omnius 1.0.882 → 1.0.883

package/dist/update-worker-runtime.js

@@ -3178,7 +3178,7 @@ var require_util = __commonJS({
         }
         path3 = url.path;
       }
-      var isAbsolute7 = exports.isAbsolute(path3);
+      var isAbsolute8 = exports.isAbsolute(path3);
       var parts = path3.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
@@ -3198,7 +3198,7 @@ var require_util = __commonJS({
       }
       path3 = parts.join("/");
       if (path3 === "") {
-        path3 = isAbsolute7 ? "/" : ".";
+        path3 = isAbsolute8 ? "/" : ".";
       }
       if (url) {
         url.path = path3;
@@ -129580,7 +129580,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve11 = factory2.createUniqueName("resolve");
+          const resolve12 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -129589,7 +129589,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve11
+              resolve12
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -129606,7 +129606,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve11, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve12, reject]
               )
             )
           ]);
@@ -216517,8 +216517,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise = new Promise((resolve11, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve11, reject });
+          const promise = new Promise((resolve12, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve12, reject });
           });
           this.installer.send(request);
           return promise;
@@ -218778,7 +218778,7 @@ var require_path_browserify = __commonJS({
     }
     var posix = {
       // path.resolve([from ...], to)
-      resolve: function resolve11() {
+      resolve: function resolve12() {
         var resolvedPath = "";
         var resolvedAbsolute = false;
         var cwd;
@@ -218813,15 +218813,15 @@ var require_path_browserify = __commonJS({
       normalize: function normalize(path3) {
         assertPath(path3);
         if (path3.length === 0) return ".";
-        var isAbsolute7 = path3.charCodeAt(0) === 47;
+        var isAbsolute8 = path3.charCodeAt(0) === 47;
         var trailingSeparator = path3.charCodeAt(path3.length - 1) === 47;
-        path3 = normalizeStringPosix(path3, !isAbsolute7);
-        if (path3.length === 0 && !isAbsolute7) path3 = ".";
+        path3 = normalizeStringPosix(path3, !isAbsolute8);
+        if (path3.length === 0 && !isAbsolute8) path3 = ".";
         if (path3.length > 0 && trailingSeparator) path3 += "/";
-        if (isAbsolute7) return "/" + path3;
+        if (isAbsolute8) return "/" + path3;
         return path3;
       },
-      isAbsolute: function isAbsolute7(path3) {
+      isAbsolute: function isAbsolute8(path3) {
         assertPath(path3);
         return path3.length > 0 && path3.charCodeAt(0) === 47;
       },
@@ -219035,9 +219035,9 @@ var require_path_browserify = __commonJS({
         var ret = { root: "", dir: "", base: "", ext: "", name: "" };
         if (path3.length === 0) return ret;
         var code = path3.charCodeAt(0);
-        var isAbsolute7 = code === 47;
+        var isAbsolute8 = code === 47;
         var start;
-        if (isAbsolute7) {
+        if (isAbsolute8) {
           ret.root = "/";
           start = 1;
         } else {
@@ -219073,11 +219073,11 @@ var require_path_browserify = __commonJS({
         preDotState === 0 || // The (right-most) trimmed path component is exactly '..'
         preDotState === 1 && startDot === end - 1 && startDot === startPart + 1) {
           if (end !== -1) {
-            if (startPart === 0 && isAbsolute7) ret.base = ret.name = path3.slice(1, end);
+            if (startPart === 0 && isAbsolute8) ret.base = ret.name = path3.slice(1, end);
             else ret.base = ret.name = path3.slice(startPart, end);
           }
         } else {
-          if (startPart === 0 && isAbsolute7) {
+          if (startPart === 0 && isAbsolute8) {
             ret.name = path3.slice(1, startDot);
             ret.base = path3.slice(1, end);
           } else {
@@ -219087,7 +219087,7 @@ var require_path_browserify = __commonJS({
           ret.ext = path3.slice(startDot, end);
         }
         if (startPart > 0) ret.dir = path3.slice(0, startPart - 1);
-        else if (isAbsolute7) ret.dir = "/";
+        else if (isAbsolute8) ret.dir = "/";
         return ret;
       },
       sep: "/",
@@ -219700,7 +219700,7 @@ var require_scan = __commonJS({
 var require_parse = __commonJS({
   "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/parse.js"(exports, module) {
     "use strict";
-    var constants2 = require_constants();
+    var constants3 = require_constants();
     var utils = require_utils();
     var {
       MAX_LENGTH,
@@ -219708,7 +219708,7 @@ var require_parse = __commonJS({
       REGEX_NON_SPECIAL_CHARS,
       REGEX_SPECIAL_CHARS_BACKREF,
       REPLACEMENTS
-    } = constants2;
+    } = constants3;
     var expandRange = (args, options) => {
       if (typeof options.expandRange === "function") {
         return options.expandRange(...args, options);
@@ -219914,7 +219914,7 @@ var require_parse = __commonJS({
       if (options.maxExtglobRecursion === false) {
         return { risky: false };
       }
-      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants2.DEFAULT_MAX_EXTGLOB_RECURSION;
+      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants3.DEFAULT_MAX_EXTGLOB_RECURSION;
       const branches = splitTopLevel(body).map((branch) => branch.trim());
       if (branches.length > 1) {
         if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) {
@@ -219946,8 +219946,8 @@ var require_parse = __commonJS({
       const bos = { type: "bos", value: "", output: opts.prepend || "" };
       const tokens = [bos];
       const capture = opts.capture ? "" : "?:";
-      const PLATFORM_CHARS = constants2.globChars(opts.windows);
-      const EXTGLOB_CHARS = constants2.extglobChars(PLATFORM_CHARS);
+      const PLATFORM_CHARS = constants3.globChars(opts.windows);
+      const EXTGLOB_CHARS = constants3.extglobChars(PLATFORM_CHARS);
       const {
         DOT_LITERAL,
         PLUS_LITERAL,
@@ -220642,7 +220642,7 @@ var require_parse = __commonJS({
         NO_DOTS_SLASH,
         STAR,
         START_ANCHOR
-      } = constants2.globChars(opts.windows);
+      } = constants3.globChars(opts.windows);
       const nodot = opts.dot ? NO_DOTS : NO_DOT;
       const slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
       const capture = opts.capture ? "" : "?:";
