vault-go 0.18.0 → 0.19.0

package/dist/smart-code.js

@@ -0,0 +1,453 @@
+import { Lang, parse } from '@ast-grep/napi';
+import { readFileSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { basename, extname, isAbsolute, relative, resolve, sep } from 'node:path';
+export const SUPPORTED_LANGUAGES = [
+    { language: 'JavaScript', extensions: ['.js', '.jsx', '.mjs', '.cjs'] },
+    { language: 'TypeScript', extensions: ['.ts', '.mts', '.cts'] },
+    { language: 'Tsx', extensions: ['.tsx'] },
+    { language: 'Html', extensions: ['.html', '.htm'] },
+    { language: 'Css', extensions: ['.css'] },
+];
+const LANGUAGE_BY_EXTENSION = new Map([
+    ['.js', { name: 'JavaScript', parser: Lang.JavaScript }],
+    ['.jsx', { name: 'JavaScript', parser: Lang.JavaScript }],
+    ['.mjs', { name: 'JavaScript', parser: Lang.JavaScript }],
+    ['.cjs', { name: 'JavaScript', parser: Lang.JavaScript }],
+    ['.ts', { name: 'TypeScript', parser: Lang.TypeScript }],
+    ['.mts', { name: 'TypeScript', parser: Lang.TypeScript }],
+    ['.cts', { name: 'TypeScript', parser: Lang.TypeScript }],
+    ['.tsx', { name: 'Tsx', parser: Lang.Tsx }],
+    ['.html', { name: 'Html', parser: Lang.Html }],
+    ['.htm', { name: 'Html', parser: Lang.Html }],
+    ['.css', { name: 'Css', parser: Lang.Css }],
+]);
+export const SMART_CODE_LIMITS = Object.freeze({
+    maxFileBytes: 1_048_576,
+    maxOutlineSymbols: 1_000,
+    maxSearchFiles: 500,
+    maxSearchBytes: 8_000_000,
+    maxSearchResults: 100,
+    maxDirectoryEntries: 10_000,
+    maxTraversalDepth: 20,
+    maxMatchTextChars: 4_000,
+    maxSearchOutputChars: 200_000,
+    maxUnfoldChars: 100_000,
+    maxSymbolNameChars: 512,
+    maxSignatureChars: 1_000,
+});
+const DENIED_DIRECTORIES = new Set(['.git', 'node_modules', 'build', 'dist', 'coverage', '.next', 'target', 'out']);
+const TRUNCATION_SUFFIX = '\n… [truncated]';
+function languageFor(filePath) {
+    const language = LANGUAGE_BY_EXTENSION.get(extname(filePath).toLowerCase());
+    if (!language) {
+        const extensions = [...LANGUAGE_BY_EXTENSION.keys()].join(', ');
+        throw new Error(`Unsupported language for "${filePath}". Supported extensions: ${extensions}`);
+    }
+    return language;
+}
+function isWithin(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return pathFromRoot === '' || (!pathFromRoot.startsWith(`..${sep}`) && pathFromRoot !== '..' && !isAbsolute(pathFromRoot));
+}
+function relativeOutputPath(root, candidate) {
+    const path = relative(root, candidate).split(sep).join('/');
+    return path || '.';
+}
+function isSensitiveFile(name) {
+    const lower = name.toLowerCase();
+    return lower === '.env'
+        || lower.startsWith('.env.')
