aidevops 3.28.0 → 3.29.0

package/README.md

@@ -58,7 +58,7 @@ The result: an AI operations platform that manages projects across every busines
 [![Copyright](https://img.shields.io/badge/Copyright-Marcus%20Quinn%202025--2026-blue.svg)](https://github.com/marcusquinn)
 
 <!-- Release & Version Info -->
-[![Version](https://img.shields.io/badge/Version-3.28.0-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.29.0-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 [![GitHub repository](https://img.shields.io/badge/github-repository-181717.svg?logo=github)](https://github.com/marcusquinn/aidevops)

package/VERSION

@@ -1 +1 @@
-3.28.0
+3.29.0

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.28.0
+# Version: 3.29.0
 
 set -euo pipefail
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.28.0",
+  "version": "3.29.0",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "workspaces": [

package/packages/gui-api/src/app.ts

@@ -1,8 +1,37 @@
+import { spawn } from "node:child_process";
 import { Hono } from "hono";
-import { BANNED_ROUTE_PATTERNS, FILE_EXPLORER_ROUTE_MANIFEST, STATUS_ROUTE_MANIFEST, VAULT_STATUS_ROUTE_MANIFEST } from "../../gui-shared/src";
+import { APP_ACTION_ROUTE_MANIFEST, APP_ACTION_STATUS_ROUTE_MANIFEST, BANNED_ROUTE_PATTERNS, createEnvelope, FILE_EXPLORER_ROUTE_MANIFEST, type GuiAppActionId, type GuiAppActionJobSummary, STATUS_ROUTE_MANIFEST, VAULT_STATUS_ROUTE_MANIFEST } from "../../gui-shared/src";
 import { readFileExplorer } from "./file-adapter";
 import { readStatus, readVaultStatus } from "./status-adapter";
 
+const appActionCommands: Record<string, Partial<Record<GuiAppActionId, string[]>>> = {
+  aidevops: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update"], reinstall: ["./setup.sh", "--non-interactive"] },
+  agents: { install: ["aidevops", "setup", "--scope", "agents"], update: ["aidevops", "setup", "--scope", "agents"], reinstall: ["aidevops", "setup", "--scope", "agents"] },
+  "gui-desktop": { install: ["aidevops", "setup", "--scope", "gui-desktop"], update: ["aidevops", "setup", "--scope", "gui-desktop"], reinstall: ["aidevops", "setup", "--scope", "gui-desktop"] },
+  hooks: { install: ["aidevops", "setup", "--scope", "hooks"], update: ["aidevops", "setup", "--scope", "hooks"], reinstall: ["aidevops", "setup", "--scope", "hooks"] },
+  opencode: { install: ["aidevops", "setup", "--scope", "opencode"], update: ["aidevops", "setup", "--scope", "opencode"], reinstall: ["aidevops", "setup", "--scope", "opencode"] },
+  pulse: { install: ["aidevops", "setup", "--scope", "pulse"], update: ["aidevops", "setup", "--scope", "pulse"], reinstall: ["aidevops", "setup", "--scope", "pulse"] },
+  tabby: { install: ["aidevops", "setup", "--scope", "tabby"], update: ["aidevops", "setup", "--scope", "tabby"], reinstall: ["aidevops", "setup", "--scope", "tabby"] },
+  bun: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  cursor: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  fd: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  gh: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  glab: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  homebrew: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  node: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  ollama: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  orbstack: { install: ["./setup.sh", "--non-interactive"] },
+  qlty: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  ripgrep: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  "ripgrep-all": { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  rtk: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  shellcheck: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  shfmt: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
+  zed: { install: ["./setup.sh", "--non-interactive"] },
+};
+
+const appActionJobs = new Map<string, GuiAppActionJobSummary>();
+
 export function createGuiApiApp() {
   const app = new Hono();
 
@@ -14,6 +43,48 @@ export function createGuiApiApp() {
     return context.json(readVaultStatus());
   });
 
