@dahch/heimdall 1.1.0 → 1.3.0

package/dist/cli.js

@@ -18,6 +18,26 @@ async function commandExists(command) {
     return false;
   }
 }
+var SUDO_REQUIRED_HINT = `Run "sudo -v" in this terminal and retry ("sudo hmd" will not work: hmd is not in root's PATH).`;
+async function ensureSudo() {
+  if (process.getuid?.() === 0) return true;
+  const cachedTicket = await safeExec("sudo", ["-n", "true"], { timeoutMs: 5e3 });
+  if (cachedTicket.success) return true;
+  if (!process.stdin.isTTY || !await commandExists("sudo")) return false;
+  try {
+    const result = await execa("sudo", ["-v"], { stdio: "inherit", reject: false });
+    return result.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+function startSudoKeepAlive(intervalMs = 6e4) {
+  const timer = setInterval(() => {
+    void safeExec("sudo", ["-n", "-v"], { timeoutMs: 1e4 });
+  }, intervalMs);
+  timer.unref();
+  return () => clearInterval(timer);
+}
 async function safeExec(file, args = [], options = {}) {
   const timeout = options.timeoutMs ?? 3e4;
   try {
@@ -140,46 +160,57 @@ var BasePackageManager = class {
   async isAvailable() {
     return commandExists(this.binary);
   }
+  /**
+   * Verifies that sudo can run without a password prompt (cached ticket or NOPASSWD rule),
+   * so privileged steps fail fast instead of hanging inside a stdin-less subprocess.
+   */
+  async hasPasswordlessSudo() {
+    const result = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
+    return result.success;
+  }
   async executeStep(stepName, file, args, options, extraExecOptions) {
-    const startTime = Date.now();
-    options.onStepStart?.(stepName);
-    if (options.dryRun) {
-      options.onStepProgress?.(stepName, `[DRY-RUN] Would run: ${file} ${args.join(" ")}`);
-      options.onStepEnd?.(stepName, true);
-      return {
-        name: stepName,
-        command: `${file} ${args.join(" ")}`,
-        status: "success",
-        durationMs: 0
-      };
-    }
-    const result = await safeExec(file, args, {
-      ...extraExecOptions,
-      timeoutMs: options.timeoutMs ?? 18e4,
-      // 3 min per step
-      onData: (data) => {
-        if (options.onStepProgress) {
-          const lines = data.split("\n").map((l) => l.trim()).filter(Boolean);
-          if (lines.length > 0) {
-            options.onStepProgress(stepName, lines[lines.length - 1]);
-          }
-        }
-      }
-    });
-    const durationMs = Date.now() - startTime;
-    const success = result.success;
-    const rawOutput = [result.stderr, result.stdout].filter(Boolean).join("\n").trim();
-    const errorMsg = !success ? result.timedOut ? `Step timed out after ${Math.round((options.timeoutMs ?? 18e4) / 1e3)}s` : extractErrorMessage(rawOutput) : void 0;
-    options.onStepEnd?.(stepName, success, errorMsg, durationMs);
+    return runStep(stepName, file, args, options, extraExecOptions);
+  }
+};
+async function runStep(stepName, file, args, options, extraExecOptions) {
+  const startTime = Date.now();
+  options.onStepStart?.(stepName);
+  if (options.dryRun) {
+    options.onStepProgress?.(stepName, `[DRY-RUN] Would run: ${file} ${args.join(" ")}`);
+    options.onStepEnd?.(stepName, true);
     return {
       name: stepName,
       command: `${file} ${args.join(" ")}`,
-      status: success ? "success" : "failed",
-      durationMs,
-      error: errorMsg
+      status: "success",
+      durationMs: 0
     };
   }
-};
+  const result = await safeExec(file, args, {
+    ...extraExecOptions,
+    timeoutMs: options.timeoutMs ?? 18e4,
+    // 3 min per step
+    onData: (data) => {
+      if (options.onStepProgress) {
+        const lines = data.split("\n").map((l) => l.trim()).filter(Boolean);
+        if (lines.length > 0) {
+          options.onStepProgress(stepName, lines[lines.length - 1]);
+        }
+      }
+    }
+  });
+  const durationMs = Date.now() - startTime;
+  const success = result.success;
+  const rawOutput = [result.stderr, result.stdout].filter(Boolean).join("\n").trim();
+  const errorMsg = !success ? result.timedOut ? `Step timed out after ${Math.round((options.timeoutMs ?? 18e4) / 1e3)}s` : extractErrorMessage(rawOutput) : void 0;
+  options.onStepEnd?.(stepName, success, errorMsg, durationMs);
+  return {
+    name: stepName,
+    command: `${file} ${args.join(" ")}`,
+    status: success ? "success" : "failed",
+    durationMs,
+    error: errorMsg
+  };
+}
 
 // src/managers/homebrew.ts
 var HomebrewManager = class extends BasePackageManager {
@@ -393,15 +424,25 @@ var NpmManager = class extends BasePackageManager {
       });
       const updates = [];
       const stdout = execRes.stdout.trim();
+      let npmError;
       if (stdout.startsWith("{")) {
         const parsed = JSON.parse(stdout);
         for (const [name, info] of Object.entries(parsed)) {
+          if (name === "error" || name === "problems") {
+            if (name === "error" && info && typeof info === "object" && "summary" in info) {
+              npmError = typeof info.summary === "string" ? info.summary : void 0;
+            }
+            continue;
+          }
+          if (!info || typeof info !== "object") continue;
+          const entry = info;
+          if (!entry.current && !entry.latest && !entry.wanted) continue;
           updates.push({
             managerId: this.id,
             managerName: this.name,
             name,
-            currentVersion: info.current ?? "unknown",
-            latestVersion: info.latest ?? info.wanted ?? "latest",
+            currentVersion: entry.current ?? "unknown",
+            latestVersion: entry.latest ?? entry.wanted ?? "latest",
             type: "global-pkg"
           });
         }
@@ -413,7 +454,8 @@ var NpmManager = class extends BasePackageManager {
         category: this.category,
         available: true,
         updates,
-        durationMs: Date.now() - startTime
+        durationMs: Date.now() - startTime,
+        error: updates.length === 0 ? npmError : void 0
       };
     } catch (err) {
       return {
@@ -1074,15 +1116,30 @@ var PipxManager = class extends BasePackageManager {
   }
 };
 
-// src/managers/cargo.ts
-var CargoManager = class extends BasePackageManager {
-  id = "cargo";
-  name = "Rust (Cargo & Rustup)";
-  icon = "\u{1F980}";
+// src/managers/uv.ts
+var UvManager = class extends BasePackageManager {
+  id = "uv";
+  name = "uv (Python tools)";
+  icon = "\u{1F9EA}";
   category = "language";
-  binary = "cargo";
-  async isAvailable() {
-    return await commandExists("cargo") || await commandExists("rustup");
+  binary = "uv";
+  /**
+   * Parses `uv tool list` output, e.g.:
+   *   black v24.10.0
+   *   - black
+   *   - blackd
+   */
+  parseToolList(stdout) {
+    const tools = [];
+    for (const rawLine of stdout.split("\n")) {
+      const line = rawLine.trim();
+      if (!line || line.startsWith("-")) continue;
+      const match = line.match(/^(\S+)\s+v?(\d[0-9A-Za-z.+-]*)(?:\s+\(.*\))?$/);
+      if (match) {
+        tools.push({ name: match[1], version: match[2] });
+      }
+    }
+    return tools;
   }
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1099,49 +1156,36 @@ var CargoManager = class extends BasePackageManager {
       };
     }
     try {
+      const execRes = await safeExec("uv", ["tool", "list"], {
+        timeoutMs: options?.timeoutMs ?? 15e3
+      });
       const updates = [];
-      if (await commandExists("rustup")) {
-        const checkRes = await safeExec("rustup", ["check"], {
-          timeoutMs: options?.timeoutMs ?? 15e3
-        });
-        const lines = checkRes.stdout.split("\n");
-        for (const line of lines) {
-          if (line.includes("Update available")) {
-            const parts = line.trim().split(/\s+/);
-            const toolchain = parts[0] ?? "toolchain";
-            updates.push({
-              managerId: this.id,
-              managerName: this.name,
-              name: `rustup (${toolchain})`,
-              currentVersion: "installed",
-              latestVersion: "update-available",
-              type: "toolchain"
-            });
-          }
-        }
-      }
-      if (await commandExists("cargo-install-update")) {
-        const listRes = await safeExec("cargo", ["install-update", "-l"], {
-          timeoutMs: options?.timeoutMs ?? 15e3
-        });
-        const lines = listRes.stdout.split("\n");
-        for (const line of lines) {
-          const match = line.match(/^(\S+)\s+v(\S+)\s+v(\S+)/);
-          if (match) {
-            const [, name, cur, latest] = match;
-            if (cur !== latest) {
+      const tools = execRes.success ? this.parseToolList(execRes.stdout) : [];
+      await Promise.all(
+        tools.map(async ({ name, version }) => {
+          try {
+            const response = await fetch(
+              `https://pypi.org/pypi/${encodeURIComponent(name)}/json`,
+              { signal: AbortSignal.timeout(3e3) }
+            );
+            if (!response.ok) return;
+            const data = await response.json();
+            const latest = data.info?.version;
+            if (latest && latest !== version) {
