MetaList 0.7.3__tar.gz → 0.7.4__tar.gz

{metalist-0.7.3 → metalist-0.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.3
+Version: 0.7.4
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,12 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.4
+
+- Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
+- The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+
 ## Changes in 0.7.3
 
 - Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
@@ -152,7 +158,7 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
-On Windows, the updater checks uv before installing packages. Versions older than 0.12.13 use a temporary PE-resource editing operation that can fail with `uv-trampoline.exe: Access is denied`. This checkout selects a private, checksum-verified uv 0.12.17 for those installations, keeping the same installer through preflight and final installation. It does not replace global uv. Already-installed MetaList releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies the compatible installer to that existing updater.
+MetaList downloads its own checksum-verified uv 0.12.17 archive for the current operating system, architecture, and Linux C library. The verified archive and extracted executable are stored in the operating system's user cache; every update verifies the archive against its pinned upstream SHA-256 and the executable against the verified archive before use. That same executable performs both preflight and final installation. MetaList does not execute or replace the user's global uv. Download, verification, platform-selection, or version failures occur before any namespace is stopped. Already-installed releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies this managed installer to an older Windows updater.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 

{metalist-0.7.3 → metalist-0.7.4}/README.md

@@ -12,6 +12,12 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.4
+
+- Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
+- The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+
 ## Changes in 0.7.3
 
 - Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
@@ -116,7 +122,7 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
-On Windows, the updater checks uv before installing packages. Versions older than 0.12.13 use a temporary PE-resource editing operation that can fail with `uv-trampoline.exe: Access is denied`. This checkout selects a private, checksum-verified uv 0.12.17 for those installations, keeping the same installer through preflight and final installation. It does not replace global uv. Already-installed MetaList releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies the compatible installer to that existing updater.
+MetaList downloads its own checksum-verified uv 0.12.17 archive for the current operating system, architecture, and Linux C library. The verified archive and extracted executable are stored in the operating system's user cache; every update verifies the archive against its pinned upstream SHA-256 and the executable against the verified archive before use. That same executable performs both preflight and final installation. MetaList does not execute or replace the user's global uv. Download, verification, platform-selection, or version failures occur before any namespace is stopped. Already-installed releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies this managed installer to an older Windows updater.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 

{metalist-0.7.3 → metalist-0.7.4}/app/https_proxy.py

@@ -2,6 +2,7 @@
 
 import http.client
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import logging
 from threading import BoundedSemaphore
 import time
 from app.upload_limits import MAX_UPLOAD_REQUEST_BYTES
@@ -12,6 +13,8 @@ IDLE_TIMEOUT_SECONDS = 60
 MAX_REQUEST_SECONDS = 30 * 60
 HOP_HEADERS = frozenset({'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
                          'te', 'trailer', 'trailers', 'transfer-encoding', 'upgrade'})
+RETRYABLE_METHODS = frozenset({'GET', 'HEAD', 'OPTIONS'})
+LOGGER = logging.getLogger(__name__)
 
 
 class BoundedProxyServer(ThreadingHTTPServer):
@@ -48,6 +51,39 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
     class ProxyHandler(BaseHTTPRequestHandler):
         protocol_version = 'HTTP/1.1'
 
