@ouro.bot/cli 0.1.0-alpha.65 → 0.1.0-alpha.650

package/dist/heart/versioning/ouro-version-manager.js

@@ -0,0 +1,409 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RETAIN_VERSIONS = void 0;
+exports.getOuroCliHome = getOuroCliHome;
+exports.getCurrentVersion = getCurrentVersion;
+exports.getPreviousVersion = getPreviousVersion;
+exports.buildChangelogCommand = buildChangelogCommand;
+exports.listInstalledVersions = listInstalledVersions;
+exports.validateInstalledVersionForActivation = validateInstalledVersionForActivation;
+exports.installVersion = installVersion;
+exports.activateVersion = activateVersion;
+exports.compareCliVersions = compareCliVersions;
+exports.selectVersionsToPrune = selectVersionsToPrune;
+exports.pruneOldVersions = pruneOldVersions;
+exports.ensureLayout = ensureLayout;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+/** Maximum number of installed CLI versions to retain after pruning. */
+exports.DEFAULT_RETAIN_VERSIONS = 5;
+const INSTALLED_RUNTIME_PACKAGE_PAYLOAD_PATHS = [
+    "assets",
+    "dist",
+    "RepairGuide.ouro",
+    "SerpentGuide.ouro",
+    "skills",
+    "changelog.json",
+    "package.json",
+];
+const INSTALLED_RUNTIME_TEXT_EXTENSIONS = new Set([
+    ".cjs",
+    ".css",
+    ".html",
+    ".js",
+    ".json",
+    ".md",
+    ".mjs",
+    ".txt",
+]);
+const BLOCKED_INSTALLED_RUNTIME_TEXT_SIGNATURES = [
+    {
+        label: "removed BlueBubbles timeout notice",
+        base64: "bGl2ZSBpTWVzc2FnZSB0dXJuIHRpbWVkIG91dDsgSSBjYXB0dXJlZCBpdCBmb3IgcmVjb3ZlcnkgaW5zdGVhZCBvZiBzaWxlbnRseSBoYW5naW5n",
+    },
+];
+function getOuroCliHome(homeDir) {
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const home = homeDir ?? os.homedir();
+    return path.join(home, ".ouro-cli");
+}
+function getCurrentVersion(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    try {
+        const target = readlinkSync(path.join(cliHome, "CurrentVersion"));
+        return path.basename(target);
+    }
+    catch {
+        return null;
+    }
+}
+function getPreviousVersion(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    try {
+        const target = readlinkSync(path.join(cliHome, "previous"));
+        return path.basename(target);
+    }
+    catch {
+        return null;
+    }
+}
+function buildChangelogCommand(previousVersion, currentVersion) {
+    if (!previousVersion || !currentVersion || previousVersion === currentVersion) {
+        return null;
+    }
+    return `ouro changelog --from ${previousVersion}`;
+}
+function listInstalledVersions(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    try {
+        const entries = readdirSync(path.join(cliHome, "versions"), { withFileTypes: true });
+        return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+    }
+    catch {
+        return [];
+    }
+}
+function validateInstalledVersionForActivation(version, deps = {}) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests inject @preserve */
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
+    /* v8 ignore stop */
+    const packageRoot = path.join(cliHome, "versions", version, "node_modules", "@ouro.bot", "cli");
+    const packageJsonPath = path.join(packageRoot, "package.json");
+    if (!existsSync(packageJsonPath)) {
+        const message = `installed runtime ${version} is missing its @ouro.bot/cli package; run 'ouro up' to restore the current release`;
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.cli_version_activation_blocked",
+            message: "blocked CLI version activation",
+            meta: { version, packageRoot, reason: "missing-package" },
+            level: "warn",
+        });
+        return { ok: false, version, packageRoot, violations: ["missing @ouro.bot/cli package"], message };
+    }
+    const violations = findBlockedInstalledRuntimePayloadText(packageRoot, { existsSync, readdirSync, readFileSync });
+    if (violations.length === 0) {
+        return { ok: true, version, packageRoot, violations, message: "installed runtime package passed activation guard" };
+    }
+    const message = `installed runtime ${version} contains blocked package assets (${violations.join(", ")}); run 'ouro up' to stay on the current release`;
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_activation_blocked",
+        message: "blocked CLI version activation",
+        meta: { version, packageRoot, reason: "blocked-package-assets", violations },
+        level: "warn",
+    });
