@4pm/cli 1.3.2 → 1.4.1

package/dist/index.js

@@ -28794,6 +28794,7 @@ var WORKER_TOOL_CATALOG = [
 var WORKER_TOOL_PREREQUISITE_IDS = WORKER_TOOL_CATALOG.filter(
   (t) => t.installPackage === null
 ).map((t) => t.id);
+var WORKER_TOOL_BUNDLED_GLOBALS = ["npm", "corepack"];
 
 // vendor/@4pm/constants/ws.ts
 var WsChannel = {
@@ -32954,7 +32955,11 @@ var issueProvisioningTokenRequestSchema = external_exports.object({
   ttlSec: external_exports.number().int().min(0).max(2592e3).optional()
 });
 var listWorkersQuerySchema = baseRequestSchema.extend({
-  status: external_exports.enum(["online", "offline"]).optional()
+  status: external_exports.enum(["online", "offline"]).optional(),
+  /** Only workers whose live CPU/memory/disk usage % ≥ the given threshold (0–100). */
+  minCpuPct: external_exports.coerce.number().min(0).max(100).optional(),
+  minMemPct: external_exports.coerce.number().min(0).max(100).optional(),
+  minDiskPct: external_exports.coerce.number().min(0).max(100).optional()
 });
 var updateWorkerRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100).optional()
@@ -33290,6 +33295,118 @@ var activityHeartbeatSchema = external_exports.object({
   projectId: external_exports.string().uuid().optional()
 });
 
