nomarmy 0.1.0-alpha.6 → 0.1.0-alpha.7

package/README.md

@@ -12,7 +12,7 @@
 
 ## TL;DR
 
-1. **Have** Git, Node 20+ and [Podman](https://podman.io) (on macOS: `brew install podman && podman machine init --memory 8192 && podman machine start`; Podman's 2 GiB default is too small for nomArmy's sandboxes).
+1. **Have** Git, Node 24.16+ (or 26.1+; OpenClaw, which nomArmy installs, needs it) and [Podman](https://podman.io) (on macOS: `brew install podman && podman machine init --memory 8192 && podman machine start`; Podman's 2 GiB default is too small for nomArmy's sandboxes).
 2. **Install and set up:**
    ```bash
    npm install -g nomarmy@alpha

package/bin/nomarmy.mjs

@@ -18,7 +18,8 @@ import { buildConfigProposal } from "../lib/propose.mjs";
 import { detectHardware } from "../lib/hardware.mjs";
 import { readGGUFMetadata, resolveModelPath, totalSplitBytes } from "../lib/gguf.mjs";
 import { recommend, customRecommendation, evaluateConfig, bytesPerKvElementForCacheTypes, MIN_CONTEXT_PER_NOM } from "../lib/sizing.mjs";
-import { connectClaude, connectCodex, connectCursor, cursorAlreadyConnected, deriveWorkerModelEnv } from "../lib/connect.mjs";
+import { connectClaude, connectCodex, connectCursor, cursorAlreadyConnected, deriveWorkerModelEnv, defaultInstallDir } from "../lib/connect.mjs";
+import { compareVersions, readPackageVersion, readInstallVersions } from "../lib/install-freshness.mjs";
 import { ID_RE, AUTH_ENV_NAME_RE, OPENCLAW_PROVIDER_ID_RE, openclawProviderId, isNativeProviderType } from "../lib/dispatch-schema.mjs";
 import { loadAgents, readAgentsFile, writeAgentsFile, agentsConfigPath, apiAgentAsPoolEntry, describeAgent as describeAgentLabel, agentRunsToolsOnHost, agentProviderId, AGENT_KINDS, API_PROVIDER_TYPES, RESERVED_AGENT_NAMES, BUILTIN_LOCAL_AGENT } from "../lib/agents.mjs";
 import { loadArmy, mergeArmy, describeArmy, readArmyFile, updateArmyInFile, assignRoleInFile, parseTargetSpec, armyLayerPath, globalConfigDir, DEFAULT_ARMY, ARMY_PHASES, LOCAL_CONFIG_FILENAME } from "../lib/army.mjs";
@@ -115,8 +116,9 @@ Usage: nomarmy <command> [options]
                                       registration (never done silently)
                   --restart-inference with --json, also stop/start local
                                       inference (never done silently)
-  update          Pull the latest nomArmy code and re-sync the installed
-                  MCP copy (fast-forward only; refuses on local changes).
+  update          Update nomArmy and reconnect your coordinators: installs
+                  npm's latest alpha, or for a git checkout pulls (fast-forward
+                  only; refuses on local changes). Then restart open sessions.
   agents <list|add|update|remove>
                   Every account a job can run on, in one list:
                   ~/.config/nomarmy/agents.yml (or NOMARMY_CONFIG_DIR).
@@ -1642,14 +1644,9 @@ function git(args) {
  */
 async function cmdUpdate() {
   const say = (s) => { if (!json) console.log(s); };
-  // Installed from npm: there's no checkout to pull. npm updates the
-  // package; connect resyncs the copy each coordinator runs.
-  if (!fs.existsSync(path.join(nomarmyRoot, ".git"))) {
-    const how = "npm install -g nomarmy@alpha && nomarmy connect";
-    if (json) return out({ error: "installed from npm, not a git checkout", fix: how });
-    console.log(`This nomArmy was installed from npm, so there's nothing to pull. Update with:\n  ${how}`);
-    return;
-  }
+  // Installed from npm: npm updates the package, then connect resyncs the
+  // copy each coordinator runs.
+  if (!fs.existsSync(path.join(nomarmyRoot, ".git"))) return updateFromNpm();
   const status = git(["status", "--porcelain"]);
   if (status) {
     if (json) { out({ error: "working tree is not clean; refusing to pull over local changes", status }); process.exit(1); }
@@ -1704,6 +1701,45 @@ async function cmdUpdate() {
   console.log(c.yellow("\nThe MCP server is a per-session child process: every open Claude Code / Codex / Cursor session needs a restart to pick this up, not just this one."));
 }
 
