@ouro.bot/cli 0.1.0-alpha.28 → 0.1.0-alpha.281

package/dist/heart/turn-coordinator.js

@@ -1,7 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createTurnCoordinator = createTurnCoordinator;
+exports.withSharedTurnLock = withSharedTurnLock;
+exports.tryBeginSharedTurn = tryBeginSharedTurn;
+exports.endSharedTurn = endSharedTurn;
+exports.isSharedTurnActive = isSharedTurnActive;
+exports.enqueueSharedFollowUp = enqueueSharedFollowUp;
+exports.drainSharedFollowUps = drainSharedFollowUps;
 const runtime_1 = require("../nerves/runtime");
+function scopedKey(scope, key) {
+    return `${scope}:${key}`;
+}
 function createTurnCoordinator() {
     const turnLocks = new Map();
     const activeTurns = new Set();
@@ -60,3 +69,22 @@ function createTurnCoordinator() {
         },
     };
 }
+const _sharedTurnCoordinator = createTurnCoordinator();
+function withSharedTurnLock(scope, key, fn) {
+    return _sharedTurnCoordinator.withTurnLock(scopedKey(scope, key), fn);
+}
+function tryBeginSharedTurn(scope, key) {
+    return _sharedTurnCoordinator.tryBeginTurn(scopedKey(scope, key));
+}
+function endSharedTurn(scope, key) {
+    _sharedTurnCoordinator.endTurn(scopedKey(scope, key));
+}
+function isSharedTurnActive(scope, key) {
+    return _sharedTurnCoordinator.isTurnActive(scopedKey(scope, key));
+}
+function enqueueSharedFollowUp(scope, key, followUp) {
+    _sharedTurnCoordinator.enqueueFollowUp(scopedKey(scope, key), followUp);
+}
+function drainSharedFollowUps(scope, key) {
+    return _sharedTurnCoordinator.drainFollowUps(scopedKey(scope, key));
+}

package/dist/heart/versioning/ouro-bot-global-installer.js

@@ -0,0 +1,128 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncGlobalOuroBotWrapper = syncGlobalOuroBotWrapper;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const runtime_metadata_1 = require("../daemon/runtime-metadata");
+function normalizeOutput(output) {
+    return (typeof output === "string" ? output : output.toString("utf-8")).trim();
+}
+function resolveGlobalPrefix(execFileSyncImpl) {
+    return normalizeOutput(execFileSyncImpl("npm", ["prefix", "-g"], { encoding: "utf-8" }));
+}
+function resolveGlobalRoot(execFileSyncImpl) {
+    return normalizeOutput(execFileSyncImpl("npm", ["root", "-g"], { encoding: "utf-8" }));
+}
+function readInstalledWrapperVersion(globalRoot, existsSyncImpl, readFileSyncImpl) {
+    const packageJsonPath = path.join(globalRoot, "ouro.bot", "package.json");
+    if (!existsSyncImpl(packageJsonPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSyncImpl(packageJsonPath, "utf-8"));
+        return typeof parsed.version === "string" && parsed.version.trim().length > 0 ? parsed.version.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveExecutableOwner(globalPrefix, platform, existsSyncImpl, realpathSyncImpl) {
+    const binName = platform === "win32" ? "ouro.bot.cmd" : "ouro.bot";
+    const binPath = platform === "win32"
+        ? path.join(globalPrefix, binName)
+        : path.join(globalPrefix, "bin", binName);
+    if (!existsSyncImpl(binPath))
+        return null;
+    try {
+        const resolved = realpathSyncImpl(binPath);
+        if (resolved.includes(`${path.sep}node_modules${path.sep}ouro.bot${path.sep}`))
+            return "wrapper";
+        if (resolved.includes(`${path.sep}node_modules${path.sep}@ouro.bot${path.sep}cli${path.sep}`))
+            return "cli";
+        return "other";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function syncGlobalOuroBotWrapper(deps = {}) {
+    /* v8 ignore start -- dependency-injection defaults are only exercised in the live runtime */
+    const execFileSyncImpl = deps.execFileSync ?? child_process_1.execFileSync;
+    const existsSyncImpl = deps.existsSync ?? fs.existsSync;
+    const readFileSyncImpl = deps.readFileSync ?? fs.readFileSync;
+    const realpathSyncImpl = deps.realpathSync ?? fs.realpathSync;
+    const runtimeVersion = deps.runtimeVersion ?? (0, runtime_metadata_1.getRuntimeMetadata)().version;
+    const platform = deps.platform ?? process.platform;
+    /* v8 ignore stop */
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.ouro_bot_global_sync_start",
+        message: "checking global ouro.bot wrapper",
+        meta: { version: runtimeVersion },
+    });
+    const globalPrefix = resolveGlobalPrefix(execFileSyncImpl);
+    const globalRoot = resolveGlobalRoot(execFileSyncImpl);
+    const installedVersion = readInstalledWrapperVersion(globalRoot, existsSyncImpl, readFileSyncImpl);
+    const executableOwner = resolveExecutableOwner(globalPrefix, platform, existsSyncImpl, realpathSyncImpl);
+    if (executableOwner === "wrapper") {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.ouro_bot_global_sync_end",
+            message: "global ouro.bot wrapper already current",
+            meta: { version: runtimeVersion, installedVersion, executableOwner, installed: false },
+        });
+        return {
+            installed: false,
+            version: runtimeVersion,
+            installedVersion,
+            executableOwner,
+        };
+    }
+    execFileSyncImpl("npm", ["install", "-g", "--force", "ouro.bot@latest"], { stdio: "pipe", encoding: "utf-8" });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.ouro_bot_global_sync_end",
+        message: "global ouro.bot wrapper synced",
+        meta: { version: runtimeVersion, installedVersion, executableOwner, installed: true },
+    });
+    return {
+        installed: true,
+        version: runtimeVersion,
+        installedVersion,
+        executableOwner,
+    };
+}