               updates.push({
                 managerId: this.id,
                 managerName: this.name,
                 name,
-                currentVersion: cur,
+                currentVersion: version,
                 latestVersion: latest,
-                type: "crate"
+                type: "uv-tool"
               });
             }
+          } catch {
           }
-        }
-      }
+        })
+      );
+      updates.sort((a, b) => a.name.localeCompare(b.name));
       return {
         managerId: this.id,
         managerName: this.name,
@@ -1167,26 +1211,29 @@ var CargoManager = class extends BasePackageManager {
   async executeUpdate(items, options) {
     const startTime = Date.now();
     const steps = [];
-    if (await commandExists("rustup")) {
-      const rustupStep = await this.executeStep(
-        "rustup update",
-        "rustup",
-        ["update"],
-        options
-      );
-      steps.push(rustupStep);
-    }
-    if (await commandExists("cargo-install-update")) {
-      const cargoStep = await this.executeStep(
-        "cargo install-update -a",
-        "cargo",
-        ["install-update", "-a"],
+    if (items.length > 0) {
+      const upgradeStep = await this.executeStep(
+        `uv tool upgrade --all (${items.length} tools)`,
+        "uv",
+        ["tool", "upgrade", "--all"],
         options
       );
-      steps.push(cargoStep);
+      steps.push(upgradeStep);
+      const pinned = items.filter((i) => {
+        const major = (v) => v.replace(/^v/, "").split(".")[0];
+        return major(i.currentVersion) !== major(i.latestVersion);
+      });
+      for (const item of pinned) {
+        const step = await this.executeStep(
+          `uv tool install ${item.name}@latest`,
+          "uv",
+          ["tool", "install", `${item.name}@latest`],
+          options
+        );
+        steps.push(step);
+      }
     }
-    const hasFailedStep = steps.some((s) => s.status === "failed");
-    const success = !hasFailedStep;
+    const success = steps.every((s) => s.status === "success");
     return {
       managerId: this.id,
       managerName: this.name,
@@ -1200,22 +1247,17 @@ var CargoManager = class extends BasePackageManager {
   }
 };
 
-// src/managers/gem.ts
-var RubyGemManager = class extends BasePackageManager {
-  id = "gem";
-  name = "Ruby Gem";
-  icon = "\u{1F48E}";
+// src/managers/poetry.ts
+var PoetryManager = class extends BasePackageManager {
+  id = "poetry";
+  name = "Poetry (self-managed)";
+  icon = "\u{1F4DC}";
   category = "language";
-  binary = "gem";
-  async isAvailable() {
-    const hasCmd = await commandExists(this.binary);
-    if (!hasCmd) return false;
-    const whichRes = await safeExec("which", ["gem"], { timeoutMs: 3e3 });
-    const gemPath = whichRes.stdout.trim();
-    if (gemPath === "/usr/bin/gem" || gemPath.startsWith("/System/Library")) {
-      return false;
-    }
-    return true;
+  binary = "poetry";
+  /** Parses `Poetry (version 1.8.5)` and older/newer banner variants. */
+  parseInstalledVersion(stdout) {
+    const match = stdout.match(/version\s+(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/i);
+    return match?.[1];
   }
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1232,24 +1274,31 @@ var RubyGemManager = class extends BasePackageManager {
       };
     }
     try {
-      const execRes = await safeExec("gem", ["outdated"], {
-        timeoutMs: options?.timeoutMs ?? 2e4
+      const execRes = await safeExec("poetry", ["--version"], {
+        timeoutMs: options?.timeoutMs ?? 15e3
       });
       const updates = [];
-      const lines = execRes.stdout.split("\n");
-      for (const line of lines) {
-        const trimmed = line.trim();
-        const match = trimmed.match(/^(\S+)\s*\(([^<]+)<\s*([^)]+)\)/);
-        if (match) {
-          const [, name, current, latest] = match;
-          updates.push({
-            managerId: this.id,
-            managerName: this.name,
-            name: name.trim(),
-            currentVersion: current.trim(),
-            latestVersion: latest.trim(),
-            type: "gem"
+      const current = this.parseInstalledVersion(execRes.stdout);
+      if (current) {
+        try {
+          const response = await fetch("https://pypi.org/pypi/poetry/json", {
+            signal: AbortSignal.timeout(3e3)
           });
+          if (response.ok) {
+            const data = await response.json();
+            const latest = data.info?.version;
+            if (latest && latest !== current) {
+              updates.push({
+                managerId: this.id,
+                managerName: this.name,
+                name: "poetry",
+                currentVersion: current,
+                latestVersion: latest,
+                type: "poetry-self"
+              });
+            }
+          }
+        } catch {
         }
       }
       return {
@@ -1277,20 +1326,15 @@ var RubyGemManager = class extends BasePackageManager {
   async executeUpdate(items, options) {
     const startTime = Date.now();
     const steps = [];
-    const updateStep = await this.executeStep(
-      "gem update --user-install",
-      "gem",
-      ["update", "--user-install"],
-      options
-    );
-    steps.push(updateStep);
-    const cleanupStep = await this.executeStep(
-      "gem cleanup",
-      "gem",
-      ["cleanup"],
-      options
-    );
-    steps.push(cleanupStep);
+    if (items.length > 0) {
+      const step = await this.executeStep(
+        "poetry self update",
+        "poetry",
+        ["self", "update"],
+        options
+      );
+      steps.push(step);
+    }
     const success = steps.every((s) => s.status === "success");
     return {
       managerId: this.id,
@@ -1305,81 +1349,526 @@ var RubyGemManager = class extends BasePackageManager {
   }
 };
 
-// src/managers/macports.ts
-var MacPortsManager = class extends BasePackageManager {
-  id = "macports";
-  name = "MacPorts";
-  icon = "\u2693";
-  category = "system";
-  binary = "port";
-  async checkUpdates(options) {
-    const startTime = Date.now();
-    const isAvail = await this.isAvailable();
-    if (!isAvail) {
-      return {
-        managerId: this.id,
-        managerName: this.name,
-        icon: this.icon,
-        category: this.category,
-        available: false,
-        updates: [],
-        durationMs: 0
-      };
-    }
-    try {
-      const execRes = await safeExec("port", ["outdated"], {
-        timeoutMs: options?.timeoutMs ?? 2e4
-      });
-      const updates = [];
-      const lines = execRes.stdout.split("\n");
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("The following") || trimmed.startsWith("--")) {
-          continue;
-        }
-        const match = trimmed.match(/^(\S+)\s+(\S+)\s*<\s*(\S+)/);
-        if (match) {
-          const [, name, current, latest] = match;
-          updates.push({
-            managerId: this.id,
-            managerName: this.name,
-            name,
-            currentVersion: current,
-            latestVersion: latest,
-            type: "port"
-          });
-        }
-      }
-      return {
-        managerId: this.id,
-        managerName: this.name,
-        icon: this.icon,
-        category: this.category,
-        available: true,
-        updates,
-        durationMs: Date.now() - startTime
-      };
-    } catch (err) {
-      return {
-        managerId: this.id,
-        managerName: this.name,
-        icon: this.icon,
-        category: this.category,
-        available: true,
-        updates: [],
-        durationMs: Date.now() - startTime,
-        error: err instanceof Error ? err.message : String(err)
-      };
-    }
+// src/utils/formatting.ts
+import pc from "picocolors";
+import Table from "cli-table3";
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  const seconds = (ms / 1e3).toFixed(1);
+  return `${seconds}s`;
+}
+function renderUpdatesTable(items) {
+  if (items.length === 0) {
+    return pc.dim("  No updates pending.");
   }
-  async executeUpdate(items, options) {
-    const startTime = Date.now();
-    const steps = [];
-    if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
-        return {
-          managerId: this.id,
+  const table = new Table({
+    head: [
+      pc.dim("Manager"),
+      pc.dim("Package"),
+      pc.dim("Type"),
+      pc.dim("Version Transition")
+    ],
+    style: {
+      head: [],
+      border: ["dim"]
+    },
+    chars: {
+      top: "\u2500",
+      "top-mid": "\u2500",
+      "top-left": "\u250C",
+      "top-right": "\u2510",
+      bottom: "\u2500",
+      "bottom-mid": "\u2500",
+      "bottom-left": "\u2514",
+      "bottom-right": "\u2518",
+      left: "\u2502",
+      "left-mid": "\u251C",
+      mid: "\u2500",
+      "mid-mid": "\u253C",
+      right: "\u2502",
+      "right-mid": "\u2524",
+      middle: "\u2502"
+    }
+  });
+  for (const item of items) {
+    const typeLabel = item.type ? pc.dim(`[${item.type}]`) : pc.dim("-");
+    const currentVer = pc.yellow(item.currentVersion || "?");
+    const arrow = pc.dim(" \u2192 ");
