@saadnvd1/agent-os 0.3.839 → 0.3.848

package/lib/models/plan-fresh.ts

@@ -0,0 +1,61 @@
+/**
+ * Whether the plan file in a task's worktree was written by this task's
+ * planning turn. A plan committed to the base branch is checked out with the
+ * worktree and reads exactly like a fresh one, so it is refused: tracked by
+ * git, older than the worktree's plan folder, or identical to the base's copy.
+ */
+
+import fs from "fs";
+import path from "path";
+import { git } from "../git-exec";
+
+export type PlanVerdict =
+  { ok: true; text: string } | { ok: false; why: string };
+
+const PLAN_FILE = ".agentos/plan.md";
+
+export async function checkPlanFile(
+  worktree: string,
+  base: string | null | undefined
+): Promise<PlanVerdict | null> {
+  const file = path.join(worktree, PLAN_FILE);
+  let text: string;
+  let mtime: number;
+  try {
+    text = fs.readFileSync(file, "utf8");
+    mtime = fs.statSync(file).mtimeMs;
+  } catch {
+    return null;
+  }
+  const quiet = (args: string[]) =>
+    git(worktree, args, { timeout: 15000 }).catch(() => null);
+  const tracked = await quiet(["ls-files", "--", PLAN_FILE]);
+  // Tracked and untouched is the base's copy; a tracked file the planner
+  // rewrote differs from HEAD and is its own.
+  if (
+    tracked?.trim() &&
+    (await quiet(["diff", "--quiet", "HEAD", "--", PLAN_FILE])) !== null
+  )
+    return { ok: false, why: "it is tracked by git and unchanged" };
+  // The plan folder's own .gitignore is written when the task starts.
+  const started = (() => {
+    try {
+      return fs.statSync(
+        path.join(worktree, path.dirname(PLAN_FILE), ".gitignore")
+      ).mtimeMs;
+    } catch {
+      return 0;
+    }
+  })();
+  if (started && mtime < started)
+    return { ok: false, why: "it was not written since the task started" };
+  if (base) {
+    for (const ref of [`origin/${base}`, base]) {
+      const theirs = await quiet(["show", `${ref}:${PLAN_FILE}`]);
+      if (theirs !== null && theirs === text)
+        return { ok: false, why: `it is identical to ${ref}'s copy` };
+      if (theirs !== null) break;
+    }
+  }
+  return { ok: true, text };
+}

package/lib/models/plan-step.ts

@@ -36,6 +36,7 @@ import {
 } from "../plans/features";
 import { advancePlan, setPlan } from "../db/session-parts";
 import { Owner } from "../owner";
+import { checkPlanFile } from "./plan-fresh";
 
 export const PLAN_FILE = ".agentos/plan.md";
 
@@ -134,9 +135,13 @@ export function planNoteFor(
   file: string,
   next: string,
   again = "",
-  after = ""
+  after = "",
+  stale = ""
 ): string {
   let head = `Task "${s.name}": no plan file was written${again}; ${next}${after}.`;
+  // A plan file left over from the base branch is not this task's plan.
+  if (stale)
+    return `Task "${s.name}": no usable plan was written (the plan file is stale: ${stale})${again}; ${next}${after}.`;
   try {
     const text = fs.readFileSync(file, "utf8");
     const summary = planSummary(text);
@@ -153,7 +158,12 @@ export function planNoteFor(
 }
 
 // Tells the orchestrator that started a task its plan is written, once.
-function announcePlan(s: Session, ref: string | null, retried = false): void {
+function announcePlan(
+  s: Session,
+  ref: string | null,
+  retried = false,
+  stale = ""
+): void {
   // The machine that placed it announces the plan, from its own copy.
   if (s.plan_waits_for_caller) return;
   if (!orchestratorOf(s.started_by) && !s.held_by_device) return;
@@ -167,7 +177,7 @@ function announcePlan(s: Session, ref: string | null, retried = false): void {
     ? `implementing on ${ref}`
     : "waiting for approval, not implementing (approve_plan to go ahead, drop to reject)";
   const again = retried ? " (asked once more for it first)" : "";
-  const head = planNoteFor(s, file, next, again, ref ? " anyway" : "");
+  const head = planNoteFor(s, file, next, again, ref ? " anyway" : "", stale);
   if (s.held_by_device) {
     setPlan(db, s.id, { plan_note: head });
     return;
@@ -215,12 +225,14 @@ async function handOffToPieces(s: Session): Promise<void> {
   }
 }
 
