MetaList 0.6.2__tar.gz → 0.6.3__tar.gz

{metalist-0.6.2 → metalist-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.6.2
+Version: 0.6.3
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,13 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.3
+
+- Restored HTTPS connection reuse and aligned the pending accept queue with the existing worker capacity, so a browser’s six-connection startup burst is admitted.
+- Every page load or refresh checks PyPI asynchronously. A newly discovered release shows a dismissible notice linking to Version Info; typing `update` in the menu also finds it.
+- Managed uv installations can update from Version Info, using the existing preflight, verified immutable backups, and namespace restart flow. Source checkouts and unmanaged installations explain why in-app installation is unavailable.
+- Release validation now transfers every installed startup asset through concurrent persistent HTTP/HTTPS connections on all supported platforms and Python versions. Actual Edge startup over LAN-style HTTPS is also required on Windows before publication.
+
 ## Changes in 0.6.2
 
 - Namespace startup allows two minutes, with progress every five seconds, instead of failing after 12 seconds on a busy machine. `METALIST_STARTUP_TIMEOUT_SECONDS` can increase the allowance. Failed children are stopped and reaped.
@@ -122,7 +129,11 @@ uv tool install metalist
 metalist
 ```
 
-After the first installation, update and restart MetaList with one cross-platform command:
+For a persistent uv installation, you can update from inside MetaList: type **update** in the menu, open **Version Info**, and choose **Update to …** when a newer release is available. Each browser load or refresh asks the server to check PyPI asynchronously. A reminder-style notice links to Version Info the first time a newer version is discovered; the announced version is remembered in that namespace's client preferences. A slow or failed check does not block the app. Version Info can retry a failed check.
+
+The in-app updater checks the selected release, creates verified backups, and restarts every namespace. Keep Version Info open to follow progress and reload when ready; closing and reopening it in the same page resumes progress. Signing in again may be necessary. Source checkouts and unmanaged installations still check for releases, but show why in-app installation is unavailable. Update job records and logs live under `~/MetaList/update-jobs/` (or the configured data directory). If installation/restart fails after servers stop, inspect the updater output and run `metalist` on the server to restart it; there is no automatic rollback.
+
+You can also update and restart MetaList with one cross-platform command:
 ```bash
 metalist update
 ```
@@ -130,7 +141,7 @@ The updater checks the installed version against the latest PyPI release first.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 

{metalist-0.6.2 → metalist-0.6.3}/README.md

@@ -12,6 +12,13 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.3
+
+- Restored HTTPS connection reuse and aligned the pending accept queue with the existing worker capacity, so a browser’s six-connection startup burst is admitted.
+- Every page load or refresh checks PyPI asynchronously. A newly discovered release shows a dismissible notice linking to Version Info; typing `update` in the menu also finds it.
+- Managed uv installations can update from Version Info, using the existing preflight, verified immutable backups, and namespace restart flow. Source checkouts and unmanaged installations explain why in-app installation is unavailable.
+- Release validation now transfers every installed startup asset through concurrent persistent HTTP/HTTPS connections on all supported platforms and Python versions. Actual Edge startup over LAN-style HTTPS is also required on Windows before publication.
+
 ## Changes in 0.6.2
 
 - Namespace startup allows two minutes, with progress every five seconds, instead of failing after 12 seconds on a busy machine. `METALIST_STARTUP_TIMEOUT_SECONDS` can increase the allowance. Failed children are stopped and reaped.
@@ -86,7 +93,11 @@ uv tool install metalist
 metalist
 ```
 
