sneakoscope 8.0.2 → 8.0.4

package/dist/core/update-check.js

@@ -13,7 +13,10 @@ import { compareSemVer, extractSemVer, parseSemVer } from './update/semver.js';
 import { countUpdates, emptyUpdateStatus, resolveSksUpdateStatus, UpdateStatusRefreshError } from './update/update-status.js';
 import { acquireUpdateOperationLock, authorizeUpdateRollback, buildUpdateNowCommand, buildUpdateRollbackCommand, canonicalUpdateRegistry, UpdateOperationRecorder, updateOperationLastInstallPath, updateReceiptHasConfirmedGlobalInstall } from './update/update-operation.js';
 import { runTemporaryInstallSmoke } from './update/temporary-install-smoke.js';
+import { updateStageFailureDiagnostics } from './update/update-stage-diagnostics.js';
+import { executableOnInjectedPath, inspectInstalledCliResolution } from './update/installed-cli-resolution.js';
 import { ui as cliUi, withHeartbeat } from '../cli/cli-theme.js';
+import { uniqueTruthyStrings as uniqueStrings } from './text/strings.js';
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
 const DOCTOR_OWNED_UPDATE_MIGRATION_SINCE = '8.0.2';
 export async function runSksUpdateStatus(options = {}) {
@@ -275,6 +278,7 @@ export const UPDATE_STAGE_ORDER = [
     'native_capability_setup',
     'menubar_rebuild',
     'menubar_signature_verify',
+    'menubar_version_probe',
     'update_finalize_doctor',
     'final_self_verification',
     'snapshot_refresh'
@@ -566,7 +570,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
             operationRecorder.recordStage(id, false, status, detail);
             await operationRecorder.flush();
         };
-        const finalize = async (result) => {
+        const finalize = async (result, operationError = result.error) => {
             result.temporary_install_smoke = temporaryInstallSmoke;
             result.operation_receipt_path = operationRecorder.receiptPath;
             const finished = await operationRecorder.finish({
@@ -574,7 +578,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                     ? 'terminal_uncertain'
                     : result.ok ? (activeRollbackAuthorization ? 'rolled_back' : 'succeeded') : 'failed',
                 resultStatus: result.status,
-                error: result.error
+                error: operationError
             });
             operationFinished = true;
             if (finished.state === 'terminal_uncertain' && result.status !== 'terminal_uncertain') {
@@ -790,7 +794,14 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
             }).catch(() => null);
             let migrationCurrent = isUpdateMigrationReceiptCurrent(receipt);
             recordMigrationReceiptStage(stage, 'hook_trust_repair', receipt, 'hook-trust-refresh');
-            stage('project_receipt', migrationCurrent, migrationCurrent ? 'current' : 'failed', { root: projectReceiptRoot });
+            stage('project_receipt', migrationCurrent, migrationCurrent ? 'current' : 'failed', {
+                root: projectReceiptRoot,
+                receipt_status: receipt?.status || null,
+                receipt_version: receipt?.sks_version || null,
+                required_blockers: receipt?.required_blockers || [],
+                optional_warnings: receipt?.optional_warnings || [],
+                installation_epoch_sha256: receipt?.installation_epoch_sha256 || null
+            });
             recordMigrationReceiptStage(stage, 'global_skills_reconcile', receipt, 'skills-reconcile');
             stage('native_capability_setup', true, 'skipped_current', { reason: 'package_already_current' });
             const sksMenuBar = migrationCurrent
@@ -804,6 +815,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 env
             });
             stage('menubar_signature_verify', menuVerification.ok, menuVerification.status, menuVerification.detail);
+            stage('menubar_version_probe', menuVerification.versionProbe.ok, menuVerification.versionProbe.status, menuVerification.versionProbe.detail);
             const currentFinalizeDoctor = await runUpdateFinalizeDoctor({
                 root: projectReceiptRoot,
                 env: nestedProcessEnv,
@@ -813,7 +825,9 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 entrypoint: currentFinalizeDoctor.entrypoint,
                 args: currentFinalizeDoctor.args,
                 exit_code: currentFinalizeDoctor.exit_code,
-                timed_out: currentFinalizeDoctor.timed_out
+                timed_out: currentFinalizeDoctor.timed_out,
