oh-my-codex 0.20.3 → 0.21.0

package/dist/cli/update.js

@@ -5,15 +5,19 @@
  * The explicit `omx update` command uses the same executor but bypasses the
  * launch-time cadence so a user request always checks npm immediately.
  */
-import { readFile, writeFile, mkdir } from 'fs/promises';
-import { appendFileSync, existsSync, mkdirSync, mkdtempSync, rmSync } from 'fs';
-import { dirname, join } from 'path';
+import { readFile, writeFile, mkdir, realpath } from 'fs/promises';
+import { appendFileSync, chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'fs';
+import { dirname, join, relative, isAbsolute } from 'path';
 import { tmpdir } from 'os';
+import { createHash } from 'node:crypto';
 import { spawn, spawnSync } from 'child_process';
+import { fileURLToPath } from 'url';
 import { createInterface } from 'readline/promises';
 import { getPackageRoot } from '../utils/package.js';
-import { omxUserInstallStampPath } from '../utils/paths.js';
 import { readPersistedSetupPreferencesSync, resolvePersistedSetupMergeAgents, } from './setup-preferences.js';
+import { isCompletePackageManagerOwnership, isWorkingTreeInstall, packageManagerOwnershipError, resolvePackageManagerOwnership, runNpmCommand, validatePackageManagerOwnership, } from './package-manager-ownership.js';
+import { readUserInstallStamp, writeUserInstallStamp, } from '../scripts/postinstall-advisory.js';
+export { isInstallVersionBump, readUserInstallStamp, writeUserInstallStamp, } from '../scripts/postinstall-advisory.js';
 const PACKAGE_NAME = 'oh-my-codex';
 const CHECK_INTERVAL_MS = 12 * 60 * 60 * 1000; // 12h
 const STABLE_INSTALL_SOURCE = `${PACKAGE_NAME}@latest`;
@@ -112,34 +116,13 @@ async function getCurrentVersion() {
         return null;
     }
 }
-function isSpawnErrorCode(error, codes) {
-    return Boolean(error &&
-        typeof error === 'object' &&
-        'code' in error &&
-        codes.includes(String(error.code)));
+function stableInstallArgs(ownership, installSource) {
+    return ownership.manager === 'bun'
+        ? ['add', '--global', '--ignore-scripts', installSource]
+        : ['install', '--global', '--ignore-scripts', '--no-audit', '--no-progress', '--prefix', ownership.npmPrefix, installSource];
 }
-function spawnNpmSync(args, options, spawnProcess = spawnSync, platform = process.platform) {
-    const result = spawnProcess('npm', args, options);
-    if (platform === 'win32' && isSpawnErrorCode(result.error, ['ENOENT'])) {
-        return spawnProcess('npm.cmd', args, options);
-    }
-    return result;
-}
-function spawnGlobalNpmInstallSync(installSource, options, spawnProcess = spawnSync, platform = process.platform) {
-    const args = ['install', '-g', installSource];
-    const result = spawnProcess('npm', args, options);
-    if (platform !== 'win32' || !isSpawnErrorCode(result.error, ['ENOENT', 'EINVAL'])) {
-        return result;
-    }
-    if (isSpawnErrorCode(result.error, ['ENOENT'])) {
-        const cmdShimResult = spawnProcess('npm.cmd', args, options);
-        if (!isSpawnErrorCode(cmdShimResult.error, ['ENOENT', 'EINVAL'])) {
-            return cmdShimResult;
-        }
-    }
-    // Some Windows/npm shim layouts reject direct npm/npm.cmd spawn with EINVAL;
-    // cmd.exe can still resolve and run npm from the user's configured PATH.
