@visual-z/xeno 0.7.1 → 0.7.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # xeno changelog
 
+## 0.7.2 — 2026-10-10
+
+- `/update` now installs the newer release when xeno was installed with bun or npm, instead of only printing the command. The status line shows the target version, elapsed time against a 3-minute limit and the package manager's latest output; success asks for a restart, and a failure gives the reason and the command to run by hand. Automatic checks still never install, and `xeno update --check` still only checks.
+
 ## 0.7.1 — 2026-10-09
 
 - Keep a dialog form editable after a validation error. A rejected provider id no longer destroys the input field (`EditBuffer is destroyed`), and the error suggests a valid id.

package/README.md

@@ -17,7 +17,7 @@ is ever summarized by a model, and nothing is ever rewritten in place.
 messages[]                             frozen system prefix + handoff + this node's events
 ```
 
-Version **0.7.1**. The on-disk session format will still change; `0.x` is that
+Version **0.7.2**. The on-disk session format will still change; `0.x` is that
 statement. Published as `@visual-z/xeno`; the license is `UNLICENSED` (readable and installable, no reuse granted).
 
 ## Install
@@ -192,7 +192,7 @@ Slash commands that exist in the session (from `/help`):
 /import <file>     validate and open an archive as an independent session
 /debug [file]      write local terminal and message diagnostics
 /changelog         show bundled release notes
-/update            check now for a newer xeno version without installing
+/update            check for a newer xeno and install it (restart to use)
 /trust [once|here|parent|never]
 /reload            refresh local resources at a durable context checkpoint
 /config            search resources and edit global or project overrides
@@ -479,10 +479,10 @@ unblocking affects new submissions, preserving historical request prefixes.
 - **`/back` does not restore symlinks.**
 - **`.xeno/` is not collected.** Snapshots and abandoned session branches
   stay until you delete them.
-- **No telemetry, `/share`, self-installing updates, or `/compact`.** Those
+- **No telemetry, `/share`, automatic updates, or `/compact`.** Those
   are refusals (`docs/PI_PARITY.md` D15, D16), not backlog. xeno does say
   when a newer version is published, checking automatically at most once a day.
-  `/update` or `xeno update --check` checks immediately without installing;
+  `/update` checks and installs when you ask; `xeno update --check` only checks;
   `docs/install.md` (Updates) lists what that request reveals and every
   way to turn it off.
 

package/docs/install.md

@@ -74,8 +74,9 @@ and restores the terminal. Start inside the intended project or pass
 
 ## Updates
 
-xeno says when a newer version is published. It never installs one: the
-notice names the command, and you run it.
+xeno says when a newer version is published. It never installs one on its
+own: the notice names the command. Typing `/update` is how you ask it to
+install (below).
 
 ```
 xeno 0.4.0 is available (you have 0.3.0)
@@ -87,7 +88,19 @@ The command follows where this copy is installed: `bun add -g` under
 (`…/lib/node_modules/`, or `…\npm\node_modules\` on Windows). Anywhere else
 the notice points to this file. A checkout updates with `git pull`.
 
-To check immediately, type `/update` in the TUI or run:
+To update now, type `/update` in the TUI. It checks the registry and, when
+a newer release exists and xeno was installed with bun or npm, runs the
+command from the notice pinned to that exact version (for example
+`bun add -g @visual-z/xeno@0.7.1`). The status line shows the target version,
+elapsed time against a 3-minute limit, and the package manager's latest output
+line; the editor stays usable. Success says `Updated xeno A → B. Restart xeno
+to use it.` — the running session keeps the old code until you restart. A
+failure says why (exit code or timeout, with the package manager's last lines)
+and repeats the command to run yourself. An unwritable install directory is
+refused before anything runs. Other install locations and checkouts are never
+installed into; they get the notice or `git pull` advice.
+
+To check without installing:
 
 ```sh
 xeno update --check
@@ -98,8 +111,8 @@ automatic-check environment switches, and CI suppression. It reports the
 current version and the result, including a failed query; a stale cache is
 never presented as a successful fresh check. A successful query refreshes
 the same cache used by startup. Repeated checks while a request is running
-share that request. No package is installed and no model credential or
-session is needed for the terminal command.
+share that request. `xeno update --check` never installs, and needs no model
+credential or session.
