@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.920

package/dist/heart/versioning/self-update-defaults.js

@@ -0,0 +1,294 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.releaseSourceDeps = void 0;
+exports.isSelfUpdateLockHeld = isSelfUpdateLockHeld;
+exports.createDefaultSelfUpdateDeps = createDefaultSelfUpdateDeps;
+exports.ensureDefaultUpdaterAgent = ensureDefaultUpdaterAgent;
+exports.isDefaultUpdaterAgentInstalled = isDefaultUpdaterAgentInstalled;
+/* v8 ignore start -- production wiring for self-update: real network, npm, launchd and daemon socket; the logic it feeds is unit-tested through injected deps @preserve */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const cli_render_1 = require("../daemon/cli-render");
+const socket_client_1 = require("../daemon/socket-client");
+const ouro_version_manager_1 = require("./ouro-version-manager");
+const release_sources_1 = require("./release-sources");
+const update_state_1 = require("./update-state");
+const updater_launchd_1 = require("./updater-launchd");
+const version_intent_1 = require("./version-intent");
+const DAEMON_UP_TIMEOUT_MS = 10 * 60_000;
+const DAEMON_HEALTH_WAIT_MS = 90_000;
+function execFileText(command, args, options) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)(command, args, { timeout: options.timeoutMs, maxBuffer: 16 * 1024 * 1024, env: process.env }, (error, stdout, stderr) => {
+            if (error) {
+                const detail = String(stderr || "").trim().split("\n").slice(-3).join(" ");
+                reject(new Error(`${command} ${args[0] ?? ""} failed: ${detail || error.message}`));
+                return;
+            }
+            resolve(String(stdout));
+        });
+    });
+}
+async function fetchJson(url, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(url, {
+            signal: controller.signal,
+            headers: { accept: "application/json", "user-agent": "ouro-self-update" },
+        });
+        if (!response.ok)
+            throw new Error(`HTTP ${response.status} from ${new URL(url).host}`);
+        return await response.json();
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === "AbortError") {
+            throw new Error(`timed out after ${Math.round(timeoutMs / 1000)}s reaching ${new URL(url).host}`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Run a command with stdin closed and OURO_UNATTENDED=1. `ouro up` can prompt
+ * (for example about manually cloned bundles); unattended, every prompt takes
+ * its default answer at once instead of waiting out the restart timeout.
+ */
+function runDetachedFromStdin(command, args, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(command, args, { stdio: ["ignore", "ignore", "pipe"], env: { ...process.env, OURO_UNATTENDED: "1" } });
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => { stderr = (stderr + String(chunk)).slice(-4000); });
+        const timer = setTimeout(() => {
+            child.kill("SIGTERM");
+            reject(new Error(`${command} ${args.join(" ")} timed out after ${Math.round(timeoutMs / 1000)}s`));
+        }, timeoutMs);
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`${args.join(" ")} exited ${code}: ${stderr.trim().split("\n").slice(-3).join(" ")}`));
+        });
+    });
+}
+exports.releaseSourceDeps = { fetchJson, execFile: execFileText, ...(0, release_sources_1.selfUpdateE2eOverrides)(process.env) };
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function lockPath(cliHome) {
+    return path.join(cliHome, "self-update.lock");
+}
+/** The pid holding the update lock when that process is still alive. */
+function liveLockOwner(cliHome) {
+    try {
+        const pid = Number.parseInt(fs.readFileSync(lockPath(cliHome), "utf8"), 10);
+        return Number.isFinite(pid) && pid > 0 && isPidAlive(pid) ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when another live process is in the middle of an update pass. */
+function isSelfUpdateLockHeld(cliHome) {
+    const owner = liveLockOwner(cliHome);
+    return owner !== null && owner !== process.pid;
+}
+function acquireLock(cliHome) {
+    const file = lockPath(cliHome);
+    fs.mkdirSync(cliHome, { recursive: true });
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            const fd = fs.openSync(file, "wx", 0o600);
+            fs.writeSync(fd, `${process.pid}\n`);
+            fs.closeSync(fd);
+            return () => {
+                try {
+                    fs.unlinkSync(file);
+                }
+                catch { /* already released */ }
+            };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            // A lock is stale only when its owner is gone; a long install by a live
+            // owner keeps it, however long it takes.
+            if (liveLockOwner(cliHome) !== null)
+                return null;
+            try {
+                fs.unlinkSync(file);
+            }
+            catch { /* raced with the owner releasing it */ }
+        }
+    }
+    return null;
+}
+function versionEntry(cliHome, version) {
+    return path.join(cliHome, "versions", version, "node_modules", "@ouro.bot", "cli", "dist", "heart", "daemon", "ouro-entry.js");
+}
+async function runningDaemonVersion(socketPath) {
+    try {
+        const response = await (0, socket_client_1.sendDaemonCommand)(socketPath, { kind: "daemon.status" });
+        return (0, cli_render_1.parseStatusPayload)(response.data)?.overview.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function createDefaultSelfUpdateDeps(options = {}) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const cliHome = (0, ouro_version_manager_1.getOuroCliHome)(homeDir);
+    // The package end-to-end test must never see a daemon on the host machine.
+    const socketPath = process.env.OURO_SELF_UPDATE_E2E === "1"
+        ? path.join(cliHome, "e2e-no-daemon.sock")
+        : options.socketPath ?? socket_client_1.DEFAULT_DAEMON_SOCKET_PATH;
+    const launcher = path.join(cliHome, "bin", "ouro-launcher.js");
+    return {
+        now: () => Date.now(),
+        getCurrentVersion: () => (0, ouro_version_manager_1.getCurrentVersion)({ homeDir }),
+        readIntent: () => (0, version_intent_1.readVersionIntent)({ homeDir }),
+        writeIntent: (intent) => (0, version_intent_1.writeVersionIntent)(intent, { homeDir }),
+        readState: () => (0, update_state_1.readUpdateState)({ homeDir }),
+        writeState: (state) => (0, update_state_1.writeUpdateState)(state, { homeDir }),
+        lookupLatest: () => (0, release_sources_1.lookupLatestRelease)(exports.releaseSourceDeps),
+        install: (version, lookup) => (0, release_sources_1.installRelease)(version, lookup, cliHome, exports.releaseSourceDeps),
+        validate: (version) => (0, ouro_version_manager_1.validateInstalledVersionForActivation)(version, { homeDir }),
+        smokeTest: async (version) => {
+            try {
+                const output = (await execFileText(process.execPath, [versionEntry(cliHome, version), "--version"], { timeoutMs: 60_000 })).trim();
+                return output.includes(version) ? { ok: true } : { ok: false, detail: `--version printed "${output.slice(0, 120)}"` };
+            }
+            catch (error) {
+                return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+            }
+        },
+        activate: (version) => {
+            (0, ouro_version_manager_1.activateVersion)(version, { homeDir });
+            (0, ouro_version_manager_1.pruneOldVersions)(undefined, { homeDir });
+        },
+        isDaemonRunning: () => (0, socket_client_1.checkDaemonSocketAlive)(socketPath),
+        runningDaemonVersion: async () => (await (0, socket_client_1.checkDaemonSocketAlive)(socketPath)) ? runningDaemonVersion(socketPath) : null,
+        restartDaemon: async (expectedVersion) => {
+            try {
+                await runDetachedFromStdin(process.execPath, [launcher, "up"], DAEMON_UP_TIMEOUT_MS);
+            }
+            catch (error) {
+                return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+            }
+            const deadline = Date.now() + DAEMON_HEALTH_WAIT_MS;
+            let seen = null;
+            while (Date.now() < deadline) {
+                seen = await runningDaemonVersion(socketPath);
+                if (seen === expectedVersion)
+                    return { ok: true };
+                await new Promise((resolve) => setTimeout(resolve, 2_000));
+            }
+            return { ok: false, detail: seen ? `daemon answered with ${seen}, expected ${expectedVersion}` : "daemon did not answer after ouro up" };
+        },
+        isDevMode: () => fs.existsSync(path.join(cliHome, "dev-config.json")),
+        acquireLock: () => acquireLock(cliHome),
+    };
+}
+function nodeMajorOf(nodePath) {
+    try {
+        fs.accessSync(nodePath, fs.constants.X_OK);
+        const version = (0, child_process_1.execFileSync)(nodePath, ["--version"], { encoding: "utf8", timeout: 10_000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+        const major = Number.parseInt(version.replace(/^v/, ""), 10);
+        return Number.isFinite(major) ? major : null;
+    }
+    catch {
+        return null;
+    }
+}
+function ensureDefaultUpdaterAgent(options = {}) {
+    // The package end-to-end test runs in a throwaway HOME; it must never load
+    // a real launch agent on the host.
+    if (process.platform !== "darwin" || process.env.OURO_SELF_UPDATE_E2E === "1")
+        return null;
+    const homeDir = options.homeDir ?? os.homedir();
+    const result = (0, updater_launchd_1.ensureUpdaterAgent)({
+        homeDir,
+        userUid: os.userInfo().uid,
+        nodePath: (0, updater_launchd_1.chooseUpdaterNodePath)({
+            execPath: process.execPath,
+            runningMajor: Number.parseInt(process.versions.node, 10),
+            majorOf: nodeMajorOf,
+        }),
+        readFile: (filePath) => {
+            try {
+                return fs.readFileSync(filePath, "utf8");
+            }
+            catch {
+                return null;
+            }
+        },
+        writeFile: (filePath, content) => fs.writeFileSync(filePath, content, "utf8"),
+        mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
+        exec: (command) => { require("child_process").execSync(command, { stdio: "ignore" }); },
+        runningUnderUpdaterAgent: process.env.XPC_SERVICE_NAME === updater_launchd_1.UPDATER_PLIST_LABEL,
+        updateInProgress: isSelfUpdateLockHeld((0, ouro_version_manager_1.getOuroCliHome)(homeDir)),
+    });
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.self_update_agent_checked",
+        message: "checked the unattended updater launch agent",
+        meta: { result },
+    });
+    return result;
+}
+function isDefaultUpdaterAgentInstalled(options = {}) {
+    if (process.platform !== "darwin")
+        return null;
+    const homeDir = options.homeDir ?? os.homedir();
+    return fs.existsSync(path.join(homeDir, "Library", "LaunchAgents", `${updater_launchd_1.UPDATER_PLIST_LABEL}.plist`));
+}
+/* v8 ignore stop */

package/dist/heart/versioning/self-update.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PIN_MAX_AGE_MS = void 0;
+exports.runSelfUpdate = runSelfUpdate;
+const runtime_1 = require("../../nerves/runtime");
+const ouro_version_manager_1 = require("./ouro-version-manager");
+/**
+ * One unattended update pass. It never starts a stopped daemon, never leaves
+ * the machine on a version that failed its checks, and always records what
+ * happened in update-state.json so `ouro status` can report it.
+ *
+ * Steps:
+ *  1. Honor a human pin (`ouro rollback`) for PIN_MAX_AGE_MS, then expire it
+ *     by rewriting the intent to "latest". A pin without a timestamp gets
+ *     one the first time a pass sees it.
+ *  2. Ask every release source for the newest version. When nothing is newer
+ *     but a running daemon still reports an older version (a pass was killed
+ *     between activation and restart), restart it on CurrentVersion.
+ *  3. Install it, validate the payload and run its `--version` smoke test.
+ *  4. Activate it. If the daemon was running, restart it on the new version
+ *     and check that it answers; otherwise leave the daemon stopped.
+ *  5. On a failed check, reactivate the previous version, pin it with reason
+ *     "auto-rollback", restart the daemon on it, and never retry the failed
+ *     version.
+ */
+exports.PIN_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+const FAILURE_OUTCOMES = ["unreachable", "install-failed", "rejected", "rolled-back"];
+async function runSelfUpdate(deps) {
+    const release = deps.acquireLock();
+    if (!release) {
+        return { outcome: "busy", summary: "another ouro self-update is already running" };
+    }
+    try {
+        return await runLocked(deps);
+    }
+    finally {
+        release();
+    }
+}
+async function runLocked(deps) {
+    const now = deps.now();
+    const previous = deps.readState();
+    const failedVersions = [...(previous?.failedVersions ?? [])];
+    const currentVersion = deps.getCurrentVersion();
+    const finish = (outcome, fields) => {
+        const { summary, ...rest } = fields;
+        const state = {
+            schemaVersion: 1,
+            lastRunAt: new Date(now).toISOString(),
+            outcome,
+            currentVersion: deps.getCurrentVersion(),
+            failedVersions,
+            consecutiveFailures: FAILURE_OUTCOMES.includes(outcome) ? (previous?.consecutiveFailures ?? 0) + 1 : 0,
+            ...rest,
+            detail: rest.detail ?? summary,
+        };
+        deps.writeState(state);
+        (0, runtime_1.emitNervesEvent)({
+            level: FAILURE_OUTCOMES.includes(outcome) ? "warn" : "info",
+            component: "daemon",
+            event: "daemon.self_update_result",
+            message: summary,
+            meta: { outcome, currentVersion: state.currentVersion, latestVersion: state.latestVersion ?? null },
+        });
+        return { outcome, summary, state };
+    };
+    /**
+     * Restart the daemon on `target`. On a failed health check, never retry
+     * `target`, pin and reactivate `fallback`, and restart on it. Returns the
+     * rolled-back result, or null when `target` came up healthy.
+     */
+    const restartOrRollBack = async (target, fallback, source) => {
+        const health = await deps.restartDaemon(target);
+        if (health.ok)
+            return null;
+        failedVersions.push(target);
+        if (!fallback) {
+            return finish("rolled-back", {
+                summary: `${target} did not come up healthy (${health.detail ?? "no detail"}) and there is no previous version to return to`,
+                latestVersion: target,
+                source,
+            });
+        }
+        deps.writeIntent({
+            schemaVersion: 1,
+            mode: "pinned",
+            targetVersion: fallback,
+            pinnedAt: new Date(now).toISOString(),
+            reason: "auto-rollback",
+        });
+        deps.activate(fallback);
+        const restored = await deps.restartDaemon(fallback);
+        return finish("rolled-back", {
+            summary: `${target} did not come up healthy (${health.detail ?? "no detail"}); rolled back to ${fallback}${restored.ok ? "" : ` but the daemon did not answer on it either (${restored.detail ?? "no detail"})`}`,
+            latestVersion: target,
+            source,
+        });
+    };
+    // 1. Pins.
+    const intent = deps.readIntent();
+    if (intent?.mode === "pinned" && intent.reason !== "auto-rollback") {
+        let pinnedAt = intent.pinnedAt;
+        if (!pinnedAt || Number.isNaN(Date.parse(pinnedAt))) {
+            // A pin written before pins carried a timestamp: start its clock now and
+            // record it in the intent itself, so the pin cannot outlive its expiry.
+            pinnedAt = new Date(now).toISOString();
+            deps.writeIntent({ ...intent, pinnedAt });
+        }
+        const expiresAtMs = Date.parse(pinnedAt) + exports.PIN_MAX_AGE_MS;
+        if (now < expiresAtMs) {
+            const until = new Date(expiresAtMs).toISOString();
+            return finish("pinned", {
+                summary: `pinned to ${intent.targetVersion} by ouro rollback; unattended updates resume after ${until} (run \`ouro up --latest\` to resume now)`,
+                detail: `pin honored until ${until}`,
+            });
+        }
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.self_update_pin_expired",
+            message: "a rollback pin older than the maximum age no longer blocks updates",
+            meta: { targetVersion: intent.targetVersion, pinnedAt },
+        });
+        deps.writeIntent({ schemaVersion: 1, mode: "latest", targetVersion: intent.targetVersion });
+    }
+    // 2. Lookup.
+    const lookup = await deps.lookupLatest();
+    const sourceSummary = lookup.answers.map((answer) => `${answer.source}: ${answer.version ?? answer.error}`).join("; ");
+    const latest = lookup.latestVersion;
+    if (!latest) {
+        return finish("unreachable", { summary: `no release source answered (${sourceSummary})` });
+    }
+    const lookupSource = lookup.answers.find((answer) => answer.version === latest)?.source;
+    if (currentVersion && (0, ouro_version_manager_1.compareCliVersions)(latest, currentVersion) <= 0) {
+        // A pass killed between activation and restart leaves the old daemon
+        // running; finish the job instead of reporting "current" forever.
+        const daemonVersion = deps.isDevMode() ? null : await deps.runningDaemonVersion();
+        if (daemonVersion && daemonVersion !== currentVersion) {
+            const restart = await restartOrRollBack(currentVersion, daemonVersion);
+            if (restart)
+                return restart;
+            return finish("updated", {
+                summary: `daemon was still running ${daemonVersion}; restarted it on ${currentVersion} and it is healthy`,
+                latestVersion: latest,
+                source: lookupSource,
+            });
+        }
+        const failedSources = lookup.answers.filter((answer) => !answer.version).map((answer) => `${answer.source}: ${answer.error}`);
+        return finish("current", {
+            summary: `current at ${currentVersion}${failedSources.length ? ` (unreachable: ${failedSources.join("; ")})` : ""}`,
+            latestVersion: latest,
+            source: lookupSource,
+        });
+    }
+    if (failedVersions.includes(latest)) {
+        return finish("rejected", {
+            summary: `latest ${latest} failed its checks on this machine earlier; staying on ${currentVersion} until a newer release ships`,
+            latestVersion: latest,
+        });
+    }
+    // 3. Install, validate, smoke test.
+    let installSource;
+    try {
+        installSource = await deps.install(latest, lookup);
+    }
+    catch (error) {
+        return finish("install-failed", { summary: errorText(error), latestVersion: latest });
+    }
+    const validation = deps.validate(latest);
+    const smoke = validation.ok ? await deps.smokeTest(latest) : { ok: false, detail: validation.message };
+    if (!smoke.ok) {
+        failedVersions.push(latest);
+        return finish("rejected", {
+            summary: `${latest} failed its pre-activation check: ${smoke.detail ?? "no detail"}; staying on ${currentVersion}`,
+            latestVersion: latest,
+            source: installSource,
+        });
+    }
+    // 4. Activate, then restart a running daemon on the new version.
+    const daemonWasRunning = !deps.isDevMode() && await deps.isDaemonRunning();
+    deps.writeIntent({ schemaVersion: 1, mode: "latest", targetVersion: latest });
+    deps.activate(latest);
+    if (daemonWasRunning) {
+        const restart = await restartOrRollBack(latest, currentVersion, installSource);
+        if (restart)
+            return restart;
+    }
+    return finish("updated", {
+        summary: `updated ${currentVersion ?? "unknown"} -> ${latest} via ${installSource}${daemonWasRunning ? "; daemon restarted and healthy" : "; daemon was not running and was left stopped"}`,
+        latestVersion: latest,
+        source: installSource,
+    });
+}

package/dist/heart/{daemon → versioning}/staged-restart.js

@@ -45,14 +45,22 @@ async function performStagedRestart(version, deps) {
     });
     // Step 1: Install new version
     try {
-        deps.execSync(`npm install -g @ouro.bot/cli@${version}`);
+        if (deps.installNewVersion) {
+            deps.installNewVersion(version);
+        }
+        else {
+            // Backward-compat fallback for callers that haven't migrated to the
+            // version-managed installer. Tests use this path with a mocked
+            // execSync; production callers inject installNewVersion.
+            deps.execSync(`npm install -g @ouro.bot/cli@${version}`);
+        }
     }
     catch (err) {
         const errorMessage = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.staged_restart_install_failed",
-            message: "npm install failed",
+            message: "install failed",
             meta: { version, error: errorMessage },
         });
         return { ok: false, error: errorMessage };
@@ -90,25 +98,49 @@ async function performStagedRestart(version, deps) {
         });
         return { ok: false, error: `hook runner exited with code ${spawnResult.status}` };
     }
-    // Step 4: Graceful shutdown (launchd will restart with new code)
+    // Step 4: Graceful shutdown then self-spawn new daemon
+    // We can't rely on launchd KeepAlive — the plist may not be loaded.
+    // Instead: shut down (releases socket), spawn new daemon from updated code.
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.staged_restart_hooks_passed",
-        message: "hooks passed, shutting down for restart",
+        message: "hooks passed, shutting down and spawning new daemon",
         meta: { version },
     });
+    let shutdownError;
     try {
         await deps.gracefulShutdown();
     }
     catch (err) {
-        const shutdownError = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
+        shutdownError = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.staged_restart_shutdown_error",
-            message: "graceful shutdown encountered error",
+            message: "graceful shutdown encountered error (continuing with spawn)",
             meta: { version, error: shutdownError },
         });
-        return { ok: true, shutdownError };
     }
-    return { ok: true };
+    // Spawn new daemon from updated code path
+    const newEntry = path.join(newCodePath, "dist", "heart", "daemon", "daemon-entry.js");
+    const socketArg = deps.socketPath ?? "/tmp/ouroboros-daemon.sock";
+    try {
+        const { pid } = deps.spawnNewDaemon(newEntry, socketArg);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.staged_restart_spawned",
+            message: "new daemon spawned successfully",
+            meta: { version, pid, entry: newEntry },
+        });
+    }
+    catch (err) {
+        const spawnError = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.staged_restart_respawn_failed",
+            message: "failed to spawn new daemon after shutdown",
+            meta: { version, error: spawnError, entry: newEntry },
+        });
+        return { ok: false, error: `shutdown succeeded but failed to spawn new daemon: ${spawnError}`, shutdownError };
+    }
+    return { ok: true, shutdownError };
 }

package/dist/heart/{daemon → versioning}/update-checker.js

@@ -33,12 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLI_UPDATE_DIST_TAG = exports.CLI_UPDATE_CHECK_TIMEOUT_MS = void 0;
 exports.checkForUpdate = checkForUpdate;
 exports.startUpdateChecker = startUpdateChecker;
 exports.stopUpdateChecker = stopUpdateChecker;
 const semver = __importStar(require("semver"));
 const runtime_1 = require("../../nerves/runtime");
 const DEFAULT_INTERVAL_MS = 30 * 60 * 1000; // 30 minutes
+exports.CLI_UPDATE_CHECK_TIMEOUT_MS = 3_000;
+exports.CLI_UPDATE_DIST_TAG = "latest";
 async function checkForUpdate(currentVersion, deps) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -102,9 +105,11 @@ function stopUpdateChecker() {
         clearInterval(_intervalId);
         _intervalId = null;
     }
+    // `_end` (not `_stop`) to satisfy the nerves audit's start/end pairing
+    // rule — counterpart to `daemon.update_checker_start` above.
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
-        event: "daemon.update_checker_stop",
+        event: "daemon.update_checker_end",
         message: "stopping update checker",
         meta: {},
     });