+        def _request_upstream(self, *, headers, content_length: int, deadline: float):
+            attempts = 1
+            if self.command in RETRYABLE_METHODS and content_length == 0:
+                attempts = 2
+            for attempt in range(attempts):
+                connection = http.client.HTTPConnection(
+                    backend_host, backend_port, timeout=IDLE_TIMEOUT_SECONDS,
+                )
+                # lint: allow-PY001 rationale="retry a bodyless safe request after an expected transient upstream transport failure"
+                try:
+                    connection.putrequest(
+                        self.command, self.path, skip_host=True, skip_accept_encoding=True,
+                    )
+                    for key, value in headers.items():
+                        connection.putheader(key, value)
+                    connection.endheaders()
+                    remaining = content_length
+                    while remaining:
+                        if time.monotonic() >= deadline:
+                            raise TimeoutError('Proxy request deadline exceeded')
+                        chunk = self.rfile.read(min(CHUNK_BYTES, remaining))
+                        if not chunk:
+                            raise ConnectionError('Incomplete request body')
+                        connection.send(chunk)
+                        remaining -= len(chunk)
+                    return connection, connection.getresponse()
+                # lint: allow-PY001 rationale="retry once, then re-raise the expected upstream transport failure"
+                except (OSError, http.client.HTTPException):
+                    connection.close()
+                    if attempt + 1 == attempts:
+                        raise
+            raise AssertionError('Upstream request attempts were not exhausted')
+
         def _proxy(self):
             # Preserve the browser's HTTP/1.1 connection across module requests.
             # Chunked response framing and the socket timeout bound each transfer.
@@ -78,24 +114,24 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
             headers = forward_headers(incoming_headers=self.headers.items(), client_ip=self.client_address[0])
             headers = {key: value for key, value in headers.items() if key.casefold() not in connection_tokens | HOP_HEADERS}
             headers['Connection'] = 'close'
-            connection = http.client.HTTPConnection(backend_host, backend_port, timeout=IDLE_TIMEOUT_SECONDS)
             deadline = time.monotonic() + MAX_REQUEST_SECONDS
+            # lint: allow-PY001 rationale="translate the final external upstream transport failure into a sanitized gateway response"
+            try:
+                connection, response = self._request_upstream(
+                    headers=headers, content_length=remaining, deadline=deadline,
+                )
+            # lint: allow-PY001 rationale="return a sanitized gateway error after retrying an expected upstream transport failure"
+            except (OSError, http.client.HTTPException) as error:
+                self.close_connection = True
+                LOGGER.error(
+                    'HTTPS proxy upstream transport failed method=%s backend=%s:%s error=%s',
+                    self.command, backend_host, backend_port, type(error).__name__,
+                )
+                self.send_error(502, 'Upstream transport failed')
+                return
             response_started = False
             # lint: allow-PY001 rationale="close upstream on client disconnect or expected transport failure without disclosing exception details"
             try:
-                connection.putrequest(self.command, self.path, skip_host=True, skip_accept_encoding=True)
-                for key, value in headers.items():
-                    connection.putheader(key, value)
-                connection.endheaders()
-                while remaining:
-                    if time.monotonic() >= deadline:
-                        raise TimeoutError('Proxy request deadline exceeded')
-                    chunk = self.rfile.read(min(CHUNK_BYTES, remaining))
-                    if not chunk:
-                        raise ConnectionError('Incomplete request body')
-                    connection.send(chunk)
-                    remaining -= len(chunk)
-                response = connection.getresponse()
                 self.send_response(response.status, response.reason)
                 response_tokens = {part.strip().casefold() for value in response.headers.get_all('Connection', []) for part in value.split(',')}
                 for key, value in response.getheaders():
@@ -125,9 +161,13 @@ def make_proxy_handler(*, backend_host: str, backend_port: int, forward_headers)
                     self.wfile.write(b'0\r\n\r\n')
                     self.wfile.flush()
             # lint: allow-PY001 rationale="terminate a disconnected or failed external HTTP transport; emit only a sanitized upstream error"
-            except (OSError, http.client.HTTPException):
+            except (OSError, http.client.HTTPException) as error:
                 # A partial request/response cannot be reused for another request.
                 self.close_connection = True
+                LOGGER.error(
+                    'HTTPS proxy response transport failed method=%s backend=%s:%s error=%s',
+                    self.command, backend_host, backend_port, type(error).__name__,
+                )
                 if not response_started:
                     self.send_error(502, 'Upstream transport failed')
             finally:

{metalist-0.7.3 → metalist-0.7.4}/app/services/self_update.py

@@ -76,17 +76,11 @@ def schedule_self_update(
             message=message,
         )
 