-    return spawnProcess('cmd.exe', ['/d', '/s', '/c', 'npm', ...args], options);
+function runFrozenNpmInstall(ownership, installSource, options, spawnProcess) {
+    return runNpmCommand(ownership.npmCommand, stableInstallArgs(ownership, installSource), options, spawnProcess);
 }
 function commandFailure(stderr, status, label) {
     const details = String(stderr || '').trim();
@@ -148,7 +131,7 @@ function commandFailure(stderr, status, label) {
         stderr: details || `${label} exited ${typeof status === 'number' ? status : 'without a status'}`,
     };
 }
-function runDevGlobalUpdate(spawnProcess = spawnSync, platform = process.platform) {
+function runDevGlobalUpdate(ownership, spawnProcess = spawnSync) {
     const tempRoot = mkdtempSync(join(tmpdir(), 'omx-dev-update-'));
     const checkoutDir = join(tempRoot, 'checkout');
     try {
@@ -176,7 +159,7 @@ function runDevGlobalUpdate(spawnProcess = spawnSync, platform = process.platfor
         const installRevision = /^[0-9a-f]{7,40}$/i.test(clonedRevision ?? '')
             ? String(clonedRevision).slice(0, 12)
             : null;
-        const installResult = spawnNpmSync([
+        const installResult = runNpmCommand(ownership.npmCommand, [
             'install',
             '--global=false',
             '--location=project',
@@ -190,32 +173,34 @@ function runDevGlobalUpdate(spawnProcess = spawnSync, platform = process.platfor
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: DEV_UPDATE_TIMEOUT_MS,
             windowsHide: true,
-            env: { ...process.env, npm_config_global: 'false', npm_config_location: 'project' },
-        }, spawnProcess, platform);
+            env: { ...ownership.environment, npm_config_global: 'false', npm_config_location: 'project' },
+        }, spawnProcess);
         if (installResult.error)
             return { ok: false, stderr: installResult.error.message };
         if (installResult.status !== 0) {
             return commandFailure(installResult.stderr, installResult.status, 'npm install --include=dev');
         }
-        const prepackResult = spawnNpmSync(['run', 'prepack'], {
+        const prepackResult = runNpmCommand(ownership.npmCommand, ['run', 'prepack'], {
             cwd: checkoutDir,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: DEV_UPDATE_TIMEOUT_MS,
             windowsHide: true,
-        }, spawnProcess, platform);
+            env: ownership.environment,
+        }, spawnProcess);
         if (prepackResult.error)
             return { ok: false, stderr: prepackResult.error.message };
         if (prepackResult.status !== 0) {
             return commandFailure(prepackResult.stderr, prepackResult.status, 'npm run prepack');
         }
-        const packResult = spawnNpmSync(['pack', '--ignore-scripts', '--json'], {
+        const packResult = runNpmCommand(ownership.npmCommand, ['pack', '--ignore-scripts', '--json'], {
             cwd: checkoutDir,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: DEV_UPDATE_TIMEOUT_MS,
             windowsHide: true,
-        }, spawnProcess, platform);
+            env: ownership.environment,
+        }, spawnProcess);
         if (packResult.error)
             return { ok: false, stderr: packResult.error.message };
         if (packResult.status !== 0) {
@@ -235,12 +220,13 @@ function runDevGlobalUpdate(spawnProcess = spawnSync, platform = process.platfor
         if (!tarballPath || !existsSync(tarballPath)) {
             return { ok: false, stderr: 'npm pack did not produce an installable tarball.' };
         }
-        const globalInstallResult = spawnNpmSync(['install', '-g', tarballPath], {
+        const globalInstallResult = runNpmCommand(ownership.npmCommand, ['install', '--global', '--ignore-scripts', '--no-audit', '--no-progress', '--prefix', ownership.npmPrefix, tarballPath], {
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: DEV_UPDATE_TIMEOUT_MS,
             windowsHide: true,
-        }, spawnProcess, platform);
+            env: ownership.environment,
+        }, spawnProcess);
         if (globalInstallResult.error) {
             return { ok: false, stderr: globalInstallResult.error.message };
         }
@@ -259,35 +245,31 @@ function runDevGlobalUpdate(spawnProcess = spawnSync, platform = process.platfor
         }
     }
 }
-export function runGlobalUpdate(installSourceOrSpawnProcess = STABLE_INSTALL_SOURCE, spawnProcessOrPlatform = spawnSync, platform = process.platform) {
-    const legacySpawnFirst = typeof installSourceOrSpawnProcess === 'function';
