@pentoshi/clai 4.14.4 → 4.14.5

package/dist/commands/update/source-worker.js

@@ -0,0 +1,71 @@
+export const sourceApplyWorker = String.raw `import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+const data = JSON.parse(readFileSync(process.argv[2], 'utf8'));
+for (const key of ['root', 'stage', 'worktree', 'head', 'commit', 'runtime', 'version']) {
+  if (typeof data[key] !== 'string' || !data[key]) throw new Error('Invalid source-update task');
+}
+function command(file, args) {
+  const result = spawnSync(file, args, { cwd: data.root, encoding: 'utf8', timeout: 30000, maxBuffer: 16384, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+  if (result.error || result.status !== 0) throw new Error((result.error?.message || result.stderr || 'Source update command failed').slice(-1024));
+  return result.stdout.trim();
+}
+const moved = [];
+let merged = false;
+let preserve = false;
+try {
+  const changes = command('git', ['status', '--porcelain', '--', '.', ':(exclude)' + basename(data.stage)]);
+  if (changes || command('git', ['rev-parse', 'HEAD']) !== data.head) throw new Error('Checkout changed while the update was building; existing files were kept');
+  command('git', ['merge', '--ff-only', data.commit]);
+  merged = true;
+  for (const name of ['node_modules', 'dist']) {
+    const target = join(data.root, name);
+    const backup = join(data.stage, 'previous-' + name);
+    const entry = { target, backup, previous: existsSync(target), installed: false };
+    moved.push(entry);
+    if (entry.previous) renameSync(target, backup);
+    renameSync(join(data.worktree, name), target);
+    entry.installed = true;
+  }
+  const actual = command(data.runtime, [join(data.root, 'dist', 'index.js'), '--version']).replace(/^clai\s+|^v/g, '');
+  if (actual !== data.version) throw new Error('Source-update runtime verification failed: ' + actual);
+  process.stdout.write(actual + '\n');
+} catch (error) {
+  try {
+    for (const entry of moved.reverse()) {
+      if (entry.installed) rmSync(entry.target, { recursive: true, force: true });
+      if (entry.previous && existsSync(entry.backup)) renameSync(entry.backup, entry.target);
+    }
+    if (merged) command('git', ['reset', '--keep', data.head]);
+  } catch (rollbackError) {
+    preserve = true;
+    writeFileSync(join(data.stage, 'recovery'), 'Previous files retained for recovery');
+    process.stderr.write('Rollback could not finish. Recovery files: ' + data.stage + '\n' + String(rollbackError) + '\n');
+  }
+  process.stderr.write(String(error) + '\n');
+  process.exitCode = 1;
+} finally {
+  if (!preserve) {
+    try { command('git', ['worktree', 'remove', '--force', data.worktree]); } catch {}
+    try { rmSync(data.stage, { recursive: true, force: true }); } catch {}
+  }
+}
+`;
+export const sourceCleanupWorker = String.raw `import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+const payload = process.argv.at(-1);
+if (!payload || !existsSync(payload)) process.exit(0);
+const data = JSON.parse(readFileSync(payload, 'utf8'));
+for (const key of ['root', 'stage', 'worktree']) {
+  if (typeof data[key] !== 'string' || !data[key]) throw new Error('Invalid source-cleanup task');
+}
+if (dirname(resolve(data.stage)) !== resolve(data.root) || !basename(data.stage).startsWith('.clai-update-') || resolve(data.worktree) !== resolve(join(data.stage, 'worktree'))) throw new Error('Invalid source staging directory');
+if (existsSync(join(data.stage, 'recovery'))) process.exit(0);
+if (existsSync(data.worktree)) {
+  const result = spawnSync('git', ['worktree', 'remove', '--force', data.worktree], { cwd: data.root, timeout: 30000, encoding: 'utf8', windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+  if (result.error || result.status !== 0) throw new Error((result.error?.message || result.stderr || 'Could not clean source worktree').slice(-1024));
+}
+rmSync(data.stage, { recursive: true, force: true });
+`;
+//# sourceMappingURL=source-worker.js.map

package/dist/commands/update/source-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-worker.js","sourceRoot":"","sources":["../../../src/commands/update/source-worker.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoD1C,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;CAgB5C,CAAC"}

