@cabane/companion 0.6.158 → 0.6.159

package/README.md

@@ -106,7 +106,7 @@ A freshly paired device runs nothing yet: pairing doesn't put any agent on it. I
 | `pair [--server <url>]`                  | Pair this device with a short code entered in Cabane, without starting the Companion. Refuses, like `start`, until an agent is signed in. `start` pairs by itself, so `pair` is rarely needed.                                                                                                                                      |
 | `start [--foreground] [--daemon]`        | Offer the signed-in agents, pair if needed, and run in the background; refuse, pairing nothing, when none is usable. `--daemon` is an accepted compatibility alias for the default. `--foreground` stays attached for a terminal or supervisor and never refuses. A non-interactive `start` on a paired device also stays attached. |
 | `connect <claude-code\|codex\|opencode>` | Connect a signed-in agent; with the Companion running, it checks and connects over its control socket, no restart. Refuses a signed-out agent and changes nothing.                                                                                                                                                                  |
-| `update [--auto on\|off]`                | Update to the version Cabane names now, between turns; with `--auto`, set whether the Companion keeps itself up to date.                                                                                                                                                                                                            |
+| `update [--auto on\|off]`                | Update to the version Cabane names now; with `--auto`, set whether the Companion keeps itself up to date.                                                                                                                                                                                                                           |
 | `service install\|uninstall\|status`     | Run the Companion as a systemd user service or a LaunchAgent that starts at boot and restarts if it stops; remove it; show its state and how updates are going.                                                                                                                                                                     |
 | `stop`                                   | Stop a foreground or detached Companion cleanly. Idempotent — "nothing running" is a success.                                                                                                                                                                                                                                       |
 | `status`                                 | Print the version and install, the paired device, whether it's running, each agent's sign-in, log and transcript paths, declared secret names, and local overrides. Works unpaired.                                                                                                                                                 |
@@ -134,7 +134,7 @@ In an interactive terminal, `cabane start` backgrounds itself, returns the promp
 
 Yes, or `cabane service install` later, runs it as a service: a systemd user unit (`~/.config/systemd/user/cabane-companion.service`) on Linux, a LaunchAgent (`~/Library/LaunchAgents/ai.cabane.companion.plist`) on macOS, with auto-update on. It runs `<node> ~/.cabane/boot-guard.mjs start --foreground` on its own copy of this install under `~/.cabane/versions`, restarts it whatever it exits with, and reads `~/.cabane/service.env`, which holds your login shell's PATH and any headless sign-in (`CLAUDE_CODE_OAUTH_TOKEN=…`). `<node>` is the install script's `~/.cabane/node/bin/node` when it's there, otherwise the Node that ran `service install`; `cabane service status` says if it's gone. On Linux it tells you when lingering is off and a logout would stop it. With a service installed, `cabane start` and `cabane stop` start and stop the service; `cabane service uninstall` removes it.
 
-Updates need the service: it's what restarts the Companion into a new version. The Companion follows the version Cabane names on each heartbeat: it installs it under `~/.cabane/versions/<version>`, checks it starts and still has the bundled agents this device uses, points `~/.cabane/current` at it between turns, and exits for the service to restart it. A version that stops three times before connecting, or can't connect within ten minutes of Cabane answering, is rolled back by the boot guard. `cabane update --auto off|on` stops or resumes updates under the service. Without the service, `cabane update` installs the latest version and the next `cabane start` runs it.
+Updates need the service: it's what restarts the Companion into a new version. The Companion follows the version Cabane names on each heartbeat: it installs it under `~/.cabane/versions/<version>`, checks it starts and still has the bundled agents this device uses, points `~/.cabane/current` at it, and exits for the service to restart it. That happens between turns, or after ten minutes if the Companion never stops working, in which case the turns it cuts carry on after the restart. A version below the minimum Cabane accepts swaps at once. A version that stops three times before connecting, or can't connect within ten minutes of Cabane answering, is rolled back by the boot guard. `cabane update --auto off|on` stops or resumes updates under the service. Without the service, `cabane update` installs the latest version and the next `cabane start` runs it.