-    const installSource = legacySpawnFirst ? STABLE_INSTALL_SOURCE : installSourceOrSpawnProcess;
-    const spawnProcess = legacySpawnFirst
-        ? installSourceOrSpawnProcess
-        : typeof spawnProcessOrPlatform === 'function'
-            ? spawnProcessOrPlatform
-            : spawnSync;
-    const resolvedPlatform = legacySpawnFirst
-        ? typeof spawnProcessOrPlatform === 'string'
-            ? spawnProcessOrPlatform
-            : platform
-        : typeof spawnProcessOrPlatform === 'string'
-            ? spawnProcessOrPlatform
-            : platform;
-    if (installSource === DEV_INSTALL_SOURCE) {
-        return runDevGlobalUpdate(spawnProcess, resolvedPlatform);
+export function runGlobalUpdate(installSourceOrSpawnProcess = STABLE_INSTALL_SOURCE, spawnProcessOrPlatform = spawnSync, _platform = process.platform, ownership) {
+    if (typeof installSourceOrSpawnProcess === 'function') {
+        return { ok: false, stderr: 'A validated package-manager ownership transaction is required before installing.' };
     }
-    const result = spawnGlobalNpmInstallSync(installSource, {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 120000,
-        windowsHide: true,
-    }, spawnProcess, resolvedPlatform);
-    if (result.error) {
-        return { ok: false, stderr: result.error.message };
+    const installSource = installSourceOrSpawnProcess;
+    const spawnProcess = typeof spawnProcessOrPlatform === 'function' ? spawnProcessOrPlatform : spawnSync;
+    if (!ownership || !isCompletePackageManagerOwnership(ownership)) {
+        return { ok: false, stderr: ownership ? 'The package-manager ownership transaction is incomplete.' : 'A validated package-manager ownership transaction is required before installing.' };
     }
+    if (installSource === DEV_INSTALL_SOURCE) {
+        return ownership.manager === 'bun'
+            ? { ok: false, stderr: 'Bun dev updates are not yet supported' }
+            : runDevGlobalUpdate(ownership, spawnProcess);
+    }
+    const result = ownership.manager === 'bun'
+        ? spawnProcess(ownership.bunCommand, stableInstallArgs(ownership, installSource), {
+            encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 120000, windowsHide: true, env: ownership.environment,
+        })
+        : runFrozenNpmInstall(ownership, installSource, {
+            encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 120000, windowsHide: true, env: ownership.environment,
+        }, spawnProcess);
+    if (result.error)
+        return { ok: false, stderr: result.error.message };
     if (result.status !== 0) {
-        return { ok: false, stderr: String(result.stderr || '').trim() || `npm exited ${result.status}` };
+        return { ok: false, stderr: String(result.stderr || '').trim() || `${ownership.manager} exited ${result.status}` };
     }
     return { ok: true, stderr: '' };
 }
@@ -322,97 +304,98 @@ export function resolveSetupRefreshArgs(cwd) {
     return args;
 }
 function quotePosixShellArg(value) {
-    if (value === '')
-        return "''";
-    return `'${value.replace(/'/g, "'\\''")}'`;
+    return value === '' ? "''" : `'${value.replace(/'/g, "'\\''")}'`;
 }
 function quotePowerShellArg(value) {
-    return `'${value.replace(/'/g, `''`)}'`;
+    return `'${value.replace(/'/g, "''")}'`;
 }
+/** Compatibility formatter retained for existing callers; deferred updates use update-worker instead. */
 export function formatDeferredSetupCommand(platform, command, args) {
     const argv = [command, ...args];
-    if (platform === 'win32') {
-        return `& ${argv.map(quotePowerShellArg).join(' ')}`;
-    }
-    return argv.map(quotePosixShellArg).join(' ');
+    return platform === 'win32'
+        ? `& ${argv.map(quotePowerShellArg).join(' ')}`
+        : argv.map(quotePosixShellArg).join(' ');
 }
 function formatUpdateLogPath(date = new Date()) {
     return `update-${date.toISOString().replace(/[:.]/g, '-')}.log`;
 }
-export function runDeferredGlobalUpdate(cwd, spawnProcess = spawn, platform = process.platform, parentPid = process.pid) {
+export function runDeferredGlobalUpdate(cwd, spawnProcess = spawn, platform = process.platform, parentPid = process.pid, ownership) {
     const logPath = join(cwd, '.omx', 'logs', formatUpdateLogPath());
-    // Snapshot the current setup delivery mode when the update is scheduled.
-    // The detached process runs after this CLI exits, so the refresh should replay
-    // the setup mode that was active when the user accepted/scheduled the update.
