tmux-ide 2.9.2 → 2.9.3

package/packages/daemon/src/lib/log.ts

@@ -152,16 +152,16 @@ export function getLogStreamFailures(): readonly StreamName[] {
 function markStreamFailed(name: StreamName, error: unknown): void {
   if (streamState[name].failed) return;
   streamState[name].failed = true;
-  const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+  const detail = sanitizeLogMessage(
+    error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+    secrets,
+    budget,
+  );
   const warning = `[log.ts] ${name} write failed (${detail}); further records are retained in memory only\n`;
   const other: StreamName = name === "stdout" ? "stderr" : "stdout";
-  if (!streamState[other].failed) {
-    try {
-      process[other].write(warning);
-    } catch {
-      streamState[other].failed = true;
-    }
-  }
+  // The fallback can fail asynchronously too. Install the same error handling
+  // before writing it; failed flags prevent a warning loop if both streams fail.
+  if (!streamState[other].failed) writeToStream(other, warning);
 }
 
 function writeToStream(name: StreamName, line: string): void {
@@ -221,7 +221,11 @@ function writeStructuredLog(
       // Avoid recursion via the logger; write directly to stderr.
       writeToStream(
         "stderr",
-        `[log.ts] subscriber threw: ${err instanceof Error ? err.message : String(err)}\n`,
+        `[log.ts] subscriber threw: ${sanitizeLogMessage(
+          err instanceof Error ? err.message : String(err),
+          secrets,
+          budget,
+        )}\n`,
       );
     }
   }

package/packages/daemon/src/lib/managed-installer-update.ts

@@ -0,0 +1,79 @@
+import { mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+import { execFileSync } from "node:child_process";
+
+export const MANAGED_INSTALLER_URL = "https://tmux-ide.com/install.sh";
+
+/** Only the active release of a marked installation may update its prefix. */
+export function managedInstallerPrefix(cliPath: string): string | null {
+  const match =
+    /^(.*)\/share\/tmux-ide\/releases\/(install-[A-Za-z0-9]{6})\/npm\/lib\/node_modules\/tmux-ide\/bin$/.exec(
+      cliPath,
+    );
+  if (!match) return null;
+  const prefix = match[1] || "/";
+  const root = join(prefix, "share/tmux-ide");
+  const release = join(root, "releases", match[2]!);
+  try {
+    if (realpathSync(join(root, "current")) !== release) return null;
+    if (realpathSync(release) !== release) return null;
+    if (readFileSync(join(root, "installer-v1"), "utf8") !== "1\n") return null;
+    if (readFileSync(join(release, ".installer-release-v1"), "utf8") !== "1\n") return null;
+    if (
+      !readFileSync(join(prefix, "bin/tmux-ide"), "utf8")
+        .split("\n")
+        .includes("# tmux-ide universal installer v1")
+    )
+      return null;
+    if (
+      JSON.parse(readFileSync(join(dirname(cliPath), "package.json"), "utf8")).name !== "tmux-ide"
+    )
+      return null;
+    return prefix;
+  } catch {
+    return null;
+  }
+}
+
+/** Download completely before execution; the canonical installer owns activation and rollback. */
+export function runManagedInstallerUpdate(
+  prefix: string,
+  channel: string,
+  json: boolean,
+  execute: typeof execFileSync = execFileSync,
+): void {
+  const temporary = mkdtempSync(join(tmpdir(), "tmux-ide-update-"));
+  const script = join(temporary, "install.sh");
+  try {
+    execute(
+      "curl",
+      [
+        "--fail",
+        "--location",
+        "--silent",
+        "--show-error",
+        "--proto",
+        "=https",
+        "--proto-redir",
+        "=https",
+        "--connect-timeout",
+        "15",
+        "--max-time",
+        "180",
+        "--output",
+        script,
+        MANAGED_INSTALLER_URL,
+      ],
+      { stdio: ["ignore", 2, 2] },
+    );
+    if (!readFileSync(script, "utf8").startsWith("#!/bin/sh\n"))
+      throw new Error("Installer download was not a shell script; installation unchanged");
+    execute("/bin/sh", ["-n", script], { stdio: ["ignore", 2, 2] });
+    execute("/bin/sh", [script, "--prefix", prefix, "--version", channel], {
+      stdio: json ? ["ignore", 2, 2] : "inherit",
+    });
+  } finally {
+    rmSync(temporary, { recursive: true, force: true });
+  }
+}

package/packages/daemon/src/lib/{tui-download-lock.ts → private-operation-lock.ts}

