@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/utils/run-bundled-script.js

@@ -29,7 +29,6 @@
  *     script needs to see termination, not a success code.
  */
 import { spawnSync } from "child_process";
-import * as fs from "node:fs";
 import * as path from "path";
 import { resolveBundledAsset } from "./hq-roots.js";
 /**
@@ -42,93 +41,6 @@ export function interpreterFor(asset) {
     const ext = path.extname(asset).toLowerCase();
     return ext === ".mjs" || ext === ".js" || ext === ".cjs" ? "node" : "bash";
 }
-function envValue(env, name) {
-    const key = Object.keys(env).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
-    return key ? env[key] : undefined;
-}
-function isFile(file, lookupErrors) {
-    try {
-        return fs.statSync(file).isFile();
-    }
-    catch (error) {
-        // Missing PATH candidates are expected during lookup; retain the cause so
-        // the final actionable error can expose why no interpreter was resolved.
-        lookupErrors.push(error);
-        return false;
-    }
-}
-function isWithinWindowsDirectory(file, directory) {
-    const normalizedFile = path.win32.resolve(file).toLowerCase();
-    const normalizedDirectory = path.win32.resolve(directory).toLowerCase();
-    return (normalizedFile === normalizedDirectory ||
-        normalizedFile.startsWith(`${normalizedDirectory}${path.win32.sep}`));
-}
-function isExcludedWindowsBash(file, env) {
-    if (path.win32.basename(file).toLowerCase() !== "bash.exe")
-        return false;
-    const windowsDir = envValue(env, "SystemRoot") ?? envValue(env, "WINDIR") ?? "C:\\Windows";
-    const systemBash = path.win32.resolve(windowsDir, "System32", "bash.exe");
-    if (path.win32.resolve(file).toLowerCase() === systemBash.toLowerCase())
-        return true;
-    const localAppData = envValue(env, "LOCALAPPDATA");
-    return Boolean(localAppData &&
-        isWithinWindowsDirectory(file, path.win32.resolve(localAppData, "Microsoft", "WindowsApps")));
-}
-function findOnWindowsPath(executable, env, lookupErrors) {
-    const pathValue = envValue(env, "PATH") ?? "";
-    const extensions = executable.includes(".")
-        ? [""]
-        : (envValue(env, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD")
-            .split(";")
-            .filter(Boolean)
-            .map((ext) => ext.toLowerCase());
-    for (const entry of pathValue.split(";").filter(Boolean)) {
-        const directory = entry.trim().replace(/^"|"$/g, "");
-        for (const extension of extensions) {
-            const candidate = path.win32.join(directory, `${executable}${extension}`);
-            if (!isExcludedWindowsBash(candidate, env) && isFile(candidate, lookupErrors))
-                return candidate;
-        }
-    }
-    return undefined;
-}
-function resolveWindowsBash(env) {
-    const lookupErrors = [];
-    const configured = envValue(env, "CLAUDE_CODE_GIT_BASH_PATH");
-    if (configured && !isExcludedWindowsBash(configured, env) && isFile(configured, lookupErrors)) {
-        return { executable: configured, cause: lookupErrors.at(-1) };
-    }
-    const pathBash = findOnWindowsPath("bash", env, lookupErrors);
-    if (pathBash)
-        return { executable: pathBash, cause: lookupErrors.at(-1) };
-    const gitExe = findOnWindowsPath("git.exe", env, lookupErrors);
-    if (gitExe) {
-        const derived = path.win32.resolve(path.win32.dirname(gitExe), "..", "bin", "bash.exe");
-        if (!isExcludedWindowsBash(derived, env) && isFile(derived, lookupErrors)) {
-            return { executable: derived, cause: lookupErrors.at(-1) };
-        }
-    }
-    const programFiles = envValue(env, "ProgramFiles") ?? "C:\\Program Files";
-    const localAppData = envValue(env, "LOCALAPPDATA");
-    const standardPaths = [
-        path.win32.join(programFiles, "Git", "bin", "bash.exe"),
-        ...(localAppData ? [path.win32.join(localAppData, "Programs", "Git", "bin", "bash.exe")] : []),
-    ];
-    const executable = standardPaths.find((candidate) => !isExcludedWindowsBash(candidate, env) && isFile(candidate, lookupErrors));
-    return {
-        executable,
-        cause: lookupErrors.at(-1) ??
