Uh oh!
There was an error while loading. Please reload this page.
feat(updater): add version revert with config restore - #175
Merged
Conversation
Review follow-ups on the version revert flow. - Keep the `.old` binary while a config restore is pending. Every daemon boot ran `cleanup_old_binary()`, so any restart between install and handoff (idle exit, reboot, `update revert` without `--restart`) deleted the only binary that understands the handoff flags: the restore was skipped and every later `/v1/restart` failed on the missing helper. - Fall back to a plain restart when the helper is gone anyway, dropping the pending request instead of wedging restarts permanently. - Start the reverted daemon even when the restore fails. `?` in the handoff path exited the process, and the bail paths left the pending file in place, so the failure repeated on every restart and left no daemon running. - Prune revert targets and pre-revert safety copies as separate buckets. Both shared one MAX_SNAPSHOTS budget, so a few reverts evicted the version snapshots those reverts need. - Return 409 from `POST /v1/update/revert` when a manual operation is already active. It answered 200 without starting anything, and the caller waited for a transition that never came. - Warn in the status bar that the restart also restarts the daemon and ends terminal sessions, matching the settings pane. - Bound the CLI wait at 15 minutes and bail after 15s of an unreachable daemon. - Restore the "release exists but has no asset" warning lost in the refactor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019i6mMQSwQtJ75RGLBC2z4T
matej21
marked this pull request as ready for review
August 10, 2026 15:54
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
okena update status,list, andrevertCLI commands with dry-run, JSON, restart, and config opt-out supportWhy
The updater could only move installations forward. A broken release required manual binary replacement and left config compatibility to the user. This adds a controlled downgrade path and restores the config captured before the original upgrade by default.
User impact
Users can select an older stable release in Settings or through the CLI. The confirmation shows the checkpoint date. They can keep the current config with an explicit compatibility warning. Restarting the daemon still ends active terminal sessions.
Validation
cargo test -p okena-core profiles --lib(25 passed)cargo test -p okena-ext-updater --no-default-features(5 passed)cargo test -p okena-cli parser --lib(3 passed)cargo check --workspacecargo check -p okena-ext-updatercargo clippy -p okena-core -p okena-ext-updater -p okena-remote-server -p okena-cli --all-features --no-deps -- -D warningscargo fmt --all -- --checkgit diff --checkA live end-to-end revert was not run because it would replace the active binaries and profile config and terminate active terminal sessions.