maqcli 0.6.3 → 0.6.5

package/dist/core/launcher.js

@@ -353,7 +353,7 @@ async function connectMobile(rl) {
 async function launchUi(authKey) {
     // Reuse the daemon; open its landing page. Import lazily to avoid a cycle.
     const { createDaemon } = await import("../server/daemon.js");
-    const daemon = createDaemon({ token: authKey, version: "0.6.3" });
+    const daemon = createDaemon({ token: authKey, version: "0.6.5" });
     try {
         const { host, port } = await daemon.listen();
         const url = `http://${host}:${port}/`;

package/dist/core/update.d.ts

@@ -66,22 +66,35 @@ export declare function runNpm(args: string[], opts?: {
 }>;
 /**
  * Build the OS-appropriate command to run `npm install -g maqcli@<version>`
- * fully detached from the current process (see module doc for why). On
- * Windows this wraps npm in a new cmd.exe (which is also how the shim gets
- * resolved at all — see runNpm above); on POSIX, a `sh -c` one-liner gives us
- * the same redirection-to-a-log-file behavior.
+ * fully detached from the current process (see module doc for why).
+ *
+ * On Windows, `cmd.exe /c "npm install..."` alone is NOT enough: even with
+ * `detached: true` + `.unref()` on the Node side, the child stays tied to the
+ * parent's console/job object, and it dies the moment the parent's console
+ * closes (a long-standing Node behavior on Windows — nodejs/node#5614). The
+ * fix is to have cmd.exe launch the real work via the `start` builtin, which
+ * creates a genuinely independent process outside the parent's job object.
+ *
+ * `start`'s own command-line parsing is notoriously fragile with nested
+ * quotes (redirection operators and quoted paths inside a quoted inner
+ * command reliably break it). Rather than fight cmd.exe's quoting rules, we
+ * write the actual work to a small, disposable .bat/.sh script on disk and
+ * have `start`/the shell launch THAT — no nested quoting at all.
  */
 export declare function detachedInstallCommand(version: string, logPath: string, platform?: NodeJS.Platform): {
     cmd: string;
     args: string[];
+    scriptPath: string;
+    scriptContent: string;
 };
 /**
  * Launch the update fully detached and return immediately — the caller
  * (cmdUpdate) should print guidance and exit right away rather than await
  * anything else, which is what avoids the Windows file-lock failure mode.
  * `spawner` is injectable for tests so nothing is actually spawned there.
+ * `writer` is injectable so tests don't touch the real filesystem either.
  */
-export declare function launchDetachedUpdate(version: string, logPath: string, spawner?: typeof spawn): number | undefined;
+export declare function launchDetachedUpdate(version: string, logPath: string, spawner?: typeof spawn, writer?: (path: string, content: string) => void): number | undefined;
 export interface UpdateOutcome {
     ok: boolean;
     message: string;
@@ -116,6 +129,7 @@ export declare function performUpdate(currentVersion: string, opts?: {
         stderr: string;
     }>;
     spawner?: typeof spawn;
+    writer?: (path: string, content: string) => void;
     logPath?: string;
 }): Promise<UpdateOutcome>;
 /**

