@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.921

package/dist/heart/versioning/ouro-version-manager.js

@@ -0,0 +1,432 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RETAIN_VERSIONS = void 0;
+exports.getOuroCliHome = getOuroCliHome;
+exports.getCurrentVersion = getCurrentVersion;
+exports.getPreviousVersion = getPreviousVersion;
+exports.buildChangelogCommand = buildChangelogCommand;
+exports.listInstalledVersions = listInstalledVersions;
+exports.validateInstalledVersionForActivation = validateInstalledVersionForActivation;
+exports.installVersion = installVersion;
+exports.activateVersion = activateVersion;
+exports.compareCliVersions = compareCliVersions;
+exports.selectVersionsToPrune = selectVersionsToPrune;
+exports.pruneOldVersions = pruneOldVersions;
+exports.ensureLayout = ensureLayout;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+/** Maximum number of installed CLI versions to retain after pruning. */
+exports.DEFAULT_RETAIN_VERSIONS = 5;
+const INSTALLED_RUNTIME_PACKAGE_PAYLOAD_PATHS = [
+    "assets",
+    "dist",
+    "RepairGuide.ouro",
+    "SerpentGuide.ouro",
+    "skills",
+    "changelog.json",
+    "package.json",
+];
+const INSTALLED_RUNTIME_TEXT_EXTENSIONS = new Set([
+    ".cjs",
+    ".css",
+    ".html",
+    ".js",
+    ".json",
+    ".md",
+    ".mjs",
+    ".txt",
+]);
+const BLOCKED_INSTALLED_RUNTIME_TEXT_SIGNATURES = [
+    {
+        label: "removed BlueBubbles timeout notice",
+        base64: "bGl2ZSBpTWVzc2FnZSB0dXJuIHRpbWVkIG91dDsgSSBjYXB0dXJlZCBpdCBmb3IgcmVjb3ZlcnkgaW5zdGVhZCBvZiBzaWxlbnRseSBoYW5naW5n",
+    },
+];
+function getOuroCliHome(homeDir) {
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const home = homeDir ?? os.homedir();
+    return path.join(home, ".ouro-cli");
+}
+function getCurrentVersion(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    try {
+        const target = readlinkSync(path.join(cliHome, "CurrentVersion"));
+        return path.basename(target);
+    }
+    catch {
+        return null;
+    }
+}
+function getPreviousVersion(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    try {
+        const target = readlinkSync(path.join(cliHome, "previous"));
+        return path.basename(target);
+    }
+    catch {
+        return null;
+    }
+}
+function buildChangelogCommand(previousVersion, currentVersion) {
+    if (!previousVersion || !currentVersion || previousVersion === currentVersion) {
+        return null;
+    }
+    return `ouro changelog --from ${previousVersion}`;
+}
+function listInstalledVersions(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    try {
+        const entries = readdirSync(path.join(cliHome, "versions"), { withFileTypes: true });
+        return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+    }
+    catch {
+        return [];
+    }
+}
+function validateInstalledVersionForActivation(version, deps = {}) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests inject @preserve */
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
+    /* v8 ignore stop */
+    const packageRoot = path.join(cliHome, "versions", version, "node_modules", "@ouro.bot", "cli");
+    const packageJsonPath = path.join(packageRoot, "package.json");
+    if (!existsSync(packageJsonPath)) {
+        const message = `installed runtime ${version} is missing its @ouro.bot/cli package; run 'ouro up' to restore the current release`;
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.cli_version_activation_blocked",
+            message: "blocked CLI version activation",
+            meta: { version, packageRoot, reason: "missing-package" },
+            level: "warn",
+        });
+        return { ok: false, version, packageRoot, violations: ["missing @ouro.bot/cli package"], message };
+    }
+    const violations = findBlockedInstalledRuntimePayloadText(packageRoot, { existsSync, readdirSync, readFileSync });
+    if (violations.length === 0) {
+        return { ok: true, version, packageRoot, violations, message: "installed runtime package passed activation guard" };
+    }
+    const message = `installed runtime ${version} contains blocked package assets (${violations.join(", ")}); run 'ouro up' to stay on the current release`;
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_activation_blocked",
+        message: "blocked CLI version activation",
+        meta: { version, packageRoot, reason: "blocked-package-assets", violations },