-After the first installation, update and restart MetaList with one cross-platform command:
+For a persistent uv installation, you can update from inside MetaList: type **update** in the menu, open **Version Info**, and choose **Update to …** when a newer release is available. Each browser load or refresh asks the server to check PyPI asynchronously. A reminder-style notice links to Version Info the first time a newer version is discovered; the announced version is remembered in that namespace's client preferences. A slow or failed check does not block the app. Version Info can retry a failed check.
+
+The in-app updater checks the selected release, creates verified backups, and restarts every namespace. Keep Version Info open to follow progress and reload when ready; closing and reopening it in the same page resumes progress. Signing in again may be necessary. Source checkouts and unmanaged installations still check for releases, but show why in-app installation is unavailable. Update job records and logs live under `~/MetaList/update-jobs/` (or the configured data directory). If installation/restart fails after servers stop, inspect the updater output and run `metalist` on the server to restart it; there is no automatic rollback.
+
+You can also update and restart MetaList with one cross-platform command:
 ```bash
 metalist update
 ```
@@ -94,7 +105,7 @@ The updater checks the installed version against the latest PyPI release first.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 

{metalist-0.6.2 → metalist-0.6.3}/app/api/middleware/auth.py

@@ -19,6 +19,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
         f"{API_PREFIX}/auth/login-namespaces",
         f"{API_PREFIX}/auth/login-namespaces/open",
         f"{API_PREFIX}/auth/status",
+        f"{API_PREFIX}/auth/app-update/check",
         f"{API_PREFIX}/auth/session",
         "/favicon.ico",
         "/locked",
@@ -29,6 +30,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
     } | ({f"{API_PREFIX}/test/reset"} if TEST_MODE else set()))
 
     PUBLIC_PREFIX_PATHS = (
+        f"{API_PREFIX}/auth/app-update/jobs/",  # Opaque job capability survives restart/logout.
         f"{API_PREFIX}/auth/namespaces/delete-jobs/",
         f"{API_PREFIX}/auth/namespaces/rename-jobs/",
         "/static/",  # CSS/JS files needed for login page

metalist-0.6.3/app/api/routes/app_updates.py

@@ -0,0 +1,55 @@
+"""Authenticated in-app update initiation and opaque restart-safe job status."""
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException
+import httpx
+from pydantic import BaseModel, Field
+from starlette.background import BackgroundTask
+from starlette.responses import JSONResponse
+
+from app.api.transactions import transactional_route
+from app.services import app_updates
+from app.services.exception_capture import CapturedExceptionContext
+from app.services.app_updates import AppUpdateRejected
+
+
+router = APIRouter(prefix='/auth/app-update', tags=['updates'])
+
+
+class AppUpdateRequest(BaseModel):
+    target_version: str = Field(pattern=r'^[0-9]+\.[0-9]+\.[0-9]+$')
+
+
+@router.get('/check')
+def check_update():
+    release = CapturedExceptionContext(httpx.HTTPError,
+        boundary='app/api/routes/app_updates.py:check_update:release')
+    with release:
+        status = app_updates.check_for_update()
+    if release.captured_exception is not None:
+        raise HTTPException(status_code=503, detail='Could not reach the release server. Please try again.') from release.captured_exception
+    return JSONResponse(content=status, headers={'Cache-Control': 'no-store'})
+
+
+@router.post('')
+@transactional_route
+def start_update(body: AppUpdateRequest):
+    admission = CapturedExceptionContext(AppUpdateRejected,
+        boundary='app/api/routes/app_updates.py:start_update:admission')
+    with admission:
+        record = app_updates.create_update_job(body.target_version)
+    if admission.captured_exception is not None:
+        raise HTTPException(status_code=409, detail=str(admission.captured_exception)) from admission.captured_exception
+    return JSONResponse(status_code=202, content=record,
+                        background=BackgroundTask(app_updates.launch_update_job, record['job_id']))
+
+
+@router.get('/jobs/{job_id}')
+def update_status(job_id: str):
+    lookup = CapturedExceptionContext(AppUpdateRejected, FileNotFoundError,
+        boundary='app/api/routes/app_updates.py:update_status:lookup')
+    with lookup:
+        record = app_updates.read_job(job_id)
+    if lookup.captured_exception is not None:
+        raise HTTPException(status_code=404, detail='Update job not found') from lookup.captured_exception
+    return JSONResponse(content=record, headers={'Cache-Control': 'no-store'})