@@ -220700,7 +220700,7 @@ var require_picomatch = __commonJS({
     var scan = require_scan();
     var parse2 = require_parse();
     var utils = require_utils();
-    var constants2 = require_constants();
+    var constants3 = require_constants();
     var isObject = (val) => val && typeof val === "object" && !Array.isArray(val);
     var picomatch = (glob2, options, returnState = false) => {
       if (Array.isArray(glob2)) {
@@ -220828,7 +220828,7 @@ var require_picomatch = __commonJS({
         return /$^/;
       }
     };
-    picomatch.constants = constants2;
+    picomatch.constants = constants3;
     module.exports = picomatch;
   }
 });
@@ -222969,12 +222969,12 @@ ${nodeLocation}` : message;
     };
     var NodeRuntimeFileSystem = class {
       delete(path4) {
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           fs__namespace.rm(path4, { recursive: true }, (err) => {
             if (err)
               reject(err);
             else
-              resolve11();
+              resolve12();
           });
         });
       }
@@ -222993,12 +222993,12 @@ ${nodeLocation}` : message;
         }));
       }
       readFile(filePath, encoding = "utf-8") {
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           fs__namespace.readFile(filePath, encoding, (err, data) => {
             if (err)
               reject(err);
             else
-              resolve11(data);
+              resolve12(data);
           });
         });
       }
@@ -223006,12 +223006,12 @@ ${nodeLocation}` : message;
         return fs__namespace.readFileSync(filePath, encoding);
       }
       async writeFile(filePath, fileText) {
-        await new Promise((resolve11, reject) => {
+        await new Promise((resolve12, reject) => {
           fs__namespace.writeFile(filePath, fileText, (err) => {
             if (err)
               reject(err);
             else
-              resolve11();
+              resolve12();
           });
         });
       }
@@ -223025,12 +223025,12 @@ ${nodeLocation}` : message;
         fs__namespace.mkdirSync(dirPath, { recursive: true });
       }
       move(srcPath, destPath) {
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           fs__namespace.rename(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve11();
+              resolve12();
           });
         });
       }
@@ -223038,12 +223038,12 @@ ${nodeLocation}` : message;
         fs__namespace.renameSync(srcPath, destPath);
       }
       copy(srcPath, destPath) {
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           fs__namespace.copyFile(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve11();
+              resolve12();
           });
         });
       }
@@ -223051,15 +223051,15 @@ ${nodeLocation}` : message;
         fs__namespace.copyFileSync(srcPath, destPath);
       }
       stat(path4) {
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           fs__namespace.stat(path4, (err, stat) => {
             if (err) {
               if (err.code === "ENOENT" || err.code === "ENOTDIR")
-                resolve11(void 0);
+                resolve12(void 0);
               else
                 reject(err);
             } else {
-              resolve11(stat);
+              resolve12(stat);
             }
           });
         });
@@ -299674,7 +299674,7 @@ async function getDaemonReportedIdentity(port) {
 async function waitForDaemonReady(port, expectedVersion, attempts = 24) {
   let observedVersion = null;
   for (let attempt = 0; attempt < attempts; attempt++) {
-    await new Promise((resolve11) => setTimeout(resolve11, 500));
+    await new Promise((resolve12) => setTimeout(resolve12, 500));
     const identity = await getDaemonReportedIdentity(port);
     if (!identity) continue;
     observedVersion = identity.bootVersion;
@@ -299685,10 +299685,10 @@ async function waitForDaemonReady(port, expectedVersion, attempts = 24) {
   return { ok: false, observedVersion };
 }
 function delay(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 function runUtilityCommand(command, args, timeout) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     let settled = false;
     let stdout = "";
     let stderr = "";
@@ -299698,7 +299698,7 @@ function runUtilityCommand(command, args, timeout) {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      resolve11({ available, code, stdout, stderr });
+      resolve12({ available, code, stdout, stderr });
     };
     let child;
     try {
@@ -299707,7 +299707,7 @@ function runUtilityCommand(command, args, timeout) {
         windowsHide: true
       });
     } catch {
-      resolve11({ available: false, code: null, stdout: "", stderr: "" });
+      resolve12({ available: false, code: null, stdout: "", stderr: "" });
       return;
     }
     child.stdout?.setEncoding("utf8");
@@ -299863,13 +299863,13 @@ async function portHolderPids(port) {
   return daemonListenerPids(port);
 }
 async function daemonPortIsFree(port) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const probe = createNetServer();
     let settled = false;
     const finish = (free) => {
       if (settled) return;
       settled = true;
-      resolve11(free);
+      resolve12(free);
     };
     probe.once("error", () => finish(false));
     probe.once("listening", () => {
@@ -300178,26 +300178,26 @@ async function quiesceDaemonForUpdate(port = getDaemonPort()) {
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
 import {
-  constants,
+  constants as constants2,
   chmodSync,
-  closeSync as closeSync3,
+  closeSync as closeSync4,
   existsSync as existsSync6,
   fchmodSync,
-  fstatSync,
-  fsyncSync,
-  lstatSync,
+  fstatSync as fstatSync2,
+  fsyncSync as fsyncSync2,
+  lstatSync as lstatSync2,
   mkdirSync as mkdirSync5,
-  openSync as openSync3,
-  readFileSync as readFileSync6,
-  readSync as readSync2,
+  openSync as openSync4,
+  readFileSync as readFileSync7,
+  readSync as readSync3,
   renameSync as renameSync4,
   statSync as statSync3,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync4,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync5,
   writeSync as writeSync2
 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
-import { dirname as dirname9, join as join16 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute7, join as join16, resolve as resolve11 } from "node:path";
 
 // packages/cli/src/service-version.ts
 var OmniusVersionError = class extends Error {
@@ -300254,8 +300254,16 @@ function compareOmniusVersions(left, right) {
 