+                required_blockers: currentFinalizeDoctor.required_blockers,
+                optional_warnings: currentFinalizeDoctor.optional_warnings
             });
             const finalCurrentReceipt = await readProjectUpdateMigrationReceipt(projectReceiptRoot);
             if (finalCurrentReceipt)
@@ -833,6 +847,16 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 && snapshotOk
                 && currentStageFailures.length === 0
                 && !currentMenuBarTerminalUncertain;
+            const currentError = currentOk ? null : currentMenuBarTerminalUncertain
+                ? 'Menu Bar launch or rollback completion could not be confirmed'
+                : currentFinalizeDoctor.ok
+                    ? currentStageFailures.length
+                        ? `current-version repair verification failed: ${currentStageFailures.join(',')}`
+                        : 'current-version repair verification failed'
+                    : 'current-version repair verification failed: update_finalize_doctor';
+            const currentOperationError = currentError && currentStageFailures.length
+                ? requiredUpdateStageFailureError(currentError, stages, currentStageFailures, projectReceiptRoot)
+                : currentError;
             return finalize(buildUpdateNowResult({
                 packageName,
                 from: check.current,
@@ -857,14 +881,8 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 migrationCurrent,
                 sksMenuBar,
                 stages,
-                error: currentOk ? null : currentMenuBarTerminalUncertain
-                    ? 'Menu Bar launch or rollback completion could not be confirmed'
-                    : currentFinalizeDoctor.ok
-                        ? currentStageFailures.length
-                            ? `current-version repair verification failed: ${currentStageFailures.join(',')}`
-                            : 'current-version repair verification failed'
-                        : 'current-version repair verification failed: update_finalize_doctor'
-            }));
+                error: currentError
+            }), currentOperationError);
         }
         const oldDoctorTimeoutOverride = Number.parseInt(env.SKS_UPDATE_OLD_DOCTOR_TIMEOUT_MS || '', 10);
         const oldDoctorTimeoutMs = Number.isFinite(oldDoctorTimeoutOverride) && oldDoctorTimeoutOverride > 0
@@ -978,6 +996,8 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
         stage('global_install', installOk, installOk ? env.SKS_UPDATE_FAKE_INSTALL === '1' ? 'fake_installed' : 'installed' : 'failed', { command, code: install.code, timed_out: install.timedOut === true });
         let newBinary = null;
         let newVersion = null;
+        let installedCliResolution = null;
+        let installedPackageIdentityOk = false;
         let newVersionDoctor = null;
         let preDoctorReceipt = null;
         let projectReceipt = null;
@@ -985,30 +1005,84 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
         let sksMenuBar = null;
         let menubarVerified = process.platform !== 'darwin' || env.SKS_UPDATE_SKIP_SKS_MENUBAR === '1';
         if (installOk) {
+            installedCliResolution = env.SKS_UPDATE_FAKE_INSTALL === '1'
+                ? null
+                : await inspectInstalledCliResolution({
+                    packageName,
+                    expectedVersion: installVersion,
+                    globalRoot,
+                    env,
+                    cwd,
+                    timeoutMs: 5_000,
+                    maxOutputBytes: 4_096
+                });
             newBinary = env.SKS_UPDATE_FAKE_INSTALL === '1'
                 ? path.resolve(env.SKS_UPDATE_FAKE_NEW_ENTRYPOINT || path.join(packageRoot(), 'dist', 'bin', 'sks.js'))
-                : await resolveInstalledSksEntrypoint({ packageName, globalRoot, env });
-            stage('resolve_new_binary', Boolean(newBinary), newBinary ? 'resolved' : 'missing', { new_binary: newBinary });
+                : installedCliResolution?.entrypoint
+                    || await resolveInstalledSksEntrypoint({ packageName, globalRoot, env });
+            installedPackageIdentityOk = env.SKS_UPDATE_FAKE_INSTALL === '1'
+                ? Boolean(newBinary)
+                : Boolean(newBinary
+                    && installedCliResolution?.manifest_name === packageName
+                    && installedCliResolution.manifest_version === installVersion);
