friend-assistant 0.1.44 → 0.1.45

package/dist/friend.mjs

@@ -3347,6 +3347,7 @@ function sanitizeLook(raw) {
   };
 }
 var DEFAULT_OLLAMA = { url: "http://127.0.0.1:11434", model: "qwen2.5:7b", contextTokens: 8192, vision: false };
+var sanitizeUpdates = (u) => ({ auto: typeof u?.auto === "boolean" ? u.auto : true });
 var DEFAULT_VOICE = {
   enabled: true,
   sttModel: "small",
@@ -3412,6 +3413,7 @@ var defaults = (dataDir) => ({
   openai: { ...DEFAULT_OPENAI },
   claudeCode: { ...DEFAULT_CLAUDE_CODE },
   voice: { ...DEFAULT_VOICE },
+  updates: sanitizeUpdates(void 0),
   view: "companion",
   look: { ...DEFAULT_LOOK },
   ownerName: "",
@@ -3458,6 +3460,7 @@ function loadConfig(dataDir = defaultDataDir()) {
     openai: { ...DEFAULT_OPENAI, ...stored.openai },
     claudeCode: sanitizeClaudeCode(stored.claudeCode),
     voice: sanitizeVoice({ ...DEFAULT_VOICE, ...stored.voice }),
+    updates: sanitizeUpdates(stored.updates),
     view: stored.view === "minimal" || stored.view === "workspace" ? stored.view : "companion",
     look: sanitizeLook(stored.look),
     ownerName: typeof stored.ownerName === "string" ? stored.ownerName.replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 40) : "",
@@ -4884,9 +4887,9 @@ function chromeToken(home = homedir3()) {
     return null;
   }
 }
-function sameKey(given, real2) {
-  if (!given || !real2) return false;
-  return timingSafeEqual(createHash3("sha256").update(given).digest(), createHash3("sha256").update(real2).digest());
+function sameKey(given, real3) {
+  if (!given || !real3) return false;
+  return timingSafeEqual(createHash3("sha256").update(given).digest(), createHash3("sha256").update(real3).digest());
 }
 function keyFromRequest(headers, search) {
   const bearer = /^Bearer (.+)$/i.exec(headers.authorization ?? "")?.[1];
@@ -7122,16 +7125,16 @@ function parseCsv(text3) {
   const rows3 = [];
   let row = [];
   let cell = "";
-  let quoted = false;
+  let quoted2 = false;
   for (let i = 0; i < text3.length; i++) {
     const ch = text3[i];
-    if (quoted) {
+    if (quoted2) {
       if (ch === '"' && text3[i + 1] === '"') {
         cell += '"';
         i++;
-      } else if (ch === '"') quoted = false;
+      } else if (ch === '"') quoted2 = false;
       else cell += ch;
-    } else if (ch === '"') quoted = true;
+    } else if (ch === '"') quoted2 = true;
     else if (ch === ",") {
       row.push(cell);
       cell = "";
@@ -7184,59 +7187,59 @@ var MediaStore = class {
   /** A file the assistant wants to send to the owner's chat: checked here (it must exist, be a real file, not be Friend's own data, not a program). */
   async sendable(rawPath) {
     if (!isAbsolute(rawPath)) return { ok: false, error: "Give the full path of the file, for example D:\\Pictures\\photo.png." };
-    let real2;
+    let real3;
     try {
-      real2 = await fs.realpath(resolve4(rawPath));
+      real3 = await fs.realpath(resolve4(rawPath));
     } catch {
       return { ok: false, error: "That file does not exist." };
     }
-    if (insideOf(await fs.realpath(this.dataDir).catch(() => this.dataDir), real2)) return { ok: false, error: "Friend's own data folder cannot be sent." };
-    const stat2 = await fs.stat(real2).catch(() => null);
+    if (insideOf(await fs.realpath(this.dataDir).catch(() => this.dataDir), real3)) return { ok: false, error: "Friend's own data folder cannot be sent." };
+    const stat2 = await fs.stat(real3).catch(() => null);
     if (!stat2 || !stat2.isFile()) return { ok: false, error: "That path is not a file." };
-    const name = basename(real2);
-    const ext = extname(real2).slice(1).toLowerCase();
+    const name = basename(real3);
+    const ext = extname(real3).slice(1).toLowerCase();
     if (NOT_SENT.has(ext)) return { ok: false, error: `Friend cannot send .${ext} files.` };
     if (stat2.size === 0) return { ok: false, error: "That file is empty." };
     if (stat2.size > MAX_SEND) return { ok: false, error: `That file is too big to send (${Math.round(stat2.size / 1048576)} MB).` };
     const mime = IMAGE[ext] ?? VIDEO[ext] ?? DOC_MIME[ext] ?? "application/octet-stream";
     const kind = mime.startsWith("image/") ? "image" : mime.startsWith("audio/") ? "audio" : mime.startsWith("video/") ? "video" : "document";
-    return { ok: true, path: real2, name, mime, size: stat2.size, kind };
+    return { ok: true, path: real3, name, mime, size: stat2.size, kind };
   }
   async present(rawPath, title2) {
     if (!isAbsolute(rawPath)) return { ok: false, error: "Give the full path of the file, for example D:\\Pictures\\photo.png." };
-    let real2;
+    let real3;
     try {
-      real2 = await fs.realpath(resolve4(rawPath));
+      real3 = await fs.realpath(resolve4(rawPath));
     } catch {
       return { ok: false, error: "That file does not exist." };
     }
-    if (insideOf(await fs.realpath(this.dataDir).catch(() => this.dataDir), real2)) return { ok: false, error: "Friend's own data folder cannot be shown." };
-    const stat2 = await fs.stat(real2).catch(() => null);
+    if (insideOf(await fs.realpath(this.dataDir).catch(() => this.dataDir), real3)) return { ok: false, error: "Friend's own data folder cannot be shown." };
+    const stat2 = await fs.stat(real3).catch(() => null);
     if (!stat2 || !stat2.isFile()) return { ok: false, error: "That path is not a file." };
-    const name = basename(real2);
-    const ext = extname(real2).slice(1).toLowerCase();
+    const name = basename(real3);
+    const ext = extname(real3).slice(1).toLowerCase();
     const label3 = title2?.trim() || name;
     const tooBig = (limit, what) => stat2.size > limit ? { ok: false, error: `That ${what} is too large to show (${Math.round(stat2.size / 1048576)} MB).` } : null;
     if (IMAGE[ext]) {
       const big = tooBig(MAX_IMAGE, "image");
       if (big) return big;
-      const id2 = this.grant(real2, IMAGE[ext], stat2.size);
+      const id2 = this.grant(real3, IMAGE[ext], stat2.size);
       return { ok: true, type: "image", props: { title: label3, src: `/api/media/${id2}` }, summary: `Showing the image ${name}.` };
     }
     if (VIDEO[ext]) {
       const big = tooBig(MAX_VIDEO, "file");
       if (big) return big;
-      const id2 = this.grant(real2, VIDEO[ext], stat2.size);
+      const id2 = this.grant(real3, VIDEO[ext], stat2.size);
       return { ok: true, type: "video", props: { title: label3, src: `/api/media/${id2}` }, summary: `Showing ${name}.` };
     }
     if (ext === "pdf") {
       const big = tooBig(MAX_PDF, "PDF");
       if (big) return big;
-      const id2 = this.grant(real2, "application/pdf", stat2.size);
+      const id2 = this.grant(real3, "application/pdf", stat2.size);
       return { ok: true, type: "pdf", props: { title: label3, src: `/api/media/${id2}` }, summary: `Showing the PDF ${name}.` };
     }
     if (MARKDOWN.has(ext) || ext === "csv" || CODE_LANG[ext]) {
-      const handle = await fs.open(real2, "r");
+      const handle = await fs.open(real3, "r");
       let text3;
       try {
         const buf = Buffer.alloc(Math.min(stat2.size, MAX_TEXT));
@@ -9400,8 +9403,8 @@ var MusicLibrary = class {
     try {
       const info = await lstat(path3);
       if (!info.isFile() || info.isSymbolicLink()) return null;
-      const real2 = await realpath(path3);
-      return real2.startsWith(this.root + sep2) ? path3 : null;
+      const real3 = await realpath(path3);
+      return real3.startsWith(this.root + sep2) ? path3 : null;
     } catch {
       return null;
     }
@@ -10608,7 +10611,7 @@ var Memory = class {
 };
 
