copilot-hub 0.1.9 → 0.1.11

package/README.md

@@ -22,7 +22,7 @@ Shared packages:
 
 The same Telegram chat handles both operations and development:
 
-- commands: `/help`, `/health`, `/bots`, `/create_agent`, `/cancel`
+- commands: `/help`, `/health`, `/bots`, `/create_agent`, `/codex_status`, `/codex_login`, `/cancel`
 - normal message: handled by the LLM assistant
 
 ## Workspace isolation
@@ -129,6 +129,8 @@ Hub commands:
 - `/health`
 - `/bots`
 - `/create_agent`
+- `/codex_status`
+- `/codex_login`
 - `/cancel`
 
 ### 3) Create runtime agent bot(s)
@@ -147,7 +149,14 @@ You need one Telegram bot token per runtime agent.
 You can use `/bots` in the hub chat to manage policy, reset context, or delete an agent.
 Default values are already applied, and actions start from that agent workspace folder.
 
-### 4) Token safety
+### 4) Switch Codex account from Telegram (optional)
+
+- Run `/codex_status` to verify current Codex login state.
+- Run `/codex_login` (or `/codex_switch`) to get a device code link, then complete sign-in from your phone.
+- Optional: run `/codex_switch_key` if you want API-key based switch (`sk-...`).
+- Running agents are restarted automatically after successful switch.
+
+### 5) Token safety
 
 - Never commit real bot tokens.
 - If a token is leaked, regenerate it in `@BotFather` using `/revoke`.
@@ -170,12 +179,19 @@ npm run restart
 npm run status
 npm run logs
 npm run configure
+npm run update
 npm run test
 npm run lint
 npm run format:check
 npm run check:apps
 ```
 
+Global update command:
+
+```bash
+copilot-hub update
+```
+
 Service mode (optional, OS-native):
 
