@agentshouse/kit 0.2.1-c8179f06883b6 → 0.2.1-c83d468784cc9

package/dist/api.js

@@ -1,9 +1,9 @@
 import { setTimeout as delay } from 'node:timers/promises';
-import { signInAgain, updateRequired } from './end.js';
+import { signInAgain } from './end.js';
 import { readEnrolment } from './home.js';
 import { retryable } from './refusals.js';
 import { relayed } from './relay.js';
-import { KIT_WIRE, KIT_WIRE_HEADER, tooOld } from './wire.js';
+import { endUnserved, KIT_WIRE, KIT_WIRE_HEADER } from './wire.js';
 export class HouseRefusal extends Error {
     status;
     text;
@@ -17,7 +17,7 @@ export function finalRefusal(error) {
     return error instanceof HouseRefusal && retryable(error.text) === false;
 }
 export function retryDelay(attempt) {
-    // Full jitter, doubling from one second to a 30-second cap, spreads the Kits one outage dropped and retries within half a minute of House's return.
+    // Full jitter, doubling from one second to a 30-second cap, spreads the Kit processes one outage dropped and retries within half a minute of House's return.
     return Math.random() * Math.min(30_000, 1000 * 2 ** attempt);
 }
 export async function retrying(sent, signal, pause = retryDelay) {
@@ -45,8 +45,8 @@ export async function post(house, path, body, credential, signal) {
         signal,
     });
     const text = await answer.text();
-    if (!answer.ok && tooOld(text))
-        updateRequired(house);
+    if (!answer.ok)
+        endUnserved(text);
     if (!answer.ok)
         throw new HouseRefusal(path, answer.status, text);
     return JSON.parse(text);

package/dist/app-git.js

@@ -1,15 +1,9 @@
-import { extname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { run } from './git.js';
 import { kitHome, readOwnAgent } from './home.js';
-import { quoted } from './shell.js';
+const HELPER = '!kit git-credential';
 function section(house) {
     return `credential.${new URL('/app/', house).href}`;
 }
-function helper() {
-    const main = fileURLToPath(new URL(`./kit-main${extname(fileURLToPath(import.meta.url))}`, import.meta.url));
-    return `!HOUSE_KIT_HOME=${quoted(resolve(kitHome()))} ${quoted(process.execPath)} ${quoted(main)} git-credential`;
-}
 async function configured(args) {
     try {
         return await run(kitHome(), ['config', '--global', ...args]);
@@ -20,30 +14,18 @@ async function configured(args) {
         throw error;
     }
 }
-async function forget(house) {
-    await configured(['--remove-section', section(house)]);
-}
-async function register(house) {
-    await forget(house);
-    for (const value of ['', helper()]) {
-        const ran = await configured(['--add', `${section(house)}.helper`, value]);
+export async function placeAppGit(ownAgent) {
+    if (ownAgent === null)
+        return;
+    await configured(['--remove-section', section(ownAgent.house)]);
+    for (const value of ['', HELPER]) {
+        const ran = await configured(['--add', `${section(ownAgent.house)}.helper`, value]);
         if (ran === null)
             return;
         if (ran.status !== 0)
             throw new Error(`git config failed: ${ran.stderr.trim()}`);
     }
 }
-export async function placeAppGit(before, after) {
-    if (before !== null && before.house !== after?.house)
-        await forget(before.house);
-    if (after !== null)
-        await register(after.house);
-}
-export async function forgetAppGit() {
-    const ownAgent = await readOwnAgent();
-    if (ownAgent !== null)
-        await forget(ownAgent.house);
-}
 export async function answerGitCredential(operation) {
     let asked = '';
     for await (const chunk of process.stdin)
@@ -55,8 +37,10 @@ export async function answerGitCredential(operation) {
         .filter((line) => line.includes('='))
         .map((line) => [line.slice(0, line.indexOf('=')), line.slice(line.indexOf('=') + 1)]));
     const ownAgent = await readOwnAgent();
-    if (ownAgent === null)
+    if (ownAgent === null) {
+        process.stderr.write(`kit: Kit home ${kitHome()} is not signed in; run kit login\n`);
         return;
+    }
     const house = new URL(ownAgent.house);
     if (attributes.get('protocol') !== house.protocol.slice(0, -1) || attributes.get('host') !== house.host)
         return;