 // packages/cli/src/npm-install-recovery.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { closeSync as closeSync3, constants, fstatSync, fsyncSync, lstatSync, openSync as openSync3, readFileSync as readFileSync6, readSync as readSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { lstat, realpath, rename, rm } from "node:fs/promises";
 import { basename as basename8, dirname as dirname8, isAbsolute as isAbsolute6, join as join15, resolve as resolve10 } from "node:path";
+var NpmInstallBusyError = class extends Error {
+  code = "NPM_INSTALL_BUSY";
+  constructor(message = "Another installer owns this npm modules directory. Wait for it to settle before retrying.") {
+    super(message);
+    this.name = "NpmInstallBusyError";
+  }
+};
 function parseNpmRenameCollision(diagnostic) {
   const fields = /* @__PURE__ */ new Map();
   let previousPathField = false;
@@ -300288,15 +300296,21 @@ function assertOwnedDirectory(metadata, label) {
   }
 }
 async function recoverNpmRetirementCollision(collision, modulesRoot, options = {}) {
+  assertNotCancelled(options.signal);
+  if (collision.code !== "ENOTEMPTY" && collision.code !== "EEXIST" || collision.syscall !== "rename" || !isAbsolute6(modulesRoot) || /[\x00-\x1f\x7f]/.test(modulesRoot + collision.path + collision.dest)) return null;
+  const root = resolve10(modulesRoot), source = join15(root, "omnius"), retired = retiredNpmPackagePath(source);
+  if (collision.path !== source || collision.dest !== retired || dirname8(retired) !== root) return null;
+  return prepareNpmRetirementSlot(root, options);
+}
+async function prepareNpmRetirementSlot(modulesRoot, options = {}) {
   const current = () => {
     assertNotCancelled(options.signal);
     options.assertOwned?.();
     assertNotCancelled(options.signal);
   };
   current();
-  if (collision.code !== "ENOTEMPTY" && collision.code !== "EEXIST" || collision.syscall !== "rename" || !isAbsolute6(modulesRoot) || /[\x00-\x1f\x7f]/.test(modulesRoot + collision.path + collision.dest)) return null;
-  const root = resolve10(modulesRoot), source = join15(root, "omnius"), retired = retiredNpmPackagePath(source);
-  if (collision.path !== source || collision.dest !== retired || dirname8(retired) !== root) return null;
+  if (!isAbsolute6(modulesRoot) || /[\x00-\x1f\x7f]/.test(modulesRoot)) throw new Error("npm modules root must be an absolute directory path.");
+  const root = resolve10(modulesRoot), retired = retiredNpmPackagePath(join15(root, "omnius"));
   const rootBefore = await lstat(root);
   assertOwnedDirectory(rootBefore, "global modules root");
   const canonicalRoot = await realpath(root);
@@ -300309,14 +300323,157 @@ async function recoverNpmRetirementCollision(collision, modulesRoot, options = {
   }
   assertOwnedDirectory(before, "retired package");
   const backup = join15(root, `.omnius-update-recovery-${randomUUID2()}`);
+  const receipt = { modulesRoot: root, retiredPath: retired, backupPath: backup, device: before.dev, inode: before.ino };
   current();
+  await options.onPrepare?.({ ...receipt });
+  current();
+  try {
+    await lstat(backup);
+    throw new Error("The planned npm retirement backup is already occupied; no directory was moved.");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
   const [rootNow, candidateNow] = await Promise.all([lstat(root), lstat(retired)]);
   if (!sameIdentity(rootBefore, rootNow) || !sameIdentity(before, candidateNow) || await realpath(root) !== canonicalRoot) throw new Error("npm retirement directory changed before recovery; no cleanup was attempted.");
   assertOwnedDirectory(rootNow, "global modules root");
   assertOwnedDirectory(candidateNow, "retired package");
   current();
   await rename(retired, backup);
-  return { modulesRoot: root, retiredPath: retired, backupPath: backup, device: before.dev, inode: before.ino };
+  return receipt;
+}
+function processIdentity(pid) {
+  if (process.platform !== "linux") return;
+  try {
+    const raw = readFileSync6(`/proc/${pid}/stat`, "utf8"), fields = raw.slice(raw.lastIndexOf(")") + 2).trim().split(/\s+/);
+    if (!/^\d+$/.test(fields[19] ?? "")) return;
+    return readFileSync6("/proc/sys/kernel/random/boot_id", "utf8").trim() + ":" + fields[19];
+  } catch {
+    return;
+  }
+}
+function readInstallOwner(path3) {
+  const before = lstatSync(path3);
+  const valid = (value) => value.isFile() && !value.isSymbolicLink() && value.size > 0 && value.size <= 4096 && value.nlink === 1 && (process.platform === "win32" || value.uid === process.getuid?.() && (value.mode & 63) === 0);
+  if (!valid(before)) throw new NpmInstallBusyError("The npm install owner record is unsafe or unknown; it was retained for inspection.");
+  const fd = openSync3(path3, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const metadata = fstatSync(fd);
+    if (!valid(metadata) || !sameIdentity(before, metadata)) throw new NpmInstallBusyError("The npm install owner record changed; no lock was removed.");
+    const data = Buffer.alloc(4097);
+    let size = 0;
+    while (size < data.length) {
+      const count = readSync2(fd, data, size, data.length - size, null);
+      if (!count) break;
+      size += count;
+    }
+    if (size > 4096) throw new NpmInstallBusyError("The npm install owner record is too large; it was retained.");
+    let value;
+    try {
+      value = JSON.parse(data.subarray(0, size).toString("utf8"));
+    } catch {
+      throw new NpmInstallBusyError("The npm install owner record is malformed; it was retained.");
+    }
+    const owner = value;
+    if (!owner || typeof owner !== "object" || Array.isArray(owner) || owner.schema_version !== 1 || typeof owner.nonce !== "string" || !/^[a-f0-9-]{36}$/.test(owner.nonce) || !Number.isSafeInteger(owner.pid) || owner.pid <= 0 || owner.pid > 2147483647 || owner.process_identity !== void 0 && (typeof owner.process_identity !== "string" || !/^[a-f0-9-]{36}:\d+$/.test(owner.process_identity)) || owner.operation_id !== void 0 && (typeof owner.operation_id !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(owner.operation_id)) || Object.keys(owner).some((key) => !["schema_version", "nonce", "pid", "process_identity", "operation_id"].includes(key))) {
+      throw new NpmInstallBusyError("The npm install owner identity is unknown; its lock was retained.");
+    }
+    return { owner, metadata };
+  } finally {
+    closeSync3(fd);
+  }
+}
+function provedAbsent(owner) {
+  try {
+    process.kill(owner.pid, 0);
+  } catch (error) {
+    return error.code === "ESRCH";
