papilot 0.8.4 → 0.8.5

package/engine/dist/web/index.html

@@ -9,7 +9,7 @@
       rel="icon"
       href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'%3E%3Crect width='16' height='16' rx='3' fill='%232b6e5c'/%3E%3Cpath d='M4 8.5l2.5 2.5L12 5' stroke='white' stroke-width='2' fill='none'/%3E%3C/svg%3E"
     />
-    <script type="module" crossorigin src="/assets/index-C_KwLmXQ.js"></script>
+    <script type="module" crossorigin src="/assets/index-BCgVChtV.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-D3_ZFdT8.css">
   </head>
   <body>

package/engine/src/client.ts

@@ -157,6 +157,15 @@ export async function connect(
   // Match the canonical repository path reported by the server (e.g. macOS /var).
   root = fs.realpathSync(root);
   const home = serverHome(root);
+  // A reader neither starts nor upgrades the server. Do not wait behind an
+  // upgrader holding start.lock while the job we need to inspect is building.
+  if (!start) {
+    const last = readJson<{ port: number } | null>(path.join(home, "last.json"), null);
+    const info = readJson<Connection | null>(path.join(home, "connection.json"), null)
+      ?? (last ? { url: `http://127.0.0.1:${last.port}`, port: last.port, pid: 0 } : null);
+    const answer = await probe(root, info);
+    return answer ? new Client(info!.url, answer.csrf) : null;
+  }
   return withLock(path.join(home, "start.lock"), async () => {
     const last = readJson<{ port: number } | null>(
       path.join(home, "last.json"),
@@ -171,12 +180,10 @@ export async function connect(
     let answer = await probe(root, info);
     if (
       answer &&
-      (!start ||
-        (answer.version === codeVersion() &&
-          answer.environment === environmentVersion()))
+      answer.version === codeVersion() &&
+      answer.environment === environmentVersion()
     )
       return new Client(info!.url, answer.csrf);
-    if (!start) return null;
     if (answer && info) {
       const deadline = Date.now() + 900000;
       while (answer?.busy && Date.now() < deadline) {

package/engine/src/core/publish.ts

@@ -199,8 +199,22 @@ export class Publisher {
       }),
     );
   }
-  submit(name: string) {
+  submit(name: string, requestId?: string) {
     this.app.tasks.get(name);
+    return this.app.store.transaction(() => this.enqueue(name, requestId));
+  }
+  private enqueue(name: string, requestId?: string) {
+    if (requestId) {
+      const existing = this.app.store.one<Job>("SELECT jobs.* FROM jobs JOIN build_requests ON jobs.id=build_requests.job WHERE build_requests.id=?", requestId);
+      if (existing) {
+        if (existing.task !== name) throw new Error("This build request belongs to another task.");
+        return existing;
+      }
+    }
+    const remember = (job: Job) => {
+      if (requestId) this.app.store.execute("INSERT INTO build_requests(id,task,job) VALUES(?,?,?)", requestId, name, job.id);
+      return job;
+    };
     if (this.stopping)
       throw new Error(
         "The review server is stopping. Publish again after it restarts.",
@@ -208,7 +222,7 @@ export class Publisher {
     const current = this.pending.get(name);
     if (current) {
       const job = this.job(current);
-      if (job.status === "queued") return job;
+      if (job.status === "queued") return remember(job);
     }
     const id = randomBytes(8).toString("hex");
     this.app.store.execute(
@@ -220,7 +234,7 @@ export class Publisher {
     this.pending.set(name, id);
     if (!this.running.has(name)) this.queue.push(id);
     queueMicrotask(() => this.drain());
-    return this.job(id);
+    return remember(this.job(id));
   }
   job(id: string) {
     const job = this.app.store.one<Job>("SELECT * FROM jobs WHERE id=?", id);

