Updates

Pond does not update itself. Once a day it asks whether a newer version exists. If one does, the sidebar shows one quiet line with links to the release notes and the download. You install it yourself.

The request

Pond sends a plain GET https://pond.codes/latest.json.

• No query string, no cookies, no cache.
• The User-Agent is just Pond. There is no version, no install id and no account in the request.
• Redirects are refused.
• The answer is capped at 64 KB.

The check runs on a 30-minute tick and goes out at most once a day. The first tick comes 20 seconds after launch.

The signed file

The file is a small envelope:

{"payload": "<base64 of the inner JSON>", "sig": "<base64 Ed25519 signature>"}

• The signature covers a fixed domain prefix plus the exact payload bytes, so no JSON canonicalisation is needed, and a signature made for anything else does not fit.
• The public key is compiled into Pond. The private key never sits in the source code.
• The payload names the version, the minimum macOS and two links. Both links must be https on pond.codes or a subdomain, with no login part and no port.

The line shows only when the signature verifies, the version is newer than yours, and your macOS meets the minimum. A build without a real public key makes no request at all.

Turning it off

• Settings › Help › Check for updates turns the daily request off. Check now asks once.
• The check never runs under tests, with CI set, with a POND_HOME override, or with POND_UPDATES=0.

The choice is kept in updates.json in the Pond folder.

What the server sees

The server sees your IP address, as with any web request, and nothing else from Pond.

The terminal helper after an update

A running pond-ptyd keeps your agents' terminals through an update. It goes on serving from the old binary and exits once its last terminal ends. The next start uses the new one. See Processes and IPC.