@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/daemon/sync-runner.d.ts

@@ -0,0 +1,58 @@
+/** Local status and resource controls shared by the daemon and its sync runner. */
+export declare const SYNC_RUNNER_OWNER = "hq-daemon";
+export declare const SYNC_RUNNER_LEASE_CONFLICT_EXIT = 20;
+export declare const SYNC_RUNNER_LEASE_RETRY_MS = 15000;
+export declare const DEFAULT_SYNC_HEARTBEAT_TIMEOUT_MS = 300000;
+export declare const DEFAULT_SYNC_RUNNER_HEAP_MB = 3584;
+export declare const SYNC_HEARTBEAT_TIMEOUT_ENV = "HQ_DAEMON_SYNC_HEARTBEAT_TIMEOUT_SECONDS";
+export declare const SYNC_RUNNER_HEAP_ENV = "HQ_SYNC_RUNNER_MAX_OLD_SPACE_MB";
+export interface WatchRunnerOwnerStatus {
+    owner: string;
+    pid: number;
+    version: string;
+    startedAt: string;
+    heartbeatAt: string;
+}
+export interface SyncRunnerProcess {
+    pid: number;
+    commandLine: string;
+}
+export type SyncRunnerProcessList = {
+    ok: true;
+    processes: SyncRunnerProcess[];
+} | {
+    ok: false;
+    error: string;
+};
+export interface ProcessListCommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    error?: Error;
+}
+export type ProcessListRunner = (command: string, args: string[]) => ProcessListCommandResult;
+export interface SyncPassResult {
+    status: "ok" | "partial" | "failed";
+    completedAt: string;
+    companiesAttempted?: number;
+    errors: number;
+    transient: number;
+}
+/** The status file path used by hq-cloud's watch-owner lease. */
+export declare function watchRunnerOwnerStatusPath(hqRoot: string, home?: string, env?: NodeJS.ProcessEnv): string;
+/** Read the watch-owner status JSON without taking or changing its lease. */
+export declare function readWatchRunnerOwnerStatus(statusPath: string): WatchRunnerOwnerStatus | null;
+/** Match a live process command line to the hq-cloud watch runner executable. */
+export declare function isSyncRunnerCommandLine(commandLine: string): boolean;
+/** Return a clear wait reason when an unleased runner already targets this HQ root. */
+export declare function syncRunnerUnleasedBlockReason(hqRoot: string, processes: readonly SyncRunnerProcess[], ownerPid: number | null, platform?: NodeJS.Platform, daemonRunnerPids?: ReadonlySet<number>): string | undefined;
+/** Read complete process command lines so root matching can include trailing arguments. */
+export declare function listSyncRunnerProcesses(platform?: NodeJS.Platform, run?: ProcessListRunner): SyncRunnerProcessList;
+/** The watchdog follows the runner's NDJSON protocol, the same liveness signal used by the desktop app. */
+export declare function parseSyncRunnerProtocolLine(line: string): Record<string, unknown> | null;
+/** Summarize the runner's all-complete event for daemon status. */
+export declare function syncPassResult(event: Record<string, unknown>, completedAt?: string): SyncPassResult | null;
+export declare function syncHeartbeatTimeoutMs(env: NodeJS.ProcessEnv): number;
+/** Preserve an explicit NODE_OPTIONS heap setting; otherwise apply the desktop runner's default/override. */
+export declare function syncRunnerNodeOptions(env: NodeJS.ProcessEnv): string | undefined;
+//# sourceMappingURL=sync-runner.d.ts.map

package/dist/lib/daemon/sync-runner.js

@@ -0,0 +1,277 @@
+/** Local status and resource controls shared by the daemon and its sync runner. */
+import * as crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export const SYNC_RUNNER_OWNER = "hq-daemon";
+export const SYNC_RUNNER_LEASE_CONFLICT_EXIT = 20;
+export const SYNC_RUNNER_LEASE_RETRY_MS = 15_000;
+export const DEFAULT_SYNC_HEARTBEAT_TIMEOUT_MS = 300_000;
+export const DEFAULT_SYNC_RUNNER_HEAP_MB = 3_584;
+export const SYNC_HEARTBEAT_TIMEOUT_ENV = "HQ_DAEMON_SYNC_HEARTBEAT_TIMEOUT_SECONDS";
+export const SYNC_RUNNER_HEAP_ENV = "HQ_SYNC_RUNNER_MAX_OLD_SPACE_MB";
+const SYNC_RUNNER_COMMAND = /(?:^|[\s/\\])(?:sync-runner\.js|hq-sync-runner(?:\.(?:cmd|exe))?)(?:[\s"']|$)/i;
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+/** The status file path used by hq-cloud's watch-owner lease. */
+export function watchRunnerOwnerStatusPath(hqRoot, home = os.homedir(), env = process.env) {
+    let canonicalRoot = path.resolve(hqRoot);
+    try {
+        canonicalRoot = fs.realpathSync.native(canonicalRoot);
+    }
+    catch (error) {
+        // hq-cloud uses the resolved path until the HQ root can be canonicalized.