+        level: "warn",
+    });
+    return { ok: false, version, packageRoot, violations, message };
+}
+function findBlockedInstalledRuntimePayloadText(packageRoot, deps) {
+    const violations = [];
+    const blockedText = BLOCKED_INSTALLED_RUNTIME_TEXT_SIGNATURES.map((signature) => ({
+        label: signature.label,
+        text: Buffer.from(signature.base64, "base64").toString("utf8"),
+    }));
+    for (const payloadPath of INSTALLED_RUNTIME_PACKAGE_PAYLOAD_PATHS) {
+        const absolutePath = path.join(packageRoot, payloadPath);
+        if (!deps.existsSync(absolutePath))
+            continue;
+        collectBlockedTextViolations(packageRoot, absolutePath, payloadPath, blockedText, deps, violations);
+    }
+    return violations.sort();
+}
+function collectBlockedTextViolations(packageRoot, absolutePath, relativePath, blockedText, deps, violations) {
+    let entries = null;
+    try {
+        entries = deps.readdirSync(absolutePath, { withFileTypes: true });
+    }
+    catch {
+        entries = null;
+    }
+    if (entries !== null) {
+        for (const entry of entries) {
+            const childRelativePath = `${relativePath}/${entry.name}`;
+            if (entry.isDirectory()) {
+                collectBlockedTextViolations(packageRoot, path.join(absolutePath, entry.name), childRelativePath, blockedText, deps, violations);
+            }
+            else if (entry.isFile()) {
+                inspectInstalledRuntimePayloadFile(packageRoot, childRelativePath, blockedText, deps, violations);
+            }
+        }
+        return;
+    }
+    inspectInstalledRuntimePayloadFile(packageRoot, relativePath, blockedText, deps, violations);
+}
+function inspectInstalledRuntimePayloadFile(packageRoot, relativePath, blockedText, deps, violations) {
+    if (!INSTALLED_RUNTIME_TEXT_EXTENSIONS.has(path.extname(relativePath)))
+        return;
+    let content = "";
+    try {
+        content = deps.readFileSync(path.join(packageRoot, relativePath), "utf8");
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error);
+        violations.push(`${relativePath} could not be inspected: ${reason}`);
+        return;
+    }
+    for (const blocked of blockedText) {
+        if (content.includes(blocked.text)) {
+            violations.push(`${relativePath} contains ${blocked.label}`);
+        }
+    }
+}
+function installVersion(version, deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    const execSync = deps.execSync ?? ((cmd, opts) => require("child_process").execSync(cmd, opts));
+    /* v8 ignore stop */
+    const versionDir = path.join(cliHome, "versions", version);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_install_start",
+        message: "installing CLI version",
+        meta: { version, versionDir },
+    });
+    mkdirSync(versionDir, { recursive: true });
+    execSync(`npm install --prefix ${versionDir} @ouro.bot/cli@${version}`, { stdio: "pipe" });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_install_end",
+        message: "CLI version installed",
+        meta: { version, versionDir },
+    });
+}
+function activateVersion(version, deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
+    const symlinkSync = deps.symlinkSync ?? fs.symlinkSync;
+    const renameSync = deps.renameSync ?? fs.renameSync;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    /* v8 ignore stop */
+    const currentVersionPath = path.join(cliHome, "CurrentVersion");
+    const previousPath = path.join(cliHome, "previous");
+    const newTarget = path.join(cliHome, "versions", version);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_activate",
+        message: "activating CLI version",
+        meta: { version },
+    });
+    // Read old CurrentVersion target (may not exist)
+    let oldTarget = null;
+    try {
+        oldTarget = readlinkSync(currentVersionPath);
+    }
+    catch {
+        // No current version — first install
+    }
+    // Update previous symlink to point to old current
+    if (oldTarget) {
+        try {
+            unlinkSync(previousPath);
+        }
+        catch {
+            // previous symlink may not exist yet
+        }
+        symlinkSync(oldTarget, previousPath);
+    }
+    // Swap CurrentVersion atomically: build the new link beside it and rename
+    // it over the old one, so a process killed mid-swap never leaves the
+    // machine without a CurrentVersion.
