Install lifecycle and profile settings

version, update, doctor, uninstall, daemon, and local-network access per profile.

version, update, doctor and uninstall run in the CLI itself. None of them starts a daemon.

`jawb version`

Prints the CLI version, the build target, the pinned jawbd version, the API level, and whether a daemon is running at the --daemon address (and its version and API level). jawb --version --json is the same command; plain jawb --version prints jawb X (jawbd Y).

`jawb update`

jawb update --check               # only report
jawb update                       # install the latest
jawb update --version X.Y.Z       # install a specific version
jawb update --force               # reinstall the same version

update fetches a signed release manifest and checks its signature against the key built into the CLI, then downloads the archive for your platform and checks its SHA-256 against the signed manifest. Only then does it stop a running daemon, replace jawb and jawbd in <install_root>/bin (all or nothing), and restart the daemon if it was running. Without --version it never installs an older or equal version. --check works from any jawb. Without --check, the running jawb must be the installed one in <install_root>/bin, or the command fails with a usage error. A fetch or verification failure is E_FETCH_FAILED (exit 1) with a details.reason, and nothing changes.

An installed jawb checks for a newer version at most once per 24 hours and prints one line on stderr when there is one. Set JAWB_NO_UPDATE_CHECK=1 to turn that off; it is also off in --json mode.

`jawb doctor`

Runs a list of checks and prints one line per check (pass, warn or fail) with a fix hint: path, binaries, daemon, port, data_dir, vault, chrome, stale_bridge, disk and release. Exit 0 when no check fails, 1 otherwise (E_DOCTOR_FAILED).

`jawb uninstall`

jawb uninstall            # asks first
jawb uninstall --yes      # no question
jawb uninstall --purge    # also deletes your data directory

It stops the daemon, then removes jawb, jawbd, the downloaded daemon copies, the update cache, and the user PATH entry the Windows installer added (JAWB_NO_MODIFY_PATH=1 leaves PATH alone). With no terminal and no --yes it exits 5. --purge deletes the data directory, which holds your profiles, and only after you type the word purge on an interactive terminal: --yes and --json do not skip that.

`jawb daemon`

daemon start, daemon stop, daemon status and daemon install [--force] control jawbd explicitly; see installation.

Letting a public page reach your local network

By default a public page cannot make jawbd fetch a local or private address (a redirect, a subresource, a form post). Addresses you name yourself, such as jawb open http://localhost:3000, are always allowed.

Per command: --allow-private on open, back/forward, reload, observe and the Act commands. Any other command refuses the flag with a usage error.
Per profile: jawb profile settings [<name>] shows the setting, and jawb profile settings [<name>] --allow-private on|off changes it immediately for that profile's live session.
Default for profiles with no setting of their own, and for incognito sessions: egress.allow_private_default in Configuration.

Link-local and cloud-metadata addresses, and jawbd's own control port, are refused whatever you set. WebSocket handshakes are not checked. Both flag and profile setting need a jawbd at API level 6 or later; the CLI refuses an older one with E_VERSION_MISMATCH.