@inceptionstack/roundhouse 0.3.28 → 0.4.0

package/README.md

@@ -52,6 +52,30 @@ npm install -g @inceptionstack/roundhouse
 
 See [architecture.md](architecture.md) for full system diagrams, data flow, config model, and module dependency graph.
 
+## Bundle
+
+When you run `roundhouse setup`, the following are installed automatically:
+
+- **30+ Skills** (agent knowledge): Synced from [loki-skills](https://github.com/inceptionstack/loki-skills) (AWS, infrastructure, DevOps patterns)
+- **CLI Tools**: `mcporter` (MCP server bridge), `@playwright/cli` (browser automation), `uv`/`uvx` (Python package runner)
+- **Extensions** (shipped in npm, auto-discovered by pi): `web-search` (Tavily API integration)
+- **Config**: MCP server definitions copied to `~/.mcporter/mcporter.json`
+
+This gives the agent access to:
+- 15K+ AWS APIs via `mcporter call aws-mcp.*`
+- AWS documentation, CDK patterns, pricing data
+- Browser automation: navigate pages, fill forms, take screenshots
+- Real-time web search
+- All skills auto-discovered at session start
+
+### Setup time
+
+Full setup takes ~5-10 minutes on first run (includes Chromium download ~186MB). Subsequent runs are faster (skills re-sync only).
+
+### Skills location
+
+All skills are synced to `~/.pi/agent/skills/`. Your agent can reference them directly by name (e.g., "use the aws-mcp skill to...").
+
 ### Design decisions
 
 - **One gateway = one agent target.** The `agent` block in config picks the type and its settings. All chat inputs route to this single agent instance.

package/architecture.md

@@ -272,9 +272,10 @@ cli/cli.ts
   ├── cli/systemd.ts (resolveExecStart, generateUnit, writeServiceUnit, systemctl, etc.)
   ├── cli/doctor.ts → cli/doctor/runner.ts → cli/doctor/checks/*
   ├── cli/cron.ts → cron/store.ts, cron/runner.ts, cron/helpers.ts
-  └── cli/setup.ts → cli/env-file.ts, cli/systemd.ts, cli/setup-telegram.ts
+  └── cli/setup.ts → cli/env-file.ts, cli/systemd.ts, cli/setup-telegram.ts, bundle.ts
 
 gateway.ts also imports:
+  → commands/update.ts → bundle.ts (bundle provisioning)
   → cli/doctor/runner.ts for /doctor command
   → cron/scheduler.ts → cron/runner.ts → cron/store.ts
   → cron/helpers.ts, cron/format.ts
@@ -283,3 +284,4 @@ gateway.ts also imports:
 
 No circular dependencies. `types.ts` and `config.ts` are pure leaf modules.
 `util.ts` is a leaf module with runtime helpers (`node:crypto` for attachment IDs).
+`bundle.ts` is a pure leaf module (only `node:*` imports) consumed by `cli/setup.ts` and `commands/update.ts`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inceptionstack/roundhouse",
-  "version": "0.3.28",
+  "version": "0.4.0",
   "type": "module",
   "description": "Multi-platform chat gateway that routes messages through a configured AI agent",
   "license": "MIT",
@@ -33,7 +33,8 @@
     "bin/",
     "LICENSE",
     "README.md",
-    "architecture.md"
+    "architecture.md",
+    "pi/"
   ],
   "dependencies": {
     "@chat-adapter/state-memory": "^4.26.0",
@@ -47,5 +48,10 @@
   },
   "devDependencies": {
     "vitest": "^4.1.5"
+  },
+  "pi": {
+    "extensions": [
+      "./pi/extensions"
+    ]
   }
 }

package/pi/config/mcporter.json

@@ -0,0 +1,33 @@
+{
+  "mcpServers": {
+    "aws-mcp": {
+      "command": "uvx",
+      "args": ["mcp-proxy-for-aws@latest", "https://aws-mcp.us-east-1.api.aws/mcp"]
+    },
+    "aws-knowledge": {
+      "url": "https://knowledge-mcp.global.api.aws"
+    },
+    "aws-documentation": {
+      "command": "uvx",
+      "args": ["awslabs.aws-documentation-mcp-server@latest"],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR",
+        "AWS_DOCUMENTATION_PARTITION": "aws"
+      }
+    },
+    "aws-iac": {
+      "command": "uvx",
+      "args": ["awslabs.aws-iac-mcp-server@latest"],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR"
+      }
+    },
+    "aws-pricing": {
+      "command": "uvx",
+      "args": ["awslabs.aws-pricing-mcp-server@latest"],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR"
+      }
+    }
+  }
+}

