@addai/node 0.11.2 → 0.12.0

package/dist/auto-update.d.ts

@@ -0,0 +1,139 @@
+import { type HarnessId } from './harness-registry';
+import { type LaunchMode } from './self-update';
+/**
+ * A stable per-node offset into the hour, derived from the daemon token.
+ *
+ * The fleet has to be spread across the hour rather than converging on :00 —
+ * with no soak window, the stagger is the ONLY thing limiting how fast a bad
+ * publish reaches everyone. Deriving it from the token (rather than random)
+ * means a node keeps its slot across restarts, including the restart an
+ * auto-roll itself causes, which would otherwise re-converge every rolled
+ * node onto the same minute.
+ */
+export declare function tickOffsetMs(token: string): number;
+/**
+ * Milliseconds until this node's next slot, measured against the wall clock
+ * rather than against boot time — so a daemon that restarts twice an hour
+ * keeps firing on its own slot instead of drifting to a new one each time.
+ */
+export declare function msUntilNextTick(nowMs: number, offsetMs: number): number;
+export type SkipReason = 'disabled' | 'busy' | 'breaker';
+/**
+ * The guards, in the order they are cheapest to check.
+ *
+ * `busy` is a skip, NOT a drain: an auto-update is elective and there is
+ * always another hour, whereas draining would take the node out of rotation
+ * for up to ten minutes every time the tick happened to land mid-turn. A node
+ * that is never idle never auto-updates, and gets rolled by hand.
+ */
+export declare function shouldRun(s: {
+    enabled: boolean;
+    busy: boolean;
+    breakerOpen: boolean;
+}): SkipReason | null;
+export interface HarnessUpgrade {
+    id: HarnessId;
+    npmPackage: string;
+}
+/**
+ * Which harnesses this tick will `npm i -g …@latest`.
+ *
+ * Two rules, both deliberate:
+ *  - npm-able only. grok's `npmPackage` is null (xAI ships its own installer),
+ *    so it is never touched here — a truthful skip beats a fake upgrade.
+ *  - installed only. The tick upgrades; it does not provision. Installing a
+ *    harness nobody asked for is a different feature, and one with a cost
+ *    (disk, a login prompt that never comes) the user never opted into.
+ */
+export declare function planHarnessUpgrades(installed: HarnessId[]): HarnessUpgrade[];
+export interface RollDecision {
+    roll: boolean;
+    /** Why not, when roll is false. Logged, and surfaced in capabilities. */
+    reason?: string;
+}
+/**
+ * Whether to roll the daemon itself.
+ *
+ * A source checkout is refused for the same reason a remote version bump is
+ * (see planRoll): its version comes from the working tree, so installing and
+ * restarting would come back up on exactly the same bits — a no-op wearing a
+ * success. Harnesses on such a node are still upgraded; only this half is off.
+ */
+export declare function planAutoRoll(current: string, latest: string | null, mode: LaunchMode): RollDecision;
+export interface HarnessOutcome {
+    from?: string;
+    to?: string;
+    /** Where the binary resolves NOW. You chose npm-for-every-npm-able-harness,
+     *  so on a machine whose Claude Code came from Anthropic's native installer
+     *  npm has just put a second copy somewhere else — possibly shadowing the
+     *  first. The path is what makes that visible instead of silent. */
+    path?: string;
+    error?: string;
+}
+export interface AutoUpdateState {
+    enabled: boolean;
+    last_checked_at?: string;
+    last_result?: 'ok' | 'skipped' | 'failed';
+    skipped_reason?: SkipReason;
+    /** Set when a roll actually happened — written by the daemon that came up
+     *  after it, from the restart handoff. */
+    runtime?: {
+        from: string;
+        to: string;
+        wanted?: string;
+    } | null;
+    harnesses?: Record<string, HarnessOutcome>;
+    error?: string;
+}
+/** Read by capabilities.ts so the whole picture rides the heartbeat the AiNode
+ *  page already reads — no new RPC, no new column, no polling. */
+export declare function autoUpdateState(): AutoUpdateState;
+/** Called by index.ts on boot when the handoff it consumed had no command id,
+ *  i.e. the roll was ours rather than a button press. */
+export declare function recordAutoRoll(r: {
+    from: string;
+    to: string;
+    wanted?: string;
+}): void;
+/** Only the part of a capabilities probe this module reads. Kept structural
+ *  rather than importing CapabilitiesShape, which would put capabilities.ts on
+ *  both ends of an import cycle (it reads autoUpdateState from here). */
+type ProbeShape = Partial<Record<HarnessId, {
+    version?: string;
+    available?: boolean;
+}>>;
+export interface AutoUpdateDeps {
+    /** The daemon token — only used to derive this node's slot. */
+    token: () => string | null;
+    /** True while this node holds a child process for a live run. */
+    isBusy: () => boolean;
+    /** The daemon-wide Supabase circuit breaker. */
+    breakerOpen: () => boolean;
+    /** Whether the server says auto-update is on for this node. */
+    enabled: () => boolean;
+    /** Full capabilities probe — used for before/after harness versions. */
+    probe: () => Promise<ProbeShape>;
+    /** Push a heartbeat so Studio sees the new versions without waiting. */
+    beat: () => Promise<void>;
+    /** The same closure `update_runtime` uses. No command id: nobody asked. */
+    roll: (opts: {
+        version: string;
+    }) => Promise<void>;
+    /** This daemon's own version. */
+    version: string;
+    /** `npm i -g <spec>`; null on success. Injectable so the orchestration below
+     *  — the before/after diff, the busy re-check — can be tested without
+     *  actually installing anything. */
+    install?: (spec: string) => Promise<string | null>;
+    /** What npm calls latest for a package, or null if we couldn't ask. */
+    latest?: (pkg: string) => Promise<string | null>;
+    /** How this daemon was launched. Injectable because under a test runner
+     *  argv[1] is the runner, which would read as `source` and mask the roll. */
+    mode?: () => LaunchMode;
+}
+/** One pass. Exported so `ainode` can be made to do it on demand later, and
+ *  so a test can drive it without waiting an hour. */
+export declare function runOnce(d: AutoUpdateDeps): Promise<void>;
+export declare function start(d: AutoUpdateDeps): void;
+export declare function stop(): void;
+export {};