+// src/core/worker-metrics.ts
+import { statfs, readFile } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import { totalmem, freemem, cpus, platform, arch } from "os";
+var CGROUP = "/sys/fs/cgroup";
+var MB = 1024 * 1024;
+var GB = 1024 * 1024 * 1024;
+async function readCgroup(file) {
+  try {
+    return (await readFile(`${CGROUP}/${file}`, "utf8")).trim();
+  } catch {
+    return null;
+  }
+}
+function createWorkerMetricsSampler(diskPath) {
+  const cgroupV2 = existsSync4(`${CGROUP}/cpu.stat`) && existsSync4(`${CGROUP}/memory.current`);
+  let prev = null;
+  async function cgroupCpuCount() {
+    const raw = await readCgroup("cpu.max");
+    if (raw) {
+      const [quota, period] = raw.split(/\s+/);
+      if (quota && quota !== "max" && period) {
+        const n = Number(quota) / Number(period);
+        if (n > 0) return Math.max(1, Math.round(n * 10) / 10);
+      }
+    }
+    return cpus().length;
+  }
+  async function cgroupCpuPct(cpuCount) {
+    const stat2 = await readCgroup("cpu.stat");
+    const m = stat2?.match(/usage_usec\s+(\d+)/);
+    const usageUsec = m ? Number(m[1]) : NaN;
+    const now = Date.now();
+    if (!Number.isFinite(usageUsec)) return 0;
+    if (!prev) {
+      prev = { busy: usageUsec, ref: now };
+      return 0;
+    }
+    const dUsage = usageUsec - prev.busy;
+    const dWall = (now - prev.ref) * 1e3;
+    prev = { busy: usageUsec, ref: now };
+    if (dWall <= 0) return 0;
+    return clampPct(dUsage / (dWall * cpuCount) * 100);
+  }
+  function osCpuPct() {
+    let busy = 0;
+    let total = 0;
+    for (const c of cpus()) {
+      const t = c.times;
+      busy += t.user + t.nice + t.sys + t.irq;
+      total += t.user + t.nice + t.sys + t.irq + t.idle;
+    }
+    if (!prev) {
+      prev = { busy, ref: total };
+      return 0;
+    }
+    const dBusy = busy - prev.busy;
+    const dTotal = total - prev.ref;
+    prev = { busy, ref: total };
+    if (dTotal <= 0) return 0;
+    return clampPct(dBusy / dTotal * 100);
+  }
+  async function disk() {
+    try {
+      const fs2 = await statfs(diskPath);
+      const total = fs2.blocks * fs2.bsize;
+      const free = fs2.bavail * fs2.bsize;
+      return { usedGb: round1((total - free) / GB), totalGb: round1(total / GB) };
+    } catch {
+      return { usedGb: 0, totalGb: 0 };
+    }
+  }
+  return {
+    async sample() {
+      const at = (/* @__PURE__ */ new Date()).toISOString();
+      const { usedGb: diskUsedGb, totalGb: diskTotalGb } = await disk();
+      const base = { platform: platform(), arch: arch(), diskUsedGb, diskTotalGb, at };
+      if (cgroupV2) {
+        const memMaxRaw = await readCgroup("memory.max");
+        const memCurRaw = await readCgroup("memory.current");
+        const memTotalBytes = memMaxRaw && memMaxRaw !== "max" ? Number(memMaxRaw) : totalmem();
+        const memUsedBytes = memCurRaw ? Number(memCurRaw) : totalmem() - freemem();
+        const cpuCount = await cgroupCpuCount();
+        const cpuPct = await cgroupCpuPct(cpuCount);
+        return {
+          ...base,
+          source: "cgroup",
+          cpuCount,
+          cpuPct,
+          memUsedMb: Math.round(memUsedBytes / MB),
+          memTotalMb: Math.round(memTotalBytes / MB)
+        };
+      }
+      const total = totalmem();
+      return {
+        ...base,
+        source: "os",
+        cpuCount: cpus().length,
+        cpuPct: osCpuPct(),
+        memUsedMb: Math.round((total - freemem()) / MB),
+        memTotalMb: Math.round(total / MB)
+      };
+    }
+  };
+}
+function clampPct(n) {
+  return round1(Math.min(100, Math.max(0, n)));
+}
+function round1(n) {
+  return Math.round(n * 10) / 10;
+}
+
 // vendor/@4pm/ws/batcher.ts
 var OutputBatcher = class {
   opts;
@@ -33432,6 +33549,12 @@ var WsChannels = {
   // whether a web viewer is attached) so an unwatched cli syncs nothing.
   CONSOLE_SYNC: "console.sync",
   CONSOLE_WATCH: "console.watch",
+  // worker resource live-metrics (ADR-0214): the cli streams live CPU/RAM/disk (cgroup-accurate)
+  // only while `metrics.watch` (server → cli: whether a web viewer has the Workers tab open) is on,
+  // so an unwatched cli samples nothing. Buffered ephemerally in Redis (never the DB), separate from
+  // the low-frequency, DB-authoritative `machine.status`.
+  METRICS_WATCH: "metrics.watch",
+  MACHINE_METRICS: "machine.metrics",
   // AI spec-assist (suggest/review/compose) moved off dedicated ai.* channels to
   // command.dispatch({ ai:true }) → the profile-failover AI path (ADR-0100).
   // quota & usage (ADR-0020)
@@ -33449,6 +33572,10 @@ var WsChannels = {
   // server → cli (reply): read a finished command's captured output on demand (ADR-0115) —
   // cli stores command-output/{commandId}.log; returns null when pruned/unavailable.
   COMMAND_OUTPUT_READ: "command.output-read",
+  // server → cli (reply): flush pending data before a rented machine is scrubbed (ADR-0210) —
+  // the worker uploads its pending log tail (+ any queued history) then acks, so the release
+  // sweep can finalise without waiting the full 5-minute timeout when the worker is online.
+  RENTAL_FLUSH: "rental.flush",
   // outbound review (ADR-0082): machine→server request, server→outbound evaluate, result back
   REVIEW_REQUEST: "review.request",
   REVIEW_EVALUATE: "review.evaluate",
@@ -33514,7 +33641,7 @@ function decryptPayload(key, payloadBase64, nonceBase64) {
 }
 
 // src/core/ws-client.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, rmSync as rmSync5 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, rmSync as rmSync5 } from "fs";
 import { randomUUID as randomCommandId } from "crypto";
 
 // src/core/update-scheduler.ts
@@ -33920,14 +34047,14 @@ async function runAiFailover(plan, commandId, cwd2, handlers) {
 }
 
 // src/core/ai-profile-state.ts
-import { existsSync as existsSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
 import { join as join7 } from "path";
 function statePath(profileDir2) {
   return join7(profileDir2, "ai-profiles.json");
 }
 function readState(profileDir2) {
   const path = statePath(profileDir2);
-  if (!existsSync4(path)) return {};
+  if (!existsSync5(path)) return {};
   try {
     return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
@@ -34393,7 +34520,7 @@ async function evaluateReview(payload) {
 }
 