package/engine/src/core/store.ts

@@ -10,6 +10,7 @@ CREATE TABLE IF NOT EXISTS actions(seq INTEGER PRIMARY KEY AUTOINCREMENT,id TEXT
 CREATE TABLE IF NOT EXISTS writes(action TEXT NOT NULL,phase TEXT NOT NULL,path TEXT NOT NULL,expected BLOB,target BLOB,PRIMARY KEY(action,phase,path));
 CREATE TABLE IF NOT EXISTS messages(id INTEGER PRIMARY KEY AUTOINCREMENT,task TEXT NOT NULL,round INTEGER,kind TEXT NOT NULL,action TEXT,body TEXT NOT NULL DEFAULT '',data TEXT NOT NULL DEFAULT '{}',created REAL NOT NULL);
 CREATE TABLE IF NOT EXISTS jobs(id TEXT PRIMARY KEY,task TEXT NOT NULL,status TEXT NOT NULL,phase TEXT NOT NULL DEFAULT '',result TEXT NOT NULL DEFAULT '{}',created REAL NOT NULL,finished REAL);
+CREATE TABLE IF NOT EXISTS build_requests(id TEXT PRIMARY KEY,task TEXT NOT NULL,job TEXT NOT NULL);
 CREATE INDEX IF NOT EXISTS actions_by_task ON actions(task,round);
 CREATE INDEX IF NOT EXISTS messages_by_task ON messages(task,id);
 CREATE INDEX IF NOT EXISTS jobs_by_task ON jobs(task,created);`;

package/engine/src/server.ts

@@ -331,11 +331,12 @@ export function createServer(app: App) {
         );
       },
     );
-    server.post<{ Params: { name: string } }>(
+    server.post<{ Params: { name: string }; Body: { requestId?: string } }>(
       "/api/tasks/:name/publish",
+      { schema: { body: { ...objectSchema, properties: { requestId: { type: "string", pattern: "^[a-zA-Z0-9-]{1,80}$" } } } } },
       (request) => {
         app.delivery.assertReady(request.params.name);
-        const job = app.publisher.submit(request.params.name);
+        const job = app.publisher.submit(request.params.name, request.body?.requestId);
         return { job: job.id, status: job.status };
       },
     );

