@integrity-labs/agt-cli 0.28.1153 → 0.28.1154

package/dist/chunk-PG343LR6.js

@@ -0,0 +1,718 @@
+import {
+  CLAUDE_AGENT_PROCESS_PATTERN,
+  parsePsRows
+} from "./chunk-XWVM4KPK.js";
+import {
+  effectiveClaudeJsonPath
+} from "./chunk-EL5MWGGH.js";
+import {
+  FORCED_UPDATE_HARD_DEADLINE_MS
+} from "./chunk-PQ6K7IGT.js";
+
+// src/lib/claude-code-updater.ts
+import { execFile, execFileSync as execFileSync2 } from "child_process";
+import { existsSync, readFileSync as readFileSync2, realpathSync } from "fs";
+import { homedir } from "os";
+import { promisify } from "util";
+
+// src/lib/disk-guard.ts
+import { readdirSync, readFileSync, statSync, statfsSync } from "fs";
+import { execFileSync } from "child_process";
+var GIB = 1024 * 1024 * 1024;
+var DISK_LOW_FREE_RATIO = 0.1;
+var DISK_LOW_FREE_BYTES = 2 * GIB;
+var DISK_LOW_FREE_CAP_BYTES = 5 * GIB;
+function diskLowThresholdBytes(totalBytes) {
+  return Math.min(DISK_LOW_FREE_CAP_BYTES, Math.max(DISK_LOW_FREE_BYTES, totalBytes * DISK_LOW_FREE_RATIO));
+}
+var SELF_UPDATE_MIN_FREE_BYTES = 1 * GIB;
+var DISK_GUARD_INTERVAL_MS = 60 * 60 * 1e3;
+function readDiskStat(path = "/", statfs = statfsSync) {
+  try {
+    const s = statfs(path);
+    const bsize = Number(s.bsize);
+    return { freeBytes: Number(s.bavail) * bsize, totalBytes: Number(s.blocks) * bsize };
+  } catch {
+    return null;
+  }
+}
+function diskVerdict(stat) {
+  if (!stat || !Number.isFinite(stat.freeBytes) || !Number.isFinite(stat.totalBytes) || stat.totalBytes <= 0) {
+    return "unknown";
+  }
+  return stat.freeBytes < diskLowThresholdBytes(stat.totalBytes) ? "low" : "ok";
+}
+var SAFE_CLEANUP_STEPS = [
+  { bin: "journalctl", args: ["--vacuum-size=200M"], needsRoot: true, packageCache: false },
+  { bin: "npm", args: ["cache", "clean", "--force"], needsRoot: false, packageCache: true },
+  { bin: "pnpm", args: ["store", "prune"], needsRoot: false, packageCache: true }
+];
+var NON_ROOT_EXTRA_STEPS = [
+  { bin: "npm", args: ["cache", "clean", "--force"], needsRoot: true, packageCache: true }
+];
+async function runSafeCleanup(deps) {
+  const timeout = deps.timeoutMs ?? CLEANUP_STEP_TIMEOUT_MS;
+  const results = [];
+  const steps = deps.isRoot ? SAFE_CLEANUP_STEPS : [...SAFE_CLEANUP_STEPS, ...NON_ROOT_EXTRA_STEPS];
+  for (const step of steps) {
+    const label = `${step.needsRoot && !deps.isRoot ? "sudo " : ""}${step.bin} ${step.args.join(" ")}`;
+    if (step.packageCache) {
+      const busy = deps.packageManagerBusy ? await deps.packageManagerBusy().catch(() => true) : false;
+      if (busy) {
+        results.push({ step: label, outcome: "skipped", detail: "an npm/pnpm install is running" });
+        continue;
+      }
+    }
+    const [cmd, args] = deps.isRoot || !step.needsRoot ? [step.bin, step.args] : ["sudo", [...step.bin === "journalctl" ? ["-n"] : ["-n", "-H"], step.bin, ...step.args]];
+    try {
+      await deps.exec(cmd, args, { timeout });
+      results.push({ step: label, outcome: "ran" });
+    } catch (err) {
+      const e = err;
+      const stderr = e.stderr ? String(e.stderr) : "";
+      const missing = e.code === "ENOENT" || /command not found|not found/i.test(stderr);
+      results.push({
+        step: label,
+        outcome: missing ? "missing" : "failed",
+        detail: (stderr || e.message || "").trim().slice(0, 200)
+      });
+    }
+  }
+  return results;
+}
+function mb(bytes) {
+  return `${Math.round(bytes / (1024 * 1024))}MB`;
+}
+function summarize(results) {
+  return results.map((r) => `${r.step}=${r.outcome}`).join(", ");
+}
+var holdEpisode = null;
+var busyEpisode = null;