 
 ### Other supervisors
 

package/dist/cli.js

@@ -15433,6 +15433,8 @@ var SseSubscriber = class {
   opts;
   aborted = false;
   controller = null;
+  // Ends the reconnect backoff early, so a stop never waits out a sleep of up to 30 s.
+  wake = null;
   lastEventId;
   // Set after `start()`; resolved when the subscriber loop exits (either
   // because `stop()` was called or because an auth failure tore it down).
@@ -15443,12 +15445,7 @@ var SseSubscriber = class {
   stop() {
     this.aborted = true;
     this.controller?.abort();
-  }
-  // Connect again after a `stop()`, once its loop has exited.
-  async resume() {
-    await this.finished;
-    this.aborted = false;
-    this.start();
+    this.wake?.();
   }
   setCursor(eventId) {
     this.lastEventId = eventId;
@@ -15461,7 +15458,7 @@ var SseSubscriber = class {
         backoff = 500;
         if (!this.aborted) {
           this.opts.log.warn("Lost the connection to Cabane; reconnecting");
-          await sleep4(backoff);
+          await this.backoff(backoff);
         }
       } catch (err) {
         if (this.aborted) return;
@@ -15481,11 +15478,21 @@ var SseSubscriber = class {
           },
           "Lost the connection to Cabane; reconnecting"
         );
-        await sleep4(backoff);
+        await this.backoff(backoff);
         backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
       }
     }
   }
+  backoff(ms) {
+    return new Promise((resolve2) => {
+      const timer = setTimeout(done, ms);
+      this.wake = done;
+      function done() {
+        clearTimeout(timer);
+        resolve2();
+      }
+    });
+  }
   async connect() {
     const base = this.opts.baseUrl.endsWith("/") ? this.opts.baseUrl.slice(0, -1) : this.opts.baseUrl;
     const url = `${base}${this.opts.path}`;
@@ -15532,9 +15539,6 @@ var SseSubscriber = class {
     }
   }
 };
-function sleep4(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
 
 // src/supervisor.ts
 init_transcript_writer();
@@ -15717,7 +15721,7 @@ function updateMode(env = process.env) {
   return env.CABANE_COMPANION_SUPERVISED === "1" ? "supervised" : "attached";
 }
 var STAGE_RETRY_MS = 60 * 6e4;
-var SWAP_DRAIN_MS = 1e4;
+var SWAP_WAIT_MS = 10 * 6e4;
 var SOURCE_BUILD_VERSION = "0.0.0";
 function versionToStage(input) {
   const { own, state, now, force } = input;
@@ -15867,6 +15871,8 @@ var CompanionUpdater = class {
   deps;
   staging = null;
   ready = null;
+  // When `ready` verified; `SWAP_WAIT_MS` counts from here.
+  readyAt = 0;
   swapping = false;
   watchdog = null;
   now;
@@ -15965,7 +15971,7 @@ var CompanionUpdater = class {
       return { ok: true, message: `Cabane ${this.deps.own} is up to date.` };
     if (state.pending?.to === latest) return { ok: true, message: this.waitingMessage(latest) };
     if (this.ready === latest) {
-      void this.trySwap();
+      void this.trySwap(true);
       return { ok: true, message: this.waitingMessage(latest) };
     }
     this.maybeStage(true);
@@ -15981,13 +15987,14 @@ var CompanionUpdater = class {
         message: failed?.kind === "failed" && failed.to === latest ? `Couldn't update to ${latest}: ${failed.reason ?? "see cabane logs"}.` : `Couldn't update to ${latest}. cabane logs says why.`
       };
     }
-    void this.trySwap();
+    void this.trySwap(true);
     return { ok: true, message: this.waitingMessage(latest) };
   }
+  // Only the person's `cabane update` asks, and that swaps at once.
