openmerit 0.2.0 → 0.3.1

package/dist/terminal/src/service-registry.mjs

@@ -1,78 +0,0 @@
-// Shared, dependency-free service identities for passive discovery and the UI.
-// Endpoint formats checked against official API docs on 2026-10-10; see the guide.
-// A match identifies configuration, never connectivity, usage, a model, or a host.
-const define = (key, name, type, options = {}) => Object.freeze({ key, name, type, aliases: [], credentials: [], endpoints: [], hosts: [], ...options });
-const label = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
-const subdomains = suffix => new RegExp(`^(?:${label}\\.)+${suffix.replaceAll('.', '\\.')}$`);
-const resource = suffix => new RegExp(`^${label}\\.${suffix.replaceAll('.', '\\.')}$`);
-const region = '[a-z]{2}(?:-[a-z]+)+-\\d+';
-const hf = subdomains('endpoints.huggingface.cloud');
-const azureOpenAI = resource('openai.azure.com');
-const azureFoundry = resource('services.ai.azure.com');
-const bedrock = new RegExp(`^bedrock-runtime(?:-fips)?\\.${region}\\.amazonaws\\.com(?:\\.cn)?$`);
-const sagemaker = new RegExp(`^runtime(?:-fips)?\\.sagemaker\\.${region}\\.amazonaws\\.com(?:\\.cn)?$`);
-const vertex = /^(?:[a-z]+(?:-[a-z]+)*\d+-)?aiplatform\.googleapis\.com$/;
-const maas = new RegExp(`^${label}\\.(?:cn-beijing|cn-hongkong|ap-southeast-1|ap-northeast-1)\\.maas\\.aliyuncs\\.com$`);
-
-export const SERVICE_REGISTRY = Object.freeze([
-  define('openai', 'OpenAI', 'model-api', { aliases: ['openai api'], credentials: ['OPENAI_API_KEY'], endpoints: ['OPENAI_BASE_URL', 'OPENAI_API_BASE'], hosts: ['api.openai.com'] }),
-  define('anthropic', 'Anthropic', 'model-api', { aliases: ['anthropic api'], credentials: ['ANTHROPIC_API_KEY'], endpoints: ['ANTHROPIC_BASE_URL'], hosts: ['api.anthropic.com'] }),
-  define('openrouter', 'OpenRouter', 'gateway', { credentials: ['OPENROUTER_API_KEY'], endpoints: ['OPENROUTER_BASE_URL'], hosts: ['openrouter.ai'] }),
-  define('google', 'Google', 'model-api', { aliases: ['google ai', 'google api', 'gemini api'], credentials: ['GOOGLE_GENERATIVE_AI_API_KEY', 'GEMINI_API_KEY'], endpoints: ['GOOGLE_GEMINI_BASE_URL', 'GEMINI_BASE_URL'], hosts: ['generativelanguage.googleapis.com'] }),
-  define('groq', 'Groq', 'inference-cloud', { aliases: ['groq api', 'groqcloud'], credentials: ['GROQ_API_KEY'], endpoints: ['GROQ_BASE_URL'], hosts: ['api.groq.com'] }),
-  define('cerebras', 'Cerebras', 'inference-cloud', { aliases: ['cerebras api'], credentials: ['CEREBRAS_API_KEY'], endpoints: ['CEREBRAS_BASE_URL'], hosts: ['api.cerebras.ai'] }),
-  define('baseten', 'Baseten', 'inference-cloud', { aliases: ['baseten api'], credentials: ['BASETEN_API_KEY'], endpoints: ['BASETEN_BASE_URL'], hosts: ['inference.baseten.co'], match: url => /^model-[a-z0-9-]+\.api\.baseten\.co$/.test(url.hostname), redact: host => host.replace(/^model-[a-z0-9-]+(?=\.api\.baseten\.co$)/, 'model-…') }),
-  // Hub and general cloud tokens can authorize unrelated products or downloads.
