stackbite 0.5.94 → 0.5.96

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stackbite",
-  "version": "0.5.94",
+  "version": "0.5.96",
   "description": "Verified native Stackbite CLI bootstrapper",
   "license": "UNLICENSED",
   "engines": {

package/packaging/npm/bin/stackbite.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 'use strict';
 const { main } = require('../lib/bootstrap');
-main().then(({ code, signal }) => {
+const path = require('node:path');
+main(process.argv.slice(2), { packageRoot: path.resolve(__dirname, '../../..') }).then(({ code, signal }) => {
   if (signal && process.platform !== 'win32') {
     process.kill(process.pid, signal);
   } else {

package/packaging/npm/lib/bootstrap.js

@@ -1,9 +1,10 @@
 'use strict';
 const fs = require('node:fs/promises');
 const path = require('node:path');
+const os = require('node:os');
 const { spawn } = require('node:child_process');
 const { createHash } = require('node:crypto');
-const { LIMITS, fail, memberPath, inside, hashFile, readSmall, exists, safeDirectory } = require('./common');
+const { LIMITS, fail, memberPath, inside, hashFile, readSmall, exists } = require('./common');
 const { download } = require('./download');
 const { extractArchive } = require('./archive');
 const { cacheDirectory, existingCacheDirectory } = require('./cache');
@@ -157,8 +158,9 @@ async function nativeExecutable(root, spec, name = 'stackbite') {
   if (spec.platform !== 'win32' && process.platform !== 'win32' && !(image.mode & 0o111)) fail('Native release executable has no execute permission');
   return executable;
 }
-// The release pins the whole payload before this mapping. Old releases keep
-// their original engine; a present native entry is never silently bypassed.
+// The release pins the whole payload before this mapping. Windows opens the
+// frozen engine, which selects the Rust TUI/owner; POSIX opens the native entry.
+// A bundled native entry is validated on every platform before either choice.
 async function publicExecutable(root, spec, hashes) {
   const engine = await nativeExecutable(root, spec);
   const name = 'stackbite-launcher' + (spec.platform === 'win32' ? '.exe' : '');
@@ -177,7 +179,8 @@ async function publicExecutable(root, spec, hashes) {
       || !info || Object.keys(info).sort().join(',') !== 'binary,commit,product,protocol,target,version'
       || info.product !== 'Stackbite' || info.binary !== 'stackbite-launcher' || info.version !== spec.version
       || info.commit !== spec.commit || info.target !== target || info.protocol !== 1) fail('Native entry package identity or pin is invalid');
-  return nativeExecutable(root, spec, 'stackbite-launcher');
+  const launcher = await nativeExecutable(root, spec, 'stackbite-launcher');
+  return spec.platform === 'win32' ? engine : launcher;
 }
 async function validatePayload(directory, spec, { includePhone = true } = {}) {
   const root = await payloadRoot(directory);
@@ -189,52 +192,322 @@ async function validatePayload(directory, spec, { includePhone = true } = {}) {
   await checkProductIdentity(root, spec, metadata);
   return publicExecutable(root, spec, hashes);
 }
+
+function installationRoot(environment, platform) {
+  const home = environment.USERPROFILE || environment.HOME || os.homedir();
+  // Python's locator/control root is distinct from npm's cache root.
+  return platform === 'win32'
+    ? path.resolve(environment.LOCALAPPDATA || home, 'Stackbite')
+    : path.resolve(environment.XDG_DATA_HOME || path.join(environment.HOME || home, '.local', 'share'), 'stackbite');
+}
+// Before a runtime is available, read the SAME journal without creating any
+// product directory. The verified bundled engine repeats this under OS locks
+// and owns cache/locator publication. This read is not a JavaScript flock.
+async function admitPublication(environment, platform) {
+  const root = installationRoot(environment, platform);
+  if (!await existingCacheDirectory(root)) return;
+  const journal = path.join(root, '.stackbite-uninstall.json');
+  if (!await exists(journal)) return;
+  const record = JSON.parse((await readSmall(journal, 8 * 1024 * 1024)).toString('utf8').replace(/^\uFEFF/, ''));
+  if (record.schema !== 'stackbite.uninstall.v1' || !['prepared', 'stopped', 'deferred', 'complete'].includes(record.phase)) {
+    fail('Stackbite removal is in progress');
+  }
+  let current = null;
+  for (const name of ['default-install.json', 'install.json']) {
+    const locator = path.join(root, name);
+    if (!await exists(locator)) continue;
+    const value = JSON.parse((await readSmall(locator, 16384)).toString('utf8').replace(/^\uFEFF/, ''));
+    if (!value || Array.isArray(value) || typeof value !== 'object'
+        || (value.installation_id != null && !/^[a-f0-9]{32}$/.test(value.installation_id))) fail('Invalid Stackbite installation locator');
+    current = value.installation_id;
+    break;
+  }
+  const saved = record.install_identity;
+  if (saved != null && (saved.root !== root || !/^[a-f0-9]{32}$/.test(saved.incarnation))) fail('Invalid removal installation identity');
+  if (current && (!saved || current !== saved.incarnation)) return;
+  fail('Stackbite removal is in progress');
+}
+
+async function baselinePin(file) {
+  await existingCacheDirectory(path.dirname(file));
+  let info;
+  try { info = await fs.lstat(file, { bigint: true }); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1n) fail('Invalid installation baseline file');
+  return { device: info.dev.toString(), inode: info.ino.toString() };
+}
+async function captureBaseline(environment, platform, cachedHome) {
+  const root = installationRoot(environment, platform);
+  for (const name of ['default-install.json', 'install.json']) {
+    const file = path.join(root, name);
+    if (!await exists(file)) continue;
+    const value = JSON.parse((await readSmall(file, 16384)).toString('utf8').replace(/^\uFEFF/, ''));
+    if (value.installation_id != null) {
+      if (!/^[a-f0-9]{32}$/.test(value.installation_id)) fail('Invalid installation incarnation');
+      return { root, incarnation: value.installation_id };
+    }
+    break;
+  }
+  const old = path.join(path.dirname(root), platform === 'win32' ? 'Helm' : 'helm');
+  const paths = [root, old].flatMap(base => ['default-install.json', 'install.json'].map(name => path.join(base, name)));
+  const home = platform === 'win32' ? environment.USERPROFILE || os.homedir() : environment.HOME || os.homedir();
+  paths.push(...(platform === 'win32' ? ['stackbite.cmd', 'stackbite-portable.cmd', 'stackbite.exe'] : ['stackbite'])
+    .map(name => path.join(home, '.local', 'bin', name)));
+  const homes = new Set([cachedHome]);
+  for (const file of paths.slice(0, 4)) {