-            Object.assign(new Error("Bash was not found (ENOENT)"), { code: "ENOENT" }),
-    };
-}
-function bashNotFoundError(asset, cause) {
-    const isHandoff = asset.replaceAll("\\", "/").endsWith("core/scripts/handoff-finalize.sh");
-    const recovery = isHandoff
-        ? "The handoff was not saved; rerun the command."
-        : "The script did not run; rerun this command.";
-    return new Error(`Bash was not found to run bundled script ${asset}. Install Git for Windows or ` +
-        `set CLAUDE_CODE_GIT_BASH_PATH. ${recovery}`, { cause });
-}
 /**
  * Execute a bundled scaffold script and return its exit code.
  *
@@ -144,30 +56,14 @@ export function runBundledScript(opts) {
         env.CLAUDE_PROJECT_DIR = opts.hqRoot;
     }
     Object.assign(env, opts.env ?? {});
-    const interpreter = interpreterFor(opts.asset);
-    const windowsBash = process.platform === "win32" && interpreter === "bash"
-        ? resolveWindowsBash(env)
-        : undefined;
-    const executable = windowsBash?.executable ?? interpreter;
-    if (windowsBash && !windowsBash.executable) {
-        throw bashNotFoundError(opts.asset, windowsBash.cause);
-    }
-    const result = spawnSync(executable, [script, ...(opts.args ?? [])], {
+    const result = spawnSync(interpreterFor(opts.asset), [script, ...(opts.args ?? [])], {
         cwd: opts.cwd,
         env,
-        stdio: opts.captureOutput ? ["inherit", "pipe", "pipe"] : "inherit",
-        ...(opts.captureOutput ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {}),
+        stdio: "inherit",
     });
     if (result.error) {
-        const spawnError = result.error;
-        if (process.platform === "win32" &&
-            interpreter === "bash" &&
-            spawnError.code === "ENOENT") {
-            throw bashNotFoundError(opts.asset, spawnError);
-        }
         throw new Error(`Failed to run bundled script ${opts.asset}: ${result.error.message}`);
     }
-    let code;
     if (result.signal) {
         // Conventional shell encoding, so a caller checking for termination sees it.
         const signals = {
@@ -177,17 +73,8 @@ export function runBundledScript(opts) {
             SIGKILL: 9,
             SIGTERM: 15,
         };
-        code = 128 + (signals[result.signal] ?? 0);
-    }
-    else {
-        code = result.status ?? 0;
+        return { code: 128 + (signals[result.signal] ?? 0) };
     }
-    return {
-        code,
-        ...(opts.captureOutput ? {
-            stdout: result.stdout ?? Buffer.alloc(0),
-            stderr: result.stderr ?? Buffer.alloc(0),
-        } : {}),
-    };
+    return { code: result.status ?? 0 };
 }
 //# sourceMappingURL=run-bundled-script.js.map

package/dist/utils/secrets-cache.d.ts

@@ -1,16 +1,12 @@
 export declare const DEFAULT_SECRETS_CACHE_TTL_MS: number;
-export declare function readCache(companyUid: string, name: string, principalUid: string, expectedVersion?: number, maxAgeMs?: number): string | null;
+export declare function readCache(companyUid: string, name: string, expectedVersion?: number, maxAgeMs?: number): string | null;
 /**
  * Returns whether an unexpired entry exists without decrypting its plaintext.
  * Callers use this only to decide whether to reauthorize a possible cache hit;
  * they must complete that authorization before calling {@link readCache}.
