fix(server): prevent accidental service downgrades

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[t3dotgg]

An older CLI can replace a newer background service during install, update, or T3 Connect setup.

This reports the installed version and requires --allow-downgrade before replacing it with an older version. It checks again before writing service files, so a completed remote update cannot bypass the guard. Onboarding leaves newer services unchanged. The existing systemd, launchd, and pending-update behavior stays intact.

Verified with 41 focused service tests, the server typecheck, changed-file lint, formatting, and git diff --check. Tests use temporary files and fake service/process runners. No real service was changed.

This retains Theo Browne's service guard. The broader original work is preserved on an archive branch.

Made with GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Changes install/update/onboarding paths for systemd and launchd with a new guard that could block legitimate repairs if version detection is wrong; extensive tests mitigate this.

Overview
Prevents an older CLI from replacing a newer installed background service during service install, service update, or T3 Connect onboarding unless the user passes --allow-downgrade.

Service status now surfaces installedVersion and, when the service is newer than the CLI, points to an exact-version repair command instead of t3@latest. reconcileService and BootService.install compare versions with compareExactServiceVersions; a second check runs after stopping the unit (via serviceStateActiveVersion) so a remote update that finishes during shutdown cannot be overwritten. Onboarding skips prompts and leaves a newer service unchanged; BootServiceDowngradeRefusedError is handled like other non-fatal setup failures. User docs describe version pinning and downgrade behavior.

^{Reviewed by Cursor Bugbot for commit 1b02641. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent accidental BootService downgrades in CLI install and update

• BootService.install now reads the final service state after stopping the unit and refuses to install if the active version is newer than the CLI, returning BootServiceDowngradeRefusedError; the stopped service is restarted on refusal.
• Adds a shared --allow-downgrade flag to the service install and update commands so users can explicitly authorize a downgrade.
• BootServiceStatus now includes a validated installedVersion; the status formatter prints an exact-version repair command instead of the generic latest command when a newer service is detected.
• Onboarding no longer prompts to replace a known newer background service and logs that it was left unchanged; a downgrade refusal during onboarding is converted to a warning and false.
• Risk: install changed from an Effect property to an optional-options function in bootService.ts — all in-tree call sites are updated, but out-of-tree consumers calling the old Effect form will break.

^{Macroscope summarized 1b02641.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8139ea6c-fd64-4178-a628-1ac012e24188

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding: a wrapper error's message now interpolates cause.message, which the Effect error conventions disallow. Everything else in the changed service/error code (new ServiceDowngradeRefusedError, catchTags handling, relay endpoint reconcile handler, RPC schema-defect mapping) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the default behavior of background-service installation and updates by refusing downgrades unless an explicit override is supplied. The implementation is localized and well covered by tests, but this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2896676. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.4 KiB	+301 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.5 KiB	+303 B (+4.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	57.0 KiB	+2.3 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.2 KiB	+80 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+83 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	56.3 KiB	+840 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b21d872 · PR result: 1b02641 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.