+  app.post(APP_ACTION_ROUTE_MANIFEST.route, (context) => {
+    const appId = context.req.param("appId");
+    const action = context.req.param("action") as GuiAppActionId;
+    const command = appActionCommands[appId]?.[action];
+
+    if (command === undefined) {
+      return context.json(createEnvelope({
+        operation_id: APP_ACTION_ROUTE_MANIFEST.operation_id,
+        source: { surface: "apps", authority: "allowlisted local command runner", path_refs: [] },
+        data: rejectedJob(appId, action, "No allowlisted command for this app action."),
+        errors: ["action_not_allowlisted"],
+      }), 400);
+    }
+
+    const job = startAppActionJob(appId, action, command);
+    return context.json(createEnvelope({
+      operation_id: APP_ACTION_ROUTE_MANIFEST.operation_id,
+      source: { surface: "apps", authority: "allowlisted local command runner", path_refs: ["setup.sh", "aidevops.sh"] },
+      data: job,
+      warnings: ["Command runs locally in the background. Output is retained in memory for this GUI API process only."],
+    }), 202);
+  });
+
+  app.get(APP_ACTION_STATUS_ROUTE_MANIFEST.route, (context) => {
+    const jobId = context.req.param("jobId");
+    const job = appActionJobs.get(jobId);
+    if (job === undefined) {
+      return context.json(createEnvelope({
+        operation_id: APP_ACTION_STATUS_ROUTE_MANIFEST.operation_id,
+        source: { surface: "apps", authority: "background job store", path_refs: [] },
+        data: rejectedJob("unknown", "install", "Unknown job."),
+        errors: ["unknown_job"],
+      }), 404);
+    }
+
+    return context.json(createEnvelope({
+      operation_id: APP_ACTION_STATUS_ROUTE_MANIFEST.operation_id,
+      source: { surface: "apps", authority: "background job store", path_refs: [] },
+      data: job,
+    }));
+  });
+
   app.get(FILE_EXPLORER_ROUTE_MANIFEST.route, (context) => {
     const root = context.req.param("root");
     const path = context.req.query("path") ?? "";
@@ -50,4 +121,57 @@ export function createGuiApiApp() {
   return app;
 }
 
+function startAppActionJob(appId: string, action: GuiAppActionId, command: string[]): GuiAppActionJobSummary {
+  const now = new Date().toISOString();
+  const job: GuiAppActionJobSummary = {
+    id: `${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    app_id: appId,
+    action,
+    status: "running",
+    command_preview: command.join(" "),
+    started_at: now,
+    finished_at: null,
+    exit_code: null,
+    output: [`$ ${command.join(" ")}`],
+  };
+  appActionJobs.set(job.id, job);
+
+  const child = spawn(command[0], command.slice(1), {
+    cwd: process.cwd(),
+    env: { ...process.env, AIDEVOPS_NON_INTERACTIVE: "true" },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  child.stdout.on("data", (chunk) => appendJobOutput(job, chunk.toString()));
+  child.stderr.on("data", (chunk) => appendJobOutput(job, chunk.toString()));
+  child.on("error", (error) => {
+    appendJobOutput(job, error.message);
+    job.status = "failed";
+    job.finished_at = new Date().toISOString();
+    job.exit_code = 127;
+  });
+  child.on("close", (code) => {
+    job.status = code === 0 ? "completed" : "failed";
+    job.finished_at = new Date().toISOString();
+    job.exit_code = code;
+  });
+
+  return job;
+}
+
+function appendJobOutput(job: GuiAppActionJobSummary, output: string): void {
+  job.output.push(...output.split(/\r?\n/).filter((line) => line.length > 0).map(redactOutputLine));
+  if (job.output.length > 400) {
+    job.output.splice(1, job.output.length - 400);
+  }
+}
+
+function redactOutputLine(line: string): string {
+  return line.replace(/(token|secret|password|authorization)=\S+/gi, "$1=[redacted]");
+}
+
+function rejectedJob(appId: string, action: GuiAppActionId, message: string): GuiAppActionJobSummary {
+  const now = new Date().toISOString();
+  return { id: "rejected", app_id: appId, action, status: "rejected", command_preview: "not run", started_at: now, finished_at: now, exit_code: null, output: [message] };
+}
+
 export const app = createGuiApiApp();