-function readPlan(s: Session): string | null {
-  try {
-    return fs.readFileSync(path.join(s.worktree_path!, PLAN_FILE), "utf8");
-  } catch {
-    return null;
-  }
+// The plan this task's planning turn wrote: null when there is none, and
+// `stale` says why a file that is there was refused.
+async function readPlan(
+  s: Session
+): Promise<{ text: string | null; stale: string }> {
+  const v = await checkPlanFile(s.worktree_path!, s.base_branch);
+  if (!v) return { text: null, stale: "" };
+  return v.ok ? { text: v.text, stale: "" } : { text: null, stale: v.why };
 }
 
 export const implementMessageId = (sessionId: string) =>
@@ -243,7 +255,8 @@ async function startImplementing(
   from: "planning" | "awaiting",
   send: Send,
   amendment?: string,
-  retried = false
+  retried = false,
+  stale = ""
 ): Promise<string | null> {
   const sessionId = s.id;
   const routed = resolveRole("implement", {
@@ -251,7 +264,14 @@ async function startImplementing(
     override: taskOverride(s),
   });
   const id = implementMessageId(sessionId);
-  const planText = readPlan(s);
+  // Only the planning turn's own file is checked for being this task's: a
+  // plan waiting for approval was checked when its turn ended.
+  const planText =
+    from === "planning"
+      ? (await readPlan(s)).text
+      : fs.existsSync(path.join(s.worktree_path!, PLAN_FILE))
+        ? fs.readFileSync(path.join(s.worktree_path!, PLAN_FILE), "utf8")
+        : null;
   // The branch was cut when the task was created; the plan may have waited.
   const fresh = await refreshBase({
     name: s.name,
@@ -313,12 +333,7 @@ async function startImplementing(
     if (nothingOwn) return true;
     enqueue(sessionId, {
       id,
-      text: implementPrompt(
-        fs.existsSync(path.join(s.worktree_path!, PLAN_FILE)),
-        note,
-        piece,
-        baseNote
-      ),
+      text: implementPrompt(planText !== null, note, piece, baseNote),
       origin: { kind: "decision", label: "Plan step" },
     });
     return true;
@@ -326,7 +341,7 @@ async function startImplementing(
   if (!claimed) return null;
   if (from === "planning") {
     try {
-      announcePlan(s, routed.ref, retried);
+      announcePlan(s, routed.ref, retried, stale);
     } catch (e) {
       console.error("plan-done event failed:", e);
     }
@@ -411,7 +426,8 @@ export async function handoffAfterPlan(
   }
   // Mid-turn, the turn's own end decides.
   if (env.turnRunning?.()) return false;
-  if (!fs.existsSync(path.join(s.worktree_path, PLAN_FILE))) {
+  const found = await readPlan(s);
+  if (found.text === null) {
     const w = stateOf(sessionId);
     const now = (env.now ?? Date.now)();
     const limit = env.waitMs ?? PLAN_BACKGROUND_WAIT_MS;
@@ -458,7 +474,7 @@ export async function handoffAfterPlan(
   // A plan-only task never goes on by itself, in No approvals mode too: it
   // was asked to stop and show the plan. Pieces that couldn't be registered
   // always hold a plan-first one: building on a guess is the bug.
-  const planText = readPlan(s);
+  const planText = found.text;
   const pieceErrors =
     (planText && !s.plan_waits_for_caller
       ? splitOf(s, planText)?.errors
@@ -469,13 +485,14 @@ export async function handoffAfterPlan(
       "planning",
       send,
       undefined,
-      retried
+      retried,
+      found.stale
     );
     return ref !== null;
   }
   if (!advancePlan(db, sessionId, "planning", "awaiting")) return false;
   try {
-    announcePlan(s, null, retried);
+    announcePlan(s, null, retried, found.stale);
   } catch (e) {
     console.error("plan-done event failed:", e);
   }
@@ -490,8 +507,7 @@ export async function handoffAfterPlan(
   // The machine that placed a plan sends its own push.
   try {
     if (!s.plan_waits_for_caller) {
-      const text = readPlan(s);
-      const planned = text ? planFor(s, text) : null;
+      const planned = planText ? planFor(s, planText) : null;
       (await import("../notify/push/events")).pushPlanAwaiting(
         s.id,
         s.name,