+            stage('resolve_new_binary', installedPackageIdentityOk, installedPackageIdentityOk ? 'resolved_exact_global_package' : 'missing_or_mismatched', {
+                new_binary: newBinary,
+                package_root: installedCliResolution?.package_root || null,
+                manifest_name: installedCliResolution?.manifest_name || null,
+                manifest_version: installedCliResolution?.manifest_version || null,
+                path_binary: installedCliResolution?.path_binary || null,
+                path_version_before_doctor: installedCliResolution?.path_version || null,
+                blockers: installedCliResolution?.blockers || []
+            });
             if (newBinary) {
-                const versionProbe = await runProcess(process.execPath, [newBinary, '--version'], {
-                    cwd,
-                    env: { ...env, SKS_UPDATE_MIGRATION_GATE_DISABLED: '1', SKS_DISABLE_UPDATE_CHECK: '1' },
-                    timeoutMs: 5000,
-                    maxOutputBytes: 4096
-                }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
-                newVersion = parseVersionText(versionProbe.stdout || versionProbe.stderr || '') || null;
-                stage('version_probe', Boolean(newVersion), newVersion ? 'version_detected' : 'failed', { new_version: newVersion, code: versionProbe.code });
-                preDoctorReceipt = await readProjectUpdateMigrationReceipt(projectReceiptRoot);
-                stageStart('new_version_doctor', 'running migration doctor on updated install');
-                newVersionDoctor = await updateHeartbeat(machineOutput, 'new-version doctor', runPackageLocalDoctor({
-                    root: projectReceiptRoot,
-                    entrypoint: newBinary,
-                    args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(projectReceiptRoot, '.sneakoscope', 'update', 'new-version-doctor.json')],
-                    env: nestedProcessEnv,
-                    timeoutMs: updateDoctorTimeoutMs(env),
-                    maxOutputBytes: 32 * 1024
-                }), 60_000);
-                stage('new_version_doctor', newVersionDoctor.ok, newVersionDoctor.status, { entrypoint: newBinary, exit_code: newVersionDoctor.exit_code, timeout_ms: updateDoctorTimeoutMs(env), timed_out: newVersionDoctor.timedOut });
+                let versionProbeCode = installedCliResolution?.entrypoint_version ? 0 : 1;
+                newVersion = installedCliResolution?.entrypoint_version || null;
+                if (!newVersion) {
+                    const versionProbe = await runProcess(process.execPath, [newBinary, '--version'], {
+                        cwd,
+                        env: { ...env, SKS_UPDATE_MIGRATION_GATE_DISABLED: '1', SKS_DISABLE_UPDATE_CHECK: '1' },
+                        timeoutMs: 5000,
+                        maxOutputBytes: 4096
+                    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+                    versionProbeCode = versionProbe.code;
+                    newVersion = parseVersionText(versionProbe.stdout || versionProbe.stderr || '') || null;
+                }
+                const exactVersion = compareSemVer(newVersion, installVersion) === 0;
+                stage('version_probe', exactVersion, exactVersion ? 'exact_version_detected' : 'version_mismatch', {
+                    expected_version: installVersion,
+                    new_version: newVersion,
+                    code: versionProbeCode
+                });
+                if (installedPackageIdentityOk && exactVersion) {
+                    preDoctorReceipt = await readProjectUpdateMigrationReceipt(projectReceiptRoot);
+                    stageStart('new_version_doctor', 'running migration doctor on updated install');
+                    newVersionDoctor = await updateHeartbeat(machineOutput, 'new-version doctor', runPackageLocalDoctor({
+                        root: projectReceiptRoot,
+                        entrypoint: newBinary,
+                        args: ['doctor', '--fix', '--yes', '--profile', 'migration', '--machine-only', '--report-file', path.join(projectReceiptRoot, '.sneakoscope', 'update', 'new-version-doctor.json')],
+                        env: nestedProcessEnv,
+                        timeoutMs: updateDoctorTimeoutMs(env),
+                        maxOutputBytes: 32 * 1024
+                    }), 60_000);
+                    stage('new_version_doctor', newVersionDoctor.ok, newVersionDoctor.status, {
+                        entrypoint: newBinary,
