nothumanallowed 16.0.63 → 17.0.0

package/src/legion-bundle.mjs

@@ -0,0 +1,64 @@
+/** Legion X as shipped in the package: its version, and the agents copied to ~/.nha/agents */
+
+import fs from 'fs';
+import path from 'path';
+import {
+  AGENTS, AGENTS_DIR, AGENTS_STAMP_FILE, BUNDLED_AGENTS_DIR, LEGION_FILE, VERSION,
+} from './constants.mjs';
+
+/**
+ * Version of the bundled Legion X, read from the file itself so it cannot
+ * drift from what actually runs.
+ * @returns {string} the version, or 'unknown' when the file cannot be read
+ */
+export function bundledLegionVersion(legionFile = LEGION_FILE) {
+  try {
+    const head = fs.readFileSync(legionFile, 'utf-8').slice(0, 20_000);
+    const match = head.match(/^var VERSION = '([^']+)';/m);
+    return match ? match[1] : 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+/**
+ * Copy the bundled agents into the user's agents directory.
+ *
+ * Runs when the package version changed since the last copy, or when an agent
+ * file is missing. A copy is skipped otherwise, so the check costs one small
+ * read per command.
+ *
+ * @param {object} [options] overrides, used by the tests
+ * @returns {{ copied: number, missing: string[], reason: 'fresh'|'version'|'incomplete'|'up-to-date' }}
+ */
+export function syncBundledAgents(options = {}) {
+  const sourceDir = options.sourceDir || BUNDLED_AGENTS_DIR;
+  const targetDir = options.targetDir || AGENTS_DIR;
+  const stampFile = options.stampFile || AGENTS_STAMP_FILE;
+  const version = options.version || VERSION;
+  const names = options.agents || AGENTS;
+
+  let stamp = '';
+  try { stamp = fs.readFileSync(stampFile, 'utf-8').trim(); } catch { /* no stamp yet */ }
+
+  const absent = names.filter((name) => !fs.existsSync(path.join(targetDir, `${name}.mjs`)));
+  let reason = 'up-to-date';
+  if (!stamp) reason = 'fresh';
+  else if (stamp !== version) reason = 'version';
+  else if (absent.length > 0) reason = 'incomplete';
+  if (reason === 'up-to-date') return { copied: 0, missing: [], reason };
+
+  fs.mkdirSync(targetDir, { recursive: true });
+  const toCopy = reason === 'incomplete' ? absent : names;
+  const missing = [];
+  let copied = 0;
+  for (const name of toCopy) {
+    const source = path.join(sourceDir, `${name}.mjs`);
+    if (!fs.existsSync(source)) { missing.push(name); continue; }
+    fs.copyFileSync(source, path.join(targetDir, `${name}.mjs`));
+    copied++;
+  }
+  // The stamp is written only for a complete copy: a partial one is retried.
+  if (missing.length === 0) fs.writeFileSync(stampFile, version + '\n', 'utf-8');
+  return { copied, missing, reason };
+}