 // src/core/command-history.ts
-import { existsSync as existsSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
 import { join as join10 } from "path";
 var MAX_ENTRIES = 1e3;
 var filePath = null;
@@ -34457,7 +34584,7 @@ async function uploadHistory(cfg) {
 }
 function initCommandHistory(profileDir2, profileName, uploadMinutes = 10) {
   filePath = join10(profileDir2, "command-history.json");
-  if (existsSync5(filePath)) {
+  if (existsSync6(filePath)) {
     try {
       entries = JSON.parse(readFileSync10(filePath, "utf8"));
     } catch {
@@ -34515,7 +34642,7 @@ function finishCommand(commandId, exitCode, usage) {
 // src/core/command-output-store.ts
 import {
   appendFileSync,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync11,
   readdirSync as readdirSync3,
@@ -34543,7 +34670,7 @@ function appendCommandOutput(commandId, text) {
 function readCommandOutput(commandId) {
   if (!dir) return null;
   const path = join11(dir, `${commandId}.log`);
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   try {
     return readFileSync11(path, "utf8");
   } catch {
@@ -34594,13 +34721,13 @@ async function listDir(path, root) {
 }
 
 // src/core/fs-read.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import { resolve as resolve2 } from "path";
 var MAX_BYTES = 256 * 1024;
 async function readWorkerFile(path) {
   const target = resolve2(path);
   try {
-    const buf = await readFile(target);
+    const buf = await readFile2(target);
     const truncated = buf.byteLength > MAX_BYTES;
     const content = buf.subarray(0, MAX_BYTES).toString("utf8");
     return { path: target, content, truncated };
@@ -34641,7 +34768,7 @@ async function writeWorkerFile(root, relPath, content) {
 import { spawn as spawn4 } from "child_process";
 import { execFile as execFile2 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
 import { join as join12 } from "path";
 import { promisify as promisify2 } from "util";
 var execFileAsync = promisify2(execFile2);
@@ -34662,7 +34789,7 @@ function authedUrl(url, token) {
 }
 async function ensureRepo(profileDir2, repo) {
   const dir2 = repoDir(profileDir2, repo.url, repo.branch);
-  if (existsSync7(join12(dir2, ".git"))) return dir2;
+  if (existsSync8(join12(dir2, ".git"))) return dir2;
   const url = authedUrl(repo.url, repo.token);
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   mkdirSync4(kbRoot(profileDir2), { recursive: true });
@@ -34673,11 +34800,11 @@ async function ensureRepo(profileDir2, repo) {
 }
 async function refreshSupportKb(profileDir2) {
   const root = kbRoot(profileDir2);
-  if (!existsSync7(root)) return;
+  if (!existsSync8(root)) return;
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   for (const entry of readdirSync4(root)) {
     const dir2 = join12(root, entry);
-    if (!existsSync7(join12(dir2, ".git"))) continue;
+    if (!existsSync8(join12(dir2, ".git"))) continue;
     try {
       await execFileAsync("git", ["-C", dir2, "pull", "--ff-only"], { env: gitEnv });
     } catch (err) {
@@ -34853,7 +34980,7 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
 }
 
 // src/core/autonomous.ts
-import { readFile as readFile2, writeFile as writeFile2, chmod } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile2, chmod } from "fs/promises";
 import { readFileSync as readFileSync13 } from "fs";
 import { execFile as execFile3, spawn as spawn6 } from "child_process";
 import { join as join13 } from "path";
@@ -34874,7 +35001,7 @@ var BOOK_FILES = {
 var DEFAULT_CRON = "*/10 * * * *";
 async function readText(path, fallback = "") {
   try {
-    return await readFile2(path, "utf8");
+    return await readFile3(path, "utf8");
   } catch {
     return fallback;
   }
@@ -35011,7 +35138,7 @@ ${req.content.trim()}
 }
 
