@gajae-code/coding-agent 0.16.7 → 0.17.1

package/dist/types/cli/doctor/types.d.ts

@@ -0,0 +1,145 @@
+export type DoctorMode = "diagnose" | "dry-run" | "fix";
+/**
+ * `unsupported` and `not_selected` are the coverage vocabulary this process
+ * accepts across the worker/probe boundary and reports in `DoctorCoverage`; the
+ * collectors on this platform never emit them, so their consumers are deliberate
+ * validation rather than reachable branches.
+ */
+export type CheckExecution = "completed" | "blocked" | "timeout" | "cancelled" | "unsupported" | "not_selected";
+export type Health = "ok" | "warning" | "error" | "unknown" | "not_applicable";
+export type EvidenceLevel = "observed" | "not_probed";
+export type Verdict = "healthy" | "degraded" | "unhealthy" | "inconclusive";
+export type RepairState = "planned" | "blocked" | "not_needed" | "preparing" | "pending_activation" | "verified" | "failed" | "uncertain" | "rolled_back" | "rollback_conflict";
+export type ReadinessFactCode = "authorization_missing" | "confirmation_required" | "candidate_unresolved" | "pin_missing" | "candidate_selection_missing" | "identity_recheck_required" | "target_resolution_incomplete" | "unsupported";
+export type DoctorScope = "user" | "project";
+export type DoctorRiskClass = "config-change" | "permission-change" | "install-replace" | "plugin-change" | "service-interruption" | "artifact-detach" | "network" | "external-execution";
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    readonly [key: string]: JsonValue;
+};
+export interface CheckEvidence {
+    readonly runtimeVersion?: string;
+    readonly platform?: string;
+    readonly arch?: string;
+    readonly channel?: string;
+    readonly schemaCoverage?: "selected_fields" | "complete";
+    readonly startupStatus?: "autoload" | "autoload-off" | "disabled";
+    readonly runtimeProbed?: boolean;
+    readonly aclCoverage?: "not_probed" | "verified";
+    readonly mode?: number;
+    readonly ownerMatches?: boolean;
+    readonly contentsRead?: boolean;
+    readonly authenticationProbed?: boolean;
+    readonly present?: boolean;
+    readonly enabled?: boolean;
+    readonly autoload?: boolean;
+    readonly hasAuth?: boolean;
+    readonly status?: string;
+    readonly sourceClass?: string;
+    /** Closed observation of a known plugin artifact; never a path or content. */
+    readonly artifactStatus?: "present" | "absent" | "unreadable";
+    readonly transport?: "stdio" | "http" | "sse" | "unknown";
+    readonly count?: number;
+    readonly warningCount?: number;
+    readonly counts?: Readonly<Record<string, number>>;
+    readonly errno?: string;
+    readonly fileKind?: string;
+    readonly schemaLocation?: string;
+    readonly version?: string;
+    readonly integrityResult?: string;
+    readonly processObservation?: JsonValue;
+    readonly generation?: string;
+    readonly occupancy?: string;
+    readonly readiness?: readonly ReadinessFactCode[];
+    readonly rootId?: string;
+    readonly safeLabel?: string;
+    readonly candidateCount?: number;
+}
+export interface DoctorCheck {
+    readonly id: string;
+    readonly targetId: string;
+    readonly scope?: DoctorScope;
+    readonly execution: CheckExecution;
+    readonly health: Health;
+    readonly reasonCode?: string;
+    readonly evidenceLevel: EvidenceLevel;
+    readonly observedAt?: string;
+    readonly durationMs?: number;
+    readonly dependsOn: readonly string[];
+    readonly evidence: CheckEvidence;
+    readonly remediationIds: readonly string[];
+}
+export interface RepairCandidate {
+    readonly id: string;
+    readonly sourceChannel: string;
+    readonly ref?: string;
+    readonly sha256?: string;
+    readonly evidence: CheckEvidence;
+}
+export interface DoctorRepair {
+    readonly id: string;
+    readonly targetId: string;
+    readonly riskClasses: readonly DoctorRiskClass[];