+// The coordinators nomArmy is registered with. Cursor has no CLI to probe,
+// so it counts when its own config already lists nomArmy.
+function connectedTargets() {
+  return [commandExists("claude") && "claude", commandExists("codex") && "codex", cursorAlreadyConnected() && "cursor"].filter(Boolean);
+}
+
+async function updateFromNpm() {
+  const current = readPackageVersion(nomarmyRoot);
+  let latest = null;
+  try { latest = execFileSync("npm", ["view", "nomarmy", "dist-tags.alpha"], { encoding: "utf8", timeout: 20000 }).trim(); } catch { /* offline */ }
+  if (!latest) {
+    const fix = "npm install -g nomarmy@alpha && nomarmy connect claude";
+    if (json) { out({ error: "could not read nomarmy's latest release from npm", fix }); process.exit(1); }
+    console.log(c.red("Couldn't reach npm to find nomArmy's latest release.") + ` Update by hand:\n  ${fix}`);
+    process.exit(1);
+  }
+  const { copyVersion } = readInstallVersions(defaultInstallDir());
+  const upgrade = compareVersions(current, latest) < 0;
+  const staleCopy = !copyVersion || compareVersions(copyVersion, upgrade ? latest : current) < 0;
+  if (!upgrade && !staleCopy) {
+    if (json) return out({ updated: false, version: current, reason: "already up to date" });
+    console.log(c.green(`✓ nomArmy ${current} is the latest, and your coordinators run it.`));
+    return;
+  }
+  if (upgrade) {
+    if (!json) console.log(c.bold(`🍪 Updating nomArmy ${current} → ${latest}\n`));
+    execFileSync("npm", ["install", "-g", `nomarmy@${latest}`, "--no-audit", "--no-fund"], { stdio: json ? "ignore" : "inherit" });
+  }
+  // A child process, so the reconnect runs the code just installed rather
+  // than the old code this process loaded.
+  const targets = connectedTargets();
+  if (targets.length) {
+    if (!json) console.log(`\nReconnecting ${targets.join(", ")}...`);
+    execFileSync(process.execPath, [path.join(nomarmyRoot, "bin", "nomarmy.mjs"), "connect", ...targets, ...(json ? ["--json"] : [])], { stdio: json ? "ignore" : "inherit" });
+  }
+  if (json) return out({ updated: upgrade, from: current, version: upgrade ? latest : current, resynced: targets });
+  console.log(c.yellow("\nRestart every open Claude Code, Codex and Cursor session: each keeps the code it started with until then."));
+}
+
 function commandExists(cmd) {
   try { execFileSync(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "ignore" }); return true; }
   catch { return false; }

package/docker/Dockerfile.go

@@ -9,15 +9,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # (verified live: apt installed 1.19 here while go.dev's stable was 1.27) --
 # same reasoning as using rustup instead of apt for Rust in Dockerfile.rust.
 # Pinned, not "latest", for a reproducible build; bump GO_VERSION by hand
-# periodically against https://go.dev/dl/.
+# periodically against https://go.dev/dl/, with both SHA256 values from
+# https://go.dev/dl/?mode=json.
 ENV GO_VERSION=1.27.1
 RUN ARCH="$(dpkg --print-architecture)" \
     && case "$ARCH" in \
-         amd64) GOARCH=amd64 ;; \
-         arm64) GOARCH=arm64 ;; \
+         amd64) GOARCH=amd64; SHA256=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 ;; \
+         arm64) GOARCH=arm64; SHA256=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec ;; \
          *) echo "unsupported architecture for Go install: $ARCH" >&2; exit 1 ;; \
        esac \
     && curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz" -o /tmp/go.tgz \
+    && echo "${SHA256}  /tmp/go.tgz" | sha256sum -c - \
     && tar -C /usr/local -xzf /tmp/go.tgz \
     && rm /tmp/go.tgz
 ENV PATH="/usr/local/go/bin:${PATH}"

package/docker/Dockerfile.rust

@@ -14,6 +14,21 @@ USER node
 ENV RUSTUP_HOME=/home/node/.rustup
 ENV CARGO_HOME=/home/node/.cargo
 ENV PATH="${CARGO_HOME}/bin:${PATH}"
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
+# rustup-init is pinned by version and checksum instead of piping
+# sh.rustup.rs into sh; rustup then verifies the toolchain it downloads.
+# Bump RUSTUP_VERSION and both hashes together, from
+# https://static.rust-lang.org/rustup/archive/<version>/<target>/rustup-init.sha256.
+ENV RUSTUP_VERSION=1.29.1
+RUN ARCH="$(dpkg --print-architecture)" \
+    && case "$ARCH" in \
+         amd64) TARGET=x86_64-unknown-linux-gnu; SHA256=dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 ;; \
+         arm64) TARGET=aarch64-unknown-linux-gnu; SHA256=15f6e4ce9f583b929c996c91562bad6d4454f3281de858b02cdfdef615fac433 ;; \
+         *) echo "unsupported architecture for Rust install: $ARCH" >&2; exit 1 ;; \
+       esac \
+    && curl --proto '=https' --tlsv1.2 -fsSL "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${TARGET}/rustup-init" -o /tmp/rustup-init \
+    && echo "${SHA256}  /tmp/rustup-init" | sha256sum -c - \
+    && chmod +x /tmp/rustup-init \
+    && /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain stable \
+    && rm /tmp/rustup-init
 WORKDIR /workspace
 CMD ["sleep", "infinity"]

