[backnotprop]

Merge after the Bun 1.4.4 PR and after 0.28.32 is cut (target 0.28.33)

0.28.33 must be built on Bun 1.4.4 (#2215 merges before then). The protection rests on the binary's own fetch rejecting the leaked eMudhra roots, which Bun 1.4.4 does and 1.3.14 does not.

What this does

Safe updates, step 1 (no signing keys). On macOS and Linux, plannotator update, the Inbox's Update now and background auto-update no longer download anything with the system curl, which on macOS still trusts the leaked eMudhra root keys. The running Plannotator downloads the install script and the release's .sha256 files with its own connection (Bun 1.4.4 blocks those keys). Then it runs the saved script, which checks the binary against those checksums before it replaces anything.

• plannotator update-prepare <version> (internal, packages/server/update-prepare.ts). It downloads install.sh and the .sha256 of the binary install.sh will pick on this machine (process.arch; required) into a private plannotator-update-* temp dir (0700, files 0600) and prints the dir. The other CPU type's .sha256 is pinned when readable and skipped otherwise, so a release that drops one CPU type never stops updates for the other. It keeps the script only when it looks like ours (#!, REPO="backnotprop/plannotator", under 4 MB). Each checksum must be 64 hex characters. On any failure nothing is staged and it exits 75.
• POSIX wrapper (packages/server/auto-update.ts). It runs update-prepare, then bash <dir>/install.sh … with PLANNOTATOR_EXPECTED_SHA256. It removes the dir on exit, on Ctrl-C and on TERM, and keeps the lock, result and log contract. If the download fails, nothing runs and the result is 75. It never falls back to curl. It removes the printed dir only when that dir is an absolute path on one line whose last part is plannotator-update-*.
• install.sh. When PLANNOTATOR_EXPECTED_SHA256 has a valid entry for the binary it picked, the script uses that entry as the expected checksum and does not fetch the .sha256 again. On a mismatch it prints a plain message, replaces nothing, touches the marker file the wrapper names (PLANNOTATOR_UPDATE_MISMATCH_FILE) and exits 113. The wrapper records 113 only when that marker exists; any other exit 113 is recorded as 1, so "nothing was changed" is never claimed for another error. The codes live in packages/core/update-exit-codes.ts, shared by the CLI, the Inbox dialog and the notice. If the entry is missing or malformed, it prints a note and falls back to today's check. Without the variable, the script behaves exactly as before.
• sem sidecar. The v0.8.0 archive checksums are pinned in install.sh, install.ps1 and install.cmd instead of read from checksums.txt. I cross-checked the pinned values against checksums.txt and against the GitHub API's asset digest.
• Back-off. After a mismatch, auto-update waits 1, then 3, then 7 days before it tries that version again (mismatchBackoff in update-state.json, outcome backed-off). A newer release is tried at once. Update now and plannotator update ignore the back-off.
• Messages. After exit 113 or 75, neither plannotator update nor the Inbox's failure dialog prints the curl | bash line. The review-window toast says "Update to vX stopped" once per version. A background download failure shows nothing, because nothing changed.

Windows is unchanged: Windows blocks the leaked keys in its own certificate store, which Invoke-WebRequest uses. The Pi and OpenCode runtimes have no installer path. Pi vendors update-check.ts, where the only change is one additive optional field.

Deploy note: plannotator.ai must serve the new install.sh

The binary check only takes effect once https://plannotator.ai/install.sh serves this branch's scripts/install.sh. The owner syncs it to S3 by hand. Until then, updates behave exactly as today, because an older script ignores PLANNOTATOR_EXPECTED_SHA256. In that case update-prepare logs "this install script does not check the pinned checksum yet". The release checklist (.agents/skills/release/SKILL.md) now has this step.

Tests

• packages/server/update-prepare.test.ts:
  • staging and permissions;
  • versions with and without the v;
  • never-stuck cases: offline, a refusing proxy in both Bun 1.3.14 and 1.4.4 behaviour, a missing, web-page or short .sha256, a captive portal, a script that is not ours, an oversized script, a stalled server;
  • the sweep;
  • end to end through the wrapper:
    • offline;
    • a refusing proxy;
    • a bad .sha256;
    • tamper through the real install.sh (mismatch recorded, old binary kept);
    • a release missing the other CPU type's .sha256 (still updates);
    • an unmarked exit 113 (recorded as 1);
    • the genuine release through the real install.sh;
    • an older install.sh (runs as before);
    • Ctrl-C;
    • the dir guard (never removes anything not named plannotator-update-*).
• scripts/install.test.ts: a matching pin, the pin read for this CPU type only and in any letter case (asserting the pin path), a pin for this CPU type alone, tamper (exit 113 and the marker, old binary kept), the marker only at a …/checksum-mismatch path, malformed pins falling back, no variable meaning no change, and the sem pins.
• packages/server/auto-update.test.ts: the wrapper tests moved to a loopback release server; the killed-outright test checks the sweep; there are tests for the 1/3/7-day back-off and the mismatch and download notices.
• apps/hook/server/update-command.test.ts: exit 113 and 75 messages (no install command); the process tests check the pins passed in and a download failure; update-prepare through the real index.ts entrypoint (stdout is exactly the dir; 75 with empty stdout on failure).
• release.yml smoke-binaries (Linux and macOS): scripts/smoke-update-prepare.sh runs the compiled binary's update-prepare against a loopback mirror, then a full plannotator update through the wrapper (compiled-binary detection) with a stand-in install script.
• packages/inbox/updates.test.tsx, packages/ui/utils/autoUpdateNotice.test.ts: the dialog and the toast for 113 and 75.

Sandboxed: temp HOME, TMPDIR and data dir, loopback servers and stub curl. Nothing reaches the network.