package/src/legion-config.mjs

@@ -0,0 +1,134 @@
+/** Translate the nha config into the flat config Legion X reads, and say whether it can run */
+
+/** Providers Legion X can deliberate with. */
+export const LEGION_PROVIDERS = [
+  'ollama', 'local-openai', 'anthropic', 'openai', 'gemini', 'deepseek', 'grok', 'mistral', 'cohere',
+];
+
+/** Cloud provider → [field of nha's llm section, key name Legion reads]. */
+const CLOUD_KEYS = {
+  anthropic: ['anthropicKey', 'anthropicApiKey'],
+  openai: ['openaiKey', 'openaiApiKey'],
+  gemini: ['geminiKey', 'geminiApiKey'],
+  deepseek: ['deepseekKey', 'deepseekApiKey'],
+  grok: ['grokKey', 'grokApiKey'],
+  mistral: ['mistralKey', 'mistralApiKey'],
+  cohere: ['cohereKey', 'cohereApiKey'],
+};
+
+const LOCAL_PROVIDERS = ['ollama', 'local-openai'];
+
+/** Environment variable Legion reads for the key of each cloud provider. */
+export const CLOUD_KEY_ENV = {
+  anthropic: 'ANTHROPIC_API_KEY', openai: 'OPENAI_API_KEY', gemini: 'GEMINI_API_KEY',
+  deepseek: 'DEEPSEEK_API_KEY', grok: 'XAI_API_KEY', mistral: 'MISTRAL_API_KEY', cohere: 'COHERE_API_KEY',
+};
+
+/**
+ * The provider Legion deliberates with: the one chosen for Legion, else the
+ * toolkit provider when Legion supports it, else none (Legion then uses
+ * whatever has a key, or a local model).
+ */
+export function resolveLegionProvider(config) {
+  const chosen = String(config.legion?.provider || '').trim();
+  if (chosen) return chosen;
+  const shared = String(config.llm?.provider || '').trim();
+  return LEGION_PROVIDERS.includes(shared) ? shared : '';
+}
+
+/**
+ * Build the Legion config from the nha config. The result is derived in full
+ * every time: the nha config is the only place settings are kept, so a key
+ * removed there is gone from Legion too.
+ *
+ * `llm.apiKey` is the key of `llm.provider` and of no other provider.
+ */
+export function buildLegionConfig(config) {
+  const llm = config.llm || {};
+  const legion = config.legion || {};
+  const features = config.features || {};
+  const deliberation = config.deliberation || {};
+
+  const out = {
+    provider: resolveLegionProvider(config),
+    llmModel: llm.model || '',
+    // Always empty: every key is written under its provider's own name.
+    llmApiKey: '',
+  };
+
+  // Legion spreads the agents across every provider it has a key for. With
+  // local-only on, no cloud key is handed over: nothing leaves the machine.
+  out.localOnly = legion.localOnly === true;
+  for (const [provider, [nhaField, legionField]] of Object.entries(CLOUD_KEYS)) {
+    out[legionField] = out.localOnly ? '' : llm[nhaField] || (llm.provider === provider ? llm.apiKey || '' : '');
+  }
+
+  out.ollamaUrl = legion.ollamaUrl || 'http://localhost:11434';
+  if (legion.ollamaModel) out.ollamaModel = legion.ollamaModel;
+  if (legion.ollamaModels) out.ollamaModels = legion.ollamaModels;
+  if (legion.ollamaEmbedModel) out.ollamaEmbedModel = legion.ollamaEmbedModel;
+  if (legion.localOpenaiUrl) out.localOpenaiUrl = legion.localOpenaiUrl;
+  if (legion.localOpenaiModel) out.localOpenaiModel = legion.localOpenaiModel;
+  if (legion.localOpenaiKey) out.localOpenaiKey = legion.localOpenaiKey;
