cdx-manager 0.25.4 → 0.25.6

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.4-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.6-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.25.4
+0.25.6

package/changelogs/CHANGELOGS_0_25_5.md

@@ -0,0 +1,14 @@
+# CDX Manager 0.25.5
+
+Release date: 2026-11-02
+
+This patch release makes `cdx update all` report version status based on verified evidence.
+
+## Fixes
+
+- Compare installed tool versions with official release sources before reporting them as up to date. Report unknown status when version evidence is unavailable or inconsistent, and offer automatic updates only when a supported CLI updater or verified Homebrew installation is available. Preserve existing JSON fields and expose uncertainty with `unknown` and an optional `reason`. (#85)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.4. (`46ff59ba5fad3bbd7b37429371112f3f6f38a330`)
+- Record release archive checksums for v0.25.4. (`8ae658e2e6f3303f575e95f58b622321cad87a60`)

package/changelogs/CHANGELOGS_0_25_6.md

@@ -0,0 +1,15 @@
+# CDX Manager 0.25.6
+
+Release date: 2026-11-02
+
+This patch release fixes provider update detection and verifies installed versions after updates.
+
+## Fixes
+
+- Detect advertised provider updaters and version output on both stdout and stderr. After an update, verify the installed version and report failure if it is missing, unchanged, downgraded, or still below the published version. Successful text output shows the version transition, and JSON results include before, after, and latest versions. (#87)
+- Fall back to the latest stable GitHub release when Ollama's vendor API returns an empty, invalid, or failed response. Keep Linux Ollama updates manual, with an explicit maintenance reason. (#87)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.5. (`b64a372f9ab4abb61f1440943fca19703ad555eb`)
+- Record release archive checksums for v0.25.5. (`1218145eae4201e40b8140e7a94cbcec18454e17`)

package/changelogs/CHANGELOGS_UNRELEASED.md

@@ -1,5 +1,13 @@
 # Unreleased
 
+## Truthful workstation updates
+
+- Detect native updater subcommands in both stdout and stderr, including Antigravity's indented `Available subcommands:` help. Verify the installed CLI version after updating, fail unchanged or unverified updates, and expose before/after versions without hiding major upgrades.
+- Fall back from empty or failed Ollama vendor responses (including Linux HTTP 204) to the latest stable `ollama/ollama` GitHub release. Keep Linux updates manual with `update_available`, a null command, and a service-safety reason; never replace a potentially active binary or restart models automatically.
+
+- Verify latest versions from npm, RTK GitHub releases, and Antigravity/Ollama vendor update endpoints with short read-only probes. Report `unknown` on unavailable evidence; reserve `up_to_date` for identical known versions, including Ponytail revisions.
+- Preserve the existing JSON fields and `update_available` status, show uncertainty and manual-update reasons in text, and apply only supported native commands or verified Homebrew package upgrades. Cover matching/outdated versions, source failures, missing tools, and command execution with faked sources.
+
 ## Dependency security
 
 - Require cryptography >=50.0.0 for encrypted auth bundles and remove the vulnerable 47.0.0 lock entry. Python 3.9 remains supported from 3.9.2, as cryptography 50 excludes 3.9.0 and 3.9.1.