+    return { ok: false, version, packageRoot, violations, message };
+}
+function findBlockedInstalledRuntimePayloadText(packageRoot, deps) {
+    const violations = [];
+    const blockedText = BLOCKED_INSTALLED_RUNTIME_TEXT_SIGNATURES.map((signature) => ({
+        label: signature.label,
+        text: Buffer.from(signature.base64, "base64").toString("utf8"),
+    }));
+    for (const payloadPath of INSTALLED_RUNTIME_PACKAGE_PAYLOAD_PATHS) {
+        const absolutePath = path.join(packageRoot, payloadPath);
+        if (!deps.existsSync(absolutePath))
+            continue;
+        collectBlockedTextViolations(packageRoot, absolutePath, payloadPath, blockedText, deps, violations);
+    }
+    return violations.sort();
+}
+function collectBlockedTextViolations(packageRoot, absolutePath, relativePath, blockedText, deps, violations) {
+    let entries = null;
+    try {
+        entries = deps.readdirSync(absolutePath, { withFileTypes: true });
+    }
+    catch {
+        entries = null;
+    }
+    if (entries !== null) {
+        for (const entry of entries) {
+            const childRelativePath = `${relativePath}/${entry.name}`;
+            if (entry.isDirectory()) {
+                collectBlockedTextViolations(packageRoot, path.join(absolutePath, entry.name), childRelativePath, blockedText, deps, violations);
+            }
+            else if (entry.isFile()) {
+                inspectInstalledRuntimePayloadFile(packageRoot, childRelativePath, blockedText, deps, violations);
+            }
+        }
+        return;
+    }
+    inspectInstalledRuntimePayloadFile(packageRoot, relativePath, blockedText, deps, violations);
+}
+function inspectInstalledRuntimePayloadFile(packageRoot, relativePath, blockedText, deps, violations) {
+    if (!INSTALLED_RUNTIME_TEXT_EXTENSIONS.has(path.extname(relativePath)))
+        return;
+    let content = "";
+    try {
+        content = deps.readFileSync(path.join(packageRoot, relativePath), "utf8");
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error);
+        violations.push(`${relativePath} could not be inspected: ${reason}`);
+        return;
+    }
+    for (const blocked of blockedText) {
+        if (content.includes(blocked.text)) {
+            violations.push(`${relativePath} contains ${blocked.label}`);
+        }
+    }
+}
+function installVersion(version, deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    const execSync = deps.execSync ?? ((cmd, opts) => require("child_process").execSync(cmd, opts));
+    /* v8 ignore stop */
+    const versionDir = path.join(cliHome, "versions", version);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_install_start",
+        message: "installing CLI version",
+        meta: { version, versionDir },
+    });
+    mkdirSync(versionDir, { recursive: true });
+    execSync(`npm install --prefix ${versionDir} @ouro.bot/cli@${version}`, { stdio: "pipe" });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_install_end",
+        message: "CLI version installed",
+        meta: { version, versionDir },
+    });
+}
+function activateVersion(version, deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
+    const symlinkSync = deps.symlinkSync ?? fs.symlinkSync;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    /* v8 ignore stop */
+    const currentVersionPath = path.join(cliHome, "CurrentVersion");
+    const previousPath = path.join(cliHome, "previous");
+    const newTarget = path.join(cliHome, "versions", version);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_activate",
+        message: "activating CLI version",
+        meta: { version },
+    });
+    // Read old CurrentVersion target (may not exist)
+    let oldTarget = null;
+    try {
+        oldTarget = readlinkSync(currentVersionPath);
+    }
+    catch {
+        // No current version — first install
+    }
+    // Update previous symlink to point to old current
+    if (oldTarget) {
+        try {
+            unlinkSync(previousPath);
+        }
+        catch {
+            // previous symlink may not exist yet
+        }
+        symlinkSync(oldTarget, previousPath);
+    }
+    // Update CurrentVersion symlink
+    if (existsSync(currentVersionPath)) {
+        unlinkSync(currentVersionPath);
+    }
+    symlinkSync(newTarget, currentVersionPath);
+}
+/**
+ * Compare two version strings of the form `0.1.0-alpha.{n}`. Returns
+ * positive when `a` is newer, negative when `b` is newer, 0 when equal.