-    const setupArgs = resolveSetupRefreshArgs(cwd);
-    const setupCommand = formatDeferredSetupCommand(platform, 'omx', setupArgs);
+    if (!isCompletePackageManagerOwnership(ownership)) {
+        return { ok: false, stderr: 'The package-manager ownership transaction is incomplete.', logPath };
+    }
+    let stage;
     try {
         mkdirSync(dirname(logPath), { recursive: true });
-        const env = {
-            ...process.env,
-            OMX_DEFERRED_UPDATE_LOG: logPath,
-            OMX_DEFERRED_UPDATE_PARENT_PID: String(parentPid),
-            [SKIP_NATIVE_AGENT_REFRESH_ENV]: '1',
-        };
-        const command = platform === 'win32' ? 'powershell.exe' : 'sh';
-        const args = platform === 'win32'
-            ? [
-                '-NoProfile',
-                '-ExecutionPolicy',
-                'Bypass',
-                '-Command',
-                [
-                    '$ErrorActionPreference = "Continue"',
-                    '$log = $env:OMX_DEFERRED_UPDATE_LOG',
-                    '$parentPid = [int]$env:OMX_DEFERRED_UPDATE_PARENT_PID',
-                    'while (Get-Process -Id $parentPid -ErrorAction SilentlyContinue) { Start-Sleep -Seconds 1 }',
-                    'npm install -g oh-my-codex@latest *>> $log',
-                    `if ($LASTEXITCODE -eq 0) { ${setupCommand} *>> $log }`,
-                ].join('; '),
-            ]
-            : [
-                '-c',
-                [
-                    'while kill -0 "$OMX_DEFERRED_UPDATE_PARENT_PID" 2>/dev/null; do sleep 1; done',
-                    'npm install -g oh-my-codex@latest >> "$OMX_DEFERRED_UPDATE_LOG" 2>&1',
-                    `if [ "$?" -eq 0 ]; then ${setupCommand} >> "$OMX_DEFERRED_UPDATE_LOG" 2>&1; fi`,
-                ].join('; '),
-            ];
-        const child = spawnProcess(command, args, {
-            cwd,
-            detached: true,
-            env,
-            stdio: 'ignore',
-            windowsHide: true,
+        stage = mkdtempSync(join(tmpdir(), 'omx-update-'));
+        if (platform !== 'win32')
+            chmodSync(stage, 0o700);
+        const payloadPath = join(stage, 'transaction.json');
+        const payload = { cwd, logPath, parentPid, ownership, setupArgs: resolveSetupRefreshArgs(cwd) };
+        const serialized = JSON.stringify(payload);
+        writeFileSync(payloadPath, serialized, { encoding: 'utf-8', mode: 0o600, flag: 'wx' });
+        const canonicalStage = realpathSync(stage);
+        const canonicalPayload = realpathSync(payloadPath);
+        const stageStat = lstatSync(stage);
+        const payloadStat = lstatSync(payloadPath);
+        if (!stageStat.isDirectory()
+            || stageStat.isSymbolicLink()
+            || (platform !== 'win32' && ((stageStat.mode & 0o077) !== 0 || (typeof process.getuid === 'function' && stageStat.uid !== process.getuid())))
+            || canonicalPayload !== join(canonicalStage, 'transaction.json')
+            || payloadStat.isSymbolicLink()
+            || !payloadStat.isFile()
+            || (platform !== 'win32' && (payloadStat.mode & 0o077) !== 0))
+            throw new Error('Deferred update payload is not a canonical owner-only staged file.');
+        const bundledWorker = join(dirname(fileURLToPath(import.meta.url)), 'update-worker.js');
+        const workerCandidate = existsSync(bundledWorker) ? bundledWorker : join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'dist', 'cli', 'update-worker.js');
+        const workerPath = realpathSync(workerCandidate);
+        if (lstatSync(workerCandidate).isSymbolicLink() || !lstatSync(workerPath).isFile())
+            throw new Error('Deferred update worker is not a regular canonical file.');
+        const payloadFingerprint = createHash('sha256').update(readFileSync(canonicalPayload)).digest('hex');
+        const workerFingerprint = createHash('sha256').update(readFileSync(workerPath)).digest('hex');
+        const stagedDirectory = stage;
+        const child = spawnProcess(process.execPath, [workerPath, payloadPath, payloadFingerprint, workerFingerprint], {
+            cwd, detached: true, env: { ...ownership.environment, [SKIP_NATIVE_AGENT_REFRESH_ENV]: '1' }, stdio: 'ignore', windowsHide: true,
         });
         child.once('error', (error) => {
             try {
                 appendFileSync(logPath, `[omx] Deferred update launcher failed: ${error.message}\n`, 'utf-8');
             }
             catch {
-                // The startup path must remain non-fatal even when diagnostics cannot be persisted.
+                // The scheduler must not become fatal when diagnostics cannot be persisted.
+            }
+            try {
+                rmSync(stagedDirectory, { recursive: true, force: true });
+            }
+            catch {
+                // The asynchronous launcher failure must not throw into the caller.
             }
         });
         child.unref();
+        stage = undefined;
         return { ok: true, stderr: '', logPath };
     }
     catch (error) {
-        return {
-            ok: false,
-            stderr: error instanceof Error ? error.message : String(error),
-            logPath,
-        };
+        if (stage) {
+            try {
+                rmSync(stage, { recursive: true, force: true });
+            }
+            catch {
+                // Preserve the original scheduling failure when cleanup cannot complete.
