@nanopm/cli 0.1.5 → 0.1.7

package/dist/index.js

@@ -105,7 +105,7 @@ var CAPABILITIES = [
    * `projects.website_url`, never a model's choice, and only that host and three fixed
    * paths are fetched. That is what lets a skill holding the founder's repository read
    * their landing page without an outbound socket sitting next to private code, which is
-   * the combination the taint rule exists to prevent (docs/nanopm-60-onboarding-end-to-end.md §6).
+   * the combination the taint rule exists to prevent (docs/✅nanopm-60-onboarding-end-to-end.md §6).
    *
    * Capped nowhere, and it does not taint: there is no tool here to misuse.
    */
@@ -139,7 +139,7 @@ var CAPABILITIES = [
   /** Maintain the market view: write_market, and list_market under `memory`. */
   "market",
   /**
-   * A conversation with Nano (docs/nanopm-68-talk-to-nano.md): read the opportunity map and the
+   * A conversation with Nano (docs/✅nanopm-68-talk-to-nano.md): read the opportunity map and the
    * board and change them as the founder asked — the tools in `TALK_TOOLS`. Nothing else: no
    * repository, no web, no data. Capped nowhere: every change is one the founder can make from a
    * sheet, and only what they asked for is done.
@@ -374,7 +374,7 @@ var SkillManifestSchema = z2.object({
   ),
   /**
    * The cap for a run with `params.depth: 'deep'`, when the skill has one: the deep needs map
-   * runs ten sessions and never fit the quick map's forty minutes (docs/nanopm-63-quick-first.md §4).
+   * runs ten sessions and never fit the quick map's forty minutes (docs/✅nanopm-63-quick-first.md §4).
    */
   timeout_deep: z2.string().refine(
     (t) => {
@@ -872,7 +872,7 @@ var CHAINED = {
   // and the crew runs when the founder asks for it from the business card.
   onboard: ["market"],
   // A problem list is what solutions hang under, so a fresh list is followed by fresh
-  // solutions. **The problem crew itself is retired** (docs/nanopm-59-opportunity-map.md,
+  // solutions. **The problem crew itself is retired** (docs/✅nanopm-59-opportunity-map.md,
   // Guillaume, 2026-09-25): the opportunity map replaced it, and nothing queues it any more —
   // not the market read, not a review, not a watch, not the founder leaving Voices. A map
   // someone still runs by hand keeps this edge, because every bet still hangs off a problem
@@ -880,7 +880,7 @@ var CHAINED = {
   problems: ["solutions"],
   // The pitch crew runs after the market read, which is the one automatic run that changes
   // what the pitch can say without anyone asking: an "unlike" clause needs competitors. It
-  // proposes beside a confirmed pitch and never over it (docs/nanopm-52-pitch-crew.md).
+  // proposes beside a confirmed pitch and never over it (docs/✅nanopm-52-pitch-crew.md).
   //
   // The direction crew **was** chained here too, for the same reason — a vision rests on who
   // else exists — then after `onboard`, and since 2026-10-01 after nothing: see the note on
@@ -891,7 +891,7 @@ var CHAINED = {
   // for both, and gets to say something different to each.
   //
   // **The persona crew follows a from-scratch start's market run, and no other**
-  // (docs/nanopm-54-personas-by-the-crew.md; docs/nanopm-63-quick-first.md §2). A start writes a
+  // (docs/✅nanopm-54-personas-by-the-crew.md; docs/✅nanopm-63-quick-first.md §2). A start writes a
   // sentence per person, and the crew draws the profile. It followed a scan's market run too
   // until 2026-09-28, to put a critic over the scan's one pass — and the redo, with the pitch
   // behind it, stood between the founder and the first opportunities while redrawing what the
@@ -900,7 +900,7 @@ var CHAINED = {
   // start: the daemon claims in queue order, and the pitch and the map read what it wrote.
   //
   // **The first opportunity map follows the onboarding's own market run, and no other**
-  // (docs/nanopm-59-opportunity-map.md §8). `ONLY_AFTER` below holds it there: a market run from
+  // (docs/✅nanopm-59-opportunity-map.md §8). `ONLY_AFTER` below holds it there: a market run from
   // the card or the terminal queues no map, so a founder's refresh of the landscape never
   // redraws it. It reads the card, the personas and their needs the onboarding wrote, and the
   // market just read; a needs map is one source among the others, never a constraint
@@ -914,7 +914,7 @@ var CHAINED = {
   // draw, on the founder's word; drawn there, it queues nothing and the page offers *Rank
   // again*. The deep map still follows a deep needs map queued after a start (`AFTER_DEEP`).
   market: ["personas", "pitch", "opportunities"],
-  // **Solutions follow the map, but not through this table** (docs/nanopm-64-solutions-from-
+  // **Solutions follow the map, but not through this table** (docs/✅nanopm-64-solutions-from-
   // opportunities.md §3): the store queues a Flash the moment a branch ranked high enough has
   // leaves with no solution — when the map is recorded, and when the founder moves, confirms or
   // sets one aside (`queue_solutions_due`). Only some maps call for one, and a map is not the only
@@ -964,7 +964,7 @@ var SKILL_SENTENCE = {
   problems: "working out the problems",
   market: "reading the market",
   // Kept: `research` is no longer chained or run from anywhere a founder can see, but the
-  // problem crew still calls it inline for its look outside (docs/nanopm-55-market-crew.md
+  // problem crew still calls it inline for its look outside (docs/✅nanopm-55-market-crew.md
   // §9), and a job of it in the journal should still read as a sentence.
   research: "reading the market",
   personas: "working out who it is for",
@@ -3856,10 +3856,10 @@ function parsePrintResult(stdout) {
 }
 
 // ../daemon/src/daemon.ts
-import { mkdir as mkdir5, readdir as readdir2, readFile as readFile7, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir5, readdir as readdir2, readFile as readFile7, rm as rm4, writeFile as writeFile4 } from "fs/promises";
 import { openSync, closeSync, unlinkSync, writeFileSync, readFileSync as readFileSyncNode, mkdirSync } from "fs";
 import { hostname as hostname2 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { setTimeout as sleep } from "timers/promises";
 
 // ../daemon/src/awake.ts
@@ -3878,6 +3878,71 @@ function stayAwake(platform = process.platform) {
   }
 }
 
+// ../daemon/src/update.ts
+import { execFile as execFile2 } from "child_process";
+import { existsSync, realpathSync } from "fs";
+import { rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join4, sep } from "path";
+import { promisify as promisify2 } from "util";
+var PACKAGE = "@nanopm/cli";
+var LATEST_URL = "https://registry.npmjs.org/@nanopm%2fcli/latest";
+var RELEASE = /^\d+\.\d+\.\d+$/;
+var execFileAsync2 = promisify2(execFile2);
+var root = (home = homedir2()) => join4(home, ".nanopm");
+var appDir = (home) => join4(root(home), "app");
+var offFlag = (home) => join4(root(home), "no-auto-update");
+function installKind(bin = process.argv[1], home = homedir2()) {
+  if (!bin) return "other";
+  let real = bin;
+  try {
+    real = realpathSync(bin);
+  } catch {
+  }
+  return real.startsWith(appDir(home) + sep) ? "installer" : "other";
+}
+function newer(latest, current) {
+  if (!latest || !RELEASE.test(latest) || !RELEASE.test(current)) return false;
+  const a = latest.split(".").map(Number);
+  const b = current.split(".").map(Number);
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return false;
+}
+async function latestVersion(fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(LATEST_URL, { signal: AbortSignal.timeout(5e3) });
+    if (!res.ok) return null;
+    const { version } = await res.json();
+    return typeof version === "string" && RELEASE.test(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+async function installVersion(version, home = homedir2()) {
+  if (!RELEASE.test(version)) return { ok: false, why: `not a version: ${version}` };
+  const runtime = join4(root(home), "runtime", "bin");
+  try {
+    await execFileAsync2(join4(runtime, "npm"), ["install", "-g", "--prefix", appDir(home), `${PACKAGE}@${version}`, "--no-fund", "--no-audit", "--loglevel=error"], {
+      timeout: 5 * 6e4,
+      env: { ...process.env, PATH: `${runtime}:${process.env.PATH ?? ""}`, NPM_CONFIG_UPDATE_NOTIFIER: "false" }
+    });
+    return { ok: true };
+  } catch (err) {
+    const failed = err;
+    return { ok: false, why: (failed.stderr?.trim() || failed.message || String(err)).split("\n").slice(-3).join(" ") };
+  }
+}
+function autoUpdateOff(home = homedir2()) {
+  return existsSync(offFlag(home));
+}
+async function setAutoUpdate(on, home = homedir2()) {
+  if (on) await rm2(offFlag(home), { force: true });
+  else await writeFile3(offFlag(home), "Automatic updates are off: `nanopm update --auto on` turns them back on.\n");
+}
+function shouldUpdate(s) {
+  return s.kind === "installer" && !s.off && !s.quickBusy && newer(s.latest, s.current);
+}
+
 // ../daemon/src/mcp.ts
 function memoryMcpCommand(env = process.env) {
   const override = env.NANOPM_MCP_COMMAND;
@@ -4865,7 +4930,7 @@ async function appStoreSearch(term, country, limit, opts = {}) {
 