package/pi/extensions/web-search.ts

@@ -0,0 +1,99 @@
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import { Type } from "typebox";
+
+export default function (pi: ExtensionAPI) {
+  pi.registerTool({
+    name: "web_search",
+    label: "Web Search",
+    description:
+      "Search the web using Tavily. Returns JSON results with title, url, and content for each result. Use this when you need current information from the internet.",
+    parameters: Type.Object({
+      query: Type.String({ description: "Search query" }),
+      num_results: Type.Optional(
+        Type.Number({ description: "Number of results (1-20, default 5)", minimum: 1, maximum: 20 })
+      ),
+      include_answer: Type.Optional(
+        Type.Boolean({ description: "Include AI-generated answer summary (default false)" })
+      ),
+    }),
+    async execute(_toolCallId, params, signal, _onUpdate, _ctx) {
+      const apiKey = process.env.TAVILY_API_KEY || "";
+      if (!apiKey) {
+        return {
+          content: [{ type: "text", text: "TAVILY_API_KEY environment variable not set. Set it to use web search." }],
+          details: { error: "missing_api_key" },
+        };
+      }
+
+      const maxResults = Math.min(Math.max(params.num_results ?? 5, 1), 20);
+      const includeAnswer = params.include_answer ?? false;
+
+      const startTime = Date.now();
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 30_000);
+      if (signal?.aborted) controller.abort();
+      else if (signal) signal.addEventListener("abort", () => controller.abort(), { once: true });
+
+      let response: Response;
+      try {
+        response = await fetch("https://api.tavily.com/search", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            query: params.query,
+            max_results: maxResults,
+            include_answer: includeAnswer,
+            api_key: apiKey,
+          }),
+          signal: controller.signal,
+        });
+      } catch (err: any) {
+        clearTimeout(timeout);
+        const msg = err.name === "AbortError" ? "Request timed out or was cancelled" : err.message;
+        return {
+          content: [{ type: "text", text: `Web search failed: ${msg}` }],
+          details: { query: params.query, error: msg },
+        };
+      } finally {
+        clearTimeout(timeout);
+      }
+
+      if (!response.ok) {
+        const errorText = await response.text();
+        return {
+          content: [{ type: "text", text: `Tavily API error (${response.status}): ${errorText}` }],
+          details: { query: params.query, error: response.status },
+        };
+      }
+
+      const data = (await response.json()) as {
+        answer?: string;
+        results?: Array<{ title: string; url: string; content: string }>;
+      };
+      const responseTime = Date.now() - startTime;
+
+      const results = data.results ?? [];
+      const parts: string[] = [];
+
+      if (includeAnswer && data.answer) {
+        parts.push(`**Answer:** ${data.answer}\n`);
+      }
+
+      for (let i = 0; i < results.length; i++) {
+        const r = results[i];
+        parts.push(`${i + 1}. **${r.title}**\n   ${r.url}\n   ${r.content}`);
+      }
+
+      const text = parts.length > 0 ? parts.join("\n\n") : "No results found.";
+
+      return {
+        content: [{ type: "text", text }],
+        details: {
+          query: params.query,
+          resultCount: results.length,
+          responseTime: `${responseTime}ms`,
+        },
+      };
+    },
+  });
+}

