Release ForgeFlow 0.6.1

Publish-ForgeFlow-Release.ps1

@@ -63,15 +63,58 @@ try {
     try {
       $installedManifest = Get-Content -LiteralPath $installedManifestPath -Raw | ConvertFrom-Json
       if ($installedManifest.name -eq "forgeflow" -and [string]$installedManifest.version -ne $version) {
-        $bootstrapSource = Join-Path $source "scripts\apply-source-update.ps1"
-        $bootstrapTarget = Join-Path $InstalledSource "scripts\apply-source-update.ps1"
-        $bootstrapText = Get-Content -LiteralPath $bootstrapSource -Raw
-        if ($bootstrapText.TrimStart() -notmatch '^param\(') { throw "The validated updater bootstrap does not start with param(." }
-        New-Item -ItemType Directory -Force -Path (Split-Path -Parent $bootstrapTarget) | Out-Null
-        Copy-Item -LiteralPath $bootstrapSource -Destination $bootstrapTarget -Force
-        $copiedText = Get-Content -LiteralPath $bootstrapTarget -Raw
-        if ($copiedText.TrimStart() -notmatch '^param\(') { throw "The updater bootstrap copy failed validation." }
-        Write-Host "Prepared the installed ForgeFlow $($installedManifest.version) updater helper without changing its version." -ForegroundColor Green
+        $helperSource = Join-Path $source "scripts\apply-source-update.ps1"
+        $helperTarget = Join-Path $InstalledSource "scripts\apply-source-update.ps1"
+        $serviceSource = Join-Path $source "src\main\update-service.cjs"
+        $serviceTarget = Join-Path $InstalledSource "src\main\update-service.cjs"
+
+        $helperText = Get-Content -LiteralPath $helperSource -Raw
+        $serviceText = Get-Content -LiteralPath $serviceSource -Raw
+        if ($helperText.TrimStart() -notmatch '^param\(') { throw "The validated updater helper does not start with param(." }
+        if ($helperText -notmatch 'System\.IO\.File\]::Replace' -or $helperText -notmatch 'HandshakeOnly') { throw "The validated updater helper is missing the Windows status replacement fix." }
+        if ($serviceText -notmatch 'expectedUpdateId' -or $serviceText -notmatch 'readLogTail') { throw "The validated update service is missing the confirmed-handshake diagnostics." }
+
+        New-Item -ItemType Directory -Force -Path (Split-Path -Parent $helperTarget) | Out-Null
+        New-Item -ItemType Directory -Force -Path (Split-Path -Parent $serviceTarget) | Out-Null
+        Copy-Item -LiteralPath $helperSource -Destination $helperTarget -Force
+        Copy-Item -LiteralPath $serviceSource -Destination $serviceTarget -Force
+
+        $copiedHelper = Get-Content -LiteralPath $helperTarget -Raw
+        $copiedService = Get-Content -LiteralPath $serviceTarget -Raw
+        if ($copiedHelper.TrimStart() -notmatch '^param\(' -or $copiedHelper -notmatch 'System\.IO\.File\]::Replace') { throw "The updater helper bootstrap copy failed validation." }
+        if ($copiedService -notmatch 'expectedUpdateId' -or $copiedService -notmatch 'readLogTail') { throw "The update-service bootstrap copy failed validation." }
+
+        # Prove the exact STARTED handshake on this Windows PowerShell version before
+        # asking the installed ForgeFlow to close itself for a real update.
+        $handshakeRoot = Join-Path ([IO.Path]::GetTempPath()) ("forgeflow-handshake-" + [guid]::NewGuid().ToString("N"))
+        New-Item -ItemType Directory -Force -Path $handshakeRoot | Out-Null
+        try {
+          $handshakeId = "publisher-" + [guid]::NewGuid().ToString("N")
+          $handshakeStatus = Join-Path $handshakeRoot "status.json"
+          $handshakeLog = Join-Path $handshakeRoot "helper.log"
+          $dummyArchive = Join-Path $handshakeRoot "unused.zip"
+          $launching = @{ schemaVersion = 1; updateId = $handshakeId; state = "launching" } | ConvertTo-Json
+          $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+          [System.IO.File]::WriteAllText($handshakeStatus, $launching, $utf8NoBom)
+          [System.IO.File]::WriteAllBytes($dummyArchive, [byte[]](0x50,0x4b,0x03,0x04))
+
+          $windowsRoot = if ($env:SystemRoot) { $env:SystemRoot } else { $env:WINDIR }
+          $powershellExe = if ($windowsRoot) { Join-Path $windowsRoot "System32\WindowsPowerShell\v1.0\powershell.exe" } else { "powershell.exe" }
+          & $powershellExe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File $helperTarget `
+            -SourcePath $InstalledSource -ArchivePath $dummyArchive -ExpectedVersion $version `
+            -ExpectedSha256 ("0" * 64) -ParentPid 2147483647 -LogPath $handshakeLog `
+            -StatusPath $handshakeStatus -UpdateId $handshakeId -HandshakeOnly
+          if ($LASTEXITCODE -ne 0) { throw "The installed update helper failed its Windows handshake self-test with exit code $LASTEXITCODE." }
+          $handshakeResult = Get-Content -LiteralPath $handshakeStatus -Raw | ConvertFrom-Json
+          if ($handshakeResult.state -ne "started" -or $handshakeResult.updateId -ne $handshakeId) {
+            $tail = if (Test-Path -LiteralPath $handshakeLog) { Get-Content -LiteralPath $handshakeLog -Tail 20 | Out-String } else { "No helper log was created." }
+            throw "The installed update helper did not replace the launching state with the expected STARTED marker. $tail"
+          }
+        } finally {
+          Remove-Item -LiteralPath $handshakeRoot -Recurse -Force -ErrorAction SilentlyContinue
+        }
+
+        Write-Host "Prepared and Windows-tested the installed ForgeFlow $($installedManifest.version) updater bootstrap without changing its version." -ForegroundColor Green
       }
     } catch {
       throw "Release was published, but the installed updater bootstrap could not be prepared: $($_.Exception.Message)"