cli-jaw 2.0.5 → 2.0.6

package/dist/bin/postinstall.js

@@ -22,16 +22,26 @@ if (major < 22) {
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import { execSync, execFileSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { fileURLToPath } from 'node:url';
 import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js';
 import { resolveHomePath } from '../src/core/path-expand.js';
 import { buildServicePath } from '../src/core/runtime-path.js';
+import { classifyClaudeInstall } from '../src/core/claude-install.js';
+import { isSpawnableCliFile, listCliBinaryCandidates, readProcessPath, } from '../src/core/cli-detect.js';
 import { asArray, asRecord, errString, fieldString } from './_http-client.js';
 // ─── JAW_HOME inline (config.ts → registry.ts import 체인 제거) ───
-const JAW_HOME = process.env["CLI_JAW_HOME"]
-    ? resolveHomePath(process.env["CLI_JAW_HOME"])
-    : path.join(os.homedir(), '.cli-jaw');
+const JAW_HOME = (() => {
+    if (!process.env["CLI_JAW_HOME"])
+        return path.join(os.homedir(), '.cli-jaw');
+    const resolved = resolveHomePath(process.env["CLI_JAW_HOME"]);
+    const userHome = os.homedir();
+    if (process.env["NODE_ENV"] !== 'test' && !resolved.startsWith(userHome + path.sep) && resolved !== userHome) {
+        console.error(`[jaw:init] ❌ CLI_JAW_HOME must be under user home (${userHome}): ${resolved}`);
+        process.exit(1);
+    }
+    return resolved;
+})();
 const home = os.homedir();
 const jawHome = JAW_HOME;
 const PATH_LOOKUP_CMD = process.platform === 'win32' ? 'where' : 'which';
@@ -44,10 +54,26 @@ const OFFICECLI_SKIP = process.env["CLI_JAW_SKIP_OFFICECLI"] === '1'
     || process.env["CLI_JAW_SKIP_OFFICECLI"] === 'true';
 const OFFICECLI_FORCE = process.env["CLI_JAW_FORCE_OFFICECLI"] === '1'
     || process.env["CLI_JAW_FORCE_OFFICECLI"] === 'true';
+const OFFICECLI_SKIP_LOCAL = process.env["CLI_JAW_SKIP_LOCAL_OFFICECLI"] === '1'
+    || process.env["CLI_JAW_SKIP_LOCAL_OFFICECLI"] === 'true';
+const OFFICECLI_FORCE_REMOTE = process.env["CLI_JAW_FORCE_REMOTE_OFFICECLI"] === '1'
+    || process.env["CLI_JAW_FORCE_REMOTE_OFFICECLI"] === 'true';
 const OFFICECLI_REQUIRE = shouldRequireOfficeCliDuringPostinstall();
+const CLAUDE_NATIVE_INSTALL_URL = 'https://claude.ai/install.sh';
+const CLAUDE_NATIVE_INSTALL_PS_URL = 'https://claude.ai/install.ps1';
 // ─── Legacy migration ───
 // Moved into runPostinstall() to prevent side effects on dynamic import.
 // (init.ts imports this module for installCliTools/etc — must not trigger fs.renameSync)
+function postinstallExecEnv(env = process.env) {
+    const currentPath = env["PATH"] || env["Path"] || env["path"] || '';
+    const safePath = buildServicePath(currentPath);
+    const out = { ...env };
+    delete out["PATH"];
+    delete out["Path"];
+    delete out["path"];
+    out[process.platform === 'win32' ? 'Path' : 'PATH'] = safePath;
+    return out;
+}
 function ensureDir(dir) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -55,6 +81,16 @@ function ensureDir(dir) {
     }
 }
 function ensureSymlink(target, linkPath) {
+    const resolvedTarget = path.resolve(target);
+    const resolvedLink = path.resolve(linkPath);
+    if (!resolvedTarget.startsWith(home + path.sep) && !resolvedTarget.startsWith(os.tmpdir()) && !resolvedTarget.startsWith(jawHome)) {
+        console.error(`[jaw:init] ❌ symlink target outside allowed paths: ${resolvedTarget}`);
+        return false;
+    }
+    if (!resolvedLink.startsWith(home + path.sep) && !resolvedLink.startsWith(os.tmpdir())) {
+        console.error(`[jaw:init] ❌ symlink link path outside user home: ${resolvedLink}`);
+        return false;
+    }
     if (fs.existsSync(linkPath))
         return false;
     fs.mkdirSync(path.dirname(linkPath), { recursive: true });
@@ -86,16 +122,49 @@ function ensureSymlink(target, linkPath) {
         return false;
     }
 }
+export function removeJawHomeClaudeInstructionFile(baseDir = jawHome) {
+    const agentsMd = path.join(baseDir, 'AGENTS.md');
+    const claudeMd = path.join(baseDir, 'CLAUDE.md');
+    try {
+        if (!fs.existsSync(claudeMd))
+            return 'missing';
+        const stat = fs.lstatSync(claudeMd);
+        if (stat.isSymbolicLink()) {
+            const linkTarget = fs.readlinkSync(claudeMd);
+            const resolvedTarget = path.resolve(path.dirname(claudeMd), linkTarget);
+            const resolvedAgents = path.resolve(agentsMd);
+            if (resolvedTarget === resolvedAgents || path.basename(linkTarget) === 'AGENTS.md') {
+                fs.unlinkSync(claudeMd);
+                console.log(`[jaw:init] removed deprecated CLAUDE.md symlink: ${claudeMd}`);
+                return 'removed-symlink';
+            }
+            console.warn(`[jaw:init] keeping custom CLAUDE.md symlink: ${claudeMd} -> ${linkTarget}`);
+            return 'kept-custom';
+        }
