@spacebar_ai/moldclaw-core 2026.3.14 → 2026.3.16

package/dist/update-cli-BZv44lFq.js

@@ -0,0 +1,1498 @@
+import "./redact-fatrROh9.js";
+import "./errors-DOJWZqNo.js";
+import "./unhandled-rejections-CTvNvnT0.js";
+import "./logger-BFfIIIKH.js";
+import { _ as resolveStateDir, n as DEFAULT_GATEWAY_PORT, u as resolveGatewayPort } from "./paths-D6AgsMTU.js";
+import "./tmp-moldclaw-dir-DWF-d8qD.js";
+import { r as theme } from "./theme-BSXzMzAA.js";
+import "./globals-DESrFYmC.js";
+import { m as defaultRuntime } from "./subsystem-S4LNMNHd.js";
+import "./ansi-BPhP6LBZ.js";
+import "./boolean-D8Ha5nYV.js";
+import "./env-Dgex_t9p.js";
+import "./warning-filter-gJuwHM7C.js";
+import { h as pathExists } from "./utils-rjVNXUns.js";
+import { t as formatDocsLink } from "./links-C5I443Xb.js";
+import { n as inheritOptionFromParent } from "./command-options-CYhpCq_H.js";
+import "./setup-binary-Fw3cCSWL.js";
+import { Hu as trimLogTail } from "./auth-profiles-9zZdaXJK.js";
+import "./model-selection-DfA4esOK.js";
+import "./agent-scope-DA7O8MVG.js";
+import "./boundary-file-read-Y1cMjPlu.js";
+import "./logger-wrbK9-ju.js";
+import { n as runCommandWithTimeout } from "./exec-CoBTyh8B.js";
+import { t as resolvemoldClawPackageRoot } from "./moldclaw-root-vgfzPuAl.js";
+import "./workspace-CxNKYS0V.js";
+import { f as readConfigFileSnapshot, y as writeConfigFile } from "./io-C6XifaT4.js";
+import "./host-env-security-xy11yVnm.js";
+import "./safe-text-BcUvBreN.js";
+import "./version-rW_3ob2o.js";
+import "./env-substitution-C9xZMTDL.js";
+import "./config-state-D1JkXt39.js";
+import "./network-mode-CE-ihBf6.js";
+import "./registry-DcDGl2X7.js";
+import "./manifest-registry-_0xclaVY.js";
+import "./ip-w605xvSx.js";
+import "./zod-schema.core-D5reNip6.js";
+import "./config-B2W1zTP1.js";
+import "./audit-fs-SjcfoPO7.js";
+import "./resolve-BbsCHGLY.js";
+import "./provider-web-search-BJhXD5dH.js";
+import "./text-runtime-CgEQ9Y9_.js";
+import "./workspace-dirs-d3Ms_ryk.js";
+import "./config-CMhKplgO.js";
+import { n as resolveCliName, t as replaceCliName } from "./cli-name-oYNDECkH.js";
+import { t as formatCliCommand } from "./command-format-DIDjlImI.js";
+import "./tailnet-KyAU6tj_.js";
+import "./net-B_Iq_SVP.js";
+import "./credentials-yYt6VWCq.js";
+import "./routes-BZtqNrBf.js";
+import "./frontmatter-BTDAgsA3.js";
+import "./env-overrides-DYVIkuvN.js";
+import "./path-alias-guards-B3ZKrId1.js";
+import "./skills-4-r1mfJM.js";
+import "./ports-BVwQuCIR.js";
+import "./ports-lsof-DiY6GaAf.js";
+import "./ssh-tunnel-BaHTFPzH.js";
+import "./image-ops-Uw4rEShL.js";
+import "./fs-safe-Da4H0IOU.js";
+import "./mime-_IkgFMS2.js";
+import "./server-middleware-BPq4bu3A.js";
+import "./message-channel-CKeDAoOT.js";
+import "./resolve-route-IkBfMjBz.js";
+import "./internal-hooks-0x1JiQ5f.js";
+import { O as formatDurationPrecise } from "./lazy-runtime-DdzFA4b9.js";
+import "./config-schema-pPBCF4hz.js";
+import "./method-scopes-Du8ODGFW.js";
+import "./session-cost-usage-B-57mlS8.js";
+import "./paths-CDWV-9nX.js";
+import "./routing-3o2D0ix4.js";
+import "./send-BRRtHxyR.js";
+import "./node-resolve-CupmrA0Y.js";
+import "./provider-stream-gVymYPmd.js";
+import "./identity-file-DM4N5_7H.js";
+import "./provider-models-BA3hqqPq.js";
+import "./secret-file-Bjh19aoH.js";
+import "./logging-BdFqMomc.js";
+import "./runtime-env-CT-voxYE.js";
+import "./registry-Dgwc-7eS.js";
+import "./provider-onboard-CBC3kdk_.js";
+import "./model-definitions-DwehIMlw.js";
+import "./diagnostic-CkiYEGqt.js";
+import "./message-hook-mappers-DORrSLHM.js";
+import "./json-store-DlpyvQXN.js";
+import "./call-DYFR7oGy.js";
+import "./multimodal-BWF8MRkz.js";
+import "./memory-search-BBG2BKIh.js";
+import "./query-expansion-8R79qExs.js";
+import "./search-manager-DxkQvUrW.js";
+import "./core-EKuk2FxR.js";
+import { n as formatConfigIssueLines } from "./issue-format-i6sEuV4a.js";
+import "./logging-BhqLWxTD.js";
+import { r as stylePromptMessage } from "./note-z78_JyNp.js";
+import "./state-paths-C7dX__ql.js";
+import "./config-value-Dl3XEpA6.js";
+import { n as quoteCmdScriptArg } from "./cmd-argv-DJMLDoCh.js";
+import "./command-secret-targets-CO_lZ_ZZ.js";
+import "./brave-CljenznH.js";
+import "./provider-usage-DzuzbNBv.js";
+import "./perplexity-Bw1u3CAF.js";
+import { f as resolveGatewaySystemdServiceName, l as resolveGatewayLaunchAgentLabel, p as resolveGatewayWindowsTaskName } from "./constants-WvU01Mp_.js";
+import "./restart-stale-pids-CN9ElYwR.js";
+import "./delivery-queue-DLjFP-0C.js";
+import "./pairing-token-ANLRyJSu.js";
+import "./accounts-BCaV8MsT.js";
+import "./process-runtime-CicRKAFe.js";
+import "./audit-hdKa3D-u.js";
+import "./cli-runtime-DtIDS2w7.js";
+import "./cli-utils-FHeUZLsT.js";
+import { t as formatHelpExamples } from "./help-format-1yV2Xzq7.js";
+import "./progress-BQSTKUhd.js";
+import "./gateway-runtime-D9FRZqKP.js";
+import "./daemon-install-plan.shared-B0aOTaiV.js";
+import "./runtime-paths-DPdaWILN.js";
+import { r as parseSemver } from "./runtime-guard-CcWejJVQ.js";
+import "./gateway-install-token-CJYFJBaC.js";
+import "./control-ui-shared-E8Nz6uKZ.js";
+import "./onboard-helpers-ChMWfUnl.js";
+import "./runtime-parse-BmC9qo9I.js";
+import "./launchd-C1YgvbKp.js";
+import { n as resolveGatewayService } from "./service-DLhEn8sS.js";
+import "./systemd-BD-XXrY3.js";
+import "./shared-DMm9TCU6.js";
+import "./systemd-hints-LWwXTYeY.js";
+import { r as runDaemonRestart, s as runDaemonInstall } from "./daemon-cli-BtQuIXEk.js";
+import "./probe-Bgt5c-cr.js";
+import "./lifecycle-core-BHHBoRTY.js";
+import { a as terminateStaleGatewayPids, i as renderRestartDiagnostics, s as waitForGatewayHealthyRestart } from "./status-IrMacJRj.js";
+import "./diagnostics-Ct6HBGrk.js";
+import "./inspect-BryOMVYx.js";
+import "./probe-auth-DYdUG8l1.js";
+import "./skills-status-BZpoMXrR.js";
+import { r as installCompletion } from "./completion-cli-Ch1sgSLQ.js";
+import "./register.subclis-DnIweTEG.js";
+import "./command-registry-DSEkUBW1.js";
+import "./program-context-a2M-ivgW.js";
+import { n as renderTable, t as getTerminalTableWidth } from "./table-DUG58M8M.js";
+import "./heartbeat-summary-BimHyQAn.js";
+import "./health-B6WwLJp4.js";
+import "./control-ui-assets-Bwqp8PYM.js";
+import { a as resolveNpmChannelTag, h as resolveUpdateChannelDisplay, l as channelToNpmTag, m as resolveEffectiveUpdateChannel, n as compareSemverStrings, p as normalizeUpdateChannel, r as fetchNpmTagVersion, t as checkUpdateStatus, u as formatUpdateChannelLabel } from "./update-check-Me_VZCOt.js";
+import { a as detectGlobalInstallManagerByPresence, c as resolveGlobalInstallSpec, d as readPackageName, f as readPackageVersion, i as createGlobalInstallEnv, l as resolveGlobalPackageRoot, n as canResolveRegistryVersionForPackageTarget, o as detectGlobalInstallManagerForRoot, r as cleanupGlobalRenameDirs, s as globalInstallArgs, t as runGatewayUpdate, u as normalizePackageTagInput } from "./update-runner-D34sooPe.js";
+import "./channels-status-issues-BjWBQHhU.js";