  */
-export declare function hasCacheEntry(companyUid: string, name: string, principalUid: string): boolean;
-export declare function writeCache(companyUid: string, name: string, principalUid: string, value: string, ttlMs?: number, version?: number): void;
-/** Persist the last successfully resolved scope for a principal, encrypted and authenticated. */
-export declare function writeCachedScopeUid(scopeKey: string, principalUid: string, scopeUid: string): void;
-/** Return a still-valid scope UID only for the principal that wrote it. */
-export declare function readCachedScopeUid(scopeKey: string, principalUid: string): string | null;
+export declare function hasCacheEntry(companyUid: string, name: string): boolean;
+export declare function writeCache(companyUid: string, name: string, value: string, ttlMs?: number, version?: number): void;
 /**
  * List the scope UIDs (`cmp_*` / `prs_*` subdirectories) that currently have a
  * secrets-cache directory on disk. Install-time MCP registration may use an

package/dist/utils/secrets-cache.js

@@ -6,11 +6,9 @@ const CACHE_DIR = path.join(os.homedir(), ".hq", "secrets-cache");
 const KEY_PATH = path.join(CACHE_DIR, ".key");
 const CACHE_FORMAT_MAGIC = Buffer.from("HQSC");
 const CACHE_FORMAT_MAGIC_BYTES = CACHE_FORMAT_MAGIC.length;
-const CACHE_VERSION_MARKER = Buffer.from("HQSCV3\0");
-const PREVIOUS_CACHE_VERSION_MARKER = Buffer.from("HQSCV2\0");
+const CACHE_VERSION_MARKER = Buffer.from("HQSCV2\0");
 const LEGACY_CACHE_VERSION_MARKER = Buffer.from("HQSCV1\0");
 const CACHE_VERSION_MARKER_BYTES = CACHE_VERSION_MARKER.length;
-const PRINCIPAL_DIGEST_BYTES = 32;
 const LEGACY_TIMESTAMP_BYTES = 8;
 const TIMESTAMP_BYTES = 8;
 const TTL_BYTES = 8;
@@ -18,9 +16,7 @@ const CACHE_VERSION_BYTES = 8;
 const ALGORITHM = "aes-256-gcm";
 const IV_BYTES = 12;
 const AUTH_TAG_BYTES = 16;
-const SCOPE_CACHE_MAGIC = Buffer.from("HQSSV1\0");
-const SCOPE_KEY_DIR = "scopes";
-export const DEFAULT_SECRETS_CACHE_TTL_MS = 3 * 60 * 60 * 1000;
+export const DEFAULT_SECRETS_CACHE_TTL_MS = 5 * 60 * 1000;
 function ensureCacheDir(companyUid) {
     const dir = path.join(CACHE_DIR, companyUid);
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -62,10 +58,7 @@ function readCacheVersion(raw, offset) {
         return undefined;
     return isCacheVersion(value) ? value : null;
 }
-function principalDigest(principalUid) {
-    return crypto.createHash("sha256").update(principalUid, "utf8").digest();
-}
-function cacheAad(header, companyUid, name, principalUid) {
+function cacheAad(header, companyUid, name) {
     const company = Buffer.from(companyUid, "utf8");
     const secretName = Buffer.from(name, "utf8");
     const companyLength = Buffer.alloc(4);
@@ -79,7 +72,6 @@ function cacheAad(header, companyUid, name, principalUid) {
         company,
         nameLength,
         secretName,
-        principalDigest(principalUid),
     ]);
 }
 function parseCacheHeader(raw) {
@@ -90,9 +82,8 @@ function parseCacheHeader(raw) {
         let ivStart = baseHeaderBytes;
         let version;
         let identityAuthenticated = false;
-        let encodedPrincipalDigest;
         if (raw.length >=
-            baseHeaderBytes + CACHE_VERSION_MARKER_BYTES + CACHE_VERSION_BYTES + PRINCIPAL_DIGEST_BYTES + IV_BYTES + AUTH_TAG_BYTES &&
+            baseHeaderBytes + CACHE_VERSION_MARKER_BYTES + CACHE_VERSION_BYTES + IV_BYTES + AUTH_TAG_BYTES &&
             raw
                 .subarray(baseHeaderBytes, baseHeaderBytes + CACHE_VERSION_MARKER_BYTES)
                 .equals(CACHE_VERSION_MARKER)) {
