@jungjaehoon/mama-os 0.78.0 → 0.79.1

package/dist/cli/runtime/default-roots.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultRoots = defaultRoots;
+exports.prepareRoot = prepareRoot;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const prompt_js_1 = require("../prompt.js");
+/**
+ * Where a new install keeps its member folders and its document tools: outside HOME, one place
+ * per person on the machine (plan decision 3). On macOS a folder of this user's sits directly in
+ * the sticky Shared folder beside the home folders, so no account uses a parent another set up;
+ * on Linux it is /var/lib/mama/<user>, which the installer creates once with sudo.
+ */
+function defaultRoots(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const user = options.user ?? (0, node_os_1.userInfo)().username;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(user))
+        return undefined;
+    const base = platform === 'darwin'
+        ? (0, node_path_1.join)((0, node_path_1.dirname)(options.home ?? (0, node_os_1.homedir)()), 'Shared', `mama-${user}`)
+        : platform === 'linux'
+            ? (0, node_path_1.join)('/var/lib/mama', user)
+            : undefined;
+    return base === undefined
+        ? undefined
+        : { memberRoot: (0, node_path_1.join)(base, 'members'), toolsRoot: (0, node_path_1.join)(base, 'tools') };
+}
+/**
+ * Make a root that this user alone owns and writes, or refuse one that is not: the agent runs
+ * what tools_root holds and reads what member_root holds, and the Shared folder lets any account
+ * create a folder first. `ownParent` also checks the per-user folder a default sits in. A root
+ * this account cannot create (Linux's /var/lib/mama) names the one sudo step that makes its
+ * per-user folder; the subfolders are made here.
+ */
+function prepareRoot(path, options = {}) {
+    const uid = options.uid ?? process.getuid?.();
+    if (!(0, node_fs_1.existsSync)(path)) {
+        try {
+            (0, node_fs_1.mkdirSync)(path, { recursive: true, mode: 0o700 });
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EACCES' && code !== 'EPERM' && code !== 'EROFS')
+                throw error;
+            const folder = options.ownParent ? (0, node_path_1.dirname)(path) : path;
+            throw new prompt_js_1.CliInputError(`${path} cannot be created. Create ${folder} for this account once: sudo install -d -o "$USER" -m 0700 ${folder}`);
+        }
+    }
+    for (const folder of options.ownParent ? [(0, node_path_1.dirname)(path), path] : [path]) {
+        const stat = (0, node_fs_1.lstatSync)(folder);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new prompt_js_1.CliInputError(`${folder} must be a folder, not a link or a file`);
+        if (uid !== undefined && stat.uid !== uid)
+            throw new prompt_js_1.CliInputError(`${folder} belongs to another account; choose another folder`);
+        if ((stat.mode & 0o022) !== 0)
+            throw new prompt_js_1.CliInputError(`${folder} can be written by other accounts; run chmod 700 on it`);
+    }
+    (0, node_fs_1.accessSync)(path, node_fs_1.constants.W_OK);
+}
+//# sourceMappingURL=default-roots.js.map

package/dist/cli/runtime/default-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-roots.js","sourceRoot":"","sources":["../../../src/cli/runtime/default-roots.ts"],"names":[],"mappings":";;AAgBA,oCAeC;AASD,kCA2BC;AAnED,qCAAkF;AAClF,qCAA4C;AAC5C,yCAA0C;AAC1C,4CAA6C;AAO7C;;;;;GAKG;AACH,SAAgB,YAAY,CAC1B,UAAwE,EAAE;IAE1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAA,kBAAQ,GAAE,CAAC,QAAQ,CAAC;IACjD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,IAAI,GACR,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,IAAA,gBAAI,EAAC,eAAe,EAAE,IAAI,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CACzB,IAAY,EACZ,UAAiD,EAAE;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,KAAK,CAAC;YAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,MAAM,IAAI,yBAAa,CACrB,GAAG,IAAI,8BAA8B,MAAM,8DAA8D,MAAM,EAAE,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,IAAA,mBAAS,EAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC9C,MAAM,IAAI,yBAAa,CAAC,GAAG,MAAM,yCAAyC,CAAC,CAAC;QAC9E,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG;YACvC,MAAM,IAAI,yBAAa,CAAC,GAAG,MAAM,oDAAoD,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAC3B,MAAM,IAAI,yBAAa,CAAC,GAAG,MAAM,wDAAwD,CAAC,CAAC;IAC/F,CAAC;IACD,IAAA,oBAAU,EAAC,IAAI,EAAE,mBAAS,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/cli/runtime/diagnostics.d.ts

@@ -12,6 +12,12 @@ export interface Check {
     readonly context?: string;
     /** What to do about a warn or fail. */
     readonly fix?: string;
+    /**
+     * A stable name for this finding where its detail carries values that an update or a backend
+     * self-update changes (versions, schema numbers). A check without one is the same finding
+     * while its name and detail are; `mama update` compares failures before and after by these.