-    uv_executable = shutil.which("uv")
-    if uv_executable is None:
-        raise RuntimeError("uv executable was not found on PATH; MetaList was not stopped")
-
     if platform_name == "win32":
         _resolve_windows_powershell()
     elif not Path("/bin/sh").is_file():
         raise RuntimeError("/bin/sh is required for MetaList self-update; MetaList was not stopped")
-    install_command = _prepare_update(
-        uv_executable=uv_executable, target_version=target_version, environ=environ,
-    )
+    install_command = _prepare_update(target_version=target_version, environ=environ)
     updater_command: list[str]
     updater_options: dict[str, object]
     if platform_name == "win32":

metalist-0.7.4/app/services/update_installer.py

@@ -0,0 +1,260 @@
+"""Provide MetaList's checksum-pinned updater runtime on every supported OS."""
+from __future__ import annotations
+
+from collections.abc import Mapping
+import hashlib
+import io
+import os
+from pathlib import Path
+import platform
+import re
+import shutil
+import subprocess
+import sys
+import tarfile
+from tempfile import NamedTemporaryFile
+from urllib.request import urlopen
+import zipfile
+
+
+# Official immutable uv 0.12.17 release archives. These values match the
+# upstream sha256.sum asset for the same release.
+INSTALLER_VERSION = "0.12.17"
+INSTALLER_ARCHIVE_SHA256 = {
+    "aarch64-apple-darwin": "85f00cbdc6dd3e97eba4c31b4d014375a9fdfe8f570023b84e5102fc3456896b",
+    "aarch64-pc-windows-msvc": "3e1aa6849d77f0e00dc865e4afab5c5b32de053e21fe35bf5ad5cec3734ec976",
+    "aarch64-unknown-linux-gnu": "d636d1b678e9e7f367ecb22b46bd1cabbed234d6bc3b4d96365d2b507f72f86c",
+    "aarch64-unknown-linux-musl": "a6096da273d548cb9f277d237a01ac7344a39ef0f455c0e148e4dc9737c1596b",
+    "armv7-unknown-linux-gnueabihf": "796e101976e18a0f92d90b6f3efd289f77fbc5afd1aaa6fdedd3c84c209eabab",
+    "armv7-unknown-linux-musleabihf": "421c5f9c53d49088e705e7a64fea147082a2191178ea1d8c51d9ad758ca899f6",
+    "i686-pc-windows-msvc": "1d3653cb6eafd1e675e979d7cd8eeac1456202f8927a2216419993077a4c473f",
+    "i686-unknown-linux-gnu": "3faa79a70e2a1aa6eb3cd78eba02263f3e4b17b6be584a01429968f92ff74966",
+    "i686-unknown-linux-musl": "fc05220cfa1c6585e0e209877c228393b25a96e17cd43028b06566ac894cd078",
+    "powerpc64le-unknown-linux-gnu": "eb6dbedaaa622af32cba2388e0d2d47e34c8724d4214a129d614b96f071d8e53",
+    "riscv64gc-unknown-linux-gnu": "65b807b24357133c49d97ca9394ee7e13ca62822e1095376c809654b35f39cf2",
+    "riscv64gc-unknown-linux-musl": "87c339a735b578f285b961bebdefe0a671f3652477d1e84dc69cd1a829f45e92",
+    "s390x-unknown-linux-gnu": "d99f69f47fc5e0975d6e7a5745cf2332317015caffb3bb81e5154cc7b66fa77a",
+    "x86_64-apple-darwin": "8dcf05a8c809bb3c471d2b614788ba27a6e41298fc8c31ac84b5f4339fd468e5",
+    "x86_64-pc-windows-msvc": "a252121d5b59398fcb137c6ea448176459a44010f33f67e0072305a637119ca7",
+    "x86_64-unknown-linux-gnu": "fa82fd8dde8e8eefdecada6aa0889666556cfceb690d06e0c3bca49eb3070a63",
+    "x86_64-unknown-linux-musl": "6401c4665d8fa2a9893e087c91f585430738e3170f5398a1141483efb4a93310",
+}
+
+
+def _installer_version(executable: str, environ: Mapping[str, str]) -> tuple[int, int, int]:
+    completed = subprocess.run(
+        [executable, "--version"], env=dict(environ), capture_output=True,
+        text=True, check=True, timeout=30,
+    )
+    match = re.fullmatch(
+        r"uv (\d+)\.(\d+)\.(\d+)(?: \([^\r\n]+\))?",
+        completed.stdout.strip(),
+    )
+    if match is None:
+        raise RuntimeError("Cannot verify the uv installer version; MetaList was not stopped")
+    return tuple(int(part) for part in match.groups())
+
+
+def _normalized_architecture() -> str:
+    machine = platform.machine().casefold()
+    aliases = {
+        "amd64": "x86_64", "x86_64": "x86_64",
+        "arm64": "aarch64", "aarch64": "aarch64",
+        "x86": "i686", "i386": "i686", "i686": "i686",
+        "armv7": "armv7", "armv7l": "armv7",
+        "ppc64le": "powerpc64le", "powerpc64le": "powerpc64le",
+        "riscv64": "riscv64gc", "riscv64gc": "riscv64gc",
