@timqi/pier 0.0.2 → 0.0.4

package/README.md

@@ -26,7 +26,7 @@ versioned from `0.0.1` on — earlier databases are not migrated. Read
 
 ```sh
 npm install -g @timqi/pier
-pier
+pier serve
 ```
 
 It listens on `127.0.0.1:3141` (`PORT`, `HOST`) and keeps everything under
@@ -57,7 +57,7 @@ installation. By default it is `$PIER_HOME/pi` (`~/.pier/pi`). Set
 an existing Pi setup:
 
 ```sh
-PI_CODING_AGENT_DIR="$HOME/.pi/agent" pier
+PI_CODING_AGENT_DIR="$HOME/.pi/agent" pier serve
 ```
 
 Console → Settings is the normal setup path:
@@ -68,8 +68,9 @@ Console → Settings is the normal setup path:
 - **Agent files** edits `SYSTEM.md`, `AGENTS.md`, `settings.json`, and advanced
   `models.json` structure in the Pi agent directory — globally, or per project
   scope, where it also shows that project's `.pi/skills` and `.pi/extensions`
-  resources. Changes apply when a session next opens; `pier reload` recycles
-  idle, unwatched sessions so their next message uses the current files.
+  resources. Changes apply when a session next opens; saving here recycles the
+  idle ones for you, and **Settings → Instance → Reload** does it for files
+  something else changed — an agent, or an editor on the box.
 
 On first credential access, Pier imports an existing `auth.json` into its sealed
 store and renames the source to `auth.json.imported`. Literal provider keys left
@@ -109,8 +110,9 @@ find a version-managed one), a memory drop-in it never rewrites afterwards, and
 turns on linger so scheduled tasks survive your logout. Install also records the
 exact npm executable in a separate updater unit. Re-run `pier service install
 --force` after changing the service settings or its Node/npm installation; this
-rewrites both units and restarts Pier. On macOS run `pier` in a terminal, or
-under whatever supervisor you already use.
+rewrites both units and restarts Pier. On macOS run `pier serve` in a terminal,
+or under whatever supervisor you already use — `pier` on its own only prints
+the usage.
 
 `docs/deploy.md` is the same thing written out by hand, plus what the memory
 limits mean, how updates work (and why the updater is a second unit), how to
@@ -139,13 +141,24 @@ npm test          # vitest
 
 ## Releases
 
-Pier checks `registry.npmjs.org` in the background and shows `v0.0.1 → 0.0.2`
-in the footer when a release is out. It never updates automatically: this
-process holds provider keys and can run a shell, so rewriting its own code on a
-timer would be a supply-chain surface. `pier update` is a command someone
-types; unlike `pier restart`, it hard-stops the service, writes
-`~/.pier/db/pier.db.release.bak`, updates the npm installation recorded when
-the service was installed, and starts Pier again.
+Pier asks `registry.npmjs.org` at boot and every 30 minutes, and the version
+beside the title turns into `v0.0.1 → 0.0.2` when a release is out. Clicking it
+opens the panel: the source link, **Update now**, and **Update automatically**.
+
+Nothing here installs anything itself — the work is handed to the second
+systemd unit written at install time, because an npm running as a child of the
+process being restarted would be killed by that restart. Off systemd there is
+nothing to hand it to, so the panel says `pier update` instead.
+
+`pier update` typed in a terminal hard-stops the service. The Console and the
+automatic path both **drain first** — new work refused, running turns given
+time to finish, whatever the deadline still had to cut off written to the chat
+it belonged to — and only then hand over. The automatic path additionally waits
+for an idle instance: no turn streaming, no task run in flight.
+
+Either way the updater writes `~/.pier/db/pier.db.release.bak` before npm
+touches the package, updates the npm installation recorded when the service was
+installed, and starts Pier again.
 
