local-operator-ui 0.29.0 → 0.29.2

package/out/main/index.js

@@ -2360,6 +2360,9 @@ const WATCHDOG_TIMEOUT_SECONDS = 600;
 const WATCHDOG_HARD_TIMEOUT_SECONDS = 1800;
 const PENDING_INSTALL_RECENCY_MARGIN_SECONDS = 300;
 const PENDING_INSTALL_RECENCY_SECONDS = WATCHDOG_HARD_TIMEOUT_SECONDS + PENDING_INSTALL_RECENCY_MARGIN_SECONDS;
+const LAUNCH_HOLD_END_MARGIN_SECONDS = 60;
+const PENDING_INSTALL_LAUNCH_HOLD_SECONDS = WATCHDOG_HARD_TIMEOUT_SECONDS - LAUNCH_HOLD_END_MARGIN_SECONDS;
+const PENDING_INSTALL_HANDOFF_SECONDS = 30;
 const PLIST_READ_TIMEOUT_SECONDS = 5;
 const WATCHDOG_TOKEN = "local-operator-update-watchdog";
 const BAD_BUNDLE_MARKERS = [
@@ -2851,14 +2854,53 @@ function pendingInstallAgeSeconds(marker, now = Date.now()) {
   return (now - started) / 1e3;
 }
 function isInstallInFlight(input) {
-  if (!input.marker || !input.jobLoaded) return false;
+  if (!input.marker) return false;
   const age = pendingInstallAgeSeconds(input.marker, input.now);
   if (age === null) return false;
-  return age >= 0 && age <= PENDING_INSTALL_RECENCY_SECONDS;
+  if (age < 0 || age > PENDING_INSTALL_RECENCY_SECONDS) return false;
+  if (input.jobState === "running") return true;
+  return input.jobState === "registered" && age <= PENDING_INSTALL_HANDOFF_SECONDS;
 }
-function launchdJobLoaded(jobLabel, probe) {
-  if (!jobLabel) return false;
-  return probe(jobLabel) === 0;
+function evaluateLaunchDuringInstall(input) {
+  const { marker } = input;
+  if (!marker) return { kind: "open" };
+  const outcome = evaluatePendingInstall({
+    marker,
+    runningVersion: input.runningVersion,
+    installInFlight: isInstallInFlight({
+      marker,
+      jobState: input.jobState,
+      now: input.now
+    })
+  });
+  if (outcome.kind !== "in-flight") return { kind: "open" };
+  const age = pendingInstallAgeSeconds(marker, input.now);
+  if (age === null || age > PENDING_INSTALL_LAUNCH_HOLD_SECONDS) {
+    return { kind: "open" };
+  }
+  return { kind: "hold", marker };
+}
+function launchdJobPid(output) {
+  const dictionary = /"PID"\s*=\s*(\d+)\s*;/.exec(output);
+  if (dictionary) {
+    const pid = Number.parseInt(dictionary[1], 10);
+    return pid > 0 ? pid : null;
+  }
+  for (const line of output.split("\n")) {
+    const columns = line.trim().split(/\s+/);
+    if (columns.length < 3) continue;
+    if (!/^\d+$/.test(columns[0]) || !/^\d+$/.test(columns[1])) continue;
+    const pid = Number.parseInt(columns[0], 10);
+    return pid > 0 ? pid : null;
+  }
+  return null;
+}
+function installJobState(jobLabel, probe) {
+  if (!jobLabel) return "unread";
+  const reading = probe(jobLabel);
+  if (reading == null || reading.status == null) return "unread";
+  if (reading.status !== 0) return "absent";
+  return launchdJobPid(reading.output) == null ? "registered" : "running";
 }
 function installStartedText(marker) {
   const started = marker.startedAt ? new Date(marker.startedAt) : null;
@@ -2898,6 +2940,13 @@ function installInFlightPayload(marker, runningVersion) {
     detail: `Install started ${installStartedText(marker)} from ${marker.artifactPath || "an unknown artifact"}, while version ${runningVersion} was running.`
   };
 }
+function installLaunchHoldNotice(marker, options = {}) {
+  const relaunch = options.relaunchEnsured === false ? "No relaunch could be arranged for this install, so start Local Operator by hand when it finishes." : "Local Operator will open by itself when the install finishes.";
+  return {
+    title: "Local Operator is still updating",
+    body: `The update to version ${marker.targetVersion} is still installing — this can take a few minutes, and opening the app now would cancel it. ${relaunch} Clicking this notice will not open it any sooner.`
+  };
+}
 function shipItJobLabel(bundleId) {
   return `${bundleId}.ShipIt`;
 }
@@ -4426,6 +4475,19 @@ function transportFailureDetail(error) {
 const SILENCE_TIMEOUT_MS = 45e3;
 const WATCHDOG_TICK_MS = 1e3;
 const MAX_FRAME_BYTES$1 = 8 * 1024 * 1024;
+const LINE_ENDING = /\r\n|\n|\r/;
+const BLANK_LINE = /(?:\r\n|\n|\r)(?:\r\n|\n|\r)/;
+function nextRecord(buffer) {
+  const blank = BLANK_LINE.exec(buffer);