+import { i as resolveUpdateAvailability, n as formatUpdateOneLiner, t as formatUpdateAvailableHint } from "./status.update-SccSfWO9.js";
+import "./skill-scanner-DB0hEKWk.js";
+import "./install-target-tXRD7VkM.js";
+import "./provider-auth-guidance-WKDIi_wk.js";
+import "./installs-C8fz8sm3.js";
+import { n as updateNpmInstalledPlugins, t as syncPluginsForUpdateChannel } from "./update-BR4JvFpV.js";
+import "./systemd-linger-B_ndoLL9.js";
+import "./health-format-D2gwr1bv.js";
+import { n as doctorCommand, t as selectStyled } from "./prompt-select-styled-DxBcUasv.js";
+import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-TvgV4SZH.js";
+import "./doctor-config-flow-DLzr8W7Y.js";
+import "./channel-account-context-CL3hEq1j.js";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import os from "node:os";
+import fs from "node:fs/promises";
+import { confirm, isCancel, spinner } from "@clack/prompts";
+//#region src/cli/update-cli/shared.ts
+const INVALID_TIMEOUT_ERROR = "--timeout must be a positive integer (seconds)";
+function parseTimeoutMsOrExit(timeout) {
+	const timeoutMs = timeout ? Number.parseInt(timeout, 10) * 1e3 : void 0;
+	if (timeoutMs !== void 0 && (Number.isNaN(timeoutMs) || timeoutMs <= 0)) {
+		defaultRuntime.error(INVALID_TIMEOUT_ERROR);
+		defaultRuntime.exit(1);
+		return null;
+	}
+	return timeoutMs;
+}
+const MOLDCLAW_REPO_URL = "https://github.com/moldclaw/moldclaw.git";
+const MAX_LOG_CHARS = 8e3;
+const DEFAULT_PACKAGE_NAME = "moldclaw";
+const CORE_PACKAGE_NAMES = new Set([DEFAULT_PACKAGE_NAME]);
+function normalizeTag(value) {
+	return normalizePackageTagInput(value, ["moldclaw", DEFAULT_PACKAGE_NAME]);
+}
+function normalizeVersionTag(tag) {
+	const trimmed = tag.trim();
+	if (!trimmed) return null;
+	const cleaned = trimmed.startsWith("v") ? trimmed.slice(1) : trimmed;
+	return parseSemver(cleaned) ? cleaned : null;
+}
+async function resolveTargetVersion(tag, timeoutMs) {
+	if (!canResolveRegistryVersionForPackageTarget(tag)) return null;
+	const direct = normalizeVersionTag(tag);
+	if (direct) return direct;
+	return (await fetchNpmTagVersion({
+		tag,
+		timeoutMs
+	})).version ?? null;
+}
+async function isGitCheckout(root) {
+	try {
+		await fs.stat(path.join(root, ".git"));
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function isCorePackage(root) {
+	const name = await readPackageName(root);
+	return Boolean(name && CORE_PACKAGE_NAMES.has(name));
+}
+async function isEmptyDir(targetPath) {
+	try {
+		return (await fs.readdir(targetPath)).length === 0;
+	} catch {
+		return false;
+	}
+}
+function resolveGitInstallDir() {
+	const override = process.env.MOLDCLAW_GIT_DIR?.trim();
+	if (override) return path.resolve(override);
+	return resolveDefaultGitDir();
+}
+function resolveDefaultGitDir() {
+	return resolveStateDir(process.env, os.homedir);
+}
+function resolveNodeRunner() {
+	const base = path.basename(process.execPath).toLowerCase();
+	if (base === "node" || base === "node.exe") return process.execPath;
+	return "node";
+}
+async function resolveUpdateRoot() {
+	return await resolvemoldClawPackageRoot({
+		moduleUrl: import.meta.url,
+		argv1: process.argv[1],
+		cwd: process.cwd()
+	}) ?? process.cwd();
+}
+async function runUpdateStep(params) {
+	const command = params.argv.join(" ");
+	params.progress?.onStepStart?.({
+		name: params.name,
+		command,
+		index: 0,
+		total: 0
+	});
+	const started = Date.now();
+	const res = await runCommandWithTimeout(params.argv, {
+		cwd: params.cwd,
+		env: params.env,
+		timeoutMs: params.timeoutMs
+	});
+	const durationMs = Date.now() - started;
+	const stderrTail = trimLogTail(res.stderr, MAX_LOG_CHARS);
+	params.progress?.onStepComplete?.({
+		name: params.name,
+		command,
+		index: 0,
+		total: 0,
+		durationMs,
+		exitCode: res.code,
+		stderrTail
+	});
+	return {
+		name: params.name,
+		command,
+		cwd: params.cwd ?? process.cwd(),
+		durationMs,
+		exitCode: res.code,
+		stdoutTail: trimLogTail(res.stdout, MAX_LOG_CHARS),
+		stderrTail
+	};
+}
+async function ensureGitCheckout(params) {
+	if (!await pathExists(params.dir)) return await runUpdateStep({
+		name: "git clone",
+		argv: [
+			"git",
+			"clone",
+			MOLDCLAW_REPO_URL,
+			params.dir
+		],
+		timeoutMs: params.timeoutMs,
+		progress: params.progress
+	});
+	if (!await isGitCheckout(params.dir)) {
+		if (!await isEmptyDir(params.dir)) throw new Error(`MOLDCLAW_GIT_DIR points at a non-git directory: ${params.dir}. Set MOLDCLAW_GIT_DIR to an empty folder or an moldclaw checkout.`);
+		return await runUpdateStep({
+			name: "git clone",
+			argv: [
+				"git",
+				"clone",
+				MOLDCLAW_REPO_URL,
+				params.dir
+			],
+			cwd: params.dir,
+			timeoutMs: params.timeoutMs,
+			progress: params.progress
+		});
+	}
+	if (!await isCorePackage(params.dir)) throw new Error(`MOLDCLAW_GIT_DIR does not look like a core checkout: ${params.dir}.`);
+	return null;
+}
+async function resolveGlobalManager(params) {
+	const runCommand = createGlobalCommandRunner();
+	if (params.installKind === "package") {
+		const detected = await detectGlobalInstallManagerForRoot(runCommand, params.root, params.timeoutMs);
+		if (detected) return detected;
+	}
+	return await detectGlobalInstallManagerByPresence(runCommand, params.timeoutMs) ?? "npm";
+}
+async function tryWriteCompletionCache(root, jsonMode) {
+	const binPath = path.join(root, "moldclaw.mjs");
+	if (!await pathExists(binPath)) return;
+	const result = spawnSync(resolveNodeRunner(), [
+		binPath,
+		"completion",
+		"--write-state"
+	], {
+		cwd: root,
+		env: process.env,
+		encoding: "utf-8"
+	});
+	if (result.error) {
+		if (!jsonMode) defaultRuntime.log(theme.warn(`Completion cache update failed: ${String(result.error)}`));
+		return;
+	}
+	if (result.status !== 0 && !jsonMode) {
+		const stderr = (result.stderr ?? "").toString().trim();
+		const detail = stderr ? ` (${stderr})` : "";
+		defaultRuntime.log(theme.warn(`Completion cache update failed${detail}.`));
+	}
+}
+function createGlobalCommandRunner() {
+	return async (argv, options) => {
+		const res = await runCommandWithTimeout(argv, options);
+		return {
+			stdout: res.stdout,
+			stderr: res.stderr,
+			code: res.code
+		};
+	};
+}
+//#endregion
+//#region src/cli/update-cli/status.ts
+function formatGitStatusLine(params) {
+	const shortSha = params.sha ? params.sha.slice(0, 8) : null;
+	const branch = params.branch && params.branch !== "HEAD" ? params.branch : null;
+	const tag = params.tag;
+	return [
+		branch ?? (tag ? "detached" : "git"),
+		tag ? `tag ${tag}` : null,
+		shortSha ? `@ ${shortSha}` : null
+	].filter(Boolean).join(" · ");
+}
+async function updateStatusCommand(opts) {
+	const timeoutMs = parseTimeoutMsOrExit(opts.timeout);
+	if (timeoutMs === null) return;
+	const root = await resolveUpdateRoot();
+	const configSnapshot = await readConfigFileSnapshot();
+	const configChannel = configSnapshot.valid ? normalizeUpdateChannel(configSnapshot.config.update?.channel) : null;
+	const update = await checkUpdateStatus({
+		root,
+		timeoutMs: timeoutMs ?? 3500,
+		fetchGit: true,
+		includeRegistry: true