package/engine/src/web/review.tsx

@@ -171,7 +171,12 @@ export function ReviewApp({
   const paper = useRef<HTMLElement>(null),
     epoch = useRef(0),
     scrollUntil = useRef(0),
+    // How far into the current change the author had read, restored once
+    // when the review reopens on it in the same view.
+    returning = useRef<{ index: number; offset: number; paper: boolean } | null>(null),
     snapshot = useRef({ state, detail, busy, composer, current });
+  // Where each review was left; a host's uncommitted changes are kept per paper.
+  const placeKey = `latex-review:${changes ? `changes:${location.pathname}` : task}`;
   const [shortcuts, setShortcuts] = useState(readShortcuts);
   // The whole paper with the changes in place, or the changed sections only.
   // A host may fix the view in the address (Papilot's manuscript chooses its
@@ -339,8 +344,9 @@ export function ReviewApp({
   }
   function select(index: number, scroll = true) {
     if (index < 0 || index >= stops.length) return;
+    if (scroll) returning.current = null;
     setCurrent(index);
-    store(`latex-review:${task}`, {
+    store(placeKey, {
       round: detail?.round,
       stop: stops[index].key,
     });
@@ -355,15 +361,34 @@ export function ReviewApp({
       });
     }
   }
-  function reveal(article: HTMLElement, behavior: ScrollBehavior = "instant") {
-    const root = paper.current;
-    if (!root) return;
+  // How far the paper is scrolled past the top of a change; 0 when revealed.
+  function past(article: HTMLElement) {
+    const root = paper.current!;
     // scrollIntoView also scrolls ancestors across the embedding iframe.
     // Navigation belongs to the paper, independently of the host's Chat.
     const padding = parseFloat(getComputedStyle(root).scrollPaddingTop) || 0;
     const margin = parseFloat(getComputedStyle(article).scrollMarginTop) || 0;
-    root.scrollTo({ top: root.scrollTop + article.getBoundingClientRect().top - root.getBoundingClientRect().top - padding - margin, behavior });
+    return root.getBoundingClientRect().top + padding + margin - article.getBoundingClientRect().top;
   }
+  function reveal(article: HTMLElement, behavior: ScrollBehavior = "instant") {
+    const root = paper.current;
+    if (!root) return;
+    const index = Number(article.dataset.stop), back = returning.current;
+    let offset = 0;
+    if (back && back.index === index && back.paper === paperView) { offset = back.offset; returning.current = null; }
+    root.scrollTo({ top: root.scrollTop - past(article) + offset, behavior });
+  }
+  // The place within the current change is kept as the author reads on.
+  function remember(index: number) {
+    const article = paper.current?.querySelector<HTMLElement>(`[data-stop="${index}"]`);
+    if (!article || !stops[index]) return;
+    store(placeKey, { round: detail?.round, stop: stops[index].key, offset: Math.round(past(article)), paper: paperView });
+  }
+  // Reading into the next change makes it current, which resizes its header;
+  // measure the place again once it has, unless a reveal is on its way.
+  useEffect(() => {
+    if (current >= 0 && !returning.current && Date.now() >= scrollUntil.current && paper.current?.scrollTop) remember(current);
+  }, [current]);
   useEffect(() => {
     let cancelled = false,
       timer: ReturnType<typeof setTimeout>;
@@ -401,8 +426,8 @@ export function ReviewApp({
           )
             return;
           const nextStops = buildStops(loaded),
-            saved = readStorage<{ round?: number; stop?: string }>(
-              `latex-review:${task}`,
+            saved = readStorage<{ round?: number; stop?: string; offset?: number; paper?: boolean }>(
+              placeKey,
               {},
             );
           let index =
@@ -416,6 +441,10 @@ export function ReviewApp({
             index = nextPending(nextStops, loadedState.decisions, index);
           if (linkedChange >= 0 && nextStops[linkedChange]) index = linkedChange;
           if (index < 0) index = pinned && nextStops.length ? 0 : -1;
+          returning.current =
+            !previous.detail && index >= 0 && saved.round === target && nextStops[index].key === saved.stop && saved.offset
+              ? { index, offset: saved.offset, paper: Boolean(saved.paper) }
+              : null;
           if (
             previous.detail &&
             loaded.round !== previous.detail.round &&
@@ -676,6 +705,7 @@ export function ReviewApp({
         });
     const index = visibleStop(regions, current, box.top + 60, box.bottom - 100);
     if (index !== current) select(index, false);
+    if (index >= 0) remember(index);
   }
   const actionBar = (index: number) => {
     if (index !== current || !state) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "papilot",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "A Cursor-like workspace for your papers: annotate and review PDFs directly without ever touching LaTeX.",
   "keywords": [
     "latex",
@@ -71,7 +71,7 @@
     "doctor": "node bin/papilot.mjs doctor",
     "service:install": "tsx scripts/service.ts install",
     "service:stop": "tsx scripts/service.ts stop",
-    "test:ui": "npm run build && node scripts/check-ui.mjs && node scripts/check-task-model.mjs && node scripts/check-appearance.mjs && node scripts/check-updates.mjs && node scripts/check-papers.mjs && node scripts/check-imports.mjs && node scripts/check-compilation.mjs && node scripts/check-build-problems.mjs && node scripts/check-review-notes.mjs && node --import tsx scripts/check-note-groups.mjs && node scripts/check-note-selection.mjs && node scripts/check-ai-review.mjs && node --import tsx scripts/check-note-results.mjs && node --import tsx scripts/check-review-flow.mjs && node scripts/check-skills.mjs && node --import tsx scripts/check-skill-library.mjs && node scripts/check-attachments.mjs && node --import tsx scripts/check-accounts.mjs",
+    "test:ui": "npm run build && node scripts/check-ui.mjs && node scripts/check-task-model.mjs && node scripts/check-appearance.mjs && node scripts/check-updates.mjs && node scripts/check-papers.mjs && node scripts/check-imports.mjs && node scripts/check-compilation.mjs && node scripts/check-build-problems.mjs && node scripts/check-review-notes.mjs && node --import tsx scripts/check-note-groups.mjs && node scripts/check-note-selection.mjs && node scripts/check-ai-review.mjs && node --import tsx scripts/check-note-results.mjs && node --import tsx scripts/check-review-flow.mjs && node scripts/check-skills.mjs && node --import tsx scripts/check-skill-library.mjs && node scripts/check-attachments.mjs && node --import tsx scripts/check-accounts.mjs && node --import tsx scripts/check-places.mjs && node scripts/check-pdf-words.mjs",
     "site": "node scripts/build-site.mjs",
     "test:site": "npm run site && node scripts/check-site.mjs",
     "prepack": "npm run build && npm run setup:review",