+    const latestVer = pc.green(pc.bold(item.latestVersion || "?"));
+    table.push([
+      pc.cyan(item.managerName),
+      pc.bold(pc.white(item.name)),
+      typeLabel,
+      `${currentVer}${arrow}${latestVer}`
+    ]);
+  }
+  return table.toString();
+}
+function renderExecutionSummary(results) {
+  const total = results.length;
+  const successful = results.filter((r) => r.success).length;
+  const failed = results.filter((r) => !r.success).length;
+  const totalUpdated = results.reduce((acc, r) => acc + r.updatedCount, 0);
+  const lines = [];
+  lines.push("");
+  lines.push(pc.dim("\u2500".repeat(60)));
+  lines.push(`  ${pc.bold(pc.cyan("Heimdall"))} ${pc.dim("\u2022 Execution Summary")}`);
+  lines.push(pc.dim("\u2500".repeat(60)));
+  for (const res of results) {
+    const icon = res.icon || "\u{1F4E6}";
+    const status = res.success ? pc.green("\u2714 SUCCESS") : pc.red("\u2716 FAILED");
+    const time = pc.dim(`(${formatDuration(res.durationMs)})`);
+    const count = res.success ? pc.dim(`\u2022 ${res.updatedCount} updated`) : pc.dim(`\u2022 ${res.updatedCount} updated, ${res.steps.filter((s) => s.status === "failed").length} issue(s)`);
+    lines.push(`  ${icon} ${pc.bold(res.managerName)} ${status} ${count} ${time}`);
+    if (!res.success && res.error) {
+      lines.push(`     ${pc.red("\u21B3 Error:")} ${pc.dim(res.error.trim().split("\n")[0])}`);
+    }
+    if (res.steps.length > 0) {
+      for (const step of res.steps) {
+        if (step.status === "skipped") continue;
+        const stepStatus = step.status === "success" ? pc.green("\u2714") : step.status === "failed" ? pc.red("\u2716") : pc.dim("\u25CB");
+        const stepDuration = step.durationMs ? pc.dim(`[${formatDuration(step.durationMs)}]`) : "";
+        const stepError = step.error && step.status === "failed" ? pc.red(` (${step.error.split("\n")[0]})`) : "";
+        lines.push(`       ${stepStatus} ${pc.dim(step.name)} ${stepDuration}${stepError}`);
+      }
+    }
+  }
+  lines.push(pc.dim("\u2500".repeat(60)));
+  const summaryParts = [
+    pc.green(`${successful}/${total} managers succeeded`),
+    failed > 0 ? pc.red(`${failed} failed`) : null,
+    pc.cyan(`${totalUpdated} package(s) updated`)
+  ].filter(Boolean);
+  lines.push(`  ${summaryParts.join(" \u2022 ")}`);
+  lines.push(pc.dim("\u2500".repeat(60)));
+  return lines.join("\n");
+}
+
+// src/managers/conda.ts
+var CondaManager = class extends BasePackageManager {
+  id = "conda";
+  name = "Conda (Anaconda/Miniforge)";
+  icon = "\u{1F152}";
+  category = "language";
+  binary = "conda";
+  parseDryRun(stdout) {
+    const jsonStart = stdout.indexOf("{");
+    const jsonEnd = stdout.lastIndexOf("}");
+    if (jsonStart === -1 || jsonEnd === -1 || jsonEnd <= jsonStart) return [];
+    let parsed;
+    try {
+      parsed = JSON.parse(stdout.slice(jsonStart, jsonEnd + 1));
+    } catch {
+      return [];
+    }
+    const unlinked = /* @__PURE__ */ new Map();
+    for (const entry of parsed.actions?.UNLINK ?? []) {
+      if (entry.name) unlinked.set(entry.name, entry);
+    }
+    const updates = [];
+    for (const entry of parsed.actions?.LINK ?? []) {
+      if (!entry.name || !entry.version) continue;
+      const previous = unlinked.get(entry.name);
+      if (!previous) continue;
+      updates.push({
+        name: entry.name,
+        currentVersion: previous.version,
+        latestVersion: entry.version,
+        channel: entry.channel
+      });
+    }
+    return updates;
+  }
+  async checkUpdates(options) {
+    const startTime = Date.now();
+    const isAvail = await this.isAvailable();
+    if (!isAvail) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: false,
+        updates: [],
+        durationMs: 0
+      };
+    }
+    try {
+      const timeoutMs = Math.max(options?.timeoutMs ?? 6e4, 6e4);
+      const execRes = await safeExec("conda", ["update", "--all", "--dry-run", "--json"], {
+        timeoutMs
+      });
+      const updates = [];
+      if (execRes.success) {
+        for (const action of this.parseDryRun(execRes.stdout)) {
+          updates.push({
+            managerId: this.id,
+            managerName: this.name,
+            name: action.name,
+            currentVersion: action.currentVersion ?? "installed",
+            latestVersion: action.latestVersion,
+            type: "conda-pkg",
+            extra: action.channel
+          });
+        }
+      }
+      const rawError = (execRes.stderr || execRes.stdout).trim();
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates,
+        durationMs: Date.now() - startTime,
+        error: !execRes.success && rawError ? extractErrorMessage(rawError) : void 0
+      };
+    } catch (err) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates: [],
+        durationMs: Date.now() - startTime,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async executeUpdate(items, options) {
+    const startTime = Date.now();
+    const steps = [];
+    if (items.length > 0) {
+      const step = await this.executeStep(
+        `conda update --all (${items.length} pkgs)`,
+        "conda",
+        ["update", "--all", "-y"],
+        options
+      );
+      steps.push(step);
+    }
+    const success = steps.every((s) => s.status === "success");
+    return {
+      managerId: this.id,
+      managerName: this.name,
+      icon: this.icon,
+      success,
+      updatedCount: success ? items.length : 0,
+      durationMs: Date.now() - startTime,
+      steps,
+      error: !success ? steps.find((s) => s.status === "failed")?.error : void 0
+    };
+  }
+};
+
+// src/managers/cargo.ts
+var CargoManager = class extends BasePackageManager {
+  id = "cargo";
+  name = "Rust (Cargo & Rustup)";
+  icon = "\u{1F980}";
+  category = "language";
+  binary = "cargo";
+  async isAvailable() {
+    return await commandExists("cargo") || await commandExists("rustup");
+  }
+  async checkUpdates(options) {
+    const startTime = Date.now();
+    const isAvail = await this.isAvailable();
+    if (!isAvail) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: false,
+        updates: [],
+        durationMs: 0
+      };
+    }
+    try {
+      const updates = [];
+      if (await commandExists("rustup")) {
+        const checkRes = await safeExec("rustup", ["check"], {
+          timeoutMs: options?.timeoutMs ?? 15e3
+        });
+        const lines = checkRes.stdout.split("\n");
+        for (const line of lines) {
+          if (line.includes("Update available")) {
+            const parts = line.trim().split(/\s+/);
+            const toolchain = parts[0] ?? "toolchain";
+            updates.push({
+              managerId: this.id,
+              managerName: this.name,
+              name: `rustup (${toolchain})`,
+              currentVersion: "installed",
+              latestVersion: "update-available",
+              type: "toolchain"
+            });
+          }
+        }
+      }
+      if (await commandExists("cargo-install-update")) {
+        const listRes = await safeExec("cargo", ["install-update", "-l"], {
+          timeoutMs: options?.timeoutMs ?? 15e3
+        });
+        const lines = listRes.stdout.split("\n");
+        for (const line of lines) {
+          const match = line.match(/^(\S+)\s+v(\S+)\s+v(\S+)/);
+          if (match) {
+            const [, name, cur, latest] = match;
+            if (cur !== latest) {
+              updates.push({
+                managerId: this.id,
+                managerName: this.name,
+                name,
+                currentVersion: cur,
+                latestVersion: latest,
+                type: "crate"
+              });
+            }
+          }
+        }
+      }
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates,
+        durationMs: Date.now() - startTime
+      };
+    } catch (err) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates: [],
+        durationMs: Date.now() - startTime,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async executeUpdate(items, options) {
+    const startTime = Date.now();
+    const steps = [];
+    if (await commandExists("rustup")) {
+      const rustupStep = await this.executeStep(
+        "rustup update",
+        "rustup",
+        ["update"],
+        options
+      );
+      steps.push(rustupStep);
+    }
+    if (await commandExists("cargo-install-update")) {
+      const cargoStep = await this.executeStep(
+        "cargo install-update -a",
+        "cargo",
+        ["install-update", "-a"],
+        options
+      );
+      steps.push(cargoStep);
+    }
+    const hasFailedStep = steps.some((s) => s.status === "failed");
+    const success = !hasFailedStep;
+    return {
+      managerId: this.id,
+      managerName: this.name,
+      icon: this.icon,
+      success,
+      updatedCount: success ? items.length : 0,
+      durationMs: Date.now() - startTime,
+      steps,
+      error: !success ? steps.find((s) => s.status === "failed")?.error : void 0
+    };
+  }
+};
+
+// src/managers/gem.ts
+var RubyGemManager = class extends BasePackageManager {
+  id = "gem";
+  name = "Ruby Gem";
+  icon = "\u{1F48E}";
+  category = "language";