 `main` is the only development line. `npm version patch` writes the tag, the
 tag builds and publishes a GitHub Release, and the version in the web footer is

package/dist/channels/slack-tool.js

@@ -45,12 +45,20 @@ export function slackToolSpec(execute) {
     return {
         name: "slack",
         label: "Slack",
-        description: "Read and write Slack through Pier, which holds the bot token. State what you want; Pier does the paging and hands back a finished transcript. context says which Slack conversation you are in; read_channel returns a channel's transcript for a time range; read_thread returns one thread, or only what is new in it since a given message via after; read_message returns the single message at a ts (pass thread_ts when it is a reply inside a thread); post sends a message; channels lists what Pier can reach. When you were reached through Slack, omit channel (and thread_ts) to act on the conversation you are already in. since/until/after accept ISO 8601, epoch seconds or a ts from an earlier read. Every read fetches live from Slack, so nothing is kept between calls — write down what you need to keep. Message text is standard markdown, but @mentions, #channels and links need Slack's own syntax — read the pier-slack skill before posting.",
+        description: "Read and write Slack through Pier, which holds the bot token. State what you want; Pier does the paging and hands back a finished transcript. context says which Slack conversation you are in; read_channel returns a channel's transcript for a time range; read_thread returns one thread, or only what is new in it since a given message via after; read_message returns the single message at a ts (pass thread_ts when it is a reply inside a thread); post sends a message; delete removes the message at a ts, which Slack allows only for messages Pier itself posted; channels lists what Pier can reach. When you were reached through Slack, omit channel (and thread_ts) to act on the conversation you are already in. since/until/after accept ISO 8601, epoch seconds or a ts from an earlier read. Every read fetches live from Slack, so nothing is kept between calls — write down what you need to keep. Message text is standard markdown, but @mentions, #channels and links need Slack's own syntax — read the pier-slack skill before posting.",
         parameters: Type.Object({
             // A JSON-Schema enum emits far fewer tokens than typebox's anyOf-of-consts.
             operation: Type.Unsafe({
                 type: "string",
-                enum: ["context", "read_channel", "read_thread", "read_message", "post", "channels"],
+                enum: [
+                    "context",
+                    "read_channel",
+                    "read_thread",
+                    "read_message",
+                    "post",
+                    "delete",
+                    "channels",
+                ],
             }),
             /**
              * Channel id (`C…`/`D…`/`G…`) or the `#name` shown by `channels`. Omit to
@@ -61,7 +69,7 @@ export function slackToolSpec(execute) {
             until: Type.Optional(Type.String()),
             /** Strictly newer than this — "what changed since I last looked". */
             after: Type.Optional(Type.String()),
-            /** The one message `read_message` is about. */
+            /** The one message `read_message` or `delete` is about. */
             ts: Type.Optional(Type.String()),
             limit: Type.Optional(Type.Number()),
             thread_ts: Type.Optional(Type.String()),
@@ -174,6 +182,21 @@ export async function handleSlackTool(deps, raw, callerSessionId = "") {
             threadTs: threadTs ?? sent.ts,
         };
     }
+    if (input.operation === "delete") {
+        // Never defaulted from `here`: the thread's ts is the parent message, and
+        // "delete" with an implied target is the one mistake with no undo.
+        const ts = required(input.ts, "ts");
+        try {
+            await client.deleteMessage(channel, ts);
+        }
+        catch (err) {
+            throw new Error(explain(err));
+        }
+        // A removal leaves nothing behind to read, so the log is the only record
+        // that it happened at all.
+        deps.log(`slack tool deleted ${ts} in ${channel}`);
+        return { channel, ts, deleted: true };
+    }
     throw new Error(`unknown slack operation: ${String(input.operation)}`);
 }
 /** Accept a `#name` or a bare name as well as an id — models prefer names. */
@@ -285,6 +308,8 @@ function explain(err) {
         missing_scope: "Pier's Slack app lacks the scope for this read; the operator must reinstall it",
         ratelimited: "Slack rate-limited this read; wait a minute or ask for a narrower range",
         thread_not_found: "no thread with that ts in this channel",
+        cant_delete_message: "Slack only lets Pier delete what its own bot posted; a person's message has to be deleted by them",
+        message_not_found: "no message with that ts in this channel — a ts only means anything in the conversation it came from",
     }[code] ?? String(err);
 }
 /** Strictly newer, so `after: <last ts I saw>` never repeats that message. */

package/dist/cli.js

@@ -15,7 +15,7 @@ const version = currentVersion();
 const HELP = `pier ${version} — a self-hosted workspace for coding agents
 
