@4pm/cli 1.5.2 → 1.5.11-b

package/dist/index.js

@@ -28834,18 +28834,21 @@ function isValidRoleSet(roles) {
 
 // vendor/@4pm/constants/worker-tools.ts
 var WORKER_TOOL_CATALOG = [
-  { id: "git", label: "Git", category: "vcs", versionArg: "--version", installPackage: null, installable: false },
-  { id: "node", label: "Node.js", category: "runtime", versionArg: "--version", installPackage: null, installable: false },
-  { id: "npm", label: "npm", category: "runtime", versionArg: "--version", installPackage: null, installable: false },
-  { id: "pnpm", label: "pnpm", category: "runtime", versionArg: "--version", installPackage: "pnpm", installable: false },
-  { id: "claude", label: "Claude Code", category: "ai-cli", versionArg: "--version", installPackage: "@anthropic-ai/claude-code", installable: false },
-  { id: "codex", label: "Codex", category: "ai-cli", versionArg: "--version", installPackage: "@openai/codex", installable: false },
-  { id: "gh", label: "GitHub CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false },
-  { id: "glab", label: "GitLab CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false }
+  { id: "git", label: "Git", category: "vcs", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "node", label: "Node.js", category: "runtime", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "npm", label: "npm", category: "runtime", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "pnpm", label: "pnpm", category: "runtime", versionArg: "--version", installPackage: "pnpm", installable: false, updatable: true },
+  { id: "claude", label: "Claude Code", category: "ai-cli", versionArg: "--version", installPackage: "@anthropic-ai/claude-code", installable: false, updatable: true },
+  { id: "codex", label: "Codex", category: "ai-cli", versionArg: "--version", installPackage: "@openai/codex", installable: false, updatable: true },
+  { id: "gh", label: "GitHub CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false, updatable: false },
+  { id: "glab", label: "GitLab CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false, updatable: false }
 ];
 var WORKER_TOOL_PREREQUISITE_IDS = WORKER_TOOL_CATALOG.filter(
   (t) => !t.installable
 ).map((t) => t.id);
+var WORKER_TOOL_UPDATABLE_IDS = WORKER_TOOL_CATALOG.filter(
+  (t) => t.updatable
+).map((t) => t.id);
 var WORKER_TOOL_BUNDLED_GLOBALS = ["npm", "corepack"];
 
 // vendor/@4pm/constants/ws.ts
@@ -32909,7 +32912,7 @@ var deletedFilterSchema = external_exports.enum(["true", "false"]).transform((v)
 
 // vendor/@4pm/dto/command.ts
 var COMMAND_MAX_LEN = 8e3;
-var AI_PROMPT_MAX_LEN = 2e5;
+var AI_PROMPT_MAX_LEN = 5e5;
 var dispatchCommandRequestSchema = external_exports.object({
   projectId: external_exports.string().uuid(),
   // Target cli. Required unless `pick` is set — with `pick:"idle"` the server chooses the
@@ -33065,12 +33068,24 @@ var listMachineLinksQuerySchema = baseRequestSchema.extend({
 var updateMachineLinkRequestSchema = external_exports.object({
   hashcode3ExpiresAt: external_exports.string().datetime().nullable()
 });
+var workerToolCopySchema = external_exports.object({
+  /** Source machine-link id whose `toolSnapshot` supplies the manifest. */
+  sourceLinkId: external_exports.string().uuid(),
+  /** Target machine-link ids to queue the manifest for (pushed on their next connect). */
+  targetLinkIds: external_exports.array(external_exports.string().uuid()).min(1).max(200)
+});
 var workerToolInstallSchema = external_exports.object({
   /** Catalog id or npm package name (validated npm-name shape on the cli). */
   name: external_exports.string().trim().min(1).max(214),
   /** Package manager to run the global install with. */
   manager: external_exports.enum(["npm", "pnpm"])
 });
+var workerToolAutoUpdateSchema = external_exports.object({
+  /** Catalog id or installed extra's npm package name. */
+  name: external_exports.string().trim().min(1).max(214),
+  /** true = flag this tool for auto-update to @latest; false = clear it. */
+  enabled: external_exports.boolean()
+});
 var configWriteRequestSchema = external_exports.object({
   config: external_exports.string().max(256 * 1024)
 });
@@ -33675,8 +33690,27 @@ var WsChannels = {
   TOOLS_LIST: "tools.list",
   TOOLS_INSTALL: "tools.install",
   TOOLS_UNINSTALL: "tools.uninstall",
+  // update-to-latest of an npm-distributed catalog tool or an extra (ADR-0252): same streamed
+  // shape as install/uninstall — the cli reinstalls the package at `@latest`.
+  TOOLS_UPDATE: "tools.update",
   TOOLS_PROGRESS: "tools.progress",
   TOOLS_DONE: "tools.done",
+  // toggle per-tool auto-update (ADR-0253): request/reply — the cli persists the flag in
+  // config.json (`autoUpdateTools`); the ADR-0074 idle daily tick later runs the flagged tools.
