directionallylocal 0.6.0 → 0.7.0

package/README.md

@@ -1,59 +1,125 @@
 # Directionally Local installer
 
-Rent a server, paste one line, and send coding tasks to it from your laptop. Each task runs in its own [Hotcell](https://github.com/directionally-local/hotcell) sandbox, driven by [Autopilot](https://github.com/directionally-local/autopilot), and comes back as a pull request, even with your laptop closed.
+Coding agents that run on your own computer or on your own server. Send a task; it runs in its own [Hotcell](https://github.com/directionally-local/hotcell) sandbox, driven by [Autopilot](https://github.com/directionally-local/autopilot), and comes back as a pull request, even with your laptop closed.
+
+## Start on your laptop
 
 ```sh
-curl -fsSL https://directionallylocal.run | sh
+npm install -g directionallylocal
+dl
 ```
 
-It asks three things:
+`dl` asks where your agents should run:
+
+- **On this computer** — start now, nothing to rent, pauses when this computer sleeps.
+- **On my own server** — keeps going when your laptop is closed; needs SSH access.
+
+For a server, `dl` lists the hosts in `~/.ssh/config` (or takes `user@host[:port]`), checks it over SSH, installs itself there, and pairs this laptop. Nothing is exposed on the server: `dl` reaches it through an SSH tunnel.
+
+### The keys it asks for
+
+Two keys, kept on the server only. `dl` looks for them on your laptop first and offers each one it finds:
 
-1. **Tailscale auth key.** The server joins your tailnet and serves Autopilot on its private `https://<name>.<tailnet>.ts.net` address, with no public ports. Turn on MagicDNS and HTTPS certificates for the tailnet first. Own-domain and instant-address options are coming.
-2. **OpenRouter API key.** This is stored in Hotcell's keystore on the server. Sandboxes get spend-capped gateway tokens instead, and your laptop never sees the key.
-3. **GitHub token,** so runs can clone, push, and open PRs. A fine-grained token with Contents and Pull requests read/write on the repositories you'll use is enough. It stays on the server; sandboxes push through Autopilot's repository-scoped proxy.
+- **GitHub** — your GitHub CLI login (`gh auth token`), offered as *"Use your GitHub CLI login (you)? It stays on your server."* Otherwise it asks for a fine-grained token with Contents and Pull requests read/write.
+- **OpenRouter** — the key in `OPENROUTER_API_KEY`, or the one Autopilot already has, offered the same way. Otherwise it asks for one.
 
-It ends with:
+The OpenRouter key goes into Hotcell's keystore on the server; sandboxes get spend-capped gateway tokens instead, and your laptop never sees it. The GitHub token stays on the server too; sandboxes push through Autopilot's repository-scoped proxy.
+
+### The model
+
+Setup asks once which model tasks and sessions use. The default is `deepseek/deepseek-v4.1-flash-1017`; if Autopilot already has a default model, that one is preselected instead. Change it any time with `dl model`, or per run with `-m`.
+
+### It ends with
 
 ```
-✓ Ready. Fits ~6 agents at once (estimate).
-  Open once to approve laptops in your browser: https://box.tail1234.ts.net/api/v1/auth/claim?token=…
-  On your laptop (signed in to the same tailnet): autopilot remote add https://box.tail1234.ts.net
+✓ Ready · fits ~6 agents at once (estimate)
+  1 Start a session: cd into a GitHub repository, then type
+      dl
+  2 Or hand off a one-off task
+      dl run "fix the flaky checkout test"
+
+  dl status shows where agents run and what they're doing.
 ```
 
-Then, on your laptop:
+Then, from inside a GitHub repository:
 
 ```sh
-npm install -g directionallylocal
-dl connect https://box.tail1234.ts.net     # approve the code in the browser you opened the link in
-dl run "fix the flaky checkout test"       # from inside a GitHub repository; local changes go along
-dl runs                                    # tasks and their pull requests
-dl pull <id>                               # check one out here
+dl                                  # talk to the repository's agent; it keeps running when you leave
+dl run "fix the flaky checkout test"  # one-off task; your uncommitted changes go along
+dl runs                             # tasks and their pull requests
+dl pull <id>                        # check one out here
 ```
 
-Typing `dl` on its own explains what it is and what's going on, on the server and on the laptop.
+`dl status` says when a server is behind npm, once a day: `! box is behind: Autopilot 2.7.0 → 2.7.2   dl update box`.
 
