@nopeek/agent-bridge 0.7.4 → 0.7.6

package/dist/backends.js

@@ -364,6 +364,7 @@ export function hermesBrain(cfg) {
             out += `${line}\n`;
             onChunk?.(`${line}\n`);
         };
+        let timedOut = false;
         const finish = () => {
             if (settled)
                 return;
@@ -381,10 +382,11 @@ export function hermesBrain(cfg) {
             // "No session found" can land on stderr in some hermes builds.
             if (!out.trim() && HERMES_NO_SESSION.test(stderr.trim()))
                 noSession = true;
-            resolvePromise({ reply: out.trim(), noSession, sessionId, stderr });
+            resolvePromise({ reply: out.trim(), noSession, sessionId, stderr, timedOut });
         };
         const timer = setTimeout(() => {
             console.error(`${tag} timed out after ${cfg.brainTimeoutMs / 1000}s, killing`);
+            timedOut = true;
             child.kill("SIGKILL");
             finish();
         }, cfg.brainTimeoutMs);
@@ -401,7 +403,7 @@ export function hermesBrain(cfg) {
             console.error(`${tag} spawn error: ${err.message}`);
             if (!settled) {
                 settled = true;
-                resolvePromise({ reply: "", noSession: false, sessionId: null, stderr: err.message });
+                resolvePromise({ reply: "", noSession: false, sessionId: null, stderr: err.message, timedOut: false });
             }
         });
         child.on("close", () => {
@@ -448,6 +450,14 @@ export function hermesBrain(cfg) {
         if (!run.reply) {
             if (run.stderr.trim())
                 console.error(`${tag} stderr: ${run.stderr.slice(0, 1000)}`);
+            // Distinguish the actual failure instead of always blaming "no
+            // authenticated provider" — that message was previously hardcoded for
+            // EVERY empty-reply cause (including a plain timeout on a slow cold
+            // start), which misdirects the user to run a command that isn't the fix.
+            if (run.timedOut) {
+                const secs = Math.round(cfg.brainTimeoutMs / 1000);
+                return `⚠️ My brain took longer than ${secs}s to respond and I had to give up — this can happen on the very first message while a session/provider is warming up. Try messaging me again.`;
+            }
             return "⚠️ My brain isn't reachable right now — Hermes has no authenticated provider on the host. Run 'hermes model' there, then message me again.";
         }
         return run.reply;

package/dist/bot.d.ts

@@ -21,6 +21,9 @@ export declare class BotRunner {
     private np;
     private stopped;
     private refreshTimer;
+    private lastConnectedAt;
+    private lastForcedRestart;
+    private running;
     private seen;
     private channelCache;
     private allowed;
@@ -38,6 +41,19 @@ export declare class BotRunner {
     private log;
     private logErr;
     constructor(info: BotInfo, cfg: BridgeConfig, pairing: Pairing);
+    /** Watchdog liveness: 0 while currently connected, else ms since the bot was
+     *  last connected (seeded at construction so a never-connected bot ages too). */
+    msSinceHealthy(): number;
+    /** When the watchdog last force-restarted this runner (null = never). */
+    get lastForcedRestartAt(): number | null;
+    /**
+     * Watchdog hard restart: tear the SDK client down completely and rebuild it
+     * from scratch (fresh session mint + NoPeek.connect) — the proven-working
+     * path when the SDK's own reconnect wedges. Unlike stop(), this does NOT
+     * permanently stop the runner; it clears `stopped` so the connect loop
+     * actually re-enters. Idempotent enough to call every watchdog tick.
+     */
+    forceRestart(): void;
     /** Re-read the effective brain (e.g. after a live server backend change) so
      *  status reflects it immediately. The next message re-resolves regardless. */
     refreshBrainKind(): void;