+  if (legion.orchestratorProvider) out.orchestratorProvider = legion.orchestratorProvider;
+  out.economy = legion.economy === true;
+  out.factCheckEnabled = legion.factCheck !== false;
+  if (Number(legion.crossReadingChars) > 0) out.crossReadingChars = Number(legion.crossReadingChars);
+
+  out.timeout = llm.timeout || 120000;
+  out.maxRetries = llm.maxRetries || 2;
+  out.parallelism = llm.parallelism || 4;
+  out.verbose = features.verbose ?? true;
+  out.immersive = features.immersive ?? true;
+  out.knowledgeEnabled = features.knowledgeEnabled ?? true;
+  out.workspaceEnabled = features.workspaceEnabled ?? true;
+  out.latentSpaceEnabled = features.latentSpaceEnabled ?? true;
+  out.knowledgeGraphEnabled = features.knowledgeGraphEnabled ?? true;
+  out.promptEvolutionEnabled = features.promptEvolutionEnabled ?? true;
+  out.metaIntelligenceEnabled = features.metaIntelligenceEnabled ?? true;
+  out.deliberationEnabled = deliberation.enabled ?? true;
+  out.deliberationRounds = deliberation.rounds || 3;
+  out.deliberationConvergence = deliberation.convergence || 0.82;
+  out.minDeliberationRounds = deliberation.minRounds || 2;
+  out.semanticConvergenceEnabled = deliberation.semanticConvergence ?? true;
+  out.tribunalEnabled = deliberation.tribunalEnabled ?? true;
+  return out;
+}
+
+/**
+ * Whether a deliberation can start with this Legion config.
+ * A cloud provider needs its key; a local one needs nothing here (Legion
+ * reports by itself when the local runtime does not answer).
+ *
+ * @param {object} legionConfig result of buildLegionConfig
+ * @param {object} [env] environment, for keys given as variables
+ * @returns {{ ready: boolean, providers: string[], reason: string }}
+ */
+export function legionReadiness(legionConfig, env = process.env) {
+  const providers = [];
+  if (!legionConfig.localOnly) {
+    for (const [provider, [, legionField]] of Object.entries(CLOUD_KEYS)) {
+      if (legionConfig[legionField] || env[CLOUD_KEY_ENV[provider]]) providers.push(provider);
+    }
+  }
+  if (legionConfig.localOpenaiUrl) providers.push('local-openai');
+  if (legionConfig.provider === 'ollama' || legionConfig.ollamaModel || legionConfig.ollamaModels) providers.push('ollama');
+
+  const chosen = legionConfig.provider;
+  if (chosen && !LEGION_PROVIDERS.includes(chosen)) {
+    return { ready: false, providers, reason: `"${chosen}" is not a provider Legion can deliberate with.` };
+  }
+  if (chosen && !LOCAL_PROVIDERS.includes(chosen) && legionConfig.localOnly) {
+    return { ready: false, providers, reason: `local-only is on, but "${chosen}" is a cloud provider. Set legion-provider to ollama or local-openai.` };
+  }
+  if (chosen && !LOCAL_PROVIDERS.includes(chosen) && !providers.includes(chosen)) {
+    return { ready: false, providers, reason: `Provider "${chosen}" is selected but has no API key.` };
+  }
+  if (chosen === 'local-openai' && !legionConfig.localOpenaiUrl) {
+    return { ready: false, providers, reason: 'Provider "local-openai" is selected but local-openai-url is not set.' };
+  }
+  if (providers.length === 0) {
+    return { ready: false, providers, reason: 'No LLM provider is configured for deliberations.' };
+  }
+  return { ready: true, providers, reason: '' };
+}