+  if (blank === null) return null;
+  const data = [];
+  for (const line of buffer.slice(0, blank.index).split(LINE_ENDING)) {
+    if (!line.startsWith("data:")) continue;
+    const value = line.slice(5);
+    data.push(value.startsWith(" ") ? value.slice(1) : value);
+  }
+  return { data, rest: buffer.slice(blank.index + blank[0].length) };
+}
 class DesktopStreamRelay {
   constructor(backendUrl, token, timings = {}) {
     this.backendUrl = backendUrl;
@@ -4534,8 +4596,8 @@ class DesktopStreamRelay {
           lastActivity = Date.now();
           buffer += decoder.decode(value, { stream: true });
           for (; ; ) {
-            const boundary = buffer.indexOf("\n\n");
-            if (boundary < 0) {
+            const record = nextRecord(buffer);
+            if (record === null) {
               if (buffer.length > MAX_FRAME_BYTES$1) {
                 emit({
                   streamId,
@@ -4547,15 +4609,11 @@ class DesktopStreamRelay {
               }
               break;
             }
-            const record = buffer.slice(0, boundary);
-            buffer = buffer.slice(boundary + 2);
-            for (const line of record.split("\n")) {
-              if (line.startsWith("data:")) {
-                const data = line.slice(5).replace(/^ /, "");
-                this.observer?.(sessionId2, data);
-                emit({ streamId, kind: "data", data });
-              }
-            }
+            buffer = record.rest;
+            if (record.data.length === 0) continue;
+            const data = record.data.join("\n");
+            this.observer?.(sessionId2, data);
+            emit({ streamId, kind: "data", data });
           }
         }
       } finally {
@@ -4701,6 +4759,14 @@ function deadlineExceeded(error) {
   const name = error?.name;
   return name === "TimeoutError" || name === "AbortError";
 }
+const ADMITTED_PATH_PREFIX = "/v1/desktop/";
+function desktopAnswerProvesPairing(input, response) {
+  const parsed = desktopRequestSchema.safeParse(input);
+  if (!parsed.success) return false;
+  if (!desktopEndpoint(parsed.data).path.startsWith(ADMITTED_PATH_PREFIX))
+    return false;
+  return response.status >= 200 && response.status < 300;
+}
 function trustedDesktopFrame(actual, expected) {
   try {
     const current = new URL(actual);
@@ -5141,6 +5207,15 @@ class DaemonStateMachine {
         }
         this.detail = observation.detail;
         break;
+      case "contradicted":
+        this.failures += 1;
+        if (this.failures >= DEGRADED_AFTER_FAILURES) {
+          this.enterDetached(observation.detail, true);
+        } else {
+          this.state = "degraded";
+          this.detail = `${observation.detail} (probe ${this.failures} of ${DEGRADED_AFTER_FAILURES}).`;
+        }
+        break;
       case "failed":
         this.failures += 1;
         if (this.failures >= DEGRADED_AFTER_FAILURES) {
@@ -5201,7 +5276,42 @@ class DaemonStateMachine {
     this.detail = `${detail} (no answer to probe ${this.unanswered} of ${UNANSWERED_BEFORE_DETACHED})`;
   }
   /**
-   * Record that a real request against the attached daemon was answered.
+   * Record that a request of this app's was ANSWERED by the attached daemon.
+   *
+   * Liveness evidence and NOTHING ELSE. An answer says a process read the request
+   * and wrote a status line - which is exactly what a probe that ran out of its
+   * 2 s budget failed to establish - and a refusal is an answer. What a refusal
+   * does not say is that this app is still PAIRED with the process that
+   * answered: a `401`, a `403` and a shut plane's `503` are what an app holding
+   * the wrong credential collects from a daemon that was replaced underneath it,
+   * and one of them arrives every few seconds on a machine whose renderer is
+   * re-asking capabilities and whose presence heartbeat is running. Counting
+   * those as a successful attachment cleared the identity-failure count on every
+   * pass, held the state at `attached` for a pid that was gone, and left the app
+   * unable to reach the re-discovery that would have re-paired it (2026-09-18;
+   * see the module docstring).