+    if (!await exists(file)) continue;
+    const value = JSON.parse((await readSmall(file, 16384)).toString('utf8').replace(/^\uFEFF/, ''));
+    if (typeof value.home === 'string' && path.isAbsolute(value.home)) homes.add(value.home);
+  }
+  for (const selected of homes) {
+    for (const name of ['portable.json', platform === 'win32' ? 'stackbite.exe' : 'stackbite', 'stackbite.py']) {
+      const file = path.join(selected, name);
+      if (await baselinePin(file) !== null) paths.push(file);
+    }
+  }
+  const legacy = [];
+  for (const file of new Set(paths)) legacy.push({ path: file, identity: await baselinePin(file) });
+  return legacy.some(pin => pin.identity !== null) ? { root, incarnation: null, legacy } : null;
+}
+
+async function assertBaseline(environment, platform) {
+  const raw = environment.STACKBITE_INSTALL_BASELINE;
+  if (raw === undefined) return;
+  if (Buffer.byteLength(raw) > 16384) fail('Invalid installation baseline');
+  const expected = JSON.parse(raw), root = installationRoot(environment, platform);
+  if (expected.preparation !== undefined) {
+    const pin = expected.preparation, file = path.join(root, '.stackbite-update', 'update.lock');
+    if (Object.keys(expected).sort().join(',') !== 'preparation,root' || expected.root !== root
+        || !pin || Object.keys(pin).sort().join(',') !== 'identity,path' || pin.path !== file || !pin.identity) fail('Invalid installation preparation');
+    let identity = pin.identity;
+    const actual = await baselinePin(file);
+    if (platform === 'win32' && actual) identity = { ...identity, device: (BigInt(identity.device) & 0xffffffffn).toString() };
+    if (JSON.stringify(actual) !== JSON.stringify(identity)) fail('Installation changed while staging');
+    return;
+  }
+  let current = null;
+  for (const name of ['default-install.json', 'install.json']) {
+    const file = path.join(root, name);
+    if (!await exists(file)) continue;
+    const value = JSON.parse((await readSmall(file, 16384)).toString('utf8').replace(/^\uFEFF/, ''));
+    current = value.installation_id ?? null;
+    break;
+  }
+  if (expected.root !== root || expected.incarnation !== current) fail('Installation changed while staging');
+  if (current === null) {
+    if (!Array.isArray(expected.legacy) || !expected.legacy.length || expected.legacy.length > 32) fail('Invalid legacy installation baseline');
+    for (const pin of expected.legacy) {
+      const actual = await baselinePin(pin.path);
+      let identity = pin.identity;
+      // Python-origin restrictions retain FILE_ID_INFO's full volume serial;
+      // libuv reports its 32-bit component. The engine still checks the full pin.
+      if (platform === 'win32' && actual && identity) identity = { ...identity, device: (BigInt(identity.device) & 0xffffffffn).toString() };
+      if (JSON.stringify(actual) !== JSON.stringify(identity)) fail('Installation changed while staging');
+    }
+  }
+}
+
+async function pinRegistration(npm, options) {
+  if (!npm) return null;
+  const file = path.join(npm.root, 'package.json');
+  const handle = await fs.open(file, require('node:fs').constants.O_RDONLY | (require('node:fs').constants.O_NOFOLLOW || 0));
+  try {
+    const held = await handle.stat({ bigint: true }), root = await fs.lstat(npm.root, { bigint: true });
+    const identity = { device: held.dev.toString(), inode: held.ino.toString() };
+    const source = {
+      async validate() {
+        const current = await fs.lstat(npm.root, { bigint: true });
+        const descriptor = await require('./uninstall-registration').descriptor(options);
+        if (!held.isFile() || held.nlink !== 1n || !current.isDirectory() || current.isSymbolicLink()
+            || current.dev !== root.dev || current.ino !== root.ino
+            || JSON.stringify(await baselinePin(file)) !== JSON.stringify(identity)
+            || JSON.stringify(descriptor) !== JSON.stringify(npm)) fail('npm registration changed while staging');
+      },
+      async absent() {
+        try { await fs.lstat(npm.root); return false; }
+        catch (error) { if (error.code === 'ENOENT') return true; throw error; }
+      },
+      close: () => handle.close()
+    };
+    await source.validate();
+    return source;
+  } catch (error) { await handle.close(); throw error; }
+}
+
+async function settlePreparation(preparation, environment, platform, source) {
+  try {
+    // Only the failed publisher's newly created object is ours. A replacement
+    // registration, locator, payload, control inode or foreign file survives.
+    if (!preparation.created || !source || !await source.absent()
+        || await captureBaseline(environment, platform, preparation.target)) return;
+    for (const [directory, pin] of preparation.directories) {
+      await existingCacheDirectory(directory);
+      const current = await fs.lstat(directory, { bigint: true });
+      if (current.dev !== pin.dev || current.ino !== pin.ino) return;
+    }
+    const { file, identity, handle } = preparation;
+    if (JSON.stringify(await baselinePin(file)) !== JSON.stringify(identity)) return;
+    const held = await handle.stat({ bigint: true });
+    if (!held.isFile() || held.nlink !== 1n || held.size > 1n) return;
+    const bytes = Buffer.alloc(2);
+    const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+    // Windows' existing Python byte-range gate initializes this SAME inode.
+    if (BigInt(bytesRead) !== held.size || bytesRead === 1 && bytes[0] !== 0x30) return;
+    await fs.unlink(file);
+    for (const [directory, pin] of preparation.directories) {
+      await existingCacheDirectory(directory);
+      const current = await fs.lstat(directory, { bigint: true });
+      if (current.dev !== pin.dev || current.ino !== pin.ino) break;
+      await fs.rmdir(directory);
+    }
+  } catch (error) {
+    if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(error.code)) throw error;
+  } finally { await preparation.handle.close(); }
+}
+
+async function reservePreparation(environment, platform, target, source) {
+  if (Object.hasOwn(environment, 'STACKBITE_INSTALL_BASELINE')) return null;
+  let baseline = await captureBaseline(environment, platform, target);
+  if (baseline) {
+    environment.STACKBITE_INSTALL_BASELINE = JSON.stringify(baseline);
+    return null;
+  }
+  // First use has no locator to pin. Hold the existing installation control
+  // file open across staging, with libuv's Windows delete sharing. This reserves
+  // object identity only; the bundled engine still takes the kernel gates.
+  const root = installationRoot(environment, platform), directory = path.join(root, '.stackbite-update');
+  await admitPublication(environment, platform);