 // ../connectors/src/stores/play.ts
 var SEARCH2 = "https://play.google.com/store/search";
-var PACKAGE = /^[a-z][a-z0-9_]*(\.[a-z0-9_]+){2,}$/i;
+var PACKAGE2 = /^[a-z][a-z0-9_]*(\.[a-z0-9_]+){2,}$/i;
 function playSearchUrl(term, country) {
   const url = new URL(SEARCH2);
   url.searchParams.set("q", term);
@@ -4889,7 +4954,7 @@ function blobs(html) {
 function cards(node, found = []) {
   if (!Array.isArray(node)) return found;
   const head = node[0];
-  if (Array.isArray(head) && head.length === 2 && typeof head[0] === "string" && PACKAGE.test(head[0]) && head[1] === 7) {
+  if (Array.isArray(head) && head.length === 2 && typeof head[0] === "string" && PACKAGE2.test(head[0]) && head[1] === 7) {
     found.push(node);
     return found;
   }
@@ -5022,13 +5087,13 @@ async function sendDigestFor(client, accessToken, jobId, fetchImpl = fetch) {
 }
 
 // ../daemon/src/deploys.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFileAsync2 = promisify2(execFile2);
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+var execFileAsync3 = promisify3(execFile3);
 var SETTLE_HOURS = 3;
 var MIN_COMMITS = 3;
 async function git(cwd, args) {
-  const { stdout } = await execFileAsync2("git", ["-C", cwd, ...args], { timeout: 2e4, maxBuffer: 1024 * 1024 });
+  const { stdout } = await execFileAsync3("git", ["-C", cwd, ...args], { timeout: 2e4, maxBuffer: 1024 * 1024 });
   return stdout.trim();
 }
 async function defaultBranch(cwd) {
@@ -5124,17 +5189,17 @@ async function reviewWithoutData(client, job) {
 }
 
 // ../daemon/src/skills.ts
-import { existsSync, readdirSync } from "fs";
+import { existsSync as existsSync2, readdirSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
-import { dirname as dirname2, join as join4, resolve as resolve2 } from "path";
+import { dirname as dirname2, join as join5, resolve as resolve2 } from "path";
 function findSkillsDir(env = process.env) {
   if (env.NANOPM_SKILLS_DIR) return env.NANOPM_SKILLS_DIR;
   const candidates = [
-    join4(process.cwd(), "skills"),
+    join5(process.cwd(), "skills"),
     ...process.argv[1] ? [resolve2(dirname2(process.argv[1]), "..", "skills")] : []
   ];
   for (const dir of candidates) {
-    if (existsSync(join4(dir, "onboard", "skill.json"))) return dir;
+    if (existsSync2(join5(dir, "onboard", "skill.json"))) return dir;
   }
   throw new Error(`Cannot find the skills directory (tried ${candidates.join(", ")}). Set NANOPM_SKILLS_DIR.`);
 }
@@ -5144,9 +5209,9 @@ function skillDirs(skillsDir, env = process.env) {
 }
 async function loadSkill(name, skillsDir = findSkillsDir()) {
   if (!/^[a-z][a-z0-9-]*$/.test(name)) throw new Error(`Invalid skill name "${name}"`);
-  const dir = skillDirs(skillsDir).map((d) => join4(d, name)).find((d) => existsSync(join4(d, "skill.json")));
+  const dir = skillDirs(skillsDir).map((d) => join5(d, name)).find((d) => existsSync2(join5(d, "skill.json")));
   if (!dir) throw new Error(`Unknown skill "${name}"`);
-  const raw = JSON.parse(await readFile2(join4(dir, "skill.json"), "utf8"));
+  const raw = JSON.parse(await readFile2(join5(dir, "skill.json"), "utf8"));
   let manifest;
   try {
     manifest = parseSkillManifest(raw);
@@ -5155,7 +5220,7 @@ async function loadSkill(name, skillsDir = findSkillsDir()) {
   }
   const tainted = taintedByTheWeb(manifest);
   if (tainted) throw new Error(`the "${name}" skill cannot be loaded: ${tainted}`);
-  const body = await readFile2(join4(dir, "SKILL.md"), "utf8");
+  const body = await readFile2(join5(dir, "SKILL.md"), "utf8");
   return { manifest, body, dir };
 }
 var NOT_WITH_READ_WEB = ["write_memory", "problems", "propose", "review", "write_repo", "run_commands"];
@@ -5190,7 +5255,7 @@ function renderPrompt(template, params) {
 var NEEDS_THE_REQUESTERS_CLONE = ["write_repo", "run_commands"];
 var NEEDS_THE_REQUESTERS_IDENTITY = /* @__PURE__ */ new Set(["want", "start"]);
 async function clonelessSkills(skillsDir = findSkillsDir()) {
-  const names = readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync(join4(skillsDir, d.name, "skill.json"))).map((d) => d.name);
+  const names = readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync2(join5(skillsDir, d.name, "skill.json"))).map((d) => d.name);
   const out = [];
   for (const name of names) {
     try {
@@ -5402,9 +5467,9 @@ async function runMappingJob({ client, job, adapter, spec, mcpServers, onEvent,
   };
   const { data: rootId, error: rootError } = await client.rpc("mapping_run_root", { p_job_id: job.id });
   if (rootError) throw new Error(rootError.message);
-  const { data: root, error: readError } = await client.from("jobs").select("result").eq("id", rootId).single();
+  const { data: root2, error: readError } = await client.from("jobs").select("result").eq("id", rootId).single();
   if (readError) throw new Error(readError.message);
-  const saved = root.result;
+  const saved = root2.result;
   if (saved?.mapping_receipt) return { status: "succeeded", result: saved.mapping_audit?.checked.summary ?? `Problem map published: ${saved.mapping_receipt.refs.join(", ")}` };
   const previousUsage = mappingUsage(saved?.mapping_checkpoints ?? []);
   const result = await runProblemMapping({
@@ -5520,7 +5585,7 @@ var UNANSWERED = /structured[ _]output|returned no result/i;
 
 // ../daemon/src/site.ts
 import { readFile as readFile3 } from "fs/promises";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var SITE_PATHS = ["/", "/about", "/pricing"];
 var PAGE_CHARS = 6e3;
 var SITE_TIMEOUT_MS = 2e4;
@@ -5643,7 +5708,7 @@ function siteFromSearch(name, hits) {
 }
 async function read(repoRoot, name) {
   try {
-    const text2 = await readFile3(join5(repoRoot, name), "utf8");
+    const text2 = await readFile3(join6(repoRoot, name), "utf8");
     return text2.length > 2e5 ? null : text2;
   } catch {
     return null;
@@ -5698,7 +5763,7 @@ async function fromReadme(repoRoot) {
 
