bloby-bot 0.66.1 → 0.68.0

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "bloby-bot",
-  "version": "0.66.1",
+  "version": "0.68.0",
   "releaseNotes": [
-    "1. Fix: image (and audio) attachments now render in chat again — /api/files is fetched with the auth token instead of a raw <img> src that 401'd after the endpoint hardening",
-    "2. Affects chat thumbnails, the image lightbox, voice-note playback, and agent image cards",
-    "3. Chat now renders Mac actions instead of raw tags: <mac_actions> arrays (and legacy <morphy_action>) fan out to clean \"Agent actions: Point at screen N\" chips, and card actions render as notch cards"
+    "1. Fix: agent self-update now actively relaunches the daemon (launchctl/systemctl) instead of relying on launchd KeepAlive — so `update` from chat/pulse comes back up reliably, matching manual `bloby update`",
+    "2. New agent control surface (/__bloby/control/*): restart-and-verify the backend in-turn, tail backend + frontend logs, and acked self-update — replacing the flaky touch .update/.restart triggers",
+    "3. Frontend errors (runtime, console, Vite) are now captured so the \"Copy error for your agent\" button is never empty"
   ],
   "description": "Self-hosted, self-evolving AI agent with its own dashboard.",
   "type": "module",
@@ -15,7 +15,6 @@
   "files": [
     "LICENSE",
     "bin/",
-    "cli/",
     "dist-bloby/",
     "supervisor/",
     "worker/",

package/scripts/install.sh

@@ -329,6 +329,7 @@ printf "\n"
 printf "    ${BLUE}bloby init${RESET}      Set up your bot\n"
 printf "    ${BLUE}bloby start${RESET}     Start your bot\n"
 printf "    ${BLUE}bloby status${RESET}    Check if it's running\n"
+printf "    ${BLUE}bloby help${RESET}      All commands\n"
 printf "\n"
 printf "  ${PINK}>${RESET} Run ${BLUE}bloby init${RESET} to begin.\n"
 printf "  ${DIM}(Open a new terminal if 'bloby' isn't found yet)${RESET}\n"

package/supervisor/backend.ts

@@ -9,6 +9,17 @@ let child: ChildProcess | null = null;
 let restarts = 0;
 let lastSpawnTime = 0;
 let intentionallyStopped = false;
+
+// Hard backstop against an orphaned backend. SIGTERM/SIGINT go through stopBackend() for a graceful
+// stop, but process.exit() (server EADDRINUSE handler, self-update relaunch, fatal errors) bypasses
+// those handlers AND can't run async cleanup — so the backend child would survive as an orphan
+// (PPID→1) still holding BACKEND_PORT, EADDRINUSE-ing every later backend spawn until killPort
+// happens to reclaim it. 'exit' fires on EVERY exit path (including process.exit) and allows the one
+// synchronous kill we need. (A SIGKILL of the supervisor itself can't be caught — killPort covers it
+// on the next startup.)
+process.on('exit', () => {
+  try { if (child && child.exitCode === null) child.kill('SIGKILL'); } catch {}
+});
 // True once the backend has crash-looped past MAX_RESTARTS and given up — i.e. it's down and
 // will NOT come back without the user fixing the code. The supervisor shows the "backend down"
 // interstitial in this state. Cleared on every spawn attempt (a deliberate restart is "trying again").

package/supervisor/channels/manager.ts

@@ -221,6 +221,8 @@ export class ChannelManager {
   /** Start WhatsApp connection (triggers QR flow if no credentials) */
   async connectWhatsApp(): Promise<void> {
     let provider = this.providers.get('whatsapp');
+    // Already linked and online — don't tear down a live socket to start a new one
+    if (provider?.getStatus().connected) return;
     if (!provider) {
       const whatsapp = new WhatsAppChannel(
         (sender, senderName, text, fromMe, isSelfChat, chatJid, isGroup, images, inboundKey) => {