+  // (ADR-0254: the flag is now persisted to the DB `toolSnapshot`; this channel is repurposed —
+  // machine-0056 forwards it to an ONLINE worker only, to update its local config.json mirror
+  // immediately instead of waiting for the next ws_token seed.)
+  TOOLS_AUTOUPDATE: "tools.autoUpdate",
+  // cli → server one-way (ADR-0254): report the worker's detected tool snapshot — the server
+  // persists it to `MachineLink.toolSnapshot` for the DB-backed Tools panel + restore-on-boot.
+  // Sent on the ADR-0074 daily idle tick, after each install/uninstall/update op, and on boot
+  // AFTER restore completes. The read/restore direction rides `ws_token` (seeds the cli).
+  TOOLS_REPORT: "tools.report",
+  // server → cli (reply, ADR-0254): push a tool manifest to reconcile NOW — used by "copy tools"
+  // to apply immediately to an online target (the offline path rides `ws_token.toolRestore` on the
+  // next connect). The cli installs each missing/mismatched `name@version`, then reports; the reply
+  // says whether it applied so the server can clear the pending manifest.
+  TOOLS_RESTORE: "tools.restore",
   // autonomous mode control (ADR-0152): read settings+status+books+approvals, tail logs, and
   // write {settings|approvals|userTodo|cron} — the dashboard drives the worker's autonomous engine.
   AUTONOMOUS_READ: "autonomous.read",
@@ -33837,7 +33871,7 @@ import { existsSync as existsSync13, mkdirSync as mkdirSync5, rmSync as rmSync4
 import { randomUUID as randomCommandId } from "crypto";
 
 // src/core/update-scheduler.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/common/logger/logger.ts
 import { appendFile, mkdir, readdir, unlink } from "fs/promises";
@@ -33942,17 +33976,191 @@ ${content.slice(-LOG_UPLOAD_CONTENT_MAX)}`;
   }
 }
 
+// src/core/worker-tools.ts
+import { spawn } from "child_process";
+var NPM_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+function run(cmd, args, onLine, timeoutMs = 18e4) {
+  return new Promise((resolve8) => {
+    let out = "";
+    let buf = "";
+    let child = null;
+    const done = (code) => {
+      clearTimeout(timer);
+      if (onLine && buf.trim()) onLine(buf.trim());
+      resolve8({ code, out });
+    };
+    const timer = setTimeout(() => {
+      child?.kill();
+      if (onLine) onLine(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
+      done(124);
+    }, timeoutMs);
+    timer.unref?.();
+    const feed = (d) => {
+      const text = d.toString("utf8");
+      out += text;
+      if (!onLine) return;
+      buf += text;
+      let nl;
+      while ((nl = buf.indexOf("\n")) >= 0) {
+        const line = buf.slice(0, nl).replace(/\r$/, "");
+        buf = buf.slice(nl + 1);
+        onLine(line);
+      }
+    };
+    try {
+      child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+      child.stdout?.on("data", feed);
+      child.stderr?.on("data", feed);
+      child.on("exit", (code) => done(code ?? 0));
+      child.on("error", () => done(127));
+    } catch {
+      done(127);
+    }
+  });
+}
+async function detectOne(cmd, versionArg) {
+  const { code, out } = await run(cmd, [versionArg], void 0, 15e3);
+  if (code !== 0) return null;
+  const first = out.split("\n").map((l) => l.trim()).find(Boolean);
+  return first ?? "";
+}
+async function listExtras(autoUpdateSet = /* @__PURE__ */ new Set()) {
+  const { out } = await run("npm", ["ls", "-g", "--depth=0", "--json"], void 0, 2e4);
+  if (!out.trim()) return [];
+  let deps = {};
+  try {
+    deps = JSON.parse(out).dependencies ?? {};
+  } catch {
+    return [];
+  }
+  const catalogPkgs = new Set(WORKER_TOOL_BUNDLED_GLOBALS);
+  for (const t of WORKER_TOOL_CATALOG) {
+    catalogPkgs.add(t.id);
+    if (t.installPackage) catalogPkgs.add(t.installPackage);
+  }
+  return Object.entries(deps).filter(([name]) => !catalogPkgs.has(name)).map(([name, info]) => ({
+    id: name,
+    label: name,
+    category: "runtime",
+    installed: true,
+    version: info.version ?? null,
+    installable: true,
+    updatable: true,
+    autoUpdate: autoUpdateSet.has(name)
+  }));
+}
+async function detectWorkerTools(autoUpdateTools = []) {
+  const autoUpdateSet = new Set(autoUpdateTools);
+  const catalog = await Promise.all(
+    WORKER_TOOL_CATALOG.map(async (t) => {
+      const version = await detectOne(t.id, t.versionArg);
+      return {
+        id: t.id,
+        label: t.label,
+        category: t.category,
+        installed: version !== null,
+        version,
+        installable: t.installable,
+        updatable: t.updatable,
+        autoUpdate: autoUpdateSet.has(t.id)
+      };
+    })
+  );
+  const extras = await listExtras(autoUpdateSet).catch(() => []);
+  return { catalog, extras };
+}
