@makerstufferupper/flypi 0.1.2 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@makerstufferupper/flypi",
-	"version": "0.1.2",
+	"version": "0.1.4",
 	"type": "module",
 	"description": "Local multi-model agent tool with a browser UI and a personal knowledge wiki, built on the pi SDK.",
 	"license": "MIT",
@@ -24,6 +24,7 @@
 	},
 	"scripts": {
 		"probe": "tsx scripts/probe.ts",
+		"probe:pi": "tsx scripts/probe-pi.ts",
 		"probe:turn": "tsx scripts/probe-turn-boundary.ts",
 		"probe:boundary": "tsx scripts/turn-boundary.ts",
 		"start": "node scripts/start.mjs",
@@ -46,17 +47,17 @@
 		"release": "node scripts/release.mjs"
 	},
 	"dependencies": {
-		"@earendil-works/pi-coding-agent": "^1.0.4",
+		"@earendil-works/pi-coding-agent": "^1.4.0",
 		"@huggingface/transformers": "^4.3.1",
 		"@modelcontextprotocol/sdk": "^1.32.1",
-		"tsx": "^4.23.15",
 		"marked": "18.0.11",
+		"tsx": "^4.23.15",
 		"typebox": "^1.3.27",
 		"ws": "^8.22.0",
 		"yaml": "^2.9.0"
 	},
 	"devDependencies": {
-		"@earendil-works/pi-ai": "^1.0.4",
+		"@earendil-works/pi-ai": "^1.4.0",
 		"@modelcontextprotocol/server-filesystem": "^1.0.0",
 		"@sveltejs/vite-plugin-svelte": "^7.3.1",
 		"@testing-library/svelte": "^5.4.2",
@@ -68,5 +69,12 @@
 		"typescript": "^7.0.2",
 		"vite": "^8.3.3",
 		"vitest": "^5.0.3"
+	},
+	"allowScripts": {
+		"@google/genai@2.21.0": true,
+		"esbuild@0.28.2": true,
+		"fsevents@2.3.3": true,
+		"onnxruntime-node@1.30.0": true,
+		"protobufjs@7.6.6": true
 	}
 }

