@4pm/cli 1.5.1 → 1.5.2-b

package/dist/index.js

@@ -28834,18 +28834,21 @@ function isValidRoleSet(roles) {
 
 // vendor/@4pm/constants/worker-tools.ts
 var WORKER_TOOL_CATALOG = [
-  { id: "git", label: "Git", category: "vcs", versionArg: "--version", installPackage: null, installable: false },
-  { id: "node", label: "Node.js", category: "runtime", versionArg: "--version", installPackage: null, installable: false },
-  { id: "npm", label: "npm", category: "runtime", versionArg: "--version", installPackage: null, installable: false },
-  { id: "pnpm", label: "pnpm", category: "runtime", versionArg: "--version", installPackage: "pnpm", installable: false },
-  { id: "claude", label: "Claude Code", category: "ai-cli", versionArg: "--version", installPackage: "@anthropic-ai/claude-code", installable: false },
-  { id: "codex", label: "Codex", category: "ai-cli", versionArg: "--version", installPackage: "@openai/codex", installable: false },
-  { id: "gh", label: "GitHub CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false },
-  { id: "glab", label: "GitLab CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false }
+  { id: "git", label: "Git", category: "vcs", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "node", label: "Node.js", category: "runtime", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "npm", label: "npm", category: "runtime", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "pnpm", label: "pnpm", category: "runtime", versionArg: "--version", installPackage: "pnpm", installable: false, updatable: true },
+  { id: "claude", label: "Claude Code", category: "ai-cli", versionArg: "--version", installPackage: "@anthropic-ai/claude-code", installable: false, updatable: true },
+  { id: "codex", label: "Codex", category: "ai-cli", versionArg: "--version", installPackage: "@openai/codex", installable: false, updatable: true },
+  { id: "gh", label: "GitHub CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "glab", label: "GitLab CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false, updatable: false }
 ];
 var WORKER_TOOL_PREREQUISITE_IDS = WORKER_TOOL_CATALOG.filter(
   (t) => !t.installable
 ).map((t) => t.id);
+var WORKER_TOOL_UPDATABLE_IDS = WORKER_TOOL_CATALOG.filter(
+  (t) => t.updatable
+).map((t) => t.id);
 var WORKER_TOOL_BUNDLED_GLOBALS = ["npm", "corepack"];
 
 // vendor/@4pm/constants/ws.ts
@@ -32990,6 +32993,7 @@ var CLI_SLASH_COMMANDS = [
   { name: "collapse", usage: "/collapse [N]", description: "Collapse an expanded \u25B8[N] block" },
   { name: "reconnect", usage: "/reconnect", description: "Reconnect to the server now (skip the backoff)" },
   { name: "whoami", usage: "/whoami", description: "Show this machine account + its teams & projects" },
+  { name: "ai-profile", usage: "/ai-profile [list|use <n>|reset]", description: "List AI profiles / switch which one runs" },
   { name: "config", usage: "/config [show|init|set <k> <v>|delete <k>]", description: "View / init / update / delete profile config" },
   { name: "claude-cmd", usage: "/claude-cmd /context", description: "Run an AI-CLI slash command (e.g. /context, /usage)" },
   { name: "clear", usage: "/clear", description: "Clear the transcript" },
@@ -33038,7 +33042,10 @@ var listWorkersQuerySchema = baseRequestSchema.extend({
   /** Only workers whose live CPU/memory/disk usage % ≥ the given threshold (0–100). */
   minCpuPct: external_exports.coerce.number().min(0).max(100).optional(),
   minMemPct: external_exports.coerce.number().min(0).max(100).optional(),
-  minDiskPct: external_exports.coerce.number().min(0).max(100).optional()
+  minDiskPct: external_exports.coerce.number().min(0).max(100).optional(),
+  /** Hide workers with no cli attached (clis = 0). The web defaults this on; unchecking the
+   *  "show empty CLIs" box drops it so empty workers are listed too. */
+  hideEmptyClis: external_exports.enum(["true", "false"]).transform((v) => v === "true").optional()
 });
 var updateWorkerRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100).optional()
@@ -33067,6 +33074,12 @@ var workerToolInstallSchema = external_exports.object({
   /** Package manager to run the global install with. */
   manager: external_exports.enum(["npm", "pnpm"])
 });
+var workerToolAutoUpdateSchema = external_exports.object({
+  /** Catalog id or installed extra's npm package name. */
+  name: external_exports.string().trim().min(1).max(214),
+  /** true = flag this tool for auto-update to @latest; false = clear it. */
+  enabled: external_exports.boolean()
+});
 var configWriteRequestSchema = external_exports.object({
   config: external_exports.string().max(256 * 1024)
 });
@@ -33671,8 +33684,14 @@ var WsChannels = {
   TOOLS_LIST: "tools.list",
   TOOLS_INSTALL: "tools.install",
   TOOLS_UNINSTALL: "tools.uninstall",
+  // update-to-latest of an npm-distributed catalog tool or an extra (ADR-0252): same streamed
+  // shape as install/uninstall — the cli reinstalls the package at `@latest`.
+  TOOLS_UPDATE: "tools.update",
   TOOLS_PROGRESS: "tools.progress",
   TOOLS_DONE: "tools.done",
+  // toggle per-tool auto-update (ADR-0253): request/reply — the cli persists the flag in
+  // config.json (`autoUpdateTools`); the ADR-0074 idle daily tick later runs the flagged tools.
+  TOOLS_AUTOUPDATE: "tools.autoUpdate",
   // autonomous mode control (ADR-0152): read settings+status+books+approvals, tail logs, and
   // write {settings|approvals|userTodo|cron} — the dashboard drives the worker's autonomous engine.