@@ -26,7 +26,7 @@ function trusted(path: string, directory: boolean) {
     (value.mode & 0o777) !== (directory ? 0o700 : 0o600) ||
     (!directory && value.nlink !== 1)
   )
-    throw new Error("unsafe TUI download lock");
+    throw new Error("unsafe private operation lock");
   return value;
 }
 function readOwner(path: string): { pid: number; ino: number; dev: number } {
@@ -35,15 +35,15 @@ function readOwner(path: string): { pid: number; ino: number; dev: number } {
   try {
     const actual = fstatSync(fd);
     if (actual.ino !== before.ino || actual.dev !== before.dev || actual.size > 32) {
-      throw new Error("unsafe TUI download lock");
+      throw new Error("unsafe private operation lock");
     }
     const bytes = Buffer.alloc(33);
     const length = readSync(fd, bytes, 0, bytes.length, 0);
     const text = bytes.subarray(0, length).toString("utf8");
-    if (!/^[1-9][0-9]*\n$/.test(text)) throw new Error("invalid TUI download lock owner");
+    if (!/^[1-9][0-9]*\n$/.test(text)) throw new Error("invalid private operation lock owner");
     const pid = Number(text.trim());
     if (!Number.isSafeInteger(pid) || pid > 2147483647)
-      throw new Error("invalid TUI download lock owner");
+      throw new Error("invalid private operation lock owner");
     return { pid, ino: actual.ino, dev: actual.dev };
   } finally {
     closeSync(fd);
@@ -88,7 +88,7 @@ function cleanStaging(
   try {
     const current = trusted(path, true);
     if (current.ino !== expected.ino || current.dev !== expected.dev)
-      throw new Error("TUI download staging lock changed");
+      throw new Error("private operation staging lock changed");
     try {
       unlinkSync(join(path, name));
     } catch (error) {
@@ -102,7 +102,10 @@ function cleanStaging(
 }
 
 /** Publish a populated private directory atomically; age never proves owner death. */
-export async function acquireTuiDownloadLock(lock: string, waitMs: number): Promise<() => void> {
+export async function acquirePrivateOperationLock(
+  lock: string,
+  waitMs: number,
+): Promise<() => void> {
   const deadline = Date.now() + waitMs;
   const nonce = randomUUID();
   const name = `owner-${nonce}`;
@@ -116,7 +119,7 @@ export async function acquireTuiDownloadLock(lock: string, waitMs: number): Prom
     writeFileSync(join(staging, name), `${process.pid}\n`, { flag: "wx", mode: 0o600 });
     while (true) {
       if (attempted && Date.now() >= deadline)
-        throw new Error("timed out waiting for another TUI download");
+        throw new Error("timed out waiting for another private operation");
       attempted = true;
       try {
         const existing = lstatSync(lock);
@@ -154,7 +157,7 @@ export async function acquireTuiDownloadLock(lock: string, waitMs: number): Prom
           }
           if (names.length !== 1 || !/^owner-[0-9a-f-]{36}$/.test(names[0]!)) {
             // Empty is only a retirement gap; the next atomic rename can claim it.
-            if (names.length !== 0) throw new Error("invalid TUI download lock inventory");
+            if (names.length !== 0) throw new Error("invalid private operation lock inventory");
           } else {
             const owner = readOwner(join(lock, names[0]!));
             if (dead(owner.pid)) {
@@ -164,7 +167,7 @@ export async function acquireTuiDownloadLock(lock: string, waitMs: number): Prom
                 current.dev !== owner.dev ||
                 current.pid !== owner.pid
               ) {
-                throw new Error("TUI download lock changed");
+                throw new Error("private operation lock changed");
               }
               retire(lock, names[0]!, entry);
             }
@@ -182,7 +185,7 @@ export async function acquireTuiDownloadLock(lock: string, waitMs: number): Prom
               current.dev !== owner.dev ||
               current.pid !== owner.pid
             ) {
-              throw new Error("TUI download lock changed");
+              throw new Error("private operation lock changed");
             }
             try {
               unlinkSync(lock);
@@ -194,7 +197,8 @@ export async function acquireTuiDownloadLock(lock: string, waitMs: number): Prom
       } catch (error) {
         if (code(error) !== "ENOENT") throw error;
       }
-      if (Date.now() >= deadline) throw new Error("timed out waiting for another TUI download");
+      if (Date.now() >= deadline)
+        throw new Error("timed out waiting for another private operation");
       await new Promise((resolve) =>
         setTimeout(resolve, Math.min(50, Math.max(0, deadline - Date.now()))),
       );