+function opPast(op) {
+  return op === "install" ? "installed" : op === "uninstall" ? "uninstalled" : "updated";
+}
+function resolvePackage(name, op) {
+  const entry = WORKER_TOOL_CATALOG.find((t) => t.id === name);
+  if (entry) {
+    const allowed = op === "update" ? entry.updatable : entry.installable;
+    if (!allowed) {
+      return { error: `"${name}" is a prerequisite and cannot be ${opPast(op)} from here.` };
+    }
+    return { pkg: entry.installPackage ?? name };
+  }
+  if (WORKER_TOOL_PREREQUISITE_IDS.includes(name)) {
+    return { error: `"${name}" is a prerequisite and cannot be ${opPast(op)} from here.` };
+  }
+  if (WORKER_TOOL_BUNDLED_GLOBALS.includes(name)) {
+    return { error: `"${name}" ships with Node and cannot be ${opPast(op)} from here.` };
+  }
+  if (!NPM_NAME.test(name)) return { error: `Invalid package name: "${name}".` };
+  return { pkg: name };
+}
+function opArgs(op, manager, pkg) {
+  if (op === "uninstall") return manager === "pnpm" ? ["remove", "-g", pkg] : ["uninstall", "-g", pkg];
+  const target = op === "update" ? `${pkg}@latest` : pkg;
+  return manager === "pnpm" ? ["add", "-g", target] : ["install", "-g", target];
+}
+async function runWorkerToolOp(op, name, manager, onLine) {
+  const resolved = resolvePackage(name, op);
+  if (resolved.error || !resolved.pkg) {
+    return { ok: false, exitCode: 1, error: resolved.error ?? "Invalid package." };
+  }
+  onLine(`$ ${manager} ${opArgs(op, manager, resolved.pkg).join(" ")}`);
+  const { code } = await run(manager, opArgs(op, manager, resolved.pkg), onLine);
+  return { ok: code === 0, exitCode: code, error: code === 0 ? void 0 : `${manager} exited ${code}` };
+}
+function setToolAutoUpdate(profileDir2, name, enabled) {
+  const resolved = resolvePackage(name, "update");
+  if (resolved.error) return { ok: false, error: resolved.error };
+  const current = readProfileConfig(profileDir2).autoUpdateTools ?? [];
+  const set = new Set(current);
+  if (enabled) set.add(name);
+  else set.delete(name);
+  writeProfileConfig(profileDir2, { autoUpdateTools: [...set] });
+  return { ok: true };
+}
+async function autoUpdateFlaggedTools(tools, onLine) {
+  for (const name of tools) {
+    const res = await runWorkerToolOp("update", name, "npm", onLine).catch(
+      (err) => ({ ok: false, exitCode: 1, error: String(err) })
+    );
+    onLine(res.ok ? `\u2713 ${name} updated` : `\u2717 ${name}: ${res.error ?? "failed"}`);
+  }
+}
+async function installPinned(name, version, manager, onLine) {
+  const resolved = resolvePackage(name, "update");
+  if (resolved.error || !resolved.pkg) return { ok: false, error: resolved.error ?? "Invalid package." };
+  const target = `${resolved.pkg}@${version}`;
+  const args = manager === "pnpm" ? ["add", "-g", target] : ["install", "-g", target];
+  onLine(`$ ${manager} ${args.join(" ")}`);
+  const { code } = await run(manager, args, onLine);
+  return { ok: code === 0, error: code === 0 ? void 0 : `${manager} exited ${code}` };
+}
+async function reconcileTools(manifest, onLine) {
+  if (manifest.length === 0) return;
+  const { catalog, extras } = await detectWorkerTools();
+  const versionByName = new Map(
+    [...catalog, ...extras].filter((r) => r.installed && r.version).map((r) => [r.id, r.version])
+  );
+  for (const entry of manifest) {
+    const current = versionByName.get(entry.name);
+    if (current && current.includes(entry.version)) continue;
+    onLine(`Restoring ${entry.name}@${entry.version}\u2026`);
+    const res = await installPinned(entry.name, entry.version, entry.manager, onLine).catch(
+      (err) => ({ ok: false, error: String(err) })
+    );
+    onLine(res.ok ? `\u2713 ${entry.name}@${entry.version}` : `\u2717 ${entry.name}: ${res.error ?? "failed"}`);
+  }
+}
+
 // src/core/update-scheduler.ts
 var TICK_MS = 6e4;
 var UpdateScheduler = class {
-  constructor(serverUrl, profileDir2, bus) {
+  constructor(serverUrl, profileDir2, bus, onToolsChanged) {
     this.serverUrl = serverUrl;
     this.profileDir = profileDir2;
     this.bus = bus;
+    this.onToolsChanged = onToolsChanged;
   }
   serverUrl;
   profileDir;
   bus;
+  onToolsChanged;
   policy = null;
   timer = null;
   /** Date key (YYYY-MM-DD in org tz) whose update already ran — enforces once per day. */
@@ -34024,6 +34232,7 @@ var UpdateScheduler = class {
   async runUpdate() {
     this.updating = true;
     try {
+      await this.updateFlaggedTools();
       this.bus.log("Scheduled auto-update: checking for a new version\u2026");
       const result = await updateToLatest(this.serverUrl);
       if (result.action === "already-latest") {
@@ -34037,7 +34246,7 @@ var UpdateScheduler = class {
       }
       logger.info("update.scheduled.updated", { version: result.version });