package/dist/heart/{daemon → versioning}/ouro-bot-wrapper.js

@@ -35,7 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runOuroBotWrapper = runOuroBotWrapper;
 const runtime_1 = require("../../nerves/runtime");
-const daemon_cli_1 = require("./daemon-cli");
+const daemon_cli_1 = require("../daemon/daemon-cli");
 async function defaultLoadCanonicalRunner() {
     // Use the subpath export so we get the daemon-cli module directly,
     // NOT the root entry point which has side-effects (immediately runs the CLI).

package/dist/heart/{daemon → versioning}/ouro-path-installer.js

@@ -38,10 +38,30 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
-const CLI_PACKAGE_SPECIFIER = "@ouro.bot/cli@alpha";
 const WRAPPER_SCRIPT = `#!/bin/sh
-exec npx --yes ${CLI_PACKAGE_SPECIFIER} "$@"
+# Check for dev mode — if dev-config.json exists, dispatch to the dev repo
+# Skip dev dispatch for "up" command (explicitly returns to production)
+DEV_CONFIG="$HOME/.ouro-cli/dev-config.json"
+if [ -f "$DEV_CONFIG" ] && [ "$1" != "up" ]; then
+  DEV_REPO=$(node -e "try{console.log(JSON.parse(require('fs').readFileSync('$DEV_CONFIG','utf-8')).repoPath)}catch{}" 2>/dev/null)
+  DEV_ENTRY="$DEV_REPO/dist/heart/daemon/ouro-entry.js"
+  if [ -n "$DEV_REPO" ] && [ -e "$DEV_ENTRY" ]; then
+    exec node "$DEV_ENTRY" "$@"
+  fi
+fi
+# Fall back to installed version
+ENTRY="$HOME/.ouro-cli/CurrentVersion/node_modules/@ouro.bot/cli/dist/heart/daemon/ouro-entry.js"
+if [ ! -e "$ENTRY" ]; then
+  echo "ouro not installed. Run: npx ouro.bot" >&2
+  exit 1
+fi
+exec node "$ENTRY" "$@"
 `;
+function writeWrapperScript(scriptPath, mkdirSync, writeFileSync, chmodSync) {
+    mkdirSync(path.dirname(scriptPath), { recursive: true });
+    writeFileSync(scriptPath, WRAPPER_SCRIPT, { mode: 0o755 });
+    chmodSync(scriptPath, 0o755);
+}
 function detectShellProfile(homeDir, shell) {
     if (!shell)
         return null;
@@ -67,6 +87,16 @@ function buildPathExportLine(binDir, shell) {
     }
     return `\n# Added by ouro\nexport PATH="${binDir}:$PATH"\n`;
 }
+function isWrapperCurrent(scriptPath, existsSync, readFileSync) {
+    if (!existsSync(scriptPath))
+        return false;
+    try {
+        return readFileSync(scriptPath, "utf-8") === WRAPPER_SCRIPT;
+    }
+    catch {
+        return false;
+    }
+}
 function installOuroCommand(deps = {}) {
     /* v8 ignore start -- dep defaults: only used in real runtime, tests always inject @preserve */
     const platform = deps.platform ?? process.platform;
@@ -87,46 +117,59 @@ function installOuroCommand(deps = {}) {
             message: "skipped ouro PATH install on Windows",
             meta: { platform },
         });
-        return { installed: false, scriptPath: null, pathReady: false, shellProfileUpdated: null, skippedReason: "windows" };
+        return { installed: false, scriptPath: null, pathReady: false, shellProfileUpdated: null, skippedReason: "windows", repairedOldLauncher: false };
+    }
+    // Ensure ~/.ouro-cli/ directory layout exists
+    if (deps.ensureCliLayout) {
+        deps.ensureCliLayout();
     }
-    const binDir = path.join(homeDir, ".local", "bin");
+    const binDir = path.join(homeDir, ".ouro-cli", "bin");
     const scriptPath = path.join(binDir, "ouro");
-    (0, runtime_1.emitNervesEvent)({
-        component: "daemon",
-        event: "daemon.ouro_path_install_start",
-        message: "installing ouro command to PATH",
-        meta: { scriptPath, binDir },
-    });
-    // If ouro already exists, check content and repair if stale
-    if (existsSync(scriptPath)) {
-        let existingContent = "";
+    const oldScriptPath = path.join(homeDir, ".local", "bin", "ouro");
+    const modernCurrent = isWrapperCurrent(scriptPath, existsSync, readFileSync);
+    const oldExists = existsSync(oldScriptPath);
+    const oldCurrent = oldExists && isWrapperCurrent(oldScriptPath, existsSync, readFileSync);
+    // ── Repair old ~/.local/bin/ouro launcher ──
+    // If the old launcher exists with stale content it can shadow the modern
+    // path and cause the wrong CLI version to run.  Overwrite it with the
