farming-code 2.2.13 → 2.2.16

package/backend/server.js

@@ -50,7 +50,6 @@ const { discoverSlashCommands } = require('./slash-command-discovery');
 const { FarmingUpdateService } = require('./update-service');
 const { isRestartBlockingAgent } = require('./agent-activity');
 const { inputPartsFromMessage } = require('./input-parts');
-const { AppServerApiBridge, createAppServerApiRouter } = require('./app-server-api');
 const { cleanupTerminalRuntime } = require('./terminal-runtime-cleanup');
 const { QrShareTicketStore, SHARE_TICKET_TTL_MS } = require('./qr-share-tickets');
 const { ReviewStateStore } = require('./review-state-store');
@@ -123,7 +122,6 @@ const updateService = new FarmingUpdateService({
   packagedRuntime: Boolean(process.pkg || process.env.FARMING_PACKAGED_RUNTIME === '1'),
   getUpdateUrl: () => configManager.getSettings().updateUrl || '',
 });
-const appServerApiBridge = new AppServerApiBridge();
 const usageMonitor = new UsageMonitor({ agentManager, getProviderHomes: configuredProviderHomes });
 const codexContextWindowReader = new CodexContextWindowReader();
 const usageSummaryCache = new AsyncCache(() => usageMonitor.getUsageSummary(), {
@@ -531,10 +529,6 @@ app.use(routePath(BASE_PATH, '/api/control'), createControlRouter(agentManager,
     && process.env.FARMING_E2E_FAKE_EXECUTABLES === '1',
 }));
 
-app.use(routePath(BASE_PATH, '/api/app-server'), createAppServerApiRouter({
-  bridge: appServerApiBridge,
-}));
-
 app.get([
   BASE_PATH || '/',
   `${BASE_PATH || ''}/`,
@@ -602,9 +596,21 @@ const IMAGE_ATTACHMENT_EXTENSIONS = {
   'image/gif': 'gif',
   'image/webp': 'webp',
 };
+const AUDIO_ATTACHMENT_EXTENSIONS = {
+  'audio/aac': 'aac',
+  'audio/flac': 'flac',
+  'audio/mp4': 'm4a',
+  'audio/mpeg': 'mp3',
+  'audio/ogg': 'ogg',
+  'audio/wav': 'wav',
+  'audio/wave': 'wav',
+  'audio/webm': 'webm',
+  'audio/x-wav': 'wav',
+};
 const IMAGE_ATTACHMENT_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 const IMAGE_ATTACHMENT_GC_INTERVAL_MS = 60 * 60 * 1000;
 const IMAGE_ATTACHMENT_FILENAME_RE = /^pasted-image-\d+-[a-f0-9]{8}\.(?:png|jpg|gif|webp)$/;
+const AUDIO_ATTACHMENT_FILENAME_RE = /^pasted-audio-\d+-[a-f0-9]{8}\.(?:aac|flac|m4a|mp3|ogg|wav|webm)$/;
 let lastImageAttachmentGcAt = 0;
 
 function imageAttachmentExtension(contentType) {
@@ -612,6 +618,11 @@ function imageAttachmentExtension(contentType) {
   return IMAGE_ATTACHMENT_EXTENSIONS[normalized] || '';
 }
 
+function audioAttachmentExtension(contentType) {
+  const normalized = String(contentType || '').split(';')[0].trim().toLowerCase();
+  return AUDIO_ATTACHMENT_EXTENSIONS[normalized] || '';
+}
+
 function imageAttachmentsDir() {
   return path.join(configManager.farmingDir, 'attachments');
 }
@@ -634,7 +645,7 @@ async function cleanupExpiredImageAttachments(options = {}) {
 
   const cutoff = now - IMAGE_ATTACHMENT_RETENTION_MS;
   await Promise.all(entries.map(async (entry) => {
-    if (!entry.isFile() || !IMAGE_ATTACHMENT_FILENAME_RE.test(entry.name)) return;
+    if (!entry.isFile() || (!IMAGE_ATTACHMENT_FILENAME_RE.test(entry.name) && !AUDIO_ATTACHMENT_FILENAME_RE.test(entry.name))) return;
 
     const filePath = path.join(attachmentsDir, entry.name);
     try {
@@ -684,6 +695,30 @@ app.post(
   }
 );
 