package/dist/commands/update/source.d.ts

@@ -0,0 +1,2 @@
+import { type PerformUpdateOptions, type UpdateInstallResult } from "./installers.js";
+export declare function installSourceUpdate(options: PerformUpdateOptions): Promise<UpdateInstallResult>;

package/dist/commands/update/source.js

@@ -0,0 +1,79 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { PACKAGE_NAME } from "./installers.js";
+import { runUpdateCommand, throwIfCancelled } from "./process.js";
+import { sourceApplyWorker, sourceCleanupWorker } from "./source-worker.js";
+import { compareVersions, releaseVersion, verifyCommand } from "./verification.js";
+import { stageWindowsUpdate } from "./windows-stage.js";
+export async function installSourceUpdate(options) {
+    const root = options.method.packageRoot;
+    const runtime = options.method.runtimePath;
+    if (!root || !runtime)
+        throw new Error("cannot identify the active source checkout and runtime");
+    const git = (args) => runUpdateCommand({ file: "git", args, cwd: root, env: { GIT_TERMINAL_PROMPT: "0", GIT_SSH_COMMAND: "ssh -o BatchMode=yes" } }, { signal: options.signal, timeoutMs: 120_000 });
+    throwIfCancelled(options.signal);
+    if (await git(["status", "--porcelain"]))
+        throw new Error("source checkout has local changes; commit or stash them before updating. Nothing was overwritten");
+    const head = await git(["rev-parse", "HEAD"]);
+    const branch = await git(["symbolic-ref", "--quiet", "--short", "HEAD"]);
+    const remote = await git(["config", "--get", `branch.${branch}.remote`]);
+    const ref = await git(["config", "--get", `branch.${branch}.merge`]);
+    const url = await git(["remote", "get-url", remote]);
+    if (!/^(?:https:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)pentoshi007\/clai(?:\.git)?\/?$/i.test(url)) {
+        throw new Error("source checkout must track the official clai upstream; custom remotes are not changed automatically");
+    }
+    if (!ref.startsWith("refs/heads/"))
+        throw new Error("source checkout has no upstream branch; configure tracking before updating");
+    options.log?.("Fetching the tracked source upstream…");
+    await git(["fetch", "--no-tags", remote, ref]);
+    const commit = await git(["rev-parse", "FETCH_HEAD"]);
+    try {
+        await git(["merge-base", "--is-ancestor", head, commit]);
+    }
+    catch {
+        throw new Error("source checkout has local or divergent commits; update requires a safe fast-forward. Nothing was overwritten");
+    }
+    const stage = mkdtempSync(join(root, ".clai-update-"));
+    const worktree = join(stage, "worktree");
+    let pending = false;
+    try {
+        await git(["worktree", "add", "--detach", worktree, commit]);
+        const manifest = JSON.parse(readFileSync(join(worktree, "package.json"), "utf8"));
+        if (!manifest || typeof manifest !== "object" || !("name" in manifest) || manifest.name !== PACKAGE_NAME || !("version" in manifest))
+            throw new Error("upstream is not a clai source checkout");
+        const version = releaseVersion(manifest.version);
+        if (!version || compareVersions(version, options.version) < 0)
+            throw new Error(`tracked source upstream has not reached v${options.version}; existing checkout was kept`);
+        options.onProgress?.({ phase: "installing", detail: "building isolated source worktree" });
+        const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+        const runOptions = { signal: options.signal, log: options.log, timeoutMs: 600_000 };
+        await runUpdateCommand({ file: npm, args: ["ci", "--no-audit", "--no-fund"], cwd: worktree }, runOptions);
+        await runUpdateCommand({ file: npm, args: ["run", "build", "--silent"], cwd: worktree }, runOptions);
+        options.onProgress?.({ phase: "verifying" });
+        await verifyCommand({ file: runtime, args: [join(worktree, "dist", "index.js"), "--version"] }, version, { signal: options.signal });
+        const worker = join(stage, "apply-source.mjs");
+        const payload = join(stage, "task.json");
+        writeFileSync(worker, sourceApplyWorker);
+        writeFileSync(payload, JSON.stringify({ root, stage, worktree, head, commit, runtime, version }));
+        const application = { file: runtime, args: [worker, payload] };
+        const verification = { file: runtime, args: [join(root, "dist", "index.js"), "--version"] };
+        throwIfCancelled(options.signal);
+        if (process.platform === "win32") {
+            const cleanup = { file: runtime, args: ["--input-type=module", "-e", sourceCleanupWorker, payload] };
+            const statusFile = await stageWindowsUpdate({ kind: "commands", commands: [application], verification, version, allowNewer: false, cleanup }, { signal: options.signal, ...(options.lockFile ? { lockFile: options.lockFile, lockToken: options.lockToken } : {}) });
+            pending = true;
+            return { ok: true, method: "dev", outcome: "staged", needsRestart: true, statusFile, message: `source update built and staged; close clai to apply it. Result: ${statusFile}` };
+        }
+        await runUpdateCommand(application, { timeoutMs: 120_000, log: options.log });
+        const installedVersion = await verifyCommand(verification, version);
+        return { ok: true, method: "dev", outcome: "applied", installedVersion, needsRestart: true, message: `source checkout fast-forwarded, rebuilt and verified at v${installedVersion}` };
+    }
+    finally {
+        if (!pending && !existsSync(join(stage, "recovery"))) {
+            if (existsSync(worktree))
+                await runUpdateCommand({ file: "git", args: ["worktree", "remove", "--force", worktree], cwd: root }, { timeoutMs: 30_000 }).catch(() => { });
+            rmSync(stage, { recursive: true, force: true });
+        }
+    }
+}
+//# sourceMappingURL=source.js.map