+  binary = "gem";
+  async isAvailable() {
+    const hasCmd = await commandExists(this.binary);
+    if (!hasCmd) return false;
+    const whichRes = await safeExec("which", ["gem"], { timeoutMs: 3e3 });
+    const gemPath = whichRes.stdout.trim();
+    if (gemPath === "/usr/bin/gem" || gemPath.startsWith("/System/Library")) {
+      return false;
+    }
+    return true;
+  }
+  async checkUpdates(options) {
+    const startTime = Date.now();
+    const isAvail = await this.isAvailable();
+    if (!isAvail) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: false,
+        updates: [],
+        durationMs: 0
+      };
+    }
+    try {
+      const execRes = await safeExec("gem", ["outdated"], {
+        timeoutMs: options?.timeoutMs ?? 2e4
+      });
+      const updates = [];
+      const lines = execRes.stdout.split("\n");
+      for (const line of lines) {
+        const trimmed = line.trim();
+        const match = trimmed.match(/^(\S+)\s*\(([^<]+)<\s*([^)]+)\)/);
+        if (match) {
+          const [, name, current, latest] = match;
+          updates.push({
+            managerId: this.id,
+            managerName: this.name,
+            name: name.trim(),
+            currentVersion: current.trim(),
+            latestVersion: latest.trim(),
+            type: "gem"
+          });
+        }
+      }
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates,
+        durationMs: Date.now() - startTime
+      };
+    } catch (err) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates: [],
+        durationMs: Date.now() - startTime,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async executeUpdate(items, options) {
+    const startTime = Date.now();
+    const steps = [];
+    const updateStep = await this.executeStep(
+      "gem update --user-install",
+      "gem",
+      ["update", "--user-install"],
+      options
+    );
+    steps.push(updateStep);
+    const cleanupStep = await this.executeStep(
+      "gem cleanup",
+      "gem",
+      ["cleanup"],
+      options
+    );
+    steps.push(cleanupStep);
+    const success = steps.every((s) => s.status === "success");
+    return {
+      managerId: this.id,
+      managerName: this.name,
+      icon: this.icon,
+      success,
+      updatedCount: success ? items.length : 0,
+      durationMs: Date.now() - startTime,
+      steps,
+      error: !success ? steps.find((s) => s.status === "failed")?.error : void 0
+    };
+  }
+};
+
+// src/managers/macports.ts
+var MacPortsManager = class extends BasePackageManager {
+  id = "macports";
+  name = "MacPorts";
+  icon = "\u2693";
+  category = "system";
+  requiresSudo = true;
+  binary = "port";
+  async checkUpdates(options) {
+    const startTime = Date.now();
+    const isAvail = await this.isAvailable();
+    if (!isAvail) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: false,
+        updates: [],
+        durationMs: 0
+      };
+    }
+    try {
+      const execRes = await safeExec("port", ["outdated"], {
+        timeoutMs: options?.timeoutMs ?? 2e4
+      });
+      const updates = [];
+      const lines = execRes.stdout.split("\n");
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("The following") || trimmed.startsWith("--")) {
+          continue;
+        }
+        const match = trimmed.match(/^(\S+)\s+(\S+)\s*<\s*(\S+)/);
+        if (match) {
+          const [, name, current, latest] = match;
+          updates.push({
+            managerId: this.id,
+            managerName: this.name,
+            name,
+            currentVersion: current,
+            latestVersion: latest,
+            type: "port"
+          });
+        }
+      }
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates,
+        durationMs: Date.now() - startTime
+      };
+    } catch (err) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates: [],
+        durationMs: Date.now() - startTime,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async executeUpdate(items, options) {
+    const startTime = Date.now();
+    const steps = [];
+    if (!options.dryRun && process.getuid?.() !== 0) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `MacPorts requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
+        return {
+          managerId: this.id,
           managerName: this.name,
           icon: this.icon,
           success: false,
@@ -1390,10 +1879,10 @@ var MacPortsManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'MacPorts requires sudo privileges. Run "sudo -v" in your terminal before hmd.'
+              error
             }
           ],
-          error: 'MacPorts requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -1513,107 +2002,13 @@ var MacAppStoreManager = class extends BasePackageManager {
   }
 };
 
-// src/utils/formatting.ts
-import pc from "picocolors";
-import Table from "cli-table3";
-function formatDuration(ms) {
-  if (ms < 1e3) return `${ms}ms`;
-  const seconds = (ms / 1e3).toFixed(1);
-  return `${seconds}s`;
-}
-function renderUpdatesTable(items) {
-  if (items.length === 0) {
-    return pc.dim("  No updates pending.");
-  }
-  const table = new Table({
-    head: [
-      pc.dim("Manager"),
-      pc.dim("Package"),
-      pc.dim("Type"),
-      pc.dim("Version Transition")
-    ],
-    style: {
-      head: [],
-      border: ["dim"]
-    },
-    chars: {
-      top: "\u2500",
-      "top-mid": "\u2500",
-      "top-left": "\u250C",
-      "top-right": "\u2510",
-      bottom: "\u2500",
-      "bottom-mid": "\u2500",
-      "bottom-left": "\u2514",
-      "bottom-right": "\u2518",
-      left: "\u2502",
-      "left-mid": "\u251C",
-      mid: "\u2500",
-      "mid-mid": "\u253C",
-      right: "\u2502",
-      "right-mid": "\u2524",
-      middle: "\u2502"
-    }
-  });
-  for (const item of items) {
-    const typeLabel = item.type ? pc.dim(`[${item.type}]`) : pc.dim("-");
-    const currentVer = pc.yellow(item.currentVersion || "?");
-    const arrow = pc.dim(" \u2192 ");
-    const latestVer = pc.green(pc.bold(item.latestVersion || "?"));
-    table.push([
-      pc.cyan(item.managerName),
-      pc.bold(pc.white(item.name)),
-      typeLabel,
-      `${currentVer}${arrow}${latestVer}`
-    ]);
-  }
-  return table.toString();
-}
-function renderExecutionSummary(results) {
-  const total = results.length;
-  const successful = results.filter((r) => r.success).length;
-  const failed = results.filter((r) => !r.success).length;
-  const totalUpdated = results.reduce((acc, r) => acc + r.updatedCount, 0);
-  const lines = [];
-  lines.push("");
-  lines.push(pc.dim("\u2500".repeat(60)));
-  lines.push(`  ${pc.bold(pc.cyan("Heimdall"))} ${pc.dim("\u2022 Execution Summary")}`);
-  lines.push(pc.dim("\u2500".repeat(60)));
-  for (const res of results) {
-    const icon = res.icon || "\u{1F4E6}";
-    const status = res.success ? pc.green("\u2714 SUCCESS") : pc.red("\u2716 FAILED");
-    const time = pc.dim(`(${formatDuration(res.durationMs)})`);
-    const count = res.success ? pc.dim(`\u2022 ${res.updatedCount} updated`) : pc.dim(`\u2022 ${res.updatedCount} updated, ${res.steps.filter((s) => s.status === "failed").length} issue(s)`);
-    lines.push(`  ${icon} ${pc.bold(res.managerName)} ${status} ${count} ${time}`);
-    if (!res.success && res.error) {
-      lines.push(`     ${pc.red("\u21B3 Error:")} ${pc.dim(res.error.trim().split("\n")[0])}`);
-    }
-    if (res.steps.length > 0) {
-      for (const step of res.steps) {
-        if (step.status === "skipped") continue;
-        const stepStatus = step.status === "success" ? pc.green("\u2714") : step.status === "failed" ? pc.red("\u2716") : pc.dim("\u25CB");
-        const stepDuration = step.durationMs ? pc.dim(`[${formatDuration(step.durationMs)}]`) : "";
-        const stepError = step.error && step.status === "failed" ? pc.red(` (${step.error.split("\n")[0]})`) : "";
-        lines.push(`       ${stepStatus} ${pc.dim(step.name)} ${stepDuration}${stepError}`);
-      }
-    }
-  }
-  lines.push(pc.dim("\u2500".repeat(60)));
-  const summaryParts = [
-    pc.green(`${successful}/${total} managers succeeded`),
-    failed > 0 ? pc.red(`${failed} failed`) : null,
-    pc.cyan(`${totalUpdated} package(s) updated`)
-  ].filter(Boolean);
-  lines.push(`  ${summaryParts.join(" \u2022 ")}`);
-  lines.push(pc.dim("\u2500".repeat(60)));
-  return lines.join("\n");
-}
-
 // src/managers/linux.ts
 var AptManager = class extends BasePackageManager {
   id = "apt";
   name = "APT (Debian/Ubuntu)";
   icon = "\u{1F427}";
   category = "system";
+  requiresSudo = true;
   binary = "apt-get";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1676,8 +2071,8 @@ var AptManager = class extends BasePackageManager {
     const startTime = Date.now();
     const steps = [];
     if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `APT requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
         return {
           managerId: this.id,
           managerName: this.name,
@@ -1690,10 +2085,10 @@ var AptManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'APT requires sudo privileges. Run "sudo -v" in your terminal before hmd.'