{metalist-0.6.2 → metalist-0.6.3}/app/exception_boundaries.py

@@ -5,6 +5,13 @@ syntax suppressions and is consumed by runtime capture and the startup gate.
 """
 
 CAPTURE_BOUNDARIES = {
+    # In-app updates translate only external transport, installation eligibility and job lookup errors.
+    'app/services/app_updates.py:check_for_update:eligibility': ('AppUpdateRejected',),
+    'app/services/app_updates.py:job_path:validation': ('ValueError',),
+    'app/services/app_updates.py:launch_update_job:launch': ('OSError',),
+    'app/api/routes/app_updates.py:check_update:release': ('HTTPError',),
+    'app/api/routes/app_updates.py:start_update:admission': ('AppUpdateRejected',),
+    'app/api/routes/app_updates.py:update_status:lookup': ('AppUpdateRejected', 'FileNotFoundError'),
     # Release smoke polls only its own disposable HTTP listeners during an actual update.
     'scripts/smoke_self_update.py:_has_updated_namespace:probe_capture': ('HTTPError',),
     # A child can exit between poll and terminate; hung children must be killed and reaped.

{metalist-0.6.2 → metalist-0.6.3}/app/https_proxy.py

@@ -15,6 +15,9 @@ HOP_HEADERS = frozenset({'connection', 'keep-alive', 'proxy-authenticate', 'prox
 
 
 class BoundedProxyServer(ThreadingHTTPServer):
+    # Admit a browser's initial connection burst before worker dispatch. The
+    # inherited five-entry accept queue can reset the sixth concurrent TLS open.
+    request_queue_size = MAX_CONNECTIONS
     daemon_threads = True
 
     def __init__(self, *args, **kwargs):
@@ -46,8 +49,8 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
         protocol_version = 'HTTP/1.1'
 
         def _proxy(self):
-            # One request per connection gives deterministic framing and bounds idle clients.
-            self.close_connection = True
+            # Preserve the browser's HTTP/1.1 connection across module requests.
+            # Chunked response framing and the socket timeout bound each transfer.
             lengths = self.headers.get_all('Content-Length', [])
             transfers = self.headers.get_all('Transfer-Encoding', [])
             if len(self.headers.get_all('Host', [])) != 1 or len(lengths) > 1 or (lengths and transfers):
@@ -103,7 +106,8 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
                     self.send_header('Transfer-Encoding', 'chunked')
                 elif response.getheader('Content-Length') is not None and self.command == 'HEAD':
                     self.send_header('Content-Length', response.getheader('Content-Length'))
-                self.send_header('Connection', 'close')
+                if self.close_connection:
+                    self.send_header('Connection', 'close')
                 self.end_headers()
                 self.wfile.flush()
                 response_started = True
@@ -122,6 +126,8 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
                     self.wfile.flush()
             # lint: allow-PY001 rationale="terminate a disconnected or failed external HTTP transport; emit only a sanitized upstream error"
             except (OSError, http.client.HTTPException):
+                # A partial request/response cannot be reused for another request.
+                self.close_connection = True
                 if not response_started:
                     self.send_error(502, 'Upstream transport failed')
             finally:

{metalist-0.6.2 → metalist-0.6.3}/app/main.py

@@ -57,6 +57,7 @@ from app.services.diagnostics import track_request
 from app.api.request_auth import clear_auth_cookie
 from app.api.routes.notes import router as api2_router
 from app.api.routes.auth import router as api2_auth_router
+from app.api.routes.app_updates import router as api2_app_updates_router
 from app.api.routes.files import router as api2_files_router
 from app.api.routes.ontology import router as api2_ontology_router
 from app.api.routes.backups import router as api2_backup_router
@@ -303,6 +304,7 @@ allowed_request_hosts = resolve_allowed_request_hosts(environ=os.environ)
 # v2 routers mounted under configured API_PREFIX
 app.include_router(api2_router, prefix=API_PREFIX, tags=["api2"]) 
 app.include_router(api2_auth_router, prefix=API_PREFIX)
+app.include_router(api2_app_updates_router, prefix=API_PREFIX)
 app.include_router(api2_backup_router, prefix=API_PREFIX)
 app.include_router(api2_files_router, prefix=API_PREFIX)
 app.include_router(api2_ontology_router, prefix=API_PREFIX)

metalist-0.6.3/app/services/app_update_worker.py

@@ -0,0 +1,42 @@
+"""Detached launcher exits before the existing updater replaces its installation."""
+from __future__ import annotations
+
+import os
+import sys
+
+from app.services.app_updates import read_job, release_update_job, update_executable, write_job
+from app.services.self_update import schedule_self_update
+from app.version import __version__
+
+
+def run_update(job_id: str) -> None:
+    record = read_job(job_id)
+    assert record['status'] == 'queued'
+    record = dict(record, status='preparing', pid=os.getpid(), message='Checking the update and preparing verified backups. MetaList will restart automatically.')
+    write_job(record)
+    # Finally records failures without intercepting internal exceptions.
+    scheduled = False
+    finished = False
+    try:
+        result = schedule_self_update(
+            current_version=__version__, metalist_executable=str(update_executable()),
+            current_pid=os.getpid(), platform_name=sys.platform, environ=os.environ,
+            expected_target_version=str(record['target_version']),
+        )
+        scheduled = result.update_scheduled
+        if scheduled:
+            status = 'installing'
+        else:
+            status = 'complete'
+        write_job(dict(record, status=status, message=result.message))
+        finished = True
+    finally:
+        if not finished:
+            write_job(dict(record, status='failed', message='Update failed. See the update log for the cause.'))
+        if not scheduled:
+            release_update_job(job_id)
+
+
+if __name__ == '__main__':
+    assert len(sys.argv) == 2, 'Usage: python -m app.services.app_update_worker JOB_ID'
+    run_update(sys.argv[1])