+        if (error?.code !== "ENOENT") {
+            throw new Error(`could not canonicalize HQ root ${canonicalRoot}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+    }
+    const rootHash = crypto.createHash("sha1").update(canonicalRoot).digest("hex").slice(0, 16);
+    const stateDir = env.HQ_STATE_DIR?.trim() || path.join(home, ".hq");
+    return path.join(stateDir, "locks", `watch-owner-${rootHash}.json`);
+}
+/** Read the watch-owner status JSON without taking or changing its lease. */
+export function readWatchRunnerOwnerStatus(statusPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(statusPath, "utf8"));
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return null;
+        throw new Error(`could not read watch-runner owner status at ${statusPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    const value = record(parsed);
+    if (!value ||
+        typeof value.owner !== "string" ||
+        !Number.isInteger(value.pid) ||
+        typeof value.version !== "string" ||
+        typeof value.startedAt !== "string" ||
+        typeof value.heartbeatAt !== "string") {
+        throw new Error(`watch-runner owner status at ${statusPath} has an invalid shape`);
+    }
+    return value;
+}
+/** Match a live process command line to the hq-cloud watch runner executable. */
+export function isSyncRunnerCommandLine(commandLine) {
+    return SYNC_RUNNER_COMMAND.test(commandLine);
+}
+function commandLineArgs(commandLine) {
+    const args = [];
+    let current = "";
+    let quote = null;
+    let started = false;
+    for (let i = 0; i < commandLine.length; i++) {
+        const char = commandLine[i];
+        if (quote) {
+            if (char === quote) {
+                quote = null;
+                started = true;
+            }
+            else if (char === "\\" && commandLine[i + 1] === quote) {
+                current += commandLine[++i];
+                started = true;
+            }
+            else {
+                current += char;
+                started = true;
+            }
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            started = true;
+        }
+        else if (/\s/.test(char)) {
+            if (started) {
+                args.push(current);
+                current = "";
+                started = false;
+            }
+        }
+        else {
+            current += char;
+            started = true;
+        }
+    }
+    if (started)
+        args.push(current);
+    return args;
+}
+function syncRunnerHqRoot(commandLine) {
+    const args = commandLineArgs(commandLine);
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--hq-root")
+            return args[i + 1] || null;
+        if (arg.startsWith("--hq-root="))
+            return arg.slice("--hq-root=".length) || null;
+    }
+    return null;
+}
+function commandLineNamesRoot(commandLine, hqRoot, platform) {
+    const parsedRoot = syncRunnerHqRoot(commandLine);
+    if (parsedRoot !== null && canonicalRoot(parsedRoot, platform) === canonicalRoot(hqRoot, platform))
+        return true;
+    const pathApi = platform === "win32" ? path.win32 : path;
+    const variants = new Set([pathApi.resolve(hqRoot)]);
+    if (platform === process.platform) {
+        try {
+            variants.add(fs.realpathSync.native(pathApi.resolve(hqRoot)));
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT") {
+                throw new Error(`could not canonicalize sync runner HQ root ${hqRoot}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+            }
+        }
+    }
+    const compareFlags = platform === "win32" ? "i" : "";
+    return [...variants].some((root) => {
+        const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        return new RegExp(`(?:^|\\s)--hq-root(?:=|\\s+)["']?${escaped}["']?(?=\\s|$)`, compareFlags).test(commandLine);
+    });
+}
+function canonicalRoot(root, platform) {
+    const pathApi = platform === "win32" ? path.win32 : path;
+    let resolved = pathApi.resolve(root);
+    if (platform === process.platform) {
+        try {
+            resolved = fs.realpathSync.native(resolved);