+              error
             }
           ],
-          error: 'APT requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -1707,18 +2102,54 @@ var AptManager = class extends BasePackageManager {
     const upgradeStep = await this.executeStep(
       "sudo apt-get upgrade",
       "sudo",
-      ["apt-get", "upgrade", "-y"],
+      ["apt-get", "upgrade", "-y", "--with-new-pkgs"],
       options
     );
     steps.push(upgradeStep);
-    const cleanupStep = await this.executeStep(
-      "sudo apt-get autoremove",
-      "sudo",
-      ["apt-get", "autoremove", "-y"],
-      options
-    );
-    steps.push(cleanupStep);
-    const success = steps.every((s) => s.status === "success");
+    if (upgradeStep.status === "success") {
+      if (options.dryRun) {
+        const autoremoveStep = await this.executeStep(
+          "sudo apt-get autoremove",
+          "sudo",
+          ["apt-get", "autoremove", "-y"],
+          options
+        );
+        steps.push(autoremoveStep);
+      } else if (options.confirmAction) {
+        const shouldAutoremove = await options.confirmAction(
+          "Do you want to run sudo apt-get autoremove to clean up orphaned packages?"
+        );
+        if (shouldAutoremove) {
+          const autoremoveStep = await this.executeStep(
+            "sudo apt-get autoremove",
+            "sudo",
+            ["apt-get", "autoremove", "-y"],
+            options
+          );
+          steps.push(autoremoveStep);
+        } else {
+          steps.push({
+            name: "sudo apt-get autoremove",
+            command: "sudo apt-get autoremove -y",
+            status: "skipped"
+          });
+        }
+      } else {
+        steps.push({
+          name: "sudo apt-get autoremove",
+          command: "sudo apt-get autoremove -y",
+          status: "skipped"
+        });
+      }
+    } else {
+      steps.push({
+        name: "sudo apt-get autoremove",
+        command: "sudo apt-get autoremove -y",
+        status: "skipped"
+      });
+    }
+    const executedSteps = steps.filter((s) => s.status !== "skipped");
+    const success = executedSteps.length > 0 && executedSteps.every((s) => s.status === "success");
     return {
       managerId: this.id,
       managerName: this.name,
@@ -1736,6 +2167,7 @@ var FlatpakManager = class extends BasePackageManager {
   name = "Flatpak";
   icon = "\u{1F4E6}";
   category = "system";
+  requiresSudo = true;
   binary = "flatpak";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1752,23 +2184,43 @@ var FlatpakManager = class extends BasePackageManager {
       };
     }
     try {
-      const execRes = await safeExec("flatpak", ["remote-ls", "--updates"], {
-        timeoutMs: options?.timeoutMs ?? 2e4
-      });
-      const updates = [];
-      const lines = execRes.stdout.split("\n");
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed) continue;
-        const parts = trimmed.split(/\s+/);
-        updates.push({
+      const timeoutMs = options?.timeoutMs ?? 2e4;
+      const [userRes, systemRes] = await Promise.all([
+        safeExec("flatpak", ["remote-ls", "--user", "--updates"], { timeoutMs }),
+        safeExec("flatpak", ["remote-ls", "--system", "--updates"], { timeoutMs })
+      ]);
+      if (!userRes.success && !systemRes.success) {
+        const raw = (systemRes.stderr || userRes.stderr).trim();
+        return {
           managerId: this.id,
           managerName: this.name,
-          name: parts[0],
-          currentVersion: "installed",
-          latestVersion: parts[1] ?? "latest",
-          type: "flatpak"
-        });
+          icon: this.icon,
+          category: this.category,
+          available: true,
+          updates: [],
+          durationMs: Date.now() - startTime,
+          error: raw ? extractErrorMessage(raw) : void 0
+        };
+      }
+      const updates = [];
+      const seen = /* @__PURE__ */ new Set();
+      for (const execRes of [userRes, systemRes]) {
+        for (const line of execRes.stdout.split("\n")) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+          const parts = trimmed.split(/\s+/);
+          const name = parts[0];
+          if (seen.has(name)) continue;
+          seen.add(name);
+          updates.push({
+            managerId: this.id,
+            managerName: this.name,
+            name,
+            currentVersion: "installed",
+            latestVersion: parts[1] ?? "latest",
+            type: "flatpak"
+          });
+        }
       }
       return {
         managerId: this.id,
@@ -1792,17 +2244,56 @@ var FlatpakManager = class extends BasePackageManager {
       };
     }
   }
+  async hasSystemScopeApps() {
+    const result = await safeExec("flatpak", ["list", "--system", "--columns=application"], {
+      timeoutMs: 1e4
+    });
+    return result.success && result.stdout.trim().length > 0;
+  }
   async executeUpdate(items, options) {
     const startTime = Date.now();
     const steps = [];
-    const updateStep = await this.executeStep(
-      "flatpak update -y",
+    const userStep = await this.executeStep(
+      "flatpak update --user",
       "flatpak",
-      ["update", "-y", "--noninteractive"],
+      ["update", "--user", "-y", "--noninteractive"],
       options
     );
-    steps.push(updateStep);
-    const success = steps.every((s) => s.status === "success");
+    steps.push(userStep);
+    const sudoStepName = "sudo flatpak update --system";
+    const sudoStepCommand = "sudo flatpak update --system -y --noninteractive";
+    if (options.dryRun) {
+      const systemStep = await this.executeStep(
+        sudoStepName,
+        "sudo",
+        ["flatpak", "update", "--system", "-y", "--noninteractive"],
+        options
+      );
+      steps.push(systemStep);
+    } else if (process.getuid?.() === 0 || await this.hasPasswordlessSudo()) {
+      const systemStep = await this.executeStep(
+        sudoStepName,
+        "sudo",
+        ["flatpak", "update", "--system", "-y", "--noninteractive"],
+        options
+      );
+      steps.push(systemStep);
+    } else if (await this.hasSystemScopeApps()) {
+      steps.push({
+        name: sudoStepName,
+        command: sudoStepCommand,
+        status: "failed",
+        error: `System-wide Flatpak updates require sudo privileges. ${SUDO_REQUIRED_HINT}`
+      });
+    } else {
+      steps.push({
+        name: sudoStepName,
+        command: sudoStepCommand,
+        status: "skipped"
+      });
+    }
+    const executedSteps = steps.filter((s) => s.status !== "skipped");
+    const success = executedSteps.length > 0 && executedSteps.every((s) => s.status === "success");
     return {
       managerId: this.id,
       managerName: this.name,
@@ -1820,6 +2311,7 @@ var DnfManager = class extends BasePackageManager {
   name = "DNF (Fedora/RHEL)";
   icon = "\u{1F4E6}";
   category = "system";
+  requiresSudo = true;
   binary = "dnf";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1917,8 +2409,8 @@ var DnfManager = class extends BasePackageManager {
     const startTime = Date.now();
     const steps = [];
     if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `DNF requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
         return {
           managerId: this.id,
           managerName: this.name,
@@ -1931,10 +2423,10 @@ var DnfManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'DNF requires sudo privileges. Run "sudo -v" before running hmd.'