+        if (stat.isFile() && fs.existsSync(agentsMd)) {
+            const claudeText = fs.readFileSync(claudeMd, 'utf8');
+            const agentsText = fs.readFileSync(agentsMd, 'utf8');
+            if (claudeText === agentsText) {
+                fs.unlinkSync(claudeMd);
+                console.log(`[jaw:init] removed deprecated CLAUDE.md mirror: ${claudeMd}`);
+                return 'removed-mirror';
+            }
+        }
+        console.warn(`[jaw:init] keeping custom CLAUDE.md: ${claudeMd}`);
+        return 'kept-custom';
+    }
+    catch (e) {
+        console.warn(`[jaw:init] CLAUDE.md cleanup failed: ${claudeMd} (${errString(e) || 'unknown'})`);
+        return 'error';
+    }
+}
 function findBinaryPath(name) {
     try {
         const out = execFileSync(PATH_LOOKUP_CMD, [name], {
             encoding: 'utf8',
             stdio: 'pipe',
             timeout: 5000,
-            env: {
-                ...process.env,
-                PATH: buildServicePath(process.env["PATH"] || ''),
-            },
+            env: postinstallExecEnv(),
         }).trim();
         const first = out.split(/\r?\n/).map(x => x.trim()).find(Boolean);
         return first || null;
@@ -104,6 +173,79 @@ function findBinaryPath(name) {
         return null;
     }
 }
+function pathMtimeMs(target) {
+    try {
+        return fs.statSync(target).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+function latestMtimeMs(target, depth = 0) {
+    if (depth > 20)
+        return 0;
+    if (!fs.existsSync(target))
+        return 0;
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink())
+        return stat.mtimeMs;
+    if (!stat.isDirectory())
+        return stat.mtimeMs;
+    let latest = stat.mtimeMs;
+    const ignoredDirs = new Set(['.git', 'bin', 'obj', 'target', 'build-local', '99.9_test']);
+    for (const entry of fs.readdirSync(target, { withFileTypes: true })) {
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory() && ignoredDirs.has(entry.name))
+            continue;
+        latest = Math.max(latest, latestMtimeMs(path.join(target, entry.name), depth + 1));
+    }
+    return latest;
+}
+function latestLocalOfficeCliSourceMtime(projectRoot = PROJECT_ROOT) {
+    const officeRoot = path.join(projectRoot, 'officecli');
+    return Math.max(latestMtimeMs(path.join(officeRoot, 'src')), pathMtimeMs(path.join(officeRoot, 'dev-install.sh')), pathMtimeMs(path.join(officeRoot, 'build.sh')), pathMtimeMs(path.join(officeRoot, 'scripts', 'build-rhwp-sidecars.sh')), pathMtimeMs(path.join(officeRoot, 'officecli.slnx')));
+}
+export function hasLocalOfficeCliCheckout(projectRoot = PROJECT_ROOT) {
+    if (process.platform === 'win32')
+        return false;
+    if (OFFICECLI_SKIP_LOCAL || OFFICECLI_FORCE_REMOTE)
+        return false;
+    return fs.existsSync(path.join(projectRoot, 'officecli', 'dev-install.sh'))
+        && fs.existsSync(path.join(projectRoot, 'officecli', 'src', 'officecli', 'officecli.csproj'));
+}
+export function shouldRunLocalOfficeCliInstall(projectRoot = PROJECT_ROOT) {
+    if (!hasLocalOfficeCliCheckout(projectRoot))
+        return false;
+    if (OFFICECLI_FORCE)
+        return true;
+    const officecliPath = findBinaryPath('officecli');
+    const installDir = officecliPath ? path.dirname(officecliPath) : path.join(home, '.local', 'bin');
+    const installedPaths = [
+        officecliPath || path.join(installDir, 'officecli'),
+        path.join(installDir, 'rhwp-field-bridge'),
+        path.join(installDir, 'rhwp-officecli-bridge'),
+    ];
+    if (installedPaths.some((candidate) => !fs.existsSync(candidate)))
+        return true;
+    if (!isInstalledLocalOfficeCliUsable(installedPaths))
+        return true;
+    const installedMtime = Math.min(...installedPaths.map(pathMtimeMs));
+    const sourceMtime = latestLocalOfficeCliSourceMtime(projectRoot);
+    return sourceMtime > installedMtime + 1000;
+}
+function isInstalledLocalOfficeCliUsable(installedPaths) {
+    const [officecliPath, ...sidecarPaths] = installedPaths;
+    if (!officecliPath || !isRunnableCliBinary('officecli', officecliPath))
+        return false;
+    for (const sidecarPath of sidecarPaths) {
+        if (process.platform !== 'win32' && !isSpawnableCliFile(sidecarPath, process.platform).ok) {
+            console.log(`[jaw:init] ⚠️  OfficeCLI sidecar is not executable → ${sidecarPath}`);
+            return false;
+        }
+    }
+    return true;
+}
 function logSkillsSymlinkReport(report) {
     const links = asArray(report.links);
     if (!links.length)
@@ -151,7 +293,7 @@ async function maybeReregisterLaunchd() {
         return;
     }
     try {
-        execFileSync(jawBin, ['launchd'], { stdio: 'inherit', timeout: 30000 });
+        execFileSync(jawBin, ['launchd'], { stdio: 'inherit', timeout: 30000, env: postinstallExecEnv() });
     }
     catch (e) {
         console.warn(`[jaw:init] ⚠️  launchd 재등록 실패 — 수동: jaw launchd`);