package/dist/auto-update.js

@@ -0,0 +1,261 @@
+"use strict";
+// Hourly auto-update — this node keeps itself, and its harnesses, current.
+//
+// Until now a node only moved when somebody clicked. `update_runtime` issued
+// by hand from Entity Studio was the ONLY thing that ever rolled a daemon,
+// which is how the fleet came to sit on 0.2.51/0.2.52/0.2.53 for days after
+// 0.2.55 shipped. Harnesses were worse: Studio offers Install only while a
+// harness reads `missing`, so once Claude Code was on a node it could never
+// be upgraded from anywhere.
+//
+// The schedule lives here rather than in a server-side cron because a node
+// asleep, behind NAT, or between pairings then needs no special case — the
+// daemon already wakes on its own for reclaim, diskguard and sleep detection.
+//
+// Everything the tick needs from the rest of the daemon is INJECTED by
+// index.ts (roll, probe, beat, isBusy, isEnabled). That keeps this module's
+// imports down to the registry and the npm helpers, so the decisions below
+// are testable without booting a daemon — and avoids the
+// auto-update → heartbeat → capabilities → auto-update cycle that importing
+// them directly would create.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tickOffsetMs = tickOffsetMs;
+exports.msUntilNextTick = msUntilNextTick;
+exports.shouldRun = shouldRun;
+exports.planHarnessUpgrades = planHarnessUpgrades;
+exports.planAutoRoll = planAutoRoll;
+exports.autoUpdateState = autoUpdateState;
+exports.recordAutoRoll = recordAutoRoll;
+exports.runOnce = runOnce;
+exports.start = start;
+exports.stop = stop;
+const harness_registry_1 = require("./harness-registry");
+const self_update_1 = require("./self-update");
+const HOUR_MS = 60 * 60 * 1000;
+/** Nothing auto-rolls in the first few minutes of a boot. A node that just
+ *  came up may BE the result of a roll (or of one that went badly), and
+ *  rolling again immediately would turn a bad publish into a restart loop. */
+const BOOT_GRACE_MS = 5 * 60 * 1000;
+/* ── when ─────────────────────────────────────────────────────────────── */
+/**
+ * A stable per-node offset into the hour, derived from the daemon token.
+ *
+ * The fleet has to be spread across the hour rather than converging on :00 —
+ * with no soak window, the stagger is the ONLY thing limiting how fast a bad
+ * publish reaches everyone. Deriving it from the token (rather than random)
+ * means a node keeps its slot across restarts, including the restart an
+ * auto-roll itself causes, which would otherwise re-converge every rolled
+ * node onto the same minute.
+ */
+function tickOffsetMs(token) {
+    // FNV-1a. Not cryptographic — it only has to spread evenly and be stable.
+    let h = 0x811c9dc5;
+    for (let i = 0; i < token.length; i++) {
+        h ^= token.charCodeAt(i);
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    return h % HOUR_MS;
+}
+/**
+ * Milliseconds until this node's next slot, measured against the wall clock
+ * rather than against boot time — so a daemon that restarts twice an hour
+ * keeps firing on its own slot instead of drifting to a new one each time.
+ */
+function msUntilNextTick(nowMs, offsetMs) {
+    const since = (((nowMs - offsetMs) % HOUR_MS) + HOUR_MS) % HOUR_MS;
+    const wait = HOUR_MS - since;
+    // since === 0 lands exactly on the slot; wait a full hour rather than
+    // firing twice for the same slot.
+    return wait === 0 ? HOUR_MS : wait;
+}
+/**
+ * The guards, in the order they are cheapest to check.
+ *
+ * `busy` is a skip, NOT a drain: an auto-update is elective and there is
+ * always another hour, whereas draining would take the node out of rotation
+ * for up to ten minutes every time the tick happened to land mid-turn. A node
+ * that is never idle never auto-updates, and gets rolled by hand.
+ */
+function shouldRun(s) {
+    if (!s.enabled)
+        return 'disabled';
+    if (s.breakerOpen)
+        return 'breaker';
+    if (s.busy)
+        return 'busy';
+    return null;
+}
+/**
+ * Which harnesses this tick will `npm i -g …@latest`.
+ *
+ * Two rules, both deliberate:
+ *  - npm-able only. grok's `npmPackage` is null (xAI ships its own installer),
+ *    so it is never touched here — a truthful skip beats a fake upgrade.
+ *  - installed only. The tick upgrades; it does not provision. Installing a
+ *    harness nobody asked for is a different feature, and one with a cost
+ *    (disk, a login prompt that never comes) the user never opted into.
+ */
+function planHarnessUpgrades(installed) {
+    const present = new Set(installed);
+    return harness_registry_1.HARNESS_IDS
+        .filter(id => present.has(id) && harness_registry_1.HARNESSES[id].npmPackage !== null)
+        .map(id => ({ id, npmPackage: harness_registry_1.HARNESSES[id].npmPackage }));
+}
+/**
+ * Whether to roll the daemon itself.
+ *
+ * A source checkout is refused for the same reason a remote version bump is
+ * (see planRoll): its version comes from the working tree, so installing and
+ * restarting would come back up on exactly the same bits — a no-op wearing a
+ * success. Harnesses on such a node are still upgraded; only this half is off.
+ */
+function planAutoRoll(current, latest, mode) {
+    if (mode === 'source')
+        return { roll: false, reason: 'source checkout — pull and rebuild it there' };
+    if (!latest)
+        return { roll: false, reason: 'could not read the latest published version' };
+    if (latest === current)
+        return { roll: false, reason: 'already latest' };
+    return { roll: true };
+}
+let state = { enabled: true };
+let isEnabled = () => true;
+/** Read by capabilities.ts so the whole picture rides the heartbeat the AiNode
+ *  page already reads — no new RPC, no new column, no polling. */
+function autoUpdateState() {
+    return { ...state, enabled: isEnabled() };
+}
+/** Called by index.ts on boot when the handoff it consumed had no command id,
+ *  i.e. the roll was ours rather than a button press. */
+function recordAutoRoll(r) {
+    state = { ...state, runtime: r, last_result: 'ok', last_checked_at: new Date().toISOString() };
+}
+let timer = null;
+let stopped = false;
+let deps = null;
+function harnessVersion(probe, id) {
+    const p = probe[id];
+    return p?.available ? p.version : undefined;
+}
+function installedHarnesses(probe) {
+    return harness_registry_1.HARNESS_IDS.filter(id => probe[id]?.available === true);
+}
+/** One pass. Exported so `ainode` can be made to do it on demand later, and
+ *  so a test can drive it without waiting an hour. */
+async function runOnce(d) {
+    const skip = shouldRun({ enabled: d.enabled(), busy: d.isBusy(), breakerOpen: d.breakerOpen() });
+    if (skip) {
+        state = { ...state, last_checked_at: new Date().toISOString(), last_result: 'skipped', skipped_reason: skip };
+        if (skip !== 'breaker')
+            console.log(`[auto-update] skipped — ${skip === 'busy' ? 'the node is mid-run' : 'turned off for this node'}`);
+        return;
+    }
+    const checkedAt = new Date().toISOString();
+    const harnesses = {};
+    let failed;
+    const install = d.install ?? self_update_1.npmInstallGlobal;
+    const latestOf = d.latest ?? self_update_1.npmLatestVersion;
+    /* ── harnesses first — nothing restarts, so this half always lands ──── */
+    try {
+        const before = await d.probe();
+        const upgrades = planHarnessUpgrades(installedHarnesses(before));
+        for (const u of upgrades) {
+            const from = harnessVersion(before, u.id);
+            const err = await install(`${u.npmPackage}@latest`);
+            harnesses[u.id] = { from, ...(err ? { error: err } : {}) };
+            if (err)
+                console.error(`[auto-update] ${u.id}: ${err}`);
+        }
+        if (upgrades.length > 0) {
+            // The finders cached their pre-upgrade lookups; a probe through stale
+            // caches would report the OLD version and hide the upgrade entirely.
+            (0, harness_registry_1.resetBinaryCaches)();
+            const after = await d.probe();
+            for (const u of upgrades) {
+                const to = harnessVersion(after, u.id);
+                const path = harness_registry_1.HARNESSES[u.id].findBinary() ?? undefined;
+                harnesses[u.id] = { ...harnesses[u.id], to, path };
+                if (harnesses[u.id].from !== to) {
+                    console.log(`[auto-update] ${u.id} ${harnesses[u.id].from ?? '?'} → ${to ?? '?'} (${path ?? 'not resolvable'})`);
+                }
+            }
+            await d.beat();
+        }
+    }
+    catch (err) {
+        failed = `harness upgrade: ${err.message}`;
+        console.error(`[auto-update] ${failed}`);
+    }
+    state = {
+        ...state,
+        last_checked_at: checkedAt,
+        last_result: failed ? 'failed' : 'ok',
+        skipped_reason: undefined,
+        harnesses,
+        error: failed,
+    };
+    /* ── then the daemon itself ─────────────────────────────────────────── */
+    const mode = d.mode ? d.mode() : (0, self_update_1.detectLaunchMode)(process.argv[1] ?? '');
+    const latest = mode === 'source' ? null : await latestOf(self_update_1.PACKAGE_NAME);
+    const decision = planAutoRoll(d.version, latest, mode);
+    if (!decision.roll) {
+        if (decision.reason !== 'already latest')
+            console.log(`[auto-update] not rolling — ${decision.reason}`);
+        return;
+    }
+    // Re-check busy: the harness upgrades above can take minutes, and a run may
+    // well have arrived while npm was working. Rolling now would guillotine it
+    // at the drain ceiling for no reason — there is another hour.
+    if (d.isBusy()) {
+        state = { ...state, last_result: 'skipped', skipped_reason: 'busy' };
+        console.log('[auto-update] a run arrived during the harness pass — leaving the roll for next hour');
+        return;
+    }
+    console.log(`[auto-update] rolling ${d.version} → ${latest}`);
+    try {
+        // This does not return: the roll drains, hands over, and exits. The
+        // daemon that comes up completes the story from the handoff file.
+        await d.roll({ version: latest });
+    }
+    catch (err) {
+        state = { ...state, last_result: 'failed', error: `roll: ${err.message}` };
+        console.error(`[auto-update] roll failed — staying on ${d.version}:`, err.message);
+    }
+}
+function schedule(firstRun) {
+    if (stopped || !deps)
+        return;
+    const token = deps.token() ?? '';
+    const offset = tickOffsetMs(token);
+    let wait = msUntilNextTick(Date.now(), offset);
+    if (firstRun)
+        wait = Math.max(wait, BOOT_GRACE_MS);
+    timer = setTimeout(() => {
+        void (async () => {
+            try {
+                await runOnce(deps);
+            }
+            catch (err) {
+                console.error('[auto-update] tick crashed:', err.message);
+            }
+            schedule(false);
+        })();
+    }, wait);
+    // Never keep the process alive just to auto-update.
+    timer.unref?.();
+}
+function start(d) {
+    if (timer || stopped)
+        return;
+    deps = d;
+    isEnabled = d.enabled;
+    state = { ...state, enabled: d.enabled() };
+    schedule(true);
+}
+function stop() {
+    stopped = true;
+    if (timer) {
+        clearTimeout(timer);
+        timer = null;
+    }
+}