+        "s390x": "s390x",
+    }
+    if machine not in aliases:
+        raise RuntimeError(f"Unsupported MetaList updater platform architecture: {machine}")
+    return aliases[machine]
+
+
+def _linux_environment() -> str:
+    libc_name = platform.libc_ver()[0].casefold()
+    if libc_name in {"glibc", "gnu libc"}:
+        return "gnu"
+    if libc_name == "musl":
+        return "musl"
+    raise RuntimeError(f"Unsupported MetaList updater platform C library: {libc_name or 'unknown'}")
+
+
+def _installer_target(platform_name: str) -> str:
+    architecture = _normalized_architecture()
+    if platform_name == "win32":
+        target = f"{architecture}-pc-windows-msvc"
+    elif platform_name == "darwin":
+        target = f"{architecture}-apple-darwin"
+    elif platform_name == "linux":
+        environment = _linux_environment()
+        if architecture == "armv7":
+            if environment == "gnu":
+                abi = "gnueabihf"
+            elif environment == "musl":
+                abi = "musleabihf"
+            else:
+                raise AssertionError(f"Unexpected Linux environment: {environment}")
+        else:
+            abi = environment
+        target = f"{architecture}-unknown-linux-{abi}"
+    else:
+        raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+    if target not in INSTALLER_ARCHIVE_SHA256:
+        raise RuntimeError(f"Unsupported MetaList updater platform target: {target}")
+    return target
+
+
+def _required_absolute_directory(environ: Mapping[str, str], name: str) -> Path:
+    if name not in environ:
+        raise RuntimeError(f"{name} is required for the MetaList update installer")
+    directory = Path(environ[name])
+    if not directory.is_absolute():
+        raise RuntimeError(f"{name} must be an absolute path for the MetaList update installer")
+    return directory
+
+
+def _installer_cache_root(*, platform_name: str, environ: Mapping[str, str]) -> Path:
+    if platform_name == "win32":
+        return _required_absolute_directory(environ, "LOCALAPPDATA") / "MetaList" / "update-tools"
+    if platform_name == "darwin":
+        home = _required_absolute_directory(environ, "HOME")
+        return home / "Library" / "Caches" / "MetaList" / "update-tools"
+    if platform_name == "linux":
+        if "XDG_CACHE_HOME" in environ:
+            cache_home = _required_absolute_directory(environ, "XDG_CACHE_HOME")
+        else:
+            home = _required_absolute_directory(environ, "HOME")
+            cache_home = home / ".cache"
+        return cache_home / "metalist" / "update-tools"
+    raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+
+
+def _archive_name(*, target: str, platform_name: str) -> str:
+    if platform_name == "win32":
+        extension = "zip"
+    elif platform_name in {"darwin", "linux"}:
+        extension = "tar.gz"
+    else:
+        raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+    return f"uv-{target}.{extension}"
+
+
+def _download_installer_archive(asset_name: str) -> bytes:
+    url = f"https://github.com/astral-sh/uv/releases/download/{INSTALLER_VERSION}/{asset_name}"
+    with urlopen(url, timeout=120) as response:
+        return response.read()
+
+
+def _extract_installer_binary(
+    *, archive_body: bytes, asset_name: str, platform_name: str, target: str,
+) -> bytes:
+    if platform_name == "win32":
+        member_name = "uv.exe"
+    elif platform_name in {"darwin", "linux"}:
+        member_name = f"uv-{target}/uv"
+    else:
+        raise RuntimeError(f"Unsupported MetaList updater platform: {platform_name}")
+    if asset_name.endswith(".zip"):
+        with zipfile.ZipFile(io.BytesIO(archive_body)) as archive:
+            return archive.read(member_name)
+    with tarfile.open(fileobj=io.BytesIO(archive_body), mode="r:gz") as archive:
+        member = archive.extractfile(member_name)
+        if member is None:
+            raise RuntimeError("Verified update installer archive is missing the uv executable")
+        return member.read()
+