package/src/bundle.ts

@@ -0,0 +1,195 @@
+/**
+ * bundle.ts — Shared bundle provisioning logic
+ *
+ * Used by both setup.ts (initial install) and gateway.ts (upgrade path).
+ * All operations are non-fatal — failures are logged but don't throw.
+ */
+
+import { homedir } from "node:os";
+import { resolve, dirname } from "node:path";
+import { readFileSync, mkdirSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { fileURLToPath } from "node:url";
+
+export const SKILLS_REPO = "https://github.com/inceptionstack/loki-skills.git";
+export const SKILLS_DIR = resolve(homedir(), ".pi", "agent", "skills");
+
+export interface ProvisionLog {
+  info(msg: string): void;
+  warn(msg: string): void;
+  ok(msg: string): void;
+}
+
+const consoleLog: ProvisionLog = {
+  info: (msg) => console.log(`[roundhouse] ${msg}`),
+  warn: (msg) => console.warn(`[roundhouse] ${msg}`),
+  ok: (msg) => console.log(`[roundhouse] ✓ ${msg}`),
+};
+
+export interface ProvisionOpts {
+  force?: boolean;
+  log?: ProvisionLog;
+}
+
+function which(cmd: string): boolean {
+  try {
+    execFileSync("which", [cmd], { stdio: "pipe", timeout: 5_000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Sync skills from loki-skills repo (additive — never deletes custom skills).
+ * Removes existing skill dirs before copy to prevent nesting.
+ * Returns number of skills synced.
+ */
+export function syncSkillsFromRepo(opts: ProvisionOpts = {}): number {
+  const log = opts.log ?? consoleLog;
+
+  if (!which("git")) {
+    log.warn("git not found — skipping skill sync");
+    return 0;
+  }
+
+  log.info("Syncing skills from inceptionstack/loki-skills...");
+  const tmpDir = `/tmp/loki-skills-${randomBytes(4).toString("hex")}`;
+  try {
+    mkdirSync(SKILLS_DIR, { recursive: true });
+    execFileSync("git", ["clone", "--depth", "1", "--quiet", SKILLS_REPO, tmpDir], {
+      stdio: "pipe", timeout: 60_000,
+    });
+
+    const entries = readdirSync(tmpDir, { withFileTypes: true })
+      .filter(e => e.isDirectory() && !e.name.startsWith("."));
+
+    let count = 0;
+    for (const entry of entries) {
+      const src = resolve(tmpDir, entry.name);
+      const dest = resolve(SKILLS_DIR, entry.name);
+      // Defense-in-depth: ensure dest stays within SKILLS_DIR
+      if (!dest.startsWith(SKILLS_DIR + "/")) continue;
+      try {
+        execFileSync("rm", ["-rf", dest], { stdio: "pipe", timeout: 10_000 });
+        execFileSync("cp", ["-r", src, dest], { stdio: "pipe", timeout: 30_000 });
+        count++;
+      } catch (e: any) {
+        log.warn(`Failed to copy skill '${entry.name}': ${e.message}`);
+      }
+    }
+    log.ok(`${count} skills synced to ~/.pi/agent/skills/`);
+    return count;
+  } catch (err: any) {
+    log.warn(`Skill sync failed: ${err.message}`);
+    return 0;
+  } finally {
+    try { execFileSync("rm", ["-rf", tmpDir], { stdio: "pipe" }); } catch {}
+  }
+}
+
+/**
+ * Install mcporter globally via npm.
+ */
+export function provisionMcporter(opts: ProvisionOpts = {}): void {
+  const log = opts.log ?? consoleLog;
+  if (which("mcporter") && !opts.force) {
+    log.ok("mcporter (already installed)");
+    return;
+  }
+  log.info("Installing mcporter...");
+  try {
+    execFileSync("npm", ["install", "-g", "mcporter"], { stdio: "pipe", timeout: 120_000 });
+    log.ok("mcporter");
+  } catch (err: any) {
+    log.warn(`mcporter install failed: ${err.message}`);
+  }
+}
+
+/**
+ * Install @playwright/cli globally and download Chromium.
+ */
+export function provisionPlaywright(opts: ProvisionOpts = {}): void {
+  const log = opts.log ?? consoleLog;
+  const alreadyInstalled = which("playwright-cli");
+  if (alreadyInstalled && !opts.force) {
+    // Ensure Chromium is downloaded (idempotent — fast no-op if present)
+    try {
+      execFileSync("playwright-cli", ["install"], { stdio: "pipe", timeout: 300_000 });
+    } catch {
+      log.warn("Chromium may be missing — run 'playwright-cli install' manually");
+    }
+    log.ok("playwright-cli (already installed)");
+    return;
+  }
+  log.info("Installing @playwright/cli...");
+  try {
+    execFileSync("npm", ["install", "-g", "@playwright/cli"], { stdio: "pipe", timeout: 120_000 });
+    log.info("Downloading Chromium (one-time, ~186MB)...");
+    try {
+      execFileSync("playwright-cli", ["install"], { stdio: "pipe", timeout: 300_000 });
+      log.ok("playwright-cli + Chromium");
+    } catch {
+      log.warn("Chromium download failed — run 'playwright-cli install' manually");
+    }
+  } catch (err: any) {
+    log.warn(`playwright-cli install failed: ${err.message}`);
+  }
+}
+
+/**
+ * Install uv/uvx via official installer.
+ */
+export function provisionUvx(opts: ProvisionOpts = {}): void {
+  const log = opts.log ?? consoleLog;
+  const uvxPath = resolve(homedir(), ".local", "bin", "uvx");
+  if ((which("uvx") || existsSync(uvxPath)) && !opts.force) {
+    log.ok("uv/uvx (already installed)");
+    return;
+  }
+  log.info("Installing uv/uvx...");
+  try {
+    execFileSync("bash", ["-c", "curl -fsSL https://astral.sh/uv/install.sh | sh"], {
+      stdio: "pipe", timeout: 120_000,
+      env: { ...process.env, HOME: homedir() },
+    });
+    log.ok("uv/uvx");
+  } catch (err: any) {
+    log.warn(`uv install failed: ${err.message}`);
+    log.warn("Install manually: curl -LsSf https://astral.sh/uv/install.sh | sh");
+  }
+}
+
+/**
+ * Copy bundled mcporter.json to ~/.mcporter/ if missing or forced.
+ */
+export function provisionMcporterConfig(opts: ProvisionOpts = {}): void {
+  const log = opts.log ?? consoleLog;
+  const mcporterDir = resolve(homedir(), ".mcporter");
+  const mcporterConfig = resolve(mcporterDir, "mcporter.json");
+  if (existsSync(mcporterConfig) && !opts.force) {
+    log.ok("~/.mcporter/mcporter.json (exists, keeping)");
+    return;
+  }
+  try {
+    const bundled = resolve(dirname(fileURLToPath(import.meta.url)), "..", "pi", "config", "mcporter.json");
+    mkdirSync(mcporterDir, { recursive: true });
+    writeFileSync(mcporterConfig, readFileSync(bundled, "utf8"), { mode: 0o644 });
+    log.ok("~/.mcporter/mcporter.json");
+  } catch (err: any) {
+    log.warn(`mcporter config copy failed: ${err.message}`);
+  }
+}
+
+/**
+ * Provision all bundle dependencies (skills + CLI tools + config).
+ * Non-fatal — logs warnings on failure but never throws.
+ */
+export function provisionBundle(opts: ProvisionOpts = {}): void {
+  syncSkillsFromRepo(opts);
+  provisionMcporter(opts);
+  provisionPlaywright(opts);
+  provisionUvx(opts);
+  provisionMcporterConfig(opts);
+}