+    readonly authorization: readonly string[];
+    readonly readiness: readonly ReadinessFactCode[];
+    readonly sourceChannel?: string;
+    readonly candidates: readonly RepairCandidate[];
+    readonly selectedCandidate?: string;
+    readonly preconditions: readonly string[];
+    readonly rollbackClass?: string;
+    readonly state: RepairState;
+    readonly reasonCode?: string;
+    readonly sideEffectStarted?: boolean;
+    readonly outcome?: {
+        readonly mutationVerified: boolean;
+        readonly desiredStartupStateAchieved?: boolean;
+    };
+    readonly beforeCheckIds: readonly string[];
+    readonly afterCheckIds: readonly string[];
+    readonly restartRequired: boolean;
+    readonly restartScope?: "none" | "new-session" | "service";
+    readonly nonrollbackableEffects: readonly string[];
+    readonly activationRecordRef?: string;
+}
+export interface DoctorCoverage {
+    readonly requested: number;
+    readonly expanded: number;
+    readonly attempted: number;
+    readonly completed: number;
+    readonly blocked: number;
+    readonly timedOut: number;
+    readonly unsupported: number;
+}
+export interface DoctorSummary {
+    readonly verdict: Verdict;
+    readonly exitCode: number;
+}
+export interface DoctorReport {
+    readonly schemaVersion: 1;
+    readonly command: "doctor";
+    readonly runId: string;
+    readonly mode: DoctorMode;
+    readonly generatedAt: string;
+    readonly durationMs: number;
+    readonly subject: {
+        readonly gjcVersion: string;
+        readonly platform: string;
+        readonly arch: string;
+        readonly channel: string;
+        readonly scope?: DoctorScope;
+        readonly rootIds: readonly string[];
+    };
+    readonly selection: {
+        readonly checks: readonly string[];
+        readonly repair?: string;
+        readonly targetId?: string;
+    };
+    readonly coverage: DoctorCoverage;
+    readonly summary: DoctorSummary;
+    readonly checks: readonly DoctorCheck[];
+    readonly repairs: readonly DoctorRepair[];
+    readonly limits: {
+        readonly [key: string]: JsonValue;
+    };
+    readonly invocationError?: string;
+}

package/dist/types/cli/doctor-cli.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Execute the boot-safe doctor parser and delegate collection to an owned,
+ * verified-terminated child worker (`doctor-supervisor.ts`). Diagnostics and
+ * repairs never run in this process: a `Promise.race` here cannot bound
+ * synchronous fs/native work, so only the child-process boundary can.
+ */
+export declare function runDoctorCli(argv: readonly string[]): Promise<void>;

package/dist/types/cli/doctor-supervisor.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Doctor bootstrap isolation supervisor (parent side).
+ *
+ * `gjc doctor` must stay usable when the normal runtime is broken (malformed
+ * config, a faulting native addon, an unbounded filesystem stall). A
+ * `Promise.race` inside the in-process runner cannot bound synchronous or
+ * native work (fs realpath/read, native addon calls, fsync) — only an owned
+ * child-process boundary can. This module owns that boundary from the
+ * parent's side; the child worker entry (imports `./doctor/runner` and is
+ * re-entered via `cli.ts`'s `--internal-doctor-worker` admission branch) is
+ * implemented in `doctor-worker.ts`.
+ *
+ * Protocol: newline-delimited JSON over the child's stdin/stdout, each
+ * message authenticated by a random per-run token delivered only via
+ * `DOCTOR_WORKER_TOKEN_ENV` (never argv, never logged, never in the report).
+ * Token comparison is constant-time. The child's stdio is fully owned by
+ * this protocol, so the interactive confirmation prompt (default No, exact
+ * action/target/value, SIGINT- and deadline-aware) is rendered by THIS
+ * parent against the real terminal — the child never touches the TTY.