+app.post(
+  routePath(BASE_PATH, '/api/attachments/audio'),
+  express.raw({ type: 'audio/*', limit: '25mb' }),
+  (req, res) => {
+    const contentType = String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase();
+    const extension = audioAttachmentExtension(contentType);
+    if (!extension) {
+      res.status(415).json({ error: 'unsupported audio type' });
+      return;
+    }
+    if (!Buffer.isBuffer(req.body) || req.body.length === 0) {
+      res.status(400).json({ error: 'empty audio attachment' });
+      return;
+    }
+    const attachmentsDir = imageAttachmentsDir();
+    fs.mkdirSync(attachmentsDir, { recursive: true });
+    const filename = `pasted-audio-${Date.now()}-${crypto.randomBytes(4).toString('hex')}.${extension}`;
+    const filePath = path.join(attachmentsDir, filename);
+    fs.writeFileSync(filePath, req.body);
+    void cleanupExpiredImageAttachments();
+    res.status(201).json({ path: filePath, name: filename, type: contentType, size: req.body.length });
+  }
+);
+
 app.get(routePath(BASE_PATH, '/api/codex/models'), async (req, res) => {
   try {
     const catalog = await codexModelOptionsCache.get('catalog');
@@ -968,8 +1003,8 @@ app.get(routePath(BASE_PATH, '/api/agents/:agentId/session-view'), async (req, r
 });
 
 app.get(routePath(BASE_PATH, '/api/agents/:agentId/codex-transcript'), async (req, res) => {
-  // Legacy JSONL transcript reader. New App Server Agents use the dedicated
-  // structured endpoint below; Terminal Agents stay in their terminal UI.
+  // Legacy JSONL transcript reader. ACP Chat uses the dedicated ACP endpoint;
+  // Terminal Agents stay in their terminal UI.
   const providerSession = agentManager.getAgentProviderSession(req.params.agentId);
   if (!providerSession) {
     res.status(404).json({ error: 'Agent not found' });
@@ -999,9 +1034,7 @@ app.get(routePath(BASE_PATH, '/api/agents/:agentId/codex-transcript'), async (re
       : DEFAULT_CODEX_TRANSCRIPT_MAX_TURNS;
     const transcript = await readCodexTranscript(providerSession.sessionId, {
       maxTurns,
-      codexHome: runtimeKind(providerSession) === 'app-server'
-        ? (providerSession.codexAppServerHomePath || providerSession.providerHomePath || '')
-        : (providerSession.providerHomePath || ''),
+      codexHome: providerSession.providerHomePath || '',
     });
     res.json({ transcript });
   } catch (error) {
@@ -1010,20 +1043,6 @@ app.get(routePath(BASE_PATH, '/api/agents/:agentId/codex-transcript'), async (re
   }
 });
 
-app.get(routePath(BASE_PATH, '/api/agents/:agentId/codex-app-server-transcript'), async (req, res) => {
-  try {
-    const requestedMaxTurns = Number.parseInt(String(req.query.maxTurns || ''), 10);
-    const maxTurns = Number.isFinite(requestedMaxTurns)
-      ? Math.min(MAX_CODEX_TRANSCRIPT_TURNS, Math.max(20, requestedMaxTurns))
-      : DEFAULT_CODEX_TRANSCRIPT_MAX_TURNS;
-    const transcript = agentManager.getCodexAppServerTranscript(req.params.agentId, { maxTurns });
-    res.json({ transcript });
-  } catch (error) {
-    const message = error && error.message ? error.message : 'Failed to read Codex App Server transcript';
-    res.status(/not using the Codex App Server runtime/i.test(message) ? 409 : 500).json({ error: message });
-  }
-});
-
 app.get(routePath(BASE_PATH, '/api/agents/:agentId/json-cli-transcript'), async (req, res) => {
   try {
     const transcript = agentManager.getJsonCliTranscript(req.params.agentId, {
@@ -1191,6 +1210,15 @@ app.post(routePath(BASE_PATH, '/api/agents/:agentId/acp-session/authenticate'),
   }
 });
 