 // ../daemon/src/repo-docs.ts
 import { readFile as readFile4, readdir, stat } from "fs/promises";
-import { join as join6, relative } from "path";
+import { join as join7, relative } from "path";
 var WRITTEN = /(persona|audience|customer|user-research|research\/|icp|segment)/i;
 var ABOUT_PEOPLE = /(persona|audience|customer|user-research|research\/|interview|feedback|survey|verbatim|voice|icp|segment)/i;
 var DOC = /\.(md|mdx|txt)$/i;
@@ -5716,7 +5781,7 @@ async function readDocs(cwd, opts = {}) {
       return;
     }
     for (const entry of entries) {
-      const full = join6(dir, entry.name);
+      const full = join7(dir, entry.name);
       if (SKIP.test(`/${relative(cwd, full)}`)) continue;
       if (entry.isDirectory()) await walk(full, depth + 1);
       else if (DOC.test(entry.name) && (!opts.onlyAboutPeople || ABOUT_PEOPLE.test(relative(cwd, full)))) found.push(full);
@@ -6827,7 +6892,7 @@ async function attempt4({ adapter, spec, onEvent, role: which, prompt, say }) {
     harnessWeb: which === "scout" ? spec.harnessWeb : false,
     // A role runs on its own model when its manifest names one: the scout on Sonnet, as spec 55
     // wanted and as it never did, because every role inherited the coordinator's — the user's
-    // default (docs/nanopm-57-needs-map.md §10).
+    // default (docs/✅nanopm-57-needs-map.md §10).
     model: skill.manifest.model ?? spec.model,
     outputSchema: schema,
     maxTurns: skill.manifest.maxTurns,
@@ -7389,15 +7454,15 @@ async function mapRows(client, projectId, persona) {
 function scopeNodes(rows2, scope) {
   return scope ? descendants(rows2, scope) : [...rows2];
 }
-function descendants(rows2, root) {
+function descendants(rows2, root2) {
   const byId = new Map(rows2.map((r) => [r.id, r]));
   const current = (id) => {
     let n = id ? byId.get(id) : void 0;
     for (let hops = 0; n && n.status === "replaced" && n.replaced_by && hops < 50; hops += 1) n = byId.get(n.replaced_by);
     return n && n.status !== "replaced" ? n : null;
   };
-  const out = [root];
-  const ids = /* @__PURE__ */ new Set([root.id]);
+  const out = [root2];
+  const ids = /* @__PURE__ */ new Set([root2.id]);
   for (let grew = true; grew; ) {
     grew = false;
     for (const r of rows2) {
@@ -7536,7 +7601,7 @@ var OpportunitiesParams = z13.object({
   chain: z13.boolean().optional(),
   repo_path: z13.string().optional(),
   // The daemon's: a run chained as background work is claimed once no quick job is queued
-  // (docs/nanopm-63-quick-first.md). The deep map after the deep needs map carries it.
+  // (docs/✅nanopm-63-quick-first.md). The deep map after the deep needs map carries it.
   background: z13.boolean().optional()
 }).strict();
 function opportunitiesAsk(params) {
@@ -7706,7 +7771,7 @@ function opportunitiesOutputSchema(which) {
 // ../daemon/src/crew.ts
 import { randomUUID as randomUUID8 } from "crypto";
 import { mkdir as mkdir2 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var READ_ONLY = {
   read_repo: /^(Read|Glob|Grep)$/,
   read_data: /(^|__)(list_connections|describe_source|query)$/
@@ -7721,14 +7786,14 @@ async function attempt6({ adapter, spec, onEvent, skill: skillName, name, schema
   if (skill.manifest.capabilities.some((c) => !holds.includes(c))) throw new Error(`The ${name} may not hold tools.`);
   const refused = grant.find((c) => !READ_ONLY[c] || !skill.manifest.capabilities.includes(c));
   if (refused) throw new Error(`The ${name} may not hold ${refused}.`);
-  const runDir = dir ? join7(spec.runDir, dir) : spec.runDir;
+  const runDir = dir ? join8(spec.runDir, dir) : spec.runDir;
   if (dir) await mkdir2(runDir, { recursive: true, mode: 448 });
   let result;
   let usage = null;
   await onEvent({ type: "text", text: say });
   for await (const event of adapter.run({
     ...spec,
-    // A role that may not read the code does not stand in it (docs/nanopm-71-deep-dive-lenses.md).
+    // A role that may not read the code does not stand in it (docs/✅nanopm-71-deep-dive-lenses.md).
     cwd: grant.includes("read_repo") ? spec.cwd : runDir,
     runDir,
     sessionId: randomUUID8(),
@@ -9398,21 +9463,21 @@ var told = (r) => ({
 });
 
 // ../daemon/src/objective-definitions.ts
-import { execFile as execFile4 } from "child_process";
+import { execFile as execFile5 } from "child_process";
 import { randomUUID as randomUUID11 } from "crypto";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { mkdir as mkdir3, readFile as readFile5 } from "fs/promises";
-import { join as join8 } from "path";
-import { promisify as promisify4 } from "util";
+import { join as join9 } from "path";
+import { promisify as promisify5 } from "util";
 
 // ../daemon/src/git.ts
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
-var execFileAsync3 = promisify3(execFile3);
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+var execFileAsync4 = promisify4(execFile4);
 var MAX_BUFFER = 4 * 1024 * 1024;
 var WIKI_DIR = ".nanopm/wiki/docs";
 async function git2(cwd, args) {
-  const { stdout } = await execFileAsync3("git", ["-C", cwd, ...args], { maxBuffer: MAX_BUFFER, timeout: 2e4 });
+  const { stdout } = await execFileAsync4("git", ["-C", cwd, ...args], { maxBuffer: MAX_BUFFER, timeout: 2e4 });
   return stdout.trim();
 }
 async function listTrackedFiles(cwd) {
@@ -9511,7 +9576,7 @@ function renderTrackedFiles(files, max = TRACKED_FILES_MAX, wiki = []) {
 }
 
 // ../daemon/src/objective-definitions.ts
-var execFileAsync4 = promisify4(execFile4);
+var execFileAsync5 = promisify5(execFile5);
 var DEFINITIONS_TIMEOUT_MS = 9e4;
 var DEFINITIONS_THINKING_TOKENS = 2e3;
 var READ_TOOLS3 = /* @__PURE__ */ new Set(["Read", "Glob", "Grep", "StructuredOutput"]);
@@ -9520,7 +9585,7 @@ var COUNTING_LINES_MAX = 80;
 var PER_FILE = 4;
 async function countingLines(cwd) {
   try {
-    const { stdout } = await execFileAsync4("git", ["grep", "-n", "-I", "-i", "-E", COUNTING, "--", ".", ":!*lock*", ":!*.min.*", ":!*.map", ":!*.svg", ":!*.snap"], {
+    const { stdout } = await execFileAsync5("git", ["grep", "-n", "-I", "-i", "-E", COUNTING, "--", ".", ":!*lock*", ":!*.min.*", ":!*.map", ":!*.svg", ":!*.snap"], {
       cwd,
       maxBuffer: 16 * 1024 * 1024,
       timeout: 5e3
@@ -9545,7 +9610,7 @@ function pickLines(raw) {
 }
 async function killRecorded(runDir) {
   try {
-    const pid = Number((await readFile5(join8(runDir, "harness.pid"), "utf8")).trim());
+    const pid = Number((await readFile5(join9(runDir, "harness.pid"), "utf8")).trim());
     if (pid > 1) process.kill(pid, "SIGKILL");
   } catch {
   }
@@ -9565,7 +9630,7 @@ async function readDefinitions({ adapter, spec, publish: publish5, journal, hasR
   if (!hasRepo) return give({}, "No repository to read: the card offers the common definitions.", "ok");
   try {
     const skill = await loadSkill("define-objective");
-    const runDir = join8(spec.runDir, "definitions");
+    const runDir = join9(spec.runDir, "definitions");
     await mkdir3(runDir, { recursive: true, mode: 448 });
     const schema = definitionsOutputSchema();
     const [lines, listed] = await Promise.all([countingLines(spec.cwd), listTrackedFiles(spec.cwd)]);
@@ -9627,7 +9692,7 @@ ${renderTrackedFiles(listed.files, void 0, listed.wiki)}
     if (!result) throw new Error("no answer");
     const parsed = DefinitionsAnswer.safeParse(JSON.parse(result));
     if (!parsed.success) throw new Error("an answer in the wrong shape");
-    const checked = checkProposals(parsed.data, (file) => existsSync2(join8(spec.cwd, file)));
+    const checked = checkProposals(parsed.data, (file) => existsSync3(join9(spec.cwd, file)));
     const definitions2 = lever ? checked[lever] ? { [lever]: checked[lever] } : {} : checked;
     const kept = Object.values(definitions2).reduce((n, list) => n + (list?.length ?? 0), 0);
     const read6 = Object.values(definitions2).flat().filter((d) => d?.found).length;
@@ -9900,10 +9965,10 @@ function localDate(timezone, at) {
 
