granttap-mcp 0.8.110 → 0.8.112

package/apps/bridge/src/device-management/index.ts

@@ -5,7 +5,7 @@ import { loadConfig, machineConfigPath } from '../config';
 import { observedComputerId } from '../mesh/identity/computer';
 import { clearComputerCache } from './cache';
 import { providerLogins } from './login';
-import { managementSnapshot, maintenanceIdle, restartProvider, restartRuntime, runtimeRoot, updateRuntime } from './maintenance';
+import { managementSnapshot, maintenanceIdle, restartProvider, restartRuntime, runtimeRoot, updateRuntime, updateProvider } from './maintenance';
 
 type Send = (result: DeviceManagementResult) => Promise<void>;
 type Entry = { fingerprint: string; result?: DeviceManagementResult; pending?: Promise<void>; at: number; ttl: number };
@@ -35,6 +35,10 @@ export async function handleDeviceManagement(client: RelayClient, request: Devic
     return true;
   }
   if (requests.size >= 128) return false;
+  if (request.action === 'status' && request.operationId) {
+    const old = requests.get(client.room + ':' + peer + ':' + request.operationId)?.result;
+    if (old && old.action !== 'status' && !old.action.startsWith('provider-login')) await send(old);
+  }
   const entry: Entry = { fingerprint, at: Date.now(), ttl: request.action === 'status' ? 60_000 : 15 * 60_000 };
   requests.set(key, entry);
   const report: Send = async result => { entry.result = result; await send(result); };
@@ -76,6 +80,8 @@ async function execute(request: DeviceManagementRequest, scope: string, computer
       message = await updateRuntime();
     } else if (request.action === 'provider-restart') {
       message = await restartProvider(request.agent!, request.interruptActiveTasks);
+    } else if (request.action === 'provider-update') {
+      message = await updateProvider(request.agent!);
     } else if (request.action === 'runtime-restart') {
       // The phone waits for a different runtimeEpoch, rather than treating this acknowledgement as a restart.
       if (!maintenanceIdle()) throw Error('Finish active requests and sign-in before restarting MCP.');

package/apps/bridge/src/device-management/maintenance.ts

@@ -17,6 +17,7 @@ import { computerCache } from './cache';
 import { providerLogins } from './login';
 import { ownedProviderProcesses, signalOwnedProcess } from '../reply/process';
 import { approvalsStatus } from '../approvals/state';
+import { inspectTool, updateTool } from '../tools/updater';
 
 export const runtimeRoot = fileURLToPath(new URL('../../../../', import.meta.url));
 const runtimeEpoch = randomUUID();
@@ -39,15 +40,17 @@ export function maintenanceIdle(): boolean {
 }
 
 export async function managementSnapshot(): Promise<DeviceManagementSnapshot> {
+  const observedAt = Date.now();
   const directory = join(configDir(), 'runtime-updates');
   const selected = readState(directory);
   const providers = await Promise.all(agents.map(async agent => {
     const command = providerCommand(agent), installed = installedProvider(command);
     return { agent, installed, version: binaryVersion(command), authentication: await providerAuthentication(agent, command),
       loginSupported: installed, restartSupported: installed,
+      updateSupported: installed && inspectTool(agent, providerEnvironment()).update != null,
       activeRequests: ownedProviderProcesses(command).length };
   }));
-  return { computerId: observedComputerId(), computerName: hostname(), observedAt: Date.now(),
+  return { computerId: observedComputerId(), computerName: hostname(), observedAt,
     runtimeVersion: runtimeVersion(runtimeRoot), runtimeEpoch, selectedRuntimeVersion: selected.version,
     automaticUpdatesEnabled: automaticUpdatesAllowed(directory),
     runtimeUpdateSupported: runtimeRoot.includes('/node_modules/'), runtimeRestartSupported: runtimeRestartSupported(),
@@ -89,3 +92,11 @@ export async function restartProvider(agent: CodingAgent, interrupt = false): Pr
   await promisify(execFile)(command, ['--version'], { env: providerEnvironment(), timeout: 15_000, maxBuffer: 16_384 });
   return 'A fresh provider CLI started successfully. The next message starts a new GrantTap connection to it.';
 }
+
+export async function updateProvider(agent: CodingAgent): Promise<string> {
+  if (providerLogins.active()) throw Error('Finish provider sign-in before updating coding tools.');
+  if (ownedProviderProcesses(providerCommand(agent)).length) throw Error('Finish this provider’s active GrantTap requests before updating it.');
+  const outcome = await updateTool(agent, providerEnvironment());
+  if (!outcome.ok) throw Error(outcome.message);
+  return outcome.message;
+}

