MetaList 0.6.1__tar.gz → 0.6.3__tar.gz

{metalist-0.6.1 → metalist-0.6.3}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.6.1
+Version: 0.6.3
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
 Project-URL: Issues, https://github.com/evolvingstuff/metalist/issues
-Requires-Python: <3.14,>=3.10
+Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: argon2-cffi==25.1.0
 Requires-Dist: cryptography==50.0.0
@@ -48,6 +48,20 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.3
+
+- Restored HTTPS connection reuse and aligned the pending accept queue with the existing worker capacity, so a browser’s six-connection startup burst is admitted.
+- Every page load or refresh checks PyPI asynchronously. A newly discovered release shows a dismissible notice linking to Version Info; typing `update` in the menu also finds it.
+- Managed uv installations can update from Version Info, using the existing preflight, verified immutable backups, and namespace restart flow. Source checkouts and unmanaged installations explain why in-app installation is unavailable.
+- Release validation now transfers every installed startup asset through concurrent persistent HTTP/HTTPS connections on all supported platforms and Python versions. Actual Edge startup over LAN-style HTTPS is also required on Windows before publication.
+
+## Changes in 0.6.2
+
+- Namespace startup allows two minutes, with progress every five seconds, instead of failing after 12 seconds on a busy machine. `METALIST_STARTUP_TIMEOUT_SECONDS` can increase the allowance. Failed children are stopped and reaped.
+- Updates preserve the running Python interpreter and validate a disposable installation and namespace startup before stopping live servers. uv then installs the tested package/dependency versions from its cache without network access.
+- Python 3.14 is supported. Command-line legacy imports also work when Python lacks Tk's native GUI component.
+- Release validation now includes the real uv update, backups, and multi-namespace restart on Windows, macOS, and Linux across Python 3.10–3.14.
+
 ## Changes in 0.6.1
 
