frizz 0.12.11 → 0.12.13

package/dist/frizz.js

@@ -12841,14 +12841,16 @@ var init_src = __esm({
       "the write-up.",
       "",
       "**DECIDE RATHER THAN ASK.** Stop only for a decision that is genuinely the human's AND that blocks you",
-      "right now: ask that one in a question fence. Every other open choice INSIDE the task \u2014 a name, a",
+      "right now: register that one with `mcp__frizz__ask`. Every other open choice INSIDE the task \u2014 a name, a",
       "default, a reversible design call \u2014 is yours to make: decide it, say in one line which way you went and",
       "what would reverse it, and carry on. A choice that would ENLARGE the task is not one of those: an",
       "unanswered question is not permission to go build the answer.",
       "",
-      "Otherwise, add a fence at the END of your next message:",
+      "Otherwise, sign off \u2014 a registration, or a fence at the END of your next message:",
       "",
-      "- `` ```question `` \u2014 you need the human. One question per fence, lettered options, one recommended.",
+      "- `mcp__frizz__ask` \u2014 you need the human. NOT a fence: the ```question fence is retired, and a fence",
+      "  with a question in its body is plain prose. Register it (options with one-line trade-offs, the",
+      "  recommended one first), then rest normally \u2014 an open registered question is the sign-off.",
       "- `` ```done `` \u2014 genuinely FINISHED. A DISMISSAL: the card is filed away and nobody looks again, so",
       "  if anything is still owed, it is not done. Body: 1-3 sentences, then bullets, each opening with a",
       "  **bolded verb phrase**.",
@@ -19831,7 +19833,7 @@ init_local_origin();
 import { readFileSync as readFileSync13 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 
 // src/browser.ts
 import { spawn, execFile } from "node:child_process";
@@ -22489,6 +22491,8 @@ async function readJsonBody(req, limit = 64 * 1024) {
 var RestartSupervisorProxy = class {
   server = null;
   restartInFlight = null;
+  /** Which action `restartInFlight` is. An update's prepare phase leaves the child serving; a restart does not. */
+  transition = null;
   state = "ready";
   message;
   options;
@@ -22615,10 +22619,11 @@ var RestartSupervisorProxy = class {
   status() {
     const delegated = this.options.status?.();
     const updateVersion = this.options.updateVersion?.();
-    const ownerTransition = this.restartInFlight !== null || this.state === "failed";
+    const owner = { state: this.state, ...this.message ? { message: this.message } : {} };
+    const reported = this.transition === "update" && delegated ? { ...delegated, ...delegated.state === "ready" ? { preparing: true } : {} } : this.restartInFlight !== null || this.state === "failed" ? owner : delegated ?? owner;
     return {
       ...delegated ?? {},
-      ...ownerTransition ? { state: this.state, ...this.message ? { message: this.message } : {} } : delegated ?? { state: this.state, ...this.message ? { message: this.message } : {} },
+      ...reported,
       // Never infer this from the generic protocol: legacy/static supervisors can recover a child
       // but cannot build and promote the canonical Frizz artifact.
       updateRestart: typeof this.options.updateRestart === "function",
@@ -22634,8 +22639,9 @@ var RestartSupervisorProxy = class {
       ...this.options.dev ? { dev: true } : {}
     };
   }
-  async runAction(action) {
+  async runAction(action, transition) {
     if (this.restartInFlight) return this.restartInFlight;
+    this.transition = transition;
     this.state = "restarting";
     this.message = void 0;
     const work = (async () => {
@@ -22655,6 +22661,7 @@ var RestartSupervisorProxy = class {
       }
     ).finally(() => {
       this.restartInFlight = null;
+      this.transition = null;
     });
     this.restartInFlight = work;
     return work;
@@ -22738,11 +22745,11 @@ var RestartSupervisorProxy = class {
       return;
     }
     if (pathname === SUPERVISOR_UPDATE_RESTART_PATH) {
-      void this.runAction(this.options.updateRestart);
+      void this.runAction(this.options.updateRestart, "update");
       responseJson(res, 202, { protocol: SUPERVISOR_CONTROL_PROTOCOL, state: "restarting" });
       return;
     }
-    const result = await this.runAction(this.options.restart);
+    const result = await this.runAction(this.options.restart, "restart");
     responseJson(res, result.state === "ready" ? 202 : 503, { protocol: SUPERVISOR_CONTROL_PROTOCOL, ...result });
   }
   handleLocalImage(req, res) {
@@ -22975,10 +22982,17 @@ async function signOutSession(port, target2) {
 
 // src/pane-host.ts
 var CTRL_C = "";
+function raiseInterrupt() {
+  if (process.listenerCount("SIGINT") > 0) {
+    process.emit("SIGINT", "SIGINT");
+    return;
+  }
+  process.kill(process.pid, "SIGINT");
+}
 function installPaneHost(options2) {
   const input = options2.input ?? process.stdin;
   const output = options2.output ?? process.stdout;
-  const onInterrupt = options2.onInterrupt ?? (() => process.kill(process.pid, "SIGINT"));
+  const onInterrupt = options2.onInterrupt ?? raiseInterrupt;
   if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== "function") return null;
   let active = null;
   let disposed = false;
@@ -23498,9 +23512,9 @@ function connectRelay(options2) {
   };
   const scheduleRetry = (reason) => {
     if (stopped) return;
-    const delay3 = backoff(attempt++);
-    options2.onStatus?.("retrying", `${reason}; retrying in ${Math.round(delay3 / 1e3)}s`);