+  }
+  const current = processIdentity(owner.pid);
+  return Boolean(owner.process_identity && current && owner.process_identity !== current);
+}
+async function acquireNpmInstallLease(modulesRoot, options = {}) {
+  assertNotCancelled(options.signal);
+  if (!isAbsolute6(modulesRoot) || /[\x00-\x1f\x7f]/.test(modulesRoot) || options.operationId !== void 0 && !/^[a-zA-Z0-9_-]{1,128}$/.test(options.operationId)) throw new Error("Invalid npm install scope.");
+  const logical = resolve10(modulesRoot), logicalMetadata = await lstat(logical);
+  assertOwnedDirectory(logicalMetadata, "global modules root");
+  const root = await realpath(logical), rootMetadata = await lstat(root);
+  assertOwnedDirectory(rootMetadata, "global modules root");
+  if (!sameIdentity(logicalMetadata, rootMetadata)) throw new Error("npm modules root changed before installer admission.");
+  const lockPath = join15(root, ".omnius-install.lock"), guardPath = lockPath + ".guard", nonce = randomUUID2();
+  const assertRoot = () => {
+    const current = lstatSync(root);
+    assertOwnedDirectory(current, "global modules root");
+    if (!sameIdentity(rootMetadata, current)) throw new Error("npm modules root changed; no installer may proceed.");
+  };
+  const withGuard = (action) => {
+    assertRoot();
+    let fd;
+    try {
+      fd = openSync3(guardPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+    } catch (error) {
+      if (error.code === "EEXIST") throw new NpmInstallBusyError("npm installer ownership is being checked, or its short guard was interrupted; no guard was stolen.");
+      throw error;
+    }
+    const metadata = fstatSync(fd), guardNonce = randomUUID2();
+    try {
+      writeFileSync4(fd, JSON.stringify({ schema_version: 1, nonce: guardNonce, pid: process.pid, process_identity: processIdentity(process.pid) }));
+      fsyncSync(fd);
+      return action();
+    } finally {
+      try {
+        const current = readInstallOwner(guardPath);
+        if (sameIdentity(metadata, current.metadata) && current.owner.nonce === guardNonce) unlinkSync3(guardPath);
+      } finally {
+        closeSync3(fd);
+      }
+    }
+  };
+  let lockMetadata;
+  withGuard(() => {
+    assertNotCancelled(options.signal);
+    try {
+      const previous = readInstallOwner(lockPath);
+      if (!provedAbsent(previous.owner)) throw new NpmInstallBusyError();
+      const checked = readInstallOwner(lockPath);
+      if (!sameIdentity(previous.metadata, checked.metadata) || checked.owner.nonce !== previous.owner.nonce) throw new NpmInstallBusyError("npm install ownership changed while checking its old owner.");
+      unlinkSync3(lockPath);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    assertNotCancelled(options.signal);
+    assertRoot();
+    const fd = openSync3(lockPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+    try {
+      lockMetadata = fstatSync(fd);
+      writeFileSync4(fd, JSON.stringify({ schema_version: 1, nonce, pid: process.pid, process_identity: processIdentity(process.pid), ...options.operationId ? { operation_id: options.operationId } : {} }));
+      fsyncSync(fd);
+    } finally {
+      closeSync3(fd);
+    }
+  });
+  const owns = () => {
+    assertRoot();
+    const current = readInstallOwner(lockPath);
+    return sameIdentity(lockMetadata, current.metadata) && current.owner.nonce === nonce && current.owner.pid === process.pid;
+  };
+  return {
+    modulesRoot: root,
+    lockPath,
+    nonce,
+    assertOwned() {
+      assertNotCancelled(options.signal);
+      if (!owns()) throw new Error("npm install lease ownership changed; no installer may proceed.");
+    },
+    async release() {
+      withGuard(() => {
+        try {
+          if (owns()) unlinkSync3(lockPath);
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+      });
+    }
+  };
 }
 async function removeVerifiedNpmRetirementBackup(backup) {
   const root = resolve10(backup.modulesRoot);
@@ -300352,9 +300509,9 @@ function watchUpdateCancellation(operationId, paths = resolveUpdatePaths()) {
   const check = () => {
     if (controller.signal.aborted) return;
     try {
-      const metadata = lstatSync(path3);
+      const metadata = lstatSync2(path3);
       if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > 1024) return;
-      const request = JSON.parse(readFileSync6(path3, "utf8"));
+      const request = JSON.parse(readFileSync7(path3, "utf8"));
       const state = readUpdateState(paths);
       if (state?.operation_id === operationId && state.status === "running" && state.cancel_token_hash && request.operation_id === operationId && request.token_hash === state.cancel_token_hash) controller.abort(new UpdateCancelledError());
     } catch {
@@ -300366,7 +300523,7 @@ function watchUpdateCancellation(operationId, paths = resolveUpdatePaths()) {
   return { signal: controller.signal, close() {
     clearInterval(timer);
     try {
-      unlinkSync3(path3);
+      unlinkSync4(path3);
     } catch {
     }
   } };
@@ -300387,36 +300544,36 @@ function resolveUpdatePaths(env = process.env, platform2 = process.platform, hom
 function ensurePrivateDirectories(paths) {
   for (const path3 of [paths.stateDir, paths.cacheDir]) {
     mkdirSync5(path3, { recursive: true, mode: 448 });
-    const before = lstatSync(path3);
+    const before = lstatSync2(path3);
     if (!before.isDirectory() || before.isSymbolicLink() || process.platform !== "win32" && (before.uid !== process.getuid?.() || (before.mode & 18) !== 0)) throw new Error("Update coordination directories must be owned and not writable by other users");
-    const fd = openSync3(path3, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    const fd = openSync4(path3, constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW);
     try {
-      const actual = fstatSync(fd);
+      const actual = fstatSync2(fd);
       if (before.ino !== actual.ino || before.dev !== actual.dev || !actual.isDirectory() || process.platform !== "win32" && (actual.uid !== process.getuid?.() || (actual.mode & 18) !== 0)) throw new Error("Update coordination directory ownership changed");
       if (process.platform !== "win32" && (actual.mode & 63) !== 0) fchmodSync(fd, 448);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
   }
 }
 function privateRecord(path3, limit = 4096) {
   let before;
   try {
-    before = lstatSync(path3);
+    before = lstatSync2(path3);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
