relay-companion 0.1.573 → 0.1.574

package/bootstrap/application-handoff.cjs

@@ -88,6 +88,13 @@ async function handoffApplication({ activationEnabled = false, envelope, version
   const target = { version, sourceSha }, transactionId = `application_${sourceSha}_${platformKey}`;
   let lock, releaseDrain, snapshot, location;
   const current = () => read(pointerPath);
+  // The runtime this handoff leaves running: the application's own, or a newer
+  // one already running under an installed Relay app, which only the app replaces.
+  const expectedRuntime = () => {
+    snapshot ||= read(snapshotFile);
+    const kept = snapshot?.previous?.version;
+    return /^\d+\.\d+\.\d+$/.test(kept || "") && lifecycle.versionCompare(kept, payload.runtime.version) > 0 ? kept : payload.runtime.version;
+  };
   const adapters = {
     lock() {
       lock = bootstrap.acquireCanonicalLock(path.join(base, "runtime", "transaction.lock"));
@@ -103,8 +110,11 @@ async function handoffApplication({ activationEnabled = false, envelope, version
       snapshot = read(snapshotFile);
       // Another updater may have advanced after an interrupted handoff. Never
       // turn an old journal into authorization to roll that newer runtime back.
-      if (lifecycle.versionCompare(active.version, payload.runtime.version) > 0) return { ok: false, preserveCurrent: true, reason: "newer-runtime-preserved" };
       const owner = applicationOwner({ homeDir, platform });
+      // The runtime updates itself far more often than the app. Where an app
+      // already owns Relay, a newer runtime stays and only the app is replaced;
+      // a legacy installation is never moved to an app older than its runtime.
+      if (!owner && lifecycle.versionCompare(active.version, payload.runtime.version) > 0) return { ok: false, preserveCurrent: true, reason: "newer-runtime-preserved" };
       if (owner && lifecycle.versionCompare(owner.installedPackageVersion, version) > 0) return { ok: false, preserveCurrent: true, reason: "newer-application-preserved" };
       if (snapshot && active.packageRoot !== snapshot.previous?.packageRoot
         && !(owner?.packagingSourceSha === sourceSha && active.version === payload.runtime.version)) return { ok: false, preserveCurrent: true, reason: "another-runtime-transaction-preserved" };
@@ -149,16 +159,16 @@ async function handoffApplication({ activationEnabled = false, envelope, version
       const active = current();
       const owner = applicationOwner({ homeDir, platform });
       return { ok: owner?.packagingSourceSha === sourceSha && owner.installedPackageVersion === version
-        && active?.version === payload.runtime.version && (await health(active, { platform })).ok };
+        && active?.version === expectedRuntime() && (await health(active, { platform })).ok };
     },
-    verifyRecovery: () => verifyRecovery({ homeDir, platform, version: payload.runtime.version }),
-    observeStability: () => ready({ homeDir, platform, target: { version: payload.runtime.version, packageRoot: current()?.packageRoot }, requireProgress: true }),
+    verifyRecovery: () => verifyRecovery({ homeDir, platform, version: expectedRuntime() }),
+    observeStability: () => ready({ homeDir, platform, target: { version: expectedRuntime(), packageRoot: current()?.packageRoot }, requireProgress: true }),
     async restorePrevious() {
       snapshot ||= read(snapshotFile);
       const previous = snapshot?.previous;
       if (!previous || !nativeLocationInside(path.join(base, "runtime", "releases"), previous.packageRoot)
         || !nativeLocationInside(previous.packageRoot, previous.bin)) return { ok: false };
-      if (current()?.active && lifecycle.versionCompare(current().version, payload.runtime.version) > 0) return { ok: false };
+      if (current()?.active && lifecycle.versionCompare(current().version, expectedRuntime()) > 0) return { ok: false };
       let restored = current()?.packageRoot === previous.packageRoot && (await health(previous, { platform })).ok;
       if (!restored) {
         const result = run(previous.node, [previous.bin, "repair-runtime", "--no-trampoline", "--claim"], { encoding: "utf8", windowsHide: true, timeout: 3 * 60_000 });
@@ -174,11 +184,11 @@ async function handoffApplication({ activationEnabled = false, envelope, version
     },
     async retirePrevious() {
       const active = current();
-      if (active?.version !== payload.runtime.version || !(await health(active, { platform })).ok) return { ok: false };
+      if (active?.version !== expectedRuntime() || !(await health(active, { platform })).ok) return { ok: false };
       // Known-good runtime trees and account data remain recovery-owned. Retire
       // migration eligibility, not the rollback copy or the frozen npm bridge.
       write(path.join(base, "application-handoff-complete.json"), { schema: 1, ...target, platform: platformKey,
-        runtime: payload.runtime, at: Date.now(), previousRuntimeRetained: true });
+        runtime: payload.runtime, keptRuntime: expectedRuntime() !== payload.runtime.version ? expectedRuntime() : undefined, at: Date.now(), previousRuntimeRetained: true });
       return { ok: true };
     },
   };