-  define('huggingface-endpoints', 'Hugging Face Endpoints', 'inference-cloud', { aliases: ['hugging face inference endpoints'], endpoints: ['HF_INFERENCE_ENDPOINT', 'HF_ENDPOINT_URL', 'HUGGINGFACE_ENDPOINT_URL'], match: url => hf.test(url.hostname), redact: () => '….endpoints.huggingface.cloud' }),
-  define('huggingface-router', 'Hugging Face Router', 'router', { aliases: ['hugging face inference providers'], hosts: ['router.huggingface.co'] }),
-  define('mistral', 'Mistral', 'model-api', { aliases: ['mistral ai', 'mistral api'], credentials: ['MISTRAL_API_KEY'], endpoints: ['MISTRAL_BASE_URL', 'MISTRAL_SERVER_URL'], hosts: ['api.mistral.ai'] }),
-  define('deepseek', 'DeepSeek', 'model-api', { aliases: ['deepseek api'], credentials: ['DEEPSEEK_API_KEY'], endpoints: ['DEEPSEEK_BASE_URL'], hosts: ['api.deepseek.com'] }),
-  define('cohere', 'Cohere', 'model-api', { aliases: ['cohere api'], credentials: ['COHERE_API_KEY', 'CO_API_KEY'], endpoints: ['COHERE_BASE_URL'], hosts: ['api.cohere.ai', 'api.cohere.com'] }),
-  define('xai', 'xAI', 'model-api', { aliases: ['xai api'], credentials: ['XAI_API_KEY'], endpoints: ['XAI_BASE_URL'], hosts: ['api.x.ai'] }),
-  define('voyage', 'Voyage AI', 'model-api', { aliases: ['voyage', 'voyageai'], credentials: ['VOYAGE_API_KEY'], endpoints: ['VOYAGE_BASE_URL'], hosts: ['api.voyageai.com'] }),
-  define('jina', 'Jina AI', 'model-api', { aliases: ['jina'], endpoints: ['JINA_BASE_URL'], hosts: ['api.jina.ai'] }),
-  define('together', 'Together AI', 'inference-cloud', { aliases: ['together'], credentials: ['TOGETHER_API_KEY'], endpoints: ['TOGETHER_BASE_URL'], hosts: ['api.together.ai', 'api.together.xyz'] }),
-  define('fireworks', 'Fireworks AI', 'inference-cloud', { aliases: ['fireworks'], credentials: ['FIREWORKS_API_KEY'], endpoints: ['FIREWORKS_BASE_URL'], hosts: ['api.fireworks.ai'] }),
-  define('deepinfra', 'DeepInfra', 'inference-cloud', { credentials: ['DEEPINFRA_API_KEY', 'DEEPINFRA_API_TOKEN'], endpoints: ['DEEPINFRA_BASE_URL'], hosts: ['api.deepinfra.com'] }),
-  define('replicate', 'Replicate', 'inference-cloud', { credentials: ['REPLICATE_API_TOKEN'], endpoints: ['REPLICATE_BASE_URL'], hosts: ['api.replicate.com'] }),
-  define('nvidia-api', 'NVIDIA API Catalog', 'inference-cloud', { endpoints: ['NVIDIA_BASE_URL', 'NVIDIA_NIM_BASE_URL'], hosts: ['integrate.api.nvidia.com'] }),
-  define('sambanova', 'SambaNova', 'inference-cloud', { credentials: ['SAMBANOVA_API_KEY'], endpoints: ['SAMBANOVA_BASE_URL'], hosts: ['api.sambanova.ai'] }),
-  define('novita', 'Novita AI', 'inference-cloud', { aliases: ['novita'], credentials: ['NOVITA_API_KEY'], endpoints: ['NOVITA_BASE_URL'], hosts: ['api.novita.ai'] }),
-  define('nebius', 'Nebius Token Factory', 'inference-cloud', { aliases: ['nebius ai studio'], endpoints: ['NEBIUS_BASE_URL'], hosts: ['api.studio.nebius.ai', 'api.studio.nebius.com'] }),
-  define('siliconflow', 'SiliconFlow', 'inference-cloud', { credentials: ['SILICONFLOW_API_KEY'], endpoints: ['SILICONFLOW_BASE_URL'], hosts: ['api.siliconflow.com', 'api.siliconflow.cn'] }),
-  define('azure-openai', 'Azure OpenAI', 'inference-cloud', { endpoints: ['AZURE_OPENAI_ENDPOINT', 'AZURE_OPENAI_BASE_URL', 'AZURE_OPENAI_API_BASE'], match: url => azureOpenAI.test(url.hostname), redact: () => '….openai.azure.com' }),
-  define('azure-foundry', 'Azure AI Foundry', 'inference-cloud', { aliases: ['microsoft foundry'], endpoints: ['AZURE_AI_ENDPOINT', 'AZURE_AI_INFERENCE_ENDPOINT', 'AZURE_INFERENCE_ENDPOINT'], match: url => azureFoundry.test(url.hostname) && /^\/(?:$|(?:openai|models)(?:\/|$))/.test(url.pathname), redact: () => '….services.ai.azure.com' }),
-  define('bedrock', 'Amazon Bedrock', 'inference-cloud', { aliases: ['aws bedrock', 'bedrock'], credentials: ['AWS_BEARER_TOKEN_BEDROCK'], endpoints: ['AWS_ENDPOINT_URL_BEDROCK_RUNTIME', 'BEDROCK_ENDPOINT_URL', 'BEDROCK_BASE_URL'], match: url => bedrock.test(url.hostname) }),
-  define('sagemaker', 'Amazon SageMaker', 'inference-cloud', { aliases: ['aws sagemaker', 'sagemaker'], endpoints: ['AWS_ENDPOINT_URL_SAGEMAKER_RUNTIME', 'SAGEMAKER_ENDPOINT_URL', 'SAGEMAKER_BASE_URL'], match: url => sagemaker.test(url.hostname) }),
-  define('vertex', 'Google Vertex AI', 'inference-cloud', { aliases: ['vertex ai', 'vertex'], endpoints: ['VERTEX_AI_ENDPOINT', 'VERTEX_AI_BASE_URL'], match: url => vertex.test(url.hostname) }),
-  define('cloudflare-workers-ai', 'Cloudflare Workers AI', 'inference-cloud', { aliases: ['workers ai'], endpoints: ['CLOUDFLARE_WORKERS_AI_BASE_URL'], match: url => url.hostname === 'api.cloudflare.com' && /^\/client\/v4\/accounts\/[a-zA-Z0-9_-]+\/ai(?:\/|$)/.test(url.pathname) }),
-  define('cloudflare-ai-gateway', 'Cloudflare AI Gateway', 'gateway', { endpoints: ['CLOUDFLARE_AI_GATEWAY_URL'], hosts: ['gateway.ai.cloudflare.com'] }),
-  define('portkey', 'Portkey', 'gateway', { credentials: ['PORTKEY_API_KEY'], endpoints: ['PORTKEY_BASE_URL', 'PORTKEY_GATEWAY_URL'], hosts: ['api.portkey.ai'] }),
-  // The generic AI_GATEWAY_API_KEY name is shared by applications; require the URL.