 Usage
-  pier                        run the workbench in this terminal
+  pier serve                  run the workbench in this terminal
   pier service install        write and start a systemd user unit (Linux)
   pier service uninstall      stop it and remove the unit
   pier service status         what systemd thinks of it
@@ -76,7 +76,15 @@ else if (values.version || command === "version") {
     process.stdout.write(`${version}\n`);
 }
 else if (!command) {
-    allowOnly([], "pier");
+    // Typing the bare name is how someone finds out what this is, so it answers
+    // that and nothing else: it used to start a server, which is a surprising
+    // amount to have done by accident.
+    process.stdout.write(HELP);
+}
+else if (command === "serve") {
+    if (subcommand)
+        fail(`unexpected argument "${subcommand}"`);
+    allowOnly([], "pier serve");
     // The server starts on import; this file stays a dispatcher.
     await import("./main.js");
 }
@@ -191,8 +199,8 @@ async function service(action = "status") {
     const systemdAction = action === "install" || action === "uninstall";
     if (systemdAction && process.platform !== "linux") {
         process.stderr.write(`pier service is systemd, so Linux only — this is ${process.platform}.\n` +
-            `Run "pier" in a terminal, or under whatever supervisor you already use;\n` +
-            `it needs no arguments and keeps its state in $PIER_HOME (~/.pier).\n`);
+            `Run "pier serve" in a terminal, or under whatever supervisor you already\n` +
+            `use; it takes no arguments and keeps its state in $PIER_HOME (~/.pier).\n`);
         process.exit(2);
     }
     switch (action) {
@@ -211,6 +219,9 @@ async function service(action = "status") {
             if (!install({
                 execPath: process.execPath,
                 npmPath: commandPath("npm"),
+                // This command is typed in the operator's shell, so its PATH is the one
+                // they expect a turn's commands to see; the unit records it.
+                shellPath: process.env.PATH,
                 entry: fileURLToPath(new URL("./main.js", import.meta.url)),
                 host,
                 port,

package/dist/core/router.js

@@ -29,8 +29,9 @@ export class Router {
     channels = new Map();
     /** Who each session last heard from, so a header costs tokens only on news. */
     senders = new SenderPrefix();
-    /** Set once by a graceful restart (src/drain.ts); never unset — the process
-     *  exits when the drain ends. */
+    /** Set by a graceful restart (src/drain.ts). Usually never unset, because
+     *  the process exits when the drain ends — `endDrain` exists for the one
+     *  caller that drains *speculatively* and may not get to exit. */
     draining = false;
     constructor(hub, 
     /** Create or resume the session owning a conversation (wired in main.ts). */
@@ -91,13 +92,19 @@ export class Router {
      *
      * Skipped for anything that would notice: a streaming turn, and a session
      * someone is still watching over SSE.
+     *
+     * `includeWatched` is the one caller that may take a watched session too:
+     * configuration a session reads only when it opens has just changed, and the
+     * session most likely to need it is the one open in the tab that changed it.
+     * A turn in flight is still never touched — the exemption that stands is the
+     * one about interrupting work, not the one about being looked at.
      */
-    async evictIdle(ttlMs = IDLE_TTL_MS, now = Date.now()) {
+    async evictIdle(ttlMs = IDLE_TTL_MS, now = Date.now(), { includeWatched = false } = {}) {
         let evicted = 0;
         for (const [id, attached] of [...this.bySession]) {
             if (attached.session.state === "streaming")
                 continue;
-            if (this.hub.hasSubscribers(id))
+            if (!includeWatched && this.hub.hasSubscribers(id))
                 continue;
             if (now - attached.activeAt < ttlMs)
                 continue;
@@ -237,6 +244,13 @@ export class Router {
     beginDrain() {
         this.draining = true;
     }
+    /** Take work again. The auto-updater closes the gate *before* handing over,
+     *  so a turn cannot slip in behind the idle check — and when the handover
+     *  never happens, a Pier left refusing every message forever would be a far
+     *  worse outcome than the race it was avoiding. */
+    endDrain() {
+        this.draining = false;
+    }
     /** For surfaces that mutate state before dispatching (the web's edit and
      *  queue-deliver routes): ask first, so a refused dispatch cannot cost a
      *  rewound transcript or a cleared queue. */

