@moxxy/cli 0.5.3 → 0.6.0

package/dist/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { z as z$1, defineProvider, definePlugin, defineTool, MoxxyError, writeFileAtomic, asTurnId, defineMode, asPluginId, defineChannel, defineTunnelProvider, createMutex, defineWorkflowExecutor, toFriendlyError, estimateTextTokens, classifyHttpStatus, createStuckLoopDetector, runCompactionIfNeeded, runElisionIfNeeded, collectProviderStream, usageEventFields, isContextOverflowError, buildSystemPromptWithSkills, projectMessages, defineCompactor, defineCacheStrategy, denyByDefaultResolver, createAllowListResolver, zodToJsonSchema, asToolCallId, dispatchToolCall, runSingleShotTurn, bearerTokenMatches, estimateContextTokens, readRequestBody, moxxyPath, defineEmbedder, skillFrontmatterSchema, asSkillId, getInstallHint, moxxyHome, defineTranscriber, summarizeTokensByModel, migrateModeName, createDeferredPermissionResolver, classifyNetworkError, addModelTotals, ISOLATION_RANK, moxxyPackageSchema, defineCommand, createCallbackResolver, autoAllowResolver, asSessionId, defineViewRenderer, DEFAULT_VIEW_TAGS, evaluateToolRule, summarizeSessionTokensFromEvents, asEventId } from '@moxxy/sdk';
+import { z as z$1, defineProvider, definePlugin, defineTool, MoxxyError, writeFileAtomic, asTurnId, defineMode, asPluginId, defineChannel, defineTunnelProvider, createMutex, defineWorkflowExecutor, toFriendlyError, estimateTextTokens, classifyHttpStatus, createStuckLoopDetector, runCompactionIfNeeded, runElisionIfNeeded, collectProviderStream, usageEventFields, isContextOverflowError, emitRequestsAndDetectStuck, executeToolUses, buildSystemPromptWithSkills, projectMessages, defineCompactor, defineCacheStrategy, denyByDefaultResolver, createAllowListResolver, zodToJsonSchema, runSingleShotTurn, bearerTokenMatches, estimateContextTokens, readRequestBody, moxxyPath, defineEmbedder, skillFrontmatterSchema, asSkillId, getInstallHint, moxxyHome, defineTranscriber, summarizeTokensByModel, migrateModeName, createDeferredPermissionResolver, classifyNetworkError, addModelTotals, ISOLATION_RANK, moxxyPackageSchema, defineCommand, createCallbackResolver, autoAllowResolver, asSessionId, asToolCallId, defineViewRenderer, DEFAULT_VIEW_TAGS, evaluateToolRule, summarizeSessionTokensFromEvents, asEventId } from '@moxxy/sdk';
 import * as fs37 from 'fs';
-import fs37__default, { existsSync, promises, ReadStream, readFileSync, statSync, readdirSync, mkdirSync, writeFileSync, unlinkSync, watch, createReadStream } from 'fs';
+import fs37__default, { existsSync, promises, ReadStream, readFileSync, statSync, readdirSync, mkdirSync, writeFileSync, unlinkSync, renameSync, watch, createReadStream } from 'fs';
 import * as path3 from 'path';
 import path3__default, { basename } from 'path';
 import { z } from 'zod';
@@ -2140,8 +2140,8 @@ var init_tools2 = __esm({
         const parseResult = tool.inputSchema.safeParse(input);
         if (!parseResult.success) {
           const issues = parseResult.error.issues.map((iss) => {
-            const path58 = iss.path.length ? iss.path.join(".") : "(root)";
-            return `${path58}: ${iss.message}`;
+            const path59 = iss.path.length ? iss.path.join(".") : "(root)";
+            return `${path59}: ${iss.message}`;
           }).join("; ");
           throw new Error(`Invalid input for ${name}: ${issues}`);
         }
@@ -7338,11 +7338,11 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
             return e6;
           })(l3, t4);
         }
-        function fileURLToPath9(e5) {
+        function fileURLToPath10(e5) {
           return "string" != typeof e5 || e5.startsWith("file://") ? normalizeSlash((0, Qe2.fileURLToPath)(e5)) : normalizeSlash(e5);
         }
         function pathToFileURL3(e5) {
-          return (0, Qe2.pathToFileURL)(fileURLToPath9(e5)).toString();
+          return (0, Qe2.pathToFileURL)(fileURLToPath10(e5)).toString();
         }
         const Ut2 = /* @__PURE__ */ new Set(["node", "import"]), Mt3 = [".mjs", ".cjs", ".js", ".json"], jt3 = /* @__PURE__ */ new Set(["ERR_MODULE_NOT_FOUND", "ERR_UNSUPPORTED_DIR_IMPORT", "MODULE_NOT_FOUND", "ERR_PACKAGE_PATH_NOT_EXPORTED"]);
         function _tryModuleResolve(e5, t4, i3) {
@@ -7355,11 +7355,11 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
         function _resolve(e5, t4 = {}) {
           if ("string" != typeof e5) {
             if (!(e5 instanceof URL)) throw new TypeError("input must be a `string` or `URL`");
-            e5 = fileURLToPath9(e5);
+            e5 = fileURLToPath10(e5);
           }
           if (/(?:node|data|http|https):/.test(e5)) return e5;
           if (st3.has(e5)) return "node:" + e5;
-          if (e5.startsWith("file://") && (e5 = fileURLToPath9(e5)), isAbsolute3(e5)) try {
+          if (e5.startsWith("file://") && (e5 = fileURLToPath10(e5)), isAbsolute3(e5)) try {
             if ((0, $e2.statSync)(e5).isFile()) return pathToFileURL3(e5);
           } catch (e6) {
             if ("ENOENT" !== e6?.code) throw e6;
@@ -7389,7 +7389,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           return _resolve(e5, t4);
         }
         function resolvePathSync(e5, t4) {
-          return fileURLToPath9(resolveSync(e5, t4));
+          return fileURLToPath10(resolveSync(e5, t4));
         }
         const Ft2 = /(?:[\s;]|^)(?:import[\s\w*,{}]*from|import\s*["'*{]|export\b\s*(?:[*{]|default|class|type|function|const|var|let|async function)|import\.meta\b)/m, Bt2 = /\/\*.+?\*\/|\/\/.*(?=[nr])/g;
         function hasESMSyntax(e5, t4 = {}) {
@@ -7546,7 +7546,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
         }
         function tryNativeRequireResolve(e5, t4, i3, n3) {
           try {
-            return e5.nativeRequire.resolve(t4, { ...n3, paths: [pathe_M_eThtNZ_dirname(fileURLToPath9(i3)), ...n3?.paths || []] });
+            return e5.nativeRequire.resolve(t4, { ...n3, paths: [pathe_M_eThtNZ_dirname(fileURLToPath10(i3)), ...n3?.paths || []] });
           } catch {
           }
         }
@@ -7736,7 +7736,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
             const i4 = {};
             return void 0 !== e6.cache && (i4.fsCache = e6.cache), void 0 !== e6.requireCache && (i4.moduleCache = e6.requireCache), { ...t5, ...i4, ...e6 };
           })(t4);
-          "string" == typeof e5 && e5.startsWith("file://") && (e5 = fileURLToPath9(e5));
+          "string" == typeof e5 && e5.startsWith("file://") && (e5 = fileURLToPath10(e5));
           const c3 = a3.alias && Object.keys(a3.alias).length > 0 ? normalizeAliases(a3.alias || {}) : void 0;
           let l3;
           if (a3.tsconfigPaths) {
@@ -8054,17 +8054,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path58) {
-      const ctrl = callVisitor(key, node, visitor, path58);
+    function visit_(key, node, visitor, path59) {
+      const ctrl = callVisitor(key, node, visitor, path59);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path58, ctrl);
-        return visit_(key, ctrl, visitor, path58);
+        replaceNode(key, path59, ctrl);
+        return visit_(key, ctrl, visitor, path59);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path58 = Object.freeze(path58.concat(node));
+          path59 = Object.freeze(path59.concat(node));
           for (let i2 = 0; i2 < node.items.length; ++i2) {
-            const ci = visit_(i2, node.items[i2], visitor, path58);
+            const ci = visit_(i2, node.items[i2], visitor, path59);
             if (typeof ci === "number")
               i2 = ci - 1;
             else if (ci === BREAK)
@@ -8075,13 +8075,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path58 = Object.freeze(path58.concat(node));
-          const ck = visit_("key", node.key, visitor, path58);
+          path59 = Object.freeze(path59.concat(node));
+          const ck = visit_("key", node.key, visitor, path59);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path58);
+          const cv = visit_("value", node.value, visitor, path59);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -8102,17 +8102,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path58) {
-      const ctrl = await callVisitor(key, node, visitor, path58);
+    async function visitAsync_(key, node, visitor, path59) {
+      const ctrl = await callVisitor(key, node, visitor, path59);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path58, ctrl);
-        return visitAsync_(key, ctrl, visitor, path58);
+        replaceNode(key, path59, ctrl);
+        return visitAsync_(key, ctrl, visitor, path59);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path58 = Object.freeze(path58.concat(node));
+          path59 = Object.freeze(path59.concat(node));
           for (let i2 = 0; i2 < node.items.length; ++i2) {
-            const ci = await visitAsync_(i2, node.items[i2], visitor, path58);
+            const ci = await visitAsync_(i2, node.items[i2], visitor, path59);
             if (typeof ci === "number")
               i2 = ci - 1;
             else if (ci === BREAK)
@@ -8123,13 +8123,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path58 = Object.freeze(path58.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path58);
+          path59 = Object.freeze(path59.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path59);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path58);
+          const cv = await visitAsync_("value", node.value, visitor, path59);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -8156,23 +8156,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path58) {
+    function callVisitor(key, node, visitor, path59) {
       if (typeof visitor === "function")
-        return visitor(key, node, path58);
+        return visitor(key, node, path59);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path58);
+        return visitor.Map?.(key, node, path59);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path58);
+        return visitor.Seq?.(key, node, path59);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path58);
+        return visitor.Pair?.(key, node, path59);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path58);
+        return visitor.Scalar?.(key, node, path59);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path58);