       this.bus.log(`Updated to ${result.version} \u2014 restarting to apply\u2026`);
-      const child = spawn(process.execPath, process.argv.slice(1), {
+      const child = spawn2(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         env: { ...process.env, FOURPM_NO_UPDATE: "1" }
       });
@@ -34048,16 +34257,26 @@ var UpdateScheduler = class {
       this.updating = false;
     }
   }
+  /** Update each tool flagged for auto-update in config.json to @latest (ADR-0253) — best-effort. */
+  async updateFlaggedTools() {
+    const tools = readProfileConfig(this.profileDir).autoUpdateTools ?? [];
+    if (tools.length === 0) return;
+    this.bus.log(`Scheduled tool auto-update: ${tools.join(", ")}\u2026`);
+    await autoUpdateFlaggedTools(tools, (line) => logger.info("update.tool.line", { line })).catch(
+      (err) => logger.warn("update.tool.error", { error: String(err) })
+    );
+    this.onToolsChanged?.();
+  }
 };
 
 // src/core/executor.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 var KILL_GRACE_MS = 5e3;
 async function runCommand(dispatch, emit, opts) {
   let seq = 0;
   let child;
   try {
-    child = spawn2(dispatch.cmd, dispatch.args ?? [], {
+    child = spawn3(dispatch.cmd, dispatch.args ?? [], {
       cwd: dispatch.path,
       env: { ...process.env, ...dispatch.env },
       shell: false
@@ -34651,7 +34870,7 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot) {
 }
 
 // src/core/claude-usage.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { readFileSync as readFileSync9 } from "fs";
 import { join as join9 } from "path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
@@ -34698,7 +34917,7 @@ function runUsageCli(dir2, aiCli2) {
     }, 3e4);
     timer.unref?.();
     try {
-      child = spawn3(aiCli2, ["/usage"], {
+      child = spawn4(aiCli2, ["/usage"], {
         env: { ...process.env, CLAUDE_CONFIG_DIR: dir2 },
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -34768,7 +34987,7 @@ async function checkClaudeUsage(dirs, aiCli2 = "claude") {
 // src/core/ai-assist.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-var run = promisify(execFile);
+var run2 = promisify(execFile);
 function aiCli() {
   return process.env.AI_CLI || "claude";
 }
@@ -34811,7 +35030,7 @@ function parseAi(cli, stdout, prompt) {
 }
 async function runAi(prompt) {
   const cli = aiCli();
-  const { stdout } = await run(cli, aiArgs(cli, prompt), {
+  const { stdout } = await run2(cli, aiArgs(cli, prompt), {
     timeout: 12e4,
     maxBuffer: 8 * 1024 * 1024
   });
@@ -35154,7 +35373,7 @@ async function writeWorkerFile(root, relPath, content) {
 }
 
 // src/core/support-answer.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { execFile as execFile2 } from "child_process";
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
@@ -35289,7 +35508,7 @@ function runClaudeOnce(cmd, profile, prompt, extraEnv) {
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
-    const child = spawn4(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3 });
+    const child = spawn5(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3 });
     const parser = createAiStreamParser(cmd);
     let out = "";
     let err = "";
@@ -35359,7 +35578,7 @@ async function runSupportAnswer(req, ai, profileDir2) {
 }
 
 // src/core/knowledge-compose.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 var COMPOSE_TIMEOUT_MS = 18e4;
 function buildPrompt2(req) {
   const focus = req.prompt ? `
@@ -35385,7 +35604,7 @@ function runOnce(cmd, profile, prompt, cwd2, extraEnv) {
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
-    const child = spawn5(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
+    const child = spawn6(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
     let out = "";
     let err = "";
     const timer = setTimeout(() => {
@@ -35433,10 +35652,10 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
 // src/core/autonomous.ts
 import { readFile as readFile3, writeFile as writeFile2, chmod } from "fs/promises";
 import { readFileSync as readFileSync13 } from "fs";
-import { execFile as execFile3, spawn as spawn6 } from "child_process";
+import { execFile as execFile3, spawn as spawn7 } from "child_process";
 import { join as join13 } from "path";
 import { promisify as promisify3 } from "util";
-var run2 = promisify3(execFile3);
+var run3 = promisify3(execFile3);
 var SETTINGS_REL = ".claude/.autonomous.settings.json";
 var HISTORIES_REL = ".claude/.autonomous.histories.json";
 var APPROVALS_REL = ".claude/.autonomous.approvals.json";
@@ -35470,7 +35689,7 @@ function tickScript(root) {
 }
 async function crontabList() {
   try {
-    const { stdout } = await run2("crontab", ["-l"], { timeout: 1e4 });