@@ -100,22 +91,9 @@ function parseCacheHeader(raw) {
             if (parsedVersion === null)
                 return null;
             version = parsedVersion;
-            const principalStart = baseHeaderBytes + CACHE_VERSION_MARKER_BYTES + CACHE_VERSION_BYTES;
-            encodedPrincipalDigest = raw.subarray(principalStart, principalStart + PRINCIPAL_DIGEST_BYTES);
-            ivStart += CACHE_VERSION_MARKER_BYTES + CACHE_VERSION_BYTES + PRINCIPAL_DIGEST_BYTES;
+            ivStart += CACHE_VERSION_MARKER_BYTES + CACHE_VERSION_BYTES;
             identityAuthenticated = true;
         }
-        else if (raw.length >=
-            baseHeaderBytes + PREVIOUS_CACHE_VERSION_MARKER.length + CACHE_VERSION_BYTES + IV_BYTES + AUTH_TAG_BYTES &&
-            raw
-                .subarray(baseHeaderBytes, baseHeaderBytes + PREVIOUS_CACHE_VERSION_MARKER.length)
-                .equals(PREVIOUS_CACHE_VERSION_MARKER)) {
-            const parsedVersion = readCacheVersion(raw, baseHeaderBytes + PREVIOUS_CACHE_VERSION_MARKER.length);
-            if (parsedVersion === null)
-                return null;
-            version = parsedVersion;
-            ivStart += PREVIOUS_CACHE_VERSION_MARKER.length + CACHE_VERSION_BYTES;
-        }
         else if (raw.length >=
             baseHeaderBytes + LEGACY_CACHE_VERSION_MARKER.length + CACHE_VERSION_BYTES + IV_BYTES + AUTH_TAG_BYTES &&
             raw
@@ -136,7 +114,6 @@ function parseCacheHeader(raw) {
             ttlMs: Number(raw.readBigInt64BE(CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES)),
             version,
             identityAuthenticated,
-            principalDigest: encodedPrincipalDigest,
             ivStart,
             authTagStart,
             ciphertextStart,
@@ -159,8 +136,8 @@ function isExpired(header, maxAgeMs) {
     const ageMs = Date.now() - header.timestampMs;
     return !Number.isFinite(ttlMs) || ttlMs <= 0 || ageMs < 0 || ageMs > ttlMs;
 }
-export function readCache(companyUid, name, principalUid, expectedVersion, maxAgeMs) {
-    if (!validateInputs(companyUid, name) || !principalUid)
+export function readCache(companyUid, name, expectedVersion, maxAgeMs) {
+    if (!validateInputs(companyUid, name))
         return null;
     const filePath = path.join(CACHE_DIR, companyUid, name);
     let raw;
@@ -182,8 +159,6 @@ export function readCache(companyUid, name, principalUid, expectedVersion, maxAg
         catch { /* ok */ }
         return null;
     }
-    if (!header.principalDigest?.equals(principalDigest(principalUid)))
-        return null;
     const iv = raw.subarray(header.ivStart, header.authTagStart);
     const authTag = raw.subarray(header.authTagStart, header.ciphertextStart);
     const ciphertext = raw.subarray(header.ciphertextStart);
@@ -196,7 +171,7 @@ export function readCache(companyUid, name, principalUid, expectedVersion, maxAg
     }
     try {
         const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
-        decipher.setAAD(cacheAad(raw.subarray(0, header.ivStart), companyUid, name, principalUid));
+        decipher.setAAD(cacheAad(raw.subarray(0, header.ivStart), companyUid, name));
         decipher.setAuthTag(authTag);
         const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
         return decrypted.toString("utf8");
@@ -214,8 +189,8 @@ export function readCache(companyUid, name, principalUid, expectedVersion, maxAg
  * Callers use this only to decide whether to reauthorize a possible cache hit;
  * they must complete that authorization before calling {@link readCache}.