+	});
+	const channelInfo = resolveUpdateChannelDisplay({
+		configChannel,
+		installKind: update.installKind,
+		gitTag: update.git?.tag ?? null,
+		gitBranch: update.git?.branch ?? null
+	});
+	const channelLabel = channelInfo.label;
+	const gitLabel = update.installKind === "git" ? formatGitStatusLine({
+		branch: update.git?.branch ?? null,
+		tag: update.git?.tag ?? null,
+		sha: update.git?.sha ?? null
+	}) : null;
+	const updateAvailability = resolveUpdateAvailability(update);
+	const updateLine = formatUpdateOneLiner(update).replace(/^Update:\s*/i, "");
+	if (opts.json) {
+		defaultRuntime.log(JSON.stringify({
+			update,
+			channel: {
+				value: channelInfo.channel,
+				source: channelInfo.source,
+				label: channelLabel,
+				config: configChannel
+			},
+			availability: updateAvailability
+		}, null, 2));
+		return;
+	}
+	const tableWidth = getTerminalTableWidth();
+	const rows = [
+		{
+			Item: "Install",
+			Value: update.installKind === "git" ? `git (${update.root ?? "unknown"})` : update.installKind === "package" ? update.packageManager : "unknown"
+		},
+		{
+			Item: "Channel",
+			Value: channelLabel
+		},
+		...gitLabel ? [{
+			Item: "Git",
+			Value: gitLabel
+		}] : [],
+		{
+			Item: "Update",
+			Value: updateAvailability.available ? theme.warn(`available · ${updateLine}`) : updateLine
+		}
+	];
+	defaultRuntime.log(theme.heading("moldClaw update status"));
+	defaultRuntime.log("");
+	defaultRuntime.log(renderTable({
+		width: tableWidth,
+		columns: [{
+			key: "Item",
+			header: "Item",
+			minWidth: 10
+		}, {
+			key: "Value",
+			header: "Value",
+			flex: true,
+			minWidth: 24
+		}],
+		rows
+	}).trimEnd());
+	defaultRuntime.log("");
+	const updateHint = formatUpdateAvailableHint(update);
+	if (updateHint) defaultRuntime.log(theme.warn(updateHint));
+}
+//#endregion
+//#region src/cli/update-cli/progress.ts
+const STEP_LABELS = {
+	"clean check": "Working directory is clean",
+	"upstream check": "Upstream branch exists",
+	"git fetch": "Fetching latest changes",
+	"git rebase": "Rebasing onto target commit",
+	"git rev-parse @{upstream}": "Resolving upstream commit",
+	"git rev-list": "Enumerating candidate commits",
+	"git clone": "Cloning git checkout",
+	"preflight worktree": "Preparing preflight worktree",
+	"preflight cleanup": "Cleaning preflight worktree",
+	"deps install": "Installing dependencies",
+	build: "Building",
+	"ui:build": "Building UI assets",
+	"ui:build (post-doctor repair)": "Restoring missing UI assets",
+	"ui assets verify": "Validating UI assets",
+	"moldclaw doctor entry": "Checking doctor entrypoint",
+	"moldclaw doctor": "Running doctor checks",
+	"git rev-parse HEAD (after)": "Verifying update",
+	"global update": "Updating via package manager",
+	"global update (omit optional)": "Retrying update without optional deps",
+	"global install": "Installing global package"
+};
+function getStepLabel(step) {
+	return STEP_LABELS[step.name] ?? step.name;
+}
+function inferUpdateFailureHints(result) {
+	if (result.status !== "error" || result.mode !== "npm") return [];
+	const failedStep = [...result.steps].toReversed().find((step) => step.exitCode !== 0);
+	if (!failedStep) return [];
+	const stderr = (failedStep.stderrTail ?? "").toLowerCase();
+	const hints = [];
+	if (failedStep.name.startsWith("global update") && stderr.includes("eacces")) {
+		hints.push("Detected permission failure (EACCES). Re-run with a writable global prefix or sudo (for system-managed Node installs).");
+		hints.push("Example: npm config set prefix ~/.local && npm i -g moldclaw@latest");
+	}
+	if (failedStep.name.startsWith("global update") && (stderr.includes("node-gyp") || stderr.includes("prebuild"))) {
+		hints.push("Detected native optional dependency build failure. The updater retries with --omit=optional automatically.");
+		hints.push("If it still fails: npm i -g moldclaw@latest --omit=optional");
+	}
+	return hints;
+}
+function createUpdateProgress(enabled) {
+	if (!enabled) return {
+		progress: {},
+		stop: () => {}
+	};
+	let currentSpinner = null;
+	return {
+		progress: {
+			onStepStart: (step) => {
+				currentSpinner = spinner();
+				currentSpinner.start(theme.accent(getStepLabel(step)));
+			},
+			onStepComplete: (step) => {
+				if (!currentSpinner) return;
+				const label = getStepLabel(step);
+				const duration = theme.muted(`(${formatDurationPrecise(step.durationMs)})`);
+				const icon = step.exitCode === 0 ? theme.success("✓") : theme.error("✗");
+				currentSpinner.stop(`${icon} ${label} ${duration}`);
+				currentSpinner = null;
+				if (step.exitCode !== 0 && step.stderrTail) {
+					const lines = step.stderrTail.split("\n").slice(-10);
+					for (const line of lines) if (line.trim()) defaultRuntime.log(`    ${theme.error(line)}`);
+				}
+			}
+		},
+		stop: () => {
+			if (currentSpinner) {
+				currentSpinner.stop();
+				currentSpinner = null;
+			}
+		}
+	};
+}
+function formatStepStatus(exitCode) {
+	if (exitCode === 0) return theme.success("✓");
+	if (exitCode === null) return theme.warn("?");
+	return theme.error("✗");
+}
+function printResult(result, opts) {
+	if (opts.json) {
+		defaultRuntime.log(JSON.stringify(result, null, 2));
+		return;
+	}
+	const statusColor = result.status === "ok" ? theme.success : result.status === "skipped" ? theme.warn : theme.error;
+	defaultRuntime.log("");
+	defaultRuntime.log(`${theme.heading("Update Result:")} ${statusColor(result.status.toUpperCase())}`);
+	if (result.root) defaultRuntime.log(`  Root: ${theme.muted(result.root)}`);
+	if (result.reason) defaultRuntime.log(`  Reason: ${theme.muted(result.reason)}`);
+	if (result.before?.version || result.before?.sha) {
+		const before = result.before.version ?? result.before.sha?.slice(0, 8) ?? "";
+		defaultRuntime.log(`  Before: ${theme.muted(before)}`);
+	}
+	if (result.after?.version || result.after?.sha) {
+		const after = result.after.version ?? result.after.sha?.slice(0, 8) ?? "";
+		defaultRuntime.log(`  After: ${theme.muted(after)}`);
+	}
+	if (!opts.hideSteps && result.steps.length > 0) {
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Steps:"));
+		for (const step of result.steps) {
+			const status = formatStepStatus(step.exitCode);
+			const duration = theme.muted(`(${formatDurationPrecise(step.durationMs)})`);
+			defaultRuntime.log(`  ${status} ${step.name} ${duration}`);
+			if (step.exitCode !== 0 && step.stderrTail) {
+				const lines = step.stderrTail.split("\n").slice(0, 5);
+				for (const line of lines) if (line.trim()) defaultRuntime.log(`      ${theme.error(line)}`);
+			}
+		}
+	}
+	const hints = inferUpdateFailureHints(result);
+	if (hints.length > 0) {
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Recovery hints:"));
+		for (const hint of hints) defaultRuntime.log(`  - ${theme.warn(hint)}`);
+	}
+	defaultRuntime.log("");
+	defaultRuntime.log(`Total time: ${theme.muted(formatDurationPrecise(result.durationMs))}`);
+}
+//#endregion
+//#region src/cli/update-cli/restart-helper.ts
+/**
+* Shell-escape a string for embedding in single-quoted shell arguments.
