eagle-mem 4.8.6 → 4.9.0

package/README.md

@@ -67,7 +67,7 @@ eagle-mem install
 
 That's it. Open Claude Code or Codex in any project directory. Eagle Mem activates automatically.
 
-Everything is automatic from here. Eagle Mem scans your codebase, indexes source files, captures session summaries, mirrors Claude's memories and tasks, learns which commands are noisy, and prunes stale data — all in the background via hooks.
+Everything is automatic from here. Eagle Mem scans your codebase, indexes source files, captures session summaries, mirrors Claude's memories and tasks, learns which commands are noisy, prunes stale data, and installs patch bug fixes — all in the background via hooks.
 
 For Codex, the installer enables `codex_hooks` in `~/.codex/config.toml`, registers hooks in `~/.codex/hooks.json`, symlinks Eagle Mem skills into `~/.codex/skills`, and patches `~/.codex/AGENTS.md` with the Eagle Mem summary contract. For Claude Code, it keeps using `~/.claude/settings.json`, `CLAUDE.md`, `~/.claude/skills`, and the existing Claude memory/task locations.
 
@@ -101,6 +101,7 @@ These run automatically via SessionStart — no commands needed:
 - **Auto-index** — new or stale project triggers FTS5 source indexing
 - **Auto-prune** — observations over 10K rows trigger cleanup
 - **Auto-curate** — the self-learning curator analyzes observation data and generates command rules, co-edit patterns, hot file detection, and guardrails (partially requires LLM provider)
+- **Auto-update** — patch releases install automatically by default, then hooks, skills, migrations, and runtime files refresh through `eagle-mem update`
 
 ### Token Savings
 
@@ -138,6 +139,7 @@ Eagle Mem prevents Claude from repeating past mistakes:
 | `eagle-mem search` | Search past sessions, memories, and code |
 | `eagle-mem health` | Diagnose pipeline health and background automation |
 | `eagle-mem config` | View or change LLM provider and token-guard settings |
+| `eagle-mem updates` | View or change auto-update policy |
 | `eagle-mem guard` | Manage regression guardrails for files |
 | `eagle-mem overview` | Build or view project overview |
 | `eagle-mem session` | Save a manual fallback session summary |
@@ -150,6 +152,10 @@ Eagle Mem prevents Claude from repeating past mistakes:
 | `eagle-mem scan` | Scan codebase and generate overview |
 | `eagle-mem index` | Index source files for FTS5 code search |
 
+### v4.9.0 Patch
+
+Eagle Mem now auto-updates by default for patch bug fixes. SessionStart performs a throttled background npm check, applies eligible patch releases with a lock and runtime/database backup, runs `eagle-mem update`, and records a one-time notice for the next session. Minor and major releases stay outside the default auto-apply range unless users opt in with `eagle-mem updates enable minor` or `eagle-mem updates enable major`.
+
 ### v4.8.6 Patch
 
 `eagle-mem session save --summary "..."` now exists as a clean manual fallback for agents that need to persist an explicit session note. It writes through the same `sessions` and `summaries` tables used by Stop hooks, keeps Claude Code/Codex source attribution, and is immediately searchable through normal recall.
@@ -186,6 +192,7 @@ eagle-mem search --files           # most frequently modified files
 eagle-mem search --stats           # project statistics
 eagle-mem search --session <id>    # full observation trail for one session
 eagle-mem session save --summary "fixed auth flow"  # manual fallback capture
+eagle-mem updates status           # auto-update state and policy
 ```
 
 ### Feature Verification

package/bin/eagle-mem

@@ -22,6 +22,7 @@ case "$command" in
     search)     bash "$SCRIPTS_DIR/search.sh" "$@" ;;
     health)     bash "$SCRIPTS_DIR/health.sh" "$@" ;;
     config)     bash "$SCRIPTS_DIR/config.sh" "$@" ;;
+    updates)    bash "$SCRIPTS_DIR/updates.sh" "$@" ;;
     guard)      bash "$SCRIPTS_DIR/guard.sh" "$@" ;;
     overview)   bash "$SCRIPTS_DIR/overview.sh" "$@" ;;
     session|sessions)

package/hooks/session-start.sh

@@ -14,6 +14,7 @@ SCRIPTS_DIR="$SCRIPT_DIR/../scripts"
 . "$LIB_DIR/common.sh"
 . "$LIB_DIR/db.sh"
 . "$LIB_DIR/provider.sh"
+. "$LIB_DIR/updater.sh"
 . "$LIB_DIR/hooks-sessionstart.sh"
 
 eagle_ensure_db
@@ -59,39 +60,16 @@ esac
 eagle_sessionstart_auto_provision "$project" "$cwd" "$SCRIPTS_DIR"
 eagle_sessionstart_auto_prune "$project" "$SCRIPTS_DIR" "$(eagle_db "SELECT COUNT(*) FROM observations WHERE session_id IN (SELECT id FROM sessions WHERE project='$p_esc');")"
 eagle_sessionstart_auto_curate "$project" "$SCRIPTS_DIR"
