relay-companion 0.1.577 → 0.1.579

package/bootstrap/application-handoff.cjs

@@ -151,7 +151,11 @@ async function handoffApplication({ activationEnabled = false, envelope, version
         const reconciled = await reconcile({ homeDir, acquireLock: sharedLock, health });
         if (!reconciled.ok) throw new Error("Runtime recovery must finish before resuming native handoff");
       }
-      const result = await activate({ homeDir, resourcesDir: location.resourcesDir, applicationRoot: location.root,
+      // A background app update never runs the destructive repair: it would end
+      // every process in the recovery folder, including this worker, and leave
+      // Relay stopped with no recovery task (Shane's laptop, 2026-10-02). An
+      // unhealthy Relay makes this step fail, and restorePrevious repairs it.
+      const result = await activate({ homeDir, allowRecovery: false, resourcesDir: location.resourcesDir, applicationRoot: location.root,
         executable: location.executable, activationEnabled: true, acquireLock: sharedLock, drain: async () => () => {} });
       return { ok: result.ok === true };
     },

package/bootstrap/application-install.cjs

@@ -33,7 +33,10 @@ async function pauseRecoveryChecks({ homeDir, timeoutMs = 3 * 60_000, pollMs = 2
   sleep = ms => new Promise(resolve => setTimeout(resolve, ms)) } = {}) {
   const intent = require("./recovery-intent.cjs");
   const wasStopped = intent.stopped(homeDir);
-  intent.setStopped(true, homeDir);
+  // Recorded as held by this setup, so Relay's own setup and pill launch during
+  // activation leave it paused; a dead holder no longer counts.
+  const hold = () => intent.setStopped(true, homeDir, { heldBy: "setup", pid: process.pid });
+  hold();
   const runLock = path.join(homeDir, ".relay", "recovery", "run.lock");
   for (const deadline = Date.now() + timeoutMs; ;) {
     try { bootstrap.acquireCanonicalLock(runLock).release(); break; }
@@ -44,7 +47,7 @@ async function pauseRecoveryChecks({ homeDir, timeoutMs = 3 * 60_000, pollMs = 2
     }
   }
   return {
-    repause: () => intent.setStopped(true, homeDir),
+    repause: hold,
     resume: succeeded => intent.setStopped(succeeded ? false : wasStopped, homeDir),
   };
 }
@@ -107,6 +110,7 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
   homeDir = os.homedir(), verify = verifyBundle, extract = extractBundle, activate = bootstrap.activateRuntime,
   acquireLock = bootstrap.acquireCanonicalLock, health = require("./runtime-health.cjs").exactRuntimeHealth,
   recover = recovery.recoverWithCandidate, pauseRecovery = pauseRecoveryChecks,
+  hidePill = require("./previous-pill.cjs").hidePreviousPill,
   drain = require("./update-activity.cjs").drainCalls, download = bootstrap.downloadVerifiedArtifact,
   onProgress = () => {}, signal } = {}) {
   onProgress({ phase: "verifying", canCancel: false });
@@ -128,7 +132,7 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
   const journalPath = path.join(homeDir, ".relay", "application-migration.json");
   let releaseDrain;
   let downloadDirectory;
-  let pausedRecovery, succeeded = false;
+  let pausedRecovery, previousPill, succeeded = false;
   try {
     const recordedCurrent = recovery.marker(path.join(runtimeRoot, "current.json"));
     const removed = recovery.marker(path.join(homeDir, ".relay", "application-uninstall.json"));
@@ -162,6 +166,10 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
     const newerRuntime = Boolean(current && /^\d+\.\d+\.\d+$/.test(current.version || "")
       && versionCompare(bundle.receipt.version, current.version) < 0);
     if (newerRuntime && recovery.marker(ownerPath)?.appId !== APPLICATION_ID) throw new Error("An older installer cannot downgrade Relay");
+    // The same runtime version is the same signed runtime: an installed app whose
+    // Relay is already current only changes owner, without touching services.
+    const currentRuntime = Boolean(current && /^\d+\.\d+\.\d+$/.test(current.version || "")
+      && versionCompare(bundle.receipt.version, current.version) === 0 && recovery.marker(ownerPath)?.appId === APPLICATION_ID);
     if (current && /^\d+\.\d+\.\d+$/.test(current.version || "") && versionCompare(current.version, "0.1.500") < 0) needsRecovery = true;
     // Never execute an old CLI as a prerequisite for rescuing it.
     if (current && !needsRecovery && !(await health(current, { platform: process.platform })).ok) needsRecovery = true;
@@ -182,9 +190,10 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
       onProgress({ phase: "ready", canCancel: false });
       return { ok: true, alreadyInstalled: true, owner: installedOwner, runtime: current, updateOwner: "canonical-runtime" };
     }
-    if (newerRuntime) {
+    if (newerRuntime || (currentRuntime && !needsRecovery)) {
       // Repairing would install this older runtime over the newer one; the
-      // runtime's own recovery owns that. A healthy newer runtime keeps running.
+      // runtime's own recovery owns that. A healthy current or newer runtime
+      // keeps running; an unhealthy same-version one is repaired below.
       if (needsRecovery) throw new Error("An older installer cannot downgrade Relay");
       const owner = { schema: 1, appId: APPLICATION_ID, platform: process.platform,
         root, executable, receipt: receiptPath, version: bundle.receipt.version,
@@ -199,6 +208,8 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
       return { ok: true, applicationOnly: true, owner, runtime: current, updateOwner: "canonical-runtime" };
     }
     pausedRecovery = await pauseRecovery({ homeDir });
+    // Only the old pill goes now; its background service runs until the switch.
+    if (current?.active === true) previousPill = hidePill({ current });
     if (bundle.receipt.runtimeDelivery === "download") {
       signal?.throwIfAborted();
       // Stage beside releases: tar requires archive and destination on one volume.
@@ -275,6 +286,7 @@ async function installFromApplication({ resourcesDir, applicationRoot, executabl
     try { releaseDrain?.(); }
     finally {
       try { pausedRecovery?.resume(succeeded); } catch { /* recovery reads a missing intent as running */ }
+      if (!succeeded) try { previousPill?.restore(); } catch { /* recovery restores a missing pill */ }
       lock.release();
       if (downloadDirectory) fs.rmSync(downloadDirectory, { recursive: true, force: true });
     }

