Merge pull request #62 from pavelhov/development

fix(macos): finish catalog sync before update recovery completes

Author: pavelhov

docs-site/src/content/docs/guides/macos-menu-bar.md

@@ -61,6 +61,11 @@ files or force-start the proxy. A cancellation or an old-version relaunch is not
 update or permission to restart. If Finish Update cannot complete, open **Logs** and retain the
 recovery state for diagnosis.
 
+If recovery cannot tell its own routing edit from a newer Native choice, it keeps the update pending
+instead of silently reporting success with Codex on the wrong route. **Stop CodexCommander and Quit…**
+records an explicit Off choice. Reopen the app to finish recovery in the stopped, native state, then
+choose **Start Proxy** to start CC and route Codex through it.
+
 Updater-enabled previews authenticate both the update feed and archives with Sparkle EdDSA
 signatures. They remain ad-hoc signed, **unnotarized previews**; Apple Developer ID signing and
 notarization are deferred.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codexcommander",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "private": true,
   "description": "CodexCommander — universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",

src/cli/macos-update.ts

@@ -189,6 +189,9 @@ export async function resumeProduction(transaction:MacosUpdateTransaction, autho
   live?: typeof findLiveProxy;
   inspect?: (pid:number) => Promise<Record<string,unknown>>;
   stop?: typeof stopProxyLifecycleUnderAuthority;
+  ensure?: typeof ensureProxyLifecycleUnderLock;
+  intentFingerprint?: () => string;
+  routing?: () => "owned" | "native" | "external";
 } = {}): Promise<boolean> {
   // Preparation does not touch an independent runtime's routes. A later native
   // choice is deferred until recovery, and must be published before any early
@@ -203,6 +206,16 @@ export async function resumeProduction(transaction:MacosUpdateTransaction, autho
   // A newer verified service choice supersedes the snapshot; never recreate or
   // take over that service merely to restore the previous update state.
   if (service.fingerprint !== transaction.original.supervisorFingerprint || service.kind === "independent") return true;
+  // A crash between our settings write and route publication looks like a
+  // newer native edit by metadata alone. Keep the recovery record until the
+  // intent is explicit instead of completing with the captured owned route
+  // missing. Independent/newer service choices above remain authoritative.
+  if (!restoreOwned && transaction.original.routing === "owned"
+    && transaction.latestIntent?.routing !== "native"
+    && transaction.preparationIntent !== "superseded"
+    && transaction.postPreparationFingerprint !== null
+    && transaction.postPreparationFingerprint !== (io.intentFingerprint ?? macOSUpdateIntentFingerprint)()
+    && (io.routing ?? currentRouting)() === "native") return false;
   const live = await (io.live ?? findLiveProxy)();
   if (transaction.latestIntent?.running === false || !transaction.original.running) {
     if (!live) return !service.active || (await (io.stop ?? stopProxyLifecycleUnderAuthority)({io:{attestedTargetPolicy:()=>false}},authority)).ok;
@@ -219,11 +232,17 @@ export async function resumeProduction(transaction:MacosUpdateTransaction, autho
     const info = await (io.inspect ?? (pid => admission(authority,"GET",pid)))(live.pid);
     // Exclusion admits only the one-shot recovery child. A crash after spawn may
     // leave it healthy; prove its bundle and changed birth identity before adopting.
-    return info.pid === live.pid && info.bundlePath === transaction.target.bundlePath
+    const adopted = info.pid === live.pid && info.bundlePath === transaction.target.bundlePath
       && typeof info.fingerprint === "string" && info.fingerprint !== transaction.original.process?.fingerprint
       && (transaction.original.supervision === "launchd" ? service.kind === "bundle" && service.active : !service.active);
+    if (!adopted) return false;
+    // A crash can occur after the replacement child starts but before its
+    // route and catalog sync. Re-enter the canonical lifecycle for that exact
+    // child; process identity alone does not complete the update.
+    const resumed = await (io.ensure ?? ensureProxyLifecycleUnderLock)({action:restoreOwned ? "start" : "ensure",honorAutoStart:false,ensureCompanion:false,preferService:transaction.original.supervision === "launchd"},authority);
+    return resumed.ok && resumed.state === "running";
   }
-  const resumed = await ensureProxyLifecycleUnderLock({action:restoreOwned ? "start" : "ensure",honorAutoStart:false,ensureCompanion:false,preferService:transaction.original.supervision === "launchd"},authority);
+  const resumed = await (io.ensure ?? ensureProxyLifecycleUnderLock)({action:restoreOwned ? "start" : "ensure",honorAutoStart:false,ensureCompanion:false,preferService:transaction.original.supervision === "launchd"},authority);
   return resumed.ok && resumed.state === "running";
 }
 export async function performMacOSUpdateCommand(command:MacOSUpdateCommand, io:MacOSUpdateHelperIo = {}): Promise<MacOSUpdateResult> {