+app.post(routePath(BASE_PATH, '/api/agents/:agentId/acp-session/logout'), async (req, res) => {
+  try {
+    res.json(await agentManager.logoutAcpAgent(req.params.agentId));
+  } catch (error) {
+    const message = error && error.message ? error.message : 'Failed to log out ACP Agent';
+    res.status(message === 'Agent not found' ? 404 : 409).json({ error: message });
+  }
+});
+
 app.post(routePath(BASE_PATH, '/api/agents/:agentId/acp-session/fork'), express.json(), async (req, res) => {
   try {
     res.json(await agentManager.forkAcpSession(req.params.agentId, req.body || {}));
@@ -1243,41 +1271,6 @@ app.patch(routePath(BASE_PATH, '/api/agents/:agentId/acp-session'), express.json
   }
 });
 
-app.get(routePath(BASE_PATH, '/api/agents/:agentId/codex-goal'), async (req, res) => {
-  try {
-    const goal = await agentManager.getCodexAppServerGoal(req.params.agentId);
-    res.json({ goal });
-  } catch (error) {
-    const message = error && error.message ? error.message : 'Failed to read Codex goal';
-    res.status(message === 'Agent not found' ? 404 : 400).json({ error: message });
-  }
-});
-
-app.patch(routePath(BASE_PATH, '/api/agents/:agentId/codex-goal'), express.json(), async (req, res) => {
-  try {
-    const body = req.body || {};
-    const goal = await agentManager.setCodexAppServerGoal(req.params.agentId, {
-      objective: typeof body.objective === 'string' ? body.objective : undefined,
-      status: typeof body.status === 'string' ? body.status : undefined,
-      ...(Object.prototype.hasOwnProperty.call(body, 'tokenBudget') ? { tokenBudget: body.tokenBudget } : {}),
-    });
-    res.json({ goal });
-  } catch (error) {
-    const message = error && error.message ? error.message : 'Failed to update Codex goal';
-    res.status(message === 'Agent not found' ? 404 : 400).json({ error: message });
-  }
-});
-
-app.delete(routePath(BASE_PATH, '/api/agents/:agentId/codex-goal'), async (req, res) => {
-  try {
-    await agentManager.clearCodexAppServerGoal(req.params.agentId);
-    res.json({ goal: null });
-  } catch (error) {
-    const message = error && error.message ? error.message : 'Failed to clear Codex goal';
-    res.status(message === 'Agent not found' ? 404 : 400).json({ error: message });
-  }
-});
-
 app.post(routePath(BASE_PATH, '/api/agents/:agentId/codex-terminal-profile'), express.json(), async (req, res) => {
   const requestAbort = new globalThis.AbortController();
   const abortRequest = () => requestAbort.abort(new Error('Terminal profile request was canceled'));
@@ -1710,7 +1703,7 @@ async function resumeAgentSessionById(provider, rawSessionId, options = {}) {
         requiredCliVersion: normalizedProvider === 'codex' && session ? session.cliVersion : '',
         projectWorkspace: session ? (session.workspace || session.cwd || '') : '',
         source: shouldFork ? resumeSource.replace('-history:', '-history-fork:') : resumeSource,
-        agentRuntimeMode: options.agentRuntimeMode === 'acp' ? 'acp' : 'terminal',
+        agentRuntimeMode: ['chat', 'acp'].includes(options.agentRuntimeMode) ? 'chat' : 'terminal',
         acpHistoryMode: options.acpHistoryMode === 'resume' ? 'resume' : 'load',
         providerHomeId: resolvedProviderHomeId,
         providerHomePath: session ? (session.providerHomePath || '') : '',
@@ -1754,7 +1747,7 @@ async function startResumedAgentSession(req, res, provider, rawSessionId) {
     allowUnarchiveArchived,
     providerHomeId: req.body && typeof req.body.providerHomeId === 'string' ? req.body.providerHomeId : '',
     customTitle: req.body && typeof req.body.customTitle === 'string' ? req.body.customTitle : '',
-    agentRuntimeMode: req.body && req.body.agentRuntimeMode === 'acp' ? 'acp' : 'terminal',
+    agentRuntimeMode: req.body && ['chat', 'acp'].includes(req.body.agentRuntimeMode) ? 'chat' : 'terminal',
     acpHistoryMode: req.body && req.body.acpHistoryMode === 'resume' ? 'resume' : 'load',
   });
 