   AUTONOMOUS_READ: "autonomous.read",
@@ -33833,7 +33852,7 @@ import { existsSync as existsSync13, mkdirSync as mkdirSync5, rmSync as rmSync4
 import { randomUUID as randomCommandId } from "crypto";
 
 // src/core/update-scheduler.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/common/logger/logger.ts
 import { appendFile, mkdir, readdir, unlink } from "fs/promises";
@@ -33938,6 +33957,153 @@ ${content.slice(-LOG_UPLOAD_CONTENT_MAX)}`;
   }
 }
 
+// src/core/worker-tools.ts
+import { spawn } from "child_process";
+var NPM_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+function run(cmd, args, onLine, timeoutMs = 18e4) {
+  return new Promise((resolve8) => {
+    let out = "";
+    let buf = "";
+    let child = null;
+    const done = (code) => {
+      clearTimeout(timer);
+      if (onLine && buf.trim()) onLine(buf.trim());
+      resolve8({ code, out });
+    };
+    const timer = setTimeout(() => {
+      child?.kill();
+      if (onLine) onLine(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
+      done(124);
+    }, timeoutMs);
+    timer.unref?.();
+    const feed = (d) => {
+      const text = d.toString("utf8");
+      out += text;
+      if (!onLine) return;
+      buf += text;
+      let nl;
+      while ((nl = buf.indexOf("\n")) >= 0) {
+        const line = buf.slice(0, nl).replace(/\r$/, "");
+        buf = buf.slice(nl + 1);
+        onLine(line);
+      }
+    };
+    try {
+      child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+      child.stdout?.on("data", feed);
+      child.stderr?.on("data", feed);
+      child.on("exit", (code) => done(code ?? 0));
+      child.on("error", () => done(127));
+    } catch {
+      done(127);
+    }
+  });
+}
+async function detectOne(cmd, versionArg) {
+  const { code, out } = await run(cmd, [versionArg], void 0, 15e3);
+  if (code !== 0) return null;
+  const first = out.split("\n").map((l) => l.trim()).find(Boolean);
+  return first ?? "";
+}
+async function listExtras(autoUpdateSet = /* @__PURE__ */ new Set()) {
+  const { out } = await run("npm", ["ls", "-g", "--depth=0", "--json"], void 0, 2e4);
+  if (!out.trim()) return [];
+  let deps = {};
+  try {
+    deps = JSON.parse(out).dependencies ?? {};
+  } catch {
+    return [];
+  }
+  const catalogPkgs = new Set(WORKER_TOOL_BUNDLED_GLOBALS);
+  for (const t of WORKER_TOOL_CATALOG) {
+    catalogPkgs.add(t.id);
+    if (t.installPackage) catalogPkgs.add(t.installPackage);
+  }
+  return Object.entries(deps).filter(([name]) => !catalogPkgs.has(name)).map(([name, info]) => ({
+    id: name,
+    label: name,
+    category: "runtime",
+    installed: true,
+    version: info.version ?? null,
+    installable: true,
+    updatable: true,
+    autoUpdate: autoUpdateSet.has(name)
+  }));
+}
+async function detectWorkerTools(autoUpdateTools = []) {
+  const autoUpdateSet = new Set(autoUpdateTools);
+  const catalog = await Promise.all(
+    WORKER_TOOL_CATALOG.map(async (t) => {
+      const version = await detectOne(t.id, t.versionArg);
+      return {
+        id: t.id,
+        label: t.label,
+        category: t.category,
+        installed: version !== null,
+        version,
+        installable: t.installable,
+        updatable: t.updatable,
+        autoUpdate: autoUpdateSet.has(t.id)
+      };
+    })
+  );
+  const extras = await listExtras(autoUpdateSet).catch(() => []);
+  return { catalog, extras };
+}
+function opPast(op) {
+  return op === "install" ? "installed" : op === "uninstall" ? "uninstalled" : "updated";
+}
+function resolvePackage(name, op) {
+  const entry = WORKER_TOOL_CATALOG.find((t) => t.id === name);
+  if (entry) {
+    const allowed = op === "update" ? entry.updatable : entry.installable;
+    if (!allowed) {
+      return { error: `"${name}" is a prerequisite and cannot be ${opPast(op)} from here.` };
+    }
+    return { pkg: entry.installPackage ?? name };
+  }
+  if (WORKER_TOOL_PREREQUISITE_IDS.includes(name)) {
+    return { error: `"${name}" is a prerequisite and cannot be ${opPast(op)} from here.` };
+  }
+  if (WORKER_TOOL_BUNDLED_GLOBALS.includes(name)) {
+    return { error: `"${name}" ships with Node and cannot be ${opPast(op)} from here.` };
+  }
+  if (!NPM_NAME.test(name)) return { error: `Invalid package name: "${name}".` };
+  return { pkg: name };
+}
+function opArgs(op, manager, pkg) {
+  if (op === "uninstall") return manager === "pnpm" ? ["remove", "-g", pkg] : ["uninstall", "-g", pkg];
+  const target = op === "update" ? `${pkg}@latest` : pkg;
+  return manager === "pnpm" ? ["add", "-g", target] : ["install", "-g", target];
+}
+async function runWorkerToolOp(op, name, manager, onLine) {
+  const resolved = resolvePackage(name, op);
+  if (resolved.error || !resolved.pkg) {
+    return { ok: false, exitCode: 1, error: resolved.error ?? "Invalid package." };
+  }
+  onLine(`$ ${manager} ${opArgs(op, manager, resolved.pkg).join(" ")}`);
+  const { code } = await run(manager, opArgs(op, manager, resolved.pkg), onLine);
+  return { ok: code === 0, exitCode: code, error: code === 0 ? void 0 : `${manager} exited ${code}` };
+}
+function setToolAutoUpdate(profileDir2, name, enabled) {
+  const resolved = resolvePackage(name, "update");
+  if (resolved.error) return { ok: false, error: resolved.error };
+  const current = readProfileConfig(profileDir2).autoUpdateTools ?? [];
+  const set = new Set(current);
+  if (enabled) set.add(name);
+  else set.delete(name);
+  writeProfileConfig(profileDir2, { autoUpdateTools: [...set] });
+  return { ok: true };
+}
+async function autoUpdateFlaggedTools(tools, onLine) {
+  for (const name of tools) {
+    const res = await runWorkerToolOp("update", name, "npm", onLine).catch(
+      (err) => ({ ok: false, exitCode: 1, error: String(err) })
+    );
+    onLine(res.ok ? `\u2713 ${name} updated` : `\u2717 ${name}: ${res.error ?? "failed"}`);
+  }
+}
+