package/dist/bot.js

@@ -24,6 +24,15 @@ export class BotRunner {
     np = null;
     stopped = false;
     refreshTimer = null;
+    // Watchdog liveness. Seeded at construction so a bot that NEVER connects still
+    // ages from birth. Set to now() whenever the socket becomes connected; while
+    // disconnected it holds the last-healthy instant, so msSinceHealthy() reports
+    // how long the bot has been down.
+    lastConnectedAt = Date.now();
+    lastForcedRestart = null;
+    // Guards against two concurrent connect loops if forceRestart() lands while a
+    // backoff retry loop is still running.
+    running = false;
     seen = new Set();
     channelCache = new Map();
     // Access control: bots are PRIVATE by default. `allowed` is the set of user
@@ -76,6 +85,39 @@ export class BotRunner {
         this.log = (m) => console.log(`${tag} ${m}`);
         this.logErr = (m) => console.error(`${tag} ${m}`);
     }
+    /** Watchdog liveness: 0 while currently connected, else ms since the bot was
+     *  last connected (seeded at construction so a never-connected bot ages too). */
+    msSinceHealthy() {
+        return this.connected ? 0 : Date.now() - this.lastConnectedAt;
+    }
+    /** When the watchdog last force-restarted this runner (null = never). */
+    get lastForcedRestartAt() {
+        return this.lastForcedRestart;
+    }
+    /**
+     * Watchdog hard restart: tear the SDK client down completely and rebuild it
+     * from scratch (fresh session mint + NoPeek.connect) — the proven-working
+     * path when the SDK's own reconnect wedges. Unlike stop(), this does NOT
+     * permanently stop the runner; it clears `stopped` so the connect loop
+     * actually re-enters. Idempotent enough to call every watchdog tick.
+     */
+    forceRestart() {
+        if (this.stopped)
+            return; // truly stopped (unpair) — never resurrect
+        this.lastForcedRestart = Date.now();
+        if (this.refreshTimer)
+            clearTimeout(this.refreshTimer);
+        this.refreshTimer = null;
+        try {
+            this.np?.close();
+        }
+        catch {
+            /* best-effort */
+        }
+        this.np = null;
+        this.connected = false;
+        this.start(); // run()'s `running` guard prevents a duplicate loop
+    }
     /** Re-read the effective brain (e.g. after a live server backend change) so
      *  status reflects it immediately. The next message re-resolves regardless. */
     refreshBrainKind() {
@@ -251,19 +293,27 @@ export class BotRunner {
         }
     }
     async run() {
-        this.log(`starting (${this.info.userId}) brain=${this.brainKind}`);
-        let delay = 2_000;
-        while (!this.stopped) {
-            try {
-                await this.connectOnce();
-                return; // connected; SDK auto-reconnects, session refresh re-enters via reconnect()
-            }
-            catch (err) {
-                this.logErr(`connect failed: ${err.message} — retrying in ${delay / 1000}s`);
-                await sleep(delay);
-                delay = Math.min(delay * 2, MAX_BACKOFF_MS);
+        if (this.running)
+            return; // a connect loop is already active — never double it
+        this.running = true;
+        try {
+            this.log(`starting (${this.info.userId}) brain=${this.brainKind}`);
+            let delay = 2_000;
+            while (!this.stopped) {
+                try {
+                    await this.connectOnce();
+                    return; // connected; SDK auto-reconnects, session refresh re-enters via reconnect()
+                }
+                catch (err) {
+                    this.logErr(`connect failed: ${err.message} — retrying in ${delay / 1000}s`);
+                    await sleep(delay);
+                    delay = Math.min(delay * 2, MAX_BACKOFF_MS);
+                }
             }
         }
+        finally {
+            this.running = false;
+        }
     }
     async connectOnce() {
         const session = await this.mintSession();
@@ -286,11 +336,13 @@ export class BotRunner {
         }
         this.np = np;
         this.connected = true;
+        this.lastConnectedAt = Date.now();
         this.channelCache.clear();
         this.ownerPresence.clear();
         this.log(`connected, device ${np.deviceId} (platform=server), store ${store.file}`);
         np.on("connected", (() => {
             this.connected = true;
+            this.lastConnectedAt = Date.now();
             this.log(`ws connected`);
         }));
         np.on("disconnected", (() => {