+        return visitor.Alias?.(key, node, path59);
       return void 0;
     }
-    function replaceNode(key, path58, node) {
-      const parent = path58[path58.length - 1];
+    function replaceNode(key, path59, node) {
+      const parent = path59[path59.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -8773,10 +8773,10 @@ var require_Collection = __commonJS({
     var createNode2 = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path58, value) {
+    function collectionFromPath(schema, path59, value) {
       let v3 = value;
-      for (let i2 = path58.length - 1; i2 >= 0; --i2) {
-        const k3 = path58[i2];
+      for (let i2 = path59.length - 1; i2 >= 0; --i2) {
+        const k3 = path59[i2];
         if (typeof k3 === "number" && Number.isInteger(k3) && k3 >= 0) {
           const a2 = [];
           a2[k3] = v3;
@@ -8795,7 +8795,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path58) => path58 == null || typeof path58 === "object" && !!path58[Symbol.iterator]().next().done;
+    var isEmptyPath = (path59) => path59 == null || typeof path59 === "object" && !!path59[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -8825,11 +8825,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path58, value) {
-        if (isEmptyPath(path58))
+      addIn(path59, value) {
+        if (isEmptyPath(path59))
           this.add(value);
         else {
-          const [key, ...rest] = path58;
+          const [key, ...rest] = path59;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -8843,8 +8843,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path58) {
-        const [key, ...rest] = path58;
+      deleteIn(path59) {
+        const [key, ...rest] = path59;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -8858,8 +8858,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path58, keepScalar) {
-        const [key, ...rest] = path58;
+      getIn(path59, keepScalar) {
+        const [key, ...rest] = path59;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -8877,8 +8877,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path58) {
-        const [key, ...rest] = path58;
+      hasIn(path59) {
+        const [key, ...rest] = path59;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -8888,8 +8888,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path58, value) {
-        const [key, ...rest] = path58;
+      setIn(path59, value) {
+        const [key, ...rest] = path59;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -11369,9 +11369,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path58, value) {
+      addIn(path59, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path58, value);
+          this.contents.addIn(path59, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -11446,14 +11446,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path58) {
-        if (Collection.isEmptyPath(path58)) {
+      deleteIn(path59) {
+        if (Collection.isEmptyPath(path59)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path58) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path59) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -11468,10 +11468,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path58, keepScalar) {
-        if (Collection.isEmptyPath(path58))
+      getIn(path59, keepScalar) {
+        if (Collection.isEmptyPath(path59))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path58, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path59, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -11482,10 +11482,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path58) {
-        if (Collection.isEmptyPath(path58))
+      hasIn(path59) {
+        if (Collection.isEmptyPath(path59))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path58) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path59) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -11502,13 +11502,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path58, value) {
-        if (Collection.isEmptyPath(path58)) {
+      setIn(path59, value) {
+        if (Collection.isEmptyPath(path59)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path58), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path59), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path58, value);
+          this.contents.setIn(path59, value);
         }
       }
       /**
@@ -13448,9 +13448,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path58) => {
+    visit.itemAtPath = (cst, path59) => {
       let item = cst;
-      for (const [field, index] of path58) {
+      for (const [field, index] of path59) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -13459,23 +13459,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path58) => {
-      const parent = visit.itemAtPath(cst, path58.slice(0, -1));
-      const field = path58[path58.length - 1][0];
+    visit.parentCollection = (cst, path59) => {
+      const parent = visit.itemAtPath(cst, path59.slice(0, -1));
+      const field = path59[path59.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path58, item, visitor) {
-      let ctrl = visitor(item, path58);
+    function _visit(path59, item, visitor) {
+      let ctrl = visitor(item, path59);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i2 = 0; i2 < token.items.length; ++i2) {
-            const ci = _visit(Object.freeze(path58.concat([[field, i2]])), token.items[i2], visitor);
+            const ci = _visit(Object.freeze(path59.concat([[field, i2]])), token.items[i2], visitor);
             if (typeof ci === "number")
               i2 = ci - 1;
             else if (ci === BREAK)
@@ -13486,10 +13486,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path58);
+            ctrl = ctrl(item, path59);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path58) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path59) : ctrl;
     }
     exports.visit = visit;
   }
@@ -16211,14 +16211,14 @@ var require_url_state_machine = __commonJS({
       return url2.replace(/\u0009|\u000A|\u000D/g, "");
     }
     function shortenPath(url2) {
-      const path58 = url2.path;
-      if (path58.length === 0) {
+      const path59 = url2.path;
+      if (path59.length === 0) {
         return;
       }
-      if (url2.scheme === "file" && path58.length === 1 && isNormalizedWindowsDriveLetter(path58[0])) {
+      if (url2.scheme === "file" && path59.length === 1 && isNormalizedWindowsDriveLetter(path59[0])) {
         return;
       }
-      path58.pop();
+      path59.pop();
     }
     function includesCredentials(url2) {
       return url2.username !== "" || url2.password !== "";
@@ -25441,14 +25441,14 @@ __export(fileFromPath_exports, {
   fileFromPathSync: () => fileFromPathSync,
   isFile: () => isFile
 });
-function createFileFromPath(path58, { mtimeMs, size }, filenameOrOptions, options = {}) {
+function createFileFromPath(path59, { mtimeMs, size }, filenameOrOptions, options = {}) {
   let filename;
   if (isPlainObject_default2(filenameOrOptions)) {
     [options, filename] = [filenameOrOptions, void 0];
   } else {
     filename = filenameOrOptions;
   }
-  const file = new FileFromPath({ path: path58, size, lastModified: mtimeMs });
+  const file = new FileFromPath({ path: path59, size, lastModified: mtimeMs });
   if (!filename) {
     filename = file.name;
   }
@@ -25457,13 +25457,13 @@ function createFileFromPath(path58, { mtimeMs, size }, filenameOrOptions, option
     lastModified: file.lastModified
   });
 }
-function fileFromPathSync(path58, filenameOrOptions, options = {}) {
-  const stats = statSync(path58);
-  return createFileFromPath(path58, stats, filenameOrOptions, options);
+function fileFromPathSync(path59, filenameOrOptions, options = {}) {
+  const stats = statSync(path59);
+  return createFileFromPath(path59, stats, filenameOrOptions, options);
 }
-async function fileFromPath2(path58, filenameOrOptions, options) {
-  const stats = await promises.stat(path58);
-  return createFileFromPath(path58, stats, filenameOrOptions, options);
+async function fileFromPath2(path59, filenameOrOptions, options) {
+  const stats = await promises.stat(path59);
+  return createFileFromPath(path59, stats, filenameOrOptions, options);
 }
 var import_node_domexception, __classPrivateFieldSet4, __classPrivateFieldGet5, _FileFromPath_path, _FileFromPath_start, MESSAGE, FileFromPath;
 var init_fileFromPath = __esm({
@@ -29322,7 +29322,7 @@ var require_has_flag = __commonJS({
 // ../../node_modules/.pnpm/supports-color@7.2.0/node_modules/supports-color/index.js
 var require_supports_color = __commonJS({
   "../../node_modules/.pnpm/supports-color@7.2.0/node_modules/supports-color/index.js"(exports, module) {
-    var os20 = __require("os");
+    var os21 = __require("os");
     var tty2 = __require("tty");
     var hasFlag2 = require_has_flag();
     var { env: env3 } = process;
@@ -29370,7 +29370,7 @@ var require_supports_color = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os20.release().split(".");
+        const osRelease = os21.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -37434,8 +37434,8 @@ var init_esm = __esm({
   }
 });
 function getMethodLiteral(schema) {
-  const shape = getObjectShape(schema);
-  const methodSchema = shape?.method;
+  const shape2 = getObjectShape(schema);
+  const methodSchema = shape2?.method;
   if (!methodSchema) {
     throw new Error("Schema is missing a method literal");
   }
@@ -41595,8 +41595,8 @@ var require_utils2 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path58) {
-      let input = path58;
+    function removeDotSegments(path59) {
+      let input = path59;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -41847,8 +41847,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path58, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path58 && path58 !== "/" ? path58 : void 0;
+        const [path59, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path59 && path59 !== "/" ? path59 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -45605,8 +45605,8 @@ var init_client2 = __esm({
        * Override request handler registration to enforce client-side validation for elicitation.