 // src/core/update-scheduler.ts
 var TICK_MS = 6e4;
 var UpdateScheduler = class {
@@ -34020,6 +34186,7 @@ var UpdateScheduler = class {
   async runUpdate() {
     this.updating = true;
     try {
+      await this.updateFlaggedTools();
       this.bus.log("Scheduled auto-update: checking for a new version\u2026");
       const result = await updateToLatest(this.serverUrl);
       if (result.action === "already-latest") {
@@ -34033,7 +34200,7 @@ var UpdateScheduler = class {
       }
       logger.info("update.scheduled.updated", { version: result.version });
       this.bus.log(`Updated to ${result.version} \u2014 restarting to apply\u2026`);
-      const child = spawn(process.execPath, process.argv.slice(1), {
+      const child = spawn2(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         env: { ...process.env, FOURPM_NO_UPDATE: "1" }
       });
@@ -34044,18 +34211,45 @@ var UpdateScheduler = class {
       this.updating = false;
     }
   }
+  /** Update each tool flagged for auto-update in config.json to @latest (ADR-0253) — best-effort. */
+  async updateFlaggedTools() {
+    const tools = readProfileConfig(this.profileDir).autoUpdateTools ?? [];
+    if (tools.length === 0) return;
+    this.bus.log(`Scheduled tool auto-update: ${tools.join(", ")}\u2026`);
+    await autoUpdateFlaggedTools(tools, (line) => logger.info("update.tool.line", { line })).catch(
+      (err) => logger.warn("update.tool.error", { error: String(err) })
+    );
+  }
 };
 
 // src/core/executor.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 var KILL_GRACE_MS = 5e3;
 async function runCommand(dispatch, emit, opts) {
   let seq = 0;
-  const child = spawn2(dispatch.cmd, dispatch.args ?? [], {
-    cwd: dispatch.path,
-    env: { ...process.env, ...dispatch.env },
-    shell: false
+  let child;
+  try {
+    child = spawn3(dispatch.cmd, dispatch.args ?? [], {
+      cwd: dispatch.path,
+      env: { ...process.env, ...dispatch.env },
+      shell: false
+    });
+  } catch (err) {
+    emit({
+      commandId: dispatch.commandId,
+      seq: seq++,
+      chunk: `spawn error: ${err.message}
+`,
+      done: true,
+      exitCode: -1
+    });
+    return;
+  }
+  child.stdin?.on("error", () => {
   });
+  if (opts?.stdin != null) {
+    child.stdin?.write(opts.stdin);
+  }
   child.stdin?.end();
   const timeoutMs = opts?.timeoutMs && opts.timeoutMs > 0 ? opts.timeoutMs : 0;
   let timedOut = false;
@@ -34255,12 +34449,16 @@ function isOutOfCredits(text) {
     text
   );
 }
-function runAttempt(commandId, cmd, args, cwd2, env3, onChunk, timeoutMs) {
+function runAttempt(commandId, cmd, args, stdin, cwd2, env3, onChunk, timeoutMs) {
   return new Promise((resolve8) => {
-    void runCommand({ commandId, cmd, args, path: cwd2, env: env3 }, (out) => {
-      if (out.chunk) onChunk(out.chunk);
-      if (out.done) resolve8(out.exitCode ?? -1);
-    }, timeoutMs > 0 ? { timeoutMs } : void 0);
+    runCommand(
+      { commandId, cmd, args, path: cwd2, env: env3 },
+      (out) => {
+        if (out.chunk) onChunk(out.chunk);
+        if (out.done) resolve8(out.exitCode ?? -1);
+      },
+      { stdin, ...timeoutMs > 0 ? { timeoutMs } : {} }
+    ).catch(() => resolve8(-1));
   });
 }
 async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0) {
@@ -34281,7 +34479,7 @@ async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0) {
         handlers.onChunk(text);
       }
     };
-    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, cwd2, attempt.env, emit, timeoutMs);
+    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, attempt.stdin, cwd2, attempt.env, emit, timeoutMs);
     const tail = parser.flush();
     if (tail) {
       captured += tail;
@@ -34358,6 +34556,52 @@ function setWorkingCredential(profileDir2, key) {
   } catch {
   }
 }
+var PINNED_CREDENTIAL_KEY = "__pinned__";
+function getPinnedCredential(profileDir2) {
+  return readState(profileDir2)[PINNED_CREDENTIAL_KEY] ?? null;
+}
+function setPinnedCredential(profileDir2, key) {
+  const state = readState(profileDir2);
+  if (state[PINNED_CREDENTIAL_KEY] === key) return;
+  state[PINNED_CREDENTIAL_KEY] = key;
+  try {
+    writeFileSync4(statePath(profileDir2), JSON.stringify(state, null, 2), "utf8");
+  } catch {
+  }
+}
+function clearPinnedCredential(profileDir2) {
+  const state = readState(profileDir2);
+  if (!(PINNED_CREDENTIAL_KEY in state)) return;
+  delete state[PINNED_CREDENTIAL_KEY];
+  try {
+    writeFileSync4(statePath(profileDir2), JSON.stringify(state, null, 2), "utf8");
+  } catch {
+  }
+}
+
+// src/utils/time.ts
+function formatTimestampInZone(date, timeZone) {
+  const build = (tz) => {
+    const parts = new Intl.DateTimeFormat("en-CA", {
+      ...tz ? { timeZone: tz } : {},
+      hour12: false,
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit"
+    }).formatToParts(date);
+    const get2 = (type) => parts.find((p) => p.type === type)?.value ?? "";
+    const hour = get2("hour") === "24" ? "00" : get2("hour");
+    return `${get2("year")}/${get2("month")}/${get2("day")} ${hour}:${get2("minute")}:${get2("second")}`;
+  };
+  try {
+    return build(timeZone);
+  } catch {
+    return build();
+  }
+}
 
 // src/utils/ai-cli.ts
 import { readFileSync as readFileSync8 } from "fs";
@@ -34463,7 +34707,7 @@ function folderScopeGuard(folder, prompt) {
     prompt
   ].join("\n");
 }
-function buildRunArgs(profile, cmd, prompt, resumeId, oneShot = false) {
+function buildRunArgs(profile, cmd, resumeId, oneShot = false) {
   const extras = profile.args ?? [];
   const model = profile.model?.trim();
   const modelArgs = model ? ["--model", model] : [];
@@ -34471,7 +34715,7 @@ function buildRunArgs(profile, cmd, prompt, resumeId, oneShot = false) {
   const turns = profile.maxTurns;
   const perProfileTurns = !oneShot && cmd.includes("claude") && typeof turns === "number" && turns > 0 ? [`--max-turns=${Math.floor(turns)}`] : [];