package/dist/authority-main.js

@@ -1,14 +1,14 @@
-import { setGlobalProxyFromEnv } from 'node:http';
 import { HouseRefusal, post } from './api.js';
 import { readEnrolment } from './home.js';
+import { proxyUnlessRelayed } from './relay.js';
 function unanswered(error) {
     return error instanceof HouseRefusal ? error.status >= 500 : error instanceof TypeError && error.message === 'fetch failed';
 }
-setGlobalProxyFromEnv();
+proxyUnlessRelayed();
 try {
     const { house, credential } = (await readEnrolment());
     try {
-        await post(house, '/kit/agents/desired', {}, credential);
+        await post(house, '/kit/agents/desired/list', {}, credential);
     }
     catch (error) {
         if (!unanswered(error))

package/dist/bridge.js

@@ -1,7 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { once } from 'node:events';
 import { setTimeout as delay } from 'node:timers/promises';
-import { mkdir } from 'node:fs/promises';
 import { createServer, request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
 import { delimiter, dirname, join } from 'node:path';
@@ -9,12 +8,12 @@ import { parse } from 'yaml';
 import { finalRefusal, HouseRefusal, retryDelay, retrying } from './api.js';
 import { loginPath } from './clis.js';
 import { changedPaths, } from './copies.js';
-import { kitHome, readEnrolment } from './home.js';
+import { kitHome, readEnrolment, socketDirectory } from './home.js';
 import { callHouse, mcpBody, rpc, UNREACHABLE } from './mcp.js';
 import { operationId } from './operation.js';
 import { refusalOf, retryable } from './refusals.js';
 import { relayed } from './relay.js';
-const MCP_REQUEST_BYTES = 4 * 1024 * 1024;
+const MCP_REQUEST_BYTES = 4_000_000;
 export async function received(request) {
     let text = '';
     request.setEncoding('utf8');
@@ -82,7 +81,7 @@ function editAnswer(forwarded) {
 export async function openBridge(house, copies, conversationId, signal) {
     const path = [join(kitHome(), 'shim'), dirname(process.execPath), await loginPath()].join(delimiter);
     const origin = (await readEnrolment()).house;
-    const { credential } = await house.post(`/kit/conversations/${conversationId}/credential`, {}, signal);
+    const { credential } = await retrying(() => house.post('/kit/conversations/credentials/issue', { conversation: conversationId }, signal), signal);
     const closed = new AbortController();
     const sent = (message, operation) => callHouse(origin, credential, message, operation, closed.signal);
     const send = async (message, operation) => {
@@ -106,7 +105,7 @@ export async function openBridge(house, copies, conversationId, signal) {
         const bytes = Buffer.from(JSON.stringify({ changes }));
         const sha256 = createHash('sha256').update(bytes).digest('hex');
         const prepared = answered(await send(call('run_command', {
-            command: 'prepare_edit_upload',
+            command: 'files/batch-upload',
             arguments: { paths: changedPaths(changes), bytes: bytes.length, sha256 },
         }), operation));
         if ('refused' in prepared)
@@ -142,7 +141,7 @@ export async function openBridge(house, copies, conversationId, signal) {
     const caller = {
         key: `conversation:${conversationId}`,
         submit: async (operation, changes, held, retain) => {
-            const inline = call('edit', { changes });
+            const inline = call('files_batch', { changes });
             let upload = held;
             if (upload === undefined && Buffer.byteLength(mcpBody(inline, operation)) > MCP_REQUEST_BYTES) {
                 const prepared = await staged(operation, changes);
@@ -151,7 +150,7 @@ export async function openBridge(house, copies, conversationId, signal) {
                 upload = prepared;
                 await retain(upload);
             }
-            return editAnswer(await send(upload === undefined ? inline : call('edit', { paths: changedPaths(changes), upload }), operation));
+            return editAnswer(await send(upload === undefined ? inline : call('files_batch', { paths: changedPaths(changes), upload }), operation));
         },
     };
     const local = async (path, text) => {
@@ -167,9 +166,7 @@ export async function openBridge(house, copies, conversationId, signal) {
         }
         return path === '/' ? forward(text) : { status: 404, text: '' };
     };
-    const sockets = join(kitHome(), 'bridges');
-    await mkdir(sockets, { recursive: true, mode: 0o700 });
-    const socketPath = join(sockets, `${randomUUID()}.sock`);
+    const socketPath = join(socketDirectory(), `${randomUUID()}.sock`);
     const bridge = createServer(async (request, response) => {
         try {
             const path = request.url ?? '';