 - Removed the unused performance overlay, including its menu option and background state updates, fixing a fatal redundant-state error during note rearranging. Obsolete overlay preferences and command usage are discarded automatically.
@@ -115,15 +129,19 @@ uv tool install metalist
 metalist
 ```
 
-After the first installation, update and restart MetaList with one cross-platform command:
+For a persistent uv installation, you can update from inside MetaList: type **update** in the menu, open **Version Info**, and choose **Update to …** when a newer release is available. Each browser load or refresh asks the server to check PyPI asynchronously. A reminder-style notice links to Version Info the first time a newer version is discovered; the announced version is remembered in that namespace's client preferences. A slow or failed check does not block the app. Version Info can retry a failed check.
+
+The in-app updater checks the selected release, creates verified backups, and restarts every namespace. Keep Version Info open to follow progress and reload when ready; closing and reopening it in the same page resumes progress. Signing in again may be necessary. Source checkouts and unmanaged installations still check for releases, but show why in-app installation is unavailable. Update job records and logs live under `~/MetaList/update-jobs/` (or the configured data directory). If installation/restart fails after servers stop, inspect the updater output and run `metalist` on the server to restart it; there is no automatic rollback.
+
+You can also update and restart MetaList with one cross-platform command:
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 
@@ -283,6 +301,10 @@ convert-from-legacy.py --namespace work --input /path/to/legacy-export.json
 
 If `--namespace`, `--port`, or `--https-port` are omitted, the import script prompts for them and saves the resulting launch profile inside the target namespace DB. That means a one-time import into `work` can immediately seed later shorthand launches like `metalist work`.
 
+Namespace startup allows 120 seconds per child, reports progress every five seconds, and stops/reaps a failed child instead of leaving it running after reporting failure. Set `METALIST_STARTUP_TIMEOUT_SECONDS` to a positive number of seconds to allow more time on a heavily loaded machine. A crashed child still fails immediately. This is a startup allowance, not a guarantee that any machine will finish within two minutes.
+
+The preflight is a disposable empty namespace; it cannot guarantee startup against every real database or prevent a later disk/process failure. If installation succeeds but real namespace startup fails, the new package remains installed: resolve the reported startup issue and run `metalist` again. No automatic code/database rollback is attempted, and backups remain unchanged.
+
 ### Publishing
 For the real user-facing install flow:
 ```bash
@@ -292,15 +314,15 @@ uv tool install metalist
 metalist
 ```
 
-This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.13.
+This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.14.
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.13. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
 3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
 4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
-If `--input` is omitted, a file picker opens (when `tkinter` is available).
+If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.
 
 ### Run Tests

{metalist-0.6.1 → metalist-0.6.3}/README.md

@@ -12,6 +12,20 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.3
+
+- Restored HTTPS connection reuse and aligned the pending accept queue with the existing worker capacity, so a browser’s six-connection startup burst is admitted.
+- Every page load or refresh checks PyPI asynchronously. A newly discovered release shows a dismissible notice linking to Version Info; typing `update` in the menu also finds it.
+- Managed uv installations can update from Version Info, using the existing preflight, verified immutable backups, and namespace restart flow. Source checkouts and unmanaged installations explain why in-app installation is unavailable.
+- Release validation now transfers every installed startup asset through concurrent persistent HTTP/HTTPS connections on all supported platforms and Python versions. Actual Edge startup over LAN-style HTTPS is also required on Windows before publication.
+
+## Changes in 0.6.2
+
+- Namespace startup allows two minutes, with progress every five seconds, instead of failing after 12 seconds on a busy machine. `METALIST_STARTUP_TIMEOUT_SECONDS` can increase the allowance. Failed children are stopped and reaped.
+- Updates preserve the running Python interpreter and validate a disposable installation and namespace startup before stopping live servers. uv then installs the tested package/dependency versions from its cache without network access.
+- Python 3.14 is supported. Command-line legacy imports also work when Python lacks Tk's native GUI component.
+- Release validation now includes the real uv update, backups, and multi-namespace restart on Windows, macOS, and Linux across Python 3.10–3.14.
+
 ## Changes in 0.6.1
 
 - Removed the unused performance overlay, including its menu option and background state updates, fixing a fatal redundant-state error during note rearranging. Obsolete overlay preferences and command usage are discarded automatically.
@@ -79,15 +93,19 @@ uv tool install metalist
 metalist
 ```
 
-After the first installation, update and restart MetaList with one cross-platform command:
+For a persistent uv installation, you can update from inside MetaList: type **update** in the menu, open **Version Info**, and choose **Update to …** when a newer release is available. Each browser load or refresh asks the server to check PyPI asynchronously. A reminder-style notice links to Version Info the first time a newer version is discovered; the announced version is remembered in that namespace's client preferences. A slow or failed check does not block the app. Version Info can retry a failed check.
+
+The in-app updater checks the selected release, creates verified backups, and restarts every namespace. Keep Version Info open to follow progress and reload when ready; closing and reopening it in the same page resumes progress. Signing in again may be necessary. Source checkouts and unmanaged installations still check for releases, but show why in-app installation is unavailable. Update job records and logs live under `~/MetaList/update-jobs/` (or the configured data directory). If installation/restart fails after servers stop, inspect the updater output and run `metalist` on the server to restart it; there is no automatic rollback.
+
+You can also update and restart MetaList with one cross-platform command:
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 
@@ -247,6 +265,10 @@ convert-from-legacy.py --namespace work --input /path/to/legacy-export.json
 
 If `--namespace`, `--port`, or `--https-port` are omitted, the import script prompts for them and saves the resulting launch profile inside the target namespace DB. That means a one-time import into `work` can immediately seed later shorthand launches like `metalist work`.
 