 // ../server/src/app.ts
-import { dirname as dirname5, extname as extname3, resolve as resolve5 } from "node:path";
+import { dirname as dirname6, extname as extname3, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { join as join18 } from "node:path";
 
@@ -11582,6 +11585,45 @@ function createGateway(deps) {
     if (!deps.video) return reply.code(404).send({ error: "Not found" });
     return deps.video.prepare();
   });
+  const systemWindow = new SlidingWindow(30, 6e4);
+  const systemGuard = async (req, reply) => {
+    const token = req.cookies[COOKIE_NAME];
+    const session = token ? auth.resolveSession(token) : null;
+    if (!session) return reply.code(401).send({ error: "Unauthorized" });
+    if (!systemWindow.allow(String(session.id))) return reply.code(429).header("retry-after", 10).send({ error: "Too many requests" });
+    if (!deps.system) return reply.code(503).send({ error: "Not available" });
+  };
+  const systemError = (reply, e, what) => {
+    if (e instanceof HttpError) return reply.code(e.status).send({ error: e.message });
+    audit.log("owner", "system.failed", { what, message: e.message });
+    return reply.code(500).send({ error: "That did not work. Try again." });
+  };
+  app.get("/api/system", { onRequest: systemGuard }, async () => deps.system.info());
+  app.post("/api/system/update/check", { onRequest: systemGuard }, async (_req, reply) => {
+    try {
+      return await deps.system.check();
+    } catch (e) {
+      return systemError(reply, e, "update.check");
+    }
+  });
+  app.post("/api/system/update/apply", { onRequest: systemGuard }, async (req, reply) => {
+    const body = z10.object({ pin: z10.string().min(1).max(32) }).safeParse(req.body);
+    if (!body.success) return reply.code(400).send({ error: "Enter your PIN" });
+    try {
+      return await deps.system.update(body.data.pin, req.ip);
+    } catch (e) {
+      return systemError(reply, e, "update.apply");
+    }
+  });
+  app.post("/api/system/autostart", { onRequest: systemGuard }, async (req, reply) => {
+    const body = z10.object({ enabled: z10.boolean(), pin: z10.string().min(1).max(32) }).safeParse(req.body);
+    if (!body.success) return reply.code(400).send({ error: "Enter your PIN" });
+    try {
+      return await deps.system.setAutostart(body.data.enabled, body.data.pin, req.ip);
+    } catch (e) {
+      return systemError(reply, e, "autostart");
+    }
+  });
   const chromeFailures = new SlidingWindow(20, 6e4);
   const chromeWss = new WebSocketServer({ noServer: true, maxPayload: MAX_DEVICE_FRAME_BYTES });
   if (deps.chrome) {
@@ -12999,7 +13041,8 @@ var SettingsPatch = z11.object({
     sttModel: z11.string().trim().min(1).max(80).regex(/^[\w./-]+$/),
     duck: z11.boolean(),
     duckPercent: z11.number().int().min(0).max(100)
-  }).partial().strict()
+  }).partial().strict(),
+  updates: z11.object({ auto: z11.boolean() }).partial().strict()
 }).partial().strict();
 function settingsView(c) {
   return {
@@ -13062,7 +13105,8 @@ function settingsView(c) {
       marathiVoice: c.voice.marathiVoice,
       duck: c.voice.duck,
       duckPercent: c.voice.duckPercent
-    }
+    },
+    updates: { auto: c.updates.auto }
   };
 }
 var SettingsError = class extends Error {
@@ -13074,6 +13118,7 @@ function refuseForAgent(raw) {
   if ("brokers" in r || "trading" in r) throw new SettingsError("Broker accounts and the trading level can only be changed by the owner on the settings screen.");
   if ("music" in r || "hud" in r) throw new SettingsError("The music folder and the screen widgets can only be changed by the owner on the settings screen.");
   if ("video" in r) throw new SettingsError("Video settings (which programs run, where videos play, which sites) can only be changed by the owner on the settings screen.");
+  if ("updates" in r) throw new SettingsError("Whether Friend updates itself can only be changed by the owner on the settings screen.");
   if ("alexa" in r) throw new SettingsError("Alexa settings can only be changed by the owner on the settings screen.");
   if ("channels" in r) throw new SettingsError("Messaging channels can only be set up by the owner on the settings screen.");
   if ("approvals" in r) throw new SettingsError("How much Friend asks before acting can only be changed by the owner on the settings screen.");
@@ -13218,6 +13263,7 @@ function applySettings(config, raw) {
     if (apiKey) config.openai.apiKey = apiKey;
   }
   if (p.claudeCode) Object.assign(config.claudeCode, p.claudeCode);
+  if (p.updates) Object.assign(config.updates, p.updates);
   if (p.voice) {
     const safe = next.voice;
     for (const k of Object.keys(p.voice)) config.voice[k] = safe[k];
@@ -13689,6 +13735,368 @@ var DuckController = class {
   }
 };
 