+var forcedHoldAnnounced = false;
+var forcedBusyAnnounced = false;
+function rearmForcedDiskHoldAnnounce() {
+  forcedHoldAnnounced = false;
+  forcedBusyAnnounced = false;
+}
+var cacheLockTail = Promise.resolve();
+var cacheLockHolders = 0;
+var PACKAGE_CACHE_LOCK_MAX_HOLD_MS = 10 * 60 * 1e3;
+var PACKAGE_CACHE_IDLE_MAX_WAIT_MS = 5 * 60 * 1e3;
+var CLEANUP_STEP_TIMEOUT_MS = 12e4;
+var SELF_UPDATE_LOCK_MAX_HOLD_MS = 12 * 60 * 1e3;
+var SELF_UPDATE_TIMEOUTS = {
+  brewUpdateMs: 6e4,
+  brewOutdatedMs: 3e4,
+  brewUpgradeMs: 12e4,
+  npmInstallMs: 18e4,
+  smokeCheckMs: 15e3
+};
+var SELF_UPDATE_BUSY_CEILING_MS = 2 * 60 * 60 * 1e3;
+var BUSY_HOLD_RELOG_MS = 60 * 60 * 1e3;
+var INSTALL_VERBS = /* @__PURE__ */ new Set(["install", "i", "ci", "add", "update", "upgrade", "up"]);
+var NOT_AN_INSTALL = /* @__PURE__ */ new Set(["run", "run-script", "exec", "x", "dlx", "test", "start"]);
+var PM_BINS = /^(npm|pnpm)$/;
+var PM_SCRIPTS = /^(npm|npm-cli\.js|pnpm|pnpm\.c?js)$/;
+var basenameOf = (p) => p.slice(p.lastIndexOf("/") + 1);
+function isPackageInstallArgv(argv) {
+  let args = argv.filter((a) => a.length > 0);
+  if (args.length === 1 && args[0].includes(" ")) args = args[0].split(/\s+/);
+  if (args.length === 0) return false;
+  let rest;
+  const bin = basenameOf(args[0]);
+  if (PM_BINS.test(bin)) rest = args.slice(1);
+  else if (/^node(js)?$/.test(bin) && args[1] && PM_SCRIPTS.test(basenameOf(args[1]))) rest = args.slice(2);
+  else return false;
+  const sub = rest.find((a) => !a.startsWith("-"));
+  if (!sub || NOT_AN_INSTALL.has(sub)) return false;
+  if (INSTALL_VERBS.has(sub)) return true;
+  const next = rest.slice(rest.indexOf(sub) + 1).find((a) => !a.startsWith("-"));
+  return next !== void 0 && INSTALL_VERBS.has(next);
+}
+function anyPackageInstallRunning(deps = {}) {
+  let pids;
+  try {
+    pids = (deps.listPids ?? (() => readdirSync("/proc").filter((d) => /^\d+$/.test(d))))();
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    pids = null;
+  }
+  if (pids === null) {
+    const lines = (deps.listProcessArgs ?? defaultPsArgs)();
+    return lines.some((line) => isPackageInstallArgv(line.trim().split(/\s+/)));
+  }
+  const readCmdline = deps.readCmdline ?? ((pid) => {
+    try {
+      return readFileSync(`/proc/${pid}/cmdline`, "utf8");
+    } catch {
+      return null;
+    }
+  });
+  const readRootId = deps.readRootId ?? ((pid) => {
+    try {
+      const st = statSync(`/proc/${pid}/root/`);
+      return `${st.dev}:${st.ino}`;
+    } catch {
+      return null;
+    }
+  });
+  const self = String(deps.selfPid ?? process.pid);
+  const selfRoot = readRootId("self");
+  for (const pid of pids) {
+    if (pid === self) continue;
+    const raw = readCmdline(pid);
+    if (!raw || !isPackageInstallArgv(raw.split("\0"))) continue;
+    const root = readRootId(pid);
+    if (selfRoot && root && root !== selfRoot) continue;
+    return true;
+  }
+  return false;
+}
+function defaultPsArgs() {
+  return execFileSync("ps", ["-A", "-o", "args="], { encoding: "utf8", timeout: 5e3 }).split("\n").filter(Boolean);
+}
+async function acquirePackageCacheLock(opts = {}) {
+  const prev = cacheLockTail;
+  let releaseTail;
+  cacheLockTail = new Promise((r) => releaseTail = r);
+  let abandoned = false;
+  let waitTimer;
+  const acquired = await new Promise((resolve) => {
+    void prev.then(() => {
+      if (abandoned) {
+        releaseTail();
+        return;
+      }
+      if (waitTimer) clearTimeout(waitTimer);
+      resolve(true);
+    });
+    if (opts.maxWaitMs !== void 0) {
+      waitTimer = setTimeout(() => {
+        abandoned = true;