tests/macos-update-helper.test.ts

@@ -109,6 +109,62 @@ test.skipIf(process.platform === "win32")("partial preparation stays excluded an
 });
 
 import { resumeProduction } from "../src/cli/macos-update";
+test.skipIf(process.platform === "win32")("adopted recovery child must complete canonical route and catalog sync",async()=>{
+  const f=fixture();await performMacOSUpdateCommand(prepare,f.io);f.replace();
+  const calls:string[]=[];let succeeds=false;
+  f.io.resume=(transaction,authority,restoreOwned)=>resumeProduction(transaction,authority,restoreOwned,{
+    service:()=>({kind:"absent",fingerprint:null,active:false}),
+    live:async()=>({pid:123,port:1234,source:"runtime"}),
+    inspect:async()=>({pid:123,bundlePath:"/Applications/Test.app",fingerprint:"child"}),
+    ensure:async options=>{calls.push(options.action!);return {schemaVersion:1,action:options.action!,ok:succeeds,state:"running",changed:false,pid:123,port:1234,message:"sync"};},
+  });
+  expect((await performMacOSUpdateCommand({action:"reconcile"},f.io)).status).toBe("blocked");
+  expect(f.store.read()?.phase).toBe("recovering");
+  succeeds=true;
+  expect((await performMacOSUpdateCommand({action:"reconcile"},f.io)).status).toBe("recovered");
+  expect(f.store.read()).toBeNull();
+  expect(calls).toEqual(["start","start"]);
+});
+test.skipIf(process.platform === "win32")("ambiguous native route after a recovery config write retains the transaction",async()=>{
+  const f=fixture();await performMacOSUpdateCommand(prepare,f.io);f.replace();
+  const authority=await f.io.authority!({includeStart:true});
+  const transaction=f.store.read()!;
+  expect(macOSUpdateResumeIntent(transaction,"newer-fingerprint").restoreOwned).toBe(false);
+  const calls:string[]=[];
+  expect(await resumeProduction(transaction,authority,false,{
+    service:()=>({kind:"absent",fingerprint:null,active:false}),
+    live:async()=>({pid:123,port:1234,source:"runtime"}),
+    inspect:async()=>({pid:123,bundlePath:"/Applications/Test.app",fingerprint:"child"}),
+    intentFingerprint:()=>"newer-fingerprint",routing:()=>"native",
+    ensure:async options=>{calls.push(options.action!);return {schemaVersion:1,action:options.action!,ok:true,state:"running",changed:false,pid:123,port:1234,message:"sync"};},
+  })).toBe(false);
+  expect(calls).toEqual([]);
+  f.store.recordOff(authority);
+  let stopped=false;
+  expect(await resumeProduction(f.store.read()!,authority,false,{
+    restoreNative:()=>({success:true,changed:false,desiredChanged:false,configChanged:false,message:"native"}),
+    service:()=>({kind:"absent",fingerprint:null,active:false}),
+    live:async()=>({pid:123,port:1234,source:"runtime"}),
+    inspect:async()=>({pid:123,bundlePath:"/Applications/Test.app",fingerprint:"child"}),
+    intentFingerprint:()=>"newer-fingerprint",routing:()=>"native",
+    stop:async()=>{stopped=true;return {schemaVersion:1,action:"stop",ok:true,state:"stopped",changed:true,pid:null,port:null,message:"stopped"};},
+  })).toBe(true);
+  expect(stopped).toBe(true);authority.releaseAll();
+});
+test.skipIf(process.platform === "win32")("independent or newer supervisor supersedes ambiguous native recovery",async()=>{
+  const f=fixture();await performMacOSUpdateCommand(prepare,f.io);f.replace();
+  const authority=await f.io.authority!({includeStart:true});
+  for (const service of [{kind:"independent" as const,fingerprint:null,active:true},{kind:"bundle" as const,fingerprint:"newer",active:true}]) {
+    expect(await resumeProduction(f.store.read()!,authority,false,{
+      service:()=>service,
+      intentFingerprint:()=>"newer-fingerprint",routing:()=>"native",
+      live:async()=>{throw Error("Independent/newer service must not be inspected");},
+      ensure:async()=>{throw Error("Independent/newer service must not be resumed");},
+      stop:async()=>{throw Error("Independent/newer service must not be stopped");},
+    })).toBe(true);
+  }
+  authority.releaseAll();
+});
 test.skipIf(process.platform === "win32")("newer OFF stops a recovery child or active bundle supervisor before clearing exclusion",async()=>{
   const f=fixture();await performMacOSUpdateCommand(prepare,f.io);await performMacOSUpdateCommand({action:"record-off"},f.io);
   const authority=await f.io.authority!({includeStart:true});let stops=0;