        */
       setRequestHandler(requestSchema, handler) {
-        const shape = getObjectShape(requestSchema);
-        const methodSchema = shape?.method;
+        const shape2 = getObjectShape(requestSchema);
+        const methodSchema = shape2?.method;
         if (!methodSchema) {
           throw new Error("Schema is missing a method literal");
         }
@@ -46006,7 +46006,7 @@ var require_windows = __commonJS({
     module.exports = isexe;
     isexe.sync = sync;
     var fs43 = __require("fs");
-    function checkPathExt(path58, options) {
+    function checkPathExt(path59, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -46017,25 +46017,25 @@ var require_windows = __commonJS({
       }
       for (var i2 = 0; i2 < pathext.length; i2++) {
         var p3 = pathext[i2].toLowerCase();
-        if (p3 && path58.substr(-p3.length).toLowerCase() === p3) {
+        if (p3 && path59.substr(-p3.length).toLowerCase() === p3) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path58, options) {
+    function checkStat(stat, path59, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path58, options);
+      return checkPathExt(path59, options);
     }
-    function isexe(path58, options, cb) {
-      fs43.stat(path58, function(er2, stat) {
-        cb(er2, er2 ? false : checkStat(stat, path58, options));
+    function isexe(path59, options, cb) {
+      fs43.stat(path59, function(er2, stat) {
+        cb(er2, er2 ? false : checkStat(stat, path59, options));
       });
     }
-    function sync(path58, options) {
-      return checkStat(fs43.statSync(path58), path58, options);
+    function sync(path59, options) {
+      return checkStat(fs43.statSync(path59), path59, options);
     }
   }
 });
@@ -46046,13 +46046,13 @@ var require_mode = __commonJS({
     module.exports = isexe;
     isexe.sync = sync;
     var fs43 = __require("fs");
-    function isexe(path58, options, cb) {
-      fs43.stat(path58, function(er2, stat) {
+    function isexe(path59, options, cb) {
+      fs43.stat(path59, function(er2, stat) {
         cb(er2, er2 ? false : checkStat(stat, options));
       });
     }
-    function sync(path58, options) {
-      return checkStat(fs43.statSync(path58), options);
+    function sync(path59, options) {
+      return checkStat(fs43.statSync(path59), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -46085,7 +46085,7 @@ var require_isexe = __commonJS({
     }
     module.exports = isexe;
     isexe.sync = sync;
-    function isexe(path58, options, cb) {
+    function isexe(path59, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -46095,7 +46095,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve12, reject) {
-          isexe(path58, options || {}, function(er2, is) {
+          isexe(path59, options || {}, function(er2, is) {
             if (er2) {
               reject(er2);
             } else {
@@ -46104,7 +46104,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core(path58, options || {}, function(er2, is) {
+      core(path59, options || {}, function(er2, is) {
         if (er2) {
           if (er2.code === "EACCES" || options && options.ignoreErrors) {
             er2 = null;
@@ -46114,9 +46114,9 @@ var require_isexe = __commonJS({
         cb(er2, is);
       });
     }
-    function sync(path58, options) {
+    function sync(path59, options) {
       try {
-        return core.sync(path58, options || {});
+        return core.sync(path59, options || {});
       } catch (er2) {
         if (options && options.ignoreErrors || er2.code === "EACCES") {
           return false;
@@ -46132,7 +46132,7 @@ var require_isexe = __commonJS({
 var require_which = __commonJS({
   "../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js"(exports, module) {
     var isWindows3 = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path58 = __require("path");
+    var path59 = __require("path");
     var COLON = isWindows3 ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -46170,7 +46170,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve12(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i2];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path58.join(pathPart, cmd);
+        const pCmd = path59.join(pathPart, cmd);
         const p3 = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve12(subStep(p3, i2, 0));
       });
@@ -46197,7 +46197,7 @@ var require_which = __commonJS({
       for (let i2 = 0; i2 < pathEnv.length; i2++) {
         const ppRaw = pathEnv[i2];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path58.join(pathPart, cmd);
+        const pCmd = path59.join(pathPart, cmd);
         const p3 = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j3 = 0; j3 < pathExt.length; j3++) {
           const cur = p3 + pathExt[j3];
@@ -46243,7 +46243,7 @@ var require_path_key = __commonJS({
 // ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js
 var require_resolveCommand = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js"(exports, module) {
-    var path58 = __require("path");
+    var path59 = __require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -46261,7 +46261,7 @@ var require_resolveCommand = __commonJS({
       try {
         resolved = which.sync(parsed.command, {
           path: env3[getPathKey({ env: env3 })],
-          pathExt: withoutPathExt ? path58.delimiter : void 0
+          pathExt: withoutPathExt ? path59.delimiter : void 0
         });
       } catch (e3) {
       } finally {
@@ -46270,7 +46270,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path58.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path59.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -46321,8 +46321,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path58, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary = path58.split("/").pop();
+      const [path59, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path59.split("/").pop();
       if (binary === "env") {
         return argument;
       }
@@ -46355,7 +46355,7 @@ var require_readShebang = __commonJS({
 // ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js
 var require_parse = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js"(exports, module) {
-    var path58 = __require("path");
+    var path59 = __require("path");
     var resolveCommand = require_resolveCommand();
     var escape4 = require_escape();
     var readShebang = require_readShebang();
@@ -46380,7 +46380,7 @@ var require_parse = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path58.normalize(parsed.command);
+        parsed.command = path59.normalize(parsed.command);
         parsed.command = escape4.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape4.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -46468,7 +46468,7 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse2 = require_parse();
     var enoent = require_enoent();
-    function spawn16(command, args, options) {
+    function spawn17(command, args, options) {
       const parsed = parse2(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -46480,8 +46480,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn16;
-    module.exports.spawn = spawn16;
+    module.exports = spawn17;
+    module.exports.spawn = spawn17;
     module.exports.sync = spawnSync5;
     module.exports._parse = parse2;
     module.exports._enoent = enoent;
@@ -74168,10 +74168,10 @@ var require_react_reconciler_development = __commonJS({
         var setErrorHandler = null;
         var setSuspenseHandler = null;
         {
-          var copyWithDeleteImpl = function(obj, path58, index2) {
-            var key = path58[index2];
+          var copyWithDeleteImpl = function(obj, path59, index2) {
+            var key = path59[index2];
             var updated = isArray(obj) ? obj.slice() : assign({}, obj);
-            if (index2 + 1 === path58.length) {
+            if (index2 + 1 === path59.length) {
               if (isArray(updated)) {
                 updated.splice(key, 1);
               } else {
@@ -74179,11 +74179,11 @@ var require_react_reconciler_development = __commonJS({
               }
               return updated;
             }
-            updated[key] = copyWithDeleteImpl(obj[key], path58, index2 + 1);
+            updated[key] = copyWithDeleteImpl(obj[key], path59, index2 + 1);
             return updated;
           };
-          var copyWithDelete = function(obj, path58) {
-            return copyWithDeleteImpl(obj, path58, 0);
+          var copyWithDelete = function(obj, path59) {
+            return copyWithDeleteImpl(obj, path59, 0);
           };
           var copyWithRenameImpl = function(obj, oldPath, newPath, index2) {
             var oldKey = oldPath[index2];
@@ -74221,17 +74221,17 @@ var require_react_reconciler_development = __commonJS({
             }
             return copyWithRenameImpl(obj, oldPath, newPath, 0);
           };
-          var copyWithSetImpl = function(obj, path58, index2, value) {
-            if (index2 >= path58.length) {
+          var copyWithSetImpl = function(obj, path59, index2, value) {
+            if (index2 >= path59.length) {
               return value;
             }
-            var key = path58[index2];
+            var key = path59[index2];
             var updated = isArray(obj) ? obj.slice() : assign({}, obj);
-            updated[key] = copyWithSetImpl(obj[key], path58, index2 + 1, value);
+            updated[key] = copyWithSetImpl(obj[key], path59, index2 + 1, value);
             return updated;
           };
-          var copyWithSet = function(obj, path58, value) {
-            return copyWithSetImpl(obj, path58, 0, value);
+          var copyWithSet = function(obj, path59, value) {
+            return copyWithSetImpl(obj, path59, 0, value);
           };
           var findHook = function(fiber, id) {
             var currentHook2 = fiber.memoizedState;
@@ -74241,10 +74241,10 @@ var require_react_reconciler_development = __commonJS({
             }
             return currentHook2;
           };
-          overrideHookState = function(fiber, id, path58, value) {
+          overrideHookState = function(fiber, id, path59, value) {
             var hook = findHook(fiber, id);
             if (hook !== null) {
-              var newState = copyWithSet(hook.memoizedState, path58, value);
+              var newState = copyWithSet(hook.memoizedState, path59, value);
               hook.memoizedState = newState;
               hook.baseState = newState;
               fiber.memoizedProps = assign({}, fiber.memoizedProps);
@@ -74254,10 +74254,10 @@ var require_react_reconciler_development = __commonJS({
               }
             }
           };
-          overrideHookStateDeletePath = function(fiber, id, path58) {
+          overrideHookStateDeletePath = function(fiber, id, path59) {
             var hook = findHook(fiber, id);
             if (hook !== null) {
-              var newState = copyWithDelete(hook.memoizedState, path58);
+              var newState = copyWithDelete(hook.memoizedState, path59);
               hook.memoizedState = newState;
               hook.baseState = newState;
               fiber.memoizedProps = assign({}, fiber.memoizedProps);
@@ -74280,8 +74280,8 @@ var require_react_reconciler_development = __commonJS({
               }
             }
           };
-          overrideProps = function(fiber, path58, value) {
-            fiber.pendingProps = copyWithSet(fiber.memoizedProps, path58, value);
+          overrideProps = function(fiber, path59, value) {
+            fiber.pendingProps = copyWithSet(fiber.memoizedProps, path59, value);
             if (fiber.alternate) {
               fiber.alternate.pendingProps = fiber.pendingProps;
             }
@@ -74290,8 +74290,8 @@ var require_react_reconciler_development = __commonJS({
               scheduleUpdateOnFiber(root, fiber, SyncLane, NoTimestamp);
             }
           };
-          overridePropsDeletePath = function(fiber, path58) {
-            fiber.pendingProps = copyWithDelete(fiber.memoizedProps, path58);
+          overridePropsDeletePath = function(fiber, path59) {
+            fiber.pendingProps = copyWithDelete(fiber.memoizedProps, path59);
             if (fiber.alternate) {
               fiber.alternate.pendingProps = fiber.pendingProps;
             }
@@ -81733,8 +81733,8 @@ var init_ErrorOverview = __esm({
     init_dist7();
     init_Box();
     init_Text();
-    cleanupPath = (path58) => {
-      return path58?.replace(`file://${cwd()}/`, "");
+    cleanupPath = (path59) => {
+      return path59?.replace(`file://${cwd()}/`, "");
     };
     stackUtils = new import_stack_utils.default({
       cwd: cwd(),
@@ -85772,7 +85772,7 @@ var init_StatusLine = __esm({
     init_theme();
     await init_Spinner();
     await init_ModeFooter();
-    StatusLine = ({ busyStartedAt, queueCount, modeName, modeBadge, provider, model, mcp, contextUsed, contextWindow }) => {
+    StatusLine = ({ busyStartedAt, queueCount, modeName, modeBadge, provider, model, mcp, contextUsed, contextWindow, version, updateLatest }) => {
       const busy = busyStartedAt != null;
       const showQueue = (queueCount ?? 0) > 0;
       const showMcp = !!(mcp && mcp.enabled > 0);
@@ -85783,7 +85783,7 @@ var init_StatusLine = __esm({
         // with the busy marker / idle hint trailing it — so the user always
         // sees the mode even mid-run, when a plain footer would be hidden.
