@ouro.bot/cli 0.1.0-alpha.904 → 0.1.0-alpha.905

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.905",
+      "changes": [
+        "Ouro keeps itself current without a human. New `ouro self-update` runs one unattended pass. It honors an `ouro rollback` pin for seven days and then rewrites the intent to latest (pins now record pinnedAt, and a pin without one gets it written into version-intent.json when first seen). It asks registry.npmjs.org, the npm registry configured on the machine and GitHub releases for the newest @ouro.bot/cli and installs from whichever serves it, so a network that blocks npmjs or a lagging npm mirror no longer strands a machine; a GitHub release counts only when github-actions[bot] created the release and its asset under this repository's v<version> download URL. It validates and runs the new version's --version before activating it, swaps CurrentVersion atomically, restarts the daemon only if it was already running (a stopped daemon stays stopped, and a dev-mode daemon is left alone), and when the restarted daemon does not answer with the new version it reactivates the previous one, pins it with reason auto-rollback and never retries that release; a newer release replaces the auto-rollback pin. When nothing is newer but a running daemon still reports an older version than CurrentVersion, it restarts the daemon with the same health check and rollback, and the current status names any release source that did not answer. Each pass writes ~/.ouro-cli/update-state.json, and `ouro status` ends with an Updates line that starts with \"needs attention\" when the last pass failed, the updater has not run for three hours, or the launchd agent is missing. On macOS, `ouro up` and `ouro self-update` install bot.ouro.updater, a launchd agent that runs the pass at login and hourly, independent of the daemon, preferring a Homebrew node of the same major version so nvm switches do not rewrite it; `ouro up` does not reload the agent while a live pass holds the update lock, the lock is reclaimed only when its owner process is gone, and the `ouro up` it runs to restart the daemon has stdin closed and OURO_UNATTENDED=1 so its prompts take their default answer. After publishing to npm, CI downloads the exact tarball npm serves, attests its build provenance and attaches it to a GitHub release. Rolling back below this version stops unattended updates until `ouro up --latest`. A package end-to-end test serves the packed build as a GitHub release and runs `ouro self-update` in a clean HOME. See docs/known-issues-and-recovery.md. The Unraid template and the Sanctuary bundle runtime move to this version."
+      ]
+    },
     {
       "version": "0.1.0-alpha.904",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.904",
+  "runtimeVersion": "0.1.0-alpha.905",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.904</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.905</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/cli-defaults.js

@@ -68,6 +68,8 @@ const agent_discovery_1 = require("./agent-discovery");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
 const ouro_bot_global_installer_1 = require("../versioning/ouro-bot-global-installer");
 const version_intent_1 = require("../versioning/version-intent");
+const self_update_defaults_1 = require("../versioning/self-update-defaults");
+const update_state_1 = require("../versioning/update-state");
 const logs_prune_1 = require("./logs-prune");
 const daemon_health_1 = require("./daemon-health");
 const log_tailer_1 = require("./log-tailer");
@@ -445,6 +447,11 @@ function defaultPrepareDaemonRuntimeReplacement() {
     (0, child_process_1.execSync)("/bin/sleep 1", { stdio: "ignore" });
 }
 async function defaultPromptInput(question) {
+    // The unattended updater runs `ouro up` with no one to answer; take the
+    // default answer instead of waiting on a stdin that never ends. Piped
+    // stdin (scripts, tests) still answers prompts.
+    if (process.env.OURO_UNATTENDED === "1")
+        return "";
     const readline = await Promise.resolve().then(() => __importStar(require("readline/promises")));
     const rl = readline.createInterface({
         input: process.stdin,
@@ -813,6 +820,16 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         getCurrentCliVersion: () => (0, ouro_version_manager_1.getCurrentVersion)({}),
         getPreviousCliVersion: () => (0, ouro_version_manager_1.getPreviousVersion)({}),
         listCliVersions: () => (0, ouro_version_manager_1.listInstalledVersions)({}),
+        runSelfUpdate: async () => {
+            const { runSelfUpdate } = await Promise.resolve().then(() => __importStar(require("../versioning/self-update")));
+            const { createDefaultSelfUpdateDeps } = await Promise.resolve().then(() => __importStar(require("../versioning/self-update-defaults")));
+            return runSelfUpdate(createDefaultSelfUpdateDeps({ socketPath }));
+        },
+        ensureUpdaterAgent: () => (0, self_update_defaults_1.ensureDefaultUpdaterAgent)(),
+        readUpdateStatusLine: () => (0, update_state_1.formatUpdateStatusLine)((0, update_state_1.readUpdateState)(), {
+            now: Date.now(),
+            updaterInstalled: (0, self_update_defaults_1.isDefaultUpdaterAgentInstalled)(),
+        }),
         reExecFromNewVersion: (reArgs) => {
             const entry = path.join((0, ouro_version_manager_1.getOuroCliHome)(), "CurrentVersion", "node_modules", "@ouro.bot", "cli", "dist", "heart", "daemon", "ouro-entry.js");
             require("child_process").execFileSync("node", [entry, ...reArgs], { stdio: "inherit" });