+ *
+ * The harness only ships `0.1.0-alpha.{n}` versions today; this comparator
+ * extracts the numeric tail and falls back to a lexicographic compare for
+ * any version that doesn't match the pattern (so unexpected version
+ * formats sort consistently rather than throwing).
+ */
+function compareCliVersions(a, b) {
+    const aMatch = /alpha\.(\d+)/.exec(a);
+    const bMatch = /alpha\.(\d+)/.exec(b);
+    if (aMatch && bMatch) {
+        const aN = parseInt(aMatch[1], 10);
+        const bN = parseInt(bMatch[1], 10);
+        return aN - bN;
+    }
+    // Fallback: lexicographic. Both-mismatched and one-mismatched cases land
+    // here. Predictable, even if not strictly semver-correct.
+    if (a < b)
+        return -1;
+    if (a > b)
+        return 1;
+    return 0;
+}
+/**
+ * Identify which installed CLI versions can be safely deleted, given a
+ * retention policy. Pure: takes the full version list and the protected
+ * (current/previous) versions, returns the versions to delete.
+ *
+ * Retention rules:
+ *   - Always keep the N most recent versions (default 5).
+ *   - Always keep the currently-active version (CurrentVersion symlink target).
+ *   - Always keep the previous version (previous symlink target) so rollback
+ *     stays one command away.
+ *   - Delete everything else.
+ *
+ * Exported so tests can pin the policy without shelling out to a real fs.
+ */
+function selectVersionsToPrune(installedVersions, protectedVersions, retain = exports.DEFAULT_RETAIN_VERSIONS) {
+    if (installedVersions.length <= retain)
+        return [];
+    const sorted = [...installedVersions].sort(compareCliVersions).reverse();
+    const keepers = new Set(sorted.slice(0, retain));
+    if (protectedVersions.current)
+        keepers.add(protectedVersions.current);
+    if (protectedVersions.previous)
+        keepers.add(protectedVersions.previous);
+    return installedVersions.filter((v) => !keepers.has(v));
+}
+/**
+ * Prune installed CLI versions according to the retention policy. Removes
+ * `~/.ouro-cli/versions/{version}/` directories for versions outside the
+ * retention window. Best-effort: per-version delete failures are logged
+ * via nerves but don't propagate.
+ *
+ * Called from the activate path (cli-defaults.ts) so that every successful
+ * `ouro up` self-prunes. The user observed `~/.ouro-cli/versions/` going
+ * back to alpha.85 from March 20 — every CLI version they'd ever installed
+ * was still on disk because nothing ever GCed.
+ */
+function pruneOldVersions(retain = exports.DEFAULT_RETAIN_VERSIONS, deps = {}) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    const rmSync = deps.rmSync ?? fs.rmSync;
+    /* v8 ignore stop */
+    const versionsDir = path.join(cliHome, "versions");
+    let installed;
+    try {
+        installed = readdirSync(versionsDir, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name);
+    }
+    catch {
+        return { kept: [], deleted: [], failed: [] };
+    }
+    const current = (() => {
+        try {
+            return path.basename(readlinkSync(path.join(cliHome, "CurrentVersion")));
+        }
+        catch {
+            return null;
+        }
+    })();
+    const previous = (() => {
+        try {
+            return path.basename(readlinkSync(path.join(cliHome, "previous")));
+        }
+        catch {
+            return null;
+        }
+    })();
+    const toDelete = selectVersionsToPrune(installed, { current, previous }, retain);
+    const deleted = [];
+    const failed = [];
+    for (const version of toDelete) {
+        const versionDir = path.join(versionsDir, version);
+        try {
+            rmSync(versionDir, { recursive: true, force: true });
+            deleted.push(version);
+        }
+        catch (error) {
+            failed.push({
+                version,
+                error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error),
+            });
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_versions_pruned",
+        message: `pruned ${deleted.length} old CLI versions`,
+        meta: { retain, deleted, failed: failed.length, kept: installed.filter((v) => !deleted.includes(v)) },
+    });
+    return { kept: installed.filter((v) => !deleted.includes(v)), deleted, failed };
+}
+function ensureLayout(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    mkdirSync(cliHome, { recursive: true });
+    mkdirSync(path.join(cliHome, "bin"), { recursive: true });
+    mkdirSync(path.join(cliHome, "versions"), { recursive: true });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_layout_ensured",
+        message: "CLI directory layout ensured",
+        meta: { cliHome },
+    });
+}

package/dist/heart/{daemon → versioning}/staged-restart.js

@@ -45,14 +45,22 @@ async function performStagedRestart(version, deps) {
     });
     // Step 1: Install new version
     try {
-        deps.execSync(`npm install -g @ouro.bot/cli@${version}`);
+        if (deps.installNewVersion) {
+            deps.installNewVersion(version);
+        }
+        else {
+            // Backward-compat fallback for callers that haven't migrated to the
+            // version-managed installer. Tests use this path with a mocked
+            // execSync; production callers inject installNewVersion.