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT") {
+                throw new Error(`could not canonicalize sync runner HQ root ${resolved}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+            }
+        }
+    }
+    return platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+/** Return a clear wait reason when an unleased runner already targets this HQ root. */
+export function syncRunnerUnleasedBlockReason(hqRoot, processes, ownerPid, platform = process.platform, daemonRunnerPids = new Set()) {
+    const runner = processes.find((candidate) => {
+        if (daemonRunnerPids.has(candidate.pid) || candidate.pid === ownerPid)
+            return false;
+        if (!isSyncRunnerCommandLine(candidate.commandLine))
+            return false;
+        return commandLineNamesRoot(candidate.commandLine, hqRoot, platform);
+    });
+    if (!runner)
+        return undefined;
+    const lease = ownerPid === null ? "missing" : `belongs to pid ${ownerPid}`;
+    return `sync runner pid ${runner.pid} for ${hqRoot} is running without the watch-owner lease (status ${lease}); waiting for it to exit`;
+}
+/** Read complete process command lines so root matching can include trailing arguments. */
+export function listSyncRunnerProcesses(platform = process.platform, run = (command, args) => {
+    const result = spawnSync(command, args, {
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 15_000,
+        maxBuffer: 8 * 1024 * 1024,
+    });
+    return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        ...(result.error ? { error: result.error } : {}),
+    };
+}) {
+    const command = platform === "win32" ? "powershell.exe" : "ps";
+    const args = platform === "win32"
+        ? [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            "Get-CimInstance Win32_Process | Select-Object @{Name='pid';Expression={$_.ProcessId}},@{Name='commandLine';Expression={$_.CommandLine}} | ConvertTo-Json -Compress",
+        ]
+        : ["-eww", "-o", "pid=", "-o", "args="];
+    const result = run(command, args);
+    if (result.error)
+        return { ok: false, error: `could not list process command lines: ${result.error.message}` };
+    if (result.status !== 0) {
+        return { ok: false, error: `could not list process command lines: ${(result.stderr ?? "").trim() || `exit ${result.status}`}` };
+    }
+    if (platform === "win32") {
+        let parsed;
+        try {
+            parsed = JSON.parse(result.stdout || "[]");
+        }
+        catch (error) {
+            return { ok: false, error: `could not parse Windows process list: ${error instanceof Error ? error.message : String(error)}` };
+        }
+        const rows = Array.isArray(parsed) ? parsed : [parsed];
+        return {
+            ok: true,
+            processes: rows.flatMap((row) => {
+                if (!row || typeof row !== "object")
+                    return [];
+                const value = row;
+                return Number.isInteger(value.pid) && typeof value.commandLine === "string"
+                    ? [{ pid: value.pid, commandLine: value.commandLine }]
+                    : [];
+            }),
+        };
+    }
+    const processes = [];
+    for (const line of (result.stdout ?? "").split(/\r?\n/)) {
+        const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+        if (match)
+            processes.push({ pid: Number(match[1]), commandLine: match[2] });
+    }
+    return { ok: true, processes };
+}
+/** The watchdog follows the runner's NDJSON protocol, the same liveness signal used by the desktop app. */
+export function parseSyncRunnerProtocolLine(line) {
+    if (!line.trim())
+        return null;
+    const parsed = record(JSON.parse(line));
+    return parsed && typeof parsed.type === "string" && parsed.type.length > 0 ? parsed : null;
+}
+/** Summarize the runner's all-complete event for daemon status. */
+export function syncPassResult(event, completedAt = new Date().toISOString()) {
+    if (event.type !== "all-complete")
+        return null;