package/src/server/index.mjs

@@ -473,20 +473,64 @@ export async function startServer({ port = 3847, host = '127.0.0.1', noBrowser =
 
   if (!noBrowser) openBrowser(`http://localhost:${port}`);
 
-  // Cleanup sandbox processes on server shutdown
+  // ── Unified graceful shutdown ─────────────────────────────────────────────
+  // Stops, in this order: PAO daemon (Telegram bot + cron + Gmail/Calendar
+  // pollers), orphan WS listener on 3848, sandbox processes on 4000-4010, the
+  // HTTP server itself. Second Ctrl+C bails out hard. 5-second hard timeout
+  // guards against any step hanging.
+  let shuttingDown = false;
   const cleanup = async () => {
+    if (shuttingDown) {
+      process.stderr.write(`\n  ${R}✗${NC} ${D}Force exit${NC}\n`);
+      process.exit(130);
+    }
+    shuttingDown = true;
+    process.stdout.write(`\n  ${D}Shutting down...${NC}\n`);
+
+    const hardTimeout = setTimeout(() => {
+      process.stderr.write(`  ${R}!${NC} ${D}Timed out, killing process${NC}\n`);
+      process.exit(1);
+    }, 5000);
+    hardTimeout.unref();
+
+    // 1. PAO daemon (Telegram, cron, Gmail/Calendar pollers, notifications)
+    try {
+      const { stopDaemon, isRunning: isDaemonRunning } = await import('../services/ops-daemon.mjs');
+      if (isDaemonRunning()) {
+        const r = stopDaemon();
+        if (r.ok) process.stdout.write(`  ${G}✓${NC} ${D}PAO daemon stopped (PID ${r.pid})${NC}\n`);
+      }
+    } catch {}
+
+    // 2. Orphan WS listeners on port 3848 (stale daemon instances from
+    //    previous sessions that never cleaned up)
+    try {
+      const { execSync } = await import('child_process');
+      const out = execSync('lsof -ti:3848 2>/dev/null', { encoding: 'utf-8', timeout: 1500 }).trim();
+      const pids = out.split('\n').filter(Boolean).filter((p) => p !== String(process.pid));
+      for (const pid of pids) { try { process.kill(parseInt(pid), 'SIGTERM'); } catch {} }
+      if (pids.length) process.stdout.write(`  ${G}✓${NC} ${D}Cleaned ${pids.length} orphan(s) on port 3848${NC}\n`);
+    } catch {}
+
+    // 3. WebCraft sandbox processes (4000-4010)
     try {
-      const { exec } = await import('child_process');
-      const { promisify } = await import('util');
-      const execAsync = promisify(exec);
+      const { execSync } = await import('child_process');
+      let sandboxKilled = 0;
       for (let p = 4000; p <= 4010; p++) {
         try {
-          const { stdout } = await execAsync(`lsof -ti:${p} 2>/dev/null || fuser ${p}/tcp 2>/dev/null`, { timeout: 2000 });
-          const pids = stdout.trim().split(/\s+/).filter(Boolean);
-          for (const pid of pids) { try { process.kill(parseInt(pid), 'SIGKILL'); } catch {} }
+          const out = execSync(`lsof -ti:${p} 2>/dev/null`, { encoding: 'utf-8', timeout: 1500 }).trim();
+          const pids = out.split('\n').filter(Boolean);
+          for (const pid of pids) { try { process.kill(parseInt(pid), 'SIGKILL'); sandboxKilled++; } catch {} }
         } catch {}
       }
+      if (sandboxKilled) process.stdout.write(`  ${G}✓${NC} ${D}Stopped ${sandboxKilled} sandbox process(es)${NC}\n`);
     } catch {}
+
+    // 4. HTTP server — close listening socket so the port frees up immediately
+    try { server.close(); } catch {}
+
+    process.stdout.write(`  ${G}✓${NC} ${D}Bye${NC}\n`);
+    clearTimeout(hardTimeout);
     process.exit(0);
   };
   process.on('SIGINT', cleanup);

package/src/services/llm.mjs

@@ -720,6 +720,29 @@ export async function callCohere(apiKey, model, systemPrompt, userMessage, _stre
   return data.text || '';
 }
 
+// ── Hosted free model offline ──────────────────────────────────────────────
+
+/**
+ * What the user reads when the hosted free model is switched off. The server
+ * then answers 200 with a canned assistant message ("try again in a few
+ * minutes") marked `__liara_unavailable`: shown as an answer, it reads like a
+ * passing fault and never says that another model has to be set.
+ */
+export const HOSTED_OFFLINE_MESSAGE = [
+  'The hosted free model (Liara) is offline. Set your own model:',
+  '  nha config set provider anthropic   (or openai, gemini, deepseek, grok, mistral, cohere, openrouter)',
+  '  nha config set key YOUR_API_KEY',
+  'For deliberations (nha run) a local model works with no key:',
+  '  nha config set legion-provider ollama',
+].join('\n');
+
+/** The error for a `__liara_unavailable` answer, flagged so callers can tell it apart. */
+export function hostedOfflineError() {
+  const err = new Error(HOSTED_OFFLINE_MESSAGE);
+  err.__hosted_offline = true;
+  return err;
+}
+
 // ── SSE Stream Parser ──────────────────────────────────────────────────────
 
 export async function streamSSE(res, format) {
@@ -741,23 +764,23 @@ export async function streamSSE(res, format) {
       const data = line.slice(6).trim();
       if (data === '[DONE]') continue;
 