+                        exit_code: newVersionDoctor.exit_code,
+                        timeout_ms: updateDoctorTimeoutMs(env),
+                        timed_out: newVersionDoctor.timedOut,
+                        required_blockers: newVersionDoctor.required_blockers
+                    });
+                }
+                else {
+                    stage('new_version_doctor', false, 'skipped_unverified_install_identity', {
+                        expected_version: installVersion,
+                        manifest_version: installedCliResolution?.manifest_version || null,
+                        entrypoint_version: newVersion
+                    });
+                }
+            }
+            else {
+                stage('version_probe', false, 'entrypoint_missing', { expected_version: installVersion });
+                stage('new_version_doctor', false, 'skipped_entrypoint_missing', { expected_version: installVersion });
             }
             if (newBinary && newVersionDoctor?.ok) {
                 const doctorReceipt = await readProjectUpdateMigrationReceipt(projectReceiptRoot);
@@ -1048,6 +1122,8 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                     via: receiptResult.via,
                     expected_version: installVersion,
                     receipt_version: projectReceipt?.sks_version || null,
+                    required_blockers: projectReceipt?.required_blockers || [],
+                    optional_warnings: projectReceipt?.optional_warnings || [],
                     error: receiptResult.error
                 });
                 recordMigrationReceiptStage(stage, 'global_skills_reconcile', projectReceipt, 'skills-reconcile');
@@ -1073,10 +1149,11 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                     });
                     menubarVerified = menuVerification.ok;
                     stage('menubar_signature_verify', menuVerification.ok, menuVerification.status, menuVerification.detail);
+                    stage('menubar_version_probe', menuVerification.versionProbe.ok, menuVerification.versionProbe.status, menuVerification.versionProbe.detail);
                 }
             }
         }
-        const finalizeDoctor = installOk && newBinary
+        const finalizeDoctor = installOk && newBinary && installedPackageIdentityOk
             ? await runUpdateFinalizeDoctor({
                 entrypoint: newBinary,
                 root: projectReceiptRoot,
@@ -1089,7 +1166,9 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 entrypoint: finalizeDoctor.entrypoint,
                 args: finalizeDoctor.args,
                 exit_code: finalizeDoctor.exit_code,
-                timed_out: finalizeDoctor.timed_out
+                timed_out: finalizeDoctor.timed_out,
+                required_blockers: finalizeDoctor.required_blockers,
+                optional_warnings: finalizeDoctor.optional_warnings
             } : {})
         });
         if (finalizeDoctor) {
@@ -1098,7 +1177,26 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 projectReceipt = finalDoctorReceipt;
             migrationCurrent = isUpdateMigrationReceiptCurrent(projectReceipt, installVersion);
         }
-        const verification = await runFinalUpdateVerification({ installOk, newBinary, installVersion, env, projectReceiptRoot });
+        if (installOk && installVersion && env.SKS_UPDATE_FAKE_INSTALL !== '1') {
+            installedCliResolution = await inspectInstalledCliResolution({
+                packageName,
+                expectedVersion: installVersion,
+                globalRoot,
+                env,
+                cwd,
+                timeoutMs: 5_000,
+                maxOutputBytes: 4_096
+            });
+        }
+        const verification = await runFinalUpdateVerification({
+            installOk,
+            packageName,
+            newBinary,
+            installVersion,
+            env,
+            projectReceiptRoot,
+            installedCliResolution
+        });
         const verifyOk = verification.length > 0 && verification.every((item) => item.ok) && finalizeDoctor?.ok === true;
         if (verification.length) {
             stage('final_self_verification', verifyOk, verifyOk ? 'verified' : 'issues', {
@@ -1112,24 +1210,53 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
             stage('final_self_verification', false, 'not_run', {});
         const snapshot = await runSksUpdateStatus(updateStatusOptionsFromNow(options, newVersion || check.current, {