+            }
+        }
+        return { ok: false, stderr: error instanceof Error ? error.message : String(error), logPath };
     }
 }
-function formatDeferredUpdateFailure(stderr, logPath) {
+function formatDeferredUpdateFailure(stderr, logPath, manager = 'npm') {
     return [
         '[omx] Failed to schedule the deferred update.',
         stderr.trim() ? `[omx] scheduler error: ${stderr.trim()}` : undefined,
         logPath ? `[omx] Intended log: ${logPath}` : undefined,
-        '[omx] You can retry manually with: npm install -g oh-my-codex@latest && omx setup',
+        `[omx] Retry with the selected ${manager} owner through: omx update`,
     ].filter((line) => typeof line === 'string').join('\n');
 }
-function summarizeUpdateFailure(stderr, installSource = STABLE_INSTALL_SOURCE, logPath) {
+function summarizeUpdateFailure(stderr, installSource = STABLE_INSTALL_SOURCE, logPath, manager = 'npm') {
     const details = stderr.trim().split(/\r?\n/).filter(Boolean).slice(0, 3).join(' | ');
     if (installSource === DEV_INSTALL_SOURCE) {
         return [
@@ -422,11 +405,12 @@ function summarizeUpdateFailure(stderr, installSource = STABLE_INSTALL_SOURCE, l
             '[omx] You can retry manually with: omx update --dev',
         ].filter((line) => typeof line === 'string').join('\n');
     }
+    const installCommand = `${manager === 'bun' ? 'bun add -g' : 'npm install -g'} ${installSource}`;
     return [
-        `[omx] Update failed while running npm install -g ${installSource}.`,
-        details ? `[omx] npm stderr: ${details}` : undefined,
+        `[omx] Update failed while running the selected ${manager} transaction (${installCommand}).`,
+        details ? `[omx] ${manager} stderr: ${details}` : undefined,
         logPath ? `[omx] Full log: ${logPath}` : undefined,
-        `[omx] You can retry manually with: npm install -g ${installSource} && omx setup`,
+        '[omx] Retry through the ownership-safe recovery command: omx update',
     ].filter((line) => typeof line === 'string').join('\n');
 }
 async function askYesNo(question) {
@@ -441,15 +425,23 @@ async function askYesNo(question) {
         rl.close();
     }
 }
+async function resolveCurrentPackageManagerOwnership() {
+    return resolvePackageManagerOwnership({
+        currentPackageRoot: getPackageRoot(),
+        readInstallStamp: readUserInstallStamp,
+    });
+}
 const defaultUpdateDependencies = {
     askYesNo,
     fetchLatestVersion,
     getCurrentVersion,
     getInstalledVersionAfterUpdate,
     getInstalledRevisionAfterUpdate,
+    isWorkingTreeInstall: () => isWorkingTreeInstall(getPackageRoot()),
     readUserInstallStamp,
-    runGlobalUpdate,
-    runDeferredGlobalUpdate,
+    resolvePackageManagerOwnership: resolveCurrentPackageManagerOwnership,
+    runGlobalUpdate: (installSource, ownership) => runGlobalUpdate(installSource, spawnSync, process.platform, ownership),
+    runDeferredGlobalUpdate: (cwd, ownership) => runDeferredGlobalUpdate(cwd, spawn, process.platform, process.pid, ownership),
     runSetupRefresh,
     writeUpdateState,
 };
@@ -464,53 +456,10 @@ async function writeSuccessfulInstallStamp(installedVersion, metadata = {}) {
         ...(metadata.source ? { install_source: metadata.source } : {}),
         ...(metadata.revision ? { install_revision: metadata.revision } : {}),
         ...(metadata.devBaseVersion ? { dev_base_version: stripLeadingV(metadata.devBaseVersion) } : {}),
+        ...(metadata.packageManager ? { package_manager: metadata.packageManager } : {}),
         updated_at: new Date().toISOString(),
     });
 }
-export async function readUserInstallStamp(path = omxUserInstallStampPath()) {
-    if (!existsSync(path))
-        return null;
-    try {
-        const content = await readFile(path, 'utf-8');
-        const parsed = JSON.parse(content);
-        if (typeof parsed.installed_version !== 'string' || typeof parsed.updated_at !== 'string') {
-            return null;
-        }
-        return {
-            installed_version: parsed.installed_version,
-            ...(typeof parsed.setup_completed_version === 'string'
-                ? { setup_completed_version: parsed.setup_completed_version }
-                : {}),
-            ...(parsed.install_channel === 'stable' || parsed.install_channel === 'dev'
-                ? { install_channel: parsed.install_channel }
-                : {}),
-            ...(typeof parsed.install_source === 'string'
-                ? { install_source: parsed.install_source }
-                : {}),
-            ...(typeof parsed.install_revision === 'string'
-                ? { install_revision: parsed.install_revision }
-                : {}),
-            ...(typeof parsed.dev_base_version === 'string'
-                ? { dev_base_version: parsed.dev_base_version }
