@getmikie/cli 1.1.108 → 1.1.114

package/README.md

@@ -3,28 +3,29 @@
 This package is a thin launcher for Mikie's compiled native relay.
 
 ```sh
-npx -y @getmikie/cli mcp
+npx --yes --ignore-scripts --registry=https://registry.npmjs.org @getmikie/cli@1.1.108 mcp
 ```
 
 For a persistent command path on Windows PowerShell:
 
 ```powershell
-npm.cmd install --global @getmikie/cli@latest --allow-scripts=@getmikie/cli
+npm.cmd install --global @getmikie/cli@1.1.108 --ignore-scripts --registry=https://registry.npmjs.org
 ```
 
-Mikie does not change your PowerShell execution policy. Do not shorten the
-command to `npm install -g --allow-scripts=@getmikie/cli`: without naming the
-package as the install target, that command incorrectly targets the current
-directory.
+Mikie does not change your PowerShell execution policy. Keep the exact package
+name in the command: without naming the package as the install target, npm
+incorrectly targets the current directory.
 
 For a persistent command path on macOS or Linux:
 
 ```sh
-npm install --global @getmikie/cli@latest --allow-scripts=@getmikie/cli
+npm install --global @getmikie/cli@1.1.108 --ignore-scripts --registry=https://registry.npmjs.org
 ```
 
-On every platform, `--allow-scripts=@getmikie/cli` approves only Mikie's
-packaged install script; it does not approve unrelated package scripts.
+These portable npm commands disable every lifecycle script and pin the public
+npm registry. The public OS installers additionally authenticate exact wrapper
+and native tarball bytes, install them offline, and explicitly run only Mikie's
+authenticated reconciliation script.
 
 Then run:
 
@@ -46,7 +47,9 @@ mikie control run --request C:\absolute\path\control-request.json --json
 ```
 
 The request must be an existing absolute JSON file. Mikie validates the frozen
-repository, allowed paths, deterministic verifier, exact model and reasoning
-effort, bounded model-turn timeout, and private temporary root before execution. The JSON result is
+repository, allowed paths, exact model and reasoning effort, bounded model-turn
+timeout, and private temporary root before execution. The verifier argv is
+restricted to `git diff --check`; interpreters, build tools, and test runners
+that could execute repository-controlled code are rejected. The JSON result is
 content-free: it reports terminal status and hashes, never prompts, context,
 patch bodies, verifier output, or credentials.

package/bin/mikie.mjs

@@ -18,6 +18,7 @@ import {
   resolveDependencyPackageJson,
   resolveNativeBinary,
   selectPlatformPackage,
+  shouldReconcileInstalledClients,
   translateArguments,
 } from "../lib/launcher.mjs";
 import {
@@ -26,9 +27,9 @@ import {
   createFilesystemAdapter,
   createRegistryAdapter,
   detectUpdateTopology,
-  externalRecoveryInvocation,
   parseUpdateHandoff,
   parseTrajectoryReconciliationReceipt,
+  recoverPendingNpmUpdate,
   runUpdateTransaction,
 } from "../lib/update.mjs";
 import {
@@ -47,12 +48,23 @@ if (["--version", "-v"].includes(singleFlag)) {
   console.log(`Mikie ${packageMetadata.version}
 
 Usage:
+  mikie savings history [options]
+  mikie savings export-meter-history
   mikie mcp [--adapter codex|claude_code]
   mikie login
-  mikie connect .