-The "fits ~N agents" figure is a conservative estimate from memory and CPUs (1 GB per sandbox). Measured numbers will replace it.
+The "fits ~N agents" figure is a conservative estimate: memory left after the host's own share (at least 1.5 GB or 15%), divided by 1 GB per sandbox, capped at two per CPU. Measured numbers will replace it.
 
 ## Commands
 
-Run these as root on the server. `dl` is short for `directionallylocal`; both work.
+`dl` is short for `directionallylocal`; both work.
+
+### On your laptop
+
+| Command | What it does |
+| --- | --- |
+| `dl` | Set up the first time; afterwards, an overview. Inside a GitHub repository, that repository's agent session. |
+| `dl setup` | Set up or repair where your agents run. Safe to re-run. `--identity FILE` names the SSH key to use. |
+| `dl new` | In a GitHub repository: start a fresh conversation for it. |
+| `dl status` | Where your agents run and what they're doing. Works anywhere. |
+| `dl connect URL` | Connect to a server someone else set up; approve the code it shows. |
+| `dl run "TASK"` | Run a task, from inside a GitHub repository. Ctrl-C stops watching, not the task. |
+| `dl runs` | Your tasks and their pull requests. `--json` for scripts. |
+| `dl watch ID` / `dl cancel ID` | Follow a task, or stop one. |
+| `dl pull ID` | Check out a task's branch here. |
+| `dl servers` | Where agents run. `dl servers rename OLD NEW`, `dl servers remove NAME`. |
+| `dl use [NAME]` | Where tasks go without `--server`. With no name, shows it. |
+| `dl keys [openrouter\|github]` | Which keys are set, or replace one. `--server NAME` picks the server. |
+| `dl model [ID]` | The model for tasks and sessions. With no ID, picks from a list. |
+| `dl update [NAME]` | Update a server's Autopilot, Hotcell and sandbox image over SSH. `--wait` waits for running tasks instead of asking; with no terminal it waits anyway. |
+| `dl local status` | Agents running on this computer: running?, where, how many fit. |
+| `dl local uninstall [--purge]` | Stop and remove them. `--purge` also deletes keys and data. |
+
+Run options: `--server NAME`, `-m/--model MODEL`, `--repo OWNER/NAME`, `--detach`.
+
+### On the server
+
+Run these as root. `dl` on its own shows what this is, whether it's healthy, the connected laptops, and the runs.
 
 | Command | What it does |
 | --- | --- |
 | `dl up` | Install or repair everything. Safe to re-run: it keeps your keys and generated secrets and skips work that's already done. |
 | `dl up --dry-run` | Print what `up` would change, without changing anything. |
+| `dl connect-laptop` | How to connect a laptop, and a link to approve it in a browser. `dl connect-laptop CODE` approves the code a laptop shows. |
+| `dl laptops` | Connected laptops. `dl laptops remove NAME` disconnects one. |
+| `dl runs` | Tasks running or done, with their pull requests. |
+| `dl logs [hotcell\|autopilot] [-f]` | The services' logs. |
 | `dl doctor` | Check every part, with a fix for each failure. |
+| `dl keys [set openrouter\|github]` | Which keys are set, or replace one (hidden input). |
 | `dl status` | Show the installed versions and where to reach the server. |
 | `dl uninstall` | Remove the services and software but keep configuration and data. Add `--purge` to delete those too, plus the service accounts and the sandbox image. |
 
-For unattended installs, set the answers as environment variables: `DL_TAILSCALE_AUTH_KEY`, `DL_OPENROUTER_API_KEY` and `DL_GITHUB_TOKEN`. `DL_ACCESS=loopback` skips Tailscale; you then reach the server over an SSH tunnel.
+### Unattended installs
+
+Set the answers as environment variables: `DL_TAILSCALE_AUTH_KEY`, `DL_OPENROUTER_API_KEY` and `DL_GITHUB_TOKEN`. `DL_ACCESS` picks how the server is reached: `tailscale` (the default), `loopback` (this machine only), or `ssh` (what the laptop's setup uses). `DL_SKIP_CREDENTIAL_CHECK=1` skips the online key checks for offline installs.
 
