void stop(job.id)}
xstyle={styles.stop}
>
diff --git a/src/routes/settings.tsx b/src/routes/settings.tsx
index bc56c4e..9b802a4 100644
--- a/src/routes/settings.tsx
+++ b/src/routes/settings.tsx
@@ -12,6 +12,7 @@ import { PasskeySetting } from "../components/passkey-setting";
import { PushNotifications } from "../components/push-notifications";
import { ThemeSetting } from "../components/theme-setting";
import { Button } from "../components/ui/button";
+import { UpdateSetting } from "../components/update-setting";
import { getCodexAccount, getCodexLogin } from "../features/auth/functions";
import { getPushSettings } from "../features/notifications/functions";
import {
@@ -164,6 +165,9 @@ function SettingsPage() {
Looking for an agent’s model, instructions, or automations? Open
that agent to manage its settings.
diff --git a/src/server.ts b/src/server.ts
index 652f711..0cefb5b 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -8,22 +8,42 @@ import { authPage } from "./server/auth/page.server";
import { nativeAuthEnabled } from "./server/auth/store.server";
import { compressHtml } from "./server/html-compression.server";
import { followStartupRedirect } from "./server/startup-response.server";
+import {
+ trackUpdateRequest,
+ updateGateRequest,
+} from "./server/update-gate.server";
+import { updatesRequest } from "./server/updates.server";
const handler = createStartHandler(defaultStreamHandler);
export default createServerEntry({
async fetch(request, options) {
- const auth = await authGate(request, authPage);
- if (auth) return auth;
- const response = await followStartupRedirect(
- request,
- await handler(request, options),
- (nextRequest) => handler(nextRequest, options),
+ const gate = await updateGateRequest(request, () =>
+ // A fixed, capability-authorized read-only shell probe. Settings' external
+ // connection loaders remain blocked by maintenance; no client JS executes.
+ handler(
+ new Request(new URL("/settings?group=updates", request.url), {
+ headers: request.headers,
+ }),
+ options,
+ ),
);
- if (nativeAuthEnabled()) {
- response.headers.set("Cache-Control", "private, no-store");
- response.headers.set("Referrer-Policy", "no-referrer");
- }
- return compressHtml(request, response);
+ if (gate) return gate;
+ return trackUpdateRequest(async () => {
+ const auth = await authGate(request, authPage);
+ if (auth) return auth;
+ if (new URL(request.url).pathname.startsWith("/api/updates"))
+ return updatesRequest(request);
+ const response = await followStartupRedirect(
+ request,
+ await handler(request, options),
+ (nextRequest) => handler(nextRequest, options),
+ );
+ if (nativeAuthEnabled()) {
+ response.headers.set("Cache-Control", "private, no-store");
+ response.headers.set("Referrer-Policy", "no-referrer");
+ }
+ return compressHtml(request, response);
+ });
},
});
diff --git a/src/server/auth/client.js b/src/server/auth/client.js
index 8cc48e5..b77ab0f 100644
--- a/src/server/auth/client.js
+++ b/src/server/auth/client.js
@@ -1,10 +1,13 @@
const content = document.querySelector("#content");
const status = document.querySelector("#status");
let setup = null;
+// A fixed destination for updater reauthentication, never a supplied URL/path.
+const returnToUpdates =
+ new URLSearchParams(location.search).get("updates") === "1";
function captureSetup() {
const value = new URLSearchParams(location.hash.slice(1)).get("setup");
if (value) setup = value;
- history.replaceState(null, "", "/auth");
+ history.replaceState(null, "", returnToUpdates ? "/auth?updates=1" : "/auth");
}
captureSetup();
window.addEventListener("hashchange", () => {
@@ -111,7 +114,15 @@ async function passkey(register, name, returnToSettings = false) {
name,
});
setup = null;
- location.assign((register && name) || returnToSettings ? "/auth" : "/");
+ location.assign(
+ register && name
+ ? "/auth"
+ : returnToUpdates
+ ? "/settings?group=updates"
+ : returnToSettings
+ ? "/auth"
+ : "/",
+ );
}
async function render() {
const response = await fetch("/auth/api/state", { cache: "no-store" });
@@ -152,7 +163,7 @@ async function render() {
return;
}
const back = element("a", "Back to Roost");
- back.href = "/settings";
+ back.href = returnToUpdates ? "/settings?group=updates" : "/settings";
content.append(
back,
element("h1", "Passkeys and sessions"),
diff --git a/src/server/auth/readiness.server.ts b/src/server/auth/readiness.server.ts
new file mode 100644
index 0000000..bf48edb
--- /dev/null
+++ b/src/server/auth/readiness.server.ts
@@ -0,0 +1,47 @@
+import type { DatabaseSync } from "node:sqlite";
+import { validateOrigin } from "./store.server";
+
+/** Read-only startup verification. SQLite integrity alone cannot detect malformed
+ * auth JSON or missing tables that would leave the owner unable to sign in. */
+export function verifyAuthReadiness(db: DatabaseSync) {
+ const config = JSON.parse(
+ String(db.prepare("SELECT value FROM config WHERE id=1").get()?.value),
+ );
+ validateOrigin(config.origin);
+ if (
+ typeof config.owner !== "string" ||
+ !/^[A-Za-z0-9_-]{43}$/.test(config.owner) ||
+ !Number.isSafeInteger(config.generation) ||
+ config.generation < 1 ||
+ !Number.isFinite(config.expires) ||
+ config.expires < 0 ||
+ (config.bootstrap !== null &&
+ (typeof config.bootstrap !== "string" ||
+ !/^[a-f0-9]{64}$/.test(config.bootstrap)))
+ )
+ throw new Error("Auth configuration failed readiness checks.");
+ const credentials = db.prepare("SELECT id,value FROM credentials").all();
+ if (
+ !credentials.length &&
+ (!config.bootstrap || config.expires <= Date.now())
+ )
+ throw new Error("Auth has no owner credential or enrollment path.");
+ for (const row of credentials) {
+ const credential = JSON.parse(String(row.value));
+ if (
+ credential.id !== row.id ||
+ typeof credential.id !== "string" ||
+ !credential.id ||
+ typeof credential.publicKey !== "string" ||
+ !/^[A-Za-z0-9_-]+$/.test(credential.publicKey) ||
+ !Number.isSafeInteger(credential.counter) ||
+ credential.counter < 0
+ )
+ throw new Error("Auth credential failed readiness checks.");
+ }
+ db.prepare(
+ "SELECT id,credential,created,expires FROM sessions LIMIT 0",
+ ).all();
+ db.prepare("SELECT id,value,expires FROM ceremonies LIMIT 0").all();
+ db.prepare("SELECT id,count,expires FROM limits LIMIT 0").all();
+}
diff --git a/src/server/codex/login.server.ts b/src/server/codex/login.server.ts
index 1673bee..4cd2717 100644
--- a/src/server/codex/login.server.ts
+++ b/src/server/codex/login.server.ts
@@ -171,3 +171,6 @@ export async function closeLogin() {
await state.starting;
await state.cancel?.();
}
+
+export const loginActive = () =>
+ Boolean(state.starting || state.value.status === "pending");
diff --git a/src/server/coding/worker.server.ts b/src/server/coding/worker.server.ts
index be62150..9f6d598 100644
--- a/src/server/coding/worker.server.ts
+++ b/src/server/coding/worker.server.ts
@@ -186,6 +186,7 @@ export async function tickCodingJobs(
status: "blocked",
error:
"This terminal now belongs to a different worker. No input was sent; inspect it in Herdr.",
+ lastWorkerState: "unknown",
});
if (worker.state === "missing")
return persist(job, {
diff --git a/src/server/computer/session.server.ts b/src/server/computer/session.server.ts
index 1e65c1c..189d047 100644
--- a/src/server/computer/session.server.ts
+++ b/src/server/computer/session.server.ts
@@ -147,3 +147,7 @@ export const endComputerAction = () => {
export const releaseComputer = (agentId: string) => {
if (state.agent === agentId) state.agent = undefined;
};
+
+export const computerActivity = () =>
+ Number(state.acting) +
+ [...state.viewers.values()].filter((viewer) => viewer.connected).length;
diff --git a/src/server/computer/socket.server.ts b/src/server/computer/socket.server.ts
index 3140824..e20256c 100644
--- a/src/server/computer/socket.server.ts
+++ b/src/server/computer/socket.server.ts
@@ -1,5 +1,6 @@
import { connect, type Socket } from "node:net";
import { defineWebSocketHandler } from "nitro";
+import { appGate } from "../../updater/gate";
import { authenticatedSocket, sessionActive } from "../auth/session.server";
import {
attachViewer,
@@ -13,6 +14,8 @@ const authTimers = new Map>();
export default defineWebSocketHandler({
upgrade(request) {
+ if (appGate().mode !== "open")
+ throw new Response("Update admission is closed", { status: 503 });
const session = authenticatedSocket(request);
const id = new URL(request.url).searchParams.get("ticket") ?? "";
if (!connectViewer(id, request.headers.get("origin"), session))
@@ -57,6 +60,11 @@ export default defineWebSocketHandler({
},
message(peer, message) {
+ if (["hold", "verify", "manual"].includes(appGate().mode)) {
+ sockets.get(peer.id)?.destroy();
+ peer.close(1013, "Roost is updating");
+ return;
+ }
if (
!sessionActive(
typeof peer.context.session === "string" ? peer.context.session : null,
diff --git a/src/server/runs/store.server.ts b/src/server/runs/store.server.ts
index a455841..abde7d4 100644
--- a/src/server/runs/store.server.ts
+++ b/src/server/runs/store.server.ts
@@ -330,7 +330,7 @@ export const claimSteeringRun = (run: Run) =>
(db) =>
db
.prepare(
- "UPDATE runs SET status='steering',owner=?,startedAt=?,threadId=(SELECT threadId FROM runs WHERE id=?) WHERE id=(SELECT q.id FROM runs q WHERE q.agentId=? AND q.kind='chat' AND q.status='queued' AND q.cancelRequested=0 AND EXISTS (SELECT 1 FROM runs r WHERE r.id=? AND r.owner=? AND r.status='running' AND r.kind IN ('chat','handoff') AND r.cancelRequested=0) AND EXISTS (SELECT 1 FROM worker_lease WHERE owner=? AND heartbeat>?) ORDER BY q.createdAt,q.rowid LIMIT 1) RETURNING *",
+ "UPDATE runs SET status='steering',owner=?,startedAt=?,threadId=(SELECT threadId FROM runs WHERE id=?) WHERE id=(SELECT q.id FROM runs q WHERE q.agentId=? AND q.kind='chat' AND q.status='queued' AND (SELECT maintenance FROM runtime_control WHERE id=1)=0 AND q.cancelRequested=0 AND EXISTS (SELECT 1 FROM runs r WHERE r.id=? AND r.owner=? AND r.status='running' AND r.kind IN ('chat','handoff') AND r.cancelRequested=0) AND EXISTS (SELECT 1 FROM worker_lease WHERE owner=? AND heartbeat>?) ORDER BY q.createdAt,q.rowid LIMIT 1) RETURNING *",
)
.get(
run.owner,
diff --git a/src/server/runs/worker.server.ts b/src/server/runs/worker.server.ts
index 0be6220..d16aa3c 100644
--- a/src/server/runs/worker.server.ts
+++ b/src/server/runs/worker.server.ts
@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
import { resolve } from "node:path";
import { Effect } from "effect";
import type { ChatEvent, Message } from "../../features/chat/schema";
+import { appGate } from "../../updater/gate";
import { AgentStoreError, withAgentStore } from "../agents/store.server";
import { CodexError } from "../codex/app-server.server";
import {
@@ -201,7 +202,12 @@ export function startWorker() {
}
const current = worker;
current.tick = async () => {
- if (current.ticking || current.stopped) return;
+ if (
+ current.ticking ||
+ current.stopped ||
+ ["hold", "verify", "manual"].includes(appGate().mode)
+ )
+ return;
current.ticking = true;
try {
const owns = await Effect.runPromise(schedulerTick(current.owner));
@@ -290,3 +296,11 @@ export function startWorker() {
workers.delete(root);
};
}
+
+export function workerActivity() {
+ const current = workers.get(resolve(process.env.ROOST_DATA_DIR ?? ".roost"));
+ return {
+ initialized: !!current,
+ tasks: current ? current.tasks.size + Number(current.ticking) : 0,
+ };
+}
diff --git a/src/server/update-gate.server.ts b/src/server/update-gate.server.ts
new file mode 100644
index 0000000..a910a1b
--- /dev/null
+++ b/src/server/update-gate.server.ts
@@ -0,0 +1,145 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { Effect } from "effect";
+import { appGate } from "../updater/gate";
+import { withAgentStore } from "./agents/store.server";
+import { verifyAuthReadiness } from "./auth/readiness.server";
+import { loginActive } from "./codex/login.server";
+import { computerActivity } from "./computer/session.server";
+import { workerActivity } from "./runs/worker.server";
+
+let requests = 0;
+export async function trackUpdateRequest(action: () => Promise) {
+ requests++;
+ try {
+ return await action();
+ } finally {
+ requests--;
+ }
+}
+export async function updateGateRequest(
+ request: Request,
+ renderShell?: () => Response | Promise,
+): Promise {
+ const gate = appGate();
+ const url = new URL(request.url);
+ const authorized =
+ request.headers.get("X-Roost-Updater") === (gate.token ?? gate.operation) &&
+ gate.mode !== "open";
+ if (url.pathname === "/api/updates/quiescence" && authorized) {
+ const activity = workerActivity();
+ return Response.json({
+ requests,
+ tasks: activity.tasks + computerActivity(),
+ login: loginActive(),
+ frozen: ["hold", "verify", "manual"].includes(gate.mode),
+ });
+ }
+ if (
+ url.pathname === "/api/updates/probe" &&
+ authorized &&
+ gate.mode === "verify"
+ ) {
+ const appSchema = await Effect.runPromise(
+ withAgentStore((db) => {
+ if (
+ db
+ .prepare("PRAGMA integrity_check")
+ .all()
+ .some((r) => r.integrity_check !== "ok")
+ )
+ throw new Error("App integrity failed.");
+ return Number(db.prepare("PRAGMA user_version").get()?.user_version);
+ }),
+ );
+ const auth = new DatabaseSync(
+ join(process.env.ROOST_DATA_DIR!, "auth.sqlite"),
+ { readOnly: true },
+ );
+ let authSchema = 0;
+ try {
+ authSchema = Number(
+ auth.prepare("PRAGMA user_version").get()?.user_version,
+ );
+ if (
+ auth
+ .prepare("PRAGMA integrity_check")
+ .all()
+ .some((r) => r.integrity_check !== "ok")
+ )
+ throw new Error("Auth integrity failed.");
+ verifyAuthReadiness(auth);
+ } finally {
+ auth.close();
+ }
+ const assets = process.env.ROOST_PUBLIC_DIR;
+ const names = assets ? await readdir(join(assets, "assets")) : [];
+ const script = names.find((name) => name.endsWith(".js"));
+ const style = names.find((name) => name.endsWith(".css"));
+ const healthyAssets = !!(
+ script &&
+ style &&
+ assets &&
+ (await readFile(join(assets, "assets", script))).length &&
+ (await readFile(join(assets, "assets", style))).length
+ );
+ let shell = false;
+ let referencedAssets = false;
+ if (renderShell) {
+ const response = await renderShell();
+ const { boundedBytes } = await import("../updater/releases");
+ const html = (await boundedBytes(response, 2 * 1024 * 1024)).toString();
+ const references = [
+ ...new Set(html.match(/\/assets\/[^"'<>\s)]+\.(?:js|css)/g) ?? []),
+ ];
+ referencedAssets =
+ !!assets &&
+ references.some((p) => p.endsWith(".js")) &&
+ references.some((p) => p.endsWith(".css"));
+ for (const path of references) {
+ const name = path.slice("/assets/".length);
+ if (!/^[A-Za-z0-9_.-]+\.(?:js|css)$/.test(name)) {
+ referencedAssets = false;
+ break;
+ }
+ const info = await stat(join(assets!, "assets", name)).catch(
+ () => null,
+ );
+ if (!info?.isFile() || info.size === 0) referencedAssets = false;
+ }
+ shell =
+ response.ok &&
+ response.headers.get("content-type")?.includes("text/html") === true &&
+ html.includes("Software updates") &&
+ html.includes("");
+ }
+ return Response.json({
+ shell,
+ operation: gate.operation,
+ token: gate.token,
+ version: process.env.ROOST_RELEASE_VERSION,
+ integrity: true,
+ appSchema,
+ authSchema,
+ assets: healthyAssets && referencedAssets,
+ workerReady: workerActivity().initialized,
+ });
+ }
+ if (["hold", "verify", "manual"].includes(gate.mode)) {
+ if (url.pathname === "/api/health")
+ return Response.json(
+ { status: "maintenance" },
+ { status: 503, headers: { "Cache-Control": "no-store" } },
+ );
+ return new Response(
+ "Roost is updating or recovering. Reconnect to check the durable result. Do not resubmit work.",
+ {
+ status: 503,
+ headers: { "Cache-Control": "no-store", "Retry-After": "2" },
+ },
+ );
+ }
+ return null;
+}
diff --git a/src/server/updates.server.ts b/src/server/updates.server.ts
new file mode 100644
index 0000000..d800fc4
--- /dev/null
+++ b/src/server/updates.server.ts
@@ -0,0 +1,259 @@
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { updaterRequest } from "../updater/client";
+import { capability } from "../updater/contract";
+import type { UpdateSummary } from "../updater/daemon";
+import { type Offer, ReleaseChecker } from "../updater/releases";
+import { authorizeMutation, csrfToken, updateBody } from "../updater/security";
+import { sessionId } from "./auth/session.server";
+import { digest, openAuth } from "./auth/store.server";
+
+const secret = randomBytes(32).toString("hex");
+let checker: ReleaseChecker | undefined;
+const json = (value: unknown, status = 200) =>
+ Response.json(value, {
+ status,
+ headers: {
+ "Cache-Control": "private, no-store",
+ "X-Content-Type-Options": "nosniff",
+ },
+ });
+async function installation() {
+ const root = process.env.ROOST_HOME;
+ if (
+ !root ||
+ !process.env.ROOST_RELEASE_VERSION ||
+ process.env.ROOST_DATA_DIR !== join(root, "data")
+ )
+ return { packaged: false, root: undefined, repository: undefined };
+ try {
+ const c = JSON.parse(await readFile(join(root, "config.json"), "utf8"));
+ if (c.root !== (await realpath(root)) || c.uid !== process.getuid?.())
+ throw new Error("Installation mismatch");
+ const os = await readFile("/etc/os-release", "utf8").catch(() => "");
+ const field = (name: string) =>
+ new RegExp(`^${name}="?([^"\\n]+)`, "m").exec(os)?.[1] ?? "unknown";
+ const mounts = (
+ await readFile("/proc/self/mountinfo", "utf8").catch(() => "")
+ )
+ .split("\n")
+ .map((line) => {
+ const [left, right] = line.split(" - ");
+ return {
+ path: (left?.split(" ")[4] ?? "").replace(
+ /\\([0-7]{3})/g,
+ (_, n: string) => String.fromCharCode(Number.parseInt(n, 8)),
+ ),
+ fs: right?.split(" ")[0],
+ };
+ })
+ .filter(
+ (mount) =>
+ mount.path &&
+ (root === mount.path ||
+ root.startsWith(mount.path === "/" ? "/" : `${mount.path}/`)),
+ )
+ .sort((a, b) => b.path.length - a.path.length);
+ return {
+ packaged: true,
+ distribution: `${field("ID")}:${field("VERSION_ID")}`,
+ filesystem: mounts[0]?.fs ?? "unknown",
+ root,
+ repository: c.repository as string | undefined,
+ };
+ } catch {
+ return { packaged: false, root: undefined, repository: undefined };
+ }
+}
+export async function updatesRequest(request: Request) {
+ const facts = await installation();
+ const detected = capability({
+ ...facts,
+ platform: process.platform,
+ arch: process.arch,
+ systemd: existsSync("/run/systemd/system"),
+ });
+ const auth = openAuth();
+ try {
+ const session = auth?.session(sessionId(request));
+ if (
+ auth &&
+ (!session ||
+ new URL(request.url).host !== new URL(auth.config().origin).host)
+ )
+ return json({ error: "Native sign-in required." }, 401);
+ const enrolled = !!(
+ facts.root && existsSync(join(facts.root, "updater.json"))
+ );
+ const url = new URL(request.url);
+ const match = /^\/api\/updates(?:\/([a-f0-9-]{36})(\/cancel)?)?$/.exec(
+ url.pathname,
+ );
+ if (!match && url.pathname !== "/api/updates/check")
+ return json({ error: "Not found." }, 404);
+ if (facts.repository && checker?.repository !== facts.repository)
+ checker = new ReleaseChecker(facts.repository);
+ if (request.method === "GET" && match) {
+ const key = url.searchParams.get("key");
+ if (
+ [...url.searchParams.keys()].some((name) => name !== "key") ||
+ (key !== null &&
+ (match[1] ||
+ url.searchParams.getAll("key").length !== 1 ||
+ !/^[a-zA-Z0-9_-]{16,100}$/.test(key)))
+ )
+ return json({ error: "Invalid status lookup." }, 400);
+ let helper:
+ | {
+ qualified: boolean;
+ latest: Offer | null;
+ operation: UpdateSummary | null;
+ }
+ | undefined;
+ let error: string | undefined;
+ if (enrolled && session)
+ try {
+ helper = await updaterRequest(facts.root!, {
+ action: "status",
+ ...(match[1] ? { id: match[1] } : key ? { key } : {}),
+ });
+ } catch {
+ error =
+ "Updater is unavailable. Existing operations may still be recovering; do not submit again.";
+ }
+ return json({
+ capability:
+ enrolled && detected.code === "setup-required"
+ ? {
+ code: !session
+ ? "native-auth-required"
+ : !helper
+ ? "updater-unavailable"
+ : helper.qualified
+ ? "supported"
+ : "qualification-required",
+ canActivate: !!helper?.qualified,
+ reason: !session
+ ? "Native passkey sign-in is required for UI updates."
+ : !helper
+ ? "The enrolled updater is unavailable. Inspect its service and durable status before retrying."
+ : helper.qualified
+ ? "Enrolled supervised updater is ready."
+ : "Updater is enrolled. Activation remains disabled until this helper build passes systemd and reboot qualification.",
+ }
+ : detected,
+ version: facts.packaged ? process.env.ROOST_RELEASE_VERSION : "dev",
+ latest: session ? (helper?.latest ?? checker?.cached ?? null) : null,
+ operation: helper?.operation ?? null,
+ enrolled,
+ error,
+ canCheck: !!(session && facts.repository),
+ csrf: session ? csrfToken(secret, session.id) : null,
+ recent: !!session && session.created >= Date.now() - 300000,
+ });
+ }
+ if (request.method !== "POST")
+ return json({ error: "Method not allowed." }, 405);
+ if (!auth || !session)
+ return json({ error: "Native passkey sign-in required." }, 401);
+ let body: Record;
+ try {
+ authorizeMutation(request, {
+ origin: auth.config().origin,
+ session,
+ secret,
+ });
+ body = await updateBody(
+ request,
+ url.pathname === "/api/updates" ? ["offerId", "version", "key"] : [],
+ );
+ // Reading a bounded streaming body may outlive revocation or recent auth.
