fix(update): prevent Windows console self-update from uninstalling itself

[BigDataDZ]

CI follow-through: #6817 proposes fixes for the three independently reproduced main-baseline test failures (Ruff import, canonical digest consumer registration, and explicit-empty receipt-guard expectation). This proposal's head is unchanged; full hosted CI remains a separate qualification.

Current qualification: rebased onto main a0fb547af9aac4e4d36f59fb05cb64eb56fd750f, head 53c6e8a9ccb006e4895138171597401ed7087d8a. The proposal source files remain byte-identical to their prior reviewed versions; fresh native validation: 49 passed, 16 POSIX skips. This includes the merged #6798 browser-fixture repair. The earlier red pytest jobs were aggregate gates with test shards skipped after browser failure, not Python assertion failures. Updated-head hosted Windows PowerShell and Release Artifacts build checks passed. The aggregate Python gate remains red after main-shared static/TypeScript failures; the same baseline fails kernel static checks and TypeScript shard 1. This is not an all-CI-green claim. Historical baseline results below remain source-pinned and are not relabeled as current-main runs.

Windows pip/pipx self-update started through loopx.exe can fail with WinError 32 after pip has already removed package files (#6804). This change refuses that invocation before installation or prompt reconciliation begins and prints an owning-interpreter python -m loopx.entrypoint retry with the original CLI arguments preserved.

The existing Python installation adapter recognizes the active distlib zip launcher; module invocation, read-only check/plan, non-Windows execution and external installation owners retain their behavior. The same guard covers execution of a previously saved plan. Argument rendering reuses the existing host-aware interpreter renderer. The install guide explains recovery, and native Windows CI now runs its argument round-trip tests.

Validation:

• Focused update/runtime, installation-owner and CLI ownership suites: 49 passed, 16 skipped (POSIX archive cases), including a real native distlib launcher and PowerShell argument round-trip with apostrophes, dollar signs, Unicode and empty values. The new regression assertions failed before implementation.
• Isolated installed-path qualification: published 1.4.0 with the exact two candidate source modules overlaid refuses native-console apply with package/launcher hashes unchanged; its exact printed PowerShell retry upgrades to published 1.4.2, with all six update stages returning zero. Fresh shells retain the unfinished task and lease, reject an invalid artifact, accept validated completion and replay the same receipt without mutation. This qualifies the patch through the real pip backend; it is not a full candidate-wheel or released-fix claim.
• Ruff, changed-source semantic advisory and diff hygiene pass. The advisory detects no new supported vocabulary carriers.
• Broader download suite: 4 failed, 57 passed, 16 skipped on native Windows. All four failures are the existing POSIX 0600 assertion in test_self_update_download.py:22; both that test and its implementation are byte-identical to the base. They do not execute the changed update path. Separate follow-up test(update): run download retry coverage on native Windows #6806 preserves POSIX permission checks and qualifies the common download assertions in Windows CI.
• Standard canary initial run: 10 of 15 checks passed; 5 failed, with all six direct hygiene/compile checks passing separately. Maintainability, full-tree semantics and public boundary passed. Failures include two POSIX installer checks (WinError 193 / missing bash), an update-plan fixture assertion reproduced on pristine base 860e42d, a CLI-output probe requiring /tmp (now reproduced and tracked in Windows: CLI output differential assumes a drive-root tmp directory #6809), and a metadata-preview smoke failure. The four download assertions also reproduce on that pristine base. The metadata smoke later passed on base and unchanged head, but further tracing found that its fake gh can be missed on Windows; those ambient passes do not prove fixture isolation. Separate test(github): keep Windows provider smokes on their fake CLI #6807 repairs both affected GitHub smokes and passes them in the isolated canary runner. The initial failures remain recorded; no fully green canary run is claimed.
• Remote browser failures at this head both time out at private-steward-scope's phone-width Settings click, matching [Bug]: private-steward-scope mobile steps skip the Goal drawer, turning the required merge gate red on main #6795 / proposed test(workspace): open the mobile Goal drawer in private-steward-scope #6798. This PR does not change that scenario. The CI follow-through comment links both job logs. Required CI remains a maintainer merge consideration.

Independent source review found no actionable defect; the reviewer independently ran the two changed test modules (44 passed, 16 skipped). Real pipx upgrade and a full candidate wheel were not independently qualified.

Scope: this prevents the demonstrated launcher-lock failure; it does not make arbitrary pip installation failures atomic or repair an already missing package. CLI entrypoint only; no new frontend/Lark capability or authority grant. The bounded refactor extends the existing command renderer rather than adding a parallel platform renderer. Runtime change is left for maintainer review and merge.