+* Replaces every `'` with `'\''` (end quote, escaped quote, resume quote).
+* For batch scripts, validates against special characters instead.
+*/
+function shellEscape(value) {
+	return value.replace(/'/g, "'\\''");
+}
+/** Validates a string is safe for embedding in a batch (cmd.exe) script. */
+function isBatchSafe(value) {
+	return /^[A-Za-z0-9 _\-().]+$/.test(value);
+}
+function resolveSystemdUnit(env) {
+	const override = env.MOLDCLAW_SYSTEMD_UNIT?.trim();
+	if (override) return override.endsWith(".service") ? override : `${override}.service`;
+	return `${resolveGatewaySystemdServiceName(env.MOLDCLAW_PROFILE)}.service`;
+}
+function resolveLaunchdLabel(env) {
+	const override = env.MOLDCLAW_LAUNCHD_LABEL?.trim();
+	if (override) return override;
+	return resolveGatewayLaunchAgentLabel(env.MOLDCLAW_PROFILE);
+}
+function resolveWindowsTaskName(env) {
+	const override = env.MOLDCLAW_WINDOWS_TASK_NAME?.trim();
+	if (override) return override;
+	return resolveGatewayWindowsTaskName(env.MOLDCLAW_PROFILE);
+}
+/**
+* Prepares a standalone script to restart the gateway service.
+* This script is written to a temporary directory and does not depend on
+* the installed package files, ensuring restart capability even if the
+* update process temporarily removes or corrupts installation files.
+*/
+async function prepareRestartScript(env = process.env, gatewayPort = DEFAULT_GATEWAY_PORT) {
+	const tmpDir = os.tmpdir();
+	const timestamp = Date.now();
+	const platform = process.platform;
+	let scriptContent = "";
+	let filename = "";
+	try {
+		if (platform === "linux") {
+			const escaped = shellEscape(resolveSystemdUnit(env));
+			filename = `moldclaw-restart-${timestamp}.sh`;
+			scriptContent = `#!/bin/sh
+# Standalone restart script — survives parent process termination.
+# Wait briefly to ensure file locks are released after update.
+sleep 1
+systemctl --user restart '${escaped}'
+# Self-cleanup
+rm -f "$0"
+`;
+		} else if (platform === "darwin") {
+			const label = resolveLaunchdLabel(env);
+			const escaped = shellEscape(label);
+			const uid = process.getuid ? process.getuid() : 501;
+			const home = env.HOME?.trim() || process.env.HOME || os.homedir();
+			const escapedPlistPath = shellEscape(path.join(home, "Library", "LaunchAgents", `${label}.plist`));
+			filename = `moldclaw-restart-${timestamp}.sh`;
+			scriptContent = `#!/bin/sh
+# Standalone restart script — survives parent process termination.
+# Wait briefly to ensure file locks are released after update.
+sleep 1
+# Try kickstart first (works when the service is still registered).
+# If it fails (e.g. after bootout), clear any persisted disabled state,
+# then re-register via bootstrap and kickstart.
+if ! launchctl kickstart -k 'gui/${uid}/${escaped}' 2>/dev/null; then
+  launchctl enable 'gui/${uid}/${escaped}' 2>/dev/null
+  launchctl bootstrap 'gui/${uid}' '${escapedPlistPath}' 2>/dev/null
+  launchctl kickstart -k 'gui/${uid}/${escaped}' 2>/dev/null || true
+fi
+# Self-cleanup
+rm -f "$0"
+`;
+		} else if (platform === "win32") {
+			const taskName = resolveWindowsTaskName(env);
+			if (!isBatchSafe(taskName)) return null;
+			const port = Number.isFinite(gatewayPort) && gatewayPort > 0 ? gatewayPort : DEFAULT_GATEWAY_PORT;
+			filename = `moldclaw-restart-${timestamp}.bat`;
+			scriptContent = `@echo off
+REM Standalone restart script — survives parent process termination.
+REM Wait briefly to ensure file locks are released after update.
+timeout /t 2 /nobreak >nul
+schtasks /End /TN "${taskName}"
+REM Poll for gateway port release before rerun; force-kill listener if stuck.
+set /a attempts=0
+:wait_for_port_release
+set /a attempts+=1
+netstat -ano | findstr /R /C:":${port} .*LISTENING" >nul
+if errorlevel 1 goto port_released
+if %attempts% GEQ 10 goto force_kill_listener
+timeout /t 1 /nobreak >nul
+goto wait_for_port_release
+:force_kill_listener
+for /f "tokens=5" %%P in ('netstat -ano ^| findstr /R /C:":${port} .*LISTENING"') do (
+  taskkill /F /PID %%P >nul 2>&1
+  goto port_released
+)
+:port_released
+schtasks /Run /TN "${taskName}"
+REM Self-cleanup
+del "%~f0"
+`;
+		} else return null;
+		const scriptPath = path.join(tmpDir, filename);
+		await fs.writeFile(scriptPath, scriptContent, { mode: 493 });
+		return scriptPath;
+	} catch {
+		return null;
+	}
+}
+/**
+* Executes the prepared restart script as a **detached** process.
+*
+* The script must outlive the CLI process because the CLI itself is part
+* of the service being restarted — `systemctl restart` / `launchctl
+* kickstart -k` will terminate the current process tree.  Using
+* `spawn({ detached: true })` + `unref()` ensures the script survives
+* the parent's exit.
+*
+* Resolves immediately after spawning; the script runs independently.
+*/
+async function runRestartScript(scriptPath) {
+	const isWindows = process.platform === "win32";
+	spawn(isWindows ? "cmd.exe" : "/bin/sh", isWindows ? [
+		"/d",
+		"/s",
+		"/c",
+		quoteCmdScriptArg(scriptPath)
+	] : [scriptPath], {
+		detached: true,
+		stdio: "ignore",
+		windowsHide: true
+	}).unref();
+}
+//#endregion
+//#region src/cli/update-cli/suppress-deprecations.ts
+/**
+* Suppress Node.js deprecation warnings.
+*
+* On Node.js v23+ `process.noDeprecation` may be a read-only property
+* (defined via a getter on the prototype with no setter), so the
+* assignment can throw. We fall back to the environment variable which
+* achieves the same effect.
+*/
+function suppressDeprecations() {
+	try {
+		process.noDeprecation = true;
+	} catch {}
+	process.env.NODE_NO_WARNINGS = "1";
+}
+//#endregion
+//#region src/cli/update-cli/update-command.ts
+const CLI_NAME = resolveCliName();
+const SERVICE_REFRESH_TIMEOUT_MS = 6e4;
+const SERVICE_REFRESH_PATH_ENV_KEYS = [
+	"MOLDCLAW_HOME",
+	"MOLDCLAW_STATE_DIR",
+	"MOLDCLAW_STATE_DIR",
+	"MOLDCLAW_CONFIG_PATH",
+	"MOLDCLAW_CONFIG_PATH"
+];
+const UPDATE_QUIPS = [
+	"Leveled up! New skills unlocked. You're welcome.",
+	"Fresh code, tighter knot. Miss me?",
+	"Back and better. Did you even notice I was gone?",
+	"Update complete. I learned some new tricks while I was out.",
+	"Upgraded! Now with 23% more sass.",
+	"I've evolved. Try to keep up.",
+	"New version, who dis? Oh right, still me but shinier.",
+	"Patched, polished, and ready to pinch. Let's go.",
+	"The knot has tightened. Stronger bonds, smoother workflows.",
+	"Update done! Check the changelog or just trust me, it's good.",
+	"Reborn from the boiling waters of npm. Stronger now.",
+	"I went away and came back smarter. You should try it sometime.",
+	"Update complete. The bugs feared me, so they left.",
+	"New version installed. Old version sends its regards.",
+	"Firmware fresh. Brain wrinkles: increased.",
+	"I've seen things you wouldn't believe. Anyway, I'm updated.",
+	"Back online. The changelog is long but our friendship is longer.",
+	"Upgraded! Peter fixed stuff. Blame him if it breaks.",
+	"Molting complete. Please don't look at my soft shell phase.",
+	"Version bump! Same chaos energy, fewer crashes (probably)."