package/dist/commands/update/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../src/commands/update/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAuD,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA6B;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACjG,MAAM,GAAG,GAAG,CAAC,IAAuB,EAAmB,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,eAAe,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACzO,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IAC9J,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,MAAM,SAAS,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,MAAM,QAAQ,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,yGAAyG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAClI,OAAO,CAAC,GAAG,EAAE,CAAC,uCAAuC,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC;QAAC,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IACjE,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAC;IAAC,CAAC;IAC1I,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChM,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,OAAO,8BAA8B,CAAC,CAAC;QAC1K,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7D,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACpF,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1G,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;QACrG,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACrI,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzC,aAAa,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACzC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5F,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,CAAC;YACrG,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrQ,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mEAAmE,UAAU,EAAE,EAAE,CAAC;QAClL,CAAC;QACD,MAAM,gBAAgB,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,4DAA4D,gBAAgB,EAAE,EAAE,CAAC;IACxL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACrD,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvK,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/update/verification.d.ts

@@ -0,0 +1,7 @@
+import type { InstallMethod } from "./installers.js";
+import { type RunOptions, type UpdateCommand } from "./process.js";
+export declare function releaseVersion(value: unknown): string | undefined;
+export declare function compareVersions(left: string, right: string): number;
+export declare function installedVersionCommand(method: InstallMethod): UpdateCommand;
+export declare function verifyCommand(command: UpdateCommand, expected: string, options?: RunOptions, allowNewer?: boolean): Promise<string>;
+export declare function verifyExecutable(path: string, expected: string, options?: RunOptions): Promise<string>;