-  define('vercel-ai-gateway', 'Vercel AI Gateway', 'gateway', { endpoints: ['AI_GATEWAY_BASE_URL', 'VERCEL_AI_GATEWAY_BASE_URL'], hosts: ['ai-gateway.vercel.sh'] }),
-  define('dashscope', 'Alibaba Cloud Model Studio', 'inference-cloud', { aliases: ['dashscope', 'alibaba model studio'], credentials: ['DASHSCOPE_API_KEY'], endpoints: ['DASHSCOPE_BASE_URL', 'DASHSCOPE_API_BASE'], hosts: ['dashscope.aliyuncs.com', 'dashscope-intl.aliyuncs.com', 'dashscope-us.aliyuncs.com', 'cn-hongkong.dashscope.aliyuncs.com'], match: url => maas.test(url.hostname), redact: host => maas.test(host) ? '….maas.aliyuncs.com' : host }),
-  define('minimax', 'MiniMax', 'model-api', { credentials: ['MINIMAX_API_KEY'], endpoints: ['MINIMAX_BASE_URL'], hosts: ['api.minimax.io'] }),
-  define('moonshot', 'Moonshot AI', 'model-api', { aliases: ['moonshot', 'kimi api'], credentials: ['MOONSHOT_API_KEY'], endpoints: ['MOONSHOT_BASE_URL'], hosts: ['api.moonshot.ai'] }),
-  define('zai', 'Z.AI', 'model-api', { aliases: ['zai'], credentials: ['ZAI_API_KEY'], endpoints: ['ZAI_BASE_URL'], hosts: ['api.z.ai'] }),
-  // Perplexity shares a host across products. Never turn a Search URL into Sonar.
-  define('perplexity-sonar', 'Perplexity Sonar', 'model-api', { endpoints: ['PERPLEXITY_BASE_URL'], match: url => url.hostname === 'api.perplexity.ai' && /^(?:\/?|\/chat\/completions\/?|\/v1\/?)$/.test(url.pathname) }),
-  define('perplexity-router', 'Perplexity Router', 'router', { match: url => url.hostname === 'api.perplexity.ai' && /^\/router(?:\/|$)/.test(url.pathname) }),
-  define('ollama', 'Ollama', 'runtime'),
-  define('vllm', 'vLLM', 'runtime'),
-  define('lm-studio', 'LM Studio', 'runtime'),
-]);
-const names = new Map(SERVICE_REGISTRY.flatMap(service => [service.name, ...service.aliases].map(name => [name.toLowerCase(), service])));
-export const registeredService = name => names.get(String(name ?? '').trim().toLowerCase()) ?? null;
-export const SERVICE_GROUPS = Object.freeze(SERVICE_REGISTRY.filter(service => service.credentials.length || service.endpoints.length));
-export const SERVICE_CREDENTIAL_FIELDS = Object.freeze(SERVICE_GROUPS.flatMap(service => service.credentials));
-export const SERVICE_ENDPOINT_FIELDS = Object.freeze(SERVICE_GROUPS.flatMap(service => service.endpoints));
-
-export function endpointService(value) {
-  if (typeof value !== 'string' || value.length > 2048 || /[\x00-\x20\x7f\\]/.test(value)) return null;
-  try {
-    const url = new URL(value);
-    if (url.protocol !== 'https:' || url.username || url.password || url.port) return null;
-    const service = SERVICE_REGISTRY.find(service => service.hosts.includes(url.hostname) || service.match?.(url));
-    return service ? { service, endpointHost: service.redact?.(url.hostname) ?? url.hostname } : null;
-  } catch { return null; }
-}

package/dist/terminal/src/services.mjs

@@ -1,44 +0,0 @@
-// Configuration evidence only. Never call services or return credentials or raw URLs.
-import { SERVICE_GROUPS, endpointService } from './service-registry.mjs';
-
-export const serviceFromEndpoint = value => endpointService(value)?.service.name ?? null;
-export function configuredServices(env = {}) {
-  const found = new Map(), unrecognizedEndpoints = [];
-  const present = key => typeof env[key] === 'string' && env[key].trim().length > 0;
-  const add = (service, field, basis, endpointHost) => {
-    const { name, type } = service;
-    const kind = ['router', 'gateway'].includes(type) ? type : 'provider';
-    const item = found.get(name) ?? { name, kind, ...(['model-api', 'inference-cloud'].includes(type) ? { serviceType: type } : {}), location: 'cloud', state: 'configured', sourceId: 'environment', evidence: [] };
-    item.evidence.push({ field, basis, ...(endpointHost ? { endpointHost } : {}) }); found.set(name, item);
-  };
-  for (const group of SERVICE_GROUPS) {
-    const overrides = group.endpoints.filter(present);
-    if (overrides.length) {
-      for (const field of overrides) {
-        const match = endpointService(env[field]);
-        if (match) add(match.service, field, 'endpoint-host', match.endpointHost);
-        else unrecognizedEndpoints.push(field);
-      }
-      // An override can repurpose the SDK credential. Unknown/local overrides
-      // must suppress the vendor fallback too; the key name is not enough.