Fixes #6804

[BigDataDZ]

Follow-through at unchanged head b6d901e26d4ceea34c24721827f19df87523c86f:

• The two failing browser jobs both time out in private-steward-scope at its phone-width Settings click. This is the already-reported [Bug]: private-steward-scope mobile steps skip the Goal drawer, turning the required merge gate red on main #6795 / proposed test(workspace): open the mobile Goal drawer in private-steward-scope #6798 fix; this PR does not change that scenario. Actual logs: packaged chat, dashboard. They remain merge-check failures, not a green-CI claim.
• The four native Windows download assertions reported above now have a separate proposed correction, test(update): run download retry coverage on native Windows #6806: retain POSIX permission validation, run all shared retry/partial-byte assertions on Windows, and add the suite to Windows CI.
• Further tracing corrected the metadata-smoke attribution: it was not enough to call the initial failure an external-path flake. Its POSIX-only fake gh and hardcoded PATH separator could miss the fixture on Windows, invoking an installed CLI instead. test(github): keep Windows provider smokes on their fake CLI #6807 repairs both affected smokes, asserts exact fixture resolution and child execution, and passes both complete scripts under the isolated canary runner. The initial failed run and later ambient pass remain historical evidence, not proof of proper fixture isolation.

These are independently reviewable follow-ups, not additions to this runtime safeguard or claims that its missing cross-platform CI has passed. Runtime merge remains with the maintainer.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Exact head: 53c6e8a9ccb006e4895138171597401ed7087d8a

动机

[P2] 原生 Windows 安装态资格尚未独立验证。 当前没有复现新实现错误；REQUEST_CHANGES 针对 #6804 明确要求的原生控制台、包/任务保全与成功模块恢复证据缺口。在可用的原生 Windows 隔离环境，以当前 exact head 的普通构建安装验证真实 loopx.exe 拒绝前无安装/提示协调效果、包可导入和原合成 Todo/lease 不变，再验证输出的模块命令可通过原安装 owner 恢复并读回结果；保留完整命令、产物身份和失败。无需更改源码或扩大功能才能补齐这项证据。

通过 Windows 的 loopx.exe 升级 pip/pipx 安装的用户，需要在原安装被拆掉之前得到安全的拒绝和可继续使用的升级入口。

具体场景是用户运行 update apply：旧行为会在外层 launcher 仍存活时启动安装器，可能在卸载一部分文件后遇到占用；本修改拟先拒绝，并返回同一 Python 环境的模块命令，保留原参数。

本轮源码及普通非 editable wheel 的真实 ZIP loader/CLI 模型都在受限调用上拒绝，且未进入提示协调或安装器；check、plan、模块入口和其他入口仍走原路。原生 Windows 安装态的成功恢复仍缺少本轮独立证据。

本 PR 限于该 launcher 锁冲突的提前拒绝及重试提示，不承诺任意 pip 失败都原子回滚，也不增加 App/Lark 更新能力或授予升级权限。

改动思路

最小合理边界是既有 Python 安装 owner：在计划构建和执行保存计划两处检查实际 ZIP loader，再复用唯一的解释器命令 renderer；不需要新协议、全局配置或另一个 TypeScript/Python 决策源。

保留本次有界源码修复及 renderer 合并；完整批准还需把 #6804 的原生控制台、安装保全和模块恢复验收接到当前普通构建产物。

调用顺序很关键：当前 launcher 拒绝先于 prompt reconciliation 和 pip，执行保存计划也重新看当前入口。另一方面，check/plan 与可用模块入口必须保留，这样才有完成更新的最短合法路径。源码和普通安装包的模型均验证了这两个方向；真实 Windows 的成功续接仍未观测。

具体改动

完整 a0fb547af9aac4e4d36f59fb05cb64eb56fd750f → 53c6e8a9ccb006e4895138171597401ed7087d8a：six paths: two Python owner/runtime modules, two existing tests, the native Windows workflow list and the installation guide，+167/-4。

• _windows_console_update_refusal：Existing Python owner gains actual loader check；win32 + zipimporter + archive basename loopx.exe + pip/pipx driver。结果由 build_update_plan and saved-plan executor 消费。
• _execute_python_distribution_update：Rechecks current invocation before subprocess.run；Any still-to-execute pip/pipx plan; committed replacement is not inferred。结果由 existing package transaction pipeline 消费。
• interpreter_invocation：Optional argument list uses existing host quoting；PowerShell call operator/single-quote literal or POSIX shlex.join。结果由 refusal retry, existing doctor/rollback callers 消费。
• test_real_windows_console_refuses_before_starting_installer：New real distlib launcher test is conditional on Windows；A real PE launcher must refuse before sentinel install。结果由 native Windows workflow 消费。

