omnius 1.0.892 → 1.0.894

package/dist/update-worker-runtime.js

@@ -3243,7 +3243,7 @@ var require_util = __commonJS({
     exports.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
-    function relative2(aRoot, aPath) {
+    function relative3(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -3262,7 +3262,7 @@ var require_util = __commonJS({
       }
       return Array(level + 1).join("../") + aPath.substr(aRoot.length + 1);
     }
-    exports.relative = relative2;
+    exports.relative = relative3;
     var supportsNullProto = (function() {
       var obj = /* @__PURE__ */ Object.create(null);
       return !("__proto__" in obj);
@@ -14693,11 +14693,11 @@ ${lanes.join("\n")}
           return toComponents;
         }
         const components = toComponents.slice(start);
-        const relative2 = [];
+        const relative3 = [];
         for (; start < fromComponents.length; start++) {
-          relative2.push("..");
+          relative3.push("..");
         }
-        return ["", ...relative2, ...components];
+        return ["", ...relative3, ...components];
       }
       function getRelativePathFromDirectory(fromDirectory, to, getCanonicalFileNameOrIgnoreCase) {
         Debug.assert(getRootLength(fromDirectory) > 0 === getRootLength(to) > 0, "Paths must either both be absolute or both be relative");
@@ -59240,9 +59240,9 @@ ${lanes.join("\n")}
               if (!startsWithDirectory(target, realPathDirectory, getCanonicalFileName)) {
                 return;
               }
-              const relative2 = getRelativePathFromDirectory(realPathDirectory, target, getCanonicalFileName);
+              const relative3 = getRelativePathFromDirectory(realPathDirectory, target, getCanonicalFileName);
               for (const symlinkDirectory of symlinkDirectories) {
-                const option = resolvePath(symlinkDirectory, relative2);
+                const option = resolvePath(symlinkDirectory, relative3);
                 const result2 = cb(option, target === referenceRedirect);
                 shouldFilterIgnoredPaths = true;
                 if (result2) return result2;
@@ -218843,7 +218843,7 @@ var require_path_browserify = __commonJS({
           return ".";
         return posix.normalize(joined);
       },
-      relative: function relative2(from, to) {
+      relative: function relative3(from, to) {
         assertPath(from);
         assertPath(to);
         if (from === to) return "";
@@ -221673,12 +221673,12 @@ var require_dist2 = __commonJS({
       return patterns.length > 0 ? buildCrawler(options, patterns) : [];
     }
     async function glob2(globInput, options) {
-      const [crawler, relative2] = getCrawler(globInput, options);
-      return crawler ? formatPaths(await crawler.withPromise(), relative2) : [];
+      const [crawler, relative3] = getCrawler(globInput, options);
+      return crawler ? formatPaths(await crawler.withPromise(), relative3) : [];
     }
     function globSync(globInput, options) {
-      const [crawler, relative2] = getCrawler(globInput, options);
-      return crawler ? formatPaths(crawler.sync(), relative2) : [];
+      const [crawler, relative3] = getCrawler(globInput, options);
+      return crawler ? formatPaths(crawler.sync(), relative3) : [];
     }
     exports.convertPathToPattern = convertPathToPattern;
     exports.escapePath = escapePath;
@@ -300186,18 +300186,20 @@ import {
   fstatSync as fstatSync2,
   fsyncSync as fsyncSync2,
   lstatSync as lstatSync2,
+  readlinkSync as readlinkSync2,
   mkdirSync as mkdirSync5,
   openSync as openSync4,
   readFileSync as readFileSync7,
   readSync as readSync3,
   renameSync as renameSync4,
   statSync as statSync3,
+  symlinkSync,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync5,
   writeSync as writeSync2
 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute7, join as join16, resolve as resolve11 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute7, join as join16, relative as relative2, resolve as resolve11 } from "node:path";
 
 // packages/cli/src/service-version.ts
 var OmniusVersionError = class extends Error {
@@ -300254,8 +300256,8 @@ function compareOmniusVersions(left, right) {
 
 // packages/cli/src/npm-install-recovery.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { closeSync as closeSync3, constants, fstatSync, fsyncSync, lstatSync, openSync as openSync3, readFileSync as readFileSync6, readSync as readSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { lstat, realpath, rename, rm } from "node:fs/promises";
