HeftyKoo · Oct 13, 2026 · Oct 13, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ on:
         description: Existing release tag to publish or retry
         required: true
         type: choice
-        options: [dsh-v0.4.0, terminal-v0.4.0, ext-v0.4.0, dsh-v0.3.0, terminal-v0.3.0, ext-v0.3.0, dsh-v0.2.0, terminal-v0.2.0, terminal-v0.2.1, ext-v0.2.0, ext-v0.2.1]
+        options: [terminal-v0.4.1, dsh-v0.4.0, terminal-v0.4.0, ext-v0.4.0, dsh-v0.3.0, terminal-v0.3.0, ext-v0.3.0, dsh-v0.2.0, terminal-v0.2.0, terminal-v0.2.1, ext-v0.2.0, ext-v0.2.1]
   push:
     tags: ["ext-v*", "dsh-v*", "terminal-v*"]
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## Terminal host 0.4.1 — 2026-10-13
+
+- Add terminal-host version reporting, daily asynchronous npm update checks with caching/backoff, persistent opt-out, and reminders in the private management page and service log.
+- Add `aow update` for explicit global npm upgrades in the original prefix, retaining CLI integrations and enrolled browser origins. Add `aow service restart` and running-version verification. Both protect live shells unless `--force` is explicit and pause new shells during maintenance.
+- Keep automatic checks separate from installation; version-pinned release installers and the extension/DSH update paths remain independent.
+
+### Upgrade
+
+For the first upgrade from 0.4.0 or earlier, finish terminal work, run `aow service uninstall`, and rerun the installer. This installs 0.4.1 and starts the update-capable host. Subsequent upgrades use `aow update` in a separate macOS Terminal after exiting or closing live shells. `aow service restart` reloads already-installed code; explicit `--force` ends live tasks. Chrome/Firefox/Safari extensions and the DSH plugin remain at 0.4.0 with connector protocol 1.
+
 ## 0.4.0 — 2026-10-13
 
 - Add Pi session status, approval and completion notifications alongside Codex and Claude Code.

diff --git a/README.md b/README.md
@@ -71,6 +71,8 @@ For Pi 1.1+, run `pi` in the same terminal. Setup adds `extensions/agentonweb.ts
 
 Use **+** in the terminal tab bar to open another project, click a tab to switch, double-click its name to rename it, or click **×** to close it. Hiding the workspace or refreshing the page keeps your sessions running.
 
+Terminal host 0.4.1 checks for stable npm updates daily and shows reminders in its private management page. Use `aow check-update` to check now or `aow check-update --disable` to turn automatic checks off. After closing live terminals, run `aow update` in a separate macOS Terminal; `aow service restart` reloads already-installed code. For the first upgrade from 0.4.0 or earlier, finish terminal work, run `aow service uninstall`, then rerun the installer.
+
 [Setup and troubleshooting](docs/one-command-setup.md) · [Terminal guide](packages/terminal-host/README.md)
 
 ## Use DeepSeek Harness

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -71,6 +71,8 @@ codex
 
 点击终端标签栏的 **+** 打开另一个项目，点击标签切换，双击名称重命名，点击 **×** 关闭。隐藏工作区或刷新网页不会中断正在运行的会话。
 
+终端主机 0.4.1 每天检查 npm 正式版，并在本地管理页显示更新提醒。运行 `aow check-update` 可立即检查，`aow check-update --disable` 可关闭自动检查。退出或关闭所有终端后，在 Mac 的独立“终端”窗口运行 `aow update` 升级；`aow service restart` 用于加载已安装的新代码。从 0.4.0 或更早版本首次升级时，请先完成终端任务，运行 `aow service uninstall`，再重新运行安装命令。
+
 [安装与常见问题](docs/one-command-setup.md) · [终端指南](packages/terminal-host/README.md)
 
 ## 使用 DeepSeek Harness

diff --git a/apps/terminal-surface/src/index.html b/apps/terminal-surface/src/index.html
@@ -25,6 +25,7 @@
       </p>
       <div id="connection-items"></div>
     </section>
+    <section id="updates" hidden aria-label="Host updates"><p id="update-status" role="status"></p></section>
     <main id="terminal" aria-label="Local terminal"></main>
     <dialog
       id="close-dialog"