+  mikie logout
+  mikie connect .|<absolute-directory>
+  mikie privacy review
+  mikie setup codex
+  mikie setup claude
+  mikie mode codex [active|shadow] [--json]
   mikie control run --request <absolute-json> --json
-  mikie doctor
+  mikie doctor [--client codex]
   mikie update
+  mikie device revoke
+  mikie uninstall
+  mikie --help
+  mikie --version
 
 All commands execute the compiled Mikie native engine.`);
 } else if (arguments_.length === 1 && arguments_[0].toLowerCase() === "update") {
@@ -77,33 +89,29 @@ All commands execute the compiled Mikie native engine.`);
       throw new Error("global npm installation authority is unavailable");
     }
     const topology = detectUpdateTopology({ globalNodeModules: npmRoot.stdout.trim() });
+    const selected = selectPlatformPackage();
+    const platformPackageJson = require.resolve(`${selected.packageName}/package.json`);
+    const wrapperPackageJson = fileURLToPath(new URL("../package.json", import.meta.url));
+    const binary = await resolveNativeBinary();
+    const globalPrefix = npmPrefix.stdout.trim();
+    const globalShims =
+      process.platform === "win32"
+        ? ["mikie", "mikie.cmd", "mikie.ps1"].map((name) => path.join(globalPrefix, name))
+        : [path.join(globalPrefix, "bin", "mikie")];
     const customerHome = homedir();
     const transactionRoot = path.join(customerHome, ".mikie", "npm-update-v1");
     const recoveryJournal = path.join(transactionRoot, "journal.json");
     if (topology === UpdateTopology.NpmGlobal) {
       try {
         await access(recoveryJournal);
-        const invocation = await externalRecoveryInvocation(transactionRoot);
-        const recovered = await commands.run(invocation.executable, invocation.args, {
-          shell: false,
-          capture: true,
+        await recoverPendingNpmUpdate(transactionRoot, {
+          commands,
+          supersedingInstallation: { version: packageMetadata.version, binary },
         });
-        if (recovered.code !== 0) {
-          throw new Error("pending Mikie update recovery failed");
-        }
       } catch (error) {
         if (error?.code !== "ENOENT") throw error;
       }
     }
-    const selected = selectPlatformPackage();
-    const platformPackageJson = require.resolve(`${selected.packageName}/package.json`);
-    const wrapperPackageJson = fileURLToPath(new URL("../package.json", import.meta.url));
-    const binary = await resolveNativeBinary();
-    const globalPrefix = npmPrefix.stdout.trim();
-    const globalShims =
-      process.platform === "win32"
-        ? ["mikie", "mikie.cmd", "mikie.ps1"].map((name) => path.join(globalPrefix, name))
-        : [path.join(globalPrefix, "bin", "mikie")];
     const handoffResult = await launchNativeCaptured(binary, ["update"], { topology });
     if (handoffResult.code !== 0) {
       if (handoffResult.stderr) process.stderr.write(handoffResult.stderr);
@@ -236,8 +244,10 @@ All commands execute the compiled Mikie native engine.`);
   }
 } else {
   try {
-    await reconcileInstalledClients({ version: packageMetadata.version });
     const nativeArguments = translateArguments(arguments_);
+    if (shouldReconcileInstalledClients(nativeArguments)) {
+      await reconcileInstalledClients({ version: packageMetadata.version });
+    }
     const binary = await prepareNativeLaunch(await resolveNativeBinary(), nativeArguments, {
       version: packageMetadata.version,
     });

package/lib/launcher.mjs

@@ -424,6 +424,11 @@ export function shouldStageWindowsRuntime(arguments_) {
   return arguments_[0] === "control" && arguments_[1] === "run";
 }
 
+/** Return whether a native runtime entrypoint needs installed client launchers reconciled first. */
+export function shouldReconcileInstalledClients(arguments_) {
+  return ["serve", "run-relay", "run-codex-hook", "run-claude-hook"].includes(arguments_[0]);
+}
+
 async function materializeRuntime(
   binary,
   { version, runtimeRoot, executableName, cleanupHistorical },
@@ -616,6 +621,13 @@ export function selectPlatformPackage({
 }
 
 export function translateArguments(arguments_) {
+  if (