+Namespace startup allows 120 seconds per child, reports progress every five seconds, and stops/reaps a failed child instead of leaving it running after reporting failure. Set `METALIST_STARTUP_TIMEOUT_SECONDS` to a positive number of seconds to allow more time on a heavily loaded machine. A crashed child still fails immediately. This is a startup allowance, not a guarantee that any machine will finish within two minutes.
+
+The preflight is a disposable empty namespace; it cannot guarantee startup against every real database or prevent a later disk/process failure. If installation succeeds but real namespace startup fails, the new package remains installed: resolve the reported startup issue and run `metalist` again. No automatic code/database rollback is attempted, and backups remain unchanged.
+
 ### Publishing
 For the real user-facing install flow:
 ```bash
@@ -256,15 +278,15 @@ uv tool install metalist
 metalist
 ```
 
-This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.13.
+This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.14.
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.13. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
 3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
 4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
-If `--input` is omitted, a file picker opens (when `tkinter` is available).
+If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.
 
 ### Run Tests

{metalist-0.6.1 → metalist-0.6.3}/app/api/middleware/auth.py

@@ -19,6 +19,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
         f"{API_PREFIX}/auth/login-namespaces",
         f"{API_PREFIX}/auth/login-namespaces/open",
         f"{API_PREFIX}/auth/status",
+        f"{API_PREFIX}/auth/app-update/check",
         f"{API_PREFIX}/auth/session",
         "/favicon.ico",
         "/locked",
@@ -29,6 +30,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
     } | ({f"{API_PREFIX}/test/reset"} if TEST_MODE else set()))
 
     PUBLIC_PREFIX_PATHS = (
+        f"{API_PREFIX}/auth/app-update/jobs/",  # Opaque job capability survives restart/logout.
         f"{API_PREFIX}/auth/namespaces/delete-jobs/",
         f"{API_PREFIX}/auth/namespaces/rename-jobs/",
         "/static/",  # CSS/JS files needed for login page

metalist-0.6.3/app/api/routes/app_updates.py

@@ -0,0 +1,55 @@
+"""Authenticated in-app update initiation and opaque restart-safe job status."""
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException
+import httpx
+from pydantic import BaseModel, Field
+from starlette.background import BackgroundTask
+from starlette.responses import JSONResponse
+
+from app.api.transactions import transactional_route
+from app.services import app_updates
+from app.services.exception_capture import CapturedExceptionContext
+from app.services.app_updates import AppUpdateRejected
+
+
+router = APIRouter(prefix='/auth/app-update', tags=['updates'])
+
+
+class AppUpdateRequest(BaseModel):
+    target_version: str = Field(pattern=r'^[0-9]+\.[0-9]+\.[0-9]+$')
+
+
+@router.get('/check')
+def check_update():
+    release = CapturedExceptionContext(httpx.HTTPError,
+        boundary='app/api/routes/app_updates.py:check_update:release')
+    with release:
+        status = app_updates.check_for_update()
+    if release.captured_exception is not None:
+        raise HTTPException(status_code=503, detail='Could not reach the release server. Please try again.') from release.captured_exception
+    return JSONResponse(content=status, headers={'Cache-Control': 'no-store'})
+
+
+@router.post('')
+@transactional_route
+def start_update(body: AppUpdateRequest):
+    admission = CapturedExceptionContext(AppUpdateRejected,
+        boundary='app/api/routes/app_updates.py:start_update:admission')
+    with admission:
+        record = app_updates.create_update_job(body.target_version)
+    if admission.captured_exception is not None:
+        raise HTTPException(status_code=409, detail=str(admission.captured_exception)) from admission.captured_exception
+    return JSONResponse(status_code=202, content=record,
+                        background=BackgroundTask(app_updates.launch_update_job, record['job_id']))
+
+
+@router.get('/jobs/{job_id}')
+def update_status(job_id: str):
+    lookup = CapturedExceptionContext(AppUpdateRejected, FileNotFoundError,
+        boundary='app/api/routes/app_updates.py:update_status:lookup')
+    with lookup:
+        record = app_updates.read_job(job_id)
+    if lookup.captured_exception is not None:
+        raise HTTPException(status_code=404, detail='Update job not found') from lookup.captured_exception
+    return JSONResponse(content=record, headers={'Cache-Control': 'no-store'})