package/install.sh

@@ -99,9 +99,23 @@ fi
 # on a fresh macOS install nothing has initialized that VM yet at this point.
 if nomarmy_is_cloud; then need aws || { echo 'ERROR: the AWS CLI is required for cloud profiles.'; exit 1; }; fi
 "$ROOT/scripts/install-llama-cpp.sh" "$NOMARMY_PROFILE"
+# A pinned npm release, which npm checks against the registry's integrity
+# hash, rather than piping a remote installer script into bash.
+OPENCLAW_VERSION="${NOMARMY_OPENCLAW_VERSION:-2026.9.6}"
 if ! command -v openclaw >/dev/null 2>&1; then
-  echo '==> Installing OpenClaw (non-interactive)'
-  curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
+  if ! node -e 'const [a, b] = process.versions.node.split(".").map(Number); process.exit((a === 24 && b >= 16) || (a === 26 && b >= 1) || a > 26 ? 0 : 1)'; then
+    echo "ERROR: OpenClaw $OPENCLAW_VERSION needs Node 24.16+ or 26.1+; this is Node $(node -v)."
+    echo '       Upgrade Node and re-run this installer, or install OpenClaw yourself first:'
+    echo '         https://openclaw.ai (then re-run this installer)'
+    exit 1
+  fi
+  echo "==> Installing OpenClaw $OPENCLAW_VERSION from npm"
+  if [[ -w "$(npm prefix -g)" ]]; then
+    npm install -g "openclaw@$OPENCLAW_VERSION" --no-audit --no-fund
+  else
+    # No writable global prefix: install for this user, as OpenClaw's own installer does.
+    npm install -g --prefix "$HOME/.npm-global" "openclaw@$OPENCLAW_VERSION" --no-audit --no-fund
+  fi
   export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
 fi
 need openclaw

package/lib/agents.mjs

@@ -30,6 +30,7 @@ import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
 import { z } from "zod";
+import { typeError, isMissingField, isUnknownDiscriminator } from "./zod-issues.mjs";
 
 import { providerEntrySchema, formatDispatchIssues, openclawProviderId, PROVIDER_TYPES, ID_RE, HOST_TOOL_PROVIDERS, agentRunsToolsOnHost } from "./dispatch-schema.mjs";
 
@@ -45,10 +46,10 @@ export const RESERVED_AGENT_NAMES = Object.freeze(["__proto__", "constructor", "
 export const BUILTIN_LOCAL_AGENT = Object.freeze({ kind: "local", slot: "coder" });
 
 const requiredString = () =>
-  z.string({ required_error: "is required", invalid_type_error: "must be a string" })
+  z.string({ error: typeError("a string") })
     .refine((value) => value.trim().length > 0, { message: "must not be empty" });
 const thinkingSchema = z.union([z.boolean(), z.enum(["low", "medium", "high"])]).default(true);
-const positiveInt = () => z.number({ invalid_type_error: "must be a number" }).int("must be a whole number").positive("must be a positive number");
+const positiveInt = () => z.number({ error: typeError("a number") }).int("must be a whole number").positive("must be a positive number");
 
 const localAgentSchema = z.object({
   kind: z.literal("local"),
@@ -62,7 +63,7 @@ const localAgentSchema = z.object({
 // providerEntrySchema in agentsFileSchema's superRefine, so they exist once.
 const apiAgentSchema = z.object({
   kind: z.literal("api"),
-  provider: z.enum(API_PROVIDER_TYPES, { errorMap: () => ({ message: `must be one of ${API_PROVIDER_TYPES.join(", ")}` }) }),
+  provider: z.enum(API_PROVIDER_TYPES, { error: `must be one of ${API_PROVIDER_TYPES.join(", ")}` }),
   model: requiredString().optional(),
   auth_env: requiredString(),
   base_url: z.string().optional(),
@@ -95,7 +96,7 @@ export function hostToolsImplementProblem(name, agent) {
 }
 
 export const agentSchema = z.discriminatedUnion("kind", [localAgentSchema, apiAgentSchema, subscriptionAgentSchema], {
-  errorMap: (issue, ctx) => (issue.code === "invalid_union_discriminator" ? { message: `kind must be one of ${AGENT_KINDS.join(", ")}` } : { message: ctx.defaultError }),
+  error: (issue) => (isUnknownDiscriminator(issue) ? `kind must be one of ${AGENT_KINDS.join(", ")}` : undefined),
 });
 
 /** An api agent as the pool entry the dispatch path understands. `model` may be absent (see resolveAgentModel). */
@@ -148,7 +149,7 @@ export function formatAgentIssues(error) {
   const lines = error.issues.map((issue) => {
     const where = issue.path.length ? issue.path.join(".") : "config";
     if (issue.code === "unrecognized_keys") return `${where}: unexpected field(s) ${issue.keys.map((k) => `"${k}"`).join(", ")}`;
-    if (issue.code === "invalid_type" && issue.received === "undefined") return `${where}: is required`;
+    if (isMissingField(issue)) return `${where}: is required`;
     return `${where}: ${issue.message}`;
   });
   return [...new Set(lines)];

package/lib/army.mjs

@@ -29,6 +29,7 @@ import os from "node:os";
 import path from "node:path";
 import YAML from "yaml";
 import { z } from "zod";
+import { typeError } from "./zod-issues.mjs";
 import { agentRunsToolsOnHost } from "./dispatch-schema.mjs";
 import { usageStatus } from "./usage-limits.mjs";
 