 ```bash

package/apps/agent-engine/dist/index.js

@@ -1,5 +1,7 @@
 // @ts-nocheck
 import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import express from "express";
 import { BotManager } from "@copilot-hub/core/bot-manager";
@@ -17,7 +19,9 @@ let botManager = null;
 let instanceLock = null;
 let controlPlane = null;
 let secretStore = null;
+let codexDeviceAuthSession = null;
 const workerScriptPath = fileURLToPath(new URL("./agent-worker.js", import.meta.url));
+const ANSI_ESCAPE_PATTERN = new RegExp(String.raw `\u001b\[[0-9;]*m`, "g");
 await bootstrap();
 async function bootstrap() {
     try {
@@ -129,6 +133,75 @@ function buildApiApp({ botManager, controlPlane, registryFilePath }) {
             secretStoreFile: config.secretStoreFilePath,
         });
     });
+    app.get("/api/system/codex/status", wrapAsync(async (req, res) => {
+        const status = readCodexLoginStatus();
+        const deviceAuth = getCodexDeviceAuthSnapshot();
+        res.json({
+            ok: true,
+            configured: status.configured,
+            codexBin: status.codexBin,
+            detail: status.detail,
+            deviceAuth,
+        });
+    }));
+    app.post("/api/system/codex/device_auth/start", wrapAsync(async (req, res) => {
+        const session = startCodexDeviceAuthSession();
+        const ready = await waitForDeviceCode(session, 12_000);
+        if (!ready) {
+            res.status(400).json({
+                error: session.error ||
+                    "Could not initialize Codex device login flow. Retry '/codex_login' in a few seconds.",
+            });
+            return;
+        }
+        res.json({
+            ok: true,
+            status: session.status,
+            loginUrl: session.loginUrl,
+            code: session.code,
+        });
+    }));
+    app.post("/api/system/codex/device_auth/cancel", wrapAsync(async (req, res) => {
+        const canceled = cancelCodexDeviceAuthSession();
+        res.json({
+            ok: true,
+            canceled,
+        });
+    }));
+    app.post("/api/system/codex/switch_api_key", wrapAsync(async (req, res) => {
+        cancelCodexDeviceAuthSession();
+        const apiKey = String(req.body?.apiKey ?? "").trim();
+        if (!looksLikeCodexApiKey(apiKey)) {
+            res.status(400).json({ error: "Field 'apiKey' is invalid." });
+            return;
+        }
+        const login = runCodexCommand(["login", "--with-api-key"], {
+            inputText: `${apiKey}\n`,
+        });
+        if (!login.ok) {
+            const message = redactSecret(firstNonEmptyLine(login.errorMessage, login.stderr, login.stdout) ||
+                "Codex login failed. Check API key and retry.", apiKey);
+            res.status(400).json({ error: message });
+            return;
+        }
+        const status = readCodexLoginStatus();
+        if (!status.configured) {
+            res.status(400).json({
+                error: status.detail || "Codex login verification failed after credential update. Retry once.",
+            });
+            return;
+        }
+        const restarted = await restartRunningBots();
+        res.json({
+            ok: true,
+            switched: true,
+            configured: true,
+            codexBin: status.codexBin,
+            detail: status.detail,
+            restartedBots: restarted.restartedBotIds,
+            restartFailures: restarted.failures,
+        });
+    }));
     app.get("/api/extensions/contract", wrapAsync(async (req, res) => {
         const contract = await controlPlane.runSystemAction(CONTROL_ACTIONS.EXTENSIONS_CONTRACT_GET, {});
         res.json(contract);
@@ -350,3 +423,289 @@ function parseDeleteModeFromRequest(body) {
     }
     return "soft";
 }
+function startCodexDeviceAuthSession() {
+    if (codexDeviceAuthSession && isDeviceAuthActive(codexDeviceAuthSession.status)) {
+        return codexDeviceAuthSession;
+    }
+    const codexBin = String(config.codexBin ?? "codex").trim() || "codex";
+    const session = {
+        id: createSessionId(),
+        status: "starting",
+        startedAt: new Date().toISOString(),