+     */
+    readonly code?: string;
 }
 export interface DiagnosticsOptions {
     home?: string;
@@ -24,6 +30,8 @@ export interface DiagnosticsOptions {
     /** A Telegram Bot API call; tests replace it. */
     telegramCall?: (token: string, method: string, params?: Record<string, string>) => Promise<Record<string, unknown>>;
     findIn?: (name: string, dirs: string[]) => string | undefined;
+    /** Where this shell finds a command; tests replace it. */
+    findExecutable?: (name: string) => string | undefined;
     /** Ask the install's daemon for its status; tests replace it. */
     askStatus?: () => Promise<DaemonControlReply>;
     /** Builds a source as boot does; tests replace it so no source reaches the network. */
@@ -33,6 +41,12 @@ export interface DiagnosticsOptions {
     /** Whether something listens on the viewer's address; tests replace it. */
     portInUse?: (port: number, host: string) => Promise<boolean>;
 }
+/** auth.env's assignments, unquoted as sh reads them; values are never printed. */
+export declare function readAuthEnv(root: string): Record<string, string>;
+export declare function defaultTelegramCall(token: string, method: string, params?: Record<string, string>, timeoutMs?: number): Promise<Record<string, unknown>>;
+/** True when something listens; a refusal means free; any other error (a host that cannot be
+ * reached or bound) rejects, since the viewer would fail on it too. */
+export declare function portAnswers(port: number, host: string): Promise<boolean>;
 /**
  * Check an install as its service would run it. Nothing here writes MAMA's files or starts a
  * service; the database is opened read-only (which can leave its -wal and -shm beside it), and the
@@ -40,4 +54,15 @@ export interface DiagnosticsOptions {
  * Each check names what it found and, when it is not ok, what to do.
  */
 export declare function runDiagnostics(options?: DiagnosticsOptions): Promise<Check[]>;
+/**
+ * start.sh's Node: still there, outside one version's folder, and able to load MAMA's SQLite. On
+ * an install the install command made (its Node in `<root>/node`), also the Node the installed
+ * release pins in its install/node.json: running the install command again moves to that one.