package/dist/capabilities.d.ts

@@ -1,4 +1,6 @@
 import { type AutostartState } from './autostart';
+import { type AutoUpdateState } from './auto-update';
+import { type MachineSample } from './machine-metrics';
 interface AuthShape {
     authed: boolean;
     account?: string;
@@ -42,6 +44,13 @@ interface CapabilitiesShape {
      *  rather than a column of its own — same channel Studio already reads the
      *  harness grid from. */
     autostart?: AutostartState;
+    /** CPU / memory / disk / runs at the moment of this probe. The AiNode page
+     *  has read this key since it was written; nothing produced it until now. */
+    machine?: MachineSample;
+    /** What the hourly auto-update last did — versions moved, skips, failures.
+     *  Same channel, same reason: without it the AiNode page is somewhere the
+     *  version silently changes with no explanation. */
+    auto_update?: AutoUpdateState;
 }
 /** Codex's credential store: $CODEX_HOME (or ~/.codex) + /auth.json. */
 export declare function codexHome(): string;

package/dist/capabilities.js

@@ -53,6 +53,8 @@ const codex_binary_1 = require("./codex-binary");
 const win_1 = require("./win");
 const harness_registry_1 = require("./harness-registry");
 const autostart_1 = require("./autostart");
+const auto_update_1 = require("./auto-update");
+const machine_metrics_1 = require("./machine-metrics");
 function readDaemonVersion() {
     try {
         // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -398,6 +400,8 @@ async function probeCapabilities() {
     return {
         daemon_version: readDaemonVersion(),
         autostart: (0, autostart_1.status)(),
+        auto_update: (0, auto_update_1.autoUpdateState)(),
+        machine: (0, machine_metrics_1.sampleMachine)(),
         claude: deco('claude', claude),
         codex: deco('codex', codex),
         kimi: deco('kimi', kimi),

package/dist/codex-spawn.d.ts

@@ -25,6 +25,14 @@ export interface CodexInput {
      *  Mirrors the claude --strict-mcp-config behavior. */
     mcpServers?: CodexMcpServer[];
 }
+/** Build a config.toml that declares only the supplied MCP servers and
+ *  return the CODEX_HOME directory plus any env vars the child needs
+ *  (bearer tokens for remote servers). Caller is responsible for cleanup
+ *  (we drop it under os.tmpdir() so it gets reaped). */
+export declare function writeCodexHome(servers: CodexMcpServer[], workingDirectory: string): {
+    home: string;
+    extraEnv: Record<string, string>;
+};
 export interface CodexHandle {
     pid: number | undefined;
     threadId: string | null;

