fix(update): keep Windows daemons serving across self-update

.github/workflows/ci.yml

@@ -80,7 +80,10 @@ jobs:
           node scripts/check-crate-skill.mjs
 
       - name: Run Windows update tests
-        run: cargo test -p bsk --lib --locked cli::update::tests
+        run: |
+          cargo test -p bsk --lib --locked cli::update::
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          cargo test -p bsk --test auto_update_policy --locked
 
       - name: Run Windows cancellation process tests
         run: cargo test -p bsk --test windows_parent_cancel --locked
@@ -96,7 +99,7 @@ jobs:
   windows-daemon-lifecycle:
     name: Windows independent daemon and update lifecycle
     runs-on: windows-latest
-    timeout-minutes: 20
+    timeout-minutes: 45
 
     steps:
       - uses: actions/checkout@v6

CHANGELOG.md

@@ -11,6 +11,50 @@ Starting from 0.2.0, CLI / Extension / DSH Plugin share the same version number.
 
 - Protocol: preserve explicit `null` results when deserializing `ResponseFrame`,
   restoring round-trip consistency while rejecting responses with both a result and an error.
+- A failed auto-update no longer leaves the browser disconnected
+  ([#336](https://github.com/Tencent/BrowserSkill/issues/336)). The daemon
+  checks that the new executable reports the release's version, starts a
+  daemon from it, and exits only after a daemon of that version serves the
+  same port. If the new daemon exits or is not ready within 20 seconds, it is
+  stopped, the previous executable is put back and the running daemon serves
+  again on the same port; the release is retried after 6 hours. The update
+  record says a daemon is serving only once it has published `daemon.json`.
+  This applies on all platforms.
+- Windows self-update no longer depends on a detached script: the running
+  `bsk.exe` is renamed aside and the new one takes its place.
+- `bsk update` installs and checks the new executable before stopping the
+  daemon. If the restarted daemon is not ready in time, it is stopped, the
+  previous executable is put back and the previous version restarted. It
+  restarts the daemon from the installed path, which Linux no longer reports
+  as the current executable once it is replaced.
+- A daemon that stops during an auto-update, for example because it went
+  idle while the release was downloading or being checked, installs nothing
+  or puts the previous executable back, and records the attempt as failed.
+- `bsk update` leaves a background daemon running when it could not start
+  one again, such as inside a sandbox whose Windows Job forbids breakaway
+  (`"daemon": "left_running"`), instead of stopping it.
+- A daemon keeps using the executable path it started from, so it can update
+  again after a rolled-back update on Linux.
+- Updates of one executable are serialized through a lock file next to it, so
+  daemons or `bsk update` runs with different bsk homes cannot overwrite each
+  other's installation or rollback.
+
+### Changed
+
+- Daemons started with `--foreground` no longer install updates or replace
+  themselves with a detached process, on any platform. They log a new version
+  once, and the CLI hint suggests `bsk update` followed by a restart in the
+  daemon's terminal or supervisor. `bsk update` leaves such a daemon running
+  instead of stopping it and starting a background daemon in its place
+  (`"daemon": "left_to_host"` in `--json` output).
+- `bsk update` restarts a background daemon on the port it served.
+- A daemon that cannot write next to its executable reports new releases
+  instead of installing them, and the CLI hint points to the installer.
+- Each update attempt, including the stage and error of a failure, is kept in
+  `update-state.json` in the bsk home and shown by `bsk doctor`.
+- `bsk update --json` reports `"status": "updated"` on Windows too; the
+  `"staged"` status is gone.
+- README documents `BSK_AUTO_UPDATE=off`.
 