@@ -116,7 +117,7 @@ const roleSchema = z.object({
   disabled: z.boolean().optional(),
 }).strict();
 
-const positiveNumber = () => z.number({ invalid_type_error: "must be a number" }).positive("must be positive");
+const positiveNumber = () => z.number({ error: typeError("a number") }).positive("must be positive");
 // Limits on one /feature run (lib/runs.mjs). Personal, like the General:
 // global or local only, never a committed project file.
 const runLimitsSchema = z.object({

package/lib/connect.mjs

@@ -28,6 +28,7 @@ import { execFileSync } from "node:child_process";
 import { loadAgents } from "./agents.mjs";
 import { globalConfigDir } from "./army.mjs";
 import { buildNotifierApp } from "./notifier-app.mjs";
+import { recordCopySource } from "./install-freshness.mjs";
 
 export function defaultInstallDir() {
   return process.env.NOMARMY_AGENT_INSTALL_DIR || path.join(process.env.HOME ?? process.env.USERPROFILE ?? ".", ".local", "share", "nomarmy-local-worker");
@@ -142,6 +143,7 @@ export function installMcpCopy({ nomarmyRoot, installDir, run = defaultRun }) {
   fs.mkdirSync(path.join(installDir, "mcp"), { recursive: true });
   fs.copyFileSync(path.join(nomarmyRoot, "package.json"), path.join(installDir, "package.json"));
   fs.copyFileSync(path.join(nomarmyRoot, "mcp", "server.mjs"), path.join(installDir, "mcp", "server.mjs"));
+  recordCopySource(installDir, nomarmyRoot);
   fs.rmSync(path.join(installDir, "lib"), { recursive: true, force: true });
   fs.cpSync(path.join(nomarmyRoot, "lib"), path.join(installDir, "lib"), { recursive: true });
   // lib/sandbox-images.mjs resolves docker/ relative to its own location

package/lib/dispatch-schema.mjs

@@ -15,10 +15,11 @@
 //     never in a file nomArmy writes or reads back.
 
 import { z } from "zod";
+import { typeError, isMissingField, isUnknownDiscriminator } from "./zod-issues.mjs";
 
 const requiredString = () =>
   z
-    .string({ required_error: "is required", invalid_type_error: "must be a string" })
+    .string({ error: typeError("a string") })
     .refine((value) => value.trim().length > 0, { message: "must not be empty" });
 
 // Exported (not just used internally) so bin/nomarmy.mjs's interactive
@@ -101,11 +102,11 @@ export function isNativeProviderType(type) {
 export const CUSTOM_ENDPOINT_PROVIDER_TYPES = Object.freeze(["bedrock", "azure-openai", "openai-compatible"]);
 
 const idSchema = z
-  .string({ required_error: "is required", invalid_type_error: "must be a string" })
+  .string({ error: typeError("a string") })
   .regex(ID_RE, "must be 1-64 characters of letters, numbers, dot, underscore or hyphen");
 
 const weightSchema = z
-  .number({ required_error: "is required", invalid_type_error: "must be a number" })
+  .number({ error: typeError("a number") })
   .positive("must be a positive number")
   .finite("must be a finite number");
 
@@ -113,13 +114,13 @@ const weightSchema = z
 // one entry at once -- a stand-in for real rate-limit-aware admission (see
 // README's dispatch-pool section for why that's out of scope for now).
 const maxConcurrentSchema = z
-  .number({ invalid_type_error: "must be a number" })
+  .number({ error: typeError("a number") })
   .int("must be a whole number")
   .positive("must be a positive number")
   .default(2);
 
 const authEnvSchema = z
-  .string({ required_error: "is required", invalid_type_error: "must be a string" })
+  .string({ error: typeError("a string") })
   .regex(
     AUTH_ENV_NAME_RE,
     "must be an environment variable NAME (uppercase letters, digits, underscores), never the credential itself",
@@ -127,7 +128,7 @@ const authEnvSchema = z
 
 const urlSchema = () =>
   z
-    .string({ required_error: "is required", invalid_type_error: "must be a string" })
+    .string({ error: typeError("a string") })
     .url("must be a valid URL");
 
