MetaList 0.7.2__tar.gz → 0.7.4__tar.gz

{metalist-0.7.2 → metalist-0.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.2
+Version: 0.7.4
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,17 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.4
+
+- Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
+- The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+
+## Changes in 0.7.3
+
+- Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
+- Release candidates now run the complete test and installed-package matrix on Windows, macOS, and Linux across Python 3.10–3.14. Real Chrome and Firefox exercise repeated cold loads and encrypted login on every operating system; Windows also checks Edge over verified LAN HTTPS and the repair path from a published older release.
+
 ## Changes in 0.7.2
 
 - Login, hydration, and workspace requests share one initialized browser-tab identity. Losing the `sessionStorage` copy while opening the workspace no longer causes the reported missing-tab-ID crash. The external trigger for that storage loss remains unconfirmed.
@@ -147,6 +158,8 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
+MetaList downloads its own checksum-verified uv 0.12.17 archive for the current operating system, architecture, and Linux C library. The verified archive and extracted executable are stored in the operating system's user cache; every update verifies the archive against its pinned upstream SHA-256 and the executable against the verified archive before use. That same executable performs both preflight and final installation. MetaList does not execute or replace the user's global uv. Download, verification, platform-selection, or version failures occur before any namespace is stopped. Already-installed releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies this managed installer to an older Windows updater.
+
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
 Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.

{metalist-0.7.2 → metalist-0.7.4}/README.md

@@ -12,6 +12,17 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.4
+
+- Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
+- The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+
+## Changes in 0.7.3
+
+- Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
+- Release candidates now run the complete test and installed-package matrix on Windows, macOS, and Linux across Python 3.10–3.14. Real Chrome and Firefox exercise repeated cold loads and encrypted login on every operating system; Windows also checks Edge over verified LAN HTTPS and the repair path from a published older release.
+
 ## Changes in 0.7.2
 
 - Login, hydration, and workspace requests share one initialized browser-tab identity. Losing the `sessionStorage` copy while opening the workspace no longer causes the reported missing-tab-ID crash. The external trigger for that storage loss remains unconfirmed.
@@ -111,6 +122,8 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
+MetaList downloads its own checksum-verified uv 0.12.17 archive for the current operating system, architecture, and Linux C library. The verified archive and extracted executable are stored in the operating system's user cache; every update verifies the archive against its pinned upstream SHA-256 and the executable against the verified archive before use. That same executable performs both preflight and final installation. MetaList does not execute or replace the user's global uv. Download, verification, platform-selection, or version failures occur before any namespace is stopped. Already-installed releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies this managed installer to an older Windows updater.
+
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
 Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.

{metalist-0.7.2 → metalist-0.7.4}/app/config.py

@@ -114,9 +114,9 @@ if TEST_MODE:
     # Delete existing test.db if it exists
     if test_database_path.exists():
         test_database_path.unlink()
-        print("🧪 Deleted existing test.db")
+        print("Deleted existing test.db")
 
-    print("🧪 Running in TEST MODE - using test.db")
+    print("Running in TEST MODE - using test.db")
 else:
     # Use production database
     DEFAULT_DB_PATH = str(resolve_default_database_path())

{metalist-0.7.2 → metalist-0.7.4}/app/db/live_recovery.py

@@ -44,7 +44,10 @@ def _sync_directory(path: Path) -> None:
 
 
 def _sync_file(path: Path) -> None:
-    with path.open('rb') as handle:
+    # Windows' CRT rejects fsync/_commit on a read-only descriptor with EBADF.
+    # These are live or recovery files owned by this transaction, so open them
+    # without truncation using a descriptor that every supported OS can flush.
+    with path.open('r+b') as handle:
         os.fsync(handle.fileno())
 
 