-      try {
-        const json = JSON.parse(data);
-        let chunk = '';
+      let json;
+      try { json = JSON.parse(data); } catch { continue; }
+      if (json.__liara_unavailable) throw hostedOfflineError();
 
-        if (format === 'anthropic') {
-          if (json.type === 'content_block_delta') {
-            chunk = json.delta?.text || '';
-          }
-        } else {
-          chunk = json.choices?.[0]?.delta?.content || '';
+      let chunk = '';
+      if (format === 'anthropic') {
+        if (json.type === 'content_block_delta') {
+          chunk = json.delta?.text || '';
         }
+      } else {
+        chunk = json.choices?.[0]?.delta?.content || '';
+      }
 
-        if (chunk) {
-          process.stdout.write(chunk);
-          fullText += chunk;
-        }
-      } catch {}
+      if (chunk) {
+        process.stdout.write(chunk);
+        fullText += chunk;
+      }
     }
   }
 
@@ -832,6 +855,7 @@ export async function callNHA(apiKey, model, systemPrompt, userMessage, stream =
   }
   if (stream) return streamSSE(res, 'openai');
   const data = await res.json();
+  if (data.__liara_unavailable) throw hostedOfflineError();
   let content = data.choices?.[0]?.message?.content || '';
   // Strip thinking tags if present
   content = content.replace(/<think>[\s\S]*?<\/think>/g, '').trim();
@@ -1228,7 +1252,7 @@ export async function callLLMVision(config, systemPrompt, userMessage, media) {
   }
 
   const apiKey = getApiKey(config, provider);
-  if (!apiKey) throw new Error(`No API key for ${provider}. Vision requires Claude, GPT-4, Gemini, or NHA Free (nha config set provider nha).`);
+  if (!apiKey) throw new Error(`No API key for ${provider}. Vision requires Claude, GPT-4 or Gemini with your own key (nha config set key YOUR_KEY).`);
 
   const { base64, mimeType } = media;
   if (!base64 || !mimeType) throw new Error('media.base64 and media.mimeType are required');
@@ -1410,6 +1434,11 @@ export async function callLLMStream(config, systemPrompt, userMessage, onToken,
     }
     // Non-streaming: vLLM returns complete text — no BPE subword splitting issues
     const nhaJson = await nhaRes.json();
+    // Hosted model switched off — shown to the user, never saved as an answer
+    if (nhaJson.__liara_unavailable) {
+      if (onToken) onToken(HOSTED_OFFLINE_MESSAGE);
+      throw hostedOfflineError();
+    }
     // SENTINEL blocked — throw special error so caller skips conversation persistence
     if (nhaJson.__sentinel_blocked) {
       const blockedMsg = nhaJson.choices?.[0]?.message?.content || 'Message blocked by SENTINEL.';

package/src/services/message-responder.mjs

@@ -3868,7 +3868,7 @@ export function startResponder(config, log, wsBroadcast) {
   const provider = (config.llm?.provider || 'nha').toLowerCase();
   const PAID_PROVIDERS = new Set(['anthropic', 'openai', 'gemini', 'deepseek', 'grok', 'mistral', 'cohere']);
   if (PAID_PROVIDERS.has(provider) && !config.llm?.apiKey) {
-    log(`[Responder] Provider "${provider}" requires an API key — cannot respond. Run: nha config set provider nha   (to switch to free Liara)   OR   nha config set ${provider}-key YOUR_KEY`);
+    log(`[Responder] Provider "${provider}" requires an API key — cannot respond. Run: nha config set key YOUR_KEY`);
     return { telegram: false, discord: false, reason: `missing_key:${provider}` };
   }
 

package/src/spawn.mjs

@@ -4,51 +4,22 @@ import fs from 'fs';
 import path from 'path';
 import { spawn } from 'child_process';
 import { loadConfig } from './config.mjs';
-import { NHA_DIR, LEGION_FILE, PIF_FILE, AGENTS_DIR, EXTENSIONS_DIR, SESSIONS_DIR } from './constants.mjs';
+import { buildLegionConfig, CLOUD_KEY_ENV } from './legion-config.mjs';
+import {
+  NHA_DIR, LEGION_FILE, LEGION_CONFIG_FILE, PIF_FILE, AGENTS_DIR, EXTENSIONS_DIR, SESSIONS_DIR,
+} from './constants.mjs';
 