+ */
+export declare function nodeCheck(node: string, cli: string, run: ProbeRun, root: string): Check;
+export declare function telegramCheck(token: string | undefined, commonChat: string | number | undefined, call: NonNullable<DiagnosticsOptions['telegramCall']>): Promise<Check>;
+/** The environment start.sh gives the daemon: auth.env, then its own exports, then its PATH. */
+export declare function serviceEnvironment(home: string, auth: Record<string, string>, exports: Record<string, string>, path: readonly string[]): NodeJS.ProcessEnv;
+/** Run with process.env as the daemon's process has it, then put this shell's back. */
+export declare function withEnvironment<T>(env: NodeJS.ProcessEnv, run: () => Promise<T>): Promise<T>;
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/cli/runtime/diagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../../src/cli/runtime/diagnostics.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAyB1D,OAAO,EAAkC,KAAK,QAAQ,EAAmB,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAOlF,OAAO,EAAoB,KAAK,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AAE5F,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9D,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,uFAAuF;IACvF,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC;IAClC,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9D;AAiFD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAmSvF"}
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../../src/cli/runtime/diagnostics.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AA2B1D,OAAO,EAAkC,KAAK,QAAQ,EAAmB,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAsBlF,OAAO,EAAoB,KAAK,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AAE5F,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9D,0DAA0D;IAC1D,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,uFAAuF;IACvF,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC;IAClC,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9D;AASD,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBhE;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACnC,SAAS,SAAQ,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOlC;AAED;uEACuE;AACvE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAexE;AAqBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAkSvF;AA6DD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAuFvF;AAuDD,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,EACvC,IAAI,EAAE,WAAW,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,GACpD,OAAO,CAAC,KAAK,CAAC,CAsEhB;AAyLD,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,CAAC,UAAU,CASnB;AAED,uFAAuF;AACvF,wBAAsB,eAAe,CAAC,CAAC,EACrC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAcZ"}

package/dist/cli/runtime/diagnostics.js

@@ -1,6 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readAuthEnv = readAuthEnv;
+exports.defaultTelegramCall = defaultTelegramCall;
+exports.portAnswers = portAnswers;
 exports.runDiagnostics = runDiagnostics;
+exports.nodeCheck = nodeCheck;
+exports.telegramCheck = telegramCheck;
+exports.serviceEnvironment = serviceEnvironment;
+exports.withEnvironment = withEnvironment;
 const node_fs_1 = require("node:fs");
 const node_module_1 = require("node:module");
 const node_net_1 = require("node:net");
@@ -15,28 +22,19 @@ const timezone_js_1 = require("../../runtime/timezone.js");
 const document_toolkit_js_1 = require("../../tools/document-toolkit.js");
 const launch_files_js_1 = require("../launch-files.js");
 const rotating_log_js_1 = require("../../runtime/rotating-log.js");
-const secrets_js_1 = require("../secrets.js");
 const daemon_js_1 = require("../commands/daemon.js");
 const backend_probe_js_1 = require("./backend-probe.js");
 const daemon_control_js_1 = require("./daemon-control.js");
+const release_check_js_1 = require("./release-check.js");
+const install_kind_js_1 = require("./install-kind.js");
+const source_tools_js_1 = require("./source-tools.js");
+const node_move_journal_js_1 = require("./node-move-journal.js");
+const update_journal_js_1 = require("./update-journal.js");
 const db_manager_1 = require("@jungjaehoon/mama-core/db-manager");
 const migrations_source_js_1 = require("../../storage/migrations-source.js");
 const systemd_service_js_1 = require("./systemd-service.js");
-/** The PATH a service manager gives a unit that does not set one ($PATH in start.sh). */
-const SERVICE_DEFAULT_PATH = {
-    darwin: ['/usr/bin', '/bin', '/usr/sbin', '/sbin'],
-    linux: ['/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin'],
-};
 /** systemd states of an installed unit that can be started or is running. */
 const SYSTEMD_USABLE = new Set(['active', 'inactive', 'activating', 'deactivating', 'reloading']);
-function findIn(name, dirs) {
-    for (const dir of dirs) {
-        const path = (0, node_path_1.join)(dir, name);
-        if ((0, node_fs_1.existsSync)(path))
-            return path;
-    }
-    return undefined;
-}
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -64,9 +62,9 @@ function readAuthEnv(root) {
     });
     return values;
 }
-async function defaultTelegramCall(token, method, params = {}) {
+async function defaultTelegramCall(token, method, params = {}, timeoutMs = 8_000) {
     const query = new URLSearchParams(params).toString();
-    const response = await fetch(`https://api.telegram.org/bot${token}/${method}${query ? `?${query}` : ''}`, { signal: AbortSignal.timeout(8_000) });
+    const response = await fetch(`https://api.telegram.org/bot${token}/${method}${query ? `?${query}` : ''}`, { signal: AbortSignal.timeout(timeoutMs) });
     return (await response.json());
 }
 /** True when something listens; a refusal means free; any other error (a host that cannot be
@@ -85,10 +83,18 @@ function portAnswers(port, host) {
         socket.once('error', (error) => error.code === 'ECONNREFUSED' ? resolve(false) : reject(error));
     });
 }
-function secretFix(name) {
-    return secrets_js_1.SECRET_NAMES.includes(name) || (0, secrets_js_1.isIcalSecret)(name)
-        ? `mama secret set ${name}`
-        : `add ${name} to auth.env`;
+/**
+ * A source's tokens are entered on the setup page by the sources section, run again for that
+ * source, which needs no terminal (install.md, W2.4.5e). Every token source is built only with
+ * the token name it reads, which auth.env holds. The page asks again for a `stored` token only
+ * when MAMA_INIT_REPLACE_SECRETS names it (#552).