+ *
+ * "Repair admitted" is a permanent fence: it is latched synchronously the
+ * instant the `admitted` message is observed, before any further await, and
+ * is never cleared. Any abnormal ending after admission is reported as an
+ * uncertain post-effect outcome (exit 4); before admission it is "nothing
+ * started" (exit 3), and a runtime that itself was admitted-then-lost is
+ * evidenced with `worker_termination_unverified`, never a silently clean
+ * exit. SIGINT is forwarded to the child; a verified clean stop after SIGINT
+ * and before admission reports 130, never fabricated merely because a
+ * `Promise.race` resolved. No successor worker is ever spawned after an
+ * unverified termination.
+ */
+import type { Writable } from "node:stream";
+import type { DoctorConfirmationResult, DoctorOptions } from "./doctor/args";
+import type { DoctorMode, DoctorRepair, DoctorReport } from "./doctor/types";
+/** Re-entrant argv marker for the isolated doctor worker. Wiring into `cli.ts`'s admission chain is a coordinated follow-up. */
+export declare const DOCTOR_WORKER_ARG = "--internal-doctor-worker";
+/** Per-spawn random token; the worker must refuse to run the protocol route without an exact match. */
+export declare const DOCTOR_WORKER_TOKEN_ENV = "GJC_DOCTOR_WORKER_TOKEN";
+export interface SupervisedDoctorInput {
+    /** Raw argv following `doctor` (unparsed). The worker re-derives options and re-runs full security admission itself. */
+    readonly argv: readonly string[];
+    /** Parsed options for local budget/cwd/tty decisions only; `confirmRepair`/`onRepairAdmitted` here are ignored — the parent supplies live protocol-backed equivalents. */
+    readonly options: DoctorOptions;
+}
+export type WorkerToSupervisorMessage = {
+    readonly type: "confirm";
+    readonly token: string;
+    readonly id: number;
+    readonly repair: DoctorRepair;
+    readonly setValue?: boolean;
+} | {
+    readonly type: "admitted";
+    readonly token: string;
+} | {
+    readonly type: "report";
+    readonly token: string;
+    readonly report: DoctorReport;
+} | {
+    readonly type: "error";
+    readonly token: string;
+    readonly code: string;
+    readonly message: string;
+};
+/** Distributes `Omit` over the message union so each variant keeps its own extra fields (plain `Omit<Union, K>` only keeps keys common to every member). */
+export type WorkerToSupervisorPayload = WorkerToSupervisorMessage extends infer M ? M extends {
+    readonly token: string;
+} ? Omit<M, "token"> : never : never;
+export type SupervisorToWorkerMessage = {
+    readonly type: "init";
+    readonly token: string;
+    readonly argv: readonly string[];
+    readonly cwd: string;
+    readonly tty: boolean;
+    readonly runId: string;
+    readonly timeoutMs: number;
+    readonly deadlineAt: number;
+} | {
+    readonly type: "confirm-result";
+    readonly token: string;
+    readonly id: number;
+    readonly result: DoctorConfirmationResult;
+};
+/** An explicit `--timeout-ms` may only shorten the action-specific ceiling, never raise it. */
+export declare function resolveSupervisedBudgetMs(options: DoctorOptions): number;
+/**
+ * Accept a worker `report` message only when it is both structurally complete
+ * and bound to this exact run. Returns the report on success so callers never
+ * re-narrow it, and `undefined` for every rejected shape — including a missing
+ * or malformed `selection`, which used to throw at the dereference.
+ */
+export declare function acceptWorkerReport(value: unknown, expected: {
+    readonly runId: string;
+    readonly mode: DoctorMode;
+    readonly repair?: string;
+    readonly targetId?: string;
+}): DoctorReport | undefined;
+/**
+ * Write side of the parent→worker protocol.
+ *
+ * The channel is a one-way latch: once the worker has settled (exit, close, or
+ * a pipe error) no further byte is written to its stdin. A confirmation prompt
+ * can resolve arbitrarily late — after the deadline fired, after SIGINT, after
+ * the worker crashed — and its callback would otherwise write to a closed pipe,
+ * surfacing as an EPIPE / ERR_STREAM_DESTROYED that crashes the parent. The
+ * latch check and the write happen in one synchronous step, so no stream event
+ * can interleave between them, and any residual race is contained: it becomes a
+ * worker-failure outcome instead of an exception.