@@ -2018,66 +2011,66 @@ async function sendInputMessage(ws, data) {
 
 async function sendComposerInputMessage(ws, data) {
   const targetAgentId = resolveInputTargetAgentId(ws, data);
+  const requestId = typeof data.requestId === 'string' ? data.requestId : '';
+  const responseAgentId = targetAgentId || (typeof data.agentId === 'string' ? data.agentId : '');
+  const respond = (accepted, message = '') => {
+    if (!requestId || !responseAgentId) return;
+    ws.send(JSON.stringify({
+      type: 'composer-input-result',
+      requestId,
+      agentId: responseAgentId,
+      accepted,
+      ...(message ? { message } : {}),
+    }));
+  };
   const message = typeof data.message === 'string' ? data.message : '';
   const content = [];
   if (message.trim()) content.push({ type: 'text', text: message });
   const attachmentsRoot = path.resolve(imageAttachmentsDir());
   const attachments = Array.isArray(data.attachments) ? data.attachments.slice(0, 8) : [];
   for (const attachment of attachments) {
-    if (attachment?.kind !== 'image' || typeof attachment.path !== 'string') continue;
+    if (!['image', 'audio'].includes(attachment?.kind) || typeof attachment.path !== 'string') continue;
     const filePath = path.resolve(attachment.path);
     if (!filePath.startsWith(`${attachmentsRoot}${path.sep}`)) continue;
-    const mimeType = typeof attachment.type === 'string' && /^image\/(?:png|jpe?g|gif|webp)$/i.test(attachment.type)
+    const mimeType = typeof attachment.type === 'string' && attachment.kind === 'image' && /^image\/(?:png|jpe?g|gif|webp)$/i.test(attachment.type)
       ? attachment.type.toLowerCase()
-      : '';
+      : (typeof attachment.type === 'string' && attachment.kind === 'audio' && Object.hasOwn(AUDIO_ATTACHMENT_EXTENSIONS, attachment.type.toLowerCase())
+        ? attachment.type.toLowerCase()
+        : '');
     if (!mimeType) continue;
     try {
       const data = await fs.promises.readFile(filePath);
       if (data.length === 0 || data.length > 12 * 1024 * 1024) continue;
       content.push({
-        type: 'image',
+        type: attachment.kind,
         data: data.toString('base64'),
         mimeType,
+        path: filePath,
         uri: pathToFileURL(filePath).href,
       });
     } catch {
       // The text fallback already explains failed or unavailable uploads.
     }
   }
-  if (!targetAgentId || content.length === 0) return;
+  if (!targetAgentId || content.length === 0) {
+    respond(false, 'Composer message is empty');
+    return;
+  }
   const targetAgent = agentManager.getState().agents.find(agent => agent.id === targetAgentId);
   const structuredRuntime = targetAgent && runtimeKind(targetAgent) !== 'terminal';
   if (!structuredRuntime) {
-    ws.send(JSON.stringify({
-      type: 'error',
-      message: 'Terminal Composer input requires the active terminal owner',
-    }));
+    const error = 'Terminal Composer input requires the active terminal owner';
+    if (requestId) respond(false, error);
+    else ws.send(JSON.stringify({ type: 'error', message: error }));
     return;
   }
   try {
     await agentManager.sendComposerMessage(targetAgentId, content);
+    respond(true);
   } catch (error) {
-    ws.send(JSON.stringify({
-      type: 'error',
-      message: error && error.message ? error.message : 'Failed to send Composer message',
-    }));
-  }
-}
-
-async function respondToAppServerRequest(ws, data) {
-  const targetAgentId = resolveInputTargetAgentId(ws, data);
-  const requestId = typeof data.requestId === 'string' ? data.requestId : '';
-  if (!targetAgentId || !requestId) return;
-  try {
-    agentManager.respondToCodexAppServerRequest(targetAgentId, requestId, data.result, {
-      reject: data.reject === true,
-      reason: typeof data.reason === 'string' ? data.reason : '',
-    });
-  } catch (error) {
-    ws.send(JSON.stringify({
-      type: 'error',
-      message: error && error.message ? error.message : 'Failed to respond to Codex App Server request',
-    }));
+    const message = error && error.message ? error.message : 'Failed to send Composer message';
+    if (requestId) respond(false, message);
+    else ws.send(JSON.stringify({ type: 'error', message }));
   }
 }
 
