check-updates

name	check-updates
description	Audit the homelab for outdated software and report findings. Use when user says "check for updates", "what's outdated", "audit the homelab", "run update check", or wants a system health report.

Check Updates

Audit every layer of the homelab for outdated software and report findings directly to the user. This is the interactive equivalent of the nightly update-check agent — but report-only, no auto-apply.

Step 1: System packages (apt)

apt list --upgradable 2>/dev/null

Categorize:

• Auto-applied nightly: docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin, docker-compose-plugin, cloudflared (these are auto-applied by the nightly update agent at 1am ET with rollback on failure)
• Routine: everything else (libs, tools)

Note the count and highlight any security-related or kernel packages.

Step 2: Snap packages

snap refresh --list 2>/dev/null

Flag the docker snap separately — never refresh it (AppArmor risk). Other snaps are safe.

Step 3: Docker images — Compose apps

docker images --format '{{.Repository}}:{{.Tag}} {{.CreatedAt}}' | grep -E "blog|delta|webui"
docker ps --format '{{.Names}} {{.Image}} {{.Status}}'

• open-webui: pinned tag. Use web_search ("open-webui latest release") to check for newer than v0.10.2.
• blog-web: locally built. Note build age. Flag if >2 weeks.
• delta_neutral-web: locally built. Note build age. Flag if >2 weeks.

Step 4: Docker images — k3s workloads

export XDG_RUNTIME_DIR=/run/user/$(id -u)
/usr/local/bin/k3s kubectl get deploy,ds,sts -A -o wide 2>/dev/null

• freshrss: :latest tag — the nightly agent does a rollout restart to pull latest. Note when it last restarted (check pod age).
• uptime-kuma: :1 tag — same pattern as freshrss.
• traefik: rancher/mirrored-library-traefik:3.3.6. Use web_search to check for newer 3.3.x.
• kube-system images: tied to k3s version. Note them but no action needed unless upgrading k3s.

Step 5: npm global packages

npm outdated -g 2>/dev/null || echo "(all up to date or check unavailable)"

Step 6: Language runtimes

go version
rbenv versions 2>/dev/null
node --version

Use web_search to check latest stable for each. Flag anything more than one minor version behind. These are manual-only — the nightly agent never touches them.

Step 7: Infrastructure

/usr/local/bin/k3s --version 2>/dev/null | head -1
nvim --version 2>/dev/null | head -1
cd ~/dev/dependabot-webhook && git fetch origin 2>/dev/null && git status -sb 2>/dev/null | head -3

Check k3s and neovim against latest releases via web_search. Check if dependabot-webhook dev clone is behind origin.

Step 8: System health

df -h / /home
free -h
uptime
test -f /var/run/reboot-required && echo "REBOOT REQUIRED" || echo "No reboot required"
docker ps -a --format '{{.Names}} {{.Status}}'
/usr/local/bin/k3s kubectl get pods -A --no-headers | grep -v -E "Running|Completed" || echo "(all pods healthy)"

Step 9: Report to user

Present findings in a clean format:

## Homelab Audit — <date>

### 🔴 Needs Attention
- item — current → target — reason

### 🟡 Behind but Safe
- item — current → target

### 🟢 Up to Date
- item, item, item

### 📊 System Health
- Disk: X% on /
- Memory: X available
- Uptime: X days
- Reboot needed: yes/no
- Containers: X running, Y issues

If there are actionable items in 🔴 or 🟡, suggest: "Run /update-homelab to apply these."

Step 10: Write session memoir

Write a brief session memoir to ~/notes/sessions/YYYY-MM-DD.md per the Persistent Memory convention in AGENTS.md.

Notes

• This skill is report-only. It never installs, upgrades, or restarts anything.
• The nightly agent (update-check.timer, 1am ET) is a deterministic Python orchestrator (update_runner.py). It auto-applies apt upgrades, Docker engine/plugins, cloudflared, open-webui stable tags, and k3s workload restarts — each with pre-version capture and automatic rollback on tunnel failure. It emails a full HTML report daily.
• Use web_search sparingly — only for items where the user would reasonably care about being behind (open-webui, traefik, Go, neovim, k3s). Skip web_search for routine apt packages.