{metalist-0.6.1 → metalist-0.6.3}/app/exception_boundaries.py

@@ -5,6 +5,18 @@ syntax suppressions and is consumed by runtime capture and the startup gate.
 """
 
 CAPTURE_BOUNDARIES = {
+    # In-app updates translate only external transport, installation eligibility and job lookup errors.
+    'app/services/app_updates.py:check_for_update:eligibility': ('AppUpdateRejected',),
+    'app/services/app_updates.py:job_path:validation': ('ValueError',),
+    'app/services/app_updates.py:launch_update_job:launch': ('OSError',),
+    'app/api/routes/app_updates.py:check_update:release': ('HTTPError',),
+    'app/api/routes/app_updates.py:start_update:admission': ('AppUpdateRejected',),
+    'app/api/routes/app_updates.py:update_status:lookup': ('AppUpdateRejected', 'FileNotFoundError'),
+    # Release smoke polls only its own disposable HTTP listeners during an actual update.
+    'scripts/smoke_self_update.py:_has_updated_namespace:probe_capture': ('HTTPError',),
+    # A child can exit between poll and terminate; hung children must be killed and reaped.
+    'app/services/namespace_switcher.py:_stop_failed_namespace_launch:terminate_capture': ('ProcessLookupError',),
+    'app/services/namespace_switcher.py:_stop_failed_namespace_launch:wait_capture': ('TimeoutExpired',),
     # Translate explicitly validated domain input/resource rejection.
     'app/api/routes/auth.py:_delete_namespace_from_body:delete_capture': ('NamespaceInputRejected', 'FileNotFoundError'),
     # Translate explicitly validated domain input/resource rejection.

{metalist-0.6.1 → metalist-0.6.3}/app/https_proxy.py

@@ -15,6 +15,9 @@ HOP_HEADERS = frozenset({'connection', 'keep-alive', 'proxy-authenticate', 'prox
 
 
 class BoundedProxyServer(ThreadingHTTPServer):
+    # Admit a browser's initial connection burst before worker dispatch. The
+    # inherited five-entry accept queue can reset the sixth concurrent TLS open.
+    request_queue_size = MAX_CONNECTIONS
     daemon_threads = True
 
     def __init__(self, *args, **kwargs):
@@ -46,8 +49,8 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
         protocol_version = 'HTTP/1.1'
 
         def _proxy(self):
-            # One request per connection gives deterministic framing and bounds idle clients.
-            self.close_connection = True
+            # Preserve the browser's HTTP/1.1 connection across module requests.
+            # Chunked response framing and the socket timeout bound each transfer.
             lengths = self.headers.get_all('Content-Length', [])
             transfers = self.headers.get_all('Transfer-Encoding', [])
             if len(self.headers.get_all('Host', [])) != 1 or len(lengths) > 1 or (lengths and transfers):
@@ -103,7 +106,8 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
                     self.send_header('Transfer-Encoding', 'chunked')
                 elif response.getheader('Content-Length') is not None and self.command == 'HEAD':
                     self.send_header('Content-Length', response.getheader('Content-Length'))
-                self.send_header('Connection', 'close')
+                if self.close_connection:
+                    self.send_header('Connection', 'close')
                 self.end_headers()
                 self.wfile.flush()
                 response_started = True
@@ -122,6 +126,8 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
                     self.wfile.flush()
             # lint: allow-PY001 rationale="terminate a disconnected or failed external HTTP transport; emit only a sanitized upstream error"
             except (OSError, http.client.HTTPException):
+                # A partial request/response cannot be reused for another request.
+                self.close_connection = True
                 if not response_started:
                     self.send_error(502, 'Upstream transport failed')
             finally:

{metalist-0.6.1 → metalist-0.6.3}/app/main.py

@@ -57,6 +57,7 @@ from app.services.diagnostics import track_request
 from app.api.request_auth import clear_auth_cookie
 from app.api.routes.notes import router as api2_router
 from app.api.routes.auth import router as api2_auth_router
+from app.api.routes.app_updates import router as api2_app_updates_router
 from app.api.routes.files import router as api2_files_router
 from app.api.routes.ontology import router as api2_ontology_router
 from app.api.routes.backups import router as api2_backup_router
@@ -303,6 +304,7 @@ allowed_request_hosts = resolve_allowed_request_hosts(environ=os.environ)
 # v2 routers mounted under configured API_PREFIX
 app.include_router(api2_router, prefix=API_PREFIX, tags=["api2"]) 
 app.include_router(api2_auth_router, prefix=API_PREFIX)
+app.include_router(api2_app_updates_router, prefix=API_PREFIX)
 app.include_router(api2_backup_router, prefix=API_PREFIX)
 app.include_router(api2_files_router, prefix=API_PREFIX)
 app.include_router(api2_ontology_router, prefix=API_PREFIX)

metalist-0.6.3/app/services/app_update_worker.py

@@ -0,0 +1,42 @@
+"""Detached launcher exits before the existing updater replaces its installation."""
+from __future__ import annotations
+
+import os
+import sys
+
+from app.services.app_updates import read_job, release_update_job, update_executable, write_job
+from app.services.self_update import schedule_self_update
+from app.version import __version__
+
+
+def run_update(job_id: str) -> None:
+    record = read_job(job_id)
+    assert record['status'] == 'queued'
+    record = dict(record, status='preparing', pid=os.getpid(), message='Checking the update and preparing verified backups. MetaList will restart automatically.')
+    write_job(record)
+    # Finally records failures without intercepting internal exceptions.
+    scheduled = False
+    finished = False
+    try:
+        result = schedule_self_update(
+            current_version=__version__, metalist_executable=str(update_executable()),
+            current_pid=os.getpid(), platform_name=sys.platform, environ=os.environ,
+            expected_target_version=str(record['target_version']),
+        )
+        scheduled = result.update_scheduled
+        if scheduled:
+            status = 'installing'
+        else:
+            status = 'complete'
+        write_job(dict(record, status=status, message=result.message))
+        finished = True
+    finally:
+        if not finished:
+            write_job(dict(record, status='failed', message='Update failed. See the update log for the cause.'))
+        if not scheduled:
+            release_update_job(job_id)
+
+
+if __name__ == '__main__':
+    assert len(sys.argv) == 2, 'Usage: python -m app.services.app_update_worker JOB_ID'
+    run_update(sys.argv[1])

