@skrr-ai/cli 0.1.94 → 0.1.95

package/dist/lib/first-party-harness-remote-install.js

@@ -0,0 +1,310 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
+const base_command_1 = require("../base-command");
+const api_fetch_1 = require("./api-fetch");
+const daemon_target_1 = require("./daemon-target");
+const first_party_harness_1 = require("./first-party-harness");
+/**
+ * `skrr code install` — install the engine from the terminal.
+ *
+ * ── Why this command exists ────────────────────────────────────────────────
+ *
+ * `skrr code`'s not-installed message offered exactly two routes and neither
+ * worked without a browser: "In the web app: the runtime menu … → Install", or
+ * point the engine-path override at a build you already have — which is the thing
+ * you are trying to obtain, and the route that gives up provenance. So the
+ * ordinary case for a coding harness (a dev box over SSH, a CI runner, a cloud
+ * VM) had no way in (dogfood OSK-276).
+ *
+ * Nothing underneath was missing. The daemon has performed the verified install
+ * since 2026-08-08, and `POST /api/daemons/:id/cli-installers/:provider/install`
+ * has fronted it since June. The install was API-exposed and CLI-unreachable —
+ * the shape the root `CLAUDE.md` names under CLI ↔ API parity: "an endpoint the
+ * API exposes must be reachable from `skrr`."
+ *
+ * So this adds a SURFACE and no mechanism. Same route the web app posts, same
+ * daemon job, same signature verification. A second install path would be a
+ * second thing to keep in step with the first, and the first is the one that
+ * verifies the signed manifest.
+ */
+class CodeInstall extends base_command_1.BaseCommand {
+    static description = `Install the ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine on this machine, through the daemon`;
+    static examples = [
+        '<%= config.bin %> code install',
+        '<%= config.bin %> code install --daemon <daemon-id>',
+        '<%= config.bin %> code install --json',
+    ];
+    static flags = {
+        daemon: core_1.Flags.string({
+            description: 'Which daemon installs it. Defaults to this machine on a Dedicated Runtime, otherwise to the only active one; required when you have several.',
+        }),
+        wait: core_1.Flags.boolean({
+            default: true,
+            allowNo: true,
+            description: 'Follow the install job until it finishes. --no-wait returns the job id.',
+        }),
+        json: core_1.Flags.boolean({ description: 'Emit the result as JSON' }),
+    };
+    async run() {
+        const { flags } = await this.parse(CodeInstall);
+        const daemonId = this.installTarget(await this.resolveTarget(flags.daemon));
+        let started;
+        try {
+            started = await (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${PROVIDER}/install`, { method: 'POST', body: {}, credential: this.resolvedCredential });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        // The daemon distinguishes three refusals, and only one of them attaches a
+        // job worth following:
+        //
+        // - `alreadyInstalled` carries the LAST job the provider ran — context, not
+        //   this request's work. Following it replays a stale outcome as though it
+        //   had just happened: `code install` on an engine one release behind
+        //   reprinted the previous update's log tail verbatim and reported that job
+        //   as its result (OSK-10650). The right answer is the daemon's own
+        //   installDisabledReason plus where the update actually comes from.
+        // - `alreadyRunning` carries the LIVE job — following it attaches the user
+        //   to work that is really in flight, which is what they asked for.
+        // - `started` carries the job this request began.
+        if (started.alreadyInstalled) {
+            if (flags.json) {
+                this.log(JSON.stringify({ daemonId, ...started }, null, 2));
+                return;
+            }
+            const state = started.provider;
+            const reason = state?.installDisabledReason?.trim();
+            const version = state?.version?.trim();
+            this.log(`Nothing to do on ${daemonId} — ${reason || 'Already installed.'}${version ? ` (${version})` : ''}`);
+            if (state?.updatable === true) {
+                this.log(`To update it: ${this.config.bin} code update`);
+            }
+            else {
+                const why = state?.updateDisabledReason?.trim();
+                if (why)
+                    this.log(`Updating: ${why}`);
+            }
+            return;
+        }
+        const jobId = started.job?.id;
+        // A 202 carrying NO job is not a queued install. It is the daemon
+        // acknowledging the call and returning nothing, and the route builds its
+        // body as `{ daemonId, ...result }` — so an empty result and a real one look
+        // identical from here. Dogfooded (OSK-287): this printed "Install requested"
+        // and exited 0 against a daemon that answered an unrelated RPC in 83ms and
+        // then installed nothing for 130 seconds. Reporting success for an empty
+        // acknowledgement is what let that reach a user as silence.