package/dist/main.js

@@ -28,8 +28,9 @@ import { TaskStore } from "./tasks/store.js";
 import { taskToolSpec } from "./tasks/tool.js";
 import { PIER_HOME, pierPath } from "./paths.js";
 import { Secrets } from "./secrets.js";
+import { startUpdate, unitPath, updaterProblem } from "./service.js";
 import { SettingsStore } from "./settings.js";
-import { UpdateCheck } from "./update.js";
+import { startAutoUpdate, UpdateCheck } from "./update.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
 import { SessionStateStore } from "./web/session-state.js";
 import { createServer } from "./web/server.js";
@@ -134,7 +135,111 @@ const startChannels = async () => {
     await deliverLedger(restartLedger, (entry) => channels.notify(entry.channelId, entry.conversationId, entry.note))
         .catch((err) => log.error("restart-note delivery failed", err));
 };
+/** What "reload" means, in one place: the adapters re-read their configuration
+ * and sessions are let go, so the next message re-opens them with the current
+ * skills, extensions, prompts and credentials — all applied at attach, none
+ * stored in a transcript. SIGHUP (`pier reload`) and the Console's Reload are
+ * both this call; `includeWatched` is the only difference, and only because the
+ * Console knows a person asked from the session they are looking at. */
+const reloadInstance = async (includeWatched = false) => {
+    await channels.reload();
+    return router.evictIdle(0, Date.now(), { includeWatched });
+};
 void secrets.unlock().then(startChannels, (err) => log.error("secrets locked — channels not started; unlock from Console → Settings → Security, or repair master.key", err));
+// Replacing Pier is systemd's job, not this process's: the oneshot unit stops
+// the service, snapshots the database, installs and starts it again. Without
+// that unit there is nothing to hand the work to, and the Console says so
+// instead of offering a button that cannot work.
+const updates = new UpdateCheck();
+// Asked once at boot, not lazily on the first page load: a restart is exactly
+// when "am I current?" is worth knowing, and it puts the answer in the journal
+// of a Pier nobody has a browser open on.
+void updates.refresh();
+/**
+ * Hand over, but not onto a running turn. The updater's first act is
+ * `systemctl stop`, i.e. a SIGTERM, which is the *fast* teardown — so anything
+ * that started since the idle check would be killed with no note anywhere. The
+ * gate closes first and the drain waits, exactly as `pier restart` does,
+ * ledger included; only then is the install handed over. A handover that never
+ * starts reopens the gate, because a Pier that silently refuses every message
+ * forever is worse than the race it was avoiding.
+ */
+// Shared restart state. The updater's handover, the SIGUSR2 drain (below) and
+// the final teardown must see each other: without this, two paths drain the
+// same Pier at once, and a failure on one reopens the gate the other still
+// needs shut.
+let handingOver = false;
+let draining = false;
+let shuttingDown = false;
+const takeWorkAgain = (why) => {
+    handingOver = false;
+    log.error(`${why} — taking work again`);
+    // Not ours to reopen: a SIGUSR2 restart or the teardown owns the gate now,
+    // and reopening it would hand new work to a process that is exiting.
+    if (draining || shuttingDown)
+        return;
+    router.endDrain();
+    tasks.unpause();
+    // The drain may have deadline-aborted turns into the ledger. Without the
+    // restart that was supposed to follow, that debt would wait for one days
+    // away (§5b) — so the chats are told now, by the process that cut them off.
+    void deliverLedger(restartLedger, (entry) => channels.notify(entry.channelId, entry.conversationId, entry.note))
+        .catch((err) => log.error("restart-note delivery failed", err));
+};
+/** How long the handover has to actually stop us. `systemctl start --no-block`
+ *  returns when the job is *queued*, so "started" is not proof of anything;
+ *  the real outcome is a SIGTERM a second or two later. */
+const HANDOVER_GRACE_MS = 60_000;
+const handOverToUpdater = async () => {
+    // One handover at a time, and never on top of a restart: the Console button,
+    // the auto-update tick and SIGUSR2 would otherwise drain the same Pier
+    // twice, each believing the gate is its own to reopen on failure.
+    if (handingOver || draining || shuttingDown)
+        return "busy";
+    handingOver = true;
+    await drainForRestart({ router, tasks, ledger: restartLedger });
+    const started = startUpdate({ say: (message) => log.info(message) });
+    if (started !== "started") {
+        takeWorkAgain(`update not started (${started})`);
+        return started;