+ */
+export interface SupervisorChannel {
+    readonly settled: boolean;
+    /** Latch the channel closed without reporting a failure (normal termination). */
+    settle(): void;
+    send(message: SupervisorToWorkerMessage): void;
+}
+export declare function createSupervisorChannel(stdin: Writable, onChannelClosed: () => void): SupervisorChannel;
+/**
+ * Run doctor diagnostics/repair inside an owned, verified-terminated child.
+ * Never falls back to in-process execution and never spawns a successor
+ * worker after this attempt's child is gone.
+ */
+export declare function runSupervisedDoctor(input: SupervisedDoctorInput): Promise<DoctorReport>;

package/dist/types/cli/doctor-worker.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Doctor bootstrap isolation worker (child side).
+ *
+ * This is the ONLY module that imports the real `./doctor/runner` inside the
+ * isolated child spawned by `doctor-supervisor.ts`. Its own stdio is fully
+ * consumed by the JSON-line protocol: the parent renders the interactive
+ * confirmation prompt against the real terminal and this process forwards
+ * `confirmRepair`/`onRepairAdmitted` callback activity over the wire rather
+ * than touching `process.stdin`/TTY itself. `onRepairAdmitted` latches the
+ * "admitted" fact on the parent's side the instant the message is sent —
+ * this worker sends it synchronously before any further await, exactly once
+ * per repair attempt, and never retracts it.
+ *
+ * No raw stderr, stack trace, or uncaught exception detail ever reaches the
+ * parent: every failure path here degrades to a bounded `error` message with
+ * a fixed reason code. The parent treats worker stdout as the only channel
+ * of record and never forwards this process's own stderr into the report.
+ */
+/**
+ * `--internal-doctor-worker` is only a routable protocol worker when BOTH the
+ * token env var is present with a plausible shape AND stdin is not a TTY — a
+ * user's own interactive terminal can never be silently routed onto the
+ * worker's non-interactive confirmation-refusal path. Any other invocation
+ * (missing token, short/malformed token, an attached TTY) falls back to
+ * ordinary CLI usage error and never enters the protocol at all.
+ */
+export declare function isRoutableDoctorWorkerInvocation(env: NodeJS.ProcessEnv, stdinIsTTY: boolean | undefined): boolean;
+/** Runs the isolated worker's full protocol lifecycle to completion. Never spawns anything; never talks to a TTY. */
+export declare function runDoctorWorker(): Promise<void>;

package/dist/types/cli/install-activation.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Shared target-adjacent v1 activation record authority for `gjc update` and
+ * `gjc doctor install.restore-binary`.
+ *
+ * Every identity capture is a bounded, no-follow, post-read-revalidated
+ * snapshot, never a bare fs.readFile/fs.stat pair. Every record write is a
+ * no-replace create or an exact CAS against the caller's own previously
+ * observed record identity, never a blind fs.rename overwrite. Promoting a
+ * staged candidate onto the live target uses the native exactReplaceRetained
+ * primitive: it validates both identities before mutating anything and
+ * retires the old target to a retained backup name instead of deleting it.
+ * There is no unlink/rename-based rollback path in this module.
