@cloudcli-ai/cloudcli 1.36.3 → 1.37.1

package/server/modules/providers/tests/sessions.service.test.ts

@@ -0,0 +1,127 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import { closeConnection, initializeDatabase, projectsDb, sessionsDb } from '@/modules/database/index.js';
+import { sessionsService } from '@/modules/providers/services/sessions.service.js';
+
+async function withIsolatedDatabase(runTest: () => void | Promise<void>): Promise<void> {
+  const previousDatabasePath = process.env.DATABASE_PATH;
+  const tempDirectory = await mkdtemp(path.join(os.tmpdir(), 'sessions-service-db-'));
+
+  closeConnection();
+  process.env.DATABASE_PATH = path.join(tempDirectory, 'auth.db');
+  await initializeDatabase();
+
+  try {
+    await runTest();
+  } finally {
+    closeConnection();
+    if (previousDatabasePath === undefined) {
+      delete process.env.DATABASE_PATH;
+    } else {
+      process.env.DATABASE_PATH = previousDatabasePath;
+    }
+    await rm(tempDirectory, { recursive: true, force: true });
+  }
+}
+
+test('provider session id returns the mapped native id', { concurrency: false }, async () => {
+  await withIsolatedDatabase(() => {
+    sessionsDb.createAppSession('app-session-id', 'codex', '/tmp/session-id-copy-project');
+    sessionsDb.assignProviderSessionId('app-session-id', 'codex-native-session-id');
+
+    assert.equal(sessionsService.getProviderSessionId('app-session-id'), 'codex-native-session-id');
+  });
+});
+
+test('app session names use at most four whole words from the initial message', { concurrency: false }, async () => {
+  await withIsolatedDatabase(() => {
+    const result = sessionsService.createAppSession(
+      'codex',
+      '/tmp/session-name-project',
+      '  supercalifragilisticexpialidocious\nsecond   third fourth fifth  ',
+    );
+
+    assert.equal(result.sessionName, 'supercalifragilisticexpialidocious second third fourth');
+    assert.equal(
+      sessionsDb.getSessionById(result.sessionId)?.custom_name,
+      'supercalifragilisticexpialidocious second third fourth',
+    );
+  });
+});
+
+test('app sessions without message text receive a stable fallback name', { concurrency: false }, async () => {
+  await withIsolatedDatabase(() => {
+    const result = sessionsService.createAppSession('claude', '/tmp/attachment-only-project', '  \n ');
+
+    assert.equal(result.sessionName, 'Untitled Session');
+    assert.equal(sessionsDb.getSessionById(result.sessionId)?.custom_name, 'Untitled Session');
+  });
+});
+
+test('provider session id is unavailable until the provider assigns one', { concurrency: false }, async () => {
+  await withIsolatedDatabase(() => {
+    sessionsDb.createAppSession('pending-app-session', 'claude', '/tmp/session-id-copy-project');
+
+    assert.throws(
+      () => sessionsService.getProviderSessionId('pending-app-session'),
+      (error: unknown) => {
+        const typedError = error as { code?: string; statusCode?: number };
+        return typedError.code === 'PROVIDER_SESSION_ID_NOT_AVAILABLE' && typedError.statusCode === 409;
+      },
+    );
+  });
+});
+
+test('provider session id reports a missing app session', { concurrency: false }, async () => {
+  await withIsolatedDatabase(() => {
+    assert.throws(
+      () => sessionsService.getProviderSessionId('missing-session'),
+      (error: unknown) => {
+        const typedError = error as { code?: string; statusCode?: number };
+        return typedError.code === 'SESSION_NOT_FOUND' && typedError.statusCode === 404;
+      },
+    );
+  });
+});
+
+test('recent sessions map project metadata and preserve database pagination', { concurrency: false }, async () => {
+  await withIsolatedDatabase(() => {
+    sessionsDb.createSession(
+      'older-session',
+      'claude',
+      '/tmp/recent-project',
+      'Older conversation',
+      '2026-08-01T08:00:00.000Z',
+      '2026-08-01T09:00:00.000Z',
+    );
+    sessionsDb.createSession(
+      'newer-session',
+      'codex',
+      '/tmp/recent-project',
+      'Newer conversation',
+      '2026-08-01T10:00:00.000Z',
+      '2026-08-01T11:00:00.000Z',
+    );
+    projectsDb.updateCustomProjectName('/tmp/recent-project', 'Recent Project');
+
+    const project = projectsDb.getProjectPath('/tmp/recent-project');
+    const page = sessionsService.listRecentSessions(1, 0);
+
+    assert.deepEqual(page, {
+      conversations: [{
+        sessionId: 'newer-session',
+        provider: 'codex',
+        projectId: project?.project_id ?? null,
+        projectDisplayName: 'Recent Project',
+        sessionTitle: 'Newer conversation',
+        lastActivity: '2026-08-01T11:00:00.000Z',
+      }],
+      total: 2,
+      hasMore: true,
+    });
+  });
+});