+        if (!jobId) {
+            if (flags.json) {
+                this.log(JSON.stringify({ daemonId, ...started }, null, 2));
+                return;
+            }
+            // A no-op is not a failure. The daemon says WHY it started nothing, and
+            // the commonest reason is the happy one — the engine is already there.
+            //
+            // This branch used to treat every job-less response as "nothing has been
+            // shown to start", which was right while the control-RPC relay dropped
+            // every reply (OSK-287) and wrong the moment it was fixed: with real
+            // payloads flowing, running `code install` twice would have reported a
+            // problem for the ordinary case of already having the engine. That is the
+            // same defect this dogfood run kept finding in other people's error copy —
+            // a message asserting a cause it has not observed — so it does not get to
+            // survive in mine.
+            const reason = await this.installerNote(daemonId);
+            if (reason) {
+                this.log(`Nothing to do on ${daemonId} — ${reason}`);
+                return;
+            }
+            this.failWithCliError({
+                message: `The daemon on ${daemonId} accepted the request and returned no ` +
+                    'install job, and does not say why. Nothing has been shown to start. ' +
+                    `Check what it offers with \`${this.config.bin} harnesses installers --daemon ${daemonId}\`, and ` +
+                    `\`${this.config.bin} code doctor\` here once you expect it to have landed.`,
+                code: 'INSTALL_NOT_TRACKED',
+                exit: 1,
+                // Retryable: the daemon is reachable and the call was accepted, so the
+                // same command may well work once whatever swallowed it is understood.
+                retryable: true,
+            });
+        }
+        if (!flags.wait) {
+            if (flags.json) {
+                this.log(JSON.stringify({ daemonId, ...started }, null, 2));
+                return;
+            }
+            this.log(`Install started on ${daemonId} — job ${jobId}.`);
+            return;
+        }
+        const job = await this.followJob(daemonId, jobId, flags.json === true);
+        if (flags.json) {
+            this.log(JSON.stringify({ daemonId, job }, null, 2));
+        }
+        if (job.status === 'failed') {
+            // The daemon's own message, verbatim. It carries the failure CODE
+            // (`runSignedInstall` puts it there deliberately) because "the feed is
+            // down" and "the signature did not verify" need very different responses.
+            this.failWithCliError({
+                message: job.error || 'The install failed and the daemon gave no reason.',
+                code: 'INSTALL_FAILED',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (!flags.json) {
+            this.log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} installed. Run \`${this.config.bin} code\` to start it.`);
+        }
+    }
+    /** Which daemon the install targets, by the rule every daemon-picking command shares. */
+    async resolveTarget(explicit) {
+        try {
+            return await (0, daemon_target_1.resolveDaemonTarget)({
+                explicit,
+                local: (0, daemon_target_1.localMachine)({ baseURL: this.cliConfig?.baseURL }),
+                listActiveDaemons: () => (0, daemon_target_1.listConnectedDaemons)(this.resolvedCredential),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+    /**
+     * The daemon id to install through, or the refusal.
+     *
+     * Refuses rather than guessing when several are active. Picking one would mean
+     * installing a hundred megabytes onto a machine the user was not thinking
+     * about. The candidates are CONNECTED daemons by the id the installer routes
+     * take (`listConnectedDaemons`), so the error names values that work — the
+     * Daemon resource list `skrr list-daemons` prints is a different id space
+     * (OSK-9993).
+     *
+     * A Dedicated Runtime's own machine is refused here, before any request. The
+     * daemon and the API refuse it too; saying so locally is what keeps the answer
+     * the same whether or not this machine's daemon is reachable, and whether or
+     * not it has published its id. Another of the owner's machines, named with
+     * `--daemon`, is not this machine and goes to the API like anywhere else.