+nohup bash "$SCRIPTS_DIR/updates.sh" auto >> "$EAGLE_MEM_LOG" 2>&1 &
 
 find "$EAGLE_MEM_DIR/read-tracker" -type f -mtime +1 -delete 2>/dev/null &
 find "$EAGLE_MEM_DIR/mod-tracker" -type f -mtime +1 -delete 2>/dev/null &
 find "$EAGLE_MEM_DIR/edit-tracker" -type f -mtime +1 -delete 2>/dev/null &
 find "$EAGLE_MEM_DIR" -name ".turn-counter.*" -mtime +1 -delete 2>/dev/null &
 
-# ─── Version check (non-blocking) ────────────────────────
+# ─── Update notice from previous background run ────────────
 
-update_notice=""
-version_file="$EAGLE_MEM_DIR/.version"
-latest_file="$EAGLE_MEM_DIR/.latest-version"
-
-if [ -f "$version_file" ] && [ -s "$version_file" ]; then
-    installed_version=$(tr -d '[:space:]' < "$version_file")
-
-    if [ -f "$latest_file" ] && [ -s "$latest_file" ]; then
-        latest_version=$(tr -d '[:space:]' < "$latest_file")
-        newest=$(printf '%s\n' "$installed_version" "$latest_version" | sort -V | tail -1)
-        if [ "$newest" != "$installed_version" ]; then
-            update_notice="Update available: v${installed_version} → v${latest_version} — run: npm update -g eagle-mem && eagle-mem update"
-        fi
-    fi
-
-    if [ ! -f "$latest_file" ] || [ -n "$(find "$latest_file" -mtime +0 2>/dev/null)" ]; then
-        (tmp_latest=$(mktemp)
-         npm view eagle-mem version 2>/dev/null | tr -d '[:space:]' > "$tmp_latest"
-         if [ -s "$tmp_latest" ]; then
-             mv "$tmp_latest" "$latest_file"
-         else
-             rm -f "$tmp_latest"
-         fi) &
-    fi
-fi
+update_notice=$(eagle_update_take_notice)
 
 # ─── Gather stats ────────────────────────────────────────
 

package/lib/provider.sh

@@ -189,6 +189,16 @@ model = "gpt-4o-mini"
 schedule = "auto"
 min_sessions = 5
 
+[updates]
+# Eagle Mem is infrastructure: patch fixes auto-apply by default so stale bugs
+# do not keep blocking Claude Code or Codex sessions.
+# mode: "auto" applies eligible updates, "notify" only reports them, "off" disables checks.
+mode = "auto"
+# allow: "patch" auto-applies x.y.Z fixes only; "minor" allows x.Y.z; "major" allows all.
+allow = "patch"
+channel = "latest"
+interval_hours = 24
+
 [token_guard]
 # rtk: "off" disables RTK help, "auto" uses RTK when found,
 # "enforce" blocks known raw-output shell commands when RTK is unavailable.
@@ -565,6 +575,13 @@ eagle_show_config() {
     echo "  Codex:      $(eagle_config_get "orchestration" "codex_worker_model" "gpt-5.5") / $(eagle_config_get "orchestration" "codex_worker_effort" "xhigh")"
     echo "  Claude:     $(eagle_config_get "orchestration" "claude_worker_model" "claude-opus-4-7") / $(eagle_config_get "orchestration" "claude_worker_effort" "xhigh")"
 
+    echo ""
+    echo "Updates:"
+    echo "  Mode:       $(eagle_config_get "updates" "mode" "auto")"
+    echo "  Allow:      $(eagle_config_get "updates" "allow" "patch")"
+    echo "  Channel:    $(eagle_config_get "updates" "channel" "latest")"
+    echo "  Interval:   $(eagle_config_get "updates" "interval_hours" "24")h"
+
     echo ""
     echo "Token guard:"
     echo "  RTK mode:  $(eagle_config_get "token_guard" "rtk" "auto")"

package/lib/updater.sh

@@ -0,0 +1,320 @@
+#!/usr/bin/env bash
+# ═══════════════════════════════════════════════════════════
+# Eagle Mem — Auto-update helpers
+# ═══════════════════════════════════════════════════════════
+[ -n "${_EAGLE_UPDATER_LOADED:-}" ] && return 0
+_EAGLE_UPDATER_LOADED=1
+
+EAGLE_UPDATE_LATEST_FILE="$EAGLE_MEM_DIR/.latest-version"
+EAGLE_UPDATE_NOTICE_FILE="$EAGLE_MEM_DIR/.update-notice"
+EAGLE_UPDATE_STATE_FILE="$EAGLE_MEM_DIR/.last-update.json"
+EAGLE_UPDATE_LOCK_DIR="$EAGLE_MEM_DIR/.update.lock"
+
+eagle_update_config_mode() {
+    eagle_config_get "updates" "mode" "auto"
+}
+
+eagle_update_config_allow() {
+    eagle_config_get "updates" "allow" "patch"
+}
+
+eagle_update_config_channel() {
+    eagle_config_get "updates" "channel" "latest"
+}
+
+eagle_update_config_interval_hours() {
+    local hours
+    hours=$(eagle_config_get "updates" "interval_hours" "24")
+    case "$hours" in
+        ''|*[!0-9]*) echo "24" ;;
+        *) [ "$hours" -lt 1 ] 2>/dev/null && echo "1" || echo "$hours" ;;
+    esac
+}
+
+eagle_update_ensure_defaults() {
+    if [ ! -f "$EAGLE_CONFIG_FILE" ]; then
+        eagle_config_init
+        return
+    fi
+
+    if ! grep -q '^\[updates\]' "$EAGLE_CONFIG_FILE" 2>/dev/null; then
+        cat >> "$EAGLE_CONFIG_FILE" << 'TOML'
+
+[updates]
+# Patch fixes auto-apply by default so stale bugs do not block sessions.