+        resolve(false);
+      }, opts.maxWaitMs);
+      waitTimer.unref?.();
+    }
+  });
+  if (!acquired) return null;
+  cacheLockHolders += 1;
+  let released = false;
+  const maxHold = opts.maxHoldMs ?? PACKAGE_CACHE_LOCK_MAX_HOLD_MS;
+  const releaseOnce = () => {
+    if (released) return;
+    released = true;
+    clearTimeout(holdTimer);
+    cacheLockHolders -= 1;
+    releaseTail();
+  };
+  const holdTimer = setTimeout(() => {
+    (opts.log ?? console.warn)(
+      `[disk-guard] package-cache lock held ${Math.round(maxHold / 6e4)}m by ${opts.label ?? "a holder"} that is still running; releasing it so a stalled install cannot block the self-update or cleanup forever [ENG-11669]`
+    );
+    releaseOnce();
+  }, maxHold);
+  holdTimer.unref?.();
+  return releaseOnce;
+}
+async function withPackageCacheLock(fn, opts = {}) {
+  const release = await acquirePackageCacheLock(opts);
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+async function exclusiveCleanup(cleanup) {
+  return withPackageCacheLock(cleanup, { label: "the disk-guard cleanup" });
+}
+async function ensureDiskForSelfUpdate(deps) {
+  const busyHold = (why) => {
+    const now = deps.nowMs ?? Date.now();
+    let first = false;
+    if (busyEpisode === null) {
+      busyEpisode = { since: now, loggedAt: now };
+      first = true;
+    }
+    const announceForced = deps.force === true && !forcedBusyAnnounced;
+    if (announceForced) forcedBusyAnnounced = true;
+    if (first || announceForced || now - busyEpisode.loggedAt >= BUSY_HOLD_RELOG_MS) {
+      const heldMin = Math.round((now - busyEpisode.since) / 6e4);
+      busyEpisode.loggedAt = now;
+      deps.log(
+        `[disk-guard] HELD${deps.force ? ' (forced "Update CLI now")' : ""} self-update: ` + (why === "lock" ? "a package install or cache cleanup has held the package cache for too long; " : "another npm/pnpm install is running on this host; ") + "not starting `npm install -g` alongside it. Retrying on a later check" + (first ? " (further busy holds this episode are logged hourly)" : `. STILL held after ${heldMin}m: if no install should be running, find and stop the stuck npm/pnpm process`) + " [ENG-11669]"
+      );
+    }
+    return { ok: false, freeBytes: null, cleaned: false, reason: "package_cache_busy" };
+  };
+  const isBusyRaw = async () => deps.packageManagerBusy ? await deps.packageManagerBusy().catch(() => true) : false;
+  const isBusy = async () => {
+    if (!await isBusyRaw()) {
+      busyEpisode = null;
+      return false;
+    }
+    const now = deps.nowMs ?? Date.now();
+    if (busyEpisode && now - busyEpisode.since >= SELF_UPDATE_BUSY_CEILING_MS) {
+      deps.log(
+        `[disk-guard] self-update has deferred to another npm/pnpm install for ${Math.round((now - busyEpisode.since) / 6e4)}m, past the ceiling; proceeding anyway so a stuck or looping install cannot block updates forever [ENG-11669]`
+      );
+      return false;
+    }
+    return true;
+  };
+  const release = await acquirePackageCacheLock({
+    maxWaitMs: deps.idleWaitMs ?? PACKAGE_CACHE_IDLE_MAX_WAIT_MS,
+    maxHoldMs: SELF_UPDATE_LOCK_MAX_HOLD_MS,
+    label: "the agt self-update",
+    log: deps.log
+  });
+  if (!release) return busyHold("lock");
+  try {
+    if (await isBusy()) {
+      release();
+      return busyHold("pgrep");
+    }
+    const room = await ensureDiskForSelfUpdateLocked(deps);
+    if (!room.ok) {
+      release();
+      return room;
+    }
+    if (await isBusy()) {
+      release();
+      return busyHold("pgrep");
+    }
+    busyEpisode = null;
+    return { ...room, release };