package/bootstrap/previous-pill.cjs

@@ -0,0 +1,47 @@
+"use strict";
+// The installer's setup leaves the existing Relay running while it downloads,
+// so a failed download still leaves a working Relay. Its pill, though, stayed
+// on screen beside the setup window looking active (Shane, 2026-10-02). Hide
+// only the old pill when setup starts; the background service keeps running
+// until activation switches over and starts the new pill. If setup fails, the
+// previous Relay opens its pill again.
+const { spawnSync, spawn } = require("node:child_process");
+
+const MAC_PILL_LABEL = "work.relay.companion.pill";
+// Every stock pill runs relay-companion's overlay/main.cjs under Electron.
+const WINDOWS_STOP_PILL_PS = [
+  "$p=Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {",
+  "  $_.CommandLine -and ($_.CommandLine -match '[\\\\/]relay-companion[\\\\/]') -and ($_.CommandLine -match '[\\\\/]overlay[\\\\/]main')",
+  "}; foreach($x in $p){ try { Invoke-CimMethod -InputObject $x -MethodName Terminate -ErrorAction Stop | Out-Null } catch {} }",
+].join(" ");
+
+function hidePreviousPill({ current, platform = process.platform, uid = process.getuid?.(), run = spawnSync, launch = spawn } = {}) {
+  let hidden = false;
+  try {
+    if (platform === "win32") {
+      const result = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_STOP_PILL_PS], { windowsHide: true, timeout: 60_000 });
+      hidden = !result?.error && result?.status === 0;
+    } else if (platform === "darwin") {
+      // launchd keeps the pill alive, so stop its job rather than its process.
+      const result = run("/bin/launchctl", ["bootout", `gui/${uid}/${MAC_PILL_LABEL}`], { timeout: 30_000 });
+      hidden = !result?.error && result?.status === 0;
+    } else {
+      const result = run("pkill", ["-u", String(uid), "-f", "relay-companion/overlay/main"], { timeout: 30_000 });
+      hidden = !result?.error && result?.status === 0;
+    }
+  } catch { hidden = false; }
+  return {
+    hidden,
+    // Only an active previous runtime can reopen its own pill.
+    restore() {
+      if (!hidden || current?.active !== true || typeof current.node !== "string" || typeof current.bin !== "string") return false;
+      try {
+        const child = launch(current.node, [current.bin, "pill"], { detached: true, stdio: "ignore", windowsHide: true });
+        child.unref?.();
+        return true;
+      } catch { return false; }
+    },
+  };
+}
+
+module.exports = { hidePreviousPill, WINDOWS_STOP_PILL_PS, MAC_PILL_LABEL };