+ */
+import { type NativeExactFileIdentity } from "@gajae-code/natives";
+export type ActivationPhase = "staged" | "published" | "verified" | "pending_activation" | "rolled_back" | "uncertain";
+/** Serialized exact regular-file identity. BigInt fields are decimal strings so the record stays plain JSON. */
+export interface FileIdentity {
+    readonly dev: string;
+    readonly ino: string;
+    readonly nlink: string;
+    readonly parentDev?: string;
+    readonly parentIno?: string;
+    readonly size: string;
+    readonly mtimeNs: string;
+    readonly mode: number;
+    readonly sha256: string;
+}
+/** Serialized directory identity. No content hash: a directory has no bytes to bind. */
+export interface DirectoryIdentity {
+    readonly dev: string;
+    readonly ino: string;
+    readonly mode: number;
+}
+export interface ActivationRecordV1 {
+    readonly schemaVersion: 1;
+    readonly kind: "gjc-install-activation";
+    readonly transactionId: string;
+    readonly targetPath: string;
+    readonly parentPath: string;
+    readonly targetIdentity?: FileIdentity;
+    readonly backupIdentity?: FileIdentity;
+    readonly parentIdentity?: DirectoryIdentity;
+    readonly baseline: {
+        readonly exists: boolean;
+        readonly digest?: string;
+        readonly version?: string;
+    };
+    readonly candidate: {
+        readonly digest: string;
+        readonly version: string;
+        readonly channel?: string;
+        readonly ref?: string;
+        readonly os?: string;
+        readonly arch?: string;
+        readonly sidecars: readonly string[];
+    };
+    readonly stagingPath: string;
+    /** Staged candidate identity captured when recorded; re-checked before promotion. */
+    readonly stagingIdentity?: FileIdentity;
+    /** Single-component name exactReplaceRetained retires the old target to, inside the target's own parent. */
+    readonly backupName: string;
+    readonly phase: ActivationPhase;
+}
+export type ActivationRead = {
+    readonly status: "missing";
+} | {
+    readonly status: "valid";
+    readonly record: ActivationRecordV1;
+    readonly identity: FileIdentity;
+} | {
+    readonly status: "malformed";
+    readonly reason: string;
+} | {
+    readonly status: "foreign";
+    readonly reason: string;
+};
+/** Public snapshot API shared by callers (update-cli/doctor) to capture original target/staging identities. */
+export declare function snapshotRegularFile(filePath: string): Promise<{
+    readonly header: Uint8Array;
+    readonly identity: FileIdentity;
+} | undefined>;
+export declare function snapshotDirectory(directoryPath: string): Promise<DirectoryIdentity | undefined>;
+export declare function sameFileIdentity(a: FileIdentity, b: FileIdentity): boolean;
+export declare function sameDirectoryIdentity(a: DirectoryIdentity | undefined, b: DirectoryIdentity | undefined): boolean;
+export declare function toNativeIdentity(identity: FileIdentity, quarantineName?: string): NativeExactFileIdentity;
+export declare function activationRecordPath(targetPath: string): string;
+/** Deterministic-enough, collision-checked single-component retained backup name for one transaction. */
+export declare function activationBackupName(targetPath: string, transactionId: string): string;
+export declare function createActivationTransactionId(): string;
+/** Pure builder for a fresh `staged` activation record; callers still write it via createActivationRecordFile. */
+export declare function buildActivationRecord(input: {
+    readonly targetPath: string;
+    readonly targetIdentity?: FileIdentity;
+    readonly originalTargetAbsent?: boolean;
+    readonly parentIdentity: DirectoryIdentity;
+    readonly baselineDigest?: string;
+    readonly baselineVersion?: string;
+    readonly stagingPath: string;
+    readonly stagingIdentity: FileIdentity;
+    readonly candidate: {
+        readonly digest: string;
+        readonly version: string;
+        readonly channel?: string;
+        readonly ref?: string;
+        readonly os?: string;
+        readonly arch?: string;
+        readonly sidecars?: readonly string[];
+    };
+    readonly transactionId?: string;
+}): ActivationRecordV1;
+/**
+ * Read the activation record for `targetPath`, itself opened bounded/
+ * no-follow/identity-revalidated. A record that is present but fails schema
+ * or path validation is reported distinctly (`malformed`/`foreign`) and is
+ * never treated as absent, so a caller cannot silently proceed past a
+ * corrupted or substituted record.
+ */
+export declare function readActivationRecord(targetPath: string): Promise<ActivationRead>;
+/**
+ * Create the activation record with a no-replace write: an existing record
+ * (foreign, malformed, or a live transaction) is never overwritten blindly.