+    const tempPath = `${currentVersionPath}.next-${process.pid}`;
+    try {
+        unlinkSync(tempPath);
+    }
+    catch {
+        // No leftover from an earlier interrupted swap.
+    }
+    symlinkSync(newTarget, tempPath);
+    try {
+        renameSync(tempPath, currentVersionPath);
+    }
+    catch {
+        // rename cannot replace a real directory; fall back to unlink + link.
+        try {
+            unlinkSync(tempPath);
+        }
+        catch {
+            // Already gone.
+        }
+        if (existsSync(currentVersionPath)) {
+            unlinkSync(currentVersionPath);
+        }
+        symlinkSync(newTarget, currentVersionPath);
+    }
+}
+/**
+ * Compare two version strings of the form `0.1.0-alpha.{n}`. Returns
+ * positive when `a` is newer, negative when `b` is newer, 0 when equal.
+ *
+ * The harness only ships `0.1.0-alpha.{n}` versions today; this comparator
+ * extracts the numeric tail and falls back to a lexicographic compare for
+ * any version that doesn't match the pattern (so unexpected version
+ * formats sort consistently rather than throwing).
+ */
+function compareCliVersions(a, b) {
+    const aMatch = /alpha\.(\d+)/.exec(a);
+    const bMatch = /alpha\.(\d+)/.exec(b);
+    if (aMatch && bMatch) {
+        const aN = parseInt(aMatch[1], 10);
+        const bN = parseInt(bMatch[1], 10);
+        return aN - bN;
+    }
+    // Fallback: lexicographic. Both-mismatched and one-mismatched cases land
+    // here. Predictable, even if not strictly semver-correct.
+    if (a < b)
+        return -1;
+    if (a > b)
+        return 1;
+    return 0;
+}
+/**
+ * Identify which installed CLI versions can be safely deleted, given a
+ * retention policy. Pure: takes the full version list and the protected
+ * (current/previous) versions, returns the versions to delete.
+ *
+ * Retention rules:
+ *   - Always keep the N most recent versions (default 5).
+ *   - Always keep the currently-active version (CurrentVersion symlink target).
+ *   - Always keep the previous version (previous symlink target) so rollback
+ *     stays one command away.
+ *   - Delete everything else.
+ *
+ * Exported so tests can pin the policy without shelling out to a real fs.
+ */
+function selectVersionsToPrune(installedVersions, protectedVersions, retain = exports.DEFAULT_RETAIN_VERSIONS) {
+    if (installedVersions.length <= retain)
+        return [];
+    const sorted = [...installedVersions].sort(compareCliVersions).reverse();
+    const keepers = new Set(sorted.slice(0, retain));
+    if (protectedVersions.current)
+        keepers.add(protectedVersions.current);
+    if (protectedVersions.previous)
+        keepers.add(protectedVersions.previous);
+    return installedVersions.filter((v) => !keepers.has(v));
+}
+/**
+ * Prune installed CLI versions according to the retention policy. Removes
+ * `~/.ouro-cli/versions/{version}/` directories for versions outside the
+ * retention window. Best-effort: per-version delete failures are logged
+ * via nerves but don't propagate.
+ *
+ * Called from the activate path (cli-defaults.ts) so that every successful
+ * `ouro up` self-prunes. The user observed `~/.ouro-cli/versions/` going
+ * back to alpha.85 from March 20 — every CLI version they'd ever installed
+ * was still on disk because nothing ever GCed.