 // src/core/agents.ts
-import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, readdir as readdir3, rm } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, readdir as readdir3, rm } from "fs/promises";
 import { join as join14 } from "path";
 var AGENTS_REL = ".claude/agents";
 var SKILLS_REL = ".claude/skills";
@@ -35021,7 +35148,7 @@ function safeName(name) {
 }
 async function readText2(path, fallback = "") {
   try {
-    return await readFile3(path, "utf8");
+    return await readFile4(path, "utf8");
   } catch {
     return fallback;
   }
@@ -35090,7 +35217,7 @@ async function writeAgent(root, req) {
 
 // src/core/packages.ts
 import { createHash as createHash4 } from "crypto";
-import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, readdir as readdir4, rm as rm2, stat } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir4, readdir as readdir4, rm as rm2, stat } from "fs/promises";
 import { dirname as dirname4, join as join15, relative } from "path";
 var AGENTS_REL2 = ".claude/agents";
 var SKILLS_REL2 = ".claude/skills";
@@ -35100,7 +35227,7 @@ function safeName2(name) {
 }
 async function readMaybe(path) {
   try {
-    return await readFile4(path);
+    return await readFile5(path);
   } catch {
     return null;
   }
@@ -35324,21 +35451,21 @@ function applyGitAuth(method) {
 }
 
 // src/core/secrets.ts
-import { readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
 import { join as join18 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
 var SECRETS_REL = "project.secrets.json";
 async function readText3(path, fallback = "") {
   try {
-    return await readFile5(path, "utf8");
+    return await readFile6(path, "utf8");
   } catch {
     return fallback;
   }
 }
 async function readSecretsObject(root) {
   try {
-    const v = JSON.parse(await readFile5(join18(root, SECRETS_REL), "utf8"));
+    const v = JSON.parse(await readFile6(join18(root, SECRETS_REL), "utf8"));
     return v && typeof v === "object" ? v : {};
   } catch {
     return {};
@@ -35387,7 +35514,7 @@ async function writeSecrets(root, req) {
 }
 
 // src/core/agent-tools.ts
-import { readFile as readFile6, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
 import { dirname as dirname5, join as join19 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
@@ -35398,7 +35525,7 @@ function fileFor(root, scope) {
 }
 async function readSettingsObject(path) {
   try {
-    const v = JSON.parse(await readFile6(path, "utf8"));
+    const v = JSON.parse(await readFile7(path, "utf8"));
     return v && typeof v === "object" ? v : {};
   } catch {
     return {};
@@ -35430,7 +35557,7 @@ async function writeAgentTools(root, scope, permissions) {
 }
 
 // src/core/graph.ts
-import { readFile as readFile7, readdir as readdir5 } from "fs/promises";
+import { readFile as readFile8, readdir as readdir5 } from "fs/promises";
 import { join as join20, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
@@ -35479,7 +35606,7 @@ async function buildDocs(root) {
     const rel = relative2(root, f).split("\\").join("/");
     let text = "";
     try {
-      text = await readFile7(f, "utf8");
+      text = await readFile8(f, "utf8");
     } catch {
       continue;
     }
@@ -35518,7 +35645,7 @@ async function buildCode(root) {
     const rel = relative2(root, f).split("\\").join("/");
     let text = "";
     try {
-      text = await readFile7(f, "utf8");
+      text = await readFile8(f, "utf8");
     } catch {
       continue;
     }
@@ -35570,10 +35697,10 @@ async function buildGraph(root, mode) {
 }
 