package/supervisor/channels/whatsapp-auth.ts

@@ -0,0 +1,216 @@
+/**
+ * Atomic multi-file auth state for Baileys.
+ *
+ * Replaces Baileys' useMultiFileAuthState, whose writeData is a bare fs.writeFile
+ * (truncate-then-write, no rename). A process death between the truncate and the
+ * write leaves a 0-byte creds.json; on the next boot Baileys' readData swallows the
+ * JSON.parse error and silently mints a FRESH identity — the session looks "logged
+ * out" and the user is forced to re-scan the QR even though WhatsApp never unlinked
+ * the device. creds.update fires constantly while connected (key rotations,
+ * app-state sync), so that corruption window recurs for the whole session.
+ *
+ * Hardening over upstream:
+ * - Atomic writes: every file is written to a temp name then rename()d into place,
+ *   so a kill at any moment leaves the old or the new content — never a truncated file.
+ * - creds.json is mirrored to creds.json.bak on every save; on load, a missing or
+ *   corrupt creds.json is restored from the backup instead of re-initializing.
+ * - A corrupt creds.json with no usable backup is quarantined (renamed) so
+ *   hasCredentials() stops treating the dead session as linked.
+ */
+
+import { BufferJSON, initAuthCreds, proto } from '@whiskeysockets/baileys';
+import type { AuthenticationCreds, AuthenticationState, SignalDataTypeMap } from '@whiskeysockets/baileys';
+import { mkdir, readFile, rename, unlink, writeFile } from 'fs/promises';
+import fs from 'fs';
+import path from 'path';
+import { log } from '../../shared/logger.js';
+
+/** Serializes reads/writes per file path (Baileys events fire concurrently). In-process
+ *  only — cross-process safety comes from the atomic rename, not from this. */
+const fileQueues = new Map<string, Promise<unknown>>();
+
+function queued<T>(file: string, task: () => Promise<T>): Promise<T> {
+  const prev = fileQueues.get(file) || Promise.resolve();
+  const next = prev.then(task, task);
+  // Store a value-free tail (a resolved read would otherwise pin the file's contents
+  // in memory forever) and drop the entry once its queue drains.
+  const tail = next.then(() => undefined, () => undefined);
+  fileQueues.set(file, tail);
+  void tail.then(() => {
+    if (fileQueues.get(file) === tail) fileQueues.delete(file);
+  });
+  return next;
+}
+
+/** Await everything currently queued for an auth folder — drained on disconnect so a
+ *  process exit right after can't clip a signal-key or creds write. */
+export function flushAuthWrites(folder: string): Promise<void> {
+  const prefix = folder.endsWith(path.sep) ? folder : folder + path.sep;
+  const tails: Promise<unknown>[] = [];
+  for (const [file, tail] of fileQueues) {
+    if (file.startsWith(prefix)) tails.push(tail);
+  }
+  return Promise.all(tails).then(() => undefined);
+}
+
+/** Same name mangling as upstream so existing auth dirs keep working as-is. */
+const fixFileName = (file: string) => file.replace(/\//g, '__').replace(/:/g, '-');
+
+/** True when the parsed object looks like real Baileys credentials (not null/empty/garbage). */
+function isValidCreds(creds: unknown): creds is AuthenticationCreds {
+  const c = creds as AuthenticationCreds | null;
+  return !!(
+    c && typeof c === 'object' &&
+    c.noiseKey && c.signedIdentityKey && c.signedPreKey &&
+    typeof c.registrationId === 'number'
+  );
+}
+
+async function writeAtomic(filePath: string, data: string): Promise<void> {
+  const tmp = `${filePath}.${process.pid}.tmp`;
+  try {
+    await writeFile(tmp, data);
+    await rename(tmp, filePath);
+  } catch (err) {
+    try { await unlink(tmp); } catch {}
+    throw err;
+  }
+}
+
+export interface AtomicAuthState {
+  state: AuthenticationState;
+  saveCreds: () => Promise<void>;
+  /** creds.json was missing/corrupt but recovered from creds.json.bak */
+  restoredFromBackup: boolean;
+  /** No usable credentials found — a brand-new identity was initialized (pairing needed) */
+  freshIdentity: boolean;
+}
+
+export async function useAtomicMultiFileAuthState(folder: string): Promise<AtomicAuthState> {
+  await mkdir(folder, { recursive: true });
+
+  const filePath = (file: string) => path.join(folder, fixFileName(file));
+
+  // Sweep temp files orphaned by a previous process death mid-write
+  try {
+    for (const f of fs.readdirSync(folder)) {
+      if (f.endsWith('.tmp')) {
+        try { fs.unlinkSync(path.join(folder, f)); } catch {}
+      }
+    }
+  } catch {}
+
+  const readData = async (file: string): Promise<any> => {
+    try {
