How updates work

Command Center keeps itself current, and it does so by checking rather than acting. You install once from the full installer; after that the app watches the update channel, tells you when a new version exists, and installs it the moment you say so. This page explains what actually happens, what an update does and does not touch on your disk, and how the app behaves when you are offline.

The update loop

With automatic checking on, Command Center checks the update channel at launch and every four hours. When it finds a newer release it tells you, and the notification carries a one-click Restart & update.

Nothing installs on its own. Installing an update restarts the app, which would end running agents and terminal sessions mid-work — so that step is always yours to take, at a moment that suits you. There is no silent-install setting to find, because there is no silent install.

Two controls live in Settings ▸ Updates:

• Check for updates automatically — on by default. Turn it off and the app never checks on its own.
• Check for updates — your own explicit check, and deliberately not disabled by the toggle above. It always reports a result, including "up to date". The same card shows the version you are running.

Two properties of the loop matter beyond the buttons:

• Every update is cryptographically verified. Releases are signed when they are built, and the app checks the signature before installing anything. An update that fails verification is simply not installed — the channel being reachable is never, by itself, enough.
• Updates require your sign-in, not your subscription. The update channel is authenticated by your account, and it is deliberately not gated on tier or on billing state: fixes and security patches keep reaching a signed-in install whose subscription has lapsed. What your subscription controls is which capabilities are unlocked — see Tiers — not whether your software stays healthy.

What an update touches, and what it does not

A release carries the whole platform, not just the app window: the desktop shell, the local services, the agent definitions, skills, and protocols your agents read, and the integrations the production features run on. But "carries" is not "overwrites". Files on your disk fall into three classes, and the difference is the one thing worth knowing here:

The middle class is the one that surprises people, and it is deliberate: editing an agent or a protocol is the product's point, so an update will never overwrite your version of one — which also means improvements to a file you have edited do not arrive on their own. When you want the shipped versions back, Settings ▸ Doctor carries a Refresh doctrine action on its Doctrine row that does exactly that: it backs your copies up first, seeds anything missing, leaves identical files alone, and never removes doctrine you wrote yourself. Detail: Doctrine.

One heavyweight piece moves on its own schedule: the bundled runtime behind the knowledge-graph engine changes only when its version actually does, rather than shipping hundreds of megabytes with every release. When it does change, the step is a one-click Provision / Re-provision on Doctor's runtime provisioner row — never something an update performs behind your back. The provisioner will not replace a runtime that is currently in use, so stop the graph database first if it asks.

Offline behavior

Command Center is a local-first product: your agents, documents, graph, and services all run on your machine, and day-to-day work does not depend on a connection to the account service.

Your sign-in is refreshed quietly in the background while you are online — at half its lifetime, not at the last minute, so a failed refresh has as much time again to succeed before you would notice. If contact is lost entirely, the app keeps working on the last confirmed sign-in for up to 72 hours. In practice that is 36 to 72 hours, depending on where in the cycle you dropped off, and there is no additional grace period afterward — the tolerance is the sign-in's own lifetime, which is why the app states it as a remaining duration rather than a date. You will find it on the Account card in Settings.

Update downloads outlive that window on purpose. They keep working for a further four days, so a machine whose features have paused still receives security fixes.

When the window does run out, the app steps down to its signed-out baseline: your data and documents remain fully accessible, and the subscription-gated capabilities pause until you are back online. Reconnecting restores everything exactly as it was — nothing is deleted, reset, or re-downloaded. What that step-down looks like in the app, and how to recover from it, is described under what a lapse looks like.

What you actually have to do

Almost nothing. Stay signed in, let the app check (or check yourself), click Restart & update when it suits you, and read the changelog when something new lands. If an update seems not to have arrived, Settings ▸ Doctor runs the checks that say why, and troubleshooting covers the rest.

Where to go next

• Install — the first-time setup the updater takes over from
• Tiers: Pro & Ultra — what a subscription unlocks, and what a lapse looks like
• BYO Claude & keys — what the subscription covers versus what runs on your accounts
• Changelog — what shipped, release by release
• Troubleshooting — if an update did not behave as expected