 ## [0.3.1] - 2026-09-23
 

README.md

@@ -248,7 +248,11 @@ Finish active browser tasks, then update the CLI:
 bsk update --yes
 ```
 
-For the default local setup, this restarts a running daemon when an update is installed. If Windows reports a staged update, wait for replacement to finish. If you use the installer to replace the binary, restart the daemon afterwards with `bsk daemon restart`.
+For the default local setup, this installs the new executable and checks that it runs while the daemon keeps serving, then restarts the daemon from it on the same port. If the restarted daemon does not become ready, the previous executable is put back and the daemon is restarted from it. A daemon started with `--foreground` is left running on the previous version; restart it in its terminal or supervisor. So is a background daemon when `bsk update` runs where it could not start one again, such as inside a sandbox whose Windows Job forbids breakaway; restart it with `bsk daemon restart` outside the sandbox. If you use the installer to replace the binary, restart the daemon afterwards with `bsk daemon restart`.
+
+A daemon that `bsk` started in the background also checks for a new release every 30 minutes and, while no agent session is active, installs it the same way. It then starts a daemon from the new executable and exits only once a daemon of the new version serves the same port. If the new daemon exits or is not ready within 20 seconds, it is stopped, and the running daemon puts the previous executable back, serves again on the same port, and retries that release after 6 hours. Browser connections drop for a moment during a handover and reconnect. A daemon that stops for another reason during an update, such as going idle, puts the previous executable back first. A daemon started with `--foreground` belongs to its terminal or supervisor, so it only reports new releases: run `bsk update`, then restart the daemon there. If bsk cannot write next to its executable, it only reports new releases; update it with the installer or package manager you used. Set `BSK_AUTO_UPDATE=off` to disable daemon-side auto-update while keeping manual `bsk update` available.
+
+`bsk doctor` shows the last update attempt; `update-state.json` in the bsk home keeps its stage, result and error. Updates of one executable run one at a time, even from different bsk homes, through `.bsk.update.lock` (`.bsk.exe.update.lock` on Windows), which stays next to it. Until an update is confirmed, the previous executable stays next to the new one as `.bsk.old-*` (`.bsk.exe.old-*` on Windows); one that is still running remains until its process exits, and a later daemon start removes it. On Windows, self-update renames the running executable, which NTFS supports; where the file system refuses, the update fails and leaves the installation unchanged. bsk supports Windows 10 and Windows Server 2016 or later.
 
 Update the extension through its browser store. Update the DSH plugin separately, then restart its profile:
 

README.zh-CN.md

@@ -248,7 +248,11 @@ BrowserSkill 没有必须使用的云服务，也不收集产品遥测。自动
 bsk update --yes
 ```
 
-默认本地配置下，安装更新后会重启正在运行的 daemon。Windows 如果提示更新已暂存，请等待替换完成。如果使用安装脚本替换了二进制，请随后执行 `bsk daemon restart`。
+默认本地配置下，这条命令会在 daemon 继续服务的同时安装新版本并检查它能否运行，然后用新版本在原端口重启 daemon。重启后的 daemon 没有就绪时，会放回旧版本并用它重启 daemon。通过 `--foreground` 启动的 daemon 不会被停止，会继续运行旧版本，请在它所在的终端或进程管理器中重启。如果 `bsk update` 运行在无法重新启动后台 daemon 的环境里（例如 Windows Job 禁止 breakaway 的沙盒），后台 daemon 同样不会被停止，请在沙盒外执行 `bsk daemon restart`。如果使用安装脚本替换了二进制，请随后执行 `bsk daemon restart`。
+
+由 `bsk` 在后台启动的 daemon 还会每 30 分钟检查一次新版本。没有 Agent 会话时，它按同样方式安装新版本，再用新版本启动一个 daemon，确认新版本的 daemon 已在原端口服务后才退出。新 daemon 退出，或 20 秒内没有就绪时，它会被停止，当前 daemon 放回旧版本，在原端口继续服务，6 小时后再尝试这个版本。交接期间浏览器连接会短暂断开并自动重连。更新过程中 daemon 因其他原因（例如空闲超时）停止时，会先放回旧版本再退出。通过 `--foreground` 启动的 daemon 归所在终端或进程管理器管理，只提示新版本：执行 `bsk update`，再在那里重启 daemon。bsk 无法在可执行文件所在目录写入时，也只提示新版本，请用原来的安装脚本或包管理器升级。设置 `BSK_AUTO_UPDATE=off` 可关闭 daemon 自动升级，手动 `bsk update` 仍然可用。
+
+`bsk doctor` 会显示最近一次更新的结果；bsk home 下的 `update-state.json` 记录了它的阶段、结果和错误原因。同一个可执行文件的更新会依次进行，即使来自不同的 bsk home 也是如此，靠的是它旁边的 `.bsk.update.lock`（Windows 上为 `.bsk.exe.update.lock`），这个文件会一直保留。更新确认成功前，旧版本会以 `.bsk.old-*`（Windows 上为 `.bsk.exe.old-*`）的名字留在新版本旁边；仍在运行的旧版本会保留到对应进程退出，之后再启动 daemon 时会清理。Windows 上的自更新依赖重命名正在运行的可执行文件，NTFS 支持这一操作；文件系统不支持时，更新会失败，已安装的版本保持不变。bsk 支持 Windows 10 和 Windows Server 2016 及以上版本。
 
 扩展通过浏览器商店更新。DSH 插件需要单独更新，完成后重启对应 profile：