+   *
+   * So this stamps the two facts a refusal DOES establish - the transport is
+   * alive, and no probe budget is outstanding - and leaves the state alone. A
+   * caller holding proof that the plane admitted the request calls
+   * {@link recordTransportSuccess} instead.
+   */
+  recordTransportAnswer() {
+    this.lastTransportAt = this.now();
+    this.unanswered = 0;
+    this.updatedAt = this.now();
+  }
+  /**
+   * Record that a real request against the attached daemon was ADMITTED.
+   *
+   * "Admitted" is the caller's judgement and the distinction this method exists
+   * for: the daemon let the request through to a route that depends on this
+   * app's desktop credential, so the pairing is proven to still hold. Every
+   * answer below that bar - a refused socket, a `401`/`403`, a shut plane's
+   * `503`, and the capability op the plane deliberately serves WITHOUT admitting
+   * anyone - is {@link recordTransportAnswer} instead, liveness only, because
+   * treating one of them as an admission is how a replaced daemon's refusals
+   * kept an unpaired app looking attached.
    *
    * WHY this is the state machine's business and not a caller's: the probe and
    * the transport disagree regularly on a box running long turns - the probe
@@ -6586,7 +6696,8 @@ class BackendServiceManager {
       this.backendUrl,
       this.desktopToken
     ).then(({ response, answered }) => {
-      if (answered) this.noteTransportAnswer();
+      if (answered)
+        this.noteTransportAnswer(desktopAnswerProvesPairing(input, response));
       return response;
     });
   }
@@ -6597,7 +6708,7 @@ class BackendServiceManager {
       this.backendUrl,
       this.desktopToken
     ).then(({ response, answered }) => {
-      if (answered) this.noteTransportAnswer();
+      if (answered) this.daemonState.recordTransportAnswer();
       return response;
     });
   }
@@ -6612,19 +6723,29 @@ class BackendServiceManager {
    * `degraded` - which is not a state `checkBackendHealth` recovers from, so a
    * genuinely gone daemon could never be reported as gone.
    *
-   * WHY this still counts EVERY answer, including a gated route's `401`/`403`:
-   * the capability rules elsewhere in this file say a refusal is not a LIVENESS
-   * signal, and that is about not calling it "connected". Turned around, a
-   * refusal is the strongest liveness evidence this app has - a process read the
-   * request and wrote a status line - which is exactly what a probe that ran out
-   * of its 2 s budget failed to establish. Without this, one long agent turn was
-   * enough to detach the connection and disable every read the daemon was still
-   * answering.
+   * `admitted` is the second, narrower question and the two are deliberately
+   * separate calls rather than one boolean: an answer of ANY status is liveness
+   * evidence (a `401`, a `403` or a `503` is a process that read the request and
+   * wrote a status line, which is exactly what a probe that ran out of its 2 s
+   * budget failed to establish - without that, one long agent turn was enough to
+   * detach the connection and disable every read the daemon was still answering),
+   * while only an answer the plane ADMITTED proves the pairing still holds.
+   * Collapsing the two is the defect this split fixes, measured 2026-09-18: a
+   * replaced daemon's refusals - plus the capability poll the renderer runs every
+   * 15 s while the plane is shut, which the plane serves without admitting
+   * anyone - each cleared the identity-failure count, so the app never detached,
+   * never re-discovered and never re-claimed, and reported "not paired with the
+   * running Local Operator server" until it was restarted (see
+   * `daemon-status.ts`'s `recordTransportAnswer`/`recordTransportSuccess`).
    *
    * Only a state that actually moves pushes a snapshot: this runs on every
    * desktop call, and one IPC wake-up per request would be worse than the bug.
    */
-  noteTransportAnswer() {
+  noteTransportAnswer(admitted) {
+    if (!admitted) {
+      this.daemonState.recordTransportAnswer();
+      return;
+    }
     if (this.daemonState.recordTransportSuccess()) this.notifyStatus();
   }
   isAppClosing = false;
@@ -8107,17 +8228,17 @@ class BackendServiceManager {
     switch (probe.outcome) {
       case "identified":
         return probe.identity.pid === this.daemonState.snapshot().pid ? { kind: "identified" } : {
-          kind: "failed",
+          kind: "contradicted",
           detail: "The answering daemon's PID no longer matches the attachment."