package/lib/models/providers.ts

@@ -190,5 +190,5 @@ export function describeSecretRef(ref: SecretRef | undefined): string {
     return `tokenvault ${ref.project}${ref.desc ? ` "${ref.desc}"` : ""}`;
   if (ref.kind === "keychain")
     return `Keychain ${ref.service}${ref.account ? ` (${ref.account})` : ""}`;
-  return `$${ref.name}`;
+  return "an environment variable";
 }

package/lib/orchestrator/scope.ts

@@ -36,6 +36,9 @@ async function cardText(task: Session): Promise<string> {
   return task.task_prompt ?? task.name;
 }
 
+export const isTaskStatePath = (p: string) =>
+  p === ".agentos" || p.startsWith(".agentos/");
+
 export async function checkScope(input: {
   workspaceId: string;
   task: Session;
@@ -53,6 +56,13 @@ export async function checkScope(input: {
     // Claimed before the first await: written in the same tick as the
     // review's verdict, so no review call sees neither.
     putCheck({ ...base, status: "running", detail: null });
+    const taskState = input.files.filter((f) => isTaskStatePath(f.path));
+    if (taskState.length)
+      return putCheck({
+        ...base,
+        status: "block",
+        detail: `Commits task state under .agentos/ (${taskState.map((f) => f.path).join(", ")}); the plan folder is never part of a change.`,
+      });
     const amended = input.amendments?.length
       ? `\n\nScope changes recorded since the task started, oldest first; they win over the card, and a later one over an earlier one:\n${fence("amendments", input.amendments.map((a, i) => `${i + 1}. ${a}`).join("\n"))}`
       : "";

package/lib/recipes/settle.ts

@@ -24,6 +24,8 @@ import {
 import { getRecipe, toRun } from "./store";
 import type { Recipe, RecipeRun, RunStatus } from "./types";
 
+// A live run with nothing running behind it for this long is given up on.
+export const LOST_RUN_MS = 24 * 60 * 60_000;
 // A session run that stops without a RESULT line settles from the model's
 // reading after it has been idle this long.
 export const IDLE_SETTLE_MS = 30 * 60_000;
@@ -379,6 +381,26 @@ async function settleOne(
       session,
       now
     );
+  // Nothing live behind it for a day (a terminal session, an archived one, a
+  // worker that's gone): it isn't still running, so it must not say so.
+  if (
+    Number.isFinite(startedMs) &&
+    now - startedMs > LOST_RUN_MS &&
+    state !== "running" &&
+    state !== "waiting"
+  )
+    return void finish(
+      run,
+      {
+        status: "failed",
+        result: line,
+        source: "state",
+        error: "Lost track of it",
+        summary: "Lost track of it",
+      },
+      session,
+      now
+    );
   const idle =
     state === "idle" || session.archived_at != null || state === null;
   if (idle && session.view === "chat") {

package/lib/settings-url.ts

@@ -5,6 +5,7 @@
 export const SETTINGS_PARAM = "settings";
 
 export const SETTINGS_SECTIONS = [
+  "general",
   "merging",
   "approvals",
   "workspaces",
@@ -18,13 +19,19 @@ export const SETTINGS_SECTIONS = [
   "schedules",
   "audits",
   "health",
-  "setup",
   "updates",
   "experiments",
 ] as const;
 
 export type SettingsSection = (typeof SETTINGS_SECTIONS)[number];
 
+// Sections that were folded into another: an old link still lands in the
+// right place.
+export const SECTION_REDIRECTS: Record<string, SettingsSection> = {
+  setup: "health",
+  "no-approvals": "approvals",
+};
+
 export interface SettingsLocation {
   open: boolean;
   // null: the list on a phone, the first section on a wider screen.
@@ -40,7 +47,12 @@ export const isSettingsSection = (v: unknown): v is SettingsSection =>
 export function settingsFromHref(href: string): SettingsLocation {
   const value = new URL(href, BASE).searchParams.get(SETTINGS_PARAM);
   if (value === null) return { open: false, section: null };
-  return { open: true, section: isSettingsSection(value) ? value : null };
+  const section = isSettingsSection(value)
+    ? value
+    : value !== null && Object.hasOwn(SECTION_REDIRECTS, value)
+      ? SECTION_REDIRECTS[value]
+      : null;
+  return { open: true, section };
 }
 