package/dist/building.js

@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto';
+import { createWriteStream } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { readEnrolment } from './home.js';
+import { relayed } from './relay.js';
+const MANIFEST = 'bootstrap.json';
+async function served(name, signal) {
+    const enrolment = await readEnrolment();
+    if (enrolment === null)
+        throw new Error('this Kit is connected to no House');
+    const answer = await fetch(relayed(new URL(`/kit-installer/${encodeURIComponent(name)}`, enrolment.house)), { signal });
+    if (answer.status === 200 && answer.body !== null)
+        return answer;
+    await answer.body?.cancel();
+    throw new Error(`House answered ${answer.status} for ${name}`);
+}
+export async function servedRelease(signal) {
+    const manifest = (await (await served(MANIFEST, signal)).json());
+    const installer = manifest.hosts?.linux;
+    const sha256 = typeof installer === 'string' ? manifest.files?.[installer]?.sha256 : undefined;
+    if (typeof manifest.version !== 'string' || typeof installer !== 'string' || typeof sha256 !== 'string') {
+        throw new Error(`House serves no Kit release in ${MANIFEST}`);
+    }
+    return { version: manifest.version, installer, sha256 };
+}
+export async function downloadServed(name, sha256, destination, signal, most = Infinity) {
+    const answer = await served(name, signal);
+    const digest = createHash('sha256');
+    let bytes = 0;
+    const hashed = new Transform({
+        transform(chunk, _encoding, done) {
+            bytes += chunk.length;
+            if (bytes > most)
+                return done(new Error(`${name} is larger than its pinned ${most} bytes`));
+            digest.update(chunk);
+            done(null, chunk);
+        },
+    });
+    try {
+        await pipeline(answer.body, hashed, createWriteStream(destination), { signal });
+        if (digest.digest('hex') !== sha256)
+            throw new Error(`${name} does not match its sha256`);
+    }
+    catch (error) {
+        await rm(destination, { force: true });
+        throw error;
+    }
+}

package/dist/calls.js

@@ -0,0 +1,71 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { kitHome } from './home.js';
+function logged(error) {
+    process.stderr.write(`kit: ${error instanceof Error ? error.message : String(error)}\n`);
+}
+export class Calls {
+    house;
+    changed;
+    carried = new Map();
+    path = join(kitHome(), 'call-results.json');
+    results;
+    returned = new Set();
+    released = new Set();
+    open = 0;
+    constructor(house, changed) {
+        this.house = house;
+        this.changed = changed;
+        this.results = new Map(existsSync(this.path) ? Object.entries(JSON.parse(readFileSync(this.path, 'utf8'))) : []);
+    }
+    keepResult(callId, result) {
+        if (this.returned.has(callId))
+            return;
+        this.results.set(callId, result);
+        this.save();
+    }
+    idle() {
+        return this.open === 0;
+    }
+    carry(callId, work) {
+        if (this.released.has(callId))
+            return Promise.resolve();
+        const known = this.carried.get(callId);
+        const result = this.results.get(callId);
+        const carried = known ?? (result === undefined ? work() : Promise.resolve({ result }));
+        if (known === undefined) {
+            this.carried.set(callId, carried);
+            carried.catch(() => this.carried.delete(callId));
+        }
+        this.open++;
+        this.changed();
+        return carried
+            .then(async ({ result, returned, release }) => {
+            try {
+                await this.house.deliver('/kit/kit-calls/results/return', { call: callId, ...result });
+            }
+            finally {
+                this.returned.add(callId);
+                if (this.results.delete(callId))
+                    this.save();
+            }
+            if (known !== undefined)
+                return;
+            if (release) {
+                this.carried.delete(callId);
+                this.released.add(callId);
+            }
+            await returned?.();
+        })
+            .catch(logged)
+            .finally(() => {
+            this.open--;
+            this.changed();
+        });
+    }
+    save() {
+        const temporary = `${this.path}.${process.pid}`;
+        writeFileSync(temporary, JSON.stringify(Object.fromEntries(this.results)), { mode: 0o600 });
+        renameSync(temporary, this.path);
+    }
+}