   const oneShotExtra = oneShot ? oneShotArgs(cmd) : perProfileTurns;
-  return [...requiredArgs(cmd), ...resumeArgs, ...extras, ...modelArgs, ...oneShotExtra, prompt];
+  return [...requiredArgs(cmd), ...resumeArgs, ...extras, ...modelArgs, ...oneShotExtra];
 }
 function claudeHomeDirs(config) {
   const dirs = profileDirs(claudeProfilesOf(config));
@@ -34522,7 +34766,7 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot) {
     return {
       cmd: active,
       attempts: [
-        { cmd: active, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, active, prompt, void 0, oneShot), env: { ...baseEnv } }
+        { cmd: active, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, active, void 0, oneShot), stdin: prompt, env: { ...baseEnv } }
       ]
     };
   }
@@ -34540,7 +34784,8 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot) {
     label: cred.label?.trim() || profileDisplayLabel(dir2),
     dir: dir2,
     key,
-    args: buildRunArgs(cred, cmd, prompt, resume.get(key), oneShot),
+    args: buildRunArgs(cred, cmd, resume.get(key), oneShot),
+    stdin: prompt,
     env: envVar ? { ...baseEnv, [envVar]: dir2 } : { ...baseEnv }
   }));
   return { cmd: attempts[0]?.cmd ?? DEFAULT_AI_CLI, attempts };
@@ -34552,7 +34797,7 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot) {
   const defaultPlan = {
     cmd,
     attempts: [
-      { cmd, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, cmd, prompt, void 0, oneShot), env: { ...baseEnv } }
+      { cmd, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, cmd, void 0, oneShot), stdin: prompt, env: { ...baseEnv } }
     ]
   };
   if (!envVar) return defaultPlan;
@@ -34569,7 +34814,8 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot) {
       label: profileDisplayLabel(dir2),
       dir: dir2,
       key,
-      args: buildRunArgs(profile, cmd, prompt, resume.get(key), oneShot),
+      args: buildRunArgs(profile, cmd, resume.get(key), oneShot),
+      stdin: prompt,
       env: { ...baseEnv, [envVar]: dir2 }
     };
   });
@@ -34577,7 +34823,7 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot) {
 }
 
 // src/core/claude-usage.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { readFileSync as readFileSync9 } from "fs";
 import { join as join9 } from "path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
@@ -34624,7 +34870,7 @@ function runUsageCli(dir2, aiCli2) {
     }, 3e4);
     timer.unref?.();
     try {
-      child = spawn3(aiCli2, ["/usage"], {
+      child = spawn4(aiCli2, ["/usage"], {
         env: { ...process.env, CLAUDE_CONFIG_DIR: dir2 },
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -34694,7 +34940,7 @@ async function checkClaudeUsage(dirs, aiCli2 = "claude") {
 // src/core/ai-assist.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-var run = promisify(execFile);
+var run2 = promisify(execFile);
 function aiCli() {
   return process.env.AI_CLI || "claude";
 }
@@ -34737,7 +34983,7 @@ function parseAi(cli, stdout, prompt) {
 }
 async function runAi(prompt) {
   const cli = aiCli();
-  const { stdout } = await run(cli, aiArgs(cli, prompt), {
+  const { stdout } = await run2(cli, aiArgs(cli, prompt), {
     timeout: 12e4,
     maxBuffer: 8 * 1024 * 1024
   });
@@ -35080,7 +35326,7 @@ async function writeWorkerFile(root, relPath, content) {
 }
 
 // src/core/support-answer.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { execFile as execFile2 } from "child_process";
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
@@ -35215,7 +35461,7 @@ function runClaudeOnce(cmd, profile, prompt, extraEnv) {
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
-    const child = spawn4(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3 });
+    const child = spawn5(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3 });
     const parser = createAiStreamParser(cmd);
     let out = "";
     let err = "";
@@ -35285,7 +35531,7 @@ async function runSupportAnswer(req, ai, profileDir2) {
 }
 
 // src/core/knowledge-compose.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 var COMPOSE_TIMEOUT_MS = 18e4;
 function buildPrompt2(req) {
   const focus = req.prompt ? `
@@ -35311,7 +35557,7 @@ function runOnce(cmd, profile, prompt, cwd2, extraEnv) {
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
-    const child = spawn5(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
+    const child = spawn6(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
     let out = "";
     let err = "";
     const timer = setTimeout(() => {
@@ -35359,10 +35605,10 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
 // src/core/autonomous.ts
 import { readFile as readFile3, writeFile as writeFile2, chmod } from "fs/promises";
 import { readFileSync as readFileSync13 } from "fs";
-import { execFile as execFile3, spawn as spawn6 } from "child_process";
+import { execFile as execFile3, spawn as spawn7 } from "child_process";
 import { join as join13 } from "path";
 import { promisify as promisify3 } from "util";
-var run2 = promisify3(execFile3);
+var run3 = promisify3(execFile3);
 var SETTINGS_REL = ".claude/.autonomous.settings.json";
 var HISTORIES_REL = ".claude/.autonomous.histories.json";
 var APPROVALS_REL = ".claude/.autonomous.approvals.json";
@@ -35396,7 +35642,7 @@ function tickScript(root) {
 }
 async function crontabList() {
   try {
-    const { stdout } = await run2("crontab", ["-l"], { timeout: 1e4 });
+    const { stdout } = await run3("crontab", ["-l"], { timeout: 1e4 });
     return stdout;
   } catch {
     return "";
@@ -35404,7 +35650,7 @@ async function crontabList() {
 }
 async function crontabSet(content) {
   return new Promise((resolve8) => {
-    const child = spawn6("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
+    const child = spawn7("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