metalist-0.6.3/app/services/app_updates.py

@@ -0,0 +1,190 @@
+"""Application-owned update jobs; only the existing installed updater installs code."""
+from __future__ import annotations
+
+from contextlib import contextmanager
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import sysconfig
+from uuid import UUID, uuid4
+
+from app.data_directory import resolve_data_directory
+from app.services.exception_capture import CapturedExceptionContext
+from app.services.namespace_switcher import _is_process_running
+from app.services.self_update import _fetch_latest_pypi_version, _release_version_key
+from app.version import __version__
+
+
+if os.name == 'nt':
+    import msvcrt
+else:
+    import fcntl
+
+
+class AppUpdateRejected(ValueError):
+    """An update cannot be started in this installation or job state."""
+
+
+def update_executable() -> Path:
+    receipt = Path(sys.prefix) / 'uv-receipt.toml'
+    if not receipt.is_file():
+        raise AppUpdateRejected('In-app updates require a uv-installed copy of MetaList. This running copy is not a managed installation.')
+    executable = Path(sysconfig.get_path('scripts')) / ('metalist.exe' if os.name == 'nt' else 'metalist')
+    if not executable.is_file():
+        raise AppUpdateRejected('The installed MetaList command is missing.')
+    if shutil.which('uv') is None:
+        raise AppUpdateRejected('The uv updater is not available on this server. Install uv before updating MetaList.')
+    return executable
+
+
+def check_for_update() -> dict[str, object]:
+    # Always contact PyPI, including in source checkouts; eligibility only controls installation.
+    target = _fetch_latest_pypi_version()
+    available = _release_version_key(target) > _release_version_key(__version__)
+    eligibility = CapturedExceptionContext(AppUpdateRejected,
+        boundary='app/services/app_updates.py:check_for_update:eligibility')
+    with eligibility:
+        update_executable()
+    supported = eligibility.captured_exception is None
+    if available:
+        message = f'Version {target} is available.'
+    else:
+        message = 'MetaList is up to date.'
+    if not supported:
+        message += f' {eligibility.captured_exception}'
+    return {'supported': supported, 'update_available': available, 'current_version': __version__,
+            'target_version': target, 'message': message}
+
+
+def jobs_directory() -> Path:
+    return resolve_data_directory(environ=os.environ) / 'update-jobs'
+
+
+def job_path(job_id: str) -> Path:
+    validation = CapturedExceptionContext(ValueError,
+        boundary='app/services/app_updates.py:job_path:validation')
+    with validation:
+        normalized = str(UUID(job_id))
+    if validation.captured_exception is not None:
+        raise AppUpdateRejected('Invalid update job ID') from validation.captured_exception
+    if normalized != job_id:
+        raise AppUpdateRejected('Invalid update job ID')
+    return jobs_directory() / f'{job_id}.json'
+
+
+def write_job(record: dict[str, object]) -> None:
+    path = job_path(str(record['job_id']))
+    temporary = path.with_suffix(f'.{uuid4().hex}.tmp')
+    try:
+        with temporary.open('x', encoding='utf-8') as stream:
+            json.dump(record, stream)
+        os.replace(temporary, path)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def read_job(job_id: str) -> dict[str, object]:
+    record = json.loads(job_path(job_id).read_text(encoding='utf-8'))
+    assert isinstance(record, dict) and record['job_id'] == job_id
+    assert record['status'] in {'queued', 'preparing', 'installing', 'complete', 'failed'}
+    assert isinstance(record['pid'], int) and record['pid'] > 0
+    _release_version_key(record['target_version'])
+    if record['status'] == 'installing' and _release_version_key(__version__) >= _release_version_key(record['target_version']):
+        record = dict(record, status='complete', message=f'MetaList {__version__} is ready. Reload to continue.')
+    elif record['status'] in {'queued', 'preparing'} and not _is_process_running(pid=record['pid']):
+        record = dict(record, status='failed', message='The update process stopped unexpectedly. See the update log.')
+    return record
+
+
+def _create_update_job_locked(target_version: str) -> dict[str, object]:
+    update_executable()
+    _release_version_key(target_version)
+    if _release_version_key(target_version) <= _release_version_key(__version__):
+        raise AppUpdateRejected('The selected release is not newer than the running version.')
+    directory = jobs_directory()
+    directory.mkdir(parents=True, exist_ok=True)
+    active_path = directory / 'active.json'
+    if active_path.is_file():
+        active = json.loads(active_path.read_text(encoding='utf-8'))
+        if read_job(active['job_id'])['status'] not in {'complete', 'failed'}:
+            raise AppUpdateRejected('An update is already in progress. Wait for it to finish.')
+        active_path.unlink()
+    job_id = str(uuid4())
+    record = {'job_id': job_id, 'status': 'queued', 'current_version': __version__,
+              'target_version': target_version, 'pid': os.getpid(),
+              'message': 'Preparing the update. All namespaces will restart.',
+              'log_path': str(directory / f'{job_id}.log')}
+    write_job(record)
+    with active_path.open('x', encoding='utf-8') as stream:
+        json.dump({'job_id': job_id}, stream)
+    return record
+
+
+def launch_update_job(job_id: str) -> None:
+    record = read_job(job_id)
+    assert record['status'] == 'queued'
+    environment = dict(os.environ)
+    # Restart every saved namespace, preserving LAN/TLS/data settings.
+    for name in ('METALIST_NAMESPACE', 'METALIST_PORT', 'METALIST_HTTPS_PORT', 'METALIST_ORCHESTRATED_CHILD'):
+        if name in environment:
+            del environment[name]
+    options: dict[str, object] = {'env': environment, 'stdin': subprocess.DEVNULL}
+    if os.name == 'nt':
+        options['creationflags'] = subprocess.CREATE_NEW_PROCESS_GROUP | subprocess.DETACHED_PROCESS
+    else:
+        options['start_new_session'] = True
+    launch = CapturedExceptionContext(OSError,
+        boundary='app/services/app_updates.py:launch_update_job:launch')
+    with launch:
+        with Path(str(record['log_path'])).open('xb') as log:
+            subprocess.Popen([sys.executable, '-m', 'app.services.app_update_worker', job_id],
+                             stdout=log, stderr=subprocess.STDOUT, **options)
+    if launch.captured_exception is not None:
+        write_job(dict(record, status='failed', message='Could not start the updater. The running version was not changed.'))
+        release_update_job(job_id)
+        raise launch.captured_exception
+
+
+def release_update_job(job_id: str) -> None:
+    with _job_lock():
+        _release_update_job_locked(job_id)
+
+
+def _release_update_job_locked(job_id: str) -> None:
+    path = jobs_directory() / 'active.json'
+    if path.is_file():
+        active = json.loads(path.read_text(encoding='utf-8'))
+        if active['job_id'] == job_id:
+            path.unlink()
+
+
+@contextmanager
+def _job_lock():
+    directory = jobs_directory()
+    directory.mkdir(parents=True, exist_ok=True)
+    # Stable cross-process lock: all namespaces share this installation's update admission.
+    with (directory / 'admission.lock').open('a+b') as handle:
+        if os.name == 'nt':
+            if handle.tell() == 0:
+                handle.write(b'0')
+                handle.flush()
+            handle.seek(0)
+            msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
+        else:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+        try:
+            yield
+        finally:
+            if os.name == 'nt':
+                handle.seek(0)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+            else:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+
+def create_update_job(target_version: str) -> dict[str, object]:
+    with _job_lock():
+        return _create_update_job_locked(target_version)