 /** The same address with Settings set (or removed), as path+query+hash. */

package/lib/updates/banner.ts

@@ -94,6 +94,7 @@ export type UpdateRefusal =
   | "up_to_date"
   | "unknown"
   | "no_restart"
+  | "managed"
   | "disk"
   | "forbidden";
 
@@ -173,6 +174,7 @@ export function bannerState({
       return "updated";
   }
   if (view.pending) return "pending";
+  if (view.canUpdate.code === "managed") return "hidden";
   if (
     view.available &&
     view.bannerEnabled &&

package/lib/updates/run.ts

@@ -85,6 +85,8 @@ export interface RunDeps {
   freeBytes: () => number | null;
   /** True when scripts/autodeploy deploys this checkout. */
   managed: () => boolean;
+  /** True while scripts/autodeploy is deploying (its lock directory exists). */
+  deployLocked: () => boolean;
   /** What a restart would interrupt, as short labels; empty when nothing. */
   busy: () => Promise<string[]>;
   /** The database the runner backs up first, and where to. */
@@ -214,6 +216,7 @@ export function realRunDeps(): RunDeps {
         return false;
       }
     },
+    deployLocked: () => fs.existsSync(agentosHome("autodeploy", "lock")),
     busy: busyLabels,
     dbFile: path.resolve(dbPath()),
     backupDir: agentosHome("backups"),
@@ -355,6 +358,12 @@ export async function preflight(
       error:
         "AgentOS isn't running from a git checkout, so it can't update itself.",
     };
+  if (deps.managed() || deps.deployLocked())
+    return {
+      code: "managed",
+      error:
+        "This machine is updated by its own deploy job, so updating from here would race it. It deploys new versions by itself.",
+    };
   const run = readRun(deps);
   if (run && isActivePhase(run.phase))
     return {

package/lib/updates/view.ts

@@ -1,7 +1,7 @@
 // The /api/updates payload: the cached check, the run, what's pending,
 // whether the caller may start an update, and what automatic updates are doing.
 
-import { isActivePhase, type UpdateView } from "./banner";
+import { isActivePhase, type UpdateRun, type UpdateView } from "./banner";
 import { cachedCheck, checkForUpdate, reconcile } from "./check";
 import {
   autoView,
@@ -26,6 +26,27 @@ const redact = (lines: string[]) =>
       .replace(/\b[A-Za-z0-9_-]{32,}\b/g, "***")
   );
 
+/**
+ * A failed or rolled-back run stops mattering once the running build has the
+ * commit it tried (autodeploy, or someone, put it or something newer there).
+ */
+export async function runSuperseded(
+  run: UpdateRun | null,
+  deps: Pick<RunDeps, "git" | "buildId">
+): Promise<boolean> {
+  if (!run?.to || (run.phase !== "failed" && run.phase !== "rolled_back"))
+    return false;
+  const build = deps.buildId();
+  if (!/^[0-9a-f]{7,40}$/.test(build)) return false;
+  if (build === run.to) return true;
+  try {
+    await deps.git(["merge-base", "--is-ancestor", run.to, build]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export async function updateView(
   { mayUpdate }: { mayUpdate: boolean },
   deps: RunDeps = realRunDeps()
@@ -45,11 +66,12 @@ export async function updateView(
       .result;
   check = await reconcile(check, deps.check);
   // The log can carry paths and remote URLs; only a device that may update sees it.
-  const run =
-    stored &&
-    (stored.phase === "failed" ||
-      stored.phase === "built" ||
-      stored.phase === "rolled_back")
+  const run = (await runSuperseded(stored, deps))
+    ? null
+    : stored &&
+        (stored.phase === "failed" ||
+          stored.phase === "built" ||
+          stored.phase === "rolled_back")
       ? {
           ...stored,
           log: mayUpdate

package/lib/worktree-deps/paths.ts

@@ -22,13 +22,16 @@ export async function realExisting(p: string): Promise<string> {
 
 export const STAGING_SUFFIX = ".aos-partial";
 
-const EXCLUDE_LINE = `*${STAGING_SUFFIX}`;
+const STAGING_LINE = `*${STAGING_SUFFIX}`;
 