-## What it sets up
+The laptop's setup drives the server over SSH with `dl up --access ssh --answers-stdin --events json`, which takes the keys as one JSON object on stdin and reports progress as JSON lines. `dl up --needs` reports which keys it would still ask for, without changing anything.
+
+## The one-line server install
+
+The curl path is still there for a server you set up by hand, as root on Ubuntu or Debian:
+
+```sh
+curl -fsSL https://directionallylocal.run | sh
+```
+
+It installs Node.js if needed, installs `directionallylocal`, and runs `dl up`. The laptop's setup uses the same script to bootstrap a server over SSH.
+
+## What it sets up on a server
 
 - **Node.js 24 LTS,** if Node is missing or lacks the fix for CVE-2026-111497 (22.23.4+, 24.22.1+ and 26.12.1+ are accepted). Node security releases from NodeSource are added to Ubuntu's automatic updates, which otherwise skip them. Delete `/etc/apt/apt.conf.d/52directionallylocal-nodejs` to opt out.
 - **Docker,** if it's missing, plus a rule that keeps sandboxes away from the cloud metadata endpoint. Docker isn't updated automatically, because its repo ships major upgrades and restarting the Docker daemon can stop running sandboxes.
 - **Hotcell and Autopilot from npm,** under `/opt/directionallylocal/releases/<versions>`, with `current` pointing at the active release.
-- **Two systemd services, each under its own unprivileged account:** `hotcell.service` (sandboxes and the credential gateway, on loopback) and `autopilot.service` (the API that laptops pair with, on `127.0.0.1:4096`). Only Tailscale Serve exposes it.
+- **Three systemd units:** `hotcell.service` (sandboxes and the credential gateway, on loopback) and `autopilot.service` (the API that laptops pair with, on `127.0.0.1:4096`), each under its own unprivileged account, plus `directionallylocal-metadata-block.service`, the firewall rule for sandboxes. Only Tailscale Serve exposes the API, and only when you use Tailscale access.
 - **A sandbox image** with Node, git, Python, and the Autopilot runtime baked in.
 - **Configuration** in `/etc/hotcell`, `/etc/autopilot` and `/etc/directionallylocal`, readable only by root and the matching service account. Data lives in `/var/lib/hotcell` and `/var/lib/autopilot`.
 
@@ -63,6 +129,8 @@ Supported: Ubuntu 24.04 and 22.04 and Debian 12, on x86_64 or arm64, with at lea
 
 `site/` is the Cloudflare Worker for `https://directionallylocal.run`. It serves `install.sh` to `curl` at the bare domain (and `/install.sh`), sends browsers to directionallylocal.com, and serves nothing else. Subdomains of `directionallylocal.run` are users' instant addresses, and the domain is on the Public Suffix List, so the Worker never sets cookies. Deploy it with `npx wrangler deploy -c site/wrangler.toml`.
 
+`site/wrangler.jsonc` is the portable config that celld and Serverless Objects read; `site/wrangler.toml` keeps the Cloudflare-only `routes` and `workers_dev`. The install script is checked in as `site/install-script.ts` so the Worker has no non-JavaScript imports; regenerate it with `npm run sync:site-script` after editing `install.sh`. `sobjects build --strict site` checks that the Worker stays portable. The design for the name service and approvals page is in [`docs/plans/portable-services.md`](docs/plans/portable-services.md).
+
 ## Development
 
 ```sh
@@ -70,6 +138,7 @@ npm install
 npm test          # node:test through tsx; a simulated server exercises up, doctor, and uninstall
 npm run typecheck
 npm run build
+npm run sync:site-script   # after editing install.sh
 ```
 