+     */
+    installTarget(target) {
+        if (target.kind === 'daemon')
+            return target.daemonId;
+        if (target.kind === 'this-machine') {
+            this.failWithCliError({
+                message: target.explicit
+                    ? first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE
+                    : `${first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE} This command installs on the machine it runs on; ` +
+                        'to install on another of your machines, name it with --daemon.',
+                code: 'DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (target.kind === 'none') {
+            this.failWithCliError({
+                message: 'No daemon is connected for this account, so nothing can perform the install. ' +
+                    `Start the background service on this computer with \`${this.config.bin} daemon start\`, then run this again.`,
+                code: 'NO_DAEMON',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        const { daemons } = target;
+        const choices = daemons
+            .slice(0, 10)
+            .map((d) => `  ${d.id}  ${d.name || '—'}`)
+            .join('\n');
+        this.failWithCliError({
+            message: `${daemons.length} connected daemons — say which machine should install the engine:\n${choices}\n` +
+                `Pass one with --daemon, or see each daemon id in the DAEMON ID column of \`${this.config.bin} harnesses list\`.`,
+            code: 'AMBIGUOUS_DAEMON',
+            exit: 1,
+            retryable: false,
+        });
+    }
+    /**
+     * What the daemon says about this provider, when it started no job.
+     *
+     * Read from the SAME list route the web app uses, so the CLI reports the
+     * daemon's own words rather than inventing an explanation for silence. Best
+     * effort: a failure here means falling back to the honest "does not say why",
+     * never to a guess.
+     */
+    async installerNote(daemonId) {
+        try {
+            const res = await (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: this.resolvedCredential });
+            // Any accepted spelling: a daemon lists the provider the way it registered it,
+            // and during a rename's alias window one that predates or postdates the flip
+            // spells it differently.
+            const row = (res.providers ?? []).find((p) => (0, auth_core_1.isFirstPartyHarnessProvider)(p.provider));
+            const reason = row?.installDisabledReason?.trim();
+            if (!reason)
+                return null;
+            // The version is what turns "Already installed." into something a reader
+            // can act on — it is the difference between reassurance and a shrug.
+            return row?.version ? `${reason} (${row.version})` : reason;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Poll the job until it settles, printing each new log line.
+     *
+     * The daemon already writes a progress log — "Fetching the signed release
+     * manifest", "Verified and installed …" — and it is the only account
+     * of a hundred-megabyte download the user is waiting on. Printing only the
+     * lines not yet seen keeps a poll loop from repeating the whole log.
+     */
+    async followJob(daemonId, jobId, quiet) {
+        const deadline = Date.now() + MAX_WAIT_MS;
+        let printed = 0;
+        for (;;) {
+            let res;
+            try {
+                res = await (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/jobs/${encodeURIComponent(jobId)}`, { credential: this.resolvedCredential });
+            }
+            catch (err) {
+                this.handleApiError(err);
+            }
+            const job = res.job;
+            if (!job) {
+                this.failWithCliError({
+                    message: `The daemon no longer has install job ${jobId}.`,
+                    code: 'JOB_MISSING',
+                    exit: 1,
+                    retryable: false,
+                });
+            }
+            if (!quiet) {
+                for (const line of (job.log ?? []).slice(printed))
+                    this.logToStderr(`  ${line}`);
+                printed = (job.log ?? []).length;
+            }
+            if (job.status === 'succeeded' || job.status === 'failed')
+                return job;
+            if (Date.now() > deadline) {
+                // NOT a failure: the daemon is still working, and saying "install
+                // failed" because this process ran out of patience would be a lie that
+                // sends someone to debug a download that is going fine.
+                this.failWithCliError({
+                    message: `Still installing after ${Math.round(MAX_WAIT_MS / 60000)} minutes — the daemon is ` +
+                        `still working on job ${jobId}. Check \`${this.config.bin} code doctor\` in a while.`,
+                    code: 'INSTALL_PENDING',
+                    exit: 1,
+                    retryable: true,
+                });
+            }
+            await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+        }
+    }
+}
+exports.default = CodeInstall;
+/**
+ * The daemon's id for skrr's own engine — the CANONICAL spelling, read from the
+ * identity module rather than written here. The install route accepts every
+ * spelling; canonical is what the platform stores and returns.
+ */
+const PROVIDER = auth_core_1.FIRST_PARTY_HARNESS.provider;
+/** A 100 MB download over a hotel connection is the case this has to survive. */
+const MAX_WAIT_MS = 10 * 60_000;
+const POLL_INTERVAL_MS = 2_000;

package/dist/lib/first-party-harness-remote-update.d.ts

@@ -0,0 +1,46 @@
+import { BaseCommand } from '../base-command';
+/**
+ * `skrr code update` — pull the engine's signed release down through the daemon.