+      const data = await queued(filePath(file), () => readFile(filePath(file), { encoding: 'utf-8' }));
+      return JSON.parse(data, BufferJSON.reviver);
+    } catch {
+      return null;
+    }
+  };
+
+  const writeData = (data: unknown, file: string): Promise<void> => {
+    // Snapshot synchronously — the creds object mutates while writes are queued
+    const json = JSON.stringify(data, BufferJSON.replacer);
+    return queued(filePath(file), () => writeAtomic(filePath(file), json));
+  };
+
+  const removeData = (file: string): Promise<void> =>
+    queued(filePath(file), async () => {
+      try { await unlink(filePath(file)); } catch {}
+    });
+
+  // ── Load creds, recovering from backup when the primary is missing/corrupt ──
+  let creds: AuthenticationCreds | null = await readData('creds.json');
+  let restoredFromBackup = false;
+  if (!isValidCreds(creds)) {
+    const backup = await readData('creds.json.bak');
+    if (isValidCreds(backup)) {
+      creds = backup;
+      restoredFromBackup = true;
+      await writeData(backup, 'creds.json');
+      log.warn('[whatsapp] creds.json was missing or corrupt — restored from creds.json.bak');
+    } else {
+      if (fs.existsSync(filePath('creds.json'))) {
+        // Present but unreadable and no usable backup: quarantine it so the dead
+        // session isn't half-trusted, and start a clean pairing flow.
+        const quarantine = filePath(`creds.json.corrupt-${Date.now()}`);
+        try { await rename(filePath('creds.json'), quarantine); } catch {}
+        log.warn(`[whatsapp] creds.json is corrupt with no backup — quarantined as ${path.basename(quarantine)}; re-link required`);
+      }
+      // The corrupt backup must go too, or hasValidCredsFile() keeps presenting the
+      // dead session as "linked" on every future boot.
+      if (fs.existsSync(filePath('creds.json.bak'))) {
+        try { await rename(filePath('creds.json.bak'), filePath(`creds.json.bak.corrupt-${Date.now()}`)); } catch {}
+      }
+      creds = null;
+    }
+  }
+  const freshIdentity = !creds;
+  if (freshIdentity) {
+    // Any key material on disk is bound to a dead identity — sweep it so the fresh
+    // pairing starts clean instead of tripping over stale sessions and pre-keys.
+    // (Quarantined creds files are kept for forensics.)
+    try {
+      for (const f of fs.readdirSync(folder)) {
+        if (f === 'creds.json' || f.includes('.corrupt-')) continue;
+        try { fs.unlinkSync(path.join(folder, f)); } catch {}
+      }
+    } catch {}
+  }
+  const liveCreds: AuthenticationCreds = creds || initAuthCreds();
+
+  return {
+    state: {
+      creds: liveCreds,
+      keys: {
+        get: async (type, ids) => {
+          const data: { [_: string]: SignalDataTypeMap[typeof type] } = {};
+          await Promise.all(
+            ids.map(async (id) => {
+              let value = await readData(`${type}-${id}.json`);
+              if (type === 'app-state-sync-key' && value) {
+                value = proto.Message.AppStateSyncKeyData.fromObject(value);
+              }
+              data[id] = value;
+            }),
+          );
+          return data;
+        },
+        set: async (data) => {
+          const tasks: Promise<void>[] = [];
+          for (const category in data) {
+            const entries = data[category as keyof SignalDataTypeMap];
+            if (!entries) continue;
+            for (const id in entries) {
+              const value = entries[id];
+              const file = `${category}-${id}.json`;
+              tasks.push(value ? writeData(value, file) : removeData(file));
+            }
+          }
+          await Promise.all(tasks);
+        },
+      },
+    },
+    saveCreds: async () => {
+      // One snapshot for both files so primary and backup are always identical
+      const json = JSON.stringify(liveCreds, BufferJSON.replacer);
+      await queued(filePath('creds.json'), () => writeAtomic(filePath('creds.json'), json));
+      await queued(filePath('creds.json.bak'), () => writeAtomic(filePath('creds.json.bak'), json));
+    },
+    restoredFromBackup,
+    freshIdentity,
+  };
+}
+
+/** Sync check used by status endpoints: a linked session exists when creds.json (or its
+ *  backup) is present and non-empty. A 0-byte creds.json — the artifact of an interrupted
+ *  legacy write — no longer counts as "linked". */
+export function hasValidCredsFile(folder: string): boolean {
+  for (const name of ['creds.json', 'creds.json.bak']) {
+    try {
+      if (fs.statSync(path.join(folder, name)).size > 0) return true;
+    } catch {}
+  }
+  return false;
+}