@@ -168,7 +310,14 @@ export async function installOfficeCli(opts = {}) {
         console.log('[jaw:init] ⏭️  officecli skipped (CLI_JAW_SKIP_OFFICECLI)');
         return;
     }
-    const repo = process.env["OFFICECLI_REPO"] || OFFICECLI_DEFAULT_REPO;
+    const rawRepo = process.env["OFFICECLI_REPO"] || OFFICECLI_DEFAULT_REPO;
+    if (!/^[\w.-]+\/[\w.-]+$/.test(rawRepo)) {
+        console.error(`[jaw:init] ❌ OFFICECLI_REPO contains invalid characters: ${rawRepo}`);
+        if (OFFICECLI_REQUIRE)
+            throw new Error(`OFFICECLI_REPO validation failed: ${rawRepo}`);
+        return;
+    }
+    const repo = rawRepo;
     if (opts.interactive && opts.ask) {
         const answer = await opts.ask(`Install/update OfficeCLI (${repo})? [Y/n]`, 'y');
         if (answer.toLowerCase() === 'n') {
@@ -176,6 +325,33 @@ export async function installOfficeCli(opts = {}) {
             return;
         }
     }
+    const localOfficeCliScript = path.join(PROJECT_ROOT, 'officecli', 'dev-install.sh');
+    if (hasLocalOfficeCliCheckout() && shouldRunLocalOfficeCliInstall()) {
+        if (opts.dryRun) {
+            console.log(`  [dry-run] would run bash ${localOfficeCliScript}`);
+            return;
+        }
+        console.log('[jaw:init] 📦 local OfficeCLI checkout is newer; installing via officecli/dev-install.sh...');
+        try {
+            execFileSync('bash', [localOfficeCliScript], {
+                stdio: 'inherit',
+                timeout: 600000,
+                env: postinstallExecEnv(),
+            });
+        }
+        catch (e) {
+            const status = asRecord(e)["status"];
+            if (OFFICECLI_REQUIRE) {
+                throw new Error(`Local OfficeCLI install required but failed (exit ${fieldString(status, '?')})`);
+            }
+            console.warn(`[jaw:init] ⚠️  local OfficeCLI install failed (exit ${fieldString(status, '?')}); run manually: bash officecli/dev-install.sh`);
+        }
+        return;
+    }
+    if (hasLocalOfficeCliCheckout()) {
+        console.log('[jaw:init] ⏭️  local OfficeCLI checkout already installed');
+        return;
+    }
     if (process.platform === 'win32') {
         const ps = findBinaryPath('pwsh') || findBinaryPath('powershell');
         const scriptPath = path.join(PROJECT_ROOT, 'scripts', 'install-officecli.ps1');
@@ -198,14 +374,14 @@ export async function installOfficeCli(opts = {}) {
         }
         console.log(`[jaw:init] 📦 ensuring officecli (${repo}) via PowerShell installer...`);
         try {
-            execFileSync(ps, args, { stdio: 'inherit', timeout: 180000, env: process.env });
+            execFileSync(ps, args, { stdio: 'inherit', timeout: 180000, env: postinstallExecEnv() });
         }
         catch (e) {
             const status = asRecord(e)["status"];
             if (OFFICECLI_REQUIRE) {
                 throw new Error(`OfficeCLI install required but failed (exit ${fieldString(status, '?')})`);
             }
-            console.warn(`[jaw:init] ⚠️  officecli install failed (exit ${fieldString(status, '?')}); skipping — run manually: install-officecli.sh`);
+            console.warn(`[jaw:init] ⚠️  officecli install failed (exit ${fieldString(status, '?')}); skipping — run manually: powershell -ExecutionPolicy Bypass -File scripts/install-officecli.ps1 -Update`);
         }
         return;
     }
@@ -228,7 +404,7 @@ export async function installOfficeCli(opts = {}) {
         execFileSync('bash', args, {
             stdio: 'inherit',
             timeout: 180000,
-            env: { ...process.env, OFFICECLI_REPO: repo },
+            env: postinstallExecEnv({ ...process.env, OFFICECLI_REPO: repo }),
         });
     }
     catch (e) {
@@ -242,8 +418,8 @@ export async function installOfficeCli(opts = {}) {
 const CLI_PACKAGES = [
     { bin: 'claude', pkg: '@anthropic-ai/claude-code' },
     { bin: 'codex', pkg: '@openai/codex' },
-    { bin: 'gemini', pkg: '@google/gemini-cli', brew: 'gemini-cli' },
-    { bin: 'copilot', pkg: '@github/copilot', forceMgr: 'npm' },
+    { bin: 'gemini', pkg: '@google/gemini-cli' },
+    { bin: 'copilot', pkg: '@github/copilot' },
     { bin: 'opencode', pkg: 'opencode-ai' },
 ];
 function truthyEnv(value) {
@@ -258,6 +434,12 @@ export function shouldRequireOfficeCliDuringPostinstall(env = process.env) {
 export function shouldRequireCliToolsDuringPostinstall(env = process.env) {
     return truthyEnv(env["CLI_JAW_REQUIRE_CLI_TOOLS"]) || truthyEnv(env["npm_config_jaw_require_cli_tools"]);
 }
+export function shouldInstallClaudeDuringPostinstall(env = process.env) {
+    return !truthyEnv(env["CLI_JAW_SKIP_CLAUDE"]) && !truthyEnv(env["npm_config_jaw_skip_claude"]);
+}
+export function shouldForceClaudeDuringPostinstall(env = process.env) {
+    return truthyEnv(env["CLI_JAW_FORCE_CLAUDE"]) || truthyEnv(env["npm_config_jaw_force_claude"]);