package/checksums/release-archives.json

@@ -727,6 +727,28 @@
         "x86_64-pc-windows-msvc": "c81623ffb94b11ae7b7b28be123b49393240bb0edd31c69969ca07d7eab8dff7",
         "x86_64-unknown-linux-musl": "6892112587c1d8c6e805a90148ec8deb6c04b5927c7ed0c18f19479d521c0ced"
       }
+    },
+    "v0.25.4": {
+      "github_tarball_sha256": "94dbd4f9e2d7e34cf3cfaf967565c1fe8dd56a0cd1fe2888c43cf8f44290a2ec",
+      "github_zip_sha256": "13c3bad9b45776fb13a25bf8a363b98d5e8a042b91f848005e7f4adbfb275659",
+      "tray_assets": {
+        "aarch64-apple-darwin": "06b4b649621b53af642b01ba543369e7ce975454f3b70977e5d35c7a5d3bca5d",
+        "aarch64-unknown-linux-musl": "f5ced5b655c525bbcd71eeab002ea557e52507dbe69101ad351fea0bbbf290ff",
+        "x86_64-apple-darwin": "2ee4a2144455fc6eebd395c9c58c3d3fa7e4ed333e5f3959ba78e46a41c55be0",
+        "x86_64-pc-windows-msvc": "8e2c1925f025a7227ef909f27e8b4696c03bb5a86e0c61c989da6a942b5638a6",
+        "x86_64-unknown-linux-musl": "9ae1164abc3ff4b30d25c44696569855138f8ac0e3b6e1c3451c716d20f221fa"
+      }
+    },
+    "v0.25.5": {
+      "github_tarball_sha256": "4a2ece21e32f59a84d8bc7b2a565817c6c90bb314f179319bc19cf85a0c71a60",
+      "github_zip_sha256": "959de4dca501fd53c937f4045936b12acbea58d255a4e3cae510ec82a230bef8",
+      "tray_assets": {
+        "aarch64-apple-darwin": "727c4ded1ee4d9d8ed9853badcb10efd1cc76bd6dcd6012b6739920d42e6273c",
+        "aarch64-unknown-linux-musl": "9270224db6be83d4a4787f9b523a6fa059267f56ed1cf12f022f65bf68c0474f",
+        "x86_64-apple-darwin": "10c555671cdeb3ce4c0372f6f8a48e6cfeac9132e980c466fe5a8978dc1a2862",
+        "x86_64-pc-windows-msvc": "85945b30580cb82c64ece94652ae0633a6156dfd85e02108c0d4b7676cab9911",
+        "x86_64-unknown-linux-musl": "7c5a23938b84c5952be71b5956ed3167c218d05ce661940b0c86f2dde2d8221f"
+      }
     }
   }
 }

package/docs/cli.md

@@ -51,7 +51,7 @@
 | `cdx repair [--dry-run] [--force] [--json]` | Plan or apply safe repairs for missing state files, quarantines, and orphan profiles |
 | `cdx view [--json] [--lan] [--lan-rw] [--focus <ref>] [--read] [--port <port>] [--host <host>] [--refresh-interval <s>] [--tls] [--tls-cert <path>] [--tls-key <path>] [--open] [--no-open]` | Open the Logics browser/focus viewer by delegating to `logics-manager view`; all viewer flags are forwarded; JSON mode reports diagnostics without launching it |
 | `cdx update [--check] [--yes] [--json] [--version TAG]` | Update cdx-manager using the installer that matches how it was installed |
-| `cdx update all [--yes] [--json]` | Check installed providers, RTK, and Ponytail across Codex profiles; show the plan and ask once before applying safe native/Homebrew updates and missing RTK/Ponytail setup |
+| `cdx update all [--yes] [--json]` | Check installed providers, RTK, and Ponytail across Codex profiles; show the plan and ask once before applying supported native/Homebrew updates and missing RTK/Ponytail setup |
 | `cdx ready [--refresh] [--json]` | Schedule an OS notification for the next cooling-down assistant that becomes ready, then return immediately |
 | `cdx notify` | Internal provider hook target for agent alerts and agent state; use `cdx set <name> --notify on` or `--agent-state on` to enable it |
 | `cdx agents [--max-age-hours N] [--json]` | Each session's last known agent state (working, waiting, done, failed, limit, ended), waiting first; records older than N hours (default 24) are dropped. See [Agent state](sessions-and-notifications.md#agent-state) |
@@ -545,3 +545,55 @@ backup, and atomically replaces history only when the complete batch has no
 conflict. Unrelated fields, usage, and malformed/unrelated history lines survive.
 Repeating the same mapping is a no-op and creates no additional backup. The
 registry and provider transcripts are never rewritten by backfill.
+
+### Workstation update checks
+
+`cdx update all --json` collects a read-only plan. `--yes` applies its supported
+update and session setup steps. Existing `plan.items` fields remain available:
+`installed`, `version`, `latest_version`, `update_command`, and `status`.
+Versions and commands are explicitly `null` when unavailable.
+
+- `up_to_date`: both versions are known and identical.
+- `update_available`: the published version is newer (the tool is outdated).
+- `unknown`: the source failed, returned invalid data, timed out, or the installed
+  version could not be compared reliably. This never means up to date.
+- `not_installed`: the executable is absent; no installation is guessed.
+
+Checks use the npm registry for Codex and `@anthropic-ai/claude-code`, GitHub's
+`rtk-ai/rtk` latest stable release, the original Antigravity editor's vendor
+`/releases` feed for `agy`, and Ollama's own `/api/update` endpoint with the local
+OS/architecture and baseline version `0.0.0`. Ollama's local `/api/version` reports
+an installed server, not the latest published release, and is not used.
+Antigravity Hub and IDE 2 have separate feeds and are not substituted for `agy`.
+HTTP and read-only CLI probes have a five-second timeout; source failures leave
+`latest_version: null` and `status: unknown`. Ponytail also reports `unknown`
+when its remote revision is unavailable. An empty, failed, or invalid Ollama
+response (including Linux HTTP 204) falls back to the latest stable GitHub
+release for `ollama/ollama`. If that source also fails, status is `unknown`;
+a different platform's vendor response is never substituted.
+
+For an outdated tool, CDX uses a native update command advertised by its
+`--help` on either stdout or stderr (including Claude, Antigravity, and RTK
+when available), Codex's updater,
+or Homebrew only when the resolved executable belongs to a Caskroom/Cellar
+package. An outdated tool without such a path retains `update_available`,
+`update_command: null`, and a human-readable `reason`; it requires the vendor's
+manual update mechanism. On Linux, Ollama always retains `update_available`
+with `update_command: null` and an explicit maintenance reason: its installer
+writes system paths and may restart a service. A binary in `~/.local/bin` can
+also serve running models, so CDX neither replaces it nor restarts services.
+Arrange a manual maintenance window. Source uncertainty never schedules a guessed install.
+The text table shows `UNKNOWN` and the reason, and an empty action list makes
+no claim that all tools are current. JSON consumers, including external
+remote-ops auto-update scripts, should inspect statuses separately from successful
+command execution: exit code zero means no attempted action failed, not that
+every installed tool was verified current. With `--yes`, the returned plan is the
+pre-update inventory; `results` records attempted actions and their exit codes.
+
+After each successful tool update command, CDX probes the CLI version again.
+An unchanged, unreadable, downgraded, or still older-than-published version
+makes the action fail, even if the updater exited zero. Successful text output
+shows the before/after versions, including major upgrades. JSON keeps the
+pre-update plan and existing result fields; tool verification adds
+`version_before`, `version_after`, and `latest_version` to successful-command
+results, plus `reason` and a nonzero `returncode` if verification fails.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.25.4",
+  "version": "0.25.6",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.25.4"
+version = "0.25.6"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9.2"