-                : {}),
-            updated_at: parsed.updated_at,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-export async function writeUserInstallStamp(stamp, path = omxUserInstallStampPath()) {
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, JSON.stringify(stamp, null, 2));
-}
-export function isInstallVersionBump(currentVersion, stamp) {
-    if (!currentVersion)
-        return false;
-    if (!stamp?.installed_version)
-        return true;
-    return stripLeadingV(currentVersion) !== stripLeadingV(stamp.installed_version);
-}
 function doesSetupStampMatchVersion(currentVersion, stamp) {
     return stripLeadingV(stamp?.setup_completed_version ?? '') === stripLeadingV(currentVersion);
 }
@@ -531,42 +480,25 @@ function resolveUpdateCheckBaseline(currentVersion, stamp) {
     }
     return currentVersion;
 }
-export function resolveGlobalInstallRoot(spawnProcess = spawnSync, platform = process.platform) {
-    const result = spawnNpmSync(['root', '-g'], {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 15000,
-        windowsHide: true,
-    }, spawnProcess, platform);
-    if (result.error || result.status !== 0) {
-        return null;
-    }
-    const root = String(result.stdout || '').trim();
-    return root === '' ? null : root;
-}
-async function getInstalledVersionAfterUpdate() {
-    const globalInstallRoot = resolveGlobalInstallRoot();
+async function getInstalledVersionAfterUpdate(ownership) {
+    const globalInstallRoot = ownership?.globalInstallRoot;
     if (!globalInstallRoot)
         return null;
     try {
-        const packageJsonPath = join(globalInstallRoot, PACKAGE_NAME, 'package.json');
-        const content = await readFile(packageJsonPath, 'utf-8');
+        const content = await readFile(join(globalInstallRoot, PACKAGE_NAME, 'package.json'), 'utf-8');
         const pkg = JSON.parse(content);
-        return typeof pkg.version === 'string' && pkg.version.trim() !== ''
-            ? pkg.version
-            : null;
+        return typeof pkg.version === 'string' && pkg.version.trim() !== '' ? pkg.version : null;
     }
     catch {
         return null;
     }
 }
-async function getInstalledRevisionAfterUpdate() {
-    const globalInstallRoot = resolveGlobalInstallRoot();
+async function getInstalledRevisionAfterUpdate(ownership) {
+    const globalInstallRoot = ownership?.globalInstallRoot;
     if (!globalInstallRoot)
         return null;
     try {
-        const packageJsonPath = join(globalInstallRoot, PACKAGE_NAME, 'package.json');
-        const content = await readFile(packageJsonPath, 'utf-8');
+        const content = await readFile(join(globalInstallRoot, PACKAGE_NAME, 'package.json'), 'utf-8');
         const pkg = JSON.parse(content);
         const revision = typeof pkg.gitHead === 'string' ? pkg.gitHead.trim() : '';
         return /^[0-9a-f]{7,40}$/i.test(revision) ? revision.slice(0, 12) : null;
@@ -575,33 +507,45 @@ async function getInstalledRevisionAfterUpdate() {
         return null;
     }
 }
+async function resolveCliEntryWithinPackage(packageRoot, relativePath) {
+    if (relativePath.trim() === '' || isAbsolute(relativePath))
+        return null;
+    try {
+        const cliEntry = await realpath(join(packageRoot, relativePath));
+        const relation = relative(packageRoot, cliEntry);
+        return relation !== '' && !relation.startsWith('..') && !isAbsolute(relation) ? cliEntry : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function resolveInstalledCliEntry(globalInstallRoot) {
     const packageRoot = join(globalInstallRoot, PACKAGE_NAME);
-    const packageJsonPath = join(packageRoot, 'package.json');
-    let cliRelativePath = join('dist', 'cli', 'omx.js');
+    let packageRootRealpath;
+    try {
+        packageRootRealpath = await realpath(packageRoot);
+    }
+    catch {
+        return null;
+    }
     try {
-        const content = await readFile(packageJsonPath, 'utf-8');
+        const content = await readFile(join(packageRootRealpath, 'package.json'), 'utf-8');
         const pkg = JSON.parse(content);
-        if (typeof pkg.bin === 'string' && pkg.bin.trim() !== '') {
-            cliRelativePath = pkg.bin;
-        }
-        else if (pkg.bin &&
-            typeof pkg.bin === 'object' &&
-            typeof pkg.bin.omx === 'string' &&
-            pkg.bin.omx.trim() !== '') {
-            cliRelativePath = pkg.bin.omx;
-        }
+        const cliRelativePath = typeof pkg.bin === 'string'
+            ? pkg.bin
+            : pkg.bin && typeof pkg.bin === 'object' ? pkg.bin.omx : undefined;
+        return typeof cliRelativePath === 'string'
+            ? resolveCliEntryWithinPackage(packageRootRealpath, cliRelativePath)
+            : null;
     }
     catch {
-        // Fall back to the published contract used in package.json today.