+mode = "auto"
+allow = "patch"
+channel = "latest"
+interval_hours = 24
+TOML
+    fi
+}
+
+eagle_update_installed_version() {
+    local version_file="$EAGLE_MEM_DIR/.version"
+    if [ -f "$version_file" ] && [ -s "$version_file" ]; then
+        tr -d '[:space:]' < "$version_file"
+        return
+    fi
+
+    if command -v eagle-mem >/dev/null 2>&1; then
+        eagle-mem version 2>/dev/null | sed -nE 's/.*v([0-9][0-9A-Za-z.+-]*).*/\1/p' | head -1
+        return
+    fi
+
+    echo "0.0.0"
+}
+
+_eagle_update_file_age_seconds() {
+    local path="$1"
+    [ -f "$path" ] || { echo 999999999; return; }
+    local now mtime
+    now=$(date +%s)
+    mtime=$(stat -f %m "$path" 2>/dev/null || stat -c %Y "$path" 2>/dev/null || echo 0)
+    echo $((now - mtime))
+}
+
+eagle_update_latest_version() {
+    local force="${1:-0}"
+    local channel
+    channel=$(eagle_update_config_channel)
+    case "$channel" in latest|next) ;; *) channel="latest" ;; esac
+
+    local interval_seconds age
+    interval_seconds=$(( $(eagle_update_config_interval_hours) * 3600 ))
+    age=$(_eagle_update_file_age_seconds "$EAGLE_UPDATE_LATEST_FILE")
+
+    if [ "$force" != "1" ] && [ -f "$EAGLE_UPDATE_LATEST_FILE" ] && [ -s "$EAGLE_UPDATE_LATEST_FILE" ] && [ "$age" -lt "$interval_seconds" ]; then
+        tr -d '[:space:]' < "$EAGLE_UPDATE_LATEST_FILE"
+        return 0
+    fi
+
+    command -v npm >/dev/null 2>&1 || return 1
+
+    local latest tmp
+    latest=$(npm view "eagle-mem@${channel}" version 2>/dev/null | tr -d '[:space:]')
+    [ -n "$latest" ] || return 1
+
+    mkdir -p "$EAGLE_MEM_DIR" 2>/dev/null
+    tmp=$(mktemp "${EAGLE_MEM_DIR}/.latest-version.XXXXXX" 2>/dev/null || mktemp)
+    printf '%s\n' "$latest" > "$tmp"
+    mv "$tmp" "$EAGLE_UPDATE_LATEST_FILE"
+    printf '%s\n' "$latest"
+}
+
+_eagle_update_clean_version() {
+    printf '%s' "${1:-0.0.0}" | sed -E 's/^v//; s/[^0-9.].*$//'
+}
+
+_eagle_update_part() {
+    local version part
+    version=$(_eagle_update_clean_version "$1")
+    part="$2"
+    printf '%s' "$version" | awk -F. -v p="$part" '{ v=$p; if (v == "") v=0; gsub(/[^0-9]/, "", v); print v + 0 }'
+}
+
+eagle_update_version_gt() {
+    local a="$1" b="$2" i av bv
+    for i in 1 2 3; do
+        av=$(_eagle_update_part "$a" "$i")
+        bv=$(_eagle_update_part "$b" "$i")
+        [ "$av" -gt "$bv" ] && return 0
+        [ "$av" -lt "$bv" ] && return 1
+    done
+    return 1
+}
+
+eagle_update_allowed() {
+    local installed="$1" latest="$2" allow="$3"
+    eagle_update_version_gt "$latest" "$installed" || return 1
+
+    local imaj imin lmaj lmin
+    imaj=$(_eagle_update_part "$installed" 1)
+    imin=$(_eagle_update_part "$installed" 2)
+    lmaj=$(_eagle_update_part "$latest" 1)
+    lmin=$(_eagle_update_part "$latest" 2)
+
+    case "$allow" in
+        major) return 0 ;;
+        minor) [ "$imaj" -eq "$lmaj" ] ;;
+        patch|*) [ "$imaj" -eq "$lmaj" ] && [ "$imin" -eq "$lmin" ] ;;
+    esac
+}
+
+eagle_update_write_state() {
+    local status="$1" installed="$2" latest="$3" message="$4"
+    mkdir -p "$EAGLE_MEM_DIR" 2>/dev/null
+    jq -nc \
+        --arg status "$status" \
+        --arg installed "$installed" \
+        --arg latest "$latest" \
+        --arg message "$message" \
+        --arg at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        '{status:$status, installed:$installed, latest:$latest, message:$message, updated_at:$at}' \
+        > "$EAGLE_UPDATE_STATE_FILE" 2>/dev/null || true
+}
+
+eagle_update_set_notice() {
+    local message="$1"
+    mkdir -p "$EAGLE_MEM_DIR" 2>/dev/null