 // ../daemon/src/run-job.ts
 import { randomUUID as randomUUID12 } from "crypto";
-import { existsSync as existsSync3 } from "fs";
-import { mkdir as mkdir4, readFile as readFile6, rm as rm2 } from "fs/promises";
-import { homedir as homedir2, tmpdir } from "os";
-import { join as join9, resolve as resolve4 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { mkdir as mkdir4, readFile as readFile6, rm as rm3 } from "fs/promises";
+import { homedir as homedir3, tmpdir } from "os";
+import { join as join10, resolve as resolve4 } from "path";
 
 // ../daemon/src/events.ts
 var JobEventWriter = class {
@@ -9984,13 +10049,13 @@ function lighten(value) {
 }
 
 // ../daemon/src/repo.ts
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
-var execFileAsync5 = promisify5(execFile5);
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+var execFileAsync6 = promisify6(execFile6);
 var MAX_BUFFER2 = 4 * 1024 * 1024;
 var TIMEOUT_MS = 6e4;
 async function git3(cwd, args, timeoutMs = TIMEOUT_MS) {
-  const { stdout } = await execFileAsync5("git", ["-C", cwd, ...args], { maxBuffer: MAX_BUFFER2, timeout: timeoutMs });
+  const { stdout } = await execFileAsync6("git", ["-C", cwd, ...args], { maxBuffer: MAX_BUFFER2, timeout: timeoutMs });
   return stdout.trim();
 }
 var RepoError = class extends Error {
@@ -10061,7 +10126,7 @@ async function pushBranch(cwd, name) {
   const state = await readState(cwd);
   if (!state.hasRemote) return { pushed: false, reason: "this repository has no origin remote" };
   try {
-    const { stderr } = await execFileAsync5("git", ["-C", cwd, "push", "--set-upstream", "origin", name], {
+    const { stderr } = await execFileAsync6("git", ["-C", cwd, "push", "--set-upstream", "origin", name], {
       maxBuffer: MAX_BUFFER2,
       timeout: 12e4
     });
@@ -10341,7 +10406,7 @@ async function runJob(job, ctx) {
   return outcome;
 }
 async function execute(job, skill, ctx, events) {
-  const runDir = join9(nanopmHome(), "run", job.id);
+  const runDir = join10(nanopmHome(), "run", job.id);
   await mkdir4(runDir, { recursive: true, mode: 448 });
   const resumeSessionId = job.resume_of ? await sessionOf(ctx.client, job.resume_of) : void 0;
   const sessionId = resumeSessionId ?? randomUUID12();
@@ -10386,7 +10451,7 @@ async function execute(job, skill, ctx, events) {
       clearTimeout(timer);
       clearInterval(heartbeat2);
       clearInterval(cancelPoll);
-      await rm2(runDir, { recursive: true, force: true });
+      await rm3(runDir, { recursive: true, force: true });
     }
   }
   const quickRun2 = QUICK_RUNS[job.skill];
@@ -10413,8 +10478,8 @@ async function execute(job, skill, ctx, events) {
       clearTimeout(timer);
       clearInterval(heartbeat2);
       clearInterval(cancelPoll);
-      await rm2(runDir, { recursive: true, force: true });
-      await rm2(cwd2, { recursive: true, force: true });
+      await rm3(runDir, { recursive: true, force: true });
+      await rm3(cwd2, { recursive: true, force: true });
     }
   }
   const capabilities = capCapabilities(skill.manifest.capabilities, autonomy2);
@@ -10622,7 +10687,7 @@ async function execute(job, skill, ctx, events) {
     clearInterval(heartbeat2);
     clearInterval(cancelPoll);
     await definitionsRead;
-    await rm2(runDir, { recursive: true, force: true });
+    await rm3(runDir, { recursive: true, force: true });
   }
   if (outcome?.status === "succeeded" && verified && verified.ran && !verified.passed) {
     outcome = {
@@ -10704,7 +10769,7 @@ function harnessWebFor(searchProvider, machineCanSearch) {
 }
 async function machineWebSearch() {
   try {
-    const parsed = JSON.parse(await readFile6(join9(nanopmHome(), "daemon.json"), "utf8"));
+    const parsed = JSON.parse(await readFile6(join10(nanopmHome(), "daemon.json"), "utf8"));
     return parsed.webSearch === true;
   } catch {
     return false;
@@ -10746,7 +10811,7 @@ function buildHeader(job, project, cwd, harnessWeb = false, memory = false) {
   return lines.join("\n");
 }
 function scratchDir(jobId) {
-  return join9(tmpdir(), `nanopm-run-${jobId}`);
+  return join10(tmpdir(), `nanopm-run-${jobId}`);
 }
 async function resolveCwd(ctx, job, params, fallback, mustBeTheClone = false) {
   const refuse2 = (why) => {
@@ -10771,7 +10836,7 @@ async function resolveCwd(ctx, job, params, fallback, mustBeTheClone = false) {
     await mkdir4(fallback, { recursive: true, mode: 448 });
     return fallback;
   }
-  if (existsSync3(allowed)) return resolve4(allowed);
+  if (existsSync4(allowed)) return resolve4(allowed);
   if (mustBeTheClone) refuse2(`${allowed} is not on this machine any more`);
   await mkdir4(fallback, { recursive: true, mode: 448 });
   return fallback;
@@ -10782,10 +10847,10 @@ ${body}
 </${label}>`;
 }
 function harnessEnv(timeoutMs, source = process.env) {
-  const home = source.HOME ?? homedir2();
+  const home = source.HOME ?? homedir3();
   const env = {
     HOME: home,
-    PATH: [source.PATH ?? "/usr/local/bin:/usr/bin:/bin", join9(home, ".local", "bin")].join(":"),
+    PATH: [source.PATH ?? "/usr/local/bin:/usr/bin:/bin", join10(home, ".local", "bin")].join(":"),
     MCP_TOOL_TIMEOUT: String(timeoutMs)
   };
   for (const key of ["USER", "LANG", "TMPDIR", "SHELL", "ANTHROPIC_API_KEY", "CLAUDE_CONFIG_DIR"]) {
@@ -10865,6 +10930,10 @@ async function runDaemon(options = {}) {
   const startedAt = Date.now();
   let lastDeployCheck = 0;
   const DEPLOY_CHECK_MS = 30 * 6e4;
+  const UPDATE_CHECK_MS = 60 * 6e4;
+  const updatable = !options.once && installKind() === "installer";
+  let lastUpdateCheck = Date.now() - UPDATE_CHECK_MS + 5 * 6e4;
+  let restart = false;
   const cloneless = await clonelessSkills().catch(() => []);
   const staleAfter = process.env.NANOPM_STALE_DAEMON_AFTER ?? "2 minutes";
   let testingConnections = false;
@@ -10924,6 +10993,21 @@ async function runDaemon(options = {}) {
           if (check.queued) log(`deploy on ${check.projectName}: review queued (${check.reason})`);
         }
       }
+      if (updatable && Date.now() - lastUpdateCheck > UPDATE_CHECK_MS) {
+        lastUpdateCheck = Date.now();
+        const current = options.version ?? "dev";
+        const off = autoUpdateOff();
+        const latest = off ? null : await latestVersion();
+        if (shouldUpdate({ kind: "installer", off, quickBusy: quick?.busy() ?? false, latest, current })) {
+          const done = await installVersion(latest);
+          if (done.ok) {
+            log(`updated to ${latest}; restarting on it`);
+            restart = true;
+            break;
+          }
+          log(`update to ${latest} failed: ${done.why}; staying on ${current}`);
+        }
+      }
       await heartbeat(auth.client, daemonId);
       await sleep(pollIntervalMs, void 0, { signal: options.signal }).catch(() => void 0);
     }
@@ -10934,7 +11018,7 @@ async function runDaemon(options = {}) {
     lock.release();
     log(`daemon ${daemonId} offline`);
   }
-  return { daemonId, processed };
+  return { daemonId, processed, restart };
 }
 async function chainAfter(auth, job, outcome, log) {
   if (NOT_CHAINED_BY_DAEMON.includes(job.skill)) return;
@@ -10986,7 +11070,7 @@ function quickLane(ctx, daemonId, log, everyMs = QUICK_POLL_MS) {
     });
   }, everyMs);
   timer.unref?.();
-  return { stop: () => clearInterval(timer) };
+  return { stop: () => clearInterval(timer), busy: () => busy };
 }
 async function parentOf(auth, id) {
   const { data } = await auth.client.from("jobs").select("skill, params").eq("id", id).maybeSingle();
@@ -11031,7 +11115,7 @@ var heldInThisProcess = false;
 function acquireLock() {
   if (heldInThisProcess) throw new Error("a nanopm daemon is already running in this process");
   mkdirSync(nanopmHome(), { recursive: true, mode: 448 });
-  const path = join10(nanopmHome(), "daemon.pid");
+  const path = join11(nanopmHome(), "daemon.pid");
   for (; ; ) {
     try {
       const fd = openSync(path, "wx");
@@ -11118,13 +11202,13 @@ async function reclaimOwnJobs(client, daemonId) {
 async function harnessPids(runDir) {
   const dirs = [runDir];
   try {
-    for (const d of await readdir2(runDir, { withFileTypes: true })) if (d.isDirectory()) dirs.push(join10(runDir, d.name));
+    for (const d of await readdir2(runDir, { withFileTypes: true })) if (d.isDirectory()) dirs.push(join11(runDir, d.name));
   } catch {
   }
   const pids = [];
   for (const dir of dirs) {
     try {
-      const pid = Number((await readFile7(join10(dir, "harness.pid"), "utf8")).trim());
+      const pid = Number((await readFile7(join11(dir, "harness.pid"), "utf8")).trim());
       if (pid > 1) pids.push(pid);
     } catch {
     }
@@ -11132,17 +11216,17 @@ async function harnessPids(runDir) {
   return pids;
 }
 async function killOrphanedHarness(jobId) {
-  const runDir = join10(nanopmHome(), "run", jobId);
+  const runDir = join11(nanopmHome(), "run", jobId);
   for (const pid of await harnessPids(runDir)) {
     try {
       process.kill(pid, "SIGTERM");
     } catch {
     }
   }
-  await rm3(runDir, { recursive: true, force: true });
+  await rm4(runDir, { recursive: true, force: true });
 }
 async function registerDaemon(auth, version, opts = {}) {
-  const path = join10(nanopmHome(), "daemon.json");
+  const path = join11(nanopmHome(), "daemon.json");
   let identity = null;
   try {
     identity = JSON.parse(await readFile7(path, "utf8"));
@@ -11184,7 +11268,7 @@ async function registerDaemon(auth, version, opts = {}) {
 }
 async function rememberDaemon(id, shared = false) {
   await mkdir5(nanopmHome(), { recursive: true, mode: 448 });
-  await writeFile3(join10(nanopmHome(), "daemon.json"), JSON.stringify({ id, shared }, null, 2) + "\n", { mode: 384 });
+  await writeFile4(join11(nanopmHome(), "daemon.json"), JSON.stringify({ id, shared }, null, 2) + "\n", { mode: 384 });
 }
 async function heartbeat(client, daemonId) {
   await client.from("daemons").update({ status: "online", last_seen_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", daemonId);
@@ -11389,11 +11473,11 @@ function checkAgainstDecisions(item, prior, sourceDates) {
   }
   if (match.status === "rejected") {
     if (!match.decidedAt) return `"${item.title}" was rejected; it comes back only with evidence written since`;
-    const newer = item.sources.some((s) => {
+    const newer2 = item.sources.some((s) => {
       const at = sourceDates(s.ref);
       return at !== void 0 && at > match.decidedAt;
     });
-    if (!newer) {
+    if (!newer2) {
       return `"${item.title}" was rejected on ${match.decidedAt.slice(0, 10)}. It comes back only citing something learned since, and saying what changed`;
     }
   }
@@ -11537,14 +11621,14 @@ function refuseFetch(url, allowlist, open = false) {
 