  */
-export function hasCacheEntry(companyUid, name, principalUid) {
-    if (!validateInputs(companyUid, name) || !principalUid)
+export function hasCacheEntry(companyUid, name) {
+    if (!validateInputs(companyUid, name))
         return false;
     const filePath = path.join(CACHE_DIR, companyUid, name);
     let raw;
@@ -228,21 +203,18 @@ export function hasCacheEntry(companyUid, name, principalUid) {
     const header = parseCacheHeader(raw);
     if (!header)
         return false;
-    if (!header.identityAuthenticated ||
-        isExpired(header)) {
+    if (!header.identityAuthenticated || isExpired(header)) {
         try {
             fs.unlinkSync(filePath);
         }
         catch { /* ok */ }
         return false;
     }
-    if (!header.principalDigest?.equals(principalDigest(principalUid)))
-        return false;
     return true;
 }
-export function writeCache(companyUid, name, principalUid, value, ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS, version) {
+export function writeCache(companyUid, name, value, ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS, version) {
     try {
-        if (!validateInputs(companyUid, name) || !principalUid)
+        if (!validateInputs(companyUid, name))
             return;
         if (ttlMs <= 0)
             return;
@@ -261,10 +233,9 @@ export function writeCache(companyUid, name, principalUid, value, ttlMs = DEFAUL
             ttl,
             CACHE_VERSION_MARKER,
             versionBuffer,
-            principalDigest(principalUid),
         ]);
         const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-        cipher.setAAD(cacheAad(header, companyUid, name, principalUid));
+        cipher.setAAD(cacheAad(header, companyUid, name));
         const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
         const authTag = cipher.getAuthTag();
         const out = Buffer.concat([
@@ -283,125 +254,6 @@ export function writeCache(companyUid, name, principalUid, value, ttlMs = DEFAUL
         // Cache write failure is non-fatal
     }
 }
-function scopeCachePath(scopeKey) {
-    const name = crypto.createHash("sha256").update(scopeKey, "utf8").digest("hex");
-    return path.join(CACHE_DIR, SCOPE_KEY_DIR, name);
-}
-function scopeCacheAad(header, scopeKey, principalUid) {
-    const key = Buffer.from(scopeKey, "utf8");
-    const keyLength = Buffer.alloc(4);
-    keyLength.writeUInt32BE(key.length);
-    return Buffer.concat([
-        Buffer.from("HQSC-SCOPE-AAD-V1\0"),
-        header,
-        keyLength,
-        key,
-        principalDigest(principalUid),
-    ]);
-}
-function logScopeCacheFailure(operation, err) {
-    const code = err && typeof err === "object" && "code" in err &&
-        typeof err.code === "string" &&
-        /^[A-Z0-9_]+$/.test(err.code)
-        ? err.code
-        : undefined;
-    console.warn(`Unable to ${operation} cached HQ scope UID`, code ? { code } : {});
-}
-function removeScopeCacheFile(filePath) {
-    try {
-        fs.unlinkSync(filePath);
-    }
-    catch (err) {
-        if (!(err &&
-            typeof err === "object" &&
-            "code" in err &&
-            err.code === "ENOENT")) {
-            logScopeCacheFailure("remove", err);
-        }
-    }
-}
-/** Persist the last successfully resolved scope for a principal, encrypted and authenticated. */
-export function writeCachedScopeUid(scopeKey, principalUid, scopeUid) {
-    try {
-        if (!scopeKey || !principalUid || !/^(?:cmp|prs)_[A-Za-z0-9_-]+$/.test(scopeUid))
-            return;
-        fs.mkdirSync(path.join(CACHE_DIR, SCOPE_KEY_DIR), { recursive: true, mode: 0o700 });