-    } else for (const field of group.credentials.filter(present)) add(group, field, 'credential-name');
-  }
-  return { services: [...found.values()], unrecognizedEndpoints };
-}
-
-// Multiple reports for one model/service may disagree. Preserve the gap rather
-// than choosing whichever file or record happened to be processed first.
-export function modelCreators(models, reports) {
-  const evidence = new Map();
-  for (const item of [...models, ...reports]) {
-    if (!item.modelCreator) continue;
-    const key = JSON.stringify([item.provider, item.model ?? item.name]);
-    const entry = evidence.get(key) ?? { names: new Set(), sources: new Set() };
-    entry.names.add(item.modelCreator); if (item.sourceId) entry.sources.add(item.sourceId);
-    evidence.set(key, entry);
-  }
-  return models.map(model => {
-    const entry = evidence.get(JSON.stringify([model.provider, model.name]));
-    return { ...model, modelCreator: entry?.names.size === 1 ? [...entry.names][0] : null, creatorConflict: (entry?.names.size ?? 0) > 1, creatorSources: [...(entry?.sources ?? [])] };
-  });
-}

package/dist/terminal/src/topology.mjs

@@ -1,30 +0,0 @@
-// Bounded metadata contracts. Never retain endpoints, credentials, or payloads.
-const label = value => typeof value === 'string' ? value.slice(0, 160).replace(/[\x00-\x1f]/g, '') : '';
-const count = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;
-const timestamp = value => typeof value === 'string' && Number.isFinite(Date.parse(value)) ? new Date(value).toISOString() : null;
-const list = (value, limit) => Array.isArray(value) ? value.slice(0, limit).filter(item => item && typeof item === 'object') : [];
-export const poolIds = value => Array.isArray(value) ? [...new Set(value.slice(0, 16).map(label).filter(Boolean))] : [];
-export function normalizePath(value) {
-  // Do not turn a broken path into an apparently complete chain by dropping hops.
-  if (!Array.isArray(value) || !value.length || value.length > 8 || value.some(hop => !hop || !label(hop.name))) return [];
-  return value.map(hop => ({ name: label(hop.name), kind: ['direct', 'local', 'router', 'gateway'].includes(hop.kind) ? hop.kind : 'unknown' }));
-}
-function unique(items) {
-  const counts = new Map();
-  for (const item of items) counts.set(item.id, (counts.get(item.id) ?? 0) + 1);
-  return items.filter(item => item.id && counts.get(item.id) === 1);
-}
-export function normalizeDeployments(value) {
-  return unique(list(value, 200).map(item => ({ id: label(item.id), name: label(item.name) || label(item.id), model: label(item.model), modelCreator: label(item.modelCreator) || null, servingMode: ['shared', 'dedicated', 'self-hosted'].includes(item.servingMode) ? item.servingMode : 'unknown', provider: label(item.provider) || 'Unattributed', location: ['local', 'private', 'cloud'].includes(item.location) ? item.location : 'unknown', poolIds: poolIds(item.poolIds), hostId: label(item.hostId) || null, sourceId: 'inventory', state: 'configured' })).filter(item => item.model && !item.id.startsWith('runtime:')));
-}
-export function normalizePools(value) {
-  return unique(list(value, 100).map(item => ({ id: label(item.id), name: label(item.name) || label(item.id), kind: ['quota', 'runtime', 'gateway'].includes(item.kind) ? item.kind : 'unknown', windowSeconds: count(item.windowSeconds), sourceId: 'capacity', observedAt: null, metrics: {} })).filter(item => !item.id.startsWith('runtime:')));
-}
-export function normalizeCapacity(value, now = Date.now()) {
-  return unique(list(value?.pools, 100).map(item => {
-    const observedAt = timestamp(item.observedAt);
-    const metrics = Object.fromEntries(['running', 'waiting', 'concurrencyLimit', 'requestsUsed', 'requestsLimit', 'tokensUsed', 'tokensLimit', 'cachePercent', 'memoryUsedBytes', 'memoryTotalBytes'].map(key => [key, count(item.metrics?.[key])]).filter(([, value]) => value !== null));
-    if (metrics.cachePercent > 100) delete metrics.cachePercent;
-    return { id: label(item.id), observedAt, resetAt: timestamp(item.resetAt), metrics };
-  }).filter(item => item.observedAt && Date.parse(item.observedAt) <= now));
-}

package/dist/terminal/src/updates.d.ts

@@ -1,62 +0,0 @@
-type ObjectValue = Record<string, unknown>;
-interface UpdateRecord {
-    enabled: boolean;
-    version: string;
-    runnerHash: string;
-    hook: ObjectValue;
-}
-export declare const updateContract = "scout-recommend-v1";
-export declare function updatePaths(base: string, scope: string): {
-    record: string;
-    runner: string;
-    settings: string;
-    state: string;
-    backup: string;
-    skill: string;
-    rule: string;
-};
-export declare function withUpdateLock<T>(base: string, work: () => Promise<T>): Promise<T>;
