@claudexor/cli 3.6.0 → 3.8.1

package/dist/harness-install-recipes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-install-recipes.d.ts","sourceRoot":"","sources":["../src/harness-install-recipes.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,kBAAkB,CAE/E;AAED;;yDAEyD;AACzD,eAAO,MAAM,uBAAuB,YAAI,OAAO,EAAE,QAAQ,CAAU,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,oBAAoB,CAEnF;AAED,uEAAuE;AACvE,eAAO,MAAM,cAAc,EAAE,MAAM,CACjC,oBAAoB,EACpB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAOpD,CAAC;AAEF;;;;;;aAMa;AACb,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,oBAAoB,GACpB,gBAAgB;AAClB;;qDAEqD;GACnD,qBAAqB,CAAC;AAE1B,eAAO,MAAM,QAAQ,EAAE,OAAO,CAC5B,MAAM,CACJ,kBAAkB,EAClB;IACE,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,sBAAsB,CAAC;IAChC,YAAY,EAAE,OAAO,CAAC,0BAA0B,EAAE,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;CAC7F,CACF,CAoBF,CAAC;AAEF,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAC/D;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,8CAA8C,CAAC;AAC3E,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,+CAA+C,CAAC;AAEpF;;2EAE2E;AAC3E,QAAA,MAAM,iBAAiB,EAAE,MAAM,CAC7B,KAAK,GAAG,QAAQ,EAChB;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB,CAoBF,CAAC;AAEF,KAAK,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAElF;sEACsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,eAAe,GAAG,IAAI,CAInF;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,yEAAyE;IACzE,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB;;gBAEY;IACZ,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;+EAE2E;IAC3E,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,kBAAkB,EAC3B,MAAM,GAAE,oBAA+B,GACtC,0BAA0B,CAqC5B"}

package/dist/harness-install-recipes.js

@@ -0,0 +1,130 @@
+/**
+ * The vendor RECIPES `claudexor harness install` executes, and the disclosure
+ * it prints before executing anything. Split from harness-installer.ts so the
+ * WHAT (which artifact, from where, into which prefix, with what evidence)
+ * stays readable next to itself, while the installer file owns the HOW
+ * (lease, spawn, proof, CLI surface). A new vendor is a row in one of the two
+ * tables here, never a new branch there.
+ */
+import { join } from "node:path";
+import { CLAUDE_VENDOR_CLI_VERSION } from "@claudexor/harness-claude";
+import { CODEX_VENDOR_CLI_VERSION } from "@claudexor/harness-codex";
+import { OPENCODE_VENDOR_CLI_VERSION } from "@claudexor/harness-opencode";
+import { managedNodeRoot } from "@claudexor/core";
+import { INSTALLABLE_HARNESSES } from "./harness-command-specs.js";
+export function isInstallableHarness(value) {
+    return INSTALLABLE_HARNESSES.includes(value);
+}
+/** Install destinations. `remote` is the historical issue-#89 SSH-host prefix;
+ * `local` is the managed toolchain root this host's harness resolution already
+ * reads, so an install there is immediately runnable. */
+export const HARNESS_INSTALL_TARGETS = ["local", "remote"];
+export function isHarnessInstallTarget(value) {
+    return HARNESS_INSTALL_TARGETS.includes(value);
+}
+/** ONE table owns each target's npm prefix and how it is disclosed. */
+export const TARGET_LAYOUTS = {
+    local: { displayRoot: "~/.claudexor/node", root: managedNodeRoot },
+    remote: {
+        displayRoot: "~/.claudexor/remote/vendor",
+        root: (home) => join(home, ".claudexor", "remote", "vendor"),
+    },
+};
+export const NPM_PINS = {
+    claude: {
+        npmPackage: "@anthropic-ai/claude-code",
+        binaryNames: ["claude"],
+        version: CLAUDE_VENDOR_CLI_VERSION,
+        verification: "release_verified",
+    },
+    codex: {
+        npmPackage: "@openai/codex",
+        binaryNames: ["codex"],
+        version: CODEX_VENDOR_CLI_VERSION,
+        verification: "release_verified",
+    },
+    opencode: {
+        npmPackage: "opencode-ai",
+        binaryNames: ["opencode"],
+        version: OPENCODE_VENDOR_CLI_VERSION,
+        verification: "deterministic_only",
+    },
+};
+export const CURSOR_INSTALL_URL = "https://cursor.com/install";
+/**
+ * Google's official Antigravity CLI installer, as published on
+ * antigravity.google/docs/cli/install (`curl -fsSL <this url> | bash`, which
+ * Claudexor deliberately does NOT do — see the header). Verified end to end on
+ * 2026-08-16: the script fetched from this URL installed agy 1.1.13 to
+ * `~/.local/bin/agy`, which is the destination disclosed below. The vendor
+ * ships one signed Go binary and no npm package, so it takes the same
+ * human-observed path as cursor.