   const valid = (st) => st.isFile() && !st.isSymbolicLink() && st.nlink === 1 && st.size <= limit && (process.platform === "win32" || st.uid === process.getuid?.() && (st.mode & 63) === 0);
   if (!valid(before)) throw new Error("Update coordination requires owner-only regular files");
-  const fd = openSync3(path3, constants.O_RDONLY | constants.O_NOFOLLOW);
+  const fd = openSync4(path3, constants2.O_RDONLY | constants2.O_NOFOLLOW);
   try {
-    const actual = fstatSync(fd);
+    const actual = fstatSync2(fd);
     if (!valid(actual) || actual.ino !== before.ino || actual.dev !== before.dev) throw new Error("Update coordination file ownership changed");
     const buffer = Buffer.alloc(limit + 1);
     let size = 0;
     while (size < buffer.length) {
-      const count = readSync2(fd, buffer, size, buffer.length - size, null);
+      const count = readSync3(fd, buffer, size, buffer.length - size, null);
       if (!count) break;
       size += count;
     }
@@ -300427,15 +300584,15 @@ function privateRecord(path3, limit = 4096) {
       throw new Error("Update coordination record is invalid; inspect its private state");
     }
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
-function processIdentity(pid) {
+function processIdentity2(pid) {
   if (process.platform !== "linux") return;
   try {
-    const raw = readFileSync6(`/proc/${pid}/stat`, "utf8"), fields = raw.slice(raw.lastIndexOf(")") + 2).trim().split(/\s+/);
+    const raw = readFileSync7(`/proc/${pid}/stat`, "utf8"), fields = raw.slice(raw.lastIndexOf(")") + 2).trim().split(/\s+/);
     if (/[ZX]/.test(fields[0] ?? "") || !/^\d+$/.test(fields[19] ?? "")) return;
-    return readFileSync6("/proc/sys/kernel/random/boot_id", "utf8").trim() + ":" + fields[19];
+    return readFileSync7("/proc/sys/kernel/random/boot_id", "utf8").trim() + ":" + fields[19];
   } catch {
     return;
   }
@@ -300445,7 +300602,7 @@ function withUpdateOwnership(paths, mutation) {
   const path3 = paths.lockFile + ".guard", nonce = randomUUID3();
   let fd;
   try {
-    fd = openSync3(path3, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+    fd = openSync4(path3, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
   } catch (error) {
     if (error.code === "EEXIST") {
       const busy = new UpdateOwnershipBusyError(`Update ownership is busy or its guard was interrupted. Retry; if it persists, inspect the private ${path3} owner record before removing that guard.`);
@@ -300456,29 +300613,29 @@ function withUpdateOwnership(paths, mutation) {
   }
   let original;
   try {
-    original = fstatSync(fd);
+    original = fstatSync2(fd);
   } catch (error) {
-    closeSync3(fd);
+    closeSync4(fd);
     throw error;
   }
   const owned = () => {
     try {
-      const current = lstatSync(path3);
+      const current = lstatSync2(path3);
       return current.ino === original.ino && current.dev === original.dev && privateRecord(path3)?.nonce === nonce;
     } catch {
       return false;
     }
   };
   try {
-    writeFileSync4(fd, JSON.stringify({ pid: process.pid, process_identity: processIdentity(process.pid), nonce }));
-    fsyncSync(fd);
+    writeFileSync5(fd, JSON.stringify({ pid: process.pid, process_identity: processIdentity2(process.pid), nonce }));
+    fsyncSync2(fd);
     if (!owned()) throw new Error("Update ownership guard changed before the transaction");
     return mutation();
   } finally {
     try {
-      if (owned()) unlinkSync3(path3);
+      if (owned()) unlinkSync4(path3);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
   }
 }
@@ -300492,22 +300649,22 @@ async function retryUpdateOwnership(attempt, timeoutMs = 2e3) {
       let live = false;
       try {
         const owner = privateRecord(error.guardPath);
-        live = !!owner && isPidAlive(owner.pid) && (process.platform !== "linux" || !!owner.process_identity && processIdentity(owner.pid) === owner.process_identity);
+        live = !!owner && isPidAlive(owner.pid) && (process.platform !== "linux" || !!owner.process_identity && processIdentity2(owner.pid) === owner.process_identity);
       } catch {
       }
       if (!live) throw error;
-      await new Promise((resolve11) => setTimeout(resolve11, 25));
+      await new Promise((resolve12) => setTimeout(resolve12, 25));
     }
   }
 }
 function releaseMatchingUpdateLock(paths, operationId, pid) {
   const lock = privateRecord(paths.lockFile);
-  if (lock?.operation_id === operationId && (pid === void 0 || lock.pid === pid)) unlinkSync3(paths.lockFile);
+  if (lock?.operation_id === operationId && (pid === void 0 || lock.pid === pid)) unlinkSync4(paths.lockFile);
 }
 function atomicPrivateJson(path3, value) {
   const temp = `${path3}.${process.pid}.${randomUUID3()}.tmp`;
   try {
-    writeFileSync4(temp, `${JSON.stringify(value, null, 2)}
+    writeFileSync5(temp, `${JSON.stringify(value, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384,
@@ -300520,14 +300677,14 @@ function atomicPrivateJson(path3, value) {
     }
   } finally {
     try {
-      if (existsSync6(temp)) unlinkSync3(temp);
+      if (existsSync6(temp)) unlinkSync4(temp);
     } catch {
     }
   }
 }
 function readUpdateState(paths = resolveUpdatePaths()) {
   try {
-    return JSON.parse(readFileSync6(paths.stateFile, "utf8"));
+    return JSON.parse(readFileSync7(paths.stateFile, "utf8"));
   } catch {
     return null;
   }
@@ -300546,7 +300703,7 @@ function isPidAlive(pid) {
   }
 }
 function ownsAdoptedWorker(state, operationId, pid, paths) {
-  if (!state || state.operation_id !== operationId || state.status !== "running" || state.pid !== pid || !state.worker_adopted_at || state.worker_process_identity && state.worker_process_identity !== processIdentity(pid)) return false;
+  if (!state || state.operation_id !== operationId || state.status !== "running" || state.pid !== pid || !state.worker_adopted_at || state.worker_process_identity && state.worker_process_identity !== processIdentity2(pid)) return false;
   const lock = privateRecord(paths.lockFile);
   return lock?.operation_id === operationId && lock.pid === pid;
 }
@@ -300580,7 +300737,7 @@ async function runUpdateCommand(command, args, options = {}) {
   if (options.signal?.aborted) {
     return { status: null, stdout: "", stderr: "command cancelled", signal: null, error: new Error("command cancelled") };
   }
-  return await new Promise((resolve11) => {
+  return await new Promise((resolve12) => {
     const child = spawn2(command, args, {
       env: options.env ?? process.env,
       cwd: options.cwd,
@@ -300626,7 +300783,7 @@ async function runUpdateCommand(command, args, options = {}) {