 /**
- * Write a Legion-compatible flat config from the NHA structured config.
- * Legion expects: { llmProvider, llmApiKey, nhaAgentId, nhaPrivateKeyPem, ... }
- * NHA stores: { llm: { provider, apiKey }, agent: { id, privateKeyPem }, ... }
+ * Write the flat config Legion X reads, derived in full from the nha config.
+ * The file holds API keys: it is readable by its owner only.
  */
 function writeLegionConfig(config) {
-  const legionConfig = {
-    llmProvider: config.llm?.provider || 'anthropic',
-    llmApiKey: config.llm?.apiKey || '',
-    llmModel: config.llm?.model || '',
-    openaiKey: config.llm?.openaiKey || '',
-    geminiKey: config.llm?.geminiKey || '',
-    deepseekKey: config.llm?.deepseekKey || '',
-    grokKey: config.llm?.grokKey || '',
-    mistralKey: config.llm?.mistralKey || '',
-    cohereKey: config.llm?.cohereKey || '',
-    timeout: config.llm?.timeout || 120000,
-    maxRetries: config.llm?.maxRetries || 2,
-    parallelism: config.llm?.parallelism || 4,
-    verbose: config.features?.verbose ?? true,
-    immersive: config.features?.immersive ?? true,
-    knowledgeEnabled: config.features?.knowledgeEnabled ?? true,
-    workspaceEnabled: config.features?.workspaceEnabled ?? true,
-    latentSpaceEnabled: config.features?.latentSpaceEnabled ?? true,
-    knowledgeGraphEnabled: config.features?.knowledgeGraphEnabled ?? true,
-    promptEvolutionEnabled: config.features?.promptEvolutionEnabled ?? true,
-    metaIntelligenceEnabled: config.features?.metaIntelligenceEnabled ?? true,
-    deliberationEnabled: config.deliberation?.enabled ?? true,
-    deliberationRounds: config.deliberation?.rounds || 3,
-    deliberationConvergence: config.deliberation?.convergence || 0.82,
-    minDeliberationRounds: config.deliberation?.minRounds || 2,
-    semanticConvergenceEnabled: config.deliberation?.semanticConvergence ?? true,
-    tribunalEnabled: config.deliberation?.tribunalEnabled ?? true,
-    // Agent identity
-    nhaAgentId: config.agent?.id || '',
-    nhaAgentName: config.agent?.name || '',
-    nhaPrivateKeyPem: config.agent?.privateKeyPem || '',
-    nhaPublicKeyHex: config.agent?.publicKeyHex || '',
-  };
-
-  const legionConfigFile = path.join(NHA_DIR, '.legion-config.json');
-  fs.writeFileSync(legionConfigFile, JSON.stringify(legionConfig, null, 2) + '\n', 'utf-8');
-  return legionConfigFile;
+  const legionConfig = buildLegionConfig(config);
+  fs.mkdirSync(NHA_DIR, { recursive: true });
+  fs.writeFileSync(LEGION_CONFIG_FILE, JSON.stringify(legionConfig, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
+  // The mode above applies to a new file only: an existing one is tightened here.
+  fs.chmodSync(LEGION_CONFIG_FILE, 0o600);
+  return legionConfig;
 }
 
 /**
@@ -62,9 +33,8 @@ export function spawnCore(target, args) {
   const config = loadConfig();
 