+ */
+function sourceSecretFixes(source, names, mama, stored) {
+    return names.length === 0
+        ? []
+        : [
+            `with MAMA stopped, run ${mama} init --section connectors --non-interactive with ${source}'s block from connectors.json in MAMA_INIT_CONNECTORS${stored ? ` and MAMA_INIT_REPLACE_SECRETS=${names.join(',')}` : ''}; its setup page takes ${names.join(' and ')}`,
+        ];
 }
 /**
  * Check an install as its service would run it. Nothing here writes MAMA's files or starts a
@@ -102,7 +108,7 @@ async function runDiagnostics(options = {}) {
     const root = (0, node_path_1.dirname)(configPath);
     const platform = options.platform ?? process.platform;
     const run = options.run ?? backend_probe_js_1.defaultProbeRun;
-    const locate = options.findIn ?? findIn;
+    const locate = options.findIn ?? launch_files_js_1.findIn;
     const checks = [];
     if ((0, node_fs_1.existsSync)((0, daemon_control_js_1.restoreJournalPath)(root))) {
         checks.push({
@@ -112,6 +118,7 @@ async function runDiagnostics(options = {}) {
             fix: 'mama restore --rollback',
         });
     }
+    checks.push(...updateChecks(root, home));
     let config = null;
     // Setting names can be anything the owner typed, so they stay out of the report.
     let ignored = [];
@@ -149,7 +156,10 @@ async function runDiagnostics(options = {}) {
     }
     // What the service runs: the start script's Node, PATH and exports, not this shell's.
     const startPath = (0, node_path_1.join)(root, 'start.sh');
-    let servicePath = SERVICE_DEFAULT_PATH[platform] ?? [];
+    let servicePath = (0, launch_files_js_1.startScriptPath)(null, home, platform);
+    // The Node start.sh runs: on an install the install command made, a source's tool installs
+    // beside MAMA with that Node (install.md, PR 3).
+    let serviceNode = null;
     let exports = {};
     // A script mama did not write is assumed to load auth.env; a generated one must still.
     let loadsAuth = true;
@@ -186,13 +196,9 @@ async function runDiagnostics(options = {}) {
                     fix: 'mama service install --replace rewrites it',
                 });
             }
-            if (reading.path !== null) {
-                servicePath = [
-                    ...(0, launch_files_js_1.startPathValue)(reading.path, home),
-                    ...(/\$\{?PATH\}?/.test(reading.path) ? servicePath : []),
-                ];
-            }
+            servicePath = (0, launch_files_js_1.startScriptPath)(reading, home, platform);
             const [, node, cli] = reading.exec === null ? [] : (0, launch_files_js_1.shellWords)(reading.exec);
+            serviceNode = node ?? null;
             if (!reading.generated) {
                 checks.push({
                     name: 'start.sh',
@@ -210,7 +216,7 @@ async function runDiagnostics(options = {}) {
                 });
             }
             else {
-                checks.push(nodeCheck(node, cli, run));
+                checks.push(nodeCheck(node, cli, run, root));
             }
         }
         catch (error) {
@@ -238,14 +244,7 @@ async function runDiagnostics(options = {}) {
             fix: `correct the quoting in ${(0, node_path_1.join)(root, 'auth.env')}`,
         });
     }
-    const serviceEnv = {
-        HOME: home,
-        USER: process.env.USER,
-        LOGNAME: process.env.LOGNAME,
-        ...auth,
-        ...exports,
-        PATH: servicePath.join(':'),
-    };
+    const serviceEnv = serviceEnvironment(home, auth, exports, servicePath);
     const secret = (name) => Boolean(serviceEnv[name]?.trim());
     if (config) {