+
+def _publish_bytes(*, destination: Path, body: bytes, mode: int) -> None:
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    with NamedTemporaryFile(
+        dir=destination.parent, prefix=destination.name + "-", suffix=".tmp", delete=False,
+    ) as staged:
+        staged.write(body)
+        staged.flush()
+        os.fsync(staged.fileno())
+        staged_path = Path(staged.name)
+    os.chmod(staged_path, mode)
+    os.replace(staged_path, destination)
+
+
+def _load_verified_archive(
+    *, archive_path: Path, expected_digest: str, asset_name: str,
+) -> bytes:
+    if archive_path.exists():
+        archive_body = archive_path.read_bytes()
+        if hashlib.sha256(archive_body).hexdigest() != expected_digest:
+            raise RuntimeError(
+                "Cached update installer archive failed checksum verification; "
+                "MetaList was not stopped"
+            )
+        return archive_body
+    print(f"Preparing verified MetaList update installer uv {INSTALLER_VERSION}...", flush=True)
+    archive_body = _download_installer_archive(asset_name)
+    if hashlib.sha256(archive_body).hexdigest() != expected_digest:
+        raise RuntimeError(
+            "Downloaded update installer failed checksum verification; MetaList was not stopped"
+        )
+    _publish_bytes(destination=archive_path, body=archive_body, mode=0o600)
+    return archive_body
+
+
+def _managed_installer(*, platform_name: str, environ: Mapping[str, str]) -> str:
+    target = _installer_target(platform_name)
+    asset_name = _archive_name(target=target, platform_name=platform_name)
+    directory = _installer_cache_root(platform_name=platform_name, environ=environ) / (
+        f"uv-{INSTALLER_VERSION}-{target}"
+    )
+    archive_path = directory / asset_name
+    archive_body = _load_verified_archive(
+        archive_path=archive_path,
+        expected_digest=INSTALLER_ARCHIVE_SHA256[target],
+        asset_name=asset_name,
+    )
+    expected_binary = _extract_installer_binary(
+        archive_body=archive_body, asset_name=asset_name,
+        platform_name=platform_name, target=target,
+    )
+    if platform_name == "win32":
+        executable = directory / "uv.exe"
+    else:
+        assert platform_name in {"darwin", "linux"}
+        executable = directory / "uv"
+    if executable.exists():
+        if executable.read_bytes() != expected_binary:
+            raise RuntimeError(
+                "Cached update installer failed checksum verification; MetaList was not stopped"
+            )
+    else:
+        _publish_bytes(destination=executable, body=expected_binary, mode=0o700)
+    if platform_name != "win32":
+        os.chmod(executable, 0o700)
+    return str(executable)
+
+
+def resolve_update_installer(*, platform_name: str, environ: Mapping[str, str]) -> str:
+    executable = _managed_installer(platform_name=platform_name, environ=environ)
+    expected_version = tuple(int(part) for part in INSTALLER_VERSION.split("."))
+    if _installer_version(executable, environ) != expected_version:
+        raise RuntimeError(
+            "Verified update installer reported the wrong version; MetaList was not stopped"
+        )
+    return executable
+
+
+def repair_windows_update() -> None:
+    if sys.platform != "win32":
+        raise RuntimeError("This recovery launcher is for Windows installations")
+    metalist_executable = shutil.which("metalist")
+    if metalist_executable is None:
+        raise RuntimeError("The existing MetaList command must be available on PATH")
+    environ = dict(os.environ)
+    installer = resolve_update_installer(platform_name="win32", environ=environ)
+    # The already-installed updater discovers uv through PATH. Preserve that
+    # updater's preflight, shutdown, backup, offline install, and restart flow.
+    environ["PATH"] = str(Path(installer).parent) + os.pathsep + environ["PATH"]
+    subprocess.run([metalist_executable, "update"], env=environ, check=True)
+
+
+if __name__ == "__main__":
+    repair_windows_update()