package/src/commands/maintenance.py

@@ -28,6 +28,7 @@ from ..update_manager import build_update_plan, format_update_failure, run_updat
 def _format_update_all(plan, use_color=False):
     labels = {
         "up_to_date": _success("OK", use_color),
+        "unknown": _warn("UNKNOWN", use_color),
         "update_available": _warn("UPDATE", use_color),
         "not_installed": _warn("MISSING", use_color),
         "check_with_native_updater": _info("CHECK", use_color),
@@ -36,6 +37,7 @@ def _format_update_all(plan, use_color=False):
     for item in plan["items"]:
         rows.append([_info(item["name"], use_color), item.get("version") or _dim("-", use_color), item.get("latest_version") or _dim("-", use_color), labels.get(item["status"], item["status"].replace("_", " "))])
     lines = [_style("Workstation update", "1", use_color), _dim("Inventory only — nothing has changed.", use_color), "", _pad_table(rows)]
+    lines.extend(f"{item['name']}: {item['reason']}" for item in plan["items"] if item.get("reason"))
     missing_rtk = plan["setup"]["rtk_missing_sessions"]
     setup = [f"RTK: enable for {', '.join(missing_rtk)}" if missing_rtk else "RTK: configured for every session"]
     setup.extend(f"Ponytail {plugin['session']}: {labels.get(plugin['status'], plugin['status'].replace('_', ' '))}" for plugin in plan["setup"]["ponytail"])
@@ -43,14 +45,15 @@ def _format_update_all(plan, use_color=False):
     if plan["steps"]:
         lines.extend(["", _warn(f"{len(plan['steps'])} action(s) ready", use_color), _dim("Confirm to update only the tools listed above.", use_color)])
     else:
-        lines.extend(["", _success("Everything managed by CDX is current and configured.", use_color)])
+        lines.extend(["", _dim("No automatic actions available. See tool statuses and reasons above.", use_color)])
     return "\n".join(lines)
 