package/dist/commands/update/verification.js

@@ -0,0 +1,73 @@
+import { join } from "node:path";
+import { runUpdateCommand } from "./process.js";
+export function releaseVersion(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const version = value.trim().replace(/^v/, "");
+    const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/.exec(version);
+    if (!match || match.slice(1, 4).some((part) => !Number.isSafeInteger(Number(part))))
+        return undefined;
+    if (match[4]?.split(".").some((part) => /^0\d+$/.test(part)))
+        return undefined;
+    return version;
+}
+function components(value) {
+    const version = value.split("+")[0];
+    const index = version.indexOf("-");
+    return { numbers: (index < 0 ? version : version.slice(0, index)).split(".").map(Number), pre: index < 0 ? [] : version.slice(index + 1).split(".") };
+}
+function compareIdentifier(left, right) {
+    if (left === right)
+        return 0;
+    const numericLeft = /^\d+$/.test(left);
+    const numericRight = /^\d+$/.test(right);
+    if (numericLeft !== numericRight)
+        return numericLeft ? -1 : 1;
+    if (numericLeft && left.length !== right.length)
+        return left.length - right.length;
+    return left < right ? -1 : 1;
+}
+export function compareVersions(left, right) {
+    if (!releaseVersion(left) || !releaseVersion(right))
+        throw new Error("invalid release version");
+    const a = components(left.replace(/^v/, ""));
+    const b = components(right.replace(/^v/, ""));
+    for (let i = 0; i < 3; i += 1) {
+        const difference = a.numbers[i] - b.numbers[i];
+        if (difference)
+            return difference;
+    }
+    if (a.pre.length === 0 || b.pre.length === 0)
+        return Number(b.pre.length > 0) - Number(a.pre.length > 0);
+    for (let i = 0; i < Math.min(a.pre.length, b.pre.length); i += 1) {
+        const difference = compareIdentifier(a.pre[i], b.pre[i]);
+        if (difference)
+            return difference;
+    }
+    return a.pre.length - b.pre.length;
+}
+export function installedVersionCommand(method) {
+    if (method.type === "pnpm" && method.scope === "global" && method.executablePath && !method.executablePath.endsWith(".mjs")) {
+        return { file: method.executablePath, args: ["--version"], env: { PNPM_SHIM_BYPASS: "1" } };
+    }
+    if (method.packageRoot && method.type !== "dev") {
+        if (!method.runtimePath)
+            throw new Error("cannot verify the installed package without its Node/Bun runtime");
+        return { file: method.runtimePath, args: [join(method.packageRoot, "bin", "clai.mjs"), "--version"] };
+    }
+    if (!method.executablePath)
+        throw new Error("cannot verify the active clai installation path");
+    return { file: method.executablePath, args: ["--version"] };
+}
+export async function verifyCommand(command, expected, options = {}, allowNewer = false) {
+    const output = await runUpdateCommand(command, { ...options, timeoutMs: 15_000, log: undefined });
+    const actual = releaseVersion(output.replace(/^clai\s+/i, ""));
+    if (!actual || (allowNewer ? compareVersions(actual, expected) < 0 : actual !== expected)) {
+        throw new Error(`update verification failed: expected ${allowNewer ? "at least " : ""}${expected}, installed command reports ${output.slice(0, 120) || "no version"}; restart or retry with the original installer`);
+    }
+    return actual;
+}
+export function verifyExecutable(path, expected, options = {}) {
+    return verifyCommand({ file: path, args: ["--version"] }, expected, options);
+}
+//# sourceMappingURL=verification.js.map

package/dist/commands/update/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../../src/commands/update/verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAuC,MAAM,cAAc,CAAC;AAErF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,+HAA+H,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5J,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtG,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACnF,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAqB;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5H,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC7G,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE,QAAgB,EAAE,UAAsB,EAAE,EAAE,UAAU,GAAG,KAAK;IACxH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,+BAA+B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,gDAAgD,CAAC,CAAC;IACvN,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB,EAAE,UAAsB,EAAE;IACvF,OAAO,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC"}

package/dist/commands/update/windows-stage.d.ts

@@ -0,0 +1,21 @@
+import { type RunOptions, type UpdateCommand } from "./process.js";
+export type WindowsUpdateTask = {
+    readonly kind: "binary";
+    readonly source: string;
+    readonly destination: string;
+    readonly digest: string;
+    readonly previousDigest: string;
+    readonly version: string;
+} | {
+    readonly kind: "commands";
+    readonly commands: readonly UpdateCommand[];
+    readonly verification: UpdateCommand;
+    readonly version: string;
+    readonly allowNewer: boolean;
+    readonly cleanup?: UpdateCommand;
+};
+export declare function windowsUpdateScript(encoded: string): string;
+export declare function stageWindowsUpdate(task: WindowsUpdateTask, options?: RunOptions & {
+    readonly lockFile?: string;
+    readonly lockToken?: string | undefined;
+}, elevated?: boolean): Promise<string>;