diff --git a/apps/terminal-surface/src/main.ts b/apps/terminal-surface/src/main.ts
@@ -541,6 +541,7 @@ async function showConnections() {
       pending: { id: string; origin: string }[];
       grants: { id: string; origin: string }[];
     } = await api("/api/connections");
+    await showUpdates();
     const signature = JSON.stringify(data);
     if (signature === connectionsSignature) return;
     connectionsSignature = signature;
@@ -579,6 +580,20 @@ async function showConnections() {
     /* Delegated terminal viewers have no admin access. */
   }
 }
+async function showUpdates() {
+  try {
+    const data = await api('/api/updates');
+    const panel = document.querySelector<HTMLElement>('#updates');
+    const message = document.querySelector<HTMLElement>('#update-status');
+    if (!panel || !message) return;
+    panel.hidden = false;
+    message.textContent = data.installedVersion !== data.runningVersion
+      ? `Installed ${data.installedVersion} · Running ${data.runningVersion}. Close terminals, then run aow service restart in a separate macOS Terminal.`
+      : data.enabled && data.updateAvailable
+        ? `AgentOnWeb ${data.latest} is available · Running ${data.runningVersion}. Close terminals, then run aow update in a separate macOS Terminal.`
+        : `AgentOnWeb ${data.runningVersion} · Automatic update checks ${data.enabled ? 'enabled' : 'disabled'}.${data.error ? ' Last check failed; try aow check-update later.' : ''}`;
+  } catch { /* Only the private management page has access to version status. */ }
+}
 if (parent === window) {
   void showConnections();
   setInterval(() => {

diff --git a/apps/terminal-surface/src/style.css b/apps/terminal-surface/src/style.css
@@ -85,7 +85,7 @@ main {
   height: 100%;
 }
 
-#connections {
+#connections, #updates {
   background: #202630;
   padding: 12px 16px;
   border-bottom: 1px solid #455164;

diff --git a/docs/one-command-setup.md b/docs/one-command-setup.md
@@ -77,14 +77,21 @@ Run `aow pi-extension install`, then start Pi 1.1+ in an AgentOnWeb terminal or
 
 ## Update or repair
 
-Rerun the installation command to install the current AgentOnWeb terminal package and repair its configuration. Installation leaves active terminal sessions running. To load an updated service, finish your work, then run:
+The host automatically checks the stable npm version at most once a day and displays updates in its private management page and service log. Checks do not install code or restart your terminals. Run these commands in a separate macOS Terminal:
 
 ```sh
-aow service uninstall
-aow setup
+aow --version
+aow service status
+aow check-update
+aow update
+aow service restart
 ```
 
-Stopping the service ends its live shells. Your saved CLI history and browser connections remain. If you move or remove the Node.js installation used by AgentOnWeb, rerun the installer under the Node version you intend to keep, then restart the service as above.
+`aow update` retains the existing global npm prefix, installs the checked stable version, and restarts a running macOS service. Exit or close every terminal first; an idle live shell also blocks maintenance. `aow service restart` reloads already-installed code without reinstalling the package. Both commands reject execution inside an AgentOnWeb terminal; use your Mac's Terminal app. `--force` explicitly permits ending all live shells and their tasks. Restart confirms the new process and version before reporting success. Saved CLI history, browser grants, selected integrations and enrolled extension IDs remain.
+
+Use `aow check-update --disable` to persistently turn automatic checks off, and `--enable` to restore them. Setting `AOW_UPDATE_CHECK=0` in the host environment also disables them; CI skips automatic checks. Explicit checks and upgrades still work. A network failure leaves terminals running, uses cached results and retries with increasing delays. Automatic requests query only npm package metadata, with a three-second timeout. See the [privacy policy](store-site/privacy.md).
+
+These commands require a host version that includes update support. For an older installed host, finish terminal work, run `aow service uninstall`, then rerun the installation command once. The installer remains version-pinned and repairs configuration. Development/npx/other package-manager installations require their original upgrade workflow. If you move or remove Node, rerun the installer under the Node version you intend to keep. npm failure does not trigger a service restart; if the package installed but the service is not ready, inspect `~/.agentonweb/terminal/service.log` and run `aow setup`.
 
 ## Uninstall
 

diff --git a/docs/releasing.md b/docs/releasing.md
@@ -1,16 +1,16 @@
 # Release AgentOnWeb
 
-## 0.4.0 scope
+## Terminal host 0.4.1 scope
 
-This release adds Pi session status alongside Codex and Claude Code, detects installed CLIs during setup and prompts for integrations, recovers disconnected runtime sessions, and preserves independent browser-tab state. Terminal mode shortcuts work from native terminal input: Focus moves input to the terminal, Chill preserves focus, and Watch restores website input. See [CHANGELOG](../CHANGELOG.md).
+Terminal host 0.4.1 adds asynchronous daily npm version checks, private management-page reminders, opt-out, explicit `aow update`, and guarded `aow service restart` with running-version verification. This is a terminal-host-only publication; publish `terminal-v0.4.1`. See [CHANGELOG](../CHANGELOG.md).
 