+    printf '%s\n' "$message" > "$EAGLE_UPDATE_NOTICE_FILE" 2>/dev/null || true
+}
+
+eagle_update_take_notice() {
+    [ -f "$EAGLE_UPDATE_NOTICE_FILE" ] || return 0
+    cat "$EAGLE_UPDATE_NOTICE_FILE" 2>/dev/null
+    rm -f "$EAGLE_UPDATE_NOTICE_FILE" 2>/dev/null || true
+}
+
+eagle_update_lock() {
+    mkdir -p "$EAGLE_MEM_DIR" 2>/dev/null
+    mkdir "$EAGLE_UPDATE_LOCK_DIR" 2>/dev/null
+}
+
+eagle_update_unlock() {
+    rmdir "$EAGLE_UPDATE_LOCK_DIR" 2>/dev/null || true
+}
+
+eagle_update_backup_runtime() {
+    local backup_dir="$1"
+    mkdir -p "$backup_dir"
+
+    for item in hooks lib db scripts; do
+        if [ -d "$EAGLE_MEM_DIR/$item" ]; then
+            cp -R "$EAGLE_MEM_DIR/$item" "$backup_dir/$item" 2>/dev/null || true
+        fi
+    done
+
+    if [ -f "$EAGLE_MEM_DB" ]; then
+        if command -v sqlite3 >/dev/null 2>&1; then
+            sqlite3 "$EAGLE_MEM_DB" ".backup '$backup_dir/memory.db'" >/dev/null 2>&1 || cp "$EAGLE_MEM_DB" "$backup_dir/memory.db" 2>/dev/null || true
+        else
+            cp "$EAGLE_MEM_DB" "$backup_dir/memory.db" 2>/dev/null || true
+        fi
+    fi
+}
+
+eagle_update_restore_runtime() {
+    local backup_dir="$1"
+
+    for item in hooks lib db scripts; do
+        if [ -d "$backup_dir/$item" ]; then
+            cp -R "$backup_dir/$item" "$EAGLE_MEM_DIR/" 2>/dev/null || true
+        fi
+    done
+
+    if [ -f "$backup_dir/memory.db" ]; then
+        cp "$backup_dir/memory.db" "$EAGLE_MEM_DB" 2>/dev/null || true
+    fi
+}
+
+eagle_update_apply_version() {
+    local latest="${1:-}"
+    local dry_run="${2:-0}"
+    local force="${3:-0}"
+
+    command -v npm >/dev/null 2>&1 || {
+        eagle_update_write_state "failed" "$(eagle_update_installed_version)" "${latest:-unknown}" "npm not found"
+        return 1
+    }
+    command -v eagle-mem >/dev/null 2>&1 || {
+        eagle_update_write_state "failed" "$(eagle_update_installed_version)" "${latest:-unknown}" "eagle-mem binary not found on PATH"
+        return 1
+    }
+
+    local installed allow
+    installed=$(eagle_update_installed_version)
+    [ -n "$latest" ] || latest=$(eagle_update_latest_version 1)
+    [ -n "$latest" ] || return 1
+    allow=$(eagle_update_config_allow)
+
+    if ! eagle_update_version_gt "$latest" "$installed"; then
+        eagle_update_write_state "current" "$installed" "$latest" "already current"
+        printf 'current|%s|%s\n' "$installed" "$latest"
+        return 0
+    fi
+
+    if [ "$force" != "1" ] && ! eagle_update_allowed "$installed" "$latest" "$allow"; then
+        eagle_update_write_state "skipped" "$installed" "$latest" "outside allowed ${allow} update range"
+        return 2
+    fi
+
+    if [ "$dry_run" = "1" ]; then
+        eagle_update_write_state "dry-run" "$installed" "$latest" "eligible for auto-update"
+        printf 'eligible|%s|%s\n' "$installed" "$latest"
+        return 0
+    fi
+
+    if ! eagle_update_lock; then
+        eagle_log "INFO" "Auto-update skipped: lock already held"
+        eagle_update_write_state "locked" "$installed" "$latest" "update already running"
+        printf 'locked|%s|%s\n' "$installed" "$latest"
+        return 3
+    fi
+
+    local stamp backup_dir update_output update_rc
+    stamp=$(date -u +%Y%m%dT%H%M%SZ)
+    backup_dir="$EAGLE_MEM_DIR/backups/update-${stamp}-${installed}"
+    eagle_update_backup_runtime "$backup_dir"
+
+    eagle_log "INFO" "Auto-update: installing eagle-mem@$latest from $installed"
+    update_output=$(npm install -g "eagle-mem@$latest" 2>&1)
+    update_rc=$?