package/dist/commands/update/windows-stage.js

@@ -0,0 +1,186 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { psQuote, runUpdateCommand, throwIfCancelled } from "./process.js";
+export function windowsUpdateScript(encoded) {
+    return String.raw `$ErrorActionPreference = 'Stop'
+$data = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')) | ConvertFrom-Json
+$task = $data.task
+$stage = $data.stage
+$status = $data.status
+$pending = $null
+$backup = $null
+$verified = $false
+function Save-Status($state, $message) {
+  @{ state=$state; version=$task.version; message=$message; time=[DateTime]::UtcNow.ToString('o') } | ConvertTo-Json -Compress | Set-Content -LiteralPath $status -Encoding UTF8
+}
+function Quote-Argument($value) {
+  if ($value -notmatch '[\s"]' -and $value.Length -gt 0) { return $value }
+  $escaped = [regex]::Replace($value, '(\\*)"', '$1$1\"')
+  return '"' + [regex]::Replace($escaped, '(\\+)$', '$1$1') + '"'
+}
+function Get-ExecutableDigest($path) {
+  $hash = [Security.Cryptography.SHA256]::Create()
+  try {
+    $stream = [IO.File]::OpenRead($path)
+    try { return [BitConverter]::ToString($hash.ComputeHash($stream)).Replace('-', '').ToLowerInvariant() }
+    finally { $stream.Dispose() }
+  } finally { $hash.Dispose() }
+}
+function Invoke-CommandSpec($spec) {
+  if ($spec.env) { foreach ($property in $spec.env.PSObject.Properties) { [Environment]::SetEnvironmentVariable($property.Name, [string]$property.Value, 'Process') } }
+  $arguments = (@($spec.args | ForEach-Object { Quote-Argument ([string]$_) }) -join ' ')
+  $outFile = Join-Path $stage 'stdout.txt'
+  $errFile = Join-Path $stage 'stderr.txt'
+  $parameters = @{ FilePath=$spec.file; ArgumentList=$arguments; RedirectStandardOutput=$outFile; RedirectStandardError=$errFile; PassThru=$true; NoNewWindow=$true }
+  if ($spec.cwd) { $parameters.WorkingDirectory = $spec.cwd }
+  $child = Start-Process @parameters
+  $null = $child.Handle
+  $limit = 600000
+  if ($spec.args -contains '--version') { $limit = 15000 }
+  if (-not $child.WaitForExit($limit)) {
+    & taskkill.exe /PID $child.Id /T /F *> $null
+    throw "Update command timed out: $($spec.file)"
+  }
+  $output = (Get-Content -LiteralPath $outFile -Tail 64) -join [Environment]::NewLine
+  $exitCode = $child.ExitCode
+  if ($null -eq $exitCode) { throw "Cannot read update command exit status: $($spec.file)" }
+  if ($exitCode -ne 0) { throw "Update command exited with status $($exitCode): $($spec.file) $((Get-Content -LiteralPath $errFile -Tail 4) -join ' ') $output" }
+  return $output.Trim()
+}
+function Compare-Version($left, $right) {
+  $a = ($left -split '\+')[0] -split '-', 2
+  $b = ($right -split '\+')[0] -split '-', 2
+  $numbersA = $a[0].Split('.')
+  $numbersB = $b[0].Split('.')
+  for ($index = 0; $index -lt 3; $index++) {
+    $difference = ([long]$numbersA[$index]).CompareTo([long]$numbersB[$index])
+    if ($difference -ne 0) { return $difference }
+  }
+  if ($a.Count -eq 1 -or $b.Count -eq 1) { return [int]($b.Count -gt 1) - [int]($a.Count -gt 1) }
+  $preA = $a[1].Split('.')
+  $preB = $b[1].Split('.')
+  for ($index = 0; $index -lt [Math]::Min($preA.Count, $preB.Count); $index++) {
+    if ($preA[$index] -ceq $preB[$index]) { continue }
+    $numericA = $preA[$index] -match '^\d+$'
+    $numericB = $preB[$index] -match '^\d+$'
+    if ($numericA -ne $numericB) { return [int]$numericB - [int]$numericA }
+    if ($numericA -and $preA[$index].Length -ne $preB[$index].Length) { return $preA[$index].Length - $preB[$index].Length }
+    return [StringComparer]::Ordinal.Compare($preA[$index], $preB[$index])
+  }
+  return $preA.Count - $preB.Count
+}
+function Verify-Version($spec, $allowNewer) {
+  $value = (Invoke-CommandSpec $spec) -replace '^clai\s+', ''
+  if ($value -cnotmatch '^v?((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)$') { throw "Cannot verify installed version: $value" }
+  $actual = $Matches[1]
+  $parts = ($actual -split '\+')[0] -split '-', 2
+  if ($parts.Count -eq 2) { foreach ($part in $parts[1].Split('.')) { if ($part -match '^0\d+$') { throw "Invalid installed version: $value" } } }
+  if ($allowNewer) {
+    if ((Compare-Version $actual $task.version) -lt 0) { throw "Installer did not reach version $($task.version): $value" }
+  } elseif ($actual -cne $task.version) { throw "Installed version mismatch: $value" }
+}
+try {
+  Save-Status 'waiting' 'Close this clai installation to apply the staged update.'
+  if (-not (Test-Path -LiteralPath $stage) -or (Test-Path -LiteralPath (Join-Path $stage 'cancel'))) { throw 'Update cancelled before staging.' }
+  if ($data.lockFile) {
+    $owner = Get-Content -LiteralPath $data.lockFile -Raw | ConvertFrom-Json
+    if ($owner.token -ne $data.lockToken) { throw 'Update lock changed before staging; existing installation was kept.' }
+    @{ pid=$PID; token=$data.lockToken } | ConvertTo-Json -Compress | Set-Content -LiteralPath $data.lockFile
+  }
+  Set-Content -LiteralPath (Join-Path $stage 'ready') -Value 'ready'
+  $deadline = [DateTime]::UtcNow.AddSeconds(120)
+  while ($true) {
+    if (-not (Test-Path -LiteralPath $stage) -or (Test-Path -LiteralPath (Join-Path $stage 'cancel'))) { throw 'Update cancelled before installation.' }
+    $owner = Get-Process -Id $data.pid -ErrorAction SilentlyContinue
+    $holders = @()