-The extension, DSH plugin and terminal host use **0.4.0**. Safari targets use marketing version **0.4.0**, build **9**. `release-contract.json` records the artifact versions and filenames. Connector protocol remains **1**, the matching extension and terminal host are both required for the terminal shortcut and focus changes. The DSH compatibility baseline remains **0.1.7-rc.2**; the `dsh-latest` CI job checks the currently published upstream version.
+The terminal host uses **0.4.1**; the extension and DSH plugin remain **0.4.0**. Safari targets remain marketing version **0.4.0**, build **9**. `release-contract.json` records each artifact's independent version and filename. Connector protocol remains **1**. Terminal host 0.4.1 works with the 0.4.0 extension; no browser-store submission or DSH publication is needed for this update. The DSH compatibility baseline remains **0.1.7-rc.2**; the `dsh-latest` CI job checks the currently published upstream version.
 
 | Artifact | Version field | Delivery |
 | --- | --- | --- |
 | Chrome/Firefox extension ZIPs and source | `extensionVersion` | `ext-v0.4.0`, then store submission |
 | DSH plugin TGZ | `pluginVersion` | `dsh-v0.4.0`, npm + GitHub release |
-| Terminal host TGZ + installer | `terminalHostVersion` | `terminal-v0.4.0`, npm + GitHub release |
+| Terminal host TGZ + installer | `terminalHostVersion` | `terminal-v0.4.1`, npm + GitHub release |
 
 A merged branch or GitHub release does not mean a browser store has approved the update. Live terminal acceptance currently covers macOS/Chrome. Firefox/Safari builds and Linux CI do not establish live terminal support on those platforms. Automatic setup targets macOS + Chrome only.
 
@@ -52,24 +52,26 @@ The `dsh-latest` CI job installs `@deepseek-ai/dsh@latest`, builds the actual pl
 After the relevant release is public, users can run:
 
 ```sh
-npm install -g @agentonweb/terminal-host@0.4.0
+npm install -g @agentonweb/terminal-host@0.4.1
 # Repair setup or run it explicitly when lifecycle scripts were blocked:
 aow setup
 ```
 
-The release installer at `https://github.com/HeftyKoo/AgentOnWeb/releases/download/terminal-v0.4.0/install.sh` pins the package to 0.4.0 and explicitly calls setup. The user-facing command downloads `https://raw.githubusercontent.com/HeftyKoo/AgentOnWeb/main/scripts/install.sh`. Both that script and its pinned npm package must be live before announcing the installation flow. The installer uses the user-owned `~/.local` npm prefix, configures zsh/bash/fish startup paths, and links `aow` beside Node when that directory is writable and already on PATH. Existing AgentOnWeb npm links are updated; unrelated commands are preserved. The versioned release URL is a publication target, not proof that the asset exists. Download and inspect it before running it; do not advertise it until the release and clean-install test succeed.
+The release installer at `https://github.com/HeftyKoo/AgentOnWeb/releases/download/terminal-v0.4.1/install.sh` pins the package to 0.4.1 and explicitly calls setup. The user-facing command downloads `https://raw.githubusercontent.com/HeftyKoo/AgentOnWeb/main/scripts/install.sh`. Both that script and its pinned npm package must be live before announcing the installation flow. The installer uses the user-owned `~/.local` npm prefix, configures zsh/bash/fish startup paths, and links `aow` beside Node when that directory is writable and already on PATH. Existing AgentOnWeb npm links are updated; unrelated commands are preserved. The versioned release URL is a publication target, not proof that the asset exists. Download and inspect it before running it; do not advertise it until the release and clean-install test succeed.
 
 ## Local installation and upgrades
 
 Before publishing, use the audited archive with the source-built extension:
 
 ```sh
-AOW_SKIP_SETUP=1 npm install -g ./release/agentonweb-terminal-host-0.4.0.tgz
+AOW_SKIP_SETUP=1 npm install -g ./release/agentonweb-terminal-host-0.4.1.tgz
 aow setup --extension-id YOUR_UNPACKED_CHROME_EXTENSION_ID
 ```
 
 For manual pairing without Chrome/CLI integration, use `aow service install` and the private setup page instead. Setup registers absolute Node/package paths; rerun it when paths change. The official native host allowlist includes the official Chrome extension ID; unpacked IDs must be enrolled explicitly.
 