         (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(ModeBadgePill, { badge: modeBadge }), (0, import_jsx_runtime21.jsx)(Text, { children: " " }), busy ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(BusyMarker, { startedAt: busyStartedAt }), queuedTail] }) : (0, import_jsx_runtime21.jsx)(Text, { color: Colors.chrome, dimColor: true, children: "Esc stops \xB7 shift+tab to change" })] })
-      ) : busy ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(BusyMarker, { startedAt: busyStartedAt }), queuedTail] }) : (0, import_jsx_runtime21.jsx)(ModeFooter, { modeName }) }), (0, import_jsx_runtime21.jsxs)(Box_default, { children: [(0, import_jsx_runtime21.jsx)(ProviderBadge, { name: provider }), (0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `  ${model}` }), showMcp ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `  ${Glyphs.midDot}  ` }), (0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: "mcp " }), (0, import_jsx_runtime21.jsx)(Text, { children: `${mcp.connected}/${mcp.enabled}` })] }) : null, showCtx ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `  ${Glyphs.midDot}  ` }), (0, import_jsx_runtime21.jsx)(ContextMeter, { used: contextUsed ?? 0, total: contextWindow })] }) : null] })] });
+      ) : busy ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(BusyMarker, { startedAt: busyStartedAt }), queuedTail] }) : (0, import_jsx_runtime21.jsx)(ModeFooter, { modeName }) }), (0, import_jsx_runtime21.jsxs)(Box_default, { children: [(0, import_jsx_runtime21.jsx)(ProviderBadge, { name: provider }), (0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `  ${model}` }), showMcp ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `  ${Glyphs.midDot}  ` }), (0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: "mcp " }), (0, import_jsx_runtime21.jsx)(Text, { children: `${mcp.connected}/${mcp.enabled}` })] }) : null, showCtx ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `  ${Glyphs.midDot}  ` }), (0, import_jsx_runtime21.jsx)(ContextMeter, { used: contextUsed ?? 0, total: contextWindow })] }) : null, version ? (0, import_jsx_runtime21.jsxs)(import_jsx_runtime21.Fragment, { children: [(0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `  ${Glyphs.midDot}  ` }), updateLatest ? (0, import_jsx_runtime21.jsx)(Text, { color: "yellow", children: `v${version} ${Glyphs.contextUp}${updateLatest}` }) : (0, import_jsx_runtime21.jsx)(Text, { dimColor: true, children: `v${version}` })] }) : null] })] });
     };
     ProviderBadge = ({ name }) => (0, import_jsx_runtime21.jsx)(Text, { backgroundColor: Colors.chrome, color: "black", bold: true, children: ` ${name} ` });
     ModeBadgePill = ({ badge }) => (0, import_jsx_runtime21.jsx)(Text, { backgroundColor: badgeBackground(badge.tone), color: "black", bold: true, children: ` ${badge.label} ` });
@@ -88304,7 +88304,7 @@ var init_SessionView = __esm({
     await init_run_slash();
     await init_OverlayOrNotice();
     await init_InteractiveZone();
-    SessionView = ({ session, registerInteractiveResolver, model, initialPrompt }) => {
+    SessionView = ({ session, registerInteractiveResolver, model, version, updateAvailable, initialPrompt }) => {
       const { exit } = use_app_default();
       const stream = useEventStream(session);
       const [systemNotice, setSystemNotice] = (0, import_react62.useState)(null);
@@ -88478,6 +88478,13 @@ var init_SessionView = __esm({
         firedInitial.current = true;
         void handleSubmit(initialPrompt);
       }, [initialPrompt]);
+      const firedUpdateNotice = (0, import_react62.useRef)(false);
+      (0, import_react62.useEffect)(() => {
+        if (firedUpdateNotice.current || !updateAvailable || initialPrompt)
+          return;
+        firedUpdateNotice.current = true;
+        setSystemNotice(`\u2728 moxxy ${updateAvailable.latest} available \u2014 run \`moxxy update\``);
+      }, [updateAvailable, initialPrompt]);
       return (0, import_jsx_runtime34.jsxs)(Box_default, { flexDirection: "column", children: [(0, import_jsx_runtime34.jsx)(ChatView, { events: stream.events, streamingDelta: stream.streamingDelta, expandToolOutputs, compactTools, hideLive: overlay != null || picker != null || pendingPermission != null || pendingApproval != null }), (0, import_jsx_runtime34.jsx)(OverlayOrNotice, { overlay, systemNotice, session, events: stream.events, contextWindow, contextTokens: contextUsed, onClose: () => setOverlay(null) }), (0, import_jsx_runtime34.jsx)(InteractiveZone, { session, pendingPermission, pendingPermissionDepth: Math.max(0, permissions.pendingPermissions.length - 1), pendingApproval, picker, busy: turn.busy, voiceReady: voice.ready, voicePhase: voice.phase, yolo, slashCommands: slashSuggestions, queueMessages: turn.queueRef.current, priorityMessage: turn.priorityMessage, commandHotkeys, onCycleMode: cycleMode, externalInsert: voice.externalInsert, onPermissionDecide: (perm, decision) => {
         permissions.setPendingPermissions((prev) => prev.slice(1));
         if (decision.mode === "allow_always") {
@@ -88490,7 +88497,7 @@ var init_SessionView = __esm({
         const { resolve: resolve12 } = pendingApproval;
         permissions.setPendingApproval(null);
         resolve12(decision);
-      }, onPickerSelect: handlePickerSelect, onPickerCancel: () => setPicker(null), onSubmit: handleSubmit, onPasteText: images.handlePasteText }), (0, import_jsx_runtime34.jsx)(StatusLine, { busyStartedAt: turn.busy && !pendingPermission && !pendingApproval ? turn.busyStartedAt : null, queueCount: turn.queueCount, modeName, modeBadge, provider: providerName, model: activeModel2, mcp: mcpStatus, contextUsed, ...contextWindow ? { contextWindow } : {} })] });
+      }, onPickerSelect: handlePickerSelect, onPickerCancel: () => setPicker(null), onSubmit: handleSubmit, onPasteText: images.handlePasteText }), (0, import_jsx_runtime34.jsx)(StatusLine, { busyStartedAt: turn.busy && !pendingPermission && !pendingApproval ? turn.busyStartedAt : null, queueCount: turn.queueCount, modeName, modeBadge, provider: providerName, model: activeModel2, mcp: mcpStatus, contextUsed, ...contextWindow ? { contextWindow } : {}, ...version ? { version } : {}, ...updateAvailable ? { updateLatest: updateAvailable.latest } : {} })] });
     };
   }
 });
@@ -88511,7 +88518,7 @@ var init_BootShell = __esm({
     await init_SessionView();
     await init_OverlayOrNotice();
     init_use_voice_input();
-    InteractiveSession = ({ session: eagerSession, bootstrap, registerInteractiveResolver, model, resumed }) => {
+    InteractiveSession = ({ session: eagerSession, bootstrap, registerInteractiveResolver, model, version, updateAvailable, resumed }) => {
       const [session, setSession] = (0, import_react63.useState)(eagerSession ?? null);
       const [bootEvents, setBootEvents] = (0, import_react63.useState)([]);
       const [bootError, setBootError] = (0, import_react63.useState)(null);
@@ -88563,7 +88570,7 @@ var init_BootShell = __esm({
       if (!session || initialPrompt == null && !resumed) {
         return (0, import_jsx_runtime35.jsxs)(Box_default, { flexDirection: "column", children: [(0, import_jsx_runtime35.jsx)(BootScreen, { events: bootEvents, startedAt, ...bootError ? { error: bootError } : {} }), session ? (0, import_jsx_runtime35.jsx)(BootInputArea, { session, ready: bootError == null, bootError, onSubmit: (text) => setInitialPrompt(text) }) : (0, import_jsx_runtime35.jsx)(DisabledBootInput, { placeholder: bootError ? "Bootstrap failed \u2014 quit and run `moxxy init`" : "Initializing\u2026" })] });
       }
-      return (0, import_jsx_runtime35.jsx)(SessionView, { session, registerInteractiveResolver, ...initialPrompt ? { initialPrompt } : {}, ...model ? { model } : {} });
+      return (0, import_jsx_runtime35.jsx)(SessionView, { session, registerInteractiveResolver, ...initialPrompt ? { initialPrompt } : {}, ...model ? { model } : {}, ...version ? { version } : {}, ...updateAvailable ? { updateAvailable } : {} });
     };
     BootInputArea = ({ session, ready, bootError, onSubmit }) => {
       const [systemNotice, setSystemNotice] = (0, import_react63.useState)(null);
@@ -92661,13 +92668,13 @@ var MultipartBody = class {
   }
 };
 var fileFromPathWarned = false;
-async function fileFromPath3(path58, ...args) {
+async function fileFromPath3(path59, ...args) {
   const { fileFromPath: _fileFromPath } = await Promise.resolve().then(() => (init_fileFromPath(), fileFromPath_exports));
   if (!fileFromPathWarned) {
-    console.warn(`fileFromPath is deprecated; use fs.createReadStream(${JSON.stringify(path58)}) instead`);
+    console.warn(`fileFromPath is deprecated; use fs.createReadStream(${JSON.stringify(path59)}) instead`);
     fileFromPathWarned = true;
   }
-  return await _fileFromPath(path58, ...args);
+  return await _fileFromPath(path59, ...args);
 }
 var defaultHttpAgent = new import_agentkeepalive.default({ keepAlive: true, timeout: 5 * 60 * 1e3 });
 var defaultHttpsAgent = new import_agentkeepalive.default.HttpsAgent({ keepAlive: true, timeout: 5 * 60 * 1e3 });
@@ -93390,29 +93397,29 @@ var APIClient = class {
   defaultIdempotencyKey() {
     return `stainless-node-retry-${uuid4()}`;
   }
-  get(path58, opts) {
-    return this.methodRequest("get", path58, opts);
+  get(path59, opts) {