+// ../server/src/system/autostart.ts
+import { spawn as spawn6 } from "node:child_process";
+import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync10, rmSync as rmSync9, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname4, posix as posix2, win32 as win322 } from "node:path";
+var RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+var NAME2 = "Friend";
+var LABEL = "com.friend.assistant";
+var UNIT = "friend.service";
+var quoted = (s) => `"${s}"`;
+function vbsLauncher(self) {
+  const cmd = `${quoted(self.node)} ${quoted(self.script)} daemon start`;
+  const inVbs = cmd.replace(/"/g, '""');
+  return [`' Starts Friend in the background when you sign in. Made by: friend autostart on`, `CreateObject("WScript.Shell").Run "${inVbs}", 0, False`, ""].join("\r\n");
+}
+var xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function plistFor(self, o) {
+  const log = `${o.dataDir}/friend-autostart.log`;
+  return [
+    `<?xml version="1.0" encoding="UTF-8"?>`,
+    `<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">`,
+    `<plist version="1.0">`,
+    `<dict>`,
+    `  <key>Label</key><string>${LABEL}</string>`,
+    `  <key>ProgramArguments</key>`,
+    `  <array>`,
+    `    <string>${xml(self.node)}</string>`,
+    `    <string>${xml(self.script)}</string>`,
+    `    <string>daemon</string>`,
+    `    <string>start</string>`,
+    `  </array>`,
+    `  <key>RunAtLoad</key>`,
+    `  <true/>`,
+    `  <key>EnvironmentVariables</key>`,
+    `  <dict><key>PATH</key><string>${xml(o.path)}</string></dict>`,
+    `  <key>StandardOutPath</key><string>${xml(log)}</string>`,
+    `  <key>StandardErrorPath</key><string>${xml(log)}</string>`,
+    `</dict>`,
+    `</plist>`,
+    ""
+  ].join("\n");
+}
+var unitWord = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%")}"`;
+function systemdUnit(self, o) {
+  return [
+    "[Unit]",
+    "Description=Friend assistant",
+    "After=network-online.target",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    "RemainAfterExit=yes",
+    `Environment=${unitWord(`PATH=${o.path}`)}`,
+    `ExecStart=${unitWord(self.node)} ${unitWord(self.script)} daemon start`,
+    `ExecStop=${unitWord(self.node)} ${unitWord(self.script)} daemon stop`,
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+var desktopWord = (s) => `"${s.replace(/(["`$\\])/g, "\\$1")}"`;
+function desktopEntry(self) {
+  return ["[Desktop Entry]", "Type=Application", "Name=Friend", "Comment=Starts Friend in the background", `Exec=${desktopWord(self.node)} ${desktopWord(self.script)} daemon start`, "Terminal=false", "X-GNOME-Autostart-enabled=true", ""].join("\n");
+}
+var Autostart = class {
+  constructor(d, self) {
+    this.d = d;
+    this.self = self;
+  }
+  d;
+  self;
+  get win() {
+    return this.d.platform === "win32";
+  }
+  get mac() {
+    return this.d.platform === "darwin";
+  }
+  get linux() {
+    return this.d.platform === "linux";
+  }
+  p() {
+    return this.win ? win322 : posix2;
+  }
+  vbs() {
+    return win322.join(this.d.dataDir, "autostart.vbs");
+  }
+  plist() {
+    return posix2.join(this.d.home, "Library", "LaunchAgents", `${LABEL}.plist`);
+  }
+  configDir() {
+    return this.d.configHome || posix2.join(this.d.home, ".config");
+  }
+  unitFile() {
+    return posix2.join(this.configDir(), "systemd", "user", UNIT);
+  }
+  desktopFile() {
+    return posix2.join(this.configDir(), "autostart", "friend.desktop");
+  }
+  async hasSystemd() {
+    return (await this.d.run("systemctl", ["--user", "--version"])).code === 0;
+  }
+  async status() {
+    if (this.win) return { supported: true, enabled: (await this.d.run("reg", ["query", RUN_KEY, "/v", NAME2])).code === 0, kind: "registry" };
+    if (this.mac) return { supported: true, enabled: this.d.exists(this.plist()), kind: "launchd" };
+    if (this.linux) {
+      if (await this.hasSystemd()) {
+        const r = await this.d.run("systemctl", ["--user", "is-enabled", UNIT]);
+        if (r.code === 0 && /enabled/.test(r.stdout)) return { supported: true, enabled: true, kind: "systemd" };
+      }
+      return { supported: true, enabled: this.d.exists(this.desktopFile()), kind: this.d.exists(this.desktopFile()) ? "xdg" : "none" };
+    }
+    return { supported: false, enabled: false, kind: "none" };
+  }
+  async enable() {
+    const self = this.self();
+    if (!self.node || !self.script) return { ok: false, message: "Friend does not know which program to start. Run it with the friend command and try again." };
+    if (this.win) return this.enableWindows(self);
+    if (this.mac) return this.enableMac(self);
+    if (this.linux) return this.enableLinux(self);
+    return { ok: false, message: "Starting Friend by itself is not supported on this kind of computer." };
+  }
+  async disable() {
+    if (this.win) {
+      await this.d.run("reg", ["delete", RUN_KEY, "/v", NAME2, "/f"]);
+      this.d.remove(this.vbs());
+    } else if (this.mac) {
+      await this.d.run("launchctl", ["bootout", `gui/${this.d.uid}`, this.plist()]);
+      this.d.remove(this.plist());
+    } else if (this.linux) {
+      if (await this.hasSystemd()) {
+        await this.d.run("systemctl", ["--user", "disable", UNIT]);
+        this.d.remove(this.unitFile());
+        await this.d.run("systemctl", ["--user", "daemon-reload"]);
+      }
+      this.d.remove(this.desktopFile());
+    } else return { ok: false, message: "Starting Friend by itself is not supported on this kind of computer." };
+    return { ok: true, message: "Friend will no longer start by itself when you sign in." };
+  }
+  /** Writes the setup again with the program's current place, when it is on. Used after an upgrade. */
+  async refresh() {
+    if ((await this.status()).enabled) await this.enable();
+  }
+  async enableWindows(self) {
+    this.d.write(this.vbs(), vbsLauncher(self));
+    const r = await this.d.run("reg", ["add", RUN_KEY, "/v", NAME2, "/t", "REG_SZ", "/d", `wscript.exe ${quoted(this.vbs())}`, "/f"]);
+    if (r.code !== 0) return { ok: false, message: "Could not add Friend to the programs that start when you sign in." };
+    return { ok: true, message: "Friend will start by itself when you sign in to this computer." };
+  }
+  async enableMac(self) {
+    this.d.write(this.plist(), plistFor(self, { dataDir: this.d.dataDir, path: this.d.path }));
+    await this.d.run("launchctl", ["bootout", `gui/${this.d.uid}`, this.plist()]);
+    let r = await this.d.run("launchctl", ["bootstrap", `gui/${this.d.uid}`, this.plist()]);
+    if (r.code !== 0) r = await this.d.run("launchctl", ["load", "-w", this.plist()]);
+    if (r.code !== 0) return { ok: false, message: "Could not switch the launch agent on. It will still be used the next time you sign in." };
+    return { ok: true, message: "Friend will start by itself when you sign in to this computer." };
+  }
+  async enableLinux(self) {
+    if (await this.hasSystemd()) {
+      this.d.write(this.unitFile(), systemdUnit(self, { path: this.d.path }));
+      await this.d.run("systemctl", ["--user", "daemon-reload"]);
+      const r = await this.d.run("systemctl", ["--user", "enable", UNIT]);
+      if (r.code === 0) {
+        this.d.remove(this.desktopFile());
+        return { ok: true, message: "Friend will start by itself when you sign in to this computer." };
+      }
+    }
+    this.d.write(this.desktopFile(), desktopEntry(self));
+    return { ok: true, message: "Friend will start by itself when you sign in to this computer." };
+  }
+};
+function realAutostartDeps(dataDir) {
+  return {
+    platform: process.platform,
+    home: homedir4(),
+    dataDir,
+    uid: typeof process.getuid === "function" ? process.getuid() : 0,
+    path: process.env.PATH ?? "",
+    ...process.env.XDG_CONFIG_HOME ? { configHome: process.env.XDG_CONFIG_HOME } : {},
+    exists: (p) => existsSync16(p),
+    read: (p) => {
+      try {
+        return readFileSync10(p, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    write: (p, text3) => {
+      mkdirSync11(dirname4(p), { recursive: true });
+      writeFileSync10(p, text3);
+    },
+    remove: (p) => rmSync9(p, { force: true }),
+    run: (cmd, args) => new Promise((resolve13) => {
+      let out = "";
+      const child = spawn6(cmd, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+      child.stdout?.on("data", (d) => out += d.toString());
+      child.stderr?.on("data", (d) => out += d.toString());
+      child.on("error", () => resolve13({ code: 127, stdout: out }));
+      child.on("close", (code) => resolve13({ code: code ?? 1, stdout: out }));
+    })
+  };
+}
+function currentSelf() {
+  const script = process.argv[1] ?? "";
+  return { node: process.execPath, script: /\.(mjs|js|cjs)$/i.test(script) ? script : "" };
+}
+
+// ../server/src/system/npm.ts
+import { spawn as spawn7 } from "node:child_process";
+var PACKAGE = "friend-assistant";
+var runningVersion = () => true ? "0.1.45" : "development";
+async function npmLatest(fetchFn = fetch, timeoutMs = 1e4) {
+  try {
+    const res = await fetchFn(`https://registry.npmjs.org/${PACKAGE}/latest`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok) return null;
+    const v = (await res.json()).version;
+    return typeof v === "string" && /^\d+\.\d+\.\d+$/.test(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+var ps = (s) => `'${s.replace(/'/g, "''")}'`;
+function spawnUpgrade(self, platform = process.platform) {
+  if (!self.node || !self.script) return false;
+  try {
+    const child = platform === "win32" ? spawn7("powershell.exe", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", `Start-Process -WindowStyle Hidden -FilePath ${ps(self.node)} -ArgumentList ${ps(`"${self.script}"`)},'upgrade','--auto'`], { detached: true, stdio: "ignore", windowsHide: true }) : spawn7(self.node, [self.script, "upgrade", "--auto"], { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+    return child.pid !== void 0;
+  } catch {
+    return false;
+  }
+}
+
+// ../server/src/system/updater.ts
+function isNewerVersion(a, b) {
+  if (!/^\d/.test(a) || !/^\d/.test(b)) return false;
+  const n = (v) => v.split(/[.-]/).slice(0, 3).map((x2) => Number(x2) || 0);
+  const [x, y] = [n(a), n(b)];
+  for (let i = 0; i < 3; i++) if ((x[i] ?? 0) !== (y[i] ?? 0)) return (x[i] ?? 0) > (y[i] ?? 0);
+  return false;
+}
+var Updater = class {
+  constructor(d, t = {}) {
+    this.d = d;
+    this.firstMs = t.firstMs ?? 2e4;
+    this.everyMs = t.everyMs ?? 6 * 36e5;
+    this.retryMs = t.retryMs ?? 5 * 6e4;
+  }
+  d;
+  latest = null;
+  checkedAt = null;
+  applying = false;
+  error = null;
+  notified = null;
+  inflight = null;
+  first = null;
+  every = null;
+  retry = null;
+  firstMs;
+  everyMs;
+  retryMs;
+  state() {
+    const current = this.d.current();
+    return { current, latest: this.latest, checkedAt: this.checkedAt, available: this.latest !== null && isNewerVersion(this.latest, current), applying: this.applying, canApply: this.d.canApply(), error: this.error };
+  }
+  start() {
+    this.stop();
+    this.first = setTimeout(() => {
+      this.first = null;
+      void this.check();
+      this.every = setInterval(() => void this.check(), this.everyMs);
+      this.every.unref?.();
+    }, this.firstMs);
+    this.first.unref?.();
+  }
+  stop() {
+    if (this.first) clearTimeout(this.first);
+    if (this.every) clearInterval(this.every);
+    if (this.retry) clearTimeout(this.retry);
+    this.first = this.every = this.retry = null;
+  }
+  /** Asks npm for the newest version (one question at a time), tells the owner, and updates when that is switched on. */
+  check() {
+    this.inflight ??= (async () => {
+      try {
+        const latest = await this.d.latest();
+        this.checkedAt = Date.now();
+        if (latest) {
+          this.latest = latest;
+          this.error = null;
+          await this.consider();
+        } else {
+          this.error = "Could not ask npm for the newest version. Check the internet connection.";
+        }
+      } catch {
+        this.error = "Could not ask npm for the newest version. Check the internet connection.";
+      } finally {
+        this.inflight = null;
+      }
+      return this.state();
+    })();
+    return this.inflight;
+  }
+  /** The owner pressed Update now: installs even when automatic updates are off, but never in the middle of an answer. */
+  async applyNow() {
+    if (this.applying) return { ok: true, message: "The update is already running. Reload this page in a minute." };
+    if (!this.latest) await this.check();
+    const s = this.state();
+    if (!s.latest) return { ok: false, message: s.error ?? "Could not ask npm for the newest version." };
+    if (this.applying) return { ok: true, message: "The update is already running. Reload this page in a minute." };
+    if (!s.available) return { ok: false, message: `Friend is up to date (${s.current}).` };
+    if (!s.canApply) return { ok: false, message: "This Friend is running in a terminal and cannot restart itself. Close it and run: friend upgrade" };
+    if (this.d.busy()) return { ok: false, message: "Friend is busy with a request. Try again in a moment." };
+    return await this.begin(s.latest) ? { ok: true, message: `Updating to ${s.latest}. Friend restarts in a moment: reload this page afterwards.` } : { ok: false, message: this.error ?? "Could not start the update." };
+  }
+  async consider() {
+    const s = this.state();
+    if (!s.available || !s.latest) return;
+    const canApply = this.d.canApply();
+    if (this.notified !== s.latest) {
+      this.notified = s.latest;
+      this.d.notify(
+        canApply ? this.d.auto() ? `Friend ${s.latest} is available. It will update by itself when Friend is not busy.` : `Friend ${s.latest} is available. Turn on automatic updates in Settings, or press Update now there.` : `Friend ${s.latest} is available. Close this Friend and run: friend upgrade`
+      );
+    }
+    if (this.d.auto() && canApply) await this.maybeApply();
+  }
+  async maybeApply() {
+    const s = this.state();
+    if (this.applying || !s.available || !s.latest) return;
+    if (this.d.busy()) {
+      if (!this.retry) {
+        this.retry = setTimeout(() => {
+          this.retry = null;
+          void this.maybeApply();
+        }, this.retryMs);
+        this.retry.unref?.();
+      }
+      return;
+    }
+    await this.begin(s.latest);
+  }
+  async begin(version) {
+    this.applying = true;
+    this.error = null;
+    this.d.notify(`Updating Friend to ${version}. It restarts in a moment: reload this page afterwards.`);
+    let ok = false;
+    try {
+      ok = await this.d.apply(version);
+    } catch {
+      ok = false;
+    }
+    if (!ok) {
+      this.applying = false;
+      this.error = "Could not start the update.";
+    }
+    return ok;
+  }
+};
+
 // ../server/src/voice/challenge.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 var Challenges = class {
@@ -13750,20 +14158,20 @@ var Challenges = class {
 