+import { closeSync as closeSync3, constants, fstatSync, fsyncSync, ftruncateSync, lstatSync, openSync as openSync3, readFileSync as readFileSync6, readdirSync, readSync as readSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmod, cp, lstat, mkdir, readdir, realpath, rename, rm } from "node:fs/promises";
 import { basename as basename8, dirname as dirname8, isAbsolute as isAbsolute6, join as join15, resolve as resolve10 } from "node:path";
 var NpmInstallBusyError = class extends Error {
   code = "NPM_INSTALL_BUSY";
@@ -300341,6 +300343,50 @@ async function prepareNpmRetirementSlot(modulesRoot, options = {}) {
   await rename(retired, backup);
   return receipt;
 }
+function bootIdentity() {
+  try {
+    return readFileSync6("/proc/sys/kernel/random/boot_id", "utf8").trim();
+  } catch {
+    return;
+  }
+}
+function updateProcessGroupHasLiveMembers(group) {
+  if (process.platform === "linux") {
+    try {
+      for (const pid of readdirSync("/proc")) {
+        if (!/^\d+$/.test(pid)) continue;
+        let raw;
+        try {
+          raw = readFileSync6(`/proc/${pid}/stat`, "utf8");
+        } catch (error) {
+          if (error.code === "ENOENT" || error.code === "ESRCH") continue;
+          throw error;
+        }
+        const fields = raw.slice(raw.lastIndexOf(")") + 2).trim().split(/\s+/);
+        if (Number(fields[2]) === group && fields[0] !== "Z" && fields[0] !== "X") return true;
+      }
+      return false;
+    } catch {
+      return true;
+    }
+  }
+  try {
+    process.kill(-group, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
+  }
+}
+function installerMayStillRun(owner) {
+  if (!owner.unconfirmed_installer) return false;
+  if (!owner.process_group) return true;
+  if (process.platform === "linux") {
+    const boot = bootIdentity();
+    if (!boot || !owner.process_group_boot_id) return true;
+    if (boot !== owner.process_group_boot_id) return false;
+  }
+  return updateProcessGroupHasLiveMembers(owner.process_group);
+}
 function processIdentity(pid) {
   if (process.platform !== "linux") return;
   try {
@@ -300374,7 +300420,7 @@ function readInstallOwner(path3) {
       throw new NpmInstallBusyError("The npm install owner record is malformed; it was retained.");
     }
     const owner = value;
-    if (!owner || typeof owner !== "object" || Array.isArray(owner) || owner.schema_version !== 1 || typeof owner.nonce !== "string" || !/^[a-f0-9-]{36}$/.test(owner.nonce) || !Number.isSafeInteger(owner.pid) || owner.pid <= 0 || owner.pid > 2147483647 || owner.process_identity !== void 0 && (typeof owner.process_identity !== "string" || !/^[a-f0-9-]{36}:\d+$/.test(owner.process_identity)) || owner.operation_id !== void 0 && (typeof owner.operation_id !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(owner.operation_id)) || Object.keys(owner).some((key) => !["schema_version", "nonce", "pid", "process_identity", "operation_id"].includes(key))) {
+    if (!owner || typeof owner !== "object" || Array.isArray(owner) || owner.schema_version !== 1 || typeof owner.nonce !== "string" || !/^[a-f0-9-]{36}$/.test(owner.nonce) || !Number.isSafeInteger(owner.pid) || owner.pid <= 0 || owner.pid > 2147483647 || owner.process_identity !== void 0 && (typeof owner.process_identity !== "string" || !/^[a-f0-9-]{36}:\d+$/.test(owner.process_identity)) || owner.operation_id !== void 0 && (typeof owner.operation_id !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(owner.operation_id)) || owner.unconfirmed_installer !== void 0 && owner.unconfirmed_installer !== true || owner.process_group !== void 0 && (!Number.isSafeInteger(owner.process_group) || owner.process_group <= 0 || owner.process_group > 2147483647 || owner.unconfirmed_installer !== true) || owner.process_group_boot_id !== void 0 && (typeof owner.process_group_boot_id !== "string" || !/^[a-f0-9-]{36}$/.test(owner.process_group_boot_id) || !owner.process_group) || Object.keys(owner).some((key) => !["schema_version", "nonce", "pid", "process_identity", "operation_id", "unconfirmed_installer", "process_group", "process_group_boot_id"].includes(key))) {
       throw new NpmInstallBusyError("The npm install owner identity is unknown; its lock was retained.");
     }
     return { owner, metadata };
@@ -300383,6 +300429,7 @@ function readInstallOwner(path3) {
   }
 }
 function provedAbsent(owner) {
+  if (installerMayStillRun(owner)) return false;
   try {
     process.kill(owner.pid, 0);
   } catch (error) {
@@ -300464,10 +300511,35 @@ async function acquireNpmInstallLease(modulesRoot, options = {}) {
       assertNotCancelled(options.signal);