 ## License

package/dist/cli.js

@@ -10,6 +10,8 @@ import { keys } from "./laptop/keys.js";
 import { model } from "./laptop/settings.js";
 import { projectSession } from "./laptop/session.js";
 import { setup } from "./laptop/setup.js";
+import { realSshExec } from "./laptop/ssh.js";
+import { update } from "./laptop/update.js";
 import { localCommand } from "./local/cli.js";
 import { setUpOnThisComputer } from "./local/setup.js";
 import { TtyPrompter } from "./prompt.js";
@@ -38,6 +40,8 @@ On your laptop:
   dl use [NAME]           where tasks go without --server (no NAME: show it)
   dl keys [openrouter|github]   which keys are set, or replace one (--server NAME)
   dl model [ID]           the model for tasks and sessions (no ID: pick from a list)
+  dl update [NAME]        update a server's Autopilot, Hotcell and sandbox image
+                          (--wait: wait for running tasks instead of asking)
   run options: --server NAME, -m/--model MODEL, --repo OWNER/NAME, --detach
   dl local status         agents running on this computer: running?, where, how many fit
   dl local uninstall [--purge]   stop and remove them (--purge also deletes keys and data)
@@ -106,6 +110,7 @@ export async function main(argv, io = {
                 needs: { type: "boolean" },
                 identity: { type: "string" },
                 stdin: { type: "boolean" },
+                wait: { type: "boolean" },
             },
         });
     }
@@ -220,7 +225,7 @@ export async function main(argv, io = {
                     }
                     // A laptop connected to servers gets its own home (`dl status` shows it from anywhere);
                     // otherwise, what this is and how to start.
-                    if ((!command || command === "status") && await laptopHome(laptopIO))
+                    if ((!command || command === "status") && await laptopHome(laptopIO, undefined, undefined, { ssh: realSshExec }))
                         return 0;
                     // A laptop with nothing set up yet: the wizard (it needs someone to answer it).
                     if (!command && terminal && !isRoot() && (await loadRemotes()).length === 0)
@@ -242,6 +247,15 @@ export async function main(argv, io = {
             }
             case "setup":
                 return await setup({ io: laptopIO, terminal, localSetup: (input) => setUpOnThisComputer(input), ...(values.identity ? { identityFile: values.identity } : {}) });
+            case "update":
+                return await update(parsed.positionals.slice(1), {
+                    ssh: realSshExec,
+                    prompter: new TtyPrompter(),
+                    newUi: () => terminal ? new TerminalUi(io.out, undefined, colorOn) : new PlainUi(io.out),
+                    io: laptopIO,
+                    interactive: terminal,
+                    wait: Boolean(values.wait),
+                });
             case "connect": {
                 const url = parsed.positionals[1];
                 if (!url) {

package/dist/laptop/client.js

@@ -77,6 +77,25 @@ export class RemoteClient {
     cancel(conversationId) {
         return this.request("POST", `/conversations/${encodeURIComponent(conversationId)}/cancel`);
     }
+    /**
+     * The newest event of a finished conversation: one request, then the stream is dropped.
+     * `dl runs` uses it to say why a task failed without replaying the whole run.
+     */
+    async lastEvent(conversationId, lastEventId) {
+        const controller = new AbortController();
+        try {
+            for await (const event of this.events(conversationId, Math.max(0, lastEventId - 1), controller.signal)) {
+                return event;
+            }
+        }
+        catch {
+            return undefined;
+        }
+        finally {
+            controller.abort();
+        }
+        return undefined;
+    }
     /**
      * Events after `cursor`, reconnecting with the last seen ID when the stream drops,
      * until the caller stops iterating or the signal aborts.