+    // current wrapper so both paths resolve to ~/.ouro-cli/CurrentVersion.
+    let repairedOldLauncher = false;
+    if (oldExists && !oldCurrent) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.ouro_path_repair_old",
+            message: "repairing stale old launcher at ~/.local/bin/ouro",
+            meta: { oldScriptPath },
+        });
         try {
-            existingContent = readFileSync(scriptPath, "utf-8");
+            writeFileSync(oldScriptPath, WRAPPER_SCRIPT, { mode: 0o755 });
+            chmodSync(oldScriptPath, 0o755);
+            repairedOldLauncher = true;
         }
         catch {
-            // Can't read — treat as stale, will overwrite below
-        }
-        if (existingContent === WRAPPER_SCRIPT) {
-            (0, runtime_1.emitNervesEvent)({
-                component: "daemon",
-                event: "daemon.ouro_path_install_skip",
-                message: "ouro command already installed",
-                meta: { scriptPath },
-            });
-            return { installed: false, scriptPath, pathReady: isBinDirInPath(binDir, envPath), shellProfileUpdated: null, skippedReason: "already-installed" };
+            // Best effort — old launcher repair failure must not block modern install
         }
-        // Content is stale — repair by overwriting
+    }
+    // ── Fast-path: modern wrapper already current ──
+    if (modernCurrent) {
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
-            event: "daemon.ouro_path_install_repair",
-            message: "repairing stale ouro wrapper script",
+            event: "daemon.ouro_path_install_skip",
+            message: "ouro command already installed",
             meta: { scriptPath },
         });
+        return { installed: false, scriptPath, pathReady: isBinDirInPath(binDir, envPath), shellProfileUpdated: null, skippedReason: "already-installed", repairedOldLauncher };
     }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.ouro_path_install_start",
+        message: existsSync(scriptPath) ? "repairing stale ouro wrapper script" : "installing ouro command to PATH",
+        meta: { scriptPath, binDir },
+    });
     try {
-        mkdirSync(binDir, { recursive: true });
-        writeFileSync(scriptPath, WRAPPER_SCRIPT, { mode: 0o755 });
-        chmodSync(scriptPath, 0o755);
+        if (!modernCurrent) {
+            writeWrapperScript(scriptPath, mkdirSync, writeFileSync, chmodSync);
+        }
     }
     catch (error) {
         (0, runtime_1.emitNervesEvent)({
@@ -136,11 +179,11 @@ function installOuroCommand(deps = {}) {
             message: "failed to install ouro command",
             meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
         });
-        return { installed: false, scriptPath: null, pathReady: false, shellProfileUpdated: null, skippedReason: error instanceof Error ? error.message : /* v8 ignore next -- defensive @preserve */ String(error) };
+        return { installed: false, scriptPath: null, pathReady: false, shellProfileUpdated: null, skippedReason: error instanceof Error ? error.message : /* v8 ignore next -- defensive @preserve */ String(error), repairedOldLauncher };
     }
-    // Check if ~/.local/bin is already in PATH
-    let shellProfileUpdated = null;
+    // Check if ~/.ouro-cli/bin is already in PATH
     const pathReady = isBinDirInPath(binDir, envPath);
+    let shellProfileUpdated = null;
     if (!pathReady) {
         const profilePath = detectShellProfile(homeDir, shell);
         if (profilePath) {
@@ -172,7 +215,7 @@ function installOuroCommand(deps = {}) {
         component: "daemon",
         event: "daemon.ouro_path_install_end",
         message: "ouro command installed",
-        meta: { scriptPath, pathReady, shellProfileUpdated },
+        meta: { scriptPath, pathReady, shellProfileUpdated, oldScriptPath: oldExists ? oldScriptPath : null },
     });
-    return { installed: true, scriptPath, pathReady, shellProfileUpdated };
+    return { installed: true, scriptPath, pathReady, shellProfileUpdated, repairedOldLauncher };
 }