package/scripts/flypi.mjs

@@ -7,15 +7,17 @@
  * detached, wait until `/healthz` answers, and report the URL you would otherwise have to dig out of a log.
  *
  *   node scripts/flypi.mjs start [--foreground]   # or: npm run flypi -- start
+ *   node scripts/flypi.mjs start --foreground --port 8791 --host 0.0.0.0   # the container entry point
  *   node scripts/flypi.mjs status | stop | restart | logs [-n 50] [-f]
  *   node scripts/flypi.mjs update [--check]        # the newest published flypi (docs/architecture.md Phase 7)
+ *   node scripts/flypi.mjs pi [list | available | use <v> | rollback | unpin]   # which pi it runs (docs/pi-upgrades.md Phase 8.3)
  *
  * `--root DIR` (or FLYPI_ROOT) picks which `.flypi/` the CLI owns; in a checkout it defaults to the cwd,
  * and the installed `bin/flypi.mjs` sets FLYPI_ROOT to the home directory before importing this.
  */
 import { mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 const argv = process.argv.slice(2);
@@ -31,6 +33,7 @@ const checkout = resolve(fileURLToPath(import.meta.url), "..", "..");
 const serveDaemon = resolve(fileURLToPath(import.meta.url), "..", "serve-daemon.ts");
 const secretCli = resolve(fileURLToPath(import.meta.url), "..", "secret.ts");
 const updateCli = resolve(fileURLToPath(import.meta.url), "..", "update.ts");
+const piCli = resolve(fileURLToPath(import.meta.url), "..", "pi.ts");
 const infoPath = resolve(root, ".flypi", "daemon.json");
 const logPath = resolve(root, ".flypi", "daemon.log");
 /**
@@ -160,6 +163,8 @@ function report(info, status) {
 	console.log(`flypi: agent   http://${info.host}:${info.port}  (token ${info.token})`);
 	console.log(`flypi: memory  http://127.0.0.1:${info.memoryPort}/mcp`);
 	if (status) console.log(`flypi: started ${status.startedAt}, version ${status.version}, ${status.jobs} job(s) queued`);
+	// Which pi it loaded (src/daemon/pi.ts) — not the range package.json declares, which is the point.
+	if (status?.pi) console.log(`flypi: pi       ${status.pi.version}${status.pi.pinned ? " (pinned)" : ""}${status.pi.bundled ? ` — the installed tree holds ${status.pi.bundled}` : ""}`);
 	// The daemon's own daily answer (src/daemon/update.ts) — `status` does not reach the network itself.
 	if (status?.updateAvailable) console.log(`flypi: ${status.updateAvailable} is available — \`flypi update\` installs it`);
 	if (status?.updateReady) console.log(`flypi: ${status.updateReady} is downloaded — it installs once the daemon has been idle`);
@@ -185,8 +190,21 @@ async function start({ foreground = false, previous } = {}) {
 	// sticky — and it merges, so naming just `--port` does not drop an `--host` that is still in force.
 	const namedFlags = { ...(flagValue("--port") ? { port: Number(flagValue("--port")) } : {}), ...(flagValue("--host") ? { host: flagValue("--host") } : {}) };
 	if (Object.keys(namedFlags).length > 0) writeFileSync(flagsPath, `${JSON.stringify({ ...readJson(flagsPath), ...namedFlags })}\n`);
+	// Which pi the daemon is about to resolve (src/daemon/pi.ts). A flypi upgrade can replace the package
+	// directory and take the pointer with it, so a pin whose tree exists is re-applied here — in this process,
+	// which has not imported pi, and before the daemon exists, because a daemon resolves its module graph at
+	// import and cannot re-pick its own pi.
+	const relink = spawnSync(process.execPath, ["--import", "tsx", piCli, "--root", root, "relink"], { cwd: checkout, encoding: "utf8" });
+	if (relink.stdout?.trim()) console.log(relink.stdout.trim());
+	if (relink.status !== 0) console.error(`flypi: the pi pin could not be applied: ${(relink.stderr ?? "").trim() || `it exited ${relink.status}`}`);
 	if (foreground) {
 		const child = spawn(process.execPath, ["--import", "tsx", serveDaemon, "--root", root, ...flags], { cwd: checkout, stdio: "inherit" });
+		// Ctrl-C and `docker stop` reach this process, not the daemon. PID 1 in a pid namespace drops a signal it
+		// has no handler for, so without this the SIGTERM never arrives: docker waits out its grace period and
+		// SIGKILLs a daemon that never got to remove its pid file, close its sockets or record an interrupted
+		// turn. Installing the handler is what makes the signal be delivered; forwarding is what makes the
+		// daemon run its own shutdown, and the exit code comes from the daemon rather than from this wrapper.
+		for (const signal of ["SIGINT", "SIGTERM"]) process.on(signal, () => child.kill(signal));
 		return new Promise((done) => child.on("exit", (code) => done(code ?? 0)));
 	}
 	// The log's directory is created above, not assumed.
@@ -281,6 +299,12 @@ const flagNumber = (name) => {
 	const i = argv.indexOf(name);
 	return i === -1 ? undefined : Number(argv[i + 1]);
 };
+/** `flypi pi …` (docs/pi-upgrades.md Phase 8.3): which pi this flypi runs, and moving it. */
+async function pi(args) {
+	const child = spawn(process.execPath, ["--import", "tsx", piCli, "--root", root, ...args], { cwd: checkout, stdio: "inherit" });
+	return new Promise((done) => child.on("exit", (code) => done(code ?? 0)));
+}
+
 const result = await {
 	start: () => start({ foreground: argv.includes("--foreground") }),
 	stop,
@@ -295,9 +319,10 @@ const result = await {
 	logs: () => logs({ ...(flagNumber("-n") ? { lines: flagNumber("-n") } : {}), follow: argv.includes("-f") || argv.includes("--follow") }),
 	secret: () => secret(argv.slice(1)),
 	update: () => update(argv.slice(1)),
+	pi: () => pi(argv.slice(1)),
 }[command]?.();
 if (result === undefined) {
-	console.log("usage: flypi [--root DIR] start [--foreground] [--port N] [--host H] [--embeddings none] [--judge none] | stop | restart | status | logs [-n N] [-f] | update [--check] | secret …");
+	console.log("usage: flypi [--root DIR] start [--foreground] [--port N] [--host H] [--embeddings none] [--judge none] | stop | restart | status | logs [-n N] [-f] | update [--check] | pi [list | available | use <version> | rollback | unpin] | secret …");
 	process.exit(2);
 }
 process.exit(result);