+];
+function pickUpdateQuip() {
+	return UPDATE_QUIPS[Math.floor(Math.random() * UPDATE_QUIPS.length)] ?? "Update complete.";
+}
+function resolveGatewayInstallEntrypointCandidates(root) {
+	if (!root) return [];
+	return [
+		path.join(root, "dist", "entry.js"),
+		path.join(root, "dist", "entry.mjs"),
+		path.join(root, "dist", "index.js"),
+		path.join(root, "dist", "index.mjs")
+	];
+}
+function formatCommandFailure(stdout, stderr) {
+	const detail = (stderr || stdout).trim();
+	if (!detail) return "command returned a non-zero exit code";
+	return detail.split("\n").slice(-3).join("\n");
+}
+function tryResolveInvocationCwd() {
+	try {
+		return process.cwd();
+	} catch {
+		return;
+	}
+}
+function resolveServiceRefreshEnv(env, invocationCwd) {
+	const resolvedEnv = { ...env };
+	for (const key of SERVICE_REFRESH_PATH_ENV_KEYS) {
+		const rawValue = resolvedEnv[key]?.trim();
+		if (!rawValue) continue;
+		if (rawValue.startsWith("~") || path.isAbsolute(rawValue) || path.win32.isAbsolute(rawValue)) {
+			resolvedEnv[key] = rawValue;
+			continue;
+		}
+		if (!invocationCwd) {
+			resolvedEnv[key] = rawValue;
+			continue;
+		}
+		resolvedEnv[key] = path.resolve(invocationCwd, rawValue);
+	}
+	return resolvedEnv;
+}
+function printDryRunPreview(preview, jsonMode) {
+	if (jsonMode) {
+		defaultRuntime.log(JSON.stringify(preview, null, 2));
+		return;
+	}
+	defaultRuntime.log(theme.heading("Update dry-run"));
+	defaultRuntime.log(theme.muted("No changes were applied."));
+	defaultRuntime.log("");
+	defaultRuntime.log(`  Root: ${theme.muted(preview.root)}`);
+	defaultRuntime.log(`  Install kind: ${theme.muted(preview.installKind)}`);
+	defaultRuntime.log(`  Mode: ${theme.muted(preview.mode)}`);
+	defaultRuntime.log(`  Channel: ${theme.muted(preview.effectiveChannel)}`);
+	defaultRuntime.log(`  Tag/spec: ${theme.muted(preview.tag)}`);
+	if (preview.currentVersion) defaultRuntime.log(`  Current version: ${theme.muted(preview.currentVersion)}`);
+	if (preview.targetVersion) defaultRuntime.log(`  Target version: ${theme.muted(preview.targetVersion)}`);
+	if (preview.downgradeRisk) defaultRuntime.log(theme.warn("  Downgrade confirmation would be required in a real run."));
+	defaultRuntime.log("");
+	defaultRuntime.log(theme.heading("Planned actions:"));
+	for (const action of preview.actions) defaultRuntime.log(`  - ${action}`);
+	if (preview.notes.length > 0) {
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Notes:"));
+		for (const note of preview.notes) defaultRuntime.log(`  - ${theme.muted(note)}`);
+	}
+}
+async function refreshGatewayServiceEnv(params) {
+	const args = [
+		"gateway",
+		"install",
+		"--force"
+	];
+	if (params.jsonMode) args.push("--json");
+	for (const candidate of resolveGatewayInstallEntrypointCandidates(params.result.root)) {
+		if (!await pathExists(candidate)) continue;
+		const res = await runCommandWithTimeout([
+			resolveNodeRunner(),
+			candidate,
+			...args
+		], {
+			cwd: params.result.root,
+			env: resolveServiceRefreshEnv(process.env, params.invocationCwd),
+			timeoutMs: SERVICE_REFRESH_TIMEOUT_MS
+		});
+		if (res.code === 0) return;
+		throw new Error(`updated install refresh failed (${candidate}): ${formatCommandFailure(res.stdout, res.stderr)}`);
+	}
+	await runDaemonInstall({
+		force: true,
+		json: params.jsonMode || void 0
+	});
+}
+async function tryInstallShellCompletion(opts) {
+	if (opts.jsonMode || !process.stdin.isTTY) return;
+	const status = await checkShellCompletionStatus(CLI_NAME);
+	if (status.usesSlowPattern) {
+		defaultRuntime.log(theme.muted("Upgrading shell completion to cached version..."));
+		if (await ensureCompletionCacheExists(CLI_NAME)) await installCompletion(status.shell, true, CLI_NAME);
+		return;
+	}
+	if (status.profileInstalled && !status.cacheExists) {
+		defaultRuntime.log(theme.muted("Regenerating shell completion cache..."));
+		await ensureCompletionCacheExists(CLI_NAME);
+		return;
+	}
+	if (!status.profileInstalled) {
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Shell completion"));
+		const shouldInstall = await confirm({
+			message: stylePromptMessage(`Enable ${status.shell} shell completion for ${CLI_NAME}?`),
+			initialValue: true
+		});
+		if (isCancel(shouldInstall) || !shouldInstall) {
+			if (!opts.skipPrompt) defaultRuntime.log(theme.muted(`Skipped. Run \`${replaceCliName(formatCliCommand("moldclaw completion --install"), CLI_NAME)}\` later to enable.`));
+			return;
+		}
+		if (!await ensureCompletionCacheExists(CLI_NAME)) {
+			defaultRuntime.log(theme.warn("Failed to generate completion cache."));
+			return;
+		}
+		await installCompletion(status.shell, opts.skipPrompt, CLI_NAME);
+	}
+}
+async function runPackageInstallUpdate(params) {
+	const manager = await resolveGlobalManager({
+		root: params.root,
+		installKind: params.installKind,
+		timeoutMs: params.timeoutMs
+	});
+	const installEnv = await createGlobalInstallEnv();
+	const pkgRoot = await resolveGlobalPackageRoot(manager, createGlobalCommandRunner(), params.timeoutMs);
+	const packageName = (pkgRoot ? await readPackageName(pkgRoot) : await readPackageName(params.root)) ?? "moldclaw";
+	const installSpec = resolveGlobalInstallSpec({
+		packageName,
+		tag: params.tag,
+		env: installEnv
+	});
+	const beforeVersion = pkgRoot ? await readPackageVersion(pkgRoot) : null;
+	if (pkgRoot) await cleanupGlobalRenameDirs({
+		globalRoot: path.dirname(pkgRoot),
+		packageName
+	});
+	const steps = [await runUpdateStep({
+		name: "global update",
+		argv: globalInstallArgs(manager, installSpec),
+		env: installEnv,
+		timeoutMs: params.timeoutMs,
+		progress: params.progress
+	})];
+	let afterVersion = beforeVersion;
+	if (pkgRoot) {
+		afterVersion = await readPackageVersion(pkgRoot);
+		const entryPath = path.join(pkgRoot, "dist", "entry.js");
+		if (await pathExists(entryPath)) {
+			const doctorStep = await runUpdateStep({
+				name: `${CLI_NAME} doctor`,
+				argv: [
+					resolveNodeRunner(),
+					entryPath,
+					"doctor",
+					"--non-interactive"
+				],
+				timeoutMs: params.timeoutMs,
+				progress: params.progress
+			});
+			steps.push(doctorStep);
+		}
+	}
+	const failedStep = steps.find((step) => step.exitCode !== 0);
+	return {
+		status: failedStep ? "error" : "ok",
+		mode: manager,
+		root: pkgRoot ?? params.root,
+		reason: failedStep ? failedStep.name : void 0,
+		before: { version: beforeVersion },
+		after: { version: afterVersion },
+		steps,
+		durationMs: Date.now() - params.startedAt
+	};
+}
+async function runGitUpdate(params) {
+	const updateRoot = params.switchToGit ? resolveGitInstallDir() : params.root;
+	const effectiveTimeout = params.timeoutMs ?? 20 * 6e4;
+	const cloneStep = params.switchToGit ? await ensureGitCheckout({
+		dir: updateRoot,
+		timeoutMs: effectiveTimeout,
+		progress: params.progress
+	}) : null;
+	if (cloneStep && cloneStep.exitCode !== 0) {
+		const result = {
+			status: "error",
+			mode: "git",
+			root: updateRoot,
+			reason: cloneStep.name,
+			steps: [cloneStep],
+			durationMs: Date.now() - params.startedAt
+		};
+		params.stop();
+		printResult(result, {
+			...params.opts,
+			hideSteps: params.showProgress
+		});
+		defaultRuntime.exit(1);
+		return result;
+	}
+	const updateResult = await runGatewayUpdate({
+		cwd: updateRoot,
+		argv1: params.switchToGit ? void 0 : process.argv[1],
+		timeoutMs: params.timeoutMs,
+		progress: params.progress,
+		channel: params.channel,
+		tag: params.tag
+	});
+	const steps = [...cloneStep ? [cloneStep] : [], ...updateResult.steps];
+	if (params.switchToGit && updateResult.status === "ok") {
+		const installStep = await runUpdateStep({
+			name: "global install",