package/dist/chatgpt.js

@@ -0,0 +1,32 @@
+import { parseArgs } from 'node:util';
+import { placeAppGit } from './app-git.js';
+import { kitHome, readOwnAgent, writeOwnAgent } from './home.js';
+import { accepted, DEFAULT_HOUSE } from './login.js';
+const KEY_SOURCE = 'New key for a script on Connections';
+const USAGE = `usage: kit chatgpt --key <key> [--house <origin>]
+  --key <key>       a key from ${KEY_SOURCE}
+  --house <origin>  the House of the key, ${DEFAULT_HOUSE} unless one is stored
+`;
+export async function chatgpt(argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: { key: { type: 'string' }, house: { type: 'string' }, help: { type: 'boolean', default: false } },
+    });
+    if (values.help) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (values.key === undefined)
+        throw new Error(`pass --key with a key from ${KEY_SOURCE}`);
+    const before = await readOwnAgent();
+    const house = values.house ?? before?.house ?? DEFAULT_HOUSE;
+    if (!(await accepted(house, values.key)))
+        throw new Error(`${house} does not accept this key; pass one from ${KEY_SOURCE}`);
+    const relay = process.env.HOUSE_KIT_RELAY || undefined;
+    await writeOwnAgent({ house, ...(relay === undefined ? {} : { relay }), credential: values.key });
+    await placeAppGit(await readOwnAgent()).catch((error) => process.stderr.write(`kit: ${error.message}\n`));
+    if (before !== null && before.credential !== values.key) {
+        process.stdout.write('This replaced the key this Kit home held; give each session its own HOUSE_KIT_HOME to keep its own key.\n');
+    }
+    process.stdout.write(`house now calls ${house} as you, with the key kept in ${kitHome()}.\n`);
+}

package/dist/chunks.js

@@ -0,0 +1,49 @@
+import { readFile, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { downloaded, fetched } from './files.js';
+const DOWNLOADS_AT_ONCE = 6;
+// A chunk is about one megabyte, so a download still unfinished after two minutes holds every Room behind it on a dead connection.
+const CHUNK_DOWNLOAD_MS = 120_000;
+class AddressExpired extends Error {
+    constructor() {
+        super("House's store refused every chunk it asked for");
+    }
+}
+function once(chunk) {
+    let asked = false;
+    return async () => {
+        if (asked)
+            throw new AddressExpired();
+        asked = true;
+        return { download: chunk.download, sha256: chunk.hash };
+    };
+}
+export async function stagedChunks(directory, chunks) {
+    let next = 0;
+    let failure;
+    const downloading = async () => {
+        while (next < chunks.length && failure === undefined) {
+            const chunk = chunks[next++];
+            const reading = (url) => fetched(url, AbortSignal.timeout(CHUNK_DOWNLOAD_MS));
+            await downloaded(once(chunk), reading, join(directory, chunk.hash), 'A Room chunk').catch((error) => {
+                failure ??= error;
+            });
+        }
+    };
+    await Promise.all(Array.from({ length: DOWNLOADS_AT_ONCE }, downloading));
+    return failure;
+}
+export async function* chunkTexts(directory, chunks, models) {
+    yield* models;
+    for (const { hash } of chunks) {
+        const file = join(directory, hash);
+        for (const line of (await readFile(file, 'utf8')).split('\n')) {
+            if (line === '')
+                continue;
+            const entry = JSON.parse(line);
+            if (entry.content !== undefined)
+                yield entry;
+        }
+        await rm(file);
+    }
+}