package/scripts/pi.ts

@@ -0,0 +1,150 @@
+/**
+ * `flypi pi …` — which pi this flypi runs, and how to move it (docs/pi-upgrades.md Phase 8.3).
+ *
+ *   flypi pi list                       the loaded version, the pin, and the trees on disk
+ *   flypi pi available                  what the registry publishes, one rung at a time
+ *   flypi pi use <version>              probe it, flip the pointer, restart, keep it only if it answers
+ *   flypi pi rollback                   back to the pinned predecessor or the tree flypi shipped with
+ *   flypi pi unpin                      put the installed pi back where npm put it
+ *   flypi pi relink                     re-apply the pin after an upgrade dropped the link (run by `start`)
+ *
+ * Run through the CLI (`scripts/flypi.mjs` spawns this the way it spawns `update.ts`), because the flip has
+ * to happen in a process that has not imported pi yet — the daemon resolves its module graph at import, so
+ * it cannot re-pick its own pi.
+ */
+import { readFileSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import { readDaemonInfo } from "../src/daemon/index.ts";
+import {
+	bundledPiVersion,
+	loadedPi,
+	piTrees,
+	readPiPin,
+	piScope,
+	scopeVersion,
+	restoreBundledScope,
+	relinkFromPin,
+	switchPiVersion,
+	PI_PACKAGE,
+} from "../src/daemon/pi.ts";
+import { checkForUpdate } from "../src/daemon/update.ts";
+
+const argv = process.argv.slice(2);
+const rootAt = argv.indexOf("--root");
+const root = resolve(rootAt === -1 ? process.env.FLYPI_ROOT ?? process.cwd() : argv.splice(rootAt, 2)[1]!);
+const command = argv[0] ?? "list";
+const cli = resolve(import.meta.dirname, "flypi.mjs");
+
+/**
+ * Stop and start the daemon through the CLI, so the port and interface carry over as they always do — but
+ * only when one is running. `flypi restart` on a stopped daemon *starts* it, which would turn "move pi" into
+ * a first run: a new `.flypi/`, a model download, a server on a port nobody asked for.
+ */
+const restart = async (): Promise<void> => {
+	if (!(await piFromHealth())) return;
+	await new Promise<void>((done) => {
+		const child = spawn(process.execPath, [cli, "--root", root, "restart"], { stdio: "inherit" });
+		child.on("exit", () => done());
+	});
+};
+
+/** What `/healthz` says about pi — null when no daemon is answering. */
+const piFromHealth = async () => {
+	const info = readDaemonInfo(root);
+	if (!info) return null;
+	try {
+		return ((await (await fetch(`http://127.0.0.1:${info.port}/healthz`)).json()) as { pi?: { version: string; pinned: boolean; bundled?: string } }).pi ?? null;
+	} catch {
+		return null;
+	}
+};
+
+/**
+ * What the switch should believe about what is running: the daemon's own answer when one is up, and otherwise
+ * what the pointer now says — the version the next process will load. Without the second half a switch made
+ * while the daemon was stopped would be judged a failure and reverted.
+ */
+const piAfterSwitch = async (): Promise<{ version: string; pinned: boolean; bundled?: string } | null> => {
+	const health = await piFromHealth();
+	if (health) return health;
+	const loaded = scopeVersion(piScope());
+	return loaded ? { version: loaded, pinned: true } : null;
+};
+