         const backend = config.agent.backend;
@@ -268,6 +267,7 @@ async function runDiagnostics(options = {}) {
                     name: 'backend',
                     status: 'fail',
                     detail: probe.problem ?? `${backend} ${probe.version} is older than ${probe.minimum}`,
+                    ...(probe.problem === null ? { code: 'backend.too_old' } : {}),
                     fix: `update ${backend} to ${probe.minimum} or newer`,
                 });
             }
@@ -276,6 +276,7 @@ async function runDiagnostics(options = {}) {
                     name: 'backend',
                     status: 'fail',
                     detail: `${backend} ${probe.version} is not signed in for the service`,
+                    code: 'backend.signed_out',
                     fix: backend === 'claude' ? 'claude auth login' : `CODEX_HOME='${codexHome}' codex login`,
                 });
             }
@@ -299,7 +300,7 @@ async function runDiagnostics(options = {}) {
                     name: messenger,
                     status: 'fail',
                     detail: `${missing.join(' and ')} not set; boot stops at the messengers stage`,
-                    fix: missing.map(secretFix).join('; '),
+                    fix: missing.map((name) => `mama secret set ${name}`).join('; '),
                 });
             }
             else if (messenger === 'telegram' && !options.offline) {
@@ -309,7 +310,10 @@ async function runDiagnostics(options = {}) {
                 checks.push({ name: messenger, status: 'ok', detail: 'secrets set' });
             }
         }
-        checks.push(...(await sourceChecks(config, configPath, servicePath, locate, secret, {
+        checks.push(...(await sourceChecks(config, configPath, locate, secret, {
+            service: { path: servicePath, nodePath: serviceNode, exports },
+            findShell: options.findExecutable ?? launch_files_js_1.findExecutable,
+            home,
             env: serviceEnv,
             online: !options.offline,
             load: options.loadSource ?? index_js_1.loadConnector,
@@ -332,6 +336,7 @@ async function runDiagnostics(options = {}) {
     }
     checks.push(...(await daemonChecks(options.askStatus ?? (() => (0, daemon_js_1.askDaemon)('status', { home, configPath })), port, serviceEnv.MAMA_API_HOST ?? '127.0.0.1', options.portInUse ?? portAnswers)));
     checks.push(serviceCheck(platform, home, options.serviceRun ?? systemd_service_js_1.defaultServiceRun));
+    checks.push(releaseCheck(root, home));
     // Each log against its own cap: the daemon rotates daemon.log and security-events.jsonl before
     // they pass theirs, and start.sh empties crash.log at start past its own.
     for (const [name, path, cap] of [
@@ -416,6 +421,7 @@ function schemaCheck(databasePath) {
                 name: 'schema',
                 status: 'fail',
                 detail: `the database is newer than this MAMA (${summary}); boot refuses it`,
+                code: 'schema.newer',
                 fix: 'install the version that wrote it, or mama restore a backup taken with this one',
             };
         }
@@ -436,8 +442,12 @@ function schemaCheck(databasePath) {
         };
     }
 }
-/** start.sh's Node: still there, outside one version's folder, and able to load MAMA's SQLite. */
-function nodeCheck(node, cli, run) {
+/**
+ * start.sh's Node: still there, outside one version's folder, and able to load MAMA's SQLite. On
+ * an install the install command made (its Node in `<root>/node`), also the Node the installed
+ * release pins in its install/node.json: running the install command again moves to that one.