package/packages/daemon/src/lib/remote-daemon-info.ts

@@ -1,4 +1,4 @@
-import { type CanonicalDaemonInfo } from "@tmux-ide/contracts";
+import { DAEMON_WIRE_PROTOCOL_VERSION, type CanonicalDaemonInfo } from "@tmux-ide/contracts";
 import {
   canonicalDaemonUrl,
   isCanonicalDaemonAlive,
@@ -35,9 +35,9 @@ export async function readRemoteDaemonHandshake(
       "daemon-missing",
     );
   const parsed = RemoteDaemonHandshakeSchema.safeParse({ version: 1, daemon: info });
-  if (!parsed.success)
+  if (!parsed.success || info.protocolVersion !== DAEMON_WIRE_PROTOCOL_VERSION)
     throw new RemoteDaemonInfoError(
-      "The daemon does not support authenticated SSH discovery.",
+      "The daemon does not support this authenticated SSH discovery protocol.",
       "incompatible",
     );
   try {

package/packages/daemon/src/lib/remote-daemon-lifecycle.ts

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { SavedMachineSchema } from "@tmux-ide/contracts/saved-machines";
+import { remoteTmuxIdeCommand } from "./remote-tmux-command.ts";
 
 /** Only explicit user actions call this; catalog discovery and retries never do. */
 export async function startInstalledRemoteDaemon(
@@ -21,12 +22,11 @@ export async function startInstalledRemoteDaemon(
         "BatchMode=yes",
         "-o",
         "ConnectTimeout=10",
+        "-o",
+        "ForkAfterAuthentication=no",
         "--",
         alias,
-        "tmux-ide",
-        "update",
-        "--daemon",
-        "--json",
+        remoteTmuxIdeCommand("start"),
       ],
       { stdio: ["ignore", "pipe", "pipe"] },
     );

package/packages/daemon/src/lib/remote-tmux-command.ts

@@ -0,0 +1,12 @@
+import { shellEscape } from "./shell.ts";
+
+/** Fixed commands only. SSH normally omits interactive shell PATH setup. */
+export function remoteTmuxIdeCommand(operation: "discover" | "start"): string {
+  const args = operation === "discover" ? "remote-daemon-info --json" : "update --daemon --json";
+  // Respect the host's existing installation preference, then try the installer
+  // and common package-manager prefixes. Never source shell profiles.
+  const script =
+    'export PATH="${PATH:-/usr/bin:/bin}:$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:/home/linuxbrew/.linuxbrew/bin:$HOME/.npm-global/bin"; ' +
+    `exec tmux-ide ${args}`;
+  return `/bin/sh -c ${shellEscape(script)}`;
+}

package/packages/daemon/src/lib/runtime-namespace.ts

@@ -81,12 +81,11 @@ function absolutePath(value: string, cwd: string, key: string): string {
   return path;
 }
 