 // ../memory-mcp/src/repo-rules.ts
 import { lstat, unlink } from "fs/promises";
-import { relative as relative3, resolve as resolve5, sep } from "path";
+import { relative as relative3, resolve as resolve5, sep as sep2 } from "path";
 var REMOVE_MAX = 50;
 function refuseRemove(workspace, requested) {
-  const root = resolve5(workspace);
-  const target = resolve5(root, requested);
-  const rel = relative3(root, target);
-  if (!rel || rel.startsWith("..") || rel.startsWith(`..${sep}`)) return "outside the workspace";
-  if (rel === ".git" || rel.startsWith(`.git${sep}`)) return "inside .git";
+  const root2 = resolve5(workspace);
+  const target = resolve5(root2, requested);
+  const rel = relative3(root2, target);
+  if (!rel || rel.startsWith("..") || rel.startsWith(`..${sep2}`)) return "outside the workspace";
+  if (rel === ".git" || rel.startsWith(`.git${sep2}`)) return "inside .git";
   if (looksLikeASecret(rel)) return "looks like a secret, which the agent may neither read nor remove";
   return null;
 }
@@ -13150,7 +13234,7 @@ var MEMORY_TOOL_NAMES = [
   "list_market",
   "write_market",
   "remove_files",
-  // Talk to Nano (docs/nanopm-68-talk-to-nano.md): the map read, and changed as the founder asked.
+  // Talk to Nano (docs/✅nanopm-68-talk-to-nano.md): the map read, and changed as the founder asked.
   ...TALK_TOOLS
 ];
 async function startMemoryServer(env = process.env) {
@@ -13163,16 +13247,16 @@ async function startMemoryServer(env = process.env) {
 import { readFile as readFile9 } from "fs/promises";
 
 // src/project.ts
-import { execFile as execFile6 } from "child_process";
+import { execFile as execFile7 } from "child_process";
 import { basename } from "path";
-import { promisify as promisify6 } from "util";
+import { promisify as promisify7 } from "util";
 
 // src/local.ts
 import { readFile as readFile8 } from "fs/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 async function localDaemonId() {
   try {
-    const parsed = JSON.parse(await readFile8(join11(nanopmHome(), "daemon.json"), "utf8"));
+    const parsed = JSON.parse(await readFile8(join12(nanopmHome(), "daemon.json"), "utf8"));
     return parsed.id ?? null;
   } catch {
     return null;
@@ -13183,30 +13267,30 @@ function useColor() {
 }
 