+ */
+export const AGY_INSTALL_URL = "https://antigravity.google/cli/install.sh";
+/** The vendor's Windows installer, from the same documentation page. */
+export const AGY_INSTALL_URL_WINDOWS = "https://antigravity.google/cli/install.ps1";
+/** Vendors distributed as a shell installer instead of a pinnable npm
+ * artifact. ONE branch serves both entries; the per-harness text below is the
+ * only thing that differs, so a third such vendor is a row, not a fork. */
+const SCRIPT_INSTALLERS = {
+    agy: {
+        binaryName: "agy",
+        url: AGY_INSTALL_URL,
+        // The one vendor here that publishes a Windows installer of its own; the
+        // POSIX row would otherwise be all Claudexor could honestly offer.
+        windowsUrl: AGY_INSTALL_URL_WINDOWS,
+        installLocation: "~/.local/bin (as selected by Google's Antigravity installer)",
+        pinNote: "none — Antigravity ships no pinnable npm artifact; the vendor script is downloaded in full, its size and sha256 print, and it runs in this terminal where you watch it",
+    },
+    cursor: {
+        // The legacy alias every Cursor login/run surface already consumes.
+        binaryName: "cursor-agent",
+        url: CURSOR_INSTALL_URL,
+        installLocation: "~/.local/bin (or ~/.cursor/bin, as selected by Cursor's installer)",
+        pinNote: "none — Cursor ships no pinnable npm artifact; the vendor script is downloaded in full, its size and sha256 print, and it runs in this terminal where you watch it",
+    },
+};
+/** Membership is asked of the TABLE, never re-typed: a third script vendor is
+ * one row, and cannot be added to the table yet fall through here. */
+export function scriptInstaller(harness) {
+    return Object.hasOwn(SCRIPT_INSTALLERS, harness)
+        ? SCRIPT_INSTALLERS[harness]
+        : null;
+}
+export function harnessInstallerDisclosure(harness, target = "remote") {
+    const layout = TARGET_LAYOUTS[target];
+    const pin = NPM_PINS[harness];
+    if (pin) {
+        return {
+            harness,
+            target,
+            command: `npm install --global --prefix ${layout.displayRoot} ${pin.npmPackage}@${pin.version}`,
+            installLocation: `${layout.displayRoot}/bin`,
+            pinnedVersion: pin.version,
+            verification: pin.verification,
+        };
+    }
+    const script = scriptInstaller(harness);
+    /* c8 ignore next -- every non-npm harness has a script row; this is the
+       unreachable guard that keeps the two tables honest. */
+    if (!script)
+        throw new Error(`harness ${harness} has neither an npm pin nor a script installer`);
+    const windows = process.platform === "win32";
+    const url = windows ? (script.windowsUrl ?? script.url) : script.url;
+    const file = windows && script.windowsUrl ? "install.ps1" : "install.sh";
+    const runner = windows && script.windowsUrl ? "powershell -ExecutionPolicy Bypass -File" : "/bin/sh";
+    return {
+        harness,
+        target,
+        command: `curl --fail --silent --show-error --location ${url} ` +
+            `--output <private-tmpdir>/${file} && ${runner} <private-tmpdir>/${file}`,
+        // The vendor script picks its own destination, so the local target cannot
+        // move it; only the WITNESS differs between the two targets.