+    return this.methodRequest("get", path59, opts);
   }
-  post(path58, opts) {
-    return this.methodRequest("post", path58, opts);
+  post(path59, opts) {
+    return this.methodRequest("post", path59, opts);
   }
-  patch(path58, opts) {
-    return this.methodRequest("patch", path58, opts);
+  patch(path59, opts) {
+    return this.methodRequest("patch", path59, opts);
   }
-  put(path58, opts) {
-    return this.methodRequest("put", path58, opts);
+  put(path59, opts) {
+    return this.methodRequest("put", path59, opts);
   }
-  delete(path58, opts) {
-    return this.methodRequest("delete", path58, opts);
+  delete(path59, opts) {
+    return this.methodRequest("delete", path59, opts);
   }
-  methodRequest(method, path58, opts) {
+  methodRequest(method, path59, opts) {
     return this.request(Promise.resolve(opts).then(async (opts2) => {
       const body = opts2 && isBlobLike(opts2?.body) ? new DataView(await opts2.body.arrayBuffer()) : opts2?.body instanceof DataView ? opts2.body : opts2?.body instanceof ArrayBuffer ? new DataView(opts2.body) : opts2 && ArrayBuffer.isView(opts2?.body) ? new DataView(opts2.body.buffer) : opts2?.body;
-      return { method, path: path58, ...opts2, body };
+      return { method, path: path59, ...opts2, body };
     }));
   }
-  getAPIList(path58, Page3, opts) {
-    return this.requestAPIList(Page3, { method: "get", path: path58, ...opts });
+  getAPIList(path59, Page3, opts) {
+    return this.requestAPIList(Page3, { method: "get", path: path59, ...opts });
   }
   calculateContentLength(body) {
     if (typeof body === "string") {
@@ -93431,10 +93438,10 @@ var APIClient = class {
   }
   buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path58, query, headers = {} } = options;
+    const { method, path: path59, query, headers = {} } = options;
     const body = ArrayBuffer.isView(options.body) || options.__binaryRequest && typeof options.body === "string" ? options.body : isMultipartBody(options.body) ? options.body.body : options.body ? JSON.stringify(options.body, null, 2) : null;
     const contentLength = this.calculateContentLength(body);
-    const url2 = this.buildURL(path58, query);
+    const url2 = this.buildURL(path59, query);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -93558,8 +93565,8 @@ var APIClient = class {
     const request = this.makeRequest(options, null);
     return new PagePromise(this, request, Page3);
   }
-  buildURL(path58, query) {
-    const url2 = isAbsoluteURL(path58) ? new URL(path58) : new URL(this.baseURL + (this.baseURL.endsWith("/") && path58.startsWith("/") ? path58.slice(1) : path58));
+  buildURL(path59, query) {
+    const url2 = isAbsoluteURL(path59) ? new URL(path59) : new URL(this.baseURL + (this.baseURL.endsWith("/") && path59.startsWith("/") ? path59.slice(1) : path59));
     const defaultQuery = this.defaultQuery();
     if (!isEmptyObj(defaultQuery)) {
       query = { ...defaultQuery, ...query };
@@ -96712,13 +96719,13 @@ var MultipartBody2 = class {
   }
 };
 var fileFromPathWarned2 = false;
-async function fileFromPath5(path58, ...args) {
+async function fileFromPath5(path59, ...args) {
   const { fileFromPath: _fileFromPath } = await Promise.resolve().then(() => (init_fileFromPath(), fileFromPath_exports));
   if (!fileFromPathWarned2) {
-    console.warn(`fileFromPath is deprecated; use fs.createReadStream(${JSON.stringify(path58)}) instead`);
+    console.warn(`fileFromPath is deprecated; use fs.createReadStream(${JSON.stringify(path59)}) instead`);
     fileFromPathWarned2 = true;
   }
-  return await _fileFromPath(path58, ...args);
+  return await _fileFromPath(path59, ...args);
 }
 var defaultHttpAgent2 = new import_agentkeepalive2.default({ keepAlive: true, timeout: 5 * 60 * 1e3 });
 var defaultHttpsAgent2 = new import_agentkeepalive2.default.HttpsAgent({ keepAlive: true, timeout: 5 * 60 * 1e3 });
@@ -97496,29 +97503,29 @@ var APIClient2 = class {
   defaultIdempotencyKey() {
     return `stainless-node-retry-${uuid42()}`;
   }
-  get(path58, opts) {
-    return this.methodRequest("get", path58, opts);
+  get(path59, opts) {
+    return this.methodRequest("get", path59, opts);
   }
-  post(path58, opts) {
-    return this.methodRequest("post", path58, opts);
+  post(path59, opts) {
+    return this.methodRequest("post", path59, opts);
   }
-  patch(path58, opts) {
-    return this.methodRequest("patch", path58, opts);
+  patch(path59, opts) {
+    return this.methodRequest("patch", path59, opts);
   }
-  put(path58, opts) {
-    return this.methodRequest("put", path58, opts);
+  put(path59, opts) {
+    return this.methodRequest("put", path59, opts);
   }
-  delete(path58, opts) {
-    return this.methodRequest("delete", path58, opts);
+  delete(path59, opts) {
+    return this.methodRequest("delete", path59, opts);
   }
-  methodRequest(method, path58, opts) {
+  methodRequest(method, path59, opts) {
     return this.request(Promise.resolve(opts).then(async (opts2) => {
       const body = opts2 && isBlobLike2(opts2?.body) ? new DataView(await opts2.body.arrayBuffer()) : opts2?.body instanceof DataView ? opts2.body : opts2?.body instanceof ArrayBuffer ? new DataView(opts2.body) : opts2 && ArrayBuffer.isView(opts2?.body) ? new DataView(opts2.body.buffer) : opts2?.body;
-      return { method, path: path58, ...opts2, body };
+      return { method, path: path59, ...opts2, body };
     }));
   }
-  getAPIList(path58, Page3, opts) {
-    return this.requestAPIList(Page3, { method: "get", path: path58, ...opts });
+  getAPIList(path59, Page3, opts) {
+    return this.requestAPIList(Page3, { method: "get", path: path59, ...opts });
   }
   calculateContentLength(body) {
     if (typeof body === "string") {
@@ -97537,10 +97544,10 @@ var APIClient2 = class {
   }
   buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path58, query, headers = {} } = options;
+    const { method, path: path59, query, headers = {} } = options;
     const body = ArrayBuffer.isView(options.body) || options.__binaryRequest && typeof options.body === "string" ? options.body : isMultipartBody2(options.body) ? options.body.body : options.body ? JSON.stringify(options.body, null, 2) : null;
     const contentLength = this.calculateContentLength(body);
-    const url2 = this.buildURL(path58, query);
+    const url2 = this.buildURL(path59, query);
     if ("timeout" in options)
       validatePositiveInteger2("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -97656,8 +97663,8 @@ var APIClient2 = class {
     const request = this.makeRequest(options, null);
     return new PagePromise2(this, request, Page3);
   }
-  buildURL(path58, query) {
-    const url2 = isAbsoluteURL2(path58) ? new URL(path58) : new URL(this.baseURL + (this.baseURL.endsWith("/") && path58.startsWith("/") ? path58.slice(1) : path58));
+  buildURL(path59, query) {
+    const url2 = isAbsoluteURL2(path59) ? new URL(path59) : new URL(this.baseURL + (this.baseURL.endsWith("/") && path59.startsWith("/") ? path59.slice(1) : path59));
     const defaultQuery = this.defaultQuery();
     if (!isEmptyObj2(defaultQuery)) {
       query = { ...defaultQuery, ...query };
@@ -103037,11 +103044,11 @@ function buildAuthUrl(input) {
 }
 async function runAuthorizationCodeFlow(opts) {
   const port = opts.redirectPort ?? 8765;
-  const path58 = opts.redirectPath ?? "/callback";
+  const path59 = opts.redirectPath ?? "/callback";
   const codeVerifier = generateCodeVerifier();
   const codeChallenge = computeCodeChallenge(codeVerifier);
   const state = generateState();
-  const redirectUri = `http://localhost:${port}${path58}`;
+  const redirectUri = `http://localhost:${port}${path59}`;
   const authUrl = buildAuthUrl({
     authUrl: opts.authUrl,
     clientId: opts.clientId,
@@ -103053,7 +103060,7 @@ async function runAuthorizationCodeFlow(opts) {
   });
   const codePromise = waitForCallback({
     port,
-    path: path58,
+    path: path59,
     expectedState: state,
     timeoutMs: opts.timeoutMs ?? 3e5,
     ...opts.signal ? { signal: opts.signal } : {}
@@ -103401,11 +103408,11 @@ function buildOauthAuthorizeTool(deps) {
           const { computeCodeChallenge: computeCodeChallenge2 } = await Promise.resolve().then(() => (init_pkce(), pkce_exports));
           const challenge = computeCodeChallenge2(verifier);
           const port = input.redirectPort ?? 8765;
-          const path58 = input.redirectPath ?? "/callback";
+          const path59 = input.redirectPath ?? "/callback";
           const url2 = buildAuthUrl({
             authUrl: input.authUrl,
             clientId: input.clientId,
-            redirectUri: `http://localhost:${port}${path58}`,
+            redirectUri: `http://localhost:${port}${path59}`,
             scopes: input.scopes,
             codeChallenge: challenge,
             state,
@@ -103547,7 +103554,7 @@ async function runOauthLogin(profile, ctx) {
 }
 async function runBrowserFlow(profile, ctx) {
   const port = profile.redirect?.port ?? 8765;
-  const path58 = profile.redirect?.path ?? "/callback";
+  const path59 = profile.redirect?.path ?? "/callback";
   const serviceName = profile.displayName ?? profile.id;
   return runAuthorizationCodeFlow({
     authUrl: profile.authUrl,
@@ -103556,7 +103563,7 @@ async function runBrowserFlow(profile, ctx) {