+        codexBin,
+        loginUrl: "",
+        code: "",
+        logLines: [],
+        error: "",
+        child: null,
+        restartedBots: [],
+        restartFailures: [],
+    };
+    const child = spawn(codexBin, ["login", "--device-auth"], {
+        cwd: config.kernelRootPath,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        env: process.env,
+    });
+    session.child = child;
+    codexDeviceAuthSession = session;
+    child.stdout.on("data", (chunk) => {
+        appendDeviceAuthOutput(session, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+        appendDeviceAuthOutput(session, chunk);
+    });
+    child.once("error", (error) => {
+        session.child = null;
+        session.status = "failed";
+        session.error = sanitizeError(error);
+    });
+    child.once("exit", (code) => {
+        session.child = null;
+        if (session.status === "canceled") {
+            return;
+        }
+        if (code === 0) {
+            session.status = "succeeded";
+            void restartRunningBots()
+                .then((restarted) => {
+                session.restartedBots = restarted.restartedBotIds;
+                session.restartFailures = restarted.failures;
+            })
+                .catch((error) => {
+                session.restartFailures = [{ botId: "*", error: sanitizeError(error) }];
+            });
+            return;
+        }
+        session.status = "failed";
+        session.error =
+            firstNonEmptyLine(session.error, ...session.logLines.slice(-12)) ||
+                `Codex login exited with code ${String(code ?? "unknown")}.`;
+    });
+    return session;
+}
+function cancelCodexDeviceAuthSession() {
+    if (!codexDeviceAuthSession || !isDeviceAuthActive(codexDeviceAuthSession.status)) {
+        return false;
+    }
+    codexDeviceAuthSession.status = "canceled";
+    codexDeviceAuthSession.error = "Canceled by user.";
+    try {
+        codexDeviceAuthSession.child?.kill("SIGTERM");
+    }
+    catch {
+        // ignore
+    }
+    codexDeviceAuthSession.child = null;
+    return true;
+}
+function getCodexDeviceAuthSnapshot() {
+    const session = codexDeviceAuthSession;
+    if (!session) {
+        return { status: "idle" };
+    }
+    return {
+        status: session.status,
+        startedAt: session.startedAt,
+        loginUrl: session.loginUrl || undefined,
+        code: session.code || undefined,
+        detail: session.error || undefined,
+        restartedBots: session.restartedBots,
+        restartFailures: session.restartFailures,
+    };
+}
+async function waitForDeviceCode(session, timeoutMs) {
+    const timeout = Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 10_000;
+    const started = Date.now();
+    while (Date.now() - started < timeout) {
+        if (session.status === "failed" || session.status === "canceled") {
+            return false;
+        }
+        if (session.loginUrl && session.code) {
+            if (session.status === "starting") {
+                session.status = "pending";
+            }
+            return true;
+        }
+        await sleep(150);
+    }
+    return Boolean(session.loginUrl && session.code);
+}
+function appendDeviceAuthOutput(session, chunk) {
+    const text = stripAnsi(String(chunk ?? ""));
+    if (!text.trim()) {
+        return;
+    }
+    const lines = text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    if (lines.length === 0) {
+        return;
+    }
+    session.logLines.push(...lines);
+    if (session.logLines.length > 120) {
+        session.logLines = session.logLines.slice(-120);
+    }
+    if (!session.loginUrl) {
+        const url = findDeviceLoginUrl(lines);
+        if (url) {
+            session.loginUrl = url;
+        }
+    }
+    if (!session.code) {
+        const code = findDeviceCode(lines);
+        if (code) {
+            session.code = code;
+        }
+    }
+    if (session.loginUrl && session.code && session.status === "starting") {
+        session.status = "pending";
+    }
+}
+function findDeviceLoginUrl(lines) {
+    for (const line of lines) {