package/bootstrap/application-install.cjs

@@ -129,10 +129,13 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
       || fs.existsSync(path.join(homeDir, ".relay-companion")))) {
       needsRecovery = true;
     }
-    if (current && /^\d+\.\d+\.\d+$/.test(current.version || "")) {
-      if (versionCompare(bundle.receipt.version, current.version) < 0) throw new Error("An older installer cannot downgrade Relay");
-      if (versionCompare(current.version, "0.1.500") < 0) needsRecovery = true;
-    }
+    // The runtime updates itself far more often than the app. Under an installed
+    // Relay app a newer runtime stays and only the app is replaced (below); a
+    // legacy installation is never handed to an app older than its runtime.
+    const newerRuntime = Boolean(current && /^\d+\.\d+\.\d+$/.test(current.version || "")
+      && versionCompare(bundle.receipt.version, current.version) < 0);
+    if (newerRuntime && recovery.marker(ownerPath)?.appId !== APPLICATION_ID) throw new Error("An older installer cannot downgrade Relay");
+    if (current && /^\d+\.\d+\.\d+$/.test(current.version || "") && versionCompare(current.version, "0.1.500") < 0) needsRecovery = true;
     // Never execute an old CLI as a prerequisite for rescuing it.
     if (current && !needsRecovery && !(await health(current, { platform: process.platform })).ok) needsRecovery = true;
     if (priorJournal && !["complete", "rolled-back"].includes(priorJournal.state)) {
@@ -152,6 +155,22 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
       onProgress({ phase: "ready", canCancel: false });
       return { ok: true, alreadyInstalled: true, owner: installedOwner, runtime: current, updateOwner: "canonical-runtime" };
     }
+    if (newerRuntime) {
+      // Repairing would install this older runtime over the newer one; the
+      // runtime's own recovery owns that. A healthy newer runtime keeps running.
+      if (needsRecovery) throw new Error("An older installer cannot downgrade Relay");
+      const owner = { schema: 1, appId: APPLICATION_ID, platform: process.platform,
+        root, executable, receipt: receiptPath, version: bundle.receipt.version,
+        applicationVersion: bundle.receipt.applicationVersion || bundle.receipt.version,
+        packagingSourceSha: bundle.receipt.packagingSourceSha, installationId: previousOwner?.installationId || crypto.randomUUID(),
+        updateOwner: "canonical-runtime" };
+      const at = Date.now();
+      atomic(journalPath, { schema: 1, state: "complete", owner, previousOwner, previous: current, releaseId: current.releaseId,
+        runtimeKept: true, at, completedAt: at });
+      atomic(ownerPath, owner);
+      onProgress({ phase: "ready", canCancel: false });
+      return { ok: true, applicationOnly: true, owner, runtime: current, updateOwner: "canonical-runtime" };
+    }
     if (bundle.receipt.runtimeDelivery === "download") {
       signal?.throwIfAborted();
       // Stage beside releases: tar requires archive and destination on one volume.

package/bootstrap/application-update.cjs

@@ -61,7 +61,10 @@ async function checkApplicationUpdate({ activationEnabled = rollout.enabled, hom
     let result;
     if (owner && (versionCompare(owner.installedPackageVersion, payload.version) > 0
       || ((owner.applicationVersion || owner.version) === payload.version && owner.packagingSourceSha === payload.sourceSha))) result = { state: "current", changed: false };
-    else if (versionCompare(current.version, payload.runtime.version) > 0) result = { state: "older-runtime-refused", changed: false };
+    // An installed app is updated even when its runtime has moved past the
+    // offer's: the runtime stays and only the app changes. Before an app owns
+    // Relay, an offer older than the running runtime is still not taken.
+    else if (!owner && versionCompare(current.version, payload.runtime.version) > 0) result = { state: "older-runtime-refused", changed: false };
     else {
       const platformKey = `${platform}-${arch}`;
       const kind = platform === "darwin" ? "zip" : platform === "win32" ? "exe"
@@ -71,7 +74,7 @@ async function checkApplicationUpdate({ activationEnabled = rollout.enabled, hom
       const directory = path.join(root, "application-packages", `${payload.version}-${payload.sourceSha}-${platformKey}`);
       fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
       const file = path.join(directory, `installer.${kind}`);
-      if (!fs.existsSync(file)) await download(artifact.url, file, artifact);
+      if (!fs.existsSync(file)) await download(artifact.url, file, artifact, { origin: release.CHANNEL_ORIGINS[consent.channel] });
       await release.verifyApplicationArtifact(file, artifact);
       // Recheck the live signed policy after a potentially slow download. A
       // withdrawn offer must not start a new transaction from a cached plan.

package/bootstrap/relay-setup.cjs

@@ -19,6 +19,9 @@ const {
 } = require("./runtime-executables.cjs");
 
 const RELEASE_ORIGIN = "https://api.sendrelays.com";
+// Dev app updates are served by the Dev API. A caller names the origin its
+// signed offer pinned; nothing else is ever trusted.
+const ARTIFACT_ORIGINS = new Set([RELEASE_ORIGIN, "https://dev-api.sendrelays.com"]);
 const RELEASE_BASE_PATH = "/v1/companion-releases";
 const PACKAGE_NAME = "relay-companion";
 // Native macOS bundles exceed Node's default 1 MiB tar-output buffer. Keep a
@@ -297,7 +300,8 @@ function sha512File(file) {
 async function downloadVerifiedArtifact(url, file, artifact, options = {}) {
   options.signal?.throwIfAborted();
   const parsed = new URL(url);
-  if (parsed.protocol !== "https:" || parsed.origin !== RELEASE_ORIGIN) {
+  const origin = options.origin || RELEASE_ORIGIN;
+  if (parsed.protocol !== "https:" || !ARTIFACT_ORIGINS.has(origin) || parsed.origin !== origin) {
     fail(`Relay refused an untrusted artifact origin: ${parsed.origin}`);
   }
   if (!Number.isSafeInteger(artifact.bytes) || artifact.bytes <= 0 || artifact.bytes > MAX_ARTIFACT_BYTES) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.573",
+  "version": "0.1.574",
   "description": "Install Relay for Claude Code, Cowork, and Codex, then sign in from the Relay pill.",
   "homepage": "https://sendrelays.com/get-started",
   "repository": {