package/apps/bridge/src/providers/codex-bin.ts

@@ -23,6 +23,8 @@ export function resolveCodexBinary(
   if (override) return override;
   const onPath = executableOnPath("codex", env);
   if (onPath) return onPath;
+  const native = join(home, '.local', 'bin', 'codex');
+  if (executable(native)) return native;
   for (const app of ["ChatGPT.app", "Codex.app"]) {
     for (const root of [applicationsRoot, join(home, "Applications")]) {
       for (const relative of [

package/apps/bridge/src/reply/README.md

@@ -1,5 +1,10 @@
 # Task delivery
 
+An explicit Grok Build usage-balance refusal is returned as a usage error rather
+than a startup timeout or a successful answer. Both stderr exits and streaming
+error events use the same explanation. Earlier confirmed response activity stays
+recorded if a turn later fails; an error alone never creates admission evidence.
+
 This module prepares phone attachments, routes selected MCP/skill intent, and runs local agent commands. The public `reply.ts` entry point owns session queueing and agent-specific command selection.
 
 `provider-headless.ts` owns the provider-neutral headless start used when a Mesh

package/apps/bridge/src/reply/grok-response/index.ts

@@ -1,5 +1,6 @@
 import type { ReplyResult } from '../payload/types';
 import type { ProviderAdmission } from '../process';
+import { providerUsageFailure } from '../process/auth-failure';
 
 function events(stdout: string): Record<string, unknown>[] {
   return stdout.split('\n').flatMap(line => {
@@ -40,7 +41,7 @@ export function parseGrok(stdout: string, fallback: string): ReplyResult {
     if (typeof event.session_id === 'string') sessionId = event.session_id;
     const error = typeof event.message === 'string' ? event.message : event.error;
     if (event.type === 'error' && typeof error === 'string') {
-      return { ok: false, error: error.slice(0, 500) };
+      return { ok: false, error: providerUsageFailure(error) ?? error.slice(0, 500) };
     }
   }
   return text.trim() ? { ok: true, text: text.trim().slice(0, 4_000), sessionId }

package/apps/bridge/src/reply/process/auth-failure.ts

@@ -9,3 +9,14 @@ export function providerSignInFailure(command: string, stderr: string): string |
     : executable.includes('codex') ? 'Codex' : executable.includes('cursor') ? 'Cursor' : 'the coding agent';
   return `Sign-in required for ${provider}. Open Devices, choose this computer, then Sign in for ${provider}. This message has not been submitted to the agent.`;
 }
+
+/** Match the provider's explicit diagnostic, not an arbitrary HTTP 402 from a tool. */
+export function providerUsageFailure(stderr: string): string | undefined {
+  if (!/\bGrok Build usage balance exhausted\b/i.test(stderr)) return;
+  return 'Grok usage limit reached: Grok Build usage balance exhausted. Check your Grok usage before retrying.';
+}
+
+export function providerExitFailure(command: string, stderr: string, stdout: string, code: number | null): string {
+  return providerUsageFailure(stderr)
+    ?? `${command} exited with code ${code}: ${(stderr.trim() || stdout.trim()).slice(0, 300)}`;
+}

package/apps/bridge/src/reply/process/index.ts

@@ -1,7 +1,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import { delimiter, dirname } from 'node:path';
 import { realpathSync } from 'node:fs';
-import { providerSignInFailure } from './auth-failure';
+import { providerSignInFailure, providerExitFailure } from './auth-failure';
 import { computerId } from "../../mesh/identity/computer";
 import { inspectRepository } from "../../mesh/catalog";
 import { localMeshStore } from "../../mesh/local-remote/local";
@@ -172,7 +172,7 @@ export function runProcess(
       if (code !== 0) {
         finish({
           ok: false,
-          error: `${command} exited with code ${code}: ${(stderr.trim() || stdout.trim()).slice(0, 300)}`,
+          error: providerExitFailure(command, stderr, stdout, code),
         });
         return;
       }

package/apps/bridge/src/tools/updater.ts

@@ -12,12 +12,13 @@
 import { spawn } from "node:child_process";
 import { accessSync, constants, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { basename, delimiter, dirname, join } from "node:path";
 import type { CodingAgent } from "../../../../packages/protocol/schema";
 import { compareVersions, executableOnPath, resolveClaudeBinary } from "../providers/claude-bin";
 import { resolveCodexBinary } from "../providers/codex-bin";
 import { resolveCursorAgentBin } from "../reply/process/cursor-agent-bin";
 import { askVersion, binaryVersion, forgetVersion, stripAnsi } from "./version";
+import { resolveGrokBinary } from '../providers/grok-bin';
 