 // src/project.ts
-var execFileAsync6 = promisify6(execFile6);
+var execFileAsync7 = promisify7(execFile7);
 async function detectRepo(cwd) {
-  let root;
+  let root2;
   try {
-    root = (await execFileAsync6("git", ["-C", cwd, "rev-parse", "--show-toplevel"])).stdout.trim();
+    root2 = (await execFileAsync7("git", ["-C", cwd, "rev-parse", "--show-toplevel"])).stdout.trim();
   } catch {
     return null;
   }
   let remote = null;
   try {
-    remote = canonicalRemote((await execFileAsync6("git", ["-C", root, "remote", "get-url", "origin"])).stdout.trim());
+    remote = canonicalRemote((await execFileAsync7("git", ["-C", root2, "remote", "get-url", "origin"])).stdout.trim());
   } catch {
     remote = null;
   }
-  const name = remote ? remote.split("/").pop() : basename(root);
-  return { root, remote, name, empty: await repoIsEmpty(root) };
+  const name = remote ? remote.split("/").pop() : basename(root2);
+  return { root: root2, remote, name, empty: await repoIsEmpty(root2) };
 }
-async function repoIsEmpty(root) {
+async function repoIsEmpty(root2) {
   try {
-    await execFileAsync6("git", ["-C", root, "rev-parse", "--verify", "HEAD"]);
+    await execFileAsync7("git", ["-C", root2, "rev-parse", "--verify", "HEAD"]);
   } catch {
     return true;
   }
-  const files = (await execFileAsync6("git", ["-C", root, "ls-files"])).stdout.split("\n").filter(Boolean);
+  const files = (await execFileAsync7("git", ["-C", root2, "ls-files"])).stdout.split("\n").filter(Boolean);
   return files.every((f) => {
     const base = basename(f);
     return base.startsWith(".") || /^(readme|licen[cs]e)(\.|$)/i.test(base);
@@ -13875,17 +13959,17 @@ async function askOne(auth, projectId, question, daemonId, opts, out) {
 }
 
 // src/commands/daemon-service.ts
-import { execFile as execFile7 } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir6, readFile as readFile11, rm as rm4, writeFile as writeFile4 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join12 } from "path";
-import { promisify as promisify7 } from "util";
+import { execFile as execFile8 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { mkdir as mkdir6, readFile as readFile11, rm as rm5, writeFile as writeFile5 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join13 } from "path";
+import { promisify as promisify8 } from "util";
 
 // package.json
 var package_default = {
   name: "@nanopm/cli",
-  version: "0.1.5",
+  version: "0.1.7",
   description: "An autonomous product manager for builders who run several small products. Runs on your machine, drives your own coding harness.",
   type: "module",
   license: "MIT",
@@ -13934,13 +14018,13 @@ var package_default = {
 var VERSION = package_default.version;
 
 // src/commands/daemon-service.ts
-var execFileAsync7 = promisify7(execFile7);
+var execFileAsync8 = promisify8(execFile8);
 var LAUNCHD_LABEL = "pm.nano.daemon";
 function plistPath() {
-  return join12(homedir3(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+  return join13(homedir4(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
 }
 function daemonLogPath() {
-  return join12(nanopmHome(), "daemon.log");
+  return join13(nanopmHome(), "daemon.log");
 }
 function renderPlist(opts) {
   const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -13999,31 +14083,39 @@ async function installDaemon(out = (l) => console.log(l), opts = {}) {
   out(web.ok ? "Claude's own search answers; searches go through your subscription." : `Claude's search is not available on this machine (${web.message}); searches use DuckDuckGo.`);
   const bin = process.argv[1];
   if (!bin) throw new Error("cannot locate the nanopm binary");
-  const home = homedir3();
-  const path = [process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", join12(home, ".local", "bin")].join(":");
-  await mkdir6(join12(home, "Library", "LaunchAgents"), { recursive: true });
+  const home = homedir4();
+  const path = [process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", join13(home, ".local", "bin")].join(":");
+  await mkdir6(join13(home, "Library", "LaunchAgents"), { recursive: true });
   await mkdir6(nanopmHome(), { recursive: true, mode: 448 });
   if (opts.shared !== void 0) await rememberShared(opts.shared);
   await found({ ...detection, authenticated: true });
-  await writeFile4(plistPath(), renderPlist({ node: process.execPath, bin, home, path, logPath: daemonLogPath(), nanopmHome: nanopmHome() }), { mode: 420 });
-  const target = `gui/${process.getuid?.() ?? 501}`;
-  await execFileAsync7("launchctl", ["bootout", target, plistPath()]).catch(() => void 0);
-  await execFileAsync7("launchctl", ["bootstrap", target, plistPath()]);
+  await writeFile5(plistPath(), renderPlist({ node: process.execPath, bin, home, path, logPath: daemonLogPath(), nanopmHome: nanopmHome() }), { mode: 420 });
+  const target = guiTarget();
+  await execFileAsync8("launchctl", ["bootout", target, plistPath()]).catch(() => void 0);
+  await execFileAsync8("launchctl", ["bootstrap", target, plistPath()]);
   out(`Installed ${LAUNCHD_LABEL}; the daemon starts now and at every login. Logs: ${daemonLogPath()}`);
   const shared = opts.shared ?? await localShared();
   out(shared ? "This machine is shared with your projects: it also runs scheduled reviews and partners' jobs." : "This machine runs your jobs only. `nanopm daemon install --share` to offer it to your projects.");
   if (opts.next !== false) out(`Next, in a repo: nanopm onboard \xB7 or continue at ${webUrl()}/new`);
 }
+function guiTarget() {
+  return `gui/${process.getuid?.() ?? 501}`;
+}
+async function restartDaemon() {
+  if (!existsSync5(plistPath())) return false;
+  await execFileAsync8("launchctl", ["kickstart", "-k", `${guiTarget()}/${LAUNCHD_LABEL}`]);
+  return true;
+}
 async function uninstallDaemon(out = (l) => console.log(l)) {
   requireMac();
-  const target = `gui/${process.getuid?.() ?? 501}`;
-  await execFileAsync7("launchctl", ["bootout", target, plistPath()]).catch(() => void 0);
-  await rm4(plistPath(), { force: true });
+  const target = guiTarget();
+  await execFileAsync8("launchctl", ["bootout", target, plistPath()]).catch(() => void 0);
+  await rm5(plistPath(), { force: true });
   out(`Removed ${LAUNCHD_LABEL}.`);
 }
 async function daemonStatus(out = (l) => console.log(l)) {
   const id = await localDaemonId();
-  const installed = process.platform === "darwin" && existsSync4(plistPath());
+  const installed = process.platform === "darwin" && existsSync5(plistPath());
   out(`launchd: ${installed ? "installed" : "not installed"}`);
   if (!id) {
     out("daemon: never registered on this machine");
@@ -14053,14 +14145,14 @@ async function daemonLogs(lines = 50) {
 }
 async function localWebSearch() {
   try {
-    const parsed = JSON.parse(await readFile11(join12(nanopmHome(), "daemon.json"), "utf8"));
+    const parsed = JSON.parse(await readFile11(join13(nanopmHome(), "daemon.json"), "utf8"));
     return parsed.webSearch === true;
   } catch {
     return false;
   }
 }
 async function rememberWebSearch(webSearch2) {
-  const path = join12(nanopmHome(), "daemon.json");
+  const path = join13(nanopmHome(), "daemon.json");
   let parsed = {};
   try {
     parsed = JSON.parse(await readFile11(path, "utf8"));
@@ -14068,18 +14160,18 @@ async function rememberWebSearch(webSearch2) {
     parsed = {};
   }
   await mkdir6(nanopmHome(), { recursive: true, mode: 448 });
-  await writeFile4(path, JSON.stringify({ ...parsed, webSearch: webSearch2 }, null, 2) + "\n", { mode: 384 });
+  await writeFile5(path, JSON.stringify({ ...parsed, webSearch: webSearch2 }, null, 2) + "\n", { mode: 384 });
 }
 async function localShared() {
   try {
-    const parsed = JSON.parse(await readFile11(join12(nanopmHome(), "daemon.json"), "utf8"));
+    const parsed = JSON.parse(await readFile11(join13(nanopmHome(), "daemon.json"), "utf8"));
     return Boolean(parsed.shared);
   } catch {
     return false;
   }
 }
 async function rememberShared(shared) {
-  const path = join12(nanopmHome(), "daemon.json");
+  const path = join13(nanopmHome(), "daemon.json");
   let parsed = {};
   try {
     parsed = JSON.parse(await readFile11(path, "utf8"));
@@ -14087,7 +14179,7 @@ async function rememberShared(shared) {
     parsed = {};
   }
   await mkdir6(nanopmHome(), { recursive: true, mode: 448 });
-  await writeFile4(path, JSON.stringify({ ...parsed, shared }, null, 2) + "\n", { mode: 384 });
+  await writeFile5(path, JSON.stringify({ ...parsed, shared }, null, 2) + "\n", { mode: 384 });
 }
 