+    arguments_.length === 2 &&
+    arguments_[0] === "setup" &&
+    arguments_[1] === "claude-code"
+  ) {
+    return ["setup", "claude"];
+  }
   if (arguments_[0] !== "mcp") {
     return [...arguments_];
   }

package/lib/update.mjs

@@ -19,11 +19,11 @@ import { isDeepStrictEqual } from "node:util";
 
 const WRAPPER_PACKAGE = "@getmikie/cli";
 const HANDOFF_SCHEMA = "mikie.update-handoff.v1";
-const REPAIR_SCHEMA = "mikie.claude-hook-repair.v1";
+const REPAIR_SCHEMA = "mikie.claude-hook-repair.v2";
 const TRAJECTORY_RECONCILIATION_SCHEMA = "mikie.trajectory-store-reconciliation.v1";
 const RERUN_COMMAND = "npx -y @getmikie/cli@latest update";
 const MAX_COMMAND_OUTPUT_BYTES = 1024 * 1024;
-const DEFAULT_COMMAND_TIMEOUT_MS = 30_000;
+const DEFAULT_COMMAND_TIMEOUT_MS = 120_000;
 const TRANSACTION_SCHEMA = "mikie.npm-update-transaction.v1";
 const LOCK_SCHEMA = "mikie.npm-update-lock.v1";
 const MAX_TRANSACTION_TREE_ENTRIES = 16_384;
@@ -331,11 +331,70 @@ export async function externalRecoveryInvocation(transactionRoot) {
       "command",
     ]) ||
     recovery.descriptor !== path.join(transactionRoot, "recovery.json") ||
-    !/^[a-f0-9]{64}$/.test(recovery.descriptor_sha256)
+    recovery.launcher !== path.join(transactionRoot, "recover.mjs") ||
+    recovery.runtime !== path.join(transactionRoot, "recovery-runtime.mjs") ||
+    recovery.node !== process.execPath ||
+    ![
+      recovery.descriptor_sha256,
+      recovery.launcher_sha256,
+      recovery.runtime_sha256,
+    ].every((digest) => /^[a-f0-9]{64}$/.test(digest))
   ) {
     throw new Error("invalid Mikie update recovery authority");
   }
-  return authenticatedRecoveryInvocation(transactionRoot, recovery.descriptor_sha256);
+  return {
+    ...authenticatedRecoveryInvocation(transactionRoot, recovery.descriptor_sha256),
+    authority: {
+      descriptorSha256: recovery.descriptor_sha256,
+      launcherSha256: recovery.launcher_sha256,
+      runtimeSha256: recovery.runtime_sha256,
+    },
+  };
+}
+
+/** Recover with frozen transaction code first, then the authenticated current implementation. */
+export async function recoverPendingNpmUpdate(
+  transactionRoot,
+  {
+    commands = createCommandAdapter(),
+    recoverCurrent = recoverExternalNpmUpdate,
+    supersedingInstallation,
+  } = {},
+) {
+  const invocation = await externalRecoveryInvocation(transactionRoot);
+  const frozen = await commands.run(invocation.executable, invocation.args, {
+    shell: false,
+    capture: true,
+  });
+  if (frozen.code === 0) return { status: "recovered", method: "frozen" };
+  try {
+    let authenticatedSupersedingInstallation;
+    if (supersedingInstallation !== undefined) {
+      if (
+        !exactPublicVersion(supersedingInstallation?.version) ||
+        typeof supersedingInstallation?.binary !== "string" ||
+        !path.isAbsolute(supersedingInstallation.binary)
+      ) {
+        throw new Error("invalid superseding Mikie installation authority");
+      }
+      authenticatedSupersedingInstallation = {
+        version: supersedingInstallation.version,
+        binarySha256: await executableDigest(supersedingInstallation.binary),
+      };
+    }
+    await recoverCurrent(transactionRoot, invocation.authority, {
+      supersedingInstallation: authenticatedSupersedingInstallation,
+    });
+    return { status: "recovered", method: "current" };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "";
+    const reason = /tampered|invalid|unsafe|authority|corrupt|changed/i.test(message)
+      ? "recovery authority could not be authenticated"
+      : /settlement|configured client/i.test(message)
+        ? "configured client state could not be settled"
+        : "authenticated recovery could not complete";
+    throw new Error(`pending Mikie update recovery failed: ${reason}; transaction preserved`);
+  }
 }
 
 function expectedHandoff(topology) {
@@ -632,12 +691,17 @@ function parseRepairReceipt(stdout) {
     receipt.after === "current" &&
     receipt.action === "already_current" &&
     receipt.restart_required === false;
+  const absent =
+    receipt.before === "absent" &&