 def _format_update_all_result(result, use_color=False):
     if result.get("skipped"):
         return _warn(f"skipped: {result['name']} (blocked by {result['blocked_by']})", use_color)
     if result.get("returncode") == 0:
-        return _success(f"done: {result['name']}", use_color)
+        versions = f" ({result['version_before']} -> {result['version_after']})" if "version_after" in result else ""
+        return _success(f"done: {result['name']}{versions}", use_color)
     detail = str(result.get("stderr") or result.get("stdout") or "No error output.").strip().replace("\n", " ")
     detail = detail[-500:]
     command = shlex.join(result.get("command") or [])
@@ -689,6 +692,9 @@ def handle_update(rest, ctx):
             if input("Apply this plan? [y/N] ").strip().lower() not in ("y", "yes"):
                 ctx["out"](f"{_warn('Cancelled.', ctx['use_color'])}\n")
                 return 0
+        if parsed["yes"] and not parsed["json"]:
+            ctx["out"](f"{_format_update_all(plan, ctx['use_color'])}\n")
+
         def progress(event):
             if parsed["json"]:
                 return

package/src/update_all.py

@@ -2,19 +2,24 @@
 
 import json
 import os
+import platform
 import re
 import shutil
 import subprocess
+from urllib.parse import urlencode, urlparse
+from urllib.request import Request, urlopen
 
 from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDER_OLLAMA
 
 _TOOLS = (
-    (PROVIDER_CODEX, "codex", None, ["codex", "update"]),
-    (PROVIDER_CLAUDE, "claude", "claude", ["brew", "upgrade", "--cask", "claude"]),
-    (PROVIDER_ANTIGRAVITY, "agy", "antigravity", ["brew", "upgrade", "--cask", "antigravity"]),
-    (PROVIDER_OLLAMA, "ollama", "ollama", ["brew", "upgrade", "ollama"]),
-    ("rtk", "rtk", "rtk", ["brew", "upgrade", "rtk"]),
+    (PROVIDER_CODEX, "codex"),
+    (PROVIDER_CLAUDE, "claude"),
+    (PROVIDER_ANTIGRAVITY, "agy"),
+    (PROVIDER_OLLAMA, "ollama"),
+    ("rtk", "rtk"),
 )
+_SOURCE_TIMEOUT = 5
+_ANTIGRAVITY_RELEASES = "https://antigravity-auto-updater-974169037036.us-central1.run.app/releases"
 _PONYTAIL_URL = "https://github.com/DietrichGebert/ponytail.git"
 
 
@@ -41,45 +46,88 @@ def _run(command, env, runner=None, timeout=15):
     return {"returncode": result.returncode, "stdout": result.stdout or "", "stderr": result.stderr or ""}
 
 
+def _parse_version(value):
+    if isinstance(value, str) and re.fullmatch(r"v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?", value):
+        return value.lstrip("v")
+    return None
+
+
 def _version(command, env, runner):
-    result = _run([command, "--version"], env, runner)
-    text = (result["stdout"] or result["stderr"] or "").strip()
-    match = re.search(r"\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b", text)
-    return match.group(1) if match else None
+    result = _run([command, "--version"], env, runner, timeout=_SOURCE_TIMEOUT)
+    if result["returncode"]:
+        return None
+    text = "\n".join((result["stdout"] or "", result["stderr"] or "")).strip()
+    # Ollama can print the server version before the CLI version.
+    client = re.search(r"client version is (\S+)", text)
+    match = client or re.search(r"\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b", text)
+    return _parse_version(match.group(1)) if match else None
 
