@pablopunk/tau 0.1.0 → 0.1.2

package/dist/{main-CI9q691u.js → main-R5EDx89w.js}

@@ -1,15 +1,16 @@
-import { $ as routes, B as COMMAND_NOUNS, G as isModelRefNode, H as commandOf, J as LIVE_PATH, K as routeFields, L as isErrorBody, M as decodeServerFrame, N as encodeFrame, U as commands, V as FLOW_COMMANDS, W as flagNameOf, Z as fillPath, a as readRunningInstance, c as lastAssistantText, it as RedeemPairingResponseSchema, l as viewToText, nt as nextViewState, z as AUTO_FIELDS } from "./wait-for-lock-D2V3vuye.js";
-import { a as lifecycleFlagsOf, c as createHubFileStore, i as commandWordOf, l as alreadyLinkedRefusal, n as serverLogOf, o as cliVersion, r as writeStoredPort, s as readOrCreateToken, t as serveInForeground, u as connectRefusal } from "./serve-92lMbcls.js";
-import { a as TemporaryEntryError, i as realContext, r as createServiceManager, t as runServiceCommand } from "./service-command-C7WDeeR2.js";
-import { t as cliEntry } from "./cli-entry-DcDpQ30L.js";
+import { $ as routes, B as COMMAND_NOUNS, G as isModelRefNode, H as commandOf, J as LIVE_PATH, K as routeFields, M as decodeServerFrame, N as encodeFrame, U as commands, V as FLOW_COMMANDS, W as flagNameOf, a as lastAssistantText, it as RedeemPairingResponseSchema, nt as nextViewState, o as viewToText, s as compareVersions, z as AUTO_FIELDS } from "./src-DO9LUlhi.js";
+import { a as lifecycleFlagsOf, c as connectRefusal, i as commandWordOf, n as serverLogOf, o as createHubFileStore, r as writeStoredPort, s as alreadyLinkedRefusal, t as serveInForeground } from "./serve-Uc4Nin5f.js";
+import { a as realLifecycleDeps, c as renderExtras, d as discoverServer, f as CliExit, i as managerOf, l as processEnv, m as usageError, n as linkedMachinesLine, o as withToken, p as failure, r as NOT_RUNNING, s as NO_EXTRAS, u as callRoute } from "./machines-behind-BjGgmSs_.js";
+import { a as cliVersion, r as npmOf, t as PACKAGE_NAME } from "./latest-version-di9hD7cY.js";
+import { a as TemporaryEntryError, i as realContext } from "./manager-B_WHbb1U.js";
+import { t as runServiceCommand } from "./service-command-C74K0saj.js";
 import { createReadStream, existsSync, readFileSync, statSync, watchFile } from "node:fs";
-import { join } from "node:path";
-import { homedir, hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { hostname } from "node:os";
 import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
+import { parseArgs } from "node:util";
 import { randomUUID } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
-import { execFile } from "node:child_process";
 import { Value } from "typebox/value";
 import { createInterface } from "node:readline/promises";
 import QRCode from "qrcode";
@@ -65,18 +66,6 @@ function readLive(view) {
 		queued: (inbox?.items ?? []).filter(isQueuedMessage).map(queuedOf)
 	};
 }
-/** A failure that ends the command with a message on stderr and an exit code. */
-var CliExit = class extends Error {
-	exitCode;
-	constructor(exitCode, message) {
-		super(message);
-		this.name = "CliExit";
-		this.exitCode = exitCode;
-	}
-};
-const usageError = (message) => new CliExit(2, message);
-const failure = (message) => new CliExit(1, message);
-const NOT_RUNNING_MESSAGE = "tau is not running. Run `tau` to start it.";
 //#endregion
 //#region src/machines/connect-args.ts
 const USAGE = "Usage: tau connect <link | code --hub <url>> [--name <label>] [--yes]";
@@ -170,94 +159,6 @@ function parseConnectTarget(input, hub) {
 	};
 }
 //#endregion
-//#region src/commands/client.ts
-const URL_POLL_MS = 100;
-async function waitForLockUrl(home, env) {
-	const deadline = env.now() + env.startupWaitMs;
-	for (;;) {
-		const info = await readRunningInstance(home);
-		if (!info) throw failure(NOT_RUNNING_MESSAGE);
-		if (info.url) return info.url;
-		if (env.now() >= deadline) throw failure("tau is starting but has not published its URL yet.");
-		await env.sleep(URL_POLL_MS);
-	}
-}
-async function readToken(home) {
-	try {
-		return (await readFile(join(home, "token"), "utf8")).trim();
-	} catch {
-		throw failure(NOT_RUNNING_MESSAGE);
-	}
-}
-/** The lock gives the URL and `<home>/token` the secret. Retries while a live server has no URL yet. */
-async function discoverServer(env) {
-	return {
-		url: await waitForLockUrl(env.home, env),
-		token: await readToken(env.home)
-	};
-}
-const queryString = (query) => {
-	const entries = Object.entries(query ?? {});
-	return entries.length === 0 ? "" : `?${new URLSearchParams(entries).toString()}`;
-};
-async function errorMessageOf$1(response) {
-	const text = await response.text();
-	try {
-		const parsed = JSON.parse(text);
-		if (isErrorBody(parsed)) return `${parsed.error.code}: ${parsed.error.message}`;
-	} catch {}
-	return `HTTP ${response.status}${text ? `: ${text.slice(0, 200)}` : ""}`;
-}
-async function send(server, name, request, env) {
-	const route = routes[name];
-	const target = `${server.url}${fillPath(route.path, request.params)}${queryString(request.query)}`;
-	const hasBody = request.body !== void 0;
-	try {
-		return await env.fetch(target, {
-			method: route.method,
-			headers: {
-				authorization: `Bearer ${server.token}`,
-				...hasBody ? { "content-type": "application/json" } : {}
-			},
-			body: hasBody ? JSON.stringify(request.body) : void 0
-		});
-	} catch {
-		throw failure(NOT_RUNNING_MESSAGE);
-	}
-}
-/** Calls one route. Returns the parsed JSON, or `undefined` for an empty answer. An `AppError` becomes a failure. */
-async function callRoute(server, name, request, env) {
-	const response = await send(server, name, request, env);
-	if (!response.ok) throw failure(await errorMessageOf$1(response));
-	const text = await response.text();
-	return text ? JSON.parse(text) : void 0;
-}
-//#endregion
-//#region src/commands/command-env.ts
-const defaultOpenSocket = (url, headers) => {
-	return new WebSocket(url, { headers });
-};
-const homeOf = (env) => env.TAU_HOME ?? join(homedir(), ".tau");
-function processEnv() {
-	return {
-		home: homeOf(process.env),
-		env: process.env,
-		stdout: (text) => void process.stdout.write(`${text}\n`),
-		stderr: (text) => void process.stderr.write(`${text}\n`),
-		fetch: (input, init) => fetch(input, init),
-		openSocket: defaultOpenSocket,
-		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-		after: (ms, fn) => {
-			const timer = setTimeout(fn, ms);
-			return () => clearTimeout(timer);
-		},
-		now: Date.now,
-		startupWaitMs: 5e3,
-		pollMs: 2e3,
-		skillPaths: []
-	};
-}
-//#endregion
 //#region src/commands/command-flags.ts
 const WAIT_COMMANDS = ["threads start", "threads send"];
 const COMMON_FLAGS = [
@@ -526,8 +427,18 @@ const THREAD_EXTRAS = ["  wait <id>       Wait until the thread is done, then pr
 const LIFECYCLE = [
 	"  start, stop, restart, status, open, logs, service   Run and manage the server",
 	"  serve           Run the server in the foreground",
+	"  update          Install the latest tau and restart the server (--check, --yes, --force, --no-restart)",
 	"  skill           Print the tau skill for agents"
 ];
+const UPDATE_FLAGS = [
+	"",
+	"tau update flags:",
+	"  --check         Print current -> latest; exit 0 current, 10 update available, 1 error",
+	"  --yes           Skip only the \"Install X -> Y and restart?\" question",
+	"  --force         Restart even when threads are running",
+	"  --no-restart    Install and verify, then print `tau restart`",
+	"  --home <dir>, --port <n>   Forwarded to `tau restart`"
+];
 const pad = (text) => text.padEnd(26);
 function rootHelp() {
 	return [
@@ -542,7 +453,8 @@ function rootHelp() {
 		...COMMAND_NOUNS.map((noun) => `  ${noun}`),
 		...FLOW_COMMANDS.map((word) => `  ${word}`),
 		"",
-		"Run `tau <noun> --help` for the commands of a noun, `tau <noun> <verb> --help` for one command."
+		"Run `tau <noun> --help` for the commands of a noun, `tau <noun> <verb> --help` for one command.",
+		...UPDATE_FLAGS
 	].join("\n");
 }
 function nounHelp(noun) {
@@ -931,7 +843,7 @@ async function redeem(hubUrl, code, deviceName, env) {
 }
 async function startAfterLink(choice, env) {
 	if (choice === "serve") {
-		const { serveInForeground } = await import("./serve-BcVZj5e2.js");
+		const { serveInForeground } = await import("./serve-CuMzEud7.js");
 		env.stdout("Starting tau for this session. Press Ctrl+C to stop.");
 		await serveInForeground([
 			"--no-open",
@@ -939,7 +851,7 @@ async function startAfterLink(choice, env) {
 			env.home
 		]);
 	} else if (choice === "service") {
-		const { runServiceCommand } = await import("./service-command-BVr33vlP.js");
+		const { runServiceCommand } = await import("./service-command-DqcstJ8e.js");
 		await runServiceCommand([
 			"install",
 			"--home",
@@ -1010,7 +922,7 @@ const runDisconnect = runner(executeDisconnect);
 const REMOTE_WAIT_MS = 72e4;
 const LINK_POLL_MS = 2e3;
 const REMOTE_POLL_MS = 3e3;
-const PROGRESS_EVERY_MS = 15e3;
+const PROGRESS_EVERY_MS = 1e4;
 const FULL_POWER_WARNING = "A linked device gets full power over this computer: agents, terminals and your files. Share this only with yourself.";
 function parsePairArgs(argv) {
 	let name;
@@ -1024,6 +936,10 @@ function parsePairArgs(argv) {
 }
 const groupShortCode = (code) => code.match(/.{1,4}/g)?.join(" ") ?? code;
 const remoteOf = (server, env) => callRoute(server, "getRemoteStatus", {}, env);
+function elapsedLine(status, now) {
+	const seconds = status.since === null ? 0 : Math.max(0, Math.floor((now - status.since) / 1e3));
+	return `Setting up remote access, ${seconds < 60 ? `${seconds} s` : `${Math.floor(seconds / 60)} min`} so far (usually 3-6 minutes)`;
+}
 async function waitUntilOnline(server, env, first) {
 	const deadline = env.now() + REMOTE_WAIT_MS;
 	let status = first;
@@ -1037,7 +953,7 @@ async function waitUntilOnline(server, env, first) {
 			env.stdout(status.message);
 		} else if (env.now() - lastProgress >= PROGRESS_EVERY_MS) {
 			lastProgress = env.now();
-			env.stdout(`Still ${status.state}… (this takes a few minutes)`);
+			env.stdout(elapsedLine(status, env.now()));
 		}
 		await env.sleep(REMOTE_POLL_MS);
 		status = await remoteOf(server, env);
@@ -1049,7 +965,7 @@ async function ensureRemoteOnline(server, env) {
 	let status = await remoteOf(server, env);
 	if (status.state === "online") return;
 	if (status.state === "off") {
-		env.stdout("Remote access is off. Turning it on: the first time takes a few minutes, please wait.");
+		env.stdout("Remote access is off. Turning it on: a new URL takes 3-6 minutes, please wait.");
 		status = await callRoute(server, "enableRemote", {}, env);
 	} else env.stdout("Remote access is starting: this takes a few minutes.");
 	await waitUntilOnline(server, env, status);
@@ -1136,121 +1052,6 @@ async function runSkill(_argv) {
 	await printSkill(processEnv());
 }
 //#endregion
-//#region src/lifecycle/status-extras.ts
-const NO_EXTRAS = {
-	uptimeSeconds: null,
-	lastExit: null,
-	tunnel: null
-};
-const execFileAsync = promisify(execFile);
-/** `[[dd-]hh:]mm:ss` as printed by `ps -o etime=`. */
-function parseElapsed(text) {
-	const match = /^(?:(?:(\d+)-)?(\d+):)?(\d+):(\d+)$/.exec(text.trim());
-	if (!match) return null;
-	const [, days, hours, minutes, seconds] = match.map((part) => Number(part ?? 0));
-	return ((days ?? 0) * 24 + (hours ?? 0)) * 3600 + (minutes ?? 0) * 60 + (seconds ?? 0);
-}
-async function uptimeOf(pid) {
-	try {
-		const { stdout } = await execFileAsync("ps", [
-			"-o",
-			"etime=",
-			"-p",
-			String(pid)
-		]);
-		return parseElapsed(stdout);
-	} catch {
-		return null;
-	}
-}
-/** Missing or corrupt files give `null`. */
-async function readLastExit(home) {
-	try {
-		const value = JSON.parse(await readFile(join(home, "last-exit.json"), "utf8"));
-		if (typeof value.reason !== "string" || typeof value.at !== "number") return null;
-		return {
-			reason: value.reason,
-			at: value.at,
-			...value.detail ? { detail: String(value.detail) } : {}
-		};
-	} catch {
-		return null;
-	}
-}
-async function readTunnel(home, instance) {
-	if (!instance?.url) return null;
-	try {
-		const token = (await readFile(join(home, "token"), "utf8")).trim();
-		const response = await fetch(`${instance.url}/api/remote`, {
-			headers: { authorization: `Bearer ${token}` },
-			signal: AbortSignal.timeout(2e3)
-		});
-		if (!response.ok) return null;
-		const { state, url, message } = await response.json();
-		return {
-			state,
-			url,
-			message
-		};
-	} catch {
-		return null;
-	}
-}
-async function realExtras(home, instance) {
-	const [uptimeSeconds, lastExit, tunnel] = await Promise.all([
-		instance ? uptimeOf(instance.pid) : null,
-		readLastExit(home),
-		readTunnel(home, instance)
-	]);
-	return {
-		uptimeSeconds,
-		lastExit,
-		tunnel
-	};
-}
-function formatDuration(totalSeconds) {
-	const days = Math.floor(totalSeconds / 86400);
-	const hours = Math.floor(totalSeconds % 86400 / 3600);
-	const minutes = Math.floor(totalSeconds % 3600 / 60);
-	if (days > 0) return `${days}d ${hours}h`;
-	if (hours > 0) return `${hours}h ${minutes}m`;
-	return minutes > 0 ? `${minutes}m ${totalSeconds % 60}s` : `${totalSeconds}s`;
-}
-function renderExtras(extras) {
-	const { uptimeSeconds, lastExit, tunnel } = extras;
-	const exit = lastExit ? `${lastExit.reason}${lastExit.detail ? ` (${lastExit.detail})` : ""} at ${new Date(lastExit.at).toISOString()}` : "-";
-	const tunnelText = tunnel ? `${tunnel.state}${tunnel.url ? ` ${tunnel.url}` : ""}` : "-";
-	return [
-		`uptime: ${uptimeSeconds === null ? "-" : formatDuration(uptimeSeconds)}`,
-		`last exit: ${exit}`,
-		`tunnel: ${tunnelText}`
-	];
-}
-//#endregion
-//#region src/lifecycle/deps.ts
-const withToken = (origin, token) => `${origin}/?token=${encodeURIComponent(token)}`;
-const managerOf = (deps, home) => createServiceManager(deps.context, deps.cli(), home);
-const NOT_RUNNING = "tau is not running. Run `tau` to start it.";
-async function realLifecycleDeps() {
-	const { waitForUrl } = await import("./wait-for-lock-BMk6v3J5.js");
-	const { existsSync } = await import("node:fs");
-	return {
-		context: realContext(),
-		cli: () => cliEntry(),
-		version: cliVersion,
-		readInstance: readRunningInstance,
-		waitForInstanceUrl: (home) => waitForUrl(home),
-		readToken: readOrCreateToken,
-		openBrowser: async (url) => {
-			const { default: open } = await import("open");
-			await open(url);
-		},
-		out: (message) => console.log(message),
-		fileExists: existsSync,
-		extras: realExtras
-	};
-}
-//#endregion
 //#region src/lifecycle/open.ts
 /** Opens the browser on a running server; returns the URL it opened. */
 async function openRunning(deps, home) {
@@ -1433,6 +1234,324 @@ async function runStop(argv) {
 	await runStopWith(await realLifecycleDeps(), argv);
 }
 //#endregion
+//#region src/update/install-method.ts
+const NPM_LAYOUT = /\/lib\/node_modules\/@pablopunk\/tau\/dist\/bin\.js$/;
+const SHIM_MANAGERS = /\/(mise|asdf)\//;
+const manual = (reason, manualCommand) => ({
+	kind: "manual",
+	reason,
+	manualCommand
+});
+function refusalOf(entry, target) {
+	const spec = `${PACKAGE_NAME}@${target}`;
+	if (entry.includes("/.bun/")) return `Installed with bun. Run: bun add -g ${spec}`;
+	if (entry.includes("/.volta/")) return `Installed with volta. Run: volta install ${spec}`;
+	if (/\/_npx\/|\/dlx\/|\/\.bun\/install\/cache\//.test(entry) || entry.includes("/_npx/")) return "Running from a temporary npx/dlx cache: nothing to update. Run `npx @pablopunk/tau@latest` again.";
+	if (/\/packages\/cli\/dist\/bin\.js$/.test(entry)) return "Running from a development checkout: update it with git.";
+}
+/** Which package manager owns this tau, from where the running entry file lives. Never guesses. */
+function installMethodOf(probe) {
+	const { entry, target } = probe;
+	const spec = `${PACKAGE_NAME}@${target}`;
+	if (probe.platform === "win32") return manual("Automatic update is not supported on Windows.", `npm i -g ${spec}`);
+	const refusal = refusalOf(entry, target);
+	if (refusal) return manual(refusal);
+	if (entry.includes("/.pnpm/") || /\/pnpm\/global\//.test(entry)) return {
+		kind: "pnpm",
+		install: {
+			command: "pnpm",
+			args: [
+				"add",
+				"-g",
+				spec
+			]
+		},
+		manualCommand: `pnpm add -g ${spec}`
+	};
+	if (!NPM_LAYOUT.test(entry)) return manual(`Unknown install layout: ${entry}`, `npm i -g ${spec}`);
+	return {
+		kind: "npm",
+		packageDir: dirname(dirname(entry)),
+		install: {
+			command: npmOf(probe.execPath),
+			args: [
+				"i",
+				"-g",
+				spec
+			]
+		},
+		manualCommand: `npm i -g ${spec}`,
+		hint: SHIM_MANAGERS.test(entry) ? "If `tau` is missing afterwards, run `mise reshim`." : void 0
+	};
+}
+const entryOfPackage = (packageDir) => join(packageDir, "dist", "bin.js");
+//#endregion
+//#region src/update/update-text.ts
+const LAG_NOTE = "A release can take 1-3 minutes to show up in the npm registry.";
+const LINKED_NOTE = "Linked machines must run the same tau version: run `tau update` on each.";
+const LINKED_HUB_NOTE = "This tau is linked to a hub: update the hub and every machine to the same version.";
+const INSIDE_TAU = "You are running inside tau; restarting would kill this command. Run `tau restart` from a normal terminal, or pass `--no-restart`.";
+const NON_TTY_NEEDS_YES = "Not a terminal. Add --yes to skip the question.";
+const FOREGROUND_NOTE = "tau runs in the foreground: restart it yourself (Ctrl-C, then `tau`).";
+const NOT_RUNNING_NOTE = "tau is not running: start it with `tau start`.";
+const names = (items) => items.map((item) => `  - ${item.title}`);
+function runningWorkText(work) {
+	const lines = [`Running threads: ${work.threads.length}, subagents: ${work.subagents.length}.`];
+	lines.push(...names(work.threads), ...names(work.subagents));
+	lines.push("A restart resumes or aborts turns on startup, ends terminals and background processes, and the page reconnects in seconds.", "Add --force to restart anyway.");
+	return lines.join("\n");
+}
+const resumingText = (work) => work.resuming.length > 0 ? `${work.resuming.length} thread(s) with timers or a goal will resume after the restart.` : void 0;
+const failedInstallText = (manual, rollback) => `The install failed. Run it yourself: ${manual}\nTo go back: ${rollback}`;
+const permissionText = (manual) => `Permission denied. Fix the permissions of the npm prefix (or use a node version manager), then run: ${manual}`;
+const verifyFailedText = (problem, rollback) => `The update did not verify: ${problem}\nNothing was restarted: the old server still runs on old in-memory code and files on disk may be inconsistent. Re-run \`tau update\`, or go back with: ${rollback}`;
+const skewText = (running, target) => `The server still reports version ${running ?? "none"}, expected ${target}. Check \`tau status\` and \`tau logs\`.`;
+//#endregion
+//#region src/update/restart-step.ts
+async function isInsideServer(deps, home) {
+	if (deps.env.TAU_THREAD_ID) return true;
+	const [instance, ancestors] = [await deps.readInstance(home), await (deps.ancestorPids?.() ?? Promise.resolve([]))];
+	return instance !== void 0 && ancestors.includes(instance.pid);
+}
+/** Restarts the managed server with the NEW binary and waits until the lock reports the target version. */
+async function restartInNewBinary(deps, request) {
+	const running = (await gatherStatus(deps, request.home)).running;
+	if (running === "foreground") return note(deps, FOREGROUND_NOTE);
+	if (running === false) return note(deps, NOT_RUNNING_NOTE);
+	if (await isInsideServer(deps, request.home)) {
+		deps.err(INSIDE_TAU);
+		return 1;
+	}
+	const args = [
+		entryOfPackage(request.packageDir),
+		"restart",
+		...request.forwarded
+	];
+	if ((await deps.runCommand(deps.execPath, args, { stdio: "inherit" })).code !== 0) {
+		deps.err("`tau restart` failed. Check `tau status` and `tau logs`.");
+		return 1;
+	}
+	const instance = await deps.pollInstance(request.home, request.target);
+	if (instance?.version !== request.target) {
+		deps.err(skewText(instance?.version, request.target));
+		return 1;
+	}
+	deps.out(`tau ${request.target} is running.`);
+	return 0;
+}
+function note(deps, message) {
+	deps.out(`Updated. ${message}`);
+	return 0;
+}
+//#endregion
+//#region src/update/running-work.ts
+/** What a restart would interrupt. Each thread is counted once; the caller's own lineage is left out. */
+function runningWorkOf(all, ownId) {
+	const own = ownId ? lineageOf(all, ownId) : /* @__PURE__ */ new Set();
+	const live = all.filter((item) => item.archivedAt === null && !own.has(item.id));
+	const subagents = live.filter((item) => item.parentId !== null && item.agentStatus === "running");
+	return {
+		threads: live.filter((item) => item.parentId === null && item.status === "running"),
+		subagents,
+		resuming: live.filter((item) => item.timers > 0 || item.goal?.state === "active")
+	};
+}
+const hasRunningWork = (work) => work.threads.length + work.subagents.length > 0;
+//#endregion
+//#region src/update/update-flags.ts
+function updateFlagsOf(argv) {
+	const { values } = parseArgs({
+		args: [...argv],
+		strict: false,
+		options: {
+			check: { type: "boolean" },
+			yes: {
+				type: "boolean",
+				short: "y"
+			},
+			force: { type: "boolean" },
+			"no-restart": { type: "boolean" },
+			home: { type: "string" },
+			port: { type: "string" }
+		}
+	});
+	const forwarded = [...typeof values.home === "string" ? ["--home", values.home] : [], ...typeof values.port === "string" ? ["--port", values.port] : []];
+	return {
+		check: values.check === true,
+		yes: values.yes === true,
+		force: values.force === true,
+		noRestart: values["no-restart"] === true,
+		forwarded
+	};
+}
+//#endregion
+//#region src/update/verify-install.ts
+const STATUS_TIMEOUT_MS = 3e4;
+function reportedVersion(stdout) {
+	try {
+		return JSON.parse(stdout.trim()).cliVersion;
+	} catch {
+		return;
+	}
+}
+/** The new files must say the target version and the new binary must load; returns the problem, if any. */
+async function verifyInstall(deps, packageDir, target, home) {
+	const onDisk = deps.readPackageVersion(packageDir);
+	if (onDisk !== target) return `${packageDir}/package.json says ${onDisk ?? "nothing"}, expected ${target}.`;
+	const args = [
+		entryOfPackage(packageDir),
+		"status",
+		"--home",
+		home,
+		"--json"
+	];
+	const result = await deps.runCommand(deps.execPath, args, {
+		stdio: "capture",
+		timeoutMs: STATUS_TIMEOUT_MS
+	});
+	if (result.code !== 0) return `The new tau does not start (exit ${result.code}): ${result.stderr.trim().slice(0, 300)}`;
+	const reported = reportedVersion(result.stdout);
+	return reported === target ? void 0 : `The new tau reports version ${reported ?? "unknown"}, expected ${target}.`;
+}
+async function planOf(deps, target) {
+	const method = installMethodOf({
+		entry: deps.entry,
+		execPath: deps.execPath,
+		platform: deps.context.platform,
+		target
+	});
+	if (method.kind === "manual") return [method.reason, method.manualCommand ? `Run: ${method.manualCommand}` : ""].filter(Boolean).join("\n");
+	const install = {
+		...method.install,
+		manual: method.manualCommand
+	};
+	if (method.kind === "npm") return {
+		packageDir: method.packageDir,
+		install,
+		hint: method.hint
+	};
+	const root = await deps.runCommand("pnpm", ["root", "-g"], {
+		stdio: "capture",
+		timeoutMs: 15e3
+	});
+	const dir = root.stdout.trim();
+	if (root.code !== 0 || !dir) return `Could not find the pnpm global directory.\nRun: ${method.manualCommand}`;
+	try {
+		return {
+			packageDir: deps.realpath(`${dir}/@pablopunk/tau`),
+			install
+		};
+	} catch {
+		return `Could not find the pnpm global package.\nRun: ${method.manualCommand}`;
+	}
+}
+async function refusalForRunningWork(deps, home) {
+	let all;
+	try {
+		all = await deps.listConversations(home);
+	} catch (error) {
+		return `Could not list the running threads (${error instanceof Error ? error.message : error}). Add --force to restart anyway.`;
+	}
+	const work = runningWorkOf(all, deps.env.TAU_THREAD_ID);
+	const resuming = resumingText(work);
+	if (resuming) deps.out(resuming);
+	return hasRunningWork(work) ? runningWorkText(work) : void 0;
+}
+async function installStep(deps, plan, current) {
+	const { command, args, manual } = plan.install;
+	const result = await deps.runCommand(command, args, { stdio: "tee" });
+	if (result.code === 0) return void 0;
+	if (/EACCES|EPERM/.test(result.stderr)) return permissionText(manual);
+	return failedInstallText(manual, manual.replace(/@[^@]+$/, `@${current}`));
+}
+async function finish(deps, flags, plan, target, home) {
+	const rollback = plan.install.manual.replace(/@[^@]+$/, `@${deps.version()}`);
+	const problem = await verifyInstall(deps, plan.packageDir, target, home);
+	if (problem) {
+		deps.err(verifyFailedText(problem, rollback));
+		return 1;
+	}
+	if (plan.hint) deps.out(plan.hint);
+	const code = flags.noRestart ? noRestartNote(deps) : await restartInNewBinary(deps, {
+		...flags,
+		packageDir: plan.packageDir,
+		target,
+		home
+	});
+	if (code === 0) await machinesBehindNote(deps, home, target);
+	if (code === 0) deps.out(deps.hasHubFile(home) ? `${LINKED_NOTE}\n${LINKED_HUB_NOTE}` : LINKED_NOTE);
+	return code;
+}
+function noRestartNote(deps) {
+	deps.out("Updated. Run `tau restart` to use the new version.");
+	return 0;
+}
+async function machinesBehindNote(deps, home, latest) {
+	try {
+		const line = linkedMachinesLine(await deps.linkedMachines?.(home), latest);
+		if (line) deps.out(line);
+	} catch {}
+}
+async function checkOnly(deps, home, current, latest) {
+	deps.out(`${current} -> ${latest}`);
+	await machinesBehindNote(deps, home, latest);
+	return compareVersions(current, latest) < 0 ? 10 : 0;
+}
+async function latestOrError(deps) {
+	try {
+		return await deps.latestVersion();
+	} catch (error) {
+		deps.err(error instanceof Error ? error.message : String(error));
+		return;
+	}
+}
+/** `tau update`; resolves to the exit code. */
+async function runUpdateWith(deps, argv) {
+	const flags = updateFlagsOf(argv);
+	const home = lifecycleFlagsOf(argv, deps.context).home;
+	const current = deps.version();
+	const latest = await latestOrError(deps);
+	if (latest === void 0) return 1;
+	if (flags.check) return checkOnly(deps, home, current, latest);
+	if (compareVersions(current, latest) >= 0) {
+		deps.out(`tau ${current} is up to date. ${LAG_NOTE}`);
+		return 0;
+	}
+	const plan = await planOf(deps, latest);
+	if (typeof plan === "string") {
+		deps.err(plan);
+		return 1;
+	}
+	if ((await gatherStatus(deps, home)).running === "service" && !flags.noRestart && !flags.force) {
+		const refusal = await refusalForRunningWork(deps, home);
+		if (refusal) {
+			deps.err(refusal);
+			return 1;
+		}
+	}
+	const question = `Install ${current} -> ${latest}${flags.noRestart ? "" : " and restart"}?`;
+	if (!flags.yes) {
+		if (!deps.isTty) {
+			deps.err(NON_TTY_NEEDS_YES);
+			return 1;
+		}
+		if (!await deps.confirm(question)) {
+			deps.out("Cancelled.");
+			return 0;
+		}
+	}
+	const failed = await installStep(deps, plan, current);
+	if (failed) {
+		deps.err(failed);
+		return 1;
+	}
+	return finish(deps, flags, plan, latest, home);
+}
+async function runUpdate(argv) {
+	const { realUpdateDeps } = await import("./real-deps-f96UmLBz.js");
+	process.exitCode = await runUpdateWith(await realUpdateDeps(), argv);
+}
+//#endregion
 //#region src/main.ts
 const apiCommandHandlers = Object.fromEntries(COMMAND_NOUNS.map((noun) => [noun, (argv) => runApiCommand(noun, argv)]));
 /** The one dispatch table: command word to handler. */
@@ -1444,6 +1563,7 @@ const commandTable = {
 	status: runStatus,
 	open: runOpen,
 	logs: runLogs,
+	update: runUpdate,
 	service: runServiceCommand,
 	skill: runSkill,
 	help: runHelp,