-export declare function inspectUpdates(base: string, scope: string, record: ObjectValue): Promise<{
-    paths: {
-        record: string;
-        runner: string;
-        settings: string;
-        state: string;
-        backup: string;
-        skill: string;
-        rule: string;
-    };
-    saved: UpdateRecord | null;
-    runner: string | null;
-    settings: ObjectValue;
-    hooks: ObjectValue;
-    conflicts: string[];
-    active: boolean;
-}>;
-export declare function configureUpdates(base: string, scope: string, record: ObjectValue, version: string, enabled: boolean): Promise<{
-    enabled: boolean;
-    version: string;
-    runnerHash: string;
-    hook: {
-        hooks: {
-            type: string;
-            command: string;
-            async: boolean;
-            timeout: number;
-        }[];
-    };
-}>;
-export declare function removeUpdates(base: string, scope: string, record: ObjectValue): Promise<void>;
-export declare function recoverUpdates(base: string, scope: string): Promise<void>;
-export interface UpdateResult {
-    status: string;
-    message: string;
-    version?: string;
-}
-export declare function runUpdate(base: string, scope: string, options?: {
-    hook?: boolean;
-    enabled?: boolean;
-    fetcher?: typeof fetch;
-    now?: number;
-}): Promise<UpdateResult>;
-export {};

package/dist/terminal/src/updates.ts

@@ -1,313 +0,0 @@
-// Standalone updater copied into Claude's configuration directory. Only Node
-// built-ins: it must survive the npx cache disappearing, without installing or
-// executing code from the release it downloads.
-import { createHash, randomUUID } from 'node:crypto';
-import { realpathSync } from 'node:fs';
-import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { gunzipSync } from 'node:zlib';
-
-type ObjectValue = Record<string, unknown>;
-interface Bundle { format: number; contract: string; version: string; skill: string; rule: string }
-interface UpdateRecord { enabled: boolean; version: string; runnerHash: string; hook: ObjectValue }
-export const updateContract = 'scout-recommend-v1';
-const registry = 'https://registry.npmjs.org/openmerit/latest';
-const day = 24 * 60 * 60 * 1000;
-const retry = 15 * 60 * 1000;
-const digest = (text: string | Buffer) => createHash('sha256').update(text).digest('hex');
-const isObject = (value: unknown): value is ObjectValue => !!value && typeof value === 'object' && !Array.isArray(value);
-const parsed = (text: string): ObjectValue => {
-  const value: unknown = JSON.parse(text);
-  if (!isObject(value)) throw new Error('Expected a JSON object.');
-  return value;
-};
-async function optional(path: string): Promise<string | null> {
-  try { return await readFile(path, 'utf8'); }
-  catch (error) { if (isObject(error) && error.code === 'ENOENT') return null; throw error; }
-}
-async function object(path: string): Promise<ObjectValue> { return parsed(await optional(path) ?? '{}'); }
-async function atomic(path: string, value: unknown) {
-  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-  const temp = `${path}.${randomUUID()}.tmp`;
-  try {
-    await writeFile(temp, typeof value === 'string' ? value : `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-    await rename(temp, path);
-  } finally { await rm(temp, { force: true }); }
-}
-export function updatePaths(base: string, scope: string) {
-  return {
-    record: join(base, 'openmerit-install.json'), runner: join(base, 'openmerit-updater.mts'),
-    settings: join(base, scope === 'user' ? 'settings.json' : 'settings.local.json'),
-    state: join(base, 'openmerit-updates.json'), backup: join(base, 'openmerit-update-backup.json'),
-    skill: join(base, 'skills/openmerit-scout/SKILL.md'), rule: join(base, 'rules/openmerit-scout.md'),
-  };
-}
-function updateRecord(record: ObjectValue): UpdateRecord | null {
-  const value = record.updates;
-  if (!isObject(value) || typeof value.enabled !== 'boolean' || typeof value.version !== 'string'
-    || typeof value.runnerHash !== 'string' || !isObject(value.hook)) return null;
-  return value as unknown as UpdateRecord;
-}
-
-// Serialize installs, removals and hooks. A dead process's lock is recoverable;
-// an active login is not mistaken for a stale updater just because it is slow.
-export async function withUpdateLock<T>(base: string, work: () => Promise<T>): Promise<T> {
-  await mkdir(base, { recursive: true, mode: 0o700 });
-  const path = join(base, 'openmerit-update.lock');
-  let handle;
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try { handle = await open(path, 'wx', 0o600); break; }
-    catch (error) {
-      if (!isObject(error) || error.code !== 'EEXIST') throw error;
-      // Only one process may reap a dead lock. Without this guard, two stale
-      // observers can unlink each other's newly acquired live lock.