 // Whether/how the entry's model uses a thinking/reasoning mode. `true`
@@ -152,7 +153,7 @@ const thinkingSchema = z.union([z.boolean(), z.enum(["low", "medium", "high"])])
 // knows about yet (see lib/model-catalog.mjs), or an operator who wants to
 // be more conservative than the model's rated maximum.
 const contextWindowSchema = z
-  .number({ invalid_type_error: "must be a number" })
+  .number({ error: typeError("a number") })
   .int("must be a whole number")
   .positive("must be a positive number")
   .optional();
@@ -189,7 +190,7 @@ const llamaCppEntrySchema = z
 // `agents add` installs it before registering the key.
 const genericOpenclawEntrySchema = hostedProviderSchema("openclaw", { requireBaseUrl: false }).extend({
   openclaw_provider: z
-    .string({ required_error: "is required", invalid_type_error: "must be a string" })
+    .string({ error: typeError("a string") })
     .regex(OPENCLAW_PROVIDER_ID_RE, "must be an OpenClaw provider id (lowercase letters, digits, dot, underscore, hyphen)")
     .refine((id) => !PROVIDER_TYPES.includes(id) || NATIVE_PROVIDER_TYPES.includes(id), "names a nomArmy provider type with its own setup -- use that type instead"),
   plugin: z.string().regex(/^\S+$/, "must be one plugin install spec, e.g. clawhub:@openclaw/deepseek-provider").optional(),
@@ -205,7 +206,7 @@ export const providerEntrySchema = z.discriminatedUnion("provider", [
 export const poolsSchema = z.record(
   z.string().min(1, "pool name must not be empty"),
   z
-    .array(providerEntrySchema, { invalid_type_error: "must be an array of provider entries" })
+    .array(providerEntrySchema, { error: typeError("an array of provider entries") })
     .min(1, "must list at least one provider entry"),
 );
 
@@ -250,11 +251,11 @@ export function formatDispatchIssues(error) {
       lines.push(`${where}: unexpected field(s) ${keys}`);
       continue;
     }
-    if (issue.code === "invalid_union_discriminator") {
+    if (isUnknownDiscriminator(issue)) {
       lines.push(`${where}: must be one of ${PROVIDER_TYPES.join(", ")}`);
       continue;
     }
-    if (issue.code === "invalid_type" && issue.received === "undefined") {
+    if (isMissingField(issue)) {
       lines.push(`${where}: is required`);
       continue;
     }

package/lib/health.mjs

@@ -11,6 +11,8 @@
 //   army             a role or the General pointing at something unusable
 //   config           agents.yml unloadable or unsafe
 //   leftovers        retained worktrees, job storage, stale "running" jobs
+//   nomarmy-update   a newer nomArmy on npm; nomarmy-copy: coordinators run
+//                    an older copy than the installed CLI (install-freshness.mjs)
 //
 // Each issue: { id, severity: "error"|"warn"|"info", title, detail, fix,
 // short }. `id` is stable across runs, so a notification goes out once per
@@ -23,6 +25,7 @@ import { executionMode } from "./execution.mjs";
 import { modelRejection } from "./openclaw-errors.mjs";
 import { providerConfigured, readOpenclawConfig } from "./openclaw-config.mjs";
 import { readUsageSnapshots, usageStatus } from "./usage-limits.mjs";
+import { freshnessIssues, readInstallVersions } from "./install-freshness.mjs";
 
 const DAY = 86400000;
 
@@ -213,7 +216,7 @@ export function leftoverIssues({ retainedWorktrees = 0, jobsBytes = 0, staleRunn
  * Run every check. `env` supplies what each needs, with real defaults;
  * tests pass their own.
  */
-export async function runHealthChecks({ now = Date.now(), mode = "local", openclawCmd = process.env.NOMARMY_OPENCLAW_CMD || "openclaw", run = runBounded, armySummary = null, agentsError = null, jobsRoot = null, pidAlive = () => true, agents = null, openclawConfig = null, vendors = {}, modelsInUse = null, autoPruned = null, usageSnapshots = null } = {}) {
+export async function runHealthChecks({ now = Date.now(), mode = "local", openclawCmd = process.env.NOMARMY_OPENCLAW_CMD || "openclaw", run = runBounded, armySummary = null, agentsError = null, jobsRoot = null, pidAlive = () => true, agents = null, openclawConfig = null, vendors = {}, modelsInUse = null, autoPruned = null, usageSnapshots = null, install = null } = {}) {
   const issues = [];
   if (autoPruned?.freedBytes) issues.push({ id: `auto-prune:${new Date(now).toISOString()}`, severity: "info",
     title: `Freed ${(autoPruned.freedBytes / 1024 ** 3).toFixed(2)} GB: ${[autoPruned.pruned ? `runtime data of ${autoPruned.pruned} finished job${autoPruned.pruned === 1 ? "" : "s"} older than ${autoPruned.olderThanHours}h` : null, autoPruned.scratchCleared ? `OpenClaw scratch files of ${autoPruned.scratchCleared} more` : null].filter(Boolean).join(", ")}`,
@@ -230,12 +233,14 @@ export async function runHealthChecks({ now = Date.now(), mode = "local", opencl
         short });
     }
   }
-  const [auth, version, latest, plugins] = await Promise.all([
+  const [auth, version, latest, plugins, nomarmyLatest] = await Promise.all([
     run(openclawCmd, ["models", "auth", "list", "--json"]),
     run(openclawCmd, ["--version"]),
     run("npm", ["view", "openclaw", "version"], { timeoutMs: 15000 }),
     run(openclawCmd, ["plugins", "inspect", "codex"]),
+    install ? run("npm", ["view", "nomarmy", "dist-tags.alpha"], { timeoutMs: 15000 }) : null,
   ]);
+  if (install) issues.push(...freshnessIssues({ ...install, latestVersion: nomarmyLatest?.ok ? nomarmyLatest.stdout : null }));
   if (auth.ok) { try { issues.push(...loginExpiryIssues(JSON.parse(auth.stdout.slice(auth.stdout.indexOf("{"))), { now })); } catch { /* unparseable: skip */ } }
   const pluginVersion = /Version:\s*(\S+)/.exec(plugins.stdout ?? "")?.[1];
   if (version.ok) issues.push(...versionIssues({ installed: version.stdout, latest: latest.ok ? latest.stdout : null, plugins: pluginVersion ? [{ id: "codex", version: pluginVersion }] : [] }));
@@ -318,8 +323,10 @@ export async function checkAndRecordHealth({ projectDir, stateRoot, configDir, n
   let autoPruned = null;
   if (ageMs !== null) { try { autoPruned = { ...pruneJobRuntime({ stateRoot, olderThanMs: ageMs, now }), olderThanHours: ageMs / 3600000 }; } catch { /* best-effort */ } }
   const mode = executionMode(env).mode;
+  const { defaultInstallDir } = await import("./connect.mjs");
+  const install = readInstallVersions(defaultInstallDir());
   const result = await runHealthChecks({ now, mode, armySummary, agentsError, jobsRoot: path.join(stateRoot, "jobs"), pidAlive,
-    agents, openclawConfig: readOpenclawConfig(), vendors: SUBSCRIPTION_VENDORS, modelsInUse, autoPruned, usageSnapshots: readUsageSnapshots(stateRoot) });
+    agents, openclawConfig: readOpenclawConfig(), vendors: SUBSCRIPTION_VENDORS, modelsInUse, autoPruned, usageSnapshots: readUsageSnapshots(stateRoot), install });
   const toNotify = recordHealth(path.join(stateRoot, "health.json"), result, { now });
   return { result, toNotify };
 }