+  await existingCacheDirectory(directory);
+  for (let parent = root; ; parent = path.dirname(parent)) {
+    if (await exists(path.join(parent, '.git'))) fail('Refusing installation preparation in a source repository');
+    if (parent === path.dirname(parent)) break;
+  }
+  if (source) await source.validate();
+  const firstCreated = await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+  await existingCacheDirectory(directory);
+  const directories = [];
+  if (firstCreated) {
+    for (const selected of [directory, root]) {
+      // libuv may return a Windows namespace spelling for the first directory.
+      const createdName = path.toNamespacedPath(firstCreated), selectedName = path.toNamespacedPath(selected);
+      if (selectedName === createdName || selectedName.startsWith(createdName + path.sep)) {
+        directories.push([selected, await fs.lstat(selected, { bigint: true })]);
+      }
+    }
+  }
+  const constants = require('node:fs').constants;
+  const file = path.join(directory, 'update.lock');
+  let handle, created = false, preparation;
+  try {
+    handle = await fs.open(file, constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | (constants.O_NOFOLLOW || 0), 0o600);
+    created = true;
+  } catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    handle = await fs.open(file, constants.O_RDWR | (constants.O_NOFOLLOW || 0));
+  }
+  try {
+    const held = await handle.stat({ bigint: true });
+    const identity = await baselinePin(file);
+    if (!held.isFile() || held.nlink !== 1n || JSON.stringify(identity) !== JSON.stringify({ device: held.dev.toString(), inode: held.ino.toString() })) fail('Invalid installation preparation');
+    preparation = { handle, file, identity, created, directories, target };
+    baseline = { root, preparation: { path: file, identity } };
+    environment.STACKBITE_INSTALL_BASELINE = JSON.stringify(baseline);
+    if (source) await source.validate();
+    await admitPublication(environment, platform);
+    await assertBaseline(environment, platform);
+    return preparation;
+  } catch (error) {
+    if (preparation) await settlePreparation(preparation, environment, platform, source);
+    else await handle.close();
+    throw error;
+  }
+}
+
+async function publishCache(payload, target, spec, options) {
+  await assertBaseline(options.environment, spec.platform);
+  if (options.existing) {
+    const root = installationRoot(options.environment, spec.platform);
+    for (const name of ['default-install.json', 'install.json']) {
+      const locator = path.join(root, name);
+      if (!await exists(locator)) continue;
+      const saved = JSON.parse((await readSmall(locator, 16384)).toString('utf8').replace(/^\uFEFF/, ''));
+      const descriptor = options.environment.STACKBITE_NPM_REGISTRATION;
+      if (typeof saved.home === 'string' && path.isAbsolute(saved.home)
+          && typeof saved.state === 'string' && path.isAbsolute(saved.state) && /^[a-f0-9]{32}$/.test(saved.installation_id)
+          && (!descriptor || JSON.stringify(saved.npm_registration) === JSON.stringify(JSON.parse(descriptor)))) return;
+      break;
+    }
+  }
+  const engine = path.join(payload, 'stackbite' + (spec.platform === 'win32' ? '.exe' : ''));
+  const argv = options.existing ? ['--record-install', target]
+    : ['--record-install', target, '-', payload, 'cache'];
+  const result = await launchNative(engine, argv, { ...options.environment, STACKBITE_HOME: payload }, options);
+  if (result.code !== 0 || result.signal) fail('Runtime publication was refused');
+}
+
 async function ensureBinary(spec, { cache = cacheDirectory(), downloadImpl = download, extractImpl = extractArchive,
-  checkOnly = false, reportCached = false, includePhone = false, progress = () => {} } = {}) {
+  checkOnly = false, reportCached = false, includePhone = false, progress = () => {},
+  environment = process.env, publishImpl = publishCache, registrationSource = null, ...options } = {}) {
   cache = path.resolve(cache);
+  environment = { ...environment };
+  if (!checkOnly) {
+    await admitPublication(environment, spec.platform);
+    await existingCacheDirectory(cache); // Validate existing ancestors without creating a cache.
+  }
   if (checkOnly) {
     if (!await existingCacheDirectory(cache)) fail('Pinned runtime is not cached; run stackbite setup.');
-  } else await safeDirectory(cache);
+  }
   // Full identity remains SHA-256 addressed while avoiding Windows MAX_PATH.
   const cacheKey = createHash('sha256').update(JSON.stringify([spec.version, spec.commit, spec.key, spec.sha256])).digest('hex');
   const target = path.join(cache, `v1-${cacheKey}`);
-  if (await exists(target)) {
-    if (checkOnly || reportCached) progress('validate');
-    const installed = { home: target, executable: await validatePayload(target, spec, { includePhone }) };
-    if (checkOnly || reportCached) progress('ready');
-    return installed;
-  }
-  if (checkOnly) fail('Pinned runtime is not cached; run stackbite setup.');
-  const staging = await fs.mkdtemp(path.join(cache, '.staging-'));
+  const preparation = !checkOnly ? await reservePreparation(environment, spec.platform, target, registrationSource) : null;
   try {
-    const archive = path.join(staging, spec.asset), extraction = path.join(staging, 'extract');
-    await fs.mkdir(extraction, { mode: 0o700 });
-    progress('download');
-    await downloadImpl(spec, archive);
-    // Recheck at the extraction boundary, including for injected test transports.
-    progress('archive');
-    if ((await fs.stat(archive)).size !== spec.size || await hashFile(archive, LIMITS.download) !== spec.sha256) fail('Pinned archive SHA-256 or size mismatch');
-    progress('extract');
-    await extractImpl(archive, extraction, spec);
-    const payload = path.join(extraction, spec.root);
-    progress('validate');
-    await validatePayload(payload, spec);
-    progress('publish');
-    try { await fs.rename(payload, target); }
-    catch (error) {
-      // Another process may have installed the same immutable payload first.
-      // Never delete/rewrite its directory or try a destructive rename retry.
-      if (!await exists(target)) throw error;
+    if (registrationSource) await registrationSource.validate();
+    if (!checkOnly) await assertBaseline(environment, spec.platform);
+    if (await exists(target)) {
+      if (checkOnly || reportCached) progress('validate');
+      const installed = { home: target, executable: await validatePayload(target, spec, { includePhone }) };
+      if (!checkOnly) await publishImpl(target, target, spec, { ...options, environment, existing: true });
+      if (checkOnly || reportCached) progress('ready');
+      return installed;
+    }