-function pathEntryExists(path: string): boolean {
+function pathEntryStat(path: string) {
   try {
-    lstatSync(path);
-    return true;
+    return lstatSync(path);
   } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
     throw error;
   }
 }
@@ -94,21 +93,23 @@ function pathEntryExists(path: string): boolean {
 function pathIdentity(path: string): string {
   let cursor = resolve(path);
   const suffix: string[] = [];
-  while (!pathEntryExists(cursor)) {
+  let stat = pathEntryStat(cursor);
+  while (!stat) {
     const parent = dirname(cursor);
     if (parent === cursor) break;
     suffix.unshift(basename(cursor));
     cursor = parent;
+    stat = pathEntryStat(cursor);
   }
-  if (pathEntryExists(cursor) && lstatSync(cursor).isSocket()) {
+  if (stat?.isSocket()) {
     return resolve(captureUnixSocketIdentity(cursor).path, ...suffix);
   }
-  return resolve(pathEntryExists(cursor) ? realpathSync(cursor) : cursor, ...suffix);
+  return resolve(stat ? realpathSync(cursor) : cursor, ...suffix);
 }
 
-function isInsideOrEqual(path: string, parent: string): boolean {
-  const child = pathIdentity(path);
-  const root = pathIdentity(parent);
+function isInsideOrEqual(path: string, parent: string, identity = pathIdentity): boolean {
+  const child = identity(path);
+  const root = identity(parent);
   const offset = relative(root, child);
   return offset === "" || (!offset.startsWith(`..${sep}`) && offset !== "..");
 }
@@ -124,6 +125,17 @@ function runtimeMode(env: NodeJS.ProcessEnv): RuntimeMode {
 export function resolveRuntimeNamespace(
   options: RuntimeNamespaceResolutionOptions = {},
 ): RuntimeNamespace {
+  // Reuse a path's identity only within this synchronous resolution. Every
+  // subsequent resolution must see new ancestors and replaced symlinks.
+  let identities: Map<string, string> | undefined;
+  const identity = (path: string): string => {
+    const cached = identities?.get(path);
+    if (cached !== undefined) return cached;
+    const resolved = pathIdentity(path);
+    (identities ??= new Map()).set(path, resolved);
+    return resolved;
+  };
+  const within = (path: string, parent: string) => isInsideOrEqual(path, parent, identity);
   const env = options.env ?? process.env;
   const userHome = options.userHome ?? homedir();
   const cwd = options.cwd ?? process.cwd();
@@ -205,16 +217,13 @@ export function resolveRuntimeNamespace(
   if (isolated && tmuxSocket.kind === "name" && tmuxSocket.name === "default") {
     throw new TypeError(`${mode} runtime requires a non-default ${TMUX_SOCKET_NAME_ENV}`);
   }
-  if (isolated && isInsideOrEqual(stateHome, canonicalHome)) {
+  if (isolated && within(stateHome, canonicalHome)) {
     throw new TypeError(`${mode} runtime cannot use the canonical tmux-ide state home`);
   }
-  if (
-    isolated &&
-    (isInsideOrEqual(registryDir, canonicalHome) || isInsideOrEqual(daemonInfoDir, canonicalHome))
-  ) {
+  if (isolated && (within(registryDir, canonicalHome) || within(daemonInfoDir, canonicalHome))) {
     throw new TypeError(`${mode} runtime cannot use canonical registry or daemon state`);
   }
-  if (isolated && tmuxSocket.kind === "path" && isInsideOrEqual(tmuxSocket.path, canonicalHome)) {
+  if (isolated && tmuxSocket.kind === "path" && within(tmuxSocket.path, canonicalHome)) {
     throw new TypeError(`${mode} runtime cannot use a tmux socket inside canonical state`);
   }
   if (isolated && cleanupToken === null) {
@@ -229,7 +238,7 @@ export function resolveRuntimeNamespace(
       (key === "TMUX_IDE_CONFIG" || key === "TMUX_IDE_SETTINGS_DIR"
         ? env[key]
         : nonEmpty(env, key)) ?? fallback;
-    if (development && (!isAbsolute(value) || !isInsideOrEqual(value, development.root)))
+    if (development && (!isAbsolute(value) || !within(value, development.root)))
       throw new TypeError(`development ${key} escapes instance`);
     return value;
   };
@@ -267,7 +276,7 @@ export function resolveRuntimeNamespace(
       if (nonEmpty(env, key)) scoped(key, "");
     if (env.TMUX) {
       const socket = /^(.*),[0-9]+,[0-9]+$/u.exec(env.TMUX)?.[1];
-      if (!socket || pathIdentity(socket) !== pathIdentity(join(runtimeDir, "tmux.sock")))
+      if (!socket || identity(socket) !== identity(join(runtimeDir, "tmux.sock")))
         throw new TypeError("development rejects inherited foreign TMUX authority");
     }
   }