package/bootstrap/recovery-install.cjs

@@ -271,7 +271,11 @@ function windowsStopRecoveryScript(root) {
     `$root=${quoted};`,
     "$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;",
     "$inside={ param($text) $text -and $text.IndexOf($root, [StringComparison]::OrdinalIgnoreCase) -ge 0 };",
-    "$find={ @(Get-CimInstance Win32_Process -ErrorAction Stop | Where-Object { $_.ProcessId -ne $PID -and ((& $inside $_.ExecutablePath) -or (& $inside $_.CommandLine)) } | Where-Object { try { (Invoke-CimMethod -InputObject $_ -MethodName GetOwnerSid -ErrorAction Stop).Sid -eq $sid } catch { $false } }) };",
+    // Never end the process that asked for this sweep or anything above it: a
+    // Relay worker running on the recovery folder's Node would end itself.
+    "$all=@(Get-CimInstance Win32_Process -ErrorAction Stop); $up=@{}; $cur=($all | Where-Object ProcessId -eq $PID).ParentProcessId;",
+    "for($i=0;$i -lt 32 -and $cur -and -not $up.ContainsKey([int]$cur);$i++){ $up[[int]$cur]=$true; $cur=($all | Where-Object ProcessId -eq $cur).ParentProcessId };",
+    "$find={ @(Get-CimInstance Win32_Process -ErrorAction Stop | Where-Object { $_.ProcessId -ne $PID -and -not $up.ContainsKey([int]$_.ProcessId) -and ((& $inside $_.ExecutablePath) -or (& $inside $_.CommandLine)) } | Where-Object { try { (Invoke-CimMethod -InputObject $_ -MethodName GetOwnerSid -ErrorAction Stop).Sid -eq $sid } catch { $false } }) };",
     "$p=@(&$find); for($i=0;$i -lt 10 -and $p.Count;$i++){ foreach($x in $p){ try { Invoke-CimMethod -InputObject $x -MethodName Terminate -ErrorAction Stop | Out-Null } catch {} }; Start-Sleep -Milliseconds 200; $p=@(&$find) };",
     "if($p.Count){ Write-Error ('Relay recovery processes did not stop: '+(($p | ForEach-Object ProcessId) -join ', ')); exit 1 }",
   ].join(" ");

package/bootstrap/recovery-intent.cjs

@@ -1,11 +1,33 @@
 "use strict";
 const fs = require("node:fs"), os = require("node:os"), path = require("node:path");
 const file = homeDir => path.join(homeDir, ".relay", "recovery", "intent.json");
+function read(homeDir) {
+  try { return { value: JSON.parse(fs.readFileSync(file(homeDir), "utf8")) }; }
+  catch (error) { return { missing: error.code === "ENOENT" }; }
+}
+function alive(pid) {
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code === "EPERM"; }
+}
+// The installer's setup pauses recovery while it replaces Relay and records
+// itself as the holder. A hold whose setup process is gone no longer counts,
+// so a killed setup can never leave recovery paused for good.
+function heldBySetup(value) {
+  return value?.stopped === true && value.heldBy === "setup" && Number.isInteger(value.pid) && alive(value.pid);
+}
 function stopped(homeDir = os.homedir()) {
-  try { return JSON.parse(fs.readFileSync(file(homeDir), "utf8")).stopped === true; }
-  catch (error) { return error.code !== "ENOENT"; }
+  const { value, missing } = read(homeDir);
+  if (!value) return !missing;
+  if (value.stopped === true && value.heldBy === "setup") return heldBySetup(value);
+  return value.stopped === true;
+}
+function setStopped(value, homeDir = os.homedir(), { heldBy, pid } = {}) {
+  require("./recovery-launcher.cjs").write(file(homeDir), { schema: 1, stopped: value, at: Date.now(), ...(value && heldBy ? { heldBy, pid } : {}) });
 }
-function setStopped(value, homeDir = os.homedir()) {
-  require("./recovery-launcher.cjs").write(file(homeDir), { schema: 1, stopped: value, at: Date.now() });
+// Starting Relay (setup, the pill) resumes recovery, except while an
+// installer's setup holds the pause; that setup lifts it when it ends.
+function resumeUnlessHeld(homeDir = os.homedir()) {
+  if (heldBySetup(read(homeDir).value)) return false;
+  setStopped(false, homeDir);
+  return true;
 }
-module.exports = { stopped, setStopped };
+module.exports = { stopped, setStopped, resumeUnlessHeld };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.577",
+  "version": "0.1.579",
   "description": "Install Relay for Claude Code, Cowork, and Codex, then sign in from the Relay pill.",
   "homepage": "https://sendrelays.com/get-started",
   "repository": {