{metalist-0.7.3 → metalist-0.7.4}/app/services/update_preflight.py

@@ -87,15 +87,12 @@ def _probe_candidate(*, python: str, executable: str, directory: Path,
         _stop_failed_namespace_launch(process=process)
 
 
-def prepare_update(*, uv_executable: str, target_version: str,
-                   environ: Mapping[str, str]) -> list[str]:
+def prepare_update(*, target_version: str, environ: Mapping[str, str]) -> list[str]:
     # A tool environment is replaced during install: pin its external base interpreter.
     python = str(Path(sys._base_executable).resolve())
     if not Path(python).is_file():
         raise RuntimeError("The current base Python interpreter is missing; MetaList was not stopped")
-    uv_executable = resolve_update_installer(
-        uv_executable=uv_executable, platform_name=sys.platform, environ=environ,
-    )
+    uv_executable = resolve_update_installer(platform_name=sys.platform, environ=environ)
     print(f"Checking MetaList v{target_version} installation and startup with Python {sys.version.split()[0]}...", flush=True)
     with TemporaryDirectory(prefix="metalist-update-check-") as temporary:
         directory = Path(temporary)

{metalist-0.7.3 → metalist-0.7.4}/app/version.py

@@ -1,3 +1,3 @@
 """Single authoritative MetaList application version."""
 
-__version__ = "0.7.3"
+__version__ = "0.7.4"

{metalist-0.7.3 → metalist-0.7.4}/metalist.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.3
+Version: 0.7.4
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,12 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.4
+
+- Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
+- The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+
 ## Changes in 0.7.3
 
 - Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
@@ -152,7 +158,7 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
-On Windows, the updater checks uv before installing packages. Versions older than 0.12.13 use a temporary PE-resource editing operation that can fail with `uv-trampoline.exe: Access is denied`. This checkout selects a private, checksum-verified uv 0.12.17 for those installations, keeping the same installer through preflight and final installation. It does not replace global uv. Already-installed MetaList releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies the compatible installer to that existing updater.
+MetaList downloads its own checksum-verified uv 0.12.17 archive for the current operating system, architecture, and Linux C library. The verified archive and extracted executable are stored in the operating system's user cache; every update verifies the archive against its pinned upstream SHA-256 and the executable against the verified archive before use. That same executable performs both preflight and final installation. MetaList does not execute or replace the user's global uv. Download, verification, platform-selection, or version failures occur before any namespace is stopped. Already-installed releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies this managed installer to an older Windows updater.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 