 // src/core/rag.ts
-import { readFile as readFile8, writeFile as writeFile7, statfs, mkdir as mkdir6 } from "fs/promises";
-import { existsSync as existsSync8 } from "fs";
+import { readFile as readFile9, writeFile as writeFile7, statfs as statfs2, mkdir as mkdir6 } from "fs/promises";
+import { existsSync as existsSync9 } from "fs";
 import { execFile as execFile4, spawn as spawn7 } from "child_process";
-import { totalmem, cpus } from "os";
+import { totalmem as totalmem2, cpus as cpus2 } from "os";
 import { join as join21 } from "path";
 import { promisify as promisify4 } from "util";
 var run3 = promisify4(execFile4);
@@ -35595,7 +35722,7 @@ async function detectPython() {
 }
 async function installLog(root) {
   try {
-    const text = await readFile8(join21(root, RAG_REL, "install.log"), "utf8");
+    const text = await readFile9(join21(root, RAG_REL, "install.log"), "utf8");
     return text.split("\n").filter((l) => l.length > 0).slice(-200);
   } catch {
     return [];
@@ -35643,28 +35770,28 @@ async function ragStatus(root) {
   ]) : [false, false, false];
   let diskFreeGB = 0;
   try {
-    const s = await statfs(root);
+    const s = await statfs2(root);
     diskFreeGB = Math.round(s.bavail * s.bsize / 1e9 * 10) / 10;
   } catch {
     diskFreeGB = 0;
   }
   const gpu = (await tryRun("nvidia-smi", ["-L"])).ok;
   const machine = {
-    ramGB: Math.round(totalmem() / 1e9 * 10) / 10,
-    cpus: cpus().length,
+    ramGB: Math.round(totalmem2() / 1e9 * 10) / 10,
+    cpus: cpus2().length,
     diskFreeGB,
     gpu
   };
   let modelName = "";
   try {
-    modelName = (await readFile8(join21(root, RAG_REL, ".installed"), "utf8")).trim();
+    modelName = (await readFile9(join21(root, RAG_REL, ".installed"), "utf8")).trim();
   } catch {
     modelName = "";
   }
   const modelPresent = modelName.length > 0;
   return {
     installed: fastembed && sqliteVec && modelPresent,
-    installing: existsSync8(join21(root, RAG_REL, ".installing")),
+    installing: existsSync9(join21(root, RAG_REL, ".installing")),
     python: { found: py.found, version: py.version },
     deps: { pip, fastembed, sqliteVec },
     model: { present: modelPresent, name: modelName },
@@ -35675,9 +35802,9 @@ async function ragStatus(root) {
   };
 }
 async function readIndexMeta(root) {
-  const indexing = existsSync8(join21(root, RAG_REL, ".indexing"));
+  const indexing = existsSync9(join21(root, RAG_REL, ".indexing"));
   try {
-    const m = JSON.parse(await readFile8(join21(root, RAG_REL, ".index.json"), "utf8"));
+    const m = JSON.parse(await readFile9(join21(root, RAG_REL, ".index.json"), "utf8"));
     return {
       present: true,
       indexing,
@@ -35750,8 +35877,8 @@ async function ensureEngine(root) {
 async function ragReindex(root) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found" };
-  if (!existsSync8(join21(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
-  if (existsSync8(join21(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  if (!existsSync9(join21(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync9(join21(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
   await ensureEngine(root);
   const script = `
 set +e
@@ -35771,7 +35898,7 @@ rm -f "${RAG_REL}/.indexing"
 async function ragQuery(root, queryText, k = 8) {
   const py = await detectPython();
   if (!py.found) return { results: [], error: "python3 not found" };
-  if (!existsSync8(join21(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  if (!existsSync9(join21(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
     const { stdout } = await run3(
@@ -35788,7 +35915,7 @@ async function ragQuery(root, queryText, k = 8) {
 async function ragInstall(root, model) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
-  if (existsSync8(join21(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  if (existsSync9(join21(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
     await mkdir6(join21(root, RAG_REL), { recursive: true });
   } catch {
@@ -35817,7 +35944,7 @@ rm -f "${RAG_REL}/.installing"
 }
 
 // src/core/git-diff.ts
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import { execFile as execFile5 } from "child_process";
 import { basename as basename3, dirname as dirname7, resolve as resolve5 } from "path";
 import { promisify as promisify5 } from "util";
@@ -35828,7 +35955,7 @@ async function gitDiff(path) {
   const base = basename3(target);
   let newContent = "";
   try {
-    newContent = await readFile9(target, "utf8");
+    newContent = await readFile10(target, "utf8");
   } catch {
   }
   let oldContent = "";
@@ -35877,7 +36004,7 @@ ${stderr}`;
 