       clearTimeout(timer);
       if (forceTimer) clearTimeout(forceTimer);
       options.signal?.removeEventListener("abort", onAbort);
-      resolve11(result);
+      resolve12(result);
     };
     const onAbort = () => {
       terminate(new Error("command cancelled"));
@@ -300661,21 +300818,21 @@ function globalExecutableCandidates(prefix) {
 }
 async function inspectGlobalOmniusInstall(expectedVersion, options = {}) {
   const npmPath = options.npmPath ?? resolveNpmPath();
-  const prefixResult = await runCommand(npmPath, ["prefix", "-g"], { env: options.env, timeout: 1e4 });
+  const prefixResult = await runCommand(npmPath, ["prefix", "-g"], { env: options.env, cwd: options.cwd, timeout: 1e4 });
   if (prefixResult.status !== 0 || !prefixResult.stdout.trim()) {
     throw new Error(`Could not resolve npm global prefix: ${prefixResult.stderr.trim() || "npm prefix -g failed"}`);
   }
   const npmPrefix = prefixResult.stdout.trim();
   const packageJsonPath = globalPackageCandidates(npmPrefix).find(existsSync6);
   if (!packageJsonPath) throw new Error(`Global omnius package.json not found under ${npmPrefix}`);
-  const packageJsonRaw = readFileSync6(packageJsonPath, "utf8");
+  const packageJsonRaw = readFileSync7(packageJsonPath, "utf8");
   const installedVersion = String(JSON.parse(packageJsonRaw)?.version ?? "");
   if (installedVersion !== expectedVersion) {
     throw new Error(`Global package verification failed: expected ${expectedVersion}, found ${installedVersion || "unknown"}`);
   }
   const executablePath = globalExecutableCandidates(npmPrefix).find(existsSync6);
   if (!executablePath) throw new Error(`Global Omnius executable not found under ${npmPrefix}`);
-  const versionResult = await runCommand(executablePath, ["--version"], { env: options.env, timeout: 1e4 });
+  const versionResult = await runCommand(executablePath, ["--version"], { env: options.env, cwd: options.cwd, timeout: 1e4 });
   const executableVersion = commandVersion(`${versionResult.stdout}
 ${versionResult.stderr}`) ?? "";
   if (versionResult.status !== 0 || executableVersion !== expectedVersion) {
@@ -300716,7 +300873,7 @@ async function quiesceDaemonWithRetry(quiesce, attempts = 3, pauseMs = 250) {
     } catch {
     }
     if (attempt < boundedAttempts && pauseMs > 0) {
-      await new Promise((resolve11) => setTimeout(resolve11, pauseMs));
+      await new Promise((resolve12) => setTimeout(resolve12, pauseMs));
     }
   }
   return false;
@@ -300732,6 +300889,7 @@ async function installGlobalPackageStreaming(input) {
     "--no-progress"
   ], {
     env: input.env,
+    cwd: input.cwd,
     signal: input.signal,
     timeout: 5 * 6e4,
     onStdout: (text2) => process.stdout.write(text2),
@@ -300747,7 +300905,8 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
   let state = initial;
   let daemonQuiesced = false;
   let installStarted = false;
-  let retirementBackup = null;
+  const retirementBackups = [];
+  let installLease;
   let cancelPublication;
   const throwIfCancelled = () => {
     if (dependencies.signal?.aborted) throw new UpdateCancelledError();
@@ -300772,10 +300931,63 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
     NPM_CONFIG_CACHE: paths.cacheDir,
     npm_config_cache: paths.cacheDir,
     npm_config_prefer_online: "true",
-    OMNIUS_UPDATE_COORDINATED: "1"
+    OMNIUS_UPDATE_COORDINATED: "1",
+    ...initial.npm_prefix ? { NPM_CONFIG_PREFIX: initial.npm_prefix, npm_config_prefix: initial.npm_prefix } : {}
+  };
+  const cwd = paths.cacheDir;
+  const assertOwned = () => {
+    installLease?.assertOwned();
+    const persisted = readUpdateState(paths);
+    if (!persisted || persisted.operation_id !== state.operation_id || persisted.status !== "running" || state.worker_adopted_at && !ownsAdoptedWorker(persisted, state.operation_id, state.pid, paths)) {
+      throw new Error("Update ownership changed before package preparation; no directory was moved.");
+    }
+  };
+  const preserveRetirement = async (stage, collision) => {
+    const options = {
+      signal: dependencies.signal,
+      assertOwned,
+      onPrepare: async (backup2) => {
+        state = await transition(state, { npm_recoveries: [...state.npm_recoveries ?? [], {
+          retired_path: backup2.retiredPath,
+          backup_path: backup2.backupPath,
+          status: "planned",
+          stage,
+          device: backup2.device,
+          inode: backup2.inode
+        }] }, paths);
+      }
+    };
+    const backup = collision ? await recoverNpmRetirementCollision(collision, state.npm_modules_root, options) : await prepareNpmRetirementSlot(state.npm_modules_root, options);
+    if (!backup) return null;
+    retirementBackups.push(backup);
+    const recovery = { retired_path: backup.retiredPath, backup_path: backup.backupPath, status: "retained" };
+    state = await transition(state, {
+      npm_recovery: recovery,
+      npm_recoveries: state.npm_recoveries.map((item) => item.backup_path === backup.backupPath ? { ...item, status: "retained" } : item)
+    }, paths);
+    return backup;
   };
   try {
     throwIfCancelled();
+    mkdirSync5(cwd, { recursive: true, mode: 448 });
+    state = await transition(state, { npm_preparation: "checking", npm_working_directory: cwd }, paths);
+    const prefixProbe = await runCommand(npmPath, ["prefix", "-g"], { env, cwd, timeout: 1e4, signal: dependencies.signal });
+    throwIfCancelled();
+    const npmPrefix = prefixProbe.stdout.trim();
+    if (prefixProbe.status !== 0 || !isAbsolute7(npmPrefix)) throw new Error("Could not resolve the selected npm global prefix before installation.");
+    if (initial.npm_prefix && resolve11(npmPrefix) !== resolve11(initial.npm_prefix)) throw new Error("The update worker resolved a different npm prefix; no package was changed.");
+    const rootProbe = await runCommand(npmPath, ["root", "-g"], { env, cwd, timeout: 1e4, signal: dependencies.signal });
+    throwIfCancelled();
+    const npmRoot = rootProbe.stdout.trim();
+    const expectedRoot = process.platform === "win32" ? join16(npmPrefix, "node_modules") : join16(npmPrefix, "lib", "node_modules");
+    if (rootProbe.status !== 0 || !isAbsolute7(npmRoot) || resolve11(npmRoot) !== resolve11(expectedRoot)) throw new Error("Could not verify the selected npm global modules directory; no package was changed.");
+    state = await transition(state, { npm_path: npmPath, npm_prefix: npmPrefix, npm_modules_root: npmRoot }, paths);