-        const key = getOrCreateKey();
-        const timestamp = Buffer.alloc(8);
-        timestamp.writeBigInt64BE(BigInt(Date.now()));
-        const ttl = Buffer.alloc(8);
-        ttl.writeBigInt64BE(BigInt(DEFAULT_SECRETS_CACHE_TTL_MS));
-        const header = Buffer.concat([SCOPE_CACHE_MAGIC, timestamp, ttl, principalDigest(principalUid)]);
-        const iv = crypto.randomBytes(IV_BYTES);
-        const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-        cipher.setAAD(scopeCacheAad(header, scopeKey, principalUid));
-        const encrypted = Buffer.concat([cipher.update(scopeUid, "utf8"), cipher.final()]);
-        const authTag = cipher.getAuthTag();
-        const output = Buffer.concat([header, iv, authTag, encrypted]);
-        const filePath = scopeCachePath(scopeKey);
-        const tmpPath = `${filePath}.tmp.${process.pid}`;
-        fs.writeFileSync(tmpPath, output, { mode: 0o600 });
-        fs.renameSync(tmpPath, filePath);
-    }
-    catch (err) {
-        // A scope-cache write failure must not change a successful online lookup.
-        logScopeCacheFailure("write", err);
-    }
-}
-/** Return a still-valid scope UID only for the principal that wrote it. */
-export function readCachedScopeUid(scopeKey, principalUid) {
-    if (!scopeKey || !principalUid)
-        return null;
-    const headerBytes = SCOPE_CACHE_MAGIC.length + TIMESTAMP_BYTES + TTL_BYTES + PRINCIPAL_DIGEST_BYTES;
-    const filePath = scopeCachePath(scopeKey);
-    let raw;
-    try {
-        raw = fs.readFileSync(filePath);
-    }
-    catch (err) {
-        if (err &&
-            typeof err === "object" &&
-            "code" in err &&
-            err.code === "ENOENT") {
-            return null;
-        }
-        logScopeCacheFailure("read", err);
-        return null;
-    }
-    if (raw.length < headerBytes + IV_BYTES + AUTH_TAG_BYTES || !raw.subarray(0, SCOPE_CACHE_MAGIC.length).equals(SCOPE_CACHE_MAGIC)) {
-        console.warn("Ignoring malformed cached HQ scope UID entry");
-        removeScopeCacheFile(filePath);
-        return null;
-    }
-    const encodedPrincipal = raw.subarray(SCOPE_CACHE_MAGIC.length + TIMESTAMP_BYTES + TTL_BYTES, headerBytes);
-    const timestampMs = Number(raw.readBigInt64BE(SCOPE_CACHE_MAGIC.length));
-    const ttlMs = Number(raw.readBigInt64BE(SCOPE_CACHE_MAGIC.length + TIMESTAMP_BYTES));
-    const ageMs = Date.now() - timestampMs;
-    if (!encodedPrincipal.equals(principalDigest(principalUid)))
-        return null;
-    if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ageMs < 0 || ageMs > ttlMs) {
-        removeScopeCacheFile(filePath);
-        return null;
-    }
-    const ivStart = headerBytes;
-    const authTagStart = ivStart + IV_BYTES;
-    const ciphertextStart = authTagStart + AUTH_TAG_BYTES;
-    try {
-        const decipher = crypto.createDecipheriv(ALGORITHM, getOrCreateKey(), raw.subarray(ivStart, authTagStart));
-        decipher.setAAD(scopeCacheAad(raw.subarray(0, headerBytes), scopeKey, principalUid));
-        decipher.setAuthTag(raw.subarray(authTagStart, ciphertextStart));
-        const scopeUid = Buffer.concat([
-            decipher.update(raw.subarray(ciphertextStart)),
-            decipher.final(),
-        ]).toString("utf8");
-        return /^(?:cmp|prs)_[A-Za-z0-9_-]+$/.test(scopeUid) ? scopeUid : null;
-    }
-    catch (err) {
-        logScopeCacheFailure("decrypt", err);
-        removeScopeCacheFile(filePath);
-        return null;
-    }
-}
 /**
  * List the scope UIDs (`cmp_*` / `prs_*` subdirectories) that currently have a