+  } catch (err) {
+    release();
+    throw err;
+  }
+}
+async function ensureDiskForSelfUpdateLocked(deps) {
+  const nowMs = deps.nowMs ?? Date.now();
+  const before = deps.readStat();
+  if (!before) {
+    deps.log("[disk-guard] could not read free space on the install filesystem; proceeding with the self-update unchecked [ENG-11669]");
+    return { ok: true, freeBytes: null, cleaned: false };
+  }
+  if (before.freeBytes >= SELF_UPDATE_MIN_FREE_BYTES) {
+    if (holdEpisode) deps.log(`[disk-guard] self-update hold cleared: ${mb(before.freeBytes)} free [ENG-11669]`);
+    holdEpisode = null;
+    forcedHoldAnnounced = false;
+    return { ok: true, freeBytes: before.freeBytes, cleaned: false };
+  }
+  if (holdEpisode && nowMs - holdEpisode.lastCleanupMs < DISK_GUARD_INTERVAL_MS) {
+    if (deps.force && !forcedHoldAnnounced) {
+      forcedHoldAnnounced = true;
+      deps.log(
+        `[disk-guard] HELD (forced "Update CLI now"): only ${mb(before.freeBytes)} free for the install (need ${mb(SELF_UPDATE_MIN_FREE_BYTES)}); cleanup already ran this hour and did not make room. Free disk on this host; the request stays pending and applies once there is room (said once per request) [ENG-11669]`
+      );
+    }
+    return { ok: false, freeBytes: before.freeBytes, cleaned: true };
+  }
+  const firstHold = holdEpisode === null;
+  if (firstHold) {
+    deps.log(
+      `[disk-guard] only ${mb(before.freeBytes)} free for the install (need ${mb(SELF_UPDATE_MIN_FREE_BYTES)} to self-update); running safe cleanup first [ENG-11669]`
+    );
+  }
+  const results = await deps.cleanup();
+  const after = deps.readStat();
+  const freeAfter = after?.freeBytes ?? before.freeBytes;
+  if (freeAfter >= SELF_UPDATE_MIN_FREE_BYTES) {
+    deps.log(`[disk-guard] cleanup freed space: ${mb(before.freeBytes)} -> ${mb(freeAfter)} (${summarize(results)}) [ENG-11669]`);
+    holdEpisode = null;
+    return { ok: true, freeBytes: freeAfter, cleaned: true };
+  }
+  holdEpisode = { lastCleanupMs: nowMs };
+  if (!firstHold && deps.force && !forcedHoldAnnounced) {
+    forcedHoldAnnounced = true;
+    deps.log(
+      `[disk-guard] HELD (forced "Update CLI now"): still only ${mb(freeAfter)} free after cleanup (need ${mb(SELF_UPDATE_MIN_FREE_BYTES)}; ${summarize(results)}). Free disk on this host, then retry [ENG-11669]`
+    );
+  }
+  if (firstHold) {
+    deps.log(
+      `[disk-guard] HELD self-update: still only ${mb(freeAfter)} free after cleanup (${summarize(results)}). Keeping the current agt binary rather than risk an install that deletes it and then fails with ENOSPC. Free disk on this host (or grow the volume) and the update applies on a later check. (further holds this episode are not logged) [ENG-11669]`
+    );
+  }
+  return { ok: false, freeBytes: freeAfter, cleaned: true };
+}
+function tightestDiskStat(paths, read = readDiskStat) {
+  let best = null;
+  for (const p of [...new Set(paths)]) {
+    const s = read(p);
+    if (s && (best === null || s.freeBytes < best.freeBytes)) best = s;
+  }
+  return best;
+}
+var lastGuardRunMs = null;
+var guardBlindLogged = false;
+async function maybeRunDiskGuard(deps) {
+  if (lastGuardRunMs !== null && deps.nowMs - lastGuardRunMs < DISK_GUARD_INTERVAL_MS) {
+    return { ran: false, reason: "throttled" };
+  }
+  lastGuardRunMs = deps.nowMs;
+  const before = deps.readStat();
+  const verdict = diskVerdict(before);
+  if (verdict === "unknown" || !before) {
+    if (!guardBlindLogged) {
+      guardBlindLogged = true;
+      deps.log(
+        "[disk-guard] could not read free space on /; the hourly disk guard is blind (no cleanup, no host_disk_low) until it can. Said once until the reading comes back [ENG-11669]"