+              error
             }
           ],
-          error: 'DNF requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -2002,6 +2494,170 @@ var DnfManager = class extends BasePackageManager {
   }
 };
 
+// src/managers/firmware.ts
+var FirmwareManager = class extends BasePackageManager {
+  id = "firmware";
+  name = "Firmware (fwupd)";
+  icon = "\u{1F527}";
+  category = "system";
+  requiresSudo = true;
+  binary = "fwupdmgr";
+  async isAvailable() {
+    if (process.platform !== "linux") return false;
+    return commandExists("fwupdmgr");
+  }
+  parseUpdates(stdout) {
+    const jsonStart = stdout.indexOf("{");
+    const jsonEnd = stdout.lastIndexOf("}");
+    if (jsonStart === -1 || jsonEnd === -1 || jsonEnd <= jsonStart) return [];
+    let parsed;
+    try {
+      parsed = JSON.parse(stdout.slice(jsonStart, jsonEnd + 1));
+    } catch {
+      return [];
+    }
+    const updates = [];
+    for (const device of parsed.Devices ?? []) {
+      const latestVersion = device.Releases?.[0]?.Version;
+      if (!device.Name || !latestVersion) continue;
+      updates.push({
+        managerId: this.id,
+        managerName: this.name,
+        name: device.Name,
+        currentVersion: device.Version ?? "unknown",
+        latestVersion,
+        type: "firmware",
+        extra: device.Vendor ?? device.Plugin
+      });
+    }
+    return updates;
+  }
+  async checkUpdates(options) {
+    const startTime = Date.now();
+    const isAvail = await this.isAvailable();
+    if (!isAvail) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: false,
+        updates: [],
+        durationMs: 0
+      };
+    }
+    try {
+      const timeoutMs = options?.timeoutMs ?? 3e4;
+      await safeExec("fwupdmgr", ["refresh"], { timeoutMs: Math.min(timeoutMs, 2e4) });
+      const execRes = await safeExec("fwupdmgr", ["--json", "get-updates"], { timeoutMs });
+      const updates = this.parseUpdates(execRes.stdout);
+      const parsedOutput = execRes.stdout.trim().startsWith("{");
+      if (!execRes.success && !parsedOutput) {
+        const raw = (execRes.stderr || execRes.stdout).trim();
+        return {
+          managerId: this.id,
+          managerName: this.name,
+          icon: this.icon,
+          category: this.category,
+          available: true,
+          updates: [],
+          durationMs: Date.now() - startTime,
+          error: raw ? extractErrorMessage(raw) : "fwupdmgr get-updates failed"
+        };
+      }
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates,
+        durationMs: Date.now() - startTime
+      };
+    } catch (err) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates: [],
+        durationMs: Date.now() - startTime,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async executeUpdate(items, options) {
+    const startTime = Date.now();
+    const steps = [];
+    if (items.length === 0) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        success: true,
+        updatedCount: 0,
+        durationMs: Date.now() - startTime,
+        steps
+      };
+    }
+    if (!options.dryRun && process.getuid?.() !== 0) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `Firmware updates require sudo privileges. ${SUDO_REQUIRED_HINT}`;
+        return {
+          managerId: this.id,
+          managerName: this.name,
+          icon: this.icon,
+          success: false,
+          updatedCount: 0,
+          durationMs: Date.now() - startTime,
+          steps: [
+            {
+              name: "sudo privileges",
+              command: "sudo -n true",
+              status: "failed",
+              error
+            }
+          ],
+          error
+        };
+      }
+    }
+    const refreshStep = await this.executeStep(
+      "sudo fwupdmgr refresh",
+      "sudo",
+      ["fwupdmgr", "refresh", "--force"],
+      options
+    );
+    steps.push(refreshStep);
+    const updateStep = await this.executeStep(
+      "sudo fwupdmgr update",
+      "sudo",
+      [
+        "fwupdmgr",
+        "update",
+        "-y",
+        "--no-reboot-check",
+        "--no-unreported-check",
+        "--no-metadata-check"
+      ],
+      options
+    );
+    steps.push(updateStep);
+    const success = steps.every((s) => s.status === "success");
+    return {
+      managerId: this.id,
+      managerName: this.name,
+      icon: this.icon,
+      success,
+      updatedCount: success ? items.length : 0,
+      durationMs: Date.now() - startTime,
+      steps,
+      error: !success ? steps.find((s) => s.status === "failed")?.error : void 0
+    };
+  }
+};
+
 // src/managers/registry.ts
 function createDefaultManagers() {
   return [
@@ -2012,13 +2668,17 @@ function createDefaultManagers() {
     new YarnManager(),
     new PythonPipManager(),
     new PipxManager(),
+    new UvManager(),
+    new PoetryManager(),
+    new CondaManager(),
     new CargoManager(),
     new RubyGemManager(),
     new MacPortsManager(),
     new MacAppStoreManager(),
     new AptManager(),
     new DnfManager(),
-    new FlatpakManager()
+    new FlatpakManager(),
+    new FirmwareManager()
   ];
 }
 function filterManagers(managers, only, exclude) {
@@ -2154,10 +2814,260 @@ var UpdaterEngine = class {
   }
 };
 
+// src/core/distro.ts
+import { readFileSync } from "fs";
+var FEDORA_RELEASES_URL = "https://bodhi.fedoraproject.org/releases?state=current";
+var UBUNTU_META_RELEASE_URL = "https://changelogs.ubuntu.com/meta-release";
+var DEBIAN_STABLE_RELEASE_URL = "https://deb.debian.org/debian/dists/stable/Release";
+function parseOsRelease(content) {
+  const values = {};
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const match = line.match(/^([A-Z0-9_]+)=(.*)$/);
+    if (!match) continue;
+    values[match[1]] = match[2].replace(/^"(.*)"$/, "$1");
+  }
+  const id = values.ID?.toLowerCase();
+  if (!id) return null;
+  return {
+    id,
+    idLike: (values.ID_LIKE ?? "").toLowerCase().split(/\s+/).filter(Boolean),
+    versionId: values.VERSION_ID ?? "",
+    codename: values.VERSION_CODENAME ?? "",
+    prettyName: values.PRETTY_NAME ?? values.NAME ?? id
+  };
+}
+function readDistroIdentity() {
+  try {
+    return parseOsRelease(readFileSync("/etc/os-release", "utf8"));
+  } catch {
+    return null;
+  }
+}
+function numericVersion(value) {
+  const parsed = Number.parseFloat(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+async function fetchText(url, timeoutMs) {
+  try {
+    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!response.ok) return void 0;
+    return await response.text();
+  } catch {
+    return void 0;
+  }
+}
+async function fetchJson(url, timeoutMs) {
+  try {
+    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!response.ok) return void 0;
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
+async function detectFedora(identity, timeoutMs) {
+  const current = numericVersion(identity.versionId);
+  if (current === void 0) return null;
+  const data = await fetchJson(FEDORA_RELEASES_URL, timeoutMs);
+  const versions = (data?.releases ?? []).filter((release) => release.id_prefix === "FEDORA" && release.version !== void 0).map((release) => numericVersion(release.version ?? "")).filter((version) => version !== void 0 && Number.isInteger(version));
+  if (versions.length === 0) return null;
+  const latest = Math.max(...versions);
+  if (latest <= current) return null;
+  return {
+    family: "fedora",
+    currentVersion: identity.versionId,
+    nextVersion: String(latest),
+    targetName: `Fedora Linux ${latest}`,
+    supported: true,
+    steps: [
+      {
+        name: `sudo dnf system-upgrade download --releasever=${latest}`,
+        file: "sudo",
+        args: ["dnf", "system-upgrade", "download", `--releasever=${latest}`, "-y"],
+        requiresSudo: true
+      }
+    ],
+    rebootRequired: true,
+    rebootCommand: "sudo dnf system-upgrade reboot",
+    guidance: [
+      `Packages for Fedora ${latest} are downloaded and staged; the upgrade runs offline during the next boot.`,
+      `Reboot to apply it: sudo dnf system-upgrade reboot`,
+      "If the system-upgrade plugin is missing, install `dnf-plugin-system-upgrade` (dnf4) or `dnf5-plugin-system-upgrade` (dnf5)."
+    ]
+  };
+}
+function parseUbuntuMetaRelease(content) {
+  const blocks = [];
+  for (const chunk of content.split(/\n\s*\n/)) {
+    const fields = {};
+    for (const line of chunk.split("\n")) {
+      const match = line.match(/^([A-Za-z-]+):\s*(.*)$/);
+      if (match) fields[match[1].toLowerCase()] = match[2].trim();
+    }
+    if (fields.dist && fields.version) {
+      blocks.push({
+        dist: fields.dist,
+        version: fields.version,
+        supported: fields.supported === "1"
+      });
+    }
+  }
+  return blocks;
+}
+async function detectUbuntu(identity, timeoutMs) {
+  const current = numericVersion(identity.versionId);
+  if (current === void 0) return null;
+  if (await commandExists("do-release-upgrade")) {
+    const check = await safeExec("do-release-upgrade", ["-c"], {
+      timeoutMs: Math.max(timeoutMs, 2e4)
+    });
+    const output = `${check.stdout}
+${check.stderr}`;
+    const match = output.match(/New release '([^']+)' available/i);
+    if (match) {
+      return {
+        family: "ubuntu",
+        currentVersion: identity.versionId,
+        nextVersion: match[1],
+        targetName: `Ubuntu ${match[1]}`,
+        supported: true,
+        steps: [
+          {
+            name: "sudo do-release-upgrade -f DistUpgradeViewNonInteractive",
+            file: "sudo",
+            args: ["do-release-upgrade", "-f", "DistUpgradeViewNonInteractive"],
+            requiresSudo: true
+          }
+        ],
+        rebootRequired: true,
+        rebootCommand: "sudo reboot",
+        guidance: [
+          "The release upgrade runs non-interactively and may take a long time; reboot when it asks or once it reports completion.",
+          "Make sure your data is backed up before upgrading the distribution."