规范 #6804，spec_revision=2026-10-18T08:53:12Z；Acceptance.native_console not_met：On native Windows prove refusal or replacement through the real console entry；Acceptance.original_task_lease not_met：Preserve an installed/importable CLI and the original synthetic task and lease；Acceptance.module_recovery not_met：Successful module-entry recovery; preserve incomplete-update evidence and owner behavior。

新增测试还覆盖 pip/pipx、原参数中引号/美元符号、check/plan 不变与保存计划再检查；Windows-only 用例生成真实 distlib launcher，PowerShell 用例验证特殊字符参数往返，并加入原 windows-powershell job。文档解释先用打印出的拥有者解释器运行模块入口，已损坏的包需先由该 owner 的 pip 修复；这没有自动授予新升级权限。

对主干的风险

Source and normal installed wheel each pass nine independent public-entrypoint models; four covered cases refuse before both effect boundaries, read-only cases retain their plan, unrelated/normal-module cases reach the bounded sentinel. Actual POSIX shell quoting preserves apostrophe, dollar, Unicode, empty and quote arguments.

54 Python passed, 6 conditional skips; 58 CLI/owner tests passed; changed Ruff and semantic advisory passed. Standard canary: 6 direct passed, 14/15 selected passed, install-local-smoke timed out at 120s. Same unchanged 120s runner later passed base39.562s/head41.977s; first direct base run passed with first install168.90s, preserving initial variability without claiming its cause repaired. Managed quality receipt missing.

普通 dashboard build 和 wheel 构建已完成，两处改动生产文件与 wheel 同字节，隔离 -I 运行确认来自 site-packages，9 项入口模型全部符合独立预期。模型用真实 Python ZIP loader 和真实 CLI，但 platform 是注入值，安装器/提示协调只写哨兵；未执行 PE launcher、真实 pip 更新或原生状态恢复，不能把它们标记 verified。真实 POSIX shell 的特殊参数往返和旧无参 renderer 字节兼容已过，PowerShell 仍未执行。首次缺少本地 vite bin link，经正常 npm ci 修复再普通构建；初次平台模拟在 sysconfig 初始化前切换导致导入错误，预加载真实 host CLI 后模型通过，原失败保留。这些是测试环境/脚手架修正，不能归因于产品或当作原生 Windows 证据。

Native Windows, PowerShell, real pip/pipx replacement and original native task/lease preservation remain unverified independently; source/ZIP model and Mac package evidence do not close #6804. Initial installer timeout variability retained, no CI fetched/polled/dispatched, no user installation modified.

相关方案 #6789 仍在同一安装 owner 上组合 CLI/macOS App 与进度读回，没有实现本次命名 launcher 的 Windows 拒绝；6806/6807/6816 在共享 Windows job 添加不同测试。当前 main 对本批改动路径无同义修复。读取 normalized key_files 后按实际 path 字段核对了关系，未把元数据对象误当路径或借别的 PR 的结论。没有查询、轮询、等待或触发 CI。

我的整体评价

最小合理边界是既有 Python 安装 owner：在计划构建和执行保存计划两处检查实际 ZIP loader，再复用唯一的解释器命令 renderer；不需要新协议、全局配置或另一个 TypeScript/Python 决策源。

保留本次有界源码修复及 renderer 合并；完整批准还需把 #6804 的原生控制台、安装保全和模块恢复验收接到当前普通构建产物。

结构和范围合理，renderer 复用是已应用的有界可维护性改进。但 problem_context=not_yet_proven，long_horizon/user_experience=not_yet_proven：模型拒绝尚不能证明用户在真实 Windows 中保全安装并完成下一次更新。请补原 issue 原生验收的可核证据后再给当前 head 的完整批准。无需为了本意见引入 handoff 框架、修改断言、提高超时或扩大改动。

当前投递的恢复设计经验只用于提醒检查首个有用结果与真实恢复，不据此添加无关 RFC 门，也不以本轮测试/评审数量宣称长期收益。

English verdict: REQUEST_CHANGES at 53c6e8a9ccb006e4895138171597401ed7087d8a. The bounded owner/loader design and nine source/ordinary-wheel ZIP-CLI models are sound, but this is not native Windows execution. The issue explicitly requires real-console refusal, installed package/task/lease preservation and successful module recovery; that current-head independent qualification remains missing. Keep the initial120s installer timeout and separate missing quality receipt visible.