-      const recoveryPath = `${path}.recovery`;
-      let recovery;
-      try { recovery = await open(recoveryPath, 'wx', 0o600); }
-      catch { throw new Error('Another OpenMerit lock recovery is running. If it was interrupted, review openmerit-update.lock.recovery before removing it.'); }
-      try {
-        await recovery.writeFile(JSON.stringify({ pid: process.pid }));
-        const text = await optional(path);
-        if (text === null) continue;
-        let alive = true;
-        try {
-          const pid = parsed(text).pid;
-          if (typeof pid === 'number' && pid > 0) {
-            try { process.kill(pid, 0); }
-            catch (failure) { if (isObject(failure) && failure.code === 'ESRCH') alive = false; }
-          } else alive = Date.now() - (await stat(path)).mtimeMs < 10 * 60_000;
-        } catch { alive = Date.now() - (await stat(path)).mtimeMs < 10 * 60_000; }
-        if (alive) throw new Error('Another OpenMerit install or update is running. Retry shortly.');
-        await rm(path, { force: true });
-      } finally { await recovery.close(); await rm(recoveryPath, { force: true }); }
-    }
-  }
-  if (!handle) throw new Error('Another OpenMerit update is running.');
-  try { await handle.writeFile(JSON.stringify({ pid: process.pid })); return await work(); }
-  finally { await handle.close(); await rm(path, { force: true }); }
-}
-
-function groups(settings: ObjectValue): ObjectValue {
-  if (settings.hooks === undefined) return {};
-  if (!isObject(settings.hooks)) throw new Error('Claude settings.hooks is not an object; nothing changed.');
-  return settings.hooks;
-}
-function eventGroups(hooks: ObjectValue, event: string): unknown[] {
-  const value = hooks[event];
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) throw new Error(`Claude ${event} hooks are not an array; nothing changed.`);
-  return value;
-}
-function usesRunner(group: unknown, runner: string): boolean {
-  return isObject(group) && Array.isArray(group.hooks) && group.hooks.some(hook =>
-    isObject(hook) && typeof hook.command === 'string' && (hook.command.includes(runner) || hook.command.includes(quote(runner))));
-}
-export async function inspectUpdates(base: string, scope: string, record: ObjectValue) {
-  const paths = updatePaths(base, scope), saved = updateRecord(record);
-  const pending = updateRecord({ updates: record.pendingUpdates });
-  const owners = [saved, pending].filter(value => value !== null);
-  const runner = await optional(paths.runner), settings = await object(paths.settings), hooks = groups(settings);
-  const conflicts: string[] = [];
-  if (runner !== null && !owners.some(owner => digest(runner) === owner.runnerHash)) conflicts.push('OpenMerit updater was edited or is not owned; nothing changed.');
-  for (const event of ['SessionStart', 'Stop']) {
-    for (const group of eventGroups(hooks, event)) {
-      if (usesRunner(group, paths.runner) && !owners.some(owner => JSON.stringify(group) === JSON.stringify(owner.hook))) {
-        conflicts.push(`OpenMerit ${event} hook was edited or is not owned; nothing changed.`);
-      }
-    }
-  }
-  const active = runner !== null && ['SessionStart', 'Stop'].every(event =>
-    eventGroups(hooks, event).some(group => owners.some(owner => JSON.stringify(group) === JSON.stringify(owner.hook))));
-  return { paths, saved: saved ?? pending, runner, settings, hooks, conflicts, active };
-}
-// Claude Code uses a shell for command hooks, including Git Bash on Windows.
-const quote = (value: string) => `'${value.replaceAll("'", "'\"'\"'")}'`;
-export async function configureUpdates(base: string, scope: string, record: ObjectValue, version: string, enabled: boolean) {
-  const state = await inspectUpdates(base, scope, record);
-  if (state.conflicts.length) throw new Error(state.conflicts.join('\n'));
-  const source = await readFile(new URL('./updates.ts', import.meta.url), 'utf8');
-  const hook = { hooks: [{ type: 'command', command: `${quote(process.execPath)} ${quote(state.paths.runner)} --base ${quote(base)} --scope ${scope} --hook`, async: true, timeout: 150 }] };
-  const hooks = { ...state.hooks };
-  for (const event of ['SessionStart', 'Stop']) {
-    const kept = eventGroups(hooks, event).filter(group => !usesRunner(group, state.paths.runner));
-    if (enabled) kept.push(hook);
-    if (kept.length) hooks[event] = kept; else delete hooks[event];
-  }
-  // Avoid clobbering settings that changed while the installer was signing in.
-  const latest = await object(state.paths.settings);
-  if (JSON.stringify(latest) !== JSON.stringify(state.settings)) throw new Error('Claude settings changed during setup. Retry.');
-  const next = { enabled, version, runnerHash: digest(source), hook };
-  await atomic(state.paths.record, { ...await object(state.paths.record), pendingUpdates: next });
-  await atomic(state.paths.runner, source);
-  await atomic(state.paths.settings, { ...state.settings, hooks });
-  return next;
-}
-export async function removeUpdates(base: string, scope: string, record: ObjectValue) {
-  const state = await inspectUpdates(base, scope, record);
-  const hooks = { ...state.hooks };
-  for (const event of ['SessionStart', 'Stop']) {
-    const kept = eventGroups(hooks, event).filter(group => !state.saved || JSON.stringify(group) !== JSON.stringify(state.saved.hook));
-    if (kept.length) hooks[event] = kept; else delete hooks[event];
-  }
-  if (state.saved) await atomic(state.paths.settings, { ...state.settings, hooks });
-  const stillReferenced = ['SessionStart', 'Stop'].some(event => eventGroups(hooks, event).some(group => usesRunner(group, state.paths.runner)));
-  if (!stillReferenced && state.runner !== null && state.saved && digest(state.runner) === state.saved.runnerHash) await rm(state.paths.runner, { force: true });
-  await rm(state.paths.state, { force: true });
-}
-
-// Read one fixed regular file in memory, never extract archive paths onto disk.