package/dist/codex-spawn.js

@@ -40,6 +40,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCodexHome = writeCodexHome;
 exports.codexEffort = codexEffort;
 exports.spawnCodex = spawnCodex;
 const child_process_1 = require("child_process");
@@ -54,15 +55,58 @@ const events_1 = require("./events");
 function tomlString(s) {
     return '"' + String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
 }
+/** Env var name carrying an HTTP MCP's bearer token into the codex process.
+ *  Only the NAME goes in config.toml — the value rides on the child env, so
+ *  the token never lands on disk. */
+const bearerEnvVar = (slug) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_TOKEN`;
 /** Build a config.toml that declares only the supplied MCP servers and
- *  return the directory path to use as CODEX_HOME. Caller is responsible
- *  for cleanup (we drop it under os.tmpdir() so it gets reaped). */
+ *  return the CODEX_HOME directory plus any env vars the child needs
+ *  (bearer tokens for remote servers). Caller is responsible for cleanup
+ *  (we drop it under os.tmpdir() so it gets reaped). */
 function writeCodexHome(servers, workingDirectory) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'entities-codex-'));
+    const extraEnv = {};
     let toml = '# Generated by ainode — sandboxes codex against host config\n\n';
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. Registry rows store command='http'|'sse' with
+        // args=[url]; codex spells that `url = "..."`, NOT command/args. Writing
+        // the row verbatim made codex try to exec a binary called `http`, so the
+        // server never started and its tools silently vanished — which is how a
+        // provider-ladder hop to codex dropped an entity's GitHub access without
+        // any error anywhere. The claude path (install.ts) always handled this;
+        // codex and grok did not.
+        if (s.command === 'http' || s.command === 'sse') {
+            const url = Array.isArray(s.args) && typeof s.args[0] === 'string' ? s.args[0] : null;
+            if (!url) {
+                console.error(`[codex] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const name = tomlString(s.slug).slice(1, -1);
+            toml += `[mcp_servers.${name}]\n`;
+            toml += `url = ${tomlString(url)}\n`;
+            // codex reads the bearer from its OWN environment (--env is stdio-only),
+            // so the value goes on the child env and only the var name in the file.
+            const creds = Object.entries(s.env || {})
+                .filter(([k, v]) => typeof v === 'string' && v.length > 0 && !k.startsWith('OAUTH_REFRESH'));
+            const bearer = creds.find(([k]) => k === 'OAUTH_ACCESS_TOKEN') ?? creds[0];
+            if (bearer) {
+                const varName = bearerEnvVar(s.slug);
+                extraEnv[varName] = String(bearer[1]);
+                toml += `bearer_token_env_var = ${tomlString(varName)}\n`;
+                if (creds.length > 1) {
+                    // codex carries one bearer and no arbitrary headers. Anything that
+                    // authenticates with several custom headers is only partly wired,
+                    // and saying so beats a server that 401s for no visible reason.
+                    console.error(`[codex] MCP ${s.slug}: only ${bearer[0]} is forwarded as a bearer token; ` +
+                        `codex cannot send custom headers, so ${creds.length - 1} other credential ` +
+                        `field(s) were dropped`);
+                }
+            }
+            toml += '\n';
+            continue;
+        }
         // On native Windows, registry commands like `npx` are .cmd shims that
         // codex can't CreateProcess directly — wrap with `cmd /c` (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
@@ -109,7 +153,7 @@ function writeCodexHome(servers, workingDirectory) {
     if (fs.existsSync(sessionSkillsDir)) {
         (0, win_1.linkDir)(sessionSkillsDir, path.join(dir, 'skills'));
     }
-    return dir;
+    return { home: dir, extraEnv };
 }
 function lineToEvents(line) {
     const type = typeof line.type === 'string' ? line.type : '';
@@ -194,7 +238,7 @@ function spawnCodex(input) {
     // Sandbox codex against an isolated CODEX_HOME so the host's
     // ~/.codex/config.toml mcp_servers don't leak in. TERM=dumb keeps
     // codex's TTY heuristics happy (no fancy terminal output).
-    const codexHome = writeCodexHome(input.mcpServers ?? [], input.workingDirectory);
+    const { home: codexHome, extraEnv: mcpBearerEnv } = writeCodexHome(input.mcpServers ?? [], input.workingDirectory);
     // Register the scratch dir with DiskGuard: marks it active (so a
     // concurrent sweep won't evict a live run) and writes a PID lock so a
     // different runtime process can tell it's still owned. dispose(true)
@@ -205,6 +249,9 @@ function spawnCodex(input) {
         ...process.env,
         TERM: 'dumb',
         CODEX_HOME: codexHome,
+        // Bearer tokens for remote (http/sse) MCP servers. config.toml names these
+        // vars via bearer_token_env_var; the values only ever live here.
+        ...mcpBearerEnv,
     };
     // Resolve binary path before spawn. Previously called spawn('codex', ...)
     // bare, which threw ENOENT under launchd / desktop-app PATH inheritance

package/dist/command-runner.d.ts

@@ -1,5 +1,7 @@
 export type RestartHook = (opts: {
-    commandId: string;
+    /** Absent when the hourly auto-update is the one rolling: nobody issued a
+     *  command, so there is nothing to close on the other side. */
+    commandId?: string;
     version: string;
     /** Bounce this daemon on the version it is already running: no npm
      *  install, no version change. See runUpdateRuntime. */

package/dist/grok-spawn.d.ts

@@ -38,4 +38,8 @@ export interface GrokHandle {
     onActivity(cb: () => void): void;
     done: Promise<number>;
 }
+/** Write the entity's MCP servers as a project-scoped `<cwd>/.grok/config.toml`.
+ *  Project scope only supports `[mcp_servers]`, which is exactly what we need.
+ *  Returns the config path (for logging) or null when there are no servers. */
+export declare function writeProjectMcpConfig(workingDirectory: string, servers: GrokMcpServer[]): string | null;
 export declare function spawnGrok(input: GrokInput): GrokHandle;

package/dist/grok-spawn.js

@@ -64,6 +64,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeProjectMcpConfig = writeProjectMcpConfig;
 exports.spawnGrok = spawnGrok;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
@@ -158,6 +159,18 @@ function writeProjectMcpConfig(workingDirectory, servers) {
     }
     const lines = [];
     for (const s of usable) {
+        // Remote MCP servers (registry command='http'|'sse', args=[url]) have no
+        // verified grok config spelling, and writing the row verbatim is worse
+        // than skipping: grok would try to exec a binary called `http`, the
+        // server would never start, and its tools would vanish with no error —
+        // the exact silent failure that cost an entity its GitHub access after a
+        // provider-ladder hop. Skip it, and say so loudly enough to be findable.
+        if (s.command === 'http' || s.command === 'sse') {
+            console.error(`[grok] MCP ${s.slug}: remote ${s.command} servers are not supported by the grok ` +
+                `adapter — skipping. Its tools will be ABSENT from this run. Use claude (or codex, ` +
+                `which supports url + bearer_token_env_var) for entities that depend on it.`);
+            continue;
+        }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args.map(String) : []);
         lines.push(`[mcp_servers.${tomlStr(s.slug)}]`);

package/dist/heartbeat.d.ts

@@ -1,4 +1,5 @@
 export declare function setPendingCommandsHook(cb: () => void): void;
+export declare function autoUpdateEnabled(): boolean;
 /** Announce a clean shutdown so the server flips us offline immediately
  *  (status='offline') instead of waiting ~90s for last_seen_at to age out —
  *  lets a planned restart fail over instantly. Best-effort; the stale-window

package/dist/heartbeat.js

@@ -4,6 +4,7 @@
 // is paired.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setPendingCommandsHook = setPendingCommandsHook;
+exports.autoUpdateEnabled = autoUpdateEnabled;
 exports.goOffline = goOffline;
 exports.beat = beat;
 exports.start = start;
@@ -21,6 +22,15 @@ let onPendingCommands = null;
 function setPendingCommandsHook(cb) {
     onPendingCommands = cb;
 }
+// Is hourly auto-update armed for this node? It rides the heartbeat rather
+// than getting an RPC of its own — the daemon is already talking to the server
+// every 30s, and the answer is one boolean on the node's own row.
+//
+// Default ON, and specifically ON when the field is ABSENT: a server that has
+// not had the migration yet must not read as "everybody opted out". Only an
+// explicit `false` turns it off.
+let autoUpdateArmed = true;
+function autoUpdateEnabled() { return autoUpdateArmed; }
 async function tick() {
     // Skip if the daemon-wide circuit breaker is open. Heartbeats are
     // safe to miss — vault marks the runtime offline after ~90s; the
@@ -41,6 +51,8 @@ async function tick() {
         if (res && typeof res.pending_commands === 'number' && res.pending_commands > 0) {
             onPendingCommands?.();
         }
+        if (res && typeof res.auto_update === 'boolean')
+            autoUpdateArmed = res.auto_update;
     }
     catch (err) {
         if (err instanceof supabase_client_1.RpcError && err.status === 401) {

