agenter-app 1.0.3 → 1.2.0

package/server.js

@@ -12,6 +12,11 @@ const openDashboard = require('./lib/open-dashboard');
 const { truncate, describeTool, readTail, readHead, parseCodexItem, readTranscript, lastAssistantText, transcriptInfo } = require('./lib/transcript');
 const { normalizeLimits, codexWindowLabel } = require('./lib/limits');
 const { buildDiffs } = require('./lib/diff');
+const { getToken, sameToken } = require('./lib/token');
+const { version: VERSION } = require('./package.json');
+const updates = require('./lib/update');
+const { createTerminals } = require('./lib/terminal');
+const { readMemory, saveMemory, carriedContext } = require('./lib/memory');
 
 const PORT = Number(process.env.AGENTER_PORT) || 4317;
 const HOST = '127.0.0.1';
@@ -26,6 +31,8 @@ const MAX_ACTIVITY = 200;
 const DISCONNECT_GRACE_MS = 15000;
 // If you switch away from the dashboard (to VS Code, say) this long, same thing.
 const BLUR_GRACE_MS = 5000;
+// While this exists hook.js won't restart the server, so an app you quit stays quit.
+const STOPPED_FILE = path.join(SETTINGS_DIR, 'stopped');
 const DISCOVER_INTERVAL_MS = 30000;
 const DISCOVER_FULL_SCAN_MS = 5 * 60 * 1000; // when a file watcher catches changes in between
 // Plan usage (5-hour session / weekly limits) comes from the same endpoint Claude
@@ -33,6 +40,9 @@ const DISCOVER_FULL_SCAN_MS = 5 * 60 * 1000; // when a file watcher catches chan
 const CREDENTIALS_FILE = path.join(os.homedir(), '.claude', '.credentials.json');
 const USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 const USAGE_INTERVAL_MS = 2 * 60 * 1000;
+// A window opening also checks, so a long-running server still tells you about updates.
+const UPDATE_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const UPDATE_THROTTLE_MS = 60 * 1000;
 
 const sessions = new Map(); // session_id -> session
 const pending = new Map(); // pending id -> { item, res, payload }
@@ -339,9 +349,12 @@ async function checkRollout(file) {
     s.codexTurnOpen = tail.turnOpen;
     s.status = codexStatus(s);
     const last = tail.last;
+    // While working, only a running tool is current; the last reply may be from the previous turn.
     s.lastAction =
-      s.status === 'working' && last?.kind === 'tool'
-        ? `${last.name}: ${last.text.split('\n')[0]}`.slice(0, 160)
+      s.status === 'working'
+        ? last?.kind === 'tool'
+          ? `${last.name}: ${last.text.split('\n')[0]}`.slice(0, 160)
+          : ''
         : (lastAssistantText(file) || '').split('\n')[0].slice(0, 160);
     return true;
   } catch {
@@ -457,6 +470,56 @@ function noteCodexLimits(rl, at) {
   codexUsage = { updatedAt: at, plan: rl.plan_type || '', limits, credits: rl.credits || null };
 }
 