+ */
+function pruneOldVersions(retain = exports.DEFAULT_RETAIN_VERSIONS, deps = {}) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests always inject @preserve */
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
+    const rmSync = deps.rmSync ?? fs.rmSync;
+    /* v8 ignore stop */
+    const versionsDir = path.join(cliHome, "versions");
+    let installed;
+    try {
+        installed = readdirSync(versionsDir, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name);
+    }
+    catch {
+        return { kept: [], deleted: [], failed: [] };
+    }
+    const current = (() => {
+        try {
+            return path.basename(readlinkSync(path.join(cliHome, "CurrentVersion")));
+        }
+        catch {
+            return null;
+        }
+    })();
+    const previous = (() => {
+        try {
+            return path.basename(readlinkSync(path.join(cliHome, "previous")));
+        }
+        catch {
+            return null;
+        }
+    })();
+    const toDelete = selectVersionsToPrune(installed, { current, previous }, retain);
+    const deleted = [];
+    const failed = [];
+    for (const version of toDelete) {
+        const versionDir = path.join(versionsDir, version);
+        try {
+            rmSync(versionDir, { recursive: true, force: true });
+            deleted.push(version);
+        }
+        catch (error) {
+            failed.push({
+                version,
+                error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error),
+            });
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_versions_pruned",
+        message: `pruned ${deleted.length} old CLI versions`,
+        meta: { retain, deleted, failed: failed.length, kept: installed.filter((v) => !deleted.includes(v)) },
+    });
+    return { kept: installed.filter((v) => !deleted.includes(v)), deleted, failed };
+}
+function ensureLayout(deps) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore next -- dep default: tests always inject @preserve */
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    mkdirSync(cliHome, { recursive: true });
+    mkdirSync(path.join(cliHome, "bin"), { recursive: true });
+    mkdirSync(path.join(cliHome, "versions"), { recursive: true });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_layout_ensured",
+        message: "CLI directory layout ensured",
+        meta: { cliHome },
+    });
+}

package/dist/heart/versioning/release-sources.js

@@ -0,0 +1,173 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_RELEASE_PUBLISHER = exports.GITHUB_DOWNLOAD_BASE = exports.GITHUB_RELEASES_API = exports.NPMJS_REGISTRY = exports.CLI_PACKAGE = void 0;
+exports.selfUpdateE2eOverrides = selfUpdateE2eOverrides;
+exports.githubTarballName = githubTarballName;
+exports.lookupLatestRelease = lookupLatestRelease;
+exports.installRelease = installRelease;
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const ouro_version_manager_1 = require("./ouro-version-manager");
+exports.CLI_PACKAGE = "@ouro.bot/cli";
+exports.NPMJS_REGISTRY = "https://registry.npmjs.org/";
+exports.GITHUB_RELEASES_API = "https://api.github.com/repos/ourostack/ouroboros/releases?per_page=20";
+exports.GITHUB_DOWNLOAD_BASE = "https://github.com/ourostack/ouroboros/releases/download/";
+/** Only releases and assets that our release workflow created are trusted. */
+exports.GITHUB_RELEASE_PUBLISHER = "github-actions[bot]";
+const LOOKUP_TIMEOUT_MS = 15_000;
+const INSTALL_TIMEOUT_MS = 10 * 60_000;
+/**
+ * The package end-to-end test serves a packed build as a GitHub release from
+ * a loopback HTTP server. Honored only with OURO_SELF_UPDATE_E2E=1 and a
+ * loopback base URL, so it cannot point a real machine at another host.
+ */
+function selfUpdateE2eOverrides(env) {
+    const base = env.OURO_SELF_UPDATE_E2E_GITHUB_BASE?.replace(/\/+$/, "");
+    if (env.OURO_SELF_UPDATE_E2E !== "1" || !base)
+        return null;
+    if (!/^http:\/\/(127\.0\.0\.1|localhost):\d+$/.test(base))
+        return null;
+    return { github: { apiUrl: `${base}/releases`, downloadBase: `${base}/releases/download/` }, githubOnly: true };
+}
+function githubTarballName(version) {
+    return `ouro.bot-cli-${version}.tgz`;
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+async function askNpmjs(deps) {
+    const body = await deps.fetchJson(`${exports.NPMJS_REGISTRY}${exports.CLI_PACKAGE.replace("/", "%2f")}`, LOOKUP_TIMEOUT_MS);
+    const version = body?.["dist-tags"]?.latest;
+    if (typeof version !== "string")