+    const errors = Array.isArray(event.errors) ? event.errors.length : 0;
+    const transient = Array.isArray(event.transient) ? event.transient.length : 0;
+    const status = event.partial === true || transient > 0 ? "partial" : errors > 0 ? "failed" : "ok";
+    return {
+        status,
+        completedAt,
+        ...(typeof event.companiesAttempted === "number" ? { companiesAttempted: event.companiesAttempted } : {}),
+        errors,
+        transient,
+    };
+}
+export function syncHeartbeatTimeoutMs(env) {
+    const raw = env[SYNC_HEARTBEAT_TIMEOUT_ENV]?.trim();
+    if (!raw || !/^\d+$/.test(raw))
+        return DEFAULT_SYNC_HEARTBEAT_TIMEOUT_MS;
+    const seconds = Number(raw);
+    const maxSeconds = Math.floor(2_147_483_647 / 1_000);
+    if (!Number.isSafeInteger(seconds) || seconds < 1 || seconds > maxSeconds)
+        return DEFAULT_SYNC_HEARTBEAT_TIMEOUT_MS;
+    return seconds * 1_000;
+}
+function hasHeapOption(options) {
+    const tokens = options.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i].replaceAll("--max_old_space_size", "--max-old-space-size");
+        if (token === "--max-old-space-size" || token.startsWith("--max-old-space-size="))
+            return true;
+    }
+    return false;
+}
+/** Preserve an explicit NODE_OPTIONS heap setting; otherwise apply the desktop runner's default/override. */
+export function syncRunnerNodeOptions(env) {
+    const inherited = env.NODE_OPTIONS?.trim() ?? "";
+    if (hasHeapOption(inherited))
+        return inherited || undefined;
+    const rawOverride = env[SYNC_RUNNER_HEAP_ENV]?.trim();
+    const override = rawOverride && /^\d+$/.test(rawOverride) ? Number(rawOverride) : undefined;
+    const heapMb = override && Number.isSafeInteger(override) && override > 0 ? override : DEFAULT_SYNC_RUNNER_HEAP_MB;
+    const heapFlag = `--max-old-space-size=${heapMb}`;
+    return inherited ? `${inherited} ${heapFlag}` : heapFlag;
+}
+//# sourceMappingURL=sync-runner.js.map

package/dist/lib/daemon/tools.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The AI CLIs the daemon keeps current (Claude, Codex, Grok): where the login
+ * user's copy is, which version it is, and how to update it.
+ *
+ * Boxes can carry two copies of a tool: one root installed under /usr during
+ * provisioning, and the login user's own under ~/.npm-global or ~/.local. The
+ * daemon runs as the login user, so it always prefers that user's copy (which
+ * it can update) and never updates a copy it cannot write.
+ */
+export declare const TOOL_NAMES: readonly ["claude", "codex", "grok"];
+export type ToolName = (typeof TOOL_NAMES)[number];
+export interface ToolProbeDeps {
+    home: string;
+    /** Defaults to this process's platform. */
+    platform?: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+    exists: (p: string) => boolean;
+    realpath: (p: string) => string;
+    /** Whether this user can write the directory. */
+    writable: (dir: string) => boolean;
+    /** `<bin> --version`. */
+    version: (bin: string) => {
+        status: number | null;
+        stdout: string;
+    };
+}
+export interface ToolInstall {
+    /** The command as found (for example ~/.npm-global/bin/claude). */
+    path: string;
+    /** Where that resolves to on disk. */
+    realPath: string;
+    version: string | null;
+    /** False for a copy this user cannot update (for example root's under /usr). */
+    writable: boolean;
+}
+/** The login user's own install folders, searched before PATH. */
+export declare function userToolDirs(home: string): string[];
+export declare function findUserTool(name: ToolName, deps: ToolProbeDeps): string | null;
+export declare function parseToolVersion(output: string): string | null;
+export declare function locateTool(name: ToolName, deps: ToolProbeDeps): ToolInstall | null;
+export interface ToolUpdateCommand {
+    file: string;
+    args: string[];
+    env: Record<string, string>;
+}
+/**
+ * An npm install is updated through npm, into the prefix it was found in (the
+ * npm on PATH may be configured for another one); anything else through the
+ * CLI's own `update`.