       if (!owns()) throw new Error("npm install lease ownership changed; no installer may proceed.");
     },
+    assertOwnedForRecovery() {
+      if (!owns()) throw new Error("npm install lease ownership changed; package recovery was held.");
+    },
+    retainForUnconfirmedInstaller(processGroup) {
+      if (processGroup !== void 0 && (!Number.isSafeInteger(processGroup) || processGroup <= 0 || processGroup > 2147483647))
+        throw new Error("Invalid owned installer process group.");
+      withGuard(() => {
+        if (!owns()) throw new Error("npm install lease ownership changed; installer admission remains held.");
+        const previous = readInstallOwner(lockPath);
+        const owner = {
+          ...previous.owner,
+          unconfirmed_installer: true,
+          ...processGroup ? { process_group: processGroup, ...bootIdentity() ? { process_group_boot_id: bootIdentity() } : {} } : {}
+        };
+        const fd = openSync3(lockPath, constants.O_WRONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+          if (!sameIdentity(lockMetadata, fstatSync(fd))) throw new Error("npm install lease changed before retaining the installer barrier.");
+          ftruncateSync(fd);
+          writeFileSync4(fd, JSON.stringify(owner));
+          fsyncSync(fd);
+        } finally {
+          closeSync3(fd);
+        }
+      });
+    },
     async release() {
       withGuard(() => {
         try {
-          if (owns()) unlinkSync3(lockPath);
+          if (owns() && !installerMayStillRun(readInstallOwner(lockPath).owner)) unlinkSync3(lockPath);
         } catch (error) {
           if (error.code !== "ENOENT") throw error;
         }
@@ -300475,6 +300547,207 @@ async function acquireNpmInstallLease(modulesRoot, options = {}) {
     }
   };
 }
+var REQUIRED_OMNIUS_RUNTIME_FILES = [
+  "package.json",
+  "dist/index.js",
+  "dist/launcher.cjs",
+  "dist/update-worker.js",
+  "dist/update-worker-runtime.js"
+];
+function hashOwnedFile(path3) {
+  const before = lstatSync(path3);
+  const valid = (metadata) => metadata.isFile() && !metadata.isSymbolicLink() && metadata.size > 0 && metadata.size <= 128 * 1024 * 1024 && (process.platform === "win32" || metadata.uid === process.getuid?.() && (metadata.mode & 2) === 0);
+  if (!valid(before)) throw new Error(`Omnius runtime file is missing or unsafe: ${path3}`);
+  const fd = openSync3(path3, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const metadata = fstatSync(fd);
+    if (!valid(metadata) || !sameIdentity(before, metadata)) throw new Error("Omnius runtime file changed during verification.");
+    const hash = createHash2("sha256"), chunk = Buffer.alloc(64 * 1024);
+    let size = 0;
+    for (; ; ) {
+      const count = readSync2(fd, chunk, 0, chunk.length, null);
+      if (!count) break;
+      size += count;
+      if (size > 128 * 1024 * 1024) throw new Error("Omnius runtime file grew during verification.");
+      hash.update(chunk.subarray(0, count));
+    }
+    const after = fstatSync(fd);
+    if (size !== metadata.size || after.size !== metadata.size || after.mtimeMs !== metadata.mtimeMs || after.ctimeMs !== metadata.ctimeMs)
+      throw new Error("Omnius runtime file changed during verification.");
+    return hash.digest("hex");
+  } finally {
+    closeSync3(fd);
+  }
+}
+function inspectNpmRuntimeInstallation(packagePath) {
+  const canonical = resolve10(packagePath), root = dirname8(canonical);
+  if (!isAbsolute6(packagePath) || basename8(canonical) !== "omnius") throw new Error("Runtime verification requires the canonical Omnius package path.");
+  return inspectRuntimeDirectory(canonical, root);
+}
+function inspectRuntimeDirectory(canonical, root) {
+  const before = lstatSync(canonical);
+  assertOwnedDirectory(lstatSync(root), "global modules root");
+  assertOwnedDirectory(before, "Omnius package");
+  assertOwnedDirectory(lstatSync(join15(canonical, "dist")), "Omnius runtime");
+  const files = {};
+  for (const file of REQUIRED_OMNIUS_RUNTIME_FILES) files[file] = hashOwnedFile(join15(canonical, file));
+  const manifest = JSON.parse(readFileSync6(join15(canonical, "package.json"), "utf8"));
+  if (manifest.name !== "omnius" || typeof manifest.version !== "string" || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(manifest.version))
+    throw new Error("Omnius runtime manifest is invalid.");
+  const binTarget = typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.omnius;
+  if (typeof binTarget !== "string" || !/^[A-Za-z0-9_./-]+$/.test(binTarget) || isAbsolute6(binTarget) || binTarget.split("/").some((part) => !part || part === ".." || part === "."))