+ *
+ * ── Why this command exists ────────────────────────────────────────────────
+ *
+ * The update verb has been API-exposed and daemon-implemented since OSK-10096 —
+ * `POST /api/daemons/:id/cli-installers/:provider/update` re-fetches the signed
+ * manifest and installs whatever the channel points at. But the only CLI that
+ * reached it was `skrr harnesses install <provider> --update`: a flag on a
+ * command a `code` user has no reason to read. On stable that left no
+ * discoverable path at all — `code install` answered "Already installed." with
+ * no next step, and the channel moving past the installed build was invisible
+ * from the surface that owns the engine (OSK-10650).
+ *
+ * So this adds a SURFACE and no mechanism. Same route `harnesses install
+ * --update` posts, same inventory pre-check, same 504 recovery — one update
+ * path, spelled where the engine's users look.
+ */
+export default class CodeUpdate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        wait: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /** Which daemon the update targets, by the rule every daemon-picking command shares. */
+    private resolveTarget;
+    /**
+     * The daemon id to update through, or the refusal — identical rules to
+     * `code install`: a Dedicated Runtime's own machine is image-managed, several
+     * connected daemons get named rather than guessed.
+     */
+    private updateTarget;
+    /**
+     * Start the update, and survive a gateway that cut the request off — the same
+     * 504 recovery `harnesses install --update` uses: the relay can drop the
+     * answer while the daemon runs the job it started, so on a server-side
+     * failure we ask the daemon and follow the job it reports.
+     */
+    private start;
+    /** Follow a job to its end, or report why it could not be followed (and return nothing). */
+    private follow;
+}

package/dist/lib/first-party-harness-remote-update.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
+const base_command_1 = require("../base-command");
+const cli_installers_1 = require("./cli-installers");
+const daemon_target_1 = require("./daemon-target");
+const first_party_harness_1 = require("./first-party-harness");
+/**
+ * `skrr code update` — pull the engine's signed release down through the daemon.
+ *
+ * ── Why this command exists ────────────────────────────────────────────────
+ *
+ * The update verb has been API-exposed and daemon-implemented since OSK-10096 —
+ * `POST /api/daemons/:id/cli-installers/:provider/update` re-fetches the signed
+ * manifest and installs whatever the channel points at. But the only CLI that
+ * reached it was `skrr harnesses install <provider> --update`: a flag on a
+ * command a `code` user has no reason to read. On stable that left no
+ * discoverable path at all — `code install` answered "Already installed." with
+ * no next step, and the channel moving past the installed build was invisible
+ * from the surface that owns the engine (OSK-10650).
+ *
+ * So this adds a SURFACE and no mechanism. Same route `harnesses install
+ * --update` posts, same inventory pre-check, same 504 recovery — one update
+ * path, spelled where the engine's users look.
+ */
+class CodeUpdate extends base_command_1.BaseCommand {
+    static description = `Update the ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine on this machine, through the daemon`;
+    static examples = [
+        '<%= config.bin %> code update',
+        '<%= config.bin %> code update --daemon <daemon-id>',
+        '<%= config.bin %> code update --json',
+    ];
+    static flags = {
+        daemon: core_1.Flags.string({
+            description: 'Which daemon runs the update. Defaults to this machine on a Dedicated Runtime, otherwise to the only active one; required when you have several.',
+        }),
+        wait: core_1.Flags.boolean({
+            default: true,
+            allowNo: true,
+            description: 'Follow the update job until it finishes. --no-wait returns the job id.',
+        }),
+        json: core_1.Flags.boolean({ description: 'Emit the result as JSON' }),
+    };
+    async run() {
+        const { flags } = await this.parse(CodeUpdate);
+        const daemonId = this.updateTarget(await this.resolveTarget(flags.daemon));
+        // Ask the inventory before posting: a daemon older than managed updates has
+        // no handler for the request and would leave it to time out, and an engine
+        // that updates some other way has a reason the daemon already words.