+        const urls = line.match(/https?:\/\/\S+/g);
+        if (!urls) {
+            continue;
+        }
+        for (const url of urls) {
+            if (url.includes("/codex/device")) {
+                return url;
+            }
+        }
+    }
+    return "";
+}
+function findDeviceCode(lines) {
+    for (const line of lines) {
+        const match = line.match(/\b[A-Z0-9]{4}-[A-Z0-9]{5}\b/);
+        if (match?.[0]) {
+            return match[0];
+        }
+    }
+    return "";
+}
+function stripAnsi(value) {
+    return String(value ?? "").replace(ANSI_ESCAPE_PATTERN, "");
+}
+function isDeviceAuthActive(status) {
+    const value = String(status ?? "")
+        .trim()
+        .toLowerCase();
+    return value === "starting" || value === "pending";
+}
+function createSessionId() {
+    return randomBytes(8).toString("hex");
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function readCodexLoginStatus() {
+    const codexBin = String(config.codexBin ?? "codex").trim() || "codex";
+    const status = runCodexCommand(["login", "status"]);
+    return {
+        configured: status.ok,
+        codexBin,
+        detail: firstNonEmptyLine(status.errorMessage, status.stderr, status.stdout),
+    };
+}
+function looksLikeCodexApiKey(value) {
+    const key = String(value ?? "").trim();
+    if (key.length < 20 || key.length > 4096) {
+        return false;
+    }
+    if (!/^[A-Za-z0-9._-]+$/.test(key)) {
+        return false;
+    }
+    return key.startsWith("sk-");
+}
+function runCodexCommand(args, { inputText = "" } = {}) {
+    const codexBin = String(config.codexBin ?? "codex").trim() || "codex";
+    const result = spawnSync(codexBin, args, {
+        cwd: config.kernelRootPath,
+        shell: false,
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true,
+        encoding: "utf8",
+        input: inputText,
+        env: process.env,
+    });
+    if (result.error) {
+        return {
+            ok: false,
+            status: 1,
+            stdout: "",
+            stderr: "",
+            errorMessage: formatCodexSpawnError(codexBin, result.error),
+        };
+    }
+    const status = Number.isInteger(result.status) ? result.status : 1;
+    return {
+        ok: status === 0,
+        status,
+        stdout: String(result.stdout ?? "").trim(),
+        stderr: String(result.stderr ?? "").trim(),
+        errorMessage: "",
+    };
+}
+function formatCodexSpawnError(codexBin, error) {
+    const code = String(error?.code ?? "")
+        .trim()
+        .toUpperCase();
+    if (code === "ENOENT") {
+        return `Codex binary '${codexBin}' was not found.`;
+    }
+    if (code === "EPERM") {
+        return `Codex binary '${codexBin}' cannot be executed (EPERM).`;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return `Failed to execute '${codexBin}': ${firstNonEmptyLine(message)}`;
+}
+function firstNonEmptyLine(...values) {
+    for (const value of values) {
+        const line = String(value ?? "")
+            .split(/\r?\n/)
+            .map((entry) => entry.trim())
+            .find(Boolean);
+        if (line) {
+            return line;
+        }
+    }
+    return "";
+}
+function redactSecret(text, secret) {
+    const input = String(text ?? "");
+    const token = String(secret ?? "").trim();
+    if (!token) {
+        return input;
+    }
+    return input.split(token).join("[redacted]");
+}
+async function restartRunningBots() {
+    const statuses = await botManager.listBotsLive();
+    const runningBotIds = statuses
+        .filter((entry) => entry?.running === true)
+        .map((entry) => String(entry?.id ?? "").trim())
+        .filter(Boolean);
+    const restartedBotIds = [];
+    const failures = [];
+    for (const botId of runningBotIds) {
+        try {
+            await botManager.stopBot(botId);
+            await botManager.startBot(botId);
+            restartedBotIds.push(botId);
+        }
+        catch (error) {
+            failures.push({
+                botId,
+                error: sanitizeError(error),
+            });
+        }
+    }
+    return {
+        restartedBotIds,
+        failures,
+    };
+}