   waitingMessage(version) {
     if (this.deps.mode === "attached")
       return `Cabane ${version} is installed. It runs from the next  cabane start.`;
-    return this.deps.isIdle() ? `Updating to ${version} now.` : `Updating to ${version} once the turns running now finish.`;
+    return this.deps.isIdle() ? `Updating to ${version} now.` : `Updating to ${version} now. The turns running now carry on after the restart.`;
   }
   maybeStage(force) {
     if (this.staging) return;
@@ -16005,6 +16012,7 @@ var CompanionUpdater = class {
       const outcome = await stage(version, this.deps.harnesses());
       if (outcome.ok) {
         this.ready = version;
+        this.readyAt = this.now();
         updateUpdateState((s) => {
           const { failed: _failed, ...rest } = s;
           return rest;
@@ -16043,8 +16051,10 @@ var CompanionUpdater = class {
     });
     void this.staging.then(() => this.trySwap());
   }
-  // Swap into the ready version once nothing is running. Called on each heartbeat until it can.
-  async trySwap() {
+  // Swap into the ready version: when nothing is running, when it has waited `SWAP_WAIT_MS` for
+  // that, when this version is below the server's minimum, or `now` (the person asked). Called on
+  // each heartbeat until it does.
+  async trySwap(now = false) {
     const to = this.ready;
     if (!to || this.swapping) return;
     if (readUpdateState().pending) return;
@@ -16053,18 +16063,9 @@ var CompanionUpdater = class {
       this.deps.log.info({ version: to }, `Cabane ${to} is installed; it runs from the next start`);
       return;
     }
-    if (!this.deps.isIdle()) return;
+    if (!now && !this.deps.isIdle() && !this.waitedLongEnough() && !this.belowMinimum()) return;
     this.swapping = true;
     try {
-      await this.deps.pauseStream();
-      const sleep5 = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-      const deadline = this.now() + SWAP_DRAIN_MS;
-      await sleep5(250);
-      while (!this.deps.isIdle() && this.now() < deadline) await sleep5(250);
-      if (!this.deps.isIdle()) {
-        this.deps.resumeStream();
-        return;
-      }
       this.select(to);
       this.deps.log.info({ from: this.deps.own, to }, `Restarting into Cabane ${to}`);
       await this.deps.restart();
@@ -16072,6 +16073,14 @@ var CompanionUpdater = class {
       this.swapping = false;
     }
   }
+  waitedLongEnough() {
+    return this.now() - this.readyAt >= SWAP_WAIT_MS;
+  }
+  // Cabane refuses this version's turns: waiting would only turn them away.
+  belowMinimum() {
+    const minimum = readUpdateState().server?.minimum;
+    return !!minimum && compareVersions(this.deps.own, minimum) < 0;
+  }
   // Record the swap and point `current` at `to`, leaving the guard that counts its starts.
   select(to) {
     const fromRoot = currentRoot() ?? ownPackageRoot();
@@ -16096,6 +16105,7 @@ init_version2();
 init_src();
 var HEARTBEAT_INTERVAL_MS = 3e4;
 var ARCHIVE_PRUNE_MS = 24 * 60 * 6e4;
+var FORCE_EXIT_MS = 4e3;
 var SHUTDOWN_HEARTBEAT_WAIT_MS = 1e3;
 function positiveIntEnv(name) {
   const raw = process.env[name];
@@ -16316,14 +16326,7 @@ var CompanionSupervisor = class {
       autoUpdate: () => this.config.update?.auto === true,
       harnesses: () => this.connectedBundledHarnesses(),
       isIdle: () => this.idle(),
-      pauseStream: async () => {
-        const sub = this.deviceSub;
-        if (!sub) return;
-        sub.stop();
-        await sub.finished;
-      },
-      resumeStream: () => void this.deviceSub?.resume(),
-      restart: () => this.restartForUpdate(),
+      restart: () => this.restartBounded(),
       log: this.log
     });
     this.updater.start();
@@ -17445,8 +17448,22 @@ var CompanionSupervisor = class {
       );
     }
   }
+  // The update's restart, held to the same `FORCE_EXIT_MS` a signal's stop gets. Exit 0: the
+  // swap is recorded and `current` names the new version, so the service starts it either way.