+        || ['id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519', 'credentials.json', 'secrets.json'].includes(lower)
+        || ['.pem', '.key', '.p12', '.pfx', '.kdbx'].some((extension) => lower.endsWith(extension));
+}
+function deniedReason(root, candidate) {
+    if (!isWithin(root, candidate))
+        return 'escapes workspace';
+    const parts = relative(root, candidate).split(sep).filter(Boolean);
+    if (parts.some((part) => DENIED_DIRECTORIES.has(part.toLowerCase())))
+        return 'is in a denied directory';
+    const name = parts.at(-1);
+    if (name && isSensitiveFile(name))
+        return 'is a sensitive file';
+    return null;
+}
+function assertAllowedPath(root, candidate, displayPath) {
+    const reason = deniedReason(root, candidate);
+    if (!reason)
+        return;
+    if (reason === 'escapes workspace')
+        throw new Error(`Path escapes workspace: ${displayPath}`);
+    if (reason === 'is a sensitive file')
+        throw new Error(`Path is a sensitive file: ${displayPath}`);
+    throw new Error(`Path is denied: ${displayPath}`);
+}
+function resolveFile(filePath, workspace) {
+    const root = realpathSync(workspace);
+    if (!statSync(root).isDirectory())
+        throw new Error(`Workspace is not a directory: ${workspace}`);
+    const requested = isAbsolute(filePath) ? filePath : resolve(root, filePath);
+    assertAllowedPath(root, requested, filePath);
+    const file = realpathSync(requested);
+    assertAllowedPath(root, file, filePath);
+    const stats = statSync(file);
+    if (!stats.isFile())
+        throw new Error(`Path is not a file: ${filePath}`);
+    if (stats.size > SMART_CODE_LIMITS.maxFileBytes) {
+        throw new Error(`File exceeds ${SMART_CODE_LIMITS.maxFileBytes} byte limit: ${filePath}`);
+    }
+    return { file, root, relativePath: relativeOutputPath(root, file) };
+}
+function sourceLocation(node) {
+    const range = node.range();
+    return {
+        startLine: range.start.line + 1,
+        startColumn: range.start.column + 1,
+        endLine: range.end.line + 1,
+        endColumn: range.end.column + 1,
+    };
+}
+const IDENTIFIER_KINDS = new Set(['identifier', 'type_identifier', 'property_identifier', 'private_property_identifier']);
+function directIdentifier(node) {
+    const identifier = node.namedChildren().find((child) => IDENTIFIER_KINDS.has(String(child.kind())));
+    return identifier?.text() ?? null;
+}
+function symbolDescriptor(node) {
+    const syntaxKind = String(node.kind());
+    const fixedKinds = {
+        class_declaration: 'class',
+        abstract_class_declaration: 'class',
+        function_declaration: 'function',
+        generator_function_declaration: 'function',
+        method_definition: 'method',
+        method_signature: 'method',
+        interface_declaration: 'interface',
+        type_alias_declaration: 'type',
+        enum_declaration: 'enum',
+        internal_module: 'namespace',
+    };
+    const fixedKind = fixedKinds[syntaxKind];
+    if (fixedKind) {
+        const name = directIdentifier(node);
+        return name ? { name, kind: fixedKind } : null;
+    }
+    if (syntaxKind === 'variable_declarator' || syntaxKind === 'public_field_definition') {
+        const children = node.namedChildren();
+        const value = children.at(-1);
+        if (!value || !['arrow_function', 'function_expression', 'generator_function'].includes(String(value.kind())))
+            return null;
+        const name = directIdentifier(node);
+        return name ? { name, kind: syntaxKind === 'variable_declarator' ? 'function' : 'field' } : null;
+    }
+    if (syntaxKind === 'element') {
+        const startTag = node.namedChildren().find((child) => String(child.kind()) === 'start_tag');
+        const tagName = startTag?.namedChildren().find((child) => String(child.kind()) === 'tag_name');
+        return tagName ? { name: tagName.text(), kind: 'element' } : null;
+    }
+    if (syntaxKind === 'rule_set') {
+        const selectors = node.namedChildren().find((child) => String(child.kind()) === 'selectors');
+        return selectors ? { name: selectors.text(), kind: 'rule' } : null;
+    }
+    if (syntaxKind === 'media_statement') {
+        const query = node.namedChildren().find((child) => String(child.kind()) === 'feature_query');
+        return { name: query ? `@media ${query.text()}` : '@media', kind: 'media' };
+    }
+    return null;
+}
+const DIRECT_BODY_KINDS = new Set(['statement_block', 'class_body', 'interface_body', 'enum_body', 'block']);
+function functionValueBody(node) {
