@getmikie/cli 1.1.86 → 1.1.88

package/README.md

@@ -16,3 +16,18 @@ mikie mcp
 The launcher contains no relay, pricing, receipt, or model logic. npm installs
 the matching `@getmikie/*` optional platform package and the launcher executes that
 binary with inherited stdio.
+
+## Mikie Control
+
+Run one immutable, repository-scoped request through the verified Codex App
+Server runtime:
+
+```sh
+mikie control run --request C:\absolute\path\control-request.json --json
+```
+
+The request must be an existing absolute JSON file. Mikie validates the frozen
+repository, allowed paths, deterministic verifier, exact model and reasoning
+effort, bounded model-turn timeout, and private temporary root before execution. The JSON result is
+content-free: it reports terminal status and hashes, never prompts, context,
+patch bodies, verifier output, or credentials.

package/bin/mikie.mjs

@@ -1,12 +1,28 @@
 #!/usr/bin/env node
 
 import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import { access } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 
 import {
+  launchNativeCaptured,
   launchNative,
   resolveNativeBinary,
+  selectPlatformPackage,
   translateArguments,
 } from "../lib/launcher.mjs";
+import {
+  UpdateTopology,
+  createCommandAdapter,
+  createFilesystemAdapter,
+  createRegistryAdapter,
+  detectUpdateTopology,
+  externalRecoveryInvocation,
+  parseUpdateHandoff,
+  runUpdateTransaction,
+} from "../lib/update.mjs";
 
 const require = createRequire(import.meta.url);
 const packageMetadata = require("../package.json");
@@ -22,9 +38,150 @@ Usage:
   mikie mcp [--adapter codex|claude_code]
   mikie login
   mikie connect .
+  mikie control run --request <absolute-json> --json
   mikie doctor
+  mikie update
 
 All commands execute the compiled Mikie native engine.`);
+} else if (arguments_.length === 1 && arguments_[0].toLowerCase() === "update") {
+  try {
+    const commands = createCommandAdapter();
+    const npmRoot = await commands.run("npm", ["root", "--global"], {
+      shell: false,
+      capture: true,
+    });
+    const npmPrefix = await commands.run("npm", ["prefix", "--global"], {
+      shell: false,
+      capture: true,
+    });
+    if (
+      npmRoot.code !== 0 ||
+      npmRoot.stdout.trim().split(/\r?\n/).length !== 1 ||
+      !path.isAbsolute(npmRoot.stdout.trim()) ||
+      npmPrefix.code !== 0 ||
+      npmPrefix.stdout.trim().split(/\r?\n/).length !== 1 ||
+      !path.isAbsolute(npmPrefix.stdout.trim())
+    ) {
+      throw new Error("global npm installation authority is unavailable");
+    }
+    const topology = detectUpdateTopology({ globalNodeModules: npmRoot.stdout.trim() });
+    const customerHome = homedir();
+    const transactionRoot = path.join(customerHome, ".mikie", "npm-update-v1");
+    const recoveryJournal = path.join(transactionRoot, "journal.json");
+    if (topology === UpdateTopology.NpmGlobal) {
+      try {
+        await access(recoveryJournal);
+        const invocation = await externalRecoveryInvocation(transactionRoot);
+        const recovered = await commands.run(invocation.executable, invocation.args, {
+          shell: false,
+          capture: true,
+        });
+        if (recovered.code !== 0) {
+          throw new Error("pending Mikie update recovery failed");
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") throw error;
+      }
+    }
+    const selected = selectPlatformPackage();
+    const platformPackageJson = require.resolve(`${selected.packageName}/package.json`);
+    const wrapperPackageJson = fileURLToPath(new URL("../package.json", import.meta.url));
+    const binary = await resolveNativeBinary();
+    const globalPrefix = npmPrefix.stdout.trim();
+    const globalShims =
+      process.platform === "win32"
+        ? ["mikie", "mikie.cmd", "mikie.ps1"].map((name) => path.join(globalPrefix, name))
+        : [path.join(globalPrefix, "bin", "mikie")];
+    const handoffResult = await launchNativeCaptured(binary, ["update"], { topology });
+    if (handoffResult.code !== 0) {
+      if (handoffResult.stderr) process.stderr.write(handoffResult.stderr);
+      throw new Error(`native update handoff exited with status ${handoffResult.code}`);
+    }
+    const handoff = parseUpdateHandoff(handoffResult.stdout, topology);
+    const registry = createRegistryAdapter({ commands });
+    const files = createFilesystemAdapter({
+      currentLayout: { wrapperPackageJson, platformPackageJson, binary, shims: globalShims },
+      locateCandidate: async ({ stagingPrefix } = {}) => {
+        if (stagingPrefix) {
+          const nodeModules =
+            process.platform === "win32"
+              ? path.join(stagingPrefix, "node_modules")
+              : path.join(stagingPrefix, "lib", "node_modules");
+          const stagedWrapper = path.join(nodeModules, "@getmikie", "cli", "package.json");
+          const stagedPlatform = path.join(
+            nodeModules,
+            ...selected.packageName.split("/"),
+            "package.json",
+          );
+          return {
+            wrapperPackageJson: stagedWrapper,
+            platformPackageJson: stagedPlatform,
+            binary: path.join(
+              path.dirname(stagedPlatform),
+              ...selected.binaryPath.split("/"),
+            ),
+            shims:
+              process.platform === "win32"
+                ? ["mikie", "mikie.cmd", "mikie.ps1"].map((name) =>
+                    path.join(stagingPrefix, name),
+                  )
+                : [path.join(stagingPrefix, "bin", "mikie")],
+          };
+        }
+        return {
+          wrapperPackageJson,
+          platformPackageJson: require.resolve(`${selected.packageName}/package.json`),
+          binary: await resolveNativeBinary(),
+          shims: globalShims,
+        };
+      },
+      providerPaths: {
+        registration: path.join(customerHome, ".claude.json"),
+        settings: path.join(customerHome, ".claude", "settings.json"),
+        ownership: path.join(customerHome, ".claude", "mikie-evidence-hook-ownership.json"),
+      },
+      transactionRoot,
+      settleProviderRepair: async (phase, snapshot) => {
+        const settlementBinary = snapshot?.preparedCandidate?.binary;
+        const finalLauncher = snapshot?.preparedCandidate?.finalLauncher;
+        if (!settlementBinary || !finalLauncher) {
+          throw new Error("prepared candidate recovery authority is unavailable");
+        }
+        const settlement = await commands.run(settlementBinary, handoff.repair_command, {
+          shell: false,
+          capture: true,
+          environment: {
+            MIKIE_DISTRIBUTION_MODE: "npm",
+            MIKIE_NPM_UPDATE_TOPOLOGY: UpdateTopology.NpmGlobal,
+            MIKIE_NPM_UPDATE_REPAIR_PHASE: phase,
+            MIKIE_UPDATE_REPAIR_CANDIDATE: settlementBinary,
+            MIKIE_UPDATE_REPAIR_LAUNCHER: finalLauncher,
+          },
+        });
+        if (settlement.code !== 0) {
+          throw new Error("candidate owned-adapter settlement failed");
+        }
+      },
+    });
+    const result = await runUpdateTransaction({
+      handoff,
+      currentVersion: packageMetadata.version,
+      platformPackage: selected.packageName,
+      registry,
+      commands,
+      files,
+    });
+    if (result.status === "updated") {
+      console.log(`Updated Mikie to ${result.version}.`);
+      for (const setting of result.foreignSettings) {
+        console.log(`Preserved foreign setting: ${setting}`);
+      }
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Mikie update failed";
+    console.error(`mikie: ${message}`);
+    process.exitCode = 1;
+  }
 } else {
   try {
     const binary = await resolveNativeBinary();