metalist-0.6.3/app/services/app_updates.py

@@ -0,0 +1,190 @@
+"""Application-owned update jobs; only the existing installed updater installs code."""
+from __future__ import annotations
+
+from contextlib import contextmanager
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import sysconfig
+from uuid import UUID, uuid4
+
+from app.data_directory import resolve_data_directory
+from app.services.exception_capture import CapturedExceptionContext
+from app.services.namespace_switcher import _is_process_running
+from app.services.self_update import _fetch_latest_pypi_version, _release_version_key
+from app.version import __version__
+
+
+if os.name == 'nt':
+    import msvcrt
+else:
+    import fcntl
+
+
+class AppUpdateRejected(ValueError):
+    """An update cannot be started in this installation or job state."""
+
+
+def update_executable() -> Path:
+    receipt = Path(sys.prefix) / 'uv-receipt.toml'
+    if not receipt.is_file():
+        raise AppUpdateRejected('In-app updates require a uv-installed copy of MetaList. This running copy is not a managed installation.')
+    executable = Path(sysconfig.get_path('scripts')) / ('metalist.exe' if os.name == 'nt' else 'metalist')
+    if not executable.is_file():
+        raise AppUpdateRejected('The installed MetaList command is missing.')
+    if shutil.which('uv') is None:
+        raise AppUpdateRejected('The uv updater is not available on this server. Install uv before updating MetaList.')
+    return executable
+
+
+def check_for_update() -> dict[str, object]:
+    # Always contact PyPI, including in source checkouts; eligibility only controls installation.
+    target = _fetch_latest_pypi_version()
+    available = _release_version_key(target) > _release_version_key(__version__)
+    eligibility = CapturedExceptionContext(AppUpdateRejected,
+        boundary='app/services/app_updates.py:check_for_update:eligibility')
+    with eligibility:
+        update_executable()
+    supported = eligibility.captured_exception is None
+    if available:
+        message = f'Version {target} is available.'
+    else:
+        message = 'MetaList is up to date.'
+    if not supported:
+        message += f' {eligibility.captured_exception}'
+    return {'supported': supported, 'update_available': available, 'current_version': __version__,
+            'target_version': target, 'message': message}
+
+
+def jobs_directory() -> Path:
+    return resolve_data_directory(environ=os.environ) / 'update-jobs'
+
+
+def job_path(job_id: str) -> Path:
+    validation = CapturedExceptionContext(ValueError,
+        boundary='app/services/app_updates.py:job_path:validation')
+    with validation:
+        normalized = str(UUID(job_id))
+    if validation.captured_exception is not None:
+        raise AppUpdateRejected('Invalid update job ID') from validation.captured_exception
+    if normalized != job_id:
+        raise AppUpdateRejected('Invalid update job ID')
+    return jobs_directory() / f'{job_id}.json'
+
+
+def write_job(record: dict[str, object]) -> None:
+    path = job_path(str(record['job_id']))
+    temporary = path.with_suffix(f'.{uuid4().hex}.tmp')
+    try:
+        with temporary.open('x', encoding='utf-8') as stream:
+            json.dump(record, stream)
+        os.replace(temporary, path)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def read_job(job_id: str) -> dict[str, object]:
+    record = json.loads(job_path(job_id).read_text(encoding='utf-8'))
+    assert isinstance(record, dict) and record['job_id'] == job_id
+    assert record['status'] in {'queued', 'preparing', 'installing', 'complete', 'failed'}
+    assert isinstance(record['pid'], int) and record['pid'] > 0
+    _release_version_key(record['target_version'])
+    if record['status'] == 'installing' and _release_version_key(__version__) >= _release_version_key(record['target_version']):
+        record = dict(record, status='complete', message=f'MetaList {__version__} is ready. Reload to continue.')
+    elif record['status'] in {'queued', 'preparing'} and not _is_process_running(pid=record['pid']):
+        record = dict(record, status='failed', message='The update process stopped unexpectedly. See the update log.')
+    return record
+
+
+def _create_update_job_locked(target_version: str) -> dict[str, object]:
+    update_executable()
+    _release_version_key(target_version)
+    if _release_version_key(target_version) <= _release_version_key(__version__):
+        raise AppUpdateRejected('The selected release is not newer than the running version.')
+    directory = jobs_directory()
+    directory.mkdir(parents=True, exist_ok=True)
+    active_path = directory / 'active.json'
+    if active_path.is_file():
+        active = json.loads(active_path.read_text(encoding='utf-8'))
+        if read_job(active['job_id'])['status'] not in {'complete', 'failed'}:
+            raise AppUpdateRejected('An update is already in progress. Wait for it to finish.')
+        active_path.unlink()
+    job_id = str(uuid4())
+    record = {'job_id': job_id, 'status': 'queued', 'current_version': __version__,
+              'target_version': target_version, 'pid': os.getpid(),
+              'message': 'Preparing the update. All namespaces will restart.',
+              'log_path': str(directory / f'{job_id}.log')}
+    write_job(record)
+    with active_path.open('x', encoding='utf-8') as stream:
+        json.dump({'job_id': job_id}, stream)
+    return record
+
+
+def launch_update_job(job_id: str) -> None:
+    record = read_job(job_id)
+    assert record['status'] == 'queued'
+    environment = dict(os.environ)
+    # Restart every saved namespace, preserving LAN/TLS/data settings.
+    for name in ('METALIST_NAMESPACE', 'METALIST_PORT', 'METALIST_HTTPS_PORT', 'METALIST_ORCHESTRATED_CHILD'):
+        if name in environment:
+            del environment[name]
+    options: dict[str, object] = {'env': environment, 'stdin': subprocess.DEVNULL}
+    if os.name == 'nt':
+        options['creationflags'] = subprocess.CREATE_NEW_PROCESS_GROUP | subprocess.DETACHED_PROCESS
+    else:
+        options['start_new_session'] = True
+    launch = CapturedExceptionContext(OSError,
+        boundary='app/services/app_updates.py:launch_update_job:launch')
+    with launch:
+        with Path(str(record['log_path'])).open('xb') as log:
+            subprocess.Popen([sys.executable, '-m', 'app.services.app_update_worker', job_id],
+                             stdout=log, stderr=subprocess.STDOUT, **options)
+    if launch.captured_exception is not None:
+        write_job(dict(record, status='failed', message='Could not start the updater. The running version was not changed.'))
+        release_update_job(job_id)
+        raise launch.captured_exception
+
+
+def release_update_job(job_id: str) -> None:
+    with _job_lock():
+        _release_update_job_locked(job_id)
+
+
+def _release_update_job_locked(job_id: str) -> None:
+    path = jobs_directory() / 'active.json'
+    if path.is_file():
+        active = json.loads(path.read_text(encoding='utf-8'))
+        if active['job_id'] == job_id:
+            path.unlink()
+
+
+@contextmanager
+def _job_lock():
+    directory = jobs_directory()
+    directory.mkdir(parents=True, exist_ok=True)
+    # Stable cross-process lock: all namespaces share this installation's update admission.
+    with (directory / 'admission.lock').open('a+b') as handle:
+        if os.name == 'nt':
+            if handle.tell() == 0:
+                handle.write(b'0')
+                handle.flush()
+            handle.seek(0)
+            msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
+        else:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+        try:
+            yield
+        finally:
+            if os.name == 'nt':
+                handle.seek(0)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+            else:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+
+def create_update_job(target_version: str) -> dict[str, object]:
+    with _job_lock():
+        return _create_update_job_locked(target_version)