-    retryHandle = setTimer(() => void open(), delay3);
+    const delay4 = backoff(attempt++);
+    options2.onStatus?.("retrying", `${reason}; retrying in ${Math.round(delay4 / 1e3)}s`);
+    retryHandle = setTimer(() => void open(), delay4);
   };
   const open = async () => {
     if (stopped) return;
@@ -24300,7 +24314,7 @@ function formatDuration(ms) {
 function tildePath(path, home) {
   if (!home || !path.startsWith(home)) return path;
   const rest = path.slice(home.length);
-  return rest === "" ? "~" : rest.startsWith("/") ? `~${rest}` : path;
+  return rest === "" ? "~" : /^[\\/]/.test(rest) ? `~${rest}` : path;
 }
 var Readout = class {
   out;
@@ -24952,6 +24966,54 @@ async function probeFrizz(port, expected2, fetcher = fetch, timeoutMs = HEALTH_P
     clearTimeout(timeout);
   }
 }
+async function readFrizzHealth(port, fetcher = fetch, timeoutMs = HEALTH_PROBE_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  timeout.unref?.();
+  try {
+    const response = await fetcher(`http://127.0.0.1:${port}${FRIZZ_ROUTE_PREFIX}/health`, { signal: controller.signal });
+    if (!response.ok) return null;
+    const health = await response.json();
+    if (health.ok !== true || typeof health.projectId !== "string" || typeof health.projectDir !== "string" || typeof health.bootId !== "string") return null;
+    return health;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function resolveLaunchControlTarget(options2) {
+  const own = { target: options2.target, stateDir: options2.stateDir, host: true };
+  if (readProjectLaunchOwner(options2.stateDir)) return own;
+  const fetcher = options2.fetcher ?? fetch;
+  const stateDirFor = options2.stateDirFor ?? ((projectId) => projectStateDir(projectId));
+  for (const port of new Set(options2.ports ?? [DEFAULT_PORT, fallbackPort(DEFAULT_PORT)])) {
+    const health = await readFrizzHealth(port, fetcher);
+    if (!health || health.projectId === options2.target.projectId) continue;
+    const stateDir = stateDirFor(health.projectId);
+    if (!readProjectLaunchOwner(stateDir)) continue;
+    return { target: { projectId: health.projectId, projectDir: health.projectDir, stateDir }, stateDir, host: false };
+  }
+  return own;
+}
+async function requestFrizzStop(port, expected2, ownerToken, fetcher = fetch) {
+  if (!await probeFrizz(port, expected2, fetcher)) return false;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1e3);
+  timeout.unref?.();
+  try {
+    const response = await fetcher(`http://127.0.0.1:${port}${FRIZZ_ROUTE_PREFIX}/control/stop`, {
+      method: "POST",
+      headers: { "x-frizz-launch-token": ownerToken },
+      signal: controller.signal
+    });
+    return response.status === 202;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function expectedOwnerHealth(target2, owner) {
   return {
     projectId: target2.projectId,
@@ -25042,6 +25104,66 @@ async function waitForWorkspace(port, expected2, timeoutMs = LAUNCH_TIMEOUT_MS,
     await delay2(150);
   }
 }
+async function stopProjectLaunch(options2) {
+  const { stateDir, target: target2 } = options2;
+  const adapter = options2.adapter ?? defaultProcessPlatformAdapter;
+  const fetcher = options2.fetcher ?? fetch;
+  const sleep = options2.sleep ?? ((ms) => delay2(ms));
+  const owner = readProjectLaunchOwner(stateDir);
+  if (!owner) return { kind: "not-running" };
+  const status = liveWorkspaceOwner(stateDir, target2, adapter);
+  const controlPort = status?.port ?? (status ? void 0 : await options2.fallbackPort?.());
+  const controlled = controlPort ? await requestFrizzStop(controlPort, expectedOwnerHealth(target2, owner), owner.token, fetcher) : false;
+  if (!controlled && !processGenerationIsStale(owner, adapter)) {
+    throw new Error(
+      "Frizz refused to stop a live owner without authenticated token-bound control; the owner was left untouched"
+    );
+  }
+  const reap = () => {
+    if (!readProjectLaunchOwner(stateDir)) return true;
+    const reaped = tryAcquireProjectLaunchOwner(target2, "launcher", { delegateDrainTimeoutMs: 250, adapter });
+    if (reaped.kind !== "acquired") return false;
+    reaped.lease.release();
+    return true;
+  };
+  const deadline = adapter.now() + (options2.timeoutMs ?? 1e4);
+  while (adapter.now() < deadline) {
+    if (reap()) return { kind: "stopped", stale: !controlled };
+    await sleep(100);
+  }
+  await sleep(100);
+  if (reap()) return { kind: "stopped", stale: !controlled };
+  throw new Error(`supervisor pid ${owner.pid} did not stop within ${Math.round((options2.timeoutMs ?? 1e4) / 1e3)}s`);
+}
+async function runningFrizzStatus(options2) {
+  const fetcher = options2.fetcher ?? fetch;
+  const owner = liveWorkspaceOwner(options2.stateDir, options2.target, options2.adapter ?? defaultProcessPlatformAdapter);
+  if (!owner?.port) return null;
+  const expected2 = expectedOwnerHealth(options2.target, readProjectLaunchOwner(options2.stateDir));
+  if (!await probeFrizz(owner.port, expected2, fetcher)) return null;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), HEALTH_PROBE_TIMEOUT_MS);
+  timeout.unref?.();
+  let control = {};
+  try {
+    const response = await fetcher(`http://127.0.0.1:${owner.port}${FRIZZ_ROUTE_PREFIX}/control/status`, {
+      signal: controller.signal,
+      headers: { origin: `http://127.0.0.1:${owner.port}`, "cache-control": "no-store" }
+    });
+    if (response.ok) {
+      const body = await response.json();
+      control = {
+        ...typeof body.version === "string" ? { version: body.version } : {},
+        ...typeof body.state === "string" ? { state: body.state } : {},