+    if (!['variable_declarator', 'public_field_definition'].includes(String(node.kind())))
+        return null;
+    const value = node.namedChildren().at(-1);
+    if (!value || !['arrow_function', 'function_expression', 'generator_function'].includes(String(value.kind())))
+        return null;
+    const candidate = value.namedChildren().at(-1);
+    if (!candidate || ['formal_parameters', 'type_annotation', 'type_parameters', 'identifier'].includes(String(candidate.kind())))
+        return null;
+    return candidate;
+}
+function signatureFor(node, descriptor) {
+    if (String(node.kind()) === 'element') {
+        return node.namedChildren().find((child) => String(child.kind()) === 'start_tag')?.text() ?? descriptor.name;
+    }
+    const body = node.namedChildren().find((child) => DIRECT_BODY_KINDS.has(String(child.kind()))) ?? functionValueBody(node);
+    if (!body)
+        return node.text().trim();
+    const nodeText = node.text();
+    const bodyText = body.text();
+    const bodyOffset = nodeText.lastIndexOf(bodyText);
+    if (bodyOffset < 0)
+        return nodeText.trim();
+    const trailingText = nodeText.slice(bodyOffset + bodyText.length).trim();
+    if (trailingText !== '' && trailingText !== ';')
+        return nodeText.trim();
+    return nodeText.slice(0, bodyOffset).trimEnd();
+}
+function extractSymbols(root) {
+    let count = 0;
+    let truncated = false;
+    const visit = (node) => {
+        const descriptor = symbolDescriptor(node);
+        if (descriptor) {
+            if (count >= SMART_CODE_LIMITS.maxOutlineSymbols) {
+                truncated = true;
+                return [];
+            }
+            count += 1;
+            const children = node.namedChildren().flatMap(visit);
+            let name = descriptor.name;
+            if (name.length > SMART_CODE_LIMITS.maxSymbolNameChars) {
+                name = `${name.slice(0, SMART_CODE_LIMITS.maxSymbolNameChars - TRUNCATION_SUFFIX.length)}${TRUNCATION_SUFFIX}`;
+                truncated = true;
+            }
+            const signature = truncateText(signatureFor(node, descriptor), SMART_CODE_LIMITS.maxSignatureChars);
+            if (signature.truncated)
+                truncated = true;
+            return [{
+                    ...descriptor,
+                    name,
+                    syntaxKind: String(node.kind()),
+                    signature: signature.text,
+                    location: sourceLocation(node),
+                    children,
+                }];
+        }
+        return node.namedChildren().flatMap(visit);
+    };
+    return { symbols: visit(root), truncated };
+}
+export function smartOutline(filePath, workspace = process.cwd()) {
+    const resolved = resolveFile(filePath, workspace);
+    const language = languageFor(resolved.file);
+    const source = readFileSync(resolved.file, 'utf8');
+    const outline = extractSymbols(parse(language.parser, source).root());
+    return {
+        path: resolved.relativePath,
+        language: language.name,
+        symbols: outline.symbols,
+        truncated: outline.truncated,
+    };
+}
+function findSymbol(root, symbolName) {
+    const descriptor = symbolDescriptor(root);
+    if (descriptor?.name === symbolName)
+        return { node: root, descriptor };
+    for (const child of root.namedChildren()) {
+        const found = findSymbol(child, symbolName);
+        if (found)
+            return found;
+    }
+    return null;
+}
+function truncateText(text, maximum) {
+    if (text.length <= maximum)
+        return { text, truncated: false };
+    if (maximum <= TRUNCATION_SUFFIX.length) {
+        return { text: TRUNCATION_SUFFIX.slice(0, Math.max(0, maximum)), truncated: true };
+    }
+    return {
+        text: `${text.slice(0, maximum - TRUNCATION_SUFFIX.length)}${TRUNCATION_SUFFIX}`,
+        truncated: true,
+    };
+}
+export function smartUnfold(filePath, symbolName, workspace = process.cwd()) {
+    if (!symbolName || symbolName.length > SMART_CODE_LIMITS.maxSymbolNameChars) {
+        throw new Error(`Symbol name must contain 1-${SMART_CODE_LIMITS.maxSymbolNameChars} characters`);
+    }
+    const resolved = resolveFile(filePath, workspace);
+    const language = languageFor(resolved.file);
+    const source = readFileSync(resolved.file, 'utf8');
+    const found = findSymbol(parse(language.parser, source).root(), symbolName);
+    if (!found) {
+        return { path: resolved.relativePath, language: language.name, symbol: null, truncated: false };
+    }
+    const text = truncateText(found.node.text(), SMART_CODE_LIMITS.maxUnfoldChars);
+    return {
+        path: resolved.relativePath,