   // For Legion: write a flat config it can understand
-  const configFile = target === 'legion'
-    ? writeLegionConfig(config)
-    : path.join(NHA_DIR, 'config.json');
+  const legionConfig = target === 'legion' ? writeLegionConfig(config) : null;
+  const configFile = legionConfig ? LEGION_CONFIG_FILE : path.join(NHA_DIR, 'config.json');
 
   const env = {
     ...process.env,
@@ -72,8 +42,16 @@ export function spawnCore(target, args) {
     NHA_EXTENSIONS_DIR: EXTENSIONS_DIR,
     NHA_SESSIONS_DIR: SESSIONS_DIR,
     NHA_CONFIG_FILE: configFile,
+    // Legion ships with this package and is updated with it: it has no
+    // version of its own to look up.
+    LEGION_NO_UPDATE_CHECK: '1',
   };
 
+  // Local-only: a cloud key exported in the shell must not reach Legion either.
+  if (legionConfig?.localOnly) {
+    for (const name of Object.values(CLOUD_KEY_ENV)) delete env[name];
+  }
+
   return new Promise((resolve) => {
     const child = spawn(process.execPath, [file, ...args], {
       stdio: 'inherit',

package/src/updater.mjs

@@ -1,12 +1,18 @@
-/** Update checker and updater for core files + agents */
+/**
+ * Update checker and updater.
+ *
+ * Legion X and the agents ship inside the npm package: they are updated by
+ * updating the package, never downloaded on their own. Only PIF still comes
+ * from the website.
+ */
 
 import fs from 'fs';
 import {
-  BASE_URL, VERSIONS_FILE, LAST_UPDATE_CHECK,
-  LEGION_FILE, PIF_FILE, AGENTS_DIR, AGENTS, VERSION,
+  BASE_URL, VERSIONS_FILE, LAST_UPDATE_CHECK, PIF_FILE, VERSION,
 } from './constants.mjs';
-import { download, downloadBatch } from './downloader.mjs';
-import { info, ok, warn, progress } from './ui.mjs';
+import { download } from './downloader.mjs';
+import { bundledLegionVersion, syncBundledAgents } from './legion-bundle.mjs';
+import { info, ok, warn } from './ui.mjs';
 
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
@@ -37,10 +43,7 @@ export async function checkForUpdates() {
     }
 
     const updates = [];
-    if (remote['legion-x']?.latest !== local['legion-x']?.latest) {
-      updates.push({ name: 'Legion X', from: local['legion-x']?.latest ?? '?', to: remote['legion-x'].latest });
-    }
-    if (remote['pif']?.latest !== local['pif']?.latest) {
+    if (remote['pif']?.latest && remote['pif'].latest !== local['pif']?.latest) {
       updates.push({ name: 'PIF', from: local['pif']?.latest ?? '?', to: remote['pif'].latest });
     }
 
@@ -128,7 +131,7 @@ async function npmSelfInstall(targetVersion) {
 }
 
 /**
- * Full update: re-download core files + agents + self-upgrade the npm package.
+ * Full update: self-upgrade the npm package (which carries Legion X and the agents) and refresh PIF.
  */
 export async function runUpdate() {
   info('Checking for updates...');
@@ -169,65 +172,47 @@ export async function runUpdate() {
     ok(`npm package nothumanallowed@${npmCheck.current} (up to date)`);
   }
 
-  // ── Agents + Legion + PIF (downloaded from website, not npm) ───────────
-  // 45s timeout (was 15s) — VMs / slow connections can take that long for
-  // the first manifest fetch. The downloader retries internally for batch
-  // downloads, so this is just for the initial manifest.
-  const res = await fetch(`${BASE_URL}/versions.json`, {
-    signal: AbortSignal.timeout(45000),
-    headers: { 'User-Agent': `nha-cli/${(await import('./constants.mjs')).VERSION}` },
-  });
-  if (!res.ok) {
-    warn('Could not reach nothumanallowed.com for agent updates.');
-    return;
-  }
-
-  const remote = await res.json();
-  let local = {};
-  if (fs.existsSync(VERSIONS_FILE)) {
-    try { local = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf-8')); } catch {}
-  }
-
-  const legionCurrent = local['legion-x']?.latest ?? '?';
-  const legionLatest = remote['legion-x']?.latest ?? '?';
-  const pifCurrent = local['pif']?.latest ?? '?';
-  const pifLatest = remote['pif']?.latest ?? '?';
-
   let updated = npmUpdated;
 