package/apps/control-plane/README.md

@@ -3,7 +3,8 @@
 `control-plane` is the single Telegram hub for Copilot Hub.
 
 It handles:
-- simple operations commands (`/help`, `/health`, `/bots`, `/create_agent`, `/cancel`)
+
+- simple operations commands (`/help`, `/health`, `/bots`, `/create_agent`, `/codex_status`, `/codex_login`, `/cancel`)
 - LLM development requests through normal chat messages
 
 ## Setup
@@ -18,9 +19,11 @@ npm run start
 ```
 
 Required env:
+
 - `HUB_TELEGRAM_TOKEN` (or custom `HUB_TELEGRAM_TOKEN_ENV`)
 
 Recommended env:
+
 - `HUB_ENGINE_BASE_URL` (default: `http://127.0.0.1:8787`)
 
 ## Workspace and policy guards

package/apps/control-plane/dist/channels/hub-ops-commands.js

@@ -7,6 +7,7 @@ const BOT_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 const TELEGRAM_TOKEN_PATTERN = /^\d{5,}:[A-Za-z0-9_-]{20,}$/;
 const menuSessions = new Map();
 const createFlows = new Map();
+const codexSwitchFlows = new Map();
 const POLICY_PROFILES = {
     safe: {
         id: "safe",
@@ -75,6 +76,69 @@ export async function maybeHandleHubOpsCommand({ ctx, runtime, channelId }) {
         }
         return true;
     }
+    if (command === "/codex_status") {
+        try {
+            const status = await apiGet("/api/system/codex/status");
+            const deviceAuth = status?.deviceAuth ?? {};
+            const deviceStatus = String(deviceAuth?.status ?? "idle");
+            await ctx.reply([
+                "Codex account:",
+                `configured: ${status?.configured ? "yes" : "no"}`,
+                `binary: ${String(status?.codexBin ?? "-")}`,
+                status?.detail ? `detail: ${String(status.detail)}` : "",
+                `deviceAuth: ${deviceStatus}`,
+                deviceAuth?.code ? `code: ${String(deviceAuth.code)}` : "",
+                deviceAuth?.loginUrl ? `link: ${String(deviceAuth.loginUrl)}` : "",
+                deviceAuth?.detail ? `deviceDetail: ${String(deviceAuth.detail)}` : "",
+            ]
+                .filter(Boolean)
+                .join("\n"));
+        }
+        catch (error) {
+            await ctx.reply(`Codex status failed: ${sanitizeError(error)}`);
+        }
+        return true;
+    }
+    if (command === "/codex_login" || command === "/codex_switch") {
+        try {
+            const response = await apiPost("/api/system/codex/device_auth/start", {});
+            const statusLabel = String(response?.status ?? "pending");
+            const loginUrl = String(response?.loginUrl ?? "").trim();
+            const code = String(response?.code ?? "").trim();
+            if (!loginUrl || !code) {
+                await ctx.reply("Codex login flow started, but code details were not ready yet. Retry /codex_login.");
+                return true;
+            }
+            await ctx.reply([
+                `Codex login flow: ${statusLabel}`,
+                `1) Open: ${loginUrl}`,
+                `2) Enter code: ${code}`,
+                "3) Finish sign-in on your phone, then run /codex_status",
+                "Use /cancel to abort this login flow.",
+            ].join("\n"));
+        }
+        catch (error) {
+            await ctx.reply(`Codex login start failed: ${sanitizeError(error)}`);
+        }
+        return true;
+    }
+    if (command === "/codex_switch_key") {
+        if (createFlows.has(flowKey) || codexSwitchFlows.has(flowKey)) {
+            await ctx.reply("Another operation is active. Send /cancel first.");
+            return true;
+        }
+        codexSwitchFlows.set(flowKey, {
+            createdAt: Date.now(),
+            step: "api_key",
+        });
+        await ctx.reply([
+            "Codex account switch started.",
+            "Send your Codex API key now (example: sk-...).",
+            "Running agents will restart automatically after successful switch.",
+            "Use /cancel to stop.",
+        ].join("\n"));
+        return true;
+    }
     if (command === "/create_agent") {
         const existing = createFlows.get(flowKey);
         if (existing) {
@@ -97,8 +161,19 @@ export async function maybeHandleHubOpsCommand({ ctx, runtime, channelId }) {
         return true;
     }
     if (command === "/cancel") {
-        const deleted = createFlows.delete(flowKey);
-        await ctx.reply(deleted ? "Current operation canceled." : "No active operation.");
+        const createDeleted = createFlows.delete(flowKey);
+        const switchDeleted = codexSwitchFlows.delete(flowKey);
+        let remoteCanceled = false;
+        try {
+            const canceled = await apiPost("/api/system/codex/device_auth/cancel", {});
+            remoteCanceled = canceled?.canceled === true;
+        }
+        catch {
+            remoteCanceled = false;
+        }
