@prismshadow/penguin-server 0.1.2 → 0.1.4

package/dist/index.js

@@ -6,7 +6,7 @@ import { serve } from "@hono/node-server";
 import fs16 from "fs";
 import fsp from "fs/promises";
 import path15 from "path";
-import { Hono as Hono20 } from "hono";
+import { Hono as Hono21 } from "hono";
 
 // src/db/database.ts
 import { mkdirSync } from "fs";
@@ -102,6 +102,20 @@ CREATE TABLE IF NOT EXISTS schedule_state (    -- schedule runtime state (files
   invalid_reason  TEXT,                        -- invalidation reason (e.g. the bound Session was deleted); NULL=healthy
   PRIMARY KEY (project_id, agent_id, name)
 );
+CREATE TABLE IF NOT EXISTS goal_state (        -- goal-mode runtime state (GOAL.yaml on disk is the model-facing protocol; this row is what the UI reads)
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,  -- one row per goal run; a Session may run goals repeatedly, latest row wins for display
+  session_id  TEXT NOT NULL,
+  project_id  TEXT NOT NULL,
+  agent_id    TEXT NOT NULL,
+  objective   TEXT NOT NULL,
+  status      TEXT NOT NULL,               -- active | complete | blocked | budget_limited | aborted (aborted is server-side only; on-disk status stays active)
+  budget      INTEGER NOT NULL,            -- token budget; -1 = unlimited
+  used        INTEGER NOT NULL DEFAULT 0,  -- uncached input + output, refreshed per round (mirrors the runner's accounting)
+  rounds      INTEGER NOT NULL DEFAULT 0,
+  created_at  TEXT NOT NULL,
+  updated_at  TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
 CREATE TABLE IF NOT EXISTS ui_prefs (
   user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
   prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
@@ -300,6 +314,10 @@ var ErrorsRepo = class {
       message: r.message
     }));
   }
+  /** Cascading cleanup on Agent deletion (unattributed errors carry no agent_id and are unaffected). */
+  deleteByAgent(projectId, agentId) {
+    this.db.prepare("DELETE FROM error_records WHERE project_id = ? AND agent_id = ?").run(projectId, agentId);
+  }
   /** Cascading cleanup on Project deletion (unattributed errors belong to no Project and are unaffected). */
   deleteByProject(projectId) {
     this.db.prepare("DELETE FROM error_records WHERE project_id = ?").run(projectId);
@@ -385,8 +403,77 @@ var ProjectsRepo = class {
   }
 };
 
-// src/db/repos/schedules.ts
+// src/db/repos/goals.ts
 function mapRow2(r) {
+  return {
+    id: Number(r.id),
+    sessionId: r.session_id,
+    projectId: r.project_id,
+    agentId: r.agent_id,
+    objective: r.objective,
+    status: r.status,
+    budget: Number(r.budget),
+    used: Number(r.used),
+    rounds: Number(r.rounds),
+    createdAt: r.created_at,
+    updatedAt: r.updated_at
+  };
+}
+var GoalsRepo = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  /** Register a new goal run (status active, counters at zero); returns the new row id. */
+  create(args) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = this.db.prepare(
+      `INSERT INTO goal_state
+           (session_id, project_id, agent_id, objective, status, budget, used, rounds, created_at, updated_at)
+         VALUES (?, ?, ?, ?, 'active', ?, 0, 0, ?, ?)`
+    ).run(args.sessionId, args.projectId, args.agentId, args.objective, args.budget, now, now);
+    return Number(result.lastInsertRowid);
+  }
+  /** Per-round progress refresh (round just started; `used` mirrors the runner's accounting so far). */
+  progress(id, rounds, used) {
+    this.db.prepare("UPDATE goal_state SET rounds = ?, used = ?, updated_at = ? WHERE id = ?").run(rounds, used, (/* @__PURE__ */ new Date()).toISOString(), id);
+  }
+  /** Record the terminal outcome. */
+  finish(id, status, rounds, used) {
+    this.db.prepare(
+      "UPDATE goal_state SET status = ?, rounds = ?, used = ?, updated_at = ? WHERE id = ?"
+    ).run(status, rounds, used, (/* @__PURE__ */ new Date()).toISOString(), id);
+  }
+  /** The Session's most recent goal run (what the chat page's banner restores from); null if it never ran one. */
+  latestForSession(sessionId) {
+    const r = this.db.prepare("SELECT * FROM goal_state WHERE session_id = ? ORDER BY id DESC LIMIT 1").get(sessionId);
+    return r ? mapRow2(r) : null;
+  }
+  deleteBySession(sessionId) {
+    this.db.prepare("DELETE FROM goal_state WHERE session_id = ?").run(sessionId);
+  }
+  deleteByAgent(projectId, agentId) {
+    this.db.prepare("DELETE FROM goal_state WHERE project_id = ? AND agent_id = ?").run(projectId, agentId);
+  }
+  deleteByProject(projectId) {
+    this.db.prepare("DELETE FROM goal_state WHERE project_id = ?").run(projectId);
+  }
+  /**
+   * Startup reconciliation: a goal runs only in SessionManager memory, so a hard crash
+   * (SIGKILL, power loss) leaves its row stuck `active` with no runner behind it — the banner
+   * would then restore a forever-"running" goal. Called once at boot, before the server accepts
+   * connections (nothing can be running yet), so every remaining `active` row is an orphan:
+   * mark them `aborted`. The on-disk GOAL.yaml is left `active` as the documented resume point.
+   * Returns the number of rows reconciled.
+   */
+  abortOrphanedActive() {
+    const result = this.db.prepare("UPDATE goal_state SET status = 'aborted', updated_at = ? WHERE status = 'active'").run((/* @__PURE__ */ new Date()).toISOString());
+    return Number(result.changes);
+  }
+};
+
+// src/db/repos/schedules.ts
+function mapRow3(r) {
   return {
     projectId: r.project_id,
     agentId: r.agent_id,
@@ -408,11 +495,11 @@ var SchedulesRepo = class {
   db;
   find(projectId, agentId, name) {
     const r = this.db.prepare("SELECT * FROM schedule_state WHERE project_id = ? AND agent_id = ? AND name = ?").get(projectId, agentId, name);
-    return r ? mapRow2(r) : null;
+    return r ? mapRow3(r) : null;
   }
   listByAgent(projectId, agentId) {
     const rows = this.db.prepare("SELECT * FROM schedule_state WHERE project_id = ? AND agent_id = ? ORDER BY name").all(projectId, agentId);
-    return rows.map((r) => mapRow2(r));
+    return rows.map((r) => mapRow3(r));
   }
   /**
    * Register or sync a task's runtime state, returning the synced row plus a `fresh`
@@ -507,13 +594,16 @@ var SchedulesRepo = class {
     }
     return removed;
   }
+  deleteByAgent(projectId, agentId) {
+    this.db.prepare("DELETE FROM schedule_state WHERE project_id = ? AND agent_id = ?").run(projectId, agentId);
+  }
   deleteByProject(projectId) {
     this.db.prepare("DELETE FROM schedule_state WHERE project_id = ?").run(projectId);
   }
 };
 
 // src/db/repos/sessions.ts
-function mapRow3(r) {
+function mapRow4(r) {
   return {
     sessionId: r.session_id,
     projectId: r.project_id,
@@ -567,15 +657,15 @@ var SessionsRepo = class {
   }
   findById(sessionId) {
     const r = this.db.prepare("SELECT * FROM sessions WHERE session_id = ?").get(sessionId);
-    return r ? mapRow3(r) : null;
+    return r ? mapRow4(r) : null;
   }
   listByAgent(projectId, agentId) {
     const rows = this.db.prepare("SELECT * FROM sessions WHERE project_id = ? AND agent_id = ?").all(projectId, agentId);
-    return rows.map(mapRow3);
+    return rows.map(mapRow4);
   }
   listByProject(projectId) {
     const rows = this.db.prepare("SELECT * FROM sessions WHERE project_id = ?").all(projectId);
-    return rows.map(mapRow3);
+    return rows.map(mapRow4);
   }
   updateApprovalMode(sessionId, mode) {
     this.db.prepare("UPDATE sessions SET approval_mode = ? WHERE session_id = ?").run(mode, sessionId);
@@ -780,7 +870,7 @@ var UsageRepo = class {
 };
 
 // src/db/repos/users.ts
-function mapRow4(r) {
+function mapRow5(r) {
   return {
     userId: r.user_id,
     passwordHash: r.password_hash,
@@ -807,12 +897,12 @@ var UsersRepo = class {
   }
   findById(userId) {
     const r = this.db.prepare("SELECT * FROM users WHERE user_id = ?").get(userId);
-    return r ? mapRow4(r) : null;
+    return r ? mapRow5(r) : null;
   }
   /** All users (for the admin user backend), ordered by creation time ascending. */
   list() {
     const rows = this.db.prepare("SELECT * FROM users ORDER BY created_at ASC, user_id ASC").all();
-    return rows.map(mapRow4);
+    return rows.map(mapRow5);
   }
   count() {
     const r = this.db.prepare("SELECT COUNT(*) AS n FROM users").get();
@@ -1514,6 +1604,12 @@ function membersRoutes(deps2) {
 
 // src/http/routes/models.ts
 import { Hono as Hono7 } from "hono";
+function publishCredentialsUpdated(deps2, projectId) {
+  const event = { type: "credentials_updated" };
+  for (const row of deps2.sessionsRepo.listByProject(projectId)) {
+    deps2.channels.peek(row.sessionId)?.publish(event, "server_event");
+  }
+}
 function parseRef(value, label) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw badRequest(`${label} must be a { provider, modelId } object.`);
@@ -1633,7 +1729,10 @@ function modelsRoutes(deps2) {
     const projectId = requireValidId(c, "projectId");
     deps2.projectService.requireProjectOwner(c.var.user.userId, projectId);
     const req = parseModelsUpdate(await readJson(c));
-    return c.json(await deps2.projectConfigService.updateModels(projectId, req));
+    const res = await deps2.projectConfigService.updateModels(projectId, req);
+    deps2.manager.invalidateProjectRuntimes(projectId);
+    publishCredentialsUpdated(deps2, projectId);
+    return c.json(res);
   });
   app2.post("/test", async (c) => {
     const projectId = requireValidId(c, "projectId");
@@ -2305,6 +2404,9 @@ function agentsRoutes(deps2) {
       await settleWithin(runnings, 5e3);
       await deps2.agentService.deleteAgent(projectId, agentId);
       deps2.sessionsRepo.deleteByAgent(projectId, agentId);
+      deps2.goalsRepo.deleteByAgent(projectId, agentId);
+      deps2.schedulesRepo.deleteByAgent(projectId, agentId);
+      deps2.errorsRepo.deleteByAgent(projectId, agentId);
     } finally {
       deps2.manager.endAgentDeletion(projectId, agentId);
     }
@@ -2410,6 +2512,7 @@ function agentConfigRoutes(deps2) {
 
 // src/http/routes/agent-traces.ts
 import { Hono as Hono16 } from "hono";
+var MAX_TRACE_BYTES = 14 * 1024 * 1024;
 function agentTracesRoutes(deps2) {
   const app2 = new Hono16();
   app2.get("/", async (c) => {
@@ -2437,6 +2540,41 @@ function agentTracesRoutes(deps2) {
     const index = positiveIntParam(c, "index");
     return c.json(await deps2.traceService.analyze(projectId, agentId, sessionId, index));
   });
+  app2.get("/:sessionId/:index/download", async (c) => {
+    const projectId = requireValidId(c, "projectId");
+    const agentId = requireValidId(c, "agentId");
+    const sessionId = requireValidId(c, "sessionId");
+    deps2.projectService.requireProjectAccess(c.var.user.userId, projectId);
+    const index = positiveIntParam(c, "index");
+    const bytes = await deps2.traceService.readFileRaw(projectId, agentId, sessionId, index);
+    const fileName = `${sessionId}_${String(index).padStart(3, "0")}.jsonl`;
+    return new Response(new Uint8Array(bytes), {
+      headers: {
+        "Content-Type": "application/x-ndjson",
+        "Content-Disposition": `attachment; filename*=UTF-8''${encodeURIComponent(fileName)}`,
+        "X-Content-Type-Options": "nosniff"
+      }
+    });
+  });
+  app2.post("/import", async (c) => {
+    const projectId = requireValidId(c, "projectId");
+    const agentId = requireValidId(c, "agentId");
+    deps2.projectService.requireProjectOwner(c.var.user.userId, projectId);
+    await deps2.agentConfigService.requireExists(projectId, agentId);
+    const body = await readJson(c);
+    const dataBase64 = requireString(body, "dataBase64", { minLen: 1, maxLen: 20 * 1024 * 1024 });
+    const bytes = Buffer.from(dataBase64, "base64");
+    if (bytes.byteLength === 0) throw badRequest("Import file is empty.");
+    if (bytes.byteLength > MAX_TRACE_BYTES) {
+      throw badRequest("Import file exceeds the 14MB limit.");
+    }
+    const res = await deps2.traceService.importTraceFile(
+      projectId,
+      agentId,
+      bytes.toString("utf8")
+    );
+    return c.json(res);
+  });
   return app2;
 }
 
@@ -2735,6 +2873,10 @@ var WorkspaceFilesService = class {
     }
     const { dir, name } = await this.resolveWriteParent(workspace, rel);
     const file = path5.join(dir, name);
+    if (process.platform === "win32") {
+      const st = await fs6.lstat(file).catch(() => null);
+      if (st?.isSymbolicLink()) throw badRequest("path must not be a symlink.");
+    }
     const flags = fsc.O_WRONLY | fsc.O_CREAT | fsc.O_TRUNC | (fsc.O_NOFOLLOW ?? 0);
     let handle;
     try {
@@ -2798,6 +2940,18 @@ function parseTaskInput(body) {
     throw badRequest(`input[${i}].type must be one of text / image_url.`);
   });
 }
+function parseGoalField(body) {
+  const goal = body.goal;
+  if (goal === void 0) return null;
+  if (goal === null || typeof goal !== "object" || Array.isArray(goal)) {
+    throw badRequest("goal must be an object.");
+  }
+  const budget = goal.budget;
+  if (budget !== void 0 && (typeof budget !== "number" || !Number.isInteger(budget) || budget <= 0 && budget !== -1)) {
+    throw badRequest("goal.budget must be a positive integer, or -1 for unlimited.");
+  }
+  return { budget: budget ?? -1 };
+}
 function agentSessionsRoutes(deps2) {
   const app2 = new Hono18();
   app2.get("/", async (c) => {
@@ -2952,6 +3106,7 @@ function sessionsRoutes(deps2) {
         { recursive: true, force: true }
       );
       deps2.sessionsRepo.deleteById(row.sessionId);
+      deps2.goalsRepo.deleteBySession(row.sessionId);
       deps2.sessionSources.delete(row.sessionId);
     } finally {
       deps2.manager.endSessionDeletion(row.sessionId);
@@ -2990,12 +3145,19 @@ function sessionsRoutes(deps2) {
   });
   app2.get("/:sessionId/messages", async (c) => {
     const row = resolveSession(c);
+    let live;
+    if (deps2.manager.statusOf(row.sessionId) !== "idle") {
+      live = {
+        cursor: deps2.channels.get(row.sessionId).lastEventId,
+        fragments: deps2.manager.liveFragments(row.sessionId)
+      };
+    }
     const messages = await deps2.traceService.readMessages(
       row.projectId,
       row.agentId,
       row.sessionId
     );
-    return c.json({ messages });
+    return c.json({ messages, ...live !== void 0 ? { live } : {} });
   });
   app2.get("/:sessionId/stream", (c) => {
     const row = resolveSession(c);
@@ -3017,8 +3179,22 @@ function sessionsRoutes(deps2) {
   app2.post("/:sessionId/tasks", async (c) => {
     const row = resolveSession(c);
     const body = await readJson(c);
-    const input = parseTaskInput(body);
+    const goal = parseGoalField(body);
     const thinkingLevel = optionalEnum(body, "thinkingLevel", THINKING_LEVELS);
+    if (goal) {
+      const input2 = parseTaskInput(body);
+      const text = input2.filter((m) => m.payload.type === "text").map((m) => m.payload.text).join("\n").trim();
+      if (!text || input2.some((m) => m.payload.type !== "text")) {
+        throw badRequest("goal mode requires text-only input (the objective).");
+      }
+      const { sessionId: sessionId2 } = await deps2.manager.startGoal(row.sessionId, {
+        input: input2,
+        budget: goal.budget,
+        ...thinkingLevel !== void 0 ? { thinkingLevel } : {}
+      });
+      return c.json({ sessionId: sessionId2 }, 202);
+    }
+    const input = parseTaskInput(body);
     const queueIfBusy = body.queueIfBusy === true;
     const { sessionId, queued } = await deps2.manager.startTask(row.sessionId, input, {
       ...thinkingLevel !== void 0 ? { thinkingLevel } : {},
@@ -3034,6 +3210,20 @@ function sessionsRoutes(deps2) {
     deps2.manager.steer(row.sessionId, text);
     return c.body(null, 202);
   });
+  app2.get("/:sessionId/goal", (c) => {
+    const row = resolveSession(c);
+    const g = deps2.goalsRepo.latestForSession(row.sessionId);
+    return c.json({
+      goal: g ? {
+        objective: g.objective,
+        status: g.status,
+        budget: g.budget,
+        used: g.used,
+        rounds: g.rounds,
+        updatedAt: g.updatedAt
+      } : null
+    });
+  });
   app2.post("/:sessionId/approvals/:toolCallId", async (c) => {
     const row = resolveSession(c);
     const body = await readJson(c);
@@ -3053,6 +3243,11 @@ function sessionsRoutes(deps2) {
     const aborted = deps2.manager.abortTask(row.sessionId);
     return c.body(null, aborted ? 202 : 204);
   });
+  app2.post("/:sessionId/retry-now", (c) => {
+    const row = resolveSession(c);
+    const skipped = deps2.manager.retryNow(row.sessionId);
+    return c.json({ skipped });
+  });
   app2.post("/:sessionId/compact", async (c) => {
     const row = resolveSession(c);
     const { sessionId } = await deps2.manager.startCompact(row.sessionId);
@@ -3167,6 +3362,104 @@ function sessionsRoutes(deps2) {
   return app2;
 }
 
+// src/http/routes/version.ts
+import { spawn } from "child_process";
+import { BUILD_DATE, VERSION } from "@prismshadow/penguin-core";
+import { Hono as Hono19 } from "hono";
+var OUTPUT_CAP = 64 * 1024;
+var UPDATE_TIMEOUT_MS = 10 * 60 * 1e3;
+var REFUSAL_MARKERS = [
+  "runs from a source checkout",
+  // sourceCheckout
+  "Cannot tell how this penguin was installed",
+  // unknownInstall
+  "could not be identified",
+  // npmUnknownManager
+  "does not run on Windows",
+  // windowsUnsupported
+  "cannot run your package manager for you"
+  // windowsGlobalInstall
+];
+function classifyUpdateRun(exitCode, output) {
+  if (exitCode !== 0) return { status: "failed", output, needsRestart: false };
+  if (REFUSAL_MARKERS.some((marker) => output.includes(marker))) {
+    return { status: "unsupported", output, needsRestart: false };
+  }
+  return { status: "updated", output, needsRestart: true };
+}
+function runSelfUpdate(cliEntry) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [cliEntry, "update", "--yes"], {
+      env: { ...process.env, PENGUIN_LANG: "en" },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let output = "";
+    const append = (chunk) => {
+      output = (output + chunk.toString("utf8")).slice(-OUTPUT_CAP);
+    };
+    child.stdout.on("data", append);
+    child.stderr.on("data", append);
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 1e4).unref();
+    }, UPDATE_TIMEOUT_MS);
+    timer.unref();
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      resolve({
+        status: "failed",
+        output: `${output}
+[failed to run the update command: ${err.message}]`.trim(),
+        needsRestart: false
+      });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (timedOut) {
+        resolve({
+          status: "failed",
+          output: `${output}
+[the update run was killed after ${UPDATE_TIMEOUT_MS / 6e4} minutes]`.trim(),
+          needsRestart: false
+        });
+        return;
+      }
+      resolve(classifyUpdateRun(code ?? -1, output.trim()));
+    });
+  });
+}
+function versionRoutes(deps2) {
+  const app2 = new Hono19();
+  let inflightRun = null;
+  app2.get("/", (c) => {
+    return c.json({ version: VERSION, buildDate: BUILD_DATE });
+  });
+  app2.get("/update-check", async (c) => {
+    return c.json(await deps2.updateCheck.check(c.req.query("force") === "1"));
+  });
+  app2.post("/update", async (c) => {
+    if (!c.var.user.isAdmin) {
+      throw new HttpError(403, "admin_required", "Only an admin can perform this operation.");
+    }
+    const cliEntry = process.env.PENGUIN_CLI_ENTRY;
+    if (!cliEntry) {
+      return c.json({
+        status: "unsupported",
+        reason: "not_launched_via_cli",
+        output: "",
+        needsRestart: false
+      });
+    }
+    inflightRun ??= runSelfUpdate(cliEntry).finally(() => {
+      inflightRun = null;
+    });
+    return c.json(await inflightRun);
+  });
+  return app2;
+}
+
 // src/runtime/channel.ts
 import { randomUUID } from "crypto";
 var DEFAULT_MAX_COUNT = 1e4;
@@ -3191,6 +3484,16 @@ var Channel = class {
   get subscriberCount() {
     return this.listeners.size;
   }
+  /**
+   * Id of the most recently assigned event (`<epoch>-<seq>`; seq 0 when none was assigned
+   * yet). Unicast (sendTo) seqs count too — the value is a position marker, not a buffer
+   * lookup key. Used as the live-tail cursor on GET /messages: captured in the same
+   * synchronous tick as the fragment snapshot, it tells the client which buffered events
+   * the snapshot already covers.
+   */
+  get lastEventId() {
+    return `${this.epoch}-${this.nextSeq - 1}`;
+  }
   /** Broadcast an event: number it, buffer it (evicting the oldest), notify all subscribers. */
   publish(data, event) {
     const entry = this.makeEvent(data, event);
@@ -3363,7 +3666,11 @@ import path8 from "path";
 import {
   createAgent,
   findLatestTraceFile,
+  goalFinishedOf,
+  goalTokenDelta,
+  isGoalRoundInput,
   isSessionMeta as isSessionMeta2,
+  stripLeadingMarkerBlocks,
   tracesDir
 } from "@prismshadow/penguin-core";
 
@@ -3434,6 +3741,165 @@ function makeApprove(args) {
   };
 }
 
+// src/runtime/live-tail.ts
+import { isPartialPayload } from "@prismshadow/penguin-core";
+var FRAGMENT_CAP = 512 * 1024;
+var FRAGMENT_CAP_SLACK = 64 * 1024;
+function partialKindFor(p) {
+  switch (p.type) {
+    case "text":
+      return p.role === "assistant" ? "partial_text" : null;
+    case "thinking":
+      return "partial_thinking";
+    case "tool_call":
+      return "partial_tool_call";
+    case "tool_call_output":
+      return "partial_tool_call_output";
+    default:
+      return null;
+  }
+}
+function fragmentKey(origin, kind, toolCallId) {
+  return `${(origin ?? []).join("/")}\0${kind}::${toolCallId}`;
+}
+function toolCallIdOf(p) {
+  const id = p.tool_call_id;
+  return typeof id === "string" ? id : "";
+}
+function appendDelta(frag, p) {
+  switch (p.type) {
+    case "partial_text":
+      frag.buffer += p.text;
+      break;
+    case "partial_thinking":
+      frag.buffer += p.thinking;
+      break;
+    case "partial_tool_call":
+      frag.buffer += p.arguments;
+      if (p.name) frag.name = p.name;
+      frag.toolCallId = p.tool_call_id;
+      break;
+    case "partial_tool_call_output":
+      frag.buffer += p.output;
+      if (p.images && p.images.length > 0) frag.images = p.images;
+      frag.toolCallId = p.tool_call_id;
+      break;
+  }
+  if (frag.buffer.length > FRAGMENT_CAP + FRAGMENT_CAP_SLACK) {
+    frag.buffer = frag.buffer.slice(frag.buffer.length - FRAGMENT_CAP);
+  }
+}
+function startPayload(frag) {
+  switch (frag.kind) {
+    case "partial_text":
+      return { type: "partial_text", role: "assistant", event_type: "start", text: frag.buffer };
+    case "partial_thinking":
+      return {
+        type: "partial_thinking",
+        role: "assistant",
+        event_type: "start",
+        thinking: frag.buffer
+      };
+    case "partial_tool_call":
+      return {
+        type: "partial_tool_call",
+        role: "assistant",
+        event_type: "start",
+        name: frag.name ?? "",
+        arguments: frag.buffer,
+        tool_call_id: frag.toolCallId ?? ""
+      };
+    case "partial_tool_call_output":
+      return {
+        type: "partial_tool_call_output",
+        role: "user",
+        event_type: "start",
+        output: frag.buffer,
+        ...frag.images !== void 0 && frag.images.length > 0 ? { images: frag.images } : {},
+        tool_call_id: frag.toolCallId ?? ""
+      };
+  }
+}
+var LiveTailTracker = class {
+  /** sessionId → open fragments keyed by fragmentKey, in the order they were opened. */
+  sessions = /* @__PURE__ */ new Map();
+  /** Feed one published message (call in the same synchronous tick as the channel publish). */
+  observe(sessionId, msg) {
+    if (msg.type !== "model_msg") return;
+    const p = msg.payload;
+    if (!isPartialPayload(p)) {
+      const kind = partialKindFor(p);
+      if (kind === null) return;
+      const open3 = this.sessions.get(sessionId);
+      if (!open3) return;
+      open3.delete(fragmentKey(msg.origin, kind, toolCallIdOf(p)));
+      if (open3.size === 0) this.sessions.delete(sessionId);
+      return;
+    }
+    const key = fragmentKey(msg.origin, p.type, toolCallIdOf(p));
+    let open2 = this.sessions.get(sessionId);
+    if (p.event_type === "start") {
+      if (!open2) {
+        open2 = /* @__PURE__ */ new Map();
+        this.sessions.set(sessionId, open2);
+      }
+      const frag2 = {
+        kind: p.type,
+        timestamp: msg.timestamp,
+        buffer: "",
+        ...msg.origin && msg.origin.length > 0 ? { origin: [...msg.origin] } : {}
+      };
+      open2.delete(key);
+      open2.set(key, frag2);
+      appendDelta(frag2, p);
+      return;
+    }
+    let frag = open2?.get(key);
+    if (!frag) {
+      if (p.event_type === "stop") return;
+      if (!open2) {
+        open2 = /* @__PURE__ */ new Map();
+        this.sessions.set(sessionId, open2);
+      }
+      frag = {
+        kind: p.type,
+        timestamp: msg.timestamp,
+        buffer: "",
+        ...msg.origin && msg.origin.length > 0 ? { origin: [...msg.origin] } : {}
+      };
+      open2.set(key, frag);
+    }
+    appendDelta(frag, p);
+    if (p.event_type === "stop") {
+      open2.delete(key);
+      if (open2.size === 0) this.sessions.delete(sessionId);
+    }
+  }
+  /**
+   * Synthetic `partial_* start` messages for every open fragment (in open order), each
+   * carrying the full accumulated content, the original origin chain, and the original
+   * start timestamp. Empty when the session has no open fragments.
+   */
+  fragments(sessionId) {
+    const open2 = this.sessions.get(sessionId);
+    if (!open2) return [];
+    const out = [];
+    for (const frag of open2.values()) {
+      out.push({
+        timestamp: frag.timestamp,
+        type: "model_msg",
+        payload: startPayload(frag),
+        ...frag.origin !== void 0 ? { origin: [...frag.origin] } : {}
+      });
+    }
+    return out;
+  }
+  /** Drop all fragment state for a session (the run ended; nothing will continue these fragments). */
+  clear(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+};
+
 // src/runtime/session-sources.ts
 function asSessionSource(v) {
   return v === "schedule" || v === "subagent" ? v : void 0;
@@ -3461,6 +3927,9 @@ var TOOL_NAMES_MAX = 1e3;
 var ORIGIN_CTX_MAX = 200;
 var LLM_FAILURES = {
   failed: { code: "llm_failed", kind: "unexpected", text: "LLM request failed (not retryable)." },
+  // Credentials rejection shares the failed bucket (no new taxonomy): same code/kind, the
+  // real reason arrives via the abort reason or the event's own message as usual.
+  auth: { code: "llm_failed", kind: "unexpected", text: "LLM request failed (not retryable)." },
   timeout: {
     code: "llm_timeout",
     kind: "expected",
@@ -3473,7 +3942,7 @@ var LLM_FAILURES = {
   }
 };
 function isLlmFailure(s) {
-  return s === "failed" || s === "timeout" || s === "malformed";
+  return s === "failed" || s === "timeout" || s === "malformed" || s === "auth";
 }
 function isToolFailure(s) {
   return s === "failed" || s === "timeout";
@@ -3497,7 +3966,7 @@ var StreamErrorWatcher = class {
   }
   errors;
   ctx;
-  /** LLM failures awaiting a real reason: origin → failure state (see file header; each session has at most one in-flight Request). */
+  /** LLM failures awaiting a real reason: origin → failure state + the request_end's own detail (see file header; each session has at most one in-flight Request). */
   pending = /* @__PURE__ */ new Map();
   /** Names of in-flight tool calls: `origin \0 tool_call_id` → tool name (dequeued once output arrives). */
   toolNames = /* @__PURE__ */ new Map();
@@ -3561,7 +4030,14 @@ var StreamErrorWatcher = class {
     const key = originKey(msg);
     if (p.type === "request_end") {
       this.flush(key);
-      if (isLlmFailure(p.status)) this.pending.set(key, p.status);
+      if (isLlmFailure(p.status)) {
+        this.pending.set(key, {
+          status: p.status,
+          // The event's own failure detail (LLMOutcome.message): the message of record when
+          // no abort follows (the retry path).
+          ...typeof p.message === "string" && p.message.trim() ? { message: p.message } : {}
+        });
+      }
       return;
     }
     if (p.type === "request_begin") {
@@ -3579,12 +4055,12 @@ var StreamErrorWatcher = class {
    * up from it (see file header).
    */
   flush(key, reason) {
-    const status = this.pending.get(key);
-    if (status === void 0) return;
+    const entry = this.pending.get(key);
+    if (entry === void 0) return;
     this.pending.delete(key);
-    const spec = LLM_FAILURES[status];
+    const spec = LLM_FAILURES[entry.status];
     const trimmed = reason?.trim();
-    const message = trimmed && !isUserAbortReason(trimmed) ? trimmed : spec.text;
+    const message = trimmed && !isUserAbortReason(trimmed) ? trimmed : entry.message ?? spec.text;
     this.errors.record({
       source: "llm",
       err: message,
@@ -3748,6 +4224,8 @@ var SessionManager = class {
   deletingSessions = /* @__PURE__ */ new Set();
   /** Per-Agent config generation (key = agentKey), bumped by invalidateAgentRuntimes on vault updates. */
   agentGenerations = /* @__PURE__ */ new Map();
+  /** Open streaming fragments of running sessions (fed by drive, served to GET /messages; see live-tail.ts). */
+  liveTail = new LiveTailTracker();
   sweepTimer;
   // —— Query surface (used by Session listing / Agent active-count / SSE subscription replay) ——
   statusOf(sessionId) {
@@ -3763,6 +4241,15 @@ var SessionManager = class {
   pendingFollowUpCount(sessionId) {
     return this.entries.get(sessionId)?.followUps.length ?? 0;
   }
+  /**
+   * Live tail of a running session: one synthetic `partial_* start` OmniMessage per open
+   * streaming fragment, carrying the full accumulated content so far (see live-tail.ts).
+   * Empty when idle or when nothing is streaming. GET /messages attaches this (with a
+   * channel cursor) so a client joining mid-stream can render the in-progress message.
+   */
+  liveFragments(sessionId) {
+    return this.liveTail.fragments(sessionId);
+  }
   /** Number of Sessions for this Agent that are currently running / compacting. */
   activeCountForAgent(projectId, agentId) {
     let n = 0;
@@ -3802,6 +4289,21 @@ var SessionManager = class {
     const key = agentKey(projectId, agentId);
     this.agentGenerations.set(key, this.generationOf(projectId, agentId) + 1);
   }
+  /**
+   * After a Project's models/credentials change: invalidate every cached runtime in this
+   * Project, so the next Task re-resumes with the new api_key / base_url. Same
+   * effective-value semantics as invalidateAgentRuntimes — no hot swap into a Task already
+   * in flight. Iterating the active table is complete here, not a shortcut: the generation
+   * map only matters for runtimes that are already cached, and an Agent with no cached
+   * entry builds fresh through the loader anyway.
+   */
+  invalidateProjectRuntimes(projectId) {
+    const agentIds = /* @__PURE__ */ new Set();
+    for (const e of this.entries.values()) {
+      if (e.projectId === projectId) agentIds.add(e.agentId);
+    }
+    for (const agentId of agentIds) this.invalidateAgentRuntimes(projectId, agentId);
+  }
   // —— Task / compaction drive ——
   /**
    * Start a Task: get-or-load → 409
@@ -3834,6 +4336,135 @@ var SessionManager = class {
       return { sessionId: entry.sessionId, queued: false };
     });
   }
+  /**
+   * Start a goal run: like startTask, but the run is core goal mode — one
+   * `session.run(input, { goal })` call loops rounds until a terminal state, and the
+   * Session stays `running` for the whole goal (every round), so the existing abort
+   * endpoint interrupts the entire loop and schedules queue behind it as usual. Round
+   * inputs are yielded by core and published like any streamed message; progress
+   * additionally goes out as goal_* server events and into goal_state (when a repo is
+   * wired).
+   */
+  async startGoal(sessionId, args) {
+    return this.withLock(sessionId, async () => {
+      this.assertOpen();
+      this.assertAgentNotDeleting(sessionId);
+      this.assertSessionNotDeleting(sessionId);
+      const entry = await this.ensureEntry(sessionId);
+      this.assertIdle(entry);
+      const text = args.input.filter(isPlainText("user")).map((m) => m.payload.text).join("\n");
+      const objective = stripLeadingMarkerBlocks(text).trim() || text.trim();
+      const ac = new AbortController();
+      entry.status = "running";
+      entry.abort = ac;
+      entry.lastActivityMs = Date.now();
+      this.publishState(entry, "running");
+      const approve = makeApprove({
+        getMode: () => this.deps.sessions.findById(entry.sessionId)?.approvalMode ?? "always-ask",
+        toolPermission: (name) => entry.session.toolPermission(name),
+        registry: entry.approvals,
+        publishRequest: (pending) => this.publishEvent(entry, {
+          type: "approval_request",
+          toolCall: pending.toolCall,
+          ...pending.origin !== void 0 ? { origin: pending.origin } : {}
+        })
+      });
+      const goalId = this.deps.goals?.create({
+        sessionId: entry.sessionId,
+        projectId: entry.projectId,
+        agentId: entry.agentId,
+        objective,
+        budget: args.budget
+      });
+      this.publishEvent(entry, {
+        type: "goal_started",
+        sessionId: entry.sessionId,
+        objective,
+        budget: args.budget
+      });
+      const gen = this.goalStream(entry, {
+        input: args.input,
+        budget: args.budget,
+        ...args.thinkingLevel !== void 0 ? { thinkingLevel: args.thinkingLevel } : {},
+        approve,
+        signal: ac.signal,
+        ...goalId !== void 0 ? { goalId } : {}
+      });
+      entry.running = this.drive(entry, gen, { userExcerpt: objective });
+      return { sessionId: entry.sessionId };
+    });
+  }
+  /**
+   * Taps core's goal-mode stream for `drive`: round boundaries (the injected `[goal]`
+   * inputs) become goal_round events + goal_state refreshes, and the terminal
+   * `goal_finished` event message becomes the goal_finished server event + the run-state
+   * row's final status. Token numbers mirror core's own accounting (same
+   * `goalTokenDelta`), so the UI shows exactly what the budget check uses.
+   */
+  async *goalStream(entry, args) {
+    const gen = entry.session.run(args.input, {
+      approve: args.approve,
+      signal: args.signal,
+      ...args.thinkingLevel !== void 0 ? { thinkingLevel: args.thinkingLevel } : {},
+      goal: { budget: args.budget }
+    });
+    let round = 0;
+    let used = 0;
+    let finished = false;
+    try {
+      for await (const msg of gen) {
+        used += goalTokenDelta(msg);
+        if (isGoalRoundInput(msg)) {
+          round++;
+          if (args.goalId !== void 0) this.deps.goals?.progress(args.goalId, round, used);
+          this.publishEvent(entry, {
+            type: "goal_round",
+            sessionId: entry.sessionId,
+            round,
+            used,
+            budget: args.budget
+          });
+        }
+        const outcome = goalFinishedOf(msg);
+        if (outcome) {
+          finished = true;
+          if (args.goalId !== void 0) {
+            this.deps.goals?.finish(
+              args.goalId,
+              outcome.outcome,
+              outcome.rounds,
+              outcome.tokensUsed
+            );
+          }
+          this.publishEvent(entry, {
+            type: "goal_finished",
+            sessionId: entry.sessionId,
+            outcome: outcome.outcome,
+            rounds: outcome.rounds,
+            used: outcome.tokensUsed
+          });
+        }
+        yield msg;
+      }
+      if (!finished) {
+        this.finishAborted(entry, args.goalId, round, used);
+      }
+    } catch (err) {
+      if (!finished) this.finishAborted(entry, args.goalId, round, used);
+      throw err;
+    }
+  }
+  /** Closes a goal's run state as aborted (stream cut off / infrastructure failure). */
+  finishAborted(entry, goalId, round, used) {
+    if (goalId !== void 0) this.deps.goals?.finish(goalId, "aborted", round, used);
+    this.publishEvent(entry, {
+      type: "goal_finished",
+      sessionId: entry.sessionId,
+      outcome: "aborted",
+      rounds: round,
+      used
+    });
+  }
   /** Shared task launch (fresh tasks and auto-started follow-ups): flips to running, publishes the input, and drives the run with the per-turn thinking level (if any). Caller holds the session lock and has verified idle. */
   launchTask(entry, input, thinkingLevel) {
     const channel = this.deps.channels.get(entry.sessionId);
@@ -3929,6 +4560,21 @@ var SessionManager = class {
     }
     entry.lastActivityMs = Date.now();
   }
+  /**
+   * "Retry now" on the reconnect countdown: skip the in-progress backoff wait and fire
+   * the next retry immediately (the attempt counter is unchanged — the skipped wait does
+   * not consume an extra attempt). Returns false as a benign no-op when the session has
+   * no active runtime or no reconnect wait is in progress — timing races (the wait
+   * elapsed right before the click) must not surface as errors. Mirrors the steer seam:
+   * manager → RuntimeSession → core Session → engine.
+   */
+  retryNow(sessionId) {
+    const entry = this.entries.get(sessionId);
+    if (!entry || entry.status === "idle") return false;
+    const skipped = entry.session.skipReconnectWait();
+    if (skipped) entry.lastActivityMs = Date.now();
+    return skipped;
+  }
   /**
    * Interrupt the current Task/compaction: pending approvals converge to deny first,
    * then the AbortSignal fires. Returns false if nothing is in progress (the route
@@ -4204,6 +4850,7 @@ var SessionManager = class {
             }
           }
         }
+        this.liveTail.observe(entry.sessionId, msg);
         this.deps.channels.get(entry.sessionId).publish(msg);
         watcher?.observe(msg);
         try {
@@ -4220,6 +4867,7 @@ var SessionManager = class {
       this.deps.errors?.record({ source: "session", err, ctx, code: "session_run_failed" });
     } finally {
       watcher?.close();
+      this.liveTail.clear(entry.sessionId);
       entry.approvals.denyAll();
       entry.status = "idle";
       entry.abort = null;
@@ -4890,6 +5538,19 @@ var ProjectConfigService = class {
   filePath(projectId) {
     return projectConfigPath(this.root, projectId);
   }
+  /**
+   * When the Project config (models/credentials) last changed: the config file's mtime as
+   * ISO — an honest persistent source that survives server restarts (every models update
+   * rewrites the file). undefined when the file doesn't exist yet.
+   */
+  async configUpdatedAt(projectId) {
+    try {
+      const st = await fs9.stat(this.filePath(projectId));
+      return st.mtime.toISOString();
+    } catch {
+      return void 0;
+    }
+  }
   /** Reads the raw TOML object; returns an empty object if the file doesn't exist (does not write to disk). */
   async readRaw(projectId) {
     let raw;
@@ -5107,9 +5768,11 @@ var ProjectConfigService = class {
       provider: ref.provider,
       modelId: ref.model_id
     });
+    const updatedAt = await this.configUpdatedAt(projectId);
     return {
       ...defaultRef !== void 0 ? { defaultModel: toDto(defaultRef) } : {},
       ...visionRef !== void 0 ? { visionModel: toDto(visionRef) } : {},
+      ...updatedAt !== void 0 ? { updatedAt } : {},
       models
     };
   }
@@ -6231,6 +6894,7 @@ var ProjectService = class {
     this.deps.usage.deleteByProject(projectId);
     this.deps.errors.deleteByProject(projectId);
     this.deps.schedules.deleteByProject(projectId);
+    this.deps.goals.deleteByProject(projectId);
     await fs14.rm(projectDir(this.deps.root, projectId), { recursive: true, force: true });
   }
   // —— Member authorization ——
@@ -6674,11 +7338,14 @@ import fs15 from "fs/promises";
 import path14 from "path";
 import {
   agentsDir as agentsDir3,
+  isSessionMeta as isSessionMeta5,
+  parseTraceLines as parseTraceLines2,
   parseUserSteeringText,
   readTraceTolerant as readTraceTolerant2,
   tracesDir as tracesDir3
 } from "@prismshadow/penguin-core";
 var TRACE_FILE_RE2 = /^(.+)_(\d{3})\.jsonl$/;
+var IMPORT_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 var MAX_SUBAGENT_DEPTH = 4;
 function subagentPointer(msg) {
   if (msg.type !== "event_msg") return null;
@@ -7088,6 +7755,10 @@ var TraceService = class {
     return out;
   }
   async readFileByIndex(projectId, agentId, sessionId, index) {
+    const file = await this.locateByIndex(projectId, agentId, sessionId, index);
+    return readTraceTolerant2(file.path);
+  }
+  async locateByIndex(projectId, agentId, sessionId, index) {
     const files = await this.locateAll(projectId, agentId, sessionId);
     const file = files.find((f) => f.index === index);
     if (!file) {
@@ -7097,7 +7768,165 @@ var TraceService = class {
         `This Session has no Trace file with index ${index}.`
       );
     }
-    return readTraceTolerant2(file.path);
+    return file;
+  }
+  /** Raw bytes of the Trace file at the given index (export/download: the file is served verbatim). */
+  async readFileRaw(projectId, agentId, sessionId, index) {
+    const file = await this.locateByIndex(projectId, agentId, sessionId, index);
+    return fs15.readFile(file.path);
+  }
+  /**
+   * Imports an uploaded Trace file (raw JSONL content). Validates the content itself —
+   * parseable JSONL whose first record is a `session_meta` carrying a filename-safe
+   * `session_id` (400 invalid_trace otherwise) — then writes it under the Agent's traces
+   * directory as a **new Session**: a session id the Agent already has is rejected with
+   * 409 `trace_session_exists` (splicing a further index into an existing Session would
+   * corrupt its concatenated transcript, silently become its resume point, and could
+   * collide with a live Writer's rotation), so the imported file is always index 1. The
+   * date dir comes from the first record's timestamp (falling back to now), formatted as
+   * a **local** date — the same convention as core's Trace Writer — so an export →
+   * import round-trip lands in the same date dir on non-UTC servers.
+   */
+  async importTraceFile(projectId, agentId, content) {
+    const invalid = (message) => new HttpError(400, "invalid_trace", message);
+    let records;
+    try {
+      records = parseTraceLines2(content);
+    } catch {
+      throw invalid("The file is not valid Trace JSONL.");
+    }
+    if (records.length === 0) throw invalid("The file contains no Trace records.");
+    const first = records[0];
+    if (!isSessionMeta5(first))
+      throw invalid("The first record of a Trace file must be session_meta.");
+    const sessionId = first.payload.session_id;
+    if (typeof sessionId !== "string" || !IMPORT_SESSION_ID_RE.test(sessionId)) {
+      throw invalid("session_meta carries a missing or invalid session_id.");
+    }
+    const duplicate = () => new HttpError(
+      409,
+      "trace_session_exists",
+      `This Agent already has a Session with id ${sessionId}; a duplicate Trace cannot be imported.`
+    );
+    if ((await this.locateAll(projectId, agentId, sessionId)).length > 0) throw duplicate();
+    const ts = Date.parse(first.timestamp);
+    const date = formatLocalDate(Number.isNaN(ts) ? /* @__PURE__ */ new Date() : new Date(ts));
+    const index = 1;
+    const dir = path14.join(tracesDir3(this.root, projectId, agentId), date);
+    await fs15.mkdir(dir, { recursive: true });
+    const file = path14.join(dir, `${sessionId}_${String(index).padStart(3, "0")}.jsonl`);
+    try {
+      await fs15.writeFile(file, content.replace(/\n+$/, "") + "\n", {
+        encoding: "utf8",
+        flag: "wx"
+      });
+    } catch (err) {
+      if (err.code === "EEXIST") throw duplicate();
+      throw err;
+    }
+    return { sessionId, index, date };
+  }
+};
+
+// src/services/update-check-service.ts
+import { BUILD_DATE as BUILD_DATE2, VERSION as VERSION2, compareVersions, normalizeVersion } from "@prismshadow/penguin-core";
+var REPO_SLUG = "Prism-Shadow/penguin-harness";
+var LATEST_RELEASE_API = `https://api.github.com/repos/${REPO_SLUG}/releases/latest`;
+var SUCCESS_TTL_MS = 60 * 60 * 1e3;
+var FAILURE_TTL_MS = 10 * 60 * 1e3;
+var UpdateCheckService = class {
+  fetchImpl;
+  now;
+  env;
+  cached = null;
+  inflight = null;
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.env = options.env ?? process.env;
+  }
+  /**
+   * Never throws; never makes a network call when disabled or (without `force`) while
+   * the cache is fresh. `force` — the web's manual "check for updates" action — skips
+   * the freshness check and performs a real lookup even over a warm cache: the cache
+   * exists to shield GitHub's unauthenticated rate limit from *passive* checks fired
+   * by every sidebar open, and an explicit user click is rare enough to press through
+   * it. Everything else is unchanged: the opt-out stays authoritative (force never
+   * dials out under PENGUIN_UPDATE_CHECK=off), the outcome lands in the same cache
+   * (subsequent passive checks reuse it), and concurrent callers — forced or not —
+   * still share one in-flight lookup.
+   */
+  async check(force = false) {
+    if (this.env["PENGUIN_UPDATE_CHECK"] === "off") {
+      return {
+        currentVersion: VERSION2,
+        buildDate: BUILD_DATE2,
+        latestVersion: null,
+        updateAvailable: false,
+        releaseUrl: null,
+        publishedAt: null,
+        checkedAt: this.now().toISOString(),
+        disabled: true
+      };
+    }
+    if (!force && this.cached && this.now().getTime() < this.cached.expiresAt) {
+      return this.cached.response;
+    }
+    this.inflight ??= this.lookup().finally(() => {
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  /** One real lookup; stores the outcome (success or failure) in the cache with its TTL. */
+  async lookup() {
+    const response = await this.resolveLatest();
+    const ttl = response.error === void 0 ? SUCCESS_TTL_MS : FAILURE_TTL_MS;
+    this.cached = { response, expiresAt: this.now().getTime() + ttl };
+    return response;
+  }
+  /**
+   * Failure taxonomy mirrors the CLI's fetchLatestVersion: an unreachable endpoint or
+   * timeout is "network"; a 403/429 is "rate_limited" (unauthenticated clients hit
+   * GitHub's per-IP limit); any other non-2xx status, an unparsable body, or a body
+   * without a usable tag_name is "bad_response".
+   */
+  async resolveLatest() {
+    const checkedAt = this.now().toISOString();
+    const base = { currentVersion: VERSION2, buildDate: BUILD_DATE2, checkedAt };
+    const failure = (error) => ({
+      ...base,
+      latestVersion: null,
+      updateAvailable: false,
+      releaseUrl: null,
+      publishedAt: null,
+      error
+    });
+    let res;
+    try {
+      res = await this.fetchImpl(LATEST_RELEASE_API, {
+        headers: { accept: "application/vnd.github+json", "user-agent": "penguin-server" },
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch {
+      return failure("network");
+    }
+    if (res.status === 403 || res.status === 429) return failure("rate_limited");
+    if (!res.ok) return failure("bad_response");
+    let body;
+    try {
+      body = await res.json();
+    } catch {
+      return failure("bad_response");
+    }
+    const tag = typeof body.tag_name === "string" ? normalizeVersion(body.tag_name) : "";
+    if (tag === "") return failure("bad_response");
+    return {
+      ...base,
+      latestVersion: tag,
+      updateAvailable: compareVersions(tag, VERSION2) > 0,
+      releaseUrl: typeof body.html_url === "string" ? body.html_url : null,
+      publishedAt: typeof body.published_at === "string" ? body.published_at : null
+    };
   }
 };
 
@@ -7270,10 +8099,10 @@ var UsageService = class {
 };
 
 // src/http/routes/preview.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono20 } from "hono";
 var DIRECTORY_INDEX = "index.html";
 function previewRoutes(deps2) {
-  const app2 = new Hono19();
+  const app2 = new Hono20();
   app2.get("/:token/*", async (c) => {
     const token = c.req.param("token");
     const payload = token ? deps2.previewTokens.verify(token) : null;
@@ -7331,6 +8160,7 @@ function buildAppDeps(config2, overrides = {}) {
   const errorsRepo = new ErrorsRepo(db);
   const prefsRepo = new UiPrefsRepo(db);
   const schedulesRepo = new SchedulesRepo(db);
+  const goalsRepo = new GoalsRepo(db);
   const projectConfigService = new ProjectConfigService(config2.root);
   const agentConfigService = new AgentConfigService(config2.root);
   const agentService = new AgentService(config2.root, agentsRepo, agentConfigService);
@@ -7345,6 +8175,7 @@ function buildAppDeps(config2, overrides = {}) {
     (projectId, provider, modelId) => projectConfigService.getPricing(projectId, provider, modelId),
     overrides.now ?? (() => /* @__PURE__ */ new Date())
   );
+  const updateCheck = overrides.updateCheck ?? new UpdateCheckService(overrides.now ? { now: overrides.now } : {});
   let managerRef;
   const channels = new ChannelHub({
     isActive: (key) => managerRef !== void 0 && managerRef.statusOf(key) !== "idle"
@@ -7361,7 +8192,8 @@ function buildAppDeps(config2, overrides = {}) {
     recorder,
     errors,
     titles,
-    log
+    log,
+    goals: goalsRepo
   });
   managerRef = manager;
   const projectService = new ProjectService({
@@ -7374,6 +8206,7 @@ function buildAppDeps(config2, overrides = {}) {
     usage: usageRepo,
     errors: errorsRepo,
     schedules: schedulesRepo,
+    goals: goalsRepo,
     projectConfig: projectConfigService,
     manager
   });
@@ -7426,11 +8259,14 @@ function buildAppDeps(config2, overrides = {}) {
     sessionService,
     traceService,
     usageService,
+    updateCheck,
     workspaceFiles,
     previewTokens,
     benchmarks,
     snapshots,
     schedulesRepo,
+    goalsRepo,
+    errorsRepo,
     scheduler,
     channels,
     manager,
@@ -7440,7 +8276,7 @@ function buildAppDeps(config2, overrides = {}) {
   };
 }
 function createApp(deps2) {
-  const app2 = new Hono20();
+  const app2 = new Hono21();
   app2.onError((err, c) => {
     const projectId = attributedProjectId(c, deps2);
     deps2.errors.record({
@@ -7484,6 +8320,7 @@ function createApp(deps2) {
   const auth = authMiddleware(deps2.authService);
   app2.use("/api/*", auth);
   app2.route("/api/me", meRoutes(deps2));
+  app2.route("/api/version", versionRoutes(deps2));
   app2.route("/api/admin/users", adminUsersRoutes(deps2));
   app2.route("/api/events", eventsRoutes(deps2));
   app2.route("/api/skills", skillLibraryRoutes());
@@ -7614,6 +8451,7 @@ var deps = buildAppDeps(config);
 var app = createApp(deps);
 await deps.authService.seedAdmin();
 await deps.scheduler.start();
+deps.goalsRepo.abortOrphanedActive();
 var appHost = loopbackHostRoles(config.host)?.app ?? config.host;
 var server = serve({ fetch: app.fetch, hostname: config.host, port: config.port }, (info) => {
   console.log(`penguin-server started: http://${appHost}:${info.port}`);