@@ -2107,12 +2100,11 @@ function handleMessage(ws, data) {
         workflowTemplate: typeof data.workflowTemplate === 'string' ? data.workflowTemplate : '',
         customTitle: typeof data.customTitle === 'string' ? data.customTitle : '',
         codexApprovalMode: typeof data.codexApprovalMode === 'string' ? data.codexApprovalMode : undefined,
-        codexRuntimeMode: data.codexRuntimeMode === 'app-server' || data.codexRuntimeMode === 'cli'
-          ? data.codexRuntimeMode
-          : undefined,
-        agentRuntimeMode: ['json', 'acp'].includes(data.agentRuntimeMode) ? data.agentRuntimeMode : 'terminal',
+        agentRuntimeMode: ['json', 'acp', 'chat'].includes(data.agentRuntimeMode) ? data.agentRuntimeMode : 'terminal',
         acpHistoryMode: data.acpHistoryMode === 'resume' ? 'resume' : 'load',
         providerHomeId: typeof data.providerHomeId === 'string' ? data.providerHomeId : '',
+        ...(Array.isArray(data.additionalDirectories) ? { additionalDirectories: data.additionalDirectories } : {}),
+        ...(Array.isArray(data.mcpServers) ? { mcpServers: data.mcpServers } : {}),
         ...(data.dangerouslySkipPermissions === true ? { dangerouslySkipPermissions: true } : {}),
       });
       break;
@@ -2129,12 +2121,6 @@ function handleMessage(ws, data) {
       }
       break;
 
-    case 'app-server-request-response':
-      {
-        void respondToAppServerRequest(ws, data);
-      }
-      break;
-
     case 'acp-permission-response':
       try {
         agentManager.respondToAcpPermission(
@@ -2717,7 +2703,6 @@ module.exports = {
   server,
   wss,
   agentManager,
-  appServerApiBridge,
   workspaceFileService,
   handleMessage,
   resolveCliBinDir,

package/backend/storage-layout.js

@@ -1,6 +1,5 @@
 const os = require('os');
 const path = require('path');
-const crypto = require('crypto');
 
 function farmingConfigDir(env = process.env) {
   return env.FARMING_CONFIG_DIR || path.join(env.HOME || os.homedir(), '.farming');
@@ -110,23 +109,8 @@ function farmingNetTrustFile(configDir) {
   return path.join(configDir, 'farming-net-trust.json');
 }
 