+        language: language.name,
+        symbol: {
+            ...found.descriptor,
+            syntaxKind: String(found.node.kind()),
+            location: sourceLocation(found.node),
+            text: text.text,
+        },
+        truncated: text.truncated,
+    };
+}
+function globExpression(pattern) {
+    if (!pattern || pattern.length > 256 || pattern.includes('\0'))
+        throw new Error('File pattern must contain 1-256 safe characters');
+    let expression = '^';
+    for (let index = 0; index < pattern.length; index += 1) {
+        const character = pattern[index];
+        if (character === '*') {
+            if (pattern[index + 1] === '*') {
+                index += 1;
+                if (pattern[index + 1] === '/') {
+                    index += 1;
+                    expression += '(?:.*/)?';
+                }
+                else {
+                    expression += '.*';
+                }
+            }
+            else {
+                expression += '[^/]*';
+            }
+        }
+        else if (character === '?') {
+            expression += '[^/]';
+        }
+        else {
+            expression += /[\\^$.*+?()[\]{}|]/.test(character) ? `\\${character}` : character;
+        }
+    }
+    return new RegExp(`${expression}$`);
+}
+function discoverFiles(searchPath, workspace, filePattern) {
+    const root = realpathSync(workspace);
+    if (!statSync(root).isDirectory())
+        throw new Error(`Workspace is not a directory: ${workspace}`);
+    const requested = isAbsolute(searchPath) ? searchPath : resolve(root, searchPath);
+    assertAllowedPath(root, requested, searchPath);
+    const target = realpathSync(requested);
+    assertAllowedPath(root, target, searchPath);
+    const targetStats = statSync(target);
+    const pattern = filePattern ? globExpression(filePattern) : null;
+    const patternHasDirectory = filePattern?.includes('/') ?? false;
+    const files = [];
+    let entryCount = 0;
+    let sourceBytes = 0;
+    let truncated = false;
+    const visitedDirectories = new Set();
+    const accepts = (relativePath) => {
+        if (!pattern)
+            return true;
+        return pattern.test(patternHasDirectory ? relativePath : basename(relativePath));
+    };
+    const addFile = (file, outputPath) => {
+        if (!LANGUAGE_BY_EXTENSION.has(extname(file).toLowerCase()) || !accepts(outputPath))
+            return;
+        const stats = statSync(file);
+        if (stats.size > SMART_CODE_LIMITS.maxFileBytes) {
+            truncated = true;
+            return;
+        }
+        if (files.length >= SMART_CODE_LIMITS.maxSearchFiles) {
+            truncated = true;
+            return;
+        }
+        if (sourceBytes + stats.size > SMART_CODE_LIMITS.maxSearchBytes) {
+            truncated = true;
+            return;
+        }
+        files.push({ file, relativePath: outputPath });
+        sourceBytes += stats.size;
+    };
+    const walk = (directory, depth) => {
+        if (depth > SMART_CODE_LIMITS.maxTraversalDepth) {
+            truncated = true;
+            return;
+        }
+        const realDirectory = realpathSync(directory);
+        if (visitedDirectories.has(realDirectory))
+            return;
+        visitedDirectories.add(realDirectory);
+        const entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            entryCount += 1;
+            if (entryCount > SMART_CODE_LIMITS.maxDirectoryEntries) {
+                truncated = true;
+                return;
+            }
+            if (DENIED_DIRECTORIES.has(entry.name.toLowerCase()) || isSensitiveFile(entry.name))
+                continue;
+            const lexicalPath = resolve(directory, entry.name);
+            let realPath;
+            try {
+                realPath = realpathSync(lexicalPath);
+            }
+            catch {
+                continue;
+            }
+            if (deniedReason(root, realPath))
+                continue;
+            const stats = statSync(realPath);
+            if (stats.isDirectory())
+                walk(realPath, depth + 1);
+            else if (stats.isFile())
+                addFile(realPath, relativeOutputPath(root, realPath));
+        }
+    };
+    if (targetStats.isFile()) {
+        languageFor(target);
+        if (targetStats.size > SMART_CODE_LIMITS.maxFileBytes) {
+            throw new Error(`File exceeds ${SMART_CODE_LIMITS.maxFileBytes} byte limit: ${searchPath}`);
+        }
+        const outputPath = relativeOutputPath(root, target);
+        if (accepts(outputPath))
+            files.push({ file: target, relativePath: outputPath });