package/dist/laptop/commands.js

@@ -12,6 +12,7 @@ import { DEFAULT_MODEL, laptopModel } from "./settings.js";
 import { sshCommandLine } from "./ssh.js";
 import { openBrowser } from "./open-browser.js";
 import { withConnections } from "./tunnel.js";
+import { outdatedServers } from "./update.js";
 export { DEFAULT_MODEL, readAutopilotModel } from "./settings.js";
 /**
  * `dl` on a laptop: send tasks to where agents run (this computer, or your own server),
@@ -129,12 +130,16 @@ async function listRuns(remotes, connections, json, io) {
         io.out(`\n  No tasks yet. From inside a GitHub repository:  ${c.bold('dl run "fix the flaky checkout test"')}\n\n`);
         return;
     }
+    const reasons = await failureReasons(rows, remotes, connections);
     io.out("\n");
     for (const entry of rows) {
         const running = entry.activeRunId !== null;
         const glyph = running ? c.cyan("◐") : entry.status === "completed" || entry.status === "merged" ? c.green("✓") : ["failed", "interrupted"].includes(entry.status) ? c.red("✗") : c.dim("○");
         const multi = remotes.length > 1 ? `${entry.server}  ` : "";
         io.out(`  ${glyph} ${entry.conversationId.slice(0, 8)}  ${multi}${(running ? "running" : entry.status).padEnd(11)} ${(entry.repository ?? "").padEnd(26)} ${c.dim(entry.pullRequestURL ?? entry.branch ?? "")}\n`);
+        const reason = reasons.get(entry.conversationId);
+        if (reason)
+            io.out(`      ${c.dim(oneLine(reason, 100))}\n`);
     }
     io.out(`\n  ${c.dim("Follow one:")} dl watch <id>   ${c.dim("Check one out:")} dl pull <id>\n\n`);
 }
@@ -262,7 +267,7 @@ export async function renameServer(args, io = processIO, path) {
     return 0;
 }
 /** `dl` on a laptop: what this is, which servers it's connected to, what to type next. */
-export async function laptopHome(io = processIO, open, model = laptopModel) {
+export async function laptopHome(io = processIO, open, model = laptopModel, versions) {
     const c = palette(io.color === true);
     const remotes = await loadRemotes();
     if (remotes.length === 0)
@@ -276,12 +281,19 @@ export async function laptopHome(io = processIO, open, model = laptopModel) {
             total += list?.length ?? 0;
         }
     });
-    const [current, chosen] = await Promise.all([defaultName(), model()]);
+    const [current, chosen, outdated] = await Promise.all([
+        defaultName(),
+        model(),
+        versions ? outdatedServers(remotes, versions).catch(() => []) : Promise.resolve([]),
+    ]);
     io.out(`\n  ${c.bold("Directionally Local")}  ${c.dim("on this laptop")}\n\n`);
     io.out("  Coding agents that run on this computer or your own server: send a task, get a pull request back.\n\n");
     io.out(`  ${c.dim("Runs on".padEnd(11))}${remotes.map((remote) => `${mark(remote, current, c)} ${remote.name} ${c.dim(where(remote))}`).join(", ")}   ${c.dim(remotes.length > 1 ? "dl servers · dl use NAME" : "dl servers")}\n`);
     io.out(`  ${c.dim("Tasks".padEnd(11))}${running} running · ${total} in all   ${c.dim("dl runs")}\n`);
-    io.out(`  ${c.dim("Model".padEnd(11))}${chosen ?? DEFAULT_MODEL}   ${c.dim("dl model")}\n\n`);
+    io.out(`  ${c.dim("Model".padEnd(11))}${chosen ?? DEFAULT_MODEL}   ${c.dim("dl model")}\n`);
+    for (const entry of outdated)
+        io.out(`  ${c.yellow("!")} ${entry.name} is behind: ${entry.notice}   ${c.dim(`dl update ${entry.name}`)}\n`);
+    io.out("\n");
     io.out(`  ${c.dim("Start a session: cd into a GitHub repository, then type")}  ${c.bold("dl")}\n`);
     io.out(`  ${c.dim("Or hand off a one-off task:")}  ${c.bold('dl run "fix the flaky checkout test"')}\n\n`);
     return true;
@@ -293,12 +305,15 @@ async function follow(client, remote, conversationId, cursor, signal, io, replay
     signal?.addEventListener("abort", stop, { once: true });
     const renderer = new EventRenderer(io, c);
     let outcome;
+    let finalEvent;
     try {
         if (replayUntil === undefined || replayUntil > cursor) {
             for await (const event of client.events(conversationId, cursor, controller.signal)) {
                 renderer.render(event);
-                if (RUN_END_EVENTS.has(event.type))
+                if (RUN_END_EVENTS.has(event.type)) {