         };
       case "identity-mismatch":
         return {
-          kind: "failed",
+          kind: "contradicted",
           detail: `Another process is answering at ${this.backendUrl} (${probe.detail})`
         };
       case "not-a-daemon":
         return {
-          kind: "failed",
+          kind: "contradicted",
           detail: `${this.backendUrl} answered but is not a Local Operator daemon (${probe.detail})`
         };
       case "unreachable":
@@ -8254,7 +8375,7 @@ class BackendServiceManager {
         if (after.state !== before.state || after.detail !== before.detail) {
           this.notifyStatus();
         }
-        if (!processGone) return;
+        if (!processGone && observation.kind !== "contradicted") return;
       }
       if (this.process && this.process.exitCode === null && this.process.signalCode == null)
         return;
@@ -17030,6 +17151,216 @@ function isWithinAnyRoot(roots, candidate) {
     return !relative.startsWith("..") && !path__namespace.isAbsolute(relative);
   });
 }
+const LAUNCH_HOLD_NOTICE_DEADLINE_MS = 2e3;
+const LAUNCH_HOLD_FORCE_QUIT_DEADLINE_MS = 1e4;
+function runningBundleIdentifier() {
+  const bundlePath = appBundleFromExecutable(process.execPath);
+  if (!bundlePath) return null;
+  const value = readCommandOutput("/usr/bin/defaults", [
+    "read",
+    path$1.join(bundlePath, "Contents", "Info.plist"),
+    "CFBundleIdentifier"
+  ]);
+  return value && BUNDLE_ID_REGEX.test(value) ? value : null;
+}
+function shipItJobForRunningBundle() {
+  const bundleId = runningBundleIdentifier();
+  return bundleId ? shipItJobLabel(bundleId) : null;
+}
+function probeShipItInstallJobState() {
+  const jobProbe = watchdogSignals(process.platform).jobProbe;
+  if (!jobProbe) return "unread";
+  return installJobState(shipItJobForRunningBundle(), (label) => {
+    const result = node_child_process.spawnSync(jobProbe, ["list", label], {
+      encoding: "utf8",
+      timeout: 5e3
+    });
+    return result.error || result.status == null ? null : { status: result.status, output: result.stdout ?? "" };
+  });
+}
+function startRelaunchWatchdog(input) {
+  if (process.platform !== "darwin" || !electron.app.isPackaged) return null;
+  const bundlePath = appBundleFromExecutable(process.execPath);
+  if (!bundlePath) return null;
+  const plan = buildWatchdogPlan({
+    appBundlePath: bundlePath,
+    executableName: path$1.basename(process.execPath),
+    // The app's own pid, captured here - before the quit - because the
+    // watchdog cannot ask a name about its own ancestor (review R1).
+    appPid: process.pid,
+    shipItJob: shipItJobForRunningBundle(),
+    // What "the install is over" is measured against on disk (review R11):
+    // the updater's advertised version, and nothing that is already in place
+    // (review R15).
+    targetVersion: watchdogSwapTarget({
+      target: input.targetVersion,
+      running: input.runningVersion
+    }),
+    // Stated rather than read off `process.platform` at the plan: this
+    // watchdog exists for Squirrel.Mac's ShipIt, the guard above already
+    // refuses it anywhere else, and the script's two probes (launchd's job
+    // lookup, `plutil`) are generated for the platform the script runs on
+    // rather than for whichever host planned it (see `watchdogSignals`).
+    platform: "darwin"
+  });
+  try {
+    const child = node_child_process.spawn("sh", ["-c", plan.script], {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env, ...plan.env }
+    });
+    child.unref();
+    input.log(
+      `Started the update relaunch watchdog (pid ${child.pid ?? "unknown"}): it starts the app again as soon as the install's job goes or version ${plan.env.LO_UPDATE_WATCHDOG_TARGET_VERSION || "unknown"} is in place, and at the ${plan.timeoutSeconds}s bound if neither happens - or at the ${plan.hardTimeoutSeconds}s hard bound when the install's job is still loaded at the first, which is the case where starting the app would cancel the install.`
+    );
+    return child.pid ?? null;
+  } catch (error) {
+    input.log(`Could not start the update relaunch watchdog: ${String(error)}`);
+    return null;
+  }
+}
+function ensureRelaunchWatchdog(input) {
+  const pid = input.marker.watchdogPid;
+  const commandLine = pid == null ? null : readCommandOutput("/bin/ps", ["-o", "command=", "-p", String(pid)]);
+  if (watchdogIsOurs({
+    alive: commandLine != null,
+    commandLine,
+    installSucceeded: true
+  })) {
+    input.log(
+      `Relaunch watchdog ${pid} is still running; it will start the app when the install settles.`
+    );
+    return true;
+  }
+  const launched = input.startWatchdog(input.marker.targetVersion);
+  input.log(
+    launched != null ? `Started relaunch watchdog ${launched} for the install already in flight; it will start the app when the install's job goes.` : "No relaunch watchdog is running for the install in flight and none could be started; the app will need starting by hand after it quits."