+        throw new Error("registry response has no latest dist-tag");
+    return { source: "npmjs", version };
+}
+async function askConfiguredRegistry(deps) {
+    const stdout = await deps.execFile("npm", ["view", exports.CLI_PACKAGE, "dist-tags.latest", "--json"], { timeoutMs: LOOKUP_TIMEOUT_MS });
+    const version = JSON.parse(stdout.trim());
+    if (typeof version !== "string")
+        throw new Error("npm view returned no latest dist-tag");
+    return { source: "npm-registry", version };
+}
+async function askGithub(deps) {
+    const github = deps.github ?? { apiUrl: exports.GITHUB_RELEASES_API, downloadBase: exports.GITHUB_DOWNLOAD_BASE };
+    const releases = await deps.fetchJson(github.apiUrl, LOOKUP_TIMEOUT_MS);
+    if (!Array.isArray(releases))
+        throw new Error("GitHub releases response is not a list");
+    let best = null;
+    for (const release of releases) {
+        if (release.draft === true || typeof release.tag_name !== "string")
+            continue;
+        const tag = /^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)$/.exec(release.tag_name);
+        if (!tag || release.author?.login !== exports.GITHUB_RELEASE_PUBLISHER)
+            continue;
+        const version = tag[1];
+        const name = githubTarballName(version);
+        const expectedUrl = `${github.downloadBase}v${version}/${name}`;
+        const asset = (release.assets ?? []).find((entry) => entry.name === name &&
+            entry.browser_download_url === expectedUrl &&
+            entry.uploader?.login === exports.GITHUB_RELEASE_PUBLISHER);
+        if (!asset)
+            continue;
+        if (!best || (0, ouro_version_manager_1.compareCliVersions)(version, best.version) > 0) {
+            best = { source: "github", version, tarballUrl: expectedUrl };
+        }
+    }
+    if (!best)
+        throw new Error(`no GitHub release published by ${exports.GITHUB_RELEASE_PUBLISHER} carries an npm tarball`);
+    return best;
+}
+async function lookupLatestRelease(deps) {
+    const asks = [
+        ["npmjs", () => askNpmjs(deps)],
+        ["npm-registry", () => askConfiguredRegistry(deps)],
+        ["github", () => askGithub(deps)],
+    ];
+    const answers = await Promise.all(asks.filter(([source]) => !deps.githubOnly || source === "github").map(async ([source, ask]) => {
+        try {
+            return await ask();
+        }
+        catch (error) {
+            return { source, error: message(error) };
+        }
+    }));
+    let latestVersion = null;
+    for (const answer of answers) {
+        if (answer.version && (!latestVersion || (0, ouro_version_manager_1.compareCliVersions)(answer.version, latestVersion) > 0)) {
+            latestVersion = answer.version;
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.self_update_lookup",
+        message: "looked up the latest published CLI release",
+        meta: {
+            latestVersion,
+            answers: answers.map((answer) => `${answer.source}=${answer.version ?? `error: ${answer.error}`}`).join("; "),
+        },
+    });
+    return { latestVersion, answers };
+}
+/**
+ * Install `version` into `~/.ouro-cli/versions/<version>`, trying each source
+ * that can serve it. Returns the source that worked.
+ */
+async function installRelease(version, lookup, cliHome, deps) {
+    const prefix = path.join(cliHome, "versions", version);
+    const github = lookup.answers.find((answer) => answer.source === "github" && answer.version === version && answer.tarballUrl);
+    const attempts = [
+        ["npm-registry", ["install", "--prefix", prefix, `${exports.CLI_PACKAGE}@${version}`]],
+        ...(github ? [["github", ["install", "--prefix", prefix, github.tarballUrl]]] : []),
+        ["npmjs", ["install", "--prefix", prefix, `${exports.CLI_PACKAGE}@${version}`, "--registry", exports.NPMJS_REGISTRY]],
+    ];
+    const failures = [];
+    for (const [source, args] of attempts.filter(([source]) => !deps.githubOnly || source === "github")) {
+        try {
+            await deps.execFile("npm", args, { timeoutMs: INSTALL_TIMEOUT_MS });
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.self_update_installed",
+                message: "installed CLI release for self-update",
+                meta: { version, source },
+            });
+            return source;
+        }
+        catch (error) {
+            failures.push(`${source}: ${message(error).split("\n")[0]}`);
+        }
+    }
+    throw new Error(`could not install ${version} from any source (${failures.join("; ")})`);
+}