 
 `--offline` / `XENO_OFFLINE` still prevent network access. Source checkouts
 explain that they update with `git pull` instead of querying npm. Bare

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visual-z/xeno",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "license": "UNLICENSED",
   "type": "module",
   "description": "Segmented append-only agent log with pure context and handoff projections",

package/src/apps/commands.ts

@@ -89,7 +89,7 @@ export const COMMANDS = [
   { name: "import", description: "Import a portable JSONL session", argumentHint: "<file>", busy: "idle" },
   { name: "debug", description: "Write local terminal diagnostics", argumentHint: "[file]", busy: "run" },
   { name: "changelog", description: "Show local release notes", busy: "run" },
-  { name: "update", description: "Check now for a newer xeno version without installing", busy: "run" },
+  { name: "update", description: "Check for a newer xeno and install it; restart to use it", busy: "run" },
   { name: "copy", description: "Copy the last assistant reply", busy: "run" },
   { name: "attachments", description: "Remove images from the current draft", busy: "run" },
   { name: "models", description: "Refresh the model catalog", argumentHint: "<refresh>", busy: "idle" },

package/src/apps/shell.ts

@@ -656,7 +656,7 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
     }
     case "update":
       if (tui) tui.checkForUpdate();
-      else await runManualUpdate({ offline: app.args.offline === true }, app.io.say);
+      else await runManualUpdate({ offline: app.args.offline === true, install: true }, app.io.say);
       return "continue";
     case "copy":
       await copyLastReply(app, tui ?? undefined);

package/src/apps/startup.ts

@@ -1588,7 +1588,7 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [-n|--name name] [--session-id id] [--version|-v]\n" +
           "            [models --refresh]\n" +
           "            [install|remove <source>... [--local]] [update [source] [--extensions]] [list]\n" +
-          "            [update --check]  Check for a newer xeno without installing\n" +
+          "            [update --check]  Check for a newer xeno without installing (/update installs)\n" +
           "            [config [--local]] [--export session [output.html]] [--offline]\n" +
           "            [--system-prompt <text-or-file>] [--append-system-prompt <text>]\n" +
           "            [--no-context-files|-nc]\n" +

package/src/apps/ui/app.ts

@@ -41,6 +41,7 @@ import { SUBSCRIPTION_OPTIONS, subscriptionById, loginGitHubCopilot, startCallba
 import { reportedCost } from "../../runtime/usage.ts";
 import { UpdateChecks } from "../update-check.ts";
 import { updateNotice } from "../../core/update-check.ts";
+import { assertNever } from "../../core/exhaustive.ts";
 import { isUpgrade } from "../../core/version.ts";
 import type { Effort } from "../../runtime/model.ts";
 import { readNode, readCursor, setSessionLabel } from "../../store/log.ts";
@@ -361,13 +362,17 @@ export class InteractiveApp implements Ui {
   checkForUpdate(): void {
     // The explicit action owns its result even when it joins a startup request.
     this.manualUpdateRequested = true;
-    void this.updateChecks.manual({ offline: this.app.args.offline === true }, (text, tone) => {
+    void this.updateChecks.manual({ offline: this.app.args.offline === true, install: true }, (text, tone) => {
       if (!this.disposed) this.notice(text, tone);
     }, activity => {
       if (this.disposed) return;
-      this.screen.setTransientActivity(activity.state === "checking" ? {
-        label: `Checking for xeno updates (current ${activity.current})`, timeoutMs: activity.timeoutMs,
-      } : undefined);
+      switch (activity.state) {
+        case "checking": this.screen.setTransientActivity({ label: `Checking for xeno updates (current ${activity.current})`, timeoutMs: activity.timeoutMs }); break;
+        case "installing": this.screen.setTransientActivity({ label: `Installing xeno ${activity.version}`, timeoutMs: activity.timeoutMs,
+          startedAt: activity.startedAt, ...(activity.detail ? { detail: activity.detail } : {}) }); break;
+        case "idle": this.screen.setTransientActivity(undefined); break;
+        default: assertNever(activity, "manual update activity");
+      }
     }).catch(() => {
       if (!this.disposed) {
         this.screen.setTransientActivity(undefined);

package/src/apps/update-check.ts

@@ -1,16 +1,21 @@