+  );
+  return launched != null;
+}
+const LAUNCH_HOLD_SCRIPT_DEADLINE_MS = 2e3;
+const LAUNCH_HOLD_LOG_FLUSH_MS = 300;
+const LAUNCH_HOLD_NOTICE_BUDGET_MS = LAUNCH_HOLD_NOTICE_DEADLINE_MS + LAUNCH_HOLD_SCRIPT_DEADLINE_MS + LAUNCH_HOLD_LOG_FLUSH_MS + /*
+* Headroom, so the quit and the flush it exists to allow cannot land in the same
+* millisecond (review R10): without it this budget IS its own worst case exactly,
+* and a host where `osascript` burns its whole deadline would make the record's
+* landing a coin flip rather than a guarantee.
+*/
+250;
+function notificationsSilenced() {
+  const value = launchEnv[NOTIFICATIONS_ENV];
+  return typeof value === "string" && value.length > 0;
+}
+function bannerReportedShown(notice, deadlineMs) {
+  if (!electron.Notification.isSupported()) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const deadline2 = setTimeout(() => resolve(false), deadlineMs);
+    deadline2.unref();
+    try {
+      const notification = new electron.Notification({
+        title: notice.title,
+        body: notice.body,
+        silent: false
+      });
+      notification.on("show", () => {
+        clearTimeout(deadline2);
+        resolve(true);
+      });
+      notification.show();
+    } catch {
+      clearTimeout(deadline2);
+      resolve(false);
+    }
+  });
+}
+function raiseThroughOsascript(notice) {
+  if (process.platform !== "darwin") return null;
+  const result = node_child_process.spawnSync(
+    "/usr/bin/osascript",
+    [
+      "-e",
+      "on run argv",
+      "-e",
+      "display notification (item 1 of argv) with title (item 2 of argv)",
+      "-e",
+      "end run",
+      notice.body,
+      notice.title
+    ],
+    { stdio: "ignore", timeout: LAUNCH_HOLD_SCRIPT_DEADLINE_MS }
+  );
+  return result.error || result.status == null ? null : result.status;
+}
+async function showInstallHoldNotice(notice, bannerDeadlineMs = LAUNCH_HOLD_NOTICE_DEADLINE_MS) {
+  if (notificationsSilenced()) {
+    return "suppressed: this launch switched notifications off, so no banner was raised";
+  }
+  const status2 = raiseThroughOsascript(notice);
+  if (status2 === 0) {
+    return "handed to the install's own notification channel (osascript, exit 0); nothing here observes whether the system displayed it";
+  }
+  if (await bannerReportedShown(notice, bannerDeadlineMs)) {
+    return "shown by the app's own banner, which is the one leg that reports delivery (the install's channel being unavailable)";
+  }
+  if (status2 == null) {
+    return "not raised: the install's channel is not available on this host, and the app's banner did not report itself shown";
+  }
+  return `not raised: the install's channel exited ${status2}, and the app's banner did not report itself shown`;
+}
+function holdLaunchForLiveInstall(options) {
+  if (!electron.app.isPackaged) return false;
+  const marker = readPendingInstallMarker(electron.app.getPath("userData"));
+  const jobState = (options.jobState ?? probeShipItInstallJobState)();
+  const reading = evaluateLaunchDuringInstall({
+    marker,
+    jobState,
+    runningVersion: options.runningVersion ?? electron.app.getVersion(),
+    now: options.now
+  });
+  if (reading.kind === "open") return false;
+  options.log(
+    `Holding this launch for the install of version ${reading.marker.targetVersion} that is still running (install job ${jobState}): a window here would make this process the running instance Squirrel's final check aborts the install on, so the app tells the user and quits.`
+  );
+  const relaunchEnsured = ensureRelaunchWatchdog({
+    marker: reading.marker,
+    startWatchdog: options.startWatchdog ?? defaultStartRelaunchWatchdog,
+    log: options.log
+  });
+  const quit = options.quit ?? (() => electron.app.quit());
+  const forceQuit = options.forceQuit ?? (() => electron.app.exit(0));
+  const forceDeadline = setTimeout(