                     outcome = event.type;
+                    finalEvent = event;
+                }
                 if (replayUntil === undefined ? RUN_END_EVENTS.has(event.type) : event.id >= replayUntil)
                     break;
             }
@@ -325,9 +340,18 @@ async function follow(client, remote, conversationId, cursor, signal, io, replay
         return 0;
     }
     io.err(`\n  ${c.red("✗")} ${id} ${outcome}\n`);
+    const reason = failureReason(finalEvent);
+    if (reason)
+        for (const line of wrap(reason, 100, 3))
+            io.err(`    ${c.dim(line)}\n`);
     if (renderer.unpriced || isModelNotPriced(JSON.stringify(final))) {
         io.err(`  This model isn't in your server's price list yet. Run ${c.bold("dl setup")} to refresh it, or pick another model with -m.\n`);
     }
+    else {
+        const hint = reason ? failureHint(reason) : undefined;
+        if (hint)
+            io.err(`  ${c.dim(hint)}\n`);
+    }
     io.err("\n");
     return 1;
 }
@@ -439,6 +463,78 @@ function oneLine(text, max) {
     const flat = text.replace(/\s+/g, " ").trim();
     return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
 }
+/** The reason a run ended, from its final event. Servers have used `reason`, `error` and `message`. */
+export function failureReason(event) {
+    if (!event)
+        return undefined;
+    for (const key of ["reason", "error", "message", "detail"]) {
+        const value = event.data[key];
+        if (typeof value === "string" && value.trim())
+            return value.trim();
+    }
+    return undefined;
+}
+/** A next step for the reasons we recognise, or undefined. */
+export function failureHint(reason) {
+    const text = reason.toLowerCase();
+    if (/context window|token limit|too many tokens|maximum context/.test(text))
+        return "pick a model with a bigger window: dl model";
+    if (/not priced|no such model|model not found|not offered|unknown model/.test(text))
+        return "pick another model: dl model";
+    if (/rate limit|429|quota/.test(text))
+        return "wait a moment, or check the OpenRouter key: dl keys openrouter";
+    if (/git_push_failed|push failed|permission denied|bad credentials|401/.test(text))
+        return "check the GitHub token: dl keys github";
+    if (/out of memory|oom|killed/.test(text))
+        return "the sandbox ran out of memory; try a smaller task";
+    return undefined;
+}
+/** `text` broken into at most `maxLines` lines of `width`, with an ellipsis when it was cut. */
+export function wrap(text, width, maxLines) {
+    const words = text.replace(/\s+/g, " ").trim().split(" ").filter(Boolean);
+    const lines = [];
+    let line = "";
+    for (const word of words) {
+        if (line && line.length + 1 + word.length > width) {
+            lines.push(line);
+            line = word;
+        }
+        else {
+            line = line ? `${line} ${word}` : word;
+        }
+    }
+    if (line)
+        lines.push(line);
+    if (lines.length <= maxLines)
+        return lines;
+    const kept = lines.slice(0, maxLines);
+    kept[maxLines - 1] = `${kept[maxLines - 1].slice(0, width - 1)}…`;
+    return kept;
+}
+/** How many failed tasks `dl runs` asks about; each one is a request. */
+const REASON_LOOKUPS = 10;
+/** One line per failed task, from its final event. */
+async function failureReasons(rows, remotes, connections) {
+    const reasons = new Map();
+    let lookups = 0;
+    for (const entry of rows) {
+        if (lookups >= REASON_LOOKUPS)
+            break;
+        if (entry.activeRunId !== null || !["failed", "interrupted"].includes(entry.status))
+            continue;
+        const remote = remotes.find((candidate) => candidate.name === entry.server);
+        if (!remote)
+            continue;
+        lookups++;
+        const event = await connections.client(remote)
+            .then((client) => client.lastEvent(entry.conversationId, entry.lastEventId))
+            .catch(() => undefined);
+        const reason = failureReason(event);
+        if (reason)
+            reasons.set(entry.conversationId, reason);
+    }
+    return reasons;
+}
 export function describeError(error) {
     if (error instanceof RemoteApiError)
         return `${error.message} (${error.code})`;