 // ../server/src/voice/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes9 } from "node:crypto";
-import { chmodSync as chmodSync9, existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
+import { chmodSync as chmodSync9, existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
 var TAG_BYTES = 16;
 function loadOrCreateKey(path3) {
-  if (existsSync16(path3)) {
-    const key2 = readFileSync10(path3);
+  if (existsSync17(path3)) {
+    const key2 = readFileSync11(path3);
     if (key2.length !== KEY_BYTES) throw new Error(`invalid voice key file (expected ${KEY_BYTES} bytes): ${path3}`);
     return key2;
   }
-  mkdirSync11(dirname4(path3), { recursive: true });
+  mkdirSync12(dirname5(path3), { recursive: true });
   const key = randomBytes9(KEY_BYTES);
-  writeFileSync10(path3, key, { mode: 384 });
+  writeFileSync11(path3, key, { mode: 384 });
   try {
     chmodSync9(path3, 384);
   } catch {
@@ -14848,7 +15256,7 @@ async function createApp(opts) {
     broadcast({ type: "voice.heard", text: held.text, trust: "owner" });
     await runVoiceTurn(held.text, conn.ip, epoch);
   }
-  const here2 = dirname5(fileURLToPath2(import.meta.url));
+  const here2 = dirname6(fileURLToPath2(import.meta.url));
   const catalogDir = opts.pluginCatalogDir ?? firstExistingDir([process.env.FRIEND_PLUGIN_CATALOG, resolve5(here2, "plugins"), resolve5(here2, "../../..", "plugins")]) ?? resolve5(here2, "plugins");
   const pluginsApi = {
     list: () => {
@@ -15020,11 +15428,42 @@ async function createApp(opts) {
       });
     }
   });
+  const self = opts.system?.self ?? currentSelf();
+  const autostart = new Autostart(opts.system?.autostartDeps ?? realAutostartDeps(opts.dataDir), () => self);
+  const updater = new Updater(
+    {
+      current: opts.system?.current ?? runningVersion,
+      latest: opts.system?.latest ?? (() => npmLatest()),
+      auto: () => config.updates.auto,
+      busy: () => agent.isBusy(),
+      canApply: opts.system?.canApply ?? (() => process.env.FRIEND_DAEMON === "1"),
+      // only Friend in the background can replace itself
+      apply: opts.system?.apply ?? (() => spawnUpgrade(self)),
+      notify: (text3) => broadcast({ type: "alert", level: "info", text: text3 })
+    },
+    opts.system?.times
+  );
+  const systemApi = {
+    info: async () => ({ version: updater.state().current, update: updater.state(), autostart: await autostart.status(), auto: config.updates.auto }),
+    check: () => updater.check(),
+    update: async (pin, ip) => {
+      await requirePin(pin, ip);
+      audit.log("owner", "system.update_now", { ip });
+      return updater.applyNow();
+    },
+    setAutostart: async (enabled, pin, ip) => {
+      await requirePin(pin, ip);
+      audit.log("owner", enabled ? "system.autostart_on" : "system.autostart_off", { ip });
+      const r = enabled ? await autostart.enable() : await autostart.disable();
+      return { ...r, status: await autostart.status() };
+    }
+  };
   const tls = config.https ? await ensureTlsCert(opts.dataDir, [...config.allowedHosts, ...config.publicUrl ? [new URL(config.publicUrl).hostname] : []]) : void 0;
   const gateway = createGateway({
     ...tls ? { tls } : {},
     connectors: connectorsApi,
     chrome: chromeRemoteApi,
+    system: systemApi,
     video: {
       stream: (id2) => videoHub.streamOf(id2),
       status: async () => videoHub.status() ?? await videoHub.refresh(),
@@ -15594,12 +16033,14 @@ ${url}`);
         for (const id2 of gone) broadcast({ type: "stage", command: { cmd: "hide", id: id2 } });
         if (gone.length) for (const follow of stage.settleNow()) broadcast({ type: "stage", command: follow });
       }, opts.expireIntervalMs ?? 1e3);
+      if (opts.system?.checkForUpdates) updater.start();
       const listening = await gateway.listen();
       listenPort = listening.port;
       return listening;
     },
     async stop() {
       stopped = true;
+      updater.stop();
       hostPlayer.dispose();
       videoHub.dispose();
       heartbeat.stop();
@@ -15622,7 +16063,7 @@ ${url}`);
 }
 