metalist-0.7.3/app/services/update_installer.py

@@ -1,122 +0,0 @@
-"""Select a compatible Windows installer; also runs standalone for old installations."""
-from __future__ import annotations
-
-from collections.abc import Mapping
-import hashlib
-import io
-import os
-from pathlib import Path
-import platform
-import re
-import shutil
-import subprocess
-import sys
-from tempfile import NamedTemporaryFile
-from urllib.request import urlopen
-import zipfile
-
-
-# Official immutable 0.12.17 release assets. 0.12.13 removed the temporary
-# Windows PE resource-editing operation that can fail under file inspection.
-INSTALLER_VERSION = "0.12.17"
-MINIMUM_WINDOWS_VERSION = (0, 12, 13)
-WINDOWS_INSTALLERS = {
-    "x86_64": (
-        "a252121d5b59398fcb137c6ea448176459a44010f33f67e0072305a637119ca7",
-        "2019cdf564cb8f749262f5f021cedc75a99abb1c6081227ca340bbcda972611d",
-    ),
-    "aarch64": (
-        "3e1aa6849d77f0e00dc865e4afab5c5b32de053e21fe35bf5ad5cec3734ec976",
-        "92e3a7af84b7da8925997eb5b856595e1c36a4b3591fbccee7d143e69f1c8656",
-    ),
-    "i686": (
-        "1d3653cb6eafd1e675e979d7cd8eeac1456202f8927a2216419993077a4c473f",
-        "8d08a9c61f18f9436069f3ccf6e13e7f665b0e9b1ff85ac98f1ec8261c493145",
-    ),
-}
-
-
-def _installer_version(executable: str, environ: Mapping[str, str]) -> tuple[int, int, int]:
-    completed = subprocess.run([executable, "--version"], env=dict(environ),
-                               capture_output=True, text=True, check=True, timeout=30)
-    match = re.fullmatch(r"uv (\d+)\.(\d+)\.(\d+)(?: \([^\r\n]+\))?", completed.stdout.strip())
-    if match is None:
-        raise RuntimeError("Cannot verify the uv installer version; MetaList was not stopped")
-    return tuple(int(part) for part in match.groups())
-
-
-def _windows_architecture() -> str:
-    machine = platform.machine().casefold()
-    aliases = {"amd64": "x86_64", "x86_64": "x86_64", "arm64": "aarch64",
-               "aarch64": "aarch64", "x86": "i686", "i386": "i686", "i686": "i686"}
-    if machine not in aliases:
-        raise RuntimeError(f"Unsupported Windows updater architecture: {machine}")
-    return aliases[machine]
-
-
-def _download_installer_archive(architecture: str) -> bytes:
-    assert architecture in WINDOWS_INSTALLERS
-    url = (f"https://github.com/astral-sh/uv/releases/download/{INSTALLER_VERSION}/"
-           f"uv-{architecture}-pc-windows-msvc.zip")
-    with urlopen(url, timeout=120) as response:
-        return response.read()
-
-
-def _managed_windows_installer(environ: Mapping[str, str]) -> str:
-    architecture = _windows_architecture()
-    archive_digest, binary_digest = WINDOWS_INSTALLERS[architecture]
-    local_directory = Path(environ["LOCALAPPDATA"])
-    if not local_directory.is_absolute():
-        raise RuntimeError("LOCALAPPDATA must be an absolute path for the update installer")
-    directory = local_directory / "MetaList" / "update-tools" / f"uv-{INSTALLER_VERSION}-{architecture}"
-    executable = directory / "uv.exe"
-    if executable.exists():
-        if hashlib.sha256(executable.read_bytes()).hexdigest() != binary_digest:
-            raise RuntimeError("Cached update installer failed checksum verification; MetaList was not stopped")
-        return str(executable)
-    print(f"Preparing verified Windows update installer uv {INSTALLER_VERSION}...", flush=True)
-    archive_body = _download_installer_archive(architecture)
-    if hashlib.sha256(archive_body).hexdigest() != archive_digest:
-        raise RuntimeError("Downloaded update installer failed checksum verification; MetaList was not stopped")
-    with zipfile.ZipFile(io.BytesIO(archive_body)) as archive:
-        binary = archive.read("uv.exe")
-    if hashlib.sha256(binary).hexdigest() != binary_digest:
-        raise RuntimeError("Update installer executable failed checksum verification; MetaList was not stopped")
-    directory.mkdir(parents=True, exist_ok=True)
-    # Publish only complete, verified bytes. This is an installer cache, never a backup.
-    with NamedTemporaryFile(dir=directory, prefix="uv-", suffix=".tmp", delete=False) as staged:
-        staged.write(binary)
-    os.replace(staged.name, executable)
-    return str(executable)
-
-
-def resolve_update_installer(*, uv_executable: str, platform_name: str,
-                             environ: Mapping[str, str]) -> str:
-    if platform_name != "win32":
-        return uv_executable
-    if _installer_version(uv_executable, environ) >= MINIMUM_WINDOWS_VERSION:
-        return uv_executable
-    executable = _managed_windows_installer(environ)
-    expected_version = tuple(int(part) for part in INSTALLER_VERSION.split("."))
-    if _installer_version(executable, environ) != expected_version:
-        raise RuntimeError("Verified update installer reported the wrong version; MetaList was not stopped")
-    return executable
-
-
-def repair_windows_update() -> None:
-    if sys.platform != "win32":
-        raise RuntimeError("This recovery launcher is for Windows installations")
-    uv_executable = shutil.which("uv")
-    metalist_executable = shutil.which("metalist")
-    if uv_executable is None or metalist_executable is None:
-        raise RuntimeError("The existing uv and MetaList commands must be available on PATH")
-    environ = dict(os.environ)
-    installer = resolve_update_installer(uv_executable=uv_executable, platform_name="win32", environ=environ)
-    # The already-installed updater discovers uv through PATH. Preserve that
-    # updater's preflight, shutdown, backup, offline install, and restart flow.
-    environ["PATH"] = str(Path(installer).parent) + os.pathsep + environ["PATH"]
-    subprocess.run([metalist_executable, "update"], env=environ, check=True)
-
-
-if __name__ == "__main__":
-    repair_windows_update()