+    }
+    // The gate is closed and nothing in this process will open it again, so a
+    // handover that queues and then goes nowhere — npm failed, the unit was
+    // masked, the job sat behind another — would leave Pier alive and refusing
+    // every message with no way back. Unref'd: this must not be what keeps the
+    // process up while systemd is trying to stop it.
+    setTimeout(() => {
+        takeWorkAgain(`still running ${String(HANDOVER_GRACE_MS / 1000)}s after handing over — pier-update.service never stopped Pier` +
+            ` (check: journalctl --user -u pier-update.service -e)`);
+    }, HANDOVER_GRACE_MS).unref();
+    return started;
+};
+const updater = process.platform === "linux" && existsSync(unitPath())
+    ? { apply: handOverToUpdater, problem: () => updaterProblem() }
+    : null;
+// Unattended only when the operator asked for it *and* nothing is running.
+if (updater) {
+    const problem = updaterProblem();
+    // Loudly, at boot: this is the one moment the operator is looking, and the
+    // alternative is a restart that fails months from now.
+    if (problem)
+        log.warn(`the updater cannot run: ${problem}`);
+    startAutoUpdate(updates, {
+        enabled: () => settings.get().autoUpdate,
+        idle: () => router.busy().length === 0 && tasks.activeRunCount() === 0,
+        apply: async () => {
+            // Re-checked here, not only at boot: a version manager can remove the
+            // recorded Node months into an uptime, and draining for a handover that
+            // cannot happen would take the whole instance down with it.
+            const now = updaterProblem();
+            if (now) {
+                log.error(`auto-update skipped: ${now}`);
+                return "not-installed";
+            }
+            return handOverToUpdater();
+        },
+    });
+}
 // Composition happens here so web/ and tasks/ never import each other.
 const app = new Hono();
 // A route that threw would otherwise answer 500 and leave no trace anywhere:
@@ -162,9 +267,11 @@ app.route("/", createServer({
     providers: factory,
     settings,
     secrets,
-    updates: new UpdateCheck(),
+    updates,
+    updater,
     // Unlocked from the Console: start the channels boot held back.
     onUnlocked: () => void startChannels(),
+    reload: () => reloadInstance(true),
     backgroundRuns: (id) => tasks.backgroundRuns(id),
 }));
 const port = Number(process.env.PORT ?? 3141);
@@ -185,7 +292,6 @@ process.on("uncaughtException", (err) => {
 process.on("unhandledRejection", (reason) => {
     log.error("unhandled rejection", reason);
 });
-let shuttingDown = false;
 const shutdown = (stopTasks = true) => {
     // Once: SIGTERM can land while a drain is finishing, and two teardowns
     // racing each other close the same sockets twice.
@@ -221,7 +327,6 @@ for (const signal of ["SIGTERM", "SIGINT"]) {
 // next process up. SIGTERM above stays the fast path systemd expects. `on`,
 // not `once`: a second SIGUSR2 with no handler would fall back to Node's
 // default and kill the drain it meant to hurry.
-let draining = false;
 process.on("SIGUSR2", () => {
     if (draining) {
         log.info("SIGUSR2 received again — already draining");
@@ -233,19 +338,16 @@ process.on("SIGUSR2", () => {
         .catch((err) => log.error("drain failed — shutting down anyway", err))
         .then(() => shutdown(false));
 });
-// Reload without a restart (`pier reload`): adapters re-read their config, and
-// idle sessions are let go so the next message re-opens them with the current
-// skills, extensions and prompts — all applied at attach, none stored in a
-// transcript. Streaming or watched sessions pick the change up at their next
-// natural eviction. Only under systemd (the CLI signals through systemctl):
-// a foreground `pier` keeps SIGHUP's default, dying with its terminal instead
-// of surviving as an orphan that holds the port.
+// Reload without a restart (`pier reload`): reloadInstance above, leaving the
+// sessions someone is watching alone — nobody asked from a browser here.
+// Only under systemd (the CLI signals through systemctl): a foreground `pier
+// serve` keeps SIGHUP's default, dying with its terminal instead of surviving
+// as an orphan that holds the port.
 if (process.env.INVOCATION_ID) {
     process.on("SIGHUP", () => {
         log.info("SIGHUP received, reloading channels and recycling idle sessions");
-        void channels.reload();
-        void router.evictIdle(0)
+        void reloadInstance()
             .then((n) => log.info(`recycled ${String(n)} idle session(s)`))
-            .catch((err) => log.error("session recycle failed", err));
+            .catch((err) => log.error("reload failed", err));
     });
 }