package/packages/daemon/src/lib/saved-machines.ts

@@ -9,8 +9,9 @@ import {
   renameSync,
   unlinkSync,
   writeFileSync,
+  watch,
 } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { SavedMachineRegistrySchema, type SavedMachineRegistry } from "@tmux-ide/contracts";
 import { changeSavedMachines, type SavedMachineChange } from "@tmux-ide/core";
 import { resolveRuntimeNamespace } from "./runtime-namespace.ts";
@@ -38,6 +39,44 @@ export function loadSavedMachines(path = savedMachinesPath()): SavedMachineRegis
   }
 }
 
+/** Watch the directory so atomic registry replacement does not detach the watcher. */
+export function watchSavedMachines(
+  onChange: (registry: SavedMachineRegistry) => void,
+  onError: () => void,
+  path = savedMachinesPath(),
+): () => void {
+  let stopped = false;
+  let pending: ReturnType<typeof setTimeout> | null = null;
+  const refresh = () => {
+    pending = null;
+    if (stopped) return;
+    try {
+      onChange(loadSavedMachines(path));
+    } catch {
+      // Keep the last valid routes while an editor is midway through a write.
+      onError();
+    }
+  };
+  // A first-run app can subscribe before the daemon creates its registry.
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const watcher = watch(dirname(path), (_event, file) => {
+    if (stopped || (file !== null && file.toString() !== basename(path))) return;
+    if (pending) clearTimeout(pending);
+    pending = setTimeout(refresh, 50);
+    pending.unref();
+  });
+  watcher.unref();
+  watcher.on("error", onError);
+  // Close the read-before-subscribe race at startup.
+  pending = setTimeout(refresh, 0);
+  pending.unref();
+  return () => {
+    stopped = true;
+    if (pending) clearTimeout(pending);
+    watcher.close();
+  };
+}
+
 /** The daemon owns writes. Synchronous read/reduce/rename cannot interleave within it. */
 export function updateSavedMachines(
   change: SavedMachineChange,