package/server/modules/providers/tests/skills.test.ts

@@ -319,8 +319,8 @@ test('providerSkillsService lists claude user, project, and enabled plugin skill
 });
 
 /**
- * This test covers Codex repository/user/system skill folders and verifies that
- * repository lookup includes cwd, parent, and git root skill locations.
+ * This test covers Codex repository/user/system skill folders, including both
+ * supported user roots, and verifies repository lookup across cwd, parent, and git root.
  */
 test('providerSkillsService lists codex repository, user, and system skills', { concurrency: false }, async () => {
   const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'llm-skills-codex-'));
@@ -355,6 +355,12 @@ test('providerSkillsService lists codex repository, user, and system skills', {
       'codex-user',
       'Codex user skill',
     );
+    await writeSkill(
+      path.join(tempRoot, '.codex', 'skills'),
+      'codex-home-user-dir',
+      'codex-home-user',
+      'Codex home user skill',
+    );
     await writeSkill(
       path.join(tempRoot, '.codex', 'skills', '.system'),
       'codex-system-dir',
@@ -369,6 +375,7 @@ test('providerSkillsService lists codex repository, user, and system skills', {
     assert.equal(byName.get('codex-parent')?.scope, 'repo');
     assert.equal(byName.get('codex-root')?.scope, 'repo');
     assert.equal(byName.get('codex-user')?.scope, 'user');
+    assert.equal(byName.get('codex-home-user')?.scope, 'user');
     assert.equal(byName.get('codex-system')?.scope, 'system');
     assert.equal(byName.get('codex-root')?.command, '$codex-root');
   } finally {

package/server/modules/settings/index.ts

@@ -0,0 +1,2 @@
+// settingsRoutes: used by the server entrypoint to mount protected application-settings endpoints.
+export { settingsRoutes } from './settings.module.js';

package/server/modules/settings/settings.module.ts

@@ -0,0 +1,50 @@
+import {
+  apiKeysDb,
+  credentialsDb,
+  notificationPreferencesDb,
+  pushSubscriptionsDb,
+} from '@/modules/database/index.js';
+import {
+  createNotificationEvent,
+  getPublicKey,
+  notifyUserIfEnabled,
+} from '@/modules/notifications/index.js';
+
+import { createSettingsRouter } from './settings.routes.js';
+import { createSettingsService } from './settings.service.js';
+
+const settingsService = createSettingsService({
+  apiKeys: {
+    list: (userId) => apiKeysDb.getApiKeys(userId),
+    create: (userId, keyName) => apiKeysDb.createApiKey(userId, keyName),
+    remove: (userId, keyId) => apiKeysDb.deleteApiKey(userId, keyId),
+    toggle: (userId, keyId, isActive) => apiKeysDb.toggleApiKey(userId, keyId, isActive),
+  },
+  credentials: {
+    list: (userId, type) => credentialsDb.getCredentials(userId, type),
+    create: (userId, name, type, value, description) =>
+      credentialsDb.createCredential(userId, name, type, value, description),
+    remove: (userId, credentialId) => credentialsDb.deleteCredential(userId, credentialId),
+    toggle: (userId, credentialId, isActive) =>
+      credentialsDb.toggleCredential(userId, credentialId, isActive),
+  },
+  notifications: {
+    getPreferences: (userId) => notificationPreferencesDb.getPreferences(userId),
+    updatePreferences: (userId, preferences) =>
+      notificationPreferencesDb.updatePreferences(userId, preferences),
+    createEnabledEvent: () => createNotificationEvent({
+      provider: 'system', kind: 'info', code: 'push.enabled',
+      meta: { message: 'Push notifications are now enabled!' }, severity: 'info',
+    }),
+    notifyUser: (userId, event) => notifyUserIfEnabled({ userId, event }),
+  },
+  pushSubscriptions: {
+    save: (userId, endpoint, p256dh, auth) =>
+      pushSubscriptionsDb.saveSubscription(userId, endpoint, p256dh, auth),
+    remove: (endpoint) => pushSubscriptionsDb.removeSubscription(endpoint),
+  },
+  getVapidPublicKey: getPublicKey,
+});
+
+/** Settings router assembled for the authenticated server mount. */
+export const settingsRoutes = createSettingsRouter(settingsService);