     ...profile.clientSecret ? { clientSecret: profile.clientSecret } : {},
     scopes: profile.scopes,
     redirectPort: port,
-    redirectPath: path58,
+    redirectPath: path59,
     ...profile.extraAuthParams ? { extraAuthParams: profile.extraAuthParams } : {},
     timeoutMs: DEFAULT_BROWSER_TIMEOUT_MS,
     ...ctx.signal ? { signal: ctx.signal } : {},
@@ -103568,7 +103575,7 @@ If your browser doesn't open automatically, paste this URL:
 
   ${url2}
 
-Waiting for callback on http://localhost:${port}${path58} (5 min timeout)\u2026
+Waiting for callback on http://localhost:${port}${path59} (5 min timeout)\u2026
 
 `);
     }
@@ -105578,7 +105585,11 @@ async function* runDefaultMode(ctx) {
       continue;
     }
     reactiveCompactions = 0;
-    const stuck = yield* emitRequestsAndDetectStuck(ctx, toolUses, detector);
+    const stuck = yield* emitRequestsAndDetectStuck(ctx, toolUses, detector, {
+      abortedResultMessage: "default mode loop aborted (stuck pattern) before this call ran",
+      nearHint: "against the same target (only volatile args like maxBytes varied)",
+      fatalMessage: ({ toolName, count, how }) => `default mode loop aborted \u2014 detected stuck pattern: tool "${toolName}" called ${count} times ${how}. The model is likely looping on the same call; reset or rephrase.`
+    });
     if (stuck)
       return;
     if (text || stopReason === "end_turn" || toolUses.length === 0) {
@@ -105606,79 +105617,6 @@ async function* runDefaultMode(ctx) {
     message: `default mode loop exceeded maxIterations (${maxIterations})`
   });
 }
-async function* emitRequestsAndDetectStuck(ctx, toolUses, detector) {
-  const emitted = [];
-  for (const t2 of toolUses) {
-    yield await ctx.emit({
-      type: "tool_call_requested",
-      sessionId: ctx.sessionId,
-      turnId: ctx.turnId,
-      source: "model",
-      callId: asToolCallId(t2.id),
-      name: t2.name,
-      input: t2.input
-    });
-    emitted.push(t2);
-    const sig = detector.record(t2.name, t2.input);
-    if (sig.stuck) {
-      for (const r2 of emitted) {
-        yield await ctx.emit({
-          type: "tool_result",
-          sessionId: ctx.sessionId,
-          turnId: ctx.turnId,
-          source: "tool",
-          callId: asToolCallId(r2.id),
-          ok: false,
-          error: { kind: "aborted", message: "default mode loop aborted (stuck pattern) before this call ran" }
-        });
-      }
-      const how = sig.kind === "near" ? "against the same target (only volatile args like maxBytes varied)" : "with identical input";
-      yield await ctx.emit({
-        type: "error",
-        sessionId: ctx.sessionId,
-        turnId: ctx.turnId,
-        source: "system",
-        kind: "fatal",
-        message: `default mode loop aborted \u2014 detected stuck pattern: tool "${t2.name}" called ${sig.count} times ${how}. The model is likely looping on the same call; reset or rephrase.`
-      });
-      return true;
-    }
-  }
-  return false;
-}
-async function* executeToolUses(ctx, toolUses, iteration) {
-  const unresolved = new Set(toolUses.map((t2) => t2.id));
-  for (const t2 of toolUses) {
-    if (ctx.signal.aborted) {
-      for (const orphanId of unresolved) {
-        yield await ctx.emit({
-          type: "tool_result",
-          sessionId: ctx.sessionId,
-          turnId: ctx.turnId,
-          source: "tool",
-          callId: asToolCallId(orphanId),
-          ok: false,
-          error: { kind: "aborted", message: "turn aborted before tool ran" }
-        });
-      }
-      unresolved.clear();
-      yield await ctx.emit({
-        type: "abort",
-        sessionId: ctx.sessionId,
-        turnId: ctx.turnId,
-        source: "system",
-        reason: "signal aborted during tool execution"
-      });
-      return true;
-    }
-    try {
-      yield* dispatchToolCall(ctx, t2, iteration);
-    } finally {
-      unresolved.delete(t2.id);
-    }
-  }
-  return false;
-}
 function buildMessages(ctx) {
   const systemPrompt = buildSystemPromptWithSkills(ctx.systemPrompt, ctx.skills.list());
   return projectMessages(ctx, { ...systemPrompt ? { systemPrompt } : {} });
@@ -105914,7 +105852,22 @@ async function* runGoalMode(ctx) {
       });
       return;
     }
-    const stuck = yield* emitRequestsAndDetectStuck2(ctx, toolUses, detector);
+    const stuck = yield* emitRequestsAndDetectStuck(ctx, toolUses, detector, {
+      abortedResultMessage: "goal mode aborted (stuck pattern) before this call ran",
+      nearHint: "against the same target (only volatile args varied)",
+      extraOnStuck: ({ toolName, count, kind: kind3 }) => [
+        {
+          type: "plugin_event",
+          sessionId: ctx.sessionId,
+          turnId: ctx.turnId,
+          source: "plugin",
+          pluginId: GOAL_PLUGIN_ID,
+          subtype: "goal_stuck",
+          payload: { tool: toolName, count, kind: kind3 }
+        }
+      ],
+      fatalMessage: ({ toolName, count, how }) => `goal mode aborted \u2014 stuck pattern: tool "${toolName}" called ${count} times ${how}. The model is looping on the same call; send another message to redirect it.`
+    });
     if (stuck)
       return;
     if (text || stopReason === "end_turn" || toolUses.length === 0) {
@@ -105952,7 +105905,7 @@ async function* runGoalMode(ctx) {
       continue;
     }
     noop3 = 0;
-    const exited = yield* executeToolUses2(goalCtx, toolUses, iteration);
+    const exited = yield* executeToolUses(goalCtx, toolUses, iteration);
     if (exited)
       return;
     const terminal = detectGoalTerminal(ctx.log.slice(), toolUses);
@@ -106030,88 +105983,6 @@ function composeSystemPrompts(user, layer) {
 
 ${user}`;
 }
-async function* emitRequestsAndDetectStuck2(ctx, toolUses, detector) {
-  const emitted = [];
-  for (const t2 of toolUses) {
-    yield await ctx.emit({
-      type: "tool_call_requested",
-      sessionId: ctx.sessionId,
-      turnId: ctx.turnId,
-      source: "model",
-      callId: asToolCallId(t2.id),
-      name: t2.name,
-      input: t2.input
-    });
-    emitted.push(t2);
-    const sig = detector.record(t2.name, t2.input);
-    if (sig.stuck) {
-      for (const r2 of emitted) {
-        yield await ctx.emit({
-          type: "tool_result",
-          sessionId: ctx.sessionId,
-          turnId: ctx.turnId,
-          source: "tool",
-          callId: asToolCallId(r2.id),
-          ok: false,
-          error: { kind: "aborted", message: "goal mode aborted (stuck pattern) before this call ran" }
-        });
-      }
-      const how = sig.kind === "near" ? "against the same target (only volatile args varied)" : "with identical input";
-      yield await ctx.emit({
-        type: "plugin_event",
-        sessionId: ctx.sessionId,
-        turnId: ctx.turnId,
-        source: "plugin",
-        pluginId: GOAL_PLUGIN_ID,
-        subtype: "goal_stuck",
-        payload: { tool: t2.name, count: sig.count, kind: sig.kind }
-      });
-      yield await ctx.emit({
-        type: "error",
-        sessionId: ctx.sessionId,
-        turnId: ctx.turnId,
-        source: "system",
-        kind: "fatal",
-        message: `goal mode aborted \u2014 stuck pattern: tool "${t2.name}" called ${sig.count} times ${how}. The model is looping on the same call; send another message to redirect it.`
-      });
-      return true;
-    }
-  }
-  return false;
-}
-async function* executeToolUses2(ctx, toolUses, iteration) {
-  const unresolved = new Set(toolUses.map((t2) => t2.id));
-  for (const t2 of toolUses) {
-    if (ctx.signal.aborted) {
-      for (const orphanId of unresolved) {
-        yield await ctx.emit({
-          type: "tool_result",
-          sessionId: ctx.sessionId,
-          turnId: ctx.turnId,
-          source: "tool",
-          callId: asToolCallId(orphanId),
-          ok: false,
-          error: { kind: "aborted", message: "turn aborted before tool ran" }
-        });
-      }
-      unresolved.clear();
-      yield await ctx.emit({
-        type: "abort",
-        sessionId: ctx.sessionId,
-        turnId: ctx.turnId,
-        source: "system",
-        reason: "signal aborted during tool execution"
-      });
-      return true;
-    }
-    try {
-      yield* dispatchToolCall(ctx, t2, iteration);
-    } finally {
-      unresolved.delete(t2.id);
-    }
-  }
-  return false;
-}
 
 // ../mode-goal/dist/index.js
 var goalMode = defineMode({
@@ -110114,11 +109985,11 @@ function isAddrInUse(err) {
 async function freeTcpPort(port) {
   if (process.platform === "win32")
     return;
-  const { spawn: spawn16 } = await import('child_process');
+  const { spawn: spawn17 } = await import('child_process');
   const pids = await new Promise((resolve12) => {
     let out = "";
     try {
-      const child = spawn16("lsof", ["-t", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+      const child = spawn17("lsof", ["-t", `-iTCP:${port}`, "-sTCP:LISTEN"], {
         stdio: ["ignore", "pipe", "ignore"]
       });
       child.stdout.on("data", (b3) => {
@@ -111353,28 +111224,54 @@ function buildSubagentsPlugin(opts = {}) {
   });
 }
 buildSubagentsPlugin();
+
+// ../plugin-plugins-admin/dist/shared.js
+var NPM_NAME_RE = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+function assertSafeNpmSpec(spec) {
+  const trimmed = spec.trim();