package/dist/laptop/update.js

@@ -0,0 +1,206 @@
+import { execFile } from "node:child_process";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { palette } from "../ui.js";
+import { resolveRemote } from "./config.js";
+import { EventReplayer } from "./remote-install.js";
+import { checkServer } from "./ssh.js";
+import { withConnections } from "./tunnel.js";
+const execFileAsync = promisify(execFile);
+const DAY_MS = 24 * 60 * 60 * 1000;
+const STATE_FILE = "/etc/directionallylocal/state.json";
+/** Non-root users run the server commands with sudo; checkServer made sure it needs no password. */
+function sudo(facts) {
+    return facts.root ? "" : "sudo -n ";
+}
+/** The versions a server has installed, from the state file `dl up` writes (world-readable). */
+export async function serverVersions(access, ssh) {
+    const result = await ssh(access, `cat ${STATE_FILE}`);
+    if (result.code !== 0)
+        return undefined;
+    try {
+        const state = JSON.parse(result.stdout);
+        return typeof state.autopilotVersion === "string" && typeof state.hotcellVersion === "string"
+            ? { autopilot: state.autopilotVersion, hotcell: state.hotcellVersion }
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `1.2.10` is newer than `1.2.9`; a pre-release suffix is ignored, since npm's `latest` has none. */
+export function compareVersions(a, b) {
+    const parse = (version) => version.replace(/^v/, "").split(/[.+-]/).slice(0, 3).map((part) => Number(part) || 0);
+    const left = parse(a);
+    const right = parse(b);
+    for (let index = 0; index < 3; index++) {
+        const difference = (left[index] ?? 0) - (right[index] ?? 0);
+        if (difference !== 0)
+            return difference < 0 ? -1 : 1;
+    }
+    return 0;
+}
+/** "Autopilot 2.7.0 → 2.7.2 · Hotcell 1.4.0 → 1.4.1", or undefined when the server is current. */
+export function behindNotice(server, latest) {
+    const parts = [];
+    if (compareVersions(server.autopilot, latest.autopilot) < 0)
+        parts.push(`Autopilot ${server.autopilot} → ${latest.autopilot}`);
+    if (compareVersions(server.hotcell, latest.hotcell) < 0)
+        parts.push(`Hotcell ${server.hotcell} → ${latest.hotcell}`);
+    return parts.length > 0 ? parts.join(" · ") : undefined;
+}
+export function versionsCachePath(env = process.env) {
+    const cacheHome = env.XDG_CACHE_HOME?.trim() || join(homedir(), ".cache");
+    return join(cacheHome, "directionallylocal", "versions.json");
+}
+async function npmVersion(pkg) {
+    try {
+        const { stdout } = await execFileAsync("npm", ["view", pkg, "version"], { timeout: 15_000 });
+        const version = stdout.trim();
+        return /^\d+\.\d+\.\d+/.test(version) ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * npm's newest Autopilot and Hotcell, looked up at most once a day. Offline keeps the last
+ * answer rather than pretending the server is current.
+ */
+export async function latestVersions(options = {}) {
+    const path = options.cacheFile ?? versionsCachePath();
+    const now = (options.now ?? Date.now)();
+    const maxAge = options.maxAgeMs ?? DAY_MS;
+    const cached = await readCache(path);
+    if (cached && now - cached.checkedAt < maxAge)
+        return cached;
+    const npm = options.npm ?? npmVersion;
+    const [autopilot, hotcell] = await Promise.all([npm("autopilot-ai"), npm("hotcell")]);
+    if (!autopilot || !hotcell)
+        return cached;
+    const fresh = { autopilot, hotcell, checkedAt: now };
+    await writeCache(path, fresh);
+    return fresh;
+}
+async function readCache(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf8"));
+        return typeof parsed.autopilot === "string" && typeof parsed.hotcell === "string" && typeof parsed.checkedAt === "number"
+            ? { autopilot: parsed.autopilot, hotcell: parsed.hotcell, checkedAt: parsed.checkedAt }
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function writeCache(path, versions) {
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        const temp = `${path}.${process.pid}.tmp`;
+        await writeFile(temp, `${JSON.stringify(versions, null, 2)}\n`, { mode: 0o644 });
+        await rename(temp, path);
+    }
+    catch {
+        // A cache that can't be written only costs another lookup next time.
+    }
+}
+/** How many tasks are running on a server, or undefined when it can't be asked. */
+export async function runningTasks(remote, open) {
+    try {
+        return await withConnections(open, async (connections) => {
+            const list = await (await connections.client(remote)).listConversations(200);
+            return list.filter((entry) => entry.activeRunId !== null).length;
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Servers that are behind npm, for `dl status`. One SSH round trip each, and a cached lookup. */
+export async function outdatedServers(remotes, deps) {
+    const latest = await (deps.latest ?? (() => latestVersions()))();