+    throw new Error("Omnius runtime manifest has no safe declared omnius executable.");
+  for (const directory of binTarget.split("/").slice(0, -1).reduce((paths, part) => [...paths, join15(paths.at(-1) ?? canonical, part)], []))
+    assertOwnedDirectory(lstatSync(directory), "Omnius executable directory");
+  files[binTarget] ??= hashOwnedFile(join15(canonical, binTarget));
+  if (!readFileSync6(join15(canonical, "dist/update-worker.js"), "utf8").includes("omnius.update-worker-bootstrap.v2"))
+    throw new Error("Omnius runtime has no compatible update worker bootstrap.");
+  if (hashOwnedFile(join15(canonical, "package.json")) !== files["package.json"] || !sameIdentity(before, lstatSync(canonical)))
+    throw new Error("Omnius package changed during runtime verification.");
+  return {
+    modulesRoot: root,
+    device: before.dev,
+    inode: before.ino,
+    mode: before.mode & 511,
+    version: manifest.version,
+    packageHash: files["package.json"],
+    binTarget,
+    files
+  };
+}
+async function preserveVerifiedNpmInstallation(snapshot, options) {
+  const root = resolve10(snapshot.modulesRoot), source = join15(root, "omnius");
+  const current = () => {
+    options.lease.assertOwnedForRecovery();
+    options.assertOwned();
+  };
+  assertNotCancelled(options.signal);
+  current();
+  if (root !== options.lease.modulesRoot) throw new Error("Package preservation belongs to a different npm lease.");
+  const before = inspectNpmRuntimeInstallation(source);
+  if (before.device !== snapshot.device || before.inode !== snapshot.inode || before.packageHash !== snapshot.packageHash || JSON.stringify(before.files) !== JSON.stringify(snapshot.files)) throw new Error("Prior runtime changed before preservation.");
+  const backupPath = join15(root, `.omnius-update-recovery-${randomUUID2()}`);
+  await mkdir(backupPath, { mode: 448 });
+  const metadata = await lstat(backupPath);
+  const backup = { modulesRoot: root, retiredPath: retiredNpmPackagePath(source), backupPath, device: metadata.dev, inode: metadata.ino };
+  await options.onPrepare?.({ ...backup });
+  assertNotCancelled(options.signal);
+  current();
+  for (const name of await readdir(source)) {
+    assertNotCancelled(options.signal);
+    current();
+    if (!sameIdentity(metadata, await lstat(backupPath))) throw new Error("Package preservation directory changed during copying.");
+    await cp(join15(source, name), join15(backupPath, name), {
+      recursive: true,
+      errorOnExist: true,
+      force: false,
+      preserveTimestamps: true,
+      verbatimSymlinks: true,
+      mode: constants.COPYFILE_FICLONE
+    });
+  }
+  await chmod(backupPath, 448);
+  current();
+  const installation = inspectRuntimeDirectory(backupPath, root);
+  const original = inspectNpmRuntimeInstallation(source);
+  if (installation.device !== backup.device || installation.inode !== backup.inode || installation.packageHash !== snapshot.packageHash || JSON.stringify(installation.files) !== JSON.stringify(snapshot.files) || original.device !== snapshot.device || original.inode !== snapshot.inode || JSON.stringify(original.files) !== JSON.stringify(snapshot.files)) throw new Error("Copied runtime differs from the verified prior installation.");
+  if (process.platform !== "win32") {
+    const fd = openSync3(root, constants.O_RDONLY);
+    try {
+      fsyncSync(fd);
+    } finally {
+      closeSync3(fd);
+    }
+  }
+  installation.mode = snapshot.mode;
+  return { backup, installation };
+}
+async function restoreVerifiedNpmInstallation(snapshot, options) {
+  const root = resolve10(snapshot.modulesRoot), canonical = join15(root, "omnius");
+  const current = () => {
+    options.lease.assertOwnedForRecovery();
+    options.assertOwned();
+  };
+  current();
+  if (root !== options.lease.modulesRoot || !isAbsolute6(snapshot.modulesRoot)) throw new Error("Package recovery belongs to a different npm lease.");
+  const rootBefore = await lstat(root);
+  assertOwnedDirectory(rootBefore, "global modules root");
+  const validPath = (path3) => path3 === canonical || path3 === retiredNpmPackagePath(canonical) || options.backups?.some((backup) => backup.modulesRoot === root && backup.backupPath === path3 && dirname8(path3) === root && /^\.omnius-update-recovery-[a-f0-9-]{36}$/.test(basename8(path3)));