package/dist/heart/versioning/ouro-version-manager.js

@@ -0,0 +1,295 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RETAIN_VERSIONS = void 0;
+exports.getOuroCliHome = getOuroCliHome;
+exports.getCurrentVersion = getCurrentVersion;
+exports.getPreviousVersion = getPreviousVersion;
+exports.buildChangelogCommand = buildChangelogCommand;
+exports.listInstalledVersions = listInstalledVersions;
+exports.installVersion = installVersion;
+exports.activateVersion = activateVersion;
+exports.compareCliVersions = compareCliVersions;
+exports.selectVersionsToPrune = selectVersionsToPrune;
+exports.pruneOldVersions = pruneOldVersions;
+exports.ensureLayout = ensureLayout;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+/** Maximum number of installed CLI versions to retain after pruning. */
+exports.DEFAULT_RETAIN_VERSIONS = 5;
+function getOuroCliHome(homeDir) {
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const home = homeDir ?? os.homedir();
+    return path.join(home, ".ouro-cli");
+}
+function getCurrentVersion(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    try {
+        const target = readlinkSync(path.join(cliHome, "CurrentVersion"));
+        return path.basename(target);
+    }
+    catch {
+        return null;
+    }
+}
+function getPreviousVersion(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    try {
+        const target = readlinkSync(path.join(cliHome, "previous"));
+        return path.basename(target);
+    }
+    catch {
+        return null;
+    }
+}
+function buildChangelogCommand(previousVersion, currentVersion) {
+    if (!previousVersion || !currentVersion || previousVersion === currentVersion) {
+        return null;
+    }
+    return `ouro changelog --from ${previousVersion}`;
+}
+function listInstalledVersions(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    try {
+        const entries = readdirSync(path.join(cliHome, "versions"), { withFileTypes: true });
+        return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+    }
+    catch {
+        return [];
+    }
+}
+function installVersion(version, deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    const execSync = deps.execSync ?? ((cmd, opts) => require("child_process").execSync(cmd, opts));
+    /* v8 ignore stop */
+    const versionDir = path.join(cliHome, "versions", version);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_install_start",
+        message: "installing CLI version",
+        meta: { version, versionDir },
+    });
+    mkdirSync(versionDir, { recursive: true });
+    execSync(`npm install --prefix ${versionDir} @ouro.bot/cli@${version}`, { stdio: "pipe" });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_install_end",
+        message: "CLI version installed",
+        meta: { version, versionDir },
+    });
+}
+function activateVersion(version, deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
+    const symlinkSync = deps.symlinkSync ?? fs.symlinkSync;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    /* v8 ignore stop */
+    const currentVersionPath = path.join(cliHome, "CurrentVersion");
+    const previousPath = path.join(cliHome, "previous");
+    const newTarget = path.join(cliHome, "versions", version);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_activate",
+        message: "activating CLI version",
+        meta: { version },
+    });
+    // Read old CurrentVersion target (may not exist)
+    let oldTarget = null;
+    try {
+        oldTarget = readlinkSync(currentVersionPath);
+    }
+    catch {
+        // No current version — first install
+    }
+    // Update previous symlink to point to old current
+    if (oldTarget) {
+        try {
+            unlinkSync(previousPath);
+        }
+        catch {
+            // previous symlink may not exist yet
+        }
+        symlinkSync(oldTarget, previousPath);
+    }
+    // Update CurrentVersion symlink
+    if (existsSync(currentVersionPath)) {
+        unlinkSync(currentVersionPath);
+    }
+    symlinkSync(newTarget, currentVersionPath);
+}
+/**
+ * Compare two version strings of the form `0.1.0-alpha.{n}`. Returns
+ * positive when `a` is newer, negative when `b` is newer, 0 when equal.
+ *
+ * The harness only ships `0.1.0-alpha.{n}` versions today; this comparator
+ * extracts the numeric tail and falls back to a lexicographic compare for
+ * any version that doesn't match the pattern (so unexpected version