             ...env,
+            ...(env.SKS_UPDATE_FAKE_INSTALL === '1' && installVersion
+                ? { SKS_INSTALLED_SKS_VERSION: installVersion }
+                : {}),
             ...(installVersion ? { [versionOverrideEnvName(packageName)]: check.latest || installVersion } : {})
         })).catch(() => null);
-        const snapshotOk = snapshot?.schema === 'sks.update-status.v3' && snapshot.source !== 'error';
-        stage('snapshot_refresh', snapshotOk, snapshotOk ? snapshot.source : 'failed', {
+        const snapshotVersionOk = compareSemVer(snapshot?.sks.current || null, installVersion) === 0;
+        const snapshotOk = snapshot?.schema === 'sks.update-status.v3'
+            && snapshot.source !== 'error'
+            && snapshotVersionOk;
+        stage('snapshot_refresh', snapshotOk, snapshotOk ? snapshot.source : snapshot?.source === 'error' ? 'failed' : 'resolved_version_mismatch', {
             current: snapshot?.sks.current || null,
+            expected: installVersion,
             update_count: snapshot?.update_count ?? null,
             public_error: snapshot?.public_error || null
         });
         const executionStageIds = UPDATE_STAGE_ORDER.filter((id) => !['update_finalize_doctor', 'final_self_verification', 'snapshot_refresh'].includes(id));
         const executionStageFailures = requiredUpdateStageFailures(stages, executionStageIds);
+        const allStageFailures = requiredUpdateStageFailures(stages, UPDATE_STAGE_ORDER);
+        const installedCliOk = env.SKS_UPDATE_FAKE_INSTALL === '1'
+            || installedCliResolution?.ok === true;
         const baseOk = installOk && Boolean(newBinary) && newVersionDoctor?.ok === true
-            && migrationCurrent && menubarVerified && executionStageFailures.length === 0;
+            && installedCliOk && migrationCurrent && menubarVerified && executionStageFailures.length === 0;
         const ok = baseOk && verifyOk && snapshotOk;
         const menuBarTerminalUncertain = menuBarInstallIsTerminalUncertain(sksMenuBar);
         const terminalUncertain = install.timedOut === true || menuBarTerminalUncertain;
         const status = terminalUncertain
             ? 'terminal_uncertain'
             : ok ? 'updated' : baseOk ? 'updated_with_issues' : 'failed';
+        const stageFailureError = executionStageFailures.length
+            ? requiredUpdateStageFailureError(`required update stages failed: ${executionStageFailures.join(',')}`, stages, executionStageFailures, projectReceiptRoot)
+            : null;
+        const resultError = terminalUncertain
+            ? menuBarTerminalUncertain
+                ? 'Menu Bar launch or rollback completion could not be confirmed'
+                : 'global install timed out; package side-effect completion is uncertain'
+            : ok ? null
+                : stageFailureError
+                    ? stageFailureError.message
+                    : status === 'updated_with_issues'
+                        ? !snapshotOk
+                            ? `update status still resolves SKS ${snapshot?.sks.current || 'unknown'} instead of ${installVersion}`
+                            : verificationError(verification, finalizeDoctor)
+                        : updateNowError(install, newBinary, newVersionDoctor, migrationCurrent, installedCliResolution);
+        const resultOperationError = stageFailureError
+            || (resultError && allStageFailures.length
+                ? requiredUpdateStageFailureError(resultError, stages, allStageFailures, projectReceiptRoot)
+                : resultError);
         return finalize(buildUpdateNowResult({
             packageName,
             from: check.current,
@@ -1149,23 +1276,15 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
             oldVersionDoctor,
             newBinary,
             newVersion,
+            installedCliResolution,
             newVersionDoctor,
             projectReceipt,
             migrationCurrent,
             sksMenuBar,
             stages,
             verification,
-            error: terminalUncertain
-                ? menuBarTerminalUncertain
-                    ? 'Menu Bar launch or rollback completion could not be confirmed'
-                    : 'global install timed out; package side-effect completion is uncertain'
-                : ok ? null
-                    : executionStageFailures.length
-                        ? `required update stages failed: ${executionStageFailures.join(',')}`