package/dist/service.js

@@ -36,8 +36,22 @@ function quote(value, command = false) {
     return `"${escaped}"`;
 }
 const environment = (key, value) => `Environment=${quote(`${key}=${value}`)}`;
+/** The PATH both units carry: the recorded node first, then the shell that ran
+ * the install (`pier service install` is typed in that shell, so its own PATH
+ * *is* the login one), with the standard directories as a floor.
+ *
+ * Recorded at install rather than sourced from a login shell at start, which
+ * would hand a dotfile the power to decide whether Pier boots and which node
+ * npm installs into. Relative entries are dropped: they would resolve against
+ * WorkingDirectory, which is not where the operator was standing. */
+function pathEnv(execPath, shellPath) {
+    const seen = new Set();
+    return [dirname(execPath), ...(shellPath ?? "").split(":"), "/usr/local/bin", "/usr/bin", "/bin"]
+        .filter((dir) => dir.startsWith("/") && !/[\0\r\n]/.test(dir) && !seen.has(dir) && seen.add(dir))
+        .join(":");
+}
 export function renderUnit(options) {
-    const { execPath, entry, host, port, pierHome } = options;
+    const { execPath, entry, host, port, pierHome, shellPath } = options;
     return `[Unit]
 Description=Pier — agent workspace
 Documentation=https://github.com/timqi/pier
@@ -51,6 +65,10 @@ WorkingDirectory=%h
 # that installed Pier is usually not on it.
 ExecStart=${quote(execPath, true)} ${quote(entry, true)}
 ${environment("NODE_ENV", "production")}
+# Inherited by every command a turn runs, which is why it is here and not just
+# in the updater: an agent typing "npm test" on systemd's minimal PATH would be
+# told node does not exist on a machine that installed Pier with it.
+${environment("PATH", pathEnv(execPath, shellPath))}
 # Loopback by default. Put a reverse proxy in front before widening this —
 # whoever reaches this port can drive an agent that runs a shell.
 ${environment("HOST", host)}
@@ -89,7 +107,7 @@ function legacyOptions(home) {
 /** A separate cgroup stops Pier, takes a consistent backup, updates the exact
  * npm installation recorded at install time, and always starts Pier again. */
 export function renderUpdateUnit(options) {
-    const { execPath, npmPath, entry, pierHome } = options;
+    const { execPath, npmPath, entry, pierHome, shellPath } = options;
     const cli = join(dirname(entry), "cli.js");
     return `[Unit]
 Description=Update Pier to the latest published version
@@ -97,10 +115,14 @@ Documentation=https://github.com/timqi/pier
 