+ */
+function nodeCheck(node, cli, run, root) {
     const rewrite = 'mama service install rewrites start.sh with a Node path that survives upgrades';
     if (!(0, node_fs_1.existsSync)(node)) {
         return {
@@ -497,6 +507,29 @@ function nodeCheck(node, cli, run) {
                 : 'run mama service install from a shell whose node is not an nvm, volta or fnm version',
         };
     }
+    if (node === (0, node_move_journal_js_1.managedNodePath)(root)) {
+        const packageRoot = (0, install_kind_js_1.packageRootOf)(cli);
+        if (packageRoot === null) {
+            return {
+                name: 'node',
+                status: 'fail',
+                detail: 'the MAMA command start.sh runs is not inside a MAMA OS package',
+                context: cli,
+                fix: 'run the install command again',
+            };
+        }
+        const pin = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(packageRoot, 'install', 'node.json'), 'utf8')).version;
+        if (version !== `v${pin}`) {
+            return {
+                name: 'node',
+                status: 'warn',
+                detail: `start.sh runs ${version}; this release pins Node.js ${pin}`,
+                code: 'node.pin',
+                context: node,
+                fix: `run the install command again, which moves it: ${node_move_journal_js_1.INSTALL_COMMAND}`,
+            };
+        }
+    }
     return { name: 'node', status: 'ok', detail: `${version} loads SQLite`, context: node };
 }
 function sandboxCheck(platform, servicePath, locate, run) {
@@ -619,8 +652,12 @@ async function telegramCheck(token, commonChat, call) {
             : 'token valid; a member of the common group that reads its messages',
     };
 }
+/** The secrets a source's requirements name. */
+function secretNames(needs) {
+    return needs.flatMap((need) => need.type === 'token' && need.tokenName !== undefined ? [need.tokenName] : []);
+}
 /** connectors.json as the connector runtime reads it, and what each enabled source needs. */
-async function sourceChecks(config, configPath, servicePath, locate, secret, start) {
+async function sourceChecks(config, configPath, locate, secret, start) {
     const paths = (0, daemon_js_1.pathsFor)(configPath, config);
     let plan;
     try {
@@ -646,14 +683,17 @@ async function sourceChecks(config, configPath, servicePath, locate, secret, sta
     }
     const checks = [];
     const timeZone = (0, timezone_js_1.createTimeZoneSetting)(config.timezone);
+    const loaded = [];
     for (const name of plan.enabledConnectorNames) {
-        let connector;
         try {
-            connector = await start.load(name, plan.config.config[name], (0, connectors_js_1.connectorLoadPaths)(name, {
-                statePath: paths.connectorsRoot,
-                kagemushaDbPath: paths.kagemushaDbPath,
-                timeZone,
-            }));
+            loaded.push({
+                name,
+                connector: await start.load(name, plan.config.config[name], (0, connectors_js_1.connectorLoadPaths)(name, {
+                    statePath: paths.connectorsRoot,
+                    kagemushaDbPath: paths.kagemushaDbPath,
+                    timeZone,
+                })),
+            });
         }
         catch (error) {
             checks.push({
@@ -662,26 +702,39 @@ async function sourceChecks(config, configPath, servicePath, locate, secret, sta
                 detail: 'cannot be built from connectors.json; boot stops at the connectors stage',
                 context: message(error),
             });
-            continue;
         }
-        const needs = connector.getAuthRequirements();
+    }
+    const enabled = loaded.map(({ name, connector }) => ({
+        name,
+        connector,
+        needs: connector.getAuthRequirements(),
+    }));
+    for (const { name, connector, needs } of enabled) {
         // A secret's name can carry an owner's channel key (iCal), so it stays out of the report.
-        const secrets = needs.flatMap((need) => need.type === 'token' && need.tokenName && !secret(need.tokenName) ? [need.tokenName] : []);
-        const commands = needs.flatMap((need) => need.type === 'cli' && need.cli && !locate(need.cli, servicePath)
-            ? [{ cli: need.cli, login: need.cliAuthCommand }]
-            : []);
-        if (secrets.length > 0 || commands.length > 0) {
+        const secrets = secretNames(needs).filter((tokenName) => !secret(tokenName));
+        const tools = (0, source_tools_js_1.sourceTools)([{ name, needs }], start.service, { root: (0, node_path_1.dirname)(configPath), home: start.home }, { inDirs: locate, shell: start.findShell }, 
+        // One login of a tool serves every source that runs it, so it names what all of them need.
+        enabled);
+        const missing = tools.filter((tool) => tool.servicePath === null);
+        // Paths stay out of `detail`, which --report shares.