+    const { stdout } = await run3("crontab", ["-l"], { timeout: 1e4 });
     return stdout;
   } catch {
     return "";
@@ -35478,7 +35697,7 @@ async function crontabList() {
 }
 async function crontabSet(content) {
   return new Promise((resolve8) => {
-    const child = spawn6("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
+    const child = spawn7("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
     child.on("error", () => resolve8(false));
     child.on("close", (code) => resolve8(code === 0));
     child.stdin.end(content.endsWith("\n") ? content : content + "\n");
@@ -36209,15 +36428,15 @@ async function buildGraph(root, mode) {
 // src/core/rag.ts
 import { readFile as readFile9, writeFile as writeFile7, statfs as statfs2, mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync10 } from "fs";
-import { execFile as execFile4, spawn as spawn7 } from "child_process";
+import { execFile as execFile4, spawn as spawn8 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
 import { join as join20 } from "path";
 import { promisify as promisify4 } from "util";
-var run3 = promisify4(execFile4);
+var run4 = promisify4(execFile4);
 var RAG_REL = ".claude/rag";
 async function tryRun(cmd, args) {
   try {
-    const { stdout } = await run3(cmd, args, { timeout: 8e3 });
+    const { stdout } = await run4(cmd, args, { timeout: 8e3 });
     return { ok: true, out: stdout.trim() };
   } catch {
     return { ok: false, out: "" };
@@ -36396,7 +36615,7 @@ touch "${RAG_REL}/.indexing"
 { echo "[reindex] $(date)"; "$RAG_PY" "${RAG_REL}/rag_engine.py" reindex 2>&1; } >> "${RAG_REL}/index.log" 2>&1
 rm -f "${RAG_REL}/.indexing"
 `;
-  const child = spawn7("bash", ["-c", script], {
+  const child = spawn8("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin },
     detached: true,
@@ -36411,7 +36630,7 @@ async function ragQuery(root, queryText, k = 8) {
   if (!existsSync10(join20(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
-    const { stdout } = await run3(
+    const { stdout } = await run4(
       py.bin,
       [join20(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
@@ -36446,7 +36665,7 @@ rm -f "${RAG_REL}/.installed"
 } >> "${RAG_REL}/install.log" 2>&1
 rm -f "${RAG_REL}/.installing"
 `;
-  const child = spawn7("bash", ["-c", script], {
+  const child = spawn8("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin, RAG_MODEL: model },
     detached: true,
@@ -36461,7 +36680,7 @@ import { readFile as readFile10 } from "fs/promises";
 import { execFile as execFile5 } from "child_process";
 import { basename as basename3, dirname as dirname7, resolve as resolve5 } from "path";
 import { promisify as promisify5 } from "util";
-var run4 = promisify5(execFile5);
+var run5 = promisify5(execFile5);
 async function gitDiff(path) {
   const target = resolve5(path);
   const dir2 = dirname7(target);
@@ -36473,7 +36692,7 @@ async function gitDiff(path) {
   }
   let oldContent = "";
   try {
-    const { stdout } = await run4("git", ["show", `HEAD:./${base}`], {
+    const { stdout } = await run5("git", ["show", `HEAD:./${base}`], {
       cwd: dir2,
       timeout: 15e3,
       maxBuffer: 4 * 1024 * 1024
@@ -36487,10 +36706,10 @@ async function gitDiff(path) {
 // src/core/git-env.ts
 import { execFile as execFile6 } from "child_process";
 import { promisify as promisify6 } from "util";
-var run5 = promisify6(execFile6);
+var run6 = promisify6(execFile6);
 async function hasBinary(bin, args = ["--version"]) {
   try {
-    await run5(bin, args, { timeout: 5e3 });
+    await run6(bin, args, { timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -36503,7 +36722,7 @@ async function checkGitEnv(provider) {
   let account = null;
   if (installed) {
     try {
-      const { stdout, stderr } = await run5(bin, ["auth", "status"], { timeout: 8e3 });
+      const { stdout, stderr } = await run6(bin, ["auth", "status"], { timeout: 8e3 });
       const out = `${stdout}
 ${stderr}`;
       authenticated = /logged in|logged into|✓/i.test(out);
@@ -36520,7 +36739,7 @@ import { execFile as execFile7 } from "child_process";
 import { readFile as readFile11, rm as rm3, mkdir as mkdir7 } from "fs/promises";
 import { join as join21 } from "path";
 import { promisify as promisify7 } from "util";
-var run6 = promisify7(execFile7);
+var run7 = promisify7(execFile7);
 function keyPaths(profileDir2) {
   const dir2 = join21(profileDir2, ".ssh");
   const key = join21(dir2, "id_4pm");
@@ -36535,14 +36754,14 @@ async function readPublicKey(pub) {
 }
 async function fingerprintOf(pub) {
   try {
-    const { stdout } = await run6("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
+    const { stdout } = await run7("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