+const logTail = () => {
+	try {
+		return readFileSync(resolve(root, ".flypi", "daemon.log"), "utf8").trimEnd().split("\n").slice(-20).join("\n");
+	} catch {
+		return "";
+	}
+};
+
+const report = async ({ ok, message }: { ok: boolean; message: string }): Promise<number> => {
+	console.log(message);
+	return ok ? 0 : 1;
+};
+
+switch (command) {
+	case "relink": {
+		// `flypi start` runs this before it spawns the daemon: the daemon resolves pi at import, so the link
+		// has to be right before it starts, not after.
+		// Silent when there is nothing to say: `flypi start` runs this every time, and a line about a pin that
+		// did nothing would be noise on every start of every machine that never pinned pi.
+		const line = relinkFromPin(root, piScope());
+		if (line) console.log(`flypi: ${line}`);
+		break;
+	}
+	case "list": {
+		const pi = loadedPi(root);
+		const pin = readPiPin(root);
+		console.log(`flypi: pi ${pi.version}${pi.pinned ? " (pinned)" : ""}${pi.bundled ? `, installed tree holds ${pi.bundled}` : ""}`);
+		console.log(`flypi: trees on disk: ${piTrees(root).join(", ") || "none"}${bundledPiVersion(root) ? `; bundled ${bundledPiVersion(root)}` : ""}`);
+		if (pin) console.log(`flypi: pinned to ${pin.version} since ${pin.pinnedAt}${pin.verified ? "" : " — never confirmed to have started"}`);
+		break;
+	}
+	case "available": {
+		// The same registry answer flypi's own ladder is built from, pointed at pi's package name: one rung at
+		// a time, because a jump runs one version's session/config format change over a file the intermediate
+		// version would have stepped.
+		const current = loadedPi(root).version;
+		const check = await checkForUpdate({ current, name: PI_PACKAGE });
+		if (check.error) {
+			console.log(`flypi: ${check.error}`);
+			break;
+		}
+		console.log(`flypi: pi ${current} is running; the newest published is ${check.latest}`);
+		console.log(`flypi: one rung at a time — ${check.next ? `flypi pi use ${check.next}` : "nothing newer than what is running"}`);
+		break;
+	}
+	case "use": {
+		const version = argv[1];
+		if (!version) {
+			console.log("flypi: `flypi pi use <version>` — `flypi pi available` lists what is published");
+			process.exit(2);
+		}
+		process.exit(await report(await switchPiVersion(version, { root, scope: piScope(), restart, pi: piFromHealth, logTail })));
+	}
+	case "rollback": {
+		const pin = readPiPin(root);
+		const back = pin?.from ?? bundledPiVersion(root);
+		if (!back) {
+			console.log("flypi: nothing to roll back to — no pin, and the tree flypi was installed with is not on disk");
+			process.exit(1);
+		}
+		process.exit(await report(await switchPiVersion(back, { root, scope: piScope(), restart, pi: piFromHealth, logTail })));
+	}
+	case "unpin": {
+		const restored = restoreBundledScope(root, piScope());
+		if (!restored.ok) {
+			console.log(`flypi: ${restored.message}`);
+			process.exit(1);
+		}
+		if (await piFromHealth()) spawnSync(process.execPath, [cli, "--root", root, "restart"], { stdio: "inherit" });
+		console.log(`flypi: ${restored.message}; the pin is gone`);
+		break;
+	}
+	default:
+		console.log("usage: flypi pi [list | available | use <version> | rollback | unpin]");
+		process.exit(2);
+}