package/supervisor/channels/whatsapp.ts

@@ -4,9 +4,8 @@
  */
 
 import makeWASocket, {
-  useMultiFileAuthState,
   makeCacheableSignalKeyStore,
-  fetchLatestWaWebVersion,
+  fetchLatestBaileysVersion,
   downloadMediaMessage,
   DisconnectReason,
   Browsers,
@@ -20,6 +19,7 @@ import QRCode from 'qrcode';
 import pino from 'pino';
 import { DATA_DIR } from '../../shared/paths.js';
 import { log } from '../../shared/logger.js';
+import { useAtomicMultiFileAuthState, hasValidCredsFile, flushAuthWrites } from './whatsapp-auth.js';
 import type { ChannelProvider, ChannelStatus, ChannelType } from './types.js';
 
 const AUTH_DIR = path.join(DATA_DIR, 'channels', 'whatsapp', 'auth');
@@ -63,6 +63,17 @@ export class WhatsAppChannel implements ChannelProvider {
   private transcribe: TranscribeFn | null = null;
   private reconnectTimer: ReturnType<typeof setTimeout> | null = null;
   private intentionalDisconnect = false;
+  /** Monotonic token — bumping it invalidates any in-flight connectInternal(), so a
+   *  pending reconnect timer and a manual connect can't race into two live sockets
+   *  (two sockets on one auth dir = 440 conflict loops + divergent creds writes). */
+  private connectGen = 0;
+  /** Consecutive failed reconnects — drives backoff; reset on successful open */
+  private reconnectAttempts = 0;
+  /** Auto-regenerated QR windows since the last explicit connect — caps the
+   *  unattended pairing loop instead of cycling QR codes in the background forever */
+  private pairingRetries = 0;
+  /** Last pending creds write — drained on disconnect so process exit can't clip it */
+  private lastCredsWrite: Promise<unknown> = Promise.resolve();
 
   /** IDs of messages we sent — used to prevent echo loops */
   private sentMessageIds = new Set<string>();
@@ -87,11 +98,29 @@ export class WhatsAppChannel implements ChannelProvider {
 
   async connect(): Promise<void> {
     this.intentionalDisconnect = false;
+    this.reconnectAttempts = 0; // explicit connect starts a fresh backoff ladder
+    this.pairingRetries = 0;
     await this.connectInternal();
   }
 