+      );
+    }
+    return { ran: false, reason: "unknown" };
+  }
+  if (guardBlindLogged) {
+    guardBlindLogged = false;
+    deps.log("[disk-guard] free space on / is readable again; the hourly disk guard is back [ENG-11669]");
+  }
+  if (verdict !== "low") return { ran: false, reason: "ok" };
+  const results = await exclusiveCleanup(deps.cleanup);
+  const after = deps.readStat();
+  const stillLow = diskVerdict(after) === "low";
+  deps.log(
+    `[disk-guard] / was low (${mb(before.freeBytes)} free of ${mb(before.totalBytes)}); safe cleanup ran (${summarize(results)}); now ${after ? mb(after.freeBytes) : "unknown"} free.` + (stillLow ? " STILL LOW: something other than caches is filling this disk. Investigate before it fills: `du -xh --max-depth=2 / | sort -rh | head`. Never delete /root/.claude/projects (agent transcripts). [ENG-11669]" : " [ENG-11669]")
+  );
+  return { ran: true, beforeBytes: before.freeBytes, afterBytes: after?.freeBytes ?? null, stillLow };
+}
+
+// src/lib/claude-code-updater.ts
+var execFileAsync = promisify(execFile);
+var NPM_PKG = "@anthropic-ai/claude-code";
+var CLAUDE_CODE_SECURITY_FLOOR = "2.1.308";
+var BELOW_FLOOR_RECHECK_MS = 6e4;
+var DEFAULT_INTERVAL_MS = 6 * 60 * 60 * 1e3;
+var DEFAULT_VERIFY_MISMATCH_THRESHOLD = 5;
+function intervalMs() {
+  const raw = Number.parseInt(process.env["AGT_CLAUDE_UPDATE_INTERVAL_MS"] ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_INTERVAL_MS;
+}
+function verifyMismatchThreshold() {
+  const raw = Number.parseInt(process.env["AGT_CLAUDE_UPDATE_VERIFY_THRESHOLD"] ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_VERIFY_MISMATCH_THRESHOLD;
+}
+function parseVersion(output) {
+  const m = output.match(/\d+\.\d+\.\d+[A-Za-z0-9.+-]*/);
+  return m ? m[0] : null;
+}
+function isConcreteVersion(spec) {
+  return /^\d+\.\d+\.\d+[A-Za-z0-9.+-]*$/.test(spec.trim());
+}
+function compareVersions(a, b) {
+  const re = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?/;
+  const ma = re.exec(a.trim());
+  const mb2 = re.exec(b.trim());
+  if (!ma || !mb2) return null;
+  for (let i = 1; i <= 3; i++) {
+    const d = Number(ma[i]) - Number(mb2[i]);
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  const preA = ma[4] !== void 0;
+  const preB = mb2[4] !== void 0;
+  if (preA === preB) return 0;
+  return preA ? -1 : 1;
+}
+function shouldRunClaudeCodeUpdater(input) {
+  if (!input.desiredVersion) return false;
+  if (isBelowSecurityFloor(input.installedVersion, input.floor)) return true;
+  return input.windowGate === "proceed";
+}
+function isBelowSecurityFloor(version, floor = CLAUDE_CODE_SECURITY_FLOOR) {
+  if (!version) return false;
+  const parsed = parseVersion(version);
+  if (!parsed) return false;
+  const cmp = compareVersions(parsed, floor);
+  return cmp !== null && cmp < 0;
+}
+var WELL_KNOWN_CLAUDE_PATHS = [
+  "/usr/bin/claude",
+  // Anthropic native autoupdater (Linux deb/rpm)
+  "/usr/local/bin/claude",
+  // npm global on macOS Intel + Linux without nvm
+  "/opt/homebrew/bin/claude",
+  // Homebrew on macOS Apple Silicon
+  "/home/linuxbrew/.linuxbrew/bin/claude"
+  // Linuxbrew (used on agt-aws-* hosts)
+];
+var lastCheckAt = 0;
+var multiInstallWarned = false;
+var verifyMismatchState = null;
+var belowFloorBusySince = null;
+function _resetClaudeCodeUpdaterState() {
+  lastCheckAt = 0;
+  multiInstallWarned = false;
+  verifyMismatchState = null;
+  belowFloorBusySince = null;
+}
+function defaultPsSnapshot() {
+  return execFileSync2("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", maxBuffer: 16 * 1024 * 1024 });