+			argv: globalInstallArgs(await resolveGlobalManager({
+				root: params.root,
+				installKind: params.installKind,
+				timeoutMs: effectiveTimeout
+			}), updateRoot),
+			cwd: updateRoot,
+			env: await createGlobalInstallEnv(),
+			timeoutMs: effectiveTimeout,
+			progress: params.progress
+		});
+		steps.push(installStep);
+		const failedStep = installStep.exitCode !== 0 ? installStep : null;
+		return {
+			...updateResult,
+			status: updateResult.status === "ok" && !failedStep ? "ok" : "error",
+			steps,
+			durationMs: Date.now() - params.startedAt
+		};
+	}
+	return {
+		...updateResult,
+		steps,
+		durationMs: Date.now() - params.startedAt
+	};
+}
+async function updatePluginsAfterCoreUpdate(params) {
+	if (!params.configSnapshot.valid) {
+		if (!params.opts.json) defaultRuntime.log(theme.warn("Skipping plugin updates: config is invalid."));
+		return;
+	}
+	const pluginLogger = params.opts.json ? {} : {
+		info: (msg) => defaultRuntime.log(msg),
+		warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+		error: (msg) => defaultRuntime.log(theme.error(msg))
+	};
+	if (!params.opts.json) {
+		defaultRuntime.log("");
+		defaultRuntime.log(theme.heading("Updating plugins..."));
+	}
+	const syncResult = await syncPluginsForUpdateChannel({
+		config: params.configSnapshot.config,
+		channel: params.channel,
+		workspaceDir: params.root,
+		logger: pluginLogger
+	});
+	let pluginConfig = syncResult.config;
+	const npmResult = await updateNpmInstalledPlugins({
+		config: pluginConfig,
+		skipIds: new Set(syncResult.summary.switchedToNpm),
+		logger: pluginLogger
+	});
+	pluginConfig = npmResult.config;
+	if (syncResult.changed || npmResult.changed) await writeConfigFile(pluginConfig);
+	if (params.opts.json) return;
+	const summarizeList = (list) => {
+		if (list.length <= 6) return list.join(", ");
+		return `${list.slice(0, 6).join(", ")} +${list.length - 6} more`;
+	};
+	if (syncResult.summary.switchedToBundled.length > 0) defaultRuntime.log(theme.muted(`Switched to bundled plugins: ${summarizeList(syncResult.summary.switchedToBundled)}.`));
+	if (syncResult.summary.switchedToNpm.length > 0) defaultRuntime.log(theme.muted(`Restored npm plugins: ${summarizeList(syncResult.summary.switchedToNpm)}.`));
+	for (const warning of syncResult.summary.warnings) defaultRuntime.log(theme.warn(warning));
+	for (const error of syncResult.summary.errors) defaultRuntime.log(theme.error(error));
+	const updated = npmResult.outcomes.filter((entry) => entry.status === "updated").length;
+	const unchanged = npmResult.outcomes.filter((entry) => entry.status === "unchanged").length;
+	const failed = npmResult.outcomes.filter((entry) => entry.status === "error").length;
+	const skipped = npmResult.outcomes.filter((entry) => entry.status === "skipped").length;
+	if (npmResult.outcomes.length === 0) defaultRuntime.log(theme.muted("No plugin updates needed."));
+	else {
+		const parts = [`${updated} updated`, `${unchanged} unchanged`];
+		if (failed > 0) parts.push(`${failed} failed`);
+		if (skipped > 0) parts.push(`${skipped} skipped`);
+		defaultRuntime.log(theme.muted(`npm plugins: ${parts.join(", ")}.`));
+	}
+	for (const outcome of npmResult.outcomes) {
+		if (outcome.status !== "error") continue;
+		defaultRuntime.log(theme.error(outcome.message));
+	}
+}
+async function maybeRestartService(params) {
+	if (params.shouldRestart) {
+		if (!params.opts.json) {
+			defaultRuntime.log("");
+			defaultRuntime.log(theme.heading("Restarting service..."));
+		}
+		try {
+			let restarted = false;
+			let restartInitiated = false;
+			if (params.refreshServiceEnv) try {
+				await refreshGatewayServiceEnv({
+					result: params.result,
+					jsonMode: Boolean(params.opts.json),
+					invocationCwd: params.invocationCwd
+				});
+			} catch (err) {
+				if (!params.opts.json) defaultRuntime.log(theme.warn(`Failed to refresh gateway service environment from updated install: ${String(err)}`));
+			}
+			if (params.restartScriptPath) {
+				await runRestartScript(params.restartScriptPath);
+				restartInitiated = true;
+			} else restarted = await runDaemonRestart();
+			if (!params.opts.json && restarted) {
+				defaultRuntime.log(theme.success("Daemon restarted successfully."));
+				defaultRuntime.log("");
+				process.env.MOLDCLAW_UPDATE_IN_PROGRESS = "1";
+				try {
+					await doctorCommand(defaultRuntime, { nonInteractive: !(Boolean(process.stdin.isTTY) && !params.opts.json && params.opts.yes !== true) });
+				} catch (err) {
+					defaultRuntime.log(theme.warn(`Doctor failed: ${String(err)}`));
+				} finally {
+					delete process.env.MOLDCLAW_UPDATE_IN_PROGRESS;
+				}
+			}
+			if (!params.opts.json && restartInitiated) {
+				const service = resolveGatewayService();
+				let health = await waitForGatewayHealthyRestart({
+					service,
+					port: params.gatewayPort
+				});
+				if (!health.healthy && health.staleGatewayPids.length > 0) {
+					if (!params.opts.json) defaultRuntime.log(theme.warn(`Found stale gateway process(es) after restart: ${health.staleGatewayPids.join(", ")}. Cleaning up...`));
+					await terminateStaleGatewayPids(health.staleGatewayPids);
+					await runDaemonRestart();
+					health = await waitForGatewayHealthyRestart({
+						service,
+						port: params.gatewayPort
+					});
+				}
+				if (health.healthy) defaultRuntime.log(theme.success("Daemon restart completed."));
+				else {
+					defaultRuntime.log(theme.warn("Gateway did not become healthy after restart."));
+					for (const line of renderRestartDiagnostics(health)) defaultRuntime.log(theme.muted(line));
+					defaultRuntime.log(theme.muted(`Run \`${replaceCliName(formatCliCommand("moldclaw gateway status --deep"), CLI_NAME)}\` for details.`));
+				}
+				defaultRuntime.log("");
+			}
+		} catch (err) {
+			if (!params.opts.json) {
+				defaultRuntime.log(theme.warn(`Daemon restart failed: ${String(err)}`));
+				defaultRuntime.log(theme.muted(`You may need to restart the service manually: ${replaceCliName(formatCliCommand("moldclaw gateway restart"), CLI_NAME)}`));
+			}
+		}
+		return;
+	}
+	if (!params.opts.json) {
+		defaultRuntime.log("");
+		if (params.result.mode === "npm" || params.result.mode === "pnpm") defaultRuntime.log(theme.muted(`Tip: Run \`${replaceCliName(formatCliCommand("moldclaw doctor"), CLI_NAME)}\`, then \`${replaceCliName(formatCliCommand("moldclaw gateway restart"), CLI_NAME)}\` to apply updates to a running gateway.`));
+		else defaultRuntime.log(theme.muted(`Tip: Run \`${replaceCliName(formatCliCommand("moldclaw gateway restart"), CLI_NAME)}\` to apply updates to a running gateway.`));
+	}
+}
+async function updateCommand(opts) {
+	suppressDeprecations();
+	const invocationCwd = tryResolveInvocationCwd();
+	const timeoutMs = parseTimeoutMsOrExit(opts.timeout);
+	const shouldRestart = opts.restart !== false;
+	if (timeoutMs === null) return;
+	const root = await resolveUpdateRoot();
+	const updateStatus = await checkUpdateStatus({
+		root,
+		timeoutMs: timeoutMs ?? 3500,
+		fetchGit: false,
+		includeRegistry: false
+	});
+	const configSnapshot = await readConfigFileSnapshot();
+	const storedChannel = configSnapshot.valid ? normalizeUpdateChannel(configSnapshot.config.update?.channel) : null;
+	const requestedChannel = normalizeUpdateChannel(opts.channel);
+	if (opts.channel && !requestedChannel) {
+		defaultRuntime.error(`--channel must be "stable", "beta", or "dev" (got "${opts.channel}")`);
+		defaultRuntime.exit(1);
+		return;
+	}
+	if (opts.channel && !configSnapshot.valid) {
+		const issues = formatConfigIssueLines(configSnapshot.issues, "-");
+		defaultRuntime.error(["Config is invalid; cannot set update channel.", ...issues].join("\n"));
