry(options.signal));
-    return Promise.all(names.map(name => checkPackage(name, true, { ...options, selection })));
+    const selection = options.selection ?? await resolveUpgradeRegistry(options.signal);
+    const distTag = options.distTag ?? resolveUpgradeDistTag();
+    return Promise.all(names.map(name => checkPackage(name, true, { ...options, selection, distTag })));
 }
 export async function recordPackageUpgrade(name, upgrade, log) {
     try {
@@ -219,14 +264,14 @@ export async function applyCachedPackageUpgrades(names = AUTO_UPGRADE_PACKAGES,
         if (!AUTO_UPGRADE_PACKAGES.includes(name))
             throw new Error('Package is not automatically managed');
         try {
-            const entry = (await readPackageVersionInfoConsistent(0)).packages[name];
+            const entry = options.target ?? (await readPackageVersionInfoConsistent(0)).packages[name];
             const registry = entry?.registry ? normalizeVersionRegistry(entry.registry) : null;
-            if (!registry || !isPackageVersionInfoFresh(entry, Date.now(), VERSION_INFO_TTL_MS, registry)) {
+            if (!registry || entry.packageName !== name || !isPackageVersionInfoFresh(entry, Date.now(), VERSION_INFO_TTL_MS, registry, options.distTag ?? resolveUpgradeDistTag())) {
                 result = { status: 'skipped', error: 'No valid cached version information' };
             }
             else {
                 options.log?.(`Applying cached version information: ${name}@${entry.latestVersion}`);
-                result = await installExactPackageVersion(name, entry.latestVersion, registry, () => resolveVersionInfoPackage(name));
+                result = await installExactPackageVersion(name, entry.latestVersion, registry, () => resolveVersionInfoPackage(name), options.npmConfig ?? entry.npmConfig);
             }
         }
         catch {