+ * formats sort consistently rather than throwing).
+ */
+function compareCliVersions(a, b) {
+    const aMatch = /alpha\.(\d+)/.exec(a);
+    const bMatch = /alpha\.(\d+)/.exec(b);
+    if (aMatch && bMatch) {
+        const aN = parseInt(aMatch[1], 10);
+        const bN = parseInt(bMatch[1], 10);
+        return aN - bN;
+    }
+    // Fallback: lexicographic. Both-mismatched and one-mismatched cases land
+    // here. Predictable, even if not strictly semver-correct.
+    if (a < b)
+        return -1;
+    if (a > b)
+        return 1;
+    return 0;
+}
+/**
+ * Identify which installed CLI versions can be safely deleted, given a
+ * retention policy. Pure: takes the full version list and the protected
+ * (current/previous) versions, returns the versions to delete.
+ *
+ * Retention rules:
+ *   - Always keep the N most recent versions (default 5).
+ *   - Always keep the currently-active version (CurrentVersion symlink target).
+ *   - Always keep the previous version (previous symlink target) so rollback
+ *     stays one command away.
+ *   - Delete everything else.
+ *
+ * Exported so tests can pin the policy without shelling out to a real fs.
+ */
+function selectVersionsToPrune(installedVersions, protectedVersions, retain = exports.DEFAULT_RETAIN_VERSIONS) {
+    if (installedVersions.length <= retain)
+        return [];
+    const sorted = [...installedVersions].sort(compareCliVersions).reverse();
+    const keepers = new Set(sorted.slice(0, retain));
+    if (protectedVersions.current)
+        keepers.add(protectedVersions.current);
+    if (protectedVersions.previous)
+        keepers.add(protectedVersions.previous);
+    return installedVersions.filter((v) => !keepers.has(v));
+}
+/**
+ * Prune installed CLI versions according to the retention policy. Removes
+ * `~/.ouro-cli/versions/{version}/` directories for versions outside the
+ * retention window. Best-effort: per-version delete failures are logged
+ * via nerves but don't propagate.
+ *
+ * Called from the activate path (cli-defaults.ts) so that every successful
+ * `ouro up` self-prunes. The user observed `~/.ouro-cli/versions/` going
+ * back to alpha.85 from March 20 — every CLI version they'd ever installed
+ * was still on disk because nothing ever GCed.
+ */
+function pruneOldVersions(retain = exports.DEFAULT_RETAIN_VERSIONS, deps = {}) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    const rmSync = deps.rmSync ?? fs.rmSync;
+    /* v8 ignore stop */
+    const versionsDir = path.join(cliHome, "versions");
+    let installed;
+    try {
+        installed = readdirSync(versionsDir, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name);
+    }
+    catch {
+        return { kept: [], deleted: [], failed: [] };
+    }
+    const current = (() => {
+        try {
+            return path.basename(readlinkSync(path.join(cliHome, "CurrentVersion")));
+        }
+        catch {
+            return null;
+        }
+    })();
+    const previous = (() => {
+        try {
+            return path.basename(readlinkSync(path.join(cliHome, "previous")));
+        }
+        catch {
+            return null;
+        }
+    })();
+    const toDelete = selectVersionsToPrune(installed, { current, previous }, retain);
+    const deleted = [];
+    const failed = [];
+    for (const version of toDelete) {
+        const versionDir = path.join(versionsDir, version);
+        try {
+            rmSync(versionDir, { recursive: true, force: true });
+            deleted.push(version);
+        }
+        catch (error) {
+            failed.push({
+                version,
+                error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error),
+            });
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_versions_pruned",
+        message: `pruned ${deleted.length} old CLI versions`,
+        meta: { retain, deleted, failed: failed.length, kept: installed.filter((v) => !deleted.includes(v)) },
+    });
+    return { kept: installed.filter((v) => !deleted.includes(v)), deleted, failed };
+}
+function ensureLayout(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    mkdirSync(cliHome, { recursive: true });
+    mkdirSync(path.join(cliHome, "bin"), { recursive: true });
+    mkdirSync(path.join(cliHome, "versions"), { recursive: true });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_layout_ensured",
+        message: "CLI directory layout ensured",
+        meta: { cliHome },
+    });
+}