 /** Shared lifecycle for automatic hints and explicit checks; policy remains in core (D16). */
-import { installKind, manualUpdateResult, updateDisabled, updatePlan, type UpdateInput } from "../core/update-check.ts";
+import { dirname } from "node:path";
+import { installArgv, installKind, installResult, manualUpdateResult, updateDisabled, updatePlan, type UpdateInput } from "../core/update-check.ts";
 import { packageLocation, readUpdateCache, writeUpdateCache } from "../store/update-cache.ts";
 import { fetchLatestVersion, UPDATE_TIMEOUT_MS } from "../runtime/update-check.ts";
+import { INSTALL_TIMEOUT_MS, runInstall } from "../runtime/self-update.ts";
 import { XENO_VERSION } from "../runtime/oauth.ts";
 
 export interface UpdateOptions {
   readonly offline?: boolean;
   readonly enabled?: boolean | undefined;
+  /** Install a newer release after the check: `/update` does, `xeno update --check` never does. */
+  readonly install?: boolean;
 }
 
 export type ManualUpdateActivity =
   | { readonly state: "checking"; readonly current: string; readonly timeoutMs: number }
+  | { readonly state: "installing"; readonly version: string; readonly timeoutMs: number; readonly startedAt: number; readonly detail?: string }
   | { readonly state: "idle" };
 
 type ManualUpdateReporter = (text: string, tone?: "info" | "error") => void;
@@ -19,6 +24,8 @@ export class UpdateChecks {
   private readonly controller = new AbortController();
   private pending: Promise<string | null> | undefined;
   private manualTask: Promise<number> | undefined;
+  /** The release this process already installed; the running code stays old until a restart. */
+  private installed: string | undefined;
 
   async prepare(options: UpdateOptions, manual = false) {
     const location = packageLocation();
@@ -50,6 +57,10 @@ export class UpdateChecks {
   }
 
   private async runManual(options: UpdateOptions, say: ManualUpdateReporter, onActivity?: (activity: ManualUpdateActivity) => void): Promise<number> {
+    if (options.install && this.installed) {
+      say(`xeno ${this.installed} is already installed. Restart xeno to use it.`);
+      return 0;
+    }
     const { input, plan, disabled } = await this.prepare(options, true);
     if (this.controller.signal.aborted) return 130;
     if (!plan.check) {
@@ -63,13 +74,32 @@ export class UpdateChecks {
       const latest = await this.refresh(input);
       if (this.controller.signal.aborted) return 130;
       const result = manualUpdateResult(latest, input.current, input.install);
-      say(result.text, result.status === "failed" ? "error" : "info");
-      return result.status === "failed" ? 1 : 0;
+      const argv = options.install && result.status === "available" && latest ? installArgv(input.install, latest) : undefined;
+      if (!argv || !latest) {
+        say(result.text, result.status === "failed" ? "error" : "info");
+        return result.status === "failed" ? 1 : 0;
+      }
+      return await this.install(argv, latest, input.current, say, onActivity);
     } finally {
       if (onActivity) onActivity({ state: "idle" });
     }
   }
 
+  private async install(argv: readonly string[], latest: string, current: string, say: ManualUpdateReporter, onActivity?: (activity: ManualUpdateActivity) => void): Promise<number> {
+    const startedAt = Date.now();
+    if (onActivity) onActivity({ state: "installing", version: latest, timeoutMs: INSTALL_TIMEOUT_MS, startedAt });
+    else say(`Installing xeno ${latest} with ${argv.join(" ")}...`);
+    const outcome = await runInstall(argv, {
+      signal: this.controller.signal, timeoutMs: INSTALL_TIMEOUT_MS, writableDir: dirname(packageLocation().root),
+      ...(onActivity ? { onLine: (detail: string) => onActivity({ state: "installing", version: latest, timeoutMs: INSTALL_TIMEOUT_MS, startedAt, detail }) } : {}),
+    });
+    if (outcome.kind === "cancelled") return 130;
+    const result = installResult(outcome, argv, current, latest);
+    if (result.ok) this.installed = latest;
+    say(result.text, result.ok ? "info" : "error");
+    return result.ok ? 0 : 1;
+  }
+
   cancel(): void { this.controller.abort(); }
 }
 

package/src/core/update-check.ts

@@ -8,6 +8,8 @@
  * environment and the cached answer are all arguments, so every rule is a
  * plain function of its inputs. Explicit checks bypass automatic scheduling
  * and opt-outs, while retaining the offline and source-checkout boundaries.
+ * An explicit `/update` also installs (docs/tasks/fix-update-installs.md):
+ * typing the command is the consent automatic installation never has.