package/server/modules/settings/settings.routes.ts

@@ -0,0 +1,51 @@
+import express from 'express';
+
+import type { createSettingsService } from './settings.service.js';
+
+type AuthenticatedRequest = express.Request & { user?: { id?: number | string } };
+
+function userId(req: express.Request): number {
+  return Number((req as AuthenticatedRequest).user?.id);
+}
+
+function queryString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+/** Creates thin Settings transport handlers around the application service. */
+export function createSettingsRouter(
+  service: ReturnType<typeof createSettingsService>,
+): express.Router {
+  const router = express.Router();
+  const respond = (operation: (req: express.Request) => unknown | Promise<unknown>) =>
+    async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+      try { res.json(await operation(req)); } catch (error) { next(error); }
+    };
+
+  router.get('/api-keys', respond((req) => service.listApiKeys(userId(req))));
+  router.post('/api-keys', respond((req) => service.createApiKey(userId(req), req.body?.keyName)));
+  router.delete('/api-keys/:keyId', respond((req) => service.deleteApiKey(userId(req), Number(req.params.keyId))));
+  router.patch('/api-keys/:keyId/toggle', respond((req) => service.toggleApiKey(
+    userId(req), Number(req.params.keyId), req.body?.isActive,
+  )));
+  router.get('/credentials', respond((req) => service.listCredentials(
+    userId(req), queryString(req.query.type),
+  )));
+  router.post('/credentials', respond((req) => service.createCredential(userId(req), req.body ?? {})));
+  router.delete('/credentials/:credentialId', respond((req) => service.deleteCredential(
+    userId(req), Number(req.params.credentialId),
+  )));
+  router.patch('/credentials/:credentialId/toggle', respond((req) => service.toggleCredential(
+    userId(req), Number(req.params.credentialId), req.body?.isActive,
+  )));
+  router.get('/notification-preferences', respond((req) => service.getNotificationPreferences(userId(req))));
+  router.put('/notification-preferences', respond((req) => service.updateNotificationPreferences(
+    userId(req), req.body ?? {},
+  )));
+  router.get('/push/vapid-public-key', respond(() => service.getVapidPublicKey()));
+  router.post('/push/subscribe', respond((req) => service.subscribeToPush(userId(req), req.body ?? {})));
+  router.post('/push/unsubscribe', respond((req) => service.unsubscribeFromPush(
+    userId(req), req.body?.endpoint,
+  )));
+  return router;
+}