+        await ctx.reply(createDeleted || switchDeleted || remoteCanceled
+            ? "Current operation canceled."
+            : "No active operation.");
         return true;
     }
     return false;
@@ -111,6 +186,13 @@ export async function maybeHandleHubOpsFollowUp({ ctx, runtime, channelId }) {
     }
     const chatId = getChatId(ctx);
     const flowKey = buildFlowKey(runtime?.runtimeId, channelId, chatId);
+    const codexFlow = codexSwitchFlows.get(flowKey);
+    if (codexFlow) {
+        const handled = await handleCodexSwitchFlow({ ctx, flowKey, flow: codexFlow, text });
+        if (handled) {
+            return true;
+        }
+    }
     const flow = createFlows.get(flowKey);
     if (!flow) {
         return false;
@@ -196,6 +278,46 @@ export async function maybeHandleHubOpsFollowUp({ ctx, runtime, channelId }) {
     await ctx.reply("Flow reset. Use /create_agent to start again.");
     return true;
 }
+async function handleCodexSwitchFlow({ ctx, flowKey, flow, text }) {
+    if (flow.step !== "api_key") {
+        codexSwitchFlows.delete(flowKey);
+        await ctx.reply("Flow reset. Use /codex_switch_key to start again.");
+        return true;
+    }
+    const apiKey = String(text ?? "").trim();
+    if (!looksLikeCodexApiKey(apiKey)) {
+        await ctx.reply("Invalid API key format. Send a key starting with 'sk-' or /cancel.");
+        return true;
+    }
+    await maybeDeleteIncomingMessage(ctx);
+    try {
+        const result = await apiPost("/api/system/codex/switch_api_key", {
+            apiKey,
+        });
+        codexSwitchFlows.delete(flowKey);
+        const restartedBots = Array.isArray(result?.restartedBots) ? result.restartedBots : [];
+        const restartFailures = Array.isArray(result?.restartFailures) ? result.restartFailures : [];
+        const lines = ["Codex account switched successfully."];
+        if (result?.detail) {
+            lines.push(`status: ${String(result.detail)}`);
+        }
+        if (restartedBots.length > 0) {
+            lines.push(`Agents restarted: ${restartedBots.join(", ")}`);
+        }
+        else {
+            lines.push("No running agents needed restart.");
+        }
+        if (restartFailures.length > 0) {
+            lines.push(`Restart warnings: ${restartFailures.length}. Use /health then /bots to verify state.`);
+        }
+        await ctx.reply(lines.join("\n"));
+        return true;
+    }
+    catch (error) {
+        await ctx.reply(`Codex switch failed:\n${sanitizeError(error)}\nRetry or /cancel.`);
+        return true;
+    }
+}
 export async function maybeHandleHubOpsCallback({ ctx }) {
     const rawData = String(ctx.callbackQuery?.data ?? "").trim();
     if (!rawData.startsWith("hub:")) {
@@ -320,8 +442,15 @@ function buildHelpText(runtimeName) {
         "/health",
         "/bots",
         "/create_agent",
+        "/codex_status",
+        "/codex_login",
+        "/codex_switch_key",
         "/cancel",
         "",
+        "Codex account:",
+        "/codex_login: switch account with device code flow",
+        "/codex_switch_key: switch account with API key",
+        "",
         "Policy guide in /bots:",
         "Safe: read-only + approval prompts",
         "Standard: workspace write + approval prompts",
@@ -349,6 +478,12 @@ function cleanupState() {
             createFlows.delete(key);
         }
     }
+    for (const [key, flow] of codexSwitchFlows.entries()) {
+        const createdAt = Number(flow?.createdAt ?? 0);
+        if (!Number.isFinite(createdAt) || now - createdAt > FLOW_TTL_MS) {
+            codexSwitchFlows.delete(key);
+        }
+    }
 }
 async function renderBotsMenu(ctx, { editMessage = false, notice = "" } = {}) {
     const bots = await fetchBots();
@@ -660,6 +795,29 @@ async function editMessageOrReply(ctx, text, options = {}) {
 function getChatId(ctx) {
     return String(ctx.chat?.id ?? ctx.callbackQuery?.message?.chat?.id ?? "").trim();
 }
+function looksLikeCodexApiKey(value) {
+    const raw = String(value ?? "").trim();
+    if (!raw.startsWith("sk-")) {
+        return false;
+    }
+    if (raw.length < 20 || raw.length > 4096) {
+        return false;
+    }
+    return /^[A-Za-z0-9._-]+$/.test(raw);
+}
+async function maybeDeleteIncomingMessage(ctx) {
+    const chatId = ctx.chat?.id;
+    const messageId = ctx.message?.message_id;
+    if (!chatId || !messageId) {
+        return;
+    }
+    try {
+        await ctx.api.deleteMessage(chatId, messageId);
+    }
+    catch {
+        // Best effort only.
+    }
+}
 async function answerCallbackQuerySafe(ctx, text = "") {
     try {
         if (text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilot-hub",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Copilot Hub CLI and runtime bundle",