-                        : status === 'updated_with_issues'
-                            ? verificationError(verification, finalizeDoctor)
-                            : updateNowError(install, newBinary, newVersionDoctor, migrationCurrent)
-        }));
+            error: resultError
+        }), resultOperationError);
     }
     catch (error) {
         if (operation && !operationFinished) {
@@ -1173,7 +1292,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 await operation.finish({
                     state: 'failed',
                     resultStatus: 'failed',
-                    error: error instanceof Error ? error.message : String(error)
+                    error
                 });
                 operationFinished = true;
             }
@@ -1193,15 +1312,31 @@ function requiredUpdateStageFailures(stages, requiredIds) {
         return matches.length !== 1 || matches[0]?.ok !== true;
     });
 }
+function requiredUpdateStageFailureError(message, stages, failedIds, projectRoot) {
+    for (const id of failedIds) {
+        for (const stage of stages.filter((entry) => entry.id === id && entry.ok !== true)) {
+            const rootCause = updateStageFailureDiagnostics(stage, projectRoot)[0];
+            if (rootCause)
+                return new Error(message, { cause: new Error(rootCause) });
+        }
+    }
+    return new Error(message);
+}
 export function menuBarInstallIsTerminalUncertain(result) {
     return result?.status === 'terminal_uncertain'
         || result?.launch?.terminal_uncertain === true
         || result?.rollback?.status === 'terminal_uncertain';
 }
 async function runUpdateFinalizeDoctor(opts) {
-    const env = opts.env.SKS_TEST_FINALIZE_DOCTOR_FAIL === '1'
-        ? { ...opts.env, SKS_TEST_DOCTOR_FAIL: '1' }
-        : opts.env;
+    const env = opts.env.SKS_TEST_FINALIZE_DOCTOR_USER_CONFIG_PRESERVED === '1'
+        ? {
+            ...opts.env,
+            SKS_TEST_DOCTOR_FAIL: undefined,
+            SKS_TEST_DOCTOR_USER_CONFIG_PRESERVED: '1'
+        }
+        : opts.env.SKS_TEST_FINALIZE_DOCTOR_FAIL === '1'
+            ? { ...opts.env, SKS_TEST_DOCTOR_FAIL: '1' }
+            : opts.env;
     return updateHeartbeat(opts.machineOutput, 'update finalize doctor', runPackageLocalDoctor({
         root: opts.root,
         ...(opts.entrypoint ? { entrypoint: opts.entrypoint } : {}),
@@ -1319,7 +1454,7 @@ export async function detectEffectiveSksVersion(options = {}) {
     add(options.currentVersion || PACKAGE_VERSION, 'runtime');
     add(env.SKS_INSTALLED_SKS_VERSION, 'env:SKS_INSTALLED_SKS_VERSION');
     const packageRootPromise = readJson(path.join(packageRoot(), 'package.json'), {}).catch(() => ({}));
-    const pathSksPromise = which('sks')
+    const pathSksPromise = executableOnInjectedPath('sks', env)
         .then(async (sks) => {
         if (!sks)
             return null;
@@ -1457,26 +1592,6 @@ function normalizeLockedInstalledVersionObservation(value) {
         ])
     };
 }
-async function executableOnInjectedPath(command, env) {
-    const rawPath = String(env.PATH ?? process.env.PATH ?? '').slice(0, 64 * 1024);
-    const extensions = process.platform === 'win32'
-        ? uniqueStrings(String(env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';').map((extension) => extension.toLowerCase()))
-        : [''];
-    const names = process.platform === 'win32' && path.extname(command)
-        ? [command]
-        : extensions.map((extension) => `${command}${extension}`);
-    for (const directory of rawPath.split(path.delimiter).filter(Boolean).slice(0, 256)) {
-        for (const name of names) {
-            const candidate = path.resolve(directory, name);
-            try {
-                await fs.access(candidate);
-                return candidate;
-            }
-            catch { }
-        }
-    }
-    return null;
-}
 function boundedLockedProbeTimeout(value) {
     if (!Number.isFinite(value))
         return 2500;
@@ -1595,6 +1710,7 @@ function buildUpdateNowResult(input) {
         old_version_doctor: input.oldVersionDoctor,
         new_binary: input.newBinary,
         new_version: input.newVersion,
+        installed_cli_resolution: input.installedCliResolution || null,
         new_version_doctor: input.newVersionDoctor,
         project_receipt: input.projectReceipt,
         migration_current: input.migrationCurrent,
@@ -1614,10 +1730,42 @@ function buildUpdateNowResult(input) {
 }
 async function verifyUpdateMenuBar(input) {