{metalist-0.7.2 → metalist-0.7.4}/app/https_proxy.py

@@ -2,6 +2,7 @@
 
 import http.client
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import logging
 from threading import BoundedSemaphore
 import time
 from app.upload_limits import MAX_UPLOAD_REQUEST_BYTES
@@ -12,6 +13,8 @@ IDLE_TIMEOUT_SECONDS = 60
 MAX_REQUEST_SECONDS = 30 * 60
 HOP_HEADERS = frozenset({'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
                          'te', 'trailer', 'trailers', 'transfer-encoding', 'upgrade'})
+RETRYABLE_METHODS = frozenset({'GET', 'HEAD', 'OPTIONS'})
+LOGGER = logging.getLogger(__name__)
 
 
 class BoundedProxyServer(ThreadingHTTPServer):
@@ -48,6 +51,39 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
     class ProxyHandler(BaseHTTPRequestHandler):
         protocol_version = 'HTTP/1.1'
 
+        def _request_upstream(self, *, headers, content_length: int, deadline: float):
+            attempts = 1
+            if self.command in RETRYABLE_METHODS and content_length == 0:
+                attempts = 2
+            for attempt in range(attempts):
+                connection = http.client.HTTPConnection(
+                    backend_host, backend_port, timeout=IDLE_TIMEOUT_SECONDS,
+                )
+                # lint: allow-PY001 rationale="retry a bodyless safe request after an expected transient upstream transport failure"
+                try:
+                    connection.putrequest(
+                        self.command, self.path, skip_host=True, skip_accept_encoding=True,
+                    )
+                    for key, value in headers.items():
+                        connection.putheader(key, value)
+                    connection.endheaders()
+                    remaining = content_length
+                    while remaining:
+                        if time.monotonic() >= deadline:
+                            raise TimeoutError('Proxy request deadline exceeded')
+                        chunk = self.rfile.read(min(CHUNK_BYTES, remaining))
+                        if not chunk:
+                            raise ConnectionError('Incomplete request body')
+                        connection.send(chunk)
+                        remaining -= len(chunk)
+                    return connection, connection.getresponse()
+                # lint: allow-PY001 rationale="retry once, then re-raise the expected upstream transport failure"
+                except (OSError, http.client.HTTPException):
+                    connection.close()
+                    if attempt + 1 == attempts:
+                        raise
+            raise AssertionError('Upstream request attempts were not exhausted')
+
         def _proxy(self):
             # Preserve the browser's HTTP/1.1 connection across module requests.
             # Chunked response framing and the socket timeout bound each transfer.
@@ -78,24 +114,24 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
             headers = forward_headers(incoming_headers=self.headers.items(), client_ip=self.client_address[0])
             headers = {key: value for key, value in headers.items() if key.casefold() not in connection_tokens | HOP_HEADERS}
             headers['Connection'] = 'close'
-            connection = http.client.HTTPConnection(backend_host, backend_port, timeout=IDLE_TIMEOUT_SECONDS)
             deadline = time.monotonic() + MAX_REQUEST_SECONDS
+            # lint: allow-PY001 rationale="translate the final external upstream transport failure into a sanitized gateway response"
+            try:
+                connection, response = self._request_upstream(
+                    headers=headers, content_length=remaining, deadline=deadline,
+                )
+            # lint: allow-PY001 rationale="return a sanitized gateway error after retrying an expected upstream transport failure"
+            except (OSError, http.client.HTTPException) as error:
+                self.close_connection = True
+                LOGGER.error(
+                    'HTTPS proxy upstream transport failed method=%s backend=%s:%s error=%s',
+                    self.command, backend_host, backend_port, type(error).__name__,
+                )
+                self.send_error(502, 'Upstream transport failed')
+                return
             response_started = False
             # lint: allow-PY001 rationale="close upstream on client disconnect or expected transport failure without disclosing exception details"
             try:
-                connection.putrequest(self.command, self.path, skip_host=True, skip_accept_encoding=True)
-                for key, value in headers.items():
-                    connection.putheader(key, value)
-                connection.endheaders()
-                while remaining:
-                    if time.monotonic() >= deadline:
-                        raise TimeoutError('Proxy request deadline exceeded')
-                    chunk = self.rfile.read(min(CHUNK_BYTES, remaining))
-                    if not chunk:
-                        raise ConnectionError('Incomplete request body')
-                    connection.send(chunk)
-                    remaining -= len(chunk)
-                response = connection.getresponse()
                 self.send_response(response.status, response.reason)
                 response_tokens = {part.strip().casefold() for value in response.headers.get_all('Connection', []) for part in value.split(',')}
                 for key, value in response.getheaders():
@@ -125,9 +161,13 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
                     self.wfile.write(b'0\r\n\r\n')
                     self.wfile.flush()
             # lint: allow-PY001 rationale="terminate a disconnected or failed external HTTP transport; emit only a sanitized upstream error"
-            except (OSError, http.client.HTTPException):
+            except (OSError, http.client.HTTPException) as error:
                 # A partial request/response cannot be reused for another request.
                 self.close_connection = True
+                LOGGER.error(
+                    'HTTPS proxy response transport failed method=%s backend=%s:%s error=%s',
+                    self.command, backend_host, backend_port, type(error).__name__,
+                )
                 if not response_started:
                     self.send_error(502, 'Upstream transport failed')
             finally:

{metalist-0.7.2 → metalist-0.7.4}/app/models/database.py

@@ -124,15 +124,8 @@ class SafeSession:
         _configure_sql_logging(anchor)
         cls._memory_anchor = anchor
         print("\n" + "=" * 50)
-        print(
-            """
-🧪 SWITCHING TO TEST MODE 🧪
-┌──────────────────────────┐
-│   IN-MEMORY DATABASE     │
-│  *All Data is Temporary  │
-└──────────────────────────┘
-        """
-        )
+        print("TEST MODE: IN-MEMORY DATABASE")
+        print("All data is temporary")
         print("=" * 50 + "\n")
         return {"status": "ok", "message": "Using in-memory database"}
 
@@ -159,15 +152,7 @@ class SafeSession:
         _configure_sql_logging(conn)
         conn.close()
         print("\n" + "=" * 50)
-        print(
-            """
-📝 RETURNING TO PRODUCTION MODE 📝
-┌──────────────────────────┐
-│      PROD DATABASE       │
-│                          │
-└──────────────────────────┘
-        """
-        )
+        print("PRODUCTION MODE: FILE DATABASE")
         print("=" * 50 + "\n")
         return {"status": "ok", "message": "Using file database"}
 

{metalist-0.7.2 → metalist-0.7.4}/app/services/app_updates.py

@@ -9,6 +9,7 @@ import shutil
 import subprocess
 import sys
 import sysconfig
+import threading
 from uuid import UUID, uuid4
 
 from app.data_directory import resolve_data_directory
@@ -28,6 +29,9 @@ class AppUpdateRejected(ValueError):
     """An update cannot be started in this installation or job state."""
 
 
+_JOB_THREAD_LOCK = threading.Lock()
+
+
 def update_executable() -> Path:
     receipt = Path(sys.prefix) / 'uv-receipt.toml'
     if not receipt.is_file():
@@ -165,24 +169,23 @@ def _release_update_job_locked(job_id: str) -> None:
 def _job_lock():
     directory = jobs_directory()
     directory.mkdir(parents=True, exist_ok=True)
-    # Stable cross-process lock: all namespaces share this installation's update admission.
-    with (directory / 'admission.lock').open('a+b') as handle:
-        if os.name == 'nt':
-            if handle.tell() == 0:
-                handle.write(b'0')
-                handle.flush()
-            handle.seek(0)
-            msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
-        else:
-            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-        try:
-            yield
-        finally:
+    # Threads share process-owned POSIX locks, so serialize them before taking
+    # the stable cross-process lock shared by all namespaces.
+    with _JOB_THREAD_LOCK:
+        with (directory / 'admission.lock').open('a+b') as handle:
             if os.name == 'nt':
                 handle.seek(0)
-                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
             else:
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+                fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                if os.name == 'nt':
+                    handle.seek(0)
+                    msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+                else:
+                    fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
 
 
 def create_update_job(target_version: str) -> dict[str, object]:

{metalist-0.7.2 → metalist-0.7.4}/app/services/self_update.py

@@ -76,17 +76,11 @@ def schedule_self_update(
             message=message,
         )
 
-    uv_executable = shutil.which("uv")
-    if uv_executable is None:
-        raise RuntimeError("uv executable was not found on PATH; MetaList was not stopped")
-
     if platform_name == "win32":
         _resolve_windows_powershell()
     elif not Path("/bin/sh").is_file():
         raise RuntimeError("/bin/sh is required for MetaList self-update; MetaList was not stopped")
-    install_command = _prepare_update(
-        uv_executable=uv_executable, target_version=target_version, environ=environ,
-    )
+    install_command = _prepare_update(target_version=target_version, environ=environ)
     updater_command: list[str]
     updater_options: dict[str, object]
     if platform_name == "win32":

metalist-0.7.4/app/services/update_installer.py

@@ -0,0 +1,260 @@
+"""Provide MetaList's checksum-pinned updater runtime on every supported OS."""
+from __future__ import annotations
+
+from collections.abc import Mapping
+import hashlib
+import io
+import os
+from pathlib import Path
+import platform
+import re
+import shutil
+import subprocess
+import sys
+import tarfile
+from tempfile import NamedTemporaryFile
+from urllib.request import urlopen
+import zipfile
+
+
+# Official immutable uv 0.12.17 release archives. These values match the
+# upstream sha256.sum asset for the same release.
+INSTALLER_VERSION = "0.12.17"
+INSTALLER_ARCHIVE_SHA256 = {
+    "aarch64-apple-darwin": "85f00cbdc6dd3e97eba4c31b4d014375a9fdfe8f570023b84e5102fc3456896b",
+    "aarch64-pc-windows-msvc": "3e1aa6849d77f0e00dc865e4afab5c5b32de053e21fe35bf5ad5cec3734ec976",
+    "aarch64-unknown-linux-gnu": "d636d1b678e9e7f367ecb22b46bd1cabbed234d6bc3b4d96365d2b507f72f86c",
+    "aarch64-unknown-linux-musl": "a6096da273d548cb9f277d237a01ac7344a39ef0f455c0e148e4dc9737c1596b",
+    "armv7-unknown-linux-gnueabihf": "796e101976e18a0f92d90b6f3efd289f77fbc5afd1aaa6fdedd3c84c209eabab",
+    "armv7-unknown-linux-musleabihf": "421c5f9c53d49088e705e7a64fea147082a2191178ea1d8c51d9ad758ca899f6",
+    "i686-pc-windows-msvc": "1d3653cb6eafd1e675e979d7cd8eeac1456202f8927a2216419993077a4c473f",
+    "i686-unknown-linux-gnu": "3faa79a70e2a1aa6eb3cd78eba02263f3e4b17b6be584a01429968f92ff74966",
+    "i686-unknown-linux-musl": "fc05220cfa1c6585e0e209877c228393b25a96e17cd43028b06566ac894cd078",
+    "powerpc64le-unknown-linux-gnu": "eb6dbedaaa622af32cba2388e0d2d47e34c8724d4214a129d614b96f071d8e53",
+    "riscv64gc-unknown-linux-gnu": "65b807b24357133c49d97ca9394ee7e13ca62822e1095376c809654b35f39cf2",
+    "riscv64gc-unknown-linux-musl": "87c339a735b578f285b961bebdefe0a671f3652477d1e84dc69cd1a829f45e92",
+    "s390x-unknown-linux-gnu": "d99f69f47fc5e0975d6e7a5745cf2332317015caffb3bb81e5154cc7b66fa77a",
+    "x86_64-apple-darwin": "8dcf05a8c809bb3c471d2b614788ba27a6e41298fc8c31ac84b5f4339fd468e5",
+    "x86_64-pc-windows-msvc": "a252121d5b59398fcb137c6ea448176459a44010f33f67e0072305a637119ca7",
+    "x86_64-unknown-linux-gnu": "fa82fd8dde8e8eefdecada6aa0889666556cfceb690d06e0c3bca49eb3070a63",
+    "x86_64-unknown-linux-musl": "6401c4665d8fa2a9893e087c91f585430738e3170f5398a1141483efb4a93310",
+}
+
+
+def _installer_version(executable: str, environ: Mapping[str, str]) -> tuple[int, int, int]:
+    completed = subprocess.run(
+        [executable, "--version"], env=dict(environ), capture_output=True,
+        text=True, check=True, timeout=30,
+    )
+    match = re.fullmatch(
+        r"uv (\d+)\.(\d+)\.(\d+)(?: \([^\r\n]+\))?",
+        completed.stdout.strip(),
+    )
+    if match is None:
+        raise RuntimeError("Cannot verify the uv installer version; MetaList was not stopped")
+    return tuple(int(part) for part in match.groups())
+
+
+def _normalized_architecture() -> str:
+    machine = platform.machine().casefold()
+    aliases = {
+        "amd64": "x86_64", "x86_64": "x86_64",
+        "arm64": "aarch64", "aarch64": "aarch64",
+        "x86": "i686", "i386": "i686", "i686": "i686",
+        "armv7": "armv7", "armv7l": "armv7",