package/src/server/agents.ts

@@ -126,10 +126,11 @@ export function claudeConfigured(env: NodeJS.ProcessEnv = process.env) {
 // Agent SDKs carry large native parts, so an installed Papilot fetches one
 // into the data folder the first time its agent can be used. ready() runs
 // before the download and throws when the agent is not configured.
+const PACKAGES = path.join(DATA, 'agents');
 export async function loadPackage(name: string, version: string, label: string, ready: () => void = () => {}): Promise<any> {
   try { return await import(name); }
   catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ERR_MODULE_NOT_FOUND') throw error; }
-  const prefix = path.join(DATA, 'agents'), resolve = () => createRequire(path.join(prefix, 'package.json')).resolve(name);
+  const prefix = PACKAGES, resolve = () => createRequire(path.join(prefix, 'package.json')).resolve(name);
   let entry: string;
   try { entry = resolve(); } catch {
     ready();
@@ -139,6 +140,14 @@ export async function loadPackage(name: string, version: string, label: string,
   }
   return import(pathToFileURL(entry).href);
 }
+// The file a package loaded from: Papilot's own dependencies, or the copy
+// fetched on first use.
+export function packageFile(name: string) {
+  for (const from of [import.meta.url, path.join(PACKAGES, 'package.json')]) {
+    try { return createRequire(from).resolve(name); } catch { /* Not installed there. */ }
+  }
+  return null;
+}
 
 let claude: Promise<typeof import('@anthropic-ai/claude-agent-sdk')['query']> | null = null;
 // The Claude Agent SDK carries Claude Code. GLM runs on it too.

package/src/server/app.ts

@@ -12,7 +12,7 @@ import { reviewClient, allowedReviewRoute, rewriteReviewHtml, rewriteReviewJson,
 import { fullPaperPdf } from './pdf.ts';
 import { type ChangeAction, Changes } from './changes.ts';
 import { bibliography, confirmEntry } from './references.ts';
-import { type Manuscripts, annotationTask, gitAbortMerge, gitCommit, gitDiff, gitFinishMerge, gitIgnore, gitRemote, gitStage, gitStatus } from './manuscript.ts';
+import { type Manuscripts, annotationTask, gitAbortMerge, gitCommit, gitDiff, gitDiscard, gitFinishMerge, gitIgnore, gitRemote, gitStage, gitStatus } from './manuscript.ts';
 import { gitOverview } from './git-overview.ts';
 import { findSkill, listedSkill, loadSkills } from './skills.ts';
 import { registerSkillRoutes } from './skill-routes.ts';
@@ -315,6 +315,11 @@ export async function buildApp(options: AppOptions) {
     const project = store.project(request.params.id), b = request.body as any;
     return serialGit(project.id, async () => ({ git: await gitStage(project.path, paths(b.paths), b.stage !== false) }));
   });
+  // The Git panel confirms before discarding; this cannot be undone.
+  app.post<{ Params: { id: string } }>('/api/projects/:id/git/discard', project(), request => {
+    const project = store.project(request.params.id), b = request.body as any;
+    return serialGit(project.id, async () => ({ git: await gitDiscard(project.path, paths(b.paths)) }));
+  });
   // An agent writes a commit message for the chosen files, or a fresh one
   // instead of the message it already wrote for them; nothing is written.
   app.post<{ Params: { id: string } }>('/api/projects/:id/git/message', project(), request => {

package/src/server/cursor.ts

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { Adapter, loadPackage, toolItem, type Item, type Thread, type Turn } from './agents.ts';
+import { Adapter, loadPackage, packageFile, toolItem, type Item, type Thread, type Turn } from './agents.ts';
 import { imageType } from './attachments.ts';
 import { DATA } from './paths.ts';
 