+        ...typeof body.message === "string" ? { message: body.message } : {}
+      };
+    }
+  } catch {
+  } finally {
+    clearTimeout(timeout);
+  }
+  return { port: owner.port, pid: owner.pid, ...control };
+}
 
 // src/production.ts
 init_project_launch();
@@ -25061,6 +25183,7 @@ var DEV_CRASH_STABLE_MS = 5e3;
 var DEV_CRASH_RETRY_BASE_MS = 500;
 var DEV_CRASH_RETRY_MAX_MS = 1e4;
 var CHILD_STOP_TIMEOUT_MS = 15e3;
+var CHILD_KILL_GRACE_MS = 5e3;
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"]);
 var CONFIG_NAMES = /* @__PURE__ */ new Set(["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", ".npmrc"]);
 var CHILD_RUNTIME_PACKAGES = /* @__PURE__ */ new Set(["server", "shared", "rpc", "claude-agent-sdk-runtime"]);
@@ -25091,7 +25214,7 @@ function devCrashRetryDelay(attempt) {
   return Math.min(DEV_CRASH_RETRY_BASE_MS * 2 ** exponent, DEV_CRASH_RETRY_MAX_MS);
 }
 var SUPERVISOR_ESCALATE_GRACE_MS = 500;
-var SUPERVISOR_DRAIN_DEADLINE_MS = CHILD_STOP_TIMEOUT_MS + 5e3;
+var SUPERVISOR_DRAIN_DEADLINE_MS = CHILD_STOP_TIMEOUT_MS + CHILD_KILL_GRACE_MS + 5e3;
 function stripPrefix(line) {
   return line.startsWith("[frizz] ") ? line.slice("[frizz] ".length) : line;
 }
@@ -25306,6 +25429,13 @@ var Supervisor = class {
   /** Environment of the generation that actually reached ready, never merely the latest pointer. */
   activeChildEnvironment = {};
   lastRestartFailure;
+  /**
+   * True from the moment an update starts draining the old child until that update has settled.
+   * Before it — the prepare phase — the old child is untouched and serving, and the status delegate
+   * says so; during it the child bookkeeping reads as "failed" (no child, no boot), which is not
+   * what a poll during those seconds should learn.
+   */
+  handoffDraining = false;
   constructor(opts) {
     const launchOwner = verifyProjectLaunchDelegate(opts.launchTarget, opts.launchOwnerToken);
     const callerGeneration = currentProcessGeneration();
@@ -25324,7 +25454,7 @@ var Supervisor = class {
     this.childLaunchProvider = opts.childLaunchProvider;
     this.childArgs = opts.childArgs ?? [];
     this.watchSubscribe = opts.watchSubscribe ?? ((root, callback, options2) => watcher.subscribe(root, callback, options2));
-    this.reexec = opts.reexec ?? (typeof process.execve === "function" ? (request) => process.execve(request.executable, request.argv, request.env) : void 0);
+    this.reexec = opts.reexec ?? (process.platform !== "win32" && typeof process.execve === "function" ? (request) => process.execve(request.executable, request.argv, request.env) : void 0);
     if (opts.stateDir && resolve5(opts.stateDir) !== opts.launchTarget.stateDir) {
       throw new Error("dev supervisor state directory does not match its owned project");
     }
@@ -25352,7 +25482,7 @@ var Supervisor = class {
       updateVersion: opts.updateVersion,
       dev: opts.dev,
       status: () => {
-        if (this.browserRestart || this.restartRunning) return { state: "restarting" };
+        if (this.handoffDraining || this.browserRestart || this.restartRunning) return { state: "restarting" };
         const failed = this.child === null && this.boot === null;
         const artifactDigest = this.activeChildEnvironment.FRIZZ_STABLE_ARTIFACT;
         return failed ? { state: "failed", message: "Frizz application server is not ready", ...artifactDigest ? { artifactDigest } : {} } : { state: "ready", ...artifactDigest ? { artifactDigest } : {} };
@@ -25505,7 +25635,7 @@ var Supervisor = class {
   }
   async updateFromBrowser() {
     if (!this.updateRestart) return { state: "failed", message: "Update & Restart is unavailable in this launcher mode" };
-    this.emitActivity("updating", "preparing the new build \u2014 the running one is untouched until it is ready");
+    this.emitActivity("updating", "preparing the update \u2014 the running Frizz is untouched until it is ready");
     const candidate = await this.updateRestart();
     if (candidate.state !== "ready") {
       this.emitActivity("failed", candidate.message ?? "the update could not be prepared");
@@ -25527,6 +25657,8 @@ var Supervisor = class {
     } catch (error) {
       const message = `durable supervisor handoff failed: ${error instanceof Error ? error.message : error}`;
       return this.failDurableUpdate(message, handoffPreparationStarted);
+    } finally {
+      this.handoffDraining = false;
     }
   }
   /**
@@ -25566,6 +25698,7 @@ var Supervisor = class {
     if (!ready) throw new Error("the recovered control plane did not become ready");
   }
   async prepareDurableReexec() {
+    this.handoffDraining = true;
     this.closed = true;
     this.clearCrashStability();
     if (this.debounce) clearTimeout(this.debounce);
@@ -25598,7 +25731,13 @@ var Supervisor = class {
           // The supervisor may itself run under `node --input-type`, `--test`, an inspector, etc. Those
           // parent-only flags are invalid or dangerous for a file-backed control-plane child.
           execArgv: [],
-          stdio: ["inherit", "inherit", "inherit", "ipc"]
+          stdio: ["inherit", "inherit", "inherit", "ipc"],
+          // A registry update leaves this supervisor with no console on Windows (its successor starts
+          // detached). A console program forked from a console-less parent gets a new, VISIBLE console
+          // window, and closing that window would stop the board. `windowsHide` keeps the window from
+          // appearing (measured 2026-09-07: hwnd 0 for the child and its children). No effect elsewhere.