package/scripts/probe-pi.ts

@@ -0,0 +1,18 @@
+/**
+ * Stage 1 of the pi upgrade probe (docs/pi-upgrades.md Phase 8.2): does a candidate pi still offer the
+ * surface flypi imports? Imports, deep paths and the Node floor, in a child process, with nothing restarted.
+ *
+ * Run: `npm run probe:pi -- --candidate DIR` — DIR is a tree built by `npm install --prefix` (Phase 8.3), or
+ * this repo's own root to check the pi that is already installed. Exit 0 clean, 1 with one line per problem.
+ *
+ * A clean run means "nothing renamed, moved or raised a floor", not "flypi works on it". The behavioural
+ * half of pi's API is only covered by `npm test` and `npm run smoke` (docs/risks.md risk 14).
+ */
+import { checkPiCompat } from "../src/agent/pi-compat.ts";
+
+const argv = process.argv.slice(2);
+const candidate = argv[argv.indexOf("--candidate") + 1] ?? process.cwd();
+const failures = await checkPiCompat(candidate);
+for (const failure of failures) console.error(`pi compat: ${failure}`);
+console.log(failures.length ? `pi compat: ${failures.length} problem(s) in ${candidate}` : `pi compat: ok — ${candidate}`);
+process.exit(failures.length ? 1 : 0);

package/scripts/release.mjs

@@ -14,7 +14,10 @@ import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 
 const argv = process.argv.slice(2);
-const dryRun = argv.includes("--dry-run");
+// `npm run release patch --dry-run` hands `--dry-run` to npm, not to this script, but npm does export it as
+// config — so a "dry run" of the release really bumped the version, committed, tagged and pushed, and only the
+// publish was dry. Read both, so the flag means what it says whichever way it arrives.
+const dryRun = argv.includes("--dry-run") || process.env.npm_config_dry_run === "true";
 const kind = argv.find((a) => ["patch", "minor", "major", "preminor", "premajor"].includes(a)) ?? "patch";
 
 /** `remote: true` marks the two steps that leave this machine, so the dry-run output says which is which. */

package/scripts/serve.ts

@@ -19,6 +19,7 @@ import { SessionRegistry } from "../src/server/session-registry.ts";
 import { openRunStore } from "../src/server/run-store.ts";
 import { secretsApi } from "../src/server/secrets-api.ts";
 import { openSecretVault, type SecretStore } from "../src/secrets/vault.ts";
+import { loadedPi } from "../src/daemon/pi.ts";
 import { startFlypiServer } from "../src/server/index.ts";
 
 const argv = process.argv.slice(2);
@@ -63,6 +64,7 @@ const server = await startFlypiServer({
 	port: flagValue("--port") ? Number(flagValue("--port")) : undefined,
 	token: flagValue("--token") ?? process.env.FLYPI_TOKEN,
 	serverVersion: "dev",
+	pi: () => loadedPi(paths.root),
 	// An interrupted turn is a backend fact, so it is answered from the backend's store here too.
 	interruptedRun: (sessionFile) => runs.interruptedFor(sessionFile),
 	// Prod: the same server serves the built UI (docs/architecture.md: "Dev vs prod").

package/src/agent/packages.ts

@@ -24,6 +24,7 @@
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { DefaultPackageManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { isNewer, published } from "../daemon/update.ts";
 import { FlypiConfigError } from "./runtime.ts";
 import type { FlypiPaths } from "./paths.ts";
 
@@ -31,6 +32,8 @@ import type { FlypiPaths } from "./paths.ts";
 export const PACKAGE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 /** The answer, next to flypi's own update stamp, so the panel reports it without reaching the network. */
 export const PACKAGE_CHECK_FILE = join(".flypi", "package-check.json");
+/** shortcut: the picker offers the 30 newest releases; going further back means editing the source by hand. */
+export const PUBLISHED_LIST_MAX = 30;
 