     child.on("error", () => resolve8(false));
     child.on("close", (code) => resolve8(code === 0));
     child.stdin.end(content.endsWith("\n") ? content : content + "\n");
@@ -36135,15 +36381,15 @@ async function buildGraph(root, mode) {
 // src/core/rag.ts
 import { readFile as readFile9, writeFile as writeFile7, statfs as statfs2, mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync10 } from "fs";
-import { execFile as execFile4, spawn as spawn7 } from "child_process";
+import { execFile as execFile4, spawn as spawn8 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
 import { join as join20 } from "path";
 import { promisify as promisify4 } from "util";
-var run3 = promisify4(execFile4);
+var run4 = promisify4(execFile4);
 var RAG_REL = ".claude/rag";
 async function tryRun(cmd, args) {
   try {
-    const { stdout } = await run3(cmd, args, { timeout: 8e3 });
+    const { stdout } = await run4(cmd, args, { timeout: 8e3 });
     return { ok: true, out: stdout.trim() };
   } catch {
     return { ok: false, out: "" };
@@ -36322,7 +36568,7 @@ touch "${RAG_REL}/.indexing"
 { echo "[reindex] $(date)"; "$RAG_PY" "${RAG_REL}/rag_engine.py" reindex 2>&1; } >> "${RAG_REL}/index.log" 2>&1
 rm -f "${RAG_REL}/.indexing"
 `;
-  const child = spawn7("bash", ["-c", script], {
+  const child = spawn8("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin },
     detached: true,
@@ -36337,7 +36583,7 @@ async function ragQuery(root, queryText, k = 8) {
   if (!existsSync10(join20(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
-    const { stdout } = await run3(
+    const { stdout } = await run4(
       py.bin,
       [join20(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
@@ -36372,7 +36618,7 @@ rm -f "${RAG_REL}/.installed"
 } >> "${RAG_REL}/install.log" 2>&1
 rm -f "${RAG_REL}/.installing"
 `;
-  const child = spawn7("bash", ["-c", script], {
+  const child = spawn8("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin, RAG_MODEL: model },
     detached: true,
@@ -36387,7 +36633,7 @@ import { readFile as readFile10 } from "fs/promises";
 import { execFile as execFile5 } from "child_process";
 import { basename as basename3, dirname as dirname7, resolve as resolve5 } from "path";
 import { promisify as promisify5 } from "util";
-var run4 = promisify5(execFile5);
+var run5 = promisify5(execFile5);
 async function gitDiff(path) {
   const target = resolve5(path);
   const dir2 = dirname7(target);
@@ -36399,7 +36645,7 @@ async function gitDiff(path) {
   }
   let oldContent = "";
   try {
-    const { stdout } = await run4("git", ["show", `HEAD:./${base}`], {
+    const { stdout } = await run5("git", ["show", `HEAD:./${base}`], {
       cwd: dir2,
       timeout: 15e3,
       maxBuffer: 4 * 1024 * 1024
@@ -36413,10 +36659,10 @@ async function gitDiff(path) {
 // src/core/git-env.ts
 import { execFile as execFile6 } from "child_process";
 import { promisify as promisify6 } from "util";
-var run5 = promisify6(execFile6);
+var run6 = promisify6(execFile6);
 async function hasBinary(bin, args = ["--version"]) {
   try {
-    await run5(bin, args, { timeout: 5e3 });
+    await run6(bin, args, { timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -36429,7 +36675,7 @@ async function checkGitEnv(provider) {
   let account = null;
   if (installed) {
     try {
-      const { stdout, stderr } = await run5(bin, ["auth", "status"], { timeout: 8e3 });
+      const { stdout, stderr } = await run6(bin, ["auth", "status"], { timeout: 8e3 });
       const out = `${stdout}
 ${stderr}`;
       authenticated = /logged in|logged into|✓/i.test(out);
@@ -36446,7 +36692,7 @@ import { execFile as execFile7 } from "child_process";
 import { readFile as readFile11, rm as rm3, mkdir as mkdir7 } from "fs/promises";
 import { join as join21 } from "path";
 import { promisify as promisify7 } from "util";
-var run6 = promisify7(execFile7);
+var run7 = promisify7(execFile7);
 function keyPaths(profileDir2) {
   const dir2 = join21(profileDir2, ".ssh");
   const key = join21(dir2, "id_4pm");
@@ -36461,14 +36707,14 @@ async function readPublicKey(pub) {
 }
 async function fingerprintOf(pub) {
   try {
-    const { stdout } = await run6("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
+    const { stdout } = await run7("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
     return stdout.match(/SHA256:[A-Za-z0-9+/=]+/)?.[0] ?? null;
   } catch {
     return null;
   }
 }
 async function configureGit(key) {
-  await run6(
+  await run7(
     "git",
     ["config", "--global", "core.sshCommand", `ssh -i ${key} -o IdentitiesOnly=yes`],
     { timeout: 5e3 }
@@ -36479,7 +36725,7 @@ async function generate(profileDir2) {
   await mkdir7(dir2, { recursive: true });
   await rm3(key, { force: true });
   await rm3(pub, { force: true });
-  await run6("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
+  await run7("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
     timeout: 15e3
   });
   await configureGit(key);
@@ -36489,7 +36735,7 @@ async function remove(profileDir2) {
   const { key, pub } = keyPaths(profileDir2);
   await rm3(key, { force: true });
   await rm3(pub, { force: true });
-  await run6("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
+  await run7("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
     () => void 0
   );
   return { publicKey: null, fingerprint: null };
@@ -36514,7 +36760,7 @@ import { readdir as readdir6 } from "fs/promises";
 import { execFile as execFile8 } from "child_process";
 import { resolve as resolve6, sep as sep4 } from "path";
 import { promisify as promisify8 } from "util";
-var run7 = promisify8(execFile8);
+var run8 = promisify8(execFile8);
 var FS = "";
 var RS = "";
 function resolveRepo(root, repo) {
@@ -36525,7 +36771,7 @@ function resolveRepo(root, repo) {
 }
 async function git(cwd2, args) {
   try {