+    if ($task.kind -eq 'binary') { $holders = @(Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path -and $_.Path -eq $task.destination }) }
+    if (-not $owner -and $holders.Count -eq 0) { break }
+    if ([DateTime]::UtcNow -ge $deadline) { throw 'Timed out waiting for clai to close; the previous installation was kept. Close all instances and retry.' }
+    Start-Sleep -Milliseconds 250
+  }
+  Save-Status 'installing' 'Applying staged update.'
+  if ($task.kind -eq 'binary') {
+    if ((Get-ExecutableDigest $task.source) -ne $task.digest) { throw 'Staged binary checksum mismatch.' }
+    Verify-Version @{ file=$task.source; args=@('--version') } $false
+    $pending = "$($task.destination).update-$([Guid]::NewGuid().ToString('N'))"
+    $backup = "$($task.destination).rollback-$([Guid]::NewGuid().ToString('N'))"
+    Copy-Item -LiteralPath $task.source -Destination $pending
+    if ((Get-ExecutableDigest $task.destination) -ne $task.previousDigest) { throw 'Installation changed while the update was staged; existing executable was kept.' }
+    [IO.File]::Replace($pending, $task.destination, $backup, $true)
+    try { Verify-Version @{ file=$task.destination; args=@('--version') } $false }
+    catch { [IO.File]::Replace($backup, $task.destination, $null, $true); throw }
+  } else {
+    foreach ($command in $task.commands) { $null = Invoke-CommandSpec $command }
+    Verify-Version $task.verification $task.allowNewer
+  }
+  $verified = $true
+  Save-Status 'applied' 'Update applied and verified.'
+} catch {
+  $message = $_.Exception.Message
+  if ($backup -and (Test-Path -LiteralPath $backup)) { $message += "; recovery executable: $backup" }
+  Save-Status 'failed' $message
+} finally {
+  if ($task.kind -eq 'commands' -and $task.cleanup) {
+    try { $null = [IO.Directory]::CreateDirectory($stage); $null = Invoke-CommandSpec $task.cleanup }
+    catch { Save-Status $(if ($verified) { 'applied' } else { 'failed' }) ("$message; staged source cleanup failed: " + $_.Exception.Message) }
+  }
+  if ($pending) { Remove-Item -LiteralPath $pending -Force -ErrorAction SilentlyContinue }
+  if ($verified -and $backup) { Remove-Item -LiteralPath $backup -Force -ErrorAction SilentlyContinue }
+  if ($data.lockFile -and (Test-Path -LiteralPath $data.lockFile)) {
+    try { if ((Get-Content -LiteralPath $data.lockFile -Raw | ConvertFrom-Json).token -eq $data.lockToken) { Remove-Item -LiteralPath $data.lockFile -Force } } catch {}
+  }
+  Remove-Item -LiteralPath $stage -Recurse -Force -ErrorAction SilentlyContinue
+}
+`;
+}
+export async function stageWindowsUpdate(task, options = {}, elevated = false) {
+    throwIfCancelled(options.signal);
+    if (options.lockFile && !options.lockToken)
+        throw new Error("cannot stage an update without its installation lock token");
+    const stage = mkdtempSync(join(tmpdir(), "clai-update-stage-"));
+    const identity = task.kind === "binary" ? task.destination : task.verification.file + task.verification.args.join("|");
+    const status = join(tmpdir(), `clai-update-status-${createHash("sha256").update(identity).update(stage).digest("hex").slice(0, 20)}.json`);
+    let accepted = false;
+    try {
+        const stagedTask = task.kind === "binary" ? { ...task, source: join(stage, "clai.exe") } : task;
+        if (task.kind === "binary" && stagedTask.kind === "binary")
+            copyFileSync(task.source, stagedTask.source);
+        const encoded = Buffer.from(JSON.stringify({ task: stagedTask, stage, status, pid: process.pid, lockFile: options.lockFile, lockToken: options.lockToken })).toString("base64");
+        const script = join(stage, "apply-update.ps1");
+        writeFileSync(script, windowsUpdateScript(encoded));
+        if (elevated) {
+            const argumentsText = `-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${script}"`;
+            await runUpdateCommand({ file: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-Command", `Start-Process -Verb RunAs -WindowStyle Hidden -FilePath powershell.exe -ArgumentList ${psQuote(argumentsText)}`] }, { ...options, timeoutMs: 120_000 });
+        }
+        else {
+            await new Promise((resolve, reject) => {
+                const child = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script], { detached: true, stdio: "ignore", windowsHide: true });
+                child.once("error", reject);
+                child.once("spawn", () => { child.unref(); resolve(); });
+            });
+        }
+        const deadline = Date.now() + 15_000;
+        while (!existsSync(join(stage, "ready"))) {
+            throwIfCancelled(options.signal);
+            if (Date.now() >= deadline || !existsSync(stage)) {
+                const failure = existsSync(status) ? readFileSync(status, "utf8") : "worker did not acknowledge the staged update";
+                throw new Error(`could not stage Windows update: ${failure.slice(0, 500)}`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        throwIfCancelled(options.signal);
+        accepted = true;
+        return status;
+    }
+    finally {
+        if (!accepted) {
+            if (existsSync(stage))
+                writeFileSync(join(stage, "cancel"), "cancel");
+            rmSync(stage, { recursive: true, force: true });
+        }
+    }
+}
+//# sourceMappingURL=windows-stage.js.map