     if (process.platform !== 'darwin' || input.env.SKS_UPDATE_SKIP_SKS_MENUBAR === '1') {
-        return { ok: true, status: 'skipped', detail: { reason: process.platform !== 'darwin' ? 'not_macos' : 'SKS_UPDATE_SKIP_SKS_MENUBAR=1' } };
+        const reason = process.platform !== 'darwin' ? 'not_macos' : 'SKS_UPDATE_SKIP_SKS_MENUBAR=1';
+        return {
+            ok: true,
+            status: 'skipped',
+            detail: { reason },
+            versionProbe: {
+                ok: true,
+                status: 'skipped',
+                detail: {
+                    running_version: null,
+                    running_pid: null,
+                    expected_version: input.expectedVersion,
+                    probe_ok: true,
+                    reason
+                }
+            }
+        };
     }
     if (!input.install || input.install.ok === false) {
-        return { ok: false, status: 'install_failed', detail: { blockers: input.install?.blockers || ['menubar_install_missing'] } };
+        const blockers = input.install?.blockers || ['menubar_install_missing'];
+        return {
+            ok: false,
+            status: 'install_failed',
+            detail: { blockers },
+            versionProbe: {
+                ok: false,
+                status: 'install_failed',
+                detail: {
+                    running_version: null,
+                    running_pid: null,
+                    expected_version: input.expectedVersion,
+                    probe_ok: false,
+                    blockers
+                }
+            }
+        };
     }
     const status = await inspectSksMenuBarStatus({
         ...(input.home === undefined ? {} : { home: input.home }),
@@ -1629,6 +1777,25 @@ async function verifyUpdateMenuBar(input) {
     const signatureOk = status?.signature.checked === true && status.signature.ok === true;
     const resourcesOk = resources?.checked === true && resources.ok === true;
     const ok = status?.installed === true && versionOk && signatureOk && resourcesOk;
+    const runningProcess = status?.running_process || input.install.running_process;
+    const probe = status?.menubar_version_probe || input.install.menubar_version_probe;
+    const launchExpected = input.install.launch?.requested === true;
+    const restartDeferred = input.env.SKS_UPDATE_DEFER_MENUBAR_RESTART === '1';
+    const runningVersion = runningProcess?.package_version || probe?.running_version || null;
+    const runningPid = runningProcess?.pid || probe?.pid || null;
+    const runningProcessOk = runningProcess?.ok === true && runningPid !== null;
+    const runningVersionOk = runningVersion === input.expectedVersion;
+    const probeOk = probe?.ok === true && runningProcessOk && runningVersionOk;
+    const versionProbeOk = !launchExpected || probeOk;
+    const versionProbeStatus = !launchExpected
+        ? restartDeferred ? 'restart_deferred' : 'launch_not_requested'
+        : !runningProcessOk
+            ? 'running_process_missing'
+            : !runningVersionOk
+                ? 'running_version_mismatch'
+                : probe?.ok !== true
+                    ? 'probe_failed'
+                    : 'verified';
     return {
         ok,
         status: ok ? 'verified' : 'failed',
@@ -1640,6 +1807,19 @@ async function verifyUpdateMenuBar(input) {
             resources_ok: resourcesOk,
             missing_resources: resources?.missing || [],
             mismatched_resources: resources?.mismatched || []
+        },
+        versionProbe: {
+            ok: versionProbeOk,
+            status: versionProbeStatus,
+            detail: {
+                running_version: runningVersion,
+                running_pid: runningPid,
+                expected_version: input.expectedVersion,
+                probe_ok: probeOk,
+                launch_expected: launchExpected,
+                restart_deferred: restartDeferred,
+                probe_error: probe?.error || runningProcess?.error || null
+            }
         }
     };
 }
@@ -1792,6 +1972,23 @@ async function runFinalUpdateVerification(input) {
         detail: `expected ${input.installVersion}, got ${got || 'missing'}`,
         remediation: 'Run: sks update now --version <expected>'
     });
+    if (input.installedCliResolution) {
+        const resolution = input.installedCliResolution;
+        verification.push({
+            id: 'package_manifest',
+            ok: resolution.manifest_name === input.packageName