   "license": "MIT",
   "repository": {
@@ -57,6 +57,7 @@
     "status": "npm run build:scripts --silent && node scripts/dist/cli.mjs status",
     "logs": "npm run build:scripts --silent && node scripts/dist/cli.mjs logs",
     "configure": "npm run build:scripts --silent && node scripts/dist/cli.mjs configure",
+    "update": "npm run build:scripts --silent && node scripts/dist/cli.mjs update",
     "test": "npm run test --workspaces --if-present",
     "lint": "eslint .",
     "format": "prettier --write \"{scripts,packages}/**/*.{js,mjs,mts,ts,json}\" \"apps/*/src/**/*.{js,ts}\" \"apps/*/package.json\" \"apps/*/test/**/*.{js,ts}\" \"apps/*/tsconfig*.json\" \"{README.md,CONTRIBUTING.md,ARCHITECTURE.md}\" \"eslint.config.mjs\" \"package.json\" \"tsconfig.base.json\"",

package/scripts/dist/cli.mjs

@@ -87,6 +87,11 @@ async function main() {
             runNode(["scripts/dist/service.mjs", ...rawArgs.slice(1)]);
             return;
         }
+        case "update":
+        case "upgrade": {
+            await runSelfUpdate();
+            return;
+        }
         default: {
             printUsage();
             process.exit(1);
@@ -224,6 +229,51 @@ async function maybeOfferServiceInstall() {
     }
     writeServicePromptState("accepted");
 }
+async function runSelfUpdate() {
+    const serviceInstalled = isServiceAlreadyInstalled();
+    const runningBeforeUpdate = serviceInstalled ? isDaemonRunning() : hasRunningSupervisorWorkers();
+    if (serviceInstalled) {
+        const stopService = runNodeCapture(["scripts/dist/service.mjs", "stop"], "inherit");
+        if (!stopService.ok) {
+            console.log("Service stop reported an error. Continuing update attempt.");
+        }
+    }
+    else {
+        const stopLocal = runNodeCapture(["scripts/dist/supervisor.mjs", "down"], "inherit");
+        if (!stopLocal.ok) {
+            console.log("Local stop reported an error. Continuing update attempt.");
+        }
+    }
+    const install = runNpm(["install", "-g", "copilot-hub@latest"], "inherit");
+    if (!install.ok) {
+        const detail = firstLine(install.errorMessage) || firstLine(install.stderr) || firstLine(install.stdout);
+        const normalizedDetail = detail.toLowerCase();
+        if (normalizedDetail.includes("ebusy") || normalizedDetail.includes("resource busy")) {
+            throw new Error([
+                "Update failed because files are locked by another process (EBUSY).",
+                "Close other terminals using copilot-hub, then retry 'copilot-hub update'.",
+            ].join("\n"));
+        }
+        throw new Error(`Update failed: ${detail || "Unknown npm error."}`);
+    }
+    console.log("copilot-hub updated to latest.");
+    if (!runningBeforeUpdate) {
+        console.log("Services remain stopped. Run 'copilot-hub start' when ready.");
+        return;
+    }
+    if (serviceInstalled) {
+        const startService = runNodeCapture(["scripts/dist/service.mjs", "start"], "inherit");
+        if (!startService.ok) {
+            console.log("Update completed, but service start failed. Run 'copilot-hub start' manually.");
+            return;
+        }
+        return;
+    }
+    const startLocal = runNodeCapture(["scripts/dist/supervisor.mjs", "up"], "inherit");
+    if (!startLocal.ok) {
+        console.log("Update completed, but local start failed. Run 'copilot-hub start' manually.");
+    }
+}
 function isServiceSupportedOnCurrentPlatform() {
     return (process.platform === "win32" || process.platform === "linux" || process.platform === "darwin");
 }
@@ -238,6 +288,16 @@ function isServiceAlreadyInstalled() {
     }
     return status.ok;
 }
+function isDaemonRunning() {
+    const status = runNodeCapture(["scripts/dist/daemon.mjs", "status"], "pipe");
+    const output = String(status.combinedOutput ?? "").toLowerCase();
+    return output.includes("=== daemon ===") && output.includes("running: yes");
+}
+function hasRunningSupervisorWorkers() {
+    const status = runNodeCapture(["scripts/dist/supervisor.mjs", "status"], "pipe");
+    const output = String(status.combinedOutput ?? "").toLowerCase();
+    return output.includes("running: yes");
+}
 function readServicePromptState() {
     if (!fs.existsSync(servicePromptStatePath)) {
         return null;
@@ -587,6 +647,7 @@ function spawnNpm(args, options) {
 function printUsage() {
     console.log([
         "Usage: node scripts/dist/cli.mjs <start|stop|restart|status|logs|configure|service|version|help>",
+        "  node scripts/dist/cli.mjs <update|upgrade>",
         "Service management:",
         "  node scripts/dist/cli.mjs service <install|uninstall|status|start|stop|help>",
     ].join("\n"));

package/scripts/dist/daemon.mjs