+    if (checkOnly) fail('Pinned runtime is not cached; run stackbite setup.');
+    // An owned system-temp stage keeps downloads out of product caches. Only the
+    // verified engine below can create/publish a canonical cache installation.
+    await admitPublication(environment, spec.platform);
+    await assertBaseline(environment, spec.platform);
+    if (registrationSource) await registrationSource.validate();
+    const staging = await fs.mkdtemp(path.join(os.tmpdir(), 'stackbite-npm-'));
+    try {
+      const archive = path.join(staging, spec.asset), extraction = path.join(staging, 'extract');
+      await fs.mkdir(extraction, { mode: 0o700 });
+      progress('download');
+      await downloadImpl(spec, archive);
+      // Recheck at the extraction boundary, including for injected test transports.
+      progress('archive');
+      if ((await fs.stat(archive)).size !== spec.size || await hashFile(archive, LIMITS.download) !== spec.sha256) fail('Pinned archive SHA-256 or size mismatch');
+      progress('extract');
+      await extractImpl(archive, extraction, spec);
+      const payload = path.join(extraction, spec.root);
+      progress('validate');
+      await validatePayload(payload, spec);
+      progress('publish');
+      await admitPublication(environment, spec.platform);
+      await assertBaseline(environment, spec.platform);
+      if (registrationSource) await registrationSource.validate();
+      await publishImpl(payload, target, spec, { ...options, environment, existing: false });
+      // Validate at the final path, including a concurrent publisher's payload.
+      progress('validate-published');
+      const installed = { home: target, executable: await validatePayload(target, spec) };
+      progress('ready');
+      return installed;
+    } finally {
+      // Only this mkdtemp handle is owned by this invocation.
+      if (path.dirname(staging) !== path.resolve(os.tmpdir()) || !path.basename(staging).startsWith('stackbite-npm-')) fail('Unsafe staging cleanup path');
+      await fs.rm(staging, { recursive: true, force: true });
     }
-    // Validate at the final path, including a concurrent publisher's payload.
-    progress('validate-published');
-    const installed = { home: target, executable: await validatePayload(target, spec) };
-    progress('ready');
-    return installed;
   } finally {
-    // Only this mkdtemp handle is owned by this invocation.
-    if (!inside(cache, staging) || path.dirname(staging) !== cache) fail('Unsafe staging cleanup path');
-    await fs.rm(staging, { recursive: true, force: true });
+    if (preparation) await settlePreparation(preparation, environment, spec.platform, registrationSource);
   }
 }
 async function launchNative(executable, argv, environment, { spawnImpl = spawn, signalSource = process } = {}) {
@@ -256,22 +529,41 @@ async function main(argv = process.argv.slice(2), options = {}) {
   const removing = ['uninstall', 'delete'].includes(argv[0]);
   const manifest = options.manifest || require('../release.json');
   const platform = options.platform || process.platform;
-  const environment = options.environment || process.env;
-  const spec = releaseSpec(manifest, platform, options.arch || process.arch, options);
-  // First install always verifies everything. Cached TUI/runtime starts defer only
-  // Phone; explicit phone/setup/removal commands retain the full pinned check.
-  const installed = await timing.phase(environment, 'launcher.ensure', () => ensureBinary(spec, { ...options,
-    cache: options.cache || cacheDirectory(environment, platform),
-    checkOnly: removing || setup?.checkOnly || false, reportCached: Boolean(setup),
-    includePhone: removing || Boolean(setup) || argv[0] === 'phone',
-    progress: options.progress || stageReporter(options.stderr || process.stderr) }));
-  if (setup) return { code: 0, signal: null };
-  timing.mark(environment, 'launcher.exec');
-  // The bundled runtime owns state discovery and migration for every entrypoint.
-  const result = await launchNative(installed.executable, argv, { ...environment,
-    STACKBITE_HOME: path.resolve(installed.home) }, options);
-  if (!removing) return result;
-  const { removeRegistration } = require('./uninstall-registration');
-  return removeRegistration(argv, result, environment, launchNative, options);
+  const environment = { ...(options.environment || process.env) };
+  // Only the package's existing descriptor producer supplies registration input.
+  // The engine validates package membership and tool/file identity before save.
+  delete environment.STACKBITE_NPM_REGISTRATION;
+  const { descriptor, explicitApply } = require('./uninstall-registration');
+  let npm = !removing ? await descriptor(options) : null;
+  const registrationSource = await pinRegistration(npm, options);
+  try {
+    if (npm) environment.STACKBITE_NPM_REGISTRATION = JSON.stringify(npm);
+    const spec = releaseSpec(manifest, platform, options.arch || process.arch, options);
+    // First install always verifies everything. Cached TUI/runtime starts defer only
+    // Phone; explicit phone/setup/removal commands retain the full pinned check.
+    let installed;
+    try { installed = await timing.phase(environment, 'launcher.ensure', () => ensureBinary(spec, { ...options,
+      environment, registrationSource,
+      cache: options.cache || cacheDirectory(environment, platform),
+      checkOnly: removing || setup?.checkOnly || false, reportCached: Boolean(setup),
+      includePhone: removing || Boolean(setup) || argv[0] === 'phone',
+      progress: options.progress || stageReporter(options.stderr || process.stderr) })); }
+    catch (error) {
+      if (!removing) throw error;
+      const { resumeWithoutRuntime, registrationOnly } = require('./uninstall-registration');
+      const recovered = await resumeWithoutRuntime(argv, environment, launchNative, options);
+      if (recovered) return recovered;
+      const registration = await registrationOnly(argv, environment, launchNative, options);
+      if (registration) return registration;
+      throw error;
+    }
+    if (setup) return { code: 0, signal: null };
+    timing.mark(environment, 'launcher.exec');
+    // The bundled runtime owns state discovery and migration for every entrypoint.
+    if (removing && explicitApply(argv)) npm = await descriptor(options);
+    return launchNative(installed.executable, argv, { ...environment,
+      ...(npm ? { STACKBITE_NPM_REGISTRATION: JSON.stringify(npm) } : {}),
+      STACKBITE_HOME: path.resolve(installed.home) }, options);
+  } finally { if (registrationSource) await registrationSource.close(); }
 }
 module.exports = { releaseSpec, validatePayload, ensureBinary, launchNative, main };