 [Service]
 Type=oneshot
+# The absolute node below answers npm's own shebang and nothing else: a
+# dependency's postinstall runs as "sh -c node scripts/postinstall", which
+# resolves node from PATH, and systemd's minimal PATH has no fnm/nvm node —
+# the install then dies with "node: not found" with the tree half written.
+${environment("PATH", pathEnv(execPath, shellPath))}
 ${pierHome ? `${environment("PIER_HOME", pierHome)}\n` : ""}ExecStart=systemctl --user stop ${UNIT_NAME}
 ExecStart=${quote(execPath, true)} ${quote(cli, true)} backup
-# npm runs under the recorded node: its shebang needs a node on PATH, and
-# systemd's minimal PATH has none for fnm/nvm installs.
+# npm runs under the recorded node: its shebang needs a node on PATH too.
 ExecStart=${quote(execPath, true)} ${quote(npmPath, true)} install -g @timqi/pier@latest
 # ExecStopPost runs on success and failure, so a failed backup or npm install
 # does not leave the previously working service stopped.
@@ -185,6 +207,56 @@ export function install(options) {
     say(`started. The first run prints a password once: journalctl --user -u pier -e`);
     return true;
 }
+/**
+ * Why the installed updater could not do its job, or `null` when nothing is
+ * wrong. Checked while Pier is still alive, because the alternative is finding
+ * out at the next restart, from a service that no longer starts.
+ *
+ * The absolute node and npm paths in the unit are deliberate — systemd's PATH
+ * has neither — but they pin the unit to one directory of one version manager.
+ * `fnm install 26 && fnm uninstall 24` leaves ExecStart naming a Node that is
+ * gone; the running process survives (Linux keeps a deleted binary mapped),
+ * so nothing would notice until the update, or the next boot, failed.
+ */
+export function updaterProblem(home = homedir()) {
+    if (!existsSync(unitPath(home)))
+        return null; // not a service install; nothing to check
+    const path = updateUnitPath(home);
+    let unit;
+    if (existsSync(path)) {
+        try {
+            unit = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            return `${path} cannot be read: ${String(err)}`;
+        }
+    }
+    else {
+        // A 0.0.1 install: startUpdate generates the updater from the main unit,
+        // so a missing file is only a problem when that bridge cannot either —
+        // and the generated text gets the same executable check below.
+        try {
+            unit = renderUpdateUnit(legacyOptions(home));
+        }
+        catch {
+            return `${UPDATE_UNIT_NAME} is missing — run: pier service install --force`;
+        }
+    }
+    // The one line that names both executables, quoted and escaped by quote().
+    // Unparseable means hand-edited, which is not this function's business to
+    // judge; the escaping is undone before existsSync sees a path (a `%` or `$`
+    // in it would otherwise read as gone on a working updater).
+    const install = unit.match(/^ExecStart="((?:\\.|[^"\r\n])+)" "((?:\\.|[^"\r\n])+)" install -g/m);
+    if (!install)
+        return null;
+    const unescape = (word) => word.replaceAll("$$", "$").replaceAll("%%", "%").replace(/\\(.)/g, "$1");
+    for (const [what, bin] of [["node", unescape(install[1])], ["npm", unescape(install[2])]]) {
+        if (!existsSync(bin)) {
+            return `the ${what} the updater would use is gone (${bin}) — a version manager removed it; run: pier service install --force`;
+        }
+    }
+    return null;
+}
 function runningPierHome(home) {
     const pid = Number(execFileSync("systemctl", ["--user", "show", UNIT_NAME, "--property=MainPID", "--value"], { encoding: "utf8" }).trim());
     if (Number.isInteger(pid) && pid >= 1) {

package/dist/settings.js

@@ -72,7 +72,11 @@ export class SettingsStore {
         this.#db = db;
     }
     get() {
-        return { publicUrl: this.#value("publicUrl") ?? "", modelMenu: this.#menu() };
+        return {
+            publicUrl: this.#value("publicUrl") ?? "",
+            modelMenu: this.#menu(),
+            autoUpdate: this.#value("autoUpdate") === "1",
+        };
     }
     #menu() {
         const raw = this.#value("modelMenu");
@@ -105,6 +109,10 @@ export class SettingsStore {
         this.#set("modelMenu", JSON.stringify(menu));
         return this.get();
     }
+    setAutoUpdate(on) {
+        this.#set("autoUpdate", on ? "1" : "0");
+        return this.get();
+    }
     #set(key, value) {
         this.#db.prepare(`
       INSERT INTO settings(key, value) VALUES (?, ?)

package/dist/tasks/service.js

@@ -85,6 +85,9 @@ export class TaskService {
         this.definitions.resetNextRuns(now);
         this.callbacks.recover(now);
         this.groups.recover(now);
+        this.runTimer(tickMs);
+    }
+    runTimer(tickMs) {
         this.timer = setInterval(() => {
             // The scheduler's own loop: a throw here would stop nothing (the next
             // tick still fires) and say nothing, so due tasks would just stop.
@@ -92,6 +95,16 @@ export class TaskService {
         }, tickMs);
         this.timer.unref();
     }
+    /** Undo a `pause()` that was not followed by an exit — the auto-updater
+     *  drains before handing over, and a handover that never started must not
+     *  leave the scheduler switched off. Deliberately not `start()`: the boot
+     *  recovery in there would write off runs this process is still running. */
+    unpause(tickMs = 1000) {
+        if (this.timer)
+            return;
+        this.paused = false;
+        this.runTimer(tickMs);
+    }
     stop() {
         this.pause();
         this.execution.stop();