+ authorizeMutation(request, {
+ origin: auth.config().origin,
+ session: auth.session(session.id),
+ secret,
+ });
+ } catch {
+ return json({ error: "Sign in again and retry from Settings." }, 403);
+ }
+ if (url.pathname === "/api/updates/check") {
+ if (!facts.repository || !checker)
+ return json(
+ { error: "No packaged release repository configured." },
+ 409,
+ );
+ if (!auth.limit("updates-check", 2))
+ return json({ error: "Wait a minute before checking again." }, 429);
+ try {
+ return json({
+ latest: enrolled
+ ? await updaterRequest(facts.root!, { action: "check" })
+ : await checker.check(),
+ });
+ } catch {
+ return json(
+ {
+ error:
+ "Release check failed. Check repository access and retry in a minute.",
+ },
+ 503,
+ );
+ }
+ }
+ if (!enrolled)
+ return json({ error: "Explicit terminal enrollment is required." }, 409);
+ if (match?.[2]) {
+ try {
+ return json({
+ operation: await updaterRequest(facts.root!, {
+ action: "cancel",
+ id: match[1],
+ }),
+ });
+ } catch {
+ return json(
+ {
+ error:
+ "Cancellation could not be confirmed. Read the operation status.",
+ },
+ 409,
+ );
+ }
+ }
+ if (!auth.limit("updates-start", 4))
+ return json({ error: "Too many update requests." }, 429);
+ if (
+ typeof body.offerId !== "string" ||
+ !/^([a-f0-9]{64})$/.test(body.offerId) ||
+ typeof body.version !== "string" ||
+ body.version.length > 32 ||
+ typeof body.key !== "string" ||
+ !/^[a-zA-Z0-9_-]{16,100}$/.test(body.key)
+ )
+ return json({ error: "Confirm the exact offered version." }, 400);
+ try {
+ return json(
+ {
+ operation: await updaterRequest(facts.root!, {
+ action: "accept",
+ ...body,
+ actor: digest(session.id),
+ }),
+ },
+ 202,
+ );
+ } catch {
+ return json(
+ {
+ error:
+ "Acceptance was not confirmed. Check durable status before any new confirmation.",
+ },
+ 409,
+ );
+ }
+ } finally {
+ auth?.close();
+ }
+}
diff --git a/src/server/worker-plugin.ts b/src/server/worker-plugin.ts
index ec8a852..a626049 100644
--- a/src/server/worker-plugin.ts
+++ b/src/server/worker-plugin.ts
@@ -1,9 +1,17 @@
import { definePlugin } from "nitro";
+import { appRoot, startupGuard } from "../updater/gate";
import { closeAgentRuntimes } from "./codex/agent-runtime.server";
import { closeLogin } from "./codex/login.server";
import { startWorker } from "./runs/worker.server";
export default definePlugin((app) => {
+ const root = appRoot();
+ if (root)
+ startupGuard(
+ root,
+ process.env.ROOST_RELEASE_VERSION ?? "dev",
+ process.env.ROOST_UPDATE_TOKEN,
+ );
const stop = startWorker();
app.hooks.hook("close", async () => {
await stop();
diff --git a/src/updater/artifact.ts b/src/updater/artifact.ts
new file mode 100644
index 0000000..222747e
--- /dev/null
+++ b/src/updater/artifact.ts
@@ -0,0 +1,191 @@
+import { createHash } from "node:crypto";
+import { lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { readRelease } from "../cli/releases";
+import { assertCompatible, compatibility } from "./contract";
+import { syncDirectory } from "./journal";
+import { execute } from "./process";
+import {
+ boundedBytes,
+ maxArchiveBytes,
+ type Offer,
+ parseOffer,
+} from "./releases";
+import { inspectData, requireHeadroom, syncTree } from "./snapshot";
+
+export function readSchemaVersions(root: string) {
+ const versions = [];
+ for (const name of ["roost.sqlite", "auth.sqlite"]) {
+ const db = new DatabaseSync(join(root, "data", name), { readOnly: true });
+ try {
+ // Staging runs while the serving app may still hold a write transaction.
+ db.exec("PRAGMA busy_timeout=5000");
+ versions.push(
+ Number(db.prepare("PRAGMA user_version").get()?.user_version),
+ );
+ } finally {
+ db.close();
+ }
+ }
+ return { app: versions[0]!, auth: versions[1]! };
+}
+
+export async function stageArtifact(
+ root: string,
+ offer: Offer,
+ id: string,
+ support: string,
+ signal: AbortSignal,
+ progress: (bytes: number) => void,
+ token?: string,
+ fetcher: typeof fetch = fetch,
+) {
+ const headers = {
+ Accept: "application/vnd.github+json",
+ ...(token ? { Authorization: `Bearer ${token}` } : {}),
+ };
+ const release = await fetcher(
+ `https://api.github.com/repos/${offer.repository}/releases/${offer.releaseId}`,
+ {
+ headers,
+ redirect: "error",
+ signal: AbortSignal.any([signal, AbortSignal.timeout(15000)]),
+ },
+ );
+ if (!release.ok) throw new Error("Pinned release unavailable.");
+ const current = parseOffer(
+ JSON.parse((await boundedBytes(release, 2 * 1024 * 1024)).toString()),
+ offer.repository,
+ offer.checkedAt,
+ );
+ for (const key of [
+ "releaseId",
+ "assetId",
+ "version",
+ "digest",
+ "size",
+ ] as const)
+ if (current[key] !== offer[key])
+ throw new Error("Approved artifact changed.");
+ const data = await inspectData(join(root, "data"));
+ await requireHeadroom(
+ root,
+ data.bytes,
+ data.entries.length,
+ offer.size + 2 * 1024 ** 3,
+ 100000,
+ );
+ const directory = join(root, "updates", id);
+ const archive = join(directory, "artifact.tar.gz");
+ const url = `https://api.github.com/repos/${offer.repository}/releases/assets/${offer.assetId}`;
+ let response = await fetcher(url, {
+ headers: { ...headers, Accept: "application/octet-stream" },
+ redirect: "manual",
+ signal: AbortSignal.any([signal, AbortSignal.timeout(300000)]),
+ });
+ if ([301, 302, 303, 307, 308].includes(response.status)) {
+ const target = new URL(response.headers.get("location") ?? "");
+ await response.body?.cancel();
+ if (
+ target.protocol !== "https:" ||
+ target.username ||
+ target.password ||
+ ![
+ "release-assets.githubusercontent.com",
+ "objects.githubusercontent.com",
+ ].includes(target.hostname)
+ )
+ throw new Error("Untrusted artifact redirect.");
+ response = await fetcher(target, {
+ redirect: "error",
+ signal: AbortSignal.any([signal, AbortSignal.timeout(300000)]),
+ });
+ }
+ if (!response.ok || !response.body)
+ throw new Error("Artifact download failed.");
+ const fd = await open(archive, "wx", 0o600);
+ const hash = createHash("sha256");
+ let size = 0;
+ try {
+ for await (const chunk of response.body) {
+ signal.throwIfAborted();
+ size += chunk.length;
+ if (size > offer.size || size > maxArchiveBytes)
+ throw new Error("Artifact size exceeded.");
+ hash.update(chunk);
+ await fd.writeFile(chunk);
+ progress(size);
+ }
+ if (size !== offer.size || `sha256:${hash.digest("hex")}` !== offer.digest)
+ throw new Error("Artifact digest/size mismatch.");
+ await fd.sync();
+ } finally {
+ await fd.close();
+ }
+ signal.throwIfAborted();
+ const unpacked = join(directory, "unpacked");
+ await execute(
+ "/usr/bin/python3",
+ [join(support, "extract.py"), archive, unpacked],
+ 300000,
+ );
+ signal.throwIfAborted();
+ const next = await readRelease(unpacked);
+ if (next.version !== offer.version) throw new Error("Manifest/tag mismatch.");
+ const c = compatibility(
+ JSON.parse(await readFile(join(unpacked, "compatibility.json"), "utf8")),
+ );
+ const old = await readRelease(join(root, "current"));
+ const versions = readSchemaVersions(root);
+ assertCompatible(c, {
+ ...versions,
+ codex: old.codex,
+ });
+ if (c.codex !== next.codex)
+ throw new Error("Bundled runtime does not match compatibility contract.");
+ // Rollback must also support the verification gate, not just the candidate.
+ const previousContract = JSON.parse(
+ await readFile(join(root, "current", "compatibility.json"), "utf8"),
+ );
+ assertCompatible(previousContract, {
+ ...versions,
+ codex: old.codex,
+ });
+ if (
+ previousContract.startupGate !== 1 ||
+ JSON.parse(await readFile(join(unpacked, "compatibility.json"), "utf8"))
+ .startupGate !== 1
+ )
+ throw new Error("Both releases require the startup verification gate.");
+ for (const file of ["runtime/node", "runtime/codex/bin/codex"]) {
+ if (!((await lstat(join(unpacked, file))).mode & 0o100))
+ throw new Error("Runtime is not executable.");
+ const output = await execute(join(unpacked, file), ["--version"], 15000);
+ if (
+ output !==
+ (file === "runtime/node" ? `v${next.node}` : `codex-cli ${next.codex}`)
+ )
+ throw new Error("Bundled runtime cannot execute.");
+ }
+ await mkdir(join(root, "releases"), { recursive: true, mode: 0o700 });
+ // A retry may reuse byte-identical verified staging; never replace a retained
+ // release merely because its version name matches a new publisher artifact.
+ try {
+ await lstat(join(root, "releases", offer.version));
+ if (
+ (await inspectData(unpacked)).digest !==
+ (await inspectData(join(root, "releases", offer.version))).digest
+ )
+ throw new Error("Existing candidate differs from the approved artifact.");
+ await rm(unpacked, { recursive: true, force: true });
+ await rm(archive, { force: true });
+ return;
+ } catch (error) {
+ if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+ }
+ await syncTree(unpacked);
+ await rename(unpacked, join(root, "releases", offer.version));
+ await syncDirectory(join(root, "releases"));
+ await rm(archive, { force: true });
+}
diff --git a/src/updater/client.ts b/src/updater/client.ts
new file mode 100644
index 0000000..f3450ce
--- /dev/null
+++ b/src/updater/client.ts
@@ -0,0 +1,54 @@
+import { connect } from "node:net";
+import { join } from "node:path";
+export async function updaterRequest(
+ root: string,
+ message: unknown,
+): Promise {
+ const input = `${JSON.stringify({ protocol: 1, ...(message as object) })}\n`;
+ if (Buffer.byteLength(input) > 8192)
+ throw new Error("Update request too large.");
+ // Service shutdown may take 90 seconds; repair also copies data and probes
+ // startup. Keep ordinary HTTP-facing requests short, with fixed CLI budgets.
+ const action = (message as { action?: string })?.action;
+ const timeout =
+ action === "repair"
+ ? 610000
+ : action === "start" || action === "stop"
+ ? 130000
+ : 20000;
+ return new Promise((resolve, reject) => {
+ const socket = connect(join(root, "updates", "helper.sock"));
+ let output = "";
+ socket.setTimeout(timeout, () =>
+ socket.destroy(
+ new Error(
+ "Updater did not respond. Check durable status; do not repeat activation.",
+ ),
+ ),
+ );
+ socket.once("connect", () => socket.write(input));
+ socket.on("data", (chunk) => {
+ output += chunk;
+ if (output.length > 65536)
+ socket.destroy(new Error("Updater response too large."));
+ });
+ socket.once("error", reject);
+ socket.once("end", () => {
+ if (!output.trim()) {
+ reject(
+ new Error(
+ "Updater connection ended without a result. Check durable status before repeating an operation.",
+ ),
+ );
+ return;
+ }
+ try {
+ const result = JSON.parse(output);
+ if (result.error) reject(new Error(result.error));
+ else resolve(result.value);
+ } catch {
+ reject(new Error("Invalid updater response."));
+ }
+ });
+ });
+}
diff --git a/src/updater/contract.ts b/src/updater/contract.ts
new file mode 100644
index 0000000..db8dcf1
--- /dev/null
+++ b/src/updater/contract.ts
@@ -0,0 +1,127 @@
+/** This protocol is independent of the application release/bundle schema. */
+export const updaterProtocol = 1;
+export const stableVersion =
+ /^(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})(?![\s\S])/;
+
+export function compareVersions(a: string, b: string) {
+ if (!stableVersion.test(a) || !stableVersion.test(b))
+ throw new Error("Invalid stable version.");
+ const left = a.split(".").map(Number);
+ const right = b.split(".").map(Number);
+ for (let i = 0; i < 3; i++) {
+ if (left[i] !== right[i]) return left[i]! > right[i]! ? 1 : -1;
+ }
+ return 0;
+}
+
+export type Compatibility = {
+ protocol: 1;
+ app: { min: number; max: number; output: number };
+ auth: { min: number; max: number; output: number };
+ data: "complete-snapshot-v1";
+ externalState: "unchanged";
+ codex: string;
+};
+
+export function compatibility(value: unknown): Compatibility {
+ const c = value as Compatibility;
+ const range = (r: Compatibility["app"]) =>
+ r &&
+ [r.min, r.max, r.output].every(
+ (n) => Number.isSafeInteger(n) && n >= 0 && n <= 10000,
+ ) &&
+ r.min <= r.max &&
+ r.output >= r.max;
+ if (
+ !c ||
+ c.protocol !== updaterProtocol ||
+ !range(c.app) ||
+ !range(c.auth) ||
+ c.data !== "complete-snapshot-v1" ||
+ c.externalState !== "unchanged" ||
+ !stableVersion.test(c.codex)
+ )
+ throw new Error("Release has no supported update compatibility contract.");
+ return c;
+}
+
+export function assertCompatible(
+ value: unknown,
+ installed: { app: number; auth: number; codex: string },
+) {
+ const c = compatibility(value);
+ if (
+ installed.app < c.app.min ||
+ installed.app > c.app.max ||
+ installed.auth < c.auth.min ||
+ installed.auth > c.auth.max ||
+ installed.codex !== c.codex
+ )
+ throw new Error(
+ "Database or bundled Codex compatibility requires terminal maintenance.",
+ );
+ return c;
+}
+
+export type Capability = {
+ code:
+ | "externally-managed"
+ | "unsupported-platform"
+ | "unsupported-service-manager"
+ | "unsupported-distribution"
+ | "unsupported-storage"
+ | "setup-required"
+ | "qualification-required";
+ reason: string;
+ canActivate: false;
+};
+
+export function capability(facts: {
+ packaged: boolean;
+ platform: string;
+ arch: string;
+ systemd: boolean;
+ distribution?: string;
+ filesystem?: string;
+}): Capability {
+ if (!facts.packaged)
+ return {
+ code: "externally-managed",
+ reason:
+ "This source or orchestrated installation is externally managed. Update it through its deployment workflow.",
+ canActivate: false,
+ };
+ if (facts.platform !== "linux" || facts.arch !== "x64")
+ return {
+ code: "unsupported-platform",
+ reason: "UI updates initially require a packaged Linux x64 installation.",
+ canActivate: false,
+ };
+ if (!facts.systemd)
+ return {
+ code: "unsupported-service-manager",
+ reason:
+ "This installation does not have the required systemd supervisor.",
+ canActivate: false,
+ };
+ if (facts.distribution && facts.distribution !== "ubuntu:24.04")
+ return {
+ code: "unsupported-distribution",
+ reason:
+ "Initial UI update qualification is limited to Ubuntu 24.04. Use operator-managed updates on this distribution.",
+ canActivate: false,
+ };
+ if (facts.filesystem && facts.filesystem !== "ext4")
+ return {
+ code: "unsupported-storage",
+ reason:
+ "Initial UI updates require persistent local ext4 installation storage. This storage layout requires operator-managed updates.",
+ canActivate: false,
+ };
+ return {
+ code: "setup-required",
+ reason:
+ "Explicit operator enrollment is required. Run roost updates enroll from the packaged terminal CLI; activation also requires a qualified helper build.",
+ canActivate: false,
+ };
+}
diff --git a/src/updater/daemon.ts b/src/updater/daemon.ts
new file mode 100644
index 0000000..b8f23cc
--- /dev/null
+++ b/src/updater/daemon.ts
@@ -0,0 +1,242 @@
+import { spawn } from "node:child_process";
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { type Operation, terminal, UpdateEngine } from "./engine";
+import { readEnrollment, validateInstallation } from "./enrollment";
+import { openGate, readGate, writeGate } from "./gate";
+import { durableJson } from "./journal";
+import { withKernelLock } from "./lock";
+import { execute } from "./process";
+import { type Offer, ReleaseChecker } from "./releases";
+import { systemdAdapter } from "./systemd";
+
+export function summary(record: Operation | null) {
+ return record
+ ? {
+ id: record.id,
+ requestKey: record.request.key,
+ phase: record.phase,
+ previous: record.previous,
+ version: record.candidate,
+ updatedAt: record.updatedAt,
+ cancellable: ["accepted", "staged", "draining"].includes(record.phase),
+ error: record.error,
+ blockers: record.blockers,
+ bytes: record.bytes,
+ committed: record.committed,
+ }
+ : null;
+}
+export type UpdateSummary = NonNullable>;
+export async function serveUpdater(root: string, support: string) {
+ const mainPid = await execute(
+ "/usr/bin/systemctl",
+ [
+ "show",
+ `roost-${process.getuid?.()}-updater.service`,
+ "--property=MainPID",
+ "--value",
+ ],
+ 10000,
+ );
+ if (mainPid !== String(process.pid))
+ throw new Error("Run the updater through its enrolled systemd supervisor.");
+ // A second manual/service invocation must not close another helper's gate or
+ // replace its live socket. This lifetime lock is separate from transaction ownership.
+ return withKernelLock(root, () => supervise(root, support), "supervisor");
+}
+async function supervise(root: string, support: string) {
+ const enrollment = await readEnrollment(root);
+ await validateInstallation(enrollment.installation, true);
+ const tokenPath = join(root, "updates", "github-token");
+ let token: string | undefined;
+ try {
+ const info = await lstat(tokenPath);
+ if (
+ !info.isFile() ||
+ info.isSymbolicLink() ||
+ info.uid !== process.getuid?.() ||
+ info.mode & 0o077 ||
+ info.size > 1024
+ )
+ throw new Error("Updater credential must be an owner-only regular file.");
+ token = (await readFile(tokenPath, "utf8")).trim();
+ } catch (e) {
+ if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+ }
+ const adapter = systemdAdapter(enrollment.installation, support, token);
+ const engine = new UpdateEngine(root, adapter);
+ const priorGate = readGate(root);
+ await writeGate(root, {
+ ...openGate,
+ mode: "hold",
+ operation: priorGate.operation ?? "boot",
+ });
+ await durableJson(join(root, "updates", "ready.json"), {
+ boot: (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim(),
+ });
+ try {
+ if (priorGate.mode === "manual" && !priorGate.operation)
+ throw new Error("Missing or corrupt gate evidence.");
+ await engine.recover();
+ } catch {
+ await writeGate(root, { ...openGate, mode: "manual", operation: "boot" });
+ }
+ const checker = new ReleaseChecker(
+ enrollment.installation.repository!,
+ fetch,
+ token,
+ );
+ let offer: Offer | undefined;
+ try {
+ offer = JSON.parse(
+ await readFile(join(root, "updates", "offer.json"), "utf8"),
+ );
+ } catch {
+ /* A missing offer is never permission to activate. */
+ }
+ const handle = async (message: Record) => {
+ if (message.protocol !== 1 || typeof message.action !== "string")
+ throw new Error("Unsupported updater protocol.");
+ const fields: Record = {
+ status: ["id", "key", "actor"],
+ check: [],
+ accept: ["offerId", "version", "actor", "key"],
+ cancel: ["id"],
+ start: [],
+ stop: [],
+ repair: ["id", "decision", "version"],
+ };
+ if (
+ !fields[message.action] ||
+ Object.keys(message).some(
+ (key) =>
+ ![
+ "protocol",
+ "action",
+ ...fields[message.action as string]!,
+ ].includes(key),
+ )
+ )
+ throw new Error("Unexpected updater request fields.");
+ if (message.action === "status") {
+ // Authenticated owner reads may reconcile a key after native reauth.
+ // This grants no mutation authority; accept still checks the original actor.
+ const record = message.key
+ ? ((await engine.records()).find(
+ (r) =>
+ r.request.key === message.key &&
+ (message.actor === undefined ||
+ r.request.actor === message.actor),
+ ) ?? null)
+ : await engine.status(
+ typeof message.id === "string" ? message.id : undefined,
+ );
+ return {
+ protocol: 1,
+ qualified: true,
+ latest: offer ?? null,
+ operation: summary(record),
+ };
+ }
+ if (message.action === "check") {
+ offer = await checker.check();
+ await durableJson(join(root, "updates", "offer.json"), offer);
+ return offer;
+ }
+ if (message.action === "accept") {
+ const existing = (await engine.records()).find(
+ (r) => r.request.key === message.key,
+ );
+ if (existing) {
+ if (
+ existing.request.actor !== message.actor ||
+ existing.request.offer.id !== message.offerId ||
+ existing.candidate !== message.version
+ )
+ throw new Error("Idempotency conflict.");
+ return summary(existing);
+ }
+ if (
+ !offer ||
+ offer.id !== message.offerId ||
+ typeof message.actor !== "string" ||
+ typeof message.key !== "string" ||
+ typeof message.version !== "string"
+ )
+ throw new Error("Check releases and confirm the offered version.");
+ return summary(
+ await engine.accept({
+ actor: message.actor,
+ key: message.key,
+ offer,
+ confirmedVersion: message.version,
+ }),
+ );
+ }
+ if (message.action === "repair") {
+ if (
+ typeof message.id !== "string" ||
+ typeof message.version !== "string" ||
+ !["restore", "resume"].includes(String(message.decision))
+ )
+ throw new Error("Invalid repair confirmation.");
+ return summary(
+ await engine.repair(
+ message.id,
+ message.decision as "restore" | "resume",
+ message.version,
+ ),
+ );
+ }
+ if (message.action === "cancel") {
+ if (typeof message.id !== "string")
+ throw new Error("Missing operation ID.");
+ return summary(await engine.cancel(message.id));
+ }
+ return withKernelLock(root, async () => {
+ const latest = await engine.status();
+ if (
+ latest &&
+ (!terminal(latest.phase) || latest.phase === "manual-recovery")
+ )
+ throw new Error("Resolve the active update first.");
+ if (message.action === "start") await adapter.start();
+ else await adapter.stop();
+ return { ok: true };
+ });
+ };
+ const child = spawn(
+ "/usr/bin/python3",
+ [join(support, "peer-broker.py"), join(root, "updates", "helper.sock")],
+ { stdio: ["pipe", "pipe", "inherit"] },
+ );
+ const lines = createInterface({ input: child.stdout });
+ for await (const line of lines) {
+ if (line.length > 16384) {
+ child.kill();
+ throw new Error("Invalid socket bridge frame.");
+ }
+ const envelope = JSON.parse(line) as {
+ ready?: boolean;
+ id: string;
+ message: Record;
+ };
+ if (envelope.ready) continue;
+ // Requests may observe/cancel an operation while its long transaction runs.
+ void handle(envelope.message)
+ .then(
+ (value) => ({ value }),
+ () => ({
+ error:
+ "Updater request refused. Check enrollment, confirmation and durable status.",
+ }),
+ )
+ .then((result) => {
+ if (child.stdin.writable)
+ child.stdin.write(`${JSON.stringify({ id: envelope.id, result })}\n`);
+ });
+ }
+ throw new Error("Updater socket bridge stopped.");
+}
diff --git a/src/updater/engine.ts b/src/updater/engine.ts
new file mode 100644
index 0000000..bac2b65
--- /dev/null
+++ b/src/updater/engine.ts
@@ -0,0 +1,622 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import {
+ cp,
+ mkdir,
+ readdir,
+ readFile,
+ realpath,
+ rename,
+ rm,
+ symlink,
+} from "node:fs/promises";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { compareVersions } from "./contract";
+import { openGate, readGate, writeGate } from "./gate";
+import {
+ durableJson,
+ type Journal,
+ type Phase,
+ readJournal,
+ syncDirectory,
+ writeJournal,
+} from "./journal";
+import { withKernelLock } from "./lock";
+import { assertOffer, type Offer } from "./releases";
+import {
+ createSnapshot,
+ syncTree,
+ verifyData,
+ verifySnapshot,
+} from "./snapshot";
+
+export class SimulatedPowerLoss extends Error {}
+
+export type Accepted = {
+ actor: string;
+ key: string;
+ offer: Offer;
+ confirmedVersion: string;
+};
+export type Operation = Journal & {
+ request: Accepted;
+ cancelRequested: boolean;
+ committed: boolean;
+ error?: string;
+ blockers?: string[];
+ bytes?: number;
+ deadline?: number;
+};
+export const terminal = (phase: Phase) =>
+ [
+ "succeeded",
+ "rolled-back",
+ "failed",
+ "deferred",
+ "cancelled",
+ "manual-recovery",
+ ].includes(phase);
+export type EngineAdapter = {
+ running(): Promise;
+ stage(
+ offer: Offer,
+ id: string,
+ signal: AbortSignal,
+ progress: (bytes: number) => void,
+ ): Promise;
+ preflight(candidate: string): Promise;
+ admission(blocked: boolean): Promise;
+ blockers(frozen: boolean): Promise;
+ stop(): Promise; // Must return only after verifying the service group empty.