{metalist-0.6.1 → metalist-0.6.3}/app/services/client_state_service.py

@@ -45,6 +45,7 @@ _ALLOWED_CLIENT_PREFERENCES = {
     "pref.show_search_results_count": {"true", "false"},
     "pref.show_ai_chat": {"true", "false"},
     "pref.animated_transitions": {"true", "false"},
+    "pref.update_notice_version": "release_version",
     "pref.reminder_surface_expanded": {"true", "false"},
     "pref.note_layout.top_level_note_size": {"same", "larger", "largest"},
     "pref.note_layout.child_indentation": {"compact", "standard", "wide"},
@@ -204,7 +205,10 @@ def _validate_client_preferences(preferences: dict[str, object]) -> dict[str, st
         if not isinstance(value, str):
             raise ClientStateValidationError(f"Client preference {key} must be a string")
         allowed_values = _ALLOWED_CLIENT_PREFERENCES[key]
-        if allowed_values == "tag_activity_windows":
+        if allowed_values == "release_version":
+            if re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", value) is None:
+                raise ClientStateValidationError("Invalid update notice version")
+        elif allowed_values == "tag_activity_windows":
             _validate_tag_activity_windows_preference(key=key, value=value)
         elif allowed_values == "ollama_base_url":
             value = normalize_ollama_base_url(value)