+        ]
+      };
+    }
+    if (/no new release found/i.test(output)) return null;
+  }
+  const meta = await fetchText(UBUNTU_META_RELEASE_URL, timeoutMs);
+  if (!meta) return null;
+  const candidates = parseUbuntuMetaRelease(meta).filter((release) => release.supported).map((release) => ({ ...release, numeric: numericVersion(release.version) })).filter(
+    (release) => release.numeric !== void 0 && release.numeric > current
+  ).sort((a, b) => a.numeric - b.numeric);
+  const next = candidates[0];
+  if (!next) return null;
+  return {
+    family: "ubuntu",
+    currentVersion: identity.versionId,
+    nextVersion: next.version,
+    targetName: `Ubuntu ${next.version}`,
+    supported: false,
+    steps: [],
+    rebootRequired: true,
+    guidance: [
+      `Ubuntu ${next.version} is available, but the official upgrader is not installed.`,
+      "Install it with: sudo apt install update-manager-core",
+      "Then run: sudo do-release-upgrade"
+    ]
+  };
+}
+async function detectDebian(identity, timeoutMs) {
+  const current = numericVersion(identity.versionId);
+  if (current === void 0) return null;
+  const release = await fetchText(DEBIAN_STABLE_RELEASE_URL, timeoutMs);
+  if (!release) return null;
+  const versionMatch = release.match(/^Version:\s*(\S+)$/m);
+  const codenameMatch = release.match(/^Codename:\s*(\S+)$/m);
+  if (!versionMatch) return null;
+  const stable = numericVersion(versionMatch[1]);
+  if (stable === void 0) return null;
+  const stableMajor = Math.trunc(stable);
+  if (stableMajor <= Math.trunc(current)) return null;
+  const codename = codenameMatch?.[1] ?? `debian-${stableMajor}`;
+  const currentCodename = identity.codename || `version ${identity.versionId}`;
+  return {
+    family: "debian",
+    currentVersion: identity.versionId,
+    nextVersion: String(stableMajor),
+    targetName: `Debian ${stableMajor} (${codename})`,
+    // Debian has no supported unattended in-place upgrader: sources.list must switch
+    // suites deliberately, so Heimdall only reports the procedure.
+    supported: false,
+    steps: [],
+    rebootRequired: true,
+    guidance: [
+      `Debian ${stableMajor} (${codename}) is available; this system runs ${identity.versionId} (${currentCodename}).`,
+      `Replace "${currentCodename}" with "${codename}" in /etc/apt/sources.list and /etc/apt/sources.list.d/*.list.`,
+      "Then run: sudo apt update && sudo apt full-upgrade",
+      "Back up your data first and expect to reboot afterwards. Debian does not offer an unattended upgrade path."
+    ]
+  };
+}
+async function detectDistroUpgrade(options) {
+  if (process.platform !== "linux") return null;
+  const identity = options?.identity ?? readDistroIdentity();
+  if (!identity) return null;
+  const timeoutMs = options?.timeoutMs ?? 6e3;
+  const family = identity.id === "fedora" ? "fedora" : identity.id === "ubuntu" || identity.idLike.includes("ubuntu") ? "ubuntu" : identity.id === "debian" ? "debian" : void 0;
+  try {
+    if (family === "fedora") return await detectFedora(identity, timeoutMs);
+    if (family === "ubuntu") return await detectUbuntu(identity, timeoutMs);
+    if (family === "debian") return await detectDebian(identity, timeoutMs);
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function applyDistroUpgrade(plan, options) {
+  const steps = [];
+  if (!plan.supported || plan.steps.length === 0) {
+    return {
+      success: false,
+      steps,
+      error: `No unattended upgrade routine is available for ${plan.targetName}.`
+    };
+  }
+  if (!options.dryRun && process.getuid?.() !== 0) {
+    const ticket = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
+    if (!ticket.success) {
+      const error = `The distribution upgrade requires sudo privileges. Run "sudo -v" in this terminal and retry.`;
+      return {
+        success: false,
+        steps: [
+          {
+            name: "sudo privileges",
+            command: "sudo -n true",
+            status: "failed",
+            error
+          }
+        ],
+        error
+      };
+    }
+  }
+  for (const step of plan.steps) {
+    const result = await runStep(step.name, step.file, step.args, {
+      ...options,
+      // Distribution upgrades are long operations: allow up to one hour per step.
+      timeoutMs: 36e5
+    });
+    steps.push(result);
+    if (result.status !== "success") break;
+  }
+  const success = steps.length > 0 && steps.every((step) => step.status === "success");
+  return {
+    success,
+    steps,
+    error: !success ? steps.find((step) => step.status === "failed")?.error : void 0
+  };
+}
+
 // src/utils/version.ts
 import { fileURLToPath } from "url";
 import { dirname, resolve } from "path";
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
 var FALLBACK_METADATA = {
   name: "@dahch/heimdall",
   version: "1.0.1",
@@ -2167,7 +3077,7 @@ var cachedMetadata = null;
 var customFsAdapter = null;
 function resolvePackageMetadata(options) {
   const exists = options?.fsAdapter?.existsSync ?? customFsAdapter?.existsSync ?? existsSync;
-  const read = options?.fsAdapter?.readFileSync ?? customFsAdapter?.readFileSync ?? readFileSync;
+  const read = options?.fsAdapter?.readFileSync ?? customFsAdapter?.readFileSync ?? readFileSync2;
   try {
     let currentDir;
     if (options?.basePath) {
@@ -2220,10 +3130,127 @@ function getPackageMetadata(options) {
 }
 
 // src/cli.ts
+async function offerDistroUpgrade(options, timeoutMs, isSimulated) {
+  if (process.platform !== "linux" || options.distroUpgrade === false) return true;
+  const scanSpinner = p.spinner();
+  scanSpinner.start("Checking for distribution release upgrades...");
+  let plan = null;
+  try {
+    plan = await detectDistroUpgrade({ timeoutMs: Math.max(timeoutMs, 6e3) });
+  } catch {
+    plan = null;
+  }
+  scanSpinner.stop(
+    plan ? `Distribution upgrade available: ${plan.targetName}` : "Distribution release is up to date"
+  );
+  if (!plan) {
+    if (options.verbose) {
+      p.log.step(pc2.dim("No newer distribution release detected."));
+    }
+    return true;
+  }
+  p.note(
+    [
+      `${pc2.bold(plan.targetName)} is available ${pc2.dim(`(current: ${plan.currentVersion})`)}.`,
+      plan.supported ? "Heimdall can stage/apply the upgrade; it never reboots the machine by itself." : "Heimdall cannot apply this upgrade automatically."
+    ].join("\n"),
+    "Distribution upgrade available"
+  );
+  for (const line of plan.guidance) {
+    p.log.step(pc2.dim(`\u21B3 ${line}`));
+  }
+  if (isSimulated) {
+    for (const step of plan.steps) {
+      p.log.info(pc2.yellow(`[DRY RUN] Would run: ${[step.file, ...step.args].join(" ")}`));
+    }
+    return true;
+  }
+  if (!plan.supported) return true;
+  const autoApply = options.upgradeDistro === true;
+  const canPrompt = Boolean(process.stdin.isTTY) && !options.yes && !autoApply;
+  if (!autoApply && !canPrompt) {
+    const [first] = plan.steps;
+    if (first) {
+      p.log.info(
+        pc2.dim(`Not applied automatically. Run: ${[first.file, ...first.args].join(" ")}`)
+      );
+    }
+    return true;
+  }
+  let proceed = autoApply;
+  if (!autoApply) {
+    const answer = await p.confirm({
+      message: `Apply the ${plan.targetName} release upgrade now?`,
+      initialValue: false
+    });
+    if (p.isCancel(answer)) {
+      p.cancel("Distribution upgrade cancelled.");
+      return true;
+    }
+    proceed = answer;
+  }
+  if (!proceed) {
+    p.log.info(pc2.yellow("Distribution upgrade skipped."));
+    return true;
+  }
+  const upgradeSpinner = p.spinner();
+  let stopSudoKeepAlive;
+  if (process.getuid?.() !== 0) {
+    p.log.step(pc2.dim("Requesting sudo privileges for the distribution upgrade..."));
+    if (!await ensureSudo()) {
+      p.log.warn(
+        pc2.yellow(
+          'Sudo privileges not granted: the distribution upgrade cannot run. Run "sudo -v" in this terminal and retry.'