 /** One `packages` entry, as the panel shows it. */
 export interface PackageRow {
@@ -42,8 +45,16 @@ export interface PackageRow {
 	installed: boolean;
 	/** Where the code is: `.flypi/agent/npm/node_modules/<name>`, a checkout, or the local path. */
 	path: string;
+	/** The version its own `package.json` says it is — what a rollback has to name (docs/pi-upgrades.md). */
+	version?: string;
 	/** A newer release is published (npm) or the remote moved (git). Only from the daemon's stamp. */
 	update?: boolean;
+	/** The npm package an `npm:` source names, version stripped — what a pin is written onto. Absent for a git URL or a path. */
+	name?: string;
+	/** The published releases the daemon's stamp knows, oldest first — what "install this version" offers. */
+	versions?: string[];
+	/** The newest of those that is newer than what is installed. Absent when nothing newer is published. */
+	available?: string;
 }
 
 export interface PackageSnapshot {
@@ -65,15 +76,53 @@ export interface PackageCheck {
 	checkedAt: string;
 	/** The `packages` entries, exactly as settings.json holds them. */
 	updates: string[];
+	/** Published releases per npm source, oldest first — the rollback list the panel offers (docs/pi-upgrades.md). */
+	versions?: Record<string, string[]>;
 	error?: string;
 }
 
+/**
+ * The npm package an `npm:` source names, with any version or range it pins stripped: `npm:foo@^1.2` and
+ * `npm:foo` are both `foo`, and `npm:@scope/foo@1.0.0` is `@scope/foo`. Undefined for a git URL or a path,
+ * which have no registry to ask. This is also what tells a reader the source is pinned — a source that names
+ * a version is not `npm:<name>` any more.
+ */
+export function npmName(source: string): string | undefined {
+	if (!source.startsWith("npm:")) return undefined;
+	const name = source.slice("npm:".length).trim().replace(/@[^/@]*$/, "");
+	return name || undefined;
+}
+
 /** pi's package manager, on flypi's own agent dir, plus the settings file it writes through. */
 function packages(paths: FlypiPaths): { manager: DefaultPackageManager; settings: SettingsManager } {
 	const settings = SettingsManager.create(paths.root, paths.agentDir);
 	return { manager: new DefaultPackageManager({ cwd: paths.root, agentDir: paths.agentDir, settingsManager: settings }), settings };
 }
 
+/** The version an installed extension's own `package.json` claims. Null when it cannot be read. */
+function installedVersion(path: string): string | undefined {
+	try {
+		return (JSON.parse(readFileSync(join(path, "package.json"), "utf8")) as { version?: string }).version;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * `updates` in `.flypi/agent/settings.json`: may the daemon install an extension update by itself, on the
+ * same idle stretch it installs flypi with? Default true — the behaviour that predates the key. It is the
+ * path an incompatible change arrives by, so it is now something a user can turn off; pi itself has no
+ * equivalent and never updates unattended (docs/pi-upgrades.md).
+ */
+export function autoExtensions(paths: FlypiPaths): boolean {
+	try {
+		const settings = JSON.parse(readFileSync(paths.settingsPath, "utf8")) as { updates?: { autoExtensions?: unknown } };
+		return settings.updates?.autoExtensions !== false;
+	} catch {
+		return true;
+	}
+}
+
 /** What pi could not read or write, named by file — a settings.json it cannot parse is never silently "empty". */
 function settingsErrors(settings: SettingsManager): string[] {
 	return settings.drainErrors().map((failure) => `${failure.path ?? failure.scope}: ${failure.error.message}`);
@@ -84,13 +133,23 @@ export function readPackages(paths: FlypiPaths): PackageSnapshot {
 	const { manager, settings } = packages(paths);
 	const check = readPackageCheck(paths.root);
 	return {
-		packages: manager.listConfiguredPackages().map((entry) => ({
-			source: entry.source,
-			scope: entry.scope,
-			installed: entry.installedPath !== undefined,
-			path: entry.installedPath ?? "",
-			...(check?.updates.includes(entry.source) ? { update: true } : {}),
-		})),
+		packages: manager.listConfiguredPackages().map((entry) => {
+			const name = npmName(entry.source);
+			const version = entry.installedPath ? installedVersion(entry.installedPath) : undefined;
+			const versions = check?.versions?.[entry.source];
+			const available = versions?.filter((v) => !version || isNewer(version, v)).at(-1);
+			return {
+				source: entry.source,
+				scope: entry.scope,
+				installed: entry.installedPath !== undefined,
+				path: entry.installedPath ?? "",
+				...(version ? { version } : {}),
+				...(check?.updates.includes(entry.source) ? { update: true } : {}),
+				...(name ? { name } : {}),
+				...(versions?.length ? { versions } : {}),
+				...(available ? { available } : {}),
+			};
+		}),
 		...(check ? { checkedAt: check.checkedAt } : {}),
 		errors: settingsErrors(settings),
 	};
@@ -117,13 +176,47 @@ export async function applyPackageEdits(paths: FlypiPaths, edits: PackageEdits):
 }
 