package/server/modules/settings/settings.service.ts

@@ -0,0 +1,186 @@
+import { AppError } from '@/shared/utils.js';
+
+type ApiKeyRow = Record<string, unknown> & { api_key: string };
+type NotificationPreferences = Record<string, unknown> & {
+  channels?: Record<string, unknown> & { webPush?: boolean };
+};
+
+type SettingsDependencies = {
+  apiKeys: {
+    list(userId: number): ApiKeyRow[];
+    create(userId: number, keyName: string): unknown;
+    remove(userId: number, keyId: number): boolean;
+    toggle(userId: number, keyId: number, isActive: boolean): boolean;
+  };
+  credentials: {
+    list(userId: number, credentialType: string | null): unknown[];
+    create(
+      userId: number,
+      name: string,
+      type: string,
+      value: string,
+      description: string | null,
+    ): unknown;
+    remove(userId: number, credentialId: number): boolean;
+    toggle(userId: number, credentialId: number, isActive: boolean): boolean;
+  };
+  notifications: {
+    getPreferences(userId: number): NotificationPreferences | undefined;
+    updatePreferences(userId: number, preferences: NotificationPreferences): unknown;
+    createEnabledEvent(): unknown;
+    notifyUser(userId: number, event: unknown): void | Promise<void>;
+  };
+  pushSubscriptions: {
+    save(userId: number, endpoint: string, p256dh: string, auth: string): void;
+    remove(endpoint: string): void;
+  };
+  getVapidPublicKey(): string | null;
+};
+
+function requiredString(value: unknown, fieldName: string, code: string): string {
+  const normalizedValue = typeof value === 'string' ? value.trim() : '';
+  if (!normalizedValue) {
+    throw new AppError(`${fieldName} is required`, { code, statusCode: 400 });
+  }
+  return normalizedValue;
+}
+
+function assertFound(found: boolean, resourceName: string, code: string): void {
+  if (!found) {
+    throw new AppError(`${resourceName} not found`, { code, statusCode: 404 });
+  }
+}
+
+/** Creates settings workflows with repositories and notification effects injected. */
+export function createSettingsService(dependencies: SettingsDependencies) {
+  return {
+    listApiKeys(userId: number) {
+      const apiKeys = dependencies.apiKeys.list(userId).map((key) => ({
+        ...key,
+        api_key: `${key.api_key.substring(0, 10)}...`,
+      }));
+      return { apiKeys };
+    },
+    createApiKey(userId: number, keyNameInput: unknown) {
+      const keyName = requiredString(keyNameInput, 'Key name', 'API_KEY_NAME_REQUIRED');
+      return { success: true, apiKey: dependencies.apiKeys.create(userId, keyName) };
+    },
+    deleteApiKey(userId: number, keyId: number) {
+      assertFound(dependencies.apiKeys.remove(userId, keyId), 'API key', 'API_KEY_NOT_FOUND');
+      return { success: true };
+    },
+    toggleApiKey(userId: number, keyId: number, isActive: unknown) {
+      if (typeof isActive !== 'boolean') {
+        throw new AppError('isActive must be a boolean', {
+          code: 'INVALID_ACTIVE_STATE',
+          statusCode: 400,
+        });
+      }
+      assertFound(
+        dependencies.apiKeys.toggle(userId, keyId, isActive),
+        'API key',
+        'API_KEY_NOT_FOUND',
+      );
+      return { success: true };
+    },
+    listCredentials(userId: number, credentialType: string | null) {
+      return { credentials: dependencies.credentials.list(userId, credentialType) };
+    },
+    createCredential(userId: number, input: Record<string, unknown>) {
+      const credentialName = requiredString(
+        input.credentialName,
+        'Credential name',
+        'CREDENTIAL_NAME_REQUIRED',
+      );
+      const credentialType = requiredString(
+        input.credentialType,
+        'Credential type',
+        'CREDENTIAL_TYPE_REQUIRED',
+      );
+      const credentialValue = requiredString(
+        input.credentialValue,
+        'Credential value',
+        'CREDENTIAL_VALUE_REQUIRED',
+      );
+      const description = typeof input.description === 'string'
+        ? input.description.trim() || null
+        : null;
+      return {
+        success: true,
+        credential: dependencies.credentials.create(
+          userId,
+          credentialName,
+          credentialType,
+          credentialValue,
+          description,
+        ),
+      };
+    },
+    deleteCredential(userId: number, credentialId: number) {
+      assertFound(
+        dependencies.credentials.remove(userId, credentialId),
+        'Credential',
+        'CREDENTIAL_NOT_FOUND',
+      );
+      return { success: true };
+    },
+    toggleCredential(userId: number, credentialId: number, isActive: unknown) {
+      if (typeof isActive !== 'boolean') {
+        throw new AppError('isActive must be a boolean', {
+          code: 'INVALID_ACTIVE_STATE',
+          statusCode: 400,
+        });
+      }
+      assertFound(
+        dependencies.credentials.toggle(userId, credentialId, isActive),
+        'Credential',
+        'CREDENTIAL_NOT_FOUND',
+      );
+      return { success: true };
+    },
+    getNotificationPreferences(userId: number) {
+      return { success: true, preferences: dependencies.notifications.getPreferences(userId) };
+    },
+    updateNotificationPreferences(userId: number, preferences: NotificationPreferences) {
+      return {
+        success: true,
+        preferences: dependencies.notifications.updatePreferences(userId, preferences),
+      };
+    },
+    getVapidPublicKey() {
+      return { publicKey: dependencies.getVapidPublicKey() };
+    },
+    subscribeToPush(userId: number, input: Record<string, unknown>) {
+      const endpoint = requiredString(input.endpoint, 'Endpoint', 'PUSH_SUBSCRIPTION_REQUIRED');
+      const keys = typeof input.keys === 'object' && input.keys !== null
+        ? input.keys as Record<string, unknown>
+        : {};
+      const p256dh = requiredString(keys.p256dh, 'p256dh', 'PUSH_SUBSCRIPTION_REQUIRED');
+      const auth = requiredString(keys.auth, 'auth', 'PUSH_SUBSCRIPTION_REQUIRED');
+      dependencies.pushSubscriptions.save(userId, endpoint, p256dh, auth);
+
+      const currentPreferences = dependencies.notifications.getPreferences(userId);
+      if (!currentPreferences?.channels?.webPush) {
+        dependencies.notifications.updatePreferences(userId, {
+          ...currentPreferences,
+          channels: { ...currentPreferences?.channels, webPush: true },
+        });
+      }
+      const event = dependencies.notifications.createEnabledEvent();
+      void dependencies.notifications.notifyUser(userId, event);
+      return { success: true };
+    },
+    unsubscribeFromPush(userId: number, endpointInput: unknown) {
+      const endpoint = requiredString(endpointInput, 'Endpoint', 'PUSH_ENDPOINT_REQUIRED');
+      dependencies.pushSubscriptions.remove(endpoint);
+      const currentPreferences = dependencies.notifications.getPreferences(userId);
+      if (currentPreferences?.channels?.webPush) {
+        dependencies.notifications.updatePreferences(userId, {
+          ...currentPreferences,
+          channels: { ...currentPreferences.channels, webPush: false },
+        });
+      }
+      return { success: true };
+    },
+  };
+}