package/dist/clis.js

@@ -1,9 +1,11 @@
 import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { constants, readFileSync } from 'node:fs';
 import { access, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { homedir, userInfo } from 'node:os';
 import { delimiter, dirname, isAbsolute, join } from 'node:path';
-import { kitHome } from './home.js';
+import { releaseDirectory } from './placement.js';
+import { childEnvironment } from './relay.js';
 const HOUSE_EXECUTABLES = /^host_executable\(name = "house", paths = (\[.*\])\)$/m;
 function houseRule(houses) {
     return `prefix_rule(pattern = ["house"], decision = "allow")\nhost_executable(name = "house", paths = ${JSON.stringify(houses)})\n`;
@@ -13,11 +15,12 @@ const RAW_SUBTYPES = [
     'task_started',
     'task_updated',
     'task_notification',
+    'task_progress',
     'session_state_changed',
     'hook_started',
     'hook_response',
 ];
-export async function executable(path) {
+async function executable(path) {
     try {
         await access(path, constants.X_OK);
         return true;
@@ -54,19 +57,31 @@ export async function allowHouseInCodex(path) {
             houses.push(house);
     }
     await mkdir(rules, { recursive: true });
-    const temporary = `${file}.${process.pid}`;
+    const temporary = `${file}.${randomUUID()}`;
     await writeFile(temporary, houseRule(houses));
     await rename(temporary, file);
 }
 async function nothing() { }
+function claudeQuestionFields(request) {
+    const properties = request.requestedSchema?.properties ?? {};
+    return Object.keys(properties).filter((name) => properties[name]._meta?.jetbrains?.air?.customAnswer !== undefined);
+}
+function codexQuestionFields(request) {
+    const { _meta, requestedSchema } = request;
+    return _meta?.codex === undefined ? [] : (requestedSchema?.required ?? []);
+}
+function answered(error) {
+    return typeof error === 'object' && error !== null ? error : {};
+}
 function bridgeInClaudeSandbox(bridge) {
     return process.platform === 'darwin' ? { allowUnixSockets: [bridge] } : { allowAllUnixSockets: true };
 }
 export const CLIS = {
     'codex-acp': {
         bin: 'codex',
-        minimum: '0.159.1',
+        minimum: '0.160.1',
         install: 'curl -fsSL https://chatgpt.com/codex/install.sh | sh',
+        update: 'codex update',
         adapter: {
             package: '@agentclientprotocol/codex-acp',
             bin: 'codex-acp',
@@ -76,16 +91,22 @@ export const CLIS = {
         args: [],
         fullAccess: 'agent-full-access',
         sessionMeta: () => ({}),
+        unknownSession: (error) => {
+            const { code, data } = answered(error);
+            return code === -32603 && typeof data?.details === 'string' && data.details.startsWith('no rollout found');
+        },
         renames: true,
         allowHouse: allowHouseInCodex,
+        questionFields: codexQuestionFields,
         signedIn: { command: ['login', 'status'] },
         login: { args: ['login', '--device-auth'], code: 'show' },
         air: ['asyncTasks', 'nativeSubagentSessions'],
     },
     'claude-agent-acp': {
         bin: 'claude',
-        minimum: '2.1.286',
+        minimum: '2.1.303',
         install: 'curl -fsSL https://claude.ai/install.sh | bash',
+        update: 'claude update',
         adapter: {
             package: '@agentclientprotocol/claude-agent-acp',
             bin: 'claude-agent-acp',
@@ -102,11 +123,13 @@ export const CLIS = {
                     title,
                     settings: { sandbox: { network: bridgeInClaudeSandbox(bridge) } },
                 },
-                emitRawSDKMessages: RAW_SUBTYPES.map((subtype) => ({ type: 'system', subtype })),
+                emitRawSDKMessages: [...RAW_SUBTYPES.map((subtype) => ({ type: 'system', subtype })), { type: 'result' }],
             },
         }),
+        unknownSession: (error) => answered(error).code === -32002,
         renames: false,
         allowHouse: nothing,
+        questionFields: claudeQuestionFields,
         signedIn: { command: ['auth', 'status'] },
         login: { args: ['auth', 'login', '--claudeai'], code: 'collect', rejected: 'Invalid code' },
         air: ['asyncTasks', 'sessionFailure'],
@@ -115,50 +138,37 @@ export const CLIS = {
         bin: 'grok',
         minimum: '1.0.46',
         install: 'curl -fsSL https://x.ai/cli/install.sh | bash',
+        update: 'grok update',
         adapter: null,
         args: ['--sandbox', 'off', 'agent', '--always-approve', '--no-leader', 'stdio'],
         fullAccess: null,
         sessionMeta: () => ({}),
+        unknownSession: (error) => answered(error).data?.code === 'FS_NOT_FOUND',
         renames: false,
         allowHouse: nothing,
+        questionFields: () => [],
         signedIn: { initializeMeta: 'defaultAuthMethodId' },
         login: { args: ['login', '--device-auth'], code: 'show' },
         air: ['asyncTasks'],
     },
 };
 const KIT_PACKAGE = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
-export const KIT_VERSION = KIT_PACKAGE.version;