package/dist/commands/update/windows-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-stage.js","sourceRoot":"","sources":["../../../src/commands/update/windows-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAuC,MAAM,cAAc,CAAC;AAMhH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,MAAM,CAAC,GAAG,CAAA;uEACoD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgI7E,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAuB,EAAE,UAAgG,EAAE,EAAE,QAAQ,GAAG,KAAK;IACpL,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAC3I,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChL,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAC/C,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,aAAa,GAAG,6DAA6D,MAAM,GAAG,CAAC;YAC7F,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,wFAAwF,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAChQ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACzC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,8CAA8C,CAAC;gBACnH,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;YACtE,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/update-install.d.ts

@@ -1,17 +1,8 @@
-import { InstallMethod, PerformUpdateOptions, UpdateInstallResult, installDirectBinary, installViaPackageManager } from "./update/installers.js";
+import type { PerformUpdateOptions, UpdateInstallResult } from "./update/installers.js";
+import { installDirectBinary, installViaPackageManager } from "./update/installers.js";
+export { detectInstallMethod, resolveInstallEnv } from "./update/detection.js";
+export type { DetectEnv } from "./update/detection.js";
 export { DEFAULT_MIRROR_BASE, ELEVATION_TIMEOUT_MS, PACKAGE_NAME, REPO, currentPlatformTarget, downloadBinary, mirrorBaseUrl } from "./update/installers.js";
 export { installDirectBinary, installViaPackageManager };
 export type { DownloadProgress, InstallMethod, InstallMethodType, PerformUpdateOptions, PlatformTarget, SecretRequester, UpdateElevation, UpdateInstallResult, UpdateProgress } from "./update/installers.js";
-export interface DetectEnv {
-    readonly argv1: string;
-    readonly execPath: string;
-    readonly platform: NodeJS.Platform;
-    readonly home: string;
-    npmRoot?: string;
-    bunRoot?: string;
-    brewPrefix?: string;
-    scoopShimsDir?: string;
-}
-export declare function detectInstallMethod(env: DetectEnv): InstallMethod;
-export declare function resolveInstallEnv(): Promise<DetectEnv>;
 export declare function performUpdate(options: PerformUpdateOptions): Promise<UpdateInstallResult>;