-function instructionBundle(bytes: Buffer): ObjectValue | null {
-  const tar = gunzipSync(bytes, { maxOutputLength: 32 * 1024 * 1024 });
-  let found: ObjectValue | null = null;
-  for (let offset = 0; offset + 512 <= tar.length;) {
-    const header = tar.subarray(offset, offset + 512);
-    if (header.every(byte => byte === 0)) break;
-    const name = header.subarray(0, 100).toString().replace(/\0.*$/s, '');
-    const rawSize = header.subarray(124, 136).toString().replace(/\0.*$/s, '').trim();
-    if (!/^[0-7]+$/.test(rawSize)) throw new Error('Invalid package archive.');
-    const size = Number.parseInt(rawSize, 8), start = offset + 512;
-    if (start + size > tar.length) throw new Error('Truncated package archive.');
-    if (name === 'package/dist/terminal/scout-update.json') {
-      if (found || size > 256 * 1024 || ![0, 48].includes(header[156] ?? -1)) throw new Error('Invalid instruction bundle.');
-      found = parsed(tar.subarray(start, start + size).toString('utf8'));
-    }
-    offset = start + Math.ceil(size / 512) * 512;
-  }
-  return found;
-}
-const stableVersion = (version: string) => /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version);
-function newer(next: string, installed: string) {
-  if (!stableVersion(next) || !stableVersion(installed)) return false;
-  const a = next.split('.').map(Number), b = installed.split('.').map(Number);
-  for (let i = 0; i < 3; i++) { if (a[i] !== b[i]) return a[i]! > b[i]!; }
-  return false;
-}
-async function boundedFetch(url: string, max: number, fetcher: typeof fetch, timeout = 12_000): Promise<Buffer> {
-  const controller = new AbortController();
-  let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const deadline = new Promise<never>((_, reject) => {
-    timer = setTimeout(() => { controller.abort(); reject(new Error('Update download timed out.')); }, timeout);
-  });
-  const download = async () => {
-    const response = await fetcher(url, { redirect: 'error', signal: controller.signal, headers: { Accept: 'application/json' } });
-    if (!response.ok || !response.body || controller.signal.aborted) throw new Error('Update server unavailable.');
-    const parts: Uint8Array[] = []; let size = 0;
-    reader = response.body.getReader();
-    for (;;) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      size += value.length;
-      if (size > max) throw new Error('Update download exceeded its size limit.');
-      parts.push(value);
-    }
-    return Buffer.concat(parts);
-  };
-  try {
-    return await Promise.race([download(), deadline]);
-  } finally {
-    clearTimeout(timer); controller.abort();
-    // Cancellation itself must not keep a timed-out hook alive.
-    void reader?.cancel().catch(() => {});
-  }
-}
-async function recover(base: string, scope: string) {
-  const paths = updatePaths(base, scope), text = await optional(paths.backup);
-  if (!text) return;
-  const backup = parsed(text);
-  if (typeof backup.skill !== 'string' || typeof backup.rule !== 'string' || !isObject(backup.record)) throw new Error('Update recovery needs manual review.');
-  for (const field of ['skill', 'rule'] as const) {
-    const current = await optional(paths[field]);
-    if (current !== null && digest(current) !== digest(backup[field] as string) && digest(current) !== backup[`${field}Hash`]) throw new Error('An interrupted update has user edits; nothing changed.');
-  }
-  // Recover the previous complete pair before any retry. Atomic per-file writes
-  // plus a durable journal cover failure between the two renames.
-  await atomic(paths.skill, backup.skill); await atomic(paths.rule, backup.rule);
-  await atomic(paths.record, backup.record); await rm(paths.backup, { force: true });
-}
-export async function recoverUpdates(base: string, scope: string) { await recover(base, scope); }
-
-export interface UpdateResult { status: string; message: string; version?: string }
-export async function runUpdate(base: string, scope: string, options: { hook?: boolean; enabled?: boolean; fetcher?: typeof fetch; now?: number } = {}): Promise<UpdateResult> {
-  return withUpdateLock(base, async () => {
-    await recover(base, scope);
-    const paths = updatePaths(base, scope), record = await object(paths.record), saved = updateRecord(record);
-    if (record.version !== 3 || record.scope !== scope || !saved) return { status: 'manual_required', message: 'Run npx -y openmerit@latest install --client claude-code to bootstrap updates in this scope.' };
-    if (options.hook && (!saved.enabled || process.env.OPENMERIT_AUTO_UPDATE === 'off')) return { status: 'disabled', message: 'Automatic updates disabled.' };
-    const now = options.now ?? Date.now(), state = options.enabled === undefined ? await object(paths.state) : {};
-    if (options.hook && typeof state.nextCheckAt === 'number' && now < state.nextCheckAt) return { status: 'not_due', message: 'Update check not due.' };
-    const support = await inspectUpdates(base, scope, record);
-    if (support.conflicts.length) {
-      if (options.hook) await atomic(paths.state, { nextCheckAt: now + day, status: 'conflict' });
-      return { status: 'conflict', message: `${support.conflicts.join(' ')} Say “update openmerit” after resolving the conflict.` };
-    }
-    if (options.enabled !== undefined) {
-      record.updates = await configureUpdates(base, scope, record, saved.version, options.enabled);
-      delete record.pendingUpdates;
-      await atomic(paths.record, record);
-      return { status: options.enabled ? 'enabled' : 'disabled', message: `Automatic Scout instruction updates ${options.enabled ? 'enabled' : 'disabled'}. Start a new Claude Code session to reload hooks.` };
-    }
-    // Record the attempt before networking so a crashed hook cannot hammer npm.