+    if [ "$update_rc" -ne 0 ]; then
+        eagle_log "ERROR" "Auto-update npm install failed: $update_output"
+        eagle_update_write_state "failed" "$installed" "$latest" "npm install failed"
+        eagle_update_set_notice "Eagle Mem auto-update failed while installing v${latest}; keeping v${installed}. Run: eagle-mem updates apply"
+        eagle_update_unlock
+        return 1
+    fi
+
+    update_output=$(EAGLE_MEM_AUTO_UPDATE_ACTIVE=1 eagle-mem update 2>&1)
+    update_rc=$?
+    if [ "$update_rc" -ne 0 ]; then
+        eagle_log "ERROR" "Auto-update runtime update failed: $update_output"
+        npm install -g "eagle-mem@$installed" >/dev/null 2>&1 || true
+        eagle_update_restore_runtime "$backup_dir"
+        printf '%s\n' "$installed" > "$EAGLE_MEM_DIR/.version" 2>/dev/null || true
+        eagle_update_write_state "rolled-back" "$installed" "$latest" "runtime update failed; restored backup"
+        eagle_update_set_notice "Eagle Mem auto-update to v${latest} failed and was rolled back to v${installed}. Run: eagle-mem updates status"
+        eagle_update_unlock
+        return 1
+    fi
+
+    printf '%s\n' "$latest" > "$EAGLE_MEM_DIR/.version" 2>/dev/null || true
+    eagle_update_write_state "updated" "$installed" "$latest" "auto-update applied"
+    eagle_update_set_notice "Eagle Mem auto-updated from v${installed} to v${latest}. Hooks and skills were refreshed automatically."
+    eagle_log "INFO" "Auto-update complete: $installed -> $latest"
+    eagle_update_unlock
+    printf 'updated|%s|%s\n' "$installed" "$latest"
+}
+
+eagle_update_auto() {
+    [ "${EAGLE_MEM_DISABLE_AUTO_UPDATE:-}" = "1" ] && return 0
+    [ "${EAGLE_MEM_AUTO_UPDATE_ACTIVE:-}" = "1" ] && return 0
+
+    eagle_update_ensure_defaults
+
+    local mode installed latest allow
+    mode=$(eagle_update_config_mode)
+    [ "$mode" = "off" ] && return 0
+
+    installed=$(eagle_update_installed_version)
+    latest=$(eagle_update_latest_version 0) || return 0
+    [ -n "$latest" ] || return 0
+    eagle_update_version_gt "$latest" "$installed" || return 0
+
+    allow=$(eagle_update_config_allow)
+    if ! eagle_update_allowed "$installed" "$latest" "$allow"; then
+        eagle_update_write_state "available" "$installed" "$latest" "outside allowed ${allow} update range"
+        eagle_update_set_notice "Eagle Mem v${latest} is available, but auto-update is limited to ${allow} releases. Run: eagle-mem updates apply --force"
+        return 0
+    fi
+
+    if [ "$mode" = "auto" ]; then
+        eagle_update_apply_version "$latest" 0 0 >/dev/null 2>&1 || true
+    else
+        eagle_update_write_state "available" "$installed" "$latest" "notify mode"
+        eagle_update_set_notice "Eagle Mem v${latest} is available. Run: eagle-mem updates apply"
+    fi
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eagle-mem",
-  "version": "4.8.6",
+  "version": "4.9.0",
   "description": "Shared memory, release guardrails, RTK token protection, and worker lanes for Claude Code and Codex",
   "bin": {
     "eagle-mem": "bin/eagle-mem"

package/scripts/config.sh

@@ -32,6 +32,8 @@ show_help() {
     echo -e "    eagle-mem config set orchestration.route opposite"
     echo -e "    eagle-mem config set orchestration.codex_worker_model gpt-5.5"
     echo -e "    eagle-mem config set orchestration.claude_worker_model claude-opus-4-7"
+    echo -e "    eagle-mem config set updates.mode auto"
+    echo -e "    eagle-mem config set updates.allow patch"