package/packages/daemon/src/lib/ssh-daemon-transport.ts

@@ -3,6 +3,7 @@ import { spawn, type ChildProcess } from "node:child_process";
 import { createServer } from "node:net";
 import type { Readable } from "node:stream";
 import { z } from "zod";
+import { remoteTmuxIdeCommand } from "./remote-tmux-command.ts";
 import { createSshDaemonRelay, type SshDaemonRelay } from "./ssh-daemon-relay.ts";
 import {
   CanonicalDaemonInfoSchema,
@@ -49,12 +50,30 @@ export class SshConnectionError extends Error {
     super(`SSH daemon connection: ${message}`);
   }
   get retryable(): boolean {
-    return this.code === "unavailable";
+    // A supervisor may temporarily remove the record while replacing its daemon.
+    return this.code === "unavailable" || this.code === "daemon-missing";
   }
 }
 function failure(message: string, code: FleetConnectionFailureCode = "unavailable"): Error {
   return new SshConnectionError(message, code);
 }
+
+/** Classify known OpenSSH errors without publishing remote stderr or credentials. */
+function observeSshFailure(child: SshTransportChild): () => FleetConnectionFailureCode {
+  let tail = "";
+  let code: FleetConnectionFailureCode = "unavailable";
+  child.stderr?.on("data", (chunk: Buffer) => {
+    tail = (tail + chunk.toString("utf8")).slice(-4096);
+    if (/Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(tail))
+      code = "ssh-host-key";
+    else if (/Permission denied \((?:publickey|password|keyboard-interactive)[^)]*\)/i.test(tail))
+      code = "ssh-authentication";
+  });
+  child.once("close", () => {
+    tail = "";
+  });
+  return () => code;
+}
 const stoppedChildren = new WeakSet<SshTransportChild>();
 function stop(child: SshTransportChild): void {
   if (stoppedChildren.has(child) || child.exitCode !== null || child.signalCode !== null) return;
@@ -153,6 +172,7 @@ const defaults: SshDaemonTransportDependencies = {
   probe: probeSshDaemonIdentity,
 };
 function discover(child: SshTransportChild, signal: AbortSignal): Promise<RemoteDaemon> {
+  const sshFailure = observeSshFailure(child);
   return new Promise((resolve, reject) => {
     const chunks: Buffer[] = [];
     let bytes = 0;
@@ -177,8 +197,6 @@ function discover(child: SshTransportChild, signal: AbortSignal): Promise<Remote
       }
       chunks.push(Buffer.from(chunk));
     });
-    // Drain without capturing: SSH banners/errors may contain confidential remote information.
-    child.stderr?.resume();
     child.once("error", () => finish(failure("could not start OpenSSH")));
     child.once("close", (code) => {
       if (settled) return;
@@ -186,6 +204,7 @@ function discover(child: SshTransportChild, signal: AbortSignal): Promise<Remote
         finish(
           failure(
             "discovery failed; check SSH authentication, host trust, and remote tmux-ide installation",
+            code === 127 ? "remote-cli-missing" : sshFailure(),
           ),
         );
         return;
@@ -266,9 +285,7 @@ export async function openSshDaemonTransport(
       "ForkAfterAuthentication=no",
       "--",
       options.alias,
-      "tmux-ide",
-      "remote-daemon-info",
-      "--json",
+      remoteTmuxIdeCommand("discover"),
     ]);
     const daemon = await discover(child, signal);
     const port = await cancellable(dependencies.allocatePort(), signal);
@@ -307,7 +324,7 @@ export async function openSshDaemonTransport(
       options.alias,
     ]);
     child.stdout?.resume();
-    child.stderr?.resume();
+    const sshFailure = observeSshFailure(child);
     child.once("exit", dispose);
     const tunnelClosed = new Promise<void>((resolve) => {
       child!.once("close", () => {
@@ -342,6 +359,7 @@ export async function openSshDaemonTransport(
     }
     throw failure(
       "tunnel could not authenticate the expected daemon before cancellation or timeout",
+      sshFailure(),
     );
   } catch (error) {
     dispose();

package/packages/daemon/src/lib/tmux-server-owner.ts

@@ -268,6 +268,7 @@ export async function createNativeTmuxServerOwner(options: NativeTmuxServerOwner
           return multiplexer.mutateWindowLink(
             { operationId, expectedDaemonInstanceId: generation, intent },
             (session, action) => sessionRuntimeRegistry.executeWindowLinkAction(session, action),
+            timing,
           );
         }
         if (intent.verb === "workspace.pane.resize") {