-    await atomic(paths.state, { ...state, nextCheckAt: now + retry });
-    try {
-      const fetcher = options.fetcher ?? fetch;
-      const release = parsed((await boundedFetch(registry, 512 * 1024, fetcher)).toString('utf8'));
-      const version = release.version;
-      if (release.name !== 'openmerit' || typeof version !== 'string' || !stableVersion(version)) throw new Error('Invalid stable release metadata.');
-      if (!newer(version, saved.version)) {
-        await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'current' });
-        return { status: 'current', version: saved.version, message: `Scout instructions ${saved.version} are current.` };
-      }
-      const dist = release.dist;
-      const tarball = `https://registry.npmjs.org/openmerit/-/openmerit-${version}.tgz`;
-      if (!isObject(dist) || dist.tarball !== tarball || typeof dist.integrity !== 'string' || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(dist.integrity)) throw new Error('Release has no trusted SHA-512 package integrity.');
-      const bytes = await boundedFetch(tarball, 16 * 1024 * 1024, fetcher, 120_000);
-      if (`sha512-${createHash('sha512').update(bytes).digest('base64')}` !== dist.integrity) throw new Error('Package integrity verification failed.');
-      const bundle = instructionBundle(bytes);
-      if (!bundle || bundle.format !== 1 || bundle.contract !== updateContract || bundle.version !== version) {
-        await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'manual_required' });
-        return { status: 'manual_required', version, message: `Release ${version} needs a reviewed installer upgrade. Review its changes, then run npx -y openmerit@latest install --client claude-code --scope ${scope}. Do not bypass permissions or rerun login automatically.` };
-      }
-      if (typeof bundle.skill !== 'string' || typeof bundle.rule !== 'string' || !bundle.skill.startsWith('---\nname: openmerit-scout\n') || !bundle.rule.trim()) throw new Error('Invalid Scout instructions.');
-      const instructions = bundle as unknown as Bundle;
-      const skill = await optional(paths.skill), rule = await optional(paths.rule);
-      if (skill === null || rule === null || digest(skill) !== record.skillHash || digest(rule) !== record.ruleHash) {
-        await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'conflict' });
-        return { status: 'conflict', message: 'Scout instructions are missing or edited. Nothing changed. Say “update openmerit” after reviewing the files.' };
-      }
-      const skillHash = digest(instructions.skill), ruleHash = digest(instructions.rule);
-      await atomic(paths.backup, { record, skill, rule, skillHash, ruleHash });
-      try {
-        // Do not overwrite edits made during the download or journal write.
-        if (await optional(paths.skill) !== skill || await optional(paths.rule) !== rule) throw new Error('Scout instructions changed during the update.');
-        await atomic(paths.skill, instructions.skill); await atomic(paths.rule, instructions.rule);
-        await atomic(paths.record, { ...record, skillHash, ruleHash, updates: { ...saved, version } });
-        await rm(paths.backup, { force: true });
-      } catch (error) {
-        try { await recover(base, scope); }
-        catch { return { status: 'conflict', message: 'An interrupted Scout update could not be recovered safely. Review the installed files and openmerit-update-backup.json; no user edits were overwritten.' }; }
-        throw error;
-      }
-      // A failed schedule write must not misreport an already applied update.
-      await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'updated', version }).catch(() => {});
-      return { status: 'updated', version, message: `Scout instructions updated to ${version}. Start a new Claude Code session to load them; the running session may still use its previous instructions.` };
-    } catch {
-      await atomic(paths.state, { nextCheckAt: now + retry, status: 'retry' });
-      return { status: 'retry', message: 'Could not safely update Scout. The installed version was retained. Automatic checks retry after 15 minutes while Claude Code is in use; say “update openmerit” to retry now.' };
-    }
-  });
-}
-
-// Hooks deliberately never ask Claude to continue, read transcripts or emit
-// blocking decisions. Offline and concurrent-hook failures exit successfully.
-if (process.argv[1] && realpathSync(resolve(process.argv[1])) === fileURLToPath(import.meta.url)) {
-  const args = process.argv.slice(2), base = args[args.indexOf('--base') + 1], scope = args[args.indexOf('--scope') + 1];
-  if (base && ['user', 'project'].includes(scope ?? '')) {
-    process.stdin.resume();
-    try {
-      const result = await runUpdate(resolve(base), scope!, { hook: args.includes('--hook') });
-      if (['updated', 'conflict', 'manual_required', 'retry'].includes(result.status)) console.log(JSON.stringify({ systemMessage: result.message }));
-    } catch { /* Maintenance cannot block the user's task. */ }
-  }
-}