+ */
+export declare function toolUpdateCommand(name: ToolName, install: Pick<ToolInstall, "path" | "realPath">, platform?: NodeJS.Platform): ToolUpdateCommand;
+//# sourceMappingURL=tools.d.ts.map

package/dist/lib/daemon/tools.js

@@ -0,0 +1,95 @@
+/**
+ * The AI CLIs the daemon keeps current (Claude, Codex, Grok): where the login
+ * user's copy is, which version it is, and how to update it.
+ *
+ * Boxes can carry two copies of a tool: one root installed under /usr during
+ * provisioning, and the login user's own under ~/.npm-global or ~/.local. The
+ * daemon runs as the login user, so it always prefers that user's copy (which
+ * it can update) and never updates a copy it cannot write.
+ */
+import * as path from "node:path";
+export const TOOL_NAMES = ["claude", "codex", "grok"];
+/** npm package for tools that can be installed with npm. */
+const NPM_PACKAGES = {
+    claude: "@anthropic-ai/claude-code",
+    codex: "@openai/codex",
+    grok: "@vibe-kit/grok-cli",
+};
+/** Environment each tool's own `update` command needs to run unattended. */
+const UPDATE_ENV = {
+    codex: { CODEX_NON_INTERACTIVE: "1" },
+};
+/** The login user's own install folders, searched before PATH. */
+export function userToolDirs(home) {
+    return [
+        path.posix.join(home, ".local", "bin"),
+        path.posix.join(home, ".npm-global", "bin"),
+        path.posix.join(home, ".grok", "bin"),
+    ];
+}
+export function findUserTool(name, deps) {
+    const windows = (deps.platform ?? process.platform) === "win32";
+    if (!windows) {
+        for (const dir of userToolDirs(deps.home)) {
+            const candidate = path.posix.join(dir, name);
+            if (deps.exists(candidate))
+                return candidate;
+        }
+    }
+    const p = windows ? path.win32 : path.posix;
+    // Windows installs are claude.exe, codex.cmd and so on.
+    const exts = windows ? (deps.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+    for (const dir of (deps.env.PATH ?? "").split(p.delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const candidate = p.join(dir, `${name}${ext.toLowerCase()}`);
+            if (deps.exists(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+export function parseToolVersion(output) {
+    const m = /\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)\b/.exec(output);
+    return m ? m[1] : null;
+}
+export function locateTool(name, deps) {
+    const found = findUserTool(name, deps);
+    if (!found)
+        return null;
+    const realPath = deps.realpath(found);
+    const r = deps.version(found);
+    return {
+        path: found,
+        realPath,
+        version: r.status === 0 ? parseToolVersion(r.stdout) : null,
+        writable: deps.writable(path.dirname(realPath)),
+    };
+}
+/**
+ * The npm global prefix an install lives in: `<prefix>/lib/node_modules/<pkg>`
+ * on Unix, `<prefix>\\node_modules\\<pkg>` on Windows. Null when the real path
+ * is not inside that package.