+  if (trimmed.length === 0) {
+    throw new Error("plugin spec must be a non-empty package name, git spec, or path");
+  }
+  if (trimmed.startsWith("-")) {
+    throw new Error(`refusing plugin spec "${spec}": leading "-" would be parsed by npm as an option, not a package`);
+  }
+  return trimmed;
+}
+function diffSnapshot2(before, after) {
+  const out = {};
+  for (const key of ["tools", "agents", "providers", "modes", "compactors", "channels"]) {
+    const b3 = new Set(before[key]);
+    const added = after[key].filter((n2) => !b3.has(n2));
+    if (added.length > 0)
+      out[key] = added;
+  }
+  return out;
+}
+
+// ../plugin-plugins-admin/dist/install.js
 function userPluginsDir() {
   return moxxyPath("plugins");
 }
-var NPM_NAME_RE = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
 var VERSION_RE = /^[0-9a-z.~^*<=>-]+$/i;
 async function installPluginPackage(opts) {
+  const spec = assertSafeNpmSpec(opts.packageName);
   const dir = userPluginsDir();
   await ensurePackageJson(dir);
-  const { exitCode, stderr } = await runNpm(["install", "--prefix", dir, "--no-fund", "--no-audit", "--save", opts.packageName], opts.signal);
+  const { exitCode, stderr } = await runNpm(["install", "--prefix", dir, "--no-fund", "--no-audit", "--save", spec], opts.signal);
   if (exitCode !== 0) {
     throw new Error(`npm install failed (exit ${exitCode}): ${truncate9(stderr, 400)}`);
   }
-  return { installed: opts.packageName, dir };
+  return { installed: spec, dir };
 }
 async function removePluginPackage(opts) {
+  const spec = assertSafeNpmSpec(opts.packageName);
   const dir = userPluginsDir();
   await ensurePackageJson(dir);
-  const { exitCode, stderr } = await runNpm(["uninstall", "--prefix", dir, "--no-fund", "--no-audit", "--save", opts.packageName], opts.signal);
+  const { exitCode, stderr } = await runNpm(["uninstall", "--prefix", dir, "--no-fund", "--no-audit", "--save", spec], opts.signal);
   if (exitCode !== 0) {
     throw new Error(`npm uninstall failed (exit ${exitCode}): ${truncate9(stderr, 400)}`);
   }
-  return { removed: opts.packageName, dir };
+  return { removed: spec, dir };
 }
 function buildInstallPluginTool(deps) {
   return defineTool({
@@ -111491,26 +111388,15 @@ function runNpm(args, signal) {
     });
   });
 }
-function diffSnapshot2(before, after) {
-  const out = {};
-  for (const key of ["tools", "agents", "providers", "modes", "compactors", "channels"]) {
-    const b3 = new Set(before[key]);
-    const added = after[key].filter((n2) => !b3.has(n2));
-    if (added.length > 0)
-      out[key] = added;
-  }
-  return out;
-}
 function truncate9(s2, n2) {
   return s2.length <= n2 ? s2 : s2.slice(0, n2 - 1) + "\u2026";
 }
-var NPM_NAME_RE2 = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
 function buildDisablePluginTool(deps) {
   return defineTool({
     name: "disable_plugin",
     description: "Disable (unplug) a registered moxxy plugin \u2014 a default builtin or an installed one \u2014 by package name. Persists `plugins[<name>].enabled=false` to ~/.moxxy/config.yaml and unloads it from the running session, so its tools / agents / providers / modes / channels disappear immediately and it stays off across restarts. Reverse with enable_plugin. Use when the user wants to turn a plugin off without uninstalling it.",
     inputSchema: z$1.object({
-      packageName: z$1.string().min(1).refine((s2) => NPM_NAME_RE2.test(s2), {
+      packageName: z$1.string().min(1).refine((s2) => NPM_NAME_RE.test(s2), {
         message: "must be a valid moxxy package name (e.g. @moxxy/plugin-browser)"
       }).describe("Plugin package name to disable, e.g. @moxxy/plugin-browser.")
     }),
@@ -111519,7 +111405,7 @@ function buildDisablePluginTool(deps) {
       const before = deps.snapshot();
       await deps.setEnabled(packageName, false);
       const after = deps.snapshot();
-      return { disabled: packageName, unregistered: diffSnapshot3(after, before) };
+      return { disabled: packageName, unregistered: diffSnapshot2(after, before) };
     }
   });
 }
@@ -111528,7 +111414,7 @@ function buildEnablePluginTool(deps) {
     name: "enable_plugin",
     description: "Enable (plug back in) a previously-disabled moxxy plugin by package name. Persists `plugins[<name>].enabled=true` to ~/.moxxy/config.yaml and loads it into the running session (re-registering a default or re-discovering an installed plugin), so its contributions reappear immediately. Reverse with disable_plugin. Use when the user wants to turn a disabled plugin back on.",
     inputSchema: z$1.object({
-      packageName: z$1.string().min(1).refine((s2) => NPM_NAME_RE2.test(s2), {
+      packageName: z$1.string().min(1).refine((s2) => NPM_NAME_RE.test(s2), {
         message: "must be a valid moxxy package name (e.g. @moxxy/plugin-browser)"
       }).describe("Plugin package name to enable, e.g. @moxxy/plugin-browser.")
     }),
@@ -111537,20 +111423,10 @@ function buildEnablePluginTool(deps) {
       const before = deps.snapshot();
       await deps.setEnabled(packageName, true);
       const after = deps.snapshot();
-      return { enabled: packageName, registered: diffSnapshot3(before, after) };
+      return { enabled: packageName, registered: diffSnapshot2(before, after) };
     }
   });
 }
-function diffSnapshot3(before, after) {
-  const out = {};
-  for (const key of ["tools", "agents", "providers", "modes", "compactors", "channels"]) {
-    const b3 = new Set(before[key]);
-    const added = after[key].filter((n2) => !b3.has(n2));
-    if (added.length > 0)
-      out[key] = added;
-  }
-  return out;
-}
 
 // ../plugin-plugins-admin/dist/catalog.js
 var INSTALLABLE_PLUGIN_CATALOG = [
@@ -113565,7 +113441,7 @@ function readHeader(headers, name) {
     return v3[0] ?? null;
   return v3 ?? null;
 }
-function readJsonPath(body, path58) {
+function readJsonPath(body, path59) {
   let parsed;
   try {
     parsed = JSON.parse(body.toString("utf8"));
@@ -113573,7 +113449,7 @@ function readJsonPath(body, path58) {
     return null;
   }
   let cur = parsed;
-  for (const seg of path58.split(".")) {
+  for (const seg of path59.split(".")) {
     if (cur === null || cur === void 0 || typeof cur !== "object")
       return null;
     cur = cur[seg];
@@ -116225,8 +116101,8 @@ function findCycle(steps) {
 }
 function formatIssues(error2) {
   return error2.issues.map((iss) => {
-    const path58 = iss.path.join(".") || "(root)";
-    return `${path58}: ${iss.message}`;
+    const path59 = iss.path.join(".") || "(root)";
+    return `${path59}: ${iss.message}`;
   });
 }
 function validateWorkflow(raw) {
@@ -119813,11 +119689,11 @@ async function pidsListeningOnPort(port) {
   return await runLsof(["-t", `-iTCP:${port}`, "-sTCP:LISTEN"]);
 }
 async function runLsof(args) {
-  const { spawn: spawn16 } = await import('child_process');
+  const { spawn: spawn17 } = await import('child_process');
   return await new Promise((resolve12) => {
     let out = "";
     try {
-      const child = spawn16("lsof", [...args], {
+      const child = spawn17("lsof", [...args], {
         stdio: ["ignore", "pipe", "ignore"]
       });
       child.stdout.on("data", (b3) => {
@@ -119885,6 +119761,145 @@ function cliVersion() {
   }
 }
 
+// src/update/registry.ts
+var REGISTRY = "https://registry.npmjs.org";
+var DEFAULT_PKG = "@moxxy/cli";
+var DEFAULT_TIMEOUT_MS = 4e3;
+async function fetchLatest(pkg = DEFAULT_PKG, opts = {}) {
+  const fetchImpl2 = opts.fetchImpl ?? fetch;
+  const url2 = `${REGISTRY}/${pkg}/latest`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  try {
+    const res = await fetchImpl2(url2, {
+      signal: controller.signal,
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const json = await res.json();
+    return typeof json.version === "string" ? json.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/update/check.ts
+var CACHE_TTL_MS = 12 * 60 * 60 * 1e3;
+var PKG = "@moxxy/cli";
+function defaultCacheFile() {
+  return path3.join(os5.homedir(), ".moxxy", "update-check.json");
+}
+function compareSemver(a2, b3) {
+  const parse2 = (s2) => (s2.split("-")[0] ?? "").split(".").map((n2) => Number.parseInt(n2, 10) || 0);
+  const pa = parse2(a2);
+  const pb = parse2(b3);
+  for (let i2 = 0; i2 < 3; i2 += 1) {
+    const d2 = (pa[i2] ?? 0) - (pb[i2] ?? 0);
+    if (d2 !== 0) return d2 < 0 ? -1 : 1;
+  }
+  return 0;
+}
+function readCache(file) {
+  try {
+    const raw = JSON.parse(readFileSync(file, "utf8"));
+    if (typeof raw.checkedAt === "number" && typeof raw.latest === "string") {
+      return { checkedAt: raw.checkedAt, latest: raw.latest };
+    }
+  } catch {
+  }
+  return null;
+}
+function writeCache(file, value) {
+  try {
+    mkdirSync(path3.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(value, null, 2));
+    renameSync(tmp, file);
+  } catch {
+  }
+}
+function shape(current, latest) {
+  if (!current || !latest) return null;
+  return { current, latest, updateAvailable: compareSemver(latest, current) > 0 };
+}
+function readCachedCheck(current, opts = {}) {
+  const cache3 = readCache(opts.cacheFile ?? defaultCacheFile());
+  return shape(current, cache3?.latest ?? null);
+}
+async function refreshCheck(current, opts = {}) {
+  const latest = await fetchLatest(PKG, opts);
+  if (latest) {