+        return resolveCliEntryWithinPackage(packageRootRealpath, join('dist', 'cli', 'omx.js'));
     }
-    const cliEntry = join(packageRoot, cliRelativePath);
-    return existsSync(cliEntry) ? cliEntry : null;
 }
-export function spawnInstalledSetupRefresh(cliEntry, cwd, spawnProcess = spawnSync) {
-    const result = spawnProcess(process.execPath, [cliEntry, ...resolveSetupRefreshArgs(cwd)], {
+export function spawnInstalledSetupRefresh(cliEntry, cwd, spawnProcess = spawnSync, command = process.execPath, environment = process.env) {
+    const result = spawnProcess(command, [cliEntry, ...resolveSetupRefreshArgs(cwd)], {
         cwd,
-        env: process.env,
+        env: environment,
         stdio: 'inherit',
         windowsHide: true,
     });
@@ -616,26 +560,52 @@ export function spawnInstalledSetupRefresh(cliEntry, cwd, spawnProcess = spawnSy
     }
     return { ok: true, stderr: '' };
 }
-async function runSetupRefresh(cwd) {
-    const globalInstallRoot = resolveGlobalInstallRoot();
-    if (!globalInstallRoot) {
-        return {
-            ok: false,
-            stderr: 'Unable to resolve the npm global install root after updating.',
-        };
-    }
-    const cliEntry = await resolveInstalledCliEntry(globalInstallRoot);
+async function runSetupRefresh(cwd, ownership) {
+    if (!ownership || !ownership.packageRoot)
+        return { ok: false, stderr: 'A frozen package-manager ownership transaction is required for setup refresh.' };
+    const cliEntry = await validatePackageManagerOwnership(ownership);
     if (!cliEntry) {
-        return {
-            ok: false,
-            stderr: `Unable to find the updated OMX CLI entry under ${join(globalInstallRoot, PACKAGE_NAME)}.`,
-        };
+        return { ok: false, stderr: `Frozen manager, package root, or bin ownership validation failed before setup refresh under ${join(ownership.globalInstallRoot, PACKAGE_NAME)}.` };
+    }
+    return spawnInstalledSetupRefresh(cliEntry, cwd, spawnSync, process.execPath, { ...ownership.environment, [SKIP_NATIVE_AGENT_REFRESH_ENV]: '1' });
+}
+function workingTreeInstallNotice() {
+    return `[omx] This build runs from a working tree (${getPackageRoot()}), which no package manager owns. Self-update is refused; pull and rebuild the checkout instead.`;
+}
+/** Stamp the cadence even when the check is skipped so an unowned build is not re-probed every launch. */
+async function recordUpdateCheck(dependencies, cwd, nowMs) {
+    try {
+        await dependencies.writeUpdateState(cwd, { last_checked_at: new Date(nowMs).toISOString() });
+    }
+    catch {
+        // Cadence bookkeeping must never block or fail a launch.