 export const TOOL_NAMES: Record<CodingAgent, string> = {
   claude: "Claude Code", codex: "Codex CLI", cursor: "Cursor CLI", grok: "Grok CLI",
@@ -51,6 +52,9 @@ export type ToolUpdateOutcome = {
 
 const UPDATE_TIMEOUT_MS = 10 * 60_000;
 const MAX_OUTPUT = 4_000;
+// The desktop bundle has no self-update channel. Use the provider's standalone
+// installer without modifying the signed app; its CLI is resolved after install.
+const CODEX_INSTALL = 'installer="$(/usr/bin/curl -fsSL https://chatgpt.com/codex/install.sh)" && CODEX_NON_INTERACTIVE=1 /bin/sh -c "$installer"';
 
 function executable(path: string): boolean {
   try {
@@ -110,12 +114,13 @@ export function updateArgv(
     case "claude":
       if (install.method === "npm") return npmArgv(install, "@anthropic-ai/claude-code", env);
       if (install.method === "brew") return brewArgv("claude-code", env);
-      if (install.method === "desktop") return undefined;
+      if (install.method === "desktop") return path ? [path, "install", "latest"] : undefined;
       return path ? [path, "update"] : undefined;
     case "codex":
       if (install.method === "npm") return npmArgv(install, "@openai/codex", env);
       if (install.method === "brew") return brewArgv("codex", env);
-      return undefined;
+      if (path?.includes('.app/Contents/')) return ['/bin/sh', '-c', CODEX_INSTALL];
+      return path ? [path, "update"] : undefined;
     case "cursor":
     case "grok":
       return path ? [path, "update"] : undefined;
@@ -124,7 +129,11 @@ export function updateArgv(
 
 function locate(agent: CodingAgent, env: NodeJS.ProcessEnv, home: string): string | undefined {
   switch (agent) {
-    case "claude": return env.GRANTTAP_CLAUDE_BIN ?? env.NODVOX_CLAUDE_BIN ?? executableOnPath("claude", env);
+    case "claude": {
+      const path = env.GRANTTAP_CLAUDE_BIN ?? env.NODVOX_CLAUDE_BIN ?? executableOnPath("claude", env)
+        ?? (executable(join(home, '.local/bin/claude')) ? join(home, '.local/bin/claude') : resolveClaudeBinary(home, env).path);
+      return executable(path) ? path : undefined;
+    }
     case "codex": {
       const path = resolveCodexBinary(home, env);
       return path.includes("/") ? (executable(path) ? path : undefined) : executableOnPath(path, env);
@@ -133,7 +142,10 @@ function locate(agent: CodingAgent, env: NodeJS.ProcessEnv, home: string): strin
       const bin = resolveCursorAgentBin(env);
       return bin.includes("/") ? (executable(bin) ? bin : undefined) : executableOnPath(bin, env);
     }
-    case "grok": return env.GRANTTAP_GROK_BIN ?? executableOnPath("grok", env);
+    case "grok": {
+      const path = resolveGrokBinary(env, home);
+      return path.includes('/') ? (executable(path) ? path : undefined) : executableOnPath(path, env);
+    }
   }
 }
 
@@ -166,6 +178,7 @@ export function inspectTools(env: NodeJS.ProcessEnv = process.env, home = homedi
 
 /** The command as the phone shows it: the binary by name, the arguments as run. */
 export function describeCommand(argv: string[]): string {
+  if (argv[2] === CODEX_INSTALL) return 'Codex CLI installer';
   return [basename(argv[0] ?? ""), ...argv.slice(1)].join(" ");
 }
 
@@ -246,12 +259,14 @@ export function updateTool(
   const argv = status.update;
   const command = describeCommand(argv);
   const task = (async (): Promise<ToolUpdateOutcome> => {
-    const before = status.version;
-    const result = await runner(argv, env, home, timeoutMs);
+    const before = status.version ?? (status.path ? binaryVersion(status.path, askVersion) : undefined);
+    const nodeDirectory = dirname(process.execPath);
+    const updaterEnv = { ...env, PATH: [nodeDirectory, env.PATH ?? ''].join(delimiter) };
+    const result = await runner(argv, updaterEnv, home, timeoutMs);
     forgetVersion();
     // The updater just ran the tool; asking it its version now adds nothing new.
     const updated = inspectTool(agent, env, home);
-    const after = updated.version ?? (updated.path ? askVersion(updated.path) : undefined);
+    const after = updated.version ?? (updated.path ? binaryVersion(updated.path, askVersion) : undefined);
     const output = stripAnsi(result.output).trim().slice(-MAX_OUTPUT) || undefined;
     if (result.error || result.code !== 0) {
       const why = result.error ?? `exited with code ${result.code}`;
@@ -261,7 +276,8 @@ export function updateTool(
       ? `${name} updated from ${before} to ${after}.`
       : !before && after
         ? `${name} is now ${after}.`
-        : `${name} is up to date${after ? ` (${after})` : ""}.`;
+        : after ? `${name} is up to date (${after}).`
+          : `${name} updater completed. The installed version could not be verified.`;
     return { ok: true, before, after, command, output, message };
   })().finally(() => running.delete(agent));
   running.set(agent, task);