{metalist-0.6.2 → metalist-0.6.3}/app/services/client_state_service.py

@@ -45,6 +45,7 @@ _ALLOWED_CLIENT_PREFERENCES = {
     "pref.show_search_results_count": {"true", "false"},
     "pref.show_ai_chat": {"true", "false"},
     "pref.animated_transitions": {"true", "false"},
+    "pref.update_notice_version": "release_version",
     "pref.reminder_surface_expanded": {"true", "false"},
     "pref.note_layout.top_level_note_size": {"same", "larger", "largest"},
     "pref.note_layout.child_indentation": {"compact", "standard", "wide"},
@@ -204,7 +205,10 @@ def _validate_client_preferences(preferences: dict[str, object]) -> dict[str, st
         if not isinstance(value, str):
             raise ClientStateValidationError(f"Client preference {key} must be a string")
         allowed_values = _ALLOWED_CLIENT_PREFERENCES[key]
-        if allowed_values == "tag_activity_windows":
+        if allowed_values == "release_version":
+            if re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", value) is None:
+                raise ClientStateValidationError("Invalid update notice version")
+        elif allowed_values == "tag_activity_windows":
             _validate_tag_activity_windows_preference(key=key, value=value)
         elif allowed_values == "ollama_base_url":
             value = normalize_ollama_base_url(value)

{metalist-0.6.2 → metalist-0.6.3}/app/services/self_update.py

@@ -43,6 +43,8 @@ def schedule_self_update(
     current_pid: int,
     platform_name: str,
     environ: Mapping[str, str],
+    # lint: allow-PY002 rationale="Preserve the existing CLI scheduler contract; the in-app caller supplies the reviewed release pin"
+    expected_target_version: str | None = None,
 ) -> SelfUpdateScheduleResult:
     _validate_schedule_inputs(
         current_version=current_version,
@@ -51,6 +53,10 @@ def schedule_self_update(
         platform_name=platform_name,
     )
     target_version = _fetch_latest_pypi_version()
+    if expected_target_version is not None:
+        _release_version_key(expected_target_version)
+        if target_version != expected_target_version:
+            raise RuntimeError('The available release changed; check for updates again. MetaList was not stopped.')
     current_version_key = _release_version_key(current_version)
     target_version_key = _release_version_key(target_version)
     if current_version_key >= target_version_key:

{metalist-0.6.2 → metalist-0.6.3}/app/services/shell_session_service.py

@@ -37,7 +37,7 @@ class ShellCapacityError(ValueError):
 def _terminate_tree(process) -> None:
     with CapturedExceptionContext(ProcessLookupError, boundary='app/services/shell_session_service.py:_terminate_tree:capture'):
         if os.name == 'nt':
-            stop_windows_process(pid=process.pid)
+            stop_windows_process(process=process)
         else:
             os.killpg(process.pid, signal.SIGKILL)
 

{metalist-0.6.2 → metalist-0.6.3}/app/services/update_preflight.py

@@ -15,6 +15,7 @@ import httpx
 from app.services.namespace_switcher import NamespaceLaunchProcess
 from app.services.namespace_switcher import _stop_failed_namespace_launch
 from app.services.namespace_switcher import _wait_for_namespace_ready
+from app.services.windows_process_control import stop_process_tree as stop_windows_process_tree
 
 
 def _run_checked(command: list[str], *, environ: Mapping[str, str], directory: Path) -> str:
@@ -78,6 +79,10 @@ def _probe_candidate(*, python: str, executable: str, directory: Path,
                 if len(response.content) == 0:
                     raise RuntimeError(f"Update candidate has an empty runtime resource: {path}")
     finally:
+        if sys.platform == "win32":
+            # The CLI/venv launchers can own a separate Python server process.
+            # Stop descendants even if readiness failure already reaped the launcher.
+            stop_windows_process_tree(process=process)
         _stop_failed_namespace_launch(process=process)
 
 

{metalist-0.6.2 → metalist-0.6.3}/app/services/windows_process_control.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 import shutil
 import subprocess
 import time
+import ctypes
+from ctypes import wintypes
 
 
 _WAIT_POLL_INTERVAL_SECONDS = 0.25
@@ -145,20 +147,51 @@ def stop_process(*, pid: int) -> None:
     raise RuntimeError(f"Timed out waiting for Windows process {pid} to exit")
 