+        const context = [
+            ...(secrets.length > 0 ? [secrets.join(', ')] : []),
+            ...missing.flatMap(({ tool, shellPath }) => shellPath === null ? [] : [`this shell finds ${tool.command} at ${shellPath}`]),
+        ];
+        if (secrets.length > 0 || missing.length > 0) {
             checks.push({
                 name: `source ${name}`,
                 status: 'fail',
                 detail: [
                     ...(secrets.length > 0 ? [`${secrets.length} secret(s) it needs are not set`] : []),
-                    ...commands.map(({ cli }) => `the ${cli} command is not on the service's PATH`),
+                    ...missing.map(({ tool }) => `the ${tool.command} command is not on the service's PATH`),
                 ].join('; '),
-                ...(secrets.length > 0 ? { context: secrets.join(', ') } : {}),
+                ...(context.length > 0 ? { context: context.join('; ') } : {}),
                 fix: [
-                    ...secrets.map(secretFix),
-                    ...commands.map(({ cli, login }) => `install ${cli}${login ? ` and run ${login}` : ''}`),
+                    ...sourceSecretFixes(name, secrets, (0, launch_files_js_1.mamaCommand)((0, node_path_1.dirname)(configPath)), false),
+                    ...missing.map(({ shellPath, install, login }) => shellPath === null
+                        ? `install it: ${install.join(' or ')}; then log in: ${login}`
+                        : `mama service install adds ${(0, node_path_1.dirname)(shellPath)} to start.sh's PATH, mama service restart applies it; then log in: ${login}`),
                 ].join('; '),
             });
             continue;
@@ -702,6 +755,9 @@ async function sourceChecks(config, configPath, servicePath, locate, secret, sta
                         status: 'fail',
                         detail: 'does not start; boot stops at the connectors stage',
                         context: message(error),
+                        // The tool is on the service's PATH here, so a source that runs one most often
+                        // lacks its sign-in or a scope (Calendar's read check).
+                        ...(tools.length > 0 ? { fix: tools.map(({ login }) => login).join('; ') } : {}),
                     };
                     return;
                 }
@@ -710,10 +766,10 @@ async function sourceChecks(config, configPath, servicePath, locate, secret, sta
                         name: `source ${name}`,
                         status: 'fail',
                         detail: 'starts, but its credentials or sign-in are refused, so its polls fail',
-                        fix: needs
-                            .map((need) => need.cliAuthCommand ?? (need.tokenName ? secretFix(need.tokenName) : ''))
-                            .filter(Boolean)
-                            .join('; ') || undefined,
+                        fix: [
+                            ...tools.map(({ login }) => login),
+                            ...sourceSecretFixes(name, secretNames(needs), (0, launch_files_js_1.mamaCommand)((0, node_path_1.dirname)(configPath)), true),
+                        ].join('; ') || undefined,
                     };
                 }
             }));
@@ -745,6 +801,17 @@ function bounded(ms, run) {
         }),
     ]).finally(() => clearTimeout(timer));
 }
+/** The environment start.sh gives the daemon: auth.env, then its own exports, then its PATH. */
+function serviceEnvironment(home, auth, exports, path) {
+    return {
+        HOME: home,
+        USER: process.env.USER,
+        LOGNAME: process.env.LOGNAME,
+        ...auth,
+        ...exports,
+        PATH: path.join(':'),
+    };
+}
 /** Run with process.env as the daemon's process has it, then put this shell's back. */
 async function withEnvironment(env, run) {
     const saved = { ...process.env };
@@ -903,6 +970,126 @@ async function daemonChecks(ask, port, host, portInUse) {
     }
     return checks;
 }
+/**
+ * An unfinished `mama update --node` (docs/development/work/install.md, "Moving the managed
+ * Node"): its journal, which the install command finishes or undoes. It holds the install on
+ * update.hold, so it comes before the hold's own check.