+ start(): Promise;
+ probe(version: string, id: string, token: string): Promise;
+};
+const digest = (value: unknown) =>
+ createHash("sha256").update(JSON.stringify(value)).digest("hex");
+/** One daemon owns the lock for the entire transaction. All crash recovery uses
+ * durable intent records; filesystem observations can never invent a commit. */
+export class UpdateEngine {
+ private busy = false;
+ private cancellationOpen = false;
+ private cancelled = false;
+ private cancellationWrite?: Promise;
+ private abort?: AbortController;
+ private work?: Promise;
+ private current?: Operation;
+ constructor(
+ readonly root: string,
+ readonly adapter: EngineAdapter,
+ readonly drainMs = 300000,
+ private readonly boundary: (
+ phase: string,
+ ) => Promise = async () => {},
+ ) {}
+ async records() {
+ await mkdir(join(this.root, "updates"), { recursive: true, mode: 0o700 });
+ const records: Operation[] = [];
+ for (const name of await readdir(join(this.root, "updates"))) {
+ if (!/^[a-f0-9-]{36}$/.test(name)) continue;
+ const value = (await readJournal(this.root, name)) as Operation;
+ if (
+ !value.request ||
+ typeof value.request !== "object" ||
+ typeof value.committed !== "boolean" ||
+ !/^[a-f0-9]{64}$/.test(value.request.actor) ||
+ !/^[a-zA-Z0-9_-]{16,100}$/.test(value.request.key) ||
+ value.request.confirmedVersion !== value.candidate ||
+ value.request.offer?.version !== value.candidate ||
+ ((value.phase === "committed" || value.phase === "succeeded") &&
+ !value.committed)
+ )
+ throw new Error("Incomplete operation evidence.");
+ records.push(value);
+ }
+ return records.sort((a, b) => b.updatedAt - a.updatedAt);
+ }
+ async status(id?: string) {
+ if (this.busy && this.current && (!id || id === this.current.id))
+ return this.current;
+ return (await this.records()).find((r) => !id || r.id === id) ?? null;
+ }
+ async checkpoint(phase: Phase, patch: Partial = {}) {
+ const record = {
+ ...this.current!,
+ ...patch,
+ phase,
+ sequence: this.current!.sequence + 1,
+ updatedAt: Date.now(),
+ };
+ await this.boundary(`before-journal-${phase}`);
+ await writeJournal(this.root, record);
+ this.current = record;
+ await this.boundary(phase);
+ }
+ async accept(request: Accepted): Promise {
+ request = { ...request, offer: { ...request.offer, notes: "" } };
+ if (
+ !/^[a-f0-9]{64}$/.test(request.actor) ||
+ !/^[a-zA-Z0-9_-]{16,100}$/.test(request.key) ||
+ request.confirmedVersion !== request.offer.version
+ )
+ throw new Error("Invalid update confirmation.");
+ const existing = (await this.records()).find(
+ (r) => r.request.key === request.key,
+ );
+ if (existing) {
+ if (digest(existing.request) !== digest(request))
+ throw new Error("Idempotency key conflicts with its accepted request.");
+ return existing;
+ }
+ if (this.busy) throw new Error("Another update is active.");
+ if (readGate(this.root).mode !== "open")
+ throw new Error("Recovery gate is not open.");
+ this.busy = true;
+ let accept!: (value: Operation) => void;
+ let reject!: (error: unknown) => void;
+ const accepted = new Promise((a, b) => {
+ accept = a;
+ reject = b;
+ });
+ this.work = withKernelLock(this.root, async () => {
+ if (
+ (await this.records()).some(
+ (r) => !terminal(r.phase) || r.phase === "manual-recovery",
+ )
+ )
+ throw new Error("Unresolved update requires recovery.");
+ const previous = (await realpath(join(this.root, "current")))
+ .split("/")
+ .at(-1)!;
+ assertOffer(request.offer, request.offer.id, previous);
+ if (compareVersions(request.confirmedVersion, previous) <= 0)
+ throw new Error("Version is not newer.");
+ const id = randomUUID();
+ this.cancellationOpen = true;
+ this.cancelled = false;
+ this.cancellationWrite = undefined;
+ this.current = {
+ protocol: 1,
+ id,
+ sequence: 1,
+ phase: "accepted",
+ previous,
+ candidate: request.confirmedVersion,
+ wasRunning: await this.adapter.running(),
+ updatedAt: Date.now(),
+ request,
+ cancelRequested: false,
+ committed: false,
+ };
+ await this.boundary("before-journal-accepted");
+ try {
+ await writeJournal(this.root, this.current);
+ } catch (error) {
+ await this.recordFailure(error);
+ // A rename may have succeeded before fsync failed. Never acknowledge or
+ // leave that operation looking like a running download: no work began.
+ try {
+ this.current = (await readJournal(this.root, id)) as Operation;
+ await this.checkpoint("failed", {
+ error: "Acceptance durability failed; no update was started.",
+ });
+ } catch {
+ // Keep partial evidence for the operator. If storage cannot persist
+ // even this gate, propagate the I/O failure; do not activate anything.
+ await this.gate("manual");
+ }
+ throw error;
+ }
+ accept(this.current);
+ await this.boundary("accepted");
+ await this.run();
+ })
+ .catch(reject)
+ .finally(() => {
+ this.busy = false;
+ this.abort = undefined;
+ });
+ return accepted;
+ }
+ async settled() {
+ await this.work;
+ }
+ async cancel(id: string) {
+ if (this.current?.id !== id || terminal(this.current.phase)) {
+ const record = await this.status(id);
+ if (!record) throw new Error("Unknown update operation.");
+ return record;
+ }
+ if (this.cancellationWrite) {
+ await this.cancellationWrite;
+ return this.status(id);
+ }
+ if (
+ !this.cancellationOpen ||
+ !["accepted", "staged", "draining"].includes(this.current.phase)
+ )
+ throw new Error("Update can no longer be cancelled.");
+ // Cancellation is serialized into the next engine checkpoint; a lost cancel
+ // response is never evidence of cancellation. The signal only cancels staging.
+ this.cancellationWrite = durableJson(
+ join(this.root, "updates", id, "cancel.json"),
+ { id, cancelled: true },
+ ).then(() => {
+ if (this.current?.id === id) {
+ this.cancelled = true;
+ this.current.cancelRequested = true;
+ this.abort?.abort();
+ }
+ });
+ await this.cancellationWrite;
+ return this.current;
+ }
+ private async switchRelease(version: string) {
+ const rollback = version === this.current!.previous;
+ const temporary = join(this.root, `.update-current-${this.current!.id}`);
+ await rm(temporary, { force: true });
+ await symlink(join(this.root, "releases", version), temporary);
+ await rename(temporary, join(this.root, "current"));
+ await this.boundary(
+ rollback
+ ? "rollback-pointer-renamed-before-sync"
+ : "pointer-renamed-before-sync",
+ );
+ await syncDirectory(this.root);
+ await this.boundary(
+ rollback ? "rollback-pointer-renamed" : "pointer-renamed",
+ );
+ }
+ private async gate(
+ mode: "drain" | "hold" | "verify" | "manual",
+ version?: string,
+ ) {
+ const token =
+ mode === "verify" ? randomBytes(32).toString("hex") : undefined;
+ await writeGate(this.root, {
+ protocol: 1,
+ operation: this.current!.id,
+ mode,
+ version,
+ token,
+ });
+ return token!;
+ }
+ private async open() {
+ await this.adapter.admission(false);
+ await writeGate(this.root, openGate);
+ await this.boundary("admission-open");
+ }
+ private async verify(version: string) {
+ await this.adapter.admission(true);
+ const token = await this.gate("verify", version);
+ await this.adapter.start();
+ await this.boundary(
+ version === this.current!.previous
+ ? "rollback-service-started"
+ : "service-started",
+ );
+ await this.adapter.probe(version, this.current!.id, token);
+ }
+ private async run() {
+ this.abort = new AbortController();
+ try {
+ await this.adapter.stage(
+ this.current!.request.offer,
+ this.current!.id,
+ this.abort.signal,
+ (bytes) => {
+ if (this.current) this.current.bytes = bytes;
+ },
+ );
+ await this.adapter.preflight(this.current!.candidate);
+ await this.checkpoint("staged");
+ if (this.cancelled || this.current!.cancelRequested) {
+ await this.checkpoint("cancelled");
+ return;
+ }
+ await this.adapter.admission(true);
+ await this.gate("drain");
+ const deadline = Date.now() + this.drainMs;
+ await this.checkpoint("draining", { deadline });
+ while (true) {
+ const blockers = await this.adapter.blockers(false);
+ if (
+ this.cancelled ||
+ this.current!.cancelRequested ||
+ Date.now() > deadline
+ ) {
+ await this.checkpoint(
+ this.cancelled || this.current!.cancelRequested
+ ? "cancelled"
+ : "deferred",
+ { blockers },
+ );
+ await this.open();
+ return;
+ }
+ if (!blockers.length) break;
+ this.current!.blockers = blockers;
+ await delay(250);
+ }
+ this.cancellationOpen = false;
+ await this.cancellationWrite?.catch(() => {});
+ if (this.cancelled || this.current!.cancelRequested) {
+ await this.checkpoint("cancelled");
+ await this.open();
+ return;
+ }
+ await this.gate("hold");
+ // Freeze background writers, then wait for their already-started tasks and
+ // in-flight requests. Never terminate work to satisfy the update deadline.
+ while ((await this.adapter.blockers(true)).length) {
+ if (Date.now() > deadline) {
+ await this.checkpoint("deferred");
+ await this.open();
+ return;
+ }
+ await delay(100);
+ }
+ await this.checkpoint("stopping", { blockers: [] });
+ await this.adapter.stop();
+ await this.boundary("service-stopped");
+ const stoppedBlockers = await this.adapter.blockers(true);
+ if (stoppedBlockers.length) {
+ // Shutdown can outlive a previously fresh external-worker observation.
+ // Recheck after the service group is empty, before copying any data.
+ if (this.current!.wasRunning) await this.verify(this.current!.previous);
+ await this.checkpoint("deferred", {
+ blockers: stoppedBlockers,
+ error:
+ "Work could not be verified after shutdown; the previous release was preserved.",
+ });
+ await this.open();
+ return;
+ }
+ const snapshotDigest = await createSnapshot(this.root, this.current!.id);
+ await durableJson(
+ join(this.root, "updates", this.current!.id, "config.json"),
+ JSON.parse(await readFile(join(this.root, "config.json"), "utf8")),
+ );
+ await this.checkpoint("snapshot-complete", { snapshotDigest });
+ await this.checkpoint("activating");
+ await this.switchRelease(this.current!.candidate);
+ await this.checkpoint("verifying");
+ await this.verify(this.current!.candidate);
+ await this.checkpoint("committed", { committed: true });
+ if (!this.current!.wasRunning) await this.adapter.stop();
+ await this.open();
+ await this.checkpoint("succeeded");
+ } catch (error) {
+ if (error instanceof SimulatedPowerLoss) throw error;
+ await this.recordFailure(error);
+ // Re-read: fsync/ack failure may follow a durable commit. Never roll back
+ // because a caller lost the successful commit response.
+ this.current = (await readJournal(
+ this.root,
+ this.current!.id,
+ )) as Operation;
+ this.current.cancelRequested ||= existsSync(
+ join(this.root, "updates", this.current.id, "cancel.json"),
+ );
+ if (this.current.committed) {
+ await this.manual();
+ return;
+ }
+ if (
+ [
+ "accepted",
+ "staged",
+ "draining",
+ "cancelled",
+ "deferred",
+ "failed",
+ ].includes(this.current.phase)
+ ) {
+ await this.checkpoint(
+ this.current.cancelRequested ? "cancelled" : "failed",
+ { error: "Update preparation failed; serving release preserved." },
+ );
+ await this.open();
+ return;
+ }
+ await this.recoverCurrent();
+ }
+ }
+ private async recordFailure(error: unknown) {
+ if (!this.current) return;
+ try {
+ await durableJson(
+ join(this.root, "updates", this.current.id, "diagnostic.json"),
+ {
+ phase: this.current.phase,
+ recordedAt: Date.now(),
+ message: (error instanceof Error
+ ? error.message
+ : String(error)
+ ).slice(0, 4096),
+ },
+ );
+ } catch {
+ // A storage fault can prevent diagnostics too. Existing journal/snapshot
+ // evidence remains authoritative; logging must never interrupt recovery.
+ }
+ }
+ private async manual() {
+ await this.gate("manual");
+ await this.checkpoint("manual-recovery", {
+ error:
+ "Automatic recovery could not be verified. Use roost updates status and retain all operation files.",
+ });
+ }
+ private async restore() {
+ const j = this.current!;
+ await verifySnapshot(this.root, j.id, j.snapshotDigest!);
+ const directory = join(this.root, "updates", j.id);
+ const restore = join(directory, "restore");
+ const failed = join(directory, "failed-data");
+ // The original snapshot is immutable. A partial restore directory may be
+ // discarded, but candidate data and the sole snapshot are never discarded.
+ if (!existsSync(failed)) {
+ await rm(restore, { recursive: true, force: true });
+ await cp(join(directory, "snapshot"), restore, {
+ recursive: true,
+ preserveTimestamps: true,
+ dereference: false,
+ });
+ await verifyData(restore, j.snapshotDigest!);
+ await syncTree(restore);
+ await rename(join(this.root, "data"), failed);
+ await this.boundary("failed-data-renamed-before-sync");
+ await syncDirectory(this.root);
+ await syncDirectory(directory);
+ await this.boundary("failed-data-renamed");
+ }
+ if (!existsSync(join(this.root, "data"))) {
+ if (!existsSync(restore)) {
+ await cp(join(directory, "snapshot"), restore, {
+ recursive: true,
+ preserveTimestamps: true,
+ dereference: false,
+ });
+ await syncTree(restore);
+ }
+ await verifyData(restore, j.snapshotDigest!);
+ await rename(restore, join(this.root, "data"));
+ await this.boundary("restored-data-renamed-before-sync");
+ await syncDirectory(this.root);
+ await syncDirectory(directory);
+ await this.boundary("restored-data-renamed");
+ } else await verifyData(join(this.root, "data"), j.snapshotDigest!);
+ await this.switchRelease(j.previous);
+ }
+ private async recoverCurrent() {
+ try {
+ const j = this.current!;
+ const actual = await realpath(join(this.root, "current"));
+ if (
+ ![j.previous, j.candidate].some(
+ (v) => actual === join(this.root, "releases", v),
+ )
+ )
+ throw new Error("Unexpected release pointer.");
+ if (j.committed) {
+ if (actual !== join(this.root, "releases", j.candidate))
+ throw new Error("Committed pointer changed.");
+ await this.verify(j.candidate);
+ if (!j.wasRunning) await this.adapter.stop();
+ await this.open();
+ await this.checkpoint("succeeded", { error: undefined, blockers: [] });
+ return;
+ }
+ await this.gate("hold");
+ await this.adapter.stop();
+ if (j.snapshotDigest) {
+ await this.checkpoint("restoring");
+ await this.restore();
+ } else if (actual !== join(this.root, "releases", j.previous))
+ throw new Error("Activation without snapshot.");
+ await this.verify(j.previous);
+ if (!j.wasRunning) await this.adapter.stop();
+ if (j.snapshotDigest)
+ await this.checkpoint("rolled-back", {
+ error:
+ "Candidate did not pass startup checks. Previous release and data restored.",
+ });
+ else await this.checkpoint("cancelled");
+ await this.open();
+ } catch (error) {
+ if (error instanceof SimulatedPowerLoss) throw error;
+ await this.recordFailure(error);
+ await this.manual();
+ }
+ }
+ async repair(id: string, decision: "restore" | "resume", version: string) {
+ if (this.busy) throw new Error("Updater is busy.");
+ return withKernelLock(this.root, async () => {
+ const record = (await this.records()).find((r) => r.id === id);
+ if (record?.phase !== "manual-recovery")
+ throw new Error("Select a manual-recovery operation.");
+ if (
+ record.committed
+ ? decision !== "resume" || version !== record.candidate
+ : decision !== "restore" || version !== record.previous
+ )
+ throw new Error(
+ "Repair decision does not match the durable commit/version.",
+ );
+ this.current = record;
+ await this.recoverCurrent();
+ return this.current;
+ });
+ }
+ async recover() {
+ if (this.busy) throw new Error("Updater is busy.");
+ return withKernelLock(this.root, async () => {
+ const records = await this.records();
+ const gate = readGate(this.root);
+ if (
+ gate.operation &&
+ /^[a-f0-9-]{36}$/.test(gate.operation) &&
+ !records.some((r) => r.id === gate.operation)
+ )
+ throw new Error("Gate refers to a missing operation journal.");
+ const unresolved = records.filter(
+ (r) => !terminal(r.phase) || r.phase === "manual-recovery",
+ );
+ if (unresolved.length > 1)
+ throw new Error(
+ "Multiple unresolved updates; manual recovery required.",
+ );
+ this.current = unresolved[0] ?? records[0];
+ if (!this.current) {
+ await writeGate(this.root, openGate);
+ return;
+ }
+ if (this.current.phase === "manual-recovery") {
+ await this.gate("manual");
+ return;
+ }
+ if (terminal(this.current.phase)) {
+ const expected = this.current.committed
+ ? this.current.candidate
+ : this.current.previous;
+ if (
+ (await realpath(join(this.root, "current"))) !==
+ join(this.root, "releases", expected)
+ ) {
+ await this.manual();
+ return;
+ }
+ await this.open();
+ return;
+ }
+ if (
+ [
+ "accepted",
+ "staged",
+ "draining",
+ "cancelled",
+ "deferred",
+ "failed",
+ ].includes(this.current.phase)
+ ) {
+ if (
+ (await realpath(join(this.root, "current"))) !==
+ join(this.root, "releases", this.current.previous)
+ ) {
+ await this.manual();
+ return;
+ }
+ if (this.current.wasRunning && !(await this.adapter.running()))
+ await this.verify(this.current.previous);
+ await this.checkpoint("failed", {
+ error: "Preparation interrupted; update was not retried.",
+ });
+ await this.open();
+ return;
+ }
+ await this.recoverCurrent();
+ });
+ }
+}
diff --git a/src/updater/enrollment.ts b/src/updater/enrollment.ts
new file mode 100644
index 0000000..ec46325
--- /dev/null
+++ b/src/updater/enrollment.ts
@@ -0,0 +1,235 @@
+import { existsSync } from "node:fs";
+import { lstat, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { type Installation, serviceName, serviceUnit } from "../cli/service";
+import { compatibility } from "./contract";
+import { durableJson, syncDirectory } from "./journal";
+import { withKernelLock } from "./lock";
+import { execute } from "./process";
+import { validateRepository } from "./releases";
+
+export const legacyFence =
+ "Roost supervised updater enrolled: permanent legacy CLI fence. DO NOT DELETE.\n";
+export type Enrollment = {
+ protocol: 1;
+ installation: Installation;
+ helperVersion: string;
+ platform: "ubuntu-24.04-x64";
+};
+export async function validateInstallation(
+ c: Installation,
+ recovering = false,
+) {
+ validateRepository(c.repository ?? "");
+ const user = userInfo();
+ if (Buffer.byteLength(join(c.root, "updates/helper.sock")) > 100)
+ throw new Error(
+ "Installation path is too long for the private updater socket.",
+ );
+ if (
+ process.platform !== "linux" ||
+ process.arch !== "x64" ||
+ user.uid === 0 ||
+ c.uid !== user.uid ||
+ c.user !== user.username ||
+ !/^[a-z_][a-z0-9_-]*$/.test(c.user) ||
+ !/^\/[A-Za-z0-9_./-]{1,160}$/.test(c.root) ||
+ !/^\/[A-Za-z0-9_./-]{1,160}$/.test(c.home) ||
+ c.root !== (await realpath(c.root)) ||
+ !Number.isInteger(c.port) ||
+ c.port < 1024 ||
+ c.port > 65535
+ )
+ throw new Error("Unsupported installation identity.");
+ for (const path of [
+ c.root,
+ ...(recovering ? [] : [join(c.root, "data")]),
+ join(c.root, "config.json"),
+ join(c.root, "releases"),
+ ]) {
+ const stat = await lstat(path);
+ if (stat.isSymbolicLink() || stat.uid !== c.uid || stat.mode & 0o022)
+ throw new Error(
+ "Installation paths must be privately controlled by the installation user.",
+ );
+ }
+ if ((await lstat(c.root)).mode & 0o077)
+ throw new Error(
+ "Enrollment requires an owner-only installation root (mode 0700), protecting every retained release and snapshot from other users.",
+ );
+ const os = await readFile("/etc/os-release", "utf8");
+ if (
+ !/^ID=ubuntu$/m.test(os) ||
+ !/^VERSION_ID="24.04"$/m.test(os) ||
+ !existsSync("/run/systemd/system")
+ )
+ throw new Error(
+ "Initial enrollment requires Ubuntu 24.04 x64 and systemd.",
+ );
+ const fs = await execute("/usr/bin/findmnt", [
+ "-n",
+ "-o",
+ "FSTYPE",
+ "-T",
+ c.root,
+ ]);
+ if (fs !== "ext4")
+ throw new Error(
+ "Initial enrollment requires persistent local ext4 storage.",
+ );
+ // Recovery must start even between data renames or with an unreadable candidate
+ // contract. The durable transaction verifies the retained pair before opening
+ // admission. Enrollment and every new activation still require the full layout.
+ if (!recovering) {
+ const release = await realpath(join(c.root, "current"));
+ if (
+ !release.startsWith(`${join(c.root, "releases")}/`) ||
+ release.split("/").at(-1)?.includes("..")