+        installLocation: windows && script.windowsUrl
+            ? "%LOCALAPPDATA%\\agy\\bin (as selected by Google's Antigravity installer)"
+            : script.installLocation,
+        pinnedVersion: null,
+        verification: target === "local" ? "unattended_unpinned" : "human_observed",
+    };
+}
+//# sourceMappingURL=harness-install-recipes.js.map

package/dist/harness-install-recipes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-install-recipes.js","sourceRoot":"","sources":["../src/harness-install-recipes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAInE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAA2B,CAAC,CAAC;AACrE,CAAC;AAED;;yDAEyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAGpE,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,KAA6B,CAAC,CAAC;AACzE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAGvB;IACF,KAAK,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAE;IAClE,MAAM,EAAE;QACN,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC;KAC7D;CACF,CAAC;AAkBF,MAAM,CAAC,MAAM,QAAQ,GAWjB;IACF,MAAM,EAAE;QACN,UAAU,EAAE,2BAA2B;QACvC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACvB,OAAO,EAAE,yBAAyB;QAClC,YAAY,EAAE,kBAAkB;KACjC;IACD,KAAK,EAAE;QACL,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE,kBAAkB;KACjC;IACD,QAAQ,EAAE;QACR,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,2BAA2B;QACpC,YAAY,EAAE,oBAAoB;KACnC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAC3E,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,4CAA4C,CAAC;AAEpF;;2EAE2E;AAC3E,MAAM,iBAAiB,GAUnB;IACF,GAAG,EAAE;QACH,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,eAAe;QACpB,yEAAyE;QACzE,mEAAmE;QACnE,UAAU,EAAE,uBAAuB;QACnC,eAAe,EAAE,8DAA8D;QAC/E,OAAO,EACL,wKAAwK;KAC3K;IACD,MAAM,EAAE;QACN,oEAAoE;QACpE,UAAU,EAAE,cAAc;QAC1B,GAAG,EAAE,kBAAkB;QACvB,eAAe,EAAE,oEAAoE;QACrF,OAAO,EACL,mKAAmK;KACtK;CACF,CAAC;AAIF;sEACsE;AACtE,MAAM,UAAU,eAAe,CAAC,OAA2B;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC;QAC9C,CAAC,CAAC,iBAAiB,CAAC,OAAyC,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAkBD,MAAM,UAAU,0BAA0B,CACxC,OAA2B,EAC3B,MAAM,GAAyB,QAAQ;IAEvC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,OAAO;YACP,MAAM;YACN,OAAO,EAAE,iCAAiC,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,EAAE;YAC/F,eAAe,EAAE,GAAG,MAAM,CAAC,WAAW,MAAM;YAC5C,aAAa,EAAE,GAAG,CAAC,OAAO;YAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC;6DACyD;IACzD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,gDAAgD,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACrE,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IACzE,MAAM,MAAM,GACV,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,OAAO;QACL,OAAO;QACP,MAAM;QACN,OAAO,EACL,gDAAgD,GAAG,GAAG;YACtD,6BAA6B,IAAI,OAAO,MAAM,qBAAqB,IAAI,EAAE;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,eAAe,EACb,OAAO,IAAI,MAAM,CAAC,UAAU;YAC1B,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,MAAM,CAAC,eAAe;QAC5B,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB;KAC5E,CAAC;AACJ,CAAC"}

package/dist/harness-installer.d.ts

@@ -1,7 +1,9 @@
 /**
- * `claudexor harness install` — the disclosed, pinned remote vendor installer
+ * `claudexor harness install` — the disclosed, pinned vendor installer
  * (issue #89; restored from the PR #82 cut with the security objections
- * fixed).
+ * fixed). The historical/default `remote` target remains the SSH-host flow;
+ * an explicit `local` target installs into the managed toolchain root that
+ * local harness resolution already owns.
  *
  * Contract:
  * - npm-distributed harnesses (claude/codex/opencode) install ONE exact
@@ -16,13 +18,26 @@
  *   downloaded first (never piped to a shell), its size and sha256 are
  *   printed, and it runs in the visible PTY the operator is watching — the
  *   same principle as interactive SSH auth.
- * - NOTHING executes without disclosure: the exact command and install
+ * - NOTHING executes without authorization: the exact command and install
  *   destination print first, and execution needs a TTY confirmation or an
  *   explicit `--yes` (the macOS flow confirms against this module's own
- *   `--dry-run --json` disclosure before passing `--yes`).