+    if (!latest)
+        return [];
+    const outdated = [];
+    for (const remote of remotes) {
+        if (!remote.ssh)
+            continue;
+        const server = await serverVersions(remote.ssh, deps.ssh);
+        if (!server)
+            continue;
+        const notice = behindNotice(server, latest);
+        if (notice)
+            outdated.push({ name: remote.name, notice });
+    }
+    return outdated;
+}
+/** `dl update [NAME] [--wait]`: update a server over SSH, without interrupting its tasks. */
+export async function update(args, deps) {
+    const c = palette(deps.io.color === true);
+    const name = args.find((arg) => !arg.startsWith("-"));
+    const remote = await resolveRemote(name);
+    if (!remote.ssh) {
+        deps.io.err(`\n  ${c.red("✗")} ${remote.name} wasn't set up over SSH, so this laptop can't update it.\n  On the server: ${c.bold("sudo dl up")}\n\n`);
+        return 1;
+    }
+    const facts = await checkServer(remote.ssh, deps.ssh, remote.name);
+    const before = await serverVersions(remote.ssh, deps.ssh);
+    const running = deps.running ?? ((target) => runningTasks(target, deps.open));
+    const count = await running(remote);
+    if (count === undefined) {
+        deps.io.err(`  ${c.yellow("!")} Couldn't ask ${remote.name} what's running; updating anyway.\n`);
+    }
+    else if (count > 0) {
+        if (!(await settleRunning(remote, count, deps, running, c)))
+            return 1;
+    }
+    deps.io.out(`\n  ${c.bold("Updating")} ${remote.name}${before ? c.dim(`  (Autopilot ${before.autopilot} · Hotcell ${before.hotcell})`) : ""}\n\n`);
+    const replay = new EventReplayer(deps.newUi);
+    // No --access: the server keeps the way it's reached. `{}` means "no new answers", so a
+    // missing key fails at once instead of waiting for a prompt nobody can see.
+    const result = await deps.ssh(remote.ssh, `${sudo(facts)}dl up --answers-stdin --events json`, {
+        input: "{}\n",
+        onStdoutLine: (line) => replay.line(line),
+    });
+    replay.finish();
+    if (result.code !== 0 || replay.error) {
+        deps.io.err(`\n  ${c.red("✗")} Updating ${remote.name} failed: ${replay.error ?? `dl up exited with ${result.code}`}\n`);
+        for (const line of replay.tail())
+            deps.io.err(`    ${c.dim(line)}\n`);
+        deps.io.err("\n");
+        return 1;
+    }
+    const after = await serverVersions(remote.ssh, deps.ssh);
+    const changed = before && after && (before.autopilot !== after.autopilot || before.hotcell !== after.hotcell);
+    const versions = after ? `  ${c.dim(`Autopilot ${after.autopilot} · Hotcell ${after.hotcell}`)}` : "";
+    deps.io.out(`\n  ${c.green("✓")} ${remote.name} is up to date${changed ? "" : c.dim("  (already was)")}${versions}\n\n`);
+    return 0;
+}
+/**
+ * Decides what to do about running tasks: wait when asked or when nobody can answer, and
+ * otherwise ask. Returns whether to go ahead.
+ */
+async function settleRunning(remote, count, deps, running, c) {
+    const tasks = `${count} task${count === 1 ? "" : "s"}`;
+    if (deps.wait || !deps.interactive) {
+        deps.io.out(`  ${c.cyan("·")} ${tasks} running on ${remote.name}; waiting for ${count === 1 ? "it" : "them"} to finish (Ctrl-C stops waiting).\n`);
+        await waitForIdle(remote, deps, running);
+        return true;
+    }
+    const answer = (await deps.prompter.text(`  ${tasks} running on ${remote.name}. Update now and interrupt ${count === 1 ? "it" : "them"}? [y/N] `)).trim().toLowerCase();
+    if (answer === "y" || answer === "yes")
+        return true;
+    deps.io.out(`  ${c.dim("Not updating. Wait for them, then run")} dl update ${remote.name}${c.dim(", or add --wait.")}\n\n`);
+    return false;
+}
+async function waitForIdle(remote, deps, running) {
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    for (;;) {
+        const count = await running(remote);
+        if (count === undefined || count === 0)
+            return;
+        await sleep(15_000);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "directionallylocal",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Directionally Local: background coding agents on your own server. One-line server install, and the dl command for your server and laptop.",
   "license": "Apache-2.0",
   "homepage": "https://directionallylocal.com",
@@ -27,8 +27,10 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit && tsc -p site/tsconfig.json",
-    "test": "tsx --test \"src/**/*.test.ts\" \"site/**/*.test.ts\"",
+    "typecheck": "tsc --noEmit && tsc -p site/tsconfig.json && tsc -p services/tsconfig.json",
+    "test": "tsx --test \"src/**/*.test.ts\" \"site/**/*.test.ts\" \"services/**/*.test.ts\"",
+    "sync:site-script": "node site/generate-install-script.mjs",
+    "check:portable": "node scripts/check-portable-apis.mjs services/name services/shared",
     "prepublishOnly": "npm run typecheck && npm test && npm run build"
   },
   "devDependencies": {