 
-def stop_process_tree(*, pid: int) -> None:
-    """Stop a shell and all descendants, including children of an exited parent."""
+def _creation_filetime(process) -> int:
+    """Read identity from the owned handle, which survives exit and prevents PID reuse."""
+    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    get_times = kernel32.GetProcessTimes
+    get_times.argtypes = [wintypes.HANDLE, *([ctypes.POINTER(wintypes.FILETIME)] * 4)]
+    get_times.restype = wintypes.BOOL
+    created, exited, kernel, user = (wintypes.FILETIME() for _ in range(4))
+    if not get_times(int(process._handle), ctypes.byref(created), ctypes.byref(exited),
+                     ctypes.byref(kernel), ctypes.byref(user)):
+        raise ctypes.WinError(ctypes.get_last_error())
+    return (created.dwHighDateTime << 32) | created.dwLowDateTime
+
+
+def stop_process_tree(*, process) -> None:
+    """Stop and wait for descendants, including children of an exited parent."""
+    pid = process.pid
     _validate_pid(pid=pid)
+    created_filetime = _creation_filetime(process)
     _run_powershell(
         script=(
+            "$ErrorActionPreference = 'Stop'; "
             "$all = @(Get-CimInstance Win32_Process -ErrorAction Stop); "
             f"$pending = [System.Collections.Generic.List[int]]::new(); $pending.Add({pid}); "
+            f"$created = @{{}}; $created[{pid}] = [datetime]::FromFileTimeUtc({created_filetime}); "
             "$seen = [System.Collections.Generic.HashSet[int]]::new(); "
             "for ($i=0; $i -lt $pending.Count; $i++) { "
             "$parent = $pending[$i]; if (-not $seen.Add($parent)) { continue }; "
-            "foreach ($child in $all) { if ($child.ParentProcessId -eq $parent) { $pending.Add([int]$child.ProcessId) } } }; "
+            "foreach ($child in $all) { if ($child.ParentProcessId -eq $parent) { "
+            "if ($null -eq $child.CreationDate) { throw 'Missing child process creation time' }; "
+            "$birth = $child.CreationDate.ToUniversalTime(); "
+            "if ($birth -ge $created[$parent]) { "
+            "$pending.Add([int]$child.ProcessId); $created[[int]$child.ProcessId] = $birth } } } }; "
             "for ($i=$pending.Count-1; $i -ge 0; $i--) { "
             "$target = Get-Process -Id $pending[$i] -ErrorAction SilentlyContinue; "
-            "if ($null -ne $target) { $target | Stop-Process -Force -ErrorAction Stop } }"
+            "if ($null -ne $target) { try { "
+            "$null = $target.Handle; "
+            "if ($target.StartTime.ToUniversalTime().ToString('yyyyMMddHHmmssffffff') -ne "
+            "$created[$pending[$i]].ToString('yyyyMMddHHmmssffffff')) { throw 'Process identity changed before cleanup' }; "
+            "$target | Stop-Process -Force -ErrorAction Stop; "
+            f"if (-not $target.WaitForExit({int(_KILL_GRACE_SECONDS * 1000)})) {{ "
+            "throw ('Timed out waiting for process ' + $pending[$i] + ' to exit') } "
+            "} finally { $target.Dispose() } } }; "
+            # An absent launcher is expected after its child exits. Its final
+            # Get-Process lookup can leave $? false despite successful cleanup.
+            "exit 0"
         ),
         operation=f"stopping process tree {pid}",
     )

{metalist-0.6.2 → metalist-0.6.3}/app/startup_sanity_config.py

@@ -43,6 +43,9 @@ PY_ALLOWED_EXCEPTION_NAMES = (
 )
 
 JS_ALLOWED_TRY_CALLEE_NAMES = (
+    # HTTP update requests and write-through notification preferences; catches rethrow internal bugs.
+    "updateRequest",
+    "persistUpdateNotice",
     "fetch",
     "JSON.parse",
     "clearAiChatSession",

{metalist-0.6.2 → metalist-0.6.3}/app/static/config/command_palette_tags.json

@@ -118,7 +118,7 @@
     },
     {
       "id": "form.version_info",
-      "tags": ["version", "versions", "schema", "database", "sqlite", "migration", "migrations", "about", "info", "debug"]
+      "tags": ["update", "updates", "upgrade", "release", "pypi", "version", "versions", "schema", "database", "sqlite", "migration", "migrations", "about", "info", "debug"]
     },
     {
       "id": "form.note_layout_appearance",

{metalist-0.6.2 → metalist-0.6.3}/app/static/css/main.css

@@ -8365,3 +8365,19 @@ body.ai-tagging-locked .ai-chat-tag-operation select:enabled { cursor: pointer !
     min-width: 0;
     overflow-wrap: anywhere;
 }
+
+
+/* Release notices use the reminder card styling without sharing reminder state. */
+.app-update-notice {
+    position: fixed;
+    right: 18px;
+    bottom: 18px;
+    z-index: 1100;
+    max-width: min(460px, calc(100vw - 36px));
+    display: flex;
+    align-items: center;
+    gap: 12px;
+}
+.app-update-notice button { flex-shrink: 0; }
+.version-update-section { margin-top: 18px; }
+.version-update-log { overflow-wrap: anywhere; font-size: 0.85em; }