+        let inventory;
+        try {
+            inventory = await (0, cli_installers_1.listCliInstallers)(daemonId, this.resolvedCredential);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        const row = (inventory.providers ?? []).find((p) => (0, auth_core_1.isFirstPartyHarnessProvider)(p.provider));
+        if (!row) {
+            this.failWithCliError({
+                message: `${auth_core_1.FIRST_PARTY_HARNESS.displayName} is not installed on ${daemonId}. ` +
+                    `Install it with \`${this.config.bin} code install\`.`,
+                code: 'NOT_INSTALLED',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (row.updatable === undefined) {
+            this.failWithCliError({
+                message: `The daemon ${daemonId} (${inventory.daemonVersion ?? 'version not reported'}) cannot update ${auth_core_1.FIRST_PARTY_HARNESS.displayName}: it predates managed updates. ` +
+                    `Update the daemon, then run this again.`,
+                code: 'DAEMON_UPDATE_UNSUPPORTED',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (!row.updatable) {
+            this.failWithCliError({
+                message: row.updateDisabledReason?.trim() ||
+                    `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: the daemon cannot update it here.`,
+                code: 'CLI_NOT_UPDATABLE',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        const start = await this.start(daemonId, flags.json === true);
+        if (!start)
+            return;
+        const jobId = start.job?.id;
+        if (!start.started || !jobId) {
+            if (flags.json) {
+                this.log(JSON.stringify({ daemonId, ...start }, null, 2));
+                return;
+            }
+            this.log(start.alreadyRunning
+                ? `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: an install or update is already running (job ${start.job?.id ?? 'unknown'}).`
+                : `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: ${start.provider?.updateDisabledReason?.trim() || 'the daemon started no update job.'}`);
+            return;
+        }
+        if (!flags.wait) {
+            if (flags.json) {
+                this.log(JSON.stringify({ daemonId, ...start }, null, 2));
+                return;
+            }
+            this.log(`Update started on ${daemonId} — job ${jobId}.`);
+            return;
+        }
+        if (!flags.json) {
+            this.logToStderr(`Updating ${auth_core_1.FIRST_PARTY_HARNESS.displayName} ${row.version ? `${row.version} ` : ''}on ${daemonId}…`);
+        }
+        const job = await this.follow(daemonId, jobId, flags.json === true);
+        if (!job)
+            return;
+        if (flags.json) {
+            this.log(JSON.stringify({ daemonId, job }, null, 2));
+            if (job.status !== 'succeeded')
+                process.exitCode = 1;
+            return;
+        }
+        if (job.status === 'failed') {
+            this.failWithCliError({
+                message: job.error || 'The update failed and the daemon gave no reason.',
+                code: 'UPDATE_FAILED',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        this.log((0, cli_installers_1.updateOutcomeLine)(job) ??
+            `${auth_core_1.FIRST_PARTY_HARNESS.displayName} updated${job.installedVersion ? ` to ${job.installedVersion}` : ''}.`);
+    }
+    /** Which daemon the update targets, by the rule every daemon-picking command shares. */
+    async resolveTarget(explicit) {
+        try {
+            return await (0, daemon_target_1.resolveDaemonTarget)({
+                explicit,
+                local: (0, daemon_target_1.localMachine)({ baseURL: this.cliConfig?.baseURL }),
+                listActiveDaemons: () => (0, daemon_target_1.listConnectedDaemons)(this.resolvedCredential),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+    /**
+     * The daemon id to update through, or the refusal — identical rules to
+     * `code install`: a Dedicated Runtime's own machine is image-managed, several
+     * connected daemons get named rather than guessed.
+     */
+    updateTarget(target) {
+        if (target.kind === 'daemon')
+            return target.daemonId;
+        if (target.kind === 'this-machine') {
+            this.failWithCliError({
+                message: target.explicit
+                    ? first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE
+                    : `${first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE} This command updates the machine it runs on; ` +
+                        'to update another of your machines, name it with --daemon.',
+                code: 'DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (target.kind === 'none') {
+            this.failWithCliError({
+                message: 'No daemon is connected for this account, so nothing can perform the update. ' +
+                    `Start the background service on this computer with \`${this.config.bin} daemon start\`, then run this again.`,
+                code: 'NO_DAEMON',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        const { daemons } = target;
+        const choices = daemons
+            .slice(0, 10)
+            .map((d) => `  ${d.id}  ${d.name || '—'}`)
+            .join('\n');
+        this.failWithCliError({
+            message: `${daemons.length} connected daemons — say which machine should update the engine:\n${choices}\n` +
+                `Pass one with --daemon, or see each daemon id in the DAEMON ID column of \`${this.config.bin} harnesses list\`.`,
+            code: 'AMBIGUOUS_DAEMON',
+            exit: 1,
+            retryable: false,
+        });
+    }
+    /**
+     * Start the update, and survive a gateway that cut the request off — the same
+     * 504 recovery `harnesses install --update` uses: the relay can drop the
+     * answer while the daemon runs the job it started, so on a server-side
+     * failure we ask the daemon and follow the job it reports.