- * - failures are typed and loud; a failed download or non-zero installer exit
- *   never reads as success, and the temp download dir is removed on every
- *   path.
+ *   `--dry-run --json` disclosure before passing `--yes`). For a host
+ *   integration, `--target local --yes` IS that authorization, granted by the
+ *   owner action that invoked it; there is no second confirmation hidden
+ *   inside the producer, and the unattended script path never claims the
+ *   human-observed verification the watched remote path earns.
+ * - concurrent installs into one prefix are serialized by a cross-process
+ *   lease. A lease whose owner died is NOT reclaimed automatically: it fails
+ *   closed with a typed `install_lock_stale` and the exact cleanup path.
+ * - failures are typed and loud; a failed download, a non-zero installer exit,
+ *   or a failed post-install binary/version proof never reads as success, and
+ *   the temp download dir is removed on every path.
+ * - the post-install PROOF is what the local target has instead of a witness.
+ *   A watched remote install keeps the historical exit-code contract, because
+ *   the operator is looking at the terminal; an unattended local install must
+ *   earn its `ok:true`, so exit zero without a resolvable launcher and a
+ *   matching `--version` is a typed failure, and `installedBinary` /
+ *   `installedVersion` are present on every local success.
  * - `--json` keeps stdout pure: exactly ONE JSON object. In json mode every
  *   human progress line goes to stderr and child processes (npm/curl/the
  *   vendor script) run with their stdout routed onto stderr, so vendor
@@ -31,56 +46,40 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync } from "node:fs";
 import { type ParsedArgs } from "./args.js";
-import { INSTALLABLE_HARNESSES } from "./harness-command-specs.js";
-export type InstallableHarness = (typeof INSTALLABLE_HARNESSES)[number];
-export declare function isInstallableHarness(value: string): value is InstallableHarness;
-/** Exact npm pins. Each version ALIASES the harness package's vendor-version
- * SSOT (vendor-cli-version.ts there). For claude/codex that is the version
- * this release's freshness gates verified; the opencode pin is a
- * deterministic install target only — no recorded verification fixture
- * vouches for it (its vendor-cli-version.ts discloses this). Cursor and agy
- * are absent deliberately: they ship no npm artifact (see SCRIPT_INSTALLERS
- * below). */
-export type HarnessInstallVerification = "release_verified" | "deterministic_only" | "human_observed";
-export declare const CURSOR_INSTALL_URL = "https://cursor.com/install";
-/**
- * Google's official Antigravity CLI installer, as published on
- * antigravity.google/docs/cli/install (`curl -fsSL <this url> | bash`, which
- * Claudexor deliberately does NOT do — see the header). Verified end to end on
- * 2026-08-16: the script fetched from this URL installed agy 1.1.13 to
- * `~/.local/bin/agy`, which is the destination disclosed below. The vendor
- * ships one signed Go binary and no npm package, so it takes the same
- * human-observed path as cursor.