+ */
+function nodeMoveCheck(root) {
+    const path = (0, node_move_journal_js_1.nodeMovePlaces)(root).journal;
+    let journal;
+    try {
+        journal = (0, node_move_journal_js_1.readNodeMoveJournal)(path);
+    }
+    catch (error) {
+        return {
+            name: 'update',
+            status: 'fail',
+            detail: 'an unfinished move of the managed Node left a journal that cannot be read',
+            code: 'node_move.open',
+            context: message(error),
+            fix: `read ${path}; the install command's recovery needs it`,
+        };
+    }
+    if (journal === null)
+        return null;
+    return {
+        name: 'update',
+        status: 'fail',
+        detail: journal.phase === 'committed'
+            ? `the move of the managed Node to ${journal.to} took effect, but its old folders are not removed yet`
+            : `the move of the managed Node from ${journal.from} to ${journal.to} is unfinished (step ${journal.step}); the daemon may stay stopped until it is finished or undone`,
+        code: 'node_move.open',
+        context: path,
+        fix: `run the install command again, which finishes or undoes it: ${node_move_journal_js_1.INSTALL_COMMAND}`,
+    };
+}
+/**
+ * An unfinished `mama update`: its journal (docs/development/work/update.md, PR 3), with the
+ * command that resolves it by absolute paths, or a staging prefix an updater killed before it
+ * wrote its journal left behind.
+ */
+function updateChecks(root, home) {
+    const move = nodeMoveCheck(root);
+    if (move !== null)
+        return [move];
+    const path = (0, update_journal_js_1.updatePaths)(root).journal;
+    let journal;
+    try {
+        journal = (0, update_journal_js_1.readUpdateJournal)(path);
+    }
+    catch (error) {
+        return [
+            {
+                name: 'update',
+                status: 'fail',
+                detail: 'an unfinished update left a journal that cannot be read',
+                code: 'update.open',
+                context: message(error),
+                fix: `read ${path}; mama update --rollback needs it`,
+            },
+        ];
+    }
+    if (journal !== null) {
+        return [
+            {
+                name: 'update',
+                status: 'fail',
+                detail: journal.phase === 'committed'
+                    ? `the update to ${journal.to} took effect, but it was not finished: its inputs may stay held, and nothing runs until the command below finishes it`
+                    : `the update from ${journal.from} to ${journal.to} is unfinished (${journal.phase}, step ${journal.step}); the daemon stays stopped or held until it is resolved`,
+                code: 'update.open',
+                fix: (0, update_journal_js_1.rollbackCommand)(journal),
+            },
+        ];
+    }
+    const hold = (0, update_journal_js_1.updatePaths)(root).hold;
+    if ((0, node_fs_1.existsSync)(hold)) {
+        return [
+            {
+                name: 'update',
+                status: 'fail',
+                detail: 'an update hold file is in place with no update journal; start.sh exits at once, so the daemon does not start',
+                code: 'update.hold',
+                context: hold,
+                fix: `rm ${hold}, then mama service start`,
+            },
+        ];
+    }
+    const install = (0, install_kind_js_1.installKind)(root, home);
+    const staging = install.kind === 'npm' ? (0, update_journal_js_1.leftoverStaging)((0, node_path_1.dirname)(install.packageRoot)) : [];
+    return staging.length === 0
+        ? []
+        : [
+            {
+                name: 'update',
+                status: 'warn',
+                detail: 'an interrupted mama update left its staging folder; the install runs as before',
+                code: 'update.staging',
+                context: staging.join(', '),
+                fix: 'the next mama update removes it',
+            },
+        ];
+}
+/** The daemon's last daily release check, from its file; doctor itself asks no registry. */
+function releaseCheck(root, home) {
+    const report = (0, release_check_js_1.releaseReport)(root, home);
+    if (report === null) {
+        return {
+            name: 'release',
+            status: 'ok',
+            detail: 'not checked yet; the running daemon checks once a day',
+        };
+    }
+    return {
+        name: 'release',
+        status: report.status,
+        detail: report.detail,
+        ...(report.context === undefined ? {} : { context: report.context }),
+        ...(report.steps === undefined ? {} : { fix: report.steps.join('; then ') }),
+        ...(report.fix === undefined ? {} : { fix: report.fix }),
+    };
+}
 function serviceCheck(platform, home, serviceRun) {
     let launchd;
     let unit;