+    forceQuit,
+    LAUNCH_HOLD_FORCE_QUIT_DEADLINE_MS
+  );
+  forceDeadline.unref();
+  const noticeDeadline = setTimeout(quit, LAUNCH_HOLD_NOTICE_BUDGET_MS);
+  noticeDeadline.unref();
+  const notice = installLaunchHoldNotice(reading.marker, { relaunchEnsured });
+  const showNotice = options.showNotice ?? showInstallHoldNotice;
+  options.log(
+    `Telling the user the install of version ${reading.marker.targetVersion} is still running, and closing this launch so the install's final check finds no running instance of the app.`
+  );
+  void showNotice(notice).then((record) => {
+    options.log(
+      `The notice for the install of version ${reading.marker.targetVersion}: ${record}.`
+    );
+  }).catch(() => {
+  }).finally(() => {
+    const flush = setTimeout(() => {
+      clearTimeout(noticeDeadline);
+      quit();
+    }, LAUNCH_HOLD_LOG_FLUSH_MS);
+    flush.unref();
+  });
+  return true;
+}
+function defaultStartRelaunchWatchdog(targetVersion) {
+  return startRelaunchWatchdog({
+    targetVersion,
+    runningVersion: electron.app.getVersion(),
+    log: (message) => logger.info(message, LogFileType.UPDATE_SERVICE)
+  });
+}
 class UpdateService {
   mainWindow = null;
   isDevMode;
@@ -17368,15 +17699,28 @@ class UpdateService {
       return;
     }
     const marker = readPendingInstallMarker(this.markerDir());
+    const jobState = this.shipItInstallJobState();
+    if (marker) {
+      logger.info(
+        `Pending install marker for version ${marker.targetVersion} on disk; its install job is ${jobState}.`,
+        LogFileType.UPDATE_SERVICE
+      );
+    }
     const outcome = evaluatePendingInstall({
       marker,
       runningVersion: electron.app.getVersion(),
-      // Probed once per evaluation, and only on macOS: a loaded job plus a
+      // Probed once per evaluation, and only on macOS: a RUNNING job plus a
       // current marker is what makes "still on the old version" an install in
-      // progress rather than an install that failed.
+      // progress rather than an install that failed. A job that is registered
+      // but not running is the state a finished install leaves behind, and
+      // reading it as live is what held a launch - and so swallowed this very
+      // report - for ~29 minutes after every successful update (review U1, U2);
+      // the one exception is the hand-off, the window in which launchd has the
+      // job but ShipIt has no pid yet, which `PENDING_INSTALL_HANDOFF_SECONDS`
+      // bounds (review R6, R11).
       installInFlight: isInstallInFlight({
         marker,
-        jobLoaded: this.shipItInstallJobLoaded()
+        jobState
       })
     });
     switch (outcome.kind) {
@@ -17401,7 +17745,7 @@ class UpdateService {
       case "in-flight": {
         this.installWasInFlight = true;
         logger.info(
-          `Update marker: the install of version ${outcome.marker.targetVersion} is still running (its install job is loaded). Leaving the marker, the install job and the relaunch watchdog in place.`,
+          `Update marker: the install of version ${outcome.marker.targetVersion} is still running (install job ${jobState}). Leaving the marker, the install job and the relaunch watchdog in place.`,
           LogFileType.UPDATE_SERVICE
         );
         this.pendingInstallInFlight = installInFlightPayload(
@@ -17453,25 +17797,11 @@ class UpdateService {
   /**
    * This app's bundle identifier, as macOS records it.
    *
-   * Read from the running bundle rather than from `package.json`: the running
-   * app is the only thing whose ShipIt job and cache directory this process may
-   * touch, and a build whose `appId` drifted would otherwise have us cleaning up
-   * some other app's leftovers.
+   * The service's name for `runningBundleIdentifier`, which the launch hold needs
+   * before a service exists; the rule itself lives there.