+}
+function defaultReadClaudeJson(path) {
+  try {
+    return readFileSync2(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function hostHasLiveAgent(psOutput) {
+  return parsePsRows(psOutput).some((r) => CLAUDE_AGENT_PROCESS_PATTERN.test(r.args));
+}
+function readsAsNativeInstall(raw) {
+  if (!raw) return false;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed.installMethod === "native";
+  } catch {
+    return false;
+  }
+}
+function isNativeInstallPath(realPath) {
+  return /\/claude\/versions\/\d+\.\d+\.\d+[^/]*$/.test(realPath);
+}
+async function resolveNativeOwnership(run, realPath, claudeJson) {
+  const configSaysNative = readsAsNativeInstall(claudeJson);
+  let resolved = null;
+  const override = process.env["CLAUDE_PATH"];
+  if (override) {
+    resolved = override;
+  } else {
+    try {
+      const { stdout } = await run("which", ["claude"]);
+      resolved = stdout.trim().split("\n")[0]?.trim() || null;
+    } catch {
+      resolved = null;
+    }
+  }
+  if (resolved) {
+    try {
+      const real = realPath(resolved);
+      return { native: isNativeInstallPath(real), binary: real, configSaysNative };
+    } catch {
+    }
+  }
+  return { native: configSaysNative, binary: null, configSaysNative };
+}
+async function resolveInstallTargetPath(run) {
+  try {
+    const { stdout } = await run("npm", ["prefix", "-g"]);
+    const prefix = stdout.trim();
+    if (!prefix) return null;
+    return `${prefix}/bin/claude`;
+  } catch {
+    return null;
+  }
+}
+async function probeClaudeInstalls(run, fileExists, home) {
+  const candidates = new Set(WELL_KNOWN_CLAUDE_PATHS);
+  candidates.add(`${home}/.claude/local/claude`);
+  try {
+    const { stdout } = await run("which", ["claude"]);
+    const p = stdout.trim().split("\n")[0]?.trim();
+    if (p) candidates.add(p);
+  } catch {
+  }
+  const results = [];
+  for (const p of candidates) {
+    if (!fileExists(p)) continue;
+    let version = null;
+    try {
+      const { stdout } = await run(p, ["--version"]);
+      version = parseVersion(stdout);
+    } catch {
+    }
+    results.push({ path: p, version });
+  }
+  return results;
+}
+async function maybeUpdateClaudeCode(deps) {
+  const now = deps.now ? deps.now() : Date.now();
+  const run = deps.runCommand ?? ((cmd, args) => execFileAsync(cmd, args, { maxBuffer: 16 * 1024 * 1024 }));
+  const ps = deps.psSnapshot ?? defaultPsSnapshot;
+  const fileExists = deps.fileExists ?? existsSync;
+  const readClaudeJson = deps.readClaudeJson ?? defaultReadClaudeJson;
+  const realPath = deps.realPath ?? realpathSync;
+  const home = (deps.homeDir ?? homedir)();
+  const { log } = deps;
+  const floor = deps.securityFloor ?? CLAUDE_CODE_SECURITY_FLOOR;
+  let forcedUnderLiveAgents = false;
+  if (now - lastCheckAt < intervalMs()) {
+    return { action: "throttled" };
+  }
+  lastCheckAt = now;
+  try {
+    const spec = (deps.desiredVersion || "latest").trim();
+    if (!multiInstallWarned) {
+      const installs = await probeClaudeInstalls(run, fileExists, home);
+      if (installs.length > 1) {
+        const summary = installs.map((i) => `${i.path}=${i.version ?? "unknown"}`).join(", ");
+        log(`[claude-code-updater] multiple claude installs detected: ${summary}`);
+      }
+      multiInstallWarned = true;
+    }
+    const claudeJsonPath = effectiveClaudeJsonPath(home);
+    const ownership = await resolveNativeOwnership(run, realPath, readClaudeJson(claudeJsonPath));
+    if (!ownership.native && ownership.configSaysNative) {
+      log(