     echo -e "    eagle-mem config set token_guard.rtk enforce"
     echo -e "    eagle-mem config set token_guard.raw_bash block"
     echo ""

package/scripts/health.sh

@@ -12,6 +12,7 @@ LIB_DIR="$SCRIPT_DIR/../lib"
 . "$SCRIPT_DIR/style.sh"
 . "$LIB_DIR/db.sh"
 . "$LIB_DIR/provider.sh"
+. "$LIB_DIR/updater.sh"
 
 project=""
 JSON_OUT=0
@@ -191,6 +192,32 @@ if [ -n "$orch_worktree_root" ]; then
     eagle_dim "  Worktree root: $orch_worktree_root"
 fi
 
+# ─── Auto-update visibility (informational) ────────────────
+
+updates_mode=$(eagle_update_config_mode)
+updates_allow=$(eagle_update_config_allow)
+updates_channel=$(eagle_update_config_channel)
+updates_interval=$(eagle_update_config_interval_hours)
+updates_latest=$(eagle_update_latest_version 0 2>/dev/null || true)
+updates_installed=$(eagle_update_installed_version)
+updates_status="current"
+
+if [ "$updates_mode" = "off" ]; then
+    eagle_warn "Updates: disabled"
+    issues+=("Auto-updates disabled. Re-enable bug-fix delivery: eagle-mem updates enable patch")
+    updates_status="disabled"
+elif [ -n "$updates_latest" ] && eagle_update_version_gt "$updates_latest" "$updates_installed"; then
+    if eagle_update_allowed "$updates_installed" "$updates_latest" "$updates_allow"; then
+        eagle_warn "Updates: v${updates_latest} available (mode=$updates_mode, allow=$updates_allow)"
+        updates_status="available"
+    else
+        eagle_warn "Updates: v${updates_latest} available, outside $updates_allow range"
+        updates_status="outside-range"
+    fi
+else
+    eagle_ok "Updates: auto/${updates_allow} (${updates_channel}, every ${updates_interval}h)"
+fi
+
 # ─── 5. Data quality (10 pts) ──────────────────────────
 
 max_score=$((max_score + 10))
@@ -290,6 +317,13 @@ if [ "$JSON_OUT" -eq 1 ]; then
         --arg claude_worker_effort "$orch_claude_effort" \
         --arg codex_bin "${codex_bin:-}" \
         --arg claude_bin "${claude_bin:-}" \
+        --arg updates_mode "$updates_mode" \
+        --arg updates_allow "$updates_allow" \
+        --arg updates_channel "$updates_channel" \
+        --arg updates_interval "$updates_interval" \
+        --arg updates_installed "$updates_installed" \
+        --arg updates_latest "${updates_latest:-}" \
+        --arg updates_status "$updates_status" \
         --argjson noise_pct "$noise_pct" \
         --arg last_curated "${last_curated:-never}" \
         '{project:$project, score:$score, max:$max_score, pct:$pct, grade:$grade,
@@ -304,5 +338,14 @@ if [ "$JSON_OUT" -eq 1 ]; then
             codex:{model:$codex_worker_model, effort:$codex_worker_effort, cli:$codex_bin},
             claude_code:{model:$claude_worker_model, effort:$claude_worker_effort, cli:$claude_bin}
           },
+          updates:{
+            mode:$updates_mode,
+            allow:$updates_allow,
+            channel:$updates_channel,
+            interval_hours:$updates_interval,
+            installed:$updates_installed,
+            latest:$updates_latest,
+            status:$updates_status
+          },
           noise_pct:$noise_pct, last_curated:$last_curated}' >&3
 fi

package/scripts/help.sh

@@ -22,6 +22,7 @@ echo -e "    ${CYAN}update${RESET}      Re-deploy hooks and run migrations"
 echo -e "    ${CYAN}uninstall${RESET}   Remove hooks and optionally delete data"
 echo -e "    ${CYAN}search${RESET}      Search past sessions, memories, and code"
 echo -e "    ${CYAN}health${RESET}      Diagnose pipeline health and background automation"