+    installLease = await acquireNpmInstallLease(npmRoot, { signal: dependencies.signal, operationId: state.operation_id });
+    state = await transition(state, { npm_modules_root: installLease.modulesRoot }, paths);
+    assertOwned();
+    await preserveRetirement("before_install");
+    throwIfCancelled();
+    state = await transition(state, { npm_preparation: "ready" }, paths);
     if (dependencies.quiesceDaemon) {
       state = await transition(state, { phase: "daemon_quiescing" }, paths);
       throwIfCancelled();
@@ -300787,52 +300999,28 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       daemonQuiesced = true;
       throwIfCancelled();
     }
-    const prefixProbe = await runCommand(npmPath, ["prefix", "-g"], { env, timeout: 1e4, signal: dependencies.signal });
-    throwIfCancelled();
-    state = await transition(state, {
-      phase: "installing",
-      npm_path: npmPath,
-      ...prefixProbe.status === 0 && prefixProbe.stdout.trim() ? { npm_prefix: prefixProbe.stdout.trim() } : {}
-    }, paths);
+    state = await transition(state, { phase: "installing" }, paths);
     throwIfCancelled();
     const installer = dependencies.install ?? installGlobalPackageStreaming;
-    installStarted = true;
     for (let attempt = 1; attempt <= 2; attempt++) {
       state = await transition(state, { installer_attempt: attempt }, paths);
       throwIfCancelled();
-      const installResult = await installer({ npmPath, targetVersion: target, env, signal: dependencies.signal });
+      installStarted = true;
+      const installResult = await installer({ npmPath, targetVersion: target, env, cwd, signal: dependencies.signal });
       state = await transition(state, { installer_exit_code: installResult.exitCode }, paths);
       throwIfCancelled();
       if (installResult.exitCode === 0) break;
       const collision = installResult.renameCollision ?? parseNpmRenameCollision(installResult.error ?? "");
       if (attempt === 1 && collision) {
-        const rootProbe = await runCommand(npmPath, ["root", "-g"], { env, timeout: 1e4, signal: dependencies.signal });
-        throwIfCancelled();
-        if (rootProbe.status === 0 && rootProbe.stdout.trim()) {
-          retirementBackup = await recoverNpmRetirementCollision(collision, rootProbe.stdout.trim(), {
-            signal: dependencies.signal,
-            assertOwned: () => {
-              const persisted = readUpdateState(paths);
-              if (!persisted || persisted.operation_id !== state.operation_id || persisted.status !== "running" || state.worker_adopted_at && !ownsAdoptedWorker(persisted, state.operation_id, state.pid, paths)) {
-                throw new Error("Update ownership changed before npm collision recovery; no directory was moved.");
-              }
-            }
-          });
-          if (retirementBackup) {
-            state = await transition(state, { npm_recovery: {
-              retired_path: retirementBackup.retiredPath,
-              backup_path: retirementBackup.backupPath,
-              status: "retained"
-            } }, paths);
-            process.stderr.write("[omnius update] Preserved the occupied npm retirement directory; retrying the same package once (attempt 2/2).\n");
-            throwIfCancelled();
-            continue;
-          }
+        const backup = await preserveRetirement("collision", collision);
+        if (backup) {
+          throwIfCancelled();
+          continue;
         }
       }
       throw new Error(installResult.error || `npm install exited with code ${installResult.exitCode}`);
     }
-    const evidence = dependencies.inspectInstall ? await dependencies.inspectInstall(target, npmPath, env) : await inspectGlobalOmniusInstall(target, { npmPath, env });
+    const evidence = dependencies.inspectInstall ? await dependencies.inspectInstall(target, npmPath, env) : await inspectGlobalOmniusInstall(target, { npmPath, env, cwd });
     throwIfCancelled();
     state = await transition(state, {
       phase: "package_verified",
@@ -300854,7 +301042,7 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       if (daemon?.bootVersion === target && daemon.bootPackageHash === evidence.packageHash) {
         break;
       }
-      if (attempt < 3) await new Promise((resolve11) => setTimeout(resolve11, 1e3));
+      if (attempt < 3) await new Promise((resolve12) => setTimeout(resolve12, 1e3));
     }
     if (!daemon || daemon.bootVersion !== target) {
       const observed = daemon?.bootVersion ?? "unreachable";
@@ -300886,19 +301074,33 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       state = await transition(state, { tray_restarted: true }, paths);
     }
     throwIfCancelled();
-    if (retirementBackup && state.npm_recovery) {
-      const recovery = state.npm_recovery;
+    try {
+      await preserveRetirement("after_install");
+    } catch (error) {
+      if (dependencies.signal?.aborted) throw error;
+      assertOwned();
+      state = await transition(state, { npm_cleanup_warning: error instanceof Error ? error.message : String(error) }, paths);
+    }
+    throwIfCancelled();
+    for (const backup of retirementBackups) {
+      assertOwned();
       let cleanupWarning;
       try {
-        await removeVerifiedNpmRetirementBackup(retirementBackup);
+        await removeVerifiedNpmRetirementBackup(backup);
       } catch (error) {
         cleanupWarning = error instanceof Error ? error.message : String(error);
       }
-      state = await transition(state, { npm_recovery: {
-        ...recovery,
-        status: cleanupWarning ? "retained" : "removed",
-        ...cleanupWarning ? { cleanup_warning: cleanupWarning } : {}
-      } }, paths);
+      const recoveries = state.npm_recoveries.map((item) => item.backup_path === backup.backupPath ? { ...item, status: cleanupWarning ? "retained" : "removed", ...cleanupWarning ? { cleanup_warning: cleanupWarning } : {} } : item);
+      const last = recoveries.filter((item) => item.status !== "planned").at(-1);
+      state = await transition(state, {
+        npm_recoveries: recoveries,
+        ...last ? { npm_recovery: {
+          retired_path: last.retired_path,
+          backup_path: last.backup_path,
+          status: last.status,
+          ...last.cleanup_warning ? { cleanup_warning: last.cleanup_warning } : {}
+        } } : {}
+      }, paths);
     }
     throwIfCancelled();
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -300931,7 +301133,7 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       error: cancelled ? "Update cancelled after the owned operation settled." : message,