 // ../server/src/voice/sidecar.ts
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import { createInterface } from "node:readline";
 var SidecarProcess = class {
   constructor(opts) {
@@ -15659,7 +16100,7 @@ var SidecarProcess = class {
         settled = true;
         reject(new Error(message));
       };
-      const child = spawn6(this.opts.command, this.opts.args, {
+      const child = spawn8(this.opts.command, this.opts.args, {
         cwd: this.opts.cwd,
         env: { ...this.opts.env ?? process.env, FRIEND_VOICE_TOKEN: this.opts.token },
         windowsHide: true,
@@ -15807,6 +16248,9 @@ var PARSERS = {
   trustProxy: bool
 };
 var GROUPS = {
+  updates: {
+    auto: bool
+  },
   voice: {
     enabled: bool,
     sttModel: nonEmpty,
@@ -15880,6 +16324,7 @@ var KEY_HELP = {
   allowedOrigins: "extra web addresses allowed to connect, separated by commas",
   allowedHosts: "extra host names that may reach Friend (for example my-pc), separated by commas",
   trustProxy: "true when Friend sits behind your own reverse proxy",
+  "updates.auto": "true or false: look for a newer Friend when it starts and install it by itself while Friend is not busy (false: only when you run friend upgrade or press Update now)",
   "voice.enabled": "true or false: use speech at all",
   "voice.sttModel": "listening model: tiny, base, small, large-v3-turbo \u2026 (bigger is more accurate and slower; Marathi and far-from-mic speech do best with small or large-v3-turbo)",
   "voice.ttsVoice": "speaking voice (easier: friend voice setup, or Settings)",
@@ -15947,12 +16392,12 @@ import { resolve as resolve9 } from "node:path";
 import { WebSocket as WebSocket3 } from "ws";
 
 // ../agent-cli/src/tools/fs.ts
-import { closeSync, mkdirSync as mkdirSync12, openSync, readSync, readdirSync as readdirSync4, statSync as statSync4, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname7, join as join19 } from "node:path";
+import { closeSync, mkdirSync as mkdirSync13, openSync, readSync, readdirSync as readdirSync4, statSync as statSync4, writeFileSync as writeFileSync12 } from "node:fs";
+import { dirname as dirname8, join as join19 } from "node:path";
 
 // ../agent-cli/src/tools/roots.ts
 import { lstatSync as lstatSync2, realpathSync } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve6, sep as sep3 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve6, sep as sep3 } from "node:path";
 var isWin = process.platform === "win32";
 var norm = (p) => isWin ? p.toLowerCase() : p;
 var exists = (p) => {
@@ -15968,18 +16413,18 @@ function realish(abs) {
   let cur = abs;
   const tail2 = [];
   while (!exists(cur)) {
-    const parent = dirname6(cur);
+    const parent = dirname7(cur);
     if (parent === cur) return abs;
     tail2.unshift(cur.slice(parent.length).replace(/^[\\/]+/, ""));
     cur = parent;
   }
-  let real2;
+  let real3;
   try {
-    real2 = realpathSync.native(cur);
+    real3 = realpathSync.native(cur);
   } catch {
     return UNRESOLVABLE + abs;
   }
-  return tail2.length ? resolve6(real2, ...tail2) : real2;
+  return tail2.length ? resolve6(real3, ...tail2) : real3;
 }
 function within(root, target) {
   if (target.startsWith(UNRESOLVABLE)) return false;
@@ -16051,8 +16496,8 @@ function fsWrite(args, ctx) {
   if ("error" in g) return { ok: false, error: g.error };
   if (Buffer.byteLength(args.content) > MAX_WRITE) return { ok: false, error: "Content too large (5 MB limit)" };
   try {
-    mkdirSync12(dirname7(g.abs), { recursive: true });
-    writeFileSync11(g.abs, args.content);
+    mkdirSync13(dirname8(g.abs), { recursive: true });
+    writeFileSync12(g.abs, args.content);
     return { ok: true, output: `Wrote ${Buffer.byteLength(args.content)} bytes to ${g.abs}`, truncated: false };
   } catch (e) {
     return { ok: false, error: e.message };
@@ -16060,7 +16505,7 @@ function fsWrite(args, ctx) {
 }
 
 // ../agent-cli/src/tools/shell.ts
-import { spawn as spawn7, spawnSync } from "node:child_process";
+import { spawn as spawn9, spawnSync } from "node:child_process";
 function killTree2(child) {
   if (!child.pid) return;
   if (process.platform === "win32") {
@@ -16086,7 +16531,7 @@ function runCommand2(command, cwdArg, ctx, argv) {
   const file = argv?.file ?? (win ? "powershell.exe" : "sh");
   const args = argv?.args ?? (win ? ["-NoProfile", "-NonInteractive", "-Command", command] : ["-c", command]);
   return new Promise((resolve13) => {
-    const child = spawn7(file, args, { cwd, windowsHide: true, detached: !win, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn9(file, args, { cwd, windowsHide: true, detached: !win, stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let truncated = false;
     let timedOut = false;
@@ -16288,8 +16733,8 @@ function startDeviceNode(opts) {
 
 // ../agent-cli/src/commands/start.ts
 import { randomBytes as randomBytes10 } from "node:crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync12, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname9, join as join21, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync13, writeFileSync as writeFileSync14 } from "node:fs";
+import { dirname as dirname10, join as join21, resolve as resolve8 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // ../agent-cli/src/commands/lan.ts
@@ -16394,9 +16839,9 @@ async function lanCommand(args, io2, ifaces = networkInterfaces2) {
 }
 
