provider update advisories

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[justsomelegs]

What Changed

Compared to main, this PR adds provider update advisories and update-state UI for installed providers.

Server-side:

• adds provider version lifecycle/update state tracking
• adds provider updater logic and related contract/RPC plumbing so the UI can know when a provider has an update available, is updating, succeeded, or failed

Web-side:

• adds provider update toasts with a one-click Update action
• adds a sidebar provider update pill for in-progress, success, and failure states
• adds provider-specific success/failure copy
• updates provider settings status copy to Up to date.
• smooth-scrolls to the providers section when opening settings from update UI entry points

Also includes tests covering the update lifecycle, updater behavior, notification logic, and the rebased provider registry fixture change.

Why

main does not have provider update advisories or a dedicated way to surface provider update state in the UI.

This PR adds that missing flow so users can:

• see when an installed provider has an update available
• trigger the update directly from the UI
• see update progress and result state in a persistent place
• get clearer provider status after the update completes

The toast handles the action. The sidebar pill handles ongoing state and final status.

UI Changes

Compared to main:

Before:

• no provider update advisory UI
• no provider update progress/status pill
• provider settings did not show post-update status

After:

• outdated providers can surface update toasts with an Update action
• the sidebar shows provider update progress/result state
• success auto-dismisses after a short timeout
• failure remains visible until dismissed
• provider settings show Up to date. after a successful update

TOASTS

SETTINGS

update.demo.vid.mp4

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Add provider update advisories, one-click updates, and version tracking across AI provider drivers

• Adds version advisory support to Claude, Codex, Cursor, and OpenCode drivers: each driver now queries npm/Homebrew/native CLI for the latest version and attaches a versionAdvisory (status, versions, update command) to provider snapshots.
• Introduces ProviderMaintenanceRunner and providerMaintenance modules to resolve per-driver update capabilities, coordinate serialized update command execution, and capture bounded stdout/stderr with timeout control.
• Exposes a new server.updateProvider RPC/IPC method (WebSocket + LocalApi) that triggers provider updates and returns updated provider snapshots.
• Adds a dedicated Providers settings panel with per-card update UI: an 'Update available' popover with a one-click 'Update now' button or clipboard copy for the update command.
• Adds ProviderUpdateLaunchNotification (app-shell toast) and SidebarProviderUpdatePill (sidebar footer) to surface update prompts at launch with auto-dismiss, progress tracking, and navigation to provider settings.
• Persists dismissed notification keys in client settings and localStorage via providerUpdateDismissal utilities.
• Risk: makeManagedServerProvider now requires a maintenanceCapabilities field (breaking change for callers); driver environments must provide HttpClient.

^{Macroscope summarized 55f46fa.}

---

---

Note

High Risk
Adds a new server-side update runner that executes provider update commands and threads volatile update state through the provider registry and WebSocket RPC, which is security- and stability-sensitive. Also changes provider snapshot construction/enrichment and persistence behavior, increasing risk of regressions in provider status caching and UI state.

Overview
Adds provider update advisories and one-click updates. Provider drivers now compute maintenanceCapabilities and enrich snapshots with a versionAdvisory fetched via HTTP (npm latest) so the UI can detect “behind latest” providers.

Introduces an update execution flow. A new ProviderMaintenanceRunner runs allowlisted update commands (with locking, timeouts, and truncated output capture), exposes it via serverUpdateProvider WebSocket RPC, and projects per-instance updateState into provider snapshots without persisting it.

Refactors snapshot/caching plumbing to support this state.makeManagedServerProvider now requires maintenanceCapabilities; ProviderRegistry adds helpers to merge snapshots while preserving model capabilities on empty refreshes and only persists refreshed instances; and stream text collection is centralized via collectUint8StreamText (also reused by VCS output collection).

^{Reviewed by Cursor Bugbot for commit 55f46fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 343c17c5-6351-43e2-9829-63a3c893691d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

just merged a large refactor on how drivers work and is registerred so this will need to be updated, i can review it when it is

[justsomelegs]

@juliusmarminge this has been rebased now :)

[juliusmarminge]

where is the update button?

[juliusmarminge]

and there should be some "dismiss until next update" or something so it doesn't reprompt every load:

CleanShot.2026-05-02.at.00.05.13.mp4

[juliusmarminge]

@justsomelegs mind trying it out now? made some changers

[justsomelegs]

@juliusmarminge LGTM, the only things i changed were the toast to track the providers exact provider instanceId instead of collapsing by driver, so it stays aligned with the new instance-scoped update state and updated the tests to accomofate the popover changes you made

[juliusmarminge]

yea made some architectural changes since i think this flow will eventually be extended to support installing drivers from and adding a proper onboarding etc

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}

[cursor]

Queued state always published even without contention

Low Severity

onQueued fires unconditionally before acquiring the semaphore permit, meaning every provider update transitions through a "queued" state with message "Waiting for another provider update to finish." even when the semaphore is immediately available and no other update is running. This results in a briefly misleading sidebar pill and state history for single-provider updates with no contention.

^{Reviewed by Cursor Bugbot for commit 55f46fa. Configure here.}