+ )
+ throw new Error("Invalid current release.");
+ compatibility(
+ JSON.parse(await readFile(join(release, "compatibility.json"), "utf8")),
+ );
+ }
+ await execute(
+ "/usr/bin/python3",
+ ["-c", "import socket; assert hasattr(socket, 'SO_PEERCRED')"],
+ 5000,
+ );
+}
+/** The initial contract excludes custom hooks and additional service writers. */
+export async function validateService(c: Installation) {
+ const unit = serviceName(c);
+ const path = `/etc/systemd/system/${unit}`;
+ const info = await lstat(path);
+ if (
+ !info.isFile() ||
+ info.isSymbolicLink() ||
+ info.uid !== 0 ||
+ info.mode & 0o022 ||
+ (await readFile(path, "utf8")) !== serviceUnit(c)
+ )
+ throw new Error(
+ "Custom or unprotected application service requires operator maintenance.",
+ );
+ const dropins = await execute("/usr/bin/systemctl", [
+ "show",
+ unit,
+ "--property=DropInPaths",
+ "--value",
+ ]);
+ const allowed = `/etc/systemd/system/${unit}.d/updater.conf`;
+ if (dropins && dropins !== allowed)
+ throw new Error(
+ "Additional application service overrides are unsupported.",
+ );
+ if (dropins) {
+ const override = await lstat(allowed);
+ if (
+ !override.isFile() ||
+ override.isSymbolicLink() ||
+ override.uid !== 0 ||
+ override.mode & 0o022 ||
+ (await readFile(allowed, "utf8")) !== enrollmentFiles(c, "0.0.0").dropin
+ )
+ throw new Error("Application startup gate differs from enrollment.");
+ }
+}
+export function enrollmentFiles(c: Installation, version: string) {
+ const unit = serviceName(c),
+ helper = `roost-${c.uid}-updater.service`;
+ const pinned = join(c.root, "releases", version);
+ return {
+ helper,
+ unit: `[Unit]\nDescription=Roost supervised updater (${c.user})\nAfter=network-online.target\nWants=network-online.target\nBefore=${unit}\n\n[Service]\nType=exec\nUser=${c.user}\nEnvironment=HOME=${c.home}\nEnvironment=ROOST_HOME=${c.root}\nExecStart=${pinned}/runtime/node ${pinned}/cli/roost.mjs updates serve\nRestart=on-failure\nRestartSec=3\nKillMode=control-group\nTimeoutStopSec=15\nUMask=0077\n\n[Install]\nWantedBy=multi-user.target\n`,
+ dropin: `[Unit]\nRequires=${helper}\nAfter=${helper}\n`,
+ policy: `# Only these two exact commands; no wildcard, restart, unit editing or shell.\n${c.user} ALL=(root) NOPASSWD: /usr/bin/systemctl start ${unit}, /usr/bin/systemctl stop ${unit}\n`,
+ };
+}
+export async function readEnrollment(root: string): Promise {
+ const value = JSON.parse(
+ await readFile(join(root, "updater.json"), "utf8"),
+ ) as Enrollment;
+ if (
+ value.protocol !== 1 ||
+ value.installation.root !== root ||
+ value.installation.uid !== process.getuid?.()
+ )
+ throw new Error("Updater enrollment mismatch.");
+ return value;
+}
+export async function enroll(c: Installation, version: string) {
+ await validateInstallation(c);
+ await validateService(c);
+ if (
+ existsSync(join(c.root, "updater.json")) &&
+ (await readEnrollment(c.root)).helperVersion !== version
+ )
+ throw new Error(
+ "Pinned helper upgrades require explicit operator maintenance; do not replace a running helper through enrollment.",
+ );
+ const files = enrollmentFiles(c, version);
+ await withKernelLock(c.root, async () => {
+ const lock = join(c.root, "operation.lock");
+ if (existsSync(lock)) {
+ if ((await readFile(lock, "utf8")) !== legacyFence)
+ throw new Error(
+ "Legacy CLI lock is present. Inspect that operation before enrollment.",
+ );
+ } else {
+ await writeFile(lock, legacyFence, { flag: "wx", mode: 0o600 });
+ await syncDirectory(c.root);
+ }
+ const directory = join(c.root, "updates");
+ await mkdir(directory, { recursive: true, mode: 0o700 });
+ const enrollment: Enrollment = {
+ protocol: 1,
+ installation: c,
+ helperVersion: version,
+ platform: "ubuntu-24.04-x64",
+ };
+ // Intent/fence survive partial setup. Repeating this explicit terminal command
+ // safely reinstalls the same fixed policy; HTTP has no enrollment operation.
+ await durableJson(join(c.root, "updater.json"), enrollment);
+ if (!existsSync(join(directory, "gate.json")))
+ await durableJson(join(directory, "gate.json"), {
+ protocol: 1,
+ operation: null,
+ mode: "open",
+ });
+ for (const [name, value] of Object.entries({
+ "helper.unit": files.unit,
+ "app.conf": files.dropin,
+ sudoers: files.policy,
+ }))
+ await writeFile(join(directory, name), value, { mode: 0o600 });
+ await execute("/usr/sbin/visudo", ["-cf", join(directory, "sudoers")]);
+ // Interactive authorization is confined to the terminal enrollment command.
+ const { command } = await import("../cli/service");
+ await command("sudo", ["-v"]);
+ const dropin = `/etc/systemd/system/${serviceName(c)}.d`;
+ await command("sudo", ["install", "-d", "-m", "755", dropin]);
+ for (const [source, target, mode] of [
+ ["helper.unit", `/etc/systemd/system/${files.helper}`, "644"],
+ ["app.conf", `${dropin}/updater.conf`, "644"],
+ ["sudoers", `/etc/sudoers.d/roost-${c.uid}-updater`, "440"],
+ ])
+ await command("sudo", [
+ "install",
+ "-o",
+ "root",
+ "-g",
+ "root",
+ "-m",
+ mode!,
+ join(directory, source!),
+ target!,
+ ]);
+ await command("sudo", ["systemctl", "daemon-reload"]);
+ await command("sudo", ["systemctl", "enable", files.helper]);
+ });
+ // Helper recovery takes the same lock; do not wait for its start while holding it.
+ const { command } = await import("../cli/service");
+ await command("sudo", ["systemctl", "start", files.helper]);
+}
diff --git a/src/updater/extract.py b/src/updater/extract.py
new file mode 100644
index 0000000..91a94f5
--- /dev/null
+++ b/src/updater/extract.py
@@ -0,0 +1,68 @@
+"""Bounded regular-file/directory-only GNU/ustar extractor. No tar subprocess."""
+import gzip, os, pathlib, sys
+archive, destination = sys.argv[1:]
+root = pathlib.Path(destination)
+root.mkdir(mode=0o700) # fresh owned staging only
+expanded = 0
+seen = set()
+long_name = None
+
+def number(value):
+ text = value.rstrip(b'\0 ').lstrip(b' ')
+ if not text: return 0
+ if any(c not in b'01234567' for c in text): raise ValueError('Invalid tar number')
+ return int(text, 8)
+
+with gzip.open(archive, 'rb') as stream:
+ def read(size):
+ global expanded
+ expanded += size
+ if expanded > 2 * 1024**3: raise ValueError('Expanded archive limit')
+ value = stream.read(size)
+ if len(value) != size: raise ValueError('Truncated archive')
+ return value
+ for count in range(100001):
+ if count == 100000: raise ValueError('Archive entry limit')
+ header = read(512)
+ if header == bytes(512):
+ if read(512) != bytes(512): raise ValueError('Invalid archive end')
+ # Consume bounded padding, rejecting concatenated hidden content.
+ while True:
+ chunk = stream.read(65536)
+ if not chunk: break
+ expanded += len(chunk)
+ if expanded > 2 * 1024**3 or any(chunk): raise ValueError('Trailing archive content')
+ break
+ if sum(header[:148]) + 8 * 32 + sum(header[156:]) != number(header[148:156]): raise ValueError('Tar checksum')
+ size = number(header[124:136])
+ kind = header[156:157]
+ if kind == b'L':
+ if long_name is not None or size > 4096: raise ValueError('Long-name limit')
+ long_name = read(size).rstrip(b'\0').decode('utf-8', 'strict')
+ if size % 512: read(512-size%512)
+ continue
+ if kind not in (b'0', b'\0', b'5'): raise ValueError('Links/extensions/special files forbidden')
+ name = long_name or header[:100].split(b'\0')[0].decode('utf-8','strict')
+ if not long_name and header[257:263] == b'ustar\0':
+ prefix = header[345:500].split(b'\0')[0].decode('utf-8','strict')
+ if prefix: name = prefix + '/' + name
+ long_name = None
+ if len(name)>4096 or '\\' in name or '\0' in name or name.startswith('/') or '..' in name.split('/'): raise ValueError('Unsafe path')
+ name = str(pathlib.PurePosixPath(name))
+ if name in seen: raise ValueError('Duplicate path')
+ seen.add(name)
+ target = root / name
+ if kind == b'5':
+ if size: raise ValueError('Directory payload')
+ target.mkdir(mode=0o700, parents=True, exist_ok=True)
+ else:
+ if name == '.': raise ValueError('Invalid file')
+ target.parent.mkdir(mode=0o700,parents=True,exist_ok=True)
+ with target.open('xb') as output:
+ remaining = size
+ while remaining:
+ chunk=read(min(65536,remaining)); output.write(chunk); remaining-=len(chunk)
+ output.flush(); os.fsync(output.fileno())
+ os.chmod(target, 0o700 if number(header[100:108]) & 0o111 else 0o600)
+ if size % 512: read(512-size%512)
+ else: raise ValueError('Missing archive end')
diff --git a/src/updater/gate.ts b/src/updater/gate.ts
new file mode 100644
index 0000000..2fd97ce
--- /dev/null
+++ b/src/updater/gate.ts
@@ -0,0 +1,69 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { durableJson } from "./journal";
+
+export type Gate = {
+ protocol: 1;
+ operation: string | null;
+ mode: "open" | "drain" | "hold" | "verify" | "manual";
+ version?: string;
+ token?: string;
+};
+export const openGate: Gate = { protocol: 1, operation: null, mode: "open" };
+export function readGate(root: string): Gate {
+ const file = join(root, "updates", "gate.json");
+ try {
+ const gate = JSON.parse(readFileSync(file, "utf8")) as Gate;
+ if (
+ gate.protocol !== 1 ||
+ !["open", "drain", "hold", "verify", "manual"].includes(gate.mode) ||
+ (gate.mode !== "open" && typeof gate.operation !== "string")
+ )
+ throw new Error("Invalid update gate.");
+ return gate;
+ } catch (error) {
+ if (
+ !existsSync(join(root, "updater.json")) &&
+ (error as NodeJS.ErrnoException).code === "ENOENT"
+ )
+ return openGate;
+ return { protocol: 1, operation: null, mode: "manual" };
+ }
+}
+export const writeGate = (root: string, gate: Gate) =>
+ durableJson(join(root, "updates", "gate.json"), gate);
+export function appRoot() {
+ const root = process.env.ROOST_HOME;
+ return root && process.env.ROOST_DATA_DIR === join(resolve(root), "data")
+ ? resolve(root)
+ : undefined;
+}
+export function appGate() {
+ const root = appRoot();
+ return root ? readGate(root) : openGate;
+}
+export function startupGuard(
+ root: string,
+ version: string,
+ token: string | undefined,
+) {
+ if (!existsSync(join(root, "updater.json"))) return;
+ const gate = readGate(root);
+ const boot = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+ const ready = JSON.parse(
+ readFileSync(join(root, "updates", "ready.json"), "utf8"),
+ ) as { boot: string };
+ if (
+ ready.boot !== boot ||
+ (gate.mode !== "open" &&
+ !(
+ gate.mode === "verify" &&
+ gate.version === version &&
+ token &&
+ token === gate.token
+ ))
+ )
+ throw new Error(
+ "Updater recovery gate is closed. Run roost updates status; do not remove update records.",
+ );
+}
diff --git a/src/updater/journal.ts b/src/updater/journal.ts
new file mode 100644
index 0000000..7becdd3
--- /dev/null
+++ b/src/updater/journal.ts
@@ -0,0 +1,169 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { mkdir, open, rename, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+export const phases = [
+ "accepted",
+ "staged",
+ "draining",
+ "stopping",
+ "snapshot-complete",
+ "activating",
+ "verifying",
+ "committed",
+ "restoring",
+ "rolled-back",
+ "succeeded",
+ "cancelled",
+ "deferred",
+ "failed",
+ "manual-recovery",
+] as const;
+export type Phase = (typeof phases)[number];
+export type Journal = {
+ protocol: 1;
+ id: string;
+ sequence: number;
+ phase: Phase;
+ previous: string;
+ candidate: string;
+ wasRunning: boolean;
+ snapshotDigest?: string;
+ updatedAt: number;
+};
+export const operationId =
+ /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}(?![\s\S])/;
+const version =
+ /^(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})(?![\s\S])/;
+
+export async function syncDirectory(path: string) {
+ const fd = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
+ try {
+ await fd.sync();
+ } finally {
+ await fd.close();
+ }
+}
+
+export async function durableJson(path: string, value: unknown) {
+ const temporary = `${path}.${randomUUID()}.tmp`;
+ const fd = await open(temporary, "wx", 0o600);
+ try {
+ await fd.writeFile(`${JSON.stringify(value)}\n`);
+ await fd.sync();
+ } finally {
+ await fd.close();
+ }
+ try {
+ await rename(temporary, path);
+ await syncDirectory(dirname(path));
+ } finally {
+ await rm(temporary, { force: true });
+ }
+}
+
+export function validateJournal(value: unknown): Journal {
+ const j = value as Journal;
+ if (
+ j?.protocol !== 1 ||
+ !operationId.test(j.id) ||
+ !Number.isSafeInteger(j.sequence) ||
+ j.sequence < 1 ||
+ !phases.includes(j.phase) ||
+ !version.test(j.previous) ||
+ !version.test(j.candidate) ||
+ j.previous === j.candidate ||
+ typeof j.wasRunning !== "boolean" ||
+ !Number.isSafeInteger(j.updatedAt) ||
+ (j.snapshotDigest !== undefined && !/^[a-f0-9]{64}$/.test(j.snapshotDigest))
+ )
+ throw new Error("Invalid update journal; manual recovery required.");
+ if (
+ [
+ "snapshot-complete",
+ "activating",
+ "verifying",
+ "committed",
+ "restoring",
+ "rolled-back",
+ "succeeded",
+ ].includes(j.phase) &&
+ !j.snapshotDigest
+ )
+ throw new Error("Update journal has no complete snapshot evidence.");
+ return j;
+}
+
+export async function readJournal(root: string, id: string) {
+ if (!operationId.test(id)) throw new Error("Invalid operation ID.");
+ const fd = await open(
+ join(root, "updates", id, "journal.json"),
+ constants.O_RDONLY | constants.O_NOFOLLOW,
+ );
+ try {
+ const stat = await fd.stat();
+ if (!stat.isFile() || stat.size > 16384 || (stat.mode & 0o077) !== 0)
+ throw new Error("Unsafe update journal; manual recovery required.");
+ const journal = validateJournal(JSON.parse(await fd.readFile("utf8")));
+ if (journal.id !== id) throw new Error("Update journal identity mismatch.");
+ return journal;
+ } finally {
+ await fd.close();
+ }
+}
+
+export async function writeJournal(root: string, journal: Journal) {
+ validateJournal(journal);
+ const directory = join(root, "updates", journal.id);
+ await mkdir(dirname(directory), { recursive: true, mode: 0o700 });
+ await syncDirectory(root);
+ try {
+ await mkdir(directory, { mode: 0o700 });
+ if (journal.sequence !== 1)
+ throw new Error("Initial journal sequence must be one.");
+ } catch (error) {
+ if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+ const previous = await readJournal(root, journal.id);
+ if (
+ journal.sequence !== previous.sequence + 1 ||
+ journal.previous !== previous.previous ||
+ journal.candidate !== previous.candidate ||
+ journal.wasRunning !== previous.wasRunning ||
+ (previous.snapshotDigest &&
+ journal.snapshotDigest !== previous.snapshotDigest) ||
+ (["committed", "succeeded"].includes(previous.phase) &&
+ !["committed", "succeeded", "manual-recovery"].includes(journal.phase))
+ )
+ throw new Error("Conflicting update journal transition.");
+ }
+ await syncDirectory(dirname(directory));
+ await durableJson(join(directory, "journal.json"), journal);
+}
+
+/** A recovery plan is deliberately conservative and never infers commit from a
+ * symlink or from an app answering health requests. Execute under kernel lock. */
+export function recoveryPlan(journal: Journal) {
+ validateJournal(journal);
+ switch (journal.phase) {
+ case "accepted":
+ case "staged":
+ case "draining":
+ return "preserve-old";
+ case "stopping":
+ return "probe-old-behind-gate";
+ case "snapshot-complete":
+ case "activating":
+ case "verifying":
+ case "restoring":
+ return "restore-matching-pair";
+ case "committed":
+ return "finish-commit-never-restore";
+ case "rolled-back":
+ return "finish-rollback";
+ case "manual-recovery":
+ return "manual-recovery";
+ default:
+ return "terminal";
+ }
+}
diff --git a/src/updater/lock.ts b/src/updater/lock.ts
new file mode 100644
index 0000000..cbfb084
--- /dev/null
+++ b/src/updater/lock.ts
@@ -0,0 +1,68 @@
+import { spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { mkdir, open, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { durableJson } from "./journal";
+
+/** flock locks the inherited open file description; the parent's fd owns it
+ * after flock exits. Closing that fd (including process death) releases it.
+ * Never unlink this file: doing so would create two independent lock domains. */
+export async function withKernelLock(
+ root: string,
+ action: () => Promise,
+ scope: "installation" | "supervisor" = "installation",
+) {
+ await mkdir(root, { recursive: true, mode: 0o700 });
+ const fd = await open(
+ join(
+ root,
+ scope === "installation" ? "updater.lock" : "updater-supervisor.lock",
+ ),
+ constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW,
+ 0o600,
+ );
+ try {
+ const info = await fd.stat();
+ if (
+ !info.isFile() ||
+ info.nlink !== 1 ||
+ info.uid !== process.getuid?.() ||
+ (info.mode & 0o077) !== 0
+ )
+ throw new Error("Unsafe installation lock.");
+ await new Promise((resolve, reject) => {
+ const child = spawn("flock", ["--exclusive", "--nonblock", "3"], {
+ stdio: ["ignore", "ignore", "ignore", fd.fd],
+ });
+ child.once("error", reject);
+ child.once("exit", (code) =>
+ code === 0
+ ? resolve()
+ : reject(
+ new Error("Another Roost installation operation is active."),
+ ),
+ );
+ });
+ const stat = await readFile(`/proc/${process.pid}/stat`, "utf8");
+ await durableJson(
+ join(
+ root,
+ scope === "installation"
+ ? "updater-owner.json"
+ : "updater-supervisor-owner.json",
+ ),
+ {
+ pid: process.pid,
+ boot: (
+ await readFile("/proc/sys/kernel/random/boot_id", "utf8")
+ ).trim(),
+ startTicks: stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19],
+ acquiredAt: Date.now(),
+ },
+ );
+ // Advisory diagnostics may remain after exit; only the kernel lock grants ownership.
+ return await action();
+ } finally {
+ await fd.close();
+ }
+}
diff --git a/src/updater/peer-broker.py b/src/updater/peer-broker.py
new file mode 100644
index 0000000..b0b6169
--- /dev/null
+++ b/src/updater/peer-broker.py
@@ -0,0 +1,61 @@
+"""Private Unix socket transport with Linux SO_PEERCRED; no command execution.
+Node owns policy/state. This bridge only multiplexes bounded JSON envelopes.
+"""
+import json, os, queue, socket, struct, sys, threading, uuid
+path=sys.argv[1]
+pending={}
+lock=threading.Lock()
+slots=threading.BoundedSemaphore(32)
+server=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM)
+# systemd owns this process group; on a daemon restart no old broker remains.
+try: os.unlink(path)
+except FileNotFoundError: pass
+server.bind(path); os.chmod(path,0o600);server.listen(16)
+
+def reply_reader():
+ for line in sys.stdin:
+ try:
+ message=json.loads(line)
+ with lock: target=pending.get(message['id'])
+ if target: target.put_nowait(message['result'])
+ except (ValueError,KeyError,queue.Full): pass
+ os._exit(0)
+threading.Thread(target=reply_reader,daemon=True).start()
+
+def client(connection):
+ request_id=None
+ try:
+ connection.settimeout(20)
+ _,uid,_=struct.unpack('3i',connection.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+ if uid != os.getuid(): return
+ data=b''
+ while b'\n' not in data:
+ chunk=connection.recv(4096)
+ if not chunk: return
+ data+=chunk
+ if len(data)>8192: return
+ if data.count(b'\n')!=1 or data.split(b'\n',1)[1]: return
+ message=json.loads(data)
+ if not isinstance(message,dict): return
+ # Fixed CLI-only service/repair budgets; clients cannot supply a timeout.
+ action=message.get('action')
+ wait=600 if action=='repair' else 120 if action in ('start','stop') else 18
+ request_id=str(uuid.uuid4()); result=queue.Queue(1)
+ with lock:
+ pending[request_id]=result
+ print(json.dumps({'id':request_id,'message':message}),flush=True)
+ try: response=result.get(timeout=wait)
+ except queue.Empty:
+ response={'error':'Updater response deadline exceeded. Check durable status before repeating an operation.'}
+ answer=json.dumps(response).encode()+b'\n'
+ if len(answer)>65536: return
+ connection.sendall(answer)
+ except (ValueError,OSError,queue.Empty): pass
+ finally:
+ with lock: pending.pop(request_id,None)
+ connection.close(); slots.release()
+print(json.dumps({'ready':True}),flush=True)
+while True:
+ connection,_=server.accept()
+ if not slots.acquire(False): connection.close();continue
+ threading.Thread(target=client,args=(connection,),daemon=True).start()
diff --git a/src/updater/process.ts b/src/updater/process.ts
new file mode 100644
index 0000000..9ba916e
--- /dev/null
+++ b/src/updater/process.ts
@@ -0,0 +1,42 @@
+import { spawn } from "node:child_process";
+/** Fixed program/arguments supplied only by trusted adapters, never HTTP fields. */
+export function execute(
+ program: string,
+ args: string[],
+ timeout = 120000,
+ input?: string,
+): Promise {
+ return new Promise((resolve, reject) => {
+ const child = spawn(program, args, {
+ stdio: ["pipe", "pipe", "pipe"],
+ env: { ...process.env, LC_ALL: "C" },
+ });
+ let output = "";
+ let exceeded = false;
+ const timer = setTimeout(() => {
+ exceeded = true;
+ child.kill("SIGKILL");
+ }, timeout);
+ child.stdout.on("data", (chunk) => {
+ output += chunk;
+ if (output.length > 1024 * 1024) {
+ exceeded = true;
+ child.kill("SIGKILL");
+ }
+ });
+ // Never echo stderr: private download/service configuration may appear there.
+ child.stderr.resume();
+ child.stdin.on("error", () => {});
+ child.stdin.end(input);
+ child.once("error", (e) => {
+ clearTimeout(timer);
+ reject(e);
+ });
+ child.once("exit", (code) => {
+ clearTimeout(timer);
+ code === 0 && !exceeded
+ ? resolve(output.trim())
+ : reject(new Error("Updater command failed or exceeded its deadline."));
+ });
+ });
+}
diff --git a/src/updater/releases.ts b/src/updater/releases.ts
new file mode 100644
index 0000000..6e2a4ac
--- /dev/null
+++ b/src/updater/releases.ts
@@ -0,0 +1,217 @@
+import { createHash } from "node:crypto";
+import { compareVersions, stableVersion } from "./contract";
+
+export type Offer = {
+ id: string;
+ repository: string;
+ releaseId: number;
+ assetId: number;
+ version: string;
+ digest: string;
+ size: number;
+ notes: string;
+ checkedAt: number;
+ expiresAt: number;
+};
+const repositoryPattern =
+ /^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9_.-]{1,100}(?![\s\S])/;
+export const maxArchiveBytes = 512 * 1024 * 1024;
+
+export function validateRepository(repository: string) {
+ if (
+ !repositoryPattern.test(repository) ||
+ [".", ".."].includes(repository.split("/")[1]!)
+ )
+ throw new Error("Invalid configured release repository.");
+}
+
+export async function boundedBytes(response: Response, maximum: number) {
+ if (!response.body) throw new Error("Empty release response.");
+ const advertised = response.headers.get("content-length");
+ if (
+ advertised &&
+ (!/^\d+$/.test(advertised) || Number(advertised) > maximum)
+ ) {
+ await response.body.cancel();
+ throw new Error("Release response exceeds its size limit.");
+ }
+ const reader = response.body.getReader();
+ let expired = false;
+ const timeout = setTimeout(() => {
+ expired = true;
+ void reader.cancel("Response read deadline exceeded.").catch(() => {});
+ }, 15000);
+ const chunks: Uint8Array[] = [];
+ let size = 0;
+ try {
+ while (true) {
+ const { value, done } = await reader.read();
+ if (expired) throw new Error("Response read deadline exceeded.");
+ if (done) break;
+ size += value.length;
+ if (size > maximum)
+ throw new Error("Release response exceeds its size limit.");
+ chunks.push(value);
+ }
+ return Buffer.concat(chunks, size);
+ } finally {
+ clearTimeout(timeout);
+ await reader.cancel().catch(() => {});
+ reader.releaseLock();
+ }
+}
+
+export function parseOffer(
+ value: unknown,
+ repository: string,
+ now: number,
+): Offer {
+ validateRepository(repository);
+ const release = value as {
+ id: number;
+ tag_name: string;
+ draft: boolean;
+ prerelease: boolean;
+ body?: string;
+ assets: {
+ id: number;
+ name: string;
+ size: number;
+ digest: string;
+ url: string;
+ }[];
+ };
+ const version =
+ typeof release?.tag_name === "string" ? release.tag_name.slice(1) : "";
+ if (
+ release?.draft !== false ||
+ release.prerelease !== false ||
+ !Number.isSafeInteger(release.id) ||
+ release.id <= 0 ||
+ release.tag_name !== `v${version}` ||
+ !stableVersion.test(version) ||
+ !Array.isArray(release.assets) ||
+ release.assets.length > 100
+ )
+ throw new Error("Release is not a published stable version.");
+ const matches = release.assets.filter(
+ (a) => a?.name === "roost-linux-x64.tar.gz",
+ );
+ const asset = matches[0];
+ if (
+ matches.length !== 1 ||
+ !asset ||
+ !Number.isSafeInteger(asset.id) ||
+ asset.id <= 0 ||
+ !Number.isSafeInteger(asset.size) ||
+ asset.size <= 0 ||
+ asset.size > maxArchiveBytes ||
+ !/^sha256:[a-f0-9]{64}$/.test(asset.digest) ||
+ asset.url !==
+ `https://api.github.com/repos/${repository}/releases/assets/${asset.id}`
+ )
+ throw new Error(
+ "Release has no unambiguous bounded Linux x64 artifact with a SHA-256 digest.",
+ );
+ const identity = {
+ repository,
+ releaseId: release.id,
+ assetId: asset.id,
+ version,
+ digest: asset.digest,
+ size: asset.size,
+ };
+ const expiresAt = now + 15 * 60_000;
+ return {
+ ...identity,
+ id: createHash("sha256")
+ .update(JSON.stringify({ ...identity, expiresAt }))
+ .digest("hex"),
+ notes: typeof release.body === "string" ? release.body.slice(0, 8000) : "",
+ checkedAt: now,
+ expiresAt,
+ };
+}
+
+/** One bounded cache per configured installation, no browser-controlled sources.