package/dist/index.js

@@ -49,6 +49,9 @@ const pairing_1 = require("./pairing");
 const heartbeat_1 = require("./heartbeat");
 const command_runner_1 = require("./command-runner");
 const self_update_1 = require("./self-update");
+const auto_update_1 = require("./auto-update");
+const machine_metrics_1 = require("./machine-metrics");
+const capabilities_1 = require("./capabilities");
 const autostart_1 = require("./autostart");
 const sleep_detector_1 = require("./sleep-detector");
 const claude_config_1 = require("./claude-config");
@@ -143,6 +146,11 @@ async function start(argv = []) {
     // server reports queued install/login commands, the command runner
     // drains them.
     (0, heartbeat_1.setPendingCommandsHook)(command_runner_1.wake);
+    // So each machine sample can say how many runs the box was holding at the
+    // time — "pinned at 90%" and "pinned at 90% running four things" are
+    // different stories. Hooked rather than imported so capabilities.ts needn't
+    // pull in request-pump, and through it session-runner.
+    (0, machine_metrics_1.setRunsInFlightHook)(() => (0, request_pump_1.activeRequestIdList)().length);
     (0, heartbeat_1.start)();
     // If we are the daemon a remote `update_runtime` restarted INTO, close out
     // that command now — with the version we actually came up as. The process
@@ -211,6 +219,7 @@ async function start(argv = []) {
         (0, projects_1.stop)();
         (0, request_pump_1.stop)();
         (0, heartbeat_1.stop)();
+        (0, auto_update_1.stop)();
         sleepMonitor.stop();
         diskGuard.stop();
         // Graceful drain: wait up to drainTimeoutMs for in-flight requests
@@ -254,7 +263,7 @@ async function start(argv = []) {
     // to the same bits (which matters for npx, whose cache dir is per-version)
     // and npm is never called — nothing to fetch, and nothing that can fail
     // offline.
-    (0, command_runner_1.setRestartHook)(async ({ commandId, version, restartOnly }) => {
+    const performRestart = async ({ commandId, version, restartOnly }) => {
         const mode = (0, self_update_1.detectLaunchMode)(process.argv[1] ?? '');
         const plan = (0, self_update_1.planRespawn)(mode, process.argv[1] ?? '', version, process.execPath, process.argv.slice(2));
         const supervised = (0, autostart_1.isSupervised)();
@@ -293,6 +302,21 @@ async function start(argv = []) {
             ? `[restart] standing down for launchd to restart us (${what}); exiting`
             : `[restart] handed over to ${plan.file} (${what}); exiting`);
         setTimeout(() => process.exit(0), 250).unref?.();
+    };
+    (0, command_runner_1.setRestartHook)(performRestart);
+    // Hourly auto-update — the node keeps itself and its harnesses current
+    // without anybody clicking. It rolls through the very same closure the
+    // manual button does, minus the command id, so a hand roll and an auto
+    // roll cannot drift apart.
+    (0, auto_update_1.start)({
+        token: () => (0, store_1.readPairing)()?.daemonToken ?? null,
+        isBusy: () => (0, request_pump_1.activeRequestIdList)().length > 0,
+        breakerOpen: () => (0, supabase_client_1.rpcShouldSkip)(),
+        enabled: heartbeat_1.autoUpdateEnabled,
+        probe: () => (0, capabilities_1.probeCapabilities)(),
+        beat: () => (0, heartbeat_1.beat)(),
+        roll: ({ version }) => performRestart({ version }),
+        version: VERSION,
     });
     process.once('SIGINT', () => { stop().finally(() => process.exit(0)); });
     process.once('SIGTERM', () => { stop().finally(() => process.exit(0)); });
@@ -392,6 +416,16 @@ async function finalizeRestartHandoff() {
     const changed = h.from_version !== VERSION;
     const wanted = h.target_version;
     const missed = wanted !== 'latest' && wanted !== VERSION;
+    // No command id means the hourly auto-update rolled us, not a button. There
+    // is nothing to close; the outcome goes into capabilities instead, which the
+    // next heartbeat (seconds away) carries to the AiNode page.
+    if (!h.command_id) {
+        (0, auto_update_1.recordAutoRoll)({ from: h.from_version, to: VERSION, ...(missed ? { wanted } : {}) });
+        console.log(missed
+            ? `[auto-update] restarted, but came up as ${VERSION} (wanted ${wanted})`
+            : `[auto-update] back up as ${VERSION} (was ${h.from_version})`);
+        return;
+    }
     try {
         await (0, supabase_client_1.rpc)('runtime_command_update', {
             p_token: t,

package/dist/machine-metrics.d.ts

@@ -0,0 +1,72 @@
+import * as os from 'os';
+export interface MachineSample {
+    /** Logical cores. */
+    cpus?: number;
+    /** Physical memory, MB. */
+    mem_total_mb?: number;
+    /** Memory in use, 0-100. */
+    mem_used_pct?: number;
+    /** Processor busy across all cores since the previous sample, 0-100.
+     *  Absent on the first sample of a daemon's life — there is nothing to
+     *  measure against yet, and a made-up first value would be a lie that
+     *  lands in a graph. */
+    cpu_used_pct?: number;
+    /** 1-minute load average per core. Zero on Windows, where the OS has no
+     *  such concept and Node reports [0,0,0]. */
+    load_per_cpu?: number;
+    /** Scratch volume in use, 0-100 — the same signal the health gate refuses
+     *  new runs on at 97%. A filling disk is the failure that has actually
+     *  bitten prod, so it belongs on the same timeline as the rest. */
+    disk_used_pct?: number;
+    /** Agent runs this node was holding at the moment of the sample. Turns
+     *  "the box was pinned at 90%" into "because it was running four things". */
+    runs?: number;
+    /** Seconds since the machine booted. */
+    uptime_s?: number;
+}
+export interface CpuTimes {
+    idle: number;
+    total: number;
+}
+/**
+ * Smallest interval, in summed CPU-milliseconds across all cores, we will
+ * report a busy figure for.
+ *
+ * Without a floor, two readings a millisecond apart can straddle a single
+ * scheduler tick: idle advances by 0, total by ~1, and the honest arithmetic
+ * says 100% busy. That is noise, not measurement, and it lands in the graph as
+ * a spike that never happened — which is exactly how it was found, by a test
+ * that took two samples back to back and got 100 roughly one run in twelve.
+ *
+ * 100ms across all cores is ~12ms of wall time on an 8-core box, far below the
+ * 30s heartbeat this actually runs at, so no real sample is ever refused.
+ */
+export declare const MIN_SAMPLE_MS = 100;
+/** Summed CPU time across every core, in the units Node reports. */
+export declare function readCpuTimes(cpus: os.CpuInfo[]): CpuTimes;
+/**
+ * Busy percentage between two cumulative readings.
+ *
+ * Deliberately delta-based rather than derived from loadavg: load is a queue
+ * length, not a utilisation, it means different things on different kernels,
+ * and on Windows it is always zero. Deltas of the counters Node already
+ * exposes give a real 0-100 on every platform we run on.
+ *
+ * Returns null when the comparison is meaningless — no previous reading, or a
+ * total that did not advance (same tick) or went backwards (core count
+ * changed under us, a VM migrated). A null is "we don't know", which the graph
+ * shows as a gap; inventing 0% would draw an idle machine that wasn't.
+ */
+export declare function cpuUsedPct(prev: CpuTimes | null, now: CpuTimes): number | null;
+/** Memory in use as a percentage. Note this counts the page cache as used on
+ *  Linux, the same way `free` does before you read the -/+ buffers line — it
+ *  is the number every other tool shows, so it is the one to match. */
+export declare function memUsedPct(totalBytes: number, freeBytes: number): number | null;
+export declare function setRunsInFlightHook(fn: () => number): void;
+/** Reset between tests. */
+export declare function resetCpuBaseline(): void;
+/**
+ * One reading of the machine. Never throws: every field is independently
+ * best-effort, and a sample with holes in it beats no heartbeat at all.
+ */
+export declare function sampleMachine(): MachineSample;