+    receipt.after === "absent" &&
+    receipt.action === "not_configured" &&
+    receipt.restart_required === false;
   const skipped =
     ["foreign_conflict", "unavailable"].includes(receipt.before) &&
     receipt.after === receipt.before &&
     receipt.action === "refused" &&
     receipt.restart_required === false;
-  if (!migrated && !current && !skipped) {
+  if (!migrated && !current && !absent && !skipped) {
     throw new Error("candidate owned-adapter repair returned an invalid receipt");
   }
   return { receipt, skipped };
@@ -779,6 +843,7 @@ export async function runUpdateTransaction({
           MIKIE_DISTRIBUTION_MODE: "npm",
           MIKIE_NPM_UPDATE_TOPOLOGY: UpdateTopology.NpmGlobal,
           MIKIE_NPM_UPDATE_REPAIR_PHASE: "prepare",
+          MIKIE_NPM_CLIENT_REPAIR_SCHEMA: REPAIR_SCHEMA,
           MIKIE_UPDATE_REPAIR_LAUNCHER_STATE: "prior",
           MIKIE_UPDATE_REPAIR_CANDIDATE: candidate.binary,
           MIKIE_UPDATE_REPAIR_LAUNCHER: finalLauncher,
@@ -816,8 +881,10 @@ export async function runUpdateTransaction({
       await files.activate(activatedCandidate);
       await files.checkpointCandidate(snapshot, { provider: true });
       const settlementRequired =
-        repairResult.receipt.action === "migrated" ||
-        files.requiresFinalLauncherSettlement?.() === true;
+        !repairResult.skipped &&
+        repairResult.receipt.action !== "not_configured" &&
+        (repairResult.receipt.action === "migrated" ||
+          files.requiresFinalLauncherSettlement?.() === true);
       // A skipped receipt does not prove that no client still references a
       // historical launcher. In particular, Claude can report unavailable
       // when hooks/ownership are absent while an MCP-only registration remains.
@@ -840,6 +907,7 @@ export async function runUpdateTransaction({
             MIKIE_DISTRIBUTION_MODE: "npm",
             MIKIE_NPM_UPDATE_TOPOLOGY: UpdateTopology.NpmGlobal,
             MIKIE_NPM_UPDATE_REPAIR_PHASE: "commit",
+            MIKIE_NPM_CLIENT_REPAIR_SCHEMA: REPAIR_SCHEMA,
             MIKIE_UPDATE_REPAIR_LAUNCHER_STATE: "activated",
             MIKIE_UPDATE_REPAIR_CANDIDATE: candidate.binary,
             MIKIE_UPDATE_REPAIR_LAUNCHER: finalLauncher,
@@ -861,7 +929,7 @@ export async function runUpdateTransaction({
           ? "skipped"
           : repairResult.receipt.action === "already_current"
             ? "verified"
-            : "migrated",
+            : repairResult.receipt.action,
         foreignSettings: verification.foreignSettings ?? [],
       };
     } catch (error) {
@@ -875,6 +943,7 @@ export async function runUpdateTransaction({
               MIKIE_DISTRIBUTION_MODE: "npm",
               MIKIE_NPM_UPDATE_TOPOLOGY: UpdateTopology.NpmGlobal,
               MIKIE_NPM_UPDATE_REPAIR_PHASE: "rollback",
+              MIKIE_NPM_CLIENT_REPAIR_SCHEMA: REPAIR_SCHEMA,
               MIKIE_UPDATE_REPAIR_LAUNCHER_STATE:
                 files.preparedLauncherState?.(snapshot) ?? "prior",
               MIKIE_UPDATE_REPAIR_CANDIDATE: candidate.binary,
@@ -935,7 +1004,15 @@ export function createCommandAdapter({
       ? environmentNpmCli
       : path.join(path.dirname(nodeExecutable), "node_modules", "npm", "bin", "npm-cli.js"));
   return {
-    run(executable, args, { shell = false, environment: commandEnvironment = {} } = {}) {
+    run(
+      executable,
+      args,
+      {
+        shell = false,
+        environment: commandEnvironment = {},
+        timeoutMs = commandTimeoutMs,
+      } = {},
+    ) {
       if (
         shell !== false ||
         !Array.isArray(args) ||
@@ -945,6 +1022,9 @@ export function createCommandAdapter({
       ) {
         throw new Error("Mikie update commands require argument arrays with shell disabled");
       }
+      if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+        throw new Error("Mikie update command timeout is invalid");
+      }
       return new Promise((resolve, reject) => {
         const stdout = [];
         const stderr = [];
@@ -970,7 +1050,7 @@ export function createCommandAdapter({
             // The child may already have exited.