+  const matches = (path3) => {
+    if (!validPath(path3)) return false;
+    let metadata;
+    try {
+      metadata = lstatSync(path3);
+    } catch (error) {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    }
+    if (metadata.dev !== snapshot.device || metadata.ino !== snapshot.inode) return false;
+    assertOwnedDirectory(metadata, "prior Omnius package");
+    assertOwnedDirectory(lstatSync(join15(path3, "dist")), "prior Omnius runtime");
+    for (const [file, digest] of Object.entries(snapshot.files)) {
+      if (!/^[A-Za-z0-9_./-]+$/.test(file) || isAbsolute6(file) || file.split("/").some((part) => !part || part === "." || part === "..") || hashOwnedFile(join15(path3, file)) !== digest) throw new Error("Prior Omnius runtime changed; restoration was held.");
+    }
+    for (const directory of snapshot.binTarget.split("/").slice(0, -1).reduce((paths, part) => [...paths, join15(paths.at(-1) ?? path3, part)], []))
+      assertOwnedDirectory(lstatSync(directory), "prior Omnius executable directory");
+    return true;
+  };
+  const source = [canonical, retiredNpmPackagePath(canonical), ...(options.backups ?? []).map((backup) => backup.backupPath)].find(matches);
+  if (!source) return null;
+  const recovery = {
+    packagePath: canonical,
+    sourcePath: source,
+    version: snapshot.version,
+    packageHash: snapshot.packageHash,
+    status: source === canonical ? "unchanged" : "restored"
+  };
+  if (source === canonical) return recovery;
+  let partial;
+  try {
+    partial = await lstat(canonical);
+    assertOwnedDirectory(partial, "failed Omnius replacement");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (partial) recovery.partialPath = join15(root, `.omnius-update-recovery-${randomUUID2()}`);
+  await options.onPrepare?.({ ...recovery });
+  current();
+  if (!sameIdentity(rootBefore, await lstat(root)) || !matches(source)) throw new Error("npm recovery identity changed before restoration.");
+  if (partial) {
+    const now = await lstat(canonical);
+    if (!sameIdentity(partial, now)) throw new Error("Failed Omnius replacement changed before preservation.");
+    try {
+      await lstat(recovery.partialPath);
+      throw new Error("Failed-package preservation path is already occupied.");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    current();
+    await rename(canonical, recovery.partialPath);
+  }
+  current();
+  try {
+    await lstat(canonical);
+    throw new Error("Canonical Omnius path changed before restoration.");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (!matches(source)) throw new Error("Prior Omnius runtime changed before restoration.");
+  current();
+  await rename(source, canonical);
+  if (process.platform !== "win32") {
+    const fd = openSync3(root, constants.O_RDONLY);
+    try {
+      fsyncSync(fd);
+    } finally {
+      closeSync3(fd);
+    }
+  }
+  current();
+  if (!matches(canonical)) throw new Error("Restored Omnius runtime failed identity verification.");
+  if (process.platform !== "win32") await chmod(canonical, snapshot.mode);
+  return recovery;
+}
 async function removeVerifiedNpmRetirementBackup(backup) {
   const root = resolve10(backup.modulesRoot);
   if (!isAbsolute6(backup.modulesRoot) || dirname8(backup.backupPath) !== root || !/^\.omnius-update-recovery-[a-f0-9-]{36}$/.test(basename8(backup.backupPath)) || backup.retiredPath !== retiredNpmPackagePath(join15(root, "omnius"))) {
@@ -300788,6 +301061,41 @@ async function runUpdateCommand(command, args, options = {}) {
     const onAbort = () => {
       terminate(new Error("command cancelled"));
     };
+    let settlement;
+    const settleOwnedTree = (result) => settlement ??= (async () => {
+      if (!child.pid) {
+        finish({ ...result, processGroupSettled: true });
+        return;
+      }
+      if (process.platform === "win32") {
+        if (stopping || result.error || result.status !== 0 || result.signal) signalChild("SIGKILL");
+        finish({
+          ...result,
+          processGroupSettled: false,
+          error: result.error ?? new Error("The owned Windows installer tree could not be confirmed stopped; package recovery was held.")