-function codexAppServerRuntimeDir(configDir) {
-  return path.join(configDir, 'c');
-}
-
-function codexAppServerAgentHome(configDir, agentId) {
-  const safeAgentId = String(agentId || '').trim();
-  if (!/^agent-[A-Za-z0-9_-]+$/.test(safeAgentId)) {
-    throw new Error('Invalid Codex App Server agent id');
-  }
-  const homeId = crypto.createHash('sha256').update(safeAgentId).digest('hex').slice(0, 16);
-  return path.join(codexAppServerRuntimeDir(configDir), homeId);
-}
-
 module.exports = {
   acpCheckpointsDir,
-  codexAppServerAgentHome,
-  codexAppServerRuntimeDir,
   farmingNetInstancesFile,
   farmingNetServerLogFile,
   farmingNetServerStateFile,

package/backend/update-service.js

@@ -681,6 +681,45 @@ function npmPackageMetadataUrl(registryUrl, packageName) {
   return `${registry}/${encodeURIComponent(packageName).replace(/^%40/, '@')}`;
 }
 
+function normalizePathForCompare(filePath) {
+  try {
+    return fs.realpathSync(filePath);
+  } catch {
+    return path.resolve(filePath);
+  }
+}
+
+function npmPackageRoot(npmRoot, packageName) {
+  return path.join(npmRoot, ...String(packageName || '').split('/').filter(Boolean));
+}
+
+function npmPrefixForPackageRoot(packageRoot, packageName) {
+  const segments = String(packageName || '').split('/').filter(Boolean);
+  if (!path.isAbsolute(packageRoot) || segments.length === 0) return '';
+  let npmRoot = packageRoot;
+  for (let index = 0; index < segments.length; index += 1) npmRoot = path.dirname(npmRoot);
+  return path.dirname(path.dirname(npmRoot));
+}
+
+function readNpmGlobalRoot(npmCommand, npmPrefix, execFile = childProcess.execFile) {
+  const args = ['root', '--global'];
+  if (npmPrefix) args.push('--prefix', npmPrefix);
+  return new Promise((resolve, reject) => {
+    execFile(npmCommand, args, (error, stdout) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      const root = String(stdout || '').split(/\r?\n/).map(value => value.trim()).find(Boolean);
+      if (!root) {
+        reject(new Error('npm root --global returned no path'));
+        return;
+      }
+      resolve(root);
+    });
+  });
+}
+
 function npmVersionsFromMetadata(metadata, currentVersion) {
   const versions = metadata && metadata.versions && typeof metadata.versions === 'object'
     ? Object.keys(metadata.versions)
@@ -711,6 +750,8 @@ class FarmingUpdateService {
     });
     this.npmPackageName = options.npmPackageName || NPM_PACKAGE_NAME;
     this.npmRegistryUrl = options.npmRegistryUrl || process.env.FARMING_NPM_REGISTRY || DEFAULT_NPM_REGISTRY;
+    this.npmPackageRoot = options.npmPackageRoot || process.env.FARMING_MANAGED_PACKAGE_ROOT || '';
+    this.npmPrefix = options.npmPrefix || process.env.FARMING_NPM_PREFIX || '';
     this.runtime = options.platform || options.arch
       ? {
         platform: normalizePlatform(options.platform || process.platform),
@@ -724,6 +765,8 @@ class FarmingUpdateService {
     this.downloadFile = options.downloadFile || downloadFile;
     this.listArchiveEntries = options.listArchiveEntries || listTarArchiveEntries;
     this.execFile = options.execFile || childProcess.execFile;
+    this.getNpmGlobalRoot = options.getNpmGlobalRoot
+      || ((npmCommand, npmPrefix) => readNpmGlobalRoot(npmCommand, npmPrefix, this.execFile));
     this.spawn = options.spawn || childProcess.spawn;
     this.latestCache = null;
     this.npmCache = null;
@@ -782,6 +825,7 @@ class FarmingUpdateService {
     const current = this.currentVersion();
     const currentVersion = normalizeVersion(current.releaseVersion || current.packageVersion);
     const metadata = await this.npmMetadata(options);
+    const target = await this.npmUpdateTarget();
     const versions = npmVersionsFromMetadata(metadata, currentVersion);
     const latestVersion = normalizeVersion(metadata && metadata['dist-tags'] && metadata['dist-tags'].latest)
       || versions[0]?.version
@@ -791,7 +835,8 @@ class FarmingUpdateService {
       || versions.find(version => version.version === latestVersion)
       || versions[0]
       || null;
-    const available = Boolean(selected && selected.available);
+    const blockedReason = target.proven ? '' : target.error;
+    const available = Boolean(selected && selected.available && target.proven);
     return {
       method: 'npm',
       current,
@@ -802,24 +847,63 @@ class FarmingUpdateService {
         publishedAt: '',
         assetName: latestVersion,
         assetSize: 0,
-        blockedReason: '',
+        blockedReason,
         source: npmPackageMetadataUrl(this.npmRegistryUrl, this.npmPackageName),
       },
       selected: {
         version: selected?.version || '',
         assetName: selected?.assetName || '',
         assetSize: selected?.assetSize || 0,
-        blockedReason: selected?.blockedReason || '',
+        blockedReason: selected?.blockedReason || blockedReason,
       },
       versions,
       runtime: this.runtime,
+      target,
       available,
-      installable: Boolean(selected),
+      installable: Boolean(selected && target.proven),
       checkedAt: new Date(this.now()).toISOString(),
       state: this.currentInstallState(),
     };
   }
 