package/dist/bridge.d.ts

@@ -1,5 +1,5 @@
 import type { BridgeConfig, Pairing, BrainSpec, BrainBackend } from "./config.js";
-export declare const VERSION = "0.7.4";
+export declare const VERSION = "0.7.6";
 export interface PairRequest {
     pairingSecret: string;
     appId: string;
@@ -39,6 +39,9 @@ export declare class BridgeApp {
     readonly startedAt: number;
     private runtimes;
     private capabilitiesTimer;
+    private watchdogTimer;
+    private hardStaleStreak;
+    private lastWatchdogAt;
     private stopped;
     constructor(cfg: BridgeConfig);
     get paired(): boolean;
@@ -48,6 +51,12 @@ export declare class BridgeApp {
     start(): void;
     stop(): void;
     private startRuntime;
+    /** Reconnect watchdog. Sweeps every pairing's runners + control sockets on a
+     *  fixed interval and force-recovers anything stuck; as a last resort, exits
+     *  so the always-restart service relaunches a clean process. unref'd so it
+     *  never keeps the process alive on its own. */
+    private ensureWatchdogTimer;
+    private watchdogTick;
     /** Re-probe + report brain availability every ~5 min (once per pairing) so a
      *  login/logout on this computer surfaces in each account's picker without a
      *  reconnect. onAuthed covers initial + reconnect reports; this covers drift.