+        )
+      );
+      return false;
+    }
+    stopSudoKeepAlive = startSudoKeepAlive();
+  }
+  upgradeSpinner.start(pc2.dim("Running the distribution release upgrade..."));
+  let result;
+  try {
+    result = await applyDistroUpgrade(plan, {
+      onStepStart: (stepName) => upgradeSpinner.message(pc2.dim(`Running: ${stepName}...`)),
+      onStepProgress: (_stepName, logLine) => {
+        if (!logLine) return;
+        const truncated = logLine.length > 55 ? `${logLine.slice(0, 52)}...` : logLine;
+        upgradeSpinner.message(pc2.dim(truncated));
+      },
+      onStepEnd: (stepName, success, error, durationMs) => {
+        const mark = success ? pc2.green("\u2714") : pc2.red("\u2716");
+        const durStr = durationMs !== void 0 ? pc2.dim(` [${formatDuration(durationMs)}]`) : "";
+        const detail = error ? pc2.red(` \u21B3 ${error.split("\n")[0]}`) : "";
+        upgradeSpinner.stop(`  ${mark} ${pc2.dim(stepName)}${durStr}${detail}`);
+        upgradeSpinner.start(pc2.dim("Working..."));
+      }
+    });
+  } finally {
+    stopSudoKeepAlive?.();
+  }
+  upgradeSpinner.stop(
+    result.success ? pc2.green("\u2714 Distribution upgrade routine completed") : pc2.red("\u2716 Distribution upgrade failed")
+  );
+  if (!result.success) {
+    if (result.error) p.log.error(pc2.red(result.error));
+    return false;
+  }
+  if (plan.rebootRequired) {
+    p.note(
+      `Reboot to finish the upgrade:
+  ${pc2.bold(plan.rebootCommand ?? "sudo reboot")}`,
+      "Reboot required"
+    );
+  }
+  return true;
+}
 async function main() {
   const { version, description } = getPackageMetadata();
   const program = new Command();
-  program.name("hmd").description(description || "Heimdall: resilient validator and updater for system and global packages").version(version).option("-y, --yes", "Skip confirmation prompt and update all automatically").option("-d, --dry-run", "Inspect outdated packages and simulate update without running changes").option("-o, --only <managers>", "Only check and update specified managers (comma-separated, e.g. brew,npm)").option("-x, --exclude <managers>", "Exclude specified managers (comma-separated, e.g. macports,pip)").option("-t, --timeout <ms>", "Timeout per check in milliseconds", "25000").option("-v, --verbose", "Show detailed output and logs").parse(process.argv);
+  program.name("hmd").description(description || "Heimdall: resilient validator and updater for system and global packages").version(version).option("-y, --yes", "Skip confirmation prompt and update all automatically").option("-d, --dry-run", "Inspect outdated packages and simulate update without running changes").option("-o, --only <managers>", "Only check and update specified managers (comma-separated, e.g. brew,npm)").option("-x, --exclude <managers>", "Exclude specified managers (comma-separated, e.g. macports,pip)").option("-t, --timeout <ms>", "Timeout per check in milliseconds", "25000").option("-v, --verbose", "Show detailed output and logs").option("--no-distro-upgrade", "Skip the distribution release upgrade check at the end").option(
+    "-U, --upgrade-distro",
+    "Apply a detected distribution release upgrade without asking (never reboots)"
+  ).parse(process.argv);
   const options = program.opts();
   if (process.stdout.isTTY && !options.verbose) {
     console.clear();
@@ -2269,8 +3296,9 @@ async function main() {
       pc2.green("All detected package managers and global packages are completely up to date! \u{1F389}"),
       "Status: Up to Date"
     );
-    p.outro(pc2.cyan("No updates needed. Have a great day!"));
-    process.exit(0);
+    const distroOk2 = await offerDistroUpgrade(options, timeoutMs, options.dryRun ?? false);
+    p.outro(pc2.cyan("No package updates needed. Have a great day!"));
+    process.exit(distroOk2 ? 0 : 1);
   }
   p.log.message(`
 ${pc2.bold("Pending updates")} ${pc2.dim(`(${allUpdates.length} total):`)}`);
@@ -2341,6 +3369,21 @@ ${pc2.bold("Pending updates")} ${pc2.dim(`(${allUpdates.length} total):`)}`);
     process.exit(0);
   }
   const isSimulated = options.dryRun ?? false;
+  let stopSudoKeepAlive;
+  const selectedIds = new Set(managersToUpdate);
+  const needsSudo = selectedManagers.some((m) => selectedIds.has(m.id) && m.requiresSudo);
+  if (needsSudo && !isSimulated) {
+    p.log.step(pc2.dim("Requesting sudo privileges required by system package managers..."));
+    if (await ensureSudo()) {
+      stopSudoKeepAlive = startSudoKeepAlive();
+    } else {
+      p.log.warn(
+        pc2.yellow(
+          'Sudo privileges not granted: system package managers will fail. Run "sudo -v" in this terminal and retry.'
+        )
+      );
+    }
+  }
   p.log.step(
     pc2.bold(
       pc2.cyan(
@@ -2351,52 +3394,58 @@ ${isSimulated ? "[DRY RUN] Simulating" : "Starting"} updates for ${managersToUpd
   );
   const updateSpinner = p.spinner();
   let managerIndex = 0;
-  const summary = await engine.execute(
-    managersToUpdate,
-    itemsByManager,
-    {
-      verbose: options.verbose,
-      dryRun: isSimulated,
-      confirmAction: async (message) => {
-        if (options.yes) return true;
-        updateSpinner.stop(pc2.dim("Waiting for user confirmation..."));
-        const confirmed = await p.confirm({ message, initialValue: false });
-        updateSpinner.start(pc2.dim("Continuing update..."));
-        return typeof confirmed === "boolean" ? confirmed : false;
-      },
-      onStepStart: (stepName) => {
-        updateSpinner.message(pc2.dim(`Running: ${stepName}...`));
-      },
-      onStepProgress: (stepName, logLine) => {
-        if (logLine) {
-          const truncated = logLine.length > 55 ? logLine.slice(0, 52) + "..." : logLine;
-          updateSpinner.message(pc2.dim(`${stepName} [${truncated}]`));
+  let summary;
+  try {
+    summary = await engine.execute(
+      managersToUpdate,
+      itemsByManager,
+      {
+        verbose: options.verbose,
+        dryRun: isSimulated,
+        confirmAction: async (message) => {
+          if (options.yes) return true;
+          updateSpinner.stop(pc2.dim("Waiting for user confirmation..."));
+          const confirmed = await p.confirm({ message, initialValue: false });
+          updateSpinner.start(pc2.dim("Continuing update..."));
+          return typeof confirmed === "boolean" ? confirmed : false;
+        },
+        onStepStart: (stepName) => {
+          updateSpinner.message(pc2.dim(`Running: ${stepName}...`));
+        },
+        onStepProgress: (stepName, logLine) => {
+          if (logLine) {
+            const truncated = logLine.length > 55 ? logLine.slice(0, 52) + "..." : logLine;
+            updateSpinner.message(pc2.dim(`${stepName} [${truncated}]`));
+          }
+        },
+        onStepEnd: (stepName, success, error, durationMs) => {
+          const mark = success ? pc2.green("\u2714") : pc2.red("\u2716");
+          const durStr = durationMs !== void 0 ? pc2.dim(` [${formatDuration(durationMs)}]`) : "";
+          const detail = error ? pc2.red(` \u21B3 ${error.split("\n")[0]}`) : "";
+          updateSpinner.stop(`  ${mark} ${pc2.dim(stepName)}${durStr}${detail}`);
+          updateSpinner.start(pc2.dim("Working..."));
         }
       },
-      onStepEnd: (stepName, success, error, durationMs) => {
-        const mark = success ? pc2.green("\u2714") : pc2.red("\u2716");
-        const durStr = durationMs !== void 0 ? pc2.dim(` [${formatDuration(durationMs)}]`) : "";
-        const detail = error ? pc2.red(` \u21B3 ${error.split("\n")[0]}`) : "";
-        updateSpinner.stop(`  ${mark} ${pc2.dim(stepName)}${durStr}${detail}`);
-        updateSpinner.start(pc2.dim("Working..."));
-      }
-    },
-    (mgr) => {
-      managerIndex++;
-      console.log(pc2.bold(pc2.cyan(`
+      (mgr) => {
+        managerIndex++;
+        console.log(pc2.bold(pc2.cyan(`
 \u25CF [${managerIndex}/${managersToUpdate.length}] ${mgr.icon} ${mgr.name}`)));
-      updateSpinner.start(pc2.dim("Starting update routine..."));
-    },
-    (mgr, res) => {
-      if (res.success) {
-        updateSpinner.stop(pc2.green(`  \u2714 ${mgr.name} completed in ${formatDuration(res.durationMs)}`));
-      } else {
-        updateSpinner.stop(pc2.red(`  \u2716 ${mgr.name} completed with issues in ${formatDuration(res.durationMs)}`));
+        updateSpinner.start(pc2.dim("Starting update routine..."));
+      },
+      (mgr, res) => {
+        if (res.success) {
+          updateSpinner.stop(pc2.green(`  \u2714 ${mgr.name} completed in ${formatDuration(res.durationMs)}`));
+        } else {
+          updateSpinner.stop(pc2.red(`  \u2716 ${mgr.name} completed with issues in ${formatDuration(res.durationMs)}`));
+        }
       }
-    }
-  );
+    );
+  } finally {
+    stopSudoKeepAlive?.();
+  }
   console.log(renderExecutionSummary(summary.results));
-  if (summary.failedCount === 0) {
+  const distroOk = await offerDistroUpgrade(options, timeoutMs, isSimulated);
+  if (summary.failedCount === 0 && distroOk) {
     p.outro(
       pc2.bold(
         pc2.green(
@@ -2406,10 +3455,11 @@ ${isSimulated ? "[DRY RUN] Simulating" : "Starting"} updates for ${managersToUpd
     );
   } else {
     process.exitCode = 1;
+    const distroNote = distroOk ? "" : ", distribution upgrade failed";
     p.outro(
       pc2.bold(
         pc2.yellow(
-          `Completed with warnings: ${summary.successCount} succeeded, ${summary.failedCount} failed (${formatDuration(summary.totalDurationMs)}).`
+          `Completed with warnings: ${summary.successCount} succeeded, ${summary.failedCount} failed${distroNote} (${formatDuration(summary.totalDurationMs)}).`
         )
       )
     );