[philcunliffe]

HypAware decodes captured Brotli bodies, so upgrading the npm package alone leaves customers exposed to CVE-2026-111497 when their daemon still pins an older Node executable. This change lets existing customers receive the update and automatically move application execution onto a verified private Node runtime, without changing their system Node, shell configuration, or other global tools.

Customer upgrade behavior

• Keep the package bootstrap compatible with Node >=22.12, including old updater --version preflights and npm engine-strict installs.
• Before application dispatch on an unpatched runtime, download the pinned official Node release into HypAware's state directory. Preserve the current supported major: 22.23.4, 24.22.1, or 26.12.1; obsolete intervening majors use 24 LTS.
• Authenticate the archive with a pinned SHA-256 taken from Node's signed release manifest before extracting or executing it. Bound download size/time, serialize concurrent installs, probe the executable and patched Brotli constant, then publish an atomic stable interpreter link.
• Automatically replace only the daemon interpreter in the installed LaunchAgent/systemd unit, preserve its CLI/config/environment/custom settings, restart it, and verify a fresh healthy/degraded heartbeat. The Linux worker enters a separate systemd scope before stopping the old service.
• Restore the original service definition if handover fails. A recent-attempt marker prevents restart loops; when handover is deferred, the application runs as a child of verified Node with signal/exit forwarding.
• Preserve the original global npm prefix for future HypAware self-updates. Honor existing auto_update: false for unattended runtime downloads.

Validation

• npm test on Node 24.22.1: 8,989 passed, 7 skipped, 0 failed.
• Typecheck, package build, LLP references and cross-branch number checks passed. Packed file list includes the runtime modules and smoke.
• Hermetic smokes passed: node_runtime_upgrade, daemon_install_render, daemon_foreground_start_stop, gateway_codex_capture. The new smoke asserts runtime verification/service handover behavior and run-scoped telemetry.
• Real nodejs.org download verified and executed Node 24.22.1 from a Node 24.2.0 bootstrap.
• Final packaged candidate migrated a sandbox LaunchAgent from Node 24.2.0 to the private runtime, preserved its original CLI/config/custom environment, and published a fresh healthy status. Mock launchctl isolates the host's actual service; sandbox service removed afterward.
• CPU/memory review: no per-record work or steady-state polling added. Archives stream to disk under a 100 MiB limit; checksum work is installation-only; normal cleanup retains active and previous distributions. The handover health poll and service-manager calls are bounded. Deferred handover adds one temporary bootstrap parent process.

Release limits

This remains a draft and is not published. Real installed-host migration checks on macOS and Linux are still release gates; Linux has deterministic and hermetic coverage here, not an actual systemd-host run. Automatic downloads target macOS and glibc Linux x64/arm64. Unsupported platforms and installations with automatic updates disabled retain an operator step. If a restarting machine cannot obtain its patched runtime, capture stays unavailable until preparation succeeds; the service definition is not changed before verification.

The bootstrap covers the CLI/daemon entrypoint. Embedded library callers bypassing the CLI still need to run a patched Node release.

Design rationale: LLP 0555.

Node security advisory.