  */
 import { compareVersions, isUpgrade, parseVersion } from "./version.ts";
 
@@ -76,6 +78,44 @@ export function upgradeCommand(install: InstallKind): string | undefined {
   }
 }
 
+/**
+ * What an explicit `/update` runs: the package manager the notice names,
+ * pinned to the version just checked so `latest` cannot move between the
+ * check and the install. Argv, never a shell string. Undefined where xeno
+ * cannot know the right command and only the notice applies.
+ */
+export function installArgv(install: InstallKind, version: string): readonly string[] | undefined {
+  switch (install) {
+    case "bun": return ["bun", "add", "-g", `${PACKAGE_NAME}@${version}`];
+    case "npm": return ["npm", "i", "-g", `${PACKAGE_NAME}@${version}`];
+    case "other": case "checkout": return undefined;
+  }
+}
+
+export type InstallOutcome =
+  | { readonly kind: "installed" }
+  | { readonly kind: "exit"; readonly code: number; readonly output: readonly string[] }
+  | { readonly kind: "timeout"; readonly ms: number; readonly output: readonly string[] }
+  | { readonly kind: "unavailable"; readonly reason: string }
+  | { readonly kind: "cancelled" };
+
+/**
+ * How an install ended, in words a person can act on. A bare exit code hides
+ * ENOTEMPTY and EACCES (codex #5015, #21897), so failures carry the package
+ * manager's last lines and always the command to run by hand.
+ */
+export function installResult(outcome: InstallOutcome, argv: readonly string[], current: string, latest: string): { readonly ok: boolean; readonly text: string } {
+  const manual = `Run it yourself: ${argv.join(" ")}`;
+  const tail = (output: readonly string[]) => output.length ? `\n${output.map(line => `  ${line}`).join("\n")}` : "";
+  switch (outcome.kind) {
+    case "installed": return { ok: true, text: `Updated xeno ${current} → ${latest}. Restart xeno to use it.` };
+    case "exit": return { ok: false, text: `Could not update xeno: ${argv[0]} exited ${outcome.code}.${tail(outcome.output)}\n${manual}` };
+    case "timeout": return { ok: false, text: `Could not update xeno: ${argv[0]} did not finish within ${Math.round(outcome.ms / 1000)}s and was stopped.${tail(outcome.output)}\n${manual}` };
+    case "unavailable": return { ok: false, text: `Could not update xeno: ${outcome.reason}.\n${manual}` };
+    case "cancelled": return { ok: false, text: "xeno update cancelled." };
+  }
+}
+
 /** Two lines: what is new, then the command on its own line so it can be copied whole. */
 export function updateNotice(latest: string, current: string, install: InstallKind): string {
   const command = upgradeCommand(install);

package/src/runtime/oauth.ts

@@ -18,7 +18,7 @@ import { pollDeviceCode } from "./oauth-device.ts";
 import { parseDeviceAuthorization, parseOAuthTokens } from "../core/oauth-fields.ts";
 
 /** Matches package.json. Sent as User-Agent so the server can see who we are (D18). */
-export const XENO_VERSION = "0.7.1";
+export const XENO_VERSION = "0.7.2";
 
 /**
  * Minutes subtracted from server expiry so a request issued at the edge

package/src/runtime/self-update.ts

@@ -0,0 +1,74 @@
+/**
+ * Run the package manager for an explicit `/update` (docs/tasks/fix-update-installs.md).
+ *
+ * The argv comes from core's `installArgv`; this module only owns the process.
+ * Every competitor runs the install unbounded, and that is exactly what their
+ * hang reports are about (claude-code #80147, opencode #10921 `bun add`
+ * stuck forever), so the install has a deadline and streams its latest line
+ * to the caller as evidence that it is moving.
+ */
+import { access, constants } from "node:fs/promises";
+import type { InstallOutcome } from "../core/update-check.ts";
+
+/** A global bun/npm install normally takes seconds; three minutes covers a slow registry. Assumed. */
+export const INSTALL_TIMEOUT_MS = 180_000;
+/** Lines of package-manager output kept for a failure message: enough for an npm error block. */
+const TAIL_LINES = 6;
+
+export interface InstallOptions {
+  readonly signal?: AbortSignal;
+  readonly timeoutMs?: number;
+  /** The package manager's newest non-empty output line. */
+  readonly onLine?: (line: string) => void;
+  /** Refuse before spawning when this directory cannot be written, as pi does. */
+  readonly writableDir?: string;
+}
+
+const ANSI = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07]*\x07|\r/g;
+
+export async function runInstall(argv: readonly string[], options: InstallOptions = {}): Promise<InstallOutcome> {
+  if (options.signal?.aborted) return { kind: "cancelled" };
+  if (options.writableDir) {
+    try { await access(options.writableDir, constants.W_OK); }
+    catch { return { kind: "unavailable", reason: `${options.writableDir} is not writable by this user` }; }
+  }
+  // Resolve through PATH like the person's own shell would; a bun-run xeno can always fall back to its own bun.