 // ../agent-cli/src/commands/voice.ts
-import { spawn as spawn8 } from "node:child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync12 } from "node:fs";
-import { dirname as dirname8, join as join20, resolve as resolve7 } from "node:path";
+import { spawn as spawn10 } from "node:child_process";
+import { existsSync as existsSync18, mkdirSync as mkdirSync14, readFileSync as readFileSync12, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname9, join as join20, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function voicePaths(dataDir) {
   const home = join20(dataDir, "voice");
@@ -16411,19 +16856,19 @@ function voicePaths(dataDir) {
 }
 function readMarker(dataDir) {
   try {
-    return JSON.parse(readFileSync11(voicePaths(dataDir).marker, "utf8"));
+    return JSON.parse(readFileSync12(voicePaths(dataDir).marker, "utf8"));
   } catch {
     return null;
   }
 }
 function findVoiceDir() {
-  const here2 = dirname8(fileURLToPath3(import.meta.url));
+  const here2 = dirname9(fileURLToPath3(import.meta.url));
   return firstExistingDir([process.env.FRIEND_VOICE_DIR, resolve7(here2, "voice"), resolve7(here2, "../../../voice")], "friend_voice") ?? resolve7(here2, "voice");
 }
 var QUIET_ENV = { ...process.env, HF_HUB_DISABLE_SYMLINKS_WARNING: "1", PYTHONUTF8: "1" };
 var defaultRunner = (cmd, args, opts) => new Promise((res) => {
   let stdout = "";
-  const child = spawn8(cmd, args, { cwd: opts?.cwd, env: QUIET_ENV, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+  const child = spawn10(cmd, args, { cwd: opts?.cwd, env: QUIET_ENV, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
   const feed = (d) => {
     const s = d.toString();
     stdout += s;
@@ -16508,8 +16953,8 @@ async function voiceSetupCommand(io2, deps = {}, args = []) {
     io2.err("Python 3.10 or newer is required. Install it from https://www.python.org/downloads/ and run this again.");
     return 1;
   }
-  mkdirSync13(p.home, { recursive: true });
-  if (!existsSync17(p.python)) {
+  mkdirSync14(p.home, { recursive: true });
+  if (!existsSync18(p.python)) {
     io2.out("1/3 Creating a private Python environment\u2026");
     const r = await run2(py.cmd, [...py.args, "-m", "venv", p.venv], { onLine });
     if (r.code !== 0) {
@@ -16543,7 +16988,7 @@ ${tail(dl.stdout)}`);
     return 1;
   }
   const marker = { python: p.python, sttModel: cfg.voice.sttModel, ttsVoice: cfg.voice.ttsVoice, at: Date.now() };
-  writeFileSync12(p.marker, JSON.stringify(marker, null, 2));
+  writeFileSync13(p.marker, JSON.stringify(marker, null, 2));
   io2.out("Voice is ready. Start Friend with `friend start`, then hold Space to talk.");
   return 0;
 }
@@ -16559,7 +17004,7 @@ async function voiceStatusCommand(io2) {
     io2.out("Voice engine:   not installed. Run: friend voice setup");
     return 0;
   }
-  if (!existsSync17(marker.python)) {
+  if (!existsSync18(marker.python)) {
     io2.out("Voice engine:   installed, but its Python is missing. Run: friend voice setup");
     return 0;
   }
@@ -16630,9 +17075,9 @@ async function voiceCommand(args, io2) {
 
 // ../agent-cli/src/commands/start.ts
 function findWebDir(explicit) {
-  const here2 = dirname9(fileURLToPath4(import.meta.url));
+  const here2 = dirname10(fileURLToPath4(import.meta.url));
   const candidates = [explicit, process.env.FRIEND_WEB_DIR, resolve8(here2, "../../../web/dist"), resolve8(here2, "web")];
-  return candidates.find((c) => !!c && existsSync18(join21(c, "index.html")));
+  return candidates.find((c) => !!c && existsSync19(join21(c, "index.html")));
 }
 async function startFriend(opts) {
   const stored = loadConfig(opts.dataDir);
@@ -16657,6 +17102,8 @@ async function startFriend(opts) {
   }) : null;
   const voice2 = sidecar ? new HttpVoiceService({ baseUrl: () => sidecar.baseUrl(), token: secret }) : void 0;
   const app = await createApp({
+    system: { checkForUpdates: true },
+    // looks for a newer Friend after it starts, and updates by itself when that is on
     dataDir: opts.dataDir,
     webDir: findWebDir(opts.webDir),
     voice: voice2,
@@ -16667,16 +17114,16 @@ async function startFriend(opts) {
   });
   const { port } = await app.start();
   const tokenFile = join21(opts.dataDir, "local-device.token");
-  let token = existsSync18(tokenFile) ? readFileSync12(tokenFile, "utf8").trim() : "";
+  let token = existsSync19(tokenFile) ? readFileSync13(tokenFile, "utf8").trim() : "";
   if (!token || !app.auth.resolveDevice(token)) {
     token = app.auth.redeemPairCode(app.auth.createPairCode(), "this-pc");
-    writeFileSync13(tokenFile, token, { mode: 384 });
+    writeFileSync14(tokenFile, token, { mode: 384 });
   }
   const node = startDeviceNode({
     url: `${app.config.https ? "wss" : "ws"}://127.0.0.1:${port}/device`,
     token,
     roots: app.config.roots,
-    ...app.config.https ? { ca: readFileSync12(join21(opts.dataDir, "tls", "cert.pem"), "utf8") } : {}
+    ...app.config.https ? { ca: readFileSync13(join21(opts.dataDir, "tls", "cert.pem"), "utf8") } : {}
     // this PC trusts only its own Friend's certificate
   });
   const urls = urlsFor(app.config.bind, port, void 0, app.config.https);
@@ -16904,12 +17351,12 @@ async function memoryCommand(args, io2) {
 }
 
 // ../agent-cli/src/commands/plugin.ts
-import { existsSync as existsSync19, readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
-import { dirname as dirname10, join as join22, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync20, readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
+import { dirname as dirname11, join as join22, resolve as resolve10 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var USAGE2 = "Usage: friend plugin catalog | list | install <name|folder> [--yes] | enable <id> | disable <id> | remove <id>";
 function defaultCatalog() {
-  const here2 = dirname10(fileURLToPath5(import.meta.url));
+  const here2 = dirname11(fileURLToPath5(import.meta.url));
   return firstExistingDir([process.env.FRIEND_PLUGIN_CATALOG, resolve10(here2, "plugins"), resolve10(here2, "../../../../plugins")]) ?? resolve10(here2, "plugins");
 }
 var count = (n, word2) => `${n} ${word2}${n === 1 ? "" : "s"}`;
@@ -16919,7 +17366,7 @@ async function pluginCommand(args, io2, deps = {}) {
   const flags = rest.filter((a) => a.startsWith("--"));
   const arg = rest.find((a) => !a.startsWith("--"));
   if (sub === "catalog") {
-    const dirs = existsSync19(catalogDir) ? readdirSync5(catalogDir).filter((d) => statSync5(join22(catalogDir, d)).isDirectory()) : [];
+    const dirs = existsSync20(catalogDir) ? readdirSync5(catalogDir).filter((d) => statSync5(join22(catalogDir, d)).isDirectory()) : [];
     if (dirs.length === 0) io2.out("The catalog is empty.");
     for (const d of dirs.sort()) {
       const r = inspectPlugin(join22(catalogDir, d));
@@ -16952,8 +17399,8 @@ async function pluginCommand(args, io2, deps = {}) {
         io2.err(USAGE2);
         return 1;
       }
-      const inCatalog = !/[\\/]/.test(arg) && existsSync19(join22(catalogDir, arg));
-      const source = inCatalog ? join22(catalogDir, arg) : existsSync19(resolve10(arg)) ? resolve10(arg) : null;
+      const inCatalog = !/[\\/]/.test(arg) && existsSync20(join22(catalogDir, arg));
+      const source = inCatalog ? join22(catalogDir, arg) : existsSync20(resolve10(arg)) ? resolve10(arg) : null;
       if (!source) {
         io2.err(`"${arg}" is not in the catalog and there is no such folder. See: friend plugin catalog`);
         return 1;
@@ -17008,7 +17455,7 @@ async function pluginCommand(args, io2, deps = {}) {
 
 // ../agent-cli/src/commands/onboard/index.ts
 import crossSpawn4 from "cross-spawn";
-import { mkdirSync as mkdirSync15 } from "node:fs";
+import { mkdirSync as mkdirSync16 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 
 // ../agent-cli/src/commands/ollama.ts
@@ -17331,16 +17778,16 @@ function installPlan(id2, platform, have) {
 }
 