           }
           reject(new Error("Mikie update command timed out"));
-        }, commandTimeoutMs);
+        }, timeoutMs);
         const finish = (callback) => {
           if (settled) return false;
           settled = true;
@@ -1041,11 +1121,19 @@ export function createRegistryAdapter({
   return {
     async resolveExactCompatibleVersion({ packageName, nodeVersion }) {
       const deadline = now() + resolutionTimeoutMs;
-      const versionsResponse = await commands.run(
-        npmExecutable,
+      const runWithinDeadline = async (args) => {
+        const timeoutMs = deadline - now();
+        if (timeoutMs <= 0) return null;
+        return commands.run(npmExecutable, args, {
+          shell: false,
+          capture: true,
+          timeoutMs,
+        });
+      };
+      const versionsResponse = await runWithinDeadline(
         ["view", packageName, "versions", "--json", "--registry", registryUrl],
-        { shell: false, capture: true },
       );
+      if (versionsResponse === null) return { public: false, compatible: false };
       if (versionsResponse.code !== 0) return { public: false, compatible: false };
       let published;
       try {
@@ -1059,8 +1147,7 @@ export function createRegistryAdapter({
       }
       for (const version of published.slice(0, 64)) {
         if (now() >= deadline) break;
-        const response = await commands.run(
-          npmExecutable,
+        const response = await runWithinDeadline(
           [
             "view",
             `${packageName}@${version}`,
@@ -1070,8 +1157,8 @@ export function createRegistryAdapter({
             "--registry",
             registryUrl,
           ],
-          { shell: false, capture: true },
         );
+        if (response === null) break;
         if (response.code !== 0) continue;
         let metadata;
         try {
@@ -1320,6 +1407,7 @@ export function createFilesystemAdapter({
   prepareFinalLauncher,
   retireFinalLauncher,
   abandonFinalLauncher,
+  supersedingInstallation,
 }) {
   const currentRoots = validateInstallationLayout(currentLayout);
   const currentShims = currentRoots.shims;
@@ -1336,7 +1424,10 @@ export function createFilesystemAdapter({
     (activationBoundary !== undefined && typeof activationBoundary !== "function") ||
     (prepareFinalLauncher !== undefined && typeof prepareFinalLauncher !== "function") ||
     (retireFinalLauncher !== undefined && typeof retireFinalLauncher !== "function") ||
-    (abandonFinalLauncher !== undefined && typeof abandonFinalLauncher !== "function")
+    (abandonFinalLauncher !== undefined && typeof abandonFinalLauncher !== "function") ||
+    (supersedingInstallation !== undefined &&
+      (!exactPublicVersion(supersedingInstallation?.version) ||
+        !/^[a-f0-9]{64}$/.test(supersedingInstallation?.binarySha256 ?? "")))
   ) {
     throw new Error("unsafe Mikie update filesystem path");
   }
@@ -2341,6 +2432,86 @@ export function createFilesystemAdapter({
     return owner?.activationState === "activated" ? "activated" : "prior";
   };
 
+  const committedActivationMatches = async (snapshot) => {
+    for (const entry of snapshot.installation) {
+      if (
+        !entry.expectedFingerprint ||
+        (await directoryFingerprint(entry.root)) !== entry.expectedFingerprint
+      ) {
+        return false;
+      }
+    }
+    for (const entry of snapshot.shims) {
+      if (
+        !entry.expectedFingerprint ||
+        (await readShimState(entry.path)).fingerprint !== entry.expectedFingerprint