+        "ppc64le": "powerpc64le", "powerpc64le": "powerpc64le",
+        "riscv64": "riscv64gc", "riscv64gc": "riscv64gc",
+        "s390x": "s390x",
+    }
+    if machine not in aliases:
+        raise RuntimeError(f"Unsupported MetaList updater platform architecture: {machine}")
+    return aliases[machine]
+
+
+def _linux_environment() -> str:
+    libc_name = platform.libc_ver()[0].casefold()
+    if libc_name in {"glibc", "gnu libc"}:
+        return "gnu"
+    if libc_name == "musl":
+        return "musl"
+    raise RuntimeError(f"Unsupported MetaList updater platform C library: {libc_name or 'unknown'}")
+
+
+def _installer_target(platform_name: str) -> str:
+    architecture = _normalized_architecture()
+    if platform_name == "win32":
+        target = f"{architecture}-pc-windows-msvc"
+    elif platform_name == "darwin":
+        target = f"{architecture}-apple-darwin"
+    elif platform_name == "linux":
+        environment = _linux_environment()
+        if architecture == "armv7":
+            if environment == "gnu":
+                abi = "gnueabihf"
+            elif environment == "musl":
+                abi = "musleabihf"
+            else:
+                raise AssertionError(f"Unexpected Linux environment: {environment}")
+        else:
+            abi = environment
+        target = f"{architecture}-unknown-linux-{abi}"
+    else:
+        raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+    if target not in INSTALLER_ARCHIVE_SHA256:
+        raise RuntimeError(f"Unsupported MetaList updater platform target: {target}")
+    return target
+
+
+def _required_absolute_directory(environ: Mapping[str, str], name: str) -> Path:
+    if name not in environ:
+        raise RuntimeError(f"{name} is required for the MetaList update installer")
+    directory = Path(environ[name])
+    if not directory.is_absolute():
+        raise RuntimeError(f"{name} must be an absolute path for the MetaList update installer")
+    return directory
+
+
+def _installer_cache_root(*, platform_name: str, environ: Mapping[str, str]) -> Path:
+    if platform_name == "win32":
+        return _required_absolute_directory(environ, "LOCALAPPDATA") / "MetaList" / "update-tools"
+    if platform_name == "darwin":
+        home = _required_absolute_directory(environ, "HOME")
+        return home / "Library" / "Caches" / "MetaList" / "update-tools"
+    if platform_name == "linux":
+        if "XDG_CACHE_HOME" in environ:
+            cache_home = _required_absolute_directory(environ, "XDG_CACHE_HOME")
+        else:
+            home = _required_absolute_directory(environ, "HOME")
+            cache_home = home / ".cache"
+        return cache_home / "metalist" / "update-tools"
+    raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+
+
+def _archive_name(*, target: str, platform_name: str) -> str:
+    if platform_name == "win32":
+        extension = "zip"
+    elif platform_name in {"darwin", "linux"}:
+        extension = "tar.gz"
+    else:
+        raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+    return f"uv-{target}.{extension}"
+
+
+def _download_installer_archive(asset_name: str) -> bytes:
+    url = f"https://github.com/astral-sh/uv/releases/download/{INSTALLER_VERSION}/{asset_name}"
+    with urlopen(url, timeout=120) as response:
+        return response.read()
+
+
+def _extract_installer_binary(
+    *, archive_body: bytes, asset_name: str, platform_name: str, target: str,
+) -> bytes:
+    if platform_name == "win32":
+        member_name = "uv.exe"
+    elif platform_name in {"darwin", "linux"}:
+        member_name = f"uv-{target}/uv"
+    else:
+        raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+    if asset_name.endswith(".zip"):
+        with zipfile.ZipFile(io.BytesIO(archive_body)) as archive:
+            return archive.read(member_name)
+    with tarfile.open(fileobj=io.BytesIO(archive_body), mode="r:gz") as archive:
+        member = archive.extractfile(member_name)
+        if member is None:
+            raise RuntimeError("Verified update installer archive is missing the uv executable")