+ */
+function npmPrefixOf(realPath, pkg, platform) {
+    const windows = platform === "win32";
+    const p = windows ? path.win32 : path.posix;
+    const marker = windows ? `${p.sep}node_modules${p.sep}${pkg.split("/").join(p.sep)}${p.sep}` : `/lib/node_modules/${pkg}/`;
+    const at = realPath.indexOf(marker);
+    return at > 0 ? realPath.slice(0, at) : null;
+}
+/**
+ * An npm install is updated through npm, into the prefix it was found in (the
+ * npm on PATH may be configured for another one); anything else through the
+ * CLI's own `update`.
+ */
+export function toolUpdateCommand(name, install, platform = process.platform) {
+    const pkg = NPM_PACKAGES[name];
+    const prefix = pkg ? npmPrefixOf(install.realPath, pkg, platform) : null;
+    if (pkg && prefix) {
+        return { file: "npm", args: ["install", "-g", "--prefix", prefix, `${pkg}@latest`], env: {} };
+    }
+    return { file: install.path, args: ["update"], env: { ...(UPDATE_ENV[name] ?? {}) } };
+}
+//# sourceMappingURL=tools.js.map

package/dist/lib/daemon/updater.d.ts

@@ -0,0 +1,57 @@
+/**
+ * One run of the `updater` service (`hq daemon service self-update`), which
+ * replaces the boxes' `hq-cli-update.timer` and `*-codex-update.timer`:
+ *
+ * 1. Update the hq CLI through the shared self-update path (same install
+ *    routing, lock and convergence check as every other CLI update), when it
+ *    is a global install this process may replace.
+ * 2. Update the Claude, Codex and Grok CLIs the login user installed, each
+ *    through its own update route. A copy this user cannot write (root's
+ *    under /usr) is reported and left alone.
+ * 3. Install or update the daemon's own hq-cloud (sync and the outpost
+ *    heartbeat run from it when it is newer than the CLI's bundled copy), and
+ *    restart sync and the heartbeat right after it changes.
+ * 4. After a CLI update, ask the daemon to restart itself so the supervisor and
+ *    every service run the new version. The remote-control hosts notice an
+ *    updated Claude or Codex on disk themselves and restart once idle.
+ */
+import type { SelfUpdateOutcome } from "../../utils/self-update.js";
+import type { HqCloudUpdateOutcome } from "./hq-cloud.js";
+import { type ToolInstall, type ToolName } from "./tools.js";
+export type { ToolInstall } from "./tools.js";
+export interface ToolUpdater {
+    name: ToolName;
+    locate: () => ToolInstall | null;
+    update: (install: ToolInstall) => {
+        ok: boolean;
+        detail?: string;
+    };
+}
+export interface UpdaterDeps {
+    /** Null when this CLI is not a global install the updater may replace. */
+    updateCli: (() => Promise<Pick<SelfUpdateOutcome, "action" | "latest">>) | null;
+    tools: readonly ToolUpdater[];
+    /** Install or update the daemon's own hq-cloud; null where it has none. */
+    updateHqCloud: (() => Promise<HqCloudUpdateOutcome>) | null;
+    /** The units on this machine that run hq-cloud code, restarted after it updates. */
+    hqCloudUnits: readonly string[];
+    requestDaemonRestart: () => void;
+    /** Restart one unit (a restart request to the running daemon). */
+    requestRestart: (unit: string) => void;
+    log: (line: string) => void;
+}
+export interface UpdaterResult {
+    ok: boolean;
+    /** Tools whose version changed in this run. */
+    updated: ToolName[];
+}
+export declare function runDaemonUpdater(deps: UpdaterDeps): Promise<UpdaterResult>;
+/**
+ * The variables for the updater's own CLI update. Every supervised service
+ * gets HQ_NO_UPDATE_CHECK=1 so it never updates itself; the updater is the one
+ * process that must, so it drops that opt-out.
+ */
+export declare function updaterEnv(vars: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** The real updater for one tool, run as this (the login) user. */
+export declare function hostToolUpdater(name: ToolName, env: NodeJS.ProcessEnv, home: string): ToolUpdater;
+//# sourceMappingURL=updater.d.ts.map