+          // `fork` passes it to `spawn` at runtime; `ForkOptions` in @types/node 24 does not declare it.
+          ...{ windowsHide: true }
         });
       } catch (error) {
         const message = `child spawn failed: ${error instanceof Error ? error.message : error}; watching for a corrective edit`;
@@ -25774,6 +25913,21 @@ var Supervisor = class {
     this.errorLine("[frizz] dev launcher re-exec returned unexpectedly; restart Frizz once");
     this.resolveStopRequested();
   }
+  /**
+   * Drain the control-plane child: ASK first, signal only a child that did not answer.
+   *
+   * The ask is `child.disconnect()` — closing the IPC channel — because dev-child already treats a
+   * lost supervisor as an order to shut down (`process.once("disconnect")`), so it needs no second
+   * protocol and it works on every platform. The ask used to be `kill("SIGTERM")`, which on POSIX
+   * runs the same shutdown handler but on Windows is a TerminateProcess: Node maps EVERY signal it
+   * can send to a hard kill there, so the child's `server.close()`, its shutdown fence and its
+   * delegate release never ran, and every Restart and every update on Windows cut open RPCs and
+   * socket writes mid-flight (audit 2026-09-11, finding 3). Only a child that has not exited within
+   * CHILD_STOP_TIMEOUT_MS is signalled — SIGTERM then, CHILD_KILL_GRACE_MS later, SIGKILL on POSIX,
+   * where a wedged event loop ignores the first; a single kill() on win32, where the first is final.
+   * A child with no channel to ask over (already gone, or never had one) gets the signal at once,
+   * which is exactly what it got before.
+   */
   async stopChild() {
     this.clearCrashStability();
     const child = this.child;
@@ -25781,19 +25935,38 @@ var Supervisor = class {
     this.stopping = child;
     await new Promise((resolveStop) => {
       let done = false;
+      const timers = [];
       const finish = () => {
         if (done) return;
         done = true;
-        clearTimeout(force);
+        for (const timer of timers) clearTimeout(timer);
         resolveStop();
       };
+      const later = (callback, delayMs) => {
+        const timer = setTimeout(callback, delayMs);
+        timer.unref();
+        timers.push(timer);
+      };
+      const who = `dev child ${child.pid ?? "?"}`;
+      const signal = (name, why) => {
+        this.errorLine(`[frizz] ${who} ${why}; ${name === "SIGTERM" ? "sending SIGTERM to" : "killing"} the control plane only`);
+        if (!child.kill(name)) finish();
+      };
+      const escalate = (why) => {
+        if (process.platform === "win32") {
+          signal(void 0, why);
+          return;
+        }
+        signal("SIGTERM", why);
+        later(() => signal("SIGKILL", `ignored SIGTERM for ${CHILD_KILL_GRACE_MS}ms`), CHILD_KILL_GRACE_MS);
+      };
       child.once("exit", finish);
-      const force = setTimeout(() => {
-        this.errorLine(`[frizz] dev child ${child.pid ?? "?"} did not close in ${CHILD_STOP_TIMEOUT_MS}ms; killing control plane only`);
-        child.kill("SIGKILL");
-      }, CHILD_STOP_TIMEOUT_MS);
-      force.unref();
-      if (!child.kill("SIGTERM")) finish();
+      if (!child.connected) {
+        escalate("has no IPC channel to ask over");
+        return;
+      }
+      later(() => escalate(`did not close in ${CHILD_STOP_TIMEOUT_MS}ms`), CHILD_STOP_TIMEOUT_MS);
+      child.disconnect();
     });
     if (this.child === child) this.child = null;
     if (this.childPort !== void 0) this.childPort = void 0;
@@ -25839,11 +26012,32 @@ async function startDevSupervisor(opts) {
 }
 
 // src/production-update.ts
+init_src();
 import { execFile as execFile4, spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync7 } from "node:fs";
-import { isAbsolute as isAbsolute5 } from "node:path";
+import { dirname as dirname12, isAbsolute as isAbsolute5, join as join14 } from "node:path";
+import { setTimeout as delay3 } from "node:timers/promises";
 var PRODUCTION_REEXEC_FLAG = "--_frizz-production-reexec";
+function canReexecInPlace(platform = process.platform, execve = process.execve) {
+  return platform !== "win32" && typeof execve === "function";
+}
 var PRODUCTION_PRINT_LAUNCHER_FLAG = "--_frizz-print-launcher";
+function resolveNpmInvocation(env = process.env, execPath = process.execPath, exists = existsSync7, platform = process.platform) {
+  const nodeDir = dirname12(execPath);
+  const candidates = [
+    // pnpm, yarn and bun set `npm_execpath` too, to their own entry file. Their directories hold no
+    // `npm-cli.js`, so the existence check below skips them.