+// ---------- updates ----------
+
+let latestVersion = updates.cachedLatest();
+let updateCheckedAt = 0;
+
+async function checkForUpdate() {
+  if (!updates.enabled()) return;
+  updateCheckedAt = Date.now();
+  latestVersion = (await updates.checkLatest({ timeoutMs: 10000 })) || latestVersion;
+  broadcast();
+}
+
+function updateState() {
+  const installed = updates.installedVersion();
+  return {
+    current: VERSION,
+    latest: latestVersion,
+    installed,
+    available: updates.isNewer(latestVersion, VERSION) && !updates.isNewer(installed, VERSION),
+    restart: updates.isNewer(installed, VERSION), // installed, but this server is still the old code
+    canSelfUpdate: updates.canSelfUpdate(),
+  };
+}
+
+// ---------- terminal ----------
+
+const TERMINAL_ENABLED = process.platform === 'win32' && process.env.AGENTER_TERMINAL !== '0';
+const terminals = createTerminals((e) => sendAll('terminal', e));
+const terminalId = (cwd) => path.resolve(cwd).toLowerCase();
+
+// ---------- folder window ----------
+// The dashboard can't browse this machine's folders itself, so the server opens Windows' own.
+
+let pickingFolder = null;
+
+function pickFolder(start) {
+  return new Promise((resolve) => {
+    if (pickingFolder) return resolve({ busy: true });
+    if (process.platform !== 'win32') return resolve({ unsupported: true });
+    const args = ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-STA', '-File', path.join(__dirname, 'scripts', 'pick-folder.ps1')];
+    pickingFolder = execFile('powershell.exe', args, { windowsHide: true, env: { ...process.env, AGENTER_PICK_START: String(start || '') } }, (err, out) => {
+      pickingFolder = null;
+      onAttentionChanged();
+      const folder = String(out || '').trim();
+      resolve(err ? { unsupported: true } : folder ? { path: folder } : { cancelled: true });
+    });
+    onAttentionChanged();
+  });
+}
+
 function openInVSCode(cwd) {
   if (!cwd || /["&|<>^%]/.test(cwd) || !fs.existsSync(cwd)) return false;
   const child =
@@ -543,7 +606,9 @@ async function findApps(cwd) {
 function addActivity(s, kind, text, extra = {}) {
   s.activity.push({ t: Date.now(), kind, text: truncate(text, 4000), ...extra });
   if (s.activity.length > MAX_ACTIVITY) s.activity.splice(0, s.activity.length - MAX_ACTIVITY);
-  s.lastAction = (extra.tool ? `${extra.tool}: ` : '') + String(text).split('\n')[0].slice(0, 160);
+  // lastAction is what the agent is doing. A prompt is what you said, so it starts blank
+  // (the dashboard shows "Working…") until the agent reports something.
+  s.lastAction = kind === 'prompt' ? '' : (extra.tool ? `${extra.tool}: ` : '') + String(text).split('\n')[0].slice(0, 160);
 }
 
 // Who drives a session: 'vscode' (Agenter only answers inside VS Code's turns) or
@@ -562,7 +627,8 @@ function hold(s, kind, data, payload, res) {
   const item = { id: crypto.randomUUID(), sessionId: s.id, kind, createdAt: Date.now(), headless: runners.has(s.id), ...data };
   const entry = { item, res, payload, timer: null };
   const minutes = Number(settings.holdMinutes) || 0;
-  if (minutes > 0) {
+  // A turn Agenter runs has no VS Code to go back to, so it waits for your answer.
+  if (minutes > 0 && !item.headless) {
     item.releaseAt = item.createdAt + minutes * 60000;
     entry.timer = setTimeout(() => respond(item.id, 'pass', { auto: true }), minutes * 60000);
   }
@@ -579,6 +645,17 @@ function hold(s, kind, data, payload, res) {
   broadcast();
 }
 
+// A turn Agenter ran is over, so anything it was waiting on can't be answered any more.
+function releaseRun(s) {
+  for (const [id, e] of [...pending]) {
+    if (e.item.sessionId !== s.id || !e.item.headless) continue;
+    clearTimeout(e.timer);
+    pending.delete(id);
+    e.res.writeHead(200, { 'content-type': 'application/json' });
+    e.res.end('{}');
+  }
+}
+
 // action: allow | always | deny | answer | reply | pass
 function respond(id, action, body = {}) {
   const entry = pending.get(id);
@@ -640,7 +717,8 @@ function respond(id, action, body = {}) {
 
 // Sessions are only held while a dashboard window has focus. If you're in VS Code,
 // Claude finishes (or asks) there as usual instead of spinning on the dashboard.
-const inUse = () => [...clients.values()].some((c) => c.focused);
+// The folder window takes focus from the dashboard, but you're still here.
+const inUse = () => !!pickingFolder || [...clients.values()].some((c) => c.focused);
 
 let releaseTimer = null;
 function onAttentionChanged() {
@@ -652,6 +730,39 @@ function onAttentionChanged() {
   }, clients.size ? BLUR_GRACE_MS : DISCONNECT_GRACE_MS);
 }
 