+  async npmUpdateTarget() {
+    const runningPackageRoot = String(this.npmPackageRoot || '').trim();
+    if (!path.isAbsolute(runningPackageRoot)) {
+      return {
+        proven: false,
+        error: 'npm update target could not be proven: the running package has no managed package-root provenance',
+      };
+    }
+    const npmCommand = process.env.FARMING_NPM_COMMAND || 'npm';
+    const npmPrefix = this.npmPrefix || npmPrefixForPackageRoot(runningPackageRoot, this.npmPackageName);
+    if (!npmPrefix) {
+      return {
+        proven: false,
+        error: 'npm update target could not be proven: the running package has no npm prefix',
+      };
+    }
+    try {
+      const root = await this.getNpmGlobalRoot(npmCommand, npmPrefix);
+      const targetPackageRoot = npmPackageRoot(root, this.npmPackageName);
+      if (normalizePathForCompare(runningPackageRoot) !== normalizePathForCompare(targetPackageRoot)) {
+        return {
+          proven: false,
+          error: `npm update would target a different installation: running ${runningPackageRoot}; npm ${targetPackageRoot}`,
+        };
+      }
+      return {
+        proven: true,
+        npmPrefix,
+        packageRoot: targetPackageRoot,
+      };
+    } catch (error) {
+      return {
+        proven: false,
+        error: `npm update target could not be inspected: ${error.message || String(error)}`,
+      };
+    }
+  }
+
   unsupportedStatus() {
     const current = this.currentVersion();
     const reason = installMethodBlockedReason(this.installMethod);
@@ -1081,9 +1165,11 @@ class FarmingUpdateService {
       stateFile: this.updateStateFile,
       logPath: this.updateLogFile,
       cliPath: path.join(this.rootDir, 'bin', 'farming'),
+      packageRoot: status.target.packageRoot,
       nodePath,
       npmCommand: process.env.FARMING_NPM_COMMAND || 'npm',
-      npmPrefix: process.env.FARMING_NPM_PREFIX || '',
+      npmPrefix: status.target.npmPrefix,
+      npmFallbackRegistryUrl: this.npmRegistryUrl,
       serverPid: process.pid,
       configDir: this.configDir,
       port: process.env.FARMING_PORT || process.env.PORT || '6694',
@@ -1181,7 +1267,10 @@ module.exports = {
   installMethodAllowsBundleUpdate,
   normalizeVersion,
   npmPackageMetadataUrl,
+  npmPrefixForPackageRoot,
+  npmPackageRoot,
   npmVersionsFromMetadata,
+  readNpmGlobalRoot,
   releaseInstallDir,
   manifestAssetSafety,
   normalizeSha256,