@@ -27,10 +27,29 @@ export function cursorConfigured(env: NodeJS.ProcessEnv = process.env) {
 let cursor: Promise<CursorSdk> | null = null;
 export function loadCursor() {
   cursor ??= loadPackage('@cursor/sdk', CURSOR_SDK_VERSION, 'the Cursor SDK for Cursor tasks', () => { if (!cursorConfigured()) throw new Error(CURSOR_KEY); })
+    .then(sdk => { const file = packageFile('@cursor/sdk'); return file ? helpersBesideSdk(sdk, file) : sdk; })
     .catch(error => { cursor = null; throw error; });
   return cursor;
 }
 
+// The SDK looks for its platform helpers (the cursorsandbox binary, rg and the
+// shell parser) in node_modules folders above the running script, not beside
+// itself, and loads them as a run starts. The copy Papilot fetches on first
+// use sits in the data folder, outside that search, so every sandboxed run
+// failed as "not supported in this environment". While a run starts, the
+// search begins at the SDK's own file.
+let starting = 0, script: string | undefined;
+export function helpersBesideSdk(sdk: CursorSdk, file: string): CursorSdk {
+  const fromSdk = async <T>(start: () => Promise<T>) => {
+    if (starting++ === 0) { script = process.argv[1]; process.argv[1] = file; }
+    try { return await start(); } finally { if (--starting === 0) process.argv[1] = script as string; }
+  };
+  const wrap = (agent: CursorAgentHandle): CursorAgentHandle => ({
+    agentId: agent.agentId, close: () => agent.close(), send: (message, options) => fromSdk(() => agent.send(message, options)),
+  });
+  return { Cursor: sdk.Cursor, Agent: { create: async options => wrap(await sdk.Agent.create(options)), resume: async (id, options) => wrap(await sdk.Agent.resume(id, options)) } };
+}
+
 // Effort is a model parameter in Cursor's catalog.
 const effortParameter = (model?: CursorModel) => model?.parameters?.find(parameter => /effort|reasoning/i.test(parameter.id));
 

package/src/server/git-overview.ts

@@ -50,11 +50,15 @@ export async function gitOverview(root: string, tasks: Pick<Task, 'id' | 'worktr
     }
   }));
   worktrees.sort((a, b) => Number(b.current) - Number(a.current));
-  const refs = new Map<string, string[]>();
-  const refOutput = await git(root, ['for-each-ref', '--format=%(objectname)%00%(refname:short)%00%(*objectname)', 'refs/heads', 'refs/remotes', 'refs/tags']);
+  const refs = new Map<string, { refs: string[]; remotes: string[]; tags: string[] }>();
+  const refOutput = await git(root, ['for-each-ref', '--format=%(objectname)%00%(refname)%00%(refname:short)%00%(*objectname)', 'refs/heads', 'refs/remotes', 'refs/tags']);
   for (const line of refOutput.trim().split('\n').filter(Boolean)) {
-    const [object, name, peeled] = line.split('\0'), hash = peeled || object;
-    refs.set(hash, [...(refs.get(hash) || []), name]);
+    const [object, full, name, peeled] = line.split('\0'), hash = peeled || object;
+    // A remote's HEAD only names its default branch, which is listed anyway.
+    if (full.startsWith('refs/remotes/') && full.endsWith('/HEAD')) continue;
+    const entry = refs.get(hash) || { refs: [], remotes: [], tags: [] };
+    (full.startsWith('refs/heads/') ? entry.refs : full.startsWith('refs/remotes/') ? entry.remotes : entry.tags).push(name);
+    refs.set(hash, entry);
   }
   // Include detached worktree tips, which --branches alone would miss.
   const heads = [...new Set(worktrees.flatMap(tree => tree.head ? [tree.head] : []))];
@@ -63,7 +67,7 @@ export async function gitOverview(root: string, tasks: Pick<Task, 'id' | 'worktr
   const log = await git(root, ['log', '--topo-order', `-${limit + 1}`, '--format=%H%x00%P%x00%s%x00%an%x00%ct', '--branches', '--remotes', '--tags', ...heads, '--']);
   const commits: GitGraphCommit[] = log.trim().split('\n').filter(Boolean).map(line => {
     const [hash, parents, subject, author, date] = line.split('\0');
-    return { hash, parents: parents ? parents.split(' ') : [], subject, author, date: Number(date) * 1000, refs: refs.get(hash) || [] };
+    return { hash, parents: parents ? parents.split(' ') : [], subject, author, date: Number(date) * 1000, refs: [], remotes: [], tags: [], ...refs.get(hash) };
   });
   return { worktrees, commits: commits.slice(0, limit), truncated: commits.length > limit };
 }