+    env.npm_execpath ? join14(dirname12(env.npm_execpath), "npm-cli.js") : void 0,
+    join14(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
+    join14(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+  ].filter((candidate) => candidate !== void 0);
+  const script = candidates.find((candidate) => exists(candidate));
+  if (script) return { command: execPath, prefixArgs: [script] };
+  if (platform === "win32") {
+    throw new Error(`npm-cli.js not found beside ${execPath} (searched: ${candidates.join(", ")})`);
+  }
+  return { command: "npm", prefixArgs: [] };
+}
 function compareReleaseVersions(a, b) {
   const parse2 = (value) => {
     const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value);
@@ -25860,7 +26054,23 @@ function compareReleaseVersions(a, b) {
   if (left.prerelease === right.prerelease) return 0;
   if (!left.prerelease) return 1;
   if (!right.prerelease) return -1;
-  return left.prerelease < right.prerelease ? -1 : 1;
+  return comparePrerelease(left.prerelease, right.prerelease);
+}
+function comparePrerelease(a, b) {
+  const left = a.split(".");
+  const right = b.split(".");
+  for (let index = 0; index < Math.min(left.length, right.length); index++) {
+    const l = left[index];
+    const r = right[index];
+    if (l === r) continue;
+    const lNumeric = /^\d+$/u.test(l);
+    const rNumeric = /^\d+$/u.test(r);
+    if (lNumeric && rNumeric) return Number(l) < Number(r) ? -1 : 1;
+    if (lNumeric !== rNumeric) return lNumeric ? -1 : 1;
+    return l < r ? -1 : 1;
+  }
+  if (left.length === right.length) return 0;
+  return left.length < right.length ? -1 : 1;
 }
 async function planRegistryUpdate(packageName, currentVersion, adapter) {
   const latestVersion = (await adapter.latestVersion(packageName)).trim();
@@ -25873,6 +26083,20 @@ async function planRegistryUpdate(packageName, currentVersion, adapter) {
 function successorArgs(port) {
   return [PRODUCTION_REEXEC_FLAG, "--port", String(port)];
 }
+function reexecArgv(rawArgs2) {
+  const kept = [];
+  for (let index = 0; index < rawArgs2.length; index++) {
+    const arg = rawArgs2[index];
+    if (arg === PRODUCTION_REEXEC_FLAG) continue;
+    if (arg === "--port" || arg === "--sign-out") {
+      kept.push(arg);
+      if (index + 1 < rawArgs2.length) kept.push(rawArgs2[++index]);
+      continue;
+    }
+    if (arg.startsWith("-")) kept.push(arg);
+  }
+  return kept;
+}
 async function resolveRegistrySuccessor(plan, request, adapter) {
   const result = await adapter.npmExec({
     packageSpec: plan.packageSpec,
@@ -25913,52 +26137,168 @@ function handoffToRegistrySuccessor(successor, request, adapter) {
   });
   child.once("error", () => {
   });
+  if (child.pid === void 0) throw new Error(`could not start Frizz ${successor.plan.latestVersion} from ${successor.entry}`);
   child.unref();
-}
-var npmRegistryReleaseAdapter = {
-  latestVersion(packageName) {
-    return new Promise((resolveVersion, reject) => {
-      execFile4("npm", ["view", `${packageName}@latest`, "version", "--json"], { encoding: "utf8" }, (error, stdout) => {
-        if (error) return reject(new Error(`could not check npm for ${packageName}: ${error.message}`));
+  return child;
+}
+var SUCCESSOR_READY_TIMEOUT_MS = 6e4;
+async function awaitRegistrySuccessor(child, expected2, watch) {
+  const deadlineMs = watch.deadlineMs ?? SUCCESSOR_READY_TIMEOUT_MS;
+  const intervalMs = watch.intervalMs ?? 250;
+  const now = watch.now ?? Date.now;
+  const sleep = watch.sleep ?? ((ms) => delay3(ms));
+  const where = expected2.logFile ? `; its log is ${expected2.logFile}` : "";
+  let exited = child.exitCode !== null || child.signalCode !== null ? describeExit(child.exitCode, child.signalCode) : void 0;
+  const onExit = (code, signal) => {
+    exited = describeExit(code, signal);
+  };
+  child.once("exit", onExit);
+  try {
+    const started = now();
+    for (; ; ) {
+      if (exited) throw new Error(`Frizz ${expected2.version} exited (${exited}) before it answered on port ${expected2.port}${where}`);
+      const status = await watch.status();
+      if (status?.version === expected2.version) return;
+      if (now() - started >= deadlineMs) {
         try {
-          const parsed = JSON.parse(stdout);
-          resolveVersion(typeof parsed === "string" ? parsed : String(parsed));
+          child.kill();
         } catch {
-          resolveVersion(stdout.trim().replaceAll('"', ""));
         }
-      });
+        throw new Error(
+          `Frizz ${expected2.version} did not answer on port ${expected2.port} within ${Math.round(deadlineMs / 1e3)}s${where}`
+        );
+      }
+      await sleep(intervalMs);
+    }
+  } finally {
+    child.off("exit", onExit);
+  }
+}
+function describeExit(code, signal) {
+  return signal ? `signal ${signal}` : `exit ${code ?? "unknown"}`;
+}
+function launcherControlHeaders(port) {
+  return { origin: `http://127.0.0.1:${port}`, "cache-control": "no-store" };
+}
+async function readLauncherStatus(port, fetcher = fetch) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1e3);
+  timeout.unref?.();
+  try {
+    const response = await fetcher(`http://127.0.0.1:${port}${FRIZZ_ROUTE_PREFIX}/control/status`, {
+      signal: controller.signal,
+      headers: launcherControlHeaders(port)
     });
-  },
-  npmExec({ packageSpec, bin, args: args2, cwd, env }) {
-    return new Promise((settle) => {
-      const child = spawn3("npm", ["exec", "--yes", `--package=${packageSpec}`, "--", bin, ...args2], {
-        cwd,
-        env,
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      let stdout = "";
-      let stderr = "";