+        });
+        return;
+      }
+      const outlivedParent = updateProcessGroupHasLiveMembers(child.pid);
+      if (outlivedParent || stopping || result.error || result.status !== 0 || result.signal) signalChild("SIGKILL");
+      const deadline = Date.now() + 2e3;
+      while (updateProcessGroupHasLiveMembers(child.pid) && Date.now() < deadline)
+        await new Promise((resolveWait) => setTimeout(resolveWait, 20));
+      if (updateProcessGroupHasLiveMembers(child.pid)) {
+        finish({
+          ...result,
+          processGroupSettled: false,
+          processGroup: child.pid,
+          error: new Error("The owned installer process group could not be confirmed stopped; package recovery was held.")
+        });
+        return;
+      }
+      finish({
+        ...result,
+        processGroupSettled: true,
+        ...outlivedParent && !result.error && result.status === 0 ? { error: new Error("The command exited before its owned subprocess group settled.") } : {}
+      });
+    })();
     options.signal?.addEventListener("abort", onAbort, { once: true });
     if (options.signal?.aborted) onAbort();
     child.stdout?.on("data", (chunk) => {
@@ -300798,10 +301106,11 @@ async function runUpdateCommand(command, args, options = {}) {
       stderr = capture(stderr, chunk);
       options.onStderr?.(chunk.toString());
     });
-    child.once("error", (error) => finish({ status: null, stdout, stderr, signal: null, error }));
+    child.once("error", (error) => {
+      void settleOwnedTree({ status: null, stdout, stderr, signal: null, error });
+    });
     child.once("close", (status, signal) => {
-      if (stopping) signalChild("SIGKILL");
-      finish({ status, stdout, stderr, signal, ...stopError ? { error: stopError } : {} });
+      void settleOwnedTree({ status, stdout, stderr, signal, ...stopError ? { error: stopError } : {} });
     });
     timer = setTimeout(() => {
       terminate(new Error(`command timed out after ${options.timeout ?? 15e3}ms`));
@@ -300830,6 +301139,9 @@ async function inspectGlobalOmniusInstall(expectedVersion, options = {}) {
   if (installedVersion !== expectedVersion) {
     throw new Error(`Global package verification failed: expected ${expectedVersion}, found ${installedVersion || "unknown"}`);
   }
+  const runtime = inspectNpmRuntimeInstallation(dirname9(packageJsonPath));
+  if (runtime.packageHash !== createHash3("sha256").update(packageJsonRaw).digest("hex"))
+    throw new Error("Global Omnius manifest changed during runtime verification");
   const executablePath = globalExecutableCandidates(npmPrefix).find(existsSync6);
   if (!executablePath) throw new Error(`Global Omnius executable not found under ${npmPrefix}`);
   const versionResult = await runCommand(executablePath, ["--version"], { env: options.env, cwd: options.cwd, timeout: 1e4 });
@@ -300895,16 +301207,41 @@ async function installGlobalPackageStreaming(input) {
     onStdout: (text2) => process.stdout.write(text2),
     onStderr: (text2) => process.stderr.write(text2)
   });
-  const exitCode = result.status ?? -1;
+  const exitCode = result.error && result.status === 0 ? -1 : result.status ?? -1;
   const renameCollision = parseNpmRenameCollision(result.stderr);
-  return { exitCode, ...result.error || exitCode !== 0 ? {
+  return { exitCode, settled: result.processGroupSettled !== false, ...result.processGroup ? { processGroup: result.processGroup } : {}, ...result.error || exitCode !== 0 ? {
     error: result.error?.message || result.stderr.slice(-8e3).trim() || `npm install exited with ${result.signal || exitCode}`
   } : {}, ...renameCollision ? { renameCollision } : {} };
 }
+function restoreOmniusExecutableLink(prefix, installation) {
+  const executable = globalExecutableCandidates(prefix)[0];
+  const target = join16(installation.modulesRoot, "omnius", installation.binTarget);
+  if (process.platform === "win32") {
+    if (!existsSync6(executable)) throw new Error("The restored Omnius Windows executable shim is missing.");
+    return;
+  }
+  const directory = dirname9(executable);
+  if (!existsSync6(directory)) mkdirSync5(directory, { recursive: false, mode: 493 });
+  const metadata = lstatSync2(directory);
+  if (!metadata.isDirectory() || metadata.isSymbolicLink() || metadata.uid !== process.getuid?.() || (metadata.mode & 2) !== 0)
+    throw new Error("The Omnius executable directory is unsafe; no link was changed.");
+  try {
+    const existing = lstatSync2(executable);
+    if (!existing.isSymbolicLink() || existing.uid !== process.getuid?.() || resolve11(directory, readlinkSync2(executable)) !== target)
+      throw new Error("A different executable occupies the Omnius bin path; it was retained.");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    symlinkSync(relative2(directory, target), executable);
+  }
+}
 async function runVerifiedUpdateTransaction(initial, dependencies, paths = resolveUpdatePaths()) {
   let state = initial;
   let daemonQuiesced = false;
   let installStarted = false;
+  let installerSettled = true;