+ */
+export declare function createActivationRecordFile(record: ActivationRecordV1): Promise<FileIdentity>;
+/**
+ * Compare-and-swap the activation record: the caller must supply the exact
+ * identity of the record it last read. `exactReplacePath` performs the
+ * atomic namespace-exchange CAS; a stale or substituted record is refused
+ * rather than overwritten.
+ */
+export declare function updateActivationRecordFile(record: ActivationRecordV1, expectedIdentity: FileIdentity): Promise<FileIdentity>;
+export type ReconcileStatus = "missing" | "verified" | "reconciled" | "applied_unverified" | "rolled_back" | "pending_activation" | "conflict" | "malformed" | "foreign";
+export interface ReconcileResult {
+    readonly status: ReconcileStatus;
+    readonly record?: ActivationRecordV1;
+    readonly recordIdentity?: FileIdentity;
+    readonly reason?: string;
+    /** Present only for a pre-mutation Windows sharing violation on the destination open. */
+    readonly windowsErrorCode?: string;
+}
+/**
+ * Reconcile the activation record for `targetPath` against durable state.
+ *
+ * `staged`/`pending_activation` phases are promoted onto the live target via
+ * `exactReplaceRetained` only when `allowPromotion` is set and every
+ * identity (staging candidate, current target, parent) still matches what
+ * the record captured; the previous target is retired intact to the
+ * record's `backupName`, never unlinked or blind-renamed. `published`
+ * records are re-verified and advanced to `verified` once the target
+ * digest/identity matches the candidate. `verified` records are read-only
+ * re-confirmations. Anything else (target/parent drift, missing staged
+ * candidate, an already-occupied backup name, a pre-mutation Windows
+ * sharing violation) is reported as `conflict` with the exact reason and
+ * never silently promoted.
+ */
+export declare function reconcileActivationRecord(targetPath: string, options?: {
+    readonly allowPromotion?: boolean;
+    readonly expectedRecordIdentity?: FileIdentity;
+}): Promise<ReconcileResult>;

package/dist/types/cli/macos-community-app.d.ts

@@ -0,0 +1,41 @@
+export declare const COMMUNITY_APP_REPOSITORY = "devswha/gajae-code-app";
+export declare const COMMUNITY_APP_BUNDLE_ID = "app.gajae.desktop";
+export declare const COMMUNITY_APP_TEAM_ID = "5987KT43TJ";
+export declare const COMMUNITY_APP_SIGNING_AUTHORITY = "Developer ID Application: sangwoo ha";
+export declare const COMMUNITY_APP_SUPPRESS_ENV = "GJC_NO_COMMUNITY_APP";
+interface CommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut?: boolean;
+    reaped?: boolean;
+    helpersRetained?: boolean;
+}
+type CommandRunner = (argv: string[]) => Promise<CommandResult>;
+export interface CommunityAppOfferDependencies {
+    platform?: NodeJS.Platform;
+    arch?: string;
+    env?: NodeJS.ProcessEnv;
+    homeDir?: string;
+    tempDir?: string;
+    stdinIsTTY?: boolean;
+    stdoutIsTTY?: boolean;
+    signal?: AbortSignal;
+    fetchImpl?: (url: string, init?: RequestInit) => Promise<Response>;
+    prompt?: () => Promise<boolean>;
+    command?: CommandRunner;
+    cleanupCommand?: (argv: string[], timeoutMs: number) => Promise<CommandResult>;
+    log?: (message: string) => void;
+}
+export interface CommunityAppOfferResult {
+    status: "skipped" | "installed" | "failed";
+    reason: string;
+}
+export declare function offerMacosCommunityApp(deps?: CommunityAppOfferDependencies): Promise<CommunityAppOfferResult>;
+export declare function parseCommunityAppChecksumForTest(text: string, assetName: string): string | undefined;
+export declare function communityAppAssetMatchesArchitectureForTest(name: string, arch: "arm64" | "x64"): boolean;
+export declare function resolveCommunityAppExecutableForTest(bundlePath: string, executable: string): Promise<string | undefined>;
+export declare function hasExpectedCommunityAppSignatureForTest(bundlePath: string, command: CommandRunner): Promise<boolean>;
+export declare function runCommunityAppCommandForTest(argv: string[], onDescendant?: (pid: number) => void): Promise<CommandResult>;
+export declare function abortActiveCommunityAppCommandsForTest(): void;
+export {};

package/dist/types/cli/mcp-cli.d.ts

@@ -22,16 +22,5 @@ export interface MCPCommandArgs {
 }
 export declare class MCPArgsError extends Error {
 }
-/** Runtime status of a stored registration for conventional autoload. */
-type AutoloadStatus = "autoload" | "autoload-off" | "disabled";
-/**
- * Compute the conventional-autoload status of a stored server.
