@openagentsinc/pylon 0.1.13 → 0.1.14

package/README.md

@@ -15,6 +15,7 @@ npm install -g @openagentsinc/pylon && pylon
 bun install -g @openagentsinc/pylon && pylon
 npx @openagentsinc/pylon --version 0.1.13
 npx @openagentsinc/pylon --no-launch
+npx @openagentsinc/pylon --no-updates
 npx @openagentsinc/pylon --download-curated-cache --model gemma-4-e2b --run-diagnostics
 npx @openagentsinc/pylon --verbose
 ```
@@ -25,6 +26,7 @@ The launcher:
   `bun install -g` installs with the same `pylon` command
 - checks GitHub for the latest tagged `pylon-v...` release on each default run,
   or resolves a specific tagged `Pylon` version when `--version` is provided
+- only installs releases initiated by `AtlantisPleb` in GitHub Releases
 - resolves the correct `pylon-v<version>-<os>-<arch>.tar.gz` asset for the
   current machine
 - falls back to the exact tagged source checkout and builds `pylon` plus
@@ -57,12 +59,17 @@ The launcher:
 - starts the installed `pylon-tui` by default after the smoke path; that TUI
   starts and supervises the earning worker
   unless `--no-launch` is set
-- for hosted homework/training work, use `0.1.13` or newer. That release keeps
-  the `0.1.12` Mac training-worker launch fix, removes the last legacy runtime
-  wording from the public bootstrap/runtime path, keeps runtime management
-  explicit instead of mutating the host automatically, prefers a current
-  `target/release/psionic-train` binary, and falls back to
-  `cargo run --release` instead of debug `cargo run`
+- while the TUI is running on the default release track, checks GitHub Releases
+  every 30 seconds and restarts the TUI from a newer trusted cached release
+  without replacing the global npm/bun command
+- use `--no-updates` to keep the current installed release running without
+  background GitHub release checks; `--version` remains a pinned release run
+- for hosted homework/training work, use launcher `0.1.14` or newer so the
+  cached standalone binary auto-updates while the dashboard is open. The latest
+  trusted standalone binary still carries the `0.1.13` and `0.1.12` runtime
+  fixes: no legacy runtime wording, explicit runtime management, current
+  `target/release/psionic-train` preference, and `cargo run --release`
+  fallback instead of debug `cargo run`
 - does not try to install or register a local runtime automatically; the
   bootstrap stays honest about the separate local Gemma runtime
   prerequisite instead of mutating the host behind the user's back

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagentsinc/pylon",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Bootstrap the standalone OpenAgents Pylon release asset and run first-run smoke checks.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -7,6 +7,7 @@ import {
   bootstrapInstalledPylon,
   ensureReleaseInstall,
   launchInstalledPylon,
+  launchInstalledPylonWithUpdates,
   resolveBootstrapOutcome,
   resolvePlatformTarget,
   renderBootstrapSummary,
@@ -85,9 +86,10 @@ Description:
   and build it locally instead. Cache the binaries, run the first-run smoke
   path, and then start the Pylon terminal UI by default. The terminal UI manages
   the earning worker and keeps live status visible. The launcher checks GitHub
-  for newer tagged pylon-v... releases on
-  each default run, but only caches the standalone binaries under the local
-  bootstrap root; it does not replace your global npm or bun pylon command.
+  for newer tagged pylon-v... releases on each default run and every 30 seconds
+  while the dashboard is open. Only releases initiated by AtlantisPleb are
+  accepted. New standalone binaries are cached under the local bootstrap root;
+  the global npm or bun pylon command is not replaced.
 
 Options:
   --version <x.y.z>                    Resolve a specific Pylon release.
@@ -107,6 +109,8 @@ Options:
   --skip-model-download                Keep the curated GGUF cache skipped.
   --skip-diagnostics                   Keep optional pylon gemma diagnose skipped.
   --no-launch                          Do not start pylon-tui after bootstrap.
+  --no-updates                         Disable 30-second GitHub release polling
+                                       and dashboard restart while pylon runs.
   --verbose                            Print extra network and recovery detail.
   --debug-network                      Alias for --verbose.
   --json                               Emit a machine-readable JSON summary.
@@ -132,6 +136,7 @@ export function parseArgs(argv) {
     skipModelDownload: true,
     skipDiagnostics: true,
     noLaunch: false,
+    noUpdates: false,
     verbose: false,
     json: false,
     help: false,
@@ -197,6 +202,9 @@ export function parseArgs(argv) {
       case "--no-launch":
         options.noLaunch = true;
         break;
+      case "--no-updates":
+        options.noUpdates = true;
+        break;
       case "--verbose":
       case "--debug-network":
         options.verbose = true;
@@ -232,7 +240,7 @@ export async function main(argv = process.argv.slice(2), dependencies = {}) {
   const {
     ensureReleaseInstallImpl = ensureReleaseInstall,
     bootstrapInstalledPylonImpl = bootstrapInstalledPylon,
-    launchInstalledPylonImpl = launchInstalledPylon,
+    launchInstalledPylonImpl = launchInstalledPylonWithUpdates,
     createTelemetryClientImpl = createTelemetryClient,
   } = dependencies;
   const options = parseArgs(argv);
@@ -318,10 +326,12 @@ export async function main(argv = process.argv.slice(2), dependencies = {}) {
             ...options,
             ...install,
             version: install.version,
+            pinnedVersion: Boolean(options.version),
           },
           {
             ...dependencies,
             onStatus: reporter?.status,
+            telemetryClient,
           },
         );
       } else {

package/src/index.js

@@ -20,6 +20,8 @@ export const DEFAULT_MODEL_ID = "gemma-4-e4b";
 export const DEFAULT_DIAGNOSTIC_REPEATS = 3;
 export const DEFAULT_DIAGNOSTIC_MAX_OUTPUT_TOKENS = 96;
 export const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
+export const DEFAULT_UPDATE_CHECK_INTERVAL_MS = 30_000;
+export const DEFAULT_TRUSTED_RELEASE_AUTHOR = "AtlantisPleb";
 const PYLON_RELEASE_TAG_PREFIX = "pylon-v";
 const RELEASE_ASSET_INSTALL_METHOD = "release_asset";
 const SOURCE_BUILD_INSTALL_METHOD = "source_build";
@@ -116,6 +118,36 @@ function comparePylonReleaseTags(leftTagName, rightTagName) {
   return left.normalized.localeCompare(right.normalized);
 }
 
+function trustedReleaseAuthor(release, trustedAuthor = DEFAULT_TRUSTED_RELEASE_AUTHOR) {
+  if (!trustedAuthor) {
+    return true;
+  }
+  return release?.author?.login === trustedAuthor;
+}
+
+export function assertTrustedReleaseAuthor(
+  release,
+  trustedAuthor = DEFAULT_TRUSTED_RELEASE_AUTHOR,
+) {
+  if (trustedReleaseAuthor(release, trustedAuthor)) {
+    return release;
+  }
+  const tagName = release?.tag_name ?? "unknown";
+  const author = release?.author?.login ?? "unknown";
+  throw new Error(
+    `Refusing ${tagName}: GitHub release author ${author} is not trusted. Expected ${trustedAuthor}.`,
+  );
+}
+
+function isNewerPylonVersion(candidateVersion, currentVersion) {
+  return (
+    comparePylonReleaseTags(
+      `${PYLON_RELEASE_TAG_PREFIX}${normalizeVersion(candidateVersion)}`,
+      `${PYLON_RELEASE_TAG_PREFIX}${normalizeVersion(currentVersion)}`,
+    ) > 0
+  );
+}
+
 function createBootstrapError(message, context = {}) {
   const error = new Error(message);
   Object.assign(error, context);
@@ -619,14 +651,19 @@ export function selectLatestPylonRelease(releases, target = null) {
   }
 
   const candidates = releases
-    .filter((candidate) => !candidate?.draft && isPylonReleaseTag(candidate?.tag_name))
+    .filter(
+      (candidate) =>
+        !candidate?.draft &&
+        isPylonReleaseTag(candidate?.tag_name) &&
+        trustedReleaseAuthor(candidate),
+    )
     .sort((left, right) => comparePylonReleaseTags(right.tag_name, left.tag_name));
   const release =
     candidates.find((candidate) => releaseHasTargetAssets(candidate, target)) ??
     candidates[0];
   if (!release) {
     throw new Error(
-      `GitHub release lookup did not find any published ${PYLON_RELEASE_TAG_PREFIX} releases.`,
+      `GitHub release lookup did not find any published ${PYLON_RELEASE_TAG_PREFIX} releases initiated by ${DEFAULT_TRUSTED_RELEASE_AUTHOR}.`,
     );
   }
 
@@ -658,7 +695,10 @@ export async function fetchReleaseMetadata({
       ? "GitHub tagged release lookup"
       : "GitHub release list lookup",
   });
-  return normalizedVersion ? payload : selectLatestPylonRelease(payload, target);
+  const release = normalizedVersion
+    ? payload
+    : selectLatestPylonRelease(payload, target);
+  return assertTrustedReleaseAuthor(release);
 }
 
 export function selectReleaseAssets(release, target) {
@@ -1367,6 +1407,45 @@ export async function runProcess(
   });
 }
 
+function delay(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+function waitForChildExit(child) {
+  return new Promise((resolve, reject) => {
+    child.once?.("error", reject);
+    child.once?.("close", (code, signal) => {
+      resolve({ code, signal });
+    });
+  });
+}
+
+async function stopChild(child, timeoutMs = 5_000) {
+  if (!child || child.killed || child.exitCode != null) {
+    return;
+  }
+
+  const exited = waitForChildExit(child).catch(() => null);
+  child.kill?.("SIGTERM");
+  const result = await Promise.race([
+    exited,
+    delay(timeoutMs).then(() => "timeout"),
+  ]);
+  if (result === "timeout" && child.exitCode == null) {
+    child.kill?.("SIGKILL");
+    await exited;
+  }
+}
+
+function spawnPylonTui(pylonTuiPath, options, spawnProcessImpl) {
+  return spawnProcessImpl(pylonTuiPath, [], {
+    env: buildPylonEnv(options),
+    stdio: "inherit",
+  });
+}
+
 async function extractArchive(archivePath, destinationDir, runProcessImpl) {
   await fs.mkdir(destinationDir, { recursive: true });
   await runProcessImpl("tar", ["-xzf", archivePath, "-C", destinationDir]);
@@ -1937,6 +2016,93 @@ export async function launchInstalledPylon(
 
 export const launchInstalledPylonTui = launchInstalledPylon;
 
+export async function launchInstalledPylonWithUpdates(
+  options,
+  {
+    ensureReleaseInstallImpl = ensureReleaseInstall,
+    spawnProcessImpl = spawn,
+    updateCheckIntervalMs = DEFAULT_UPDATE_CHECK_INTERVAL_MS,
+    onStatus = null,
+    ...dependencies
+  } = {},
+) {
+  if (options.noUpdates || options.pinnedVersion) {
+    return launchInstalledPylon(options, { ...dependencies, onStatus });
+  }
+
+  let current = {
+    ...options,
+    version: normalizeVersion(options.version),
+  };
+  let lastUpdateError = null;
+
+  while (true) {
+    const pylonTuiPath = path.resolve(current.pylonTuiPath);
+    emitStatus(
+      onStatus,
+      "Starting Pylon terminal UI",
+      `${path.basename(pylonTuiPath)} manages the earning worker`,
+    );
+    const child = spawnPylonTui(pylonTuiPath, current, spawnProcessImpl);
+    const childExit = waitForChildExit(child);
+    let restartForUpdate = false;
+
+    while (!restartForUpdate) {
+      const result = await Promise.race([
+        childExit.then((exit) => ({ type: "exit", exit })),
+        delay(updateCheckIntervalMs).then(() => ({ type: "tick" })),
+      ]);
+
+      if (result.type === "exit") {
+        const { code, signal } = result.exit;
+        if (code === 0 || signal === "SIGTERM" || signal === "SIGINT") {
+          return result.exit;
+        }
+        throw new Error(
+          `${path.basename(pylonTuiPath)} exited with code ${
+            code ?? "null"
+          }${signal ? ` signal ${signal}` : ""}`,
+        );
+      }
+
+      try {
+        const install = await ensureReleaseInstallImpl(
+          {
+            ...options,
+            version: null,
+          },
+          {
+            ...dependencies,
+            onStatus: null,
+          },
+        );
+        lastUpdateError = null;
+        if (!isNewerPylonVersion(install.version, current.version)) {
+          continue;
+        }
+        emitStatus(
+          onStatus,
+          "Installed newer Pylon release",
+          `${install.tagName}; restarting dashboard`,
+        );
+        await stopChild(child);
+        current = {
+          ...options,
+          ...install,
+          version: install.version,
+        };
+        restartForUpdate = true;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message !== lastUpdateError) {
+          emitStatus(onStatus, "Pylon update check failed", message);
+          lastUpdateError = message;
+        }
+      }
+    }
+  }
+}
+
 export function resolveBootstrapOutcome(summary) {
   const runtimeState =
     summary.status?.snapshot?.runtime?.authoritative_status ?? "unknown";