+      ) {
+        return false;
+      }
+    }
+    return true;
+  };
+
+  const authenticateSupersedingInstallation = async () => {
+    if (!supersedingInstallation) return false;
+    try {
+      const [wrapper, platform, binarySha256] = await Promise.all([
+        readFile(currentLayout.wrapperPackageJson, "utf8"),
+        readFile(currentLayout.platformPackageJson, "utf8"),
+        executableDigest(currentLayout.binary),
+      ]);
+      return (
+        JSON.parse(wrapper)?.version === supersedingInstallation.version &&
+        JSON.parse(platform)?.version === supersedingInstallation.version &&
+        binarySha256 === supersedingInstallation.binarySha256
+      );
+    } catch {
+      return false;
+    }
+  };
+
+  const cleanupSupersededCommittedActivation = async (snapshot) => {
+    for (const entry of snapshot.installation) {
+      const priorFingerprint = await directoryFingerprint(entry.priorQuarantine);
+      const stagedFingerprint = await directoryFingerprint(entry.activationStaging);
+      if (
+        (priorFingerprint !== "absent" && priorFingerprint !== entry.sourceFingerprint) ||
+        (stagedFingerprint !== "absent" && stagedFingerprint !== entry.expectedFingerprint)
+      ) {
+        throw new Error("tampered Mikie superseded activation state");
+      }
+    }
+    for (const entry of snapshot.shims) {
+      const prior = await readShimState(entry.priorQuarantine);
+      const staged = await readShimState(entry.activationStaging);
+      if (
+        (prior.existed && prior.fingerprint !== entry.sourceFingerprint) ||
+        (staged.existed && staged.fingerprint !== entry.expectedFingerprint)
+      ) {
+        throw new Error("tampered Mikie superseded activation state");
+      }
+    }
+    for (const entry of snapshot.installation) {
+      await rm(entry.priorQuarantine, { recursive: true, force: true });
+      await rm(entry.activationStaging, { recursive: true, force: true });
+    }
+    for (const entry of snapshot.shims) {
+      await rm(entry.priorQuarantine, { force: true });
+      await rm(entry.activationStaging, { force: true });
+    }
+  };
+
+  const providerConfigurationMatchesSnapshot = async (snapshot) => {
+    for (const entry of snapshot.providerConfig) {
+      await assertNoLinkedAncestors(entry.path);
+      const current = await readOptionalFile(entry.path);
+      if (bytesFingerprint(current.existed, current.bytes) !== entry.sourceFingerprint) {
+        return false;
+      }
+    }
+    return true;
+  };
+
   const recoverInterrupted = async (lease, expectedJournalToken) => {
     try {
       const metadata = await lstat(transactionRoot);
@@ -2352,6 +2523,33 @@ export function createFilesystemAdapter({
       throw error;
     }
     const snapshot = await hydrateJournal(lease, expectedJournalToken);
+    if (snapshot.phase === "commit_decided_retain_runtime") {
+      const activationMatches = await committedActivationMatches(snapshot);
+      if (!activationMatches && (await authenticateSupersedingInstallation())) {
+        await cleanupSupersededCommittedActivation(snapshot);
+        await rm(transactionRoot, { recursive: true, force: true });
+        return;
+      }
+    }
+    if (
+      snapshot.phase === "commit_decided_retain_runtime" &&
+      (await providerConfigurationMatchesSnapshot(snapshot))
+    ) {
+      if (!reconcileTrajectoryStore) {
+        throw new Error("trajectory-store reconciliation is unavailable");
+      }
