fix(ide): upgrade managed agent and migrate existing member media connection

apps/desktop/electron/active-runtime-state.test.ts

@@ -2,13 +2,22 @@ import assert from 'node:assert/strict'
 
 import { test } from 'vitest'
 
-import { classifyActiveRuntime, hasValidBootstrapMarker } from './active-runtime-state'
+import { classifyActiveRuntime, hasValidBootstrapMarker, needsPackagedRuntimeUpgrade } from './active-runtime-state'
 
 const VALID_MARKER = {
   pinnedCommit: '1234567890abcdef1234567890abcdef12345678',
   schemaVersion: 1
 }
 
+test('a package upgrade refreshes only a proven managed runtime, once per package', () => {
+  const stamp = {commit: 'b'.repeat(40), source: 'git'}
+  assert.equal(needsPackagedRuntimeUpgrade(true, stamp, VALID_MARKER), true)
+  assert.equal(needsPackagedRuntimeUpgrade(true, stamp, {...VALID_MARKER, pinnedCommit: stamp.commit}), false)
+  assert.equal(needsPackagedRuntimeUpgrade(false, stamp, VALID_MARKER), false)
+  assert.equal(needsPackagedRuntimeUpgrade(true, stamp, null), false)
+  assert.equal(needsPackagedRuntimeUpgrade(true, {commit: '0'.repeat(40), source: 'fallback'}, VALID_MARKER), false)
+})
+
 test('hasValidBootstrapMarker accepts the current schema with a real-looking commit', () => {
   assert.equal(hasValidBootstrapMarker(VALID_MARKER, 1), true)
 })

apps/desktop/electron/active-runtime-state.ts

@@ -3,6 +3,18 @@ export interface BootstrapMarkerLike {
   schemaVersion?: unknown
 }
 
+// An AITURK package upgrade must bring its managed agent along with the UI.
+// Developer checkouts and installs without proven Desktop ownership keep their
+// existing launch behavior. The installer preserves edits and refuses rollback.
+export function needsPackagedRuntimeUpgrade(
+  packaged: boolean, stamp: { commit?: string; source?: string } | null,
+  marker: BootstrapMarkerLike | null
+): boolean {
+  return Boolean(packaged && stamp?.source !== 'fallback' &&
+    /^[0-9a-f]{40}$/i.test(stamp?.commit || '') && !/^0+$/.test(stamp?.commit || '') &&
+    hasValidBootstrapMarker(marker, 1) && marker?.pinnedCommit !== stamp?.commit)
+}
+
 export interface ActiveRuntimeState {
   hasValidMarker: boolean
   shouldUseActiveRuntime: boolean

apps/desktop/electron/main.ts

@@ -30,7 +30,7 @@ import {
   systemPreferences
 } from 'electron'
 
-import { classifyActiveRuntime } from './active-runtime-state'
+import { classifyActiveRuntime, needsPackagedRuntimeUpgrade } from './active-runtime-state'
 import { destroyKeepaliveAgents, downloadAgentFor, jsonAgentFor, withRetry } from './api-transport'
 import { appIconCandidates, resolveAppIcon } from './app-icon'
 import { stopBackendChild as stopBackendChildImpl, stopBackendTreesForUpdate } from './backend-child'
@@ -4905,6 +4905,11 @@ function resolveHermesBackend(backendArgs) {
   //    bootstrap when the runtime itself is unusable.
   const activeRuntime = activeRuntimeState()
 
+  if (needsPackagedRuntimeUpgrade(IS_PACKAGED, INSTALL_STAMP, readBootstrapMarker())) {
+    rememberLog('[bootstrap] AITURK package changed; updating its managed agent before launch.')
+    return createBootstrapBackend(backendArgs)
+  }
+
   if (activeRuntime.shouldUseActiveRuntime && !bootstrapRepairRequested) {
     if (!activeRuntime.hasValidMarker) {
       rememberLog(