+        `[claude-code-updater] ${claudeJsonPath} says installMethod=native but the binary this host runs (${ownership.binary}) is not a native install \u2014 ignoring it and converging to the pin`
+      );
+    }
+    if (ownership.native) {
+      log("[claude-code-updater] native install detected, deferring to Anthropic autoupdater");
+      verifyMismatchState = null;
+      return { action: "skipped_native_install", target: spec };
+    }
+    let target;
+    if (isConcreteVersion(spec)) {
+      target = spec;
+    } else {
+      const { stdout } = await run("npm", ["view", `${NPM_PKG}@${spec}`, "version"]);
+      const resolved = parseVersion(stdout);
+      if (!resolved) {
+        log(`[claude-code-updater] could not resolve ${NPM_PKG}@${spec} to a version; skipping`);
+        return { action: "failed", reason: "unresolved_target" };
+      }
+      target = resolved;
+    }
+    const targetVsFloor = compareVersions(target, floor);
+    if (targetVsFloor !== null && targetVsFloor < 0) {
+      log(
+        `[claude-code-updater] target ${target} is below the security floor ${floor} (ENG-11641: CVE-2026-111497 + emSign root) \u2014 raising the target to the floor`
+      );
+      target = floor;
+    }
+    let current = deps.currentVersion ?? null;
+    if (!current) {
+      try {
+        const { stdout } = await run("claude", ["--version"]);
+        current = parseVersion(stdout);
+      } catch {
+        current = null;
+      }
+    }
+    const belowFloor = isBelowSecurityFloor(current, floor);
+    if (!belowFloor) belowFloorBusySince = null;
+    if (current && current === target) {
+      if (verifyMismatchState && verifyMismatchState.target === target) {
+        verifyMismatchState = null;
+      }
+      return { action: "up_to_date", version: target };
+    }
+    if (hostHasLiveAgent(ps())) {
+      if (!belowFloor) {
+        log(`[claude-code-updater] host busy (live agent) \u2014 deferring update to ${target} to a later cycle`);
+        return { action: "deferred_busy", target };
+      }
+      if (belowFloorBusySince === null) belowFloorBusySince = now;
+      const waitedMs = now - belowFloorBusySince;
+      if (waitedMs < FORCED_UPDATE_HARD_DEADLINE_MS) {
+        lastCheckAt = now - intervalMs() + BELOW_FLOOR_RECHECK_MS;
+        log(
+          `[claude-code-updater] host busy (live agent) and ${current} is below the security floor ${floor} \u2014 deferring update to ${target}; will force it in ${Math.ceil((FORCED_UPDATE_HARD_DEADLINE_MS - waitedMs) / 6e4)}m if the npm install slot is the binary agents run`
+        );
+        return { action: "deferred_busy", target };
+      }
+      const slotPath = await resolveInstallTargetPath(run);
+      let slotVersion = null;
+      if (slotPath) {
+        try {
+          slotVersion = parseVersion((await run(slotPath, ["--version"])).stdout);
+        } catch {
+          slotVersion = null;
+        }
+      }
+      if (!slotPath) {
+        belowFloorBusySince = null;
+        log(
+          `[claude-code-updater] ERROR security_floor_blocked: deadline reached but \`npm prefix -g\` did not resolve \u2014 cannot prove an install would reach the binary agents run; not forcing an install under live agents`
+        );
+        return { action: "deferred_busy", target };
+      }
+      const slotIsTheRunningBinary = slotVersion !== null && isBelowSecurityFloor(slotVersion, floor) && slotVersion === current;
+      if (!slotIsTheRunningBinary) {
+        belowFloorBusySince = null;
+        log(