+ * ETags are sent only to the GitHub API; authorization never follows redirects. */
+export class ReleaseChecker {
+ private cache?: { offer: Offer; etag: string | null };
+ private nextCheck = 0;
+ private pending?: Promise;
+ constructor(
+ readonly repository: string,
+ private readonly fetcher: typeof fetch = fetch,
+ private readonly token?: string,
+ private readonly clock = Date.now,
+ ) {
+ validateRepository(repository);
+ }
+
+ get cached() {
+ return this.cache?.offer;
+ }
+
+ check(): Promise {
+ if (this.pending) return this.pending;
+ if (this.clock() < this.nextCheck)
+ return Promise.reject(new Error("Wait a minute before checking again."));
+ this.nextCheck = this.clock() + 60_000;
+ this.pending = this.lookup().finally(() => {
+ this.pending = undefined;
+ });
+ return this.pending;
+ }
+
+ private async lookup() {
+ const headers: Record = {
+ Accept: "application/vnd.github+json",
+ "X-GitHub-Api-Version": "2022-11-28",
+ ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}),
+ ...(this.cache?.etag && this.cache.offer.expiresAt > this.clock()
+ ? { "If-None-Match": this.cache.etag }
+ : {}),
+ };
+ const response = await this.fetcher(
+ `https://api.github.com/repos/${this.repository}/releases/latest`,
+ {
+ headers,
+ redirect: "error",
+ signal: AbortSignal.timeout(15000),
+ },
+ );
+ if (response.status === 304 && this.cache) {
+ // Retain the pinned offer identity/expiry; a 304 does not renew authorization.
+ this.cache.offer = { ...this.cache.offer, checkedAt: this.clock() };
+ return this.cache.offer;
+ }
+ if (!response.ok) {
+ await response.body?.cancel();
+ throw new Error(
+ `Release check failed (HTTP ${response.status}). Check network and configured repository access.`,
+ );
+ }
+ const value: unknown = JSON.parse(
+ (await boundedBytes(response, 2 * 1024 * 1024)).toString("utf8"),
+ );
+ const offer = parseOffer(value, this.repository, this.clock());
+ this.cache = { offer, etag: response.headers.get("etag") };
+ return offer;
+ }
+}
+
+export function assertOffer(
+ offer: Offer,
+ approvedId: string,
+ installedVersion: string,
+ now = Date.now(),
+) {
+ if (
+ offer.id !== approvedId ||
+ offer.expiresAt <= now ||
+ compareVersions(offer.version, installedVersion) <= 0
+ )
+ throw new Error(
+ "Offer expired, changed, or is not a newer version. Check again.",
+ );
+}
diff --git a/src/updater/security.ts b/src/updater/security.ts
new file mode 100644
index 0000000..a635a16
--- /dev/null
+++ b/src/updater/security.ts
@@ -0,0 +1,52 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { boundedBytes } from "./releases";
+
+export function csrfToken(secret: string, session: string) {
+ return createHmac("sha256", secret)
+ .update(`roost-update-v1:${session}`)
+ .digest("hex");
+}
+
+export function authorizeMutation(
+ request: Request,
+ context: {
+ origin: string;
+ session: { id: string; created: number } | undefined;
+ secret: string;
+ now?: number;
+ },
+) {
+ const { session, origin, secret, now = Date.now() } = context;
+ if (!session || session.created < now - 5 * 60_000 || session.created > now)
+ throw new Error("Recent native passkey authentication required.");
+ if (
+ request.method !== "POST" ||
+ new URL(request.url).host !== new URL(origin).host ||
+ request.headers.get("origin") !== origin ||
+ request.headers.get("sec-fetch-site") === "cross-site" ||
+ request.headers.get("content-type")?.split(";")[0] !== "application/json"
+ )
+ throw new Error("Invalid update request origin or content type.");
+ const supplied = request.headers.get("x-roost-csrf") ?? "";
+ const expected = csrfToken(secret, session.id);
+ if (
+ !/^[a-f0-9]{64}$/.test(supplied) ||
+ !timingSafeEqual(Buffer.from(supplied), Buffer.from(expected))
+ )
+ throw new Error("Invalid update CSRF token.");
+}
+
+export async function updateBody(request: Request, allowed: readonly string[]) {
+ const response = new Response(request.body, { headers: request.headers });
+ const value: unknown = JSON.parse(
+ (await boundedBytes(response, 2048)).toString("utf8"),
+ );
+ if (
+ !value ||
+ typeof value !== "object" ||
+ Array.isArray(value) ||
+ Object.keys(value).some((key) => !allowed.includes(key))
+ )
+ throw new Error("Unexpected update fields.");
+ return value as Record;
+}
diff --git a/src/updater/snapshot.ts b/src/updater/snapshot.ts
new file mode 100644
index 0000000..3d64bdf
--- /dev/null
+++ b/src/updater/snapshot.ts
@@ -0,0 +1,245 @@
+import { createHash } from "node:crypto";
+import {
+ cpSync,
+ createReadStream,
+ existsSync,
+ mkdtempSync,
+ rmSync,
+} from "node:fs";
+import {
+ chmod,
+ cp,
+ lstat,
+ mkdir,
+ open,
+ readdir,
+ readFile,
+ realpath,
+ statfs,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, relative, resolve } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { durableJson, operationId, syncDirectory } from "./journal";
+
+type Entry = {
+ path: string;
+ kind: "file" | "directory";
+ size: number;
+ mode: number;
+ digest?: string;
+};
+export type Snapshot = {
+ schema: 1;
+ entries: Entry[];
+ digest: string;
+ bytes: number;
+};
+const maximumFiles = 250000;
+
+async function hashFile(path: string) {
+ const hash = createHash("sha256");
+ for await (const chunk of createReadStream(path)) hash.update(chunk);
+ return hash.digest("hex");
+}
+const manifestDigest = (entries: Entry[]) =>
+ createHash("sha256").update(JSON.stringify(entries)).digest("hex");
+
+/** Complete managed data only. Initial contract refuses symlinks, hard links,
+ * device files, and mounts, instead of silently excluding mutable state. The
+ * supervisor must first prove all writers stopped; a scan is not that proof. */
+async function scan(directory: string): Promise {
+ const root = await realpath(directory);
+ if (root !== resolve(directory))
+ throw new Error("Snapshot data path must be canonical.");
+ const rootStat = await lstat(root);
+ if (!rootStat.isDirectory())
+ throw new Error("Snapshot data is not a directory.");
+ const mounts = await readFile("/proc/self/mountinfo", "utf8");
+ const decode = (path: string) =>
+ path.replace(/\\([0-7]{3})/g, (_, octal: string) =>
+ String.fromCharCode(Number.parseInt(octal, 8)),
+ );
+ for (const line of mounts.trim().split("\n")) {
+ const mount = decode(line.split(" ")[4] ?? "");
+ if (mount === root || mount.startsWith(`${root}/`))
+ throw new Error("Mounted data requires operator-managed backup.");
+ }
+ const entries: Entry[] = [];
+ let bytes = 0;
+ async function visit(path: string) {
+ const info = await lstat(path);
+ if (
+ info.dev !== rootStat.dev ||
+ info.isSymbolicLink() ||
+ (!info.isDirectory() && !info.isFile()) ||
+ (info.isFile() && info.nlink !== 1)
+ )
+ throw new Error(
+ "Unsupported link, mount, or special file in managed data.",
+ );
+ if (entries.length >= maximumFiles)
+ throw new Error("Snapshot file count limit exceeded.");
+ const entry: Entry = {
+ path: relative(root, path),
+ kind: info.isDirectory() ? "directory" : "file",
+ size: info.isFile() ? info.size : 0,
+ mode: info.mode & 0o700,
+ };
+ if (info.isFile()) {
+ entry.digest = await hashFile(path);
+ bytes += info.size;
+ }
+ entries.push(entry);
+ if (info.isDirectory())
+ for (const child of (await readdir(path)).sort())
+ await visit(join(path, child));
+ }
+ await visit(root);
+ return { schema: 1, entries, digest: manifestDigest(entries), bytes };
+}
+
+export async function requireHeadroom(
+ root: string,
+ bytes: number,
+ files: number,
+ staging = 0,
+ stagingFiles = 0,
+) {
+ const free = await statfs(root, { bigint: true });
+ if (
+ ![bytes, files, staging, stagingFiles].every(
+ (value) => Number.isSafeInteger(value) && value >= 0,
+ )
+ )
+ throw new Error("Invalid capacity estimate.");
+ if (
+ free.bavail * free.bsize <
+ BigInt(bytes) * 3n + BigInt(staging) + 128n * 1024n * 1024n ||
+ free.ffree < BigInt(files) * 3n + BigInt(stagingFiles) + 1024n
+ )
+ throw new Error(
+ "Insufficient free space or inodes for snapshot and recovery.",
+ );
+}
+
+function integrity(directory: string) {
+ // SQLite can alter SHM even for a read-only connection. Inspect a private copy
+ // so verification never changes the immutable recovery pair or its sidecars.
+ const temporary = mkdtempSync(join(tmpdir(), "roost-snapshot-check-"));
+ try {
+ for (const name of ["roost.sqlite", "auth.sqlite"]) {
+ for (const suffix of ["", "-wal", "-shm", "-journal"]) {
+ const source = join(directory, name + suffix);
+ if (existsSync(source)) cpSync(source, join(temporary, name + suffix));
+ }
+ const path = join(temporary, name);
+ // Both stores are required for the native-auth update contract.
+ const db = new DatabaseSync(path, { readOnly: true });
+ try {
+ if (
+ db
+ .prepare("PRAGMA integrity_check")
+ .all()
+ .some((row) => row.integrity_check !== "ok")
+ )
+ throw new Error("Snapshot database integrity check failed.");
+ } finally {
+ db.close();
+ }
+ }
+ } finally {
+ rmSync(temporary, { recursive: true, force: true });
+ }
+}
+
+export async function createSnapshot(root: string, id: string) {
+ if (!operationId.test(id)) throw new Error("Invalid operation ID.");
+ const source = join(root, "data");
+ const before = await scan(source);
+ await requireHeadroom(root, before.bytes, before.entries.length);
+ const directory = join(root, "updates", id);
+ await mkdir(directory, { recursive: true, mode: 0o700 });
+ const snapshot = join(directory, "snapshot");
+ await mkdir(snapshot, { mode: 0o700 }); // Existing/partial snapshot is never reused.
+ for (const child of await readdir(source)) {
+ await cp(join(source, child), join(snapshot, child), {
+ recursive: true,
+ dereference: false,
+ preserveTimestamps: true,
+ force: false,
+ errorOnExist: true,
+ });
+ }
+ // Copy permissions are deliberately reduced to owner-only access. Original
+ // owner executable bits remain, but secrets never become group/world readable.
+ for (const entry of before.entries) {
+ const target = join(snapshot, entry.path);
+ await chmod(target, entry.mode);
+ const fd = await open(target, "r");
+ try {
+ await fd.sync();
+ } finally {
+ await fd.close();
+ }
+ }
+ integrity(snapshot);
+ const copied = await scan(snapshot);
+ const after = await scan(source);
+ if (copied.digest !== before.digest || after.digest !== before.digest)
+ throw new Error(
+ "Managed data changed during snapshot; writers are not quiescent.",
+ );
+ await durableJson(join(directory, "snapshot.json"), copied);
+ await syncDirectory(directory);
+ await syncDirectory(dirname(directory));
+ return copied.digest;
+}
+
+export async function verifySnapshot(
+ root: string,
+ id: string,
+ expected: string,
+) {
+ if (!operationId.test(id) || !/^[a-f0-9]{64}$/.test(expected))
+ throw new Error("Invalid snapshot identity.");
+ const directory = join(root, "updates", id);
+ const fd = await open(join(directory, "snapshot.json"), "r");
+ let value: Snapshot;
+ try {
+ if ((await fd.stat()).size > 64 * 1024 * 1024)
+ throw new Error("Snapshot manifest too large.");
+ value = JSON.parse(await fd.readFile("utf8")) as Snapshot;
+ } finally {
+ await fd.close();
+ }
+ if (
+ value.schema !== 1 ||
+ value.digest !== expected ||
+ !Array.isArray(value.entries) ||
+ manifestDigest(value.entries) !== expected
+ )
+ throw new Error("Snapshot manifest does not match the journal.");
+ integrity(join(directory, "snapshot"));
+ const actual = await scan(join(directory, "snapshot"));
+ if (actual.digest !== expected)
+ throw new Error("Snapshot data failed digest verification.");
+ return actual;
+}
+
+export async function verifyData(directory: string, expected: string) {
+ integrity(directory);
+ if ((await scan(directory)).digest !== expected)
+ throw new Error("Restored data does not match complete snapshot.");
+}
+export async function syncTree(directory: string) {
+ for (const entry of (await scan(directory)).entries.reverse()) {
+ const fd = await open(join(directory, entry.path), "r");
+ try {
+ await fd.sync();
+ } finally {
+ await fd.close();
+ }
+ }
+}
+export const inspectData = scan;
diff --git a/src/updater/systemd.ts b/src/updater/systemd.ts
new file mode 100644
index 0000000..a9f5538
--- /dev/null
+++ b/src/updater/systemd.ts
@@ -0,0 +1,231 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { setTimeout as delay } from "node:timers/promises";
+import { readRelease } from "../cli/releases";
+import { type Installation, serviceName } from "../cli/service";
+import { maintenance } from "../cli/state";
+import { stageArtifact } from "./artifact";
+import type { EngineAdapter } from "./engine";
+import { validateInstallation, validateService } from "./enrollment";
+import { readGate } from "./gate";
+import { execute } from "./process";
+
+/** Labels alone do not establish quiescence. Missing/stale/changed identity
+ * observations never authorize stopping an installation. */
+export function codingWorkUncertain(
+ j: Record,
+ now = Date.now(),
+) {
+ if (
+ j.lastWorkerState === "not_started" &&
+ j.status === "blocked" &&
+ !j.observedWorking &&
+ !j.sessionIdentity &&
+ !j.nativeSessionId
+ )
+ return false;
+ return (
+ j.status !== "review" ||
+ !j.observedWorking ||
+ !["idle", "done"].includes(String(j.lastWorkerState)) ||
+ !!j.cancelRequested ||
+ !j.sessionIdentity ||
+ !j.nativeSessionId ||
+ Number(j.lastCheckedAt) < now - 15000 ||
+ !Number.isFinite(Number(j.lastCheckedAt)) ||
+ !!j.error
+ );
+}
+export function systemdAdapter(
+ c: Installation,
+ support: string,
+ token?: string,
+): EngineAdapter {
+ const unit = serviceName(c);
+ const control = (action: "start" | "stop") =>
+ execute("/usr/bin/sudo", ["-n", "/usr/bin/systemctl", action, unit]);
+ async function appProbe(path: string) {
+ const gate = readGate(c.root);
+ const response = await fetch(`http://127.0.0.1:${c.port}${path}`, {
+ headers: { "X-Roost-Updater": gate.token ?? gate.operation ?? "" },
+ signal: AbortSignal.timeout(2000),
+ });
+ if (!response.ok) throw new Error("Application update probe unavailable.");
+ return response.json();
+ }
+ return {
+ async running() {
+ const status = await execute("/usr/bin/systemctl", [
+ "show",
+ unit,
+ "--property=ActiveState",
+ "--value",
+ ]);
+ return status === "active" || status === "activating";
+ },
+ stage: (offer, id, signal, progress) =>
+ stageArtifact(c.root, offer, id, support, signal, progress, token),
+ async preflight(candidate) {
+ await validateInstallation(c);
+ await validateService(c);
+ await readRelease(join(c.root, "releases", candidate));
+ // sudo -n -l validates authorization without actually starting/stopping.
+ for (const action of ["start", "stop"])
+ await execute("/usr/bin/sudo", [
+ "-n",
+ "-l",
+ "/usr/bin/systemctl",
+ action,
+ unit,
+ ]);
+ const fragment = await execute("/usr/bin/systemctl", [
+ "show",
+ unit,
+ "--property=ExecStart",
+ "--value",
+ ]);
+ if (!fragment.includes(join(c.root, "current", "runtime/node")))
+ throw new Error("Service identity differs from enrollment.");
+ },
+ async admission(blocked) {
+ maintenance(c.root, blocked);
+ },
+ async blockers(frozen) {
+ let db: DatabaseSync | undefined;
+ try {
+ db = new DatabaseSync(join(c.root, "data", "roost.sqlite"), {
+ readOnly: true,
+ });
+ db.exec("PRAGMA busy_timeout=5000");
+ } catch {
+ db?.close();
+ return ["Work cannot be verified because its store is unavailable."];
+ }
+ const blockers: string[] = [];
+ try {
+ if (
+ Number(
+ db
+ .prepare(
+ "SELECT count(*) AS n FROM runs WHERE status IN ('running','steering')",
+ )
+ .get()?.n,
+ )
+ )
+ blockers.push("Conversations or steering are still active.");
+ const jobs = db
+ .prepare(
+ "SELECT * FROM coding_jobs WHERE status NOT IN ('completed','cancelled','failed','queued')",
+ )
+ .all();
+ for (const j of jobs) {
+ if (codingWorkUncertain(j))
+ blockers.push(
+ "A coding worker is active, missing, or uncertain; inspect it before retrying.",
+ );
+ }
+ if (
+ Number(
+ db
+ .prepare(
+ "SELECT count(*) AS n FROM coding_job_inputs WHERE status IN ('launching','dispatching')",
+ )
+ .get()?.n,
+ )
+ )
+ blockers.push("Coding submission is in flight.");
+ } catch {
+ blockers.push(
+ "Work cannot be verified because its store is busy or unreadable.",
+ );
+ } finally {
+ db.close();
+ }
+ if (await this.running()) {
+ try {
+ const result = await appProbe("/api/updates/quiescence");
+ if (result.tasks || result.requests || result.login)
+ blockers.push("Application tasks or requests are still finishing.");
+ if (frozen && !result.frozen)
+ blockers.push("Writer gate has not closed.");
+ } catch {
+ blockers.push("Application quiescence cannot be verified.");
+ }
+ }
+ return [...new Set(blockers)];
+ },
+ async stop() {
+ const before = await execute("/usr/bin/systemctl", [
+ "show",
+ unit,
+ "--property=ControlGroup",
+ "--value",
+ ]);
+ await control("stop");
+ const values = await execute("/usr/bin/systemctl", [
+ "show",
+ unit,
+ "--property=ActiveState,SubState,MainPID,ControlGroup",
+ ]);
+ if (
+ !values.includes("ActiveState=inactive") ||
+ !values.includes("MainPID=0")
+ )
+ throw new Error("Service did not stop cleanly.");
+ const reported = values
+ .split("\n")
+ .find((s) => s.startsWith("ControlGroup="))
+ ?.slice(13);
+ const group = before || reported;
+ if (group) {
+ try {
+ if (
+ (
+ await readFile(
+ join("/sys/fs/cgroup", group, "cgroup.events"),
+ "utf8",
+ )
+ ).includes("populated 1")
+ )
+ throw new Error("Service group still has writers.");
+ } catch (e) {
+ if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+ }
+ }
+ },
+ async start() {
+ await control("start");
+ },
+ async probe(version, id, tokenValue) {
+ const contract = JSON.parse(
+ await readFile(
+ join(c.root, "releases", version, "compatibility.json"),
+ "utf8",
+ ),
+ );
+ const deadline = Date.now() + 120000;
+ while (Date.now() < deadline) {
+ try {
+ const result = await appProbe("/api/updates/probe");
+ if (
+ result.version === version &&
+ result.operation === id &&
+ result.token === tokenValue &&
+ result.integrity === true &&
+ result.appSchema === contract.app.output &&
+ result.authSchema === contract.auth.output &&
+ result.assets === true &&
+ result.shell === true &&
+ result.workerReady === true
+ )
+ return;
+ } catch {
+ /* Startup may still be in progress. */
+ }
+ await delay(500);
+ }
+ throw new Error("Candidate readiness deadline exceeded.");
+ },
+ };
+}
diff --git a/tests/coding-worker.test.ts b/tests/coding-worker.test.ts
index 740602d..f8144fc 100644
--- a/tests/coding-worker.test.ts
+++ b/tests/coding-worker.test.ts
@@ -771,3 +771,86 @@ test("a backlog over forty queued jobs cannot starve active monitoring or stop r
"cancelled",
);
}));
+
+for (const dispatch of ["launch", "follow-up"] as const) {
+ test(`update admission closing during coding ${dispatch} preparation prevents submission and replay`, async () =>
+ fixture(async (agentId) => {
+ const job = await create(agentId);
+ const mock = mockAdapter();
+ if (dispatch === "follow-up") {
+ await tickCodingJobs(owner, signal(), mock.adapter);
+ await run(
+ withAgentStore((db) => {
+ db.prepare(
+ "INSERT INTO coding_job_inputs(id,jobId,agentId,prompt,createdAt) VALUES(?,?,?,?,?)",
+ ).run(
+ randomUUID(),
+ job.id,
+ agentId,
+ "Unsent follow-up",
+ Date.now(),
+ );
+ }),
+ );
+ await poll();
+ }
+ let entered!: () => void;
+ let release!: () => void;
+ const preparing = new Promise((resolve) => {
+ entered = resolve;
+ });
+ const ready = new Promise((resolve) => {
+ release = resolve;
+ });
+ const prepare = async (beforeSend: (() => Promise) | undefined) => {
+ entered();
+ await ready;
+ assert.ok(beforeSend);
+ await beforeSend();
+ mock.calls.prompts++;
+ return worker();
+ };
+ if (dispatch === "launch") {
+ mock.adapter.startCodingWorker = async (_target, options) => {
+ mock.calls.starts++;
+ return prepare(options.beforeSend);
+ };
+ } else {
+ mock.adapter.promptCodingWorker = async (
+ _target,
+ _worker,
+ _prompt,
+ _identity,
+ _signal,
+ beforeSend,
+ ) => prepare(beforeSend);
+ }
+ const ticking = tickCodingJobs(owner, signal(), mock.adapter);
+ await preparing;
+ try {
+ await run(
+ withAgentStore((db) =>
+ db.exec("UPDATE runtime_control SET maintenance=1 WHERE id=1"),
+ ),
+ );
+ } finally {
+ release();
+ await ticking;
+ }
+ assert.equal(mock.calls.prompts, 0);
+ const blocked = await run(getCodingJob(agentId, job.id));
+ assert.equal(blocked.status, "blocked");
+ // Reopening admission is not fresh authorization to retry the interrupted
+ // dispatch. Existing identity is inspected and the prompt stays unsent.
