3. add verified updates and rollback for compiled installs - #2166

Note

Add verified updates and offline rollback for compiled native installs

• Adds an offline rollback command to install.sh that restores a validated previous compiled release without downloading. The update command now accepts --rollback for Bun-compiled self-updates through getSelfUpdatePlan in package-manager-cli.ts.
• Native release validation now checks release-target naming, asset file types and symlink status, archive checksums, package versions, and bounded executable probes with a 10-second timeout. Invalid releases are rejected before activation.
• Activation writes a two-line .activation-state file with intended current and previous targets, enabling recovery after interrupted link replacements. Root preparation and cleanup now recover interrupted activations, sweep orphan staging directories, and prune eligible inactive releases.
• config.getUpdateInstruction returns the application update command for Bun binaries with a detected native installation. Release manifests can carry validated native binary artifacts via getLatestPiRelease in version-check.ts.
• Risk: readNativeRollbackInstallation throws on ambiguous activation state instead of guessing; parsePackageCommand rejects --rollback combined with extension targets or non-self sources; prime_agent_native_valid_target now rejects release paths that do not match the strict version/platform/digest naming format, which may break manually-created release directories that previously passed the looser path-shape check.

^{Macroscope summarized dd43e70.}

Note

High Risk
Changes core install/update/rollback and launcher activation paths; stricter release naming and validation can reject previously tolerated layouts, and failed recovery depends on manual lock/state cleanup.

Overview
Adds self-update and offline rollback for managed compiled installs: prime-agent update (and /update) can fetch a checksum-verified archive or run install.sh --rollback to swap launchers without re-downloading.

The shell installer gains durable .activation-state journaling before symlink changes, automatic recovery on the next run, stricter release-dir validation (assets, checksum marker, version/help probes with a 10s timeout), optional PRIME_AGENT_EXPECTED_* guards for planned updates, and conservative pruning of orphan staging dirs and inactive releases when lsof shows the binary unused.

The CLI wires --rollback through package self-update, plans native updates via getNativeUpdatePlan (release manifest binaries + SHA-256), and relaunches post-update through the managed launcher instead of the running binary. Release metadata parsing keeps npm update paths working when native entries are invalid.

Docs, changelog, CI (including probe-timeout tests), and broad installer/regression tests cover interrupted activation, damaged releases, and daemon restart behavior.

^{Reviewed by Cursor Bugbot for commit dd43e70. Bugbot is set up for automated code reviews on this repo. Configure here.}