+		defaultRuntime.exit(1);
+		return;
+	}
+	const installKind = updateStatus.installKind;
+	const switchToGit = requestedChannel === "dev" && installKind !== "git";
+	const switchToPackage = requestedChannel !== null && requestedChannel !== "dev" && installKind === "git";
+	const updateInstallKind = switchToGit ? "git" : switchToPackage ? "package" : installKind;
+	const channel = requestedChannel ?? storedChannel ?? (updateInstallKind === "git" ? "dev" : "stable");
+	const explicitTag = normalizeTag(opts.tag);
+	let tag = explicitTag ?? channelToNpmTag(channel);
+	let currentVersion = null;
+	let targetVersion = null;
+	let downgradeRisk = false;
+	let fallbackToLatest = false;
+	let packageInstallSpec = null;
+	if (updateInstallKind !== "git") {
+		currentVersion = switchToPackage ? null : await readPackageVersion(root);
+		if (explicitTag) targetVersion = await resolveTargetVersion(tag, timeoutMs);
+		else targetVersion = await resolveNpmChannelTag({
+			channel,
+			timeoutMs
+		}).then((resolved) => {
+			tag = resolved.tag;
+			fallbackToLatest = channel === "beta" && resolved.tag === "latest";
+			return resolved.version;
+		});
+		const cmp = currentVersion && targetVersion ? compareSemverStrings(currentVersion, targetVersion) : null;
+		downgradeRisk = canResolveRegistryVersionForPackageTarget(tag) && !fallbackToLatest && currentVersion != null && (targetVersion == null || cmp != null && cmp > 0);
+		packageInstallSpec = resolveGlobalInstallSpec({
+			packageName: DEFAULT_PACKAGE_NAME,
+			tag,
+			env: process.env
+		});
+	}
+	if (opts.dryRun) {
+		let mode = "unknown";
+		if (updateInstallKind === "git") mode = "git";
+		else if (updateInstallKind === "package") mode = await resolveGlobalManager({
+			root,
+			installKind,
+			timeoutMs: timeoutMs ?? 20 * 6e4
+		});
+		const actions = [];
+		if (requestedChannel && requestedChannel !== storedChannel) actions.push(`Persist update.channel=${requestedChannel} in config`);
+		if (switchToGit) actions.push("Switch install mode from package to git checkout (dev channel)");
+		else if (switchToPackage) actions.push(`Switch install mode from git to package manager (${mode})`);
+		else if (updateInstallKind === "git") actions.push(`Run git update flow on channel ${channel} (fetch/rebase/build/doctor)`);
+		else actions.push(`Run global package manager update with spec ${packageInstallSpec ?? tag}`);
+		actions.push("Run plugin update sync after core update");
+		actions.push("Refresh shell completion cache (if needed)");
+		actions.push(shouldRestart ? "Restart gateway service and run doctor checks" : "Skip restart (because --no-restart is set)");
+		const notes = [];
+		if (opts.tag && updateInstallKind === "git") notes.push("--tag applies to npm installs only; git updates ignore it.");
+		if (fallbackToLatest) notes.push("Beta channel resolves to latest for this run (fallback).");
+		if (explicitTag && !canResolveRegistryVersionForPackageTarget(tag)) notes.push("Non-registry package specs skip npm version lookup and downgrade previews.");
+		printDryRunPreview({
+			dryRun: true,
+			root,
+			installKind,
+			mode,
+			updateInstallKind,
+			switchToGit,
+			switchToPackage,
+			restart: shouldRestart,
+			requestedChannel,
+			storedChannel,
+			effectiveChannel: channel,
+			tag: packageInstallSpec ?? tag,
+			currentVersion,
+			targetVersion,
+			downgradeRisk,
+			actions,
+			notes
+		}, Boolean(opts.json));
+		return;
+	}
+	if (downgradeRisk && !opts.yes) {
+		if (!process.stdin.isTTY || opts.json) {
+			defaultRuntime.error(["Downgrade confirmation required.", "Downgrading can break configuration. Re-run in a TTY to confirm."].join("\n"));
+			defaultRuntime.exit(1);
+			return;
+		}
+		const targetLabel = targetVersion ?? `${tag} (unknown)`;
+		const ok = await confirm({
+			message: stylePromptMessage(`Downgrading from ${currentVersion} to ${targetLabel} can break configuration. Continue?`),
+			initialValue: false
+		});
+		if (isCancel(ok) || !ok) {
+			if (!opts.json) defaultRuntime.log(theme.muted("Update cancelled."));
+			defaultRuntime.exit(0);
+			return;
+		}
+	}
+	if (updateInstallKind === "git" && opts.tag && !opts.json) defaultRuntime.log(theme.muted("Note: --tag applies to npm installs only; git updates ignore it."));
+	if (requestedChannel && configSnapshot.valid) {
+		await writeConfigFile({
+			...configSnapshot.config,
+			update: {
+				...configSnapshot.config.update,
+				channel: requestedChannel
+			}
+		});
+		if (!opts.json) defaultRuntime.log(theme.muted(`Update channel set to ${requestedChannel}.`));
+	}
+	const showProgress = !opts.json && process.stdout.isTTY;
+	if (!opts.json) {
+		defaultRuntime.log(theme.heading("Updating moldClaw..."));
+		defaultRuntime.log("");
+	}
+	const { progress, stop } = createUpdateProgress(showProgress);
+	const startedAt = Date.now();
+	let restartScriptPath = null;
+	let refreshGatewayServiceEnv = false;
+	const gatewayPort = resolveGatewayPort(configSnapshot.valid ? configSnapshot.config : void 0, process.env);
+	if (shouldRestart) try {
+		if (await resolveGatewayService().isLoaded({ env: process.env })) {
+			restartScriptPath = await prepareRestartScript(process.env, gatewayPort);
+			refreshGatewayServiceEnv = true;
+		}
+	} catch {}
+	const result = updateInstallKind === "package" ? await runPackageInstallUpdate({
+		root,
+		installKind,
+		tag,
+		timeoutMs: timeoutMs ?? 20 * 6e4,
+		startedAt,
+		progress
+	}) : await runGitUpdate({
+		root,
+		switchToGit,
+		installKind,
+		timeoutMs,
+		startedAt,
+		progress,
+		channel,
+		tag,
+		showProgress,
+		opts,
+		stop
+	});
+	stop();
+	printResult(result, {
+		...opts,
+		hideSteps: showProgress
+	});
+	if (result.status === "error") {
+		defaultRuntime.exit(1);
+		return;
+	}
+	if (result.status === "skipped") {
+		if (result.reason === "dirty") defaultRuntime.log(theme.warn("Skipped: working directory has uncommitted changes. Commit or stash them first."));
+		if (result.reason === "not-git-install") {
+			defaultRuntime.log(theme.warn(`Skipped: this moldClaw install isn't a git checkout, and the package manager couldn't be detected. Update via your package manager, then run \`${replaceCliName(formatCliCommand("moldclaw doctor"), CLI_NAME)}\` and \`${replaceCliName(formatCliCommand("moldclaw gateway restart"), CLI_NAME)}\`.`));
+			defaultRuntime.log(theme.muted(`Examples: \`${replaceCliName("npm i -g moldclaw@latest", CLI_NAME)}\` or \`${replaceCliName("pnpm add -g moldclaw@latest", CLI_NAME)}\``));
+		}
+		defaultRuntime.exit(0);
+		return;
+	}
+	await updatePluginsAfterCoreUpdate({
+		root,
+		channel,
+		configSnapshot,
+		opts
+	});
+	await tryWriteCompletionCache(root, Boolean(opts.json));
+	await tryInstallShellCompletion({
+		jsonMode: Boolean(opts.json),
+		skipPrompt: Boolean(opts.yes)
+	});
+	await maybeRestartService({
+		shouldRestart,
+		result,
+		opts,
+		refreshServiceEnv: refreshGatewayServiceEnv,
+		gatewayPort,
+		restartScriptPath,
+		invocationCwd
+	});
+	if (!opts.json) defaultRuntime.log(theme.muted(pickUpdateQuip()));
+}
+//#endregion
+//#region src/cli/update-cli/wizard.ts
+async function updateWizardCommand(opts = {}) {
+	if (!process.stdin.isTTY) {
+		defaultRuntime.error("Update wizard requires a TTY. Use `moldclaw update --channel <stable|beta|dev>` instead.");
+		defaultRuntime.exit(1);
+		return;
+	}
+	const timeoutMs = parseTimeoutMsOrExit(opts.timeout);
+	if (timeoutMs === null) return;
+	const root = await resolveUpdateRoot();
+	const [updateStatus, configSnapshot] = await Promise.all([checkUpdateStatus({
+		root,
+		timeoutMs: timeoutMs ?? 3500,