    */
   bundleIdentifier() {
-    const bundlePath = appBundleFromExecutable(process.execPath);
-    if (!bundlePath) return null;
-    const value = readCommandOutput("/usr/bin/defaults", [
-      "read",
-      path$1.join(bundlePath, "Contents", "Info.plist"),
-      "CFBundleIdentifier"
-    ]);
-    return value && BUNDLE_ID_REGEX.test(value) ? value : null;
-  }
-  /** The launchd job Squirrel's install runs under, by label. */
-  shipItJob() {
-    const bundleId = this.bundleIdentifier();
-    return bundleId ? shipItJobLabel(bundleId) : null;
+    return runningBundleIdentifier();
   }
   /**
    * Squirrel's own stderr log for this app, when it exists.
@@ -17617,9 +17947,9 @@ class UpdateService {
     );
   }
   /**
-   * A substituted answer to "is this app's install job loaded", or null.
+   * A substituted answer to "what is this app's install job doing", or null.
    *
-   * The production answer is the launchd probe in `shipItInstallJobLoaded`, and
+   * The production answer is the launchd probe in `shipItInstallJobState`, and
    * it asks about a label read from the RUNNING BUNDLE (`shipItJob`). A test or a
    * harness process that is not that bundle has no label to ask about, so the
    * whole in-flight path - recovery's reading, the re-check, and the quit below -
@@ -17629,28 +17959,21 @@ class UpdateService {
    * rule production uses rather than a second copy of it. Production never sets
    * it.
    */
-  installJobLoadedProbe = null;
+  installJobStateProbe = null;
   /**
-   * Whether this app's ShipIt install job is loaded, right now.
+   * What this app's ShipIt install job is doing, right now.
    *
    * This is the machine's own answer to "is an install in flight", and the only
-   * answer that can tell a live install apart from the job a failed one left
-   * behind. It is asked of launchd by label rather than inferred from a process
-   * name, so nothing else on the machine can be mistaken for it. Off macOS there
-   * is no launchd to ask, so the answer is a plain no and recovery stays
+   * answer that can tell a live install from the job a finished one left behind -
+   * which is why it reports `running` separately from `registered` rather than a
+   * boolean (review U1). It is asked of launchd by label rather than inferred from
+   * a process name, so nothing else on the machine can be mistaken for it. Off
+   * macOS there is no launchd to ask, so the answer is `unread` and recovery stays
    * version-only there, exactly as it is today.
    */
-  shipItInstallJobLoaded() {
-    if (this.installJobLoadedProbe) return this.installJobLoadedProbe();
-    const jobProbe = watchdogSignals(process.platform).jobProbe;
-    if (!jobProbe) return false;
-    return launchdJobLoaded(this.shipItJob(), (label) => {
-      const result = node_child_process.spawnSync(jobProbe, ["list", label], {
-        encoding: "utf8",
-        timeout: 5e3
-      });
-      return result.error || result.status == null ? null : result.status;
-    });
+  shipItInstallJobState() {
+    if (this.installJobStateProbe) return this.installJobStateProbe();
+    return probeShipItInstallJobState();
   }
   /**
    * Deliver the still-installing notice once the renderer can hear it.
@@ -17712,34 +18035,18 @@ class UpdateService {
    * Make sure something will start the app again after a quit that is only
    * getting out of an install's way.
    *
-   * The watchdog from the original install is usually still there - it holds
-   * while the job is loaded now, rather than starting the app into the swap -
-   * but it may have run out its own bounds, and the user may be quitting hours
-   * later. Quitting without one would leave them with no app at all, which is
-   * the outcome this whole change exists to remove. Nothing is started when ours
-   * is alive, because two watchdogs relaunching at the same moment is a race
-   * with nothing to gain. The marker is left exactly as it is: its start time is
-   * what tells recovery this is still the same install.
+   * The rule is `ensureRelaunchWatchdog`'s, shared with the launch hold; what is
+   * the service's own here is the starter, which a harness substitutes.
    */
   ensureWatchdogAfterInFlightQuit(marker) {
-    const pid = marker.watchdogPid;
-    const commandLine = pid == null ? null : readCommandOutput("/bin/ps", ["-o", "command=", "-p", String(pid)]);
-    if (watchdogIsOurs({
-      alive: commandLine != null,
-      commandLine,
-      installSucceeded: true
-    })) {
-      logger.info(
-        `Relaunch watchdog ${pid} is still running; it will start the app when the install settles.`,
-        LogFileType.UPDATE_SERVICE
-      );
-      return;
-    }
-    const launched = this.launchWatchdog(marker.targetVersion);
-    logger.info(
-      launched ? `Started relaunch watchdog ${launched} for the install already in flight; it will start the app when the install's job goes.` : "No relaunch watchdog is running for the install in flight and none could be started; the app will need starting by hand after it quits.",
-      LogFileType.UPDATE_SERVICE
-    );
+    ensureRelaunchWatchdog({
+      marker,
+      // The service's own method, not the module function, because a harness
+      // substitutes this one: substituting the seam is how a test counts the
+      // watchdogs a quit leaves running without spawning any.