+  /** Arm the reconnect timer. connectInternal can reject (disk errors during auth
+   *  load) — without the catch + re-arm, a timer-driven failure would strand the
+   *  channel offline with no retry until someone manually reconnects. */
+  private scheduleReconnect(delay: number): void {
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = setTimeout(() => {
+      this.connectInternal().catch((err: any) => {
+        if (this.intentionalDisconnect) return;
+        const next = Math.min(5000 * 2 ** this.reconnectAttempts++, 60_000);
+        log.warn(`[whatsapp] Reconnect attempt failed: ${err.message} — retrying in ${Math.round(next / 1000)}s`);
+        this.scheduleReconnect(next);
+      });
+    }, delay);
+  }
+
   async disconnect(): Promise<void> {
     this.intentionalDisconnect = true;
+    this.connectGen++; // invalidate any connectInternal() still in flight
     if (this.reconnectTimer) {
       clearTimeout(this.reconnectTimer);
       this.reconnectTimer = null;
@@ -103,6 +132,12 @@ export class WhatsAppChannel implements ChannelProvider {
     // Clear all typing intervals
     for (const interval of this.typingIntervals.values()) clearInterval(interval);
     this.typingIntervals.clear();
+    // Let in-flight auth writes (creds + signal keys) land before callers proceed to
+    // process.exit — writes are atomic now, but a lost update rolls session keys back.
+    await Promise.race([
+      Promise.all([this.lastCredsWrite, flushAuthWrites(AUTH_DIR)]),
+      new Promise((r) => setTimeout(r, 2000)),
+    ]);
     this.connected = false;
     this.qrData = null;
     this.qrSvg = null;
@@ -292,7 +327,9 @@ export class WhatsAppChannel implements ChannelProvider {
   }
 
   hasCredentials(): boolean {
-    return fs.existsSync(path.join(AUTH_DIR, 'creds.json'));
+    // Validates content, not just existence — a 0-byte creds.json (interrupted legacy
+    // write) must not count as "linked", or boot lands in a silent QR loop.
+    return hasValidCredsFile(AUTH_DIR);
   }
 
   /** Delete stored credentials (for re-auth / logout) */
@@ -358,6 +395,14 @@ export class WhatsAppChannel implements ChannelProvider {
   }
 
   private async connectInternal(): Promise<void> {
+    const gen = ++this.connectGen;
+    // A pending reconnect must not fire on top of this attempt — clear it so the
+    // timer and a manual connect can't produce two sockets on the same auth dir.
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+
     // Clean up any existing socket before creating a new one
     if (this.sock) {
       try { this.sock.ev.removeAllListeners('creds.update'); } catch {}
@@ -370,18 +415,26 @@ export class WhatsAppChannel implements ChannelProvider {
     // Ensure auth directory exists
     fs.mkdirSync(AUTH_DIR, { recursive: true });
 
-    const { state, saveCreds } = await useMultiFileAuthState(AUTH_DIR);
+    // Atomic-write auth state — survives the kills/crashes that used to truncate
+    // creds.json, and recovers from creds.json.bak when the primary is corrupt.
+    const { state, saveCreds, freshIdentity } = await useAtomicMultiFileAuthState(AUTH_DIR);
+    if (gen !== this.connectGen || this.intentionalDisconnect) return; // superseded while loading auth
+    if (freshIdentity) log.info('[whatsapp] No valid credentials — starting pairing flow');
 
     // Suppress Baileys' noisy logging
     const logger = pino({ level: 'silent' }) as any;
 
     let version: [number, number, number] | undefined;
     try {
-      const result = await fetchLatestWaWebVersion({});
+      // fetchLatestBaileysVersion = newest WA Web version the LIBRARY supports.
+      // (fetchLatestWaWebVersion scrapes web.whatsapp.com and can return a protocol
+      // revision newer than Baileys handles — a disconnect source.)
+      const result = await fetchLatestBaileysVersion();
       version = result.version;
     } catch {
       log.warn('[whatsapp] Could not fetch latest WA version — using default');
     }
+    if (gen !== this.connectGen || this.intentionalDisconnect) return; // superseded during version fetch
 
     const sock = makeWASocket({
       auth: {
@@ -390,18 +443,27 @@ export class WhatsAppChannel implements ChannelProvider {
       },
       version,
       browser: Browsers.macOS('Chrome'),
-      printQRInTerminal: false,
       logger,
+      markOnlineOnConnect: false, // keep message notifications on the phone
       generateHighQualityLinkPreview: false,
+      // Baileys 7.x retry handshake: without this, inbound messages that need an
+      // E2EE session re-establishment are silently dropped (msg.message === null).
+      getMessage: async () => ({ conversation: '' }),
     });
 
     this.sock = sock;
 