+  async restartBounded() {
+    const force = setTimeout(() => {
+      this.log.warn({ ms: FORCE_EXIT_MS }, "Restarting for the update: shutdown took too long");
+      this.exitFn(0);
+    }, FORCE_EXIT_MS);
+    force.unref?.();
+    try {
+      await this.restartForUpdate();
+    } finally {
+      clearTimeout(force);
+    }
+  }
   // Nothing running and nothing about to: no dispatch claimed, no turn chained, no recovery
-  // in progress. What a self-update swap waits for.
+  // in progress. What a self-update swap waits for, up to `SWAP_WAIT_MS`.
   idle() {
     if (this.claims.size > 0 || this.recovering) return false;
     for (const wr of this.workspaces.values()) if (wr.chains.size > 0) return false;
@@ -17468,7 +17485,7 @@ var CompanionSupervisor = class {
       if (auto) this.kickHeartbeat();
       return {
         ok: true,
-        message: auto ? "Cabane will keep itself up to date. Updates install between turns and roll back if they fail." : "Cabane won't update itself. Run  cabane update  to update."
+        message: auto ? "Cabane will keep itself up to date. Updates install between turns when they can, and roll back if they fail." : "Cabane won't update itself. Run  cabane update  to update."
       };
     }
     if (!this.updater) return { ok: false, message: "This computer isn't paired yet." };
@@ -18178,7 +18195,7 @@ async function startDaemon(opts = {}, deps = {}) {
   const readState = deps.readState ?? readLiveRuntimeState;
   const verify = deps.verify ?? ((s) => verifyRuntime(s));
   const spawnDetached = deps.spawnDetached ?? defaultSpawnDetached;
-  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   const quiet = opts.report === "failures";
   const cfg = requireStartConfig({
@@ -18226,7 +18243,7 @@ async function startDaemon(opts = {}, deps = {}) {
     const deadline = now() + STARTUP_TIMEOUT_MS;
     let seen = readState();
     while (!ready(seen) && now() < deadline) {
-      await sleep5(POLL_INTERVAL_MS);
+      await sleep4(POLL_INTERVAL_MS);
       seen = readState();
     }
     return ready(seen) ? seen : null;
@@ -18299,7 +18316,7 @@ async function stop(deps = {}) {
   const readState = deps.readState ?? readLiveRuntimeState;
   const verify = deps.verify ?? ((s) => verifyRuntime(s));
   const kill = deps.kill ?? ((pid2, signal) => process.kill(pid2, signal));
-  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   const state = readState();
   if (!state) {
@@ -18327,7 +18344,7 @@ async function stop(deps = {}) {
       process.stdout.write("companion: stopped.\n");
       return;
     }
-    await sleep5(POLL_INTERVAL_MS2);
+    await sleep4(POLL_INTERVAL_MS2);
   }
   process.stdout.write(
     `companion: didn't exit within ${TERM_GRACE_MS / 1e3}s, sending SIGKILL.
@@ -18353,7 +18370,7 @@ function isAlive(kill, pid) {
 var STARTUP_WAIT_MS = 2e4;
 async function installAndStartService(deps = {}) {
   const readState = deps.readState ?? readLiveRuntimeState;
-  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? Date.now;
   const before = await serviceState(deps);
   const running = readState();
@@ -18369,7 +18386,7 @@ async function installAndStartService(deps = {}) {
   while (now() < deadline) {
     const state = readState();
     if (state?.socket) return true;
-    await sleep5(250);
+    await sleep4(250);
   }
   write(
     `${INDENT}The service is installed but Cabane hasn't come up yet. ${cabane("service status")} and ${cabane("logs")} say why.`
@@ -18383,7 +18400,7 @@ async function serviceInstall(deps = {}) {
   }
   write(
     INDENT + tick(
-      "Cabane runs as a service. It starts at boot, restarts if it stops, and updates itself between turns."