package/server/modules/settings/tests/settings.service.test.ts

@@ -0,0 +1,54 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createSettingsService } from '../settings.service.js';
+
+type Dependencies = Parameters<typeof createSettingsService>[0];
+
+function dependencies(overrides: Partial<Dependencies> = {}): Dependencies {
+  return {
+    apiKeys: { list: () => [], create: () => ({}), remove: () => false, toggle: () => false },
+    credentials: { list: () => [], create: () => ({}), remove: () => false, toggle: () => false },
+    notifications: {
+      getPreferences: () => undefined,
+      updatePreferences: () => ({}),
+      createEnabledEvent: () => ({}),
+      notifyUser: () => undefined,
+    },
+    pushSubscriptions: { save: () => undefined, remove: () => undefined },
+    getVapidPublicKey: () => null,
+    ...overrides,
+  };
+}
+
+test('listApiKeys redacts secret values through the service boundary', () => {
+  const service = createSettingsService(dependencies({
+    apiKeys: {
+      list: () => [{ id: 1, api_key: '1234567890-secret' }],
+      create: () => ({}), remove: () => false, toggle: () => false,
+    },
+  }));
+  assert.equal(service.listApiKeys(1).apiKeys[0]?.api_key, '1234567890...');
+});
+
+test('subscribeToPush persists the subscription and enables Web Push', () => {
+  const operations: string[] = [];
+  const service = createSettingsService(dependencies({
+    pushSubscriptions: {
+      save: (_id, endpoint) => operations.push(`save:${endpoint}`),
+      remove: () => undefined,
+    },
+    notifications: {
+      getPreferences: () => ({ channels: { webPush: false } }),
+      updatePreferences: () => { operations.push('preferences'); return {}; },
+      createEnabledEvent: () => ({ code: 'push.enabled' }),
+      notifyUser: () => { operations.push('notify'); },
+    },
+  }));
+
+  service.subscribeToPush(1, {
+    endpoint: 'https://push.example.test',
+    keys: { p256dh: 'key', auth: 'auth' },
+  });
+  assert.deepEqual(operations, ['save:https://push.example.test', 'preferences', 'notify']);
+});

package/server/modules/system/index.ts

@@ -0,0 +1,2 @@
+// createSystemModule: used by the server entrypoint to mount protected system update routes.
+export { createSystemModule } from './system.module.js';