+      await reconcileTrajectoryStore(snapshot.preparedCandidate.finalLauncher, snapshot);
+      const activationMatches = await committedActivationMatches(snapshot);
+      if (!activationMatches && !(await authenticateSupersedingInstallation())) {
+        throw new Error("committed Mikie package changed before cleanup");
+      }
+      snapshot.phase = "committed_retain_runtime";
+      await writeJournal(snapshot);
+      if (activationMatches) await cleanupCommittedActivation(snapshot);
+      else await cleanupSupersededCommittedActivation(snapshot);
+      await rm(transactionRoot, { recursive: true, force: true });
+      return;
+    }
     if (["commit_decided", "commit_decided_retain_runtime"].includes(snapshot.phase)) {
       const retainHistoricalRuntimes = snapshot.phase === "commit_decided_retain_runtime";
       if (!reconcileTrajectoryStore) {
@@ -2394,7 +2592,12 @@ export function createFilesystemAdapter({
       return;
     }
     if (snapshot.phase === "committed_retain_runtime") {
-      await cleanupCommittedActivation(snapshot);
+      const activationMatches = await committedActivationMatches(snapshot);
+      if (!activationMatches && !(await authenticateSupersedingInstallation())) {
+        throw new Error("committed Mikie package changed before cleanup");
+      }
+      if (activationMatches) await cleanupCommittedActivation(snapshot);
+      else await cleanupSupersededCommittedActivation(snapshot);
       await rm(transactionRoot, { recursive: true, force: true });
       return;
     }
@@ -3061,7 +3264,11 @@ export function createFilesystemAdapter({
   return adapter;
 }
 
-export async function recoverExternalNpmUpdate(transactionRoot, expectedAuthority) {
+export async function recoverExternalNpmUpdate(
+  transactionRoot,
+  expectedAuthority,
+  { supersedingInstallation } = {},
+) {
   if (typeof transactionRoot !== "string" || !path.isAbsolute(transactionRoot)) {
     throw new Error("unsafe Mikie update recovery root");
   }
@@ -3154,6 +3361,7 @@ export async function recoverExternalNpmUpdate(transactionRoot, expectedAuthorit
     },
     providerPaths: descriptor.provider_paths,
     transactionRoot,
+    supersedingInstallation,
     settleProviderRepair: async (phase, snapshot) => {
       if (
         snapshot?.preparedCandidate?.binary !== descriptor.candidate_binary ||
@@ -3171,6 +3379,7 @@ export async function recoverExternalNpmUpdate(transactionRoot, expectedAuthorit
             MIKIE_DISTRIBUTION_MODE: "npm",
             MIKIE_NPM_UPDATE_TOPOLOGY: UpdateTopology.NpmGlobal,
             MIKIE_NPM_UPDATE_REPAIR_PHASE: phase,
+            MIKIE_NPM_CLIENT_REPAIR_SCHEMA: REPAIR_SCHEMA,
             MIKIE_UPDATE_REPAIR_CANDIDATE: descriptor.candidate_binary,
             MIKIE_UPDATE_REPAIR_LAUNCHER: descriptor.final_launcher,
           },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmikie/cli",
-  "version": "1.1.108",
+  "version": "1.1.114",
   "description": "Native Mikie relay launcher for MCP clients",
   "license": "Apache-2.0",
   "repository": {
@@ -24,10 +24,10 @@
     "node": ">=22"
   },
   "optionalDependencies": {
-    "@getmikie/darwin-arm64": "1.1.108",
-    "@getmikie/darwin-x64": "1.1.108",
-    "@getmikie/linux-x64-gnu": "1.1.108",
-    "@getmikie/win32-x64": "1.1.108"
+    "@getmikie/darwin-arm64": "1.1.114",
+    "@getmikie/darwin-x64": "1.1.114",
+    "@getmikie/linux-x64-gnu": "1.1.114",
+    "@getmikie/win32-x64": "1.1.114"
   },
   "publishConfig": {
     "access": "public",

package/scripts/reconcile-install.mjs