package/src/server/manuscript.ts

@@ -47,8 +47,9 @@ export function parseStatus(output: string, numstat: string): Omit<GitStatus, 'h
       // A rename or copy is followed by its original path.
       const from = kind === '2' ? fields[++i] : undefined;
       const code = kind === 'u' ? 'U' : xy[1] !== '.' ? xy[1] : xy[0];
-      // X is the index against HEAD, Y the working tree against the index.
-      status.files.push({ path: file, status: code, staged: xy[0] !== '.', unstaged: xy[1] !== '.', lines: lines.get(file), ...(from ? { from } : {}) });
+      // X is the index against HEAD, Y the working tree against the index. The
+      // staged list shows X where it differs, such as a new file edited again.
+      status.files.push({ path: file, status: code, staged: xy[0] !== '.', unstaged: xy[1] !== '.', lines: lines.get(file), ...(from ? { from } : {}), ...(xy[0] !== '.' && xy[0] !== code ? { index: xy[0] } : {}) });
     }
   }
   return status;
@@ -147,6 +148,24 @@ export async function gitStage(root: string, paths: string[], stage: boolean) {
   return gitStatus(root);
 }
 
+// Discard what the Changes list shows for these files, as an editor's source
+// control does: a tracked file returns to its staged version, or the last
+// commit, and an untracked file is deleted. Staged changes stay.
+export async function gitDiscard(root: string, paths: string[]) {
+  const status = await gitStatus(root);
+  if (status.merging) throw new Error('Finish or abort the merge before discarding changes.');
+  const files = status.files.filter(item => paths.includes(item.path) && item.unstaged);
+  if (!files.length) throw new Error('Select at least one changed file.');
+  const tracked = files.filter(item => item.status !== '?').map(item => item.path);
+  if (tracked.length) await gitAction(root, ['checkout', '--', ...tracked]);
+  for (const item of files.filter(item => item.status === '?')) {
+    const file = path.resolve(root, item.path);
+    if (!file.startsWith(root + path.sep)) throw new Error('Invalid file path.');
+    fs.rmSync(file, { force: true });
+  }
+  return gitStatus(root);
+}
+
 // Commit what is staged, or with paths, exactly those files as they are on
 // disk; changes staged for other files then stay staged and out of the commit.
 export async function gitCommit(root: string, message: string, paths: string[] | null) {

package/src/server/review.ts

@@ -4,12 +4,17 @@ import { ENGINE } from './paths.ts';
 import type { Task } from '../shared.ts';
 
 export interface ReviewClient { url: string; token: string; get<T = any>(route: string): Promise<T>; post<T = any>(route: string, body?: unknown, timeout?: number): Promise<T> }
-let modulePromise: Promise<{ connect: (root: string) => Promise<ReviewClient> }> | null = null;
-export function reviewClient(root: string): Promise<ReviewClient> {
+let modulePromise: Promise<{ connect: (root: string, start?: boolean) => Promise<ReviewClient | null> }> | null = null;
+export function reviewClient(root: string, reuse = false): Promise<ReviewClient> {
   modulePromise ??= import(pathToFileURL(path.join(ENGINE, 'src/client.ts')).href);
-  return modulePromise!.then(module => module.connect(root));
+  // Polling an existing job must not replace a healthy server of another version.
+  return modulePromise!.then(async module => (reuse && await module.connect(root, false)) || (await module.connect(root))!);
 }
 export const taskRoute = (name: string) => `/api/tasks/${encodeURIComponent(name)}`;
+export function reviewConnectionError(error: unknown): boolean {
+  if (!(error instanceof Error)) return false;
+  return ['AbortError', 'TimeoutError'].includes(error.name) || /fetch failed|ECONNREFUSED|ECONNRESET|socket hang up|The review server failed to start/.test(error.message);
+}
 