 /**
- * Ask the registries and remotes which configured sources have something newer. An unreachable registry is
- * the answer, not a crash — the daemon asks this on a machine that may be offline.
+ * The published releases of each npm source, for the panel's "install this version" — the way back for an
+ * extension is pi's own pin form, and a pin has to name a version to name (docs/pi-upgrades.md). One
+ * registry document per npm source per day, on the same rhythm as the update check below.
+ *
+ * A source with nothing to offer is simply absent from the answer: a package the registry has never heard of
+ * (404), an offline box, and a git URL or a path all leave the row with no list rather than failing the check.
+ */
+export async function publishedVersions(paths: FlypiPaths, fetchImpl?: typeof fetch): Promise<Record<string, string[]>> {
+	const out: Record<string, string[]> = {};
+	for (const entry of packages(paths).manager.listConfiguredPackages()) {
+		const name = npmName(entry.source);
+		if (!name) continue;
+		try {
+			// The scoped form is `@scope%2Fname`; an unscoped name needs no escaping at all.
+			const response = await (fetchImpl ?? fetch)(`https://registry.npmjs.org/${name.replace("/", "%2F")}`, {
+				signal: AbortSignal.timeout(5_000),
+				headers: { accept: "application/json" },
+			});
+			if (!response.ok) continue;
+			const doc = (await response.json()) as { versions?: Record<string, unknown> };
+			// Released only, oldest first — the same rule flypi's own version ladder reads.
+			const list = published(doc.versions ?? {}).slice(-PUBLISHED_LIST_MAX);
+			if (list.length > 0) out[entry.source] = list;
+		} catch {
+			// Nothing to say: the row offers no version until a later check reaches the registry.
+		}
+	}
+	return out;
+}
+
+/**
+ * Ask the registries and remotes which configured sources have something newer, and what each npm source has
+ * ever published. An unreachable registry is the answer, not a crash — the daemon asks this on a machine that
+ * may be offline.
  */
-export async function checkPackageUpdates(paths: FlypiPaths): Promise<PackageCheck> {
+export async function checkPackageUpdates(paths: FlypiPaths, fetchImpl?: typeof fetch): Promise<PackageCheck> {
 	const { manager } = packages(paths);
 	try {
-		return { checkedAt: new Date().toISOString(), updates: (await manager.checkForAvailableUpdates()).map((entry) => entry.source) };
+		const updates = (await manager.checkForAvailableUpdates()).map((entry) => entry.source);
+		const versions = await publishedVersions(paths, fetchImpl);
+		return { checkedAt: new Date().toISOString(), updates, ...(Object.keys(versions).length > 0 ? { versions } : {}) };
 	} catch (error) {
 		return { checkedAt: new Date().toISOString(), updates: [], error: (error as Error).message };
 	}