+ await run(
+ withAgentStore((db) =>
+ db.exec("UPDATE runtime_control SET maintenance=0 WHERE id=1"),
+ ),
+ );
+ await poll();
+ mock.state.worker = worker("missing");
+ await tickCodingJobs(owner, signal(), mock.adapter);
+ assert.equal(mock.calls.starts, 1);
+ assert.equal(mock.calls.prompts, 0);
+ }));
+}
diff --git a/tests/releases.test.ts b/tests/releases.test.ts
index d51dc08..e88a055 100644
--- a/tests/releases.test.ts
+++ b/tests/releases.test.ts
@@ -54,7 +54,7 @@ test("update work detection includes resumable coding jobs and supports older da
["review", "idle", 1],
["queued", "unknown", 0],
["blocked", "not_started", 0],
- ["blocked", "missing", 0],
+ ["blocked", "missing", 1],
["completed", "idle", 0],
["cancelled", "idle", 0],
["failed", "unknown", 0],
diff --git a/tests/runs.test.ts b/tests/runs.test.ts
index adf48f3..7b516c6 100644
--- a/tests/runs.test.ts
+++ b/tests/runs.test.ts
@@ -21,6 +21,7 @@ import { closeAgentRuntimes } from "../src/server/codex/agent-runtime.server";
import {
cancelRun,
claimRun,
+ claimSteeringRun,
enqueueChat,
finishRun,
listRuns,
@@ -767,3 +768,113 @@ test("background work reserves capacity for user conversations", async () => {
rmSync(directory, { recursive: true, force: true });
}
});
+
+test("update admission fences queued claims and steering while observations finish; downtime catches up once", async () => {
+ const directory = mkdtempSync("/tmp/roost-update-admission-");
+ const old = process.env.ROOST_DATA_DIR;
+ process.env.ROOST_DATA_DIR = directory;
+ try {
+ const agent = await create("Update admission");
+ const automation = await run(
+ saveAutomation({
+ agentId: agent.id,
+ id: randomUUID(),
+ name: "Due during outage",
+ prompt: "quiet",
+ schedule: { kind: "interval", minutes: 60 },
+ notification: "when-needed",
+ }),
+ );
+ await run(
+ enqueueChat({
+ agentId: agent.id,
+ messageId: randomUUID(),
+ text: "Accepted before drain",
+ }),
+ );
+ await run(schedulerTick("update-test"));
+ const active = (await run(claimRun("update-test")))!;
+ assert.ok(active);
+ await run(
+ enqueueChat({
+ agentId: agent.id,
+ messageId: randomUUID(),
+ text: "Queued before drain",
+ }),
+ );
+ const overdue = Date.now() - 10 * 3600000;
+ await run(
+ withAgentStore((db) => {
+ db.exec("UPDATE runtime_control SET maintenance=1 WHERE id=1");
+ db.prepare("UPDATE automations SET nextRunAt=? WHERE id=?").run(
+ overdue,
+ automation.id,
+ );
+ }),
+ );
+ assert.equal(await run(claimSteeringRun(active)), undefined);
+ assert.equal(await run(claimRun("update-test")), undefined);
+ await assert.rejects(
+ run(
+ enqueueChat({
+ agentId: agent.id,
+ messageId: randomUUID(),
+ text: "After drain",
+ }),
+ ),
+ /updating/,
+ );
+ await run(schedulerTick("update-test"));
+ await run(schedulerTick("update-test"));
+ assert.equal((await run(listAutomations(agent.id)))[0]!.nextRunAt, overdue);
+ assert.equal(
+ (await run(listRuns(agent.id))).filter((r) => r.kind === "automation")
+ .length,
+ 0,
+ );
+ await run(
+ persistRun(active, [
+ {
+ id: "observed-during-drain",
+ role: "assistant",
+ text: "Existing work remains observable",
+ },
+ ]),
+ );
+ await run(
+ finishRun(active, "completed", [
+ {
+ id: "observed-during-drain",
+ role: "assistant",
+ text: "Existing work completed",
+ },
+ ]),
+ );
+ assert.equal(
+ (await run(listRuns(agent.id))).find((r) => r.id === active.id)?.status,
+ "completed",
+ );
+ assert.equal(await run(claimRun("update-test")), undefined);
+ await run(
+ withAgentStore((db) =>
+ db.exec("UPDATE runtime_control SET maintenance=0 WHERE id=1"),
+ ),
+ );
+ await run(schedulerTick("update-test"));
+ await run(schedulerTick("update-test"));
+ const runs = await run(listRuns(agent.id));
+ assert.equal(runs.filter((r) => r.kind === "automation").length, 1);
+ assert.ok(
+ (await run(listAutomations(agent.id)))[0]!.nextRunAt! > Date.now(),
+ );
+ assert.equal(runs.filter((r) => r.id === active.id).length, 1);
+ assert.equal(
+ (await run(claimRun("update-test")))?.prompt,
+ "Queued before drain",
+ );
+ } finally {
+ if (old === undefined) delete process.env.ROOST_DATA_DIR;
+ else process.env.ROOST_DATA_DIR = old;
+ rmSync(directory, { recursive: true, force: true });
+ }
+});
diff --git a/tests/settings-navigation.test.ts b/tests/settings-navigation.test.ts
index 02d74a4..de40e17 100644
--- a/tests/settings-navigation.test.ts
+++ b/tests/settings-navigation.test.ts
@@ -15,6 +15,7 @@ test("unknown settings groups fall back to appearance", () => {
test("search finds existing controls, conditional options, and vocabulary across groups", () => {
const cases = [
+ ["software update", "updates"],
[" THINKING summaries ", "conversation"],
["tool inputs", "conversation"],
["messages", "conversation"],
@@ -51,7 +52,7 @@ test("search finds existing controls, conditional options, and vocabulary across
findSettings("codex").map((entry) => entry.id),
["conversation", "account"],
);
- assert.equal(findSettings(" \n ").length, 5);
+ assert.equal(findSettings(" \n ").length, 6);
assert.equal(findSettings("nothing-matches-this").length, 0);
assert.equal(findSettings("passkeys trackers").length, 0);
});
diff --git a/tests/steering.test.ts b/tests/steering.test.ts
index a50f4e1..32a1d9e 100644
--- a/tests/steering.test.ts
+++ b/tests/steering.test.ts
@@ -200,6 +200,23 @@ test("finished turns leave pending messages queued; ownership and restart recove
await run(claimSteeringRun({ ...first, owner: "foreign" })),
undefined,
);
+ await run(
+ withAgentStore((db) =>
+ db.prepare("UPDATE runtime_control SET maintenance=1 WHERE id=1").run(),
+ ),
+ );
+ assert.equal(await run(claimSteeringRun(first)), undefined);
+ assert.equal(
+ (await run(listRuns(agentId))).find(
+ (entry) => entry.id === second.messageId,
+ )?.status,
+ "queued",
+ );
+ await run(
+ withAgentStore((db) =>
+ db.prepare("UPDATE runtime_control SET maintenance=0 WHERE id=1").run(),
+ ),
+ );
await run(finishRun(first, "completed", []));
assert.equal(await run(claimSteeringRun(first)), undefined);
const next = (await run(claimRun("owner")))!;
diff --git a/tests/ui-updates.test.ts b/tests/ui-updates.test.ts
new file mode 100644
index 0000000..c3e70d8
--- /dev/null
+++ b/tests/ui-updates.test.ts
@@ -0,0 +1,481 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { once } from "node:events";
+import {
+ chmod,
+ mkdir,
+ mkdtemp,
+ readFile,
+ rm,
+ symlink,
+ writeFile,
+} from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { test } from "node:test";
+import { activeRuns, withLock } from "../src/cli/state";
+import { updatesRequest } from "../src/server/updates.server";
+import {
+ assertCompatible,
+ capability,
+ compareVersions,
+} from "../src/updater/contract";
+import {
+ type Journal,
+ phases,
+ readJournal,
+ recoveryPlan,
+ writeJournal,
+} from "../src/updater/journal";
+import { withKernelLock } from "../src/updater/lock";
+import {
+ assertOffer,
+ boundedBytes,
+ parseOffer,
+ ReleaseChecker,
+} from "../src/updater/releases";
+import {
+ authorizeMutation,
+ csrfToken,
+ updateBody,
+} from "../src/updater/security";
+import {
+ createSnapshot,
+ requireHeadroom,
+ verifySnapshot,
+} from "../src/updater/snapshot";
+
+const metadata = () => ({
+ id: 2,
+ tag_name: "v0.2.0",
+ draft: false,
+ prerelease: false,
+ body: "",
+ assets: [
+ {
+ id: 3,
+ name: "roost-linux-x64.tar.gz",
+ digest: `sha256:${"a".repeat(64)}`,
+ size: 1234,
+ url: "https://api.github.com/repos/srctl/roost/releases/assets/3",
+ },
+ ],
+});
+const contract = {
+ protocol: 1,
+ app: { min: 10, max: 10, output: 10 },
+ auth: { min: 0, max: 0, output: 0 },
+ data: "complete-snapshot-v1",
+ externalState: "unchanged",
+ codex: "0.153.4",
+};
+
+test("capability never infers enrollment or activates unqualified installations", () => {
+ for (const facts of [
+ { packaged: false, platform: "linux", arch: "x64", systemd: true },
+ { packaged: true, platform: "linux", arch: "arm64", systemd: true },
+ { packaged: true, platform: "linux", arch: "x64", systemd: false },
+ { packaged: true, platform: "linux", arch: "x64", systemd: true },
+ ])
+ assert.equal(capability(facts).canActivate, false);
+ for (const [extra, code] of [
+ [{ distribution: "fedora:43" }, "unsupported-distribution"],
+ [
+ { distribution: "ubuntu:24.04", filesystem: "overlay" },
+ "unsupported-storage",
+ ],
+ ] as const)
+ assert.equal(
+ capability({
+ packaged: true,
+ platform: "linux",
+ arch: "x64",
+ systemd: true,
+ ...extra,
+ }).code,
+ code,
+ );
+ assert.equal(
+ capability({
+ packaged: false,
+ platform: "darwin",
+ arch: "arm64",
+ systemd: false,
+ }).code,
+ "externally-managed",
+ );
+});
+
+test("stable numeric versions and explicit database/runtime compatibility default deny", () => {
+ assert.equal(compareVersions("0.1.40", "0.1.9"), 1);
+ assert.equal(compareVersions("1.0.0", "1.0.0"), 0);
+ for (const invalid of [
+ "1.2.3-beta",
+ "01.2.3",
+ "9007199254740992.1.0",
+ "v1.2.3",
+ "1.2.3\n",
+ ])
+ assert.throws(() => compareVersions(invalid, "1.2.3"));
+ assertCompatible(contract, { app: 10, auth: 0, codex: "0.153.4" });
+ for (const installed of [
+ { app: 11, auth: 0, codex: "0.153.4" },
+ { app: 9, auth: 0, codex: "0.153.4" },
+ { app: 10, auth: 1, codex: "0.153.4" },
+ { app: 10, auth: 0, codex: "0.154.0" },
+ ])
+ assert.throws(() => assertCompatible(contract, installed));
+ assert.throws(() =>
+ assertCompatible(undefined, { app: 10, auth: 0, codex: "0.153.4" }),
+ );
+});
+
+test("offers pin stable release, asset identity, digest, size and expiry", () => {
+ const source = metadata();
+ const offer = parseOffer(source, "srctl/roost", 1000);
+ assert.ok(
+ Buffer.byteLength(
+ JSON.stringify(
+ parseOffer(
+ { ...source, body: "\u0000".repeat(16000) },
+ "srctl/roost",
+ 1000,
+ ),
+ ),
+ ) < 60000,
+ );
+ assertOffer(offer, offer.id, "0.1.40", 2000);
+ assert.throws(() => assertOffer(offer, offer.id, "0.2.0", 2000));
+ assert.throws(() => assertOffer(offer, offer.id, "0.1.40", offer.expiresAt));
+ const changed = metadata();
+ changed.assets[0]!.id = 4;
+ changed.assets[0]!.url =
+ "https://api.github.com/repos/srctl/roost/releases/assets/4";
+ assert.notEqual(parseOffer(changed, "srctl/roost", 1000).id, offer.id);
+ for (const changed of [
+ { ...source, draft: true },
+ { ...source, prerelease: true },
+ { ...source, tag_name: "v0.2.0-rc1" },
+ { ...source, assets: [...source.assets, ...source.assets] },
+ { ...source, assets: [{ ...source.assets[0], digest: "" }] },
+ {
+ ...source,
+ assets: [{ ...source.assets[0], url: "https://evil.example/archive" }],
+ },
+ { ...source, assets: [{ ...source.assets[0], size: 2 ** 40 }] },
+ ])
+ assert.throws(() => parseOffer(changed, "srctl/roost", 1000));
+});
+
+test("metadata checks coalesce, back off and never redirect credentials", async () => {
+ let calls = 0;
+ let now = 1000;
+ const fetcher = (async (_url, init) => {
+ calls++;
+ assert.equal(init?.redirect, "error");
+ assert.equal(
+ (init!.headers as Record).Authorization,
+ "Bearer private-token",
+ );
+ return Response.json(metadata(), { headers: { etag: '"pinned"' } });
+ }) as typeof fetch;
+ const checker = new ReleaseChecker(
+ "srctl/roost",
+ fetcher,
+ "private-token",
+ () => now,
+ );
+ const [a, b] = await Promise.all([checker.check(), checker.check()]);
+ assert.deepEqual(a, b);
+ assert.equal(calls, 1);
+ await assert.rejects(checker.check(), /Wait a minute/);
+ now += 60001;
+ await checker.check();
+ assert.equal(calls, 2);
+ for (const status of [401, 404, 429, 500]) {
+ const failed = new ReleaseChecker(
+ "srctl/roost",
+ async () => new Response("private-token", { status }),
+ );
+ await assert.rejects(
+ failed.check(),
+ (error: Error) => !error.message.includes("private-token"),
+ );
+ assert.equal(failed.cached, undefined);
+ }
+});
+
+test("streamed metadata and request bodies enforce actual byte limits and field allowlists", async () => {
+ await assert.rejects(boundedBytes(new Response("12345"), 4), /size limit/);
+ await assert.rejects(
+ boundedBytes(
+ new Response("1", { headers: { "content-length": "100" } }),
+ 4,
+ ),
+ /size limit/,
+ );
+ assert.equal(
+ (await boundedBytes(new Response("1234"), 4)).toString(),
+ "1234",
+ );
+ const request = (value: unknown) =>
+ new Request("https://roost.example/api/updates", {
+ method: "POST",
+ body: JSON.stringify(value),
+ });
+ for (const value of [
+ { unit: "other" },
+ { path: "/" },
+ { url: "https://evil.example" },
+ [],
+ null,
+ ])
+ await assert.rejects(updateBody(request(value), []));
+ assert.deepEqual(await updateBody(request({}), []), {});
+});
+
+test("mutations require recent native authentication, exact host/origin, JSON and session-bound CSRF", () => {
+ const context = {
+ origin: "https://roost.example",
+ session: { id: "session-a", created: 1000 },
+ secret: "server-secret",
+ now: 2000,
+ };
+ const headers = {
+ origin: context.origin,
+ "content-type": "application/json",
+ "x-roost-csrf": csrfToken(context.secret, context.session.id),
+ };
+ const request = (patch = {}, url = context.origin) =>
+ new Request(`${url}/api/updates`, {
+ method: "POST",
+ headers: { ...headers, ...patch },
+ body: "{}",
+ });
+ authorizeMutation(request(), context);
+ for (const patch of [
+ { origin: "" },
+ { origin: "https://evil.example" },
+ { "sec-fetch-site": "cross-site" },
+ { "content-type": "text/plain" },
+ { "x-roost-csrf": csrfToken(context.secret, "session-b") },
+ { "x-roost-csrf": "" },
+ ])
+ assert.throws(() => authorizeMutation(request(patch), context));
+ assert.throws(() =>
+ authorizeMutation(request({}, "https://evil.example"), context),
+ );
+ assert.throws(() =>
+ authorizeMutation(request(), { ...context, session: undefined }),
+ );
+ assert.throws(() =>
+ authorizeMutation(request(), { ...context, now: 400000 }),
+ );
+ assert.throws(() =>
+ authorizeMutation(new Request(context.origin, { headers }), context),
+ );
+});
+
+test("kernel ownership survives flock exit, excludes CLI, releases after SIGKILL, rejects symlink locks", async () => {
+ const root = await mkdtemp("/tmp/ui-update-kernel-");
+ try {
+ await withKernelLock(root, async () => {
+ await withKernelLock(
+ root,
+ async () => {
+ await assert.rejects(
+ withKernelLock(root, async () => {}, "supervisor"),
+ /operation is active/,
+ );
+ },
+ "supervisor",
+ );
+ await assert.rejects(
+ withKernelLock(root, async () => {}),
+ /operation is active/,
+ );
+ await assert.rejects(
+ withLock(root, async () => {}),
+ /operation is active/,
+ );
+ });
+ const child = spawn(
+ process.execPath,
+ [
+ "--import",
+ "tsx",
+ "--input-type=module",
+ "-e",
+ `import { withKernelLock } from './src/updater/lock.ts'; await withKernelLock(${JSON.stringify(root)},async()=>{console.log('owned');await new Promise(()=>{setInterval(()=>{},1000)});});`,
+ ],
+ { stdio: ["ignore", "pipe", "pipe"] },
+ );
+ await once(child.stdout!, "data");
+ child.kill("SIGKILL");
+ await once(child, "exit");
+ await withKernelLock(root, async () => {});
+ await rm(join(root, "updater.lock"));
+ await writeFile(join(root, "target"), "unchanged");
+ await symlink(join(root, "target"), join(root, "updater.lock"));
+ await assert.rejects(withKernelLock(root, async () => {}));
+ assert.equal(await readFile(join(root, "target"), "utf8"), "unchanged");
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});
+
+test("journal recovery decisions never restore after durable commit and reject corrupt evidence", async () => {
+ const root = await mkdtemp("/tmp/ui-update-journal-");
+ const journal: Journal = {
+ protocol: 1,
+ id: randomUUID(),
+ sequence: 1,
+ phase: "accepted",
+ previous: "0.1.40",
+ candidate: "0.2.0",
+ wasRunning: true,
+ updatedAt: 1000,
+ };
+ try {
+ await writeJournal(root, journal);
+ assert.deepEqual(await readJournal(root, journal.id), journal);
+ for (const phase of phases) {
+ const value = { ...journal, phase, snapshotDigest: "a".repeat(64) };
+ const plan = recoveryPlan(value);
+ if (phase === "committed")
+ assert.equal(plan, "finish-commit-never-restore");
+ if (
+ ["snapshot-complete", "activating", "verifying", "restoring"].includes(
+ phase,
+ )
+ )
+ assert.equal(plan, "restore-matching-pair");
+ }
+ assert.throws(() => recoveryPlan({ ...journal, phase: "verifying" }));
+ await writeFile(join(root, "updates", journal.id, "journal.json"), "{");
+ await assert.rejects(readJournal(root, journal.id));
+ await assert.rejects(readJournal(root, "../data"));
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});
+
+test("complete protected snapshots include both databases and files; tampering and links fail closed", async () => {
+ const root = await mkdtemp("/tmp/ui-update-snapshot-");
+ try {
+ await mkdir(join(root, "data"), { mode: 0o700 });
+ for (const name of ["roost.sqlite", "auth.sqlite"]) {
+ const db = new DatabaseSync(join(root, "data", name));
+ db.exec(
+ "CREATE TABLE saved(value TEXT); INSERT INTO saved VALUES ('preserved')",
+ );
+ db.close();
+ await chmod(join(root, "data", name), 0o600);
+ }
+ await writeFile(join(root, "data", "secret.txt"), "private", {
+ mode: 0o600,
+ });
+ const id = randomUUID();
+ const digest = await createSnapshot(root, id);
+ const snapshot = await verifySnapshot(root, id, digest);
+ assert.equal(snapshot.entries.filter((e) => e.kind === "file").length, 3);
+ await writeFile(
+ join(root, "updates", id, "snapshot", "secret.txt"),
+ "modified",
+ );
+ await assert.rejects(
+ verifySnapshot(root, id, digest),
+ /digest verification/,
+ );
+ await symlink("/tmp", join(root, "data", "external"));
+ await assert.rejects(
+ createSnapshot(root, randomUUID()),
+ /Unsupported link/,
+ );
+ await assert.rejects(
+ requireHeadroom(root, Number.MAX_SAFE_INTEGER, 100),
+ /Insufficient/,
+ );
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});
+
+test("steering, missing and null worker observations all defer service stop", async () => {
+ const root = await mkdtemp("/tmp/ui-update-work-");
+ await mkdir(join(root, "data"));
+ const db = new DatabaseSync(join(root, "data", "roost.sqlite"));
+ try {
+ db.exec(
+ "CREATE TABLE runs(status TEXT); INSERT INTO runs VALUES('steering'); CREATE TABLE coding_jobs(status TEXT,lastWorkerState TEXT); INSERT INTO coding_jobs VALUES('blocked','missing'),('review',NULL),('queued','unknown')",
+ );
+ assert.equal(activeRuns(root), 3);
+ } finally {
+ db.close();
+ await rm(root, { recursive: true, force: true });
+ }
+});
+
+test("journal updates reject sequence reuse and rollback after commit", async () => {
+ const root = await mkdtemp("/tmp/ui-update-journal-sequence-");
+ try {
+ const journal: Journal = {
+ protocol: 1,
+ id: randomUUID(),
+ sequence: 1,
+ phase: "accepted",
+ previous: "0.1.40",
+ candidate: "0.2.0",
+ wasRunning: true,
+ updatedAt: 1000,
+ };
+ await writeJournal(root, journal);
+ await assert.rejects(writeJournal(root, journal), /Conflicting/);
+ const committed: Journal = {
+ ...journal,
+ sequence: 2,
+ phase: "committed",
+ snapshotDigest: "a".repeat(64),
+ };
+ await writeJournal(root, committed);
+ await assert.rejects(
+ writeJournal(root, { ...committed, sequence: 3, phase: "restoring" }),
+ /Conflicting/,
+ );
+ assert.equal((await readJournal(root, journal.id)).phase, "committed");
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});
+
+test("source status is read-only and unauthenticated activation cannot reach any updater", async () => {
+ const directory = await mkdtemp("/tmp/ui-update-http-");
+ const old = process.env.ROOST_DATA_DIR;
+ process.env.ROOST_DATA_DIR = directory;
+ try {
+ const response = await updatesRequest(
+ new Request("https://roost.example/api/updates"),
+ );
+ assert.equal(response.status, 200);
+ assert.equal(response.headers.get("cache-control"), "private, no-store");
+ const status = await response.json();
+ assert.equal(status.capability.canActivate, false);
+ assert.equal(status.version, "dev");
+ assert.equal(status.canCheck, false);
+ assert.equal(status.csrf, null);
+ for (const path of ["/api/updates", "/api/updates/check"]) {
+ const denied = await updatesRequest(
+ new Request(`https://roost.example${path}`, {
+ method: "POST",
+ body: JSON.stringify({ unit: "arbitrary.service" }),
+ }),
+ );
+ assert.equal(denied.status, 401);
+ }
+ } finally {
+ if (old === undefined) delete process.env.ROOST_DATA_DIR;
+ else process.env.ROOST_DATA_DIR = old;
+ await rm(directory, { recursive: true, force: true });
+ }
+});
diff --git a/tests/update-artifact.test.ts b/tests/update-artifact.test.ts
new file mode 100644
index 0000000..bcfdb47
--- /dev/null
+++ b/tests/update-artifact.test.ts
@@ -0,0 +1,71 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { test } from "node:test";
+import { gzipSync } from "node:zlib";
+
+function archive(name: string, type = "0", contents = "hello") {
+ const header = Buffer.alloc(512);
+ header.write(name, 0, 100, "utf8");
+ header.write("0000644\0", 100);
+ header.write(`${contents.length.toString(8).padStart(11, "0")}\0`, 124);
+ header.fill(32, 148, 156);
+ header.write(type, 156);
+ header.write("ustar\0", 257);
+ const sum = header.reduce((a, b) => a + b, 0);
+ header.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148);
+ return gzipSync(
+ Buffer.concat([
+ header,
+ Buffer.from(contents),
+ Buffer.alloc((512 - (contents.length % 512)) % 512),
+ Buffer.alloc(1024),
+ ]),
+ );
+}