+  let packageVerified = false;
+  let previousInstallation;
+  let previousInstallationCopy;
   const retirementBackups = [];
   let installLease;
   let cancelPublication;
@@ -300942,6 +301279,12 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       throw new Error("Update ownership changed before package preparation; no directory was moved.");
     }
   };
+  const assertRecoveryOwned = () => {
+    installLease?.assertOwnedForRecovery();
+    const persisted = readUpdateState(paths);
+    if (!persisted || persisted.operation_id !== state.operation_id || persisted.status !== "running" || state.worker_adopted_at && !ownsAdoptedWorker(persisted, state.operation_id, state.pid, paths))
+      throw new Error("Update ownership changed; package recovery was held.");
+  };
   const preserveRetirement = async (stage, collision) => {
     const options = {
       signal: dependencies.signal,
@@ -300985,8 +301328,33 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
     installLease = await acquireNpmInstallLease(npmRoot, { signal: dependencies.signal, operationId: state.operation_id });
     state = await transition(state, { npm_modules_root: installLease.modulesRoot }, paths);
     assertOwned();
+    try {
+      previousInstallation = inspectNpmRuntimeInstallation(join16(installLease.modulesRoot, "omnius"));
+    } catch {
+    }
     await preserveRetirement("before_install");
     throwIfCancelled();
+    if (previousInstallation) {
+      const preserved = await preserveVerifiedNpmInstallation(previousInstallation, {
+        lease: installLease,
+        signal: dependencies.signal,
+        assertOwned: assertRecoveryOwned,
+        async onPrepare(backup) {
+          state = await transition(state, { npm_recoveries: [...state.npm_recoveries ?? [], {
+            retired_path: backup.retiredPath,
+            backup_path: backup.backupPath,
+            status: "planned",
+            stage: "previous_install",
+            device: backup.device,
+            inode: backup.inode
+          }] }, paths);
+        }
+      });
+      retirementBackups.push(preserved.backup);
+      previousInstallationCopy = preserved.installation;
+      state = await transition(state, { npm_recoveries: state.npm_recoveries.map((item) => item.backup_path === preserved.backup.backupPath ? { ...item, status: "retained" } : item) }, paths);
+      throwIfCancelled();
+    }
     state = await transition(state, { npm_preparation: "ready" }, paths);
     if (dependencies.quiesceDaemon) {
       state = await transition(state, { phase: "daemon_quiescing" }, paths);
@@ -301007,8 +301375,18 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       throwIfCancelled();
       installStarted = true;
       const installResult = await installer({ npmPath, targetVersion: target, env, cwd, signal: dependencies.signal });
-      state = await transition(state, { installer_exit_code: installResult.exitCode }, paths);
+      installerSettled = installResult.settled !== false;
+      if (!installerSettled) {
+        assertRecoveryOwned();
+        installLease.retainForUnconfirmedInstaller(installResult.processGroup);
+      }
+      state = await transition(state, {
+        installer_exit_code: installResult.exitCode,
+        installer_settled: installerSettled,
+        ...installResult.processGroup ? { installer_process_group: installResult.processGroup } : {}
+      }, paths);
       throwIfCancelled();
+      if (!installerSettled) throw new Error(installResult.error || "The owned installer has not settled; package recovery was held.");
       if (installResult.exitCode === 0) break;
       const collision = installResult.renameCollision ?? parseNpmRenameCollision(installResult.error ?? "");
       if (attempt === 1 && collision) {
@@ -301022,6 +301400,7 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
     }
     const evidence = dependencies.inspectInstall ? await dependencies.inspectInstall(target, npmPath, env) : await inspectGlobalOmniusInstall(target, { npmPath, env, cwd });
     throwIfCancelled();
+    packageVerified = true;
     state = await transition(state, {
       phase: "package_verified",
       npm_prefix: evidence.npmPrefix,
@@ -301117,7 +301496,61 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
     const cancelled = error instanceof UpdateCancelledError || dependencies.signal?.aborted === true;
     const message = error instanceof Error ? error.message : String(error);
     let recoveryNote;
-    if (daemonQuiesced && dependencies.recoverDaemon) {
+    let packageRecoveryNote;
+    let restoredPackageVerified = false;
+    if (installStarted && installerSettled && !packageVerified && installLease && previousInstallation) {
+      state = await transition(state, { phase: "recovering" }, paths);
+      const journal = (recovery) => ({
+        version: recovery.version,
+        package_hash: recovery.packageHash,
+        source_path: recovery.sourcePath,
+        ...recovery.partialPath ? { partial_path: recovery.partialPath } : {}