package/src/cli/cli.ts

@@ -9,6 +9,7 @@ import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { readdirSync, statSync } from "node:fs";
 import { execSync, execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { performUpdate } from "../commands/update";
 
 import {
   CONFIG_DIR,
@@ -48,7 +49,8 @@ const __dirname = dirname(__filename);
  */
 function run(cmd: string, opts?: { silent?: boolean }): string {
   try {
-    return execSync(cmd, { encoding: "utf8", stdio: opts?.silent ? "pipe" : "inherit" }).trim();
+    const out = execSync(cmd, { encoding: "utf8", stdio: opts?.silent ? "pipe" : "inherit" });
+    return (out ?? "").trim();
   } catch (e: any) {
     if (opts?.silent) return "";
     throw e;
@@ -157,8 +159,15 @@ async function cmdUninstall() {
 }
 
 async function cmdUpdate() {
-  console.log("[roundhouse] Updating to latest version...\n");
-  run("npm update -g roundhouse");
+  const progress = { update: async (msg: string) => console.log(msg) };
+  const result = await performUpdate(progress);
+
+  if (result.action === "already-latest") {
+    console.log(`[roundhouse] Already on latest (v${result.currentVersion})`);
+    return;
+  }
+
+  console.log(`[roundhouse] Updated to v${result.latestVersion}`);
   console.log("\n[roundhouse] Restarting daemon...");
   try {
     systemctl("restart", "Updated and restarted.");

package/src/cli/setup.ts

@@ -15,6 +15,7 @@ import { readFile, writeFile, mkdir, rename, unlink, realpath, stat } from "node
 import { execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { BOT_COMMANDS } from "../commands";
+import { provisionBundle, type ProvisionLog } from "../bundle";
 import {
   ROUNDHOUSE_DIR,
   CONFIG_PATH,
@@ -131,10 +132,14 @@ function resolveAgentForSetup(opts: SetupOptions): AgentDefinition {
       // Ensure packages array exists
       if (!Array.isArray(settings.packages)) settings.packages = [];
 