+test("bounded extractor accepts regular GNU/ustar files and refuses path/link/device/extension attacks", async () => {
+ const root = await mkdtemp("/tmp/roost-extraction-");
+ try {
+ const file = join(root, "release.gz");
+ await writeFile(file, archive("./directory/file"));
+ execFileSync(
+ "/usr/bin/python3",
+ ["src/updater/extract.py", file, join(root, "good")],
+ { stdio: "pipe" },
+ );
+ assert.equal(
+ await readFile(join(root, "good/directory/file"), "utf8"),
+ "hello",
+ );
+ let n = 0;
+ for (const [name, type] of [
+ ["../escape", "0"],
+ ["/absolute", "0"],
+ ["link", "2"],
+ ["hardlink", "1"],
+ ["device", "3"],
+ ["pax", "x"],
+ ["file", "6"],
+ ]) {
+ await writeFile(file, archive(name!, type));
+ assert.throws(() =>
+ execFileSync(
+ "/usr/bin/python3",
+ ["src/updater/extract.py", file, join(root, `bad-${n++}`)],
+ { stdio: "pipe" },
+ ),
+ );
+ }
+ await writeFile(file, gzipSync(Buffer.alloc(700)));
+ assert.throws(() =>
+ execFileSync(
+ "/usr/bin/python3",
+ ["src/updater/extract.py", file, join(root, "truncated")],
+ { stdio: "pipe" },
+ ),
+ );
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});
diff --git a/tests/update-auth-readiness.test.ts b/tests/update-auth-readiness.test.ts
new file mode 100644
index 0000000..45b7261
--- /dev/null
+++ b/tests/update-auth-readiness.test.ts
@@ -0,0 +1,52 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { test } from "node:test";
+import { verifyAuthReadiness } from "../src/server/auth/readiness.server";
+import { AuthStore } from "../src/server/auth/store.server";
+
+test("candidate auth checks reject malformed JSON, lost credentials and missing API tables without writing", () => {
+ const root = mkdtempSync("/tmp/roost-auth-readiness-");
+ const store = new AuthStore(root);
+ store.setup("http://localhost:4195");
+ store.close();
+ const db = new DatabaseSync(join(root, "auth.sqlite"));
+ try {
+ verifyAuthReadiness(db);
+ const original = db
+ .prepare("SELECT value FROM config WHERE id=1")
+ .get()!.value;
+ for (const bad of [
+ "{",
+ JSON.stringify({
+ ...JSON.parse(String(original)),
+ origin: "http://untrusted.test",
+ }),
+ JSON.stringify({ ...JSON.parse(String(original)), bootstrap: null }),
+ JSON.stringify({ ...JSON.parse(String(original)), expires: 1 }),
+ ]) {
+ db.prepare("UPDATE config SET value=?").run(bad);
+ assert.throws(() => verifyAuthReadiness(db));
+ }
+ db.prepare("UPDATE config SET value=?").run(original);
+ db.prepare("INSERT INTO credentials VALUES (?,?)").run("bad", "{}");
+ assert.throws(() => verifyAuthReadiness(db));
+ db.exec("DELETE FROM credentials; DROP TABLE sessions");
+ assert.throws(() => verifyAuthReadiness(db));
+ db.exec(
+ "CREATE TABLE sessions(id TEXT,credential TEXT,created INTEGER,expires INTEGER)",
+ );
+ const readonly = new DatabaseSync(join(root, "auth.sqlite"), {
+ readOnly: true,
+ });
+ try {
+ verifyAuthReadiness(readonly);
+ } finally {
+ readonly.close();
+ }
+ } finally {
+ db.close();
+ rmSync(root, { recursive: true, force: true });
+ }
+});
diff --git a/tests/update-download.test.ts b/tests/update-download.test.ts
new file mode 100644
index 0000000..22147db
--- /dev/null
+++ b/tests/update-download.test.ts
@@ -0,0 +1,380 @@
+import assert from "node:assert/strict";
+import { execFileSync, spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { once } from "node:events";
+import {
+ chmod,
+ mkdir,
+ mkdtemp,
+ readFile,
+ rm,
+ writeFile,
+} from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { test } from "node:test";
+import { activate } from "../src/cli/releases";
+import { readSchemaVersions, stageArtifact } from "../src/updater/artifact";
+import { parseOffer } from "../src/updater/releases";
+
+test("staging schema reads wait for transient writers and bound persistent contention", async () => {
+ const root = await mkdtemp("/tmp/roost-schema-lock-");
+ try {
+ await mkdir(join(root, "data"));
+ for (const name of ["roost.sqlite", "auth.sqlite"]) {
+ const db = new DatabaseSync(join(root, "data", name));
+ db.exec(`PRAGMA user_version=${name === "roost.sqlite" ? 10 : 0}`);
+ db.close();
+ }
+ for (const [name, transient] of [
+ ["roost.sqlite", true],
+ ["auth.sqlite", true],
+ ["auth.sqlite", false],
+ ] as const) {
+ const writer = spawn(
+ process.execPath,
+ [
+ "--input-type=module",
+ "-e",
+ `import {DatabaseSync} from 'node:sqlite';
+ const db=new DatabaseSync(process.argv[1]);
+ db.exec('BEGIN EXCLUSIVE');
+ process.stdout.write('locked\\n');
+ process.stdin.once('data',()=>setTimeout(()=>{db.exec('COMMIT');db.close();process.exit(0)},200));`,
+ join(root, "data", name),
+ ],
+ { stdio: ["pipe", "pipe", "ignore"] },
+ );
+ const exited = once(writer, "exit");
+ try {
+ assert.equal(
+ String((await once(writer.stdout!, "data"))[0]),
+ "locked\n",
+ );
+ if (transient) writer.stdin!.write("release\n");
+ const start = Date.now();
+ if (transient) {
+ assert.deepEqual(readSchemaVersions(root), { app: 10, auth: 0 });
+ assert.ok(
+ Date.now() - start >= 100,
+ "The actual writer lock was reached",
+ );
+ } else {
+ assert.throws(() => readSchemaVersions(root), /database is locked/);
+ assert.ok(Date.now() - start >= 4500);
+ assert.ok(Date.now() - start < 10000);
+ }
+ } finally {
+ if (!transient && writer.exitCode === null)
+ writer.stdin!.end("release\n");
+ await exited;
+ }
+ }
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});
+
+test("pinned download validates identity/digest/manifest and strips credentials on trusted redirects", async () => {
+ const root = await mkdtemp("/tmp/roost-download-");
+ const compatibility = {
+ protocol: 1,
+ startupGate: 1,
+ app: { min: 10, max: 10, output: 10 },
+ auth: { min: 0, max: 0, output: 0 },
+ data: "complete-snapshot-v1",
+ externalState: "unchanged",
+ codex: "0.153.4",
+ };
+ const manifest = {
+ schema: 1,
+ version: "0.1.40",
+ platform: "linux",
+ arch: "x64",
+ node: "24.15.0",
+ codex: "0.153.4",
+ };
+ try {
+ await mkdir(join(root, "data"));
+ for (const name of ["roost.sqlite", "auth.sqlite"]) {
+ const db = new DatabaseSync(join(root, "data", name));
+ db.exec(`PRAGMA user_version=${name === "roost.sqlite" ? 10 : 0}`);
+ db.close();
+ }
+ for (const version of ["0.1.40", "0.1.41"]) {
+ const target = join(
+ root,
+ version === "0.1.40" ? "releases" : "fixture",
+ version,
+ );
+ for (const [path, contents] of Object.entries({
+ "release.json": JSON.stringify({ ...manifest, version }),
+ "compatibility.json": JSON.stringify(compatibility),
+ "runtime/node": "#!/bin/sh\necho v24.15.0\n",
+ "runtime/codex/bin/codex": "#!/bin/sh\necho codex-cli 0.153.4\n",
+ "cli/roost.mjs": "export {};",
+ "app/server/index.mjs": "export {};",
+ "bin/roost": "#!/bin/sh\n",
+ })) {
+ await mkdir(join(target, path, ".."), { recursive: true });
+ await writeFile(join(target, path), contents);
+ await chmod(join(target, path), 0o700);
+ }
+ }
+ await activate(root, join(root, "releases", "0.1.40"));
+ const archive = join(root, "fixture.tar.gz");
+ execFileSync("tar", [
+ "--format=gnu",
+ "-czf",
+ archive,
+ "-C",
+ join(root, "fixture", "0.1.41"),
+ ".",
+ ]);
+ const bytes = await readFile(archive);
+ const metadata = {
+ id: 1,
+ tag_name: "v0.1.41",
+ draft: false,
+ prerelease: false,
+ assets: [
+ {
+ id: 2,
+ name: "roost-linux-x64.tar.gz",
+ size: bytes.length,
+ digest: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
+ url: "https://api.github.com/repos/srctl/roost/releases/assets/2",
+ },
+ ],
+ };
+ const offer = parseOffer(metadata, "srctl/roost", Date.now());
+ for (const mode of [
+ "changed",
+ "evil-redirect",
+ "bad-digest",
+ "success",
+ "retry",
+ ] as const) {
+ let calls = 0;
+ const fetcher = (async (url, init) => {
+ calls++;
+ if (calls === 1)
+ return Response.json(
+ mode === "changed"
+ ? {
+ ...metadata,
+ assets: [
+ {
+ ...metadata.assets[0],
+ id: 3,
+ url: "https://api.github.com/repos/srctl/roost/releases/assets/3",
+ },
+ ],
+ }
+ : metadata,
+ );
+ if (calls === 2) {
+ assert.equal(
+ new Headers(init?.headers).get("authorization"),
+ "Bearer private-token",
+ );
+ return new Response(null, {
+ status: 302,
+ headers: {
+ location:
+ mode === "evil-redirect"
+ ? "https://evil.example/payload"
+ : "https://release-assets.githubusercontent.com/payload",
+ },
+ });
+ }
+ assert.equal(
+ String(url),
+ "https://release-assets.githubusercontent.com/payload",
+ );
+ assert.equal(new Headers(init?.headers).get("authorization"), null);
+ return new Response(
+ mode === "bad-digest" ? Buffer.alloc(bytes.length) : bytes,
+ );
+ }) as typeof fetch;
+ const id = randomUUID();
+ await mkdir(join(root, "updates", id), { recursive: true });
+ const run = stageArtifact(
+ root,
+ offer,
+ id,
+ resolve("src/updater"),
+ new AbortController().signal,
+ () => {},
+ "private-token",
+ fetcher,
+ );
+ if (["success", "retry"].includes(mode)) await run;
+ else await assert.rejects(run);
+ assert.equal(
+ await readFile(join(root, "current", "release.json"), "utf8"),
+ JSON.stringify(manifest),
+ );
+ }
+ const fixture = join(root, "fixture", "0.1.41");
+ const validManifest = { ...manifest, version: "0.1.41" };
+ for (const [name, file, contents, error] of [
+ [
+ "tag",
+ "release.json",
+ JSON.stringify({ ...validManifest, version: "0.1.42" }),
+ /Manifest\/tag mismatch/,
+ ],
+ [
+ "platform",
+ "release.json",
+ JSON.stringify({ ...validManifest, arch: "arm64" }),
+ /invalid Roost release manifest/,
+ ],
+ [
+ "protocol",
+ "compatibility.json",
+ JSON.stringify({ ...compatibility, protocol: 2 }),
+ /compatibility contract/,
+ ],
+ [
+ "app schema",
+ "compatibility.json",
+ JSON.stringify({
+ ...compatibility,
+ app: { min: 11, max: 11, output: 11 },
+ }),
+ /Database or bundled Codex compatibility/,
+ ],
+ [
+ "auth schema",
+ "compatibility.json",
+ JSON.stringify({
+ ...compatibility,
+ auth: { min: 1, max: 1, output: 1 },
+ }),
+ /Database or bundled Codex compatibility/,
+ ],
+ [
+ "Codex",
+ "compatibility.json",
+ JSON.stringify({ ...compatibility, codex: "0.154.0" }),
+ /Database or bundled Codex compatibility/,
+ ],
+ [
+ "startup gate",
+ "compatibility.json",
+ JSON.stringify({ ...compatibility, startupGate: 0 }),
+ /startup verification gate/,
+ ],
+ [
+ "runtime version substring",
+ "runtime/node",
+ "#!/bin/sh\necho v124.15.0\n",
+ /Bundled runtime cannot execute/,
+ ],
+ ["runtime ABI", "runtime/node", "#!/unavailable-abi-interpreter\n", /./],
+ ] as const) {
+ const original = await readFile(join(fixture, file));
+ try {
+ await writeFile(join(fixture, file), contents);
+ execFileSync("tar", [
+ "--format=gnu",
+ "-czf",
+ archive,
+ "-C",
+ fixture,
+ ".",
+ ]);
+ const payload = await readFile(archive);
+ const release = {
+ ...metadata,
+ assets: [
+ {
+ ...metadata.assets[0]!,
+ size: payload.length,
+ digest: `sha256:${createHash("sha256").update(payload).digest("hex")}`,
+ },
+ ],
+ };
+ const invalid = parseOffer(release, "srctl/roost", Date.now());
+ const id = randomUUID();
+ await mkdir(join(root, "updates", id), { recursive: true });
+ let calls = 0;
+ const fetcher = (async () =>
+ ++calls === 1
+ ? Response.json(release)
+ : new Response(payload)) as typeof fetch;
+ await assert.rejects(
+ stageArtifact(
+ root,
+ invalid,
+ id,
+ resolve("src/updater"),
+ new AbortController().signal,
+ () => {},
+ undefined,
+ fetcher,
+ ),
+ error,
+ name,
+ );
+ assert.equal(
+ calls,
+ 2,
+ `${name}: artifact must reach actual validation`,
+ );
+ assert.equal(
+ await readFile(join(root, "current", "release.json"), "utf8"),
+ JSON.stringify(manifest),
+ );
+ } finally {
+ await writeFile(join(fixture, file), original);
+ }
+ }
+ for (const prior of [
+ { ...compatibility, app: { min: 0, max: 9, output: 9 } },
+ { ...compatibility, codex: "0.154.0" },
+ ]) {
+ await writeFile(
+ join(root, "current", "compatibility.json"),
+ JSON.stringify(prior),
+ );
+ const id = randomUUID();
+ await mkdir(join(root, "updates", id), { recursive: true });
+ let calls = 0;
+ const fetcher = (async () =>
+ ++calls === 1
+ ? Response.json(metadata)
+ : new Response(bytes)) as typeof fetch;
+ await assert.rejects(
+ stageArtifact(
+ root,
+ offer,
+ id,
+ resolve("src/updater"),
+ new AbortController().signal,
+ () => {},
+ undefined,
+ fetcher,
+ ),
+ /Database or bundled Codex compatibility/,
+ );
+ }
+ await writeFile(
+ join(root, "current", "compatibility.json"),
+ JSON.stringify(compatibility),
+ );
+ assert.equal(
+ JSON.parse(
+ await readFile(
+ join(root, "releases", "0.1.41", "release.json"),
+ "utf8",
+ ),
+ ).version,
+ "0.1.41",
+ );
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});
diff --git a/tests/update-drafts.test.ts b/tests/update-drafts.test.ts
new file mode 100644
index 0000000..34e5829
--- /dev/null
+++ b/tests/update-drafts.test.ts
@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { readDraft, saveDraft } from "../src/features/updates/drafts";
+import { rememberResult } from "../src/features/updates/state";
+
+function storage() {
+ const values: Record = {};
+ return new Proxy(values, {
+ get: (target, key) =>
+ key === "getItem"
+ ? (k: string) => target[k] ?? null
+ : key === "setItem"
+ ? (k: string, v: string) => {
+ target[k] = v;
+ }
+ : target[String(key)],
+ });
+}
+test("drafts survive reload, preserve independent tab text, and do not revive sent prompts", () => {
+ const oldLocal = Object.getOwnPropertyDescriptor(globalThis, "localStorage");
+ const oldSession = Object.getOwnPropertyDescriptor(
+ globalThis,
+ "sessionStorage",
+ );
+ try {
+ Object.defineProperty(globalThis, "localStorage", {
+ configurable: true,
+ value: storage(),
+ });
+ const first = storage();
+ Object.defineProperty(globalThis, "sessionStorage", {
+ configurable: true,
+ value: first,
+ });
+ saveDraft("agent", "unsent text", []);
+ assert.equal(readDraft("agent")?.text, "unsent text");
+ assert.equal(readDraft("different"), null);
+ Object.defineProperty(globalThis, "sessionStorage", {
+ configurable: true,
+ value: storage(),
+ });
+ assert.equal(readDraft("agent")?.text, "unsent text");
+ saveDraft("agent", "other tab", []);
+ Object.defineProperty(globalThis, "sessionStorage", {
+ configurable: true,
+ value: first,
+ });
+ assert.equal(readDraft("agent")?.text, "unsent text");
+ saveDraft("agent", "", []);
+ assert.equal(readDraft("agent")?.text, "");
+ assert.throws(() => saveDraft("agent", "x".repeat(2 * 1024 * 1024), []));
+ } finally {
+ if (oldLocal) Object.defineProperty(globalThis, "localStorage", oldLocal);
+ else Reflect.deleteProperty(globalThis, "localStorage");
+ if (oldSession)
+ Object.defineProperty(globalThis, "sessionStorage", oldSession);
+ else Reflect.deleteProperty(globalThis, "sessionStorage");
+ }
+});
+
+test("unavailable browser storage is reported separately from connectivity", () => {
+ const old = Object.getOwnPropertyDescriptor(globalThis, "localStorage");
+ try {
+ Object.defineProperty(globalThis, "localStorage", {
+ configurable: true,
+ value: {
+ setItem() {
+ throw new Error("disabled");
+ },
+ },
+ });
+ assert.equal(rememberResult(null), true);
+ assert.equal(
+ rememberResult({
+ id: "operation",
+ requestKey: "key",
+ phase: "accepted",
+ previous: "0.1.40",
+ version: "0.1.41",
+ updatedAt: Date.now(),
+ cancellable: true,
+ committed: false,
+ error: undefined,
+ blockers: undefined,
+ bytes: undefined,
+ }),
+ false,
+ );
+ } finally {
+ if (old) Object.defineProperty(globalThis, "localStorage", old);
+ else Reflect.deleteProperty(globalThis, "localStorage");
+ }
+});
diff --git a/tests/update-engine.test.ts b/tests/update-engine.test.ts
new file mode 100644
index 0000000..0082222
--- /dev/null
+++ b/tests/update-engine.test.ts
@@ -0,0 +1,577 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import fs, {
+ chmod,
+ mkdir,
+ mkdtemp,
+ readFile,
+ realpath,
+ rm,
+ writeFile,
+} from "node:fs/promises";
+import { syncBuiltinESMExports } from "node:module";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { mock, test } from "node:test";
+import { activate } from "../src/cli/releases";
+import { maintenance } from "../src/cli/state";
+import {
+ type EngineAdapter,
+ SimulatedPowerLoss,
+ UpdateEngine,
+} from "../src/updater/engine";
+import { enrollmentFiles } from "../src/updater/enrollment";
+import { readGate } from "../src/updater/gate";
+import { parseOffer } from "../src/updater/releases";
+
+async function fixture(
+ run: (
+ root: string,
+ adapter: EngineAdapter,
+ control: { fail: boolean; busy: boolean; running: boolean; stops: number },
+ ) => Promise,
+) {
+ const root = await mkdtemp("/tmp/roost-engine-");
+ await mkdir(join(root, "data"), { mode: 0o700 });
+ await mkdir(join(root, "releases", "0.1.40"), { recursive: true });
+ await mkdir(join(root, "releases", "0.2.0"));
+ await activate(root, join(root, "releases", "0.1.40"));
+ await writeFile(join(root, "config.json"), JSON.stringify({ root }), {
+ mode: 0o600,
+ });
+ for (const name of ["roost.sqlite", "auth.sqlite"]) {
+ const db = new DatabaseSync(join(root, "data", name));
+ db.exec(
+ "CREATE TABLE data(value TEXT); INSERT INTO data VALUES('old'); CREATE TABLE runtime_control(id INTEGER, maintenance INTEGER); INSERT INTO runtime_control VALUES(1,0)",
+ );
+ db.close();
+ await chmod(join(root, "data", name), 0o600);
+ }
+ await writeFile(join(root, "data", "secret"), "original", { mode: 0o600 });
+ const control = { fail: false, busy: false, running: true, stops: 0 };
+ const adapter: EngineAdapter = {
+ running: async () => control.running,
+ stage: async (_offer, _id, signal, progress) => {
+ signal.throwIfAborted();
+ progress(123);
+ },
+ preflight: async () => {},
+ admission: async (blocked) => maintenance(root, blocked),
+ blockers: async () => (control.busy ? ["uncertain worker"] : []),
+ stop: async () => {
+ control.stops++;
+ control.running = false;
+ },
+ start: async () => {
+ control.running = true;
+ },
+ probe: async (version, id, token) => {
+ const db = new DatabaseSync(join(root, "data", "roost.sqlite"), {
+ readOnly: true,
+ });
+ assert.equal(
+ db.prepare("SELECT maintenance FROM runtime_control WHERE id=1").get()
+ ?.maintenance,
+ 1,
+ );
+ db.close();
+ assert.equal(readGate(root).mode, "verify");
+ assert.equal(readGate(root).token, token);
+ assert.equal(readGate(root).operation, id);
+ if (version === "0.2.0") {
+ await writeFile(join(root, "data", "secret"), "candidate");
+ if (control.fail) throw new Error("bad startup");
+ }
+ },
+ };
+ try {
+ await run(root, adapter, control);
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+}
+function request() {
+ const offer = parseOffer(
+ {
+ id: 1,
+ tag_name: "v0.2.0",
+ draft: false,
+ prerelease: false,
+ assets: [
+ {
+ id: 2,
+ name: "roost-linux-x64.tar.gz",
+ digest: `sha256:${"a".repeat(64)}`,
+ size: 123,
+ url: "https://api.github.com/repos/srctl/roost/releases/assets/2",
+ },
+ ],
+ },
+ "srctl/roost",
+ Date.now(),
+ );
+ return {
+ actor: "b".repeat(64),
+ key: randomUUID(),
+ offer,
+ confirmedVersion: offer.version,
+ };
+}
+
+test("full engine commits once, preserves candidate data, and keeps prior stopped state", async () => {
+ for (const running of [true, false])
+ await fixture(async (root, adapter, c) => {
+ c.running = running;
+ const engine = new UpdateEngine(root, adapter);
+ const input = request();
+ const accepted = await engine.accept(input);
+ await engine.settled();
+ assert.equal((await engine.status())?.phase, "succeeded");
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", "0.2.0"),
+ );
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ "candidate",
+ );
+ assert.equal(c.running, running);
+ assert.equal(readGate(root).mode, "open");
+ assert.equal((await engine.accept(input)).id, accepted.id);
+ await assert.rejects(
+ engine.accept({ ...input, confirmedVersion: "0.3.0" }),
+ );
+ });
+});
+test("startup failure restores matching data/release and preserves failed evidence", async () =>
+ fixture(async (root, adapter, c) => {
+ c.fail = true;
+ const engine = new UpdateEngine(root, adapter);
+ const accepted = await engine.accept(request());
+ await engine.settled();
+ assert.equal((await engine.status())?.phase, "rolled-back");
+ const diagnostic = JSON.parse(
+ await readFile(
+ join(root, "updates", accepted.id, "diagnostic.json"),
+ "utf8",
+ ),
+ );
+ assert.equal(diagnostic.message, "bad startup");
+ assert.doesNotMatch((await engine.status())!.error!, /bad startup/);
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", "0.1.40"),
+ );
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ "original",
+ );
+ assert.equal(
+ await readFile(
+ join(root, "updates", accepted.id, "failed-data", "secret"),
+ "utf8",
+ ),
+ "candidate",
+ );
+ assert.equal(readGate(root).mode, "open");
+ }));
+test("busy/uncertain work defers without stopping or replay; cancellation is durable", async () =>
+ fixture(async (root, adapter, c) => {
+ c.busy = true;
+ const engine = new UpdateEngine(root, adapter, 10);
+ await engine.accept(request());
+ await engine.settled();
+ assert.equal((await engine.status())?.phase, "deferred");
+ assert.equal(c.stops, 0);
+ assert.equal(readGate(root).mode, "open");
+ const next = new UpdateEngine(root, adapter, 5000);
+ const op = await next.accept(request());
+ await Promise.all([next.cancel(op.id), next.cancel(op.id)]);
+ await assert.rejects(next.cancel(randomUUID()), /Unknown/);
+ await next.settled();
+ assert.equal((await next.status())?.phase, "cancelled");