 
-def _npm_latest(package, env, runner):
-    if not _which("npm", env):
+def _fetch_json(url):
+    request = Request(url, headers={"Accept": "application/json", "User-Agent": "cdx-manager-update-check"})
+    with urlopen(request, timeout=_SOURCE_TIMEOUT) as response:
+        return json.loads(response.read(1024 * 1024))
+
+
+def _latest_version(name):
+    try:
+        if name in (PROVIDER_CODEX, PROVIDER_CLAUDE):
+            package = "@openai/codex" if name == PROVIDER_CODEX else "@anthropic-ai/claude-code"
+            return _parse_version(_fetch_json(f"https://registry.npmjs.org/{package}/latest")["version"])
+        if name == "rtk":
+            release = _fetch_json("https://api.github.com/repos/rtk-ai/rtk/releases/latest")
+            if release.get("draft") or release.get("prerelease"):
+                return None
+            return _parse_version(release["tag_name"])
+        if name == PROVIDER_ANTIGRAVITY:
+            # agy belongs to the original editor, whose feed differs from Hub and IDE 2.
+            return _parse_version(_fetch_json(_ANTIGRAVITY_RELEASES)[0]["version"])
+        if name == PROVIDER_OLLAMA:
+            arch = {"x86_64": "amd64", "aarch64": "arm64"}.get(platform.machine().lower(), platform.machine().lower())
+            query = urlencode({"os": platform.system().lower(), "arch": arch, "version": "0.0.0"})
+            try:
+                release = _fetch_json(f"https://ollama.com/api/update?{query}")
+                # The vendor updater extracts the release tag from the artifact URL.
+                version = _parse_version(os.path.basename(os.path.dirname(urlparse(release["url"]).path)))
+                if version:
+                    return version
+            except Exception:
+                # Linux can return HTTP 204 with no JSON body.
+                pass
+            release = _fetch_json("https://api.github.com/repos/ollama/ollama/releases/latest")
+            if release.get("draft") or release.get("prerelease"):
+                return None
+            return _parse_version(release["tag_name"])
+    except Exception:
+        # A failed or changed source is uncertainty, never evidence of currency.
         return None
-    result = _run(["npm", "view", package, "version"], env, runner)
-    value = (result["stdout"] or "").strip()
-    return value if re.fullmatch(r"\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?", value) else None
+    return None
 
 
 def _newer(latest, current):
     def key(value):
-        return tuple(int(part) for part in str(value).split("-", 1)[0].split("+", 1)[0].split("."))
+        return tuple(int(part) for part in value.split("-", 1)[0].split("+", 1)[0].split("."))
     return bool(latest and current and key(latest) > key(current))
 
 
-def _brew_outdated(env, runner):
-    if not _which("brew", env):
-        return {}
-    result = _run(["brew", "outdated", "--json=v2"], env, runner, timeout=30)
-    try:
-        payload = json.loads(result["stdout"])
-    except (TypeError, ValueError):
-        return {}
-    rows = {}
-    for group in ("formulae", "casks"):
-        for item in payload.get(group, []):
-            rows[item.get("name")] = item
-    return rows
-
-
-def _brew_cask_for_path(path):
-    match = re.search(r"/Caskroom/([^/]+)/", os.path.realpath(path or ""))
-    return match.group(1) if match else None
+def _native_update_command(name, command, path, env, runner):
+    if name == PROVIDER_OLLAMA and platform.system().lower() == "linux":
+        return None
+    real_path = os.path.realpath(path)
+    cask = re.search(r"/Caskroom/([^/]+)/", real_path)
+    formula = re.search(r"/Cellar/([^/]+)/", real_path)
+    if (cask or formula) and _which("brew", env):
+        package = (cask or formula).group(1)
+        return ["brew", "upgrade", *(["--cask"] if cask else []), package]
+    if name == PROVIDER_CODEX:
+        return [command, "update"]
+    help_result = _run([command, "--help"], env, runner, timeout=_SOURCE_TIMEOUT)
+    if help_result["returncode"] == 0:
+        help_text = "\n".join((help_result["stdout"] or "", help_result["stderr"] or ""))
+        for subcommand in ("self-update", "update", "--update"):
+            if re.search(r"(?m)^\s*" + re.escape(subcommand) + r"(?:\s|$)", help_text):
+                return [command, subcommand]
+    return None
 
 
 def _ponytail_revision(auth_home, env=None, runner=None):
@@ -99,26 +147,30 @@ def _ponytail_revision(auth_home, env=None, runner=None):
 