 export function confirmedReviewResponse(status: number, value: unknown, task: string): boolean {
   if (!value || typeof value !== 'object') return false;

package/src/server/start.ts

@@ -21,8 +21,13 @@ const accounts = new Accounts(store, ACCOUNT_ORIGIN || null);
 const manuscripts = new Manuscripts(), changes = new Changes();
 const desktop = process.env.PAPILOT_DESKTOP === '1';
 if (desktop) await desktopDemo(ROOT, DATA, store, workspace, manuscripts).catch(error => console.error('Could not prepare the demo paper:', error));
-// Desktop releases are complete installers; npm updates belong to the web server.
-const updates = new Updates({ root: ROOT, data: DATA, version: VERSION, port: PORT, desktop,
+// A packaged desktop app downloads only Papilot's own code built for its
+// installer (see desktop/runtime.ts) and asks the app to switch to it. npm
+// updates belong to the web server.
+const bundleRoot = desktop && process.send ? process.env.PAPILOT_DESKTOP_BUNDLE : undefined, fingerprint = process.env.PAPILOT_DESKTOP_FINGERPRINT || '';
+const bundle = bundleRoot && fingerprint ? { root: bundleRoot, version: readJson(path.join(bundleRoot, 'package.json'))?.version || '', fingerprint } : undefined;
+const updates = new Updates({ root: ROOT, data: DATA, version: VERSION, port: PORT, desktop, bundle,
+  ...(bundle ? { restart: async (root: string, version: string) => { process.send!({ type: 'papilot:activate', root, version }); } } : {}),
   busy: () => workspace.busyForUpdate || manuscripts.busyForUpdate || changes.busyForUpdate, shutdown: () => shutdown() });
 const activation = desktop ? null : readJson(path.join(DATA, 'updates/active.json'));
 const updateInstance = typeof activation?.root === 'string' && fs.existsSync(activation.root) && fs.realpathSync(activation.root) === fs.realpathSync(ROOT) ? activation.id : undefined;
@@ -46,7 +51,9 @@ console.log(`Papilot is running at ${localUrl}${PUBLIC_ORIGIN ? `\nRemote: ${PUB
 if (!process.env.PAPILOT_UPDATE_PROBE) { void workspace.connect(); updates.start(); }
 // Recompute cached feedback counts, including decisions from before this restart.
 for (const task of store.tasks()) {
-  if (task.status === 'building') {
+  if (task.pendingBuild || (task.review?.job?.id && (task.status === 'building' || (task.status === 'failed' && task.error === 'fetch failed')))) {
+    void workspace.resumeBuild(task.id);
+  } else if (task.status === 'building') {
     store.updateTask(task.id, { status: 'interrupted', error: 'The server restarted during the PDF build. Check the review and rebuild it if needed.' });
     void workspace.refresh(task.id);
   } else if (task.review?.round && task.status !== 'deleting') void workspace.refresh(task.id);