- *
- * - `autoload-off`: the server opted out of startup connection via `autoload: false`.
- * - `disabled`: the server is disabled via `enabled: false` or the `disabledServers` list.
- * - `autoload`: connected by ordinary standalone sessions at startup.
- */
-export declare function computeAutoloadStatus(name: string, config: MCPServerConfig, disabledServers: ReadonlySet<string>): AutoloadStatus;
 export declare function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig;
 export declare function runMCPCommand(args: MCPCommandArgs): Promise<void>;
-export {};

package/dist/types/cli/update-cli.d.ts

@@ -1,8 +1,17 @@
+/**
+ * Update CLI command handler.
+ *
+ * Handles `gjc update` to check for and install standalone GitHub release
+ * binaries. Package-manager installs are migrated to a user binary path
+ * rather than overwritten. Source checkouts and dev-links are never replaced.
+ */
 import { Settings } from "../config/settings";
 import { type UpdateChannel } from "../config/update-channel";
 import { type NotificationProvider } from "../sdk/bus/config";
 import type { TelemetryDetails, TelemetryEventName } from "../telemetry";
 import { type GithubReleaseLookupOptions } from "./github-release";
+import { type DirectoryIdentity, type FileIdentity } from "./install-activation";
+import { offerMacosCommunityApp } from "./macos-community-app";
 export interface UpdateCommandOptions {
     force: boolean;
     check: boolean;
@@ -44,6 +53,14 @@ export interface BinaryReplacementOptions {
     tempPath: string;
     backupPath: string;
     expectedVersion: string;
+    originalTarget: FileIdentity | undefined;
+    originalParent: DirectoryIdentity;
+    candidate?: {
+        readonly channel: string;
+        readonly ref: string;
+        readonly sha256: string;
+    };
+    verifyStagedVersion?: (stagingPath: string, expectedVersion: string) => Promise<void>;
     verifyInstalledVersion: (expectedVersion: string) => Promise<InstalledVersionVerification>;
 }
 /**
@@ -75,6 +92,7 @@ export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: s
 export declare function resolveNpmManagedTargetForTest(ompPath: string, platform: PathPlatform, packageExists: PackageExists): PackageManagerTarget | undefined;
 export declare function defaultUserBinaryPath(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): string;
 export declare function isProtectedSourcePathForTest(filePath: string): boolean;
+export declare function isProtectedSourcePathForInstall(filePath: string): boolean;
 export declare function defaultUserBinaryPathForTest(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): string;
 /** Lookup options for the GitHub release check. */
 export interface LatestReleaseLookupOptions extends GithubReleaseLookupOptions {
@@ -82,6 +100,10 @@ export interface LatestReleaseLookupOptions extends GithubReleaseLookupOptions {
 }
 export declare function getLatestReleaseForTest(options: LatestReleaseLookupOptions): Promise<ReleaseInfo>;
 export declare function compareVersionsForTest(a: string, b: string): number;
+/**
+ * Get the appropriate binary name for this platform.