+      "Cabane runs as a service. It starts at boot, restarts if it stops, and updates itself, usually between turns."
     )
   );
   write(`${INDENT}  Status:  ${cabane("service status")}        Logs:  ${cabane("logs")}`);
@@ -18446,7 +18463,7 @@ function updateRows(state, auto, opts = {}) {
   rows.push(
     row(
       "Auto-update",
-      !opts.service ? `off \u2014 runs with the service: ${cabane("service install")}` : auto === true ? "on \u2014 updates install between turns and roll back if they fail" : `off \u2014 ${cabane("update --auto on")} turns it on`
+      !opts.service ? `off \u2014 runs with the service: ${cabane("service install")}` : auto === true ? "on \u2014 updates install between turns when they can, and roll back if they fail" : `off \u2014 ${cabane("update --auto on")} turns it on`
     )
   );
   const last = state.lastResult;
@@ -18477,7 +18494,6 @@ function setRunsAsService(on) {
 }
 
 // src/commands/start.ts
-var FORCE_EXIT_MS = 4e3;
 var MAX_CODES = 3;
 async function start(opts = {}) {
   setLogOverrides(opts);
@@ -18943,7 +18959,7 @@ async function askHowToRun(deps = {}) {
     return { asService: false };
   blank();
   const asService = await ask(
-    "Keep Cabane running and up to date on this computer? It starts at boot, restarts if it stops, and updates itself between turns."
+    "Keep Cabane running and up to date on this computer? It starts at boot, restarts if it stops, and updates itself, usually between turns."
   );
   if (!asService) saveConfig({ ...cfg, serviceDeclined: true });
   blank();
@@ -19367,7 +19383,7 @@ async function update(opts = {}) {
     saveConfig({ ...cfg2, update: { auto } });
     write(
       INDENT + tick(
-        auto ? "Cabane will keep itself up to date. Updates install between turns and roll back if they fail." : "Cabane won't update itself."
+        auto ? "Cabane will keep itself up to date. Updates install between turns when they can, and roll back if they fail." : "Cabane won't update itself."
       )
     );
     return;

package/dist/runtime.js

@@ -13281,6 +13281,8 @@ var SseSubscriber = class {
   opts;
   aborted = false;
   controller = null;
+  // Ends the reconnect backoff early, so a stop never waits out a sleep of up to 30 s.
+  wake = null;
   lastEventId;
   // Set after `start()`; resolved when the subscriber loop exits (either
   // because `stop()` was called or because an auth failure tore it down).
@@ -13291,12 +13293,7 @@ var SseSubscriber = class {
   stop() {
     this.aborted = true;
     this.controller?.abort();
-  }
-  // Connect again after a `stop()`, once its loop has exited.