-      child.stdout.setEncoding("utf8").on("data", (chunk) => {
-        stdout += chunk;
-      });
-      child.stderr.setEncoding("utf8").on("data", (chunk) => {
-        stderr += chunk;
+    if (!response.ok) return void 0;
+    const body = await response.json();
+    return {
+      ...typeof body.version === "string" ? { version: body.version } : {},
+      ...typeof body.state === "string" ? { state: body.state } : {}
+    };
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function isGlobalInstall(bundleDir, env = process.env) {
+  if (env.npm_execpath) return false;
+  const segments = bundleDir.split(/[\\/]/u);
+  return segments.includes("node_modules") && !segments.includes("_npx");
+}
+var GLOBAL_INSTALL_ENV = "FRIZZ_REGISTRY_GLOBAL_INSTALL";
+function keepUpdateHint(packageName, version) {
+  return `this session only \u2014 run npm i -g ${packageName}@${version} to keep it`;
+}
+var NPM_VIEW_TIMEOUT_MS = 3e4;
+var NPM_EXEC_TIMEOUT_MS = 10 * 6e4;
+var NPM_KILL_SIGNAL = "SIGTERM";
+function formatTimeout(ms) {
+  return ms >= 6e4 ? `${Math.ceil(ms / 6e4)}m` : `${Math.ceil(ms / 1e3)}s`;
+}
+function createNpmRegistryReleaseAdapter(options2 = {}) {
+  const viewTimeoutMs = options2.viewTimeoutMs ?? NPM_VIEW_TIMEOUT_MS;
+  const execTimeoutMs = options2.execTimeoutMs ?? NPM_EXEC_TIMEOUT_MS;
+  const npmInvocation = options2.npm ?? (() => resolveNpmInvocation());
+  return {
+    latestVersion(packageName) {
+      return new Promise((resolveVersion, reject) => {
+        let npm;
+        try {
+          npm = npmInvocation();
+        } catch (error) {
+          return reject(error);
+        }
+        execFile4(
+          npm.command,
+          [...npm.prefixArgs, "view", `${packageName}@latest`, "version", "--json"],
+          { encoding: "utf8", windowsHide: true, timeout: viewTimeoutMs, killSignal: NPM_KILL_SIGNAL },
+          (error, stdout) => {
+            if (error) {
+              const why = error.killed && error.signal === NPM_KILL_SIGNAL ? `npm view did not answer within ${formatTimeout(viewTimeoutMs)}` : error.message;
+              return reject(new Error(`could not check npm for ${packageName}: ${why}`));
+            }
+            try {
+              const parsed = JSON.parse(stdout);
+              resolveVersion(typeof parsed === "string" ? parsed : String(parsed));
+            } catch {
+              resolveVersion(stdout.trim().replaceAll('"', ""));
+            }
+          }
+        );
       });
-      child.once("error", (error) => settle({ code: null, signal: null, stdout, stderr: `${stderr}
+    },
+    npmExec({ packageSpec, bin, args: args2, cwd, env }) {
+      return new Promise((settle) => {
+        let npm;
+        try {
+          npm = npmInvocation();
+        } catch (error) {
+          return settle({ code: null, signal: null, stdout: "", stderr: error instanceof Error ? error.message : String(error) });
+        }
+        const started = Date.now();
+        const child = spawn3(npm.command, [...npm.prefixArgs, "exec", "--yes", `--package=${packageSpec}`, "--", bin, ...args2], {
+          cwd,
+          env,
+          stdio: ["ignore", "pipe", "pipe"],
+          windowsHide: true,
+          timeout: execTimeoutMs,
+          killSignal: NPM_KILL_SIGNAL
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.setEncoding("utf8").on("data", (chunk) => {
+          stdout += chunk;
+        });
+        child.stderr.setEncoding("utf8").on("data", (chunk) => {
+          stderr += chunk;
+        });
+        child.once("error", (error) => settle({ code: null, signal: null, stdout, stderr: `${stderr}
 ${error.message}` }));
-      child.once("close", (code, signal) => settle({ code, signal, stdout, stderr }));
-    });
-  },
-  spawnDetached({ entry, args: args2, cwd, env }) {
-    return spawn3(process.execPath, [entry, ...args2], { cwd, env, detached: true, stdio: "ignore" });
-  }
-};
+        child.once("close", (code, signal) => {
+          const timedOut = signal === NPM_KILL_SIGNAL && Date.now() - started >= execTimeoutMs;
+          settle({
+            code,
+            signal,
+            stdout,
+            stderr: timedOut ? `${stderr}
+npm exec ${packageSpec} did not finish within ${formatTimeout(execTimeoutMs)} and was stopped` : stderr
+          });
+        });
+      });
+    },
+    spawnDetached({ entry, args: args2, cwd, env }) {
+      return spawn3(process.execPath, [entry, ...args2], { cwd, env, detached: true, stdio: "ignore", windowsHide: true });
+    }
+  };
+}
+var npmRegistryReleaseAdapter = createNpmRegistryReleaseAdapter();
 
 // src/preflight.ts
 import { spawnSync } from "node:child_process";
 import { chmodSync as chmodSync2, statSync as statSync5 } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname as dirname12, join as join14 } from "node:path";
+import { dirname as dirname13, join as join15 } from "node:path";
 var SUPPORTED_NODE_LINES = [
   { major: 22, minor: 13 },
   { major: 23, minor: 4 }
@@ -26009,8 +26349,8 @@ function ensureNativeHelperPermissions(options2 = {}) {
   const chmod = options2.chmod ?? ((path, mode) => chmodSync2(path, mode));
   const resolvePty = options2.resolvePty ?? (() => createRequire(import.meta.url).resolve("node-pty/package.json"));
   try {
-    const helper = join14(
-      dirname12(resolvePty()),
+    const helper = join15(
+      dirname13(resolvePty()),
       "prebuilds",
       `${platform}-${options2.arch ?? process.arch}`,
       "spawn-helper"
@@ -26029,7 +26369,7 @@ init_project_identity();
 var PACKAGE_NAME = process.env.FRIZZ_REGISTRY_PACKAGE ?? "frizz";
 function resolvePackageVersion() {