package/packages/gui-api/src/status-adapter-utils.ts

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 
@@ -106,3 +107,37 @@ export function readOptionalText(pathName: string): string | null {
 
   return readFileSync(pathName, "utf8").trim();
 }
+
+export function firstExistingPathRef(pathRefs: string[]): string | null {
+  return pathRefs.find((pathRef) => existsSync(expandHome(pathRef))) ?? null;
+}
+
+export function resolveBinary(binary: string): string | null {
+  try {
+    const output = execFileSync("which", [binary], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 200,
+    }).trim();
+    return output.split("\n").find((line) => line.length > 0) ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function readBinaryVersion(binaryPath: string, args: string[]): string {
+  if (args.length === 0) {
+    return "unknown";
+  }
+
+  try {
+    const output = execFileSync(binaryPath, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 500,
+    }).trim();
+    return output.split("\n").find((line) => line.length > 0) ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}

package/packages/gui-api/src/status-adapter.ts

@@ -1,19 +1,18 @@
+import { Database } from "bun:sqlite";
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { hostname, networkInterfaces, userInfo } from "node:os";
 import { join } from "node:path";
-import { Database } from "bun:sqlite";
 import {
-  type GuiLocalRepoSetupSummary,
-  type GuiOpenCodeSessionRegistrySummary,
-  type GuiOpenCodeSessionSummary,
   assertNoSecretSentinels,
   createEnvelope,
-  VAULT_STATUS_ROUTE_MANIFEST,
   type GuiAiAppSummary,
   type GuiAiProviderId,
+  type GuiLocalRepoSetupSummary,
   type GuiOAuthPoolSummary,
   type GuiOAuthProviderSummary,
+  type GuiOpenCodeSessionRegistrySummary,
+  type GuiOpenCodeSessionSummary,
   type GuiRepoRegistrySummary,
   type GuiRepoSummary,
   type GuiResponseEnvelope,
@@ -22,20 +21,25 @@ import {
   type GuiStatusData,
   type GuiVaultStatusData,
   statusFixture,
+  VAULT_STATUS_ROUTE_MANIFEST,
 } from "../../gui-shared/src";
 import {
   collapseHome,
   cooldownReady,
   expandHome,
+  firstExistingPathRef,
   formatEpochField,
   formatNullableEpochField,
   isRecord,
   numberField,
+  readBinaryVersion,
   readJsonObject,
   readOptionalText,
+  resolveBinary,
   stringField,
 } from "./status-adapter-utils";
 import { readLocalReposSetupSummary } from "./status-local-repos";
+import { readManagedApps } from "./status-managed-apps";
 import { readVaultSummary } from "./status-vault";
 
 export { readVaultSummary } from "./status-vault";
@@ -69,6 +73,7 @@ export function readStatus(
   const restartRequired = installedVersion !== aidevopsVersion;
   const setupTargets = readSetupTargets(aidevopsVersion || "unknown", installedVersion || "unknown");
   const aiApps = readAiApps(aidevopsVersion || "unknown", installedVersion || "unknown");
+  const managedApps = readManagedApps(aidevopsVersion || "unknown", installedVersion || "unknown");
   const localRepos = readLocalReposSetupSummary(reposPath);
   const opencodeSessions = readOpenCodeSessions(opencodeDbPath, opencodeDbPathRef, localRepos.repos);
   const vault = readVaultSummary(repoRoot);
@@ -82,6 +87,7 @@ export function readStatus(
     "VERSION",
     ...setupTargets.map((target) => target.path_ref),
     ...aiApps.flatMap((app) => [app.app_path_ref, app.binary_path_ref, app.config_path_ref, app.aidevops_target_path_ref]),
+    ...managedApps.map((app) => app.install_path_ref),
   ].filter(isSourcePathRef);
 
   const data: GuiStatusData = {
@@ -128,6 +134,7 @@ export function readStatus(
     oauth_pool: readOAuthPoolSummary(oauthPoolPath, oauthPoolPathRef),
     setup_targets: setupTargets,
     ai_apps: aiApps,
+    managed_apps: managedApps,
     vault,
   };
 