+}
 export function shouldDedupeCliTools(env = process.env) {
     return truthyEnv(env["CLI_JAW_DEDUPE_CLI_TOOLS"]) || truthyEnv(env["npm_config_jaw_dedupe_cli_tools"]);
 }
@@ -270,10 +452,7 @@ function npmPrefixGlobal() {
             encoding: 'utf8',
             stdio: 'pipe',
             timeout: 3000,
-            env: {
-                ...process.env,
-                PATH: buildServicePath(process.env["PATH"] || ''),
-            },
+            env: postinstallExecEnv(),
         }).trim();
     }
     catch {
@@ -326,16 +505,6 @@ export function detectInstaller(binName) {
         realPath,
     });
 }
-/** Detect the default package manager for fresh installs. */
-function detectDefaultPkgMgr() {
-    try {
-        execSync('bun --version', { stdio: 'pipe' });
-        return 'bun';
-    }
-    catch {
-        return 'npm';
-    }
-}
 function buildInstallCmd(mgr, pkg, brewFormula) {
     switch (mgr) {
         case 'brew': return `brew upgrade ${brewFormula || pkg} 2>/dev/null || brew install ${brewFormula || pkg}`;
@@ -343,19 +512,197 @@ function buildInstallCmd(mgr, pkg, brewFormula) {
         case 'npm': return `npm i -g ${pkg}@latest`;
     }
 }
+function runInstallCmd(mgr, pkg, env, brewFormula) {
+    const timeout = 180000;
+    if (mgr === 'brew') {
+        try {
+            execFileSync('brew', ['upgrade', brewFormula || pkg], { stdio: 'pipe', timeout, env });
+        }
+        catch {
+            execFileSync('brew', ['install', brewFormula || pkg], { stdio: 'pipe', timeout, env });
+        }
+    }
+    else if (mgr === 'bun') {
+        execFileSync('bun', ['install', '-g', `${pkg}@latest`], { stdio: 'pipe', timeout, env });
+    }
+    else {
+        execFileSync('npm', ['i', '-g', `${pkg}@latest`], { stdio: 'pipe', timeout, env });
+    }
+}
+function buildClaudeNativeInstallCmd() {
+    if (process.platform === 'win32') {
+        return `powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-Expression (Invoke-RestMethod '${CLAUDE_NATIVE_INSTALL_PS_URL}')"`;
+    }
+    return `curl -fsSL -o /tmp/claude-install.sh ${CLAUDE_NATIVE_INSTALL_URL} && bash /tmp/claude-install.sh`;
+}
+function runClaudeNativeInstall(_cmd) {
+    const env = postinstallExecEnv();
+    if (process.platform === 'win32') {
+        execFileSync('powershell', [
+            '-NoProfile',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-Command',
+            `Invoke-Expression (Invoke-RestMethod '${CLAUDE_NATIVE_INSTALL_PS_URL}')`,
+        ], {
+            stdio: 'pipe',
+            timeout: 180000,
+            env,
+        });
+        return;
+    }
+    const tmpScript = path.join(os.tmpdir(), `claude-install-${Date.now()}.sh`);
+    try {
+        execFileSync('curl', ['-fsSL', '-o', tmpScript, CLAUDE_NATIVE_INSTALL_URL], {
+            stdio: 'pipe', timeout: 30000, env,
+        });
+        execFileSync('bash', [tmpScript], {
+            stdio: 'pipe', timeout: 180000, env,
+        });
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmpScript);
+        }
+        catch { }
+    }
+}
+function findClaudeNativeBinary() {
+    const candidates = [
+        path.join(home, '.local', 'bin', process.platform === 'win32' ? 'claude.exe' : 'claude'),
+        path.join(home, '.local', 'bin', 'claude'),
+        path.join(home, '.claude', 'local', 'bin', process.platform === 'win32' ? 'claude.exe' : 'claude'),
+        path.join(home, '.claude', 'local', 'bin', 'claude'),
+        findBinaryPath('claude'),
+    ].filter((candidate) => !!candidate);
+    for (const candidate of candidates) {
+        if (!fs.existsSync(candidate))
+            continue;
+        if (process.platform !== 'win32' && !isSpawnableCliFile(candidate, process.platform).ok)
+            continue;
+        try {
+            const realPath = fs.realpathSync(candidate);
+            if (classifyClaudeInstall(candidate) === 'native' || classifyClaudeInstall(realPath) === 'native') {
+                return candidate;
+            }
+        }
+        catch {
+            if (classifyClaudeInstall(candidate) === 'native')
+                return candidate;
+        }
+    }
+    return null;
+}
+export function findRunnableCliBinary(name) {
+    const scan = listCliBinaryCandidates(name, readProcessPath());
+    for (const candidate of scan.candidates) {
+        if (!candidate.spawnable) {
+            console.log(`[jaw:init] ⚠️  ${name} candidate is not spawnable → ${candidate.path}`);
+            continue;
+        }
+        if (isRunnableCliBinary(name, candidate.path))
+            return candidate.path;
+    }
+    return null;
+}
+function findExistingCliBinary(name) {
+    return findRunnableCliBinary(name);
+}
+function findExistingClaudeBinary() {
+    return findRunnableCliBinary('claude');
+}
+function outputText(value) {
+    if (Buffer.isBuffer(value))
+        return value.toString('utf8');