package/lib/launcher.mjs

@@ -17,6 +17,8 @@ const SIGNAL_EXIT_CODES = new Map([
   ["SIGTERM", 143],
 ]);
 
+const MAX_CAPTURED_OUTPUT_BYTES = 1024 * 1024;
+
 function currentRuntimeUsesGlibc() {
   try {
     const report = process.report?.getReport();
@@ -122,3 +124,89 @@ export function launchNative(
     });
   });
 }
+
+export function launchNativeCaptured(
+  binary,
+  arguments_,
+  {
+    topology,
+    spawnProcess = spawn,
+    environment = process.env,
+    timeoutMs = 30_000,
+    scheduleTimeout = setTimeout,
+    cancelTimeout = clearTimeout,
+  } = {},
+) {
+  if (!["npm_global", "npm_ephemeral"].includes(topology)) {
+    throw new Error("Mikie npm update topology is invalid");
+  }
+  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("Mikie native update timeout is invalid");
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const stdout = [];
+    const stderr = [];
+    let capturedBytes = 0;
+    const child = spawnProcess(binary, arguments_, {
+      shell: false,
+      stdio: ["inherit", "pipe", "pipe"],
+      windowsHide: true,
+      env: {
+        ...environment,
+        MIKIE_DISTRIBUTION_MODE: "npm",
+        MIKIE_NPM_UPDATE_TOPOLOGY: topology,
+      },
+    });
+    const deadline = scheduleTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try {
+        child.kill?.("SIGKILL");
+      } catch {
+        // The child may already have exited.
+      }
+      reject(new Error("Mikie native update command timed out"));
+    }, timeoutMs);
+    const finish = (callback) => {
+      if (settled) return false;
+      settled = true;
+      cancelTimeout(deadline);
+      callback();
+      return true;
+    };
+    const capture = (target) => (chunk) => {
+      if (settled) return;
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      capturedBytes += bytes.length;
+      if (capturedBytes > MAX_CAPTURED_OUTPUT_BYTES) {
+        finish(() => {
+          try {
+            child.kill?.("SIGKILL");
+          } catch {
+            // The child may already have exited.
+          }
+          reject(new Error("Mikie native update response exceeded the capture limit"));
+        });
+        return;
+      }
+      target.push(bytes);
+    };
+    child.stdout.on("data", capture(stdout));
+    child.stderr.on("data", capture(stderr));
+    child.once("error", (error) => {
+      finish(() =>
+        reject(new Error("Mikie native update command could not be started", { cause: error })),
+      );
+    });
+    child.once("close", (code, signal) => {
+      finish(() =>
+        resolve({
+          code: Number.isInteger(code) ? code : (SIGNAL_EXIT_CODES.get(signal) ?? 1),
+          stdout: Buffer.concat(stdout).toString("utf8"),
+          stderr: Buffer.concat(stderr).toString("utf8"),
+        }),
+      );
+    });
+  });
+}