+    writeCache(opts.cacheFile ?? defaultCacheFile(), {
+      checkedAt: opts.now ?? Date.now(),
+      latest
+    });
+  }
+  return shape(current, latest);
+}
+async function checkForCliUpdate(current, opts = {}) {
+  if (!current) return null;
+  const now = opts.now ?? Date.now();
+  const file = opts.cacheFile ?? defaultCacheFile();
+  if (!opts.force) {
+    const cache3 = readCache(file);
+    if (cache3 && now - cache3.checkedAt < CACHE_TTL_MS) {
+      return shape(current, cache3.latest);
+    }
+  }
+  const refreshed = await refreshCheck(current, { ...opts, cacheFile: file, now });
+  return refreshed ?? shape(current, readCache(file)?.latest ?? null);
+}
+var PKG2 = "@moxxy/cli";
+function detectInstall(opts = {}) {
+  const fromUrl = opts.fromUrl ?? import.meta.url;
+  const ua = opts.userAgent ?? process.env.npm_config_user_agent ?? "";
+  let installPath = null;
+  try {
+    installPath = fileURLToPath(fromUrl);
+  } catch {
+    installPath = null;
+  }
+  const p3 = (installPath ?? "").replace(/\\/g, "/");
+  if (p3.includes("/packages/cli/")) {
+    return { manager: "workspace", global: false, pkg: PKG2, cmd: [], installPath };
+  }
+  const manager = inferManager(p3, ua);
+  const global2 = looksGlobal(p3, (opts.cwd ?? process.cwd()).replace(/\\/g, "/"));
+  return { manager, global: global2, pkg: PKG2, cmd: upgradeCmd(manager, global2), installPath };
+}
+function inferManager(p3, ua) {
+  const head = ua.split("/")[0]?.toLowerCase();
+  if (head === "pnpm" || head === "yarn" || head === "bun" || head === "npm") return head;
+  if (/(^|\/)\.?pnpm(\/|-global|$)|\/library\/pnpm\//i.test(p3)) return "pnpm";
+  if (/\/\.bun\//i.test(p3)) return "bun";
+  if (/\/\.?yarn\//i.test(p3) || /\/\.config\/yarn\//i.test(p3)) return "yarn";
+  return "npm";
+}
+function looksGlobal(p3, cwd2) {
+  if (!p3) return true;
+  if (p3.includes(`${cwd2}/node_modules/`)) return false;
+  return true;
+}
+function upgradeCmd(manager, global2) {
+  const target = `${PKG2}@latest`;
+  switch (manager) {
+    case "pnpm":
+      return ["pnpm", "add", ...global2 ? ["-g"] : [], target];
+    case "yarn":
+      return global2 ? ["yarn", "global", "add", target] : ["yarn", "add", target];
+    case "bun":
+      return ["bun", "add", ...global2 ? ["-g"] : [], target];
+    case "npm":
+    default:
+      return ["npm", "install", ...global2 ? ["-g"] : [], target];
+  }
+}
+function formatCmd(cmd) {
+  return cmd.join(" ");
+}
+
 // src/validate-key.ts
 async function validateProviderKey(providerName, key, providers) {
   const def = providers.list().find((p3) => p3.name === providerName);
@@ -120266,6 +120281,13 @@ async function killStaleRunnerAt(socketPath) {
   } catch {
   }
 }
+function resolveUpdateNotice(version) {
+  if (!version) return void 0;
+  if (detectInstall().manager === "workspace") return void 0;
+  void refreshCheck(version).catch(() => void 0);
+  const cached = readCachedCheck(version);
+  return cached?.updateAvailable ? { latest: cached.latest } : void 0;
+}
 async function runTuiWithBootstrap(argv, tuiOpts = {}) {
   const standalone = hasBoolFlag(argv, "standalone");
   const mode = chooseClientMode({ standalone, runnerUp: standalone ? false : await isRunnerUp() });
@@ -120302,6 +120324,7 @@ async function runAttachedTui(argv, tuiOpts) {
   const prefs = await loadPreferences();
   const effectiveModel = stringFlag(argv, "model") ?? prefs.model;
   const version = cliVersion();
+  const updateNotice = resolveUpdateNotice(version);
   let shuttingDown = false;
   const shutdown = async () => {
     if (shuttingDown) return;
@@ -120321,6 +120344,7 @@ async function runAttachedTui(argv, tuiOpts) {
       },
       ...effectiveModel ? { model: effectiveModel } : {},
       ...version ? { version } : {},
+      ...updateNotice ? { updateAvailable: updateNotice } : {},
       // Land directly in the (replayed) conversation rather than the splash.
       resumed: true
     })
@@ -120372,6 +120396,7 @@ async function runSelfHostedTui(argv, tuiOpts, standalone) {
   });
   const effectiveModel = stringFlag(argv, "model") ?? (await loadPreferences()).model;
   const version = cliVersion();
+  const updateNotice = resolveUpdateNotice(version);
   let bootedSession = null;
   let runnerServer = null;
   let webHandle = null;
@@ -120430,6 +120455,7 @@ async function runSelfHostedTui(argv, tuiOpts, standalone) {
       },
       ...effectiveModel ? { model: effectiveModel } : {},
       ...version ? { version } : {},
+      ...updateNotice ? { updateAvailable: updateNotice } : {},
       ...tuiOpts.resumeSessionId ? { resumed: true } : {}
     })
   );
@@ -123951,6 +123977,114 @@ async function runSelfUpdateCommand(argv) {
 ${HELP13}`);
   return 2;
 }
+var HELP14 = formatHelp({
+  title: "moxxy update",
+  tagline: "update the moxxy CLI to the latest published version",
+  sections: [
+    {
+      title: "USAGE",
+      rows: [
+        ["moxxy update", "check npm + upgrade (asks before running)"],
+        ["moxxy update --check", "report current vs latest, print the command, do nothing"],
+        ["moxxy update --yes", "upgrade without the confirmation prompt"]
+      ]
+    },
+    {
+      title: "NOTES",
+      notes: [
+        "Detects npm / pnpm / yarn / bun (global or local) and runs the matching upgrade.",
+        "From a source checkout, update with git instead \u2014 nothing is installed."
+      ]
+    }
+  ]
+});
+async function runCommand(cmd) {
+  const [bin, ...args] = cmd;
+  if (!bin) return 1;
+  return new Promise((resolve12) => {
+    const proc = spawn(bin, args, {
+      stdio: "inherit",
+      // npm/pnpm/yarn/bun are `.cmd` shims on Windows — needs a shell to launch.
+      shell: process.platform === "win32"
+    });
+    proc.on("error", () => resolve12(127));
+    proc.on("exit", (code) => resolve12(code ?? 1));
+  });
+}
+async function runUpdateCommand(argv, deps = {}) {
+  if (helpRequested(argv) || argv.positional[0] === "help") {
+    process.stdout.write(HELP14);
+    return 0;
+  }
+  const out = deps.out ?? ((s2) => process.stdout.write(s2));
+  const current = deps.current ?? cliVersion();
+  const checkOnly = hasBoolFlag(argv, "check") || hasBoolFlag(argv, "dry-run");
+  const check = deps.check ?? ((c2) => checkForCliUpdate(c2, { force: true }));
+  const detect = deps.detect ?? (() => detectInstall());
+  const run2 = deps.run ?? runCommand;
+  out(colors.dim("Checking for updates\u2026\n"));
+  const result = await check(current);
+  if (!result) {
+    const info2 = detect();
+    out(colors.dim(`Could not reach the npm registry. Current version: ${current ?? "unknown"}.
+`));
+    if (info2.manager !== "workspace") {
+      out(colors.dim("To update manually:\n  ") + colors.bold(formatCmd(info2.cmd)) + "\n");
+    }
+    return 0;
+  }
+  if (!result.updateAvailable) {
+    out(colors.green("\u2713 ") + `You're on the latest moxxy (v${result.current}).
+`);
+    return 0;
+  }
+  out(
+    `Update available: ${colors.dim("v" + result.current)} \u2192 ${colors.bold(colors.green("v" + result.latest))}
+`
+  );
+  const info = detect();
+  if (info.manager === "workspace") {
+    out(
+      colors.dim(
+        "You're running moxxy from a source checkout \u2014 nothing to install.\nUpdate with: "
+      ) + colors.bold("git pull") + colors.dim(" && pnpm install && pnpm build") + "\n"
+    );
+    return 0;
+  }
+  const cmdStr = formatCmd(info.cmd);
+  out(colors.dim("Will run: ") + colors.bold(cmdStr) + "\n");
+  if (checkOnly) return 0;
+  const interactive = deps.interactive ?? Boolean(process.stdin.isTTY);
+  let proceed = confirmedYes(argv);
+  if (!proceed) {
+    if (!interactive) {
+      out(colors.dim("Re-run with --yes to apply, or run the command above yourself.\n"));
+      return 0;
+    }
+    const ask = deps.promptConfirm ?? defaultConfirm;
+    proceed = await ask(`Run \`${cmdStr}\` now?`);
+    if (!proceed) {
+      out(colors.dim("Skipped. Run the command above when you're ready.\n"));
+      return 0;
+    }
+  }
+  out(colors.dim(`
+$ ${cmdStr}
+`));
+  const code = await run2(info.cmd);
+  if (code === 0) {
+    out("\n" + colors.green("\u2713 ") + `Updated to v${result.latest}. Restart moxxy to use it.
+`);
+    return 0;
+  }
+  printError(`update command exited with code ${code}`);
+  return code || 1;
+}
+async function defaultConfirm(message) {
+  const answer = await ue2({ message });
+  if (q2(answer)) return false;
+  return answer === true;
+}
 
 // src/bin.ts
 await init_dist9();
@@ -124014,7 +124148,8 @@ var SECTIONS = [
       ["init", "interactive first-time setup (provider keys \u2192 vault)"],
       ["login <provider>", "OAuth sign-in for providers that don't use API keys"],
       ["login status|logout", "inspect / remove stored OAuth credentials"],
-      ["doctor [--check-keys]", "diagnose config, vault, providers, channels, memory"]
+      ["doctor [--check-keys]", "diagnose config, vault, providers, channels, memory"],
+      ["update [--check|--yes]", "upgrade the moxxy CLI to the latest published version"]
     ]
   },
   {
@@ -124132,6 +124267,7 @@ var COMMANDS = {
   mcp: runMcpCommand,
   schedule: runScheduleCommand,
   doctor: runDoctorCommand,
+  update: runUpdateCommand,
   prompt: runPromptCommand,
   tui: runTuiCommand,
   resume: runResumeCommand,