package/packaging/npm/lib/cache.js

@@ -6,7 +6,7 @@ const { fail } = require('./common');
 
 function cacheDirectory(environment = process.env, platform = process.platform, home = os.homedir()) {
   return platform === 'win32'
-    ? path.resolve(environment.LOCALAPPDATA || path.join(home, 'AppData', 'Local'), 'Stackbite', 'cache')
+    ? path.resolve(environment.LOCALAPPDATA || path.join(environment.USERPROFILE || home, 'AppData', 'Local'), 'Stackbite', 'cache')
     : path.resolve(environment.XDG_CACHE_HOME || path.join(environment.HOME || home, '.cache'), 'stackbite');
 }
 // Check every ancestor without creating anything, including for an absent cache.

package/packaging/npm/lib/uninstall-registration.js

@@ -11,7 +11,11 @@ async function registration(packageRoot, platform = process.platform) {
   if (!info.isDirectory() || info.isSymbolicLink() || await fs.realpath(root) !== root) {
     throw new Error('Linked npm registration preserved; remove it through its original package manager');
   }
-  const metadata = JSON.parse(await fs.readFile(path.join(root, 'package.json'), 'utf8'));
+  const packageFile = path.join(root, 'package.json'), packageInfo = await fs.lstat(packageFile);
+  await commandParent(packageFile);
+  if (await projectLocalPackage(root)) throw new Error('Source npm package preserved');
+  if (!packageInfo.isFile() || packageInfo.isSymbolicLink() || packageInfo.nlink !== 1) throw new Error('Linked npm package registration preserved');
+  const metadata = JSON.parse(await fs.readFile(packageFile, 'utf8'));
   if (metadata.name !== 'stackbite') throw new Error('Foreign npm package registration preserved');
   // npx owns its own cache, which is not a global registration.
   const prefix = globalPrefix(modules, platform);
@@ -19,6 +23,11 @@ async function registration(packageRoot, platform = process.platform) {
   return prefix;
 }
 
+async function projectLocalPackage(root) {
+  try { await fs.lstat(path.join(root, '.git')); return true; }
+  catch (error) { if (error.code !== 'ENOENT') throw error; return false; }
+}
+
 function globalPrefix(modules, platform) {
   const prefix = path.dirname(modules);
   if (prefix.split(path.sep).includes('_npx')) return null;
@@ -47,21 +56,321 @@ async function removeRegistration(argv, result, environment, launch, options = {
   if (prefix === null) return result;
   const node = options.nodeExecutable || process.execPath;
   const cli = options.npmCli || npmProgram(root, node);
+  const backup = await captureCommand(root, prefix, options.platform || process.platform, node, cli, options);
   const removed = await launch(node, [cli, 'uninstall', '--global', '--prefix', prefix,
     'stackbite', '--ignore-scripts', '--offline', '--no-audit', '--no-fund'],
   { ...environment, npm_config_update_notifier: 'false' }, options);
-  if (removed.code !== 0 || removed.signal) throw new Error('Product removal was accepted; npm registration removal failed');
+  let remains;
+  try { await fs.lstat(root); remains = true; } catch (error) { if (error.code !== 'ENOENT') throw error; remains = false; }
+  if (remains) {
+    await restoreCommand(backup);
+    throw new Error('Product removal was accepted; npm registration removal failed');
+  }
+  for (const item of backup?.shims || []) {
+    try {
+      const info = await fs.lstat(item.path);
+      if (info.dev === item.info.dev && info.ino === item.info.ino) await fs.unlink(item.path);
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  }
+  // npm can fail after removing its last owned file. Physical absence settles it.
+  void removed;
   return result;
 }
 
+async function captureCommand(root, prefix, platform, node, cli, recoveryOptions) {
+  const metadata = await fs.readFile(path.join(root, 'package.json'));
+  const relative = 'packaging/npm/bin/stackbite.js';
+  const bins = JSON.parse(metadata).bin;
+  if (!bins || Object.keys(bins).length !== 1 || bins.stackbite !== relative) return null;
+  const entry = path.join(root, relative), shims = [];
+  await commandParent(entry);
+  const entryInfo = await fs.lstat(entry);
+  if (!entryInfo.isFile() || entryInfo.isSymbolicLink() || entryInfo.nlink !== 1) throw new Error('Linked npm command preserved');
+  const entryData = await fs.readFile(entry);
+  for (const shim of platform === 'win32' ? ['stackbite', 'stackbite.cmd', 'stackbite.ps1'].map(name => path.join(prefix, name)) : [path.join(prefix, 'bin', 'stackbite')]) {
+    await commandParent(shim);
+    let info;
+    try { info = await fs.lstat(shim); } catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+    if (info.isSymbolicLink()) {
+      const target = await fs.readlink(shim);
+      if (path.resolve(path.dirname(shim), target) !== entry) throw new Error('Foreign npm command preserved');
+      shims.push({ path: shim, info, target });
+    } else {
+      const data = await fs.readFile(shim);
+      if (!info.isFile() || info.nlink !== 1 || data.length > 128 * 1024 || !data.toString('utf8').replaceAll('\\', '/').includes(relative)) throw new Error('Foreign npm command preserved');
+      shims.push({ path: shim, info, data });
+    }
+  }
+  if (!shims.length) return null;
+  const options = JSON.stringify({ packageRoot: root, platform, nodeExecutable: node, npmCli: cli,
+    installRoot: recoveryOptions.installRoot, cache: recoveryOptions.cache });
+  const recovery = Buffer.from(`const m=require('./uninstall-registration'),cp=require('node:child_process');\nconst launch=async(exe,args,env)=>{const r=cp.spawnSync(exe,args,{env,stdio:'inherit'});if(r.error)throw r.error;return {code:r.status,signal:r.signal};};\nmodule.exports.main=async()=>{const r=await m.registrationOnly(process.argv.slice(2),process.env,launch,${options});if(!r)throw Error('Native removal remains incomplete');return r;};\n`);
+  const files = [];
+  for (const [file, data] of [[path.join(root, 'package.json'), metadata], [entry, entryData],
+    [path.join(root, 'packaging/npm/lib/bootstrap.js'), recovery],
+    [path.join(root, 'packaging/npm/lib/uninstall-registration.js'), await fs.readFile(__filename)]]) {
+    await commandParent(file);
+    let info;
+    try { info = await fs.lstat(file); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (info && (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1)) throw new Error('Linked npm command preserved');
+    files.push({ path: file, info, data });
+  }
+  return { root, info: await fs.lstat(root), prefix, prefixInfo: await fs.lstat(prefix), shims, files };
+}
+
+async function restoreCommand(backup) {
+  if (!backup) return;
+  const info = await fs.lstat(backup.root);
+  if (info.dev !== backup.info.dev || info.ino !== backup.info.ino) throw new Error('npm registration replaced; preserved');
+  const prefix = await fs.lstat(backup.prefix);
+  if (prefix.dev !== backup.prefixInfo.dev || prefix.ino !== backup.prefixInfo.ino) throw new Error('npm prefix replaced; preserved');
+  const items = [...backup.files, ...backup.shims];
+  for (const item of items) {
+    await commandParent(item.path);
+    try {
+      const current = await fs.lstat(item.path);
+      if (!item.info || current.dev !== item.info.dev || current.ino !== item.info.ino) throw new Error('npm command replaced; preserved');
+      if (!item.target && (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1)) throw new Error('Linked npm command preserved');
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  }
+  for (const item of items) {
+    if (item.target) {
+      try { await fs.lstat(item.path); } catch (error) { if (error.code !== 'ENOENT') throw error; await fs.symlink(item.target, item.path); }
+    } else {
+      // An npm partial uninstall can leave this original bin read/share-only.
+      // Its existing require('../lib/bootstrap') reaches the small recovery module.
+      try { if ((await fs.readFile(item.path)).equals(item.data)) continue; }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      await fs.mkdir(path.dirname(item.path), { recursive: true });
+      await commandParent(item.path);
+      const file = await fs.open(item.path, require('node:fs').constants.O_WRONLY | require('node:fs').constants.O_CREAT
+        | require('node:fs').constants.O_TRUNC | (require('node:fs').constants.O_NOFOLLOW || 0), 0o755);
+      try { await file.writeFile(item.data); } finally { await file.close(); }
+      await fs.chmod(item.path, 0o755);
+    }
+  }
+}
+
+async function commandParent(file) {
+  for (let parent = path.dirname(file); ; parent = path.dirname(parent)) {
+    try { const info = await fs.lstat(parent); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('Linked npm command preserved'); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (parent === path.dirname(parent)) return;
+  }
+}
+
 function acceptedRemoval(argv, result) {
   return explicitApply(argv) && !result.signal && [0, 2].includes(result.code);
 }
 