+		fetchGit: false,
+		includeRegistry: false
+	}), readConfigFileSnapshot()]);
+	const channelInfo = resolveEffectiveUpdateChannel({
+		configChannel: configSnapshot.valid ? normalizeUpdateChannel(configSnapshot.config.update?.channel) : null,
+		installKind: updateStatus.installKind,
+		git: updateStatus.git ? {
+			tag: updateStatus.git.tag,
+			branch: updateStatus.git.branch
+		} : void 0
+	});
+	const channelLabel = formatUpdateChannelLabel({
+		channel: channelInfo.channel,
+		source: channelInfo.source,
+		gitTag: updateStatus.git?.tag ?? null,
+		gitBranch: updateStatus.git?.branch ?? null
+	});
+	const pickedChannel = await selectStyled({
+		message: "Update channel",
+		options: [
+			{
+				value: "keep",
+				label: `Keep current (${channelInfo.channel})`,
+				hint: channelLabel
+			},
+			{
+				value: "stable",
+				label: "Stable",
+				hint: "Tagged releases (npm latest)"
+			},
+			{
+				value: "beta",
+				label: "Beta",
+				hint: "Prereleases (npm beta)"
+			},
+			{
+				value: "dev",
+				label: "Dev",
+				hint: "Git main"
+			}
+		],
+		initialValue: "keep"
+	});
+	if (isCancel(pickedChannel)) {
+		defaultRuntime.log(theme.muted("Update cancelled."));
+		defaultRuntime.exit(0);
+		return;
+	}
+	const requestedChannel = pickedChannel === "keep" ? null : pickedChannel;
+	if (requestedChannel === "dev" && updateStatus.installKind !== "git") {
+		const gitDir = resolveGitInstallDir();
+		if (!await isGitCheckout(gitDir)) {
+			if (await pathExists(gitDir)) {
+				if (!await isEmptyDir(gitDir)) {
+					defaultRuntime.error(`MOLDCLAW_GIT_DIR points at a non-git directory: ${gitDir}. Set MOLDCLAW_GIT_DIR to an empty folder or an moldclaw checkout.`);
+					defaultRuntime.exit(1);
+					return;
+				}
+			}
+			const ok = await confirm({
+				message: stylePromptMessage(`Create a git checkout at ${gitDir}? (override via MOLDCLAW_GIT_DIR)`),
+				initialValue: true
+			});
+			if (isCancel(ok) || !ok) {
+				defaultRuntime.log(theme.muted("Update cancelled."));
+				defaultRuntime.exit(0);
+				return;
+			}
+		}
+	}
+	const restart = await confirm({
+		message: stylePromptMessage("Restart the gateway service after update?"),
+		initialValue: true
+	});
+	if (isCancel(restart)) {
+		defaultRuntime.log(theme.muted("Update cancelled."));
+		defaultRuntime.exit(0);
+		return;
+	}
+	try {
+		await updateCommand({
+			channel: requestedChannel ?? void 0,
+			restart: Boolean(restart),
+			timeout: opts.timeout
+		});
+	} catch (err) {
+		defaultRuntime.error(String(err));
+		defaultRuntime.exit(1);
+	}
+}
+//#endregion
+//#region src/cli/update-cli.ts
+function inheritedUpdateJson(command) {
+	return Boolean(inheritOptionFromParent(command, "json"));
+}
+function inheritedUpdateTimeout(opts, command) {
+	const timeout = opts.timeout;
+	if (timeout) return timeout;
+	return inheritOptionFromParent(command, "timeout");
+}
+function registerUpdateCli(program) {
+	const update = program.command("update").description("Update moldClaw and inspect update channel status").option("--json", "Output result as JSON", false).option("--no-restart", "Skip restarting the gateway service after a successful update").option("--dry-run", "Preview update actions without making changes", false).option("--channel <stable|beta|dev>", "Persist update channel (git + npm)").option("--tag <dist-tag|version|spec>", "Override the package target for this update (dist-tag, version, or package spec)").option("--timeout <seconds>", "Timeout for each update step in seconds (default: 1200)").option("--yes", "Skip confirmation prompts (non-interactive)", false).addHelpText("after", () => {
+		const fmtExamples = [
+			["moldclaw update", "Update a source checkout (git)"],
+			["moldclaw update --channel beta", "Switch to beta channel (git + npm)"],
+			["moldclaw update --channel dev", "Switch to dev channel (git + npm)"],
+			["moldclaw update --tag beta", "One-off update to a dist-tag or version"],
+			["moldclaw update --tag main", "One-off package install from GitHub main"],
+			["moldclaw update --dry-run", "Preview actions without changing anything"],
+			["moldclaw update --no-restart", "Update without restarting the service"],
+			["moldclaw update --json", "Output result as JSON"],
+			["moldclaw update --yes", "Non-interactive (accept downgrade prompts)"],
+			["moldclaw update wizard", "Interactive update wizard"],
+			["moldclaw --update", "Shorthand for moldclaw update"]
+		].map(([cmd, desc]) => `  ${theme.command(cmd)} ${theme.muted(`# ${desc}`)}`).join("\n");
+		return `
+${theme.heading("What this does:")}
+  - Git checkouts: fetches, rebases, installs deps, builds, and runs doctor
+  - npm installs: updates via detected package manager
+
+${theme.heading("Switch channels:")}
+  - Use --channel stable|beta|dev to persist the update channel in config
+  - Run moldclaw update status to see the active channel and source
+  - Use --tag <dist-tag|version|spec> for a one-off package update without persisting
+
+${theme.heading("Non-interactive:")}
+  - Use --yes to accept downgrade prompts
+  - Combine with --channel/--tag/--restart/--json/--timeout as needed
+  - Use --dry-run to preview actions without writing config/installing/restarting
+
+${theme.heading("Examples:")}
+${fmtExamples}
+
+${theme.heading("Notes:")}
+  - Switch channels with --channel stable|beta|dev
+  - For global installs: auto-updates via detected package manager when possible (see docs/install/updating.md)
+  - Downgrades require confirmation (can break configuration)
+  - Skips update if the working directory has uncommitted changes
+
+${theme.muted("Docs:")} ${formatDocsLink("/cli/update", "docs.moldclaw.ai/cli/update")}`;
+	}).action(async (opts) => {
+		try {
+			await updateCommand({
+				json: Boolean(opts.json),
+				restart: Boolean(opts.restart),
+				dryRun: Boolean(opts.dryRun),
+				channel: opts.channel,
+				tag: opts.tag,
+				timeout: opts.timeout,
+				yes: Boolean(opts.yes)
+			});
+		} catch (err) {
+			defaultRuntime.error(String(err));
+			defaultRuntime.exit(1);
+		}
+	});
+	update.command("wizard").description("Interactive update wizard").option("--timeout <seconds>", "Timeout for each update step in seconds (default: 1200)").addHelpText("after", `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/update", "docs.moldclaw.ai/cli/update")}\n`).action(async (opts, command) => {
+		try {
+			await updateWizardCommand({ timeout: inheritedUpdateTimeout(opts, command) });
+		} catch (err) {
+			defaultRuntime.error(String(err));
+			defaultRuntime.exit(1);
+		}
+	});
+	update.command("status").description("Show update channel and version status").option("--json", "Output result as JSON", false).option("--timeout <seconds>", "Timeout for update checks in seconds (default: 3)").addHelpText("after", () => `\n${theme.heading("Examples:")}\n${formatHelpExamples([
+		["moldclaw update status", "Show channel + version status."],
+		["moldclaw update status --json", "JSON output."],
+		["moldclaw update status --timeout 10", "Custom timeout."]
+	])}\n\n${theme.heading("Notes:")}\n${theme.muted("- Shows current update channel (stable/beta/dev) and source")}\n${theme.muted("- Includes git tag/branch/SHA for source checkouts")}\n\n${theme.muted("Docs:")} ${formatDocsLink("/cli/update", "docs.moldclaw.ai/cli/update")}`).action(async (opts, command) => {
+		try {
+			await updateStatusCommand({
+				json: Boolean(opts.json) || inheritedUpdateJson(command),
+				timeout: inheritedUpdateTimeout(opts, command)
+			});
+		} catch (err) {
+			defaultRuntime.error(String(err));
+			defaultRuntime.exit(1);
+		}
+	});
+}
+//#endregion
+export { registerUpdateCli };