package/dist/machine-metrics.js

@@ -0,0 +1,175 @@
+"use strict";
+// What the machine underneath the daemon is actually doing.
+//
+// Entity Studio's AiNode page has read `capabilities.machine` for cores,
+// memory, load and uptime since it was written — but no version of this daemon
+// has ever produced that key, so those readouts have always been dashes and
+// the Memory tile has always silently fallen back to showing the pairing date.
+// This is the producing half.
+//
+// Sampled on the capabilities probe (every heartbeat, ~30s). Everything here
+// is cheap and synchronous: three `os` calls and one statfs. Nothing may throw
+// — a metrics failure must never cost the heartbeat, because the heartbeat is
+// what keeps the node marked online.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_SAMPLE_MS = void 0;
+exports.readCpuTimes = readCpuTimes;
+exports.cpuUsedPct = cpuUsedPct;
+exports.memUsedPct = memUsedPct;
+exports.setRunsInFlightHook = setRunsInFlightHook;
+exports.resetCpuBaseline = resetCpuBaseline;
+exports.sampleMachine = sampleMachine;
+const os = __importStar(require("os"));
+const node_health_1 = require("./node-health");
+const paths_1 = require("./paths");
+/**
+ * Smallest interval, in summed CPU-milliseconds across all cores, we will
+ * report a busy figure for.
+ *
+ * Without a floor, two readings a millisecond apart can straddle a single
+ * scheduler tick: idle advances by 0, total by ~1, and the honest arithmetic
+ * says 100% busy. That is noise, not measurement, and it lands in the graph as
+ * a spike that never happened — which is exactly how it was found, by a test
+ * that took two samples back to back and got 100 roughly one run in twelve.
+ *
+ * 100ms across all cores is ~12ms of wall time on an 8-core box, far below the
+ * 30s heartbeat this actually runs at, so no real sample is ever refused.
+ */
+exports.MIN_SAMPLE_MS = 100;
+/** Summed CPU time across every core, in the units Node reports. */
+function readCpuTimes(cpus) {
+    let idle = 0;
+    let total = 0;
+    for (const c of cpus) {
+        for (const key of Object.keys(c.times)) {
+            total += c.times[key];
+        }
+        idle += c.times.idle;
+    }
+    return { idle, total };
+}
+/**
+ * Busy percentage between two cumulative readings.
+ *
+ * Deliberately delta-based rather than derived from loadavg: load is a queue
+ * length, not a utilisation, it means different things on different kernels,
+ * and on Windows it is always zero. Deltas of the counters Node already
+ * exposes give a real 0-100 on every platform we run on.
+ *
+ * Returns null when the comparison is meaningless — no previous reading, or a
+ * total that did not advance (same tick) or went backwards (core count
+ * changed under us, a VM migrated). A null is "we don't know", which the graph
+ * shows as a gap; inventing 0% would draw an idle machine that wasn't.
+ */
+function cpuUsedPct(prev, now) {
+    if (!prev)
+        return null;
+    const total = now.total - prev.total;
+    const idle = now.idle - prev.idle;
+    if (total < exports.MIN_SAMPLE_MS || idle < 0)
+        return null;
+    const pct = (1 - idle / total) * 100;
+    return Math.max(0, Math.min(100, Math.round(pct * 10) / 10));
+}
+/** Memory in use as a percentage. Note this counts the page cache as used on
+ *  Linux, the same way `free` does before you read the -/+ buffers line — it
+ *  is the number every other tool shows, so it is the one to match. */
+function memUsedPct(totalBytes, freeBytes) {
+    if (!Number.isFinite(totalBytes) || totalBytes <= 0)
+        return null;
+    const pct = (1 - freeBytes / totalBytes) * 100;
+    return Math.max(0, Math.min(100, Math.round(pct * 10) / 10));
+}
+/* ── live sampling ────────────────────────────────────────────────────── */
+let prevCpu = null;
+/** How many runs this node is holding. Wired by index.ts rather than imported,
+ *  so capabilities.ts does not have to pull in request-pump (and through it
+ *  session-runner) just to count them. */
+let runsInFlight = null;
+function setRunsInFlightHook(fn) { runsInFlight = fn; }
+/** Reset between tests. */
+function resetCpuBaseline() { prevCpu = null; }
+/**
+ * One reading of the machine. Never throws: every field is independently
+ * best-effort, and a sample with holes in it beats no heartbeat at all.
+ */
+function sampleMachine() {
+    const s = {};
+    try {
+        const cpus = os.cpus();
+        if (cpus.length > 0) {
+            s.cpus = cpus.length;
+            const now = readCpuTimes(cpus);
+            const pct = cpuUsedPct(prevCpu, now);
+            if (pct !== null)
+                s.cpu_used_pct = pct;
+            prevCpu = now;
+        }
+    }
+    catch { /* no cpu info — the other fields still stand */ }
+    try {
+        const total = os.totalmem();
+        s.mem_total_mb = Math.round(total / (1024 * 1024));
+        const pct = memUsedPct(total, os.freemem());
+        if (pct !== null)
+            s.mem_used_pct = pct;
+    }
+    catch { /* skip */ }
+    try {
+        const [one] = os.loadavg();
+        const cores = s.cpus ?? 0;
+        if (cores > 0 && Number.isFinite(one))
+            s.load_per_cpu = Math.round((one / cores) * 100) / 100;
+    }
+    catch { /* skip */ }
+    try {
+        const disk = (0, node_health_1.readDiskUsedPct)(paths_1.RUNTIME_HOME);
+        if (disk !== null)
+            s.disk_used_pct = Math.round(disk * 10) / 10;
+    }
+    catch { /* skip */ }
+    try {
+        s.runs = runsInFlight?.() ?? 0;
+    }
+    catch {
+        s.runs = 0;
+    }
+    try {
+        s.uptime_s = Math.round(os.uptime());
+    }
+    catch { /* skip */ }
+    return s;
+}