     }
-    return spawnInstalledSetupRefresh(cliEntry, cwd);
 }
 async function executeUpdate(options) {
     const { cwd, dependencies, prompt, immediate, channel = 'stable', forceInstall = false, nowMs = Date.now(), } = options;
     const channelConfig = resolveUpdateChannelConfig(channel);
+    const usesNativeTransaction = immediate
+        ? dependencies.runGlobalUpdate === defaultUpdateDependencies.runGlobalUpdate
+            || dependencies.runSetupRefresh === defaultUpdateDependencies.runSetupRefresh
+        : dependencies.runDeferredGlobalUpdate === defaultUpdateDependencies.runDeferredGlobalUpdate;
+    const ownership = usesNativeTransaction
+        ? await dependencies.resolvePackageManagerOwnership()
+        : null;
+    if (usesNativeTransaction && !ownership) {
+        if (dependencies.isWorkingTreeInstall()) {
+            if (immediate)
+                console.log(workingTreeInstallNotice());
+            else
+                await recordUpdateCheck(dependencies, cwd, nowMs);
+            return { status: 'skipped', currentVersion: null, latestVersion: null };
+        }
+        console.log(packageManagerOwnershipError());
+        return { status: 'failed', currentVersion: null, latestVersion: null };
+    }
+    if (ownership?.manager === 'bun' && channel === 'dev') {
+        console.log('[omx] Bun dev updates are not yet supported');
+        return { status: 'failed', currentVersion: null, latestVersion: null };
+    }
     const [current, latest] = await Promise.all([
         dependencies.getCurrentVersion(),
         channel === 'stable' || !forceInstall || channel === 'dev' ? dependencies.fetchLatestVersion() : Promise.resolve(null),
@@ -664,12 +634,12 @@ async function executeUpdate(options) {
         if (immediate) {
             if (current && !doesSetupStampMatchVersion(current, installStamp)) {
                 console.log(`[omx] oh-my-codex is already up to date (v${updateCheckBaseline}). Running setup refresh...`);
-                const setupRefreshResult = await dependencies.runSetupRefresh(cwd);
+                const setupRefreshResult = await dependencies.runSetupRefresh(cwd, ownership ?? undefined);
                 if (!setupRefreshResult.ok) {
                     console.log(`[omx] Update installed, but the setup refresh failed. Run \`omx setup\` with the new install. (${setupRefreshResult.stderr})`);
                     return { status: 'failed', currentVersion: current, latestVersion: latest };
                 }
-                await writeSuccessfulInstallStamp(current);
+                await writeSuccessfulInstallStamp(current, { packageManager: ownership?.manager });
                 console.log(`[omx] Setup refresh completed for v${updateCheckBaseline}. Restart to use current code.`);
                 return { status: 'up-to-date', currentVersion: current, latestVersion: latest };
             }
@@ -688,9 +658,9 @@ async function executeUpdate(options) {
         }
     }
     if (!immediate) {
-        const deferredResult = dependencies.runDeferredGlobalUpdate(cwd);
+        const deferredResult = dependencies.runDeferredGlobalUpdate(cwd, ownership ?? undefined);
         if (!deferredResult.ok) {
-            console.log(formatDeferredUpdateFailure(deferredResult.stderr, deferredResult.logPath));
+            console.log(formatDeferredUpdateFailure(deferredResult.stderr, deferredResult.logPath, ownership?.manager));
             return { status: 'failed', currentVersion: current, latestVersion: latest };
         }
         console.log('[omx] Update scheduled after this session exits.');
@@ -705,21 +675,21 @@ async function executeUpdate(options) {
         console.log('[omx] Running: clone dev branch, run prepack, then npm install -g the packed tarball');
     }
     else {
-        console.log(`[omx] Running: npm install -g ${channelConfig.installSource}`);
+        console.log(`[omx] Running: ${ownership?.manager === 'bun' ? 'bun add -g' : 'npm install -g'} ${channelConfig.installSource}`);
     }
-    const result = dependencies.runGlobalUpdate(channelConfig.installSource);
+    const result = dependencies.runGlobalUpdate(channelConfig.installSource, ownership ?? undefined);
     if (!result.ok) {
-        console.log(summarizeUpdateFailure(result.stderr, channelConfig.installSource));
+        console.log(summarizeUpdateFailure(result.stderr, channelConfig.installSource, undefined, ownership?.manager));
         return { status: 'failed', currentVersion: current, latestVersion: latest };
     }
-    const setupRefreshResult = await dependencies.runSetupRefresh(cwd);
+    const setupRefreshResult = await dependencies.runSetupRefresh(cwd, ownership ?? undefined);
     if (!setupRefreshResult.ok) {
         console.log(`[omx] Update installed, but the setup refresh failed. Run \`omx setup\` with the new install. (${setupRefreshResult.stderr})`);
         return { status: 'failed', currentVersion: current, latestVersion: latest };
     }
-    const installedVersion = await dependencies.getInstalledVersionAfterUpdate();
+    const installedVersion = await dependencies.getInstalledVersionAfterUpdate(ownership ?? undefined);
     const installedRevision = channelConfig.channel === 'dev'
-        ? ((await dependencies.getInstalledRevisionAfterUpdate()) ?? result.revision ?? null)
+        ? ((await dependencies.getInstalledRevisionAfterUpdate(ownership ?? undefined)) ?? result.revision ?? null)
         : null;
     const devBaseVersion = channelConfig.channel === 'dev'
         ? (latest && installedVersion
@@ -735,6 +705,7 @@ async function executeUpdate(options) {
             source: channelConfig.installSource,
             revision: channelConfig.channel === 'dev' ? installedRevision : null,
             devBaseVersion,
+            packageManager: ownership?.manager,
         });
     }
     else if (channelConfig.channel === 'dev') {