+      startWatchdog: (targetVersion) => this.launchWatchdog(targetVersion),
+      log: (message) => logger.info(message, LogFileType.UPDATE_SERVICE)
+    });
   }
   /**
    * The pending-install marker, if the machine says an install is live now.
@@ -17754,7 +18061,7 @@ class UpdateService {
     if (!marker) return null;
     return isInstallInFlight({
       marker,
-      jobLoaded: this.shipItInstallJobLoaded()
+      jobState: this.shipItInstallJobState()
     }) ? marker : null;
   }
   /**
@@ -18229,53 +18536,16 @@ ${heal.removed.join("\n")}`,
   /**
    * Start the detached relaunch watchdog.
    *
-   * Spawned detached so it survives this process exiting, with stdio ignored so
-   * it holds no pipe open and cannot keep the app alive.
+   * The service's name for `startRelaunchWatchdog`, which the launch hold also
+   * uses; the plan, the bounds and the log line live there. Kept as a method
+   * because a harness substitutes it to count watchdogs without spawning one.
    */
   launchWatchdog(targetVersion) {
-    if (process.platform !== "darwin" || !electron.app.isPackaged) return null;
-    const bundlePath = appBundleFromExecutable(process.execPath);
-    if (!bundlePath) return null;
-    const plan = buildWatchdogPlan({
-      appBundlePath: bundlePath,
-      executableName: path$1.basename(process.execPath),
-      // The app's own pid, captured here - before the quit - because the
-      // watchdog cannot ask a name about its own ancestor (review R1).
-      appPid: process.pid,
-      shipItJob: this.shipItJob(),
-      // What "the install is over" is measured against on disk (review R11):
-      // the updater's advertised version, and nothing that is already in place
-      // (review R15).
-      targetVersion: watchdogSwapTarget({
-        target: targetVersion,
-        running: electron.app.getVersion()
-      }),
-      // Stated rather than read off `process.platform` at the plan: this
-      // watchdog exists for Squirrel.Mac's ShipIt, the guard above already
-      // refuses it anywhere else, and the script's two probes (launchd's job
-      // lookup, `plutil`) are generated for the platform the script runs on
-      // rather than for whichever host planned it (see `watchdogSignals`).
-      platform: "darwin"
+    return startRelaunchWatchdog({
+      targetVersion,
+      runningVersion: electron.app.getVersion(),
+      log: (message) => logger.info(message, LogFileType.UPDATE_SERVICE)
     });
-    try {
-      const child = node_child_process.spawn("sh", ["-c", plan.script], {
-        detached: true,
-        stdio: "ignore",
-        env: { ...process.env, ...plan.env }
-      });
-      child.unref();
-      logger.info(
-        `Started the update relaunch watchdog (pid ${child.pid ?? "unknown"}): it starts the app again as soon as the install's job goes or version ${plan.env.LO_UPDATE_WATCHDOG_TARGET_VERSION || "unknown"} is in place, and at the ${plan.timeoutSeconds}s bound if neither happens - or at the ${plan.hardTimeoutSeconds}s hard bound when the install's job is still loaded at the first, which is the case where starting the app would cancel the install.`,
-        LogFileType.UPDATE_SERVICE
-      );
-      return child.pid ?? null;
-    } catch (error) {
-      logger.error(
-        `Could not start the update relaunch watchdog: ${String(error)}`,
-        LogFileType.UPDATE_SERVICE
-      );
-      return null;
-    }
   }
   /**
    * Clean up resources when the service is no longer needed
@@ -22097,6 +22367,11 @@ electron.app.whenReady().then(async () => {
     electron.app.exit(0);
     return;
   }
+  if (holdLaunchForLiveInstall({
+    log: (message) => logger.info(message, LogFileType.UPDATE_SERVICE)
+  })) {
+    return;
+  }
   configureAboutPanel();
   createApplicationMenu();
   const launcher = resolveLauncherWatchPlan({