 // Staging dirs (`node_modules.aos-partial`) sit beside their target, where git
 // would list them as untracked work. Written once to the repo's shared
 // info/exclude, so it covers every worktree and no .gitignore is touched.
 // Best effort: outside a repository there is nothing to ignore it in.
-export async function ignoreStaging(dir: string): Promise<void> {
+export const ignoreStaging = (dir: string) => addExcludes(dir, [STAGING_LINE]);
+
+// Lines written once to the shared info/exclude of the repo `dir` is in.
+export async function addExcludes(dir: string, lines: string[]): Promise<void> {
   try {
     const common = (
       await git(dir, ["rev-parse", "--git-common-dir"], { timeout: 5000 })
@@ -36,10 +39,12 @@ export async function ignoreStaging(dir: string): Promise<void> {
     if (!common) return;
     const file = path.join(path.resolve(dir, common), "info", "exclude");
     const current = await fs.promises.readFile(file, "utf8").catch(() => "");
-    if (current.split(/\r?\n/).some((l) => l.trim() === EXCLUDE_LINE)) return;
+    const have = new Set(current.split(/\r?\n/).map((l) => l.trim()));
+    const missing = lines.filter((l) => !have.has(l));
+    if (!missing.length) return;
     await fs.promises.mkdir(path.dirname(file), { recursive: true });
     const lead = current && !current.endsWith("\n") ? "\n" : "";
-    await fs.promises.appendFile(file, `${lead}${EXCLUDE_LINE}\n`);
+    await fs.promises.appendFile(file, `${lead}${missing.join("\n")}\n`);
   } catch {
     // never fails a setup
   }

package/lib/worktrees.ts

@@ -17,6 +17,7 @@ import { refuseRealStateUnderTest } from "./test-home-guard";
 import { installWorktreeHooks } from "./worktree-hooks";
 import { gitResult, isGitError, worktreeList } from "./git-exec";
 import { addWorktree } from "./worktree-add";
+import { addExcludes } from "./worktree-deps/paths";
 import {
   markRemoving,
   removalKey,
@@ -172,6 +173,8 @@ export async function createWorktree(
           err
         )
       );
+      // Task state (the plan) must never be committed from a worktree.
+      await addExcludes(worktreePath, [".agentos/"]);
       return {
         worktreePath,
         branchName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.839",
+  "version": "0.3.848",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/autodeploy

@@ -33,6 +33,17 @@ mkdir -p "$state"
 # updates stand aside (lib/updates/run.ts managedByAutodeploy). Before the
 # lock: a long deploy still counts as managing it.
 touch "$state/heartbeat"
+# An in-app update (lib/updates/run.ts) in progress owns this checkout: its
+# pull would meet ours mid-way. Its state file is rewritten every 15 seconds,
+# so an old one is a run that died. Quiet exit; the next minute retries.
+for f in "${AGENTOS_UPDATE_STATE:-}" "${DB_PATH:+$(dirname "$DB_PATH")/agent-os-update.json}" \
+  "$HOME/.agent-os/agent-os-update.json" "$PWD/agent-os-update.json"; do
+  [ -n "$f" ] && [ -f "$f" ] || continue
+  [ -z "$(find "$f" -maxdepth 0 -mmin +30)" ] || continue
+  if grep -Eq '"phase" *: *"(starting|backing_up|pulling|installing|building|restarting|verifying|rolling_back)"' "$f"; then
+    exit 0
+  fi
+done
 # A lock older than 30 minutes is from a run that died.
 for lock in lock publish.lock; do
   if [ -d "$state/$lock" ] && [ -n "$(find "$state/$lock" -maxdepth 0 -mmin +30)" ]; then

package/scripts/autodeploy.test.ts

@@ -241,3 +241,33 @@ describe("autodeploy publish", () => {
     expect(fs.existsSync(lock)).toBe(false);
   });
 });
+
+describe("autodeploy and an in-app update", () => {
+  it("exits quietly while an update is in progress, and deploys once it's done", () => {
+    const t = setup();
+    t.commit("a");
+    fs.mkdirSync(path.join(t.home, ".agent-os"), { recursive: true });
+    const file = path.join(t.home, ".agent-os/agent-os-update.json");
+    fs.writeFileSync(file, JSON.stringify({ id: "r", phase: "pulling" }));
+    expect(t.run()).toBe("");
+    expect(t.restarts()).toBe(0);
+    expect(fs.existsSync(path.join(t.state, "deployed"))).toBe(false);
+    // The heartbeat still says this machine is managed.
+    expect(fs.existsSync(path.join(t.state, "heartbeat"))).toBe(true);
+    fs.writeFileSync(file, JSON.stringify({ id: "r", phase: "done" }));
+    t.run();
+    expect(t.restarts()).toBe(1);
+  });
+
+  it("ignores the state file of a run that died long ago", () => {
+    const t = setup();
+    t.commit("a");
+    fs.mkdirSync(path.join(t.home, ".agent-os"), { recursive: true });
+    const file = path.join(t.home, ".agent-os/agent-os-update.json");
+    fs.writeFileSync(file, JSON.stringify({ id: "r", phase: "building" }));
+    const old = new Date(Date.now() - 60 * 60_000);
+    fs.utimesSync(file, old, old);
+    t.run();
+    expect(t.restarts()).toBe(1);
+  });
+});