     return stdout.match(/SHA256:[A-Za-z0-9+/=]+/)?.[0] ?? null;
   } catch {
     return null;
   }
 }
 async function configureGit(key) {
-  await run6(
+  await run7(
     "git",
     ["config", "--global", "core.sshCommand", `ssh -i ${key} -o IdentitiesOnly=yes`],
     { timeout: 5e3 }
@@ -36553,7 +36772,7 @@ async function generate(profileDir2) {
   await mkdir7(dir2, { recursive: true });
   await rm3(key, { force: true });
   await rm3(pub, { force: true });
-  await run6("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
+  await run7("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
     timeout: 15e3
   });
   await configureGit(key);
@@ -36563,7 +36782,7 @@ async function remove(profileDir2) {
   const { key, pub } = keyPaths(profileDir2);
   await rm3(key, { force: true });
   await rm3(pub, { force: true });
-  await run6("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
+  await run7("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
     () => void 0
   );
   return { publicKey: null, fingerprint: null };
@@ -36588,7 +36807,7 @@ import { readdir as readdir6 } from "fs/promises";
 import { execFile as execFile8 } from "child_process";
 import { resolve as resolve6, sep as sep4 } from "path";
 import { promisify as promisify8 } from "util";
-var run7 = promisify8(execFile8);
+var run8 = promisify8(execFile8);
 var FS = "";
 var RS = "";
 function resolveRepo(root, repo) {
@@ -36599,7 +36818,7 @@ function resolveRepo(root, repo) {
 }
 async function git(cwd2, args) {
   try {
-    const { stdout } = await run7("git", args, {
+    const { stdout } = await run8("git", args, {
       cwd: cwd2,
       timeout: 15e3,
       maxBuffer: 8 * 1024 * 1024
@@ -36703,11 +36922,11 @@ async function gitCommitDiff(root, repo, hash, path) {
 // src/core/git-commit-identity.ts
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify9 } from "util";
-var run8 = promisify9(execFile9);
+var run9 = promisify9(execFile9);
 async function setCommitAuthor(cwd2, machineUsername) {
   if (!machineUsername) return;
   try {
-    await run8("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
+    await run9("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
   } catch {
   }
 }
@@ -36718,7 +36937,7 @@ import { execFile as execFile10 } from "child_process";
 import { dirname as dirname8, join as join22, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify as promisify10 } from "util";
-var run9 = promisify10(execFile10);
+var run10 = promisify10(execFile10);
 function reposOf(spec) {
   const repos = spec?.repos;
   return Array.isArray(repos) ? repos : [];
@@ -36732,13 +36951,13 @@ async function provisionRepos(target, repos, emit, opts = {}) {
     if (repo.primary) {
       if (opts.clonePrimary && repo.url) {
         emit("git", `Cloning ${repo.url}\u2026`);
-        await run9("git", ["clone", repo.url, target], { timeout: 12e4 });
+        await run10("git", ["clone", repo.url, target], { timeout: 12e4 });
         continue;
       }
       emit("git", "Initializing the primary repo\u2026");
-      await run9("git", ["init"], { cwd: target, timeout: 2e4 });
+      await run10("git", ["init"], { cwd: target, timeout: 2e4 });
       if (repo.url) {
-        await run9("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
+        await run10("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
           () => void 0
         );
       }
@@ -36747,11 +36966,11 @@ async function provisionRepos(target, repos, emit, opts = {}) {
     const dir2 = join22(target, subDirName(repo));
     if (repo.url) {
       emit("git", `Cloning sub-repo ${repo.url}\u2026`);
-      await run9("git", ["clone", repo.url, dir2], { timeout: 12e4 });
+      await run10("git", ["clone", repo.url, dir2], { timeout: 12e4 });
     } else {
       emit("git", `Initializing sub-repo ${subDirName(repo)}\u2026`);
       await mkdir8(dir2, { recursive: true });
-      await run9("git", ["init"], { cwd: dir2, timeout: 2e4 });
+      await run10("git", ["init"], { cwd: dir2, timeout: 2e4 });
     }
   }
 }
@@ -37229,7 +37448,7 @@ function runSlashCommand(line, base) {
 }
 
 // src/core/memory-compact.ts
-import { spawn as spawn8 } from "child_process";
+import { spawn as spawn9 } from "child_process";
 var COMPACT_TIMEOUT_MS = 6e4;
 function buildPrompt3(input) {
   return [
@@ -37257,7 +37476,7 @@ function runOnce2(cmd, profile, prompt, cwd2, extraEnv) {
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
-    const child = spawn8(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
+    const child = spawn9(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
     let out = "";
     let err = "";
     const timer = setTimeout(() => {