-  async resume() {
-    await this.finished;
-    this.aborted = false;
-    this.start();
+    this.wake?.();
   }
   setCursor(eventId) {
     this.lastEventId = eventId;
@@ -13309,7 +13306,7 @@ var SseSubscriber = class {
         backoff = 500;
         if (!this.aborted) {
           this.opts.log.warn("Lost the connection to Cabane; reconnecting");
-          await sleep3(backoff);
+          await this.backoff(backoff);
         }
       } catch (err) {
         if (this.aborted) return;
@@ -13329,11 +13326,21 @@ var SseSubscriber = class {
           },
           "Lost the connection to Cabane; reconnecting"
         );
-        await sleep3(backoff);
+        await this.backoff(backoff);
         backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
       }
     }
   }
+  backoff(ms) {
+    return new Promise((resolve2) => {
+      const timer = setTimeout(done, ms);
+      this.wake = done;
+      function done() {
+        clearTimeout(timer);
+        resolve2();
+      }
+    });
+  }
   async connect() {
     const base = this.opts.baseUrl.endsWith("/") ? this.opts.baseUrl.slice(0, -1) : this.opts.baseUrl;
     const url = `${base}${this.opts.path}`;
@@ -13380,9 +13387,6 @@ var SseSubscriber = class {
     }
   }
 };
-function sleep3(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
 
 // src/updater.ts
 import { spawn as spawn8 } from "child_process";
@@ -13554,7 +13558,7 @@ function updateMode(env = process.env) {
   return env.CABANE_COMPANION_SUPERVISED === "1" ? "supervised" : "attached";
 }
 var STAGE_RETRY_MS = 60 * 6e4;
-var SWAP_DRAIN_MS = 1e4;
+var SWAP_WAIT_MS = 10 * 6e4;
 var SOURCE_BUILD_VERSION = "0.0.0";
 function versionToStage(input) {
   const { own, state, now, force } = input;
@@ -13704,6 +13708,8 @@ var CompanionUpdater = class {
   deps;
   staging = null;
   ready = null;
+  // When `ready` verified; `SWAP_WAIT_MS` counts from here.
+  readyAt = 0;
   swapping = false;
   watchdog = null;
   now;
@@ -13802,7 +13808,7 @@ var CompanionUpdater = class {
       return { ok: true, message: `Cabane ${this.deps.own} is up to date.` };
     if (state.pending?.to === latest) return { ok: true, message: this.waitingMessage(latest) };
     if (this.ready === latest) {
-      void this.trySwap();
+      void this.trySwap(true);
       return { ok: true, message: this.waitingMessage(latest) };
     }
     this.maybeStage(true);
@@ -13818,13 +13824,14 @@ var CompanionUpdater = class {
         message: failed?.kind === "failed" && failed.to === latest ? `Couldn't update to ${latest}: ${failed.reason ?? "see cabane logs"}.` : `Couldn't update to ${latest}. cabane logs says why.`
       };
     }
-    void this.trySwap();
+    void this.trySwap(true);
     return { ok: true, message: this.waitingMessage(latest) };
   }
+  // Only the person's `cabane update` asks, and that swaps at once.
   waitingMessage(version) {
     if (this.deps.mode === "attached")
       return `Cabane ${version} is installed. It runs from the next  cabane start.`;
-    return this.deps.isIdle() ? `Updating to ${version} now.` : `Updating to ${version} once the turns running now finish.`;
+    return this.deps.isIdle() ? `Updating to ${version} now.` : `Updating to ${version} now. The turns running now carry on after the restart.`;
   }
   maybeStage(force) {
     if (this.staging) return;
@@ -13842,6 +13849,7 @@ var CompanionUpdater = class {
       const outcome = await stage(version, this.deps.harnesses());
       if (outcome.ok) {
         this.ready = version;
+        this.readyAt = this.now();
         updateUpdateState((s) => {
           const { failed: _failed, ...rest } = s;
           return rest;
@@ -13880,8 +13888,10 @@ var CompanionUpdater = class {
     });
     void this.staging.then(() => this.trySwap());
   }
-  // Swap into the ready version once nothing is running. Called on each heartbeat until it can.
-  async trySwap() {
+  // Swap into the ready version: when nothing is running, when it has waited `SWAP_WAIT_MS` for
+  // that, when this version is below the server's minimum, or `now` (the person asked). Called on
+  // each heartbeat until it does.