+    }
+    else if (targetStats.isDirectory()) {
+        walk(target, 0);
+    }
+    else {
+        throw new Error(`Path is not a file or directory: ${searchPath}`);
+    }
+    return { files, displayPath: relativeOutputPath(root, target), truncated };
+}
+export function smartSearch(query, path = '.', maxResults = 20, filePattern, workspace = process.cwd()) {
+    if (!query || query.length > 10_000)
+        throw new Error('AST query must contain 1-10000 characters');
+    if (!Number.isSafeInteger(maxResults) || maxResults < 1)
+        throw new Error('maxResults must be a positive integer');
+    const limit = Math.min(maxResults, SMART_CODE_LIMITS.maxSearchResults);
+    const discovered = discoverFiles(path, workspace, filePattern);
+    const matches = [];
+    let outputChars = 0;
+    let scannedFiles = 0;
+    let truncated = discovered.truncated || maxResults > SMART_CODE_LIMITS.maxSearchResults;
+    let acceptedByAnyParser = discovered.files.length === 0;
+    for (const [fileIndex, file] of discovered.files.entries()) {
+        const language = languageFor(file.file);
+        const source = readFileSync(file.file, 'utf8');
+        const root = parse(language.parser, source).root();
+        scannedFiles += 1;
+        let fileMatches;
+        try {
+            fileMatches = root.findAll(query);
+            acceptedByAnyParser = true;
+        }
+        catch {
+            continue;
+        }
+        for (const [matchIndex, node] of fileMatches.entries()) {
+            if (matches.length >= limit || outputChars >= SMART_CODE_LIMITS.maxSearchOutputChars) {
+                truncated = true;
+                break;
+            }
+            const perMatch = truncateText(node.text(), SMART_CODE_LIMITS.maxMatchTextChars);
+            const remaining = SMART_CODE_LIMITS.maxSearchOutputChars - outputChars;
+            const bounded = truncateText(perMatch.text, remaining);
+            matches.push({
+                path: file.relativePath,
+                language: language.name,
+                syntaxKind: String(node.kind()),
+                location: sourceLocation(node),
+                text: bounded.text,
+            });
+            outputChars += bounded.text.length;
+            if (perMatch.truncated || bounded.truncated)
+                truncated = true;
+            if (matchIndex < fileMatches.length - 1 && matches.length >= limit)
+                truncated = true;
+        }
+        if (matches.length >= limit || outputChars >= SMART_CODE_LIMITS.maxSearchOutputChars) {
+            if (fileIndex < discovered.files.length - 1)
+                truncated = true;
+            break;
+        }
+    }
+    if (!acceptedByAnyParser)
+        throw new Error('AST query is invalid for every supported file in the search path');
+    return { query, path: discovered.displayPath, matches, scannedFiles, truncated };
+}

package/dist/update-control.d.ts

@@ -0,0 +1,24 @@
+import { type LocalHealth } from './local-install.js';
+import { type UpdateState } from './updater.js';
+export declare function activatePreparedUpdate(home: string, state: UpdateState, operations?: {
+    stop: (home: string) => Promise<boolean>;
+    start: (home: string) => Promise<LocalHealth>;
+}, options?: {
+    automatic?: boolean;
+}): Promise<LocalHealth>;
+export declare function launchPreparedUpdate(home: string, state: UpdateState, options?: {
+    automatic?: boolean;
+}): Promise<void>;
+/** Checks start after boot and run while idle. Active model calls are never interrupted. */
+export interface AutomaticUpdateOperations {
+    install?: (home: string) => Promise<UpdateState>;
+    launch?: (home: string, state: UpdateState, options?: {
+        automatic?: boolean;
+    }) => Promise<void>;
+    status?: (home: string) => UpdateState;
+    queueStatus?: (home: string) => {
+        pending: number;
+    };
+    schedule?: (callback: () => Promise<void>, delay: number, repeat: boolean) => () => void;
+}
+export declare function scheduleAutomaticUpdates(isIdle: () => boolean, home?: string, operations?: AutomaticUpdateOperations): () => void;

package/dist/update-control.js

@@ -0,0 +1,191 @@
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { existsSync, openSync, closeSync, readFileSync, realpathSync, renameSync, rmSync, lstatSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join, relative, isAbsolute } from 'node:path';
+import { stageLocalRuntime, startLocal, stopLocal } from './local-install.js';
+import { installUpdate, updateStatus } from './updater.js';
+import { vaultHome } from './config.js';