 // src/format/log.ts
@@ -14215,11 +14307,11 @@ async function correctionNote(client, jobId) {
 import { setTimeout as sleep4 } from "timers/promises";
 
 // src/browser.ts
-import { execFile as execFile8 } from "child_process";
+import { execFile as execFile9 } from "child_process";
 function openBrowser(url, interactive = Boolean(process.stdout.isTTY)) {
   if (!interactive) return false;
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  execFile8(cmd, [url], () => void 0);
+  execFile9(cmd, [url], () => void 0);
   return true;
 }
 
@@ -14303,6 +14395,33 @@ async function logout(out = (l) => console.log(l)) {
   out("Logged out. The daemon on this machine will stop taking jobs at its next start.");
 }
 
+// src/commands/update.ts
+async function update(opts, out = (l) => console.log(l)) {
+  if (opts.auto !== void 0) {
+    if (opts.auto !== "on" && opts.auto !== "off") throw new Error("--auto takes on or off");
+    await setAutoUpdate(opts.auto === "on");
+    out(opts.auto === "on" ? "Automatic updates are on: NanoPM updates itself when it is idle." : "Automatic updates are off. `nanopm update` still updates when you ask.");
+    return;
+  }
+  if (installKind() !== "installer") {
+    out(`This NanoPM (${VERSION}) was not installed with the install line, so it does not update itself.`);
+    out("From a clone of nanopm2: git pull && pnpm build && nanopm daemon install");
+    out("Installed with npm: npm i -g @nanopm/cli@latest && nanopm daemon install");
+    return;
+  }
+  const latest = await latestVersion();
+  if (!latest) throw new Error("could not reach the npm registry; try again in a moment");
+  if (!newer(latest, VERSION)) {
+    out(`Already up to date (${VERSION}).`);
+    return;
+  }
+  out(`Updating ${VERSION} \u2192 ${latest}\u2026`);
+  const done = await installVersion(latest);
+  if (!done.ok) throw new Error(`${done.why}
+The install line does the same: curl -fsSL https://nanopm.app/install | sh`);
+  out(await restartDaemon() ? `Updated ${VERSION} \u2192 ${latest}; the daemon restarted on it.` : `Updated ${VERSION} \u2192 ${latest}.`);
+}
+
 // src/format/roadmap.ts
 var SHAPE = {
   proposed: { mark: "\u25CB", colour: ANSI.amber, label: "proposed" },
@@ -15292,7 +15411,7 @@ async function verifyCommand(command, opts) {
 
 // src/detect-sources.ts
 import { readFile as readFile12 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var ENV_FILES = [".env", ".env.local", ".env.development.local", ".env.development", ".env.example"];
 var POSTGRES_KEYS = [
   "DATABASE_URL",
@@ -15342,7 +15461,7 @@ async function envFiles(repoRoot) {
   const out = [];
   for (const file of ENV_FILES) {
     try {
-      out.push({ file, env: parseEnv(await readFile12(join13(repoRoot, file), "utf8")) });
+      out.push({ file, env: parseEnv(await readFile12(join14(repoRoot, file), "utf8")) });
     } catch {
       continue;
     }
@@ -17083,7 +17202,7 @@ async function invite(email, opts) {
   const [, ...rest] = inviteLines({ name: project.name, code, email: email.trim().toLowerCase(), web: webUrl() });
   return [`Invite to ${paint(ANSI.bold, project.name)}: ${paint(ANSI.bold, code)}`, ...rest.map((l) => l ? paint(ANSI.dim, l) : l)].join("\n");
 }
-async function join14(code, opts) {
+async function join15(code, opts) {
   const normalized2 = code.trim().toUpperCase();
   if (!INVITE_CODE.test(normalized2)) throw new Error(`that does not look like an invite code: ten letters and digits, like ${"K7PQ2XM9RT"}`);
   const repo = await detectRepo(opts.cwd);
@@ -17368,7 +17487,7 @@ async function showSchedule(opts) {
 }
 
 // src/commands/status.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 async function status(opts) {
   const auth = await authenticate();
   const color = opts.color ?? useColor();
@@ -17421,7 +17540,7 @@ async function projectStatus(client, project) {
     openProblems: (problems2.data ?? []).length,
     unprovenProblems: (problems2.data ?? []).filter((p) => p.importance_basis === "judgment").length,
     search: describeSearch(search, await localWebSearch()),
-    onThisMachine: Boolean(project.repoPath && existsSync5(project.repoPath)),
+    onThisMachine: Boolean(project.repoPath && existsSync6(project.repoPath)),
     measures: measures({
       solutionStatuses: (roadmap2.data ?? []).map((r) => r.status),
       decisions: decisions2.data ?? [],
@@ -17460,6 +17579,7 @@ function buildProgram() {
     process.once("SIGINT", stop2);
     process.once("SIGTERM", stop2);
     const result = await runDaemon({ once: opts.once, version: VERSION, signal: abort.signal });
+    if (result.restart) process.exit(0);
     if (opts.once && result.processed === 0) {
       console.error("nanopm: no queued job arrived in time");
       process.exitCode = 2;
@@ -17469,6 +17589,7 @@ function buildProgram() {
   daemon.command("uninstall").description("Remove the background daemon").action(async () => uninstallDaemon());
   daemon.command("status").description("Is the daemon online, and what is queued").action(async () => daemonStatus());
   daemon.command("logs").description("The daemon log").option("-n <lines>", "lines", (v) => Number(v), 50).action(async (opts) => console.log(await daemonLogs(opts.n)));
+  program.command("update").description("Update NanoPM to the latest release now; it also updates itself when idle").option("--auto <on|off>", "turn the automatic update on or off").action(async (opts) => update(opts));
   program.command("login").description("Connect this computer to your nano.pm account, and start the daemon on it").option("--no-browser", "print the link instead of opening it").option("--no-daemon", "link only; do not install the background daemon").option("--web <url>", "nano.pm base URL (development)").action(async (opts) => {
     await login({ noBrowser: !opts.browser, noDaemon: !opts.daemon, web: opts.web });
   });
@@ -17779,7 +17900,7 @@ function buildProgram() {
     console.log(await invite(email, { cwd: process.cwd(), projectId: opts.project, color: colorOf(opts) }));
   });
   program.command("join <code>").description("Join a project you were invited to, from inside your clone of its repository").option("--no-color", "plain output").action(async (code, opts) => {
-    console.log(await join14(code, { cwd: process.cwd(), color: colorOf(opts) }));
+    console.log(await join15(code, { cwd: process.cwd(), color: colorOf(opts) }));
   });
   program.command("members").description("Who is on this project, and whether their daemon is awake").option("--project <id>", "project id (default: the project of the current repo)").option("--no-color", "plain output").action(async (opts) => {
     console.log(await members({ cwd: process.cwd(), projectId: opts.project, color: colorOf(opts) }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanopm/cli",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "An autonomous product manager for builders who run several small products. Runs on your machine, drives your own coding harness.",
   "type": "module",
   "license": "MIT",

package/skills/direction/SKILL.md

@@ -16,5 +16,5 @@ A mission or a vision the founder has said yes to is theirs. When one exists, th
 winner is written beside it as a proposal (`mission-next`, `vision-next`) and the founder
 decides on the business card; the run never replaces a stated row.
 