-    const { stdout } = await run7("git", args, {
+    const { stdout } = await run8("git", args, {
       cwd: cwd2,
       timeout: 15e3,
       maxBuffer: 8 * 1024 * 1024
@@ -36629,11 +36875,11 @@ async function gitCommitDiff(root, repo, hash, path) {
 // src/core/git-commit-identity.ts
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify9 } from "util";
-var run8 = promisify9(execFile9);
+var run9 = promisify9(execFile9);
 async function setCommitAuthor(cwd2, machineUsername) {
   if (!machineUsername) return;
   try {
-    await run8("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
+    await run9("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
   } catch {
   }
 }
@@ -36644,7 +36890,7 @@ import { execFile as execFile10 } from "child_process";
 import { dirname as dirname8, join as join22, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify as promisify10 } from "util";
-var run9 = promisify10(execFile10);
+var run10 = promisify10(execFile10);
 function reposOf(spec) {
   const repos = spec?.repos;
   return Array.isArray(repos) ? repos : [];
@@ -36658,13 +36904,13 @@ async function provisionRepos(target, repos, emit, opts = {}) {
     if (repo.primary) {
       if (opts.clonePrimary && repo.url) {
         emit("git", `Cloning ${repo.url}\u2026`);
-        await run9("git", ["clone", repo.url, target], { timeout: 12e4 });
+        await run10("git", ["clone", repo.url, target], { timeout: 12e4 });
         continue;
       }
       emit("git", "Initializing the primary repo\u2026");
-      await run9("git", ["init"], { cwd: target, timeout: 2e4 });
+      await run10("git", ["init"], { cwd: target, timeout: 2e4 });
       if (repo.url) {
-        await run9("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
+        await run10("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
           () => void 0
         );
       }
@@ -36673,11 +36919,11 @@ async function provisionRepos(target, repos, emit, opts = {}) {
     const dir2 = join22(target, subDirName(repo));
     if (repo.url) {
       emit("git", `Cloning sub-repo ${repo.url}\u2026`);
-      await run9("git", ["clone", repo.url, dir2], { timeout: 12e4 });
+      await run10("git", ["clone", repo.url, dir2], { timeout: 12e4 });
     } else {
       emit("git", `Initializing sub-repo ${subDirName(repo)}\u2026`);
       await mkdir8(dir2, { recursive: true });
-      await run9("git", ["init"], { cwd: dir2, timeout: 2e4 });
+      await run10("git", ["init"], { cwd: dir2, timeout: 2e4 });
     }
   }
 }
@@ -36948,6 +37194,70 @@ function runWhoami(ctx) {
     ctx.print(`projects: ${w.projects.length ? w.projects.map((p) => p.name).join(", ") : "(none)"}`);
   });
 }
+function aiProfileLabel(c) {
+  return c.label?.trim() || profileDisplayLabel(resolveHomePath(c.profile));
+}
+function runAiProfile(ctx) {
+  const dir2 = ctx.info.profileDir;
+  const config = readProfileConfig(dir2);
+  const list = Array.isArray(config.aiProfiles) ? config.aiProfiles : [];
+  const [sub, ...rest] = ctx.args;
+  const action = (sub ?? "list").toLowerCase();
+  if (action === "list") {
+    if (list.length === 0) {
+      ctx.print("No AI profiles configured (config.aiProfiles is empty).", "warn");
+      ctx.print("This worker may use a legacy per-provider config \u2014 /config show to inspect.");
+      return;
+    }
+    const pinned = getPinnedCredential(dir2);
+    const working = getWorkingCredential(dir2);
+    ctx.print("AI profiles (config order = failover priority) \xB7 /ai-profile use <n> to switch:");
+    list.forEach((c, i) => {
+      const usable = isUsableCredential(c);
+      const key = usable ? credentialKey(c.provider, resolveHomePath(c.profile)) : null;
+      const flags = [];
+      if (key && key === pinned) flags.push("pinned");
+      else if (key && !pinned && key === working) flags.push("active");
+      if (c.enabled === false) flags.push("disabled");
+      const model = c.model?.trim() ? ` \xB7 model=${c.model.trim()}` : "";
+      const flagStr = flags.length ? `  (${flags.join(", ")})` : "";
+      const marker = key && key === pinned ? "*" : " ";
+      ctx.print(`  ${marker}[${i + 1}] ${c.provider.padEnd(11)} ${aiProfileLabel(c)}${model}${flagStr}`);
+    });
+    if (pinned) {
+      ctx.print("A profile is pinned \u2014 tried first every prompt; /ai-profile reset returns to auto.");
+    }
+    return;
+  }
+  if (action === "reset" || action === "auto" || action === "clear") {
+    clearPinnedCredential(dir2);
+    ctx.print("\u2714 AI profile pin cleared \u2014 failover is back to automatic (config order / remembered).");
+    const working = getWorkingCredential(dir2);
+    ctx.setActiveProfile(working ? labelFromCredentialKey(working) : null);
+    return;
+  }
+  if (action === "use" || action === "switch") {
+    const n = Number(rest[0]);
+    if (!Number.isInteger(n) || n < 1 || n > list.length) {
+      ctx.print(`usage: /ai-profile use <n>   (n = 1-${list.length || "?"} from /ai-profile list)`, "error");
+      return;
+    }
+    const cred = list[n - 1];
+    if (!isUsableCredential(cred)) {
+      const why = cred.enabled === false ? "it is disabled" : "it has no usable profile dir / provider";
+      ctx.print(`Profile [${n}] "${aiProfileLabel(cred)}" can't be used \u2014 ${why}.`, "error");
+      return;
+    }
+    const credDir = resolveHomePath(cred.profile);
+    setPinnedCredential(dir2, credentialKey(cred.provider, credDir));
+    ctx.setActiveProfile(profileDisplayLabel(credDir));
+    ctx.print(
+      `\u2714 switched to ${cred.provider} profile "${aiProfileLabel(cred)}" \u2014 tried first from the next prompt (failover keeps the rest as backup).`
+    );
+    return;
+  }
+  ctx.print(`Unknown /ai-profile subcommand "${sub}". Use: list | use <n> | reset.`, "error");
+}
 function runFold(ctx, action) {
   if (ctx.maxBlock === 0) {