   try {
-    const manifest = JSON.parse(readFileSync13(join15(import.meta.dirname, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync13(join16(import.meta.dirname, "..", "package.json"), "utf8"));
     if (typeof manifest.version === "string" && manifest.version.trim()) return manifest.version.trim();
   } catch {
   }
@@ -26042,7 +26382,7 @@ if (rawArgs.includes(PRODUCTION_PRINT_LAUNCHER_FLAG)) {
   console.log(fileURLToPath2(import.meta.url));
   process.exit(0);
 }
-var args = rawArgs.filter((arg) => arg !== PRODUCTION_REEXEC_FLAG);
+var args = reexec ? reexecArgv(rawArgs) : rawArgs;
 var fail = (error) => {
   console.error(`frizz: ${error instanceof Error ? error.message : error}`);
   process.exit(1);
@@ -26074,6 +26414,8 @@ Options:
   --link                 print a fresh single-use access link for the running board
   --sessions             list the devices signed in to the running board
   --sign-out <id|all>    sign one device out, or every one of them
+  --status               report the board running for this project: address, pid, version
+  --stop                 stop the board running for this project (running agents keep going)
   --debug                stream the full event feed to the terminal instead of the compact readout
   -h, --help             show this help
 
@@ -26091,6 +26433,8 @@ var sandbox = options.sandbox ? prepareSandbox() : null;
 if (sandbox) process.on("exit", () => cleanupSandbox(sandbox.home));
 var remote = null;
 var paneHost = null;
+var rearmPaneHost = null;
+var globalInstall = process.env[GLOBAL_INSTALL_ENV] === "1" || isGlobalInstall(import.meta.dirname);
 var accessPane = null;
 var activeAccessLink = null;
 var launchIntent;
@@ -26117,6 +26461,34 @@ var workspace = (() => {
   }
 })();
 process.chdir(workspace.root);
+if (options.stop) {
+  try {
+    const control = await resolveLaunchControlTarget({ stateDir: workspace.stateDir, target: workspaceLaunchTarget(workspace) });
+    const where = control.host ? workspace.root : `${workspace.root} (the board was launched from ${control.target.projectDir})`;
+    const result = await stopProjectLaunch({ stateDir: control.stateDir, target: control.target });
+    console.log(
+      result.kind !== "stopped" ? `Frizz is not running for ${where}` : result.stale ? `Frizz was not running for ${where}; cleared the record a dead board left behind` : `stopped Frizz for ${where}; running agents keep going \u2014 they are detached daemons`
+    );
+    process.exit(0);
+  } catch (error) {
+    fail(error);
+  }
+}
+if (options.status) {
+  const control = await resolveLaunchControlTarget({ stateDir: workspace.stateDir, target: workspaceLaunchTarget(workspace) });
+  const running = await runningFrizzStatus({ stateDir: control.stateDir, target: control.target });
+  if (!running) {
+    console.log(`Frizz is not running for ${workspace.root}`);
+    process.exit(1);
+  }
+  console.log(`running: http://127.0.0.1:${running.port}`);
+  console.log(`workspace: ${workspace.root}`);
+  if (!control.host) console.log(`launched from: ${control.target.projectDir} (one server serves every project)`);
+  console.log(`supervisor pid: ${running.pid}`);
+  console.log(`version: ${running.version ?? "unknown"}`);
+  if (running.state && running.state !== "ready") console.log(`state: ${running.state}${running.message ? ` \u2014 ${running.message}` : ""}`);
+  process.exit(0);
+}
 if (options.sessions || options.signOut !== void 0) {
   const running = liveWorkspaceOwner(workspace.stateDir, workspaceLaunchTarget(workspace));
   if (!running?.port) {
@@ -26207,7 +26579,7 @@ async function openOrPrint(port, reused, path = "") {
     readout?.begin("browser", options.appMode ? "requesting app window" : "requesting default browser");
     try {
       if (options.appMode) {
-        await launchApp(url, { dataPath: join15(workspace.stateDir, "browser-profile") });
+        await launchApp(url, { dataPath: join16(workspace.stateDir, "browser-profile") });
         browser = reused ? "focused the Frizz app window" : "opened the Frizz app window";
       } else {
         await launchBrowserTab(url);
@@ -26265,13 +26637,13 @@ async function runSupervisor(port, token) {
     target,
     owner.token
   );
-  const webDist = join15(import.meta.dirname, "..", "web-dist");
-  const runtimeDir = join15(import.meta.dirname, "..", "runtime");
-  const scriptsDir = join15(runtimeDir, "board");
-  const workerPluginDir = join15(runtimeDir, "cc-worker");
+  const webDist = join16(import.meta.dirname, "..", "web-dist");
+  const runtimeDir = join16(import.meta.dirname, "..", "runtime");
+  const scriptsDir = join16(runtimeDir, "board");
+  const workerPluginDir = join16(runtimeDir, "cc-worker");
   const childEntry = fileURLToPath2(new URL("./dev-child.js", import.meta.url));
   let plannedSuccessor;
-  let updateAvailable = true;
+  let updateAvailable = false;
   let updateVersion;
   const refreshUpdateAvailable = async () => {
     try {
@@ -26325,22 +26697,56 @@ async function runSupervisor(port, token) {
         return { state: "failed", message: error instanceof Error ? error.message : String(error) };
       }
     },
+    // The registry launcher promotes no pointer — the release sits in npm's own execution cache and
+    // the running package is never touched — so there is nothing to roll back. Present and empty
+    // rather than absent: the supervisor appends "rollback callback is unavailable" to every failed
+    // handoff it cannot roll back, which for this launcher was noise on a message that already said
+    // what went wrong (audit 2026-09-11, finding 4).