 def collect_update_all_plan(service, env=None, runner=None):
     env = dict(env or os.environ)
-    outdated = _brew_outdated(env, runner)
     items, steps = [], []
-    for name, command, brew_name, update_command in _TOOLS:
+    for name, command in _TOOLS:
         path = _which(command, env)
-        item = {"name": name, "command": command, "installed": bool(path), "path": path, "version": _version(command, env, runner) if path else None}
-        cask_name = _brew_cask_for_path(path)
-        brew_target = cask_name or brew_name
-        brew_row = outdated.get(brew_target) if brew_target else None
-        if brew_row:
-            command_to_run = ["brew", "upgrade", "--cask", brew_target] if cask_name else update_command
-            item.update({"status": "update_available", "latest_version": brew_row.get("current_version"), "update_command": command_to_run, "package": brew_target})
-            steps.append({"name": name, "command": command_to_run, "env": {}})
-        elif path and name == PROVIDER_CODEX:
-            # Codex owns its installer; it is the only reliable updater across npm, Homebrew and standalone installs.
-            latest = _npm_latest("@openai/codex", env, runner)
-            item.update({"latest_version": latest, "status": "update_available" if _newer(latest, item["version"]) else "up_to_date" if latest else "check_with_native_updater", "update_command": update_command})
-            if item["status"] != "up_to_date":
-                steps.append({"name": name, "command": update_command, "env": {}})
-        else:
-            item["status"] = "up_to_date" if path else "not_installed"
+        current = _version(command, env, runner) if path else None
+        item = {"name": name, "command": command, "installed": bool(path), "path": path,
+                "version": current, "latest_version": None, "update_command": None, "status": "not_installed"}
+        if path:
+            latest = _latest_version(name)
+            item["latest_version"] = latest
+            if latest and current and latest == current:
+                item["status"] = "up_to_date"
+            elif _newer(latest, current):
+                item["status"] = "update_available"
+                item["update_command"] = _native_update_command(name, command, path, env, runner)
+                if item["update_command"]:
+                    steps.append({"name": name, "command": item["update_command"], "env": {}})
+                else:
+                    item["reason"] = "No supported CLI updater or verified Homebrew installation; use the vendor's updater manually."
+                    if name == PROVIDER_OLLAMA and platform.system().lower() == "linux":
+                        item["reason"] = ("No supported safe automatic Linux update: Ollama's installer writes system paths and may restart a service. "
+                                          "Even a user-local binary may serve running models; arrange a manual maintenance window.")
+            else:
+                item["status"] = "unknown"
+                item["reason"] = "Latest version unavailable from the official source." if not latest else "Installed version unavailable or does not match the published release."
         items.append(item)
 
     rtk_available = any(item["name"] == "rtk" and item["installed"] for item in items)
@@ -131,13 +183,14 @@ def collect_update_all_plan(service, env=None, runner=None):
     ponytail_head = None
     if any(_ponytail_revision(session.get("authHome") or "", env, runner) for session in codex_sessions):
         remote = _run(["git", "ls-remote", _PONYTAIL_URL, "HEAD"], env, runner)
-        ponytail_head = (remote["stdout"] or "").split("\t", 1)[0].strip() or None
+        candidate = (remote["stdout"] or "").split("\t", 1)[0].strip()
+        ponytail_head = candidate if remote["returncode"] == 0 and re.fullmatch(r"[0-9a-f]{40}", candidate) else None
     for session in codex_sessions:
         revision = _ponytail_revision(session.get("authHome") or "", env, runner)
         row = {"session": session["name"], "installed": bool(revision), "revision": revision}
         if revision:
             row["latest_revision"] = ponytail_head
-            row["status"] = "update_available" if ponytail_head and not ponytail_head.startswith(revision) else "up_to_date"
+            row["status"] = "update_available" if ponytail_head and not ponytail_head.startswith(revision) else "up_to_date" if ponytail_head else "unknown"
             if row["status"] == "update_available":
                 steps.append({"name": f"update Ponytail ({session['name']})", "command": ["codex", "plugin", "marketplace", "upgrade", "ponytail", "--json"], "env": {"CODEX_HOME": session["authHome"]}})
         else:
@@ -176,6 +229,15 @@ def apply_update_all_plan(plan, service, env=None, runner=None, progress=None):
             continue
         result = _run(step["command"], {**env, **step.get("env", {})}, runner, timeout=120)
         result = {"name": step["name"], "command": step["command"], **result}
+        item = next((item for item in plan.get("items", []) if item["name"] == step["name"]), None)
+        if result["returncode"] == 0 and item:
+            after = _version(item["command"], env, runner)
+            result.update(version_before=item["version"], version_after=after, latest_version=item["latest_version"])
+            if not (_newer(after, item["version"]) and
+                    (after == item["latest_version"] or _newer(after, item["latest_version"]))):
+                result["returncode"] = 1
+                result["reason"] = "Update verification failed: installed version did not advance to the published release."
+                result["stderr"] = (result["stderr"] + "\n" + result["reason"]).strip()
         results.append(result)
         if result["returncode"] == 0 and step.get("id"):
             completed.add(step["id"])