-    // Persist credential updates
-    sock.ev.on('creds.update', saveCreds);
+    // Persist credential updates (fires constantly while connected — key rotations,
+    // app-state sync). Track the promise so disconnect() can drain it before exit.
+    sock.ev.on('creds.update', () => {
+      this.lastCredsWrite = saveCreds().catch((err: any) => {
+        log.warn(`[whatsapp] Failed to persist credentials: ${err.message}`);
+      });
+    });
 
     // Connection state changes
     sock.ev.on('connection.update', async (update) => {
+      if (this.sock !== sock) return; // stale event from a superseded socket
       const { connection, lastDisconnect, qr } = update;
 
       // QR code received — render to SVG
@@ -418,6 +480,7 @@ export class WhatsAppChannel implements ChannelProvider {
 
       if (connection === 'open') {
         this.connected = true;
+        this.reconnectAttempts = 0;
         this.qrData = null;
         this.qrSvg = null;
         this.buildLidMap();
@@ -453,9 +516,41 @@ export class WhatsAppChannel implements ChannelProvider {
           return;
         }
 
-        // Any other disconnect — try to reconnect
-        log.info('[whatsapp] Reconnecting in 5s...');
-        this.reconnectTimer = setTimeout(() => this.connectInternal(), 5000);
+        // Never paired (pair-success sets creds.registered before the post-pairing 515,
+        // so a registered=false close means the pairing window expired unused).
+        if (!state.creds.registered) {
+          if (state.creds.me) {
+            // Phantom identity from an uncompleted pairing-code attempt (Baileys sets
+            // creds.me as a placeholder when the code is requested). Reconnecting would
+            // try to LOG IN with an identity the server never registered → guaranteed
+            // 401 wipe. Reset to a clean unpaired state instead.
+            log.info('[whatsapp] Pairing code expired before confirmation — resetting credentials; connect again to retry');
+            await this.deleteCredentials();
+          } else if (this.pairingRetries < 2) {
+            // Fresh QR windows for a while (the link page is likely still open),
+            // then stop instead of cycling QR codes in the background forever.
+            this.pairingRetries++;
+            log.info(`[whatsapp] QR expired — generating a fresh one (retry ${this.pairingRetries}/2)`);
+            this.emitStatus();
+            this.scheduleReconnect(2000);
+            return;
+          } else {
+            log.info('[whatsapp] Pairing window closed without a scan — connect again to retry');
+          }
+          this.emitStatus();
+          return;
+        }
+
+        // restartRequired (515) is the normal post-pairing handoff — reconnect right
+        // away, but only the first time (a repeated-515 loop is a known Baileys failure
+        // mode; let it back off). Everything else backs off 5s → 60s so an offline
+        // network doesn't hot-loop.
+        const fastRestart = statusCode === DisconnectReason.restartRequired && this.reconnectAttempts === 0;
+        const delay = fastRestart ? 1000 : Math.min(5000 * 2 ** this.reconnectAttempts, 60_000);
+        this.reconnectAttempts++;
+        log.info(`[whatsapp] Reconnecting in ${Math.round(delay / 1000)}s...`);
+        this.emitStatus();
+        this.scheduleReconnect(delay);
       }
     });
 