+ */
+export declare function getBinaryNameForPlatform(platform?: NodeJS.Platform, arch?: string): string;
 export declare function resolveGjcPathForTest(options: {
     compiled: boolean;
     execPath: string;
@@ -129,14 +151,23 @@ export declare function recoverWindowsUpdateJournal(journalPath: string): Promis
 export declare function replaceBinaryForUpdate(options: BinaryReplacementOptions): Promise<InstalledVersionVerification>;
 export declare function runPackageManagerUpdateForTest(options: PackageManagerUpdateOptions): Promise<InstalledVersionVerification>;
 export declare function fsyncFileForTest(filePath: string): Promise<void>;
+/** Production adapter used by doctor restore: official release origin, checksum manifest, and runtime smoke. */
+export declare function fetchAndVerifyOfficialPinnedCandidate(candidate: {
+    ref: string;
+    version: string;
+    os: NodeJS.Platform;
+    arch: string;
+    sha256: string;
+}, stagingPath: string): Promise<void>;
+export declare function smokeTestPinnedCandidate(candidate: {
+    version: string;
+}, stagingPath: string): Promise<void>;
 /** Injectable steps of the binary update flow (seams for testing ordering). */
 export interface BinaryUpdateFlow {
     download(url: string, tempPath: string): Promise<void>;
     fsync(filePath: string): Promise<void>;
     replace(options: BinaryReplacementOptions): Promise<InstalledVersionVerification>;
     verifyInstalledVersion(expectedVersion: string): Promise<InstalledVersionVerification>;
-    /** Best-effort cleanup of the temp file when the flow aborts before replace. */
-    removeTemp?(filePath: string): Promise<void>;
     /** Called once fsync has succeeded, right before replacement begins. */
     beforeReplace?(): void;
 }
@@ -146,15 +177,18 @@ export interface BinaryUpdateFlow {
  * before it is published (renamed into place) or exec'd for verification.
  *
  * If fsync fails the temp bytes are not durable, so we abort before
- * replacement/verification and clean up the temp file rather than installing a
- * possibly-truncated binary.
+ * replacement/verification and retain the staging artifact rather than risk
+ * deleting a substituted pathname or installing a possibly-truncated binary.
  */
 export declare function runBinaryUpdateFlow(targetPath: string, url: string, expectedVersion: string, flow: BinaryUpdateFlow): Promise<InstalledVersionVerification>;
+export declare function acquireBinaryUpdateLock(targetPath: string): Promise<() => Promise<void>>;
 export declare function assertSupportedLinuxLibcForTest(glibcVersionRuntime: string | undefined, muslLoaderPresent: boolean): void;
 /**
  * Run the update command.
  */
 export interface UpdateCommandDependencies {
+    /** User-visible migration guidance owned by the standalone update command, not the TUI logger. */
+    writeStdout?: (text: string) => void;
     getLatestRelease?: (options?: LatestReleaseLookupOptions) => Promise<ReleaseInfo>;
     resolveUpdateTarget?: () => Promise<UpdateTarget>;
     verifyMigrationTarget?: (release: ReleaseInfo, runtimePath: string) => Promise<InstalledVersionVerification>;
@@ -165,6 +199,8 @@ export interface UpdateCommandDependencies {
     restartDaemon?: (settings: Settings) => Promise<void>;
     recoverNotifications?: (settings: Settings) => Promise<void>;
     runPostUpdateRecovery?: (runtimePath: string) => Promise<void>;
+    platform?: NodeJS.Platform;
+    offerMacosCommunityApp?: typeof offerMacosCommunityApp;
     recordTelemetryEvent?: (event: TelemetryEventName, details: TelemetryDetails) => unknown;
     exit?: (code: number) => never;
 }
@@ -202,6 +238,7 @@ export declare function resolveUpdateDecision(options: {
     currentVersion: string;
     migrate?: boolean;
 }): UpdateDecision;
+export declare function formatVerifiedBinaryInvocation(runtimePath: string, platform: NodeJS.Platform): string;
 export declare function runUpdateCommand(opts: UpdateCommandOptions, deps?: UpdateCommandDependencies): Promise<void>;
 /**
  * Print update command help.