 function explicitApply(argv) {
-  const choices = new Set(['--all', '--keep-data', '--resume']);
-  return argv.length === 3 && ['uninstall', 'delete'].includes(argv[0])
-    && argv.slice(1).includes('--apply') && argv.slice(1).some(arg => choices.has(arg));
+  const allowed = new Set(['--all', '--keep-data', '--resume', '--apply', '--yes']);
+  return ['uninstall', 'delete'].includes(argv[0]) && argv.slice(1).every(arg => allowed.has(arg))
+    && !(argv.includes('--all') && argv.includes('--keep-data'))
+    && !(argv.includes('--resume') && (argv.includes('--all') || argv.includes('--keep-data')));
+}
+
+async function descriptor(options = {}) {
+  const root = options.packageRoot || path.resolve(__dirname, '../../..');
+  const prefix = await registration(root, options.platform || process.platform);
+  if (prefix === null) return null;
+  const node = options.nodeExecutable || process.execPath;
+  return { root, prefix, node: await fs.realpath(node), cli: await fs.realpath(options.npmCli || npmProgram(root, node)) };
+}
+
+function windowsCleanupCommand(helper, pin) {
+  const encoded = Buffer.from(helper, 'utf8').toString('base64');
+  const dispatch = "& { $p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encoded
+    + "')); $b=[IO.File]::ReadAllBytes($p); $s=[Security.Cryptography.SHA256]::Create(); try { "
+    + "$h=[BitConverter]::ToString($s.ComputeHash($b)).Replace('-','').ToLowerInvariant() "
+    + "} finally { $s.Dispose() }; if ($h -ne '" + pin.sha256 + "') { throw 'Removal capsule changed' }; "
+    + "& ([scriptblock]::Create([Text.Encoding]::UTF8.GetString($b).TrimStart([char]0xfeff))) }";
+  return ['powershell.exe', '-NoProfile', '-Command', dispatch];
+}
+
+async function registrationOnly(argv, environment, launch, options = {}) {
+  if (!explicitApply(argv)) return null;
+  const platform = options.platform || process.platform;
+  const packageRoot = options.packageRoot || path.resolve(__dirname, '../../..');
+  const prefix = await registration(packageRoot, platform);
+  if (prefix === null) return null;
+  const home = (platform === 'win32' ? environment.USERPROFILE || environment.HOME : environment.HOME) || require('node:os').homedir();
+  const data = platform === 'win32' ? environment.LOCALAPPDATA || home
+    : environment.XDG_DATA_HOME || path.join(home, '.local', 'share');
+  const root = options.installRoot || path.join(data, platform === 'win32' ? 'Stackbite' : 'stackbite');
+  const canonical = path.join(data, platform === 'win32' ? 'Stackbite' : 'stackbite');
+  const old = path.join(data, platform === 'win32' ? 'Helm' : 'helm');
+  // Keep this recovery module standalone after npm removes the other modules.
+  // This is cache.js's npm namespace, not Python's locator/control fallback.
+  const npmData = environment.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+  const roots = [root, ...['app', 'cache', 'state', 'default-install.json', 'install.json'].map(name => path.join(old, name)),
+    ...(platform === 'win32' ? [path.join(npmData, 'Stackbite'),
+      ...['app', 'cache', 'state', 'default-install.json', 'install.json'].map(name =>
+        path.join(npmData, 'Helm', name))] : []),
+    ...(platform === 'win32' ? [] : ['stackbite', 'helm'].flatMap(name => [
+      path.join(environment.XDG_STATE_HOME || path.join(home, '.local', 'state'), name),
+      path.join(environment.XDG_CACHE_HOME || path.join(home, '.cache'), name)])),
+    ...[options.cache, environment.STACKBITE_HOME, environment.STACKBITE_STATE_DIR].filter(Boolean)];
+  // Directory shells left by a completed physical tail contain no artifacts.
+  // The pinned canonical preparation below is the only permitted file.
+  let preparation, preparationHandle;
+  async function empty(location) {
+    try {
+      const info = await fs.lstat(location);
+      if (preparation && location === preparation.file) return preparationCurrent();
+      if (!info.isDirectory() || info.isSymbolicLink() || await fs.realpath(location) !== path.resolve(location)) return false;
+      for (const name of await fs.readdir(location)) if (!await empty(path.join(location, name))) return false;
+      return true;
+    } catch (error) { if (error.code === 'ENOENT') return true; throw error; }
+  }
+  const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
+  async function preparationCurrent() {
+    const held = await preparation.handle.stat({ bigint: true });
+    const current = await fs.lstat(preparation.file, { bigint: true });
+    const bytes = Buffer.alloc(2);
+    const { bytesRead } = await preparation.handle.read(bytes, 0, bytes.length, 0);
+    return held.isFile() && current.isFile() && !current.isSymbolicLink()
+      && held.nlink === 1n && current.nlink === 1n && same(held, preparation.info) && same(current, held)
+      && held.size <= 1n && current.size === held.size && BigInt(bytesRead) === held.size
+      && (bytesRead === 0 || bytesRead === 1 && bytes[0] === 0x30);
+  }
+  async function preparationDirectories() {
+    for (let parent = preparation.directory; ; parent = path.dirname(parent)) {
+      const info = await fs.lstat(parent);
+      if (!info.isDirectory() || info.isSymbolicLink() || await fs.realpath(parent) !== parent) return false;
+      try { await fs.lstat(path.join(parent, '.git')); return false; }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      if (parent === path.dirname(parent)) break;
+    }
+    for (const [directory, expected, names] of [
+      [root, preparation.rootInfo, ['.stackbite-update']],
+      [preparation.directory, preparation.directoryInfo, ['update.lock']],
+    ]) {
+      const info = await fs.lstat(directory, { bigint: true });
+      if (!info.isDirectory() || info.isSymbolicLink() || !same(info, expected)
+          || await fs.realpath(directory) !== directory
+          || JSON.stringify((await fs.readdir(directory)).sort()) !== JSON.stringify(names)) return false;
+    }
+    return preparationCurrent();
+  }
+  // A first-ever publisher pins this existing control object across download.
+  // Unlinking its verified name invalidates that publisher; this FD is no mutex.
+  const directory = path.join(root, '.stackbite-update'), file = path.join(directory, 'update.lock');
+  try {
+    try {
+      const info = await fs.lstat(file, { bigint: true });
+      if (root !== canonical || !path.isAbsolute(root) || path.resolve(root) !== root
+          || root.split(path.sep).includes('..') || /[\0\r\n]/.test(root)
+          || !info.isFile() || info.isSymbolicLink() || info.nlink !== 1n || info.size > 1n) return null;
+      for (let parent = directory; ; parent = path.dirname(parent)) {
+        const parentInfo = await fs.lstat(parent);