+        return member.read()
+
+
+def _publish_bytes(*, destination: Path, body: bytes, mode: int) -> None:
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    with NamedTemporaryFile(
+        dir=destination.parent, prefix=destination.name + "-", suffix=".tmp", delete=False,
+    ) as staged:
+        staged.write(body)
+        staged.flush()
+        os.fsync(staged.fileno())
+        staged_path = Path(staged.name)
+    os.chmod(staged_path, mode)
+    os.replace(staged_path, destination)
+
+
+def _load_verified_archive(
+    *, archive_path: Path, expected_digest: str, asset_name: str,
+) -> bytes:
+    if archive_path.exists():
+        archive_body = archive_path.read_bytes()
+        if hashlib.sha256(archive_body).hexdigest() != expected_digest:
+            raise RuntimeError(
+                "Cached update installer archive failed checksum verification; "
+                "MetaList was not stopped"
+            )
+        return archive_body
+    print(f"Preparing verified MetaList update installer uv {INSTALLER_VERSION}...", flush=True)
+    archive_body = _download_installer_archive(asset_name)
+    if hashlib.sha256(archive_body).hexdigest() != expected_digest:
+        raise RuntimeError(
+            "Downloaded update installer failed checksum verification; MetaList was not stopped"
+        )
+    _publish_bytes(destination=archive_path, body=archive_body, mode=0o600)
+    return archive_body
+
+
+def _managed_installer(*, platform_name: str, environ: Mapping[str, str]) -> str:
+    target = _installer_target(platform_name)
+    asset_name = _archive_name(target=target, platform_name=platform_name)
+    directory = _installer_cache_root(platform_name=platform_name, environ=environ) / (
+        f"uv-{INSTALLER_VERSION}-{target}"
+    )
+    archive_path = directory / asset_name
+    archive_body = _load_verified_archive(
+        archive_path=archive_path,
+        expected_digest=INSTALLER_ARCHIVE_SHA256[target],
+        asset_name=asset_name,
+    )
+    expected_binary = _extract_installer_binary(
+        archive_body=archive_body, asset_name=asset_name,
+        platform_name=platform_name, target=target,
+    )
+    if platform_name == "win32":
+        executable = directory / "uv.exe"
+    else:
+        assert platform_name in {"darwin", "linux"}
+        executable = directory / "uv"
+    if executable.exists():
+        if executable.read_bytes() != expected_binary:
+            raise RuntimeError(
+                "Cached update installer failed checksum verification; MetaList was not stopped"
+            )
+    else:
+        _publish_bytes(destination=executable, body=expected_binary, mode=0o700)
+    if platform_name != "win32":
+        os.chmod(executable, 0o700)
+    return str(executable)
+
+
+def resolve_update_installer(*, platform_name: str, environ: Mapping[str, str]) -> str:
+    executable = _managed_installer(platform_name=platform_name, environ=environ)
+    expected_version = tuple(int(part) for part in INSTALLER_VERSION.split("."))
+    if _installer_version(executable, environ) != expected_version:
+        raise RuntimeError(
+            "Verified update installer reported the wrong version; MetaList was not stopped"
+        )
+    return executable
+
+
+def repair_windows_update() -> None:
+    if sys.platform != "win32":
+        raise RuntimeError("This recovery launcher is for Windows installations")
+    metalist_executable = shutil.which("metalist")
+    if metalist_executable is None:
+        raise RuntimeError("The existing MetaList command must be available on PATH")
+    environ = dict(os.environ)
+    installer = resolve_update_installer(platform_name="win32", environ=environ)
+    # The already-installed updater discovers uv through PATH. Preserve that
+    # updater's preflight, shutdown, backup, offline install, and restart flow.
+    environ["PATH"] = str(Path(installer).parent) + os.pathsep + environ["PATH"]
+    subprocess.run([metalist_executable, "update"], env=environ, check=True)
+
+
+if __name__ == "__main__":
+    repair_windows_update()