package/server/modules/system/system.module.ts

@@ -0,0 +1,62 @@
+import os from 'node:os';
+
+import spawn from 'cross-spawn';
+import type { Router } from 'express';
+
+import { createSystemRouter } from './system.routes.js';
+import { createSystemUpdateService } from './system.service.js';
+
+type SystemModuleOptions = {
+  appRoot: string;
+  installMode: 'git' | 'npm';
+  isPlatform: boolean;
+};
+
+function runShellCommand(
+  command: string,
+  workingDirectory: string,
+  environment: NodeJS.ProcessEnv,
+  onOutput: (output: string) => void,
+  onErrorOutput: (errorOutput: string) => void,
+): Promise<{ exitCode: number | null; output: string; errorOutput: string }> {
+  return new Promise((resolve, reject) => {
+    const childProcess = spawn('sh', ['-c', command], {
+      cwd: workingDirectory,
+      env: environment,
+    });
+    let output = '';
+    let errorOutput = '';
+
+    childProcess.stdout?.on('data', (data: Buffer) => {
+      const text = data.toString();
+      output += text;
+      onOutput(text);
+    });
+    childProcess.stderr?.on('data', (data: Buffer) => {
+      const text = data.toString();
+      errorOutput += text;
+      onErrorOutput(text);
+    });
+    childProcess.once('error', reject);
+    childProcess.once('close', (exitCode) => {
+      resolve({ exitCode, output, errorOutput });
+    });
+  });
+}
+
+/**
+ * Builds the authenticated system router for the server entrypoint using the
+ * installation details it already resolves for health and startup metadata.
+ */
+export function createSystemModule(options: SystemModuleOptions): Router {
+  const systemUpdateService = createSystemUpdateService({
+    ...options,
+    homeDirectory: os.homedir(),
+    environment: process.env,
+    runShellCommand,
+    logInfo: (message, detail) => console.log(message, detail ?? ''),
+    logError: (message, detail) => console.error(message, detail ?? ''),
+  });
+
+  return createSystemRouter(systemUpdateService);
+}

package/server/modules/system/system.routes.ts

@@ -0,0 +1,21 @@
+import express from 'express';
+
+import type { createSystemUpdateService } from './system.service.js';
+
+/** Creates thin system routes that delegate update execution to the service. */
+export function createSystemRouter(
+  systemUpdateService: ReturnType<typeof createSystemUpdateService>,
+): express.Router {
+  const router = express.Router();
+
+  router.post('/update', async (_request, response, next) => {
+    try {
+      const result = await systemUpdateService.updateSystem();
+      response.status(result.success ? 200 : 500).json(result);
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  return router;
+}

package/server/modules/system/system.service.ts

@@ -0,0 +1,76 @@
+type SystemUpdateCommandResult = {
+  exitCode: number | null;
+  output: string;
+  errorOutput: string;
+};
+
+type SystemUpdateDependencies = {
+  appRoot: string;
+  homeDirectory: string;
+  installMode: 'git' | 'npm';
+  isPlatform: boolean;
+  environment: NodeJS.ProcessEnv;
+  runShellCommand(
+    command: string,
+    workingDirectory: string,
+    environment: NodeJS.ProcessEnv,
+    onOutput: (output: string) => void,
+    onErrorOutput: (errorOutput: string) => void,
+  ): Promise<SystemUpdateCommandResult>;
+  logInfo(message: string, detail?: string): void;
+  logError(message: string, detail?: string): void;
+};
+
+/**
+ * Creates the update workflow used by the system module and its focused tests.
+ * Runtime-specific process spawning stays behind the injected command adapter.
+ */
+export function createSystemUpdateService(dependencies: SystemUpdateDependencies) {
+  return {
+    /** Selects and executes the correct update workflow for this installation. */
+    async updateSystem() {
+      const updateCommand = dependencies.isPlatform
+        ? 'npm run update:platform'
+        : dependencies.installMode === 'git'
+          ? 'git checkout main && git pull && npm install'
+          : 'npm install -g @cloudcli-ai/cloudcli@latest';
+      const workingDirectory = dependencies.isPlatform || dependencies.installMode === 'git'
+        ? dependencies.appRoot
+        : dependencies.homeDirectory;
+
+      dependencies.logInfo('Starting system update from directory:', workingDirectory);
+
+      try {
+        const result = await dependencies.runShellCommand(
+          updateCommand,
+          workingDirectory,
+          dependencies.environment,
+          (output) => dependencies.logInfo('Update output:', output),
+          (errorOutput) => dependencies.logError('Update error:', errorOutput),
+        );
+
+        if (result.exitCode === 0) {
+          return {
+            success: true as const,
+            output: result.output || 'Update completed successfully',
+            message: 'Update completed. Please restart the server to apply changes.',
+          };
+        }
+
+        return {
+          success: false as const,
+          error: 'Update command failed',
+          output: result.output,
+          errorOutput: result.errorOutput,
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        dependencies.logError('Update process error:', message);
+        return {
+          success: false as const,
+          error: message,
+        };
+      }
+    },
+  };
+}