@@ -412,23 +419,6 @@ function aiAppSummary(definition: AiAppDefinition, latestVersion: string, instal
   };
 }
 
-function firstExistingPathRef(pathRefs: string[]): string | null {
-  return pathRefs.find((pathRef) => existsSync(expandHome(pathRef))) ?? null;
-}
-
-function resolveBinary(binary: string): string | null {
-  try {
-    const output = execFileSync("/usr/bin/which", [binary], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 1_000,
-    }).trim();
-    return output.split("\n").find((line) => line.length > 0) ?? null;
-  } catch {
-    return null;
-  }
-}
-
 interface OpenCodeSessionRow {
   id: string;
   directory: string;
@@ -506,23 +496,6 @@ function formatUnixMillis(value: number): string {
   return new Date(value).toISOString();
 }
 
-function readBinaryVersion(binaryPath: string, args: string[]): string {
-  if (args.length === 0) {
-    return "unknown";
-  }
-
-  try {
-    const output = execFileSync(binaryPath, args, {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 1_500,
-    }).trim();
-    return output.split("\n").find((line) => line.length > 0) ?? "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-
 function isSourcePathRef(pathRef: string): boolean {
   return pathRef === "VERSION" || pathRef.startsWith("~/") || pathRef.startsWith("/");
 }