package/dist/bridge.js

@@ -17,9 +17,27 @@ import { resolveBrain } from "./brain.js";
 import { provisionSoul, provisionHermesProfile } from "./backends.js";
 import { reportCapabilities } from "./capabilities.js";
 import { isBrainBackend } from "./config.js";
-export const VERSION = "0.7.4";
+export const VERSION = "0.7.6";
 /** How often to re-probe + report brain availability to the server. */
 const CAPABILITIES_INTERVAL_MS = 5 * 60_000;
+// ---- Reconnect watchdog -----------------------------------------------------
+// A layered safety net for the exact wedge seen in the field: after a network
+// routing change all bot sockets closed with 1006 and the process's networking
+// got stuck — the SDK's own reconnect never recovered, though a fresh process
+// connected fine. So we don't trust internal reconnect: we (a) force a hard
+// rebuild of any runner/control socket that's been down too long, and (b) as a
+// last resort exit so the always-restart service relaunches a clean process.
+/** How often the watchdog sweeps every pairing's runners + control sockets. */
+const WATCHDOG_INTERVAL_MS = 30_000;
+/** Down longer than this → force a hard restart (rebuild from scratch). */
+const SOFT_STALE_MS = 90_000;
+/** Every bot down longer than this (sustained) → exit for a clean relaunch. */
+const HARD_STALE_MS = 5 * 60_000;
+/** A SINGLE bot down this long despite repeated forced restarts → exit too.
+ *  Covers a bot wedged for a reason forceRestart() can't fix from inside the
+ *  process (e.g. a stuck OS-level DNS resolution) while OTHER bots are fine —
+ *  the all-bots-down HARD_STALE_MS check alone would never catch that case. */
+const ULTRA_STALE_MS = 10 * 60_000;
 export class PairError extends Error {
     code;
     constructor(code, message) {
@@ -140,9 +158,48 @@ class PairingRuntime {
             userId: b.info.userId,
             connected: b.connected,
             handled: b.handled,
+            msSinceHealthy: b.msSinceHealthy(),
+            lastForcedRestart: b.lastForcedRestartAt,
             brain: resolveBrain(this.cfg, b.info.handle).kind,
         }));
     }
+    /**
+     * Watchdog soft pass for THIS pairing. Force-restart (full rebuild) any bot
+     * that's been disconnected longer than softMs, debounced so a single bot is
+     * restarted at most once per softMs window. Also force-recreate the control
+     * socket if it's been un-authed longer than softMs (its internal backoff can
+     * wedge too). Returns each bot's msSinceHealthy so the app can evaluate the
+     * hard, process-level catch-all across all pairings.
+     */
+    watchdogSoftPass(softMs) {
+        if (this.stopped)
+            return [];
+        const now = Date.now();
+        const liveness = [];
+        for (const b of this.bots.values()) {
+            const ms = b.msSinceHealthy();
+            liveness.push(ms);
+            if (ms <= softMs)
+                continue;
+            const last = b.lastForcedRestartAt;
+            if (last !== null && now - last < softMs)
+                continue; // debounce: one restart per window
+            console.log(`${this.tag} [watchdog] @${b.info.handle} disconnected ${Math.round(ms / 1000)}s — forcing hard restart`);
+            b.forceRestart();
+        }
+        const control = this.control;
+        if (control) {
+            const ms = control.msSinceHealthy();
+            if (ms > softMs) {
+                const last = control.lastForcedRestartAt;
+                if (last === null || now - last >= softMs) {
+                    console.log(`${this.tag} [watchdog] control socket down ${Math.round(ms / 1000)}s — forcing a fresh socket`);
+                    control.forceReconnect();
+                }
+            }
+        }
+        return liveness;
+    }
     // ---------------------------------------------------------------- core ----
     startBot(info) {
         if (this.bots.has(info.userId))
@@ -229,6 +286,11 @@ export class BridgeApp {
     startedAt = Date.now();
     runtimes = [];
     capabilitiesTimer = null;
+    watchdogTimer = null;
+    // Hard exit needs the all-bots-stale condition sustained across TWO
+    // consecutive checks — a single transient blip must never restart the process.
+    hardStaleStreak = 0;
+    lastWatchdogAt = 0;
     stopped = false;
     constructor(cfg) {
         this.cfg = cfg;
@@ -261,6 +323,10 @@ export class BridgeApp {
             clearInterval(this.capabilitiesTimer);
             this.capabilitiesTimer = null;
         }
+        if (this.watchdogTimer) {
+            clearInterval(this.watchdogTimer);
+            this.watchdogTimer = null;
+        }
         for (const r of this.runtimes)
             r.stop();
         this.runtimes = [];
@@ -274,6 +340,51 @@ export class BridgeApp {
         this.runtimes.push(rt);
         rt.start();
         this.ensureCapabilitiesTimer();
+        this.ensureWatchdogTimer();
+    }
+    /** Reconnect watchdog. Sweeps every pairing's runners + control sockets on a
+     *  fixed interval and force-recovers anything stuck; as a last resort, exits
+     *  so the always-restart service relaunches a clean process. unref'd so it
+     *  never keeps the process alive on its own. */
+    ensureWatchdogTimer() {
+        if (this.watchdogTimer)
+            return;
+        this.watchdogTimer = setInterval(() => this.watchdogTick(), WATCHDOG_INTERVAL_MS);
+        this.watchdogTimer.unref?.();
+    }
+    watchdogTick() {
+        if (this.stopped || !this.paired) {
+            this.hardStaleStreak = 0;
+            return;
+        }
+        this.lastWatchdogAt = Date.now();
+        // Layers 2+3: soft force-recovery per pairing (bots + control socket).
+        let allLiveness = [];
+        for (const r of this.runtimes)
+            allLiveness = allLiveness.concat(r.watchdogSoftPass(SOFT_STALE_MS));
+        // Layer 4 (the guarantee): exit for a clean relaunch when soft recovery has
+        // clearly failed — either EVERY bot is down past HARD_STALE_MS, or a SINGLE
+        // bot has been down past ULTRA_STALE_MS despite repeated forceRestart()
+        // calls (a bot wedged for a reason forceRestart can't fix from inside the
+        // process — e.g. a stuck OS-level DNS resolution — while other bots are
+        // fine; the all-down check alone would never catch that). Require the
+        // condition sustained over two consecutive checks, then exit.
+        const hasBots = allLiveness.length > 0;
+        const allHardStale = hasBots && allLiveness.every((ms) => ms > HARD_STALE_MS);
+        const anyUltraStale = hasBots && allLiveness.some((ms) => ms > ULTRA_STALE_MS);
+        if (this.paired && hasBots && (allHardStale || anyUltraStale)) {
+            this.hardStaleStreak++;
+            const mins = Math.round((allHardStale ? HARD_STALE_MS : ULTRA_STALE_MS) / 60_000);
+            const reason = allHardStale ? `no bot connected for ${mins}min across ${allLiveness.length} bot(s)` : `a bot stuck down > ${mins}min`;
+            if (this.hardStaleStreak >= 2) {
+                console.error(`[watchdog] ${reason} — exiting for a clean relaunch`);
+                process.exit(1);
+            }
+            console.error(`[watchdog] ${reason} — will exit for a clean relaunch if still stuck next check`);
+        }
+        else {
+            this.hardStaleStreak = 0;
+        }
     }
     /** Re-probe + report brain availability every ~5 min (once per pairing) so a
      *  login/logout on this computer surfaces in each account's picker without a
@@ -342,6 +453,7 @@ export class BridgeApp {
      * Returns false when a runtimeId was given but matches no pairing.
      */
     unpair(runtimeId) {
+        this.hardStaleStreak = 0; // never carry a stale streak across a topology change
         if (!runtimeId) {
             console.log(`[bridge] unpairing ALL ${this.cfg.pairings.length} account(s) — stopping bots and forgetting the pairing secrets`);
             for (const r of this.runtimes)
@@ -499,6 +611,15 @@ export class BridgeApp {
             },
             // Legacy flat list = every pairing's bots (pre-0.6 clients read this).
             bots: this.runtimes.flatMap((r) => r.botStatuses()),
+            // Reconnect watchdog state (per-bot msSinceHealthy/lastForcedRestart ride
+            // each bot entry above; this summarizes the process-level guard).
+            watchdog: {
+                intervalMs: WATCHDOG_INTERVAL_MS,
+                softStaleMs: SOFT_STALE_MS,
+                hardStaleMs: HARD_STALE_MS,
+                hardStaleStreak: this.hardStaleStreak,
+                lastCheckAt: this.lastWatchdogAt || null,
+            },
         };
     }
 }