 // ../agent-cli/src/commands/onboard/state.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync14, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync9, writeFileSync as writeFileSync14 } from "node:fs";
-import { dirname as dirname11, join as join23 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync15, readFileSync as readFileSync14, renameSync as renameSync4, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname12, join as join23 } from "node:path";
 var FEATURES = ["claude-code", "claude-api", "ollama", "voice", "sandbox"];
 var emptyState = () => ({ version: 1, done: {}, features: [], restart: [] });
 var statePath = (dataDir) => join23(dataDir, "onboarding.json");
 function loadState(dataDir) {
   const f = statePath(dataDir);
-  if (!existsSync20(f)) return emptyState();
+  if (!existsSync21(f)) return emptyState();
   try {
-    const raw = JSON.parse(readFileSync13(f, "utf8"));
+    const raw = JSON.parse(readFileSync14(f, "utf8"));
     const done = raw.done && typeof raw.done === "object" ? Object.fromEntries(Object.entries(raw.done).filter(([, v]) => typeof v === "string")) : {};
     const features2 = Array.isArray(raw.features) ? raw.features.filter((x) => FEATURES.includes(x)) : [];
     const restart = Array.isArray(raw.restart) ? raw.restart.filter((x) => typeof x === "string") : [];
@@ -17351,13 +17798,13 @@ function loadState(dataDir) {
 }
 function saveState(dataDir, state) {
   const f = statePath(dataDir);
-  mkdirSync14(dirname11(f), { recursive: true });
+  mkdirSync15(dirname12(f), { recursive: true });
   const tmp = `${f}.tmp`;
-  writeFileSync14(tmp, JSON.stringify(state, null, 2));
+  writeFileSync15(tmp, JSON.stringify(state, null, 2));
   renameSync4(tmp, f);
 }
 function resetState(dataDir) {
-  rmSync9(statePath(dataDir), { force: true });
+  rmSync10(statePath(dataDir), { force: true });
 }
 
 // ../agent-cli/src/commands/onboard/ui.ts
@@ -17709,7 +18156,7 @@ async function workspace(c) {
   const answer = await text2(c.ui, current ? "Workspace folder" : "Workspace folder (Enter to skip)", current ?? "");
   if (answer) {
     const abs = resolve11(answer);
-    mkdirSync15(abs, { recursive: true });
+    mkdirSync16(abs, { recursive: true });
     cfg.roots = [abs];
     saveConfig(cfg);
     io2.out(`Workspace: ${abs}`);
@@ -17879,19 +18326,54 @@ async function doctorCommand(io2, partial = {}) {
   return requiredMissing ? 1 : 0;
 }
 
+// ../agent-cli/src/commands/autostart.ts
+var USAGE3 = "Usage: friend autostart on|off|status";
+var real = (io2) => new Autostart(realAutostartDeps(io2.dataDir), currentSelf);
+async function autostartCommand(args, io2, autostart = real(io2)) {
+  switch (args[0]) {
+    case "on":
+    case "off": {
+      const r = await (args[0] === "on" ? autostart.enable() : autostart.disable());
+      if (!r.ok) {
+        io2.err(r.message);
+        return 1;
+      }
+      io2.out(r.message);
+      if (args[0] === "on") io2.out("Turn it off again with: friend autostart off");
+      return 0;
+    }
+    case "status": {
+      const s = await autostart.status();
+      if (!s.supported) {
+        io2.out("Starting Friend by itself is not supported on this kind of computer.");
+        return 0;
+      }
+      io2.out(`Starts by itself when you sign in: ${s.enabled ? "yes" : "no"}${s.enabled ? ` (${s.kind})` : ""}`);
+      if (!s.enabled) io2.out("Turn it on with: friend autostart on");
+      return 0;
+    }
+    case "refresh":
+      await autostart.refresh();
+      return 0;
+    default:
+      io2.err(USAGE3);
+      return 1;
+  }
+}
+
 // ../agent-cli/src/commands/daemon.ts
-import { spawn as spawn9, spawnSync as spawnSync2 } from "node:child_process";
-import { closeSync as closeSync2, existsSync as existsSync21, mkdirSync as mkdirSync16, openSync as openSync2, readFileSync as readFileSync14, renameSync as renameSync5, rmSync as rmSync10, statSync as statSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { spawn as spawn11, spawnSync as spawnSync2 } from "node:child_process";
+import { closeSync as closeSync2, existsSync as existsSync22, mkdirSync as mkdirSync17, openSync as openSync2, readFileSync as readFileSync15, renameSync as renameSync5, rmSync as rmSync11, statSync as statSync6, writeFileSync as writeFileSync16 } from "node:fs";
 import { connect } from "node:net";
 import { join as join24 } from "node:path";
-var USAGE3 = "Usage: friend daemon start | stop | restart | status";
+var USAGE4 = "Usage: friend daemon start | stop | restart | status";
 var MAX_LOG_BYTES = 5 * 1024 * 1024;
 var sleep = (ms2) => new Promise((r) => setTimeout(r, ms2));
 var realDeps = {
   launch(logFile) {
     const fd = openSync2(logFile, "a");
     try {
-      const child = spawn9(process.execPath, [process.argv[1], "start"], { detached: true, stdio: ["ignore", fd, fd], windowsHide: true });
+      const child = spawn11(process.execPath, [process.argv[1], "start"], { detached: true, stdio: ["ignore", fd, fd], windowsHide: true, env: { ...process.env, FRIEND_DAEMON: "1" } });
       child.unref();
       return child.pid;
     } finally {
@@ -17943,7 +18425,7 @@ var pidFile = (dataDir) => join24(dataDir, "friend.pid");
 var logFileOf = (dataDir) => join24(dataDir, "friend.log");
 function readPid(dataDir) {
   try {
-    const r = JSON.parse(readFileSync14(pidFile(dataDir), "utf8"));
+    const r = JSON.parse(readFileSync15(pidFile(dataDir), "utf8"));
     return Number.isInteger(r.pid) && r.pid > 0 ? r : null;
   } catch {
     return null;
@@ -17952,7 +18434,7 @@ function readPid(dataDir) {
 function running(dataDir, deps) {
   const r = readPid(dataDir);
   if (r && deps.alive(r.pid)) return r;
-  if (r) rmSync10(pidFile(dataDir), { force: true });
+  if (r) rmSync11(pidFile(dataDir), { force: true });
   return null;
 }
 function since(ms2) {
@@ -17974,10 +18456,10 @@ async function start(io2, deps) {
     io2.err(`Port ${cfg.port} is already in use. Friend may be running in a terminal (stop it with Ctrl+C), or another program uses that port (friend lan port N).`);
     return 1;
   }
-  mkdirSync16(io2.dataDir, { recursive: true });
+  mkdirSync17(io2.dataDir, { recursive: true });
   const log = logFileOf(io2.dataDir);
   try {
-    if (existsSync21(log) && statSync6(log).size > MAX_LOG_BYTES) renameSync5(log, `${log}.old`);
+    if (existsSync22(log) && statSync6(log).size > MAX_LOG_BYTES) renameSync5(log, `${log}.old`);
   } catch {
   }
   const pid = deps.launch(log);
@@ -17985,7 +18467,7 @@ async function start(io2, deps) {
     io2.err("Could not start Friend in the background.");
     return 1;
   }
-  writeFileSync15(pidFile(io2.dataDir), JSON.stringify({ pid, startedAt: deps.now() }));
+  writeFileSync16(pidFile(io2.dataDir), JSON.stringify({ pid, startedAt: deps.now() }));
   for (let i = 0; i < 60; i++) {
     if (await deps.portOpen(cfg.port, 300)) {
       io2.out(`Friend is running in the background (pid ${pid}) at ${urls.local}`);
@@ -17996,7 +18478,7 @@ async function start(io2, deps) {
     if (!deps.alive(pid)) break;
     await sleep(250);
   }
-  rmSync10(pidFile(io2.dataDir), { force: true });
+  rmSync11(pidFile(io2.dataDir), { force: true });
   io2.err(`Friend did not start. See the log: ${log}`);
   return 1;
 }
@@ -18011,7 +18493,7 @@ async function stop(io2, deps) {
     io2.err(`Could not stop Friend (pid ${r.pid}). End that process yourself.`);
     return 1;
   }
-  rmSync10(pidFile(io2.dataDir), { force: true });
+  rmSync11(pidFile(io2.dataDir), { force: true });
   io2.out("Friend stopped.");
   return 0;
 }
@@ -18043,25 +18525,27 @@ async function daemonCommand(args, io2, deps = realDeps) {
     case "status":
       return status(io2, deps);
     default:
-      io2.err(USAGE3);
+      io2.err(USAGE4);
       return 1;
   }
 }
 