package/packages/gui-api/src/status-managed-apps.ts

@@ -0,0 +1,228 @@
+import { existsSync } from "node:fs";
+import type { GuiAppActionId, GuiManagedAppSummary } from "../../gui-shared/src";
+import { collapseHome, expandHome, firstExistingPathRef, readBinaryVersion, resolveBinary } from "./status-adapter-utils";
+
+type ManagedAppActionCommands = Partial<Record<GuiAppActionId, string>>;
+
+interface ManagedAppDefinition {
+  id: string;
+  name: string;
+  description: string;
+  category: string;
+  binary: string | null;
+  version_args: string[];
+  install_path_refs: string[];
+  origin_website_url: string;
+  origin_repo_url: string;
+  aidevops_install: boolean;
+  aidevops_update: boolean;
+  latest_version_source: "aidevops" | "binary" | "unknown";
+  action_commands: ManagedAppActionCommands;
+}
+
+type BinaryAppInput = Omit<ManagedAppDefinition, "action_commands" | "aidevops_install" | "aidevops_update" | "latest_version_source"> & {
+  binary: string;
+  aidevops_install?: boolean;
+  aidevops_update?: boolean;
+};
+
+const TOOL_ACTIONS: ManagedAppActionCommands = {
+  install: "./setup.sh --non-interactive",
+  update: "aidevops update-tools --update",
+};
+
+const MANAGED_APP_DEFINITIONS: ManagedAppDefinition[] = [
+  {
+    id: "aidevops",
+    name: "aidevops",
+    description: "Framework CLI, agents, workflows, scripts, and local GUI assets.",
+    category: "core",
+    binary: "aidevops",
+    version_args: ["--version"],
+    install_path_refs: ["~/.aidevops/agents", "/opt/homebrew/bin/aidevops", "/usr/local/bin/aidevops"],
+    origin_website_url: "https://aidevops.sh",
+    origin_repo_url: "https://github.com/marcusquinn/aidevops.git",
+    aidevops_install: true,
+    aidevops_update: true,
+    latest_version_source: "aidevops",
+    action_commands: {
+      install: "./setup.sh --non-interactive",
+      update: "aidevops update",
+      reinstall: "./setup.sh --non-interactive",
+    },
+  },
+  {
+    id: "agents",
+    name: "Deployed agents",
+    description: "Canonical aidevops agents, commands, workflows, scripts, and reference files.",
+    category: "core",
+    binary: null,
+    version_args: [],
+    install_path_refs: ["~/.aidevops/agents/VERSION"],
+    origin_website_url: "https://aidevops.sh",
+    origin_repo_url: "https://github.com/marcusquinn/aidevops.git",
+    aidevops_install: true,
+    aidevops_update: true,
+    latest_version_source: "aidevops",
+    action_commands: setupScopeActions("agents"),
+  },
+  {
+    id: "gui-desktop",
+    name: "aidevops.app",
+    description: "Native macOS desktop launcher for the local GUI.",
+    category: "desktop",
+    binary: null,
+    version_args: [],
+    install_path_refs: ["~/Applications/aidevops.app", "/Applications/aidevops.app"],
+    origin_website_url: "https://aidevops.sh",
+    origin_repo_url: "https://github.com/marcusquinn/aidevops.git",
+    aidevops_install: true,
+    aidevops_update: true,
+    latest_version_source: "aidevops",
+    action_commands: setupScopeActions("gui-desktop"),
+  },
+  {
+    id: "opencode",
+    name: "OpenCode",
+    description: "AI terminal runtime configured by aidevops for local sessions.",
+    category: "ai runtime",
+    binary: "opencode",
+    version_args: ["--version"],
+    install_path_refs: ["~/Applications/OpenCode AIDevOps.app", "/Applications/OpenCode.app", "~/.config/opencode/opencode.json"],
+    origin_website_url: "https://opencode.ai",
+    origin_repo_url: "",
+    aidevops_install: true,
+    aidevops_update: true,
+    latest_version_source: "binary",
+    action_commands: setupScopeActions("opencode"),
+  },
+  {
+    id: "hooks",
+    name: "Safety hooks",
+    description: "Git, prompt, privacy, complexity, task-id, and canonical-install guards.",
+    category: "safety",
+    binary: null,
+    version_args: [],
+    install_path_refs: ["~/.aidevops/hooks", "~/.config/aidevops"],
+    origin_website_url: "https://aidevops.sh",
+    origin_repo_url: "https://github.com/marcusquinn/aidevops.git",
+    aidevops_install: true,
+    aidevops_update: true,
+    latest_version_source: "aidevops",
+    action_commands: setupScopeActions("hooks"),
+  },
+  {
+    id: "pulse",
+    name: "Pulse scheduler",
+    description: "Launchd/cron supervisor for autonomous aidevops maintenance and dispatch routines.",
+    category: "automation",
+    binary: null,
+    version_args: [],
+    install_path_refs: ["~/Library/LaunchAgents/sh.aidevops.pulse.plist", "~/.aidevops/.agent-workspace/pulse"],
+    origin_website_url: "https://aidevops.sh",
+    origin_repo_url: "https://github.com/marcusquinn/aidevops.git",
+    aidevops_install: true,
+    aidevops_update: true,