package/dist/cli.js

@@ -8,7 +8,7 @@
 import { loadConfig, HELP } from "./config.js";
 import { BridgeApp, VERSION } from "./bridge.js";
 import { startLocalApi } from "./localapi.js";
-import { installService, uninstallService, printStatus } from "./service.js";
+import { installService, uninstallService, printStatus, checkForUpdate } from "./service.js";
 // ---------------------------------------------------------------- guards ----
 // The bridge must never die to a stray rejection deep inside a WS/crypto
 // callback — one flaky bot cannot take the fleet down.
@@ -22,6 +22,14 @@ if (typeof WebSocket === "undefined" || !globalThis.crypto?.subtle) {
     console.error(`@nopeek/agent-bridge needs Node >= 22 (global WebSocket + fetch + WebCrypto). Current: ${process.version}`);
     process.exit(1);
 }
+// Every log line gets an ISO timestamp. The service log otherwise has no time
+// axis at all — investigating an incident (e.g. "which network blip closed
+// every bot's socket, and when did the watchdog recover it") is only possible
+// if log lines can be correlated against system events by clock time.
+for (const level of ["log", "error", "warn"]) {
+    const orig = console[level].bind(console);
+    console[level] = (...args) => orig(`[${new Date().toISOString()}]`, ...args);
+}
 // ----------------------------------------------------------- subcommands ----
 const argv = process.argv.slice(2);
 const SUBCOMMANDS = new Set(["install", "uninstall", "status", "run", "help"]);
@@ -100,6 +108,15 @@ catch (err) {
     process.exit(1);
 }
 app.start();
+// Periodic self-update: a published fix (e.g. a reconnect-reliability bug)
+// otherwise sits unused on already-installed bridges until someone manually
+// reinstalls. Check shortly after startup, then every 6h; each check exits the
+// process on a successful update so the always-restart service (KeepAlive)
+// relaunches running the new code. No-op on install methods it doesn't
+// recognize (see checkForUpdate) — never touches a dev checkout.
+const UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60_000;
+setTimeout(() => void checkForUpdate(VERSION, cfg.homeDir), 60_000).unref();
+setInterval(() => void checkForUpdate(VERSION, cfg.homeDir), UPDATE_CHECK_INTERVAL_MS).unref();
 const shutdown = (signal) => {
     console.log(`[bridge] ${signal} — shutting down`);
     app.stop();

package/dist/control.d.ts

@@ -42,12 +42,25 @@ export declare class ControlSocket {
     private ws;
     private stopped;
     private heartbeat;
+    private reconnectTimer;
     private delay;
+    private lastConnectedAt;
+    private lastForcedRestart;
     /** Log tag — with several sockets running, lines must say whose they are. */
     private tag;
     constructor(pairing: Pairing, handlers: ControlHandlers);
     start(): void;
     stop(): void;
+    /** Watchdog liveness: 0 while authenticated, else ms since the last auth.ok. */
+    msSinceHealthy(): number;
+    /** When the watchdog last force-recreated this socket (null = never). */
+    get lastForcedRestartAt(): number | null;
+    /**
+     * Watchdog force-recovery: cancel any pending backoff timer, tear down the
+     * current socket and open a brand-new one immediately — bypassing the
+     * internal backoff, which can itself wedge after a network event.
+     */
+    forceReconnect(): void;
     private connect;
     private handleFrame;
     private scheduleReconnect;

package/dist/control.js

@@ -10,7 +10,13 @@ export class ControlSocket {
     ws = null;
     stopped = false;
     heartbeat = null;
+    reconnectTimer = null;
     delay = 2_000;
+    // Watchdog liveness. Seeded at construction; set to now() on every auth.ok
+    // (the only "healthy" moment for a control socket). While un-authed it holds
+    // the last-authed instant so msSinceHealthy() reports how long we've been out.
+    lastConnectedAt = Date.now();
+    lastForcedRestart = null;
     /** Log tag — with several sockets running, lines must say whose they are. */
     tag;
     constructor(pairing, handlers) {
@@ -23,6 +29,14 @@ export class ControlSocket {
     }
     stop() {
         this.stopped = true;
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.heartbeat) {
+            clearInterval(this.heartbeat);
+            this.heartbeat = null;
+        }
         try {
             this.ws?.close();
         }
@@ -32,6 +46,42 @@ export class ControlSocket {
         this.ws = null;
         this.connected = false;
     }
+    /** Watchdog liveness: 0 while authenticated, else ms since the last auth.ok. */
+    msSinceHealthy() {
+        return this.connected ? 0 : Date.now() - this.lastConnectedAt;
+    }
+    /** When the watchdog last force-recreated this socket (null = never). */
+    get lastForcedRestartAt() {
+        return this.lastForcedRestart;
+    }
+    /**
+     * Watchdog force-recovery: cancel any pending backoff timer, tear down the
+     * current socket and open a brand-new one immediately — bypassing the
+     * internal backoff, which can itself wedge after a network event.
+     */
+    forceReconnect() {
+        if (this.stopped)
+            return;
+        this.lastForcedRestart = Date.now();
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.heartbeat) {
+            clearInterval(this.heartbeat);
+            this.heartbeat = null;
+        }
+        try {
+            this.ws?.close();
+        }
+        catch {
+            /* best-effort */
+        }
+        this.ws = null;
+        this.connected = false;
+        this.delay = 2_000; // fresh start — reset backoff
+        this.connect();
+    }
     connect() {
         if (this.stopped)
             return;
@@ -47,6 +97,13 @@ export class ControlSocket {
         }
         this.ws = ws;
         ws.onopen = () => {
+            if (this.ws !== ws) {
+                try {
+                    ws.close();
+                }
+                catch { /* stale */ }
+                return;
+            } // superseded
             console.log(`${this.tag} socket open, awaiting auth.ok`);
             // Heartbeat: the server closes sockets idle >60s; the SDK pings every
             // 25s and so do we — otherwise the control socket flaps once a minute
@@ -76,6 +133,10 @@ export class ControlSocket {
             // onclose always follows; log there.
         };
         ws.onclose = (ev) => {
+            // A newer socket (e.g. from a watchdog forceReconnect) already superseded
+            // this one — ignore this stale close so we never stack reconnects.
+            if (this.ws !== ws)
+                return;
             if (this.heartbeat) {
                 clearInterval(this.heartbeat);
                 this.heartbeat = null;
@@ -92,6 +153,7 @@ export class ControlSocket {
         switch (frame.type) {
             case "auth.ok": {
                 this.connected = true;
+                this.lastConnectedAt = Date.now();
                 this.delay = 2_000; // reset backoff on a good auth
                 this.runtimeId = String(frame.runtimeId ?? "");
                 console.log(`${this.tag} authenticated as runtime ${this.runtimeId} (control=${String(frame.control)})`);
@@ -147,9 +209,16 @@ export class ControlSocket {
     scheduleReconnect() {
         if (this.stopped)
             return;
+        // A watchdog forceReconnect() may have already opened a fresh socket; only
+        // one pending reconnect timer at a time (never stack sockets).
+        if (this.reconnectTimer)
+            return;
         console.log(`${this.tag} reconnecting in ${this.delay / 1000}s`);
-        const t = setTimeout(() => this.connect(), this.delay);
-        t.unref?.();
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            this.connect();
+        }, this.delay);
+        this.reconnectTimer.unref?.();
         this.delay = Math.min(this.delay * 2, 30_000);
     }
 }

package/dist/service.d.ts

@@ -1,4 +1,16 @@
 import type { BridgeConfig } from "./config.js";
+/**
+ * Periodic self-update: compares the running version against npm's published
+ * `latest` and, if newer, re-installs using the SAME method this process is
+ * actually running from (global npm root, or the private <home>/app copy —
+ * see resolveEntrypoint above) and exits so the always-restart service
+ * relaunches running the fresh code. Only acts on an install method it
+ * recognizes — a pnpm-linked dev checkout or anything unrecognized is left
+ * alone (safety over completeness). This is how a published fix (like a
+ * reconnect-reliability bug) actually reaches already-installed bridges
+ * instead of sitting unused until someone manually reinstalls.
+ */
+export declare function checkForUpdate(currentVersion: string, homeDir: string): Promise<void>;
 export declare function installService(cfg: BridgeConfig, noOpen?: boolean): Promise<void>;
 export declare function uninstallService(): void;
 export declare function printStatus(port: number): Promise<void>;

package/dist/service.js

@@ -32,6 +32,61 @@ function resolveEntrypoint(homeDir) {
         throw new Error(`expected ${entry} after install — not found`);
     return entry;
 }
+/**
+ * Periodic self-update: compares the running version against npm's published
+ * `latest` and, if newer, re-installs using the SAME method this process is
+ * actually running from (global npm root, or the private <home>/app copy —
+ * see resolveEntrypoint above) and exits so the always-restart service
+ * relaunches running the fresh code. Only acts on an install method it
+ * recognizes — a pnpm-linked dev checkout or anything unrecognized is left
+ * alone (safety over completeness). This is how a published fix (like a
+ * reconnect-reliability bug) actually reaches already-installed bridges
+ * instead of sitting unused until someone manually reinstalls.
+ */
+export async function checkForUpdate(currentVersion, homeDir) {
+    let latest;
+    try {
+        const res = await fetch("https://registry.npmjs.org/@nopeek/agent-bridge/latest", {
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok)
+            return;
+        const body = (await res.json());
+        latest = body.version ?? "";
+    }
+    catch {
+        return; // offline / registry unreachable — try again next check
+    }
+    if (!latest || latest === currentVersion)
+        return;
+    const self = realpathSync(process.argv[1]);
+    let installArgs = null;
+    try {
+        const globalRoot = execFileSync("npm", ["root", "-g"], { encoding: "utf8" }).trim();
+        if (globalRoot && self.startsWith(globalRoot))
+            installArgs = ["install", "-g", "@nopeek/agent-bridge@latest"];
+    }
+    catch {
+        /* npm not on PATH / no permission to query — fall through to the private-copy check */
+    }
+    if (!installArgs) {
+        const privateHome = join(homeDir, "app");
+        if (self.startsWith(privateHome))
+            installArgs = ["install", "--prefix", privateHome, "@nopeek/agent-bridge@latest"];
+    }
+    if (!installArgs) {
+        console.log(`[update] v${latest} is available (running v${currentVersion}) but this install (${self}) isn't a recognized global/private copy — skipping auto-update`);
+        return;
+    }
+    console.log(`[update] v${latest} available (running v${currentVersion}) — updating via 'npm ${installArgs.join(" ")}'`);
+    const r = spawnSync("npm", installArgs, { stdio: "inherit" });
+    if (r.status !== 0) {
+        console.error(`[update] npm install failed (exit ${r.status}) — will retry next check`);
+        return;
+    }
+    console.log(`[update] updated to v${latest} — exiting for the service to relaunch with the new version`);
+    process.exit(0);
+}
 function launchctl(args, ignoreFailure = false) {
     try {
         execFileSync("launchctl", args, { stdio: "pipe" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nopeek/agent-bridge",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Run your own agents as E2EE NoPeek bots. Pairs with one-time codes (multiple accounts per computer), runs every bot each account owns, and pipes messages to any command or webhook.",
   "type": "module",
   "license": "MIT",