+        if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink() || await fs.realpath(parent) !== parent) return null;
+        try { await fs.lstat(path.join(parent, '.git')); return null; }
+        catch (error) { if (error.code !== 'ENOENT') throw error; }
+        if (parent === path.dirname(parent)) break;
+      }
+      preparationHandle = await fs.open(file, require('node:fs').constants.O_RDONLY | (require('node:fs').constants.O_NOFOLLOW || 0));
+      preparation = { file, directory, info, handle: preparationHandle, rootInfo: await fs.lstat(root, { bigint: true }),
+        directoryInfo: await fs.lstat(directory, { bigint: true }) };
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (preparation && !await preparationDirectories()) return null;
+    const commands = platform === 'win32' ? ['stackbite.cmd', 'stackbite-portable.cmd', 'stackbite.exe', 'stackbite.exe.next'] : ['stackbite'];
+    for (const name of commands) {
+      const native = path.join(home, '.local', 'bin', name);
+      const own = platform === 'win32' ? path.join(prefix, name) : path.join(prefix, 'bin', name);
+      if (native !== own) roots.push(native);
+    }
+    for (const location of new Set(roots)) {
+      const absolute = path.resolve(location);
+      for (let parent = path.dirname(absolute); ; parent = path.dirname(parent)) {
+        try { const info = await fs.lstat(parent); if (!info.isDirectory() || info.isSymbolicLink()) return null; }
+        catch (error) { if (error.code !== 'ENOENT') throw error; }
+        if (parent === path.dirname(parent)) break;
+      }
+      if (!await empty(absolute)) return null;
+    }
+    if (preparation) {
+      if (!await preparationDirectories()) return null;
+      await fs.unlink(preparation.file);
+      for (const [location, expected] of [[directory, preparation.directoryInfo], [root, preparation.rootInfo]]) {
+        const current = await fs.lstat(location, { bigint: true });
+        if (!same(current, expected) || !current.isDirectory() || current.isSymbolicLink()
+            || await fs.realpath(location) !== location) throw new Error('Installation preparation replaced; preserved');
+        await fs.rmdir(location);
+      }
+    }
+    return removeRegistration(argv, { code: 0, signal: null }, environment, launch, { ...options, packageRoot });
+  } finally { if (preparationHandle) await preparationHandle.close(); }
+}
+
+// Recovery never installs/downloads another runtime. Only the accepted journal's
+// exact capsule can continue a partially removed product.
+async function resumeWithoutRuntime(argv, environment, launch, options = {}) {
+  if (!explicitApply(argv)) return null;
+  const platform = options.platform || process.platform;
+  const home = (platform === 'win32' ? environment.USERPROFILE || environment.HOME : environment.HOME) || require('node:os').homedir();
+  const root = options.installRoot || (platform === 'win32'
+    ? path.join(environment.LOCALAPPDATA || home, 'Stackbite')
+    : path.join(environment.XDG_DATA_HOME || path.join(home, '.local', 'share'), 'stackbite'));
+  const journal = path.join(root, '.stackbite-uninstall.json');
+  let record;
+  try {
+    const info = await fs.lstat(journal);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > 8 * 1024 * 1024
+        || await fs.realpath(journal) !== journal) throw new Error('Unsafe removal journal');
+    record = JSON.parse(await fs.readFile(journal, 'utf8'));
+  } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  if (record.schema !== 'stackbite.uninstall.v1' || !record.accepted || !record.processes_settled
+      || record.install_identity?.root !== root) return null;
+  // The capsule takes the existing installation/removal locks and owns all
+  // journal mutation, including npm settlement. This reader never rewrites it.
+  const command = record.recovery_command;
+  const suffix = platform === 'win32' ? '.ps1' : '.sh';
+  const helper = journal.replace(/\.json$/, suffix);
+  const pin = record.helper_files?.find(item => item.path === helper);
+  if (!pin) return null;
+  const expected = platform === 'win32' ? windowsCleanupCommand(helper, pin) : ['sh', helper];
+  const legacy = ['powershell.exe', '-NoProfile', '-File', helper];
+  const selected = platform === 'win32' && JSON.stringify(command) === JSON.stringify(legacy) ? legacy : expected;
+  if (!Array.isArray(command) || JSON.stringify(command) !== JSON.stringify(selected)
+      || !record.helper_files?.some(item => item.path === helper)) return null;
+  const info = await fs.lstat(helper);
+  if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > 128 * 1024
+      || await fs.realpath(helper) !== helper
+      || require('node:crypto').createHash('sha256').update(await fs.readFile(helper)).digest('hex') !== pin.sha256) {
+    throw new Error('Removal capsule changed; preserved');
+  }
+  if (platform !== 'win32') {
+    const capsule = journal.replace(/\.json$/, '.cleanup');
+    const pinned = record.helper_files.find(item => item.path === capsule);
+    const current = await fs.lstat(capsule);
+    if (!pinned || !current.isFile() || current.isSymbolicLink() || current.nlink !== 1
+        || await fs.realpath(capsule) !== capsule
+        || require('node:crypto').createHash('sha256').update(await fs.readFile(capsule)).digest('hex') !== pinned.sha256) {
+      throw new Error('Removal capsule changed; preserved');
+    }
+    // Source invocations retain their existing interpreter/entry outside the
+    // removal inventory. Validate those exact pins before executing the shell
+    // capsule; neither environment PATH nor journal argv selects a runtime.
+    if (record.source_cleanup_pins !== undefined) {
+      if (!Array.isArray(record.source_cleanup_pins) || record.source_cleanup_pins.length !== 4) {
+        throw new Error('Source cleanup identity changed');
+      }
+      for (const pin of record.source_cleanup_pins) {
+        const location = pin.path;
+        if (typeof location !== 'string' || !path.isAbsolute(location) || /[\x00\r\n]/.test(location)
+            || location.split(path.sep).includes('..')) throw new Error('Source cleanup runtime changed');
+        const current = await fs.lstat(location);
+        if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1
+            || await fs.realpath(location) !== location || current.dev !== pin.identity?.device
+            || current.ino !== pin.identity?.inode
+            || require('node:crypto').createHash('sha256').update(await fs.readFile(location)).digest('hex') !== pin.sha256) {
+          throw new Error('Source cleanup runtime changed');
+        }
+      }
+    }
+  }
+  return launch(selected[0], selected.slice(1), environment, options);
 }
 