package/dist/core/update.js

@@ -43,6 +43,7 @@
 import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { writeFileSync, chmodSync } from "node:fs";
 import { execSafe } from "./exec.js";
 /** Parse "x.y.z" into a comparable tuple; non-numeric parts sort as 0. */
 function parseSemver(v) {
@@ -97,26 +98,50 @@ export async function runNpm(args, opts = {}) {
 }
 /**
  * Build the OS-appropriate command to run `npm install -g maqcli@<version>`
- * fully detached from the current process (see module doc for why). On
- * Windows this wraps npm in a new cmd.exe (which is also how the shim gets
- * resolved at all — see runNpm above); on POSIX, a `sh -c` one-liner gives us
- * the same redirection-to-a-log-file behavior.
+ * fully detached from the current process (see module doc for why).
+ *
+ * On Windows, `cmd.exe /c "npm install..."` alone is NOT enough: even with
+ * `detached: true` + `.unref()` on the Node side, the child stays tied to the
+ * parent's console/job object, and it dies the moment the parent's console
+ * closes (a long-standing Node behavior on Windows — nodejs/node#5614). The
+ * fix is to have cmd.exe launch the real work via the `start` builtin, which
+ * creates a genuinely independent process outside the parent's job object.
+ *
+ * `start`'s own command-line parsing is notoriously fragile with nested
+ * quotes (redirection operators and quoted paths inside a quoted inner
+ * command reliably break it). Rather than fight cmd.exe's quoting rules, we
+ * write the actual work to a small, disposable .bat/.sh script on disk and
+ * have `start`/the shell launch THAT — no nested quoting at all.
  */
 export function detachedInstallCommand(version, logPath, platform = process.platform) {
     const pkg = `maqcli@${version}`;
     if (platform === "win32") {
-        return { cmd: "cmd.exe", args: ["/c", `npm install -g ${pkg} > "${logPath}" 2>&1`] };
+        const scriptPath = join(tmpdir(), `maq-update-${Date.now()}.bat`);
+        const scriptContent = ["@echo off", `npm install -g ${pkg} > "${logPath}" 2>&1`, `start "" /min cmd.exe /c del "%~f0"`].join("\r\n");
+        return { cmd: "cmd.exe", args: ["/c", "start", "", "/min", scriptPath], scriptPath, scriptContent };
     }
-    return { cmd: "sh", args: ["-c", `npm install -g ${pkg} > '${logPath}' 2>&1`] };
+    const scriptPath = join(tmpdir(), `maq-update-${Date.now()}.sh`);
+    const scriptContent = ["#!/bin/sh", `npm install -g ${pkg} > '${logPath}' 2>&1`, `rm -f "$0"`].join("\n");
+    return { cmd: "sh", args: [scriptPath], scriptPath, scriptContent };
 }
 /**
  * Launch the update fully detached and return immediately — the caller
  * (cmdUpdate) should print guidance and exit right away rather than await
  * anything else, which is what avoids the Windows file-lock failure mode.
  * `spawner` is injectable for tests so nothing is actually spawned there.
+ * `writer` is injectable so tests don't touch the real filesystem either.
  */
-export function launchDetachedUpdate(version, logPath, spawner = spawn) {
-    const { cmd, args } = detachedInstallCommand(version, logPath);
+export function launchDetachedUpdate(version, logPath, spawner = spawn, writer = (path, content) => writeFileSync(path, content, "utf8")) {
+    const { cmd, args, scriptPath, scriptContent } = detachedInstallCommand(version, logPath);
+    writer(scriptPath, scriptContent);
+    if (process.platform !== "win32") {
+        try {
+            chmodSync(scriptPath, 0o755);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
     const child = spawner(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
     child.on("error", () => {
         /* best-effort; the log file (or its absence) is the source of truth */
@@ -153,7 +178,9 @@ export async function performUpdate(currentVersion, opts = {}) {
     const latest = version.latest;
     if (!opts.wait) {
         const logPath = opts.logPath ?? defaultLogPath();
-        const pid = launchDetachedUpdate(latest, logPath, opts.spawner);
+        const pid = opts.writer
+            ? launchDetachedUpdate(latest, logPath, opts.spawner, opts.writer)
+            : launchDetachedUpdate(latest, logPath, opts.spawner);
         return {
             ok: true,
             message: `update to v${latest} launched in the background (detached, avoids file locks). Open a new terminal in a few seconds to pick it up.`,

package/dist/index.js

@@ -46,7 +46,7 @@ import { runOrchestration } from "./core/orchestrator.js";
 import { performUpdate, installedGlobalVersion } from "./core/update.js";
 import { checkProtectedPath, scanForInjection, securityLog, securityRules, } from "./core/security.js";
 import { readFileSync, statSync } from "node:fs";
-const VERSION = "0.6.3";
+const VERSION = "0.6.5";
 async function main(argv) {
     const [command, ...rest] = argv;
     switch (command) {

package/dist/server/daemon.js

@@ -52,7 +52,7 @@ export function createDaemon(opts = {}) {
     const host = opts.host ?? process.env.MAQ_HOST ?? "127.0.0.1";
     const port = opts.port ?? Number(process.env.MAQ_PORT ?? 7717);
     const token = opts.token ?? process.env.MAQ_TOKEN ?? generateToken();
-    const version = opts.version ?? "0.6.3";
+    const version = opts.version ?? "0.6.5";
     const corsOrigin = opts.corsOrigin ?? process.env.MAQ_CORS_ORIGIN;
     const registry = opts.registry ?? new SessionRegistry();
     const interactive = new InteractiveRegistry();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maqcli",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "MAQ master orchestrator — a token-efficient, agent-agnostic supervisor CLI that sits on top of any worker CLI (AI or not) via a Scout -> Plan -> Execute -> Verify pipeline.",
   "type": "module",
   "bin": {