+// Quit, from the tray. Open windows close themselves on the 'quit' event.
+// A restart (to finish an update) leaves them open; they reconnect to the new server.
+function stopServer({ restart = false } = {}) {
+  if (!restart) sendAll('quit', {});
+  for (const id of [...pending.keys()]) respond(id, 'pass');
+  for (const child of runners.values()) {
+    child.interrupted = true;
+    killRun(child);
+  }
+  terminals.killAll();
+  pickingFolder?.kill();
+  if (restart) {
+    // It waits for this process to let go of the port.
+    const env = { ...process.env, AGENTER_RESTART: '1' };
+    spawn(process.execPath, [path.join(__dirname, 'server.js'), '--no-open'], { detached: true, stdio: 'ignore', windowsHide: true, env }).unref();
+  } else {
+    fs.mkdirSync(SETTINGS_DIR, { recursive: true });
+    fs.writeFileSync(STOPPED_FILE, '');
+  }
+  // Long enough for the hooks to receive those answers.
+  setTimeout(() => process.exit(0), 300);
+}
+
+// The tray icon. It watches this process, so it goes away when the server does.
+function startTray() {
+  if (process.platform !== 'win32' || process.env.AGENTER_TRAY === '0') return;
+  const args = ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-STA', '-WindowStyle', 'Hidden', '-File', path.join(__dirname, 'scripts', 'tray.ps1'), '-ServerPid', String(process.pid), '-Node', process.execPath, '-Port', String(PORT)];
+  // Not detached: PowerShell exits at once without a console.
+  const child = spawn('powershell.exe', args, { stdio: 'ignore', windowsHide: true });
+  child.on('error', () => {});
+  child.unref();
+}
+
 // ---------- steering ----------
 // Messages typed in the dashboard while Claude isn't waiting for a reply. Hooks only run
 // at events, so they wait here and go out with the next one: after the current tool
@@ -729,6 +840,7 @@ function startRun(s, text, { fresh = false } = {}) {
   child.on('error', (e) => (err = e.message));
   child.on('close', (code) => {
     runners.delete(s.id);
+    releaseRun(s);
     if (code && !child.interrupted) addActivity(s, 'notice', `Claude stopped with an error${err.trim() ? `: ${err.trim()}` : ''}`);
     if (child.interrupted) addActivity(s, 'notice', 'Stopped from Agenter');
     settleStatus(s, 'idle');
@@ -742,6 +854,12 @@ function startRun(s, text, { fresh = false } = {}) {
   return true;
 }
 
+// Ends a turn along with what it started: tools, and hooks still waiting on the dashboard.
+function killRun(child) {
+  if (process.platform !== 'win32') return child.kill();
+  execFile('taskkill', ['/pid', String(child.pid), '/T', '/F'], { windowsHide: true }, (err) => err && child.kill());
+}
+
 // ---------- steering Codex ----------
 // Driven from the Codex app (default): `codex queue` hands the message to Codex, which runs
 // it as the next turn of that session in the VS Code extension or the desktop app.
@@ -780,22 +898,37 @@ function findCodex() {
   return null;
 }
 
+// Windows only runs a .cmd through a shell, which would treat your message as commands.
+// npm's codex.cmd just starts a script with Node, so start that script directly.
+function codexCommand(bin) {
+  if (!bin.endsWith('.cmd')) return [bin];
+  try {
+    const script = fs.readFileSync(bin, 'utf8').match(/"%~?dp0%?[\\/]([^"]+\.js)"/i)?.[1];
+    if (script) return [process.execPath, path.join(path.dirname(bin), script)];
+  } catch {}
+  return null;
+}
+
 async function steerCodex(s, text) {
+  // A turn Agenter is running keeps the session here, even if the switch moved since it started.
+  if (runners.has(s.id)) {
+    // `exec` can't take messages mid-turn; this runs as the next turn.
+    s.queue.push({ id: crypto.randomUUID(), text, t: Date.now() });
+    broadcast();
+    return 'queued';
+  }
   if (driveOf(s) === 'agenter') {
-    if (runners.has(s.id)) {
-      // `exec` can't take messages mid-turn; this runs as the next turn.
-      s.queue.push({ id: crypto.randomUUID(), text, t: Date.now() });
-      broadcast();
-      return 'queued';
-    }
     if (!(await startCodexRun(s, text))) return 'no-codex';
     addActivity(s, 'prompt', text, { fromDashboard: true });
     return 'started';
   }
   const bin = findCodex();
   if (!bin) return 'no-codex';
+  const command = codexCommand(bin);
+  if (!command) return 'error';
+  const [file, ...prefix] = command;
   return new Promise((resolve) => {
-    execFile(bin, ['queue', '--thread', s.id, '--message', text], { windowsHide: true, timeout: 30000, shell: bin.endsWith('.cmd') }, (err) => {
+    execFile(file, [...prefix, 'queue', '--thread', s.id, '--message', text], { windowsHide: true, timeout: 30000 }, (err) => {
       if (err) return resolve('error');
       addActivity(s, 'prompt', text, { fromDashboard: true });
       resolve('codex-queued');
@@ -849,6 +982,7 @@ function startCodexRun(s, text, { fresh = false } = {}) {
       // Never got going (Codex missing a login, bad folder…): report why to whoever asked.
       if (runners.get(s.id) !== child) return resolve(fresh ? { error: failure || err.trim().split('\n').pop() || `Codex exited (${code}).` } : false);
       runners.delete(s.id);
+      releaseRun(s);
       s.codexTurnOpen = false;
       if ((code || failure) && !child.interrupted) addActivity(s, 'notice', `Codex stopped with an error${failure || err.trim() ? `: ${failure || err.trim().split('\n').pop()}` : ''}`);
       if (child.interrupted) addActivity(s, 'notice', 'Stopped from Agenter');
@@ -862,6 +996,15 @@ function startCodexRun(s, text, { fresh = false } = {}) {
   });
 }
 