package/supervisor/index.ts

@@ -1,6 +1,7 @@
 import http from 'http';
 import net from 'net';
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { WebSocketServer, WebSocket } from 'ws';
 import { loadConfig, saveConfig } from '../shared/config.js';
@@ -1000,6 +1001,7 @@ ${connected
 ${!connected ? `<script>
   // Poll for status changes instead of full page reload (avoids SW reinstall cycle)
   let polling=true;
+  let qrMisses=0;
   async function poll(){
     if(!polling) return;
     try{
@@ -1012,10 +1014,16 @@ ${!connected ? `<script>
       const wa=Array.isArray(statuses)?statuses.find(s=>s.channel==='whatsapp'):null;
       if(wa?.connected){location.reload();return}
       if(qrData.qr){
+        qrMisses=0;
         const inner=document.querySelector('.qr-inner');
         if(inner) inner.innerHTML=qrData.qr;
         const loading=document.querySelector('.loading');
         if(loading) loading.remove();
+      }else if(wa&&!wa.connected&&++qrMisses>=3){
+        // QR window expired and background retries stopped — this page being open means
+        // the user is still trying to link, so restart pairing for a fresh code.
+        qrMisses=0;
+        fetch('/api/channels/whatsapp/connect',{method:'POST'}).catch(()=>{});
       }
     }catch{}
     setTimeout(poll,3000);
@@ -3578,11 +3586,40 @@ ${alreadyLinked ? '' : `
   server.listen(config.port, () => {
     log.ok(`Supervisor on http://localhost:${config.port}`);
     log.ok(`Bloby chat at http://localhost:${config.port}/bloby`);
+    writeRuntimeFile();
     if (config.tunnel.mode === 'off') {
       console.log('__READY__');
     }
   });
 
+  // ~/.bloby/supervisor.json — the CLI's single source of truth for "is Bloby
+  // running and which process is it". Written here (not by the CLI) because the
+  // supervisor has at least four different parents (cli foreground, launchd,
+  // systemd, docker) and only the supervisor itself is present in all of them.
+  // The CLI validates pid liveness + command line, so a stale file after kill -9
+  // is harmless.
+  function writeRuntimeFile() {
+    try {
+      let version = 'unknown';
+      try { version = JSON.parse(fs.readFileSync(path.join(PKG_DIR, 'package.json'), 'utf-8')).version || 'unknown'; } catch {}
+      fs.writeFileSync(path.join(DATA_DIR, 'supervisor.json'), JSON.stringify({
+        pid: process.pid,
+        startedAt: Date.now(),
+        version,
+        port: config.port,
+        parent: process.env.INVOCATION_ID ? 'systemd' : (process.env.XPC_SERVICE_NAME?.includes('bloby') ? 'launchd' : 'other'),
+      }, null, 2));
+    } catch { /* best-effort — the CLI falls back to launchd/systemd queries */ }
+  }
+
+  function removeRuntimeFile() {
+    try {
+      const p = path.join(DATA_DIR, 'supervisor.json');
+      const cur = JSON.parse(fs.readFileSync(p, 'utf-8'));
+      if (cur.pid === process.pid) fs.unlinkSync(p); // never delete a newer instance's file
+    } catch {}
+  }
+
   // Track whether an agent is actively processing — file watcher defers restarts during active turns
   let agentQueryActive = false;
   let pendingBackendRestart = false; // Set when file watcher fires during agent turn
@@ -3683,8 +3720,14 @@ ${alreadyLinked ? '' : `
         try { fs.closeSync(logFd); } catch {}
         if (code === 0) {
           clearUpdateMarker(); // success (updated or already-latest) — don't re-run on the next boot
-          log.ok('Update completed — restarting with new version...');
-          process.exit(1); // non-zero triggers daemon manager to restart us onto the new code
+          log.ok('Update completed — relaunching daemon onto the new version...');
+          relaunchSupervisor();
+          // NO process.exit here: the old reliance on launchd KeepAlive after exit(1) does NOT fire
+          // when the supervisor runs in the foreground or the launchd job isn't loaded (the user hit
+          // exactly this). relaunchSupervisor() actively reloads the daemon (mirroring the battle-
+          // tested manual `bloby update` path); its `launchctl unload` / the new daemon's killPort
+          // terminates THIS old process. If the daemon isn't installed at all (pure foreground dev),
+          // the relaunch no-ops and we stay up on the old code rather than going down unrecoverably.
         } else {
           // Leave the marker so the next boot retries (bounded by attempts); allow another flush now.
           updateInProgress = false;
@@ -3702,6 +3745,51 @@ ${alreadyLinked ? '' : `
     }
   }
 