@@ -325,6 +325,7 @@ function runChecked(command, args, { stdio = "pipe", allowFailure = false } = {}
         cwd: repoRoot,
         shell: false,
         stdio: spawnStdio,
+        windowsHide: true,
         encoding: "utf8",
         env: process.env,
     });

package/scripts/dist/service.mjs

@@ -434,6 +434,7 @@ function runChecked(command, args, { stdio = "pipe", allowFailure = false } = {}
         cwd: repoRoot,
         shell: false,
         stdio,
+        windowsHide: true,
         encoding: "utf8",
         env: process.env,
     });

package/scripts/src/cli.mts

@@ -94,6 +94,11 @@ async function main() {
       runNode(["scripts/dist/service.mjs", ...rawArgs.slice(1)]);
       return;
     }
+    case "update":
+    case "upgrade": {
+      await runSelfUpdate();
+      return;
+    }
     default: {
       printUsage();
       process.exit(1);
@@ -258,6 +263,60 @@ async function maybeOfferServiceInstall() {
   writeServicePromptState("accepted");
 }
 
+async function runSelfUpdate() {
+  const serviceInstalled = isServiceAlreadyInstalled();
+  const runningBeforeUpdate = serviceInstalled ? isDaemonRunning() : hasRunningSupervisorWorkers();
+
+  if (serviceInstalled) {
+    const stopService = runNodeCapture(["scripts/dist/service.mjs", "stop"], "inherit");
+    if (!stopService.ok) {
+      console.log("Service stop reported an error. Continuing update attempt.");
+    }
+  } else {
+    const stopLocal = runNodeCapture(["scripts/dist/supervisor.mjs", "down"], "inherit");
+    if (!stopLocal.ok) {
+      console.log("Local stop reported an error. Continuing update attempt.");
+    }
+  }
+
+  const install = runNpm(["install", "-g", "copilot-hub@latest"], "inherit");
+  if (!install.ok) {
+    const detail =
+      firstLine(install.errorMessage) || firstLine(install.stderr) || firstLine(install.stdout);
+    const normalizedDetail = detail.toLowerCase();
+    if (normalizedDetail.includes("ebusy") || normalizedDetail.includes("resource busy")) {
+      throw new Error(
+        [
+          "Update failed because files are locked by another process (EBUSY).",
+          "Close other terminals using copilot-hub, then retry 'copilot-hub update'.",
+        ].join("\n"),
+      );
+    }
+    throw new Error(`Update failed: ${detail || "Unknown npm error."}`);
+  }
+
+  console.log("copilot-hub updated to latest.");
+
+  if (!runningBeforeUpdate) {
+    console.log("Services remain stopped. Run 'copilot-hub start' when ready.");
+    return;
+  }
+
+  if (serviceInstalled) {
+    const startService = runNodeCapture(["scripts/dist/service.mjs", "start"], "inherit");
+    if (!startService.ok) {
+      console.log("Update completed, but service start failed. Run 'copilot-hub start' manually.");
+      return;
+    }
+    return;
+  }
+
+  const startLocal = runNodeCapture(["scripts/dist/supervisor.mjs", "up"], "inherit");
+  if (!startLocal.ok) {
+    console.log("Update completed, but local start failed. Run 'copilot-hub start' manually.");
+  }
+}
+
 function isServiceSupportedOnCurrentPlatform() {
   return (
     process.platform === "win32" || process.platform === "linux" || process.platform === "darwin"
@@ -276,6 +335,18 @@ function isServiceAlreadyInstalled() {
   return status.ok;
 }
 
+function isDaemonRunning() {
+  const status = runNodeCapture(["scripts/dist/daemon.mjs", "status"], "pipe");
+  const output = String(status.combinedOutput ?? "").toLowerCase();
+  return output.includes("=== daemon ===") && output.includes("running: yes");
+}
+
+function hasRunningSupervisorWorkers() {
+  const status = runNodeCapture(["scripts/dist/supervisor.mjs", "status"], "pipe");
+  const output = String(status.combinedOutput ?? "").toLowerCase();
+  return output.includes("running: yes");
+}
+
 function readServicePromptState() {
   if (!fs.existsSync(servicePromptStatePath)) {
     return null;
@@ -693,6 +764,7 @@ function printUsage() {
   console.log(
     [
       "Usage: node scripts/dist/cli.mjs <start|stop|restart|status|logs|configure|service|version|help>",
+      "  node scripts/dist/cli.mjs <update|upgrade>",
       "Service management:",
       "  node scripts/dist/cli.mjs service <install|uninstall|status|start|stop|help>",
     ].join("\n"),

package/scripts/src/daemon.mts

@@ -385,6 +385,7 @@ function runChecked(command, args, { stdio = "pipe", allowFailure = false } = {}
     cwd: repoRoot,
     shell: false,
     stdio: spawnStdio,
+    windowsHide: true,
     encoding: "utf8",
     env: process.env,
   });

package/scripts/src/service.mts

@@ -532,6 +532,7 @@ function runChecked(command, args, { stdio = "pipe", allowFailure = false } = {}
     cwd: repoRoot,
     shell: false,
     stdio,
+    windowsHide: true,
     encoding: "utf8",
     env: process.env,
   });