+ assert.equal(c.stops, 0);
+ assert.ok(await readFile(join(root, "updates", op.id, "cancel.json")));
+ }));
+test("simulated power loss at intent and rename boundaries recovers deterministically", async () => {
+ for (const phase of [
+ "accepted",
+ "staged",
+ "draining",
+ "stopping",
+ "service-stopped",
+ "snapshot-complete",
+ "activating",
+ "pointer-renamed-before-sync",
+ "pointer-renamed",
+ "verifying",
+ "service-started",
+ "committed",
+ "admission-open",
+ "before-journal-staged",
+ "before-journal-draining",
+ "before-journal-stopping",
+ "before-journal-snapshot-complete",
+ "before-journal-activating",
+ "before-journal-verifying",
+ "before-journal-committed",
+ "before-journal-succeeded",
+ ]) {
+ await fixture(async (root, adapter, _c) => {
+ let tripped = false;
+ const engine = new UpdateEngine(root, adapter, 1000, async (point) => {
+ if (!tripped && point === phase) {
+ tripped = true;
+ throw new SimulatedPowerLoss();
+ }
+ });
+ await engine.accept(request());
+ await engine.settled();
+ assert.ok(tripped, phase);
+ const recovery = new UpdateEngine(root, adapter);
+ await recovery.recover();
+ const committed = [
+ "committed",
+ "admission-open",
+ "before-journal-succeeded",
+ ].includes(phase);
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", committed ? "0.2.0" : "0.1.40"),
+ phase,
+ );
+ assert.equal(readGate(root).mode, "open", phase);
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ committed ? "candidate" : "original",
+ phase,
+ );
+ });
+ }
+});
+test("interrupted rollback resumes rename boundaries without overwriting failed data", async () => {
+ for (const phase of [
+ "failed-data-renamed-before-sync",
+ "failed-data-renamed",
+ "restored-data-renamed-before-sync",
+ "restored-data-renamed",
+ "rollback-pointer-renamed-before-sync",
+ "rollback-pointer-renamed",
+ "rollback-service-started",
+ ]) {
+ await fixture(async (root, adapter, c) => {
+ c.fail = true;
+ let tripped = false;
+ const engine = new UpdateEngine(root, adapter, 1000, async (point) => {
+ if (point === phase && !tripped) {
+ tripped = true;
+ throw new SimulatedPowerLoss();
+ }
+ });
+ const op = await engine.accept(request());
+ await engine.settled();
+ assert.ok(tripped);
+ await new UpdateEngine(root, adapter).recover();
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ "original",
+ );
+ assert.equal(
+ await readFile(
+ join(root, "updates", op.id, "failed-data", "secret"),
+ "utf8",
+ ),
+ "candidate",
+ );
+ });
+ }
+});
+test("corrupt complete snapshot fails closed and never pairs old code with candidate data", async () =>
+ fixture(async (root, adapter, _c) => {
+ const engine = new UpdateEngine(root, adapter, 1000, async (phase) => {
+ if (phase === "verifying") throw new SimulatedPowerLoss();
+ });
+ const op = await engine.accept(request());
+ await engine.settled();
+ await writeFile(
+ join(root, "updates", op.id, "snapshot", "secret"),
+ "corrupt",
+ );
+ await new UpdateEngine(root, adapter).recover();
+ assert.equal(readGate(root).mode, "manual");
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", "0.2.0"),
+ );
+ }));
+test("enrollment policy grants only fixed-unit start/stop and pins helper outside current", () => {
+ const files = enrollmentFiles(
+ {
+ root: "/home/roost/install",
+ home: "/home/roost",
+ user: "roost",
+ uid: 1000,
+ port: 3000,
+ },
+ "0.2.0",
+ );
+ assert.match(
+ files.policy,
+ /NOPASSWD: \/usr\/bin\/systemctl start roost-1000.service, \/usr\/bin\/systemctl stop roost-1000.service/,
+ );
+ assert.doesNotMatch(files.policy, /\*/);
+ assert.match(files.unit, /releases\/0.2.0\/runtime\/node/);
+ assert.doesNotMatch(files.unit, /current/);
+ assert.match(files.dropin, /After=roost-1000-updater.service/);
+ assert.doesNotMatch(files.dropin, /EnvironmentFile|start.env/);
+});
+
+test("post-commit failure never restores data and repair only resumes the committed candidate", async () =>
+ fixture(async (root, adapter, _c) => {
+ let interrupted = false;
+ const engine = new UpdateEngine(root, adapter, 1000, async (phase) => {
+ if (phase === "admission-open" && !interrupted) {
+ interrupted = true;
+ await writeFile(join(root, "data", "secret"), "new work after commit");
+ throw new Error("lost commit acknowledgement");
+ }
+ });
+ const op = await engine.accept(request());
+ await engine.settled();
+ assert.equal((await engine.status())?.phase, "manual-recovery");
+ assert.equal((await engine.status())?.committed, true);
+ await assert.rejects(engine.repair(op.id, "restore", "0.1.40"));
+ adapter.probe = async () => {};
+ await engine.repair(op.id, "resume", "0.2.0");
+ assert.equal((await engine.status())?.phase, "succeeded");
+ assert.equal((await engine.status())?.error, undefined);
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ "new work after commit",
+ );
+ }));
+
+test("concurrent UI/CLI engine owners cannot both accept or stop work", async () =>
+ fixture(async (root, adapter, control) => {
+ control.busy = true;
+ const one = new UpdateEngine(root, adapter, 10000);
+ const two = new UpdateEngine(root, adapter, 10000);
+ const first = request(),
+ second = request();
+ const results = await Promise.allSettled([
+ one.accept(first),
+ two.accept(second),
+ ]);
+ assert.equal(results.filter((r) => r.status === "fulfilled").length, 1);
+ const winner = results[0]!.status === "fulfilled" ? one : two;
+ const op = await winner.status();
+ await winner.cancel(op!.id);
+ await winner.settled();
+ assert.equal(control.stops, 0);
+ }));
+
+test("storage failures preserve a recoverable pair and never claim a commit", async () => {
+ for (const fault of [
+ "bytes",
+ "inodes",
+ "snapshot-copy",
+ "snapshot-fsync",
+ "restore-copy",
+ "restore-fsync",
+ ])
+ await fixture(async (root, adapter, control) => {
+ let injected = 0;
+ control.fail = fault.startsWith("restore");
+ const cp = fs.cp;
+ const open = fs.open;
+ const statfs = fs.statfs;
+ if (fault === "bytes" || fault === "inodes")
+ mock.method(
+ fs,
+ "statfs",
+ async (...args: Parameters) => {
+ const result = await statfs(...args);
+ injected++;
+ return {
+ ...result,
+ ...(fault === "bytes" ? { bavail: 0n } : { ffree: 0n }),
+ };
+ },
+ );
+ if (fault.endsWith("copy"))
+ mock.method(fs, "cp", async (...args: Parameters) => {
+ if (
+ String(args[1]).includes(
+ fault.startsWith("restore") ? "/restore" : "/snapshot/",
+ )
+ ) {
+ injected++;
+ throw Object.assign(new Error("Injected copy I/O failure"), {
+ code: "EIO",
+ });
+ }
+ return cp(...args);
+ });
+ if (fault.endsWith("fsync"))
+ mock.method(fs, "open", async (...args: Parameters) => {
+ const handle = await open(...args);
+ if (
+ String(args[0]).includes(
+ fault.startsWith("restore") ? "/restore/" : "/snapshot/",
+ )
+ )
+ handle.sync = async () => {
+ injected++;
+ throw Object.assign(new Error("Injected fsync I/O failure"), {
+ code: "EIO",
+ });
+ };
+ return handle;
+ });
+ syncBuiltinESMExports();
+ const engine = new UpdateEngine(root, adapter);
+ try {
+ await engine.accept(request());
+ await engine.settled();
+ assert.ok(injected > 0, `Fault must actually be reached: ${fault}`);
+ assert.equal((await engine.status())?.committed, false);
+ if (fault.startsWith("restore")) {
+ assert.equal((await engine.status())?.phase, "manual-recovery");
+ assert.equal(readGate(root).mode, "manual");
+ const operation = (await engine.status())!;
+ assert.equal(
+ await readFile(
+ join(root, "updates", operation.id, "snapshot", "secret"),
+ "utf8",
+ ),
+ "original",
+ );
+ } else {
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", "0.1.40"),
+ );
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ "original",
+ );
+ }
+ } finally {
+ mock.restoreAll();
+ syncBuiltinESMExports();
+ }
+ if (fault.startsWith("restore")) {
+ const operation = (await engine.status())!;
+ await engine.repair(operation.id, "restore", "0.1.40");
+ assert.equal((await engine.status())?.phase, "rolled-back");
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ "original",
+ );
+ }
+ });
+});
+
+test("failed rollback startup holds the restored pair for explicit repair", async () =>
+ fixture(async (root, adapter) => {
+ const probe = adapter.probe;
+ adapter.probe = async () => {
+ throw new Error("Both releases fail their startup probes");
+ };
+ const engine = new UpdateEngine(root, adapter);
+ const operation = await engine.accept(request());
+ await engine.settled();
+ assert.equal((await engine.status())?.phase, "manual-recovery");
+ assert.equal(readGate(root).mode, "manual");
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", "0.1.40"),
+ );
+ assert.equal(
+ await readFile(join(root, "data", "secret"), "utf8"),
+ "original",
+ );
+ adapter.probe = probe;
+ await engine.repair(operation.id, "restore", "0.1.40");
+ assert.equal((await engine.status())?.phase, "rolled-back");
+ }));
+
+test("interruption before durable acceptance does not acknowledge or invent an operation", async () =>
+ fixture(async (root, adapter, control) => {
+ let reached = false;
+ const engine = new UpdateEngine(root, adapter, 1000, async (phase) => {
+ if (phase === "before-journal-accepted") {
+ reached = true;
+ throw new SimulatedPowerLoss();
+ }
+ });
+ await assert.rejects(engine.accept(request()), SimulatedPowerLoss);
+ await engine.settled();
+ assert.equal(reached, true);
+ assert.equal((await engine.records()).length, 0);
+ await new UpdateEngine(root, adapter).recover();
+ assert.equal(control.stops, 0);
+ assert.equal(readGate(root).mode, "open");
+ }));
+
+test("acceptance fsync failure after rename is not acknowledged or left falsely running", async () =>
+ fixture(async (root, adapter, control) => {
+ const open = fs.open;
+ let injected = false;
+ mock.method(fs, "open", async (...args: Parameters) => {
+ const handle = await open(...args);
+ const path = String(args[0]);
+ if (!injected && /\/updates\/[a-f0-9-]{36}$/.test(path)) {
+ const sync = handle.sync.bind(handle);
+ handle.sync = async () => {
+ if (!injected) {
+ injected = true;
+ throw Object.assign(new Error("Injected directory fsync failure"), {
+ code: "EIO",
+ });
+ }
+ return sync();
+ };
+ }
+ return handle;
+ });
+ syncBuiltinESMExports();
+ try {
+ const engine = new UpdateEngine(root, adapter);
+ await assert.rejects(engine.accept(request()), /fsync failure/);
+ await engine.settled();
+ assert.equal(injected, true);
+ assert.equal((await engine.status())?.phase, "failed");
+ assert.equal(control.stops, 0);
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", "0.1.40"),
+ );
+ } finally {
+ mock.restoreAll();
+ syncBuiltinESMExports();
+ }
+ }));
+
+test("work becoming uncertain during shutdown defers before snapshot or activation", async () =>
+ fixture(async (root, adapter, control) => {
+ const stop = adapter.stop;
+ adapter.stop = async () => {
+ await stop();
+ control.busy = true;
+ };
+ const engine = new UpdateEngine(root, adapter);
+ const operation = await engine.accept(request());
+ await engine.settled();
+ assert.equal((await engine.status())?.phase, "deferred");
+ assert.equal(control.running, true);
+ assert.equal((await engine.status())?.committed, false);
+ await assert.rejects(
+ readFile(join(root, "updates", operation.id, "snapshot.json")),
+ );
+ assert.equal(
+ await realpath(join(root, "current")),
+ join(root, "releases", "0.1.40"),
+ );
+ assert.equal(readGate(root).mode, "open");
+ }));
diff --git a/tests/update-gate.test.ts b/tests/update-gate.test.ts
new file mode 100644
index 0000000..15b49fa
--- /dev/null
+++ b/tests/update-gate.test.ts
@@ -0,0 +1,166 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { test } from "node:test";
+import { AuthStore } from "../src/server/auth/store.server";
+import {
+ trackUpdateRequest,
+ updateGateRequest,
+} from "../src/server/update-gate.server";
+import { startupGuard, writeGate } from "../src/updater/gate";
+
+test("boot and candidate gates reject stale readiness, ordinary HTTP/auth and in-flight quiescence", async () => {
+ const root = await mkdtemp("/tmp/roost-gate-");
+ const previous = {
+ ROOST_HOME: process.env.ROOST_HOME,
+ ROOST_DATA_DIR: process.env.ROOST_DATA_DIR,
+ };
+ process.env.ROOST_HOME = root;
+ process.env.ROOST_DATA_DIR = join(root, "data");
+ try {
+ await mkdir(join(root, "updates"));
+ await writeFile(join(root, "updater.json"), "{}");
+ const boot = (
+ await readFile("/proc/sys/kernel/random/boot_id", "utf8")
+ ).trim();
+ await writeFile(
+ join(root, "updates", "ready.json"),
+ JSON.stringify({ boot: "old-boot" }),
+ );
+ await writeGate(root, { protocol: 1, operation: null, mode: "open" });
+ assert.throws(() => startupGuard(root, "0.1.41", undefined));
+ await writeFile(
+ join(root, "updates", "ready.json"),
+ JSON.stringify({ boot }),
+ );
+ startupGuard(root, "0.1.41", undefined);
+ await writeGate(root, {
+ protocol: 1,
+ operation: "operation",
+ mode: "verify",
+ version: "0.1.41",
+ token: "private-capability",
+ });
+ assert.throws(() => startupGuard(root, "0.1.41", undefined));
+ assert.throws(() => startupGuard(root, "0.1.40", "private-capability"));
+ startupGuard(root, "0.1.41", "private-capability");
+ for (const path of [
+ "/",
+ "/api/health",
+ "/auth",
+ "/auth/api/login-options",
+ "/api/updates",
+ "/api/updates/probe",
+ "/_serverFn/mutation",
+ "/api/desktop/socket",
+ ]) {
+ const response = await updateGateRequest(
+ new Request(`http://localhost${path}`),
+ );
+ assert.equal(response?.status, 503, path);
+ }
+ let release!: () => void;
+ const action = trackUpdateRequest(async () => {
+ await new Promise((r) => {
+ release = r;
+ });
+ return new Response();
+ });
+ const probe = () =>
+ updateGateRequest(
+ new Request("http://localhost/api/updates/quiescence", {
+ headers: { "X-Roost-Updater": "private-capability" },
+ }),
+ );
+ const during = await (await probe())!.json();
+ assert.equal(during.requests, 1);
+ assert.equal(during.frozen, true);
+ release();
+ await action;
+ assert.equal((await (await probe())!.json()).requests, 0);
+ await writeFile(join(root, "updates", "gate.json"), "corrupt");
+ assert.throws(() => startupGuard(root, "0.1.41", "private-capability"));
+ assert.equal(
+ (await updateGateRequest(new Request("http://localhost/auth")))?.status,
+ 503,
+ );
+ } finally {
+ for (const [key, value] of Object.entries(previous)) {
+ if (value === undefined) delete process.env[key];
+ else process.env[key] = value;
+ }
+ await rm(root, { recursive: true, force: true });
+ }
+});
+
+test("candidate probes validate referenced assets and actual native-auth storage before commit", async () => {
+ const root = await mkdtemp("/tmp/roost-probe-");
+ const keys = [
+ "ROOST_HOME",
+ "ROOST_DATA_DIR",
+ "ROOST_PUBLIC_DIR",
+ "ROOST_RELEASE_VERSION",
+ ];
+ const previous = Object.fromEntries(
+ keys.map((key) => [key, process.env[key]]),
+ );
+ Object.assign(process.env, {
+ ROOST_HOME: root,
+ ROOST_DATA_DIR: join(root, "data"),
+ ROOST_PUBLIC_DIR: join(root, "public"),
+ ROOST_RELEASE_VERSION: "0.1.41",
+ });
+ try {
+ await mkdir(join(root, "updates"));
+ await mkdir(join(root, "public", "assets"), { recursive: true });
+ await writeFile(join(root, "updater.json"), "{}");
+ await writeFile(
+ join(root, "updates", "ready.json"),
+ JSON.stringify({
+ boot: (
+ await readFile("/proc/sys/kernel/random/boot_id", "utf8")
+ ).trim(),
+ }),
+ );
+ const auth = new AuthStore(join(root, "data"));
+ auth.setup("http://localhost:4195");
+ auth.close();
+ await writeGate(root, {
+ protocol: 1,
+ operation: "probe",
+ mode: "verify",
+ version: "0.1.41",
+ token: "probe-capability",
+ });
+ for (const name of ["main.js", "decoy.js", "main.css"])
+ await writeFile(join(root, "public", "assets", name), "fixture");
+ const probe = () =>
+ updateGateRequest(
+ new Request("http://localhost/api/updates/probe", {
+ headers: { "X-Roost-Updater": "probe-capability" },
+ }),
+ () =>
+ new Response(
+ 'Software updates;
+ const body = new ReadableStream({
+ start(c) {
+ controller = c;
+ },
+ });
+ const request = new Request(`${origin}/api/updates`, {
+ method: "POST",
+ headers: {
+ cookie,
+ origin,
+ "Content-Type": "application/json",
+ "X-Roost-CSRF": status.csrf,
+ },
+ body,
+ duplex: "half",
+ } as RequestInit);
+ const pending = updatesRequest(request);
+ await new Promise((resolve) => setTimeout(resolve, 20));
+ store.revokeSession(digest(secret));
+ controller.enqueue(new TextEncoder().encode("{}"));
+ controller.close();
+ assert.equal((await pending).status, 403);
+ assert.equal(
+ (
+ await updatesRequest(
+ new Request(`${origin}/api/updates`, { headers: { cookie } }),
+ )
+ ).status,
+ 401,
+ );
+ } finally {
+ store.close();
+ if (previous === undefined) delete process.env.ROOST_DATA_DIR;
+ else process.env.ROOST_DATA_DIR = previous;
+ await rm(directory, { recursive: true, force: true });
+ }
+});
diff --git a/tests/update-socket.test.ts b/tests/update-socket.test.ts
new file mode 100644
index 0000000..bebfe5c
--- /dev/null
+++ b/tests/update-socket.test.ts
@@ -0,0 +1,82 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { mkdtemp, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { test } from "node:test";
+import { setTimeout as delay } from "node:timers/promises";
+import { updaterRequest } from "../src/updater/client";
+
+test("real private Unix transport bounds requests and routes responses through the credential-checking bridge", async () => {
+ const root = await mkdtemp("/tmp/roost-socket-");
+ const directory = join(root, "updates");
+ const { mkdir } = await import("node:fs/promises");
+ await mkdir(directory, { mode: 0o700 });
+ const child = spawn(
+ "/usr/bin/python3",
+ ["src/updater/peer-broker.py", join(directory, "helper.sock")],
+ { stdio: ["pipe", "pipe", "pipe"] },
+ );
+ const reader = createInterface({ input: child.stdout });
+ let ready!: () => void;
+ const started = new Promise((resolve) => {
+ ready = resolve;
+ });
+ reader.on("line", (line) => {
+ const frame = JSON.parse(line);
+ if (frame.ready) {
+ ready();
+ return;
+ }
+ const reply = () =>
+ child.stdin.write(
+ `${JSON.stringify({
+ id: frame.id,
+ result: {
+ value: {
+ seen: frame.message.action,
+ protocol: frame.message.protocol,
+ },
+ },
+ })}\n`,
+ );
+ if (frame.message.action === "repair") setTimeout(reply, 21000);
+ else reply();
+ });
+ try {
+ await started;
+ assert.equal(
+ (await stat(join(directory, "helper.sock"))).mode & 0o777,
+ 0o600,
+ );
+ assert.deepEqual(await updaterRequest(root, { action: "status" }), {
+ seen: "status",
+ protocol: 1,
+ });
+ await assert.rejects(
+ updaterRequest(root, { action: "status", payload: "x".repeat(9000) }),
+ /too large/,
+ );
+ // Exceeds both former 18-second broker and 20-second client limits. Status
+ // must still be observable while the same connection waits for repair.
+ const repair = updaterRequest(root, { action: "repair" });
+ await delay(100);
+ const observed = await Promise.race([
+ updaterRequest(root, { action: "status" }),
+ delay(5000).then(() => {
+ throw new Error("Status was blocked by the pending repair.");
+ }),
+ ]);
+ assert.deepEqual(observed, {
+ seen: "status",
+ protocol: 1,
+ });
+ assert.deepEqual(await repair, { seen: "repair", protocol: 1 });
+ } finally {
+ child.kill("SIGTERM");
+ await once(child, "exit");
+ reader.close();
+ await rm(root, { recursive: true, force: true });
+ }
+});
diff --git a/tests/update-work.test.ts b/tests/update-work.test.ts
new file mode 100644
index 0000000..60f0586
--- /dev/null
+++ b/tests/update-work.test.ts
@@ -0,0 +1,71 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { test } from "node:test";
+import { codingWorkUncertain, systemdAdapter } from "../src/updater/systemd";
+
+test("coding quiescence requires fresh verified idle identity; labels never substitute", () => {
+ const now = 100000;
+ const idle = {
+ status: "review",
+ observedWorking: 1,
+ lastWorkerState: "idle",
+ sessionIdentity: "owner",
+ nativeSessionId: "session",
+ lastCheckedAt: now,
+ cancelRequested: 0,
+ };
+ assert.equal(codingWorkUncertain(idle, now), false);
+ assert.equal(
+ codingWorkUncertain({ ...idle, lastWorkerState: "done" }, now),
+ false,
+ );
+ for (const patch of [
+ { status: "blocked" },
+ { status: "running" },
+ { observedWorking: 0 },
+ { lastWorkerState: "working" },
+ { lastWorkerState: "missing" },
+ { lastWorkerState: "unknown" },
+ { lastWorkerState: null },
+ { lastCheckedAt: now - 15001 },
+ { lastCheckedAt: undefined },
+ { sessionIdentity: null },
+ { nativeSessionId: null },
+ { cancelRequested: 1 },
+ { error: "identity changed" },
+ ])
+ assert.equal(
+ codingWorkUncertain({ ...idle, ...patch }, now),
+ true,
+ JSON.stringify(patch),
+ );
+ assert.equal(
+ codingWorkUncertain(
+ { status: "blocked", lastWorkerState: "not_started" },
+ now,
+ ),
+ false,
+ );
+ assert.equal(
+ codingWorkUncertain(
+ { ...idle, status: "blocked", lastWorkerState: "not_started" },
+ now,
+ ),
+ true,
+ );
+});
+
+test("unavailable work storage defers instead of granting quiescence", async () => {
+ const root = await mkdtemp("/tmp/roost-work-unavailable-");
+ try {
+ const adapter = systemdAdapter(
+ { root, user: "test", uid: 1000, home: root, port: 12345 },
+ root,
+ );
+ assert.deepEqual(await adapter.blockers(false), [
+ "Work cannot be verified because its store is unavailable.",
+ ]);
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+});