package/lib/install-freshness.mjs

@@ -0,0 +1,83 @@
+// Whether the nomArmy a coordinator runs is current. Claude Code, Codex and
+// Cursor run a copy of the server that `nomarmy connect` puts in the install
+// dir, and each session keeps the code it started with. So an upgrade can
+// stall at three points, each checked here:
+//
+//   nomarmy-update  npm's alpha release is newer than the installed CLI
+//   nomarmy-copy    the CLI is newer than the copy coordinators run
+//                   (`nomarmy connect` wasn't re-run)
+//   restart         the copy on disk changed after this server started
+//                   (the session wasn't restarted); per session, so it is
+//                   reported by that session's server, not in health.json
+
+import fs from "node:fs";
+import path from "node:path";
+
+/** Written into the install dir by `nomarmy connect`: where the copy came from. */
+export const SOURCE_FILE = "source.json";
+
+export function readPackageVersion(root) {
+  try { return JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version ?? null; }
+  catch { return null; }
+}
+
+export function recordCopySource(installDir, nomarmyRoot) {
+  fs.writeFileSync(path.join(installDir, SOURCE_FILE), JSON.stringify({ root: nomarmyRoot, version: readPackageVersion(nomarmyRoot) }, null, 2) + "\n");
+}
+
+/** The copy's version and, when connect recorded it, the version now at its source. */
+export function readInstallVersions(installDir) {
+  let source = null;
+  try { source = JSON.parse(fs.readFileSync(path.join(installDir, SOURCE_FILE), "utf8")); } catch { /* connected before source.json existed */ }
+  return { copyVersion: readPackageVersion(installDir), sourceVersion: source?.root ? readPackageVersion(source.root) : null };
+}
+
+/** Semver order, prerelease included (0.1.0-alpha.7 < 0.1.0-alpha.10 < 0.1.0). */
+export function compareVersions(a, b) {
+  const split = (v) => { const [main, pre] = String(v).trim().replace(/^v/, "").split("-", 2); return { main: main.split(".").map(Number), pre: pre ? pre.split(".") : null }; };
+  const x = split(a), y = split(b);
+  for (let i = 0; i < 3; i++) if ((x.main[i] || 0) !== (y.main[i] || 0)) return (x.main[i] || 0) < (y.main[i] || 0) ? -1 : 1;
+  if (!x.pre || !y.pre) return x.pre === y.pre ? 0 : x.pre ? -1 : 1;
+  for (let i = 0; i < Math.max(x.pre.length, y.pre.length); i++) {
+    const p = x.pre[i], q = y.pre[i];
+    if (p === undefined || q === undefined) return p === undefined ? -1 : 1;
+    if (p === q) continue;
+    const pn = /^\d+$/.test(p), qn = /^\d+$/.test(q);
+    if (pn && qn) return Number(p) < Number(q) ? -1 : 1;
+    if (pn !== qn) return pn ? -1 : 1;
+    return p < q ? -1 : 1;
+  }
+  return 0;
+}
+
+const valid = (v) => typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
+
+/** Health issues for a stale CLI or a stale installed copy. */
+export function freshnessIssues({ copyVersion = null, sourceVersion = null, latestVersion = null }) {
+  const issues = [];
+  if (valid(latestVersion) && valid(sourceVersion) && compareVersions(sourceVersion, latestVersion) < 0) {
+    const latest = latestVersion.trim();
+    issues.push({ id: `nomarmy-update:${latest}`, severity: "info", title: `nomArmy ${latest} is out (you have ${sourceVersion})`,
+      detail: "Updating installs it, reconnects your coordinators and tells you which sessions to restart.",
+      fix: "nomarmy update", short: "nomarmy update" });
+  }
+  if (valid(sourceVersion) && valid(copyVersion) && compareVersions(copyVersion, sourceVersion) < 0) {
+    issues.push({ id: `nomarmy-copy:${sourceVersion}`, severity: "warn", title: `Your coordinators run nomArmy ${copyVersion}, but ${sourceVersion} is installed`,
+      detail: "Claude Code, Codex and Cursor run a copy of nomArmy that only `nomarmy connect` refreshes.",
+      fix: "nomarmy connect claude (and codex, cursor), then restart those sessions", short: "nomarmy reconnect" });
+  }
+  return issues;
+}
+
+/**
+ * For the running server: a notice when its copy on disk changed after it
+ * started, so this session still runs the old code. Null when current.
+ */
+export function restartNotice({ serverFile, startedAtMs, runningVersion, stat = fs.statSync, readVersion = readPackageVersion }) {
+  let changedMs;
+  try { changedMs = stat(serverFile).mtimeMs; } catch { return null; }
+  if (!(changedMs > startedAtMs)) return null;
+  const onDisk = readVersion(path.join(path.dirname(serverFile), ".."));
+  const versions = onDisk && onDisk !== runningVersion ? ` (this session runs ${runningVersion}; ${onDisk} is installed)` : "";
+  return `nomArmy was updated after this session started${versions}. Restart this session to use the new version; until then it runs the old code.`;
+}