     ctx.print("No collapsible blocks on screen.", "warn");
@@ -37037,6 +37347,12 @@ var COMMANDS = [
     description: "Show this machine account + its teams & projects",
     run: runWhoami
   },
+  {
+    name: "ai-profile",
+    usage: "/ai-profile [list|use <n>|reset]",
+    description: "List AI profiles / switch which one runs (ADR-0250)",
+    run: runAiProfile
+  },
   {
     name: "config",
     usage: "/config [show|init|set <k> <v>|delete <k>]",
@@ -37085,7 +37401,7 @@ function runSlashCommand(line, base) {
 }
 
 // src/core/memory-compact.ts
-import { spawn as spawn8 } from "child_process";
+import { spawn as spawn9 } from "child_process";
 var COMPACT_TIMEOUT_MS = 6e4;
 function buildPrompt3(input) {
   return [
@@ -37113,7 +37429,7 @@ function runOnce2(cmd, profile, prompt, cwd2, extraEnv) {
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
-    const child = spawn8(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
+    const child = spawn9(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
     let out = "";
     let err = "";
     const timer = setTimeout(() => {
@@ -37201,125 +37517,6 @@ function applyConfigText(profileDir2, text) {
   return { ok: true };
 }
 
-// src/core/worker-tools.ts
-import { spawn as spawn9 } from "child_process";
-var NPM_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
-function run10(cmd, args, onLine, timeoutMs = 18e4) {
-  return new Promise((resolve8) => {
-    let out = "";
-    let buf = "";
-    let child = null;
-    const done = (code) => {
-      clearTimeout(timer);
-      if (onLine && buf.trim()) onLine(buf.trim());
-      resolve8({ code, out });
-    };
-    const timer = setTimeout(() => {
-      child?.kill();
-      if (onLine) onLine(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
-      done(124);
-    }, timeoutMs);
-    timer.unref?.();
-    const feed = (d) => {
-      const text = d.toString("utf8");
-      out += text;
-      if (!onLine) return;
-      buf += text;
-      let nl;
-      while ((nl = buf.indexOf("\n")) >= 0) {
-        const line = buf.slice(0, nl).replace(/\r$/, "");
-        buf = buf.slice(nl + 1);
-        onLine(line);
-      }
-    };
-    try {
-      child = spawn9(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
-      child.stdout?.on("data", feed);
-      child.stderr?.on("data", feed);
-      child.on("exit", (code) => done(code ?? 0));
-      child.on("error", () => done(127));
-    } catch {
-      done(127);
-    }
-  });
-}
-async function detectOne(cmd, versionArg) {
-  const { code, out } = await run10(cmd, [versionArg], void 0, 15e3);
-  if (code !== 0) return null;
-  const first = out.split("\n").map((l) => l.trim()).find(Boolean);
-  return first ?? "";
-}
-async function listExtras() {
-  const { out } = await run10("npm", ["ls", "-g", "--depth=0", "--json"], void 0, 2e4);
-  if (!out.trim()) return [];
-  let deps = {};
-  try {
-    deps = JSON.parse(out).dependencies ?? {};
-  } catch {
-    return [];
-  }
-  const catalogPkgs = new Set(WORKER_TOOL_BUNDLED_GLOBALS);
-  for (const t of WORKER_TOOL_CATALOG) {
-    catalogPkgs.add(t.id);
-    if (t.installPackage) catalogPkgs.add(t.installPackage);
-  }
-  return Object.entries(deps).filter(([name]) => !catalogPkgs.has(name)).map(([name, info]) => ({
-    id: name,
-    label: name,
-    category: "runtime",
-    installed: true,
-    version: info.version ?? null,
-    installable: true
-  }));
-}
-async function detectWorkerTools() {
-  const catalog = await Promise.all(
-    WORKER_TOOL_CATALOG.map(async (t) => {
-      const version = await detectOne(t.id, t.versionArg);
-      return {
-        id: t.id,
-        label: t.label,
-        category: t.category,
-        installed: version !== null,
-        version,
-        installable: t.installable
-      };
-    })
-  );
-  const extras = await listExtras().catch(() => []);
-  return { catalog, extras };
-}
-function resolvePackage(name, op) {
-  const entry = WORKER_TOOL_CATALOG.find((t) => t.id === name);
-  if (entry) {
-    if (!entry.installable) {
-      return { error: `"${name}" is a prerequisite and cannot be ${op}ed from here.` };
-    }
-    return { pkg: entry.installPackage ?? name };
-  }
-  if (WORKER_TOOL_PREREQUISITE_IDS.includes(name)) {
-    return { error: `"${name}" is a prerequisite and cannot be ${op}ed from here.` };
-  }
-  if (WORKER_TOOL_BUNDLED_GLOBALS.includes(name)) {
-    return { error: `"${name}" ships with Node and cannot be ${op}ed from here.` };
-  }
-  if (!NPM_NAME.test(name)) return { error: `Invalid package name: "${name}".` };
-  return { pkg: name };
-}
-function opArgs(op, manager, pkg) {
-  if (manager === "pnpm") return [op === "install" ? "add" : "remove", "-g", pkg];
-  return [op === "install" ? "install" : "uninstall", "-g", pkg];
-}
-async function runWorkerToolOp(op, name, manager, onLine) {
-  const resolved = resolvePackage(name, op);
-  if (resolved.error || !resolved.pkg) {
-    return { ok: false, exitCode: 1, error: resolved.error ?? "Invalid package." };
-  }
-  onLine(`$ ${manager} ${opArgs(op, manager, resolved.pkg).join(" ")}`);
-  const { code } = await run10(manager, opArgs(op, manager, resolved.pkg), onLine);
-  return { ok: code === 0, exitCode: code, error: code === 0 ? void 0 : `${manager} exited ${code}` };
-}
-
 // src/core/ws-client.ts
 var MEMORY_SEED_HEADER = "CONTEXT MEMORY from earlier in this conversation (may span prior sessions/accounts). Use it as background; do not repeat it back unless relevant:";
 var HEARTBEAT_MS = 3e4;
@@ -37417,6 +37614,9 @@ var WsClient = class {
   reconnectEntryId = null;
   /** Org-configured reconnect cap (seconds) from the last ws_token — overrides env. */
   orgReconnectMaxSec = null;
+  /** Org timezone (IANA) from the last ws_token (ADR-0132) — a rented worker follows its renter's
+   *  org; used to stamp the AI-run start time on the `aireq` transcript marker (ADR-0249). */