-Installing over a running service does not reload its code. Finish active shell work, run `aow service uninstall`, then `aow setup` (include the unpacked ID when needed) to activate the installed version. Stopping the service ends live shells; saved CLI history, browser grants and pairing receipts remain. Restart `dsh web` separately after updating its plugin.
+Installing over a running service does not reload its code. With update-capable hosts, close all live shells and run `aow update` from a separate macOS Terminal; it retains the original npm prefix, skips setup to preserve integrations/enrolled extension IDs, installs the checked stable version and verifies the restarted service. `aow service restart` activates code already installed. Both refuse live shells unless `--force` is explicit. Hosts without the maintenance interface need `aow service uninstall`, then the installer or `aow setup` (include the unpacked ID when needed) once. Saved CLI history, browser grants and pairing receipts remain. Restart `dsh web` separately after updating its plugin.
+
+Automatic host checks query the public npm metadata endpoint, cache successful results for 24 hours and back off on failures. They never install code. Publish and verify npm before advancing the public installer pin; versioned release installers remain immutable/pinned. Validate active-shell refusal, original-prefix installation, npm failure, disabled/offline checks, installed-versus-running status and restart readiness with every updater change. Terminal-host checks/commands and its bundled private management page can ship without an extension protocol change. Reminders in extension settings require a separate extension release.
 
 To remove integrations, run `aow uninstall` **before** `npm uninstall -g @agentonweb/terminal-host`. This stops service terminals, removes native registration and AgentOnWeb hooks, and restores the previous notify command while preserving user settings/history/backups. See [setup and recovery](one-command-setup.md).
diff --git a/docs/store-site/privacy.md b/docs/store-site/privacy.md
@@ -4,9 +4,9 @@ title: Privacy Policy
 ---
 # AgentOnWeb Privacy Policy
 
-Effective date: September 29, 2026
+Effective date: October 13, 2026
 
-AgentOnWeb is an open-source browser extension for Chrome, Firefox, and Safari that displays local workspaces over the website you are using. Version 0.2.0 supports DeepSeek Harness and a separate local terminal host. This policy covers the browser extensions, the Safari macOS containing app, the DSH integration and the local terminal host.
+AgentOnWeb is an open-source browser extension for Chrome, Firefox, and Safari that displays local workspaces over the website you are using. The 0.4.0 extension supports DeepSeek Harness and a separate local terminal host for Codex, Claude Code and Pi. Terminal host 0.4.1 adds version checks and explicit upgrade/restart commands. This policy covers the browser extensions, the Safari macOS containing app, the DSH integration and the local terminal host.
 
 ## Data handled on your computer
 
@@ -24,6 +24,8 @@ The shell installer installs the terminal package under `~/.local` and adds its
 
 ## Collection and sharing
 
+The update-capable local terminal host automatically queries public npm metadata for `@agentonweb/terminal-host`, at most once every 24 hours after successful checks. Failed checks use increasing retry delays. npm's infrastructure receives normal request/network information, such as your IP address; the query contains no terminal text, prompts, browsing data, directories, connection credentials or user identifier. Results and the on/off preference are stored locally in `~/.agentonweb/terminal/update-cache.json` and `updates.json`. Checks do not install packages or restart processes. Disable them with `aow check-update --disable`, or `AOW_UPDATE_CHECK=0` in the host environment; CI skips automatic checks. Explicit `aow check-update` and `aow update` still contact npm. An explicit update uses npm to install the checked package and its dependencies under the original global prefix. Live shells block upgrade/restart unless you explicitly use `--force` to end their tasks.
+
 AgentOnWeb does not operate an analytics service, advertising service, or developer-hosted data backend. The extension and containing app do not send your browsing history, website contents, prompts, or connection credentials to the AgentOnWeb developer. AgentOnWeb does not sell personal information or track users across apps and websites for advertising.
 
 In the DSH workspace, anything you type, attach or authorize is handled by DSH and the model providers or plugins you configure. In Local terminal, commands run on your computer with your user permissions. Those commands may read files, use the system clipboard or send data to their configured services; terminal text is delivered locally between the host and browser. Those services may process information outside your computer under their own policies. AgentOnWeb does not promise that your AI conversations remain offline. The extension itself does not automatically scrape or transmit the underlying webpage to a model.