+echo -e "    ${CYAN}updates${RESET}     Auto-update status and policy"
 echo -e "    ${CYAN}overview${RESET}    Build or view project overview"
 echo -e "    ${CYAN}session${RESET}     Save a manual session summary"
 echo -e "    ${CYAN}memories${RESET}    View/sync agent memories"
@@ -42,6 +43,7 @@ echo -e "    ${DIM}Recall${RESET}       Project overview, summaries, memories, p
 echo -e "    ${DIM}Guardrails${RESET}   Decisions, gotchas, feature verification, stale memory warnings"
 echo -e "    ${DIM}Tokens${RESET}       Compact hook recall and optional RTK shell-output routing"
 echo -e "    ${DIM}Lanes${RESET}        Cross-agent worker status, worktrees, logs, validation, handoffs"
+echo -e "    ${DIM}Updates${RESET}      Patch fixes install automatically by default"
 echo ""
 echo -e "  ${BOLD}Search modes:${RESET}"
 echo -e "    ${DIM}\$${RESET} eagle-mem search \"auth bug\"    ${DIM}# keyword search${RESET}"

package/scripts/install.sh

@@ -316,12 +316,15 @@ fi
 # ─── Initialize config ────────────────────────────────────
 
 . "$LIB_DIR/provider.sh"
+. "$LIB_DIR/updater.sh"
 if [ ! -f "$EAGLE_CONFIG_FILE" ]; then
     eagle_config_init
     eagle_ok "Config created ${DIM}(auto-detected provider)${RESET}"
 else
+    eagle_update_ensure_defaults
     eagle_ok "Config ${DIM}(already exists)${RESET}"
 fi
+eagle_ok "Auto-updates ${DIM}(mode=$(eagle_update_config_mode), allow=$(eagle_update_config_allow))${RESET}"
 
 # ─── Patch CLAUDE.md with Eagle Mem instructions ─────────
 

package/scripts/update.sh

@@ -12,6 +12,8 @@ LIB_DIR="$SCRIPTS_DIR/../lib"
 . "$SCRIPTS_DIR/style.sh"
 . "$LIB_DIR/common.sh"
 . "$LIB_DIR/db.sh"
+. "$LIB_DIR/provider.sh"
+. "$LIB_DIR/updater.sh"
 . "$LIB_DIR/hooks.sh"
 . "$LIB_DIR/codex-hooks.sh"
 
@@ -150,6 +152,11 @@ else
     eagle_ok "Project names up to date"
 fi
 
+# ─── Ensure auto-update defaults exist ─────────────────────
+
+eagle_update_ensure_defaults
+eagle_ok "Auto-updates ${DIM}(mode=$(eagle_update_config_mode), allow=$(eagle_update_config_allow))${RESET}"
+
 # ─── Patch CLAUDE.md with Eagle Mem instructions ─────────
 
 if [ "$claude_found" = true ]; then

package/scripts/updates.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# ═══════════════════════════════════════════════════════════
+# Eagle Mem — Update policy and auto-update CLI
+# ═══════════════════════════════════════════════════════════
+set -euo pipefail
+
+SCRIPTS_DIR="$(cd "$(dirname "$0")" && pwd)"
+LIB_DIR="$SCRIPTS_DIR/../lib"
+
+. "$SCRIPTS_DIR/style.sh"
+. "$LIB_DIR/common.sh"
+. "$LIB_DIR/provider.sh"
+. "$LIB_DIR/updater.sh"
+
+show_help() {
+    echo -e "  ${BOLD}eagle-mem updates${RESET} — Manage automatic Eagle Mem updates"
+    echo ""
+    echo -e "  ${BOLD}Usage:${RESET}"
+    echo -e "    eagle-mem updates ${CYAN}status${RESET}"
+    echo -e "    eagle-mem updates ${CYAN}check${RESET}"
+    echo -e "    eagle-mem updates ${CYAN}apply${RESET} [--force] [--dry-run]"
+    echo -e "    eagle-mem updates ${CYAN}enable${RESET} [auto|notify|patch|minor|major]"
+    echo -e "    eagle-mem updates ${CYAN}disable${RESET}"
+    echo ""
+    echo -e "  ${DIM}Default: mode=auto, allow=patch. Patch bug fixes install in the${RESET}"
+    echo -e "  ${DIM}background from SessionStart so stale bugs do not block agents.${RESET}"
+    echo ""
+}
+
+updates_status() {
+    eagle_update_ensure_defaults
+
+    local installed latest latest_rc
+    installed=$(eagle_update_installed_version)
+    latest=$(eagle_update_latest_version 0 2>/dev/null) && latest_rc=0 || latest_rc=$?
