@kilogent/runner-dev 0.1.4 → 0.1.5

package/dist/cli.js

@@ -4,9 +4,9 @@
 import { Command } from "commander";
 
 // src/daemon.ts
-import fs9 from "node:fs";
+import fs14 from "node:fs";
 import os5 from "node:os";
-import path11 from "node:path";
+import path15 from "node:path";
 import {
   collection as collection8,
   deleteField as deleteField2,
@@ -242,7 +242,18 @@ var ASSISTANT_FROZEN_ARGS = Object.freeze({
 // ../shared/dist/assistantConfig.js
 var CONFIG_DOCS = {
   /** `crewConfig/assistant` — the workspace assistant's prompt, model, budget and prices. */
-  assistant: "assistant"
+  assistant: "assistant",
+  /**
+   * `crewConfig/engines` — which version of each engine's CLI the fleet believes works, and which
+   * versions a runner proved broken (PRD §15.82).
+   *
+   * Read by every RUNNER with the client SDK, written by nobody but the Admin SDK, exactly like
+   * the assistant contract beside it. The shipped defaults live in the runner
+   * (`engines/install/spec.ts`) rather than here on purpose: the runner is the only thing that
+   * installs, and keeping them out of a package the app also reads keeps a surface a captain can
+   * edit from ever naming a version.
+   */
+  engines: "engines"
 };
 var DEFAULT_ASSISTANT_MODEL = "gemini-3.1-flash-lite";
 var DEFAULT_DAILY_CAP_USD = 0.1;
@@ -377,10 +388,10 @@ function rates(value) {
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
-function resolveAssistantConfig(raw, engine) {
+function resolveAssistantConfig(raw, engine2) {
   const doc13 = raw ?? {};
   const shared = text(doc13.contract) ?? DEFAULT_ASSISTANT_CONTRACT;
-  const perEngine = engine === "free" ? text(doc13.freeContract) ?? DEFAULT_FREE_CONTRACT : text(doc13.agenticContract) ?? DEFAULT_AGENTIC_CONTRACT;
+  const perEngine = engine2 === "free" ? text(doc13.freeContract) ?? DEFAULT_FREE_CONTRACT : text(doc13.agenticContract) ?? DEFAULT_AGENTIC_CONTRACT;
   return {
     contract: `${shared}
 
@@ -806,11 +817,11 @@ function machineLoginPending(c, now) {
   return now - c.login.requestedAt < MACHINE_LOGIN_TTL_MS ? "start" : "expire";
 }
 function resolveAgentCredential(agent, credentials, defaultEngine) {
-  const engine = agent.engine ?? defaultEngine;
+  const engine2 = agent.engine ?? defaultEngine;
   if (agent.credentialId) {
     return credentials.find((c) => c.id === agent.credentialId) ?? null;
   }
-  const forEngine = credentials.filter((c) => c.engine === engine && isCredentialReady(c));
+  const forEngine = credentials.filter((c) => c.engine === engine2 && isCredentialReady(c));
   const oldest = [...forEngine].sort((a, b) => a.createdAt - b.createdAt)[0];
   return oldest ?? void 0;
 }
@@ -887,9 +898,9 @@ function str(input, key) {
   const value = input[key];
   return typeof value === "string" && value.trim() ? value : void 0;
 }
-function basename(path13) {
-  const parts = path13.split(/[\\/]/).filter(Boolean);
-  return parts[parts.length - 1] ?? path13;
+function basename(path17) {
+  const parts = path17.split(/[\\/]/).filter(Boolean);
+  return parts[parts.length - 1] ?? path17;
 }
 function hostOf(url) {
   try {
@@ -977,8 +988,8 @@ function builtinDetail(tool, input) {
     case "Write":
     case "Edit":
     case "MultiEdit": {
-      const path13 = str(input, "file_path");
-      return path13 ? basename(path13) : void 0;
+      const path17 = str(input, "file_path");
+      return path17 ? basename(path17) : void 0;
     }
     case "Glob":
     case "Grep":
@@ -1246,7 +1257,7 @@ import os from "node:os";
 import path from "node:path";
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.1.5" : "0.0.0-dev";
 var RUNNER_PACKAGE = true ? "@kilogent/runner-dev" : "@kilogent/runner-dev";
 var RUNNER_BIN = true ? "kilogent-runner-dev" : "kilogent-runner-dev";
 
@@ -1358,11 +1369,15 @@ function allowsLocalMcp(config2, shipId) {
 var TOGGLE_DEFAULTS = {
   notifications: false,
   keepAwake: true,
-  autoUpdate: true
+  autoUpdate: true,
+  autoInstallEngines: true
 };
 function notificationsEnabled(config2) {
   return config2?.notifications ?? TOGGLE_DEFAULTS.notifications;
 }
+function engineInstallAllowed(config2) {
+  return config2?.autoInstallEngines ?? TOGGLE_DEFAULTS.autoInstallEngines;
+}
 function mcpUrl(config2) {
   return process.env.CREW_MCP_URL || config2.mcpUrl || (config2.projectId === DEFAULT_PROJECT_ID ? DEFAULT_MCP_URL : `https://us-central1-${config2.projectId}.cloudfunctions.net/workspaceMcp`);
 }
@@ -2480,12 +2495,12 @@ async function resolveAssistantCredential(db, shipId, machine) {
   const credentialId = settings?.assistant?.credentialId ?? settings?.defaultCredentialId;
   const credentials = await loadShipCredentials(db, shipId).catch(() => []);
   const credential = credentialId ? credentials.find((c) => c.id === credentialId) : void 0;
-  const engine = credential?.engine ?? DEFAULT_ENGINE_ID;
+  const engine2 = credential?.engine ?? DEFAULT_ENGINE_ID;
   const secrets = await resolveJobSecrets({
     db,
     shipId,
     // The synthetic agent: two fields, both of which this module has just decided.
-    agent: { engine, credentialId },
+    agent: { engine: engine2, credentialId },
     credentials,
     machine
   });
@@ -2494,22 +2509,220 @@ async function resolveAssistantCredential(db, shipId, machine) {
     // A MODEL, ALWAYS. `engines/claude.ts` puts this straight onto `--model`, and an empty string
     // is an empty flag — a failure that reads as the model misbehaving rather than as a missing
     // value. The engine's own default is the right answer when nothing has been chosen.
-    model: getEngine(engine)?.defaultModelId ?? ""
+    model: getEngine(engine2)?.defaultModelId ?? ""
   };
 }
 
 // src/engines/claude.ts
 import { spawn as spawn3 } from "node:child_process";
-import fs3 from "node:fs";
+import fs5 from "node:fs";
 import os2 from "node:os";
+import path6 from "node:path";
+
+// src/engines/binary.ts
+import fs4 from "node:fs";
+
+// src/engines/install/spec.ts
 import path3 from "node:path";
+var ENGINE_PACKAGES = {
+  codex: { npmPackage: "@openai/codex", binName: "codex" },