+    return fieldString(value);
+}
+function childFailureOutput(error) {
+    const err = asRecord(error);
+    return [outputText(err["stderr"]), outputText(err["stdout"]), errString(error)]
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .join('\n');
+}
+function runCliVersionCheck(binaryPath) {
+    const common = {
+        encoding: 'utf8',
+        stdio: 'pipe',
+        timeout: 5000,
+        env: postinstallExecEnv(),
+    };
+    if (process.platform === 'win32') {
+        execFileSync('powershell', [
+            '-NoProfile',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-Command',
+            '& $args[0] --version',
+            binaryPath,
+        ], common);
+        return;
+    }
+    execFileSync(binaryPath, ['--version'], common);
+}
+function isRunnableCliBinary(name, binaryPath) {
+    try {
+        runCliVersionCheck(binaryPath);
+        return true;
+    }
+    catch (e) {
+        const output = childFailureOutput(e);
+        console.log(`[jaw:init] ⚠️  ${name} exists but failed --version → ${binaryPath}`);
+        if (output)
+            console.log(`             ${output.slice(0, 160)}`);
+        return false;
+    }
+}
+function isRunnableClaudeBinary(binaryPath) {
+    return isRunnableCliBinary('claude', binaryPath);
+}
+function installClaudeCli(options = {}) {
+    const existingPath = findExistingClaudeBinary();
+    if (existingPath && !options.force) {
+        console.log(`[jaw:init] ⏭️  claude already works → ${existingPath}`);
+        return true;
+    }
+    const cmd = buildClaudeNativeInstallCmd();
+    const label = process.platform === 'win32' ? 'native PowerShell installer' : 'native installer';
+    console.log(`[jaw:init] 📦 claude (${label}): ${cmd}`);
+    try {
+        runClaudeNativeInstall(cmd);
+    }
+    catch (e) {
+        console.error(`[jaw:init] ⚠️  claude: auto-install failed — install manually: ${cmd}`);
+        const message = errString(e);
+        if (message)
+            console.error(`             ${message.slice(0, 160)}`);
+        return false;
+    }
+    const nativePath = findClaudeNativeBinary();
+    if (nativePath && isRunnableClaudeBinary(nativePath)) {
+        console.log(`[jaw:init] ✅ claude native binary verified → ${nativePath}`);
+        return true;
+    }
+    if (nativePath) {
+        console.error(`[jaw:init] ⚠️  claude native binary exists but failed --version → ${nativePath}`);
+    }
+    console.error('[jaw:init] ⚠️  claude: installer completed but native binary was not found or not runnable');
+    console.error('[jaw:init]    expected a working ~/.local/bin/claude, ~/.claude/local/bin/claude, or %USERPROFILE%\\.local\\bin\\claude.exe');
+    return false;
+}
 /** Check if a package is installed via a specific manager (independent of PATH order). */
 function isInstalledVia(mgr, pkg, brewFormula) {
     try {
         switch (mgr) {
             case 'npm':
-                execSync(`npm ls -g ${pkg} --depth=0`, { stdio: 'pipe', timeout: 5000 });
+                execFileSync('npm', ['ls', '-g', pkg, '--depth=0'], { stdio: 'pipe', timeout: 5000, env: postinstallExecEnv() });
                 return true;
             case 'bun': {
                 const bunGlobal = path.join(home, '.bun', 'install', 'global', 'node_modules', pkg.split('/').pop());
                 return fs.existsSync(bunGlobal);
             }
             case 'brew':
-                execSync(`brew list --formula ${brewFormula || pkg}`, { stdio: 'pipe', timeout: 5000 });
+                execFileSync('brew', ['list', '--formula', brewFormula || pkg], { stdio: 'pipe', timeout: 5000, env: postinstallExecEnv() });
                 return true;
         }
     }
@@ -370,9 +717,12 @@ function buildUninstallCmd(mgr, pkg, brewFormula) {
         case 'brew': return `brew uninstall ${brewFormula || pkg}`;
     }
 }
-/** Remove duplicate installations — keep the active one (PATH winner), remove the rest. */
-function deduplicateCliTool(bin, pkg, brew) {
-    const active = detectInstaller(bin);
+/** Remove duplicate installations — keep the preferred manager when postinstall just installed one. */
+function deduplicateCliTool(bin, pkg, brew, preferredActive) {
+    const detectedActive = detectInstaller(bin);
+    const active = preferredActive && isInstalledVia(preferredActive, pkg, brew)
+        ? preferredActive
+        : detectedActive;
     if (!active)
         return; // not installed at all
     const others = ['bun', 'npm', 'brew'].filter(m => m !== active);
@@ -385,24 +735,58 @@ function deduplicateCliTool(bin, pkg, brew) {
         return;
     }
     for (const mgr of duplicates) {
-        const cmd = buildUninstallCmd(mgr, pkg, brew);
         console.log(`[jaw:init] 🧹 ${bin}: removing duplicate from ${mgr} (active: ${active})`);
         try {
-            execSync(cmd, { stdio: 'pipe', timeout: 30000 });