-module.exports = { registration, npmProgram, removeRegistration, explicitApply };
+module.exports = { registration, npmProgram, removeRegistration, explicitApply, descriptor, resumeWithoutRuntime, registrationOnly };

package/packaging/npm/release.json

@@ -1,35 +1,35 @@
 {
   "schema": 1,
-  "version": "0.5.94",
-  "commit": "0967956cd84b4f54ebbd6ea57e97d39b41a0180d",
+  "version": "0.5.96",
+  "commit": "7f23d4a4e4d940e0147d841992e93dd23befc944",
   "repository": "Shinick-Han/stackbite",
   "platforms": {
     "win32-x64": {
-      "asset": "stackbite-0.5.94-windows-x64-0967956cd84b.zip",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.94/stackbite-0.5.94-windows-x64-0967956cd84b.zip",
-      "sha256": "2f4b498d32c4b178c13050ecfbe8d75c68519e28fb077faf332047e324aa9468",
-      "size": 95452893,
-      "root": "stackbite-0.5.94-windows-x64-0967956cd84b",
-      "manifestSha256": "562dfe876813843a21cdad476f0668acd56bd237d46df7b38b3744f6d1fbea19",
-      "metadataSha256": "4f5af02381519002f07821e067d7ceb101e385c199f7dd40cbeee8de39b3bbe3"
+      "asset": "stackbite-0.5.96-windows-x64-7f23d4a4e4d9.zip",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.96/stackbite-0.5.96-windows-x64-7f23d4a4e4d9.zip",
+      "sha256": "ea9b75271f5fbb2ba082eb323adecbacf53a0b049330be2e99fefe865fc6dba0",
+      "size": 95635099,
+      "root": "stackbite-0.5.96-windows-x64-7f23d4a4e4d9",
+      "manifestSha256": "464afb4d132173090c27e4fb2546801cf469b4659e1df68b51fad92555ceaac4",
+      "metadataSha256": "5d741796ed25420cb01d0ba736a3d54a94609369702f58c0770c1dc23241aa75"
     },
     "linux-x64": {
-      "asset": "stackbite-0.5.94-linux-x86_64-0967956cd84b.tar.gz",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.94/stackbite-0.5.94-linux-x86_64-0967956cd84b.tar.gz",
-      "sha256": "2a7c598bb64e0aa344d7b803b4b45c5b8fe065e0d2bf8dd76ce65d4319629c75",
-      "size": 75552802,
-      "root": "stackbite-0.5.94-linux-x86_64-0967956cd84b",
-      "manifestSha256": "998b676c92c2211cdac5403fcb690aa8af9e098fcda9da2dad40a1f6bd7839eb",
-      "metadataSha256": "b713e8488390fc5e739796d521989f814f7df84ea0f14f57a5cca499ffed0ad7"
+      "asset": "stackbite-0.5.96-linux-x86_64-7f23d4a4e4d9.tar.gz",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.96/stackbite-0.5.96-linux-x86_64-7f23d4a4e4d9.tar.gz",
+      "sha256": "2cd509a933634d270da4e1729022beb7b7a803880617088c94327d2ad4631e38",
+      "size": 75907031,
+      "root": "stackbite-0.5.96-linux-x86_64-7f23d4a4e4d9",
+      "manifestSha256": "d59dd6704b0ada8a426f5fab557728d2fef7008cecf076c45662c6292546b6b7",
+      "metadataSha256": "d1afa491f2d0d1f3f128e9b8bef24b62c2adbd3a3ea84fef5692552f303063b2"
     },
     "darwin-arm64": {
-      "asset": "stackbite-0.5.94-macos-arm64-0967956cd84b.tar.gz",
-      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.94/stackbite-0.5.94-macos-arm64-0967956cd84b.tar.gz",
-      "sha256": "36a0678f50e965aafc11f0aad78e1dda6cd43f19fbb417407ec47a4a11d1bb8f",
-      "size": 30617240,
-      "root": "stackbite-0.5.94-macos-arm64-0967956cd84b",
-      "manifestSha256": "6c3c88d740dcd8eee9cd20321d55a44153bd605a72f8d09151e0a3b664d509e9",
-      "metadataSha256": "ce7ff89aa5b64c3d3aa488486f1e5aa6fd8ebbc56de9c2057070bbac781a8a75"
+      "asset": "stackbite-0.5.96-macos-arm64-7f23d4a4e4d9.tar.gz",
+      "url": "https://github.com/Shinick-Han/stackbite/releases/download/v0.5.96/stackbite-0.5.96-macos-arm64-7f23d4a4e4d9.tar.gz",
+      "sha256": "822879f121af836b47152d7def5e59e50fcb1a8ed987090d1efff4c3688e3ed2",
+      "size": 30871909,
+      "root": "stackbite-0.5.96-macos-arm64-7f23d4a4e4d9",
+      "manifestSha256": "e25fc4c20e124d2db018d8402cb5590368e634afc0b6bc035db665ee0a54578c",
+      "metadataSha256": "e6ef71691f4d36ad244864d2cbfb2f916e7afafda8c59787926399b6539e2562"
     }
   }
 }