@@ -37345,125 +37564,6 @@ function applyConfigText(profileDir2, text) {
   return { ok: true };
 }
 
-// src/core/worker-tools.ts
-import { spawn as spawn9 } from "child_process";
-var NPM_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
-function run10(cmd, args, onLine, timeoutMs = 18e4) {
-  return new Promise((resolve8) => {
-    let out = "";
-    let buf = "";
-    let child = null;
-    const done = (code) => {
-      clearTimeout(timer);
-      if (onLine && buf.trim()) onLine(buf.trim());
-      resolve8({ code, out });
-    };
-    const timer = setTimeout(() => {
-      child?.kill();
-      if (onLine) onLine(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
-      done(124);
-    }, timeoutMs);
-    timer.unref?.();
-    const feed = (d) => {
-      const text = d.toString("utf8");
-      out += text;
-      if (!onLine) return;
-      buf += text;
-      let nl;
-      while ((nl = buf.indexOf("\n")) >= 0) {
-        const line = buf.slice(0, nl).replace(/\r$/, "");
-        buf = buf.slice(nl + 1);
-        onLine(line);
-      }
-    };
-    try {
-      child = spawn9(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
-      child.stdout?.on("data", feed);
-      child.stderr?.on("data", feed);
-      child.on("exit", (code) => done(code ?? 0));
-      child.on("error", () => done(127));
-    } catch {
-      done(127);
-    }
-  });
-}
-async function detectOne(cmd, versionArg) {
-  const { code, out } = await run10(cmd, [versionArg], void 0, 15e3);
-  if (code !== 0) return null;
-  const first = out.split("\n").map((l) => l.trim()).find(Boolean);
-  return first ?? "";
-}
-async function listExtras() {
-  const { out } = await run10("npm", ["ls", "-g", "--depth=0", "--json"], void 0, 2e4);
-  if (!out.trim()) return [];
-  let deps = {};
-  try {
-    deps = JSON.parse(out).dependencies ?? {};
-  } catch {
-    return [];
-  }
-  const catalogPkgs = new Set(WORKER_TOOL_BUNDLED_GLOBALS);
-  for (const t of WORKER_TOOL_CATALOG) {
-    catalogPkgs.add(t.id);
-    if (t.installPackage) catalogPkgs.add(t.installPackage);
-  }
-  return Object.entries(deps).filter(([name]) => !catalogPkgs.has(name)).map(([name, info]) => ({
-    id: name,
-    label: name,
-    category: "runtime",
-    installed: true,
-    version: info.version ?? null,
-    installable: true
-  }));
-}
-async function detectWorkerTools() {
-  const catalog = await Promise.all(
-    WORKER_TOOL_CATALOG.map(async (t) => {
-      const version = await detectOne(t.id, t.versionArg);
-      return {
-        id: t.id,
-        label: t.label,
-        category: t.category,
-        installed: version !== null,
-        version,
-        installable: t.installable
-      };
-    })
-  );
-  const extras = await listExtras().catch(() => []);
-  return { catalog, extras };
-}
-function resolvePackage(name, op) {
-  const entry = WORKER_TOOL_CATALOG.find((t) => t.id === name);
-  if (entry) {
-    if (!entry.installable) {
-      return { error: `"${name}" is a prerequisite and cannot be ${op}ed from here.` };
-    }
-    return { pkg: entry.installPackage ?? name };
-  }
-  if (WORKER_TOOL_PREREQUISITE_IDS.includes(name)) {
-    return { error: `"${name}" is a prerequisite and cannot be ${op}ed from here.` };
-  }
-  if (WORKER_TOOL_BUNDLED_GLOBALS.includes(name)) {
-    return { error: `"${name}" ships with Node and cannot be ${op}ed from here.` };
-  }
-  if (!NPM_NAME.test(name)) return { error: `Invalid package name: "${name}".` };
-  return { pkg: name };
-}
-function opArgs(op, manager, pkg) {
-  if (manager === "pnpm") return [op === "install" ? "add" : "remove", "-g", pkg];
-  return [op === "install" ? "install" : "uninstall", "-g", pkg];
-}
-async function runWorkerToolOp(op, name, manager, onLine) {
-  const resolved = resolvePackage(name, op);
-  if (resolved.error || !resolved.pkg) {
-    return { ok: false, exitCode: 1, error: resolved.error ?? "Invalid package." };
-  }
-  onLine(`$ ${manager} ${opArgs(op, manager, resolved.pkg).join(" ")}`);
-  const { code } = await run10(manager, opArgs(op, manager, resolved.pkg), onLine);
-  return { ok: code === 0, exitCode: code, error: code === 0 ? void 0 : `${manager} exited ${code}` };
-}
-
 // src/core/ws-client.ts
 var MEMORY_SEED_HEADER = "CONTEXT MEMORY from earlier in this conversation (may span prior sessions/accounts). Use it as background; do not repeat it back unless relevant:";
 var HEARTBEAT_MS = 3e4;
@@ -37505,7 +37605,9 @@ var WsClient = class {
     this.updateScheduler = new UpdateScheduler(
       context.credential.serverUrl,
       context.profileDir,
-      context.bus
+      context.bus,
+      // After the idle daily tick updates flagged tools, report the fresh snapshot (ADR-0254).