@@ -18,7 +18,7 @@ import {
 const RECONCILIATION_ARGUMENTS = ["reconcile-trajectory-store-v2", "--json"];
 const CLIENT_REPAIR_ARGUMENTS = ["repair-claude-hooks-v1", "--json"];
 const CLIENT_RECONCILIATION_SCHEMA = "mikie.npm-client-reconciliation.v2";
-const CLIENT_REPAIR_SCHEMA = "mikie.claude-hook-repair.v1";
+const CLIENT_REPAIR_SCHEMA = "mikie.claude-hook-repair.v2";
 const CLIENT_SETTLEMENT_SCHEMA = "mikie.claude-hook-repair-settlement.v1";
 const TRANSACTION_TOKEN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const PUBLIC_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
@@ -453,11 +453,12 @@ export async function reconcileInstalledClients({
       preserveSha256,
     }),
   commands = createCommandAdapter({ environment, platform }),
+  allowDeferred = false,
 } = {}) {
   if (isTransactionStagedInstall(environment, platform)) {
     return { status: "staged_candidate" };
   }
-  if (!PUBLIC_VERSION.test(version ?? "")) {
+  if (!PUBLIC_VERSION.test(version ?? "") || typeof allowDeferred !== "boolean") {
     throw new Error("installed client reconciliation authority is invalid");
   }
 
@@ -513,7 +514,9 @@ export async function reconcileInstalledClients({
     const preserved = explicitMarker
       ? [authority.runtime_sha256]
       : await retainedRuntimeDigests(markerRoot, platform);
-    await retireLauncher(launcher, authority.runtime_sha256, preserved);
+    if (!allowDeferred) {
+      await retireLauncher(launcher, authority.runtime_sha256, preserved);
+    }
     return { status: "current" };
   }
   const finalLauncher = await prepareLauncher(binary);
@@ -523,6 +526,7 @@ export async function reconcileInstalledClients({
   const baseEnvironment = {
     MIKIE_DISTRIBUTION_MODE: "npm",
     MIKIE_NPM_UPDATE_TOPOLOGY: "npm_global",
+    MIKIE_NPM_CLIENT_REPAIR_SCHEMA: CLIENT_REPAIR_SCHEMA,
     MIKIE_UPDATE_REPAIR_CANDIDATE: binary,
     MIKIE_UPDATE_REPAIR_LAUNCHER: finalLauncher,
   };
@@ -540,6 +544,9 @@ export async function reconcileInstalledClients({
   });
   parseClientSettlement(committed, settlementPhase);
   if (preparedReceipt.action === "refused") {
+    if (allowDeferred) {
+      return { status: "deferred", providerState: preparedReceipt.before };
+    }
     throw new Error(
       "Mikie could not authenticate every configured client; close active clients and run `mikie update` before reinstalling",
     );
@@ -554,7 +561,9 @@ export async function reconcileInstalledClients({
   const preserved = explicitMarker
     ? [authority.runtime_sha256]
     : await retainedRuntimeDigests(markerRoot, platform);
-  await retireLauncher(finalLauncher, authority.runtime_sha256, preserved);
+  if (!allowDeferred) {
+    await retireLauncher(finalLauncher, authority.runtime_sha256, preserved);
+  }
   return { status: "reconciled", finalLauncher };
 }
 
@@ -566,7 +575,13 @@ if (scriptIdentity !== null && scriptIdentity === invokedIdentity) {
     const packageMetadata = JSON.parse(
       await readFile(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"),
     );
-    await reconcileInstalledClients({ version: packageMetadata.version });
+    const clients = await reconcileInstalledClients({
+      version: packageMetadata.version,
+      allowDeferred: true,
+    });
+    if (clients.status === "deferred") {
+      console.warn("Mikie install client repair deferred; run `mikie setup` or `mikie doctor`.");
+    }
   } catch (error) {
     console.error(`Mikie install reconciliation failed: ${error.message}`);
     process.exitCode = 1;