package/lib/schema.mjs

@@ -12,6 +12,7 @@
 //     approval before the job runs. See `collectElevated`.
 
 import { z } from "zod";
+import { typeError, isMissingField, isUnknownDiscriminator } from "./zod-issues.mjs";
 import { armySchema } from "./army.mjs";
 
 export const SERVICE_SOURCES = Object.freeze([
@@ -57,12 +58,12 @@ export const SERVICE_FIELDS = Object.freeze({
 // the dotted path, so repeating it reads as stutter.
 const requiredString = () =>
   z
-    .string({ required_error: "is required", invalid_type_error: "must be a string" })
+    .string({ error: typeError("a string") })
     .refine((value) => value.trim().length > 0, { message: "must not be empty" });
 
 const enumOf = (values) =>
   z.enum(values, {
-    errorMap: () => ({ message: `must be one of ${values.join(", ")}` }),
+    error: `must be one of ${values.join(", ")}`,
   });
 
 // A plain hostname: no scheme, no path, no port, no whitespace.
@@ -90,7 +91,7 @@ export function hostnameProblem(value) {
 }
 
 const hostnameSchema = z
-  .string({ invalid_type_error: "must be a string hostname" })
+  .string({ error: typeError("a string hostname") })
   .superRefine((value, ctx) => {
     const problem = hostnameProblem(value);
     if (problem) ctx.addIssue({ code: z.ZodIssueCode.custom, message: problem });
@@ -162,7 +163,7 @@ export const serviceSchema = z.discriminatedUnion("source", [
 export const pythonEnvironmentSchema = z
   .object({
     requirements: z
-      .array(requiredString(), { invalid_type_error: "must be an array of strings" })
+      .array(requiredString(), { error: typeError("an array of strings") })
       .min(1, "must list at least one requirements file"),
   })
   .strict();
@@ -211,10 +212,7 @@ export const verificationProfileSchema = z
   .object({
     environment: enumOf(ENVIRONMENT_LEVELS).default("none"),
     commands: z
-      .array(requiredString(), {
-        required_error: "is required",
-        invalid_type_error: "must be an array of strings",
-      })
+      .array(requiredString(), { error: typeError("an array of strings") })
       .min(1, "must list at least one command"),
   })
   .strict();
@@ -235,7 +233,7 @@ export const environmentRetentionSchema = z
     debug: enumOf(RETENTION_ACTIONS).default(DEFAULT_RETENTION.debug),
   })
   .strict()
-  .default({});
+  .prefault({});
 
 // ---------------------------------------------------------------------------
 // root
@@ -295,11 +293,11 @@ export function formatIssues(error) {
       lines.push(`${where}: unexpected field(s) ${keys}`);
       continue;
     }
-    if (issue.code === "invalid_union_discriminator") {
+    if (isUnknownDiscriminator(issue)) {
       lines.push(`${where}: must be one of ${SERVICE_SOURCES.join(", ")}`);
       continue;
     }
-    if (issue.code === "invalid_type" && issue.received === "undefined") {
+    if (isMissingField(issue)) {
       lines.push(`${where}: is required`);
       continue;
     }