-const PROXY = /^https?_proxy$/i;
+export const KIT_RELEASE = KIT_PACKAGE.version;
 const VERSION = /\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?/;
-// An install still running after fifteen minutes is ended and reported as failed, so a hung download cannot hold its CLI's report.
+// An install or update still running after fifteen minutes is ended as failed, so a hung download can neither hold its CLI's report nor keep the Kit busy.
 const INSTALL_MS = 15 * 60_000;
 // A login shell or a version read is ended after half a minute, so a profile that waits for input cannot stall the report.
 const READ_MS = 30_000;
 const CAUSE_CHARACTERS = 4000;
-function prefix(kind) {
-    return join(kitHome(), 'agents', kind);
-}
 export function adapterCommand(kind) {
-    return join(prefix(kind), 'node_modules', '.bin', CLIS[kind].adapter.bin);
-}
-async function installedAdapter(kind) {
-    try {
-        const manifest = join(prefix(kind), 'node_modules', CLIS[kind].adapter.package, 'package.json');
-        return JSON.parse(await readFile(manifest, 'utf8')).version;
-    }
-    catch {
-        return null;
-    }
-}
-export function withoutProxy() {
-    return Object.fromEntries(Object.entries(process.env).filter(([name]) => !PROXY.test(name)));
+    return join(releaseDirectory(KIT_RELEASE), 'adapters', kind, 'node_modules', '.bin', CLIS[kind].adapter.bin);
 }
 export function run(command, args, timeoutMs, detached = false, signal) {
     return new Promise((resolve) => {
         const child = spawn(command, args, {
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
-            env: withoutProxy(),
+            env: childEnvironment(),
             detached,
             signal: detached ? undefined : signal,
         });
@@ -192,19 +202,18 @@ export function run(command, args, timeoutMs, detached = false, signal) {
 export function failureOf(ran, program) {
     return ran.output.trim().slice(-CAUSE_CHARACTERS) || `${program} exited with ${ran.status ?? 'a signal'}`;
 }
-export async function installAdapter(kind, signal) {
-    const adapter = CLIS[kind].adapter;
-    if (adapter === null)
-        return null;
-    const release = KIT_PACKAGE.peerDependencies[adapter.package];
-    if ((await installedAdapter(kind)) === release)
-        return null;
-    const ran = await run('npm', ['install', '--prefix', prefix(kind), '--no-save', '--no-audit', '--no-fund', '--omit=optional', `${adapter.package}@${release}`], INSTALL_MS, true, signal);
-    return ran.status === 0 ? null : failureOf(ran, 'npm');
+export function adapterArchive(kind) {
+    return `${kind}-${KIT_PACKAGE.peerDependencies[CLIS[kind].adapter.package]}.tar.gz`;
 }
-export async function installCli(kind, signal) {
-    const ran = await run('bash', ['-o', 'pipefail', '-c', CLIS[kind].install], INSTALL_MS, true, signal);
-    return ran.status === 0 ? null : failureOf(ran, 'the install');
+async function bounded(program, work, signal) {
+    const deadline = AbortSignal.timeout(INSTALL_MS);
+    const ran = await work(signal === undefined ? deadline : AbortSignal.any([signal, deadline]));
+    if (deadline.aborted && signal?.aborted !== true)
+        return `${program} did not end within ${INSTALL_MS / 1000} seconds`;
+    return ran.status === 0 ? null : failureOf(ran, program);
+}
+export function installCli(kind, signal) {
+    return bounded('the install', (within) => run('bash', ['-o', 'pipefail', '-c', CLIS[kind].install], INSTALL_MS, true, within), signal);
 }
 function loginShell() {
     return process.env.SHELL || userInfo().shell;
@@ -212,13 +221,19 @@ function loginShell() {
 const FOUND = 'house-kit-cli ';
 const LOOKUP = `found=$(command -v "$1") || exit 0; case $found in /*) ;; *) found=$(pwd -P)/$found ;; esac; printf "${FOUND}%s\\n" "$found"`;
 const USER_BIN = 'case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) PATH="$PATH:$HOME/.local/bin" ;; esac; export PATH';
-function inLoginShell(script, argument = '', signal) {
-    return run(loginShell(), ['-l', '-i', '-c', `exec /bin/sh -c '${USER_BIN}; ${script}' sh ${argument}`], READ_MS, true, signal);
+function inLoginShell(script, argument = '', signal, timeoutMs = READ_MS) {
+    return run(loginShell(), ['-l', '-i', '-c', `exec /bin/sh -c '${USER_BIN}; ${script}' sh ${argument}`], timeoutMs, true, signal);
 }
-export async function locate(kind, signal) {
-    const ran = await inLoginShell(LOOKUP, CLIS[kind].bin, signal);
+export async function onLoginPath(program, signal) {
+    const ran = await inLoginShell(LOOKUP, program, signal);
     return ran.stdout.split('\n').findLast((line) => line.startsWith(FOUND))?.slice(FOUND.length) ?? null;
 }
+export function locate(kind, signal) {
+    return onLoginPath(CLIS[kind].bin, signal);
+}
+export function updateCli(kind) {
+    return bounded('the update', (within) => inLoginShell(CLIS[kind].update, '', within, INSTALL_MS));
+}
 export async function loginPath() {
     const marker = 'house-kit-path ';
     const ran = await inLoginShell(`printf "${marker}%s\\n" "$PATH"`);