+    latest_version_source: "aidevops",
+    action_commands: setupScopeActions("pulse"),
+  },
+  binaryApp({ id: "tabby", name: "Tabby terminal profiles", description: "Terminal profile sync for aidevops-managed shells.", category: "terminal", binary: "tabby", version_args: ["--version"], install_path_refs: ["~/Library/Application Support/tabby", "/Applications/Tabby.app"], origin_website_url: "https://github.com/Eugeny/tabby/releases/latest", origin_repo_url: "https://github.com/Eugeny/tabby/releases/latest" }),
+  binaryApp({ id: "gh", name: "GitHub CLI", description: "GitHub issues, PRs, checks, releases, and API automation.", category: "git", binary: "gh", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"], origin_website_url: "", origin_repo_url: "" }),
+  binaryApp({ id: "glab", name: "GitLab CLI", description: "GitLab repository, issue, merge request, and CI automation.", category: "git", binary: "glab", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/glab", "/usr/local/bin/glab", "/usr/bin/glab"], origin_website_url: "", origin_repo_url: "" }),
+  binaryApp({ id: "fd", name: "fd", description: "Fast file discovery for agents and developer workflows.", category: "search", binary: "fd", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/fd", "/usr/local/bin/fd", "/usr/bin/fd"], origin_website_url: "", origin_repo_url: "" }),
+  binaryApp({ id: "ripgrep", name: "ripgrep", description: "Fast code and text search used by agents and local diagnostics.", category: "search", binary: "rg", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/rg", "/usr/local/bin/rg", "/usr/bin/rg"], origin_website_url: "", origin_repo_url: "" }),
+  binaryApp({ id: "ripgrep-all", name: "ripgrep-all", description: "Document/archive-aware search companion for ripgrep.", category: "search", binary: "rga", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/rga", "/usr/local/bin/rga", "/usr/bin/rga"], origin_website_url: "", origin_repo_url: "" }),
+  binaryApp({ id: "shellcheck", name: "ShellCheck", description: "Shell script static analysis gate.", category: "quality", binary: "shellcheck", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/shellcheck", "/usr/local/bin/shellcheck", "/usr/bin/shellcheck"], origin_website_url: "", origin_repo_url: "" }),
+  binaryApp({ id: "shfmt", name: "shfmt", description: "Shell formatter used by local quality workflows.", category: "quality", binary: "shfmt", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/shfmt", "/usr/local/bin/shfmt", "/usr/bin/shfmt"], origin_website_url: "", origin_repo_url: "" }),
+  binaryApp({ id: "bun", name: "Bun", description: "JavaScript runtime used for the GUI and toolchain helpers.", category: "runtime", binary: "bun", version_args: ["--version"], install_path_refs: ["~/.bun/bin/bun", "/opt/homebrew/bin/bun", "/usr/local/bin/bun"], origin_website_url: "https://bun.sh/install", origin_repo_url: "" }),
+  binaryApp({ id: "node", name: "Node.js", description: "JavaScript runtime required by npm-hosted helpers and frontend tooling.", category: "runtime", binary: "node", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/node", "/usr/local/bin/node", "/usr/bin/node"], origin_website_url: "https://nodejs.org/", origin_repo_url: "" }),
+  binaryApp({ id: "homebrew", name: "Homebrew", description: "macOS package manager used by setup/update when available.", category: "package manager", binary: "brew", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/brew", "/usr/local/bin/brew"], origin_website_url: "https://brew.sh", origin_repo_url: "https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh" }),
+  binaryApp({ id: "qlty", name: "Qlty CLI", description: "Optional code quality aggregator installed by setup when selected.", category: "quality", binary: "qlty", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/qlty", "/usr/local/bin/qlty", "~/.qlty/bin/qlty"], origin_website_url: "https://qlty.sh", origin_repo_url: "" }),
+  binaryApp({ id: "rtk", name: "rtk", description: "Token-optimized GitHub/API helper used by interactive discovery.", category: "developer tooling", binary: "rtk", version_args: ["--version"], install_path_refs: ["~/.local/bin/rtk", "/opt/homebrew/bin/rtk", "/usr/local/bin/rtk"], origin_website_url: "https://github.com/rtk-ai/rtk#installation", origin_repo_url: "https://github.com/rtk-ai/rtk" }),
+  binaryApp({ id: "cursor", name: "Cursor CLI", description: "Cursor command-line integration and config targets.", category: "ai runtime", binary: "cursor", version_args: ["--version"], install_path_refs: ["~/.cursor/bin/cursor", "/Applications/Cursor.app"], origin_website_url: "https://cursor.com/install", origin_repo_url: "" }),
+  binaryApp({ id: "zed", name: "Zed", description: "Optional editor installed by setup when selected.", category: "editor", binary: "zed", version_args: ["--version"], install_path_refs: ["/Applications/Zed.app", "/opt/homebrew/bin/zed", "/usr/local/bin/zed"], origin_website_url: "https://zed.dev/download", origin_repo_url: "", aidevops_install: false, aidevops_update: false }),
+  binaryApp({ id: "orbstack", name: "OrbStack", description: "Optional local container/VM runtime for macOS development.", category: "runtime", binary: "orb", version_args: ["version"], install_path_refs: ["/Applications/OrbStack.app", "/opt/homebrew/bin/orb"], origin_website_url: "https://orbstack.dev/", origin_repo_url: "", aidevops_install: false, aidevops_update: false }),
+  binaryApp({ id: "ollama", name: "Ollama", description: "Optional local model runtime for local AI workflows.", category: "ai runtime", binary: "ollama", version_args: ["--version"], install_path_refs: ["/Applications/Ollama.app", "/opt/homebrew/bin/ollama", "/usr/local/bin/ollama"], origin_website_url: "https://ollama.com", origin_repo_url: "" }),
+];
+
+export function readManagedApps(latestVersion: string, installedVersion: string): GuiManagedAppSummary[] {
+  return MANAGED_APP_DEFINITIONS.map((definition) => managedAppSummary(definition, latestVersion, installedVersion));
+}
+
+function binaryApp(input: BinaryAppInput): ManagedAppDefinition {
+  const aidevopsInstall = input.aidevops_install ?? true;
+  const aidevopsUpdate = input.aidevops_update ?? true;
+
+  return {
+    id: input.id,
+    name: input.name,
+    description: input.description,
+    category: input.category,
+    binary: input.binary,
+    version_args: input.version_args,
+    install_path_refs: input.install_path_refs,
+    origin_website_url: input.origin_website_url,
+    origin_repo_url: input.origin_repo_url,
+    aidevops_install: aidevopsInstall,
+    aidevops_update: aidevopsUpdate,
+    latest_version_source: "binary",
+    action_commands: aidevopsUpdate ? TOOL_ACTIONS : { install: "./setup.sh --non-interactive" },
+  };
+}
+
+function setupScopeActions(scope: string): ManagedAppActionCommands {
+  return {
+    install: `aidevops setup --scope ${scope}`,
+    update: `aidevops setup --scope ${scope}`,
+    reinstall: `aidevops setup --scope ${scope}`,
+  };
+}
+
+function managedAppSummary(definition: ManagedAppDefinition, latestVersion: string, installedVersion: string): GuiManagedAppSummary {
+  const binaryPath = definition.binary === null ? null : resolveBinary(definition.binary);
+  const installPathRef = firstExistingPathRef(definition.install_path_refs) ?? definition.install_path_refs[0] ?? "not found";
+  const installedVersionText = readManagedAppVersion(definition, binaryPath, installedVersion);
+  const latestVersionText = definition.latest_version_source === "aidevops"
+    ? latestVersion
+    : definition.latest_version_source === "binary"
+      ? installedVersionText
+      : "unknown";
+
+  return {
+    id: definition.id,
+    name: definition.name,
+    description: definition.description,
+    category: definition.category,
+    origin_website_url: definition.origin_website_url,
+    origin_repo_url: definition.origin_repo_url,
+    aidevops_install: definition.aidevops_install,
+    aidevops_update: definition.aidevops_update,
+    installed_version: installedVersionText,
+    latest_version: latestVersionText,
+    install_path_ref: binaryPath === null ? installPathRef : collapseHome(binaryPath),
+    status: binaryPath !== null || definition.install_path_refs.some((pathRef) => existsSync(expandHome(pathRef))) ? "found" : "missing",
+    actions: (["install", "update", "reinstall", "remove"] as const).map((action) => managedAppAction(definition.action_commands, action)),
+  };
+}
+
+function managedAppAction(actionCommands: ManagedAppActionCommands, action: GuiAppActionId): GuiManagedAppSummary["actions"][number] {
+  return {
+    id: action,
+    label: action[0].toUpperCase() + action.slice(1),
+    enabled: actionCommands[action] !== undefined,
+    command_preview: actionCommands[action] ?? "No allowlisted command yet",
+    confirmation: action === "remove" ? "required" : action === "reinstall" ? "recommended" : "none",
+  };
+}
+
+function readManagedAppVersion(definition: ManagedAppDefinition, binaryPath: string | null, installedVersion: string): string {
+  if (definition.latest_version_source === "aidevops") {
+    return firstExistingPathRef(definition.install_path_refs) === null ? "not installed" : installedVersion;
+  }
+
+  if (binaryPath === null) {
+    return "not installed";
+  }
+
+  return readBinaryVersion(binaryPath, definition.version_args);
+}