+            deps.execSync(`npm install -g @ouro.bot/cli@${version}`);
+        }
     }
     catch (err) {
         const errorMessage = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.staged_restart_install_failed",
-            message: "npm install failed",
+            message: "install failed",
             meta: { version, error: errorMessage },
         });
         return { ok: false, error: errorMessage };
@@ -90,25 +98,49 @@ async function performStagedRestart(version, deps) {
         });
         return { ok: false, error: `hook runner exited with code ${spawnResult.status}` };
     }
-    // Step 4: Graceful shutdown (launchd will restart with new code)
+    // Step 4: Graceful shutdown then self-spawn new daemon
+    // We can't rely on launchd KeepAlive — the plist may not be loaded.
+    // Instead: shut down (releases socket), spawn new daemon from updated code.
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.staged_restart_hooks_passed",
-        message: "hooks passed, shutting down for restart",
+        message: "hooks passed, shutting down and spawning new daemon",
         meta: { version },
     });
+    let shutdownError;
     try {
         await deps.gracefulShutdown();
     }
     catch (err) {
-        const shutdownError = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
+        shutdownError = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.staged_restart_shutdown_error",
-            message: "graceful shutdown encountered error",
+            message: "graceful shutdown encountered error (continuing with spawn)",
             meta: { version, error: shutdownError },
         });
-        return { ok: true, shutdownError };
     }
-    return { ok: true };
+    // Spawn new daemon from updated code path
+    const newEntry = path.join(newCodePath, "dist", "heart", "daemon", "daemon-entry.js");
+    const socketArg = deps.socketPath ?? "/tmp/ouroboros-daemon.sock";
+    try {
+        const { pid } = deps.spawnNewDaemon(newEntry, socketArg);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.staged_restart_spawned",
+            message: "new daemon spawned successfully",
+            meta: { version, pid, entry: newEntry },
+        });
+    }
+    catch (err) {
+        const spawnError = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.staged_restart_respawn_failed",
+            message: "failed to spawn new daemon after shutdown",
+            meta: { version, error: spawnError, entry: newEntry },
+        });
+        return { ok: false, error: `shutdown succeeded but failed to spawn new daemon: ${spawnError}`, shutdownError };
+    }
+    return { ok: true, shutdownError };
 }

package/dist/heart/{daemon → versioning}/update-checker.js

@@ -33,12 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLI_UPDATE_DIST_TAG = exports.CLI_UPDATE_CHECK_TIMEOUT_MS = void 0;
 exports.checkForUpdate = checkForUpdate;
 exports.startUpdateChecker = startUpdateChecker;
 exports.stopUpdateChecker = stopUpdateChecker;
 const semver = __importStar(require("semver"));
 const runtime_1 = require("../../nerves/runtime");
 const DEFAULT_INTERVAL_MS = 30 * 60 * 1000; // 30 minutes
+exports.CLI_UPDATE_CHECK_TIMEOUT_MS = 3_000;
+exports.CLI_UPDATE_DIST_TAG = "latest";
 async function checkForUpdate(currentVersion, deps) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -102,9 +105,11 @@ function stopUpdateChecker() {
         clearInterval(_intervalId);
         _intervalId = null;
     }
+    // `_end` (not `_stop`) to satisfy the nerves audit's start/end pairing
+    // rule — counterpart to `daemon.update_checker_start` above.