package/apps/bridge/src/tools/version.ts

@@ -52,7 +52,7 @@ export function passiveVersion(resolvedPath: string): string | undefined {
 }
 
 export function parseVersionOutput(output: string): string | undefined {
-  return SEMVER.exec(output)?.[0];
+  return /\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?/.exec(output)?.[0];
 }
 
 export function stripAnsi(text: string): string {
@@ -91,9 +91,10 @@ export function binaryVersion(path: string, probe?: VersionProbe): string | unde
     return undefined;
   }
   const stated = passiveVersion(resolved);
-  if (stated || !probe) return stated;
+  if (stated) return stated;
   const hit = cache.get(resolved);
   if (hit && hit.key === key) return hit.version;
+  if (!probe) return undefined;
   const version = probe(resolved);
   cache.set(resolved, { key, version });
   return version;

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.110
+npm install -g granttap-mcp@0.8.112
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.110\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.112\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.110";
+const PACKAGE = "granttap-mcp@0.8.112";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/docs/device-management.md

@@ -1,6 +1,6 @@
 # Computer controls from GrantTap
 
-MCP 0.8.110 adds the paired-controller `device.manage` protocol. The iOS client
+MCP 0.8.109 adds the paired-controller `device.manage` protocol. The iOS client
 must also support these controls. A computer without an installed, connected
 MCP cannot execute remote commands; install and pair MCP on that computer first.
 
@@ -47,3 +47,13 @@ streams, launchd Node PATH recovery and preservation during cache cleanup.
 The latest sign-in state is replayed privately when its controller refreshes status.
 This restores completion after a phone returns from the browser without starting
 another login, resending a prompt, or retaining terminal authorization codes.
+
+MCP 0.8.111 adds provider-update controls for Claude Code, Codex CLI, Grok CLI and Cursor CLI. Each runs its own fixed updater (or its owning npm/Homebrew installer) on the selected computer; desktop Claude can install the latest native CLI. An explicit update probes versions before and after, caches the observed version, and refuses active GrantTap requests for that provider or an active sign-in. Background recovery asks for the original operation ID; it returns the saved private result without running the update again. Older clients can ignore the optional updateSupported capability.
+
+A Codex copy bundled with the desktop app is preserved. Its update action uses
+the [official standalone installer](https://learn.chatgpt.com/docs/cli) with
+noninteractive input and then resolves the native `~/.local/bin/codex` copy,
+including under launchd's stripped PATH. An explicit binary override keeps
+priority. Version output retains prerelease suffixes so an alpha is not shown
+as a stable release. Regression tests simulate installer output and verify the
+original app binary remains unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.110",
+  "version": "0.8.112",
   "description": "Commercial computer runtime connecting local coding agents to GrantTap on Mac, iPhone, iPad and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/protocol/messages/device/management.ts

@@ -4,7 +4,7 @@ import { CodingAgent } from '../primitives';
 const identifier = z.string().trim().min(1).max(160);
 export const DeviceManagementAction = z.enum([
   'status', 'clear-cache', 'runtime-update', 'runtime-install', 'runtime-restart',
-  'provider-login', 'provider-login-code', 'provider-login-cancel', 'provider-restart',
+  'provider-login', 'provider-login-code', 'provider-login-cancel', 'provider-restart', 'provider-update',
 ]);
 export const DeviceManagementRequest = z.object({
   type: z.literal('device.manage'),
@@ -41,6 +41,7 @@ export const DeviceProviderState = z.object({
   agent: CodingAgent, installed: z.boolean(), version: z.string().max(80).optional(),
   authentication: z.enum(['signed-in', 'signed-out', 'unknown', 'not-installed']),
   loginSupported: z.boolean(), restartSupported: z.boolean(),
+  updateSupported: z.boolean().optional(),
   activeRequests: z.number().int().nonnegative(),
 });
 export const DeviceManagementSnapshot = z.object({