@openagentsinc/pylon 0.1.13 → 0.1.15

package/README.md

@@ -13,8 +13,9 @@ npx @openagentsinc/pylon
 bunx @openagentsinc/pylon
 npm install -g @openagentsinc/pylon && pylon
 bun install -g @openagentsinc/pylon && pylon
-npx @openagentsinc/pylon --version 0.1.13
+npx @openagentsinc/pylon --version 0.1.15
 npx @openagentsinc/pylon --no-launch
+npx @openagentsinc/pylon --no-updates
 npx @openagentsinc/pylon --download-curated-cache --model gemma-4-e2b --run-diagnostics
 npx @openagentsinc/pylon --verbose
 ```
@@ -25,6 +26,7 @@ The launcher:
   `bun install -g` installs with the same `pylon` command
 - checks GitHub for the latest tagged `pylon-v...` release on each default run,
   or resolves a specific tagged `Pylon` version when `--version` is provided
+- only installs releases initiated by `AtlantisPleb` in GitHub Releases
 - resolves the correct `pylon-v<version>-<os>-<arch>.tar.gz` asset for the
   current machine
 - falls back to the exact tagged source checkout and builds `pylon` plus
@@ -32,8 +34,9 @@ The launcher:
 - prompts before installing the Rust toolchain via `rustup` if a source build
   is needed and `cargo` / `rustc` are missing
 - emits best-effort anonymous installer telemetry to `openagents.com` so the
-  public stats page can show install starts, completions, source-build fallbacks,
-  Rust prompts, and smoke-test outcomes
+  public stats page can show install starts, completions, source-build
+  fallbacks, update checks, restart behavior, Rust prompts, and smoke-test
+  outcomes
 - downloads the archive and published SHA-256 checksum
 - verifies the checksum before extracting
 - caches the unpacked binaries under `~/.openagents/pylon/bootstrap/`
@@ -57,12 +60,17 @@ The launcher:
 - starts the installed `pylon-tui` by default after the smoke path; that TUI
   starts and supervises the earning worker
   unless `--no-launch` is set
-- for hosted homework/training work, use `0.1.13` or newer. That release keeps
-  the `0.1.12` Mac training-worker launch fix, removes the last legacy runtime
-  wording from the public bootstrap/runtime path, keeps runtime management
-  explicit instead of mutating the host automatically, prefers a current
-  `target/release/psionic-train` binary, and falls back to
-  `cargo run --release` instead of debug `cargo run`
+- while the TUI is running on the default release track, checks GitHub Releases
+  every 30 seconds and restarts the TUI from a newer trusted cached release
+  without replacing the global npm/bun command
+- use `--no-updates` to keep the current installed release running without
+  background GitHub release checks; `--version` remains a pinned release run
+- for hosted homework/training work, use launcher `0.1.15` or newer so the
+  cached standalone binary auto-updates while the dashboard is open. The
+  `pylon-v0.1.15` standalone binary keeps the long hosted homework ID hashing
+  from `0.1.14` and also refuses to seal terminal training windows until the
+  worker contribution artifact bundle has uploaded and verified for validator
+  replay.
 - does not try to install or register a local runtime automatically; the
   bootstrap stays honest about the separate local Gemma runtime
   prerequisite instead of mutating the host behind the user's back

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagentsinc/pylon",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Bootstrap the standalone OpenAgents Pylon release asset and run first-run smoke checks.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -7,6 +7,7 @@ import {
   bootstrapInstalledPylon,
   ensureReleaseInstall,
   launchInstalledPylon,
+  launchInstalledPylonWithUpdates,
   resolveBootstrapOutcome,
   resolvePlatformTarget,
   renderBootstrapSummary,
@@ -85,9 +86,10 @@ Description:
   and build it locally instead. Cache the binaries, run the first-run smoke
   path, and then start the Pylon terminal UI by default. The terminal UI manages
   the earning worker and keeps live status visible. The launcher checks GitHub
-  for newer tagged pylon-v... releases on
-  each default run, but only caches the standalone binaries under the local
-  bootstrap root; it does not replace your global npm or bun pylon command.
+  for newer tagged pylon-v... releases on each default run and every 30 seconds
+  while the dashboard is open. Only releases initiated by AtlantisPleb are
+  accepted. New standalone binaries are cached under the local bootstrap root;
+  the global npm or bun pylon command is not replaced.
 
 Options:
   --version <x.y.z>                    Resolve a specific Pylon release.
@@ -107,6 +109,8 @@ Options:
   --skip-model-download                Keep the curated GGUF cache skipped.
   --skip-diagnostics                   Keep optional pylon gemma diagnose skipped.
   --no-launch                          Do not start pylon-tui after bootstrap.
+  --no-updates                         Disable 30-second GitHub release polling
+                                       and dashboard restart while pylon runs.
   --verbose                            Print extra network and recovery detail.
   --debug-network                      Alias for --verbose.
   --json                               Emit a machine-readable JSON summary.
@@ -132,6 +136,7 @@ export function parseArgs(argv) {
     skipModelDownload: true,
     skipDiagnostics: true,
     noLaunch: false,
+    noUpdates: false,
     verbose: false,
     json: false,
     help: false,
@@ -197,6 +202,9 @@ export function parseArgs(argv) {
       case "--no-launch":
         options.noLaunch = true;
         break;
+      case "--no-updates":
+        options.noUpdates = true;
+        break;
       case "--verbose":
       case "--debug-network":
         options.verbose = true;
@@ -232,7 +240,7 @@ export async function main(argv = process.argv.slice(2), dependencies = {}) {
   const {
     ensureReleaseInstallImpl = ensureReleaseInstall,
     bootstrapInstalledPylonImpl = bootstrapInstalledPylon,
-    launchInstalledPylonImpl = launchInstalledPylon,
+    launchInstalledPylonImpl = launchInstalledPylonWithUpdates,
     createTelemetryClientImpl = createTelemetryClient,
   } = dependencies;
   const options = parseArgs(argv);
@@ -318,10 +326,12 @@ export async function main(argv = process.argv.slice(2), dependencies = {}) {
             ...options,
             ...install,
             version: install.version,
+            pinnedVersion: Boolean(options.version),
           },
           {
             ...dependencies,
             onStatus: reporter?.status,
+            telemetryClient,
           },
         );
       } else {

package/src/index.js

@@ -20,6 +20,8 @@ export const DEFAULT_MODEL_ID = "gemma-4-e4b";
 export const DEFAULT_DIAGNOSTIC_REPEATS = 3;
 export const DEFAULT_DIAGNOSTIC_MAX_OUTPUT_TOKENS = 96;
 export const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
+export const DEFAULT_UPDATE_CHECK_INTERVAL_MS = 30_000;
+export const DEFAULT_TRUSTED_RELEASE_AUTHOR = "AtlantisPleb";
 const PYLON_RELEASE_TAG_PREFIX = "pylon-v";
 const RELEASE_ASSET_INSTALL_METHOD = "release_asset";
 const SOURCE_BUILD_INSTALL_METHOD = "source_build";
@@ -116,6 +118,36 @@ function comparePylonReleaseTags(leftTagName, rightTagName) {
   return left.normalized.localeCompare(right.normalized);
 }
 
+function trustedReleaseAuthor(release, trustedAuthor = DEFAULT_TRUSTED_RELEASE_AUTHOR) {
+  if (!trustedAuthor) {
+    return true;
+  }
+  return release?.author?.login === trustedAuthor;
+}
+
+export function assertTrustedReleaseAuthor(
+  release,
+  trustedAuthor = DEFAULT_TRUSTED_RELEASE_AUTHOR,
+) {
+  if (trustedReleaseAuthor(release, trustedAuthor)) {
+    return release;
+  }
+  const tagName = release?.tag_name ?? "unknown";
+  const author = release?.author?.login ?? "unknown";
+  throw new Error(
+    `Refusing ${tagName}: GitHub release author ${author} is not trusted. Expected ${trustedAuthor}.`,
+  );
+}
+
+function isNewerPylonVersion(candidateVersion, currentVersion) {
+  return (
+    comparePylonReleaseTags(
+      `${PYLON_RELEASE_TAG_PREFIX}${normalizeVersion(candidateVersion)}`,
+      `${PYLON_RELEASE_TAG_PREFIX}${normalizeVersion(currentVersion)}`,
+    ) > 0
+  );
+}
+
 function createBootstrapError(message, context = {}) {
   const error = new Error(message);
   Object.assign(error, context);
@@ -619,14 +651,19 @@ export function selectLatestPylonRelease(releases, target = null) {
   }
 
   const candidates = releases
-    .filter((candidate) => !candidate?.draft && isPylonReleaseTag(candidate?.tag_name))
+    .filter(
+      (candidate) =>
+        !candidate?.draft &&
+        isPylonReleaseTag(candidate?.tag_name) &&
+        trustedReleaseAuthor(candidate),
+    )
     .sort((left, right) => comparePylonReleaseTags(right.tag_name, left.tag_name));
   const release =
     candidates.find((candidate) => releaseHasTargetAssets(candidate, target)) ??
     candidates[0];
   if (!release) {
     throw new Error(
-      `GitHub release lookup did not find any published ${PYLON_RELEASE_TAG_PREFIX} releases.`,
+      `GitHub release lookup did not find any published ${PYLON_RELEASE_TAG_PREFIX} releases initiated by ${DEFAULT_TRUSTED_RELEASE_AUTHOR}.`,
     );
   }
 
@@ -658,7 +695,10 @@ export async function fetchReleaseMetadata({
       ? "GitHub tagged release lookup"
       : "GitHub release list lookup",
   });
-  return normalizedVersion ? payload : selectLatestPylonRelease(payload, target);
+  const release = normalizedVersion
+    ? payload
+    : selectLatestPylonRelease(payload, target);
+  return assertTrustedReleaseAuthor(release);
 }
 
 export function selectReleaseAssets(release, target) {
@@ -1367,6 +1407,45 @@ export async function runProcess(
   });
 }
 
+function delay(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+function waitForChildExit(child) {
+  return new Promise((resolve, reject) => {
+    child.once?.("error", reject);
+    child.once?.("close", (code, signal) => {
+      resolve({ code, signal });
+    });
+  });
+}
+
+async function stopChild(child, timeoutMs = 5_000) {
+  if (!child || child.killed || child.exitCode != null) {
+    return;
+  }
+
+  const exited = waitForChildExit(child).catch(() => null);
+  child.kill?.("SIGTERM");
+  const result = await Promise.race([
+    exited,
+    delay(timeoutMs).then(() => "timeout"),
+  ]);
+  if (result === "timeout" && child.exitCode == null) {
+    child.kill?.("SIGKILL");
+    await exited;
+  }
+}
+
+function spawnPylonTui(pylonTuiPath, options, spawnProcessImpl) {
+  return spawnProcessImpl(pylonTuiPath, [], {
+    env: buildPylonEnv(options),
+    stdio: "inherit",
+  });
+}
+
 async function extractArchive(archivePath, destinationDir, runProcessImpl) {
   await fs.mkdir(destinationDir, { recursive: true });
   await runProcessImpl("tar", ["-xzf", archivePath, "-C", destinationDir]);
@@ -1937,6 +2016,203 @@ export async function launchInstalledPylon(
 
 export const launchInstalledPylonTui = launchInstalledPylon;
 
+export async function launchInstalledPylonWithUpdates(
+  options,
+  {
+    ensureReleaseInstallImpl = ensureReleaseInstall,
+    spawnProcessImpl = spawn,
+    updateCheckIntervalMs = DEFAULT_UPDATE_CHECK_INTERVAL_MS,
+    onStatus = null,
+    telemetryClient = null,
+    ...dependencies
+  } = {},
+) {
+  const currentReleaseTag =
+    options.tagName ?? `pylon-v${normalizeVersion(options.version)}`;
+  const updateTelemetryBase = {
+    current_release_tag: currentReleaseTag,
+    current_version: normalizeVersion(options.version),
+    os: options.target?.os ?? null,
+    arch: options.target?.arch ?? null,
+    platform_key:
+      options.target?.os && options.target?.arch
+        ? `${options.target.os}-${options.target.arch}`
+        : null,
+    install_source: installSourceForTelemetry(
+      options.installMethod,
+      Boolean(options.cached),
+    ),
+    update_check_interval_ms: updateCheckIntervalMs,
+  };
+
+  if (options.noUpdates || options.pinnedVersion) {
+    emitTelemetry(
+      telemetryClient,
+      options.noUpdates
+        ? "installer_update_disabled"
+        : "installer_update_pinned_run",
+      {
+        ...updateTelemetryBase,
+        update_mode: options.noUpdates ? "no_updates" : "pinned_version",
+        update_reason: options.noUpdates ? "--no-updates" : "--version",
+      },
+    );
+    await telemetryClient?.flush?.();
+    return launchInstalledPylon(options, { ...dependencies, onStatus });
+  }
+
+  let current = {
+    ...options,
+    version: normalizeVersion(options.version),
+  };
+  let lastUpdateError = null;
+  let pendingRestartTelemetry = null;
+
+  while (true) {
+    const pylonTuiPath = path.resolve(current.pylonTuiPath);
+    emitStatus(
+      onStatus,
+      "Starting Pylon terminal UI",
+      `${path.basename(pylonTuiPath)} manages the earning worker`,
+    );
+    if (pendingRestartTelemetry) {
+      emitTelemetry(telemetryClient, "installer_update_restart_succeeded", {
+        ...pendingRestartTelemetry,
+        restarted_release_tag: current.tagName,
+        restarted_version: current.version,
+      });
+      pendingRestartTelemetry = null;
+    }
+    const child = spawnPylonTui(pylonTuiPath, current, spawnProcessImpl);
+    const childExit = waitForChildExit(child);
+    let restartForUpdate = false;
+
+    while (!restartForUpdate) {
+      const result = await Promise.race([
+        childExit.then((exit) => ({ type: "exit", exit })),
+        delay(updateCheckIntervalMs).then(() => ({ type: "tick" })),
+      ]);
+
+      if (result.type === "exit") {
+        const { code, signal } = result.exit;
+        if (code === 0 || signal === "SIGTERM" || signal === "SIGINT") {
+          return result.exit;
+        }
+        throw new Error(
+          `${path.basename(pylonTuiPath)} exited with code ${
+            code ?? "null"
+          }${signal ? ` signal ${signal}` : ""}`,
+        );
+      }
+
+      emitTelemetry(telemetryClient, "installer_update_check_started", {
+        ...updateTelemetryBase,
+        observed_release_tag: current.tagName,
+        observed_version: current.version,
+      });
+
+      try {
+        const install = await ensureReleaseInstallImpl(
+          {
+            ...options,
+            version: null,
+          },
+          {
+            ...dependencies,
+            onStatus: null,
+          },
+        );
+        lastUpdateError = null;
+        if (!isNewerPylonVersion(install.version, current.version)) {
+          continue;
+        }
+        emitTelemetry(telemetryClient, "installer_update_available", {
+          ...updateTelemetryBase,
+          observed_release_tag: current.tagName,
+          observed_version: current.version,
+          available_release_tag: install.tagName,
+          available_version: install.version,
+          available_install_source: installSourceForTelemetry(
+            install.installMethod,
+            Boolean(install.cached),
+          ),
+        });
+        if (
+          install.installMethod === RELEASE_ASSET_INSTALL_METHOD &&
+          !install.cached
+        ) {
+          emitTelemetry(telemetryClient, "installer_update_downloaded", {
+            ...updateTelemetryBase,
+            observed_release_tag: current.tagName,
+            observed_version: current.version,
+            available_release_tag: install.tagName,
+            available_version: install.version,
+          });
+          emitTelemetry(telemetryClient, "installer_update_verified", {
+            ...updateTelemetryBase,
+            observed_release_tag: current.tagName,
+            observed_version: current.version,
+            available_release_tag: install.tagName,
+            available_version: install.version,
+          });
+        }
+        emitTelemetry(telemetryClient, "installer_update_applied", {
+          ...updateTelemetryBase,
+          previous_release_tag: current.tagName,
+          previous_version: current.version,
+          applied_release_tag: install.tagName,
+          applied_version: install.version,
+          applied_install_source: installSourceForTelemetry(
+            install.installMethod,
+            Boolean(install.cached),
+          ),
+        });
+        emitStatus(
+          onStatus,
+          "Installed newer Pylon release",
+          `${install.tagName}; restarting dashboard`,
+        );
+        emitTelemetry(telemetryClient, "installer_update_restart_attempted", {
+          ...updateTelemetryBase,
+          previous_release_tag: current.tagName,
+          previous_version: current.version,
+          restart_target_release_tag: install.tagName,
+          restart_target_version: install.version,
+        });
+        await stopChild(child);
+        pendingRestartTelemetry = {
+          previous_release_tag: current.tagName,
+          previous_version: current.version,
+          applied_release_tag: install.tagName,
+          applied_version: install.version,
+          applied_install_source: installSourceForTelemetry(
+            install.installMethod,
+            Boolean(install.cached),
+          ),
+        };
+        current = {
+          ...options,
+          ...install,
+          version: install.version,
+        };
+        restartForUpdate = true;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        emitTelemetry(telemetryClient, "installer_update_failed", {
+          ...updateTelemetryBase,
+          observed_release_tag: current.tagName,
+          observed_version: current.version,
+          ...telemetryFailureContext(error, "update_check"),
+        });
+        if (message !== lastUpdateError) {
+          emitStatus(onStatus, "Pylon update check failed", message);
+          lastUpdateError = message;
+        }
+      }
+    }
+  }
+}
+
 export function resolveBootstrapOutcome(summary) {
   const runtimeState =
     summary.status?.snapshot?.runtime?.authoritative_status ?? "unknown";