package/dist/self-update.d.ts

@@ -53,6 +53,23 @@ export interface RollPlan {
     /** Non-null = refuse before anything drains, with this explanation. */
     refusal: string | null;
 }
+/**
+ * Is this something we are willing to hand to `npm i -g @addai/node@…`?
+ *
+ * npm accepts far more than a version after the `@`: a tarball URL, a
+ * `github:user/repo`, a `file:` path — each of which installs code of the
+ * caller's choosing, which this daemon then re-execs as its own binary. A
+ * remotely-supplied spec is therefore restricted to a plain semver or a
+ * dist-tag, and everything else is refused before npm is ever invoked.
+ *
+ * This is the second lock. The first is the RLS policy on runtime_commands,
+ * which was found comparing `input ->> 'restart_only'` (text) while this file
+ * compared `=== true` (boolean) — so the string "true" read as a harmless
+ * restart to the database and as a roll-to-anything here, giving anyone a node
+ * was merely SHARED with arbitrary code execution on the owner's machine.
+ * The policy is fixed; this makes the same mistake unexploitable next time.
+ */
+export declare function isSafeVersionSpec(v: string): boolean;
 /**
  * Read an `update_runtime` command's input into what this node should do.
  *
@@ -67,7 +84,12 @@ export declare function planRoll(input: {
     restart_only?: boolean;
 } | null, mode: LaunchMode, currentVersion: string): RollPlan;
 export interface RestartHandoff {
-    command_id: string;
+    /** Absent when the roll was the hourly auto-update rather than a button:
+     *  there is no command to close, so the daemon that comes up records the
+     *  outcome in capabilities instead. The property that matters survives
+     *  either way — it is the NEW process that reports, so a restart that
+     *  never comes back still never reports success. */
+    command_id?: string;
     from_version: string;
     target_version: string;
     mode: LaunchMode;
@@ -87,11 +109,27 @@ export declare function writeHandoff(runtimeDir: string, h: RestartHandoff): voi
 /** Reads and DELETES the handoff — it must never be replayed twice. */
 export declare function takeHandoff(runtimeDir: string): RestartHandoff | null;
 /**
- * `npm i -g <pkg>@<version>`. Returns null on success, else the reason.
+ * `npm i -g <spec>` for any package. Returns null on success, else the reason.
  * Never throws — a failed install must leave the CURRENT daemon running
  * rather than take the node down.
+ *
+ * On a classic Mac with a root-owned /usr/local prefix the first attempt dies
+ * EACCES, so we retry into the daemon's own prefix — the same fallback
+ * command-runner's interactive install uses, and the same one the binary
+ * finders already search. Without it, auto-update would fail silently forever
+ * on exactly the nodes that needed a human least.
  */
+export declare function npmInstallGlobal(spec: string, timeoutMs?: number): Promise<string | null>;
+/** `npm i -g @addai/node@<version>`. Thin wrapper kept for the roll paths. */
 export declare function installGlobal(targetVersion: string, timeoutMs?: number): Promise<string | null>;
+/**
+ * What npm currently calls `latest` for a package, or null if we couldn't ask.
+ *
+ * Null is deliberately NOT treated as "up to date" by callers — it means the
+ * question went unanswered (offline, registry blip), and an unanswered
+ * question must never masquerade as a clean bill of health.
+ */
+export declare function npmLatestVersion(pkg: string, timeoutMs?: number): Promise<string | null>;
 /**
  * Spawn the replacement daemon fully detached, so it survives this process's
  * exit. stdio is redirected to the daemon log (inheriting our stdio would tie

package/dist/self-update.js

@@ -55,16 +55,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PACKAGE_NAME = void 0;
 exports.detectLaunchMode = detectLaunchMode;
 exports.planRespawn = planRespawn;
+exports.isSafeVersionSpec = isSafeVersionSpec;
 exports.planRoll = planRoll;
 exports.handoffPath = handoffPath;
 exports.writeHandoff = writeHandoff;
 exports.takeHandoff = takeHandoff;
+exports.npmInstallGlobal = npmInstallGlobal;
 exports.installGlobal = installGlobal;
+exports.npmLatestVersion = npmLatestVersion;
 exports.spawnReplacement = spawnReplacement;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const win_1 = require("./win");
+const paths_1 = require("./paths");
 exports.PACKAGE_NAME = '@addai/node';
 /**
  * Classify the launch from the running script's path.
@@ -113,6 +117,29 @@ userArgs = []) {
         canChangeVersion: mode === 'global',
     };
 }
+/**
+ * Is this something we are willing to hand to `npm i -g @addai/node@…`?
+ *
+ * npm accepts far more than a version after the `@`: a tarball URL, a
+ * `github:user/repo`, a `file:` path — each of which installs code of the
+ * caller's choosing, which this daemon then re-execs as its own binary. A
+ * remotely-supplied spec is therefore restricted to a plain semver or a
+ * dist-tag, and everything else is refused before npm is ever invoked.
+ *
+ * This is the second lock. The first is the RLS policy on runtime_commands,
+ * which was found comparing `input ->> 'restart_only'` (text) while this file
+ * compared `=== true` (boolean) — so the string "true" read as a harmless
+ * restart to the database and as a roll-to-anything here, giving anyone a node
+ * was merely SHARED with arbitrary code execution on the owner's machine.
+ * The policy is fixed; this makes the same mistake unexploitable next time.
+ */
+function isSafeVersionSpec(v) {
+    // 1.2.3 / 1.2.3-beta.1
+    if (/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(v))
+        return true;
+    // a dist-tag: latest, next, canary…
+    return /^[a-z][a-z0-9-]{0,31}$/.test(v);
+}
 /**
  * Read an `update_runtime` command's input into what this node should do.
  *
@@ -128,9 +155,11 @@ function planRoll(input, mode, currentVersion) {
     // "did we come up as what was asked for?" check meaningful instead of
     // special-cased — and pins npx, whose cache dir is per-version.
     const target = restartOnly ? currentVersion : (input?.version ?? '').trim() || 'latest';
-    const refusal = !restartOnly && mode === 'source' && target !== 'latest'
-        ? 'this node runs from a source checkout — pull and rebuild it there; a remote version bump cannot apply'
-        : null;
+    const refusal = !restartOnly && !isSafeVersionSpec(target)
+        ? `refusing to install "${target}" — a remote roll may name a version or a dist-tag, nothing else`
+        : !restartOnly && mode === 'source' && target !== 'latest'
+            ? 'this node runs from a source checkout — pull and rebuild it there; a remote version bump cannot apply'
+            : null;
     return { target, restartOnly, refusal };
 }
 function handoffPath(runtimeDir) {
@@ -150,22 +179,85 @@ function takeHandoff(runtimeDir) {
         }
         catch { /* already gone */ }
         const parsed = JSON.parse(raw);
-        return parsed && typeof parsed.command_id === 'string' ? parsed : null;
+        // A handoff with no command_id is the auto-update shape, so the id can no
+        // longer be what proves the file is one of ours — from_version is.
+        return parsed && typeof parsed.from_version === 'string' ? parsed : null;
     }
     catch {
         return null;
     }
 }
+/** One `npm i -g` attempt. Resolves the failure reason, or null on success. */
+function npmInstallAttempt(spec, prefix, timeoutMs) {
+    const args = ['i', '-g', ...(prefix ? ['--prefix', prefix] : []), spec];
+    const inv = (0, win_1.resolveCliInvocation)('npm', args);
+    return new Promise((resolve) => {
+        let log = '';
+        let settled = false;
+        const done = (err) => { if (!settled) {
+            settled = true;
+            resolve({ err, log });
+        } };
+        try {
+            const child = (0, child_process_1.spawn)(inv.file, inv.args, { windowsHide: true, env: process.env });
+            const timer = setTimeout(() => { try {
+                child.kill('SIGKILL');
+            }
+            catch { /* gone */ } done(`npm i -g ${spec} timed out`); }, timeoutMs);
+            timer.unref?.();
+            child.stdout?.on('data', b => { log += b.toString('utf8'); });
+            child.stderr?.on('data', b => { log += b.toString('utf8'); });
+            child.on('error', err => { clearTimeout(timer); done(`npm i -g failed to start: ${err.message}`); });
+            child.on('exit', code => {
+                clearTimeout(timer);
+                done(code === 0 ? null : `npm i -g ${spec} exited ${code}: ${log.trim().slice(-400)}`);
+            });
+        }
+        catch (err) {
+            done(`npm i -g failed to start: ${err.message}`);
+        }
+    });
+}
 /**
- * `npm i -g <pkg>@<version>`. Returns null on success, else the reason.
+ * `npm i -g <spec>` for any package. Returns null on success, else the reason.
  * Never throws — a failed install must leave the CURRENT daemon running
  * rather than take the node down.
+ *
+ * On a classic Mac with a root-owned /usr/local prefix the first attempt dies
+ * EACCES, so we retry into the daemon's own prefix — the same fallback
+ * command-runner's interactive install uses, and the same one the binary
+ * finders already search. Without it, auto-update would fail silently forever
+ * on exactly the nodes that needed a human least.
  */
+async function npmInstallGlobal(spec, timeoutMs = 5 * 60_000) {
+    const first = await npmInstallAttempt(spec, null, timeoutMs);
+    if (!first.err)
+        return null;
+    if (!/EACCES/.test(first.log))
+        return first.err;
+    const toolsPrefix = path.join(paths_1.RUNTIME_HOME, 'tools');
+    try {
+        fs.mkdirSync(toolsPrefix, { recursive: true });
+    }
+    catch { /* the spawn will surface it */ }
+    const retry = await npmInstallAttempt(spec, toolsPrefix, timeoutMs);
+    return retry.err;
+}
+/** `npm i -g @addai/node@<version>`. Thin wrapper kept for the roll paths. */
 async function installGlobal(targetVersion, timeoutMs = 5 * 60_000) {
-    const spec = `${exports.PACKAGE_NAME}@${targetVersion || 'latest'}`;
-    const inv = (0, win_1.resolveCliInvocation)('npm', ['i', '-g', spec]);
+    return npmInstallGlobal(`${exports.PACKAGE_NAME}@${targetVersion || 'latest'}`, timeoutMs);
+}
+/**
+ * What npm currently calls `latest` for a package, or null if we couldn't ask.
+ *
+ * Null is deliberately NOT treated as "up to date" by callers — it means the
+ * question went unanswered (offline, registry blip), and an unanswered
+ * question must never masquerade as a clean bill of health.
+ */
+function npmLatestVersion(pkg, timeoutMs = 60_000) {
+    const inv = (0, win_1.resolveCliInvocation)('npm', ['view', pkg, 'version']);
     return new Promise((resolve) => {
-        let stderr = '';
+        let out = '';
         let settled = false;
         const done = (v) => { if (!settled) {
             settled = true;
@@ -176,17 +268,18 @@ async function installGlobal(targetVersion, timeoutMs = 5 * 60_000) {
             const timer = setTimeout(() => { try {
                 child.kill('SIGKILL');
             }
-            catch { /* gone */ } done(`npm i -g ${spec} timed out`); }, timeoutMs);
+            catch { /* gone */ } done(null); }, timeoutMs);
             timer.unref?.();
-            child.stderr?.on('data', b => { stderr += b.toString('utf8'); });
-            child.on('error', err => { clearTimeout(timer); done(`npm i -g failed to start: ${err.message}`); });
+            child.stdout?.on('data', b => { out += b.toString('utf8'); });
+            child.on('error', () => { clearTimeout(timer); done(null); });
             child.on('exit', code => {
                 clearTimeout(timer);
-                done(code === 0 ? null : `npm i -g ${spec} exited ${code}: ${stderr.trim().slice(-400)}`);
+                const v = out.trim();
+                done(code === 0 && /^\d+\.\d+\.\d+/.test(v) ? v : null);
             });
         }
-        catch (err) {
-            done(`npm i -g failed to start: ${err.message}`);
+        catch {
+            done(null);
         }
     });
 }