+      // Add roundhouse itself (ships extensions via pi.extensions in package.json)
+      const selfPkg = "npm:@inceptionstack/roundhouse";
+      const pkgs = settings.packages as string[];
+      if (!pkgs.includes(selfPkg)) pkgs.push(selfPkg);
+
       // Add pi-psst if using psst
       if (ctx.psst) {
         const psstPkg = "npm:@miclivs/pi-psst";
-        const pkgs = settings.packages as string[];
         if (!pkgs.includes(psstPkg)) pkgs.push(psstPkg);
       }
 
@@ -621,6 +626,20 @@ async function stepStoreSecrets(opts: SetupOptions, botInfo: BotInfo): Promise<v
   }
 }
 
+// ── Bundle install ──────────────────────────────────────────────────
+
+async function stepInstallBundle(opts: SetupOptions): Promise<void> {
+  step("⑥b", "Installing bundle (skills + CLI tools)...");
+
+  const bundleLog: ProvisionLog = {
+    info: (msg) => log(`   ${msg}`),
+    warn: (msg) => warn(msg),
+    ok: (msg) => ok(msg),
+  };
+
+  provisionBundle({ force: opts.force, log: bundleLog });
+}
+
 async function stepConfigure(
   opts: SetupOptions,
   botInfo: BotInfo,
@@ -921,6 +940,9 @@ async function runInteractiveTelegramSetup(opts: SetupOptions): Promise<void> {
     // Step 5: Install packages
     await stepInstallPackages(opts, agent);
 
+    // Step 5b: Install bundle (skills + CLI tools)
+    await stepInstallBundle(opts);
+
     // Step 6: Pair via Telegram
     step("⑥", "Pairing with Telegram...");
     const nonce = createPairingNonce();
@@ -1014,6 +1036,9 @@ async function runHeadlessTelegramSetup(opts: SetupOptions): Promise<void> {
     await stepInstallPackages(opts, agent);
     logger.ok("Packages installed");
 
+    // Step 4b: Install bundle
+    await stepInstallBundle(opts);
+
     // Step 5: Create pending pairing
     logger.step(5, 9, "pairing.pending", "Creating pending pairing");
     let nonce: string;
@@ -1153,6 +1178,9 @@ export async function cmdSetup(argv: string[]): Promise<void> {
     // Phase 2: Install packages
     await stepInstallPackages(opts, agent);
 
+    // Phase 2b: Install bundle (skills + CLI tools)
+    await stepInstallBundle(opts);
+
     // Phase 3: Pair (before secrets/config, so paired username is included)
     const pairResult = await stepPair(opts, botInfo);
 

package/src/cli/systemd.ts

@@ -132,7 +132,7 @@ export function generateUnit(opts: UnitOptions): string {
   const user = opts.user || process.env.USER || "root";
   const envFilePath = opts.envFilePath || ENV_FILE_PATH;
   const home = homedir();
-  const pathValue = `${opts.nodeBinDir}:/usr/local/bin:/usr/bin:/bin`;
+  const pathValue = `${opts.nodeBinDir}:${home}/.local/bin:/usr/local/bin:/usr/bin:/bin`;
 
   // Validate all interpolated values before generating the unit
   for (const [label, value] of Object.entries({