+import { generationQueueStatus } from './hook-queue.js';
+function preparedPackage(home, state) {
+    if (state.status !== 'ready' || !state.packageRoot || !state.latest)
+        throw new Error('No validated update is ready.');
+    const root = realpathSync(state.packageRoot), releases = realpathSync(join(home, 'releases'));
+    const within = relative(releases, root);
+    if (!within || within.startsWith('..') || isAbsolute(within))
+        throw new Error('Invalid update location.');
+    const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+    if (pkg.name !== 'vault-go' || pkg.version !== state.latest)
+        throw new Error('Invalid prepared update.');
+    return root;
+}
+export async function activatePreparedUpdate(home, state, operations = { stop: stopLocal, start: startLocal }, options = {}) {
+    const release = await acquireActivationLock(home);
+    try {
+        if (options.automatic && !updateStatus(home).enabled)
+            throw new Error('Automatic updates are disabled.');
+        const source = preparedPackage(home, state);
+        const active = runtimeVersion(home);
+        if (active === state.latest) {
+            const health = await operations.start(home);
+            if (health.version !== state.latest)
+                throw new Error('Active worker version mismatch.');
+            return health;
+        }
+        if (active && compareVersions(active, state.latest) > 0)
+            throw new Error('Refusing to activate an older runtime.');
+        return await replaceRuntime(home, state, source, operations);
+    }
+    finally {
+        release();
+    }
+}
+function runtimeVersion(home) {
+    try {
+        const version = JSON.parse(readFileSync(join(home, 'local-runtime', 'package.json'), 'utf8')).version;
+        return typeof version === 'string' && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version) ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function compareVersions(a, b) {
+    const left = a.split('.').map(Number), right = b.split('.').map(Number);
+    for (let index = 0; index < 3; index++) {
+        if (left[index] !== right[index])
+            return left[index] > right[index] ? 1 : -1;
+    }
+    return 0;
+}
+function lockOwner(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+async function acquireActivationLock(home) {
+    const path = join(home, 'activation.lock'), token = randomUUID(), started = Date.now();
+    for (;;) {
+        let descriptor;
+        try {
+            descriptor = openSync(path, 'wx', 0o600);
+            writeFileSync(descriptor, JSON.stringify({ pid: process.pid, token }));
+            closeSync(descriptor);
+            return () => { if (lockOwner(path).token === token)
+                unlinkSync(path); };
+        }
+        catch (error) {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const before = lstatSync(path), owner = lockOwner(path);
+                let stale = false;
+                if (typeof owner.pid === 'number' && Number.isInteger(owner.pid) && owner.pid > 0) {
+                    try {
+                        process.kill(owner.pid, 0);
+                    }
+                    catch (failure) {
+                        stale = failure.code === 'ESRCH';
+                    }
+                }
+                else
+                    stale = Date.now() - before.mtimeMs > 600_000;
+                if (stale && lstatSync(path).ino === before.ino) {
+                    unlinkSync(path);
+                    continue;
+                }
+            }
+            catch (failure) {
+                if (failure.code === 'ENOENT')
+                    continue;
+            }
+            if (Date.now() - started >= 30_000)
+                throw new Error('Another update activation is already running.');
+            await new Promise(resolve => setTimeout(resolve, 25));
+        }
+    }
+}
+async function replaceRuntime(home, state, source, operations) {
+    await operations.stop(home);
+    const runtime = join(home, 'local-runtime'), previous = join(home, 'local-runtime.previous');
+    let staged = false;
+    try {
+        stageLocalRuntime(home, join(source, 'dist'));
+        staged = true;
+        const health = await operations.start(home);
+        if (health.version !== state.latest)
+            throw new Error('New worker version mismatch.');
+        return health;
+    }
+    catch {
+        if (staged)
+            await operations.stop(home);
+        // A failed stage normally leaves the current runtime intact. Do not replace it
+        // with an unrelated backup from a previous successful update.