-  // Update Legion
-  if (legionCurrent !== legionLatest) {
-    info(`Legion X: ${legionCurrent} → ${legionLatest}`);
-    const success = await download(`${BASE_URL}/legion-x.mjs`, LEGION_FILE, { timeout: 90_000, retries: 4 });
-    if (success) { ok(`Legion X updated to v${legionLatest}`); updated = true; }
-  } else {
-    ok(`Legion X v${legionCurrent} (up to date)`);
-  }
+  // ── Legion X + agents: part of the package ─────────────────────────────
+  // A freshly installed package brings its own Legion and agents; they are
+  // put in place the next time `nha` starts. Here the agents of the running
+  // version are restored if any went missing.
+  ok(`Legion X v${bundledLegionVersion()} (bundled with nothumanallowed@${VERSION})`);
+  const agents = syncBundledAgents();
+  if (agents.copied > 0) { ok(`${agents.copied} agents restored from the package`); updated = true; }
+
+  // ── PIF (downloaded from website, not npm) ─────────────────────────────
+  // 45s timeout — VMs / slow connections can take that long for the manifest.
+  let remote = null;
+  try {
+    const res = await fetch(`${BASE_URL}/versions.json`, {
+      signal: AbortSignal.timeout(45000),
+      headers: { 'User-Agent': `nha-cli/${VERSION}` },
+    });
+    if (res.ok) remote = await res.json();
+  } catch { /* reported below */ }
 
-  // Update PIF
-  if (pifCurrent !== pifLatest) {
-    info(`PIF: ${pifCurrent} → ${pifLatest}`);
-    const success = await download(`${BASE_URL}/pif.mjs`, PIF_FILE, { timeout: 90_000, retries: 4 });
-    if (success) { ok(`PIF updated to v${pifLatest}`); updated = true; }
+  if (!remote) {
+    warn('Could not reach nothumanallowed.com: PIF not checked. Nothing else depends on it.');
   } else {
-    ok(`PIF v${pifCurrent} (up to date)`);
+    let local = {};
+    if (fs.existsSync(VERSIONS_FILE)) {
+      try { local = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf-8')); } catch {}
+    }
+    const pifCurrent = local['pif']?.latest ?? '?';
+    const pifLatest = remote['pif']?.latest ?? '?';
+    if (pifCurrent !== pifLatest || !fs.existsSync(PIF_FILE)) {
+      info(`PIF: ${pifCurrent} → ${pifLatest}`);
+      const success = await download(`${BASE_URL}/pif.mjs`, PIF_FILE, { timeout: 90_000, retries: 4 });
+      if (success) { ok(`PIF updated to v${pifLatest}`); updated = true; }
+    } else {
+      ok(`PIF v${pifCurrent} (up to date)`);
+    }
+    await download(`${BASE_URL}/versions.json`, VERSIONS_FILE);
+    fs.writeFileSync(LAST_UPDATE_CHECK, String(Date.now()));
   }
 
-  // Re-download all agents (they may have been updated)
-  info(`Updating ${AGENTS.length} agents...`);
-  const agentTasks = AGENTS.map(name => ({
-    url: `${BASE_URL}/agents/${name}.mjs`,
-    dest: `${AGENTS_DIR}/${name}.mjs`,
-  }));
-  const result = await downloadBatch(agentTasks, 8, (done, total) => {
-    progress(done, total, 'agents');
-  });
-  ok(`${result.ok}/${AGENTS.length} agents updated`);
-
-  // Save new versions manifest
-  await download(`${BASE_URL}/versions.json`, VERSIONS_FILE);
-  fs.writeFileSync(LAST_UPDATE_CHECK, String(Date.now()));
-
   if (updated) {
     console.log('');
     ok('Update complete!');