feat(install): install without administrator rights (--no-admin)

Codeman itself always lived under $HOME; administrator rights were only
spent on what it needs first (system packages for Node.js, tmux and git,
Homebrew on a Mac). An account without those rights could not install it:
the installer died in ensure_sudo, or in Homebrew's own installer.

install.sh now has a no-admin route, taken by itself when the account has
no administrator rights (no sudo binary; outside sudo/wheel/admin and
`sudo -n true` fails; a refused sudo password; a Mac account outside the
admin group with no writable Homebrew) and forced with --no-admin or
CODEMAN_NO_ADMIN=1:

- Node.js: the official tarball from nodejs.org, checked against the
  SHASUMS256.txt published beside it, into ~/.codeman/runtime/node.
- tmux: the tmux project's own build (tmux/tmux-builds 3.7c), checked
  against a SHA-256 pinned in the installer, into ~/.codeman/runtime/bin.
- Both are linked from ~/.local/bin (never over a file that is not ours),
  and the runtime is on PATH and on the LaunchAgent's PATH.
- git is never installed. Without a working git the source comes as an
  archive, the install is marked with .install-source, and it updates by
  re-running the installer: the new tree is built beside the old one and
  swapped in only after the build succeeded. A later re-run on a machine
  that has gained git turns it back into a clone.
- Nothing on this route runs sudo, Homebrew or `xcode-select --install`,
  and the route is never decided by `sudo -v`.

What it cannot supply is checked before the first download: a C/C++
toolchain on Linux (node-pty 1.1.0 compiles there), musl, and macOS below
15 (the tmux build's deployment target).

Along the way:

- check_git no longer trusts `command -v git`. On a Mac without the Xcode
  Command Line Tools /usr/bin/git is a stub that opens Apple's install
  dialog; it is judged by `xcode-select -p` and never executed. Any other
  git is asked for its version.
- scripts/git-hooks.mjs answers "not a checkout" without running git, for
  the same reason: postinstall calls it on every npm install.
- The in-app updater knows the install kind `archive` and points such an
  install at the installer instead of `npm i -g aicodeman@latest`.
- download() and download_to_stdout() resolve DOWNLOADER themselves. Only
  main() used to set it, so `install.sh cloudflared` died on `set -u` with
  the message swallowed by the step log.
- The AI CLI menu leaves out a Homebrew-only install command where there
  is no Homebrew.

Verified with the real installer: a bare Ubuntu 24.04 container as an
unprivileged user (install, a PTY round trip through the API, update by
re-run, cloudflared, uninstall), the same without a compiler (stops before
any download), with a broken then working git, with sudo present but not
usable, and on macOS 26 (arm64) in an isolated HOME with sudo, brew, git,
the compilers, launchctl and tailscale replaced by tripwires. Not verified
on a real standard macOS account: that account was an administrator.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/types/update.ts

@@ -31,8 +31,11 @@ export type SupervisorKind = 'systemd' | 'launchd' | 'launchd-daemon' | 'docker-
  * How Codeman was installed. `git` and `docker-compose` can self-update in
  * place; `docker-compose` is a git checkout bind-mounted into the container, so
  * the pull/build happen on the host filesystem and survive container recreation.
+ * `archive` is what `install.sh` leaves on a machine with no working git (its
+ * no-admin route): the source unpacked from an archive, with nothing for the
+ * in-app updater to pull into, so it updates by re-running the installer.
  */
-export type InstallKind = 'git' | 'docker-compose' | 'npm' | 'unknown';
+export type InstallKind = 'git' | 'docker-compose' | 'npm' | 'archive' | 'unknown';
 
 /**
  * Why an in-place container update is refused. Each is derived mechanically from

src/web/public/settings-ui.js

@@ -1940,10 +1940,14 @@ Object.assign(CodemanApp.prototype, {
     // `docker-compose` self-updates in place like `git` does — the container
     // restarts itself. Anything else cannot.
     if (data.installKind && data.installKind !== 'git' && data.installKind !== 'docker-compose') {
+      // `archive` = installed by install.sh on a machine with no working git: the
+      // installer replaces it with a fresh build, so point there, not at npm.
       const hint =
         data.supervisor === 'docker-compose'
           ? 'Update from the Docker host with <code>docker/Start-Codeman.sh</code>.'
-          : 'Update with <code>npm i -g aicodeman@latest</code>.';
+          : data.installKind === 'archive'
+            ? 'It was installed without git. Re-run the installer to update: <code>curl -fsSL https://getcodeman.com/install | bash</code>'
+            : 'Update with <code>npm i -g aicodeman@latest</code>.';
       this._setUpdateResult(`This install can't update itself (${escapeHtml(data.installKind)}). ${hint}`);
       return;
     }

src/web/self-update.ts

@@ -462,12 +462,26 @@ export function isRunningInContainer(): boolean {
   return process.env.CODEMAN_IN_CONTAINER === '1' || existsSync('/.dockerenv');
 }
 
-function detectInstallKind(dir: string): InstallKind {
+/**
+ * Marker `install.sh` writes into an install directory whose source came from an
+ * archive instead of a git clone (`SOURCE_MARKER` there; the two names are pinned
+ * to each other by `test/install-sh-invariants.test.ts`).
+ */
+export const ARCHIVE_INSTALL_MARKER = '.install-source';
+
+/** How an `archive` install updates: the installer replaces it with a fresh build. */
+export const ARCHIVE_UPDATE_HINT =
+  'This install has no git checkout, so it cannot update in place. Re-run the installer to update: ' +
+  'curl -fsSL https://getcodeman.com/install | bash';
+
+export function detectInstallKind(dir: string): InstallKind {
   // A container whose code is a bind-mounted checkout updates in place (the pull
   // and build land on the host filesystem and survive container recreation). A
   // container WITHOUT that mount runs a baked image copy — a pull there would go
   // to the writable layer and vanish on the next `up`, so it is not updatable.
   if (existsSync(join(dir, '.git'))) return isRunningInContainer() ? 'docker-compose' : 'git';
+  // install.sh on a machine with no working git: the source from an archive.
+  if (existsSync(join(dir, ARCHIVE_INSTALL_MARKER))) return 'archive';
   // Global npm install ships only dist/ (no src/, no .git).
   if (!existsSync(join(dir, 'src'))) return 'npm';
   return 'unknown';
@@ -705,7 +719,9 @@ export async function checkForUpdate(): Promise<UpdateCheckResult> {
       error:
         info.installKind === 'unknown' && isRunningInContainer()
           ? 'This container runs a baked image copy with no repository mounted — self-update is unavailable. See docs/docker-self-update.md.'
-          : 'Not a git install — self-update is unavailable.',
+          : info.installKind === 'archive'
+            ? ARCHIVE_UPDATE_HINT
+            : 'Not a git install — self-update is unavailable.',
     };
   }
 
@@ -829,7 +845,9 @@ export async function startUpdate(): Promise<StartUpdateResult> {
       code: 'not-git',
       message: isRunningInContainer()
         ? 'This container has no repository mounted. Update from the host with docker/Start-Codeman.sh.'
-        : 'This is not a git install. Update with: npm i -g aicodeman@latest',
+        : info.installKind === 'archive'
+          ? ARCHIVE_UPDATE_HINT
+          : 'This is not a git install. Update with: npm i -g aicodeman@latest',
     };
   }
   const existing = readCurrentUpdateStatus();