 // src/core/git-ssh-key.ts
 import { execFile as execFile7 } from "child_process";
-import { readFile as readFile10, rm as rm3, mkdir as mkdir7 } from "fs/promises";
+import { readFile as readFile11, rm as rm3, mkdir as mkdir7 } from "fs/promises";
 import { join as join22 } from "path";
 import { promisify as promisify7 } from "util";
 var run6 = promisify7(execFile7);
@@ -35888,7 +36015,7 @@ function keyPaths(profileDir2) {
 }
 async function readPublicKey(pub) {
   try {
-    return (await readFile10(pub, "utf8")).trim();
+    return (await readFile11(pub, "utf8")).trim();
   } catch {
     return null;
   }
@@ -36197,12 +36324,12 @@ async function addProject(payload, profileDir2, onProgress) {
 }
 
 // src/core/config-sync.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
 import { join as join24 } from "path";
 var SERVER_MANAGED_KEYS = ["physicPath", "sessionSwitchPct", "perPromptTokenLimit"];
 function readConfigText(profileDir2) {
   const path = join24(profileDir2, "config.json");
-  if (existsSync9(path)) {
+  if (existsSync10(path)) {
     try {
       return readFileSync14(path, "utf8");
     } catch {
@@ -36287,9 +36414,11 @@ async function listExtras() {
   } catch {
     return [];
   }
-  const catalogPkgs = new Set(
-    WORKER_TOOL_CATALOG.map((t) => t.installPackage).filter((p) => !!p)
-  );
+  const catalogPkgs = new Set(WORKER_TOOL_BUNDLED_GLOBALS);
+  for (const t of WORKER_TOOL_CATALOG) {
+    catalogPkgs.add(t.id);
+    if (t.installPackage) catalogPkgs.add(t.installPackage);
+  }
   return Object.entries(deps).filter(([name]) => !catalogPkgs.has(name)).map(([name, info]) => ({
     id: name,
     label: name,
@@ -36327,6 +36456,9 @@ function resolvePackage(name, op) {
   if (WORKER_TOOL_PREREQUISITE_IDS.includes(name)) {
     return { error: `"${name}" is a prerequisite and cannot be ${op}ed from here.` };
   }
+  if (WORKER_TOOL_BUNDLED_GLOBALS.includes(name)) {
+    return { error: `"${name}" ships with Node and cannot be ${op}ed from here.` };
+  }
   if (!NPM_NAME.test(name)) return { error: `Invalid package name: "${name}".` };
   return { pkg: name };
 }
@@ -36363,6 +36495,8 @@ var CLOSE_DRAINING = 4001;
 var OFFLINE_BUFFER_MAX_BYTES = 512 * 1024;
 var CONSOLE_SNAPSHOT_INTERVAL_MS = 3e4;
 var CONSOLE_WATCH_LEASE_MS = 45e3;
+var METRICS_SAMPLE_INTERVAL_MS = 5e3;
+var METRICS_WATCH_LEASE_MS = 45e3;
 function toDtoEntry(e) {
   return { id: e.id, source: e.source, kind: e.kind, text: e.text, level: e.level, resultKind: e.resultKind };
 }
@@ -36455,6 +36589,16 @@ var WsClient = class {
   consoleSnapshotTimer = null;
   /** Lease expiry: stop syncing if the server does not renew `console.watch` in time. */
   consoleWatchExpiry = null;
+  /**
+   * Worker-metrics state (ADR-0214). `metricsWatching` is set by `metrics.watch` (a viewer has the
+   * Workers tab open); only then does the cli sample + emit `machine.metrics`. The sampler holds the
+   * CPU-delta baseline; both timers are lease-driven like console-sync and reset on reconnect.
+   */
+  metricsWatching = false;
+  metricsTimer = null;
+  metricsWatchExpiry = null;
+  /** Lazily created on the first `metrics.watch` (keeps the CPU-delta baseline across samples). */
+  metricsSampler = null;
   /** cli → server requests awaiting a reply (quota.check — ADR-0020). */
   pending = /* @__PURE__ */ new Map();
   /** Daily scheduled cli auto-update (ADR-0074); policy fed from each ws_token. */
@@ -36690,6 +36834,7 @@ var WsClient = class {
         }
         logger.info("ws.connected", { version: CLI_VERSION });
         this.stopConsoleSync();
+        this.stopMetricsSync();
         this.bus.setStatus("connected");
         this.finishReconnect();
         this.sendMachineStatus();
@@ -37152,6 +37297,11 @@ var WsClient = class {
         this.send(WsChannels.COMMAND_OUTPUT_READ, { output }, message.id);
         break;
       }
+      case WsChannels.RENTAL_FLUSH: {
+        this.uploadLog();
+        this.send(WsChannels.RENTAL_FLUSH, { ok: true }, message.id);
+        break;
+      }
       case WsChannels.PROJECT_CREATE:
         void scaffoldProject(
           payload,
@@ -37176,6 +37326,9 @@ var WsClient = class {
       case WsChannels.CONSOLE_WATCH:
         this.setConsoleWatching(payload.on);
         break;
+      case WsChannels.METRICS_WATCH:
+        this.setMetricsWatching(payload.on);
+        break;
       default:
         this.bus.log(`Unsupported channel: ${message.channel}`, "warn");
     }
@@ -37605,6 +37758,50 @@ var WsClient = class {
       this.consoleWatchExpiry = null;
     }
   }
+  /**
+   * Handle `metrics.watch` (ADR-0214) — a renewable lease mirroring `console.watch`. `on` renews it:
+   * on the first assertion the cli samples immediately + starts the ~5s sampler; later renewals just
+   * extend the lease. No renewal within `METRICS_WATCH_LEASE_MS` (or an explicit `on:false`) ⇒ stop.
+   */
+  setMetricsWatching(on) {
+    if (!on) {
+      this.stopMetricsSync();
+      return;
+    }
+    if (this.metricsWatchExpiry) clearTimeout(this.metricsWatchExpiry);