+          `[claude-code-updater] ERROR security_floor_blocked: PATH claude reports ${current} (below the security floor ${floor}) but the npm install slot ${slotPath} reports ${slotVersion ?? "no readable version"} \u2014 cannot show the install would reach the binary agents run (multi-install, ENG-5798); not forcing an install under live agents, investigate the host's claude install slots`
+        );
+        return { action: "deferred_busy", target };
+      }
+      log(
+        `[claude-code-updater] security floor deadline reached: ${current} < ${floor} and host still busy after ${Math.round(waitedMs / 6e4)}m \u2014 installing ${target} anyway (ENG-11641)`
+      );
+      forcedUnderLiveAgents = true;
+    }
+    const installTargetPath = await resolveInstallTargetPath(run);
+    log(`[claude-code-updater] updating Claude Code ${current ?? "(none)"} \u2192 ${target}`);
+    await withPackageCacheLock(() => run("npm", ["install", "-g", `${NPM_PKG}@${target}`]), {
+      label: "the Claude Code install",
+      log
+    });
+    const verifyTarget = installTargetPath ?? "claude";
+    let installed = null;
+    try {
+      const { stdout } = await run(verifyTarget, ["--version"]);
+      installed = parseVersion(stdout);
+    } catch {
+      installed = null;
+    }
+    if (installed !== target) {
+      belowFloorBusySince = null;
+      log(
+        `[claude-code-updater] post-install verify mismatch: expected ${target}, got ${installed ?? "unknown"} from ${verifyTarget}`
+      );
+      if (!verifyMismatchState || verifyMismatchState.target !== target) {
+        verifyMismatchState = { target, count: 1, alarmed: false };
+      } else {
+        verifyMismatchState.count += 1;
+      }
+      const threshold = verifyMismatchThreshold();
+      if (verifyMismatchState.count >= threshold && !verifyMismatchState.alarmed) {
+        verifyMismatchState.alarmed = true;
+        log(
+          `[claude-code-updater] ERROR verify_mismatch_stuck: ${verifyMismatchState.count} consecutive verify failures for target ${target} (verify path: ${verifyTarget}) \u2014 install is not taking effect, investigate host install slots`
+        );
+        return { action: "failed", reason: "verify_mismatch_threshold" };
+      }
+      return { action: "failed", reason: "verify_mismatch" };
+    }
+    verifyMismatchState = null;
+    belowFloorBusySince = null;
+    log(`[claude-code-updater] updated Claude Code ${current ?? "(none)"} \u2192 ${installed}`);
+    if (forcedUnderLiveAgents) {
+      log(
+        `[claude-code-updater] WARNING installed ${installed} under live agents: running sessions keep the previous ${current ?? "unknown"} binary until they restart. framework_version now reports ${installed}, which does NOT mean the live sessions are patched`
+      );
+    }
+    return { action: "updated", from: current, to: installed };
+  } catch (err) {
+    if (forcedUnderLiveAgents) belowFloorBusySince = null;
+    log(`[claude-code-updater] update attempt failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { action: "failed", reason: "exception" };
+  }
+}
+
+export {
+  readDiskStat,
+  runSafeCleanup,
+  rearmForcedDiskHoldAnnounce,
+  SELF_UPDATE_TIMEOUTS,
+  anyPackageInstallRunning,
+  withPackageCacheLock,
+  ensureDiskForSelfUpdate,
+  tightestDiskStat,
+  maybeRunDiskGuard,
+  CLAUDE_CODE_SECURITY_FLOOR,
+  parseVersion,
+  isConcreteVersion,
+  compareVersions,
+  shouldRunClaudeCodeUpdater,
+  isBelowSecurityFloor,
+  WELL_KNOWN_CLAUDE_PATHS,
+  _resetClaudeCodeUpdaterState,
+  hostHasLiveAgent,
+  readsAsNativeInstall,
+  isNativeInstallPath,
+  probeClaudeInstalls,
+  maybeUpdateClaudeCode
+};
+//# sourceMappingURL=chunk-PG343LR6.js.map