+  /** Relaunch the supervisor onto freshly-updated code by actively (re)loading the daemon — the same
+   *  `launchctl unload/load` (macOS) / `systemctl restart` (Linux) that the battle-tested manual
+   *  `bloby update` uses. Spawned DETACHED + unref'd so it OUTLIVES this process when the relaunch's
+   *  unload terminates us. `sleep 1` lets the final HTTP ack flush first. If the daemon isn't
+   *  installed (foreground dev with no plist), `bloby daemon restart` no-ops — we then stay up on the
+   *  current code instead of going down with nothing to bring us back. Replaces the previous reliance
+   *  on launchd KeepAlive after process.exit, which never fires in the foreground / when unloaded. */
+  function relaunchSupervisor(): void {
+    // Under systemd we ARE the unit's main process: a non-zero exit triggers
+    // Restart=on-failure and systemd respawns us onto the new code in ~5s. The
+    // old detached `bloby daemon restart` path is a dead end here — it needs
+    // sudo for systemctl and there is no TTY to ask for a password.
+    if (process.env.INVOCATION_ID) {
+      log.ok('Updated — exiting so systemd restarts the unit onto the new version...');
+      try { removeRuntimeFile(); } catch {}
+      try { const cfg = loadConfig(); delete cfg.tunnelUrl; saveConfig(cfg); } catch {}
+      setTimeout(() => process.exit(1), 1000); // let the final HTTP ack flush
+      return;
+    }
+    // No service installed (pure foreground dev, no plist/unit): `bloby restart`
+    // now consolidates foreground instances INTO the daemon, so spawning it here
+    // would kill this process and silently install a service nobody asked for.
+    // Stay up on the old code instead — the human restarts when they choose.
+    const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', 'com.bloby.bot.plist');
+    const unitPath = '/etc/systemd/system/bloby.service';
+    if (!fs.existsSync(process.platform === 'darwin' ? plistPath : unitPath)) {
+      log.warn('Updated, but no background service is installed — restart Bloby manually to load the new version.');
+      return;
+    }
+    const cliPath = path.join(PKG_DIR, 'bin', 'cli.js');
+    try {
+      // `bloby daemon restart` boots the launchd job out and bootstraps it again; the
+      // bootout terminates THIS process, so the relauncher must be detached + unref'd
+      // to outlive it.
+      const relauncher = cpSpawn(process.execPath, [cliPath, 'daemon', 'restart'], {
+        detached: true,
+        stdio: 'ignore',
+        env: { ...process.env },
+      });
+      relauncher.unref();
+    } catch (err) {
+      log.error(`Relaunch failed to spawn: ${err instanceof Error ? err.message : err} — run \`bloby restart\` manually.`);
+    }
+  }
+
   /** On boot, resume an update that was queued but never ran (supervisor died in the request→flush
    *  window). Safe to auto-run: bin/cli.js update version-checks and no-ops if already latest, and
    *  the marker's TTL + attempts cap prevent a restart loop. */
@@ -4083,6 +4171,7 @@ ${alreadyLinked ? '' : `
     stopTunnel();
     await stopViteDevServers();
     server.close();
+    removeRuntimeFile();
     process.exit(0);
   };
   process.on('SIGINT', () => shutdown());

package/tsconfig.json

@@ -15,6 +15,6 @@
       "@client/*": ["./workspace/client/src/*"]
     }
   },
-  "include": ["server/**/*", "workspace/client/src/**/*", "workspace/backend/**/*", "cli/**/*", "vite.config.ts"],
+  "include": ["server/**/*", "workspace/client/src/**/*", "workspace/backend/**/*", "vite.config.ts"],
   "exclude": ["node_modules", "dist", "data"]
 }