+  const program = Bun.which(argv[0]!) ?? (argv[0] === "bun" ? process.execPath : null);
+  if (!program) return { kind: "unavailable", reason: `${argv[0]} was not found on PATH` };
+  let child: ReturnType<typeof Bun.spawn<"ignore", "pipe", "pipe">>;
+  try { child = Bun.spawn([program, ...argv.slice(1)], { stdin: "ignore", stdout: "pipe", stderr: "pipe" }); }
+  catch (error) { return { kind: "unavailable", reason: error instanceof Error ? error.message : String(error) }; }
+
+  const output: string[] = [];
+  const read = async (stream: ReadableStream<Uint8Array>) => {
+    const decoder = new TextDecoder();
+    let pending = "";
+    const take = (line: string) => {
+      const clean = line.replace(ANSI, "").trim();
+      if (!clean) return;
+      output.push(clean); if (output.length > TAIL_LINES) output.shift();
+      options.onLine?.(clean);
+    };
+    for await (const chunk of stream) {
+      const lines = (pending + decoder.decode(chunk, { stream: true })).split("\n");
+      pending = lines.pop()!;
+      lines.forEach(take);
+    }
+    take(pending + decoder.decode());
+  };
+
+  let stopped: "timeout" | "cancelled" | undefined;
+  const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS;
+  const timer = setTimeout(() => { stopped = "timeout"; child.kill(); }, timeoutMs);
+  const abort = () => { stopped ??= "cancelled"; child.kill(); };
+  options.signal?.addEventListener("abort", abort, { once: true });
+  try {
+    const [code] = await Promise.all([child.exited, read(child.stdout), read(child.stderr)]);
+    if (stopped === "timeout") return { kind: "timeout", ms: timeoutMs, output };
+    if (stopped === "cancelled") return { kind: "cancelled" };
+    return code === 0 ? { kind: "installed" } : { kind: "exit", code, output };
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abort);
+  }
+}

package/src/tui/ui/screen.ts

@@ -96,7 +96,7 @@ export class Screen {
   private sidebarWanted = true;
   private status: StatusModel | undefined;
   private dockState: DockState = { model: "", thinking: "", busy: false, activity: "" };
-  private transientActivity: { readonly label: string; readonly startedAt: number; readonly timeoutMs: number } | undefined;
+  private transientActivity: { readonly label: string; readonly startedAt: number; readonly timeoutMs: number; readonly detail?: string } | undefined;
   private home: Greeting | undefined;
   private greetingPlayed = false;
   private greetingFrame = MASCOT_FRAMES;
@@ -349,8 +349,9 @@ export class Screen {
     this.paintEdges();
   }
 
-  setTransientActivity(activity: { readonly label: string; readonly timeoutMs: number } | undefined): void {
-    this.transientActivity = activity ? { ...activity, startedAt: Date.now() } : undefined;
+  /** `startedAt` keeps the elapsed clock running when a long activity only refreshes its detail line. */
+  setTransientActivity(activity: { readonly label: string; readonly timeoutMs: number; readonly startedAt?: number; readonly detail?: string } | undefined): void {
+    this.transientActivity = activity ? { ...activity, startedAt: activity.startedAt ?? Date.now() } : undefined;
     this.syncActivity();
     this.paintEdges();
   }
@@ -427,7 +428,7 @@ export class Screen {
     const activity = this.transientActivity!;
     const elapsed = Math.max(0, Math.floor((Date.now() - activity.startedAt) / 1000));
     const deadline = Math.max(1, Math.ceil(activity.timeoutMs / 1000));
-    return `${activity.label} · ${elapsed}s / ${deadline}s max`;
+    return `${activity.label} · ${elapsed}s / ${deadline}s max${activity.detail ? ` · ${activity.detail}` : ""}`;
   }
 
   /** The spinner's current interval (tests). */