+     */
+    async start(daemonId, json) {
+        try {
+            return await (0, cli_installers_1.startManagedCliUpdate)(daemonId, PROVIDER, this.resolvedCredential);
+        }
+        catch (err) {
+            const status = err.status ?? 0;
+            if (status >= 500 || status === 408) {
+                const job = await (0, cli_installers_1.jobStartedDespiteTimeout)(daemonId, PROVIDER, this.resolvedCredential);
+                if (job?.id) {
+                    if (!json) {
+                        this.logToStderr(`The request to ${daemonId} did not come back (HTTP ${status}), but the daemon started job ${job.id}. Following it.`);
+                    }
+                    return { started: true, job };
+                }
+            }
+            this.handleApiError(err);
+            return undefined;
+        }
+    }
+    /** Follow a job to its end, or report why it could not be followed (and return nothing). */
+    async follow(daemonId, jobId, json) {
+        const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({
+            daemonId,
+            jobId,
+            credential: this.resolvedCredential,
+            onLogLine: json ? undefined : (line) => this.logToStderr(`  ${line}`),
+        });
+        if (outcome.kind === 'missing') {
+            this.failWithCliError({
+                message: `The daemon no longer has update job ${jobId}.`,
+                code: 'JOB_MISSING',
+                exit: 1,
+                retryable: false,
+            });
+            return undefined;
+        }
+        if (outcome.kind === 'timeout') {
+            this.failWithCliError({
+                message: `Still updating after ${Math.round(cli_installers_1.INSTALL_MAX_WAIT_MS / 60000)} minutes — the daemon is ` +
+                    `still working on job ${jobId}. Check \`${this.config.bin} code doctor\` in a while.`,
+                code: 'UPDATE_PENDING',
+                exit: 1,
+                retryable: true,
+            });
+            return undefined;
+        }
+        return outcome.job;
+    }
+}
+exports.default = CodeUpdate;
+/** Same canonical provider id `code install` posts — read from the identity module. */
+const PROVIDER = auth_core_1.FIRST_PARTY_HARNESS.provider;

package/dist/lib/first-party-harness-startup-update.d.ts

@@ -0,0 +1,26 @@
+import { checkLocalCodeUpdate, updateLocalCode, type LocalCodeUpdateStatus } from './first-party-harness-update';
+export type CodeUpdateChoice = 'update' | 'once' | 'version' | 'disable';
+export declare function configureCodeStartupChecks(enabled: boolean, env?: NodeJS.ProcessEnv): {
+    enabled: boolean;
+    preferencesPath: string;
+};
+export declare function shouldCheckCodeAtStartup(input: {
+    argv: string[];
+    env?: NodeJS.ProcessEnv;
+    stdinTTY?: boolean;
+    stdoutTTY?: boolean;
+    stderrTTY?: boolean;
+}): boolean;
+export declare function ttyCodeUpdateAsker(): (result: LocalCodeUpdateStatus) => Promise<CodeUpdateChoice>;
+/** The only caller is a new interactive TUI launch, before any broker or lease. */
+export declare function maybeOfferCodeUpdate(input: {
+    argv: string[];
+    env?: NodeJS.ProcessEnv;
+    say: (line: string) => void;
+    stdinTTY?: boolean;
+    stdoutTTY?: boolean;
+    stderrTTY?: boolean;
+    ask?: (result: LocalCodeUpdateStatus) => Promise<CodeUpdateChoice>;
+    check?: typeof checkLocalCodeUpdate;
+    update?: typeof updateLocalCode;
+}): Promise<void>;