  * secrets-cache directory on disk. Install-time MCP registration may use an

package/dist/utils/self-update.d.ts

@@ -56,15 +56,13 @@
  * Opt-outs: `HQ_NO_UPDATE_CHECK=1` (the shared knob that also silences
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
-import * as fs from "node:fs";
 import { type RunningInstall, type UpdateResult } from "./version-gate.js";
-import { type RestartDaemonResult } from "../lib/mesh/live/daemon/install.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
  */
 export declare const REEXEC_GUARD_ENV = "HQ_RESCUE_SELF_UPDATED";
-type SelfUpdateAction = 
+export type SelfUpdateAction = 
 /** Opted out, guard set, lock held elsewhere, or latest unknown — nothing attempted. */
 "skipped"
 /** Already at (or ahead of) npm latest. */
@@ -84,8 +82,6 @@ type SelfUpdateAction =
  | "update-ineffective"
 /** Updated and the command re-ran on the new version; exit with `reexecStatus`. */
  | "reexec"
-/** Updated with no re-exec (the `hq daemon` updater restarts the daemon instead). */
- | "updated"
 /**
  * Unattended caller: replacing the CLI in place is unsafe here, so nothing
  * was attempted and the command runs on the current version. An attended
@@ -137,12 +133,6 @@ export interface SelfUpdateDeps {
     currentVersion?: string;
     fetchLatest?: () => Promise<string | null>;
     resolveInstall?: () => RunningInstall;
-    /** Permission preflight for an npm global prefix (tests inject a read-only result). */
-    canWriteNpmInstall?: (install: RunningInstall) => boolean;
-    /** Home directory used for the durable per-install permission notice marker. */
-    homeDir?: string;
-    /** Same-filesystem install rename, injectable for rollback tests. */
-    renamePath?: typeof fs.renameSync;
     runner?: (cmd: string, args: string[], env?: NodeJS.ProcessEnv) => UpdateResult;
     reexec?: (argv: string[], env: NodeJS.ProcessEnv) => number | null;
     acquireLock?: () => (() => void) | null;
@@ -163,21 +153,6 @@ export interface SelfUpdateDeps {
      * underneath themselves: hooks, scripts, agents, cron, CI.
      */
     interactive?: boolean;
-    /** Best-effort daemon kick after the CLI install converges (tests). */
-    restartDaemon?: () => RestartDaemonResult | void;
-    /**
-     * Whether `cli.staged-self-update` is on: build the new version beside the
-     * running package and swap it in, instead of moving the running package
-     * aside for the whole install. Read only when an npm global install is due.
-     */
-    stagedSelfUpdate?: () => Promise<boolean>;
-    /**
-     * Runs installs through a copy of the installer's supervisor outside the
-     * package until disposed. Defaults to {@link detachUpdateSupervisor}.
-     */
-    detachSupervisor?: () => {
-        dispose(): void;
-    } | null;
 }
 /**
  * Startup path: the running CLI is behind npm `latest`, so update in place and
@@ -193,12 +168,4 @@ export declare function autoUpdateAndReexec(argv: readonly string[], latest: str
  * are preserved.
  */
 export declare function selfUpdateAndReexec(argv: readonly string[], deps?: SelfUpdateDeps): Promise<SelfUpdateOutcome>;
-/**
- * `hq daemon` updater service: update to npm latest with nobody at a terminal
- * and no re-exec. It runs as its own short-lived child of the daemon, so no
- * user command is waiting on the package being replaced; after an "updated"
- * outcome the daemon restarts itself onto the new version.
- */
-export declare function daemonSelfUpdate(deps?: SelfUpdateDeps): Promise<SelfUpdateOutcome>;
-export {};
 //# sourceMappingURL=self-update.d.ts.map