 // ../agent-cli/src/commands/upgrade.ts
 import crossSpawn5 from "cross-spawn";
-var PACKAGE = "friend-assistant";
-var real = {
-  current: () => true ? "0.1.44" : "development",
+import { appendFileSync } from "node:fs";
+import { join as join25 } from "node:path";
+var PACKAGE2 = "friend-assistant";
+var real2 = {
+  current: () => true ? "0.1.45" : "development",
   latest: () => new Promise((resolve13) => {
-    const child = crossSpawn5("npm", ["view", PACKAGE, "version", "--prefer-online"], { stdio: ["ignore", "pipe", "ignore"] });
+    const child = crossSpawn5("npm", ["view", PACKAGE2, "version", "--prefer-online"], { stdio: ["ignore", "pipe", "ignore"] });
     let out = "";
     child.stdout?.on("data", (d) => out += d.toString());
     child.on("error", () => resolve13(null));
     child.on("close", (code) => resolve13(code === 0 && /^\d+\.\d+\.\d+/.test(out.trim()) ? out.trim().split(/\s+/)[0] : null));
   }),
   install: (version) => new Promise((resolve13) => {
-    const child = crossSpawn5("npm", ["install", "-g", `${PACKAGE}@${version}`, "--prefer-online"], { stdio: "inherit" });
+    const child = crossSpawn5("npm", ["install", "-g", `${PACKAGE2}@${version}`, "--prefer-online"], { stdio: "inherit" });
     child.on("error", () => resolve13(1));
     child.on("close", (code) => resolve13(code ?? 1));
   }),
@@ -18070,6 +18554,11 @@ var real = {
     child.on("error", () => resolve13(1));
     child.on("close", (code) => resolve13(code ?? 1));
   }),
+  refreshAutostart: () => new Promise((resolve13) => {
+    const child = crossSpawn5("friend", ["autostart", "refresh"], { stdio: "ignore" });
+    child.on("error", () => resolve13());
+    child.on("close", () => resolve13());
+  }),
   daemon: realDeps
 };
 var newer = (a, b) => {
@@ -18078,12 +18567,26 @@ var newer = (a, b) => {
   for (let i = 0; i < 3; i++) if ((x[i] ?? 0) !== (y[i] ?? 0)) return (x[i] ?? 0) > (y[i] ?? 0);
   return false;
 };
-async function upgradeCommand(args, io2, deps = real) {
+async function upgradeCommand(args, io0, deps = real2) {
   const force = args.includes("--force");
-  if (args.some((a) => a !== "--force")) {
-    io2.err("Usage: friend upgrade [--force]");
+  const auto = args.includes("--auto");
+  if (args.some((a) => a !== "--force" && a !== "--auto")) {
+    io0.err("Usage: friend upgrade [--force] [--auto]");
     return 1;
   }
+  const log = deps.log ?? ((line) => appendFileSync(join25(io0.dataDir, "update.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`));
+  const io2 = auto ? {
+    ...io0,
+    out: (l) => {
+      io0.out(l);
+      log(l);
+    },
+    err: (l) => {
+      io0.err(l);
+      log(l);
+    }
+  } : io0;
   const current = deps.current();
   io2.out(`Installed: ${current}`);
   const latest = await deps.latest();
@@ -18106,7 +18609,7 @@ async function upgradeCommand(args, io2, deps = real) {
     io2.err(`Friend is running in a terminal (port ${cfg.port} is in use). Press Ctrl+C there to stop it, then run: friend upgrade`);
     return 1;
   }
-  io2.out(`Installing ${PACKAGE}@${latest}\u2026`);
+  io2.out(`Installing ${PACKAGE2}@${latest}\u2026`);
   const code = await deps.install(latest);
   if (code !== 0) {
     io2.err("The install failed. If it says EBUSY or EPERM, close whatever is using Friend (a terminal running it, a voice process) and run: friend upgrade");
@@ -18114,6 +18617,8 @@ async function upgradeCommand(args, io2, deps = real) {
     return 1;
   }
   io2.out(`Upgraded ${current} \u2192 ${latest}.`);
+  await deps.refreshAutostart?.().catch(() => {
+  });
   if (wasRunning) return deps.startAgain();
   io2.out("Start it with: friend start   (or in the background: friend daemon start)");
   return 0;
@@ -18187,7 +18692,7 @@ async function claudeCommand(args, io2, deps = {}) {
 }
 
 // ../agent-cli/src/commands/setup.ts
-import { mkdirSync as mkdirSync17 } from "node:fs";
+import { mkdirSync as mkdirSync18 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
 async function setupCommand3(io2) {
   const db = openDb(io2.dataDir);
@@ -18213,7 +18718,7 @@ async function setupCommand3(io2) {
     const cfg = loadConfig(io2.dataDir);
     if (workspace2) {
       const abs = resolve12(workspace2);
-      mkdirSync17(abs, { recursive: true });
+      mkdirSync18(abs, { recursive: true });
       cfg.roots = [abs];
     }
     if (apiKey) cfg.apiKey = apiKey;
@@ -18278,7 +18783,7 @@ async function statusCommand3(io2) {
 }
 
 // ../agent-cli/src/cli.ts
-var USAGE4 = `Usage: friend <command>
+var USAGE5 = `Usage: friend <command>
 
   onboard                    guided setup, step by step: checks this PC, installs what is missing, asks what you want
   doctor                     check what this PC has and what is missing (changes nothing)
@@ -18288,6 +18793,7 @@ var USAGE4 = `Usage: friend <command>
   start                      run the gateway and a local device node
   daemon start|stop|restart|status  run Friend in the background (no terminal needed), stop it, or see if it is running
   upgrade [--force]          stop the background Friend, install the newest version, start it again
+  autostart on|off|status    start Friend by itself when you sign in to this computer (Windows, macOS, Linux)
   pair                       print a one-time code to connect another PC
   node --url <ws-url> --code <code> [--roots a,b] [--name pc]
                              connect this PC to a Friend gateway
@@ -18320,6 +18826,8 @@ async function run(argv, io2) {
         return await daemonCommand(rest, io2);
       case "upgrade":
         return await upgradeCommand(rest, io2);
+      case "autostart":
+        return await autostartCommand(rest, io2);
       case "pair":
         return await pairCommand(io2);
       case "node":
@@ -18335,12 +18843,12 @@ async function run(argv, io2) {
       case "help":
       case "--help":
       case "-h":
-        io2.out(USAGE4);
+        io2.out(USAGE5);
         return 0;
       case "version":
       case "--version":
       case "-v":
-        io2.out(true ? "0.1.44" : "development");
+        io2.out(true ? "0.1.45" : "development");
         return 0;
       case "lan":
         return await lanCommand(rest, io2);
@@ -18359,7 +18867,7 @@ async function run(argv, io2) {
       case "config":
         return await configCommand(rest, io2);
       default:
-        io2.err(USAGE4);
+        io2.err(USAGE5);
         return 1;
     }
   } catch (e) {