package/src/commands/update.ts

@@ -0,0 +1,69 @@
+/**
+ * commands/update.ts — Handle the /update command
+ *
+ * Transport-agnostic: receives a ProgressReporter interface,
+ * not a Telegram-specific thread object.
+ */
+
+import { homedir } from "node:os";
+import { execSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { provisionBundle } from "../bundle";
+
+export interface UpdateProgress {
+  update(text: string): Promise<void>;
+}
+
+export interface UpdateResult {
+  action: "already-latest" | "updated";
+  currentVersion: string;
+  latestVersion?: string;
+}
+
+/**
+ * Check for updates, install if newer, provision bundle, patch settings.
+ * Returns the result — caller decides how to present it and whether to restart.
+ */
+export async function performUpdate(progress: UpdateProgress): Promise<UpdateResult> {
+  // Get current version
+  const pkg = await import("../../package.json", { with: { type: "json" } });
+  const currentVersion = pkg.default?.version ?? "unknown";
+
+  // Check latest version on npm
+  const latestVersion = execSync("npm view @inceptionstack/roundhouse version 2>/dev/null", {
+    timeout: 30_000,
+    encoding: "utf8",
+  }).trim();
+
+  if (!latestVersion || latestVersion === currentVersion) {
+    return { action: "already-latest", currentVersion };
+  }
+
+  await progress.update(`📦 Updating v${currentVersion} → v${latestVersion}...`);
+
+  execSync("npm install -g @inceptionstack/roundhouse@latest 2>&1", {
+    timeout: 120_000,
+    encoding: "utf8",
+  });
+
+  // Provision bundle (skills sync + CLI tools + config)
+  try {
+    provisionBundle();
+  } catch (e) {
+    console.warn("[roundhouse] bundle provisioning failed:", e instanceof Error ? e.message : e);
+  }
+
+  // Ensure settings.json includes roundhouse package (for pre-bundle upgrades)
+  try {
+    const settingsPath = `${homedir()}/.pi/agent/settings.json`;
+    const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+    const selfPkg = "npm:@inceptionstack/roundhouse";
+    if (!Array.isArray(settings.packages)) settings.packages = [];
+    if (!settings.packages.includes(selfPkg)) {
+      settings.packages.push(selfPkg);
+      writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    }
+  } catch { /* settings.json may not exist yet — fine, setup will create it */ }
+
+  return { action: "updated", currentVersion, latestVersion };
+}

package/src/commands.ts

@@ -16,6 +16,7 @@ export const BOT_COMMANDS: BotCommand[] = [
   { command: "verbose", description: "Toggle verbose tool output" },
   { command: "stop", description: "Stop the current agent run" },
   { command: "restart", description: "Restart agent process" },
+  { command: "update", description: "Update roundhouse and restart" },
   { command: "status", description: "Show system status" },
   { command: "doctor", description: "Run diagnostics" },
   { command: "crons", description: "List scheduled cron jobs" },

package/src/gateway.ts

@@ -48,7 +48,6 @@ function isCommandWithArgs(text: string, cmd: string): boolean {
   return suffix.toLowerCase() === _botUsername.toLowerCase();
 }
 import { hostname, loadavg, totalmem, freemem, cpus } from "node:os";
-import { homedir } from "node:os";
 
 /** Get system resource info */
 function getSystemResources() {
@@ -478,6 +477,35 @@ export class Gateway {
         return;
       }
 
+      // Handle /update command — update roundhouse then restart
+      if (isCommand(userText.trim(), "/update")) {
+        if (allowedUsers.length === 0 && allowedUserIds.length === 0) {
+          await thread.post("⚠️ /update requires an allowlist to be configured.");
+          return;
+        }
+        console.log(`[roundhouse] /update requested by @${authorName} in thread=${thread.id}`);
+        const progress = await createProgressMessage(thread, "📦 Checking for updates...");
+        try {
+          const { performUpdate } = await import("./commands/update");
+          const result = await performUpdate(progress);
+          if (result.action === "already-latest") {
+            await progress.update(`✅ Already on latest (v${result.currentVersion})`);
+          } else if (result.action === "updated") {
+            await progress.update(`✅ Updated v${result.currentVersion} → v${result.latestVersion}. Restarting...`);
+            console.log(`[roundhouse] updated ${result.currentVersion} -> ${result.latestVersion}, restarting`);
+            setTimeout(async () => {
+              try { await this.stop(); } catch (e) { console.error("[roundhouse] stop error:", e); }
+              process.exit(75);
+            }, 1500);
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          await progress.update(`⚠️ Update failed: ${msg.slice(0, 200)}`);
+          console.error(`[roundhouse] /update failed:`, msg);
+        }
+        return;
+      }
+
       // Handle /compact command — flush memory then compact session context
       // Routed through the per-thread lock to prevent concurrent agent access
       if (isCommand(userText.trim(), "/compact")) {