package/dist/heart/daemon/cli-exec.js

@@ -5956,6 +5956,46 @@ function writeVersionIntentWithRecoveryLauncher(deps, intent) {
     }
     deps.writeVersionIntent(intent);
 }
+const SELF_UPDATE_FAILURE_OUTCOMES = new Set(["unreachable", "install-failed", "rejected", "rolled-back"]);
+async function executeSelfUpdate(command, deps) {
+    if (!deps.runSelfUpdate) {
+        return returnCliFailure(deps, "self-update is not available in this runtime");
+    }
+    const result = await deps.runSelfUpdate();
+    const lines = [`self-update: ${result.outcome}: ${result.summary}`];
+    // Install or refresh the hourly updater after the pass so its first run
+    // (RunAtLoad) does not race this one for the update lock.
+    if (deps.ensureUpdaterAgent) {
+        try {
+            const agent = deps.ensureUpdaterAgent();
+            if (agent === "installed")
+                lines.push("unattended updater: installed (runs hourly and at login)");
+            else if (agent === "written-reload-pending")
+                lines.push("unattended updater: refreshed; reloads on the next interactive run");
+            else if (agent === null && !command.unattended)
+                lines.push("unattended updater: not available on this platform");
+        }
+        catch (error) {
+            lines.push(`unattended updater: could not install: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`);
+        }
+    }
+    const message = lines.join("\n");
+    if (SELF_UPDATE_FAILURE_OUTCOMES.has(result.outcome)) {
+        return returnCliFailure(deps, message);
+    }
+    deps.writeStdout(message);
+    return message;
+}
+function withUpdateStatusLine(message, deps) {
+    let line = null;
+    try {
+        line = deps.readUpdateStatusLine?.() ?? null;
+    }
+    catch {
+        line = null;
+    }
+    return line ? `${message}\n\n${line}` : message;
+}
 async function performSystemSetup(deps) {
     // Install ouro command to PATH (non-blocking)
     if (deps.installOuroCommand) {
@@ -6031,6 +6071,21 @@ async function performSystemSetup(deps) {
         }
         /* v8 ignore stop */
     }
+    // Keep the unattended updater installed so updates do not depend on the daemon.
+    if (deps.ensureUpdaterAgent) {
+        try {
+            deps.ensureUpdaterAgent();
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.system_setup_updater_agent_error",
+                message: "failed to install the unattended updater launch agent",
+                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
+            });
+        }
+    }
     // Register .ouro bundle type (UTI on macOS)
     await registerOuroBundleTypeNonBlocking(deps);
 }
@@ -7274,7 +7329,13 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             }
             targetVersion = previousVersion;
         }
-        writeVersionIntentWithRecoveryLauncher(deps, { schemaVersion: 1, mode: "pinned", targetVersion });
+        writeVersionIntentWithRecoveryLauncher(deps, {
+            schemaVersion: 1,
+            mode: "pinned",
+            targetVersion,
+            pinnedAt: new Date((deps.now ?? Date.now)()).toISOString(),
+            reason: "rollback",
+        });
         deps.activateCliVersion(targetVersion);
         // Stop daemon (non-fatal if not running)
         try {
@@ -7291,6 +7352,10 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
     if (command.kind === "a2a.identity" || command.kind === "a2a.message" || command.kind === "a2a.outbox") {
         return executeA2AClientCommand(command, deps);
     }
+    // ── self-update (unattended-safe update pass; never starts a stopped daemon) ──
+    if (command.kind === "self-update") {
+        return executeSelfUpdate(command, deps);
+    }
     // ── versions command (local install list + published update truth, no daemon socket needed) ──
     if (command.kind === "versions") {
         const versions = deps.listCliVersions?.() ?? [];
@@ -8979,7 +9044,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         if (command.kind === "daemon.status" && (0, cli_render_1.isDaemonUnavailableError)(error)) {
             const message = command.json
                 ? daemonUnavailableStatusJsonOutput(deps.socketPath, deps.healthFilePath)
-                : (0, cli_render_1.daemonUnavailableStatusOutput)(deps.socketPath, deps.healthFilePath);
+                : withUpdateStatusLine((0, cli_render_1.daemonUnavailableStatusOutput)(deps.socketPath, deps.healthFilePath), deps);
             deps.writeStdout(message);
             return message;
         }
@@ -8994,7 +9059,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
     const message = command.kind === "daemon.status"
         ? command.json
             ? formatDaemonStatusJsonOutput(response)
-            : (0, cli_render_1.formatDaemonStatusOutput)(response, fallbackMessage)
+            : withUpdateStatusLine((0, cli_render_1.formatDaemonStatusOutput)(response, fallbackMessage), deps)
         : command.kind === "habit.probe" && command.json
             ? habitProbeJsonResponse(response)
             : fallbackMessage;

package/dist/heart/daemon/cli-help.js

@@ -62,6 +62,12 @@ exports.COMMAND_REGISTRY = {
         usage: "ouro rollback [<version>]",
         example: "ouro rollback 0.1.0-alpha.250",
     },
+    "self-update": {
+        category: "Lifecycle",
+        description: "Update the installed CLI to the newest release from npm or GitHub, restart a running daemon on it, roll back if it fails its checks, and install the hourly launchd updater on macOS",
+        usage: "ouro self-update [--unattended]",
+        example: "ouro self-update",
+    },
     versions: {
         category: "Lifecycle",
         description: "List installed CLI versions and show the active version intent mode and target",

package/dist/heart/daemon/cli-parse.js

@@ -2988,6 +2988,13 @@ function parseOuroCommand(args) {
             throw new Error("Usage: ouro move <agent> here");
         return { kind: "agent.move", agent: second };
     }
+    if (head === "self-update") {
+        const rest = args.slice(1);
+        const unknown = rest.filter((token) => token !== "--unattended");
+        if (unknown.length > 0)
+            throw new Error("Usage: ouro self-update [--unattended]");
+        return { kind: "self-update", ...(rest.includes("--unattended") ? { unattended: true } : {}) };
+    }
     if (head === "stop" || head === "down")
         return { kind: "daemon.stop" };
     if (head === "status") {

package/dist/heart/versioning/ouro-version-manager.js

@@ -240,6 +240,7 @@ function activateVersion(version, deps) {
     const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
     const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
     const symlinkSync = deps.symlinkSync ?? fs.symlinkSync;
+    const renameSync = deps.renameSync ?? fs.renameSync;
     const existsSync = deps.existsSync ?? fs.existsSync;
     /* v8 ignore stop */
     const currentVersionPath = path.join(cliHome, "CurrentVersion");
@@ -269,11 +270,33 @@ function activateVersion(version, deps) {
         }
         symlinkSync(oldTarget, previousPath);
     }
-    // Update CurrentVersion symlink
-    if (existsSync(currentVersionPath)) {
-        unlinkSync(currentVersionPath);
+    // Swap CurrentVersion atomically: build the new link beside it and rename
+    // it over the old one, so a process killed mid-swap never leaves the
+    // machine without a CurrentVersion.
+    const tempPath = `${currentVersionPath}.next-${process.pid}`;
+    try {
+        unlinkSync(tempPath);
+    }
+    catch {
+        // No leftover from an earlier interrupted swap.
+    }
+    symlinkSync(newTarget, tempPath);
+    try {
+        renameSync(tempPath, currentVersionPath);
+    }
+    catch {
+        // rename cannot replace a real directory; fall back to unlink + link.
+        try {
+            unlinkSync(tempPath);
+        }
+        catch {
+            // Already gone.
+        }
+        if (existsSync(currentVersionPath)) {
+            unlinkSync(currentVersionPath);
+        }
+        symlinkSync(newTarget, currentVersionPath);
     }
-    symlinkSync(newTarget, currentVersionPath);
 }
 /**
  * Compare two version strings of the form `0.1.0-alpha.{n}`. Returns