{metalist-0.7.2 → metalist-0.7.4}/app/services/update_preflight.py

@@ -16,6 +16,7 @@ from app.services.namespace_switcher import NamespaceLaunchProcess
 from app.services.namespace_switcher import _stop_failed_namespace_launch
 from app.services.namespace_switcher import _wait_for_namespace_ready
 from app.services.windows_process_control import stop_process_tree as stop_windows_process_tree
+from app.services.update_installer import resolve_update_installer
 
 
 def _run_checked(command: list[str], *, environ: Mapping[str, str], directory: Path) -> str:
@@ -86,12 +87,12 @@ def _probe_candidate(*, python: str, executable: str, directory: Path,
         _stop_failed_namespace_launch(process=process)
 
 
-def prepare_update(*, uv_executable: str, target_version: str,
-                   environ: Mapping[str, str]) -> list[str]:
+def prepare_update(*, target_version: str, environ: Mapping[str, str]) -> list[str]:
     # A tool environment is replaced during install: pin its external base interpreter.
     python = str(Path(sys._base_executable).resolve())
     if not Path(python).is_file():
         raise RuntimeError("The current base Python interpreter is missing; MetaList was not stopped")
+    uv_executable = resolve_update_installer(platform_name=sys.platform, environ=environ)
     print(f"Checking MetaList v{target_version} installation and startup with Python {sys.version.split()[0]}...", flush=True)
     with TemporaryDirectory(prefix="metalist-update-check-") as temporary:
         directory = Path(temporary)

{metalist-0.7.2 → metalist-0.7.4}/app/startup_js_sanity.py

@@ -165,7 +165,7 @@ def discover_typescript_source_paths(project_root: Path) -> list[Path]:
 
 
 def _path_rel(project_root: Path, path: Path) -> str:
-    return os.path.relpath(path, project_root)
+    return path.relative_to(project_root).as_posix()
 
 
 def _codeframe(lines: list[str], lineno: int, col: int, context_lines: int) -> str:

{metalist-0.7.2 → metalist-0.7.4}/app/startup_sanity.py

@@ -72,7 +72,7 @@ class _RouteDecorator:
 
 
 def _path_rel(project_root: Path, path: Path) -> str:
-    return os.path.relpath(path, project_root)
+    return path.relative_to(project_root).as_posix()
 
 
 def _suppressed(lines: list[str], lineno: int, rule_id: str) -> bool:

{metalist-0.7.2 → metalist-0.7.4}/app/version.py

@@ -1,3 +1,3 @@
 """Single authoritative MetaList application version."""
 
-__version__ = "0.7.2"
+__version__ = "0.7.4"