+
+    eagle_header "Updates"
+    eagle_kv "Installed:" "v${installed:-unknown}"
+    if [ "$latest_rc" -eq 0 ] && [ -n "$latest" ]; then
+        eagle_kv "Latest:" "v$latest"
+    else
+        eagle_kv "Latest:" "unavailable"
+    fi
+    eagle_kv "Mode:" "$(eagle_update_config_mode)"
+    eagle_kv "Allow:" "$(eagle_update_config_allow)"
+    eagle_kv "Channel:" "$(eagle_update_config_channel)"
+    eagle_kv "Interval:" "$(eagle_update_config_interval_hours)h"
+
+    if [ -f "$EAGLE_UPDATE_STATE_FILE" ]; then
+        status=$(jq -r '.status // "unknown"' "$EAGLE_UPDATE_STATE_FILE" 2>/dev/null || echo "unknown")
+        at=$(jq -r '.updated_at // ""' "$EAGLE_UPDATE_STATE_FILE" 2>/dev/null || echo "")
+        msg=$(jq -r '.message // ""' "$EAGLE_UPDATE_STATE_FILE" 2>/dev/null || echo "")
+        eagle_kv "Last run:" "$status ${at:+($at)}"
+        [ -n "$msg" ] && eagle_kv "Message:" "$msg"
+    fi
+
+    if [ -n "$latest" ] && eagle_update_version_gt "$latest" "$installed"; then
+        if eagle_update_allowed "$installed" "$latest" "$(eagle_update_config_allow)"; then
+            eagle_ok "Eligible update available"
+        else
+            eagle_warn "Update available but outside allowed range"
+        fi
+    else
+        eagle_ok "Already current"
+    fi
+}
+
+updates_check() {
+    eagle_update_ensure_defaults
+    installed=$(eagle_update_installed_version)
+    latest=$(eagle_update_latest_version 1)
+    if [ -z "$latest" ]; then
+        eagle_err "Could not check npm for updates"
+        exit 1
+    fi
+
+    if eagle_update_version_gt "$latest" "$installed"; then
+        if eagle_update_allowed "$installed" "$latest" "$(eagle_update_config_allow)"; then
+            eagle_ok "Update available: v$installed -> v$latest"
+        else
+            eagle_warn "Update available: v$installed -> v$latest (outside allowed range)"
+        fi
+    else
+        eagle_ok "Already current: v$installed"
+    fi
+}
+
+updates_apply() {
+    eagle_update_ensure_defaults
+    local dry_run=0 force=0 latest=""
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --dry-run) dry_run=1; shift ;;
+            --force) force=1; shift ;;
+            --latest) latest="${2:-}"; shift 2 ;;
+            --help|-h) show_help; exit 0 ;;
+            *)
+                eagle_err "Unknown apply option: $1"
+                exit 1
+                ;;
+        esac
+    done
+
+    if output=$(eagle_update_apply_version "$latest" "$dry_run" "$force" 2>&1); then
+        state=$(printf '%s' "$output" | awk -F'|' 'NR == 1 {print $1}')
+        installed=$(printf '%s' "$output" | awk -F'|' 'NR == 1 {print $2}')
+        latest=$(printf '%s' "$output" | awk -F'|' 'NR == 1 {print $3}')
+        if [ "$state" = "current" ]; then
+            eagle_ok "Already current: v$installed"
+        elif [ "$dry_run" = "1" ]; then
+            eagle_ok "Would update v$installed -> v$latest"
+        else
+            eagle_ok "Eagle Mem updated from v$installed to v$latest"
+        fi
+    else
+        rc=$?
+        if [ "$rc" -eq 2 ]; then
+            eagle_warn "Update skipped: outside allowed range"
+            eagle_info "Use --force for a manual override"
+            exit 0
+        fi
+        if [ "$rc" -eq 3 ]; then
+            eagle_warn "Update already running"
+            exit 0
+        fi
+        eagle_err "Update failed"
+        [ -n "$output" ] && eagle_dim "$output"
+        exit 1
+    fi
+}
+
+updates_enable() {
+    eagle_update_ensure_defaults
+    local value="${1:-auto}"
+    case "$value" in
+        auto|notify|off)
+            eagle_config_set "updates" "mode" "$value"
+            ;;
+        patch|minor|major)
+            eagle_config_set "updates" "mode" "auto"
+            eagle_config_set "updates" "allow" "$value"
+            ;;
+        *)
+            eagle_err "Use: eagle-mem updates enable [auto|notify|patch|minor|major]"
+            exit 1
+            ;;
+    esac
+    eagle_ok "Updates enabled: mode=$(eagle_update_config_mode), allow=$(eagle_update_config_allow)"
+}
+
+updates_disable() {
+    eagle_update_ensure_defaults
+    eagle_config_set "updates" "mode" "off"
+    eagle_ok "Automatic update checks disabled"
+}
+
+command="${1:-status}"
+shift 2>/dev/null || true
+
+case "$command" in
+    status) updates_status "$@" ;;
+    check) updates_check "$@" ;;
+    apply) updates_apply "$@" ;;
+    auto) eagle_update_auto ;;
+    enable) updates_enable "$@" ;;
+    disable) updates_disable ;;
+    help|--help|-h) show_help ;;
+    *)
+        eagle_err "Unknown updates command: $command"
+        echo ""
+        show_help
+        exit 1
+        ;;
+esac