package/packages/daemon/src/lib/tmux-server-registration.ts

@@ -77,11 +77,29 @@ export function createTmuxServerProbe(
         )
       ).stdout.trimEnd();
     try {
-      const first = await read(args);
+      // A direct socket can be pinned before contacting tmux. Named servers
+      // and aliases still need discovery followed by an explicit-path proof.
+      let pinned: ReturnType<typeof captureUnixSocketIdentity> | null = null;
+      if (selector.kind === "path") {
+        try {
+          pinned = captureUnixSocketIdentity(selector.path);
+        } catch {
+          // Preserve discovery for aliases which are not direct socket paths.
+        }
+      }
+      const first = await read(pinned ? ["-S", pinned.path] : args);
       const match = /^(.*)\|([1-9][0-9]*)\|([1-9][0-9]*)$/u.exec(first);
       if (!match) return null;
-      const socket = captureUnixSocketIdentity(match[1]!);
-      if ((await read(["-S", socket.path])) !== first) return null;
+      const reportedSocket = captureUnixSocketIdentity(match[1]!);
+      const socket = pinned ?? reportedSocket;
+      if (pinned) {
+        if (
+          reportedSocket.path !== pinned.path ||
+          reportedSocket.dev !== pinned.dev ||
+          reportedSocket.ino !== pinned.ino
+        )
+          return null;
+      } else if ((await read(["-S", socket.path])) !== first) return null;
       revalidateUnixSocketIdentity(socket);
       return {
         nativeServerIdentity: { pid: match[2]!, startTime: match[3]! },

package/packages/daemon/src/lib/tui-binary.ts

@@ -28,7 +28,7 @@ import {
 } from "node:fs";
 import { dirname, join } from "node:path";
 import { gunzipSync } from "node:zlib";
-import { acquireTuiDownloadLock } from "./tui-download-lock.ts";
+import { acquirePrivateOperationLock } from "./private-operation-lock.ts";
 import { getCurrentVersion } from "./update-check.ts";
 
 /** The `<os>-<arch>` tags we publish a prebuilt TUI binary for. */
@@ -360,7 +360,7 @@ export async function downloadTuiBinary(
     timeoutMs: opts.timeoutMs ?? TUI_DOWNLOAD_TIMEOUT_MS,
   };
   mkdirSync(dirname(dest), { recursive: true });
-  const releaseLock = await acquireTuiDownloadLock(
+  const releaseLock = await acquirePrivateOperationLock(
     downloadLockPath(dest),
     limits.timeoutMs * 2 + 5_000,
   );

package/packages/daemon/src/lib/update.ts

@@ -1,3 +1,8 @@
+import {
+  managedInstallerPrefix,
+  runManagedInstallerUpdate,
+  MANAGED_INSTALLER_URL,
+} from "./managed-installer-update.ts";
 import { resolveRuntimeNamespace } from "./runtime-namespace.ts";
 import { parseStrictSemver } from "./semver.ts";
 /** Origin-aware update planning; unsupported origins never fall back to npm. */
@@ -28,6 +33,7 @@ export interface UpdatePlan {
   args?: string[];
   guidance?: string;
   proposedCommand?: string;
+  installerPrefix?: string;
 }
 export const UPDATE_COMMANDS: Record<PackageManager, string> = {
   npm: "npm install -g tmux-ide@latest",
@@ -62,7 +68,21 @@ export function planUpdate(input: {
       reason: `global ${method} layout (${input.cliPath})`,
     };
   }
+  if (method === "installer") {
+    const prefix = managedInstallerPrefix(input.cliPath);
+    if (prefix) {
+      return {
+        method,
+        channel,
+        installerPrefix: prefix,
+        command: `installer ${MANAGED_INSTALLER_URL} --prefix ${JSON.stringify(prefix)} --version ${channel}`,
+        reason: `verified active managed installation (${prefix})`,
+      };
+    }
+  }
   const guidance: Record<Exclude<InstallOrigin, PackageManager>, string> = {
+    installer:
+      "Rerun https://tmux-ide.com/install.sh with the same --prefix to update atomically and retain rollback. This managed release must not be modified by npm in place.",
     dev: "Update this checkout with git pull, then follow its build instructions.",
     homebrew: "Update with brew upgrade tmux-ide (using the tap/formula you installed).",
     yarn: `Update this Yarn global installation with yarn global add tmux-ide@${channel}.`,
@@ -167,6 +187,10 @@ export function runUpdate(
     });
     executed = true;
   }
+  if (!dryRun && plan.installerPrefix && plan.channel) {
+    runManagedInstallerUpdate(plan.installerPrefix, plan.channel, json, dependencies.execute);
+    executed = true;
+  }
   if (json) output(JSON.stringify({ ...plan, current, latest, dryRun, executed }));
   return plan;
 }