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
-        event: "daemon.update_checker_stop",
+        event: "daemon.update_checker_end",
         message: "stopping update checker",
         meta: {},
     });

package/dist/heart/versioning/update-hooks.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerUpdateHook = registerUpdateHook;
+exports.getRegisteredHooks = getRegisteredHooks;
+exports.clearRegisteredHooks = clearRegisteredHooks;
+exports.applyPendingUpdates = applyPendingUpdates;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const semver = __importStar(require("semver"));
+const runtime_1 = require("../../nerves/runtime");
+const _hooks = [];
+function registerUpdateHook(hook) {
+    _hooks.push(hook);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.update_hook_registered",
+        message: "registered update hook",
+        meta: {},
+    });
+}
+function getRegisteredHooks() {
+    return _hooks;
+}
+function clearRegisteredHooks() {
+    _hooks.length = 0;
+}
+function isNoAgentDefaultBundle(agentRoot, entryName) {
+    return entryName === "default.ouro" && !fs.existsSync(path.join(agentRoot, "agent.json"));
+}
+async function applyPendingUpdates(bundlesRoot, currentVersion) {
+    const summary = { updated: [] };
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.apply_pending_updates_start",
+        message: "applying pending updates",
+        meta: { bundlesRoot, currentVersion },
+    });
+    try {
+        if (!fs.existsSync(bundlesRoot)) {
+            return summary;
+        }
+        let entries;
+        try {
+            entries = fs.readdirSync(bundlesRoot, { withFileTypes: true });
+        }
+        catch {
+            return summary;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory() || !entry.name.endsWith(".ouro"))
+                continue;
+            const agentRoot = path.join(bundlesRoot, entry.name);
+            if (isNoAgentDefaultBundle(agentRoot, entry.name)) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "daemon",
+                    event: "daemon.update_hook_skip_no_agent_default",
+                    message: "skipping no-agent default bundle during pending updates",
+                    meta: { agentRoot },
+                });
+                continue;
+            }
+            let previousVersion;
+            const metaPath = path.join(agentRoot, "bundle-meta.json");
+            try {
+                if (fs.existsSync(metaPath)) {
+                    const raw = fs.readFileSync(metaPath, "utf-8");
+                    const meta = JSON.parse(raw);
+                    previousVersion = meta.runtimeVersion;
+                    if (previousVersion === currentVersion) {
+                        continue;
+                    }
+                    // Skip downgrades — only update forward
+                    if (semver.valid(previousVersion) && semver.valid(currentVersion) && semver.gte(previousVersion, currentVersion)) {
+                        (0, runtime_1.emitNervesEvent)({
+                            component: "daemon",
+                            event: "daemon.update_hook_skip_downgrade",
+                            message: "skipping downgrade",
+                            meta: { agentRoot, previousVersion, currentVersion },
+                        });
+                        continue;
+                    }
+                }
+            }
+            catch {
+                // Malformed or unreadable bundle-meta.json -- treat as needing update
+                previousVersion = undefined;
+            }
+            const ctx = { agentRoot, currentVersion, previousVersion };
+            for (const hook of _hooks) {
+                try {
+                    await hook(ctx);
+                }
+                catch (err) {
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "daemon",
+                        event: "daemon.update_hook_error",
+                        message: "update hook threw",
+                        meta: {
+                            agentRoot,
+                            error: err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err),
+                        },
+                    });
+                }
+            }
+            summary.updated.push({
+                agent: entry.name.replace(/\.ouro$/, ""),
+                from: previousVersion,
+                to: currentVersion,
+            });
+        }
+        return summary;
+    }
+    finally {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.apply_pending_updates_end",
+            message: "pending updates applied",
+            meta: { bundlesRoot },
+        });
+    }
+}