+// ---------- memory ----------
+
+const memoryContext = (s) => ({ agent: s.agent, cwd: s.cwd, transcriptPath: s.transcriptPath, home: os.homedir(), codexHome: CODEX_HOME });
+
+function carryFrom(s) {
+  const t = s?.transcriptPath && readTranscript(s.transcriptPath);
+  return t ? carriedContext({ agent: s.agent, cwd: s.cwd, title: s.title, messages: t.messages }) : '';
+}
+
 // ---------- hook events ----------
 
 function handleHook(p, res) {
@@ -944,6 +1087,9 @@ function handleHook(p, res) {
 
 function snapshot() {
   return {
+    version: VERSION,
+    update: updateState(),
+    terminal: TERMINAL_ENABLED,
     settings,
     usage,
     codexUsage,
@@ -953,14 +1099,18 @@ function snapshot() {
   };
 }
 
+const sendAll = (event, data) => {
+  const msg = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+  for (const c of clients.keys()) c.write(msg);
+};
+
 let broadcastQueued = false;
 function broadcast() {
   if (broadcastQueued) return;
   broadcastQueued = true;
   setTimeout(() => {
     broadcastQueued = false;
-    const msg = `event: state\ndata: ${JSON.stringify(snapshot())}\n\n`;
-    for (const c of clients.keys()) c.write(msg);
+    sendAll('state', snapshot());
   }, 30);
 }
 
@@ -994,11 +1144,29 @@ const json = (res, code, obj) => {
 const STATIC = {
   '/': ['index.html', 'text/html; charset=utf-8'],
   '/app.js': ['app.js', 'text/javascript; charset=utf-8'],
+  '/theme.js': ['theme.js', 'text/javascript; charset=utf-8'],
   '/style.css': ['style.css', 'text/css; charset=utf-8'],
   '/icon.png': ['icon.png', 'image/png'],
   '/favicon.ico': ['agenter.ico', 'image/x-icon'],
 };
 
+// frame-src stays open for http(s): Preview shows whatever app address you type.
+const CSP = [
+  "default-src 'none'",
+  "script-src 'self'",
+  "style-src-elem 'self' https://fonts.googleapis.com",
+  "style-src-attr 'unsafe-inline'",
+  'font-src https://fonts.gstatic.com',
+  "img-src 'self' data:",
+  "connect-src 'self'",
+  'frame-src http: https:',
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'",
+].join('; ');
+
+const TOKEN = require.main === module ? getToken() : '';
+
 const ALLOWED_HOSTS = new Set([`127.0.0.1:${PORT}`, `localhost:${PORT}`]);
 const ALLOWED_ORIGINS = new Set([...ALLOWED_HOSTS].map((h) => `http://${h}`));
 