+    this.metricsWatchExpiry = setTimeout(() => this.stopMetricsSync(), METRICS_WATCH_LEASE_MS);
+    this.metricsWatchExpiry.unref?.();
+    if (this.metricsWatching) return;
+    this.metricsWatching = true;
+    void this.sendMachineMetrics();
+    this.metricsTimer = setInterval(() => void this.sendMachineMetrics(), METRICS_SAMPLE_INTERVAL_MS);
+    this.metricsTimer.unref?.();
+  }
+  /** Stop sampling worker resources (lease expired / viewer left / reconnect) — clears both timers. */
+  stopMetricsSync() {
+    this.metricsWatching = false;
+    if (this.metricsTimer) {
+      clearInterval(this.metricsTimer);
+      this.metricsTimer = null;
+    }
+    if (this.metricsWatchExpiry) {
+      clearTimeout(this.metricsWatchExpiry);
+      this.metricsWatchExpiry = null;
+    }
+  }
+  /** Sample the worker's live CPU/RAM/disk and push a `machine.metrics` frame (ADR-0214). */
+  async sendMachineMetrics() {
+    if (!this.sessionKey) return;
+    try {
+      if (!this.metricsSampler) this.metricsSampler = createWorkerMetricsSampler(this.context.profileDir);
+      const resources = await this.metricsSampler.sample();
+      this.send(WsChannels.MACHINE_METRICS, {
+        fingerprint: this.context.machine.fingerprint,
+        resources
+      });
+    } catch {
+    }
+  }
   /**
    * Send a cli → server request and await the reply by envelope id (15s timeout).
    * Used for quota.check before spawning an AI cli (ADR-0020).
@@ -37677,7 +37874,7 @@ var WsClient = class {
   /** Create the physic folder at an absolute path if missing (best-effort). */
   ensurePhysicFolderPath(folder) {
     try {
-      if (!existsSync10(folder)) {
+      if (!existsSync11(folder)) {
         mkdirSync5(folder, { recursive: true });
         this.bus.log(`Created physic project folder: ${folder}`);
       }
@@ -37706,7 +37903,7 @@ var WsClient = class {
       projects: [],
       version: CLI_VERSION,
       physicPath,
-      physicPathExists: physicPath ? existsSync10(physicPath) : void 0,
+      physicPathExists: physicPath ? existsSync11(physicPath) : void 0,
       // Real coarse state (ADR-0152): !paused and a recent tick (was hard-coded false).
       autonomousRunning: physicPath ? isAutonomousRunning(physicPath) : false
     });
@@ -37729,6 +37926,7 @@ var WsClient = class {
     this.logUploadTimer = null;
     if (this.kbRefreshTimer) clearInterval(this.kbRefreshTimer);
     this.kbRefreshTimer = null;
+    this.stopMetricsSync();
   }
   /**
    * Poll the Claude subscription usage API and push a `machine.usage` snapshot (ADR-0072).
@@ -38415,12 +38613,12 @@ var isWebWorker = typeof WorkerGlobalScope !== "undefined" && globalThis instanc
 var isDedicatedWorker = typeof DedicatedWorkerGlobalScope !== "undefined" && globalThis instanceof DedicatedWorkerGlobalScope;
 var isSharedWorker = typeof SharedWorkerGlobalScope !== "undefined" && globalThis instanceof SharedWorkerGlobalScope;
 var isServiceWorker = typeof ServiceWorkerGlobalScope !== "undefined" && globalThis instanceof ServiceWorkerGlobalScope;
-var platform = globalThis.navigator?.userAgentData?.platform;
-var isMacOs = platform === "macOS" || globalThis.navigator?.platform === "MacIntel" || globalThis.navigator?.userAgent?.includes(" Mac ") === true || globalThis.process?.platform === "darwin";
-var isWindows = platform === "Windows" || globalThis.navigator?.platform === "Win32" || globalThis.process?.platform === "win32";
-var isLinux = platform === "Linux" || globalThis.navigator?.platform?.startsWith("Linux") === true || globalThis.navigator?.userAgent?.includes(" Linux ") === true || globalThis.process?.platform === "linux";
-var isIos = platform === "iOS" || globalThis.navigator?.platform === "MacIntel" && globalThis.navigator?.maxTouchPoints > 1 || /iPad|iPhone|iPod/.test(globalThis.navigator?.platform);
-var isAndroid = platform === "Android" || globalThis.navigator?.platform === "Android" || globalThis.navigator?.userAgent?.includes(" Android ") === true || globalThis.process?.platform === "android";
+var platform2 = globalThis.navigator?.userAgentData?.platform;
+var isMacOs = platform2 === "macOS" || globalThis.navigator?.platform === "MacIntel" || globalThis.navigator?.userAgent?.includes(" Mac ") === true || globalThis.process?.platform === "darwin";
+var isWindows = platform2 === "Windows" || globalThis.navigator?.platform === "Win32" || globalThis.process?.platform === "win32";
+var isLinux = platform2 === "Linux" || globalThis.navigator?.platform?.startsWith("Linux") === true || globalThis.navigator?.userAgent?.includes(" Linux ") === true || globalThis.process?.platform === "linux";
+var isIos = platform2 === "iOS" || globalThis.navigator?.platform === "MacIntel" && globalThis.navigator?.maxTouchPoints > 1 || /iPad|iPhone|iPod/.test(globalThis.navigator?.platform);
+var isAndroid = platform2 === "Android" || globalThis.navigator?.platform === "Android" || globalThis.navigator?.userAgent?.includes(" Android ") === true || globalThis.process?.platform === "android";
 