+  orgTimezone = "UTC";
   /** Env override for the reconnect cap (seconds); resolved once at construction. */
   envReconnectMaxSec = envReconnectMaxSec();
   /** Process start (ms) — uptime for a web-dispatched `/status` (ADR-0249). */
@@ -37601,6 +37801,9 @@ var WsClient = class {
         if (typeof token.reconnectMaxBackoffSec === "number") {
           this.orgReconnectMaxSec = token.reconnectMaxBackoffSec;
         }
+        if (typeof token.timezone === "string" && token.timezone) {
+          this.orgTimezone = token.timezone;
+        }
         if (typeof token.autoUpdateDaily === "boolean") {
           this.updateScheduler.configure({
             autoUpdateDaily: token.autoUpdateDaily,
@@ -38100,14 +38303,21 @@ var WsClient = class {
         break;
       }
       case WsChannels.TOOLS_LIST:
-        void detectWorkerTools().then(
+        void detectWorkerTools(readProfileConfig(this.context.profileDir).autoUpdateTools ?? []).then(
           (reply) => this.send(WsChannels.TOOLS_LIST, reply, message.id)
         );
         break;
+      case WsChannels.TOOLS_AUTOUPDATE: {
+        const req = payload;
+        const res = setToolAutoUpdate(this.context.profileDir, req.name, req.enabled);
+        this.send(WsChannels.TOOLS_AUTOUPDATE, res, message.id);
+        break;
+      }
       case WsChannels.TOOLS_INSTALL:
-      case WsChannels.TOOLS_UNINSTALL: {
+      case WsChannels.TOOLS_UNINSTALL:
+      case WsChannels.TOOLS_UPDATE: {
         const req = payload;
-        const op = message.channel === WsChannels.TOOLS_INSTALL ? "install" : "uninstall";
+        const op = message.channel === WsChannels.TOOLS_INSTALL ? "install" : message.channel === WsChannels.TOOLS_UPDATE ? "update" : "uninstall";
         this.send(message.channel, { started: true }, message.id);
         void runWorkerToolOp(
           op,
@@ -38288,9 +38498,10 @@ var WsClient = class {
     const unified = isUnifiedConfig(config);
     const mode = config.aiFailoverMode ?? "remember";
     const workingDir = unified ? null : getWorkingProfile(this.context.profileDir, cmd);
-    const workingCred = unified && mode === "remember" ? getWorkingCredential(this.context.profileDir) : null;
+    const pinnedCred = unified ? getPinnedCredential(this.context.profileDir) : null;
+    const workingCred = unified ? pinnedCred ?? (mode === "remember" ? getWorkingCredential(this.context.profileDir) : null) : null;
     const startDir = unified ? null : this.profileUnderSessionPressure(config, cmd, workingDir);
-    const startCred = unified ? this.credentialUnderSessionPressure(config, workingCred) : null;
+    const startCred = unified && !pinnedCred ? this.credentialUnderSessionPressure(config, workingCred) : null;
     if (startDir && startDir !== workingDir) {
       this.bus.push({
         source: origin,
@@ -38322,7 +38533,8 @@ ${guardedPrompt}`;
     }
     const plan = planAiRun(effectivePrompt, config, hint, resume, oneShot);
     const markerArgs = plan.attempts[0]?.args ?? [];
-    this.bus.push({ source: origin, kind: "aireq", text: `${plan.cmd} \u2039 ${prompt}` });
+    const startStamp = formatTimestampInZone(/* @__PURE__ */ new Date(), this.orgTimezone);
+    this.bus.push({ source: origin, kind: "aireq", text: `${startStamp} ${plan.cmd} \u2039 ${prompt}` });
     logger.info("command.ai", { commandId, origin, cmd: plan.cmd, profiles: plan.attempts.length });
     if (origin === "local") {
       this.send(WsChannels.COMMAND_ANNOUNCE, {
@@ -38557,6 +38769,8 @@ ${guardedPrompt}`;
       submitAi: () => {
       },
       // only /claude-cmd uses this, and it is special-cased above
+      // /ai-profile use/reset from the web Console updates the shared header too (ADR-0250).
+      setActiveProfile: (label) => this.bus.setActiveProfile(label),
       reconnect: () => this.reconnectNow(),
       expand: () => emit("Use the web console's fold viewer to expand blocks."),
       collapse: () => emit("Use the web console's fold viewer to collapse blocks."),
@@ -45263,12 +45477,17 @@ function textColor(line) {
   if (line.kind === "exit") return "green";
   return void 0;
 }
+var START_STAMP_RE = /^(\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2} )/;
 function AiMarkerLine({ line }) {
   const arrow = line.kind === "aireq" ? "\u2039" : "\u203A";
   const idx = line.text.indexOf(arrow);
   if (idx < 0) return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { children: line.text || " " });
+  const before = line.text.slice(0, idx);
+  const stamp = line.kind === "aireq" ? START_STAMP_RE.exec(before)?.[1] ?? "" : "";
+  const name = stamp ? before.slice(stamp.length) : before;
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: "cyan", bold: true, children: line.text.slice(0, idx) }),
+    stamp ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { dimColor: true, children: stamp }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: "cyan", bold: true, children: name }),
     /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { dimColor: true, children: arrow }),
     /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { children: line.text.slice(idx + 1) })
   ] });
@@ -45685,6 +45904,9 @@ function App2({
           setPendingConfirm({ prompt, onYes });
         },
         submitAi: (aiInput) => bus.submitLocal(aiInput),
+        // /ai-profile use/reset updates the header's active-profile label at once (ADR-0250);
+        // the bus event feeds the React state (see the onActiveProfile subscription above).
+        setActiveProfile: (label) => bus.setActiveProfile(label),
         reconnect: () => bus.requestReconnect(),
         expand: expandFold,
         collapse: collapseFold,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.5.1",
+  "version": "1.5.2b",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",