       remediation: [
         cancelled && installStarted ? "Package files may have changed. No rollback was performed; verify the installed version before retrying." : void 0,
-        state.npm_recovery?.status === "retained" ? `The prior npm retirement directory is preserved at ${state.npm_recovery.backup_path}.` : void 0,
+        ...(state.npm_recoveries ?? []).filter((item) => item.status === "retained").map((item) => `The prior npm retirement directory is preserved at ${item.backup_path}.`),
         permissionRemediation(message),
         recoveryNote
       ].filter(Boolean).join(" ") || void 0
@@ -300940,6 +301142,8 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
   } finally {
     dependencies.signal?.removeEventListener("abort", onCancel);
     if (cancelPublication) await cancelPublication;
+    await installLease?.release().catch(() => {
+    });
     await retryUpdateOwnership(() => withUpdateOwnership(paths, () => releaseMatchingUpdateLock(paths, initial.operation_id))).catch(() => {
     });
   }
@@ -300948,16 +301152,16 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
 // packages/cli/src/tray.ts
 import { spawn as spawn3 } from "node:child_process";
 import {
-  closeSync as closeSync4,
+  closeSync as closeSync5,
   chmodSync as chmodSync2,
   existsSync as existsSync7,
   mkdirSync as mkdirSync6,
-  openSync as openSync4,
-  readFileSync as readFileSync7,
+  openSync as openSync5,
+  readFileSync as readFileSync8,
   realpathSync,
   renameSync as renameSync5,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync5,
+  unlinkSync as unlinkSync5,
+  writeFileSync as writeFileSync6,
   writeSync as writeSync3
 } from "node:fs";
 import { homedir as homedir16, tmpdir as tmpdir6 } from "node:os";
@@ -301082,7 +301286,7 @@ function isProcessAlive2(pid) {
 }
 function readPid(path3) {
   try {
-    const pid = Number(readFileSync7(path3, "utf8").trim());
+    const pid = Number(readFileSync8(path3, "utf8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
@@ -301090,13 +301294,13 @@ function readPid(path3) {
 }
 function readProcessState(path3) {
   try {
-    return JSON.parse(readFileSync7(path3, "utf8"));
+    return JSON.parse(readFileSync8(path3, "utf8"));
   } catch {
     return null;
   }
 }
 async function commandOutput(command, args, timeout = 2e3) {
-  return await new Promise((resolve11) => {
+  return await new Promise((resolve12) => {
     const child = spawn3(command, args, { stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
     let stdout = "";
     let settled = false;
@@ -301104,7 +301308,7 @@ async function commandOutput(command, args, timeout = 2e3) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve11(stdout);
+      resolve12(stdout);
     };
     child.stdout?.on("data", (chunk) => {
       stdout = `${stdout}${chunk.toString()}`.slice(-64 * 1024);
@@ -301124,7 +301328,7 @@ async function commandOutput(command, args, timeout = 2e3) {
 async function processCommandLine(pid) {
   try {
     if (process.platform === "linux") {
-      return readFileSync7(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ");
+      return readFileSync8(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ");
     }
     if (process.platform !== "win32") {
       return (await commandOutput("ps", ["-p", String(pid), "-o", "command="])).trim();
@@ -301143,7 +301347,7 @@ async function getTrayStatus(explicitEndpoint) {
   const running = pid !== null && isProcessAlive2(pid);
   if (pid && !running) {
     try {
-      unlinkSync4(paths.pidFile);
+      unlinkSync5(paths.pidFile);
     } catch {
     }
   }
@@ -301171,11 +301375,11 @@ async function stopTray() {
   const pid = readPid(paths.pidFile);
   if (!pid || !isProcessAlive2(pid)) {
     try {
-      unlinkSync4(paths.pidFile);
+      unlinkSync5(paths.pidFile);
     } catch {
     }
     try {
-      unlinkSync4(paths.stateFile);
+      unlinkSync5(paths.stateFile);
     } catch {
     }
     return false;
@@ -301192,16 +301396,16 @@ async function stopTray() {
   for (let i = 0; i < 30; i++) {
     if (!isProcessAlive2(pid)) {
       try {
-        unlinkSync4(paths.pidFile);
+        unlinkSync5(paths.pidFile);
       } catch {
       }
       try {
-        unlinkSync4(paths.stateFile);
+        unlinkSync5(paths.stateFile);
       } catch {
       }
       return true;
     }
-    await new Promise((resolve11) => setTimeout(resolve11, 100));
+    await new Promise((resolve12) => setTimeout(resolve12, 100));
   }
   if (!trayProcessCommandLooksOwned(await processCommandLine(pid))) return false;
   try {
@@ -301211,16 +301415,16 @@ async function stopTray() {
   for (let i = 0; i < 20; i++) {
     if (!isProcessAlive2(pid)) {
       try {
-        unlinkSync4(paths.pidFile);
+        unlinkSync5(paths.pidFile);
       } catch {
       }
       try {
-        unlinkSync4(paths.stateFile);
+        unlinkSync5(paths.stateFile);
       } catch {
       }
       return true;
     }
-    await new Promise((resolve11) => setTimeout(resolve11, 100));
+    await new Promise((resolve12) => setTimeout(resolve12, 100));
   }
   return false;
 }
@@ -301228,7 +301432,7 @@ async function stopTray() {
 // packages/cli/src/update-worker-runtime.ts
 async function restartTrayWithInstalledExecutable(executable, endpoint) {
   await stopTray();
-  const launched = await new Promise((resolve11) => {
+  const launched = await new Promise((resolve12) => {
     const child = spawn4(executable, ["tray", "start", "--endpoint", endpoint], {
       stdio: "ignore",
       windowsHide: true
@@ -301238,15 +301442,15 @@ async function restartTrayWithInstalledExecutable(executable, endpoint) {
         child.kill();
       } catch {
       }
-      resolve11(false);
+      resolve12(false);
     }, 15e3);
     child.once("error", () => {
       clearTimeout(timer);
-      resolve11(false);
+      resolve12(false);
     });
     child.once("close", (code) => {
       clearTimeout(timer);
-      resolve11(code === 0);
+      resolve12(code === 0);
     });
   });
   if (!launched) return false;
@@ -301254,7 +301458,7 @@ async function restartTrayWithInstalledExecutable(executable, endpoint) {
     const status = await getTrayStatus(endpoint);
     if (status.running && status.ready && status.endpoint === endpoint)
       return true;
-    await new Promise((resolve11) => setTimeout(resolve11, 250));
+    await new Promise((resolve12) => setTimeout(resolve12, 250));
   }
   return false;
 }