+        if (!staged && existsSync(runtime)) {
+            await operations.start(home);
+            throw new Error('Update staging failed; previous runtime restarted.');
+        }
+        if (existsSync(previous)) {
+            rmSync(runtime, { recursive: true, force: true });
+            renameSync(previous, runtime);
+            await operations.start(home);
+            throw new Error('Update failed; previous runtime restored.');
+        }
+        throw new Error('Update failed to start.');
+    }
+}
+export async function launchPreparedUpdate(home, state, options = {}) {
+    if (options.automatic && !updateStatus(home).enabled)
+        return;
+    const root = preparedPackage(home, state);
+    const runner = join(root, 'dist', 'update-runner.js');
+    if (!existsSync(runner))
+        throw new Error('Update activation runner is missing.');
+    const log = openSync(join(home, 'update.log'), 'a', 0o600);
+    try {
+        const child = spawn(process.execPath, [runner, ...(options.automatic ? ['--automatic'] : [])], { detached: true, shell: false, stdio: ['ignore', log, log], env: { ...process.env, VAULT_GO_HOME: home } });
+        await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
+        child.unref();
+    }
+    finally {
+        closeSync(log);
+    }
+}
+export function scheduleAutomaticUpdates(isIdle, home = vaultHome(), operations = {}) {
+    const install = operations.install ?? installUpdate;
+    const launch = operations.launch ?? launchPreparedUpdate;
+    const status = operations.status ?? updateStatus;
+    const queueStatus = operations.queueStatus ?? generationQueueStatus;
+    const schedule = operations.schedule ?? ((callback, delay, repeat) => {
+        const timer = repeat ? setInterval(() => void callback(), delay) : setTimeout(() => void callback(), delay);
+        timer.unref();
+        return () => { if (repeat)
+            clearInterval(timer);
+        else
+            clearTimeout(timer); };
+    });
+    let busy = false, closed = false;
+    const tick = async () => {
+        if (closed || busy)
+            return;
+        busy = true;
+        try {
+            if (!isIdle() || queueStatus(home).pending > 0 || !status(home).enabled)
+                return;
+            const state = await install(home);
+            if (!closed && isIdle() && queueStatus(home).pending === 0 && status(home).enabled && state.status === 'ready' && state.restartRequired)
+                await launch(home, state, { automatic: true });
+        }
+        catch { /* sanitized status is available through the updater; retry on the next tick */ }
+        finally {
+            busy = false;
+        }
+    };
+    const cancelBoot = schedule(tick, 60_000, false);
+    const cancelInterval = schedule(tick, 60 * 60 * 1000, true);
+    return () => { closed = true; cancelBoot(); cancelInterval(); };
+}

package/dist/update-runner.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/update-runner.js

@@ -0,0 +1,16 @@
+import { activatePreparedUpdate } from './update-control.js';
+import { updateStatus } from './updater.js';
+import { vaultHome } from './config.js';
+try {
+    const home = vaultHome();
+    const automatic = process.argv.includes('--automatic');
+    const state = updateStatus(home);
+    if (!automatic || state.enabled) {
+        const health = await activatePreparedUpdate(home, state, undefined, { automatic });
+        process.stderr.write(`Vault Go updated to ${health.version}. Reconnect MCP clients to load the new tools.\n`);
+    }
+}
+catch {
+    process.stderr.write('Vault Go update activation failed. The previous runtime was retained where possible.\n');
+    process.exitCode = 1;
+}