@@ -1008,6 +1176,10 @@ const server = http.createServer(async (req, res) => {
     return json(res, 403, { error: 'forbidden' });
   }
   const url = new URL(req.url, `http://${req.headers.host}`);
+  // The page itself holds no secrets. Everything else needs the token; a custom header also
+  // forces a CORS preflight, which we never approve. EventSource can't set headers.
+  const given = req.headers['x-agenter-token'] ?? (url.pathname === '/events' ? url.searchParams.get('token') : null);
+  if (!(req.method === 'GET' && STATIC[url.pathname]) && !sameToken(given, TOKEN)) return json(res, 401, { error: 'unauthorized' });
 
   try {
     if (req.method === 'POST' && url.pathname === '/hook') {
@@ -1016,7 +1188,7 @@ const server = http.createServer(async (req, res) => {
 
     if (req.method === 'GET' && STATIC[url.pathname]) {
       const [file, type] = STATIC[url.pathname];
-      res.writeHead(200, { 'content-type': type, 'cache-control': 'no-store' });
+      res.writeHead(200, { 'content-type': type, 'cache-control': 'no-store', 'content-security-policy': CSP });
       return res.end(fs.readFileSync(path.join(PUBLIC_DIR, file)));
     }
 
@@ -1026,6 +1198,7 @@ const server = http.createServer(async (req, res) => {
       clients.set(res, { id: url.searchParams.get('client') || '', focused: url.searchParams.get('focused') === '1' });
       onAttentionChanged();
       if (!usage || Date.now() - usage.fetchedAt > 60000) fetchUsage();
+      if (Date.now() - updateCheckedAt > UPDATE_THROTTLE_MS) checkForUpdate();
       const ping = setInterval(() => res.write(': ping\n\n'), 20000);
       req.on('close', () => {
         clearInterval(ping);
@@ -1052,11 +1225,52 @@ const server = http.createServer(async (req, res) => {
       return json(res, 200, { apps: await findApps(s.cwd), detects: process.platform === 'win32' });
     }
 
+    if (req.method === 'GET' && url.pathname === '/api/memory') {
+      const s = sessions.get(url.searchParams.get('session'));
+      if (!s) return json(res, 404, { error: 'unknown session' });
+      return json(res, 200, { files: readMemory(memoryContext(s)) });
+    }
+
     if (req.method === 'POST' && url.pathname.startsWith('/api/')) {
-      // A custom header forces a CORS preflight, which we never approve.
-      if (req.headers['x-agenter'] !== '1') return json(res, 403, { error: 'forbidden' });
       const body = await readBody(req);
 