package/src/server/update-install.ts

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import net from 'node:net';
 import { execFile, spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { promisify } from 'node:util';
 import { createRequire } from 'node:module';
 import { devRevision, readJson, stableVersion } from '../../bin/installation.mjs';
@@ -102,6 +103,62 @@ async function installDev(data: string, version: string) {
   } catch (error) { fs.rmSync(stage, { recursive: true, force: true }); throw error; }
   finally { fs.closeSync(log); }
 }
+const INSTALL_FAILED = 'The new version could not be installed. Check the connection and available disk space, then retry.';
+// Release assets redirect from github.com to GitHub's download hosts. Each hop
+// stays on HTTPS and on those hosts (or on the smoke test's local source).
+export async function download(url: string, fetcher: typeof fetch, limit: number) {
+  const source = process.env.PAPILOT_DESKTOP_UPDATE_SOURCE ? new URL(process.env.PAPILOT_DESKTOP_UPDATE_SOURCE).origin : null;
+  const trusted = (address: URL) => address.origin === source
+    || address.protocol === 'https:' && (address.hostname === 'github.com' || address.hostname.endsWith('.githubusercontent.com'));
+  let address = new URL(url);
+  for (let hop = 0; hop < 5; hop++) {
+    if (!trusted(address)) throw new Error(INSTALL_FAILED);
+    const response = await fetcher(address.href, { signal: AbortSignal.timeout(300000), redirect: 'manual', headers: { Accept: 'application/octet-stream', 'User-Agent': 'Papilot' } });
+    const location = response.headers.get('location');
+    if (response.status >= 300 && response.status < 400 && location) { address = new URL(location, address); continue; }
+    if (!response.ok || Number(response.headers.get('content-length') || 0) > limit) throw new Error(INSTALL_FAILED);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.length > limit) throw new Error(INSTALL_FAILED);
+    return bytes;
+  }
+  throw new Error(INSTALL_FAILED);
+}
+export interface DesktopLayer { url: string; size: number; sha256: string }
+// As in desktop/runtime.ts: a layer runs on the installer's dependencies.
+function linkBundle(root: string, bundle: string) {
+  for (const folder of ['node_modules', 'engine/node_modules']) {
+    const target = path.join(bundle, folder), link = path.join(root, folder);
+    if (!fs.existsSync(target) || !fs.existsSync(path.dirname(link))) continue;
+    fs.rmSync(link, { recursive: true, force: true });
+    fs.symlinkSync(target, link, 'dir');
+  }
+}
+// The desktop app downloads only Papilot's own code, built by the release
+// workflow for this installer's shell, and checks that it starts. The app then
+// switches to it (desktop/runtime.ts).
+export async function installLayer(data: string, version: string, layer: DesktopLayer, bundle: { root: string; fingerprint: string }, fetcher = fetch) {
+  const layers = path.join(data, 'updates/desktop/layers'); fs.mkdirSync(layers, { recursive: true, mode: 0o700 });
+  const stage = fs.mkdtempSync(path.join(layers, version + '-')), root = path.join(stage, 'papilot'), archive = path.join(stage, 'layer.tgz');
+  const log = fs.openSync(path.join(data, 'updates/desktop/install.log'), 'a', 0o600);
+  try {
+    const bytes = await download(layer.url, fetcher, layer.size);
+    if (bytes.length !== layer.size || createHash('sha256').update(bytes).digest('hex') !== layer.sha256) throw new Error(INSTALL_FAILED);
+    fs.writeFileSync(archive, bytes, { mode: 0o600 });
+    fs.mkdirSync(root);
+    await promisify(execFile)('tar', ['-xzf', archive, '-C', root, '--strip-components=1'], { timeout: 120000 });
+    fs.rmSync(archive);
+    const pkg = readJson(path.join(root, 'package.json')), shell = readJson(path.join(root, 'desktop-layer.json'));
+    if (pkg?.name !== 'papilot' || pkg.version !== version || shell?.version !== version) throw new Error('The downloaded package does not match the requested release.');
+    if (shell.fingerprint !== bundle.fingerprint) throw new Error('Download desktop updates from GitHub Releases.');
+    for (const file of ['dist/index.html', 'src/server/start.ts', 'src/server/main.ts', 'engine/package.json']) {
+      if (!fs.existsSync(path.join(root, file))) throw new Error('The downloaded release is incomplete.');
+    }
+    linkBundle(root, bundle.root);
+    await probeInstallation(root, version, stage, log);
+    return root;
+  } catch (error) { fs.rmSync(stage, { recursive: true, force: true }); throw error; }
+  finally { fs.closeSync(log); }
+}
 export async function installRelease(data: string, version: string) {
   if (process.env.PAPILOT_DESKTOP === '1') throw new Error('Download desktop updates from GitHub Releases.');
   if (devRevision(version)) return installDev(data, version);