+      () => void this.reportWorkerTools()
     );
     context.bus.onLocalSubmit((input) => void this.runLocalCommand(input));
     context.bus.onReconnect(() => this.reconnectNow());
@@ -37622,6 +37724,20 @@ var WsClient = class {
   get isStopped() {
     return this.stopped;
   }
+  /**
+   * Detect the worker's tools and report the snapshot to the server (ADR-0254, `tools.report`) so the
+   * DB-backed Tools panel + restore target stay current. One-way, best-effort — a detect/send failure
+   * never disrupts the session. Called after each tool op, after the daily tick, and after a restore.
+   */
+  async reportWorkerTools() {
+    try {
+      const autoUpdate = readProfileConfig(this.context.profileDir).autoUpdateTools ?? [];
+      const { catalog, extras } = await detectWorkerTools(autoUpdate);
+      this.send(WsChannels.TOOLS_REPORT, { catalog, extras });
+    } catch (err) {
+      logger.warn("tools.report.error", { error: String(err) });
+    }
+  }
   /**
    * Force an immediate reconnect: wake the backoff sleep if waiting, else drop the live
    * socket so the run() loop reconnects (the next backoff is skipped). No-op if stopped.
@@ -37772,7 +37888,10 @@ var WsClient = class {
           projectAutoClearIdleMinutes: token.projectTokens?.autoClearIdleMinutes ?? 0,
           // Project shared-AI-memory override mirrors (ADR-0245).
           projectAiMemoryMode: token.aiMemory?.mode ?? "inherit",
-          projectAiMemoryBudgetChars: token.aiMemory?.budgetChars ?? 0
+          projectAiMemoryBudgetChars: token.aiMemory?.budgetChars ?? 0,
+          // Per-tool auto-update flags (ADR-0253) are now DB-owned (ADR-0254) — mirror the server's
+          // list locally so the idle daily tick (UpdateScheduler) can read it without a round-trip.
+          autoUpdateTools: token.toolRestore?.autoUpdate ?? []
         });
         if (token.aiMemory && !this.aiMemory) this.aiMemory = token.aiMemory.text;
         this.outboundReviewEnabled = token.outboundReview?.enabled === true;
@@ -38250,27 +38369,49 @@ var WsClient = class {
         break;
       }
       case WsChannels.TOOLS_LIST:
-        void detectWorkerTools().then(
+        void detectWorkerTools(readProfileConfig(this.context.profileDir).autoUpdateTools ?? []).then(
           (reply) => this.send(WsChannels.TOOLS_LIST, reply, message.id)
         );
         break;
+      case WsChannels.TOOLS_AUTOUPDATE: {
+        const req = payload;
+        const res = setToolAutoUpdate(this.context.profileDir, req.name, req.enabled);
+        this.send(WsChannels.TOOLS_AUTOUPDATE, res, message.id);
+        break;
+      }
       case WsChannels.TOOLS_INSTALL:
-      case WsChannels.TOOLS_UNINSTALL: {
+      case WsChannels.TOOLS_UNINSTALL:
+      case WsChannels.TOOLS_UPDATE: {
         const req = payload;
-        const op = message.channel === WsChannels.TOOLS_INSTALL ? "install" : "uninstall";
+        const op = message.channel === WsChannels.TOOLS_INSTALL ? "install" : message.channel === WsChannels.TOOLS_UPDATE ? "update" : "uninstall";
         this.send(message.channel, { started: true }, message.id);
         void runWorkerToolOp(
           op,
           req.name,
           req.manager,
           (line) => this.send(WsChannels.TOOLS_PROGRESS, { opId: req.opId, line })
-        ).then(
-          (res) => this.send(WsChannels.TOOLS_DONE, {
+        ).then((res) => {
+          this.send(WsChannels.TOOLS_DONE, {
             opId: req.opId,
             ok: res.ok,
             exitCode: res.exitCode,
             error: res.error
-          })
+          });
+          void this.reportWorkerTools();
+        });
+        break;
+      }
+      case WsChannels.TOOLS_RESTORE: {
+        const req = payload;
+        void reconcileTools(
+          req.manifest.map((m) => ({ name: m.name, version: m.version, manager: m.manager })),
+          (line) => this.bus.log(line)
+        ).then(() => this.reportWorkerTools()).then(() => this.send(WsChannels.TOOLS_RESTORE, { ok: true }, message.id)).catch(
+          (err) => this.send(
+            WsChannels.TOOLS_RESTORE,
+            { ok: false, error: String(err) },
+            message.id
+          )
         );
         break;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.5.2",
+  "version": "1.5.11b",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",