package/dist/store.d.ts

@@ -1,5 +1,8 @@
 import type { RuntimePairingState } from './types';
 export declare function readPairing(): RuntimePairingState | null;
 export declare function writePairing(state: RuntimePairingState): void;
-export declare function clearPairing(): void;
+export declare function clearPairing(opts?: {
+    stateFile?: string;
+    legacy?: string;
+}): void;
 export declare function isPaired(): boolean;

package/dist/store.js

@@ -43,6 +43,7 @@ exports.writePairing = writePairing;
 exports.clearPairing = clearPairing;
 exports.isPaired = isPaired;
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const paths_1 = require("./paths");
 const win_1 = require("./win");
 function ensureHome() {
@@ -71,11 +72,30 @@ function writePairing(state) {
     // rename-over-open-file fails EPERM/EBUSY on Windows — retried there.
     (0, win_1.safeRenameSync)(tmp, paths_1.RUNTIME_STATE_FILE);
 }
-function clearPairing() {
+// `opts` exists so this is testable without touching the real home — same
+// injection migrateLegacyStateDir takes, for the same reason.
+function clearPairing(opts = {}) {
+    const stateFile = opts.stateFile ?? paths_1.RUNTIME_STATE_FILE;
+    const legacy = opts.legacy ?? paths_1.LEGACY_RUNTIME_HOME;
     try {
-        fs.unlinkSync(paths_1.RUNTIME_STATE_FILE);
+        fs.unlinkSync(stateFile);
     }
     catch { /* already gone */ }
+    // The legacy home too. state-migrate COPIES ~/.entities-runtime/state.json
+    // into the new home rather than moving it, so the old file outlives the
+    // rename on purpose — but nothing ever cleaned it up, and the migration
+    // only skips when the new home already has a state.json. Deleting just the
+    // new copy therefore didn't unpair anything: the next start copied the old
+    // token straight back in, the daemon believed it was already paired (so an
+    // explicit `ainode entities <CODE>` never ran the pairing flow at all), the
+    // server rejected the dead token, and it cleared state again. That loop
+    // survived three releases on a real machine before we found it.
+    //
+    // Unpairing means unpaired. Both copies go.
+    try {
+        fs.unlinkSync(path.join(legacy, 'state.json'));
+    }
+    catch { /* no legacy home, or already gone */ }
 }
 function isPaired() {
     return readPairing() !== null;

package/dist/tui/dashboard.js

@@ -244,6 +244,14 @@ function createDashboardScreen(deps) {
         if (recent.length)
             st.recent = recent;
         st.offline = deps.data.offline();
+        // The server can unpair a node out from under a running daemon — the
+        // machine removed from the fleet, or its token revoked. The heartbeat
+        // notices and clears the local pairing, but this screen was reading
+        // `paired` once at startup, so it kept showing the old stats and a header
+        // that said Online while every call underneath it came back unauthorized.
+        // Re-read it: a node that has lost its pairing should say so and tell you
+        // how to come back, not sit there looking healthy and empty.
+        st.paired = (0, store_1.isPaired)();
         // A selected run that has finished is no longer in the band. nowIndex
         // already reads that as "cursor is in the menu"; drop the id too so the
         // state doesn't keep pointing at a run nobody can see.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [