local-operator-ui 0.26.2 → 0.26.4

package/out/main/index.js

@@ -99,6 +99,9 @@ const variableKey = zod.z.string().min(1).max(128).refine(
 ).refine(isAddressableVariableKey);
 const variableType = zod.z.enum(["str", "int", "float", "bool", "list", "dict"]);
 const variableValue = zod.z.string().max(16384);
+const WAKE_MESSAGE_MAX_CHARS = 2e3;
+const wakeMessage = zod.z.string().min(1).max(WAKE_MESSAGE_MAX_CHARS);
+const wakeId = zod.z.string().min(1).max(64);
 const scheduleWrite = zod.z.object({
   is_active: zod.z.boolean().nullish(),
   one_time: zod.z.boolean().nullish(),
@@ -620,6 +623,91 @@ const desktopRequestSchema = zod.z.discriminatedUnion("op", [
     sessionId,
     asideId: requestId
   }).strict(),
+  /*
+   * The wake surface: the Schedules page's machine-wide read and its writes.
+   *
+   * Deliberately NOT an extension of `sessions.*`. The session list is
+   * paginated by recency (`limit ≤ 500`), so a session armed once and never
+   * opened falls off it - and the page whose whole job is "every session that
+   * has wakes" would then list fewer sessions than exist. `wakes.list` reads
+   * the wake index instead, which is one small JSON file per wake-carrying
+   * session and is complete at any store size.
+   *
+   * The four ops sit behind the same router-level desktop bearer as their
+   * `sessions.*` siblings, and every one of them does its filesystem work off
+   * the event loop, so a listing over a cold store cannot stall the desktop
+   * plane's other readers.
+   */
+  zod.z.object({
+    op: zod.z.literal("wakes.list"),
+    /* Bounded like `sessions.list`: the field exists so a pathological
+       store degrades visibly (through `truncated`) rather than silently. */
+    limit: zod.z.number().int().min(1).max(500).optional(),
+    /* Dormant rows are the ones whose session was stopped, which the page
+       SHOWS ("parked") rather than hides: stopping a conversation parks its
+       wakes, and a management surface that dropped them would report a
+       scheduled task as gone when it is only parked. */
+    includeDormant: zod.z.boolean().optional()
+  }).strict(),
+  zod.z.object({
+    op: zod.z.literal("wakes.create"),
+    requestId,
+    /*
+     * The session half of the request is EXACTLY ONE of two shapes: name an
+     * existing `sessionId`, or name a `cwd` (plus an optional `target`) and
+     * have the backend create the conversation and arm the wake in one
+     * call. The exclusivity cannot be stated with a `.refine()` on this
+     * object - that turns the member into a `ZodEffects`, which a
+     * discriminated union cannot take (see `mcp.credentials.store`, which
+     * records the same trap) - so the API client enforces it on the way out
+     * with `wakeCreateBody`, and the backend refuses the malformed shape
+     * with a 422 rather than a 500.
+     */
+    sessionId: sessionId.optional(),
+    cwd: zod.z.string().min(1).max(4096).optional(),
+    target: target.optional(),
+    message: wakeMessage,
+    /*
+     * Timing, in the same spellings the wake tool and `lop wake create`
+     * take, parsed by the backend's own `parse_wake_duration` /
+     * `parse_wake_at`: a relative duration (`30m`), an ISO instant or the
+     * next `HH:MM`. The dialog's presets are `in`/`at` pairs so the common
+     * path never touches a calendar, and `Pick a time…` sends the ISO
+     * instant the picker yields.
+     */
+    in: zod.z.string().min(1).max(64).optional(),
+    at: zod.z.string().min(1).max(64).optional(),
+    every: zod.z.string().min(1).max(64).optional(),
+    until: zod.z.string().min(1).max(64).optional(),
+    limit: zod.z.number().int().min(1).optional(),
+    /*
+     * The conversation's own title, when a caller wants to override the one
+     * derived from the prompt.
+     *
+     * Carried because the interface declares it, and never set by this
+     * page: the prompt IS the name here (the backend writes it into the
+     * session's stored-title sidecar, which `resume.session_name` consults
+     * first), which is what keeps the create flow free of a "name" field
+     * nobody would fill in.
+     */
+    title: zod.z.string().min(1).max(200).optional()
+  }).strict(),
+  zod.z.object({
+    op: zod.z.literal("wakes.edit"),
+    sessionId,
+    wakeId,
+    /* Every field optional, and the body is sent with the absent ones
+       OMITTED rather than nulled: the backend applies the update against
+       the schedule it holds, so a `null` here would be a request to clear
+       a bound the user did not touch. */
+    message: wakeMessage.optional(),
+    in: zod.z.string().min(1).max(64).optional(),
+    at: zod.z.string().min(1).max(64).optional(),
+    every: zod.z.string().min(1).max(64).optional(),
+    until: zod.z.string().min(1).max(64).optional(),
+    limit: zod.z.number().int().min(1).optional()
+  }).strict(),
+  zod.z.object({ op: zod.z.literal("wakes.remove"), sessionId, wakeId }).strict(),
   zod.z.object({ op: zod.z.literal("mcp.list"), sessionId }).strict(),
   zod.z.object({
     op: zod.z.literal("mcp.credentials.store"),
@@ -762,6 +850,82 @@ function desktopRequestByteBudget(op) {
     return DESKTOP_SYSTEM_PROMPT_BYTE_BUDGET;
   return MESSAGE_OPS.has(op) ? DESKTOP_MESSAGE_BYTE_BUDGET : DESKTOP_CONTROL_BYTE_BUDGET;
 }
+const DESKTOP_CONTROL_DEADLINE_MS = 2e4;
+const DESKTOP_LONG_READ_DEADLINE_MS = 9e4;
+const LEDGER_READ_OPS = /* @__PURE__ */ new Set([
+  "analytics.get",
+  "sessions.report"
+]);
+const PROVIDER_READ_OPS = /* @__PURE__ */ new Set(["usage.get"]);
+const LONG_READ_OPS = /* @__PURE__ */ new Set([
+  ...LEDGER_READ_OPS,
+  ...PROVIDER_READ_OPS
+]);
+function desktopRequestDeadlineMs(op) {
+  return LONG_READ_OPS.has(op) ? DESKTOP_LONG_READ_DEADLINE_MS : DESKTOP_CONTROL_DEADLINE_MS;
+}
+const DESKTOP_DEADLINE_EXCEEDED_CODE = "deadline_exceeded";
+const READ_ONLY_OPS = /* @__PURE__ */ new Set([
+  "capabilities",
+  "accounts.list",
+  "analytics.get",
+  "commands.entities",
+  "commands.list",
+  "config.get",
+  "credentials.list",
+  "info.get",
+  "instructions.get",
+  "legacy.agent.get",
+  "legacy.agent.history",
+  "legacy.agent.schedules.list",
+  "legacy.agents.list",
+  "legacy.job.get",
+  "legacy.jobs.list",
+  "legacy.models",
+  "legacy.models.providers",
+  "legacy.schedule.get",
+  "legacy.schedules.list",
+  "mcp.list",
+  "models.catalogue",
+  "profiles.get",
+  "profiles.list",
+  "providers.list",
+  "sessions.aside.get",
+  "sessions.failovers",
+  "sessions.get",
+  "sessions.history",
+  "sessions.list",
+  "sessions.preview",
+  "sessions.report",
+  "sessions.search",
+  "sessions.variables.list",
+  "skills.list",
+  "subagents.transcript",
+  "teams.get",
+  "teams.list",
+  "usage.get"
+]);
+const PANEL_READ_OPS = /* @__PURE__ */ new Set([
+  "analytics.get",
+  "usage.get",
+  "sessions.report",
+  "info.get",
+  "sessions.failovers"
+]);
+function desktopRequestDeadlineDetail(op, deadlineMs) {
+  const seconds = Math.round(deadlineMs / 1e3);
+  const code = DESKTOP_DEADLINE_EXCEEDED_CODE;
+  if (READ_ONLY_OPS.has(op)) {
+    return {
+      code,
+      message: PANEL_READ_OPS.has(op) ? `The app waits up to ${seconds} seconds for this panel's data, and the read was still running when the app stopped waiting. Nothing was read; reopen the panel to ask again.` : `The app waits up to ${seconds} seconds for this read, and it was still running when the app stopped waiting. Nothing was read; ask again.`
+    };
+  }
+  return {
+    code,
+    message: `The app waits up to ${seconds} seconds for this request, and it was still running when the app stopped waiting. It may or may not have reached the server; check the result before repeating it.`
+  };
+}
 const DESKTOP_REQUEST_TOO_LARGE_DETAIL = "This message is too large to send in one request. Remove an image, or split the text across two messages.";
 function desktopRequestTooLargeDetail(op) {
   if (op === "legacy.agent.systemPrompt.update")
@@ -773,6 +937,22 @@ function desktopRequestTooLargeDetail(op) {
   if (MESSAGE_OPS.has(op)) return DESKTOP_REQUEST_TOO_LARGE_DETAIL;
   return "This request is too large to send. Shorten the text in this form.";
 }
+function wakeSessionHalf(request) {
+  if (request.sessionId) return { session_id: request.sessionId };
+  return {
+    ...request.cwd ? { cwd: request.cwd } : {},
+    ...request.target ? { target: request.target } : {}
+  };
+}
+function wakeTiming(request) {
+  return {
+    ...request.in !== void 0 ? { in: request.in } : {},
+    ...request.at !== void 0 ? { at: request.at } : {},
+    ...request.every !== void 0 ? { every: request.every } : {},
+    ...request.until !== void 0 ? { until: request.until } : {},
+    ...request.limit !== void 0 ? { limit: request.limit } : {}
+  };
+}
 function desktopEndpoint(request) {
   switch (request.op) {
     case "capabilities":
@@ -1061,6 +1241,47 @@ function desktopEndpoint(request) {
         method: "GET"
       };
     }
+    /*
+     * The wake routes, mapped beside their `sessions.*` siblings: one op per
+     * method, snake_case on the wire (`include_dormant`, `request_id`), which is
+     * what the backend's models declare.
+     */
+    case "wakes.list": {
+      const query = new URLSearchParams();
+      if (request.limit !== void 0)
+        query.set("limit", String(request.limit));
+      if (request.includeDormant !== void 0)
+        query.set("include_dormant", String(request.includeDormant));
+      return {
+        path: query.size > 0 ? `/v1/desktop/wakes?${query}` : "/v1/desktop/wakes",
+        method: "GET"
+      };
+    }
+    case "wakes.create":
+      return {
+        path: "/v1/desktop/wakes",
+        method: "POST",
+        body: {
+          request_id: request.requestId,
+          ...wakeSessionHalf(request),
+          message: request.message,
+          ...wakeTiming(request)
+        }
+      };
+    case "wakes.edit":
+      return {
+        path: `/v1/desktop/wakes/${request.sessionId}/${request.wakeId}`,
+        method: "PATCH",
+        body: {
+          ...request.message !== void 0 ? { message: request.message } : {},
+          ...wakeTiming(request)
+        }
+      };
+    case "wakes.remove":
+      return {
+        path: `/v1/desktop/wakes/${request.sessionId}/${request.wakeId}`,
+        method: "DELETE"
+      };
     case "legacy.jobs.list": {
       const query = new URLSearchParams();
       if (request.agentId) query.set("agent_id", request.agentId);
@@ -2107,6 +2328,7 @@ async function requestDesktopOutcome(input, backendUrl, token) {
   }
   const target2 = desktopEndpoint(request);
   let answered = false;
+  const deadlineMs = desktopRequestDeadlineMs(request.op);
   try {
     const body = target2.body === void 0 ? void 0 : JSON.stringify(target2.body);
     if (body && Buffer.byteLength(body) > desktopRequestByteBudget(request.op)) {
@@ -2127,7 +2349,7 @@ async function requestDesktopOutcome(input, backendUrl, token) {
       },
       body,
       redirect: "error",
-      signal: AbortSignal.timeout(2e4)
+      signal: AbortSignal.timeout(deadlineMs)
     });
     answered = true;
     const result = response.status === 204 ? null : await response.json();
@@ -2138,7 +2360,24 @@ async function requestDesktopOutcome(input, backendUrl, token) {
       response: { status: response.status, body: result },
       answered: true
     };
-  } catch {
+  } catch (error) {
+    if (deadlineExceeded(error)) {
+      return {
+        response: {
+          status: 504,
+          body: {
+            detail: desktopRequestDeadlineDetail(request.op, deadlineMs)
+          }
+        },
+        /*
+         * Carried through the same way as the 503 below, and it means the same
+         * thing here: an abort during the body read is an answer this process
+         * received and could not finish, which is still liveness evidence, while
+         * an abort that never got a response is not.
+         */
+        answered
+      };
+    }
     return {
       response: {
         status: 503,
@@ -2165,6 +2404,10 @@ async function requestDesktopOutcome(input, backendUrl, token) {
 async function requestDesktop(input, backendUrl, token) {
   return (await requestDesktopOutcome(input, backendUrl, token)).response;
 }
+function deadlineExceeded(error) {
+  const name = error?.name;
+  return name === "TimeoutError" || name === "AbortError";
+}
 function trustedDesktopFrame(actual, expected) {
   try {
     const current = new URL(actual);
@@ -2637,6 +2880,49 @@ function clearPendingInstallMarker(dir) {
   fs.rmSync(path2, { force: true });
   return true;
 }
+const PENDING_SERVER_UPDATE_MARKER_FILE = "pending-server-update.json";
+function pendingServerUpdateMarkerPath(dir) {
+  return path$1.join(dir, PENDING_SERVER_UPDATE_MARKER_FILE);
+}
+function writePendingServerUpdateMarker(dir, marker) {
+  fs.mkdirSync(dir, { recursive: true });
+  const target2 = pendingServerUpdateMarkerPath(dir);
+  const temp = `${target2}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(marker, null, 2)}
+`, "utf8");
+  fs.renameSync(temp, target2);
+  return marker;
+}
+function parsePendingServerUpdateMarker(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.startedAt !== "string" || parsed.startedAt.length === 0) {
+      return null;
+    }
+    return {
+      before: typeof parsed.before === "string" ? parsed.before : null,
+      target: typeof parsed.target === "string" ? parsed.target : null,
+      startedAt: parsed.startedAt
+    };
+  } catch {
+    return null;
+  }
+}
+function readPendingServerUpdateMarker(dir) {
+  const path2 = pendingServerUpdateMarkerPath(dir);
+  if (!fs.existsSync(path2)) return null;
+  try {
+    return parsePendingServerUpdateMarker(fs.readFileSync(path2, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function clearPendingServerUpdateMarker(dir) {
+  const path2 = pendingServerUpdateMarkerPath(dir);
+  if (!fs.existsSync(path2)) return false;
+  fs.rmSync(path2, { force: true });
+  return true;
+}
 const LAST_INSTALL_ATTEMPT_FILE = "last-update-install.json";
 function lastInstallAttemptPath(dir) {
   return path$1.join(dir, LAST_INSTALL_ATTEMPT_FILE);
@@ -3216,6 +3502,33 @@ function pipxListNamesLocalOperator(output) {
 }
 const PYTHON_LIB_DIR = /^python\d/;
 const LOCAL_OPERATOR_DIST_INFO = /^local[-_]operator[-_]/;
+const PYPI_SOURCE_TOKEN = "pypi";
+const SOURCE_MARKER_SEPARATOR = /\s+/;
+function isSourceBuildRef(token) {
+  if (typeof token !== "string") return false;
+  const trimmed = token.trim();
+  if (trimmed.length < 7 || trimmed.length > 40) return false;
+  for (const char of trimmed) {
+    if (!"0123456789abcdefABCDEF".includes(char)) return false;
+  }
+  return trimmed.toLowerCase() !== PYPI_SOURCE_TOKEN;
+}
+function readSourceRef(prefix) {
+  try {
+    const raw = fs.readFileSync(path$1.join(prefix, ".lop-source"), "utf8");
+    const token = raw.split(SOURCE_MARKER_SEPARATOR).filter(Boolean)[0];
+    return token && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+const LOCAL_OPERATOR_DIST_INFO_VERSION = /^local[-_]operator[-_](.+)\.dist-info$/;
+function newerDistInfoVersion(candidate, current) {
+  if (current === null) return true;
+  const order = compareVersions$1(candidate, current);
+  if (order !== null) return order > 0;
+  return compareVersions$1(current, candidate) === null && candidate > current;
+}
 function resolveDistributionMarkers(prefix) {
   const sitePackages = [];
   try {
@@ -3230,6 +3543,7 @@ function resolveDistributionMarkers(prefix) {
   if (fs.existsSync(windowsSitePackages)) sitePackages.push(windowsSitePackages);
   let installer = null;
   let editable = false;
+  let version = null;
   for (const dir of sitePackages) {
     let entries;
     try {
@@ -3241,6 +3555,8 @@ function resolveDistributionMarkers(prefix) {
       if (!LOCAL_OPERATOR_DIST_INFO.test(entry)) continue;
       if (!entry.endsWith(".dist-info")) continue;
       const distInfo = path$1.join(dir, entry);
+      const parsed = LOCAL_OPERATOR_DIST_INFO_VERSION.exec(entry)?.[1]?.trim();
+      if (parsed && newerDistInfoVersion(parsed, version)) version = parsed;
       try {
         const installerText = fs.readFileSync(path$1.join(distInfo, "INSTALLER"), "utf8");
         installer = installerText.trim().toLowerCase() || installer;
@@ -3257,7 +3573,7 @@ function resolveDistributionMarkers(prefix) {
       }
     }
   }
-  return { installer, editable };
+  return { installer, editable, version, sourceRef: readSourceRef(prefix) };
 }
 const TRAILING_SLASHES = /\/+$/;
 function commandSearchDirs(env, home) {
@@ -3279,6 +3595,14 @@ function commandSearchDirs(env, home) {
   add("/bin");
   return dirs;
 }
+function installerSearchPath(env = process.env, home = os.homedir()) {
+  const inherited = (env.PATH ?? "").split(path$1.delimiter).map((dir) => dir.replace(TRAILING_SLASHES, "")).filter((dir) => dir.length > 0);
+  const inheritedSet = new Set(inherited);
+  const ours = commandSearchDirs(env, home).filter(
+    (dir) => !inheritedSet.has(dir)
+  );
+  return [...ours, ...inherited].join(path$1.delimiter);
+}
 function uvToolBinDirs(env, home, listDir, platform) {
   const root = env.UV_TOOL_DIR ?? (env.XDG_DATA_HOME ? path$1.join(env.XDG_DATA_HOME, "uv", "tools") : path$1.join(home, ".local", "share", "uv", "tools"));
   const scriptDir = platform === "win32" ? "Scripts" : "bin";
@@ -3337,6 +3661,23 @@ function resolveCommandPath(name, options = {}) {
   }
   return null;
 }
+function resolveGlobalConsoleScript(options = {}) {
+  if ((options.platform ?? process.platform) === "win32") {
+    const first = (name) => {
+      try {
+        const resolved = node_child_process.execFileSync("where", [name], {
+          encoding: "utf8",
+          timeout: 5e3
+        }).split("\n")[0]?.trim();
+        return resolved && resolved.length > 0 ? resolved : null;
+      } catch {
+        return null;
+      }
+    };
+    return first("local-operator") ?? first("lop");
+  }
+  return resolveCommandPath("local-operator", options) ?? resolveCommandPath("lop", options);
+}
 function readInstallIdentity(shimPath) {
   if (!shimPath) return { path: null };
   let realPath = null;
@@ -3363,9 +3704,30 @@ function readInstallIdentity(shimPath) {
     uvReceipt: existing(path$1.join(prefix, "uv-receipt.toml")),
     venvPrefix: fs.existsSync(path$1.join(prefix, "pyvenv.cfg")) ? prefix : null,
     installer: markers.installer,
-    editable: markers.editable
+    editable: markers.editable,
+    version: markers.version,
+    sourceRef: markers.sourceRef
   };
 }
+function generationInstallRoot(identity) {
+  const resolved = identity.realPath ?? identity.path;
+  if (!resolved) return null;
+  let executable;
+  try {
+    executable = fs.realpathSync(resolved);
+  } catch {
+    return null;
+  }
+  let dir = executable;
+  for (; ; ) {
+    const parent = path$1.dirname(dir);
+    if (parent === dir) return null;
+    if (path$1.basename(parent) === "generations") {
+      return fs.existsSync(path$1.join(path$1.dirname(parent), "current")) ? dir : null;
+    }
+    dir = parent;
+  }
+}
 function classifyGlobalInstall(identity) {
   if (!identity.path) return "global-unknown";
   if (identity.editable) return "editable";
@@ -3386,8 +3748,8 @@ function classifyGlobalInstall(identity) {
 }
 function resolveGlobalInstallPlan(input) {
   const kind = classifyGlobalInstall(input.identity);
-  const sourceBuild = kind === "editable" || kind === "uv-tool" && Boolean(input.lopUpdatePath);
-  const detail = input.identity.path ? `local-operator resolves to ${input.identity.path}${input.identity.realPath && input.identity.realPath !== input.identity.path ? ` (${input.identity.realPath})` : ""}, classified as ${kind}${sourceBuild ? ", built from source on this machine, so it follows the checkout rather than the published release" : ""}` : "local-operator was not found on PATH";
+  const sourceBuild = kind === "editable" || kind === "uv-tool" && isSourceBuildRef(input.identity.sourceRef);
+  const detail = input.identity.path ? `local-operator resolves to ${input.identity.path}${input.identity.realPath && input.identity.realPath !== input.identity.path ? ` (${input.identity.realPath})` : ""}, classified as ${kind}.${kind === "editable" ? " Built from source on this machine, so it follows the checkout rather than the published release." : ""}` : "local-operator was not found on PATH.";
   if (kind === "editable") {
     return {
       canManageUpdate: false,
@@ -3398,12 +3760,33 @@ function resolveGlobalInstallPlan(input) {
     };
   }
   if (kind === "uv-tool") {
-    const useLopUpdate = Boolean(input.lopUpdatePath);
+    const managed = generationInstallRoot(input.identity) !== null;
+    const provenance = sourceBuild ? " Built from source on this machine, so `lop update` installs the published release over it - the harness prints the same notice." : "";
     return {
-      canManageUpdate: false,
-      updateCommand: useLopUpdate ? "lop-update" : "uv tool upgrade local-operator",
-      remedy: useLopUpdate ? "The server is a uv tool install built from source on this machine, so update it from your terminal:" : "The server is a uv tool install, so update it from your terminal:",
-      detail,
+      canManageUpdate: managed,
+      updateCommand: "lop update",
+      /*
+       * The remedy is the sentence above the command well in the by-hand panel
+       * and the consequence line in the managed offer, and each arm says the
+       * thing that decides the reader's next move:
+       *
+       * Managed - what the app is about to do TO THEM. This arm used to tell the
+       * user to go to a terminal on the one path where the app runs the command
+       * itself, which no surface rendered (reviews D7, U7), and the offer named
+       * no cost at all before the click (review U3). The restart is the one
+       * destructive thing this path does, so it is stated here rather than in
+       * the in-flight panel the user reaches only after pressing.
+       *
+       * Legacy - WHY the app will not press the button, which is what the user
+       * is choosing between (reviews U8, N1). It lived only in the mono Details
+       * line, trailing a resolved path and a classification.
+       *
+       * NEITHER ENDS IN A COLON: the well below is visually distinct in both
+       * panels, and in the by-hand panel the next line was the version sentence,
+       * so the promise landed on the wrong line (review D5).
+       */
+      remedy: managed ? "The app updates this install and then restarts the server it started, so a turn that is in flight is dropped while the server comes back. This can take a minute or two." : "This install predates the non-disruptive installer, so update it once from your terminal. This install's updater rewrites the shared environment in place, which can interrupt sessions mid-turn; the app manages updates after that.",
+      detail: `${detail}${provenance}`,
       sourceBuild
     };
   }
@@ -3411,7 +3794,7 @@ function resolveGlobalInstallPlan(input) {
     return {
       canManageUpdate: false,
       updateCommand: "pipx upgrade local-operator",
-      remedy: "The server is a pipx install, so update it from your terminal:",
+      remedy: "The server is a pipx install, so update it from your terminal",
       detail,
       sourceBuild: false
     };
@@ -3420,7 +3803,7 @@ function resolveGlobalInstallPlan(input) {
     return {
       canManageUpdate: false,
       updateCommand: "pip install --upgrade local-operator",
-      remedy: "The server is a pip install, so update it from your terminal:",
+      remedy: "The server is a pip install, so update it from your terminal",
       detail,
       sourceBuild: false
     };
@@ -3428,7 +3811,7 @@ function resolveGlobalInstallPlan(input) {
   return {
     canManageUpdate: false,
     updateCommand: "",
-    remedy: "The app could not tell how this server was installed, so update it with the tool you installed it with - uv, pipx or pip:",
+    remedy: "The app could not tell how this server was installed, so update it with the tool you installed it with - uv, pipx or pip",
     detail,
     sourceBuild: false
   };
@@ -3465,9 +3848,11 @@ function parsePipShowVersion(stdout) {
 function didUpgradeLand(input) {
   const { before, after, target: target2 } = input;
   if (after == null) return false;
-  if (before == null) {
-    return target2 != null && after.trim() === target2.trim();
+  if (target2 != null) {
+    const order = compareVersions$1(after, target2);
+    return order !== null && order >= 0;
   }
+  if (before == null) return false;
   return before.trim() !== after.trim();
 }
 const launchEnv = {
@@ -5393,8 +5778,6 @@ var LocalOperatorStartupMode = /* @__PURE__ */ ((LocalOperatorStartupMode2) => {
   LocalOperatorStartupMode2["NOT_STARTED"] = "NOT_STARTED";
   return LocalOperatorStartupMode2;
 })(LocalOperatorStartupMode || {});
-const CONSOLE_DISCOVERY_TIMEOUT_MS = 5e3;
-const CONSOLE_RESOLUTION_WORST_MS = 2 * CONSOLE_DISCOVERY_TIMEOUT_MS;
 const SHUTDOWN_TIMEOUT_DEFAULTS = {
   restart: 1e4,
   // 10 seconds for restart operations
@@ -5408,7 +5791,6 @@ const READINESS_POLL_INTERVAL_MS = 1e3;
 const DESKTOP_TOKEN_FILENAME = "desktop-token";
 const execPromise = node_util.promisify(node_child_process.exec);
 const ENV_VAR_REGEX = /^([^=]+)=(.*)$/;
-const LINE_BREAK = /\r?\n/;
 function classifyDesktopAnswer(status2) {
   if (status2 >= 200 && status2 < 300) return "accepted";
   if (status2 === 401 || status2 === 403) return "refused";
@@ -6093,59 +6475,75 @@ class BackendServiceManager {
     }
     this.notifyStatus();
   }
+  /**
+   * The global launcher this app ranks its daemons by, spawns from, and reports.
+   *
+   * ONE resolution, read by `checkLocalOperatorExists`, `resolveGlobalConsole`
+   * and `preferredInstallPrefix`, because the three have to name the same
+   * install: the decision to run GLOBAL_INSTALL is only true if the spawn can
+   * resolve that same launcher, and a second resolution through a different
+   * mechanism is exactly how a shell rc file's prepended venv becomes the thing
+   * that gets spawned while the ranking talked about a different one.
+   *
+   * `resolveCommandPath`, NOT `which`. WHY, measured on this host 2026-09-16: the
+   * app is started by LaunchServices, whose PATH is `/usr/bin:/bin:/usr/sbin:/sbin`,
+   * and an app launched from a session that carries its own minimal PATH inherits
+   * that. `~/.local/bin` - where uv and pipx link their console scripts, and where
+   * this machine's `lop-update` install lives - is on neither. So the shell probe
+   * this replaced answered "not found globally" on every ordinary launch, and the
+   * app fell through to its OWN bundled environment: it ran a backend the
+   * operator never updates, watched it diverge from `lop --version` (0.55.9
+   * bundled against 0.55.10 installed), and offered to `pip install` into a uv
+   * tool. `resolveCommandPath` searches the installers' own locations
+   * (`UV_TOOL_BIN_DIR`, `XDG_BIN_HOME`, `$XDG_DATA_HOME/../bin`, `~/.local/bin`,
+   * the Homebrew prefixes and every uv tool environment) as well as the inherited
+   * PATH, so the same install is named with or without a shell - which is the
+   * ranking rule `preferredInstallPrefix` states, and precisely what a
+   * `which`-based check could not honour.
+   *
+   * `local-operator` before `lop`: both are console scripts of the same install
+   * and normally sit in the same bin directory, but the spawn reads the resolved
+   * script's shebang and refuses anything that is not a
+   * `from local_operator.cli import main` launcher (`consoleInterpreter`), so the
+   * name this app has always spawned is tried first and `lop` covers an install
+   * whose older console script is gone.
+   */
+  globalConsoleScript() {
+    return resolveGlobalConsoleScript();
+  }
   /**
    * Check if the local-operator command exists globally
    * @returns Promise resolving to true if the command exists, false otherwise
    */
   async checkLocalOperatorExists() {
-    try {
-      const command = process.platform === "win32" ? "where local-operator" : "which local-operator";
+    const command = this.globalConsoleScript();
+    if (!command) {
       logger.info(
-        `Checking if local-operator command exists: ${command}`,
+        "local-operator command not found globally",
         LogFileType.BACKEND
       );
-      const { stdout } = await execPromise(command, {
-        // Bounded: a quit that arrives mid-start waits on this same path, and an
-        // unbounded child here is a wait with nothing underneath it.
-        timeout: CONSOLE_DISCOVERY_TIMEOUT_MS,
-        windowsHide: true
-      });
-      if (stdout.trim()) {
-        if (process.platform === "darwin" && isLegacyManagedCommand(
-          stdout.trim().split("\n")[0],
-          path$1.join(
-            electron.app.getPath("home"),
-            "Library",
-            "Application Support",
-            "Local Operator"
-          )
-        )) {
-          logger.info(
-            "The PATH command belongs to a legacy managed environment; preparing a separate backend instead",
-            LogFileType.BACKEND
-          );
-          return false;
-        }
-        logger.info(
-          `local-operator command found at: ${stdout.trim()}`,
-          LogFileType.BACKEND
-        );
-        return true;
-      }
-    } catch (_error) {
+      return false;
+    }
+    if (process.platform === "darwin" && isLegacyManagedCommand(
+      command,
+      path$1.join(
+        electron.app.getPath("home"),
+        "Library",
+        "Application Support",
+        "Local Operator"
+      )
+    )) {
       logger.info(
-        "local-operator command not found globally",
+        `The resolved command belongs to a legacy managed environment (${command}); preparing a separate backend instead`,
         LogFileType.BACKEND
       );
+      return false;
     }
-    return false;
-  }
-  /**
-   * Check if the local-operator command exists globally
-   * @returns Promise resolving to true if the command exists, false otherwise
-   */
-  canonicalLauncher() {
-    return resolveCommandPath("lop") ?? resolveCommandPath("local-operator");
+    logger.info(
+      `local-operator command found at: ${command}`,
+      LogFileType.BACKEND
+    );
+    return true;
   }
   /**
    * `sys.prefix` of the install the user's own `lop` runs, when it can be named.
@@ -6160,7 +6558,7 @@ class BackendServiceManager {
    */
   preferredInstallPrefix() {
     try {
-      const identity = readInstallIdentity(this.canonicalLauncher());
+      const identity = readInstallIdentity(this.globalConsoleScript());
       if (identity.uvReceipt) return path$1.dirname(identity.uvReceipt);
       if (identity.venvPrefix) return identity.venvPrefix;
       return null;
@@ -6539,14 +6937,32 @@ class BackendServiceManager {
    * Start the backend service
    * @returns Promise resolving to true if the backend was started successfully, false otherwise
    */
-  /** Keep PATH discovery authoritative; `ownedServeLaunch` proves the identity
-   * of what it found rather than trusting the name it was resolved under. */
-  async resolveGlobalConsole(env) {
-    const { stdout } = await execPromise(
-      process.platform === "win32" ? "where local-operator" : "which local-operator",
-      { env, timeout: CONSOLE_DISCOVERY_TIMEOUT_MS }
-    );
-    return stdout.trim().split(LINE_BREAK)[0];
+  /** The global console to launch, resolved the one shell-free way.
+   *
+   * `ownedServeLaunch` still proves the identity of what it is handed rather than
+   * trusting the name it was resolved under - that part is unchanged. What
+   * changed is WHERE the name comes from: this method used to re-resolve a bare
+   * `local-operator` through a shell, in the spawn environment that carries the
+   * login shell's PATH. That is the second resolution `globalConsoleScript`
+   * warns about, and it could name a venv a shell rc file prepends while the
+   * decision above had ranked the operator's real install - two answers to one
+   * question, with the spawn using the one the ranking never saw. Reading the
+   * same helper removes the possibility instead of documenting it.
+   *
+   * The throw is reachable only when the resolution succeeded a moment ago and
+   * the install disappeared since. It is deliberately not swallowed into an
+   * empty string: `consoleInterpreter("")` would report that as an ENOENT on a
+   * path nobody printed, and the caller's own failure report is the honest face
+   * of this.
+   */
+  async resolveGlobalConsole() {
+    const command = this.globalConsoleScript();
+    if (!command) {
+      throw new Error(
+        "No global local-operator command could be resolved, though one was found a moment ago"
+      );
+    }
+    return command;
   }
   /**
    * Start a daemon this app owns, or attach to one that already exists.
@@ -6619,7 +7035,7 @@ class BackendServiceManager {
       let interpreters;
       if (globalInstall) {
         this.startupMode = "GLOBAL_INSTALL";
-        const executable = await this.resolveGlobalConsole(env);
+        const executable = await this.resolveGlobalConsole();
         interpreters = process.platform === "win32" ? await windowsInterpreterCandidates(executable, env) : [consoleInterpreter(executable)];
       } else {
         this.startupMode = "APP_BUNDLED_VENV";
@@ -7383,6 +7799,20 @@ class BackendServiceManager {
   getOwnedPid() {
     return this.process?.pid ?? null;
   }
+  /**
+   * The address this app is talking to RIGHT NOW.
+   *
+   * Not the configured target: `attachTo` rotates `backendUrl` onto the daemon
+   * discovery adopted, and everything that queries the backend resolves against
+   * it at call time. A consumer that instead read the configured URL described a
+   * daemon the app is not talking to - the update service's `/health` read did
+   * exactly that, so for an adopted daemon every version read failed and the
+   * panel could neither name the build being served nor report the skew after an
+   * install moved (QA Q-2, UX U1).
+   */
+  getBackendUrl() {
+    return this.backendUrl;
+  }
   /**
    * Check if the backend service is using an external backend
    * @returns True if using an external backend, false if we started our own
@@ -15410,6 +15840,9 @@ function runCommand(command, args, options = {}) {
     );
   });
 }
+function serverUpdateLogPath() {
+  return path$1.join(logger.getLogPath(), LogFileType.UPDATE_SERVICE);
+}
 function readCommandOutput(command, args) {
   try {
     const output = node_child_process.execFileSync(command, args, {
@@ -15421,6 +15854,11 @@ function readCommandOutput(command, args) {
     return null;
   }
 }
+const INSTALLER_PROBE_TIMEOUT_MS = 5e3;
+function stderrTail(stderr, maxLines = 4) {
+  const lines = stderr.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+  return lines.slice(-maxLines).join("\n").slice(-600);
+}
 class UpdateService {
   mainWindow = null;
   isDevMode;
@@ -17266,19 +17704,39 @@ ${heal.removed.join("\n")}`,
     if (v1PreRelease && !v2PreRelease) return false;
     return v1PreRelease > v2PreRelease;
   }
+  /**
+   * The address every backend read in this service goes to.
+   *
+   * The manager's LIVE address rather than the configured one: an adopted daemon
+   * is discovered at a port the configuration never named, and the manager rotates
+   * its own `backendUrl` onto it when it attaches. Reading the configured URL
+   * instead made every health read fail for exactly the shape this branch adds -
+   * a daemon the app did not start - so the skew after an install moved degraded
+   * to "no reading" on the one path where that sentence is the only report the
+   * user gets, while Settings could name the same daemon's version a few clicks
+   * away (QA Q-2, UX U1).
+   *
+   * The configured URL stays as the fallback for the frames where no manager is
+   * attached yet - the update service is constructed before it in the app's start
+   * path.
+   */
+  liveBackendUrl() {
+    return this.backendService?.getBackendUrl() ?? this.backendUrl;
+  }
   /**
    * Get the installed backend version using the health API
    * @returns Promise resolving to the installed version or null if not found
    */
   async getInstalledBackendVersion() {
     try {
+      const backendUrl = this.liveBackendUrl();
       logger.info(
-        `Checking backend version from health API at ${this.backendUrl}/health`,
+        `Checking backend version from health API at ${backendUrl}/health`,
         LogFileType.UPDATE_SERVICE
       );
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 5e3);
-      const response = await fetch(`${this.backendUrl}/health`, {
+      const response = await fetch(`${backendUrl}/health`, {
         method: "GET",
         headers: { Accept: "application/json" },
         signal: controller.signal
@@ -17310,9 +17768,10 @@ ${heal.removed.join("\n")}`,
         LogFileType.UPDATE_SERVICE,
         error
       );
-      if (this.backendUrl.includes("127.0.0.1")) {
+      const retryUrl = this.liveBackendUrl();
+      if (retryUrl.includes("127.0.0.1")) {
         try {
-          const altUrl = this.backendUrl.replace("127.0.0.1", "localhost");
+          const altUrl = retryUrl.replace("127.0.0.1", "localhost");
           logger.info(
             `Trying alternative URL: ${altUrl}/health`,
             LogFileType.UPDATE_SERVICE
@@ -17433,12 +17892,10 @@ ${heal.removed.join("\n")}`,
    */
   async resolveBackendUpdatePlan(startupMode) {
     if (startupMode === LocalOperatorStartupMode.EXISTING_SERVER || startupMode === LocalOperatorStartupMode.GLOBAL_INSTALL) {
-      const plan = resolveGlobalInstallPlan({
-        identity: this.resolveInstallIdentity(),
-        lopUpdatePath: this.resolveLopUpdatePath()
-      });
+      const identity = await this.resolveInstallIdentity();
+      const plan = resolveGlobalInstallPlan({ identity });
       logger.info(
-        `External backend install (${startupMode}): ${plan.detail}; remedy is \`${plan.updateCommand || "nothing the app can name"}\``,
+        `External backend install (${startupMode}): ${plan.detail}; remedy is \`${plan.updateCommand || "nothing the app can name"}\`; install version ${identity.version ?? "unreadable"}`,
         LogFileType.UPDATE_SERVICE
       );
       return {
@@ -17446,7 +17903,8 @@ ${heal.removed.join("\n")}`,
         updateCommand: plan.updateCommand,
         remedy: plan.remedy,
         detail: plan.detail,
-        sourceBuild: plan.sourceBuild
+        sourceBuild: plan.sourceBuild,
+        installedInstallVersion: identity.version ?? null
       };
     }
     return {
@@ -17454,7 +17912,8 @@ ${heal.removed.join("\n")}`,
       updateCommand: "pip install --upgrade local-operator",
       remedy: "Updating the server will improve AI functionality.",
       detail: `The app started this server itself (${startupMode}).`,
-      sourceBuild: false
+      sourceBuild: false,
+      installedInstallVersion: null
     };
   }
   /**
@@ -17473,25 +17932,7 @@ ${heal.removed.join("\n")}`,
    * searches the machine's and the user's own install locations.
    */
   resolveLocalOperatorPath() {
-    if (process.platform === "win32") {
-      const first = readCommandOutput("where", ["local-operator"])?.split("\n")[0]?.trim();
-      return first && first.length > 0 ? first : null;
-    }
-    return resolveCommandPath("local-operator");
-  }
-  /**
-   * Path the `lop-update` shim resolves to, or null when this machine has none.
-   *
-   * The same problem as the shim above, for the remedy rather than the
-   * classification: `lop-update` is what the source-build wording tells the user
-   * to run, and it lives in `~/.local/bin`, which a Finder launch cannot see
-   * through PATH alone - so the plan fell back to the pip/pipx wording for an
-   * install that is neither. It is a shell script, so there is no Windows
-   * counterpart to look for.
-   */
-  resolveLopUpdatePath() {
-    if (process.platform === "win32") return null;
-    return resolveCommandPath("lop-update");
+    return resolveGlobalConsoleScript();
   }
   /**
    * Everything `classifyGlobalInstall` needs to tell a uv tool install from a
@@ -17503,17 +17944,44 @@ ${heal.removed.join("\n")}`,
    * answered: spawning `uv` and `pipx` on every backend check for a question
    * three string tests settled is work nobody asked for.
    */
-  resolveInstallIdentity() {
+  async resolveInstallIdentity() {
     const identity = readInstallIdentity(this.resolveLocalOperatorPath());
     if (identity.path && classifyGlobalInstall(identity) !== "global-unknown") {
       return identity;
     }
     const uv = resolveCommandPath("uv");
     const pipx = resolveCommandPath("pipx");
-    identity.uvToolList = uv ? readCommandOutput(uv, ["tool", "list"]) : null;
-    identity.pipxList = pipx ? readCommandOutput(pipx, ["list"]) : null;
+    const [uvToolList, pipxList] = await Promise.all([
+      uv ? this.probeInstallerList(uv, ["tool", "list"]) : null,
+      pipx ? this.probeInstallerList(pipx, ["list"]) : null
+    ]);
+    identity.uvToolList = uvToolList;
+    identity.pipxList = pipxList;
     return identity;
   }
+  /**
+   * What an installer's own list command answers, or null.
+   *
+   * ASYNC, and that is the R1-4 fix: this runs on every backend check for an
+   * install the three string tests cannot classify, and the synchronous form of it
+   * blocked the main thread for up to 5 s per probe - 10 s for the pair, with the
+   * window and every IPC channel frozen behind it. Review R1-4 measured it; the
+   * answer is identical, only the waiting is not done on the event loop.
+   *
+   * `runCommand` rather than a second runner, and with `pythonSpawnEnv()`: `uv` and
+   * `pipx` are python programs, so they get the same guarded environment every
+   * other python spawn here passes - which is what keeps bytecode they write out
+   * of the installed app.
+   */
+  async probeInstallerList(command, args) {
+    const result = await runCommand(command, args, {
+      timeoutMs: INSTALLER_PROBE_TIMEOUT_MS,
+      env: this.pythonSpawnEnv()
+    });
+    if (!result.ran) return null;
+    const output = result.stdout.trim();
+    return output.length > 0 ? output : null;
+  }
   /**
    * Check the installed server against the published release.
    *
@@ -17528,6 +17996,7 @@ ${heal.removed.join("\n")}`,
       `Checking for backend updates... (silent mode: ${silent})`,
       LogFileType.UPDATE_SERVICE
     );
+    await this.reportUnattendedServerUpdate();
     try {
       if (this.isDevMode) {
         logger.info(
@@ -17557,9 +18026,12 @@ ${heal.removed.join("\n")}`,
         );
         return { status: "unavailable", info: null };
       }
-      const installedVersion = await this.getInstalledBackendVersion();
+      const plan = await this.resolveBackendUpdatePlan(startupMode);
+      const runningVersion = await this.getInstalledBackendVersion();
       const latestVersion = await this.getLatestPypiVersion();
       if (latestVersion) this.lastPublishedBackendVersion = latestVersion;
+      const installVersion = plan.installedInstallVersion;
+      const installedVersion = installVersion && isReadableVersion(installVersion) ? installVersion : runningVersion;
       if (!installedVersion || !latestVersion) {
         logger.error(
           "Unable to determine backend versions.",
@@ -17568,7 +18040,8 @@ ${heal.removed.join("\n")}`,
         if (reportFailure) {
           this.sendToRenderer("backend-update-error", {
             message: "Unable to determine backend version.",
-            phase: "check"
+            phase: "check",
+            logPath: serverUpdateLogPath()
           });
         }
         return { status: "unavailable", info: null };
@@ -17581,7 +18054,8 @@ ${heal.removed.join("\n")}`,
         if (reportFailure) {
           this.sendToRenderer("backend-update-error", {
             message: "The installed server version could not be determined, so no update was offered. Restart the app to try again.",
-            phase: "check"
+            phase: "check",
+            logPath: serverUpdateLogPath()
           });
         }
         return { status: "unavailable", info: null };
@@ -17600,12 +18074,17 @@ ${heal.removed.join("\n")}`,
         if (reportFailure) {
           this.sendToRenderer("backend-update-error", {
             message: "Unable to determine backend version.",
-            phase: "check"
+            phase: "check",
+            logPath: serverUpdateLogPath()
           });
         }
         return { status: "unavailable", info: null };
       }
       const shouldUpdate = this.isNewerVersion(latestVersion, installedVersion);
+      logger.info(
+        `Install on disk reports: ${installVersion ?? "no reading"}, running backend reports: ${runningVersion ?? "no reading"}, Latest: ${latestVersion}, Update needed: ${shouldUpdate}, Startup mode: ${startupMode}`,
+        LogFileType.UPDATE_SERVICE
+      );
       logger.info(
         `Installed backend version: ${installedVersion}, Latest: ${latestVersion}, Update needed: ${shouldUpdate}, Startup mode: ${startupMode}`,
         LogFileType.UPDATE_SERVICE
@@ -17615,16 +18094,29 @@ ${heal.removed.join("\n")}`,
           `New backend version available: ${latestVersion} (installed: ${installedVersion})`,
           LogFileType.UPDATE_SERVICE
         );
-        const { canManageUpdate, updateCommand, remedy, detail, sourceBuild } = await this.resolveBackendUpdatePlan(startupMode);
         const updateInfo = {
           currentVersion: installedVersion,
           latestVersion,
-          updateCommand,
-          canManageUpdate,
+          runningVersion,
+          updateCommand: plan.updateCommand,
+          canManageUpdate: plan.canManageUpdate,
           startupMode,
-          remedy,
-          detail,
-          sourceBuild,
+          remedy: plan.remedy,
+          detail: plan.detail,
+          sourceBuild: plan.sourceBuild,
+          /*
+           * WHO THE APP WOULD RESTART, on the panel where the user decides (UX U9).
+           *
+           * The managed arm's consequence sentence comes from the plan, and the plan is
+           * an INSTALL classification - it cannot know whether the daemon serving this
+           * app is one the app started. On a machine where discovery ADOPTED a server,
+           * the offer therefore promised a restart that cannot happen, and the app's
+           * own completion notice then said the opposite ("Local Operator does not
+           * restart a server it did not start"). The sentence is right for the arm it
+           * was written for; what was missing is the reading that decides it, which the
+           * other two events already carry. It travels here too.
+           */
+          restartable: this.backendIsAppOwned(),
           /* `silent` is the whole difference between the two callers: the periodic
              and start-up checks pass `true`, the IPC handlers behind the buttons
              pass `false`. The renderer needs to know which one it is answering,
@@ -17644,9 +18136,23 @@ ${heal.removed.join("\n")}`,
         `No new backend version available. (installed: ${installedVersion}, latest: ${latestVersion})`,
         LogFileType.UPDATE_SERVICE
       );
-      if (!silent && this.mainWindow && !this.mainWindow.isDestroyed() && this.mainWindow.webContents && !this.mainWindow.webContents.isDestroyed()) {
+      const readingsDiffer = installedVersion !== null && runningVersion !== null && isReadableVersion(installedVersion) && isReadableVersion(runningVersion) && installedVersion.trim() !== runningVersion.trim();
+      if ((!silent || readingsDiffer) && this.mainWindow && !this.mainWindow.isDestroyed() && this.mainWindow.webContents && !this.mainWindow.webContents.isDestroyed()) {
         this.mainWindow.webContents.send("backend-update-not-available", {
-          version: installedVersion
+          version: installedVersion,
+          /*
+           * The second reading travels on THIS state too, which is the one QA
+           * Q-1 found: an install already at the published version whose daemon
+           * still serves the old build offers nothing, so the offer's detail was
+           * never rendered and the user was told nothing at all - while the log
+           * carried both readings and Settings could name the daemon. It is the
+           * state design §5 exists for (right after a landed install, before the
+           * restart), and no later check re-offers it, because the install itself
+           * is up to date.
+           */
+          runningVersion,
+          /** Whether the app may restart the daemon that is behind. */
+          restartable: this.backendIsAppOwned()
         });
       }
       return { status: "current", info: null };
@@ -17666,7 +18172,8 @@ ${heal.removed.join("\n")}`,
            * keeps that sentence's machine line readable.
            */
           message: stripErrorPrefixes(error.message),
-          phase: "check"
+          phase: "check",
+          logPath: serverUpdateLogPath()
         });
       }
       return { status: "unavailable", info: null };
@@ -17735,7 +18242,11 @@ ${heal.removed.join("\n")}`,
       const version = await this.getInstalledBackendVersion();
       if (version && version !== "Unknown") {
         last = version;
-        if (target2 == null || version === target2) return version;
+        if (target2 == null) return version;
+        const order = compareVersions$1(version, target2);
+        if (order === null ? version.trim() === target2.trim() : order >= 0) {
+          return version;
+        }
       }
       await new Promise((resolve) => setTimeout(resolve, intervalMs));
     }
@@ -17745,6 +18256,281 @@ ${heal.removed.join("\n")}`,
     );
     return null;
   }
+  /**
+   * Whether the daemon serving this app is one the APP may restart.
+   *
+   * The answer decides what the skew notice can tell the user to do about a server
+   * still on the old build: an owned daemon is the app's to bounce (so the sentence
+   * names restarting Local Operator, which is an action), while an adopted one is
+   * not (so the sentence says the app will not, which is a fact about what the
+   * reader should expect). Getting this wrong is not cosmetic - the notice would
+   * tell a user of an app-owned daemon that nothing will ever move it.
+   */
+  backendIsAppOwned() {
+    return this.backendService !== null && !this.backendService.isUsingExternalBackend();
+  }
+  /**
+   * The version the resolved global install reports on disk, or null.
+   *
+   * Shell-free, and deliberately a different read from the running backend's
+   * `/health`: the install is what an update moves, and immediately after one it
+   * is the only reading that has moved - the daemon lags until it is restarted.
+   * Read through the same resolution the plan classified, because it is half of
+   * the evidence that the install changed at all.
+   */
+  readGlobalInstallVersion() {
+    return readInstallIdentity(this.resolveLocalOperatorPath())?.version ?? null;
+  }
+  /**
+   * Run the install's own front end: `<resolved shim> update`.
+   *
+   * WHY THIS AND NOT AN INSTALLER. The mechanism that owns a uv tool install is
+   * `lop update`: it detects the install kind, honours the `editable`/`unknown`
+   * refusals, writes the `.lop-source` marker runtimes converge on, prunes the
+   * generations nothing refers to, and refreshes the daemons it supervises. An
+   * app that ran `uv` itself would bypass every one of those, and the two
+   * commands this path used to name are the ones the harness documents as
+   * failing (`uv tool upgrade` on a pinned receipt or a git snapshot) or as
+   * belonging to another audience (`lop-update`, the release owner's
+   * build-from-checkout script, which refuses when its ref has diverged).
+   *
+   * THE PATH IS BUILT, NOT INHERITED. `lop update` reaches `uv` by bare name
+   * through the child's environment, and this app is normally launched by Finder
+   * with `/usr/bin:/bin:/usr/sbin:/sbin` - on this machine `uv` is
+   * `/opt/homebrew/bin/uv`. Without `installerSearchPath` the feature fails with
+   * an `installer exited 127` that reads as an installer bug.
+   *
+   * The cwd is the user's home: a neutral directory, never the app's resources
+   * dir, so an installer that resolves a relative path from where it stands
+   * cannot land inside the sealed bundle. `shell: true` is never used - this is a
+   * resolved shim path, not a command line.
+   */
+  async runGlobalUpdate(consolePath) {
+    const updatePath = installerSearchPath(process.env, os.homedir());
+    logger.info(
+      `Executing the install's own updater: ${consolePath} update (PATH: ${updatePath})`,
+      LogFileType.UPDATE_SERVICE
+    );
+    const run = await runCommand(consolePath, ["update"], {
+      timeoutMs: 15 * 60 * 1e3,
+      env: { ...this.pythonSpawnEnv(), PATH: updatePath }
+    });
+    logger.info(
+      `lop update stdout: ${run.stdout.trim() || "(empty)"}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    if (run.stderr.trim().length > 0) {
+      logger.warn(
+        `lop update stderr: ${run.stderr.trim()}`,
+        LogFileType.UPDATE_SERVICE
+      );
+    }
+    return run;
+  }
+  /**
+   * True while an app-driven update of the global install is running.
+   *
+   * The guard is here and not on the surfaces that ask for the update, because
+   * their flags are per-surface: the offer holds `checking` and the run panel holds
+   * `updatingBackend`, so a press on each of them reached `updateGlobalInstall`
+   * twice and the second `lop update` ran beside the first against one install root
+   * (review R1-8). The bundled path never needed one because it stops the backend
+   * first, which serialises it by accident; nothing on this path stops anything.
+   */
+  globalUpdateInFlight = false;
+  /**
+   * Update the resolved global install, then restart the daemon this app owns.
+   *
+   * ORDERING IS THE POINT, and it is the opposite of the bundled path: that one
+   * stops the backend BEFORE pip because pip replaces the environment the daemon
+   * runs from. Under generations the install lands in a new tree, the pointer
+   * flips, and no running process's tree is touched - so the install cannot fail
+   * the daemon, and stopping first would throw away in-flight work for the whole
+   * install to buy nothing. Install, verify, restart. A failed install therefore
+   * leaves a daemon that never stopped serving.
+   *
+   * `landed` is a READING, not an exit code: `lop update` exits 0 in its "already
+   * latest" case too, so the app holds the install's own version to the target
+   * exactly as the pip path does (`didUpgradeLand`).
+   */
+  async updateGlobalInstall(backend, plan, target2) {
+    if (this.globalUpdateInFlight) {
+      logger.warn(
+        "A global install update is already running; refusing to start a second beside it",
+        LogFileType.UPDATE_SERVICE
+      );
+      this.sendToRenderer("backend-update-error", {
+        message: "A server update is already running. Let it finish before starting another.",
+        phase: "update",
+        logPath: serverUpdateLogPath()
+      });
+      return false;
+    }
+    this.globalUpdateInFlight = true;
+    try {
+      return await this.runGlobalUpdateAttempt(backend, plan, target2);
+    } finally {
+      this.globalUpdateInFlight = false;
+    }
+  }
+  /** The attempt itself, under the guard above. */
+  async runGlobalUpdateAttempt(backend, plan, target2) {
+    const consolePath = this.resolveLocalOperatorPath();
+    if (!consolePath) {
+      this.sendToRenderer("backend-update-error", {
+        message: "The global install could not be found on this machine, so the update did not run. See the update service log.",
+        phase: "update",
+        logPath: serverUpdateLogPath()
+      });
+      return false;
+    }
+    const before = this.readGlobalInstallVersion() ?? plan.installedInstallVersion;
+    this.sendToRenderer("backend-update-progress", { phase: "installing" });
+    writePendingServerUpdateMarker(this.markerDir(), {
+      before,
+      target: target2,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const run = await this.runGlobalUpdate(consolePath);
+    const after = this.readGlobalInstallVersion();
+    clearPendingServerUpdateMarker(this.markerDir());
+    const landed = run.exitCode === 0 && didUpgradeLand({ before, after, target: target2 });
+    if (!landed) {
+      const running = await this.getInstalledBackendVersion();
+      const tail = stderrTail(run.stderr);
+      logger.error(
+        `Global install update did not land (exited ${run.exitCode}, ran ${run.ran}): ${before ?? "unknown"} -> ${after ?? "unknown"}, running backend reports ${running ?? "no reading"}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      this.sendToRenderer("backend-update-error", {
+        message: `${!run.ran ? "The server update did not finish: the installer could not be run to a verdict or timed out." : run.exitCode !== 0 ? `The server update did not install: \`lop update\` exited ${run.exitCode}.` : `The server update to ${target2 ?? "the new release"} did not take effect: the install still reports ${after ?? before ?? "its previous version"}.`} The running backend is still serving${running ? ` version ${running}` : ""}; see the update service log for the installer's output.${tail ? `
+
+${tail}` : ""}`,
+        phase: "update",
+        logPath: serverUpdateLogPath()
+      });
+      return false;
+    }
+    logger.info(
+      `Global install updated: ${before ?? "unknown"} -> ${after ?? "unknown"}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    if (backend.isUsingExternalBackend()) {
+      const running = await this.getInstalledBackendVersion();
+      logger.info(
+        `Install moved to ${after ?? "unknown"}; the attached backend still reports ${running ?? "no reading"}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      this.sendToRenderer("backend-update-completed", {
+        installVersion: after,
+        runningVersion: running,
+        restarted: false,
+        restartable: this.backendIsAppOwned()
+      });
+      return true;
+    }
+    logger.info(
+      "Restarting backend service onto the updated install...",
+      LogFileType.UPDATE_SERVICE
+    );
+    this.sendToRenderer("backend-update-progress", { phase: "restarting" });
+    backend.setAutoUpdating(true);
+    const restartSuccess = await backend.restart();
+    backend.setAutoUpdating(false);
+    if (!restartSuccess) {
+      logger.error(
+        "Backend service restart failed after the global install update",
+        LogFileType.UPDATE_SERVICE
+      );
+      this.sendToRenderer("backend-update-error", {
+        message: "The server was updated but the backend did not restart. Restart Local Operator to run the new version.",
+        phase: "update",
+        logPath: serverUpdateLogPath()
+      });
+      return false;
+    }
+    const healthy = await this.checkBackendHealth();
+    if (!healthy) {
+      logger.error(
+        "Backend service restarted but the health check failed; retrying once",
+        LogFileType.UPDATE_SERVICE
+      );
+      await backend.start();
+      if (!await this.checkBackendHealth()) {
+        this.sendToRenderer("backend-update-error", {
+          message: "The server was updated but the backend did not restart properly. Restart Local Operator to run the new version.",
+          phase: "update",
+          logPath: serverUpdateLogPath()
+        });
+        return false;
+      }
+    }
+    const reported = await this.waitForBackendVersion(target2);
+    if (reported === null) {
+      logger.error(
+        `Backend restarted onto the updated install but did not report ${target2 ?? "the target version"}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      this.sendToRenderer("backend-update-error", {
+        message: `The server restarted but did not report ${target2 ? `version ${target2}` : "the updated version"}. See the update service log, then restart Local Operator.`,
+        phase: "update",
+        logPath: serverUpdateLogPath()
+      });
+      return false;
+    }
+    logger.info(
+      `Backend reports version ${reported} after the global install update`,
+      LogFileType.UPDATE_SERVICE
+    );
+    this.sendToRenderer("backend-update-completed", {
+      installVersion: after,
+      runningVersion: reported,
+      restarted: true
+    });
+    return true;
+  }
+  /**
+   * Report a server update that landed while no app was supervising it.
+   *
+   * The other half of UX U6: the marker above survives exactly when the app died
+   * mid-attempt, and the installer is a child that outlives its parent, so the
+   * update can land with nothing watching. The end state is coherent on its own -
+   * the app comes up on the new build and reports it - which is why this reports
+   * the fact ONCE rather than treating a stale marker as a failure: there is no
+   * remedy to offer and no version to hold anyone to, only a sentence the user has
+   * never seen about an update they started.
+   *
+   * Cleared either way: a marker whose install did NOT move describes an
+   * interrupted attempt whose reason is in the log, and re-reporting it on every
+   * launch would be a permanent warning about a state the app has since read
+   * correctly (and the failure path keeps no record for the app to re-read).
+   */
+  async reportUnattendedServerUpdate() {
+    const marker = readPendingServerUpdateMarker(this.markerDir());
+    if (!marker) return;
+    const after = this.readGlobalInstallVersion();
+    clearPendingServerUpdateMarker(this.markerDir());
+    if (!after || after === marker.before) {
+      logger.info(
+        `A server update started at ${marker.startedAt} did not move the install (still ${after ?? "no reading"}); nothing to report on this launch`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return;
+    }
+    const running = await this.getInstalledBackendVersion();
+    logger.info(
+      `A server update that no app was supervising landed: ${marker.before ?? "unknown"} -> ${after}; the backend serving this launch reports ${running ?? "no reading"}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    this.sendToRenderer("backend-update-completed", {
+      installVersion: after,
+      runningVersion: running,
+      restarted: false,
+      unattended: true,
+      restartable: this.backendIsAppOwned(),
+      before: marker.before
+    });
+  }
   async updateBackend(targetVersion) {
     logger.info("Updating backend...", LogFileType.UPDATE_SERVICE);
     try {
@@ -17756,7 +18542,8 @@ ${heal.removed.join("\n")}`,
         if (this.mainWindow && !this.mainWindow.isDestroyed() && this.mainWindow.webContents && !this.mainWindow.webContents.isDestroyed()) {
           this.mainWindow.webContents.send("backend-update-error", {
             message: "No backend service reference available, cannot update.",
-            phase: "update"
+            phase: "update",
+            logPath: serverUpdateLogPath()
           });
         }
         return false;
@@ -17771,13 +18558,22 @@ ${heal.removed.join("\n")}`,
           if (this.mainWindow && !this.mainWindow.isDestroyed() && this.mainWindow.webContents && !this.mainWindow.webContents.isDestroyed()) {
             this.mainWindow.webContents.send("backend-update-error", {
               message: "No python server is available, nothing to update.",
-              phase: "update"
+              phase: "update",
+              logPath: serverUpdateLogPath()
             });
           }
           return false;
         case LocalOperatorStartupMode.EXISTING_SERVER:
         case LocalOperatorStartupMode.GLOBAL_INSTALL: {
           const plan = await this.resolveBackendUpdatePlan(startupMode);
+          const target2 = targetVersion ?? this.lastPublishedBackendVersion ?? null;
+          if (plan.canManageUpdate) {
+            return await this.updateGlobalInstall(
+              this.backendService,
+              plan,
+              target2
+            );
+          }
           logger.info(
             `Cannot manage the update for ${startupMode}: ${plan.detail}`,
             LogFileType.UPDATE_SERVICE
@@ -17787,13 +18583,10 @@ ${heal.removed.join("\n")}`,
             message: plan.remedy,
             command: plan.updateCommand,
             detail: plan.detail,
-            // The caller's target when it named one (the "Update server"
-            // button does), otherwise the published release the last check
-            // read: the compatibility banner calls this with no target at
-            // all, and the panel's version sentence then had nothing to
-            // render on the path that actually produces it (review U17).
-            latestVersion: targetVersion ?? this.lastPublishedBackendVersion ?? null,
+            latestVersion: target2,
             currentVersion: installed && installed !== "Unknown" ? installed : null,
+            installVersion: plan.installedInstallVersion,
+            runningVersion: installed,
             sourceBuild: plan.sourceBuild
           });
           return false;
@@ -17807,7 +18600,8 @@ ${heal.removed.join("\n")}`,
           );
           this.sendToRenderer("backend-update-error", {
             message: "The app could not tell how this server was started, so it did not update it. See the update service log.",
-            phase: "update"
+            phase: "update",
+            logPath: serverUpdateLogPath()
           });
           return false;
       }
@@ -17841,7 +18635,8 @@ ${heal.removed.join("\n")}`,
         await this.restartBackendAfterFailedUpgrade();
         this.sendToRenderer("backend-update-error", {
           message: "The bundled server's Python environment could not be found, so the update did not run. Please reinstall the application.",
-          phase: "update"
+          phase: "update",
+          logPath: serverUpdateLogPath()
         });
         return false;
       }
@@ -17881,7 +18676,8 @@ ${pipRun.stderr.trim()}`,
         const serverIsBack = await this.restartBackendAfterFailedUpgrade();
         this.sendToRenderer("backend-update-error", {
           message: pipRun.exitCode !== 0 ? serverIsBack ? "The server update failed to install. The previously installed server is running again; see the update service log for pip's output." : "The server update failed to install and the server did not come back up. Restart Local Operator, and see the update service log for pip's output." : `The server update to ${targetVersion ?? "the new release"} did not take effect: the server is still on ${versionAfter ?? "its previous version"}. See the update service log for pip's output, then try again.`,
-          phase: "update"
+          phase: "update",
+          logPath: serverUpdateLogPath()
         });
         return false;
       }
@@ -17920,7 +18716,8 @@ ${pipRun.stderr.trim()}`,
             if (this.mainWindow) {
               this.mainWindow.webContents.send("backend-update-error", {
                 message: "Backend was updated but failed to restart properly. Please restart the application.",
-                phase: "update"
+                phase: "update",
+                logPath: serverUpdateLogPath()
               });
             }
             return false;
@@ -17935,7 +18732,8 @@ ${pipRun.stderr.trim()}`,
         if (this.mainWindow) {
           this.mainWindow.webContents.send("backend-update-error", {
             message: "Backend was updated but failed to restart. Please restart the application.",
-            phase: "update"
+            phase: "update",
+            logPath: serverUpdateLogPath()
           });
         }
         return false;
@@ -17950,7 +18748,8 @@ ${pipRun.stderr.trim()}`,
         );
         this.sendToRenderer("backend-update-error", {
           message: `The server restarted but did not report ${targetVersion ? `version ${targetVersion}` : "the updated version"}. Check the update service log, then try again.`,
-          phase: "update"
+          phase: "update",
+          logPath: serverUpdateLogPath()
         });
         return false;
       }
@@ -17992,7 +18791,8 @@ ${pipRun.stderr.trim()}`,
           // Cleaned at the source, for the reason written on the check-phase
           // report above.
           message: stripErrorPrefixes(error.message),
-          phase: "update"
+          phase: "update",
+          logPath: serverUpdateLogPath()
         });
       }
       return false;
@@ -18023,7 +18823,7 @@ ${pipRun.stderr.trim()}`,
     try {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 3e3);
-      const response = await fetch(`${this.backendUrl}/health`, {
+      const response = await fetch(`${this.liveBackendUrl()}/health`, {
         method: "GET",
         headers: { Accept: "application/json" },
         signal: controller.signal
@@ -19729,7 +20529,7 @@ electron.app.on("window-all-closed", () => {
   electron.app.quit();
 });
 const QUIT_FAILSAFE_MARGIN_MS = 5e3;
-const QUIT_CLEANUP_FAILSAFE_MS = CONSOLE_RESOLUTION_WORST_MS + INTERPRETER_RESOLUTION_WORST_MS + OWNED_STOP_WORST_MS + READINESS_POLL_INTERVAL_MS + QUIT_FAILSAFE_MARGIN_MS;
+const QUIT_CLEANUP_FAILSAFE_MS = INTERPRETER_RESOLUTION_WORST_MS + OWNED_STOP_WORST_MS + READINESS_POLL_INTERVAL_MS + QUIT_FAILSAFE_MARGIN_MS;
 let backendQuitPending = false;
 electron.app.on("will-quit", (event) => {
   viewerEndpoint?.close();