- */
-export declare const AGY_INSTALL_URL = "https://antigravity.google/cli/install.sh";
-/** The vendor's Windows installer, from the same documentation page. */
-export declare const AGY_INSTALL_URL_WINDOWS = "https://antigravity.google/cli/install.ps1";
-export interface HarnessInstallerDisclosure {
-    harness: InstallableHarness;
-    command: string;
-    installLocation: string;
-    /** Exact vendor version the command installs; null exactly for the script
-     * vendors (cursor, agy), which have no pinnable artifact — disclosed, never
-     * faked. */
-    pinnedVersion: string | null;
-    /** Evidence behind the install target. Package-registry integrity verifies
-     * downloaded bytes for every npm pin, but only release_verified means the
-     * exact vendor version was exercised by this release's freshness gates. */
-    verification: HarnessInstallVerification;
-}
-export declare function harnessInstallerDisclosure(harness: InstallableHarness): HarnessInstallerDisclosure;
+import { type HarnessInstallTarget, type InstallableHarness } from "./harness-install-recipes.js";
+export { AGY_INSTALL_URL, AGY_INSTALL_URL_WINDOWS, CURSOR_INSTALL_URL, HARNESS_INSTALL_TARGETS, harnessInstallerDisclosure, isHarnessInstallTarget, isInstallableHarness, type HarnessInstallTarget, type InstallableHarness, } from "./harness-install-recipes.js";
 export interface HarnessInstallRunResult {
     exitCode: number;
     /** Set when the installer refused loudly WITHOUT running the vendor
      * payload (failed/unreadable download); never a silent partial install. */
     refusal?: string;
+    /** Stable machine reason when the payload did not run or did not verify. */
+    code?: string;
+    /** Evidence for the exact unpinned vendor-script bytes that ran. */
+    installerSha256?: string;
+    installerByteLength?: number;
+    /** Present on every SUCCESS: the absolute launcher the proof executed. */
+    installedBinary?: string;
+    /** Present on every SUCCESS: the exact npm pin, or the script vendor's own
+     * trimmed `--version` line. */
+    installedVersion?: string;
 }
 export declare function runHarnessInstaller(harness: InstallableHarness, options?: {
     home?: string;
     nodePath?: string;
+    /** Explicit install layout. Omitted preserves the historical remote target. */
+    target?: HarnessInstallTarget;
     spawn?: typeof spawnSync;
     mkdir?: typeof mkdirSync;
     exists?: typeof existsSync;
+    /** Production installs serialize cross-process. Tests may disable only this
+     * wrapper while preserving the install recipe under test. */
+    lock?: boolean;
+    lockTimeoutMs?: number;
+    platform?: NodeJS.Platform;
+    /** Test/integration source before the clean allowlist and target-aware PATH
+     * normalization are applied. Provider credentials are still scrubbed. */
+    sourceEnv?: NodeJS.ProcessEnv;
     /** `--json` stdout purity: route human progress lines AND child stdout
      * to stderr, so stdout carries exactly one JSON object (the caller's
      * final envelope). Human mode keeps everything on stdout as before. */
@@ -88,5 +87,5 @@ export declare function runHarnessInstaller(harness: InstallableHarness, options
 }): HarnessInstallRunResult;
 export declare function harnessInstallCommand(args: ParsedArgs, json: boolean, 
 /** Test seam: forwarded to `runHarnessInstaller` (spawn/home/... fakes). */
-runnerOptions?: Omit<NonNullable<Parameters<typeof runHarnessInstaller>[1]>, "json">): number;
+runnerOptions?: Omit<NonNullable<Parameters<typeof runHarnessInstaller>[1]>, "json" | "target">): number;
 //# sourceMappingURL=harness-installer.d.ts.map

package/dist/harness-installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness-installer.d.ts","sourceRoot":"","sources":["../src/harness-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAA+C,MAAM,SAAS,CAAC;AAQ7F,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,kBAAkB,CAE/E;AAED;;;;;;aAMa;AACb,MAAM,MAAM,0BAA0B,GACpC,kBAAkB,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;AA6B/D,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAC/D;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,8CAA8C,CAAC;AAC3E,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,+CAA+C,CAAC;AAoCpF,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB;;gBAEY;IACZ,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;+EAE2E;IAC3E,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,kBAAkB,GAC1B,0BAA0B,CAgC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB;+EAC2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,GAAE;IACP,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,UAAU,CAAC;IAC3B;;2EAEuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;CACX,GACL,uBAAuB,CAkGzB;AAwCD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,OAAO;AACb,4EAA4E;AAC5E,aAAa,GAAE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAM,GACvF,MAAM,CAoDR"}
+{"version":3,"file":"harness-installer.d.ts","sourceRoot":"","sources":["../src/harness-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAA+C,MAAM,SAAS,CAAC;AAI7F,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAe/D,OAAO,EAQL,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB;+EAC2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;mCAC+B;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6CD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,GAAE;IACP,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,UAAU,CAAC;IAC3B;iEAC6D;IAC7D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B;6EACyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC9B;;2EAEuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;CACX,GACL,uBAAuB,CAkNzB;AA8CD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,OAAO;AACb,4EAA4E;AAC5E,aAAa,GAAE,IAAI,CACjB,WAAW,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EACtD,MAAM,GAAG,QAAQ,CACb,GACL,MAAM,CA0ER"}