 // ../../node_modules/.pnpm/ansi-escapes@7.3.0/node_modules/ansi-escapes/base.js
 var ESC = "\x1B[";
@@ -43874,7 +44072,7 @@ var import_react21 = __toESM(require_react(), 1);
 var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
 import { join as join28 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
@@ -43882,7 +44080,7 @@ function historyPath(profileDir2) {
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
-  if (!existsSync12(path)) return [];
+  if (!existsSync13(path)) return [];
   try {
     const data = JSON.parse(readFileSync17(path, "utf8"));
     return Array.isArray(data) ? data.filter((x) => typeof x === "string") : [];
@@ -44144,7 +44342,7 @@ function TranscriptLine({ line }) {
 var import_react24 = __toESM(require_react(), 1);
 
 // src/ui/slash-commands.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { join as join29 } from "path";
 var CONFIG_KEYS = [
   "aiCli",
@@ -44207,7 +44405,7 @@ function runConfig(ctx) {
       ctx.print(`\u2714 ${verb} default config: ${path}`);
       ctx.print("add claude profiles: /config set claudeHome .claude .claude-1 (tried in order)");
     };
-    if (existsSync13(path)) {
+    if (existsSync14(path)) {
       ctx.confirm(
         `config exists: ${path} \u2014 replace it with defaults? (y/N)`,
         () => writeDefaults("replaced with")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.3.2",
+  "version": "1.4.1",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",