package/dist/heart/versioning/release-sources.js

@@ -0,0 +1,173 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_RELEASE_PUBLISHER = exports.GITHUB_DOWNLOAD_BASE = exports.GITHUB_RELEASES_API = exports.NPMJS_REGISTRY = exports.CLI_PACKAGE = void 0;
+exports.selfUpdateE2eOverrides = selfUpdateE2eOverrides;
+exports.githubTarballName = githubTarballName;
+exports.lookupLatestRelease = lookupLatestRelease;
+exports.installRelease = installRelease;
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const ouro_version_manager_1 = require("./ouro-version-manager");
+exports.CLI_PACKAGE = "@ouro.bot/cli";
+exports.NPMJS_REGISTRY = "https://registry.npmjs.org/";
+exports.GITHUB_RELEASES_API = "https://api.github.com/repos/ourostack/ouroboros/releases?per_page=20";
+exports.GITHUB_DOWNLOAD_BASE = "https://github.com/ourostack/ouroboros/releases/download/";
+/** Only releases and assets that our release workflow created are trusted. */
+exports.GITHUB_RELEASE_PUBLISHER = "github-actions[bot]";
+const LOOKUP_TIMEOUT_MS = 15_000;
+const INSTALL_TIMEOUT_MS = 10 * 60_000;
+/**
+ * The package end-to-end test serves a packed build as a GitHub release from
+ * a loopback HTTP server. Honored only with OURO_SELF_UPDATE_E2E=1 and a
+ * loopback base URL, so it cannot point a real machine at another host.
+ */
+function selfUpdateE2eOverrides(env) {
+    const base = env.OURO_SELF_UPDATE_E2E_GITHUB_BASE?.replace(/\/+$/, "");
+    if (env.OURO_SELF_UPDATE_E2E !== "1" || !base)
+        return null;
+    if (!/^http:\/\/(127\.0\.0\.1|localhost):\d+$/.test(base))
+        return null;
+    return { github: { apiUrl: `${base}/releases`, downloadBase: `${base}/releases/download/` }, githubOnly: true };
+}
+function githubTarballName(version) {
+    return `ouro.bot-cli-${version}.tgz`;
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+async function askNpmjs(deps) {
+    const body = await deps.fetchJson(`${exports.NPMJS_REGISTRY}${exports.CLI_PACKAGE.replace("/", "%2f")}`, LOOKUP_TIMEOUT_MS);
+    const version = body?.["dist-tags"]?.latest;
+    if (typeof version !== "string")
+        throw new Error("registry response has no latest dist-tag");
+    return { source: "npmjs", version };
+}
+async function askConfiguredRegistry(deps) {
+    const stdout = await deps.execFile("npm", ["view", exports.CLI_PACKAGE, "dist-tags.latest", "--json"], { timeoutMs: LOOKUP_TIMEOUT_MS });
+    const version = JSON.parse(stdout.trim());
+    if (typeof version !== "string")
+        throw new Error("npm view returned no latest dist-tag");
+    return { source: "npm-registry", version };
+}
+async function askGithub(deps) {
+    const github = deps.github ?? { apiUrl: exports.GITHUB_RELEASES_API, downloadBase: exports.GITHUB_DOWNLOAD_BASE };
+    const releases = await deps.fetchJson(github.apiUrl, LOOKUP_TIMEOUT_MS);
+    if (!Array.isArray(releases))
+        throw new Error("GitHub releases response is not a list");
+    let best = null;
+    for (const release of releases) {
+        if (release.draft === true || typeof release.tag_name !== "string")
+            continue;
+        const tag = /^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)$/.exec(release.tag_name);
+        if (!tag || release.author?.login !== exports.GITHUB_RELEASE_PUBLISHER)
+            continue;
+        const version = tag[1];
+        const name = githubTarballName(version);
+        const expectedUrl = `${github.downloadBase}v${version}/${name}`;
+        const asset = (release.assets ?? []).find((entry) => entry.name === name &&
+            entry.browser_download_url === expectedUrl &&
+            entry.uploader?.login === exports.GITHUB_RELEASE_PUBLISHER);
+        if (!asset)
+            continue;
+        if (!best || (0, ouro_version_manager_1.compareCliVersions)(version, best.version) > 0) {
+            best = { source: "github", version, tarballUrl: expectedUrl };
+        }
+    }
+    if (!best)
+        throw new Error(`no GitHub release published by ${exports.GITHUB_RELEASE_PUBLISHER} carries an npm tarball`);
+    return best;
+}
+async function lookupLatestRelease(deps) {
+    const asks = [
+        ["npmjs", () => askNpmjs(deps)],
+        ["npm-registry", () => askConfiguredRegistry(deps)],
+        ["github", () => askGithub(deps)],
+    ];
+    const answers = await Promise.all(asks.filter(([source]) => !deps.githubOnly || source === "github").map(async ([source, ask]) => {
+        try {
+            return await ask();
+        }
+        catch (error) {
+            return { source, error: message(error) };
+        }
+    }));
+    let latestVersion = null;
+    for (const answer of answers) {
+        if (answer.version && (!latestVersion || (0, ouro_version_manager_1.compareCliVersions)(answer.version, latestVersion) > 0)) {
+            latestVersion = answer.version;
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.self_update_lookup",
+        message: "looked up the latest published CLI release",
+        meta: {
+            latestVersion,
+            answers: answers.map((answer) => `${answer.source}=${answer.version ?? `error: ${answer.error}`}`).join("; "),
+        },
+    });
+    return { latestVersion, answers };
+}
+/**
+ * Install `version` into `~/.ouro-cli/versions/<version>`, trying each source
+ * that can serve it. Returns the source that worked.
+ */
+async function installRelease(version, lookup, cliHome, deps) {
+    const prefix = path.join(cliHome, "versions", version);
+    const github = lookup.answers.find((answer) => answer.source === "github" && answer.version === version && answer.tarballUrl);
+    const attempts = [
+        ["npm-registry", ["install", "--prefix", prefix, `${exports.CLI_PACKAGE}@${version}`]],
+        ...(github ? [["github", ["install", "--prefix", prefix, github.tarballUrl]]] : []),
+        ["npmjs", ["install", "--prefix", prefix, `${exports.CLI_PACKAGE}@${version}`, "--registry", exports.NPMJS_REGISTRY]],
+    ];
+    const failures = [];
+    for (const [source, args] of attempts.filter(([source]) => !deps.githubOnly || source === "github")) {
+        try {
+            await deps.execFile("npm", args, { timeoutMs: INSTALL_TIMEOUT_MS });
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.self_update_installed",
+                message: "installed CLI release for self-update",
+                meta: { version, source },
+            });
+            return source;
+        }
+        catch (error) {
+            failures.push(`${source}: ${message(error).split("\n")[0]}`);
+        }
+    }
+    throw new Error(`could not install ${version} from any source (${failures.join("; ")})`);
+}

package/dist/heart/versioning/self-update-defaults.js

@@ -0,0 +1,294 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.releaseSourceDeps = void 0;
+exports.isSelfUpdateLockHeld = isSelfUpdateLockHeld;
+exports.createDefaultSelfUpdateDeps = createDefaultSelfUpdateDeps;
+exports.ensureDefaultUpdaterAgent = ensureDefaultUpdaterAgent;
+exports.isDefaultUpdaterAgentInstalled = isDefaultUpdaterAgentInstalled;
+/* v8 ignore start -- production wiring for self-update: real network, npm, launchd and daemon socket; the logic it feeds is unit-tested through injected deps @preserve */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const cli_render_1 = require("../daemon/cli-render");
+const socket_client_1 = require("../daemon/socket-client");
+const ouro_version_manager_1 = require("./ouro-version-manager");
+const release_sources_1 = require("./release-sources");
+const update_state_1 = require("./update-state");
+const updater_launchd_1 = require("./updater-launchd");
+const version_intent_1 = require("./version-intent");
+const DAEMON_UP_TIMEOUT_MS = 10 * 60_000;
+const DAEMON_HEALTH_WAIT_MS = 90_000;
+function execFileText(command, args, options) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)(command, args, { timeout: options.timeoutMs, maxBuffer: 16 * 1024 * 1024, env: process.env }, (error, stdout, stderr) => {
+            if (error) {
+                const detail = String(stderr || "").trim().split("\n").slice(-3).join(" ");
+                reject(new Error(`${command} ${args[0] ?? ""} failed: ${detail || error.message}`));
+                return;
+            }
+            resolve(String(stdout));
+        });
+    });
+}
+async function fetchJson(url, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(url, {
+            signal: controller.signal,
+            headers: { accept: "application/json", "user-agent": "ouro-self-update" },
+        });
+        if (!response.ok)
+            throw new Error(`HTTP ${response.status} from ${new URL(url).host}`);
+        return await response.json();
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === "AbortError") {
+            throw new Error(`timed out after ${Math.round(timeoutMs / 1000)}s reaching ${new URL(url).host}`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Run a command with stdin closed and OURO_UNATTENDED=1. `ouro up` can prompt
+ * (for example about manually cloned bundles); unattended, every prompt takes
+ * its default answer at once instead of waiting out the restart timeout.
+ */
+function runDetachedFromStdin(command, args, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(command, args, { stdio: ["ignore", "ignore", "pipe"], env: { ...process.env, OURO_UNATTENDED: "1" } });
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => { stderr = (stderr + String(chunk)).slice(-4000); });
+        const timer = setTimeout(() => {
+            child.kill("SIGTERM");
+            reject(new Error(`${command} ${args.join(" ")} timed out after ${Math.round(timeoutMs / 1000)}s`));
+        }, timeoutMs);
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`${args.join(" ")} exited ${code}: ${stderr.trim().split("\n").slice(-3).join(" ")}`));
+        });
+    });
+}
+exports.releaseSourceDeps = { fetchJson, execFile: execFileText, ...(0, release_sources_1.selfUpdateE2eOverrides)(process.env) };
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function lockPath(cliHome) {
+    return path.join(cliHome, "self-update.lock");
+}
+/** The pid holding the update lock when that process is still alive. */
+function liveLockOwner(cliHome) {
+    try {
+        const pid = Number.parseInt(fs.readFileSync(lockPath(cliHome), "utf8"), 10);
+        return Number.isFinite(pid) && pid > 0 && isPidAlive(pid) ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when another live process is in the middle of an update pass. */
+function isSelfUpdateLockHeld(cliHome) {
+    const owner = liveLockOwner(cliHome);
+    return owner !== null && owner !== process.pid;
+}
+function acquireLock(cliHome) {
+    const file = lockPath(cliHome);
+    fs.mkdirSync(cliHome, { recursive: true });
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            const fd = fs.openSync(file, "wx", 0o600);
+            fs.writeSync(fd, `${process.pid}\n`);
+            fs.closeSync(fd);
+            return () => {
+                try {
+                    fs.unlinkSync(file);
+                }
+                catch { /* already released */ }
+            };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            // A lock is stale only when its owner is gone; a long install by a live
+            // owner keeps it, however long it takes.
+            if (liveLockOwner(cliHome) !== null)
+                return null;
+            try {
+                fs.unlinkSync(file);
+            }
+            catch { /* raced with the owner releasing it */ }
+        }
+    }
+    return null;
+}
+function versionEntry(cliHome, version) {
+    return path.join(cliHome, "versions", version, "node_modules", "@ouro.bot", "cli", "dist", "heart", "daemon", "ouro-entry.js");
+}
+async function runningDaemonVersion(socketPath) {
+    try {
+        const response = await (0, socket_client_1.sendDaemonCommand)(socketPath, { kind: "daemon.status" });
+        return (0, cli_render_1.parseStatusPayload)(response.data)?.overview.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function createDefaultSelfUpdateDeps(options = {}) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const cliHome = (0, ouro_version_manager_1.getOuroCliHome)(homeDir);
+    // The package end-to-end test must never see a daemon on the host machine.
+    const socketPath = process.env.OURO_SELF_UPDATE_E2E === "1"
+        ? path.join(cliHome, "e2e-no-daemon.sock")
+        : options.socketPath ?? socket_client_1.DEFAULT_DAEMON_SOCKET_PATH;
+    const launcher = path.join(cliHome, "bin", "ouro-launcher.js");
+    return {
+        now: () => Date.now(),
+        getCurrentVersion: () => (0, ouro_version_manager_1.getCurrentVersion)({ homeDir }),
+        readIntent: () => (0, version_intent_1.readVersionIntent)({ homeDir }),
+        writeIntent: (intent) => (0, version_intent_1.writeVersionIntent)(intent, { homeDir }),
+        readState: () => (0, update_state_1.readUpdateState)({ homeDir }),
+        writeState: (state) => (0, update_state_1.writeUpdateState)(state, { homeDir }),
+        lookupLatest: () => (0, release_sources_1.lookupLatestRelease)(exports.releaseSourceDeps),
+        install: (version, lookup) => (0, release_sources_1.installRelease)(version, lookup, cliHome, exports.releaseSourceDeps),
+        validate: (version) => (0, ouro_version_manager_1.validateInstalledVersionForActivation)(version, { homeDir }),
+        smokeTest: async (version) => {
+            try {
+                const output = (await execFileText(process.execPath, [versionEntry(cliHome, version), "--version"], { timeoutMs: 60_000 })).trim();
+                return output.includes(version) ? { ok: true } : { ok: false, detail: `--version printed "${output.slice(0, 120)}"` };
+            }
+            catch (error) {
+                return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+            }
+        },
+        activate: (version) => {
+            (0, ouro_version_manager_1.activateVersion)(version, { homeDir });
+            (0, ouro_version_manager_1.pruneOldVersions)(undefined, { homeDir });
+        },
+        isDaemonRunning: () => (0, socket_client_1.checkDaemonSocketAlive)(socketPath),
+        runningDaemonVersion: async () => (await (0, socket_client_1.checkDaemonSocketAlive)(socketPath)) ? runningDaemonVersion(socketPath) : null,
+        restartDaemon: async (expectedVersion) => {
+            try {
+                await runDetachedFromStdin(process.execPath, [launcher, "up"], DAEMON_UP_TIMEOUT_MS);
+            }
+            catch (error) {
+                return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+            }
+            const deadline = Date.now() + DAEMON_HEALTH_WAIT_MS;
+            let seen = null;
+            while (Date.now() < deadline) {
+                seen = await runningDaemonVersion(socketPath);
+                if (seen === expectedVersion)
+                    return { ok: true };
+                await new Promise((resolve) => setTimeout(resolve, 2_000));
+            }
+            return { ok: false, detail: seen ? `daemon answered with ${seen}, expected ${expectedVersion}` : "daemon did not answer after ouro up" };
+        },
+        isDevMode: () => fs.existsSync(path.join(cliHome, "dev-config.json")),
+        acquireLock: () => acquireLock(cliHome),
+    };
+}
+function nodeMajorOf(nodePath) {
+    try {
+        fs.accessSync(nodePath, fs.constants.X_OK);
+        const version = (0, child_process_1.execFileSync)(nodePath, ["--version"], { encoding: "utf8", timeout: 10_000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+        const major = Number.parseInt(version.replace(/^v/, ""), 10);
+        return Number.isFinite(major) ? major : null;
+    }
+    catch {
+        return null;
+    }
+}
+function ensureDefaultUpdaterAgent(options = {}) {
+    // The package end-to-end test runs in a throwaway HOME; it must never load
+    // a real launch agent on the host.
+    if (process.platform !== "darwin" || process.env.OURO_SELF_UPDATE_E2E === "1")
+        return null;
+    const homeDir = options.homeDir ?? os.homedir();
+    const result = (0, updater_launchd_1.ensureUpdaterAgent)({
+        homeDir,
+        userUid: os.userInfo().uid,
+        nodePath: (0, updater_launchd_1.chooseUpdaterNodePath)({
+            execPath: process.execPath,
+            runningMajor: Number.parseInt(process.versions.node, 10),
+            majorOf: nodeMajorOf,
+        }),
+        readFile: (filePath) => {
+            try {
+                return fs.readFileSync(filePath, "utf8");
+            }
+            catch {
+                return null;
+            }
+        },
+        writeFile: (filePath, content) => fs.writeFileSync(filePath, content, "utf8"),
+        mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
+        exec: (command) => { require("child_process").execSync(command, { stdio: "ignore" }); },
+        runningUnderUpdaterAgent: process.env.XPC_SERVICE_NAME === updater_launchd_1.UPDATER_PLIST_LABEL,
+        updateInProgress: isSelfUpdateLockHeld((0, ouro_version_manager_1.getOuroCliHome)(homeDir)),
+    });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.self_update_agent_checked",
+        message: "checked the unattended updater launch agent",
+        meta: { result },
+    });
+    return result;
+}
+function isDefaultUpdaterAgentInstalled(options = {}) {
+    if (process.platform !== "darwin")
+        return null;
+    const homeDir = options.homeDir ?? os.homedir();
+    return fs.existsSync(path.join(homeDir, "Library", "LaunchAgents", `${updater_launchd_1.UPDATER_PLIST_LABEL}.plist`));
+}
+/* v8 ignore stop */

package/dist/heart/versioning/self-update.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PIN_MAX_AGE_MS = void 0;
+exports.runSelfUpdate = runSelfUpdate;
+const runtime_1 = require("../../nerves/runtime");
+const ouro_version_manager_1 = require("./ouro-version-manager");
+/**
+ * One unattended update pass. It never starts a stopped daemon, never leaves
+ * the machine on a version that failed its checks, and always records what
+ * happened in update-state.json so `ouro status` can report it.
+ *
+ * Steps:
+ *  1. Honor a human pin (`ouro rollback`) for PIN_MAX_AGE_MS, then expire it
+ *     by rewriting the intent to "latest". A pin without a timestamp gets
+ *     one the first time a pass sees it.
+ *  2. Ask every release source for the newest version. When nothing is newer
+ *     but a running daemon still reports an older version (a pass was killed
+ *     between activation and restart), restart it on CurrentVersion.
+ *  3. Install it, validate the payload and run its `--version` smoke test.
+ *  4. Activate it. If the daemon was running, restart it on the new version
+ *     and check that it answers; otherwise leave the daemon stopped.
+ *  5. On a failed check, reactivate the previous version, pin it with reason
+ *     "auto-rollback", restart the daemon on it, and never retry the failed
+ *     version.
+ */
+exports.PIN_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+const FAILURE_OUTCOMES = ["unreachable", "install-failed", "rejected", "rolled-back"];
+async function runSelfUpdate(deps) {
+    const release = deps.acquireLock();
+    if (!release) {
+        return { outcome: "busy", summary: "another ouro self-update is already running" };
+    }
+    try {
+        return await runLocked(deps);
+    }
+    finally {
+        release();
+    }
+}
+async function runLocked(deps) {
+    const now = deps.now();
+    const previous = deps.readState();
+    const failedVersions = [...(previous?.failedVersions ?? [])];
+    const currentVersion = deps.getCurrentVersion();
+    const finish = (outcome, fields) => {
+        const { summary, ...rest } = fields;
+        const state = {
+            schemaVersion: 1,
+            lastRunAt: new Date(now).toISOString(),
+            outcome,
+            currentVersion: deps.getCurrentVersion(),
+            failedVersions,
+            consecutiveFailures: FAILURE_OUTCOMES.includes(outcome) ? (previous?.consecutiveFailures ?? 0) + 1 : 0,
+            ...rest,
+            detail: rest.detail ?? summary,
+        };
+        deps.writeState(state);
+        (0, runtime_1.emitNervesEvent)({
+            level: FAILURE_OUTCOMES.includes(outcome) ? "warn" : "info",
+            component: "daemon",
+            event: "daemon.self_update_result",
+            message: summary,
+            meta: { outcome, currentVersion: state.currentVersion, latestVersion: state.latestVersion ?? null },
+        });
+        return { outcome, summary, state };
+    };
+    /**
+     * Restart the daemon on `target`. On a failed health check, never retry
+     * `target`, pin and reactivate `fallback`, and restart on it. Returns the
+     * rolled-back result, or null when `target` came up healthy.
+     */
+    const restartOrRollBack = async (target, fallback, source) => {
+        const health = await deps.restartDaemon(target);
+        if (health.ok)
+            return null;
+        failedVersions.push(target);
+        if (!fallback) {
+            return finish("rolled-back", {
+                summary: `${target} did not come up healthy (${health.detail ?? "no detail"}) and there is no previous version to return to`,
+                latestVersion: target,
+                source,
+            });
+        }
+        deps.writeIntent({
+            schemaVersion: 1,
+            mode: "pinned",
+            targetVersion: fallback,
+            pinnedAt: new Date(now).toISOString(),
+            reason: "auto-rollback",
+        });
+        deps.activate(fallback);
+        const restored = await deps.restartDaemon(fallback);
+        return finish("rolled-back", {
+            summary: `${target} did not come up healthy (${health.detail ?? "no detail"}); rolled back to ${fallback}${restored.ok ? "" : ` but the daemon did not answer on it either (${restored.detail ?? "no detail"})`}`,
+            latestVersion: target,
+            source,
+        });
+    };
+    // 1. Pins.
+    const intent = deps.readIntent();
+    if (intent?.mode === "pinned" && intent.reason !== "auto-rollback") {
+        let pinnedAt = intent.pinnedAt;
+        if (!pinnedAt || Number.isNaN(Date.parse(pinnedAt))) {
+            // A pin written before pins carried a timestamp: start its clock now and
+            // record it in the intent itself, so the pin cannot outlive its expiry.
+            pinnedAt = new Date(now).toISOString();
+            deps.writeIntent({ ...intent, pinnedAt });
+        }
+        const expiresAtMs = Date.parse(pinnedAt) + exports.PIN_MAX_AGE_MS;
+        if (now < expiresAtMs) {
+            const until = new Date(expiresAtMs).toISOString();
+            return finish("pinned", {
+                summary: `pinned to ${intent.targetVersion} by ouro rollback; unattended updates resume after ${until} (run \`ouro up --latest\` to resume now)`,
+                detail: `pin honored until ${until}`,
+            });
+        }
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.self_update_pin_expired",
+            message: "a rollback pin older than the maximum age no longer blocks updates",
+            meta: { targetVersion: intent.targetVersion, pinnedAt },
+        });
+        deps.writeIntent({ schemaVersion: 1, mode: "latest", targetVersion: intent.targetVersion });
+    }
+    // 2. Lookup.
+    const lookup = await deps.lookupLatest();
+    const sourceSummary = lookup.answers.map((answer) => `${answer.source}: ${answer.version ?? answer.error}`).join("; ");
+    const latest = lookup.latestVersion;
+    if (!latest) {
+        return finish("unreachable", { summary: `no release source answered (${sourceSummary})` });
+    }
+    const lookupSource = lookup.answers.find((answer) => answer.version === latest)?.source;
+    if (currentVersion && (0, ouro_version_manager_1.compareCliVersions)(latest, currentVersion) <= 0) {
+        // A pass killed between activation and restart leaves the old daemon
+        // running; finish the job instead of reporting "current" forever.
+        const daemonVersion = deps.isDevMode() ? null : await deps.runningDaemonVersion();
+        if (daemonVersion && daemonVersion !== currentVersion) {
+            const restart = await restartOrRollBack(currentVersion, daemonVersion);
+            if (restart)
+                return restart;
+            return finish("updated", {
+                summary: `daemon was still running ${daemonVersion}; restarted it on ${currentVersion} and it is healthy`,
+                latestVersion: latest,
+                source: lookupSource,
+            });
+        }
+        const failedSources = lookup.answers.filter((answer) => !answer.version).map((answer) => `${answer.source}: ${answer.error}`);
+        return finish("current", {
+            summary: `current at ${currentVersion}${failedSources.length ? ` (unreachable: ${failedSources.join("; ")})` : ""}`,
+            latestVersion: latest,
+            source: lookupSource,
+        });
+    }
+    if (failedVersions.includes(latest)) {
+        return finish("rejected", {
+            summary: `latest ${latest} failed its checks on this machine earlier; staying on ${currentVersion} until a newer release ships`,
+            latestVersion: latest,
+        });
+    }
+    // 3. Install, validate, smoke test.
+    let installSource;
+    try {
+        installSource = await deps.install(latest, lookup);
+    }
+    catch (error) {
+        return finish("install-failed", { summary: errorText(error), latestVersion: latest });
+    }
+    const validation = deps.validate(latest);
+    const smoke = validation.ok ? await deps.smokeTest(latest) : { ok: false, detail: validation.message };
+    if (!smoke.ok) {
+        failedVersions.push(latest);
+        return finish("rejected", {
+            summary: `${latest} failed its pre-activation check: ${smoke.detail ?? "no detail"}; staying on ${currentVersion}`,
+            latestVersion: latest,
+            source: installSource,
+        });
+    }
+    // 4. Activate, then restart a running daemon on the new version.
+    const daemonWasRunning = !deps.isDevMode() && await deps.isDaemonRunning();
+    deps.writeIntent({ schemaVersion: 1, mode: "latest", targetVersion: latest });
+    deps.activate(latest);
+    if (daemonWasRunning) {
+        const restart = await restartOrRollBack(latest, currentVersion, installSource);
+        if (restart)
+            return restart;
+    }
+    return finish("updated", {
+        summary: `updated ${currentVersion ?? "unknown"} -> ${latest} via ${installSource}${daemonWasRunning ? "; daemon restarted and healthy" : "; daemon was not running and was left stopped"}`,
+        latestVersion: latest,
+        source: installSource,
+    });
+}

package/dist/heart/versioning/update-state.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPDATER_INTERVAL_SECONDS = void 0;
+exports.updateStatePath = updateStatePath;
+exports.readUpdateState = readUpdateState;
+exports.writeUpdateState = writeUpdateState;
+exports.formatUpdateStatusLine = formatUpdateStatusLine;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+exports.UPDATER_INTERVAL_SECONDS = 60 * 60;
+function updateStatePath(homeDir = os.homedir()) {
+    return path.join(homeDir, ".ouro-cli", "update-state.json");
+}
+function readUpdateState(deps = {}) {
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
+    try {
+        const parsed = JSON.parse(readFileSync(updateStatePath(deps.homeDir), "utf8"));
+        if (parsed?.schemaVersion !== 1 || typeof parsed.lastRunAt !== "string" || typeof parsed.outcome !== "string")
+            return null;
+        return {
+            ...parsed,
+            failedVersions: Array.isArray(parsed.failedVersions) ? parsed.failedVersions.filter((v) => typeof v === "string") : [],
+            consecutiveFailures: typeof parsed.consecutiveFailures === "number" ? parsed.consecutiveFailures : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeUpdateState(state, deps = {}) {
+    const writeFileSync = deps.writeFileSync ?? fs.writeFileSync;
+    const renameSync = deps.renameSync ?? fs.renameSync;
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    const destination = updateStatePath(deps.homeDir);
+    mkdirSync(path.dirname(destination), { recursive: true });
+    const temporary = `${destination}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    renameSync(temporary, destination);
+    (0, runtime_1.emitNervesEvent)({
+        level: ["updated", "current", "pinned"].includes(state.outcome) ? "info" : "warn",
+        component: "daemon",
+        event: "daemon.self_update_state_written",
+        message: "recorded the unattended updater outcome",
+        meta: { outcome: state.outcome, currentVersion: state.currentVersion, latestVersion: state.latestVersion ?? null, detail: state.detail ?? null },
+    });
+}
+function formatAge(ms) {
+    const minutes = Math.max(0, Math.round(ms / 60_000));
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 48)
+        return `${hours}h ago`;
+    return `${Math.round(hours / 24)}d ago`;
+}
+/**
+ * One line for `ouro status`. Problems lead with "needs attention" so a
+ * stuck machine is visible at a glance.
+ */
+function formatUpdateStatusLine(state, options) {
+    if (!state) {
+        return options.updaterInstalled === false
+            ? "Updates: needs attention: the unattended updater is not installed; run `ouro self-update` once"
+            : "Updates: no update check recorded yet; run `ouro self-update`";
+    }
+    const ageMs = options.now - Date.parse(state.lastRunAt);
+    const age = formatAge(ageMs);
+    const stale = ageMs > exports.UPDATER_INTERVAL_SECONDS * 1000 * 3;
+    const version = state.currentVersion ?? "unknown version";
+    let line;
+    switch (state.outcome) {
+        case "updated":
+            line = `Updates: updated to ${version} ${age}${state.source ? ` via ${state.source}` : ""}`;
+            break;
+        case "current":
+            line = `Updates: current at ${version} (checked ${age}${state.source ? ` via ${state.source}` : ""})`;
+            break;
+        case "pinned":
+            line = `Updates: pinned to ${version} (checked ${age}; ${state.detail ?? "pin honored"})`;
+            break;
+        default:
+            line = `Updates: needs attention: ${state.outcome} ${age} on ${version}${state.latestVersion ? ` (latest ${state.latestVersion})` : ""}: ${state.detail ?? "no detail"}`;
+    }
+    if (stale) {
+        line += `; needs attention: the updater has not run since ${state.lastRunAt}`;
+    }
+    if (options.updaterInstalled === false) {
+        line += "; needs attention: the unattended updater is not installed; run `ouro self-update` once";
+    }
+    return line;
+}

package/dist/heart/versioning/updater-launchd.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STABLE_NODE_PATHS = exports.UPDATER_PLIST_LABEL = void 0;
+exports.chooseUpdaterNodePath = chooseUpdaterNodePath;
+exports.updaterPlistPath = updaterPlistPath;
+exports.generateUpdaterPlist = generateUpdaterPlist;
+exports.ensureUpdaterAgent = ensureUpdaterAgent;
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const update_state_1 = require("./update-state");
+/**
+ * A launchd agent that runs `ouro self-update --unattended` every hour and at
+ * login, independent of the Ouro daemon. Updates keep flowing when the
+ * daemon is stopped, crashed, or was never started on this machine.
+ */
+exports.UPDATER_PLIST_LABEL = "bot.ouro.updater";
+/** Node binaries that survive nvm switches and Node upgrades, in preference order. */
+exports.STABLE_NODE_PATHS = ["/opt/homebrew/bin/node", "/usr/local/bin/node"];
+/**
+ * Pick the node binary the updater agent runs. A stable path (Homebrew) is
+ * preferred when it exists and runs the same major Node version as this
+ * process, so the plist does not churn every time another nvm node runs
+ * `ouro up`; otherwise the running node is used.
+ */
+function chooseUpdaterNodePath(options) {
+    for (const candidate of options.candidates ?? exports.STABLE_NODE_PATHS) {
+        if (options.majorOf(candidate) === options.runningMajor)
+            return candidate;
+    }
+    return options.execPath;
+}
+function updaterPlistPath(homeDir) {
+    return path.join(homeDir, "Library", "LaunchAgents", `${exports.UPDATER_PLIST_LABEL}.plist`);
+}
+function xmlEscape(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function generateUpdaterPlist(options) {
+    const launcher = path.join(options.homeDir, ".ouro-cli", "bin", "ouro-launcher.js");
+    const envPath = [path.dirname(options.nodePath), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"].join(":");
+    return [
+        `<?xml version="1.0" encoding="UTF-8"?>`,
+        `<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">`,
+        `<plist version="1.0">`,
+        `<dict>`,
+        `  <key>Label</key>`,
+        `  <string>${exports.UPDATER_PLIST_LABEL}</string>`,
+        `  <key>ProgramArguments</key>`,
+        `  <array>`,
+        `    <string>${xmlEscape(options.nodePath)}</string>`,
+        `    <string>${xmlEscape(launcher)}</string>`,
+        `    <string>self-update</string>`,
+        `    <string>--unattended</string>`,
+        `  </array>`,
+        `  <key>RunAtLoad</key>`,
+        `  <true/>`,
+        `  <key>StartInterval</key>`,
+        `  <integer>${update_state_1.UPDATER_INTERVAL_SECONDS}</integer>`,
+        `  <key>ProcessType</key>`,
+        `  <string>Background</string>`,
+        `  <key>EnvironmentVariables</key>`,
+        `  <dict>`,
+        `    <key>PATH</key>`,
+        `    <string>${xmlEscape(envPath)}</string>`,
+        `  </dict>`,
+        `</dict>`,
+        `</plist>`,
+        ``,
+    ].join("\n");
+}
+/**
+ * Write the updater plist when it is missing or stale (for example after the
+ * node binary moved) and load it. When the updater agent itself is running,
+ * or another process holds the update lock, reloading would kill the run in
+ * progress, so it only rewrites the file and the next interactive
+ * `ouro self-update` or `ouro up` reloads it.
+ */
+function ensureUpdaterAgent(deps) {
+    const plistPath = updaterPlistPath(deps.homeDir);
+    const desired = generateUpdaterPlist({ homeDir: deps.homeDir, nodePath: deps.nodePath });
+    const existing = deps.readFile(plistPath);
+    const domain = `gui/${deps.userUid}`;
+    let loaded = true;
+    try {
+        deps.exec(`launchctl print ${domain}/${exports.UPDATER_PLIST_LABEL}`);
+    }
+    catch {
+        loaded = false;
+    }
+    if (existing === desired && loaded)
+        return "unchanged";
+    deps.mkdirp(path.dirname(plistPath));
+    deps.writeFile(plistPath, desired);
+    if (deps.runningUnderUpdaterAgent || deps.updateInProgress) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.self_update_agent_written",
+            message: "rewrote the updater launch agent; reload waits for the next interactive run",
+            meta: { plistPath, updateInProgress: deps.updateInProgress },
+        });
+        return "written-reload-pending";
+    }
+    if (loaded) {
+        try {
+            deps.exec(`launchctl bootout ${domain}/${exports.UPDATER_PLIST_LABEL}`);
+        }
+        catch { /* already gone */ }
+    }
+    deps.exec(`launchctl bootstrap ${domain} "${plistPath}"`);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.self_update_agent_installed",
+        message: "installed the unattended updater launch agent",
+        meta: { plistPath, intervalSeconds: update_state_1.UPDATER_INTERVAL_SECONDS },
+    });
+    return "installed";
+}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.904",
+  "version": "0.1.0-alpha.905",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.904",
+      "version": "0.1.0-alpha.905",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.904",
+  "version": "0.1.0-alpha.905",
   "engines": {
     "node": ">=22"
   },
@@ -36,6 +36,7 @@
     "test": "vitest run",
     "test:integration": "npm run build && vitest run --config vitest.integration.config.ts",
     "test:e2e:package": "npm run build && node scripts/package-e2e.cjs",
+    "test:e2e:self-update": "node scripts/self-update-package-e2e.cjs",
     "test:e2e:ouro-bot-package": "node scripts/ouro-bot-package-e2e.cjs",
     "test:e2e:real-smoke": "npm run build && node scripts/nightly-real-smoke.cjs",
     "typecheck:mailbox-ui": "tsc --noEmit -p packages/mailbox-ui/tsconfig.json",