package/lib/zod-issues.mjs

@@ -0,0 +1,15 @@
+// Zod 4 helpers shared by nomArmy's config schemas and their issue formatters.
+
+/**
+ * The `error` option for a primitive schema: "is required" when the field is
+ * absent, "must be <expected>" when it has the wrong type. Zod 4 replaced
+ * zod 3's required_error and invalid_type_error with this single function.
+ * @param {string} expected e.g. "a string"
+ */
+export const typeError = (expected) => (issue) => (issue.input === undefined ? "is required" : `must be ${expected}`);
+
+/** A field that is absent entirely, with no custom message of its own. */
+export const isMissingField = (issue) => issue.code === "invalid_type" && / received undefined$/.test(issue.message);
+
+/** A discriminated union whose discriminator matched none of its options. */
+export const isUnknownDiscriminator = (issue) => issue.code === "invalid_union" && issue.note === "No matching discriminator";

package/mcp/server.mjs

@@ -35,6 +35,7 @@ import { OUTCOMES, COORDINATOR_STATUS_BY_OUTCOME } from "../lib/outcomes.mjs";
 import { readUsageSnapshots, usageStatus } from "../lib/usage-limits.mjs";
 import { modelRefusals } from "../lib/health.mjs";
 import { podmanProblem, podmanVmStartedAt } from "../lib/podman-health.mjs";
+import { restartNotice } from "../lib/install-freshness.mjs";
 import { createBuildMetrics, resolveOutcome, finalText, workerMetadata, usageMetrics, policyAdmissionProblems, applyRefactorContract, applyVerificationPolicy, resolveVerifyRegression } from "../lib/outcome.mjs";
 import { compactJobRecord, formatResult, formatUnion, testChangeBanner, regressionCheckBanner, decomposeOverlapBanner } from "../lib/job-format.mjs";
 
@@ -57,6 +58,7 @@ export { TEST_PATH_PATTERNS, isTestPath, testPatternFor, classifyTestChanges, de
 // package.json to the same relative location next to the installed
 // mcp/server.mjs, so this resolves identically in a dev checkout or an
 // installed copy.
+const SERVER_STARTED_MS = Date.now();
 const VERSION = JSON.parse(fs.readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8")).version;
 // Sent to every coordinator on connect, so no project needs a copied CLAUDE.md.
 const server = new McpServer({ name: "nomarmy-local-worker", version: VERSION }, { instructions: COORDINATOR_INSTRUCTIONS });
@@ -406,9 +408,20 @@ server.tool("local_worker_status", `Status of one job started by this server: ph
   if (full && files.meta) return toolText(JSON.stringify(files.meta, null, 2), summary.coordinatorStatus !== "complete");
   return toolText(JSON.stringify({ ...summary, jobDir, hint: entry?.result || files.meta ? "call again with full=true for the complete report" : null }, null, 2), summary.state === "orphaned" || summary.state === "failed");
 });
+// Set when this session's copy of nomArmy changed on disk after it started
+// (nomarmy connect or update ran): shown first in army and capacity, and
+// notified once, since only a restart of this session picks it up.
+let restartNotified = false;
+function currentRestartNotice() {
+  const notice = restartNotice({ serverFile: fileURLToPath(import.meta.url), startedAtMs: SERVER_STARTED_MS, runningVersion: VERSION });
+  if (notice && !restartNotified) { restartNotified = true; try { notify("nomArmy: restart this session", notice); } catch { /* best-effort */ } }
+  return notice;
+}
+const withRestartNotice = (value) => { const notice = currentRestartNotice(); return notice ? { restartNeeded: notice, ...value } : value; };
+
 server.tool("local_worker_capacity", "What this host can take right now: context per nom and the brief/report budgets derived from it, memory pressure and whether another job would be admitted, and the jobs currently running. Read-only.", {}, async () => {
   await budgetState.refresh();
-  return toolText(JSON.stringify(capacitySnapshot(), null, 2));
+  return toolText(JSON.stringify(withRestartNotice(capacitySnapshot()), null, 2));
 });
 // The only way to know what `verification`/`union_verification`/
 // `verify_regression` profile names are actually valid for this repo used to
@@ -515,7 +528,7 @@ server.tool("army", "Who you, the General, are and who you call for what in this
         role.modelNote = `${role.model} isn't in OpenClaw's catalog for ${role.agent}; \`army assign\` checked it with a real test call when it was set, and the catalog can lag new models. Use it as assigned; if a job reports "Unknown model", reassign.`;
       }
     }
-    return toolText(JSON.stringify(summary, null, 2));
+    return toolText(JSON.stringify(withRestartNotice(summary), null, 2));
   } catch (error) {
     return toolText(error.message, true);
   }

package/package.json

@@ -3,7 +3,7 @@
   "description": "A harness for AI coding workers whose claims are never trusted: your coding assistant stays in charge while workers implement and test in sandboxes, on local models, API keys or your own subscriptions.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.6",
+  "version": "0.1.0-alpha.7",
   "private": false,
   "type": "module",
   "engines": {
@@ -21,11 +21,11 @@
     "tag": "alpha"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.1",
     "@secretlint/node": "^13.0.5",
     "@secretlint/secretlint-rule-preset-recommend": "^13.0.5",
     "yaml": "^2.5.0",
-    "zod": "^3.24.0"
+    "zod": "^4.6.5"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",