+      if (url.pathname === '/api/quit') {
+        stopServer();
+        return json(res, 200, {});
+      }
+      if (url.pathname === '/api/restart') {
+        stopServer({ restart: true });
+        return json(res, 200, {});
+      }
+      if (url.pathname === '/api/update') {
+        if (!TERMINAL_ENABLED) return json(res, 400, { error: 'Run agenter update in a terminal.' });
+        if (!updates.canSelfUpdate()) return json(res, 400, { error: 'This copy is a git clone. Update it with git pull.' });
+        const id = terminalId(os.homedir());
+        const term = terminals.open(id, os.homedir());
+        if (term.running) return json(res, 409, { error: 'That terminal is busy. Wait for it to finish, or press Stop.' });
+        const quote = (p) => `'${p.replace(/'/g, "''")}'`;
+        terminals.run(id, `& ${quote(process.execPath)} ${quote(path.join(__dirname, 'cli.js'))} update`, checkForUpdate);
+        return json(res, 200, { id });
+      }
+      if (url.pathname.startsWith('/api/terminal/')) {
+        if (!TERMINAL_ENABLED) return json(res, 400, { error: 'The terminal is turned off or not available here.' });
+        if (url.pathname === '/api/terminal/open') {
+          const cwd = sessions.get(body.sessionId)?.cwd;
+          const folder = cwd && fs.existsSync(cwd) ? cwd : os.homedir();
+          return json(res, 200, terminals.open(terminalId(folder), folder));
+        }
+        const ok = url.pathname === '/api/terminal/run' ? terminals.run(body.id, String(body.input ?? '')) : url.pathname === '/api/terminal/stop' && terminals.stop(body.id);
+        return json(res, ok ? 200 : 404, {});
+      }
+      if (url.pathname === '/api/pick-folder') {
+        return json(res, 200, await pickFolder(body.start));
+      }
+      if (url.pathname === '/api/memory/save') {
+        const s = sessions.get(body.sessionId);
+        if (!s) return json(res, 404, { error: 'unknown session' });
+        const { status, ...out } = saveMemory(memoryContext(s), body.path, body.text, body.mtime);
+        return json(res, status, out);
+      }
       if (url.pathname === '/api/respond') {
         const s = sessions.get(pending.get(body.id)?.item.sessionId);
         const ok = respond(body.id, body.action, body);
@@ -1087,6 +1301,8 @@ const server = http.createServer(async (req, res) => {
         const cwd = String(body.cwd || '').trim().replace(/^"(.*)"$/, '$1');
         const text = String(body.message || '').trim();
         const codex = body.agent === 'codex';
+        const carried = carryFrom(sessions.get(body.fromSessionId));
+        const prompt = carried ? `${text}\n\n${carried}` : text;
         if (!text) return json(res, 400, { error: `Type a first message for ${codex ? 'Codex' : 'Claude'}.` });
         let isDir = false;
         try {
@@ -1098,7 +1314,7 @@ const server = http.createServer(async (req, res) => {
           // Codex names the session itself, so it's registered once Codex has started it.
           const draft = Object.assign(newSession(''), { agent: 'codex', title: text.split('\n')[0].slice(0, 140), lastEventAt: Date.now() });
           setCwd(draft, path.resolve(cwd));
-          const started = await Promise.race([startCodexRun(draft, text, { fresh: true }), new Promise((r) => setTimeout(() => r({ error: 'Codex took too long to start.' }), 60000))]);
+          const started = await Promise.race([startCodexRun(draft, prompt, { fresh: true }), new Promise((r) => setTimeout(() => r({ error: 'Codex took too long to start.' }), 60000))]);
           if (!started?.id) return json(res, 500, { error: `Codex couldn't start: ${started?.error || 'unknown error'}` });
           settings.drive = { ...settings.drive, [started.id]: 'agenter' };
           saveSettings();
@@ -1113,7 +1329,7 @@ const server = http.createServer(async (req, res) => {
         s.lastEventAt = Date.now();
         settings.drive = { ...settings.drive, [s.id]: 'agenter' };
         saveSettings();
-        if (!startRun(s, text, { fresh: true })) {
+        if (!startRun(s, prompt, { fresh: true })) {
           sessions.delete(s.id);
           return json(res, 500, { error: "Couldn't start Claude." });
         }
@@ -1138,7 +1354,7 @@ const server = http.createServer(async (req, res) => {
         const child = runners.get(body.sessionId);
         if (child) {
           child.interrupted = true;
-          child.kill();
+          killRun(child);
         }
         return json(res, child ? 200 : 404, {});
       }
@@ -1187,7 +1403,9 @@ const server = http.createServer(async (req, res) => {
 server.requestTimeout = 0; // hooks can legitimately wait a long time for you
 // Only listen when run directly; the tests load this file to drive the hook and steering logic.
 if (require.main === module) {
+  let portRetries = process.env.AGENTER_RESTART ? 50 : 0;
   server.on('error', (err) => {
+    if (err.code === 'EADDRINUSE' && portRetries-- > 0) return void setTimeout(() => server.listen(PORT, HOST), 200);
     if (err.code === 'EADDRINUSE') console.error(`Port ${PORT} is busy. Is Agenter already running? (Set AGENTER_PORT to use another port.)`);
     else console.error(err);
     process.exit(1);
@@ -1195,10 +1413,18 @@ if (require.main === module) {
   server.listen(PORT, HOST, () => {
     const url = `http://localhost:${PORT}`;
     console.log(`Agenter dashboard: ${url}`);
+    delete process.env.AGENTER_RESTART;
+    fs.rmSync(STOPPED_FILE, { force: true });
+    // Shortcuts start us inside the install folder, and on Windows a folder that's in use
+    // can't be replaced by `npm i -g`. Everything here uses full paths.
+    process.chdir(os.homedir());
+    startTray();
     startDiscovery();
     startCodexDiscovery();
     fetchUsage();
     setInterval(fetchUsage, USAGE_INTERVAL_MS);
+    checkForUpdate();
+    setInterval(checkForUpdate, UPDATE_INTERVAL_MS);
     if (!process.argv.includes('--no-open')) openDashboard(url);
   });
 }
@@ -1207,5 +1433,5 @@ module.exports = {
   sessions, pending, clients, runners, dismissed,
   get settings() { return settings; },
   handleHook, hold, respond, steer, takeQueue, touchSession, snapshot, driveOf, effectiveHold,
-  findClaude, findCodex,
+  findClaude, findCodex, codexCommand, releaseRun,
 };