+                && resolution.manifest_version === input.installVersion
+                && resolution.entrypoint === input.newBinary,
+            detail: `expected ${input.packageName}@${input.installVersion}, got ${resolution.manifest_name || 'missing'}@${resolution.manifest_version || 'missing'} from ${resolution.package_root || 'missing'}`,
+            remediation: `Run: npm install --global ${input.packageName}@${input.installVersion}`
+        });
+        verification.push({
+            id: 'path_version_match',
+            ok: resolution.path_version === input.installVersion && resolution.path_targets_entrypoint,
+            detail: `expected PATH sks ${input.installVersion} at the verified entrypoint; got ${resolution.path_version || 'missing'} from ${resolution.path_binary || 'missing'} (exact target: ${resolution.path_targets_entrypoint ? 'yes' : 'no'})`,
+            remediation: 'Remove or reorder the older SKS npm prefix on PATH, then rerun: sks update now'
+        });
+    }
     const hookState = await readCodexHookActualState(input.projectReceiptRoot).catch(() => null);
     const managedEntries = (hookState?.entries || []).filter((entry) => entry.managed === true);
     const untrusted = managedEntries.filter((entry) => entry.trust_status !== 'Trusted' && entry.trust_status !== 'Managed');
@@ -1801,15 +1998,6 @@ async function runFinalUpdateVerification(input) {
         detail: untrusted.length ? untrusted.map((entry) => entry.key).slice(0, 3).join(', ') : `managed ${managedEntries.length}`,
         remediation: 'Run: sks codex trust-doctor --fix --managed --actual'
     });
-    const stampPath = path.join(path.dirname(input.newBinary), '..', '.sks-build-stamp.json');
-    const stamp = await readJson(stampPath, null).catch(() => null);
-    const stampVersion = stamp?.package_version || stamp?.version || null;
-    verification.push({
-        id: 'dist_stamp',
-        ok: stampVersion === input.installVersion,
-        detail: `expected ${input.installVersion}, got ${stampVersion || 'missing'}`,
-        remediation: 'Run: npm run build:incremental'
-    });
     const home = input.env.HOME || os.homedir();
     const skillsManifest = await readJson(path.join(home, '.agents', 'skills', '.sks-generated.json'), null).catch(() => null);
     verification.push({
@@ -1839,11 +2027,14 @@ function verificationError(verification, finalizeDoctor) {
         ? `update self-verification failed: ${failed.join(', ')}`
         : 'update self-verification did not run';
 }
-function updateNowError(install, newBinary, newVersionDoctor, migrationCurrent) {
+function updateNowError(install, newBinary, newVersionDoctor, migrationCurrent, installedCliResolution) {
     if (install.code !== 0)
         return `${install.stderr || install.stdout || 'npm global install failed'}`.trim();
     if (!newBinary)
         return 'new package-local sks binary could not be resolved after install';
+    if (installedCliResolution && !installedCliResolution.ok) {
+        return `installed SKS CLI resolution failed: ${installedCliResolution.blockers.join(', ') || 'unknown resolution blocker'}; PATH sks=${installedCliResolution.path_binary || 'missing'} version=${installedCliResolution.path_version || 'missing'}`;
+    }
     if (!newVersionDoctor?.ok)
         return newVersionDoctor?.error || 'new-version global Doctor failed';
     if (!migrationCurrent)
@@ -1854,8 +2045,8 @@ function effectiveInstalledVersion(candidates) {
     const firstBySource = (source) => candidates.find((candidate) => candidate.source === source)?.version || null;
     const firstByPrefix = (prefix) => candidates.find((candidate) => candidate.source.startsWith(prefix))?.version || null;
     return firstBySource('env:SKS_INSTALLED_SKS_VERSION')
-        || firstByPrefix('npm-global:')
         || firstByPrefix('PATH:')
+        || firstByPrefix('npm-global:')
         || firstBySource('runtime')
         || firstBySource('packageRoot:package.json')
         || highestPackageVersion(candidates.map((candidate) => candidate.version));
@@ -1865,6 +2056,3 @@ function highestPackageVersion(versions) {
         .filter((version) => typeof version === 'string' && version.length > 0)
         .reduce((best, candidate) => comparePackageVersions(candidate, best) > 0 ? candidate : best, '0.0.0');
 }
-function uniqueStrings(values) {
-    return [...new Set(values.filter(Boolean))];
-}

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.0.2';
+export const PACKAGE_VERSION = '8.0.4';