+  async trySwap(now = false) {
     const to = this.ready;
     if (!to || this.swapping) return;
     if (readUpdateState().pending) return;
@@ -13890,18 +13900,9 @@ var CompanionUpdater = class {
       this.deps.log.info({ version: to }, `Cabane ${to} is installed; it runs from the next start`);
       return;
     }
-    if (!this.deps.isIdle()) return;
+    if (!now && !this.deps.isIdle() && !this.waitedLongEnough() && !this.belowMinimum()) return;
     this.swapping = true;
     try {
-      await this.deps.pauseStream();
-      const sleep4 = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-      const deadline = this.now() + SWAP_DRAIN_MS;
-      await sleep4(250);
-      while (!this.deps.isIdle() && this.now() < deadline) await sleep4(250);
-      if (!this.deps.isIdle()) {
-        this.deps.resumeStream();
-        return;
-      }
       this.select(to);
       this.deps.log.info({ from: this.deps.own, to }, `Restarting into Cabane ${to}`);
       await this.deps.restart();
@@ -13909,6 +13910,14 @@ var CompanionUpdater = class {
       this.swapping = false;
     }
   }
+  waitedLongEnough() {
+    return this.now() - this.readyAt >= SWAP_WAIT_MS;
+  }
+  // Cabane refuses this version's turns: waiting would only turn them away.
+  belowMinimum() {
+    const minimum = readUpdateState().server?.minimum;
+    return !!minimum && compareVersions(this.deps.own, minimum) < 0;
+  }
   // Record the swap and point `current` at `to`, leaving the guard that counts its starts.
   select(to) {
     const fromRoot = currentRoot() ?? ownPackageRoot();
@@ -13936,6 +13945,7 @@ var COMPANION_VERSION = pkg.version;
 // src/supervisor.ts
 var HEARTBEAT_INTERVAL_MS = 3e4;
 var ARCHIVE_PRUNE_MS = 24 * 60 * 6e4;
+var FORCE_EXIT_MS = 4e3;
 var SHUTDOWN_HEARTBEAT_WAIT_MS = 1e3;
 function positiveIntEnv(name) {
   const raw = process.env[name];
@@ -14156,14 +14166,7 @@ var CompanionSupervisor = class {
       autoUpdate: () => this.config.update?.auto === true,
       harnesses: () => this.connectedBundledHarnesses(),
       isIdle: () => this.idle(),
-      pauseStream: async () => {
-        const sub = this.deviceSub;
-        if (!sub) return;
-        sub.stop();
-        await sub.finished;
-      },
-      resumeStream: () => void this.deviceSub?.resume(),
-      restart: () => this.restartForUpdate(),
+      restart: () => this.restartBounded(),
       log: this.log
     });
     this.updater.start();
@@ -15285,8 +15288,22 @@ var CompanionSupervisor = class {
       );
     }
   }
+  // The update's restart, held to the same `FORCE_EXIT_MS` a signal's stop gets. Exit 0: the
+  // swap is recorded and `current` names the new version, so the service starts it either way.
+  async restartBounded() {
+    const force = setTimeout(() => {
+      this.log.warn({ ms: FORCE_EXIT_MS }, "Restarting for the update: shutdown took too long");
+      this.exitFn(0);
+    }, FORCE_EXIT_MS);
+    force.unref?.();
+    try {
+      await this.restartForUpdate();
+    } finally {
+      clearTimeout(force);
+    }
+  }
   // Nothing running and nothing about to: no dispatch claimed, no turn chained, no recovery
-  // in progress. What a self-update swap waits for.
+  // in progress. What a self-update swap waits for, up to `SWAP_WAIT_MS`.
   idle() {
     if (this.claims.size > 0 || this.recovering) return false;
     for (const wr of this.workspaces.values()) if (wr.chains.size > 0) return false;
@@ -15308,7 +15325,7 @@ var CompanionSupervisor = class {
       if (auto) this.kickHeartbeat();
       return {
         ok: true,
-        message: auto ? "Cabane will keep itself up to date. Updates install between turns and roll back if they fail." : "Cabane won't update itself. Run  cabane update  to update."
+        message: auto ? "Cabane will keep itself up to date. Updates install between turns when they can, and roll back if they fail." : "Cabane won't update itself. Run  cabane update  to update."
       };
     }
     if (!this.updater) return { ok: false, message: "This computer isn't paired yet." };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.158",
+  "version": "0.6.159",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",