package/scripts/lib/update-verify.mjs

@@ -39,6 +39,9 @@ async function health(base, expect) {
   if (expect && build && build !== expect && !build.startsWith("v"))
     return {
       ok: false,
+      wrongBuild: true,
+      build,
+      startedAt,
       why: `it is running ${String(build).slice(0, 7)}, not ${expect.slice(0, 7)}`,
     };
   if (migrations && migrations.applied < migrations.known)
@@ -77,6 +80,14 @@ export async function verifyServer({ port, expect, env = process.env }) {
   for (let i = 0; i < checks; i++) {
     await sleep(every);
     const again = await health(base, expect);
+    // The expected build was up; now another one answers. Something else
+    // (a deploy job) restarted it: not a crash, and not ours to roll back over.
+    if (!again.ok && again.wrongBuild)
+      return {
+        ok: false,
+        otherRestart: true,
+        why: `something else restarted it into ${String(again.build).slice(0, 7)}, not ${expect.slice(0, 7)}`,
+      };
     if (!again.ok)
       return { ok: false, why: `it stopped answering: ${again.why}` };
     if (

package/scripts/update-run.mjs

@@ -9,11 +9,13 @@
 //   AGENTOS_UPDATE_DB     the database to back up first, into AGENTOS_UPDATE_BACKUPS
 //   AGENTOS_UPDATE_VERIFY=0  skip the health check (tests)
 //   AGENTOS_UPDATE_REDEPLOY  the script to run (tests); default scripts/redeploy
+//   AGENTOS_AUTODEPLOY_DIR  autodeploy's state dir (tests); default ~/.agent-os/autodeploy
 //   AGENTOS_UPDATE_ROOT   the checkout (tests); default this script's
 // Outcomes: done, built, build_failed (live server untouched), rolled_back,
 // broken (the rollback didn't come up either).
 import { execFileSync, spawn } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { fileURLToPath } from "node:url";
@@ -149,6 +151,24 @@ function resetSource(from) {
   }
 }
 
+/**
+ * scripts/autodeploy's "deployed" marker must not claim a build that isn't
+ * running: after a rollback it names the build that is. Only where autodeploy
+ * runs (its state directory exists).
+ */
+function markDeployed(sha) {
+  const dir =
+    env.AGENTOS_AUTODEPLOY_DIR ||
+    path.join(os.homedir(), ".agent-os", "autodeploy");
+  if (!sha || !fs.existsSync(dir)) return;
+  try {
+    fs.writeFileSync(path.join(dir, "deployed"), `${sha}\n`);
+    say(`Recorded ${sha.slice(0, 7)} as the deployed build.`);
+  } catch (error) {
+    say(`Couldn't record the deployed build: ${error.message}`);
+  }
+}
+
 async function main() {
   const heartbeat = setInterval(() => write({}), 15_000);
   write({ pid: process.pid });
@@ -184,6 +204,14 @@ async function main() {
         expect: env.AGENTOS_UPDATE_TO || head(),
         env,
       });
+      if (ok.otherRestart) {
+        say(`Not rolling back: ${ok.why}.`);
+        return finish(
+          "failed",
+          "interrupted",
+          `The update was built, but ${ok.why}. Nothing was rolled back; check which version is running.`
+        );
+      }
       if (!ok.ok) why = ok.why;
     }
     if (!why) return finish("done", "done");
@@ -205,6 +233,7 @@ async function main() {
         say(`The rolled-back version isn't healthy either: ${ok.why}`);
       }
     }
+    if (backOk) markDeployed(from);
     return backOk
       ? finish(
           "rolled_back",