+      });
+      try {
+        const recoveryOptions = {
+          lease: installLease,
+          backups: retirementBackups,
+          assertOwned: assertRecoveryOwned,
+          async onPrepare(recovery) {
+            state = await transition(state, { package_recovery: { status: "planned", ...journal(recovery) } }, paths);
+          }
+        };
+        let recovered;
+        try {
+          recovered = await restoreVerifiedNpmInstallation(previousInstallation, recoveryOptions);
+        } catch (restoreError) {
+          if (!previousInstallationCopy) throw restoreError;
+          recovered = null;
+        }
+        if (!recovered && previousInstallationCopy) recovered = await restoreVerifiedNpmInstallation(previousInstallationCopy, recoveryOptions);
+        if (recovered) {
+          assertRecoveryOwned();
+          restoreOmniusExecutableLink(state.npm_prefix, previousInstallation);
+          const verified = await inspectGlobalOmniusInstall(previousInstallation.version, { npmPath, env, cwd });
+          assertRecoveryOwned();
+          if (verified.packageHash !== previousInstallation.packageHash) throw new Error("Restored Omnius manifest differs from the pre-install verification.");
+          restoredPackageVerified = true;
+          state = await transition(state, {
+            package_recovery: { status: recovered.status, ...journal(recovered) },
+            npm_recoveries: state.npm_recoveries?.map((item) => item.backup_path === recovered.sourcePath ? { ...item, status: "restored" } : item),
+            package_json_path: verified.packageJsonPath,
+            global_executable: verified.executablePath,
+            installed_version: verified.installedVersion,
+            executable_version: verified.executableVersion,
+            installed_package_hash: verified.packageHash
+          }, paths);
+          packageRecoveryNote = recovered.status === "restored" ? `The previous verified Omnius v${verified.installedVersion} installation was restored.${recovered.partialPath ? ` Failed replacement files remain at ${recovered.partialPath}.` : ""}` : `The previous verified Omnius v${verified.installedVersion} installation remains available.`;
+        } else {
+          state = await transition(state, { package_recovery: { status: "unavailable", version: previousInstallation.version } }, paths);
+          packageRecoveryNote = "The exact previous installation was not available for restoration. No rollback was performed.";
+        }
+      } catch (packageError) {
+        const detail = packageError instanceof Error ? packageError.message : String(packageError);
+        state = await transition(state, { package_recovery: { ...state.package_recovery, status: "failed", error: detail } }, paths);
+        packageRecoveryNote = `Package recovery could not be verified: ${detail}`;
+      }
+    }
+    if (daemonQuiesced && dependencies.recoverDaemon && installerSettled && (!installStarted || packageVerified || restoredPackageVerified)) {
       state = await transition(state, { phase: "recovering" }, paths);
       try {
         const recovered = await dependencies.recoverDaemon();
@@ -301125,15 +301558,18 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       } catch (recoveryError) {
         recoveryNote = `Daemon recovery failed: ${recoveryError instanceof Error ? recoveryError.message : String(recoveryError)}`;
       }
+    } else if (daemonQuiesced && dependencies.recoverDaemon) {
+      recoveryNote = "Daemon recovery was held because the installed runtime could not be verified.";
     }
     state = await transition(state, {
       status: cancelled ? "cancelled" : "failed",
       phase: cancelled ? "cancelled" : "failed",
       completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-      error: cancelled ? "Update cancelled after the owned operation settled." : message,
+      error: cancelled ? installerSettled ? "Update cancelled after the owned operation settled." : "Update cancellation requested; owned installer shutdown could not be confirmed." : message,
       remediation: [
-        cancelled && installStarted ? "Package files may have changed. No rollback was performed; verify the installed version before retrying." : void 0,
-        ...(state.npm_recoveries ?? []).filter((item) => item.status === "retained").map((item) => `The prior npm retirement directory is preserved at ${item.backup_path}.`),
+        packageRecoveryNote,
+        cancelled && installStarted && !restoredPackageVerified ? "Package files may have changed. No rollback was performed; verify the installed version before retrying." : void 0,
+        ...(state.npm_recoveries ?? []).filter((item) => item.status === "retained").map((item) => item.stage === "previous_install" ? `The verified prior installation backup is preserved at ${item.backup_path}.` : `The prior npm retirement directory is preserved at ${item.backup_path}.`),
         permissionRemediation(message),
         recoveryNote
       ].filter(Boolean).join(" ") || void 0