-See docs/nanopm-53-direction.md, and docs/reference/mission-vision.md for the rules the three
+See docs/✅nanopm-53-direction.md, and docs/reference/mission-vision.md for the rules the three
 roles judge by.

package/skills/market/SKILL.md

@@ -16,4 +16,4 @@ what was learned *about* a company attached to that company rather than beside i
 
 It replaces `research` everywhere a founder can see. `research` stays in the bundle for one
 caller — the problem crew's inline look outside — and is chained from nowhere
-(docs/nanopm-55-market-crew.md §9).
+(docs/✅nanopm-55-market-crew.md §9).

package/skills/needs/SKILL.md

@@ -1,7 +1,7 @@
 The needs crew's coordinator is **code**, not a model: `packages/daemon/src/needs-job.ts`.
 This file exists because a job names a skill and a skill has a manifest.
 
-Nothing reads this as a prompt. The run is five roles and a gate (docs/nanopm-57-needs-map.md §4):
+Nothing reads this as a prompt. The run is five roles and a gate (docs/✅nanopm-57-needs-map.md §4):
 
 1. **`needs-listener`** — the product's own users: the signals, the repository's notes about
    people, and on a deep run the connected services (`read_data`). No web, no write.

package/skills/onboard/SKILL.md

@@ -81,8 +81,9 @@ product is.
      it does from the line alone? These three are the pitch the founder reads first on the
      web and says yes to; the pitch crew may propose better ones later, beside theirs.
    - Batch 1, who it is for: `segments` up to 3 — **personas**, see step 4 — and `needs` up
-     to 5, each keyed to the persona it belongs to; **`mission` and `vision` only where the
-     product's own words already say one** — see step 4.
+     to 5, each keyed to the persona it belongs to; then **`mission` and `vision`, always** —
+     see step 4. They are climbed from the personas and needs, so they come right after them,
+     and Direction is the first section the founder reads after the pitch.
    - Batch 2, the rest of what it is and the money: `identity` `what-it-is-for` and at
      most one more, and `revenue` up to 4 (who pays, for what, how much).
    - Batch 3, the product: `products` — the `areas` item, the `not-doing` item, plus up
@@ -163,18 +164,29 @@ product is.
      roadmap, a milestone, a phase or a commit: those are things to build, not outcomes.
    - a principle the code states in words ("no human in the loop", "never email
      without consent") as `preferences`, one line each.
-   Two things you **do not** propose, and this is the one place the rule is different: a
-   **mission** (topic `mission`, key `mission`) and a **vision** (topic `vision`, key
-   `vision`). Write one only where the product's own words already say it — the first lines
-   of a README, a MANIFESTO, the hero of a landing page, an About page — and then it is
-   `observed`, with those files as its sources, in their words and not yours. The vision has
-   its own cap of 280 characters; the mission is a fact's 200.
-   **Never infer either from the routes and the feature set.** A mission read off what the
-   code does is the pitch with a wider adjective, and it is exactly the row this rule exists
-   to stop (docs/nanopm-53-direction.md §3). If the product's own words do not say where the
-   company is going, write nothing under these two topics and say so in your final log: the
-   card asks the founder for the mission in their own words, and the business card drafts a
-   mission and a vision with them when they ask. Do not write a gap for it: the card asks.
+   A **mission** (topic `mission`, key `mission`) and a **vision** (topic `vision`, key
+   `vision`), **always**: Direction on the card is these two, Yes or Edit (Nicolas,
+   2026-10-02). Where the product's own words already say one — the first lines of a README,
+   a MANIFESTO, a landing page's hero, an About page, the founder's wiki — write those words,
+   `observed`, with the files as sources. Otherwise draft them, `inferred`:
+   - **Mission**: the long-term change the founder is making in a business situation, the
+     lasting problem they solve, for whom. For whom → what fundamental value → why it
+     matters, one sentence under 200 characters a person could repeat from memory.
+   - **Vision**: what becomes true for the world, or the industry, once the mission
+     succeeds — and a person still living in it, doing something. One or two sentences,
+     under 280.
+   **Climb to them from the personas and needs, never from the routes and the feature
+   set**: a mission read off what the code does is the pitch with a wider adjective
+   (docs/✅nanopm-53-direction.md §3). In your head, in order: what the primary persona does
+   today *instead* (usually not a product: the time goes and leaves nothing); why they
+   struggle, the cause and not the pain; the progress they need, true even if the product
+   were rebuilt in another form; their world once it worked. Then compress: the mission from
+   the progress, the vision from that world. Before writing, check both against the direction
+   crew's must-pass tests (docs/reference/mission-vision.md): neither is the product back —
+   no feature, area name, platform, metric or date; no competitor could sign either
+   unchanged; the vision is more than today slightly improved, an outcome rather than one
+   solution, and adds a picture the mission does not already hold. A stated mission or
+   vision is the founder's: propose nothing under its key.
    Only when the repo states a stance in words (a README that says "maintenance mode",
    a roadmap that says "growth"), call set_preferences with `stance_provenance:
    "inferred"`; otherwise do not call it at all. The stance is `grow` until someone says

package/skills/opportunities/SKILL.md

@@ -1,7 +1,7 @@
 The opportunity crew's coordinator is **code**, not a model: `packages/daemon/src/opportunity-job.ts`.
 This file exists because a job names a skill and a skill has a manifest.
 
-Nothing reads this as a prompt. The run (docs/nanopm-61-opportunity-tree-whole.md §29):
+Nothing reads this as a prompt. The run (docs/✅nanopm-61-opportunity-tree-whole.md §29):
 
 **Quick** — the onboarding's run, and a quick *Update the map*:
 

package/skills/personas/SKILL.md

@@ -13,4 +13,4 @@ not write where decisions are made. The crew reads the market view instead — w
 already brought back — which is how a competitor's own words about their buyer reach the
 personas without that boundary moving.
 
-See docs/nanopm-50-personas.md.
+See docs/✅nanopm-50-personas.md.

package/skills/pitch/SKILL.md

@@ -13,4 +13,4 @@ A pitch the founder has said yes to is theirs. When one exists, the crew's winne
 beside it as a proposal (`pitch-<line>-next`) and the founder decides on the business card;
 the run never replaces a stated line.
 
-See docs/nanopm-52-pitch-crew.md.
+See docs/✅nanopm-52-pitch-crew.md.

package/skills/problem-mapper/SKILL.md

@@ -48,7 +48,7 @@ source merely to fill the sources array. Expert hypotheses may have an empty arr
 A source whose `provenance` is `inferred` may be marked context or contradicts, never
 supports: the store refuses it, and the refusal aborts the whole publication, so one
 wrong mark costs the entire run. Since the market crew began keeping what it found but
-could not read (docs/nanopm-55-market-crew.md §5), the competitors it saw named in a
+could not read (docs/✅nanopm-55-market-crew.md §5), the competitors it saw named in a
 search and never opened arrive here as `inferred` — they are real names worth reasoning
 from and they are not proof of anything.
 

package/skills/talk/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "talk",
-  "description": "A conversation with Nano about one opportunity (docs/nanopm-68-talk-to-nano.md): one round per message, on the daemon's quick lane. Nano answers like a CPO on the founder's side — the objective first, one push back, then their call — and changes the map with his tools: what the founder asked for at once, his own ideas only as suggestions.",
+  "description": "A conversation with Nano about one opportunity (docs/✅nanopm-68-talk-to-nano.md): one round per message, on the daemon's quick lane. Nano answers like a CPO on the founder's side — the objective first, one push back, then their call — and changes the map with his tools: what the founder asked for at once, his own ideas only as suggestions.",
   "capabilities": ["talk"],
   "model": "claude-sonnet-5-5",
   "maxTurns": 12,