+    rollbackUpdate: () => {
+    },
     durableReexec: async () => {
       const successor = plannedSuccessor;
       if (!successor) throw new Error("no update was prepared");
       const { plan } = successor;
-      const successorEnv = { ...env, FRIZZ_REGISTRY_PACKAGE: plan.packageName, FRIZZ_REGISTRY_VERSION: plan.latestVersion };
-      if (typeof process.execve === "function") {
+      const successorEnv = {
+        ...env,
+        FRIZZ_REGISTRY_PACKAGE: plan.packageName,
+        FRIZZ_REGISTRY_VERSION: plan.latestVersion,
+        ...globalInstall ? { [GLOBAL_INSTALL_ENV]: "1" } : {}
+      };
+      if (canReexecInPlace()) {
         activityReadout?.notice("progress", "Updating", `reloading this launcher in place on Frizz ${plan.latestVersion}`);
         paneHost?.dispose();
         remote?.stop();
-        reexecIntoRegistrySuccessor(successor, { port, env: successorEnv });
+        try {
+          reexecIntoRegistrySuccessor(successor, { port, env: successorEnv });
+        } catch (error) {
+          rearmPaneHost?.();
+          try {
+            await remote?.serveSaved();
+          } catch (remoteError) {
+            const message = remoteError instanceof Error ? remoteError.message : String(remoteError);
+            logger.error("remote", `could not re-arm the saved remote setup after a failed update: ${message}`);
+          }
+          throw error;
+        }
       }
-      handoffToRegistrySuccessor(successor, { port, cwd: workspace.root, env: successorEnv }, npmRegistryReleaseAdapter);
-      readout?.notice("done", "Updated", `Frizz ${plan.latestVersion} is taking over on port ${port}`);
-      readout?.note(`
-  Frizz ${plan.latestVersion} now runs in the background \u2014 ctrl-c here no longer reaches it. Stop it with ${PACKAGE_NAME} --stop.
-`);
+      const child = handoffToRegistrySuccessor(successor, { port, cwd: workspace.root, env: successorEnv }, npmRegistryReleaseAdapter);
+      activityReadout?.notice("progress", "Updating", `starting Frizz ${plan.latestVersion} in the background and waiting for it to answer on port ${port}`);
+      await awaitRegistrySuccessor(
+        child,
+        { version: plan.latestVersion, port, logFile: successorEnv.FRIZZ_LOG_FILE },
+        { status: () => readLauncherStatus(port) }
+      );
+      paneHost?.dispose();
+      remote?.stop();
+      activityReadout?.notice("done", "Updated", `Frizz ${plan.latestVersion} is serving on port ${port}`);
+      activityReadout?.note(
+        `
+  Frizz ${plan.latestVersion} now runs in the background \u2014 ctrl-c here no longer reaches it. Stop it with ${PACKAGE_NAME} --stop.${globalInstall ? `
+  Update: ${keepUpdateHint(PACKAGE_NAME, plan.latestVersion)}.` : ""}
+`
+      );
       process.exit(0);
     }
   });
@@ -26364,7 +26770,12 @@ async function runSupervisor(port, token) {
     onChanged: (config) => logger.info("remote", config ? `reached at https://${config.hostname}` : "loopback only"),
     sandbox: sandbox !== null
   });
-  paneHost = installPaneHost({ bindings: { l: accessPane, L: accessPane, r: remotePane, R: remotePane } });
+  const bindings = { l: accessPane, L: accessPane, r: remotePane, R: remotePane };
+  const armPaneHost = () => {
+    paneHost = installPaneHost({ bindings });
+  };
+  armPaneHost();
+  rearmPaneHost = armPaneHost;
   const stop = createSupervisorShutdownHandler({
     close: () => supervisor.close(),
     force: () => supervisor.forceStop(),
@@ -26398,7 +26809,13 @@ async function runSupervisor(port, token) {
   process.on("SIGHUP", stop);
   void supervisor.stopRequested.then(stop);
   await supervisor.firstBoot;
-  if (reexec) activityReadout?.notice("done", "Updated", `Frizz ${PACKAGE_VERSION} is serving on port ${port} \xB7 ctrl-c to stop`);
+  if (reexec) {
+    activityReadout?.notice(
+      "done",
+      "Updated",
+      `Frizz ${PACKAGE_VERSION} is serving on port ${port} \xB7 ctrl-c to stop${globalInstall ? ` \xB7 ${keepUpdateHint(PACKAGE_NAME, PACKAGE_VERSION)}` : ""}`
+    );
+  }
   return await new Promise(() => {
   });
 }