+            const env = postinstallExecEnv();
+            if (mgr === 'npm')
+                execFileSync('npm', ['uninstall', '-g', pkg], { stdio: 'pipe', timeout: 30000, env });
+            else if (mgr === 'bun')
+                execFileSync('bun', ['remove', '-g', pkg], { stdio: 'pipe', timeout: 30000, env });
+            else
+                execFileSync('brew', ['uninstall', brew || pkg], { stdio: 'pipe', timeout: 30000, env });
             console.log(`[jaw:init]    removed ${pkg} from ${mgr}`);
         }
         catch {
-            console.warn(`[jaw:init]    ⚠️  failed to remove ${pkg} from ${mgr} — remove manually: ${cmd}`);
+            console.warn(`[jaw:init]    ⚠️  failed to remove ${pkg} from ${mgr} — remove manually: ${buildUninstallCmd(mgr, pkg, brew)}`);
         }
     }
 }
 export async function installCliTools(opts = {}) {
-    const defaultMgr = detectDefaultPkgMgr();
     const failed = [];
     console.log('[jaw:init] installing CLI tools @latest...');
-    for (const { bin, pkg, brew, forceMgr } of CLI_PACKAGES) {
+    for (const { bin, pkg, brew } of CLI_PACKAGES) {
+        if (bin === 'claude') {
+            if (!shouldInstallClaudeDuringPostinstall()) {
+                console.log('[jaw:init] claude install skipped (CLI_JAW_SKIP_CLAUDE)');
+                continue;
+            }
+            const existingPath = findRunnableCliBinary('claude');
+            if (existingPath && !shouldForceClaudeDuringPostinstall()) {
+                console.log(`[jaw:init] ⏭️  claude already works → ${existingPath}`);
+                continue;
+            }
+            if (opts.dryRun) {
+                console.log(`  [dry-run] would run ${buildClaudeNativeInstallCmd()}`);
+                continue;
+            }
+            if (opts.interactive && opts.ask) {
+                const answer = await opts.ask('Install claude (native Claude Code installer)? [y/N]', 'n');
+                if (answer.toLowerCase() !== 'y') {
+                    console.log(`  ⏭️  skipped ${bin}`);
+                    continue;
+                }
+            }
+            if (!installClaudeCli({ force: shouldForceClaudeDuringPostinstall() }))
+                failed.push('claude (native installer)');
+            continue;
+        }
+        const existingPath = findExistingCliBinary(bin);
+        if (existingPath) {
+            console.log(`[jaw:init] ⏭️  ${bin} already works → ${existingPath}`);
+            continue;
+        }
         if (opts.dryRun) {
-            console.log(`  [dry-run] would install ${pkg}`);
+            console.log(`  [dry-run] would run ${buildInstallCmd('npm', pkg, brew)}`);
             continue;
         }
         if (opts.interactive && opts.ask) {
@@ -412,50 +796,38 @@ export async function installCliTools(opts = {}) {
                 continue;
             }
         }
-        // forceMgr overrides detection (e.g. copilot → always npm)
-        const existing = forceMgr ? null : detectInstaller(bin);
-        const mgr = forceMgr || existing || defaultMgr;
-        const cmd = buildInstallCmd(mgr, pkg, brew);
-        const tag = existing ? `update via ${mgr}` : `fresh install via ${mgr}`;
-        console.log(`[jaw:init] 📦 ${bin} (${tag}): ${cmd}`);
+        const tag = existingPath ? 'repair via npm' : 'fresh install via npm';
+        console.log(`[jaw:init] 📦 ${bin} (${tag}): npm i -g ${pkg}@latest`);
         try {
-            execSync(cmd, { stdio: 'pipe', timeout: 180000 });
+            runInstallCmd('npm', pkg, postinstallExecEnv(), brew);
             console.log(`[jaw:init] ✅ ${bin} installed`);
         }
         catch {
-            // Fallback: if preferred manager failed and it wasn't npm, try npm
-            if (mgr !== 'npm') {
-                console.log(`[jaw:init] ⚠️  ${mgr} failed, trying npm i -g ${pkg}@latest ...`);
-                try {
-                    execSync(`npm i -g ${pkg}@latest`, { stdio: 'pipe', timeout: 180000 });
-                    console.log(`[jaw:init] ✅ ${bin} installed (via npm fallback)`);
-                }
-                catch {
-                    failed.push(`${bin} (${pkg})`);
-                    console.error(`[jaw:init] ⚠️  ${bin}: auto-install failed — install manually: npm i -g ${pkg}`);
-                }
-            }
-            else {
-                failed.push(`${bin} (${pkg})`);
-                console.error(`[jaw:init] ⚠️  ${bin}: auto-install failed — install manually: npm i -g ${pkg}`);
-            }
+            failed.push(`${bin} (${pkg})`);
+            console.error(`[jaw:init] ⚠️  ${bin}: auto-install failed — install manually: npm i -g ${pkg}`);
         }
-        // Clean up duplicate installations from other package managers
-        deduplicateCliTool(bin, pkg, brew);
+        // Clean up duplicate installations from other package managers only after cli-jaw installs npm.
+        deduplicateCliTool(bin, pkg, brew, 'npm');
     }
     if (failed.length > 0 && shouldRequireCliToolsDuringPostinstall()) {
         throw new Error(`Required CLI tool install failed: ${failed.join(', ')}`);
     }
 }
 const MCP_PACKAGES = [
-    { pkg: '@upstash/context7-mcp', bin: 'context7-mcp' },
+    { name: 'context7', pkg: '@upstash/context7-mcp', bin: 'context7-mcp' },
 ];
 export async function installMcpServers(opts = {}) {
     console.log('[jaw:init] installing MCP servers globally...');
     const config = loadUnifiedMcp();
     let updated = false;
-    for (const { pkg, bin } of MCP_PACKAGES) {
+    const servers = asRecord(config.servers);
+    for (const { name, pkg, bin } of MCP_PACKAGES) {
         try {
+            const server = asRecord(servers[name]);
+            if (typeof server["url"] === 'string' && server["url"]) {
+                console.log(`[jaw:init] ⏭️  ${name} MCP (remote URL, no local install needed)`);
+                continue;
+            }
             const installedPath = findBinaryPath(bin);
             if (installedPath) {
                 console.log(`[jaw:init] ⏭️  ${bin} (already installed)`);
@@ -473,10 +845,9 @@ export async function installMcpServers(opts = {}) {
                 }
             }
             console.log(`[jaw:init] 📦 npm i -g ${pkg} ...`);
-            execSync(`npm i -g ${pkg}`, { stdio: 'pipe', timeout: 120000 });
+            execFileSync('npm', ['i', '-g', pkg], { stdio: 'pipe', timeout: 120000, env: postinstallExecEnv() });
             const binPath = findBinaryPath(bin) || bin;
             console.log(`[jaw:init] ✅ ${bin} → ${binPath}`);
-            const servers = asRecord(config.servers);
             for (const srv of Object.values(servers).map(asRecord)) {
                 const args = asArray(srv["args"]);
                 if (srv["command"] === 'npx' && args.includes(pkg)) {
@@ -496,24 +867,47 @@ export async function installMcpServers(opts = {}) {
 const SKILL_DEPS = [
     {
         name: 'uv',
-        check: 'uv --version',
+        check: ['uv', ['--version']],
         install: process.platform === 'win32'
-            ? 'powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"'
-            : 'curl -LsSf https://astral.sh/uv/install.sh | sh',
+            ? { type: 'remote-script', url: 'https://astral.sh/uv/install.ps1', shell: 'powershell' }
+            : { type: 'remote-script', url: 'https://astral.sh/uv/install.sh', shell: 'sh' },
         why: 'Python skills (imagegen, pdf, speech, spreadsheet, transcribe)',
     },
     {
         name: 'playwright-core',
-        check: 'node -e "require.resolve(\'playwright-core\')"',
-        install: 'npm i -g playwright-core',
+        check: ['node', ['-e', "require.resolve('playwright-core')"]],
+        install: { type: 'npm', pkg: 'playwright-core' },
         why: 'Browser control skill (cli-jaw browser)',
     },
 ];
+function runSkillDepInstall(install, env) {
+    if ('pkg' in install) {
+        execFileSync('npm', ['i', '-g', install.pkg], { stdio: 'pipe', timeout: 120000, env });
+        return;
+    }
+    const tmpScript = path.join(os.tmpdir(), `jaw-dep-${Date.now()}.sh`);
+    try {
+        execFileSync('curl', ['-fsSL', '-o', tmpScript, install.url], { stdio: 'pipe', timeout: 30000, env });
+        if (install.shell === 'powershell') {
+            execFileSync('powershell', ['-ExecutionPolicy', 'ByPass', '-File', tmpScript], { stdio: 'pipe', timeout: 120000, env });
+        }
+        else {
+            execFileSync(install.shell, [tmpScript], { stdio: 'pipe', timeout: 120000, env });
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmpScript);
+        }
+        catch { }
+    }
+}
 export async function installSkillDeps(opts = {}) {
     console.log('[jaw:init] checking skill dependencies...');
     for (const dep of SKILL_DEPS) {
+        const [checkBin, checkArgs] = dep.check;
         try {
-            execSync(dep.check, { stdio: 'pipe', timeout: 10000 });
+            execFileSync(checkBin, checkArgs, { stdio: 'pipe', timeout: 10000, env: postinstallExecEnv() });
             console.log(`[jaw:init] ⏭️  ${dep.name} (already installed)`);
         }
         catch {
@@ -530,12 +924,11 @@ export async function installSkillDeps(opts = {}) {
             }
             console.log(`[jaw:init] 📦 installing ${dep.name} (${dep.why})...`);
             try {
-                execSync(dep.install, { stdio: 'pipe', timeout: 120000 });
+                runSkillDepInstall(dep.install, postinstallExecEnv());
                 console.log(`[jaw:init] ✅ ${dep.name} installed`);
             }
-            catch (e) {
-                console.error(`[jaw:init] ⚠️  ${dep.name}: auto-install failed — install manually:`);
-                console.error(`             ${dep.install}`);
+            catch {
+                console.error(`[jaw:init] ⚠️  ${dep.name}: auto-install failed — install manually`);
             }
         }
     }
@@ -555,6 +948,25 @@ export async function runPostinstall() {
         console.log('[jaw:postinstall] Run `jaw init` to configure interactively');
         return;
     }
+    // ── WSL + Windows Node detection ──
+    const looksLikeWsl = Boolean(process.env['WSL_DISTRO_NAME'] || process.env['WSL_INTEROP'] || process.env['WSLENV']
+        || (() => { try {
+            return fs.readFileSync('/proc/version', 'utf8').toLowerCase().includes('microsoft');
+        }
+        catch {
+            return false;
+        } })());
+    if (looksLikeWsl) {
+        const execPath = process.execPath.replace(/\\/g, '/');
+        const isWindowsNode = process.platform === 'win32'
+            || /^[A-Z]:\//i.test(execPath)
+            || execPath.startsWith('/mnt/');
+        if (isWindowsNode) {
+            console.warn('[jaw:init] ⚠️  Running with Windows Node.js inside WSL');
+            console.warn('[jaw:init]    npm -g packages will install to Windows, not WSL');
+            console.warn('[jaw:init]    Recommended: install Node inside WSL (fnm install 22 or nvm install 22)');
+        }
+    }
     // ── Legacy migration (only in normal mode, NOT safe mode) ──
     const legacyHome = path.join(home, '.cli-jaw');
     const isCustomHome = jawHome !== legacyHome;
@@ -597,16 +1009,13 @@ export async function runPostinstall() {
         console.log('[jaw:init] shared path migration skipped (isolated-by-default)');
         console.log('[jaw:init] to opt in: CLI_JAW_MIGRATE_SHARED_PATHS=1 npm install -g cli-jaw');
     }
-    // 3. CLAUDE.md → AGENTS.md symlink
-    const agentsMd = path.join(jawHome, 'AGENTS.md');
-    const claudeMd = path.join(jawHome, 'CLAUDE.md');
-    if (fs.existsSync(agentsMd) && !fs.existsSync(claudeMd)) {
-        ensureSymlink(agentsMd, claudeMd);
-    }
+    // 3. Remove deprecated Jaw-home CLAUDE.md mirrors.
+    // Boss prompts are already passed through append/system-prompt paths.
+    removeJawHomeClaudeInstructionFile(jawHome);
     // 4. Default heartbeat.json
     const heartbeatPath = path.join(jawHome, 'heartbeat.json');
     if (!fs.existsSync(heartbeatPath)) {
-        fs.writeFileSync(heartbeatPath, JSON.stringify({ jobs: [] }, null, 2));
+        fs.writeFileSync(heartbeatPath, JSON.stringify({ jobs: [] }, null, 2), { mode: 0o600 });
         console.log(`[jaw:init] created ${heartbeatPath}`);
     }
     // 5. MCP config
@@ -614,13 +1023,22 @@ export async function runPostinstall() {
     // 6. Default skills (base) + propagate to all instances
     copyDefaultSkills();
     propagateSkillsToInstances();
-    // 7-9. Install MCP servers, skill deps, officecli runtime. CLI tools are opt-in:
-    // postinstall must not update or uninstall user-managed agent CLIs unexpectedly.
+    // 7-9. Install MCP servers, skill deps, officecli runtime. Claude is the default
+    // agent CLI, so keep it spawnable; other agent CLIs remain opt-in.
     if (shouldInstallCliToolsDuringPostinstall()) {
         await installCliTools();
     }
     else {
-        console.log('[jaw:init] CLI tool install/update skipped by default');
+        if (shouldInstallClaudeDuringPostinstall()) {
+            const ok = installClaudeCli({ force: shouldForceClaudeDuringPostinstall() });
+            if (!ok && shouldRequireCliToolsDuringPostinstall()) {
+                throw new Error('Required CLI tool install failed: claude (native installer)');
+            }
+        }
+        else {
+            console.log('[jaw:init] claude install skipped (CLI_JAW_SKIP_CLAUDE)');
+        }
+        console.log('[jaw:init] additional CLI tool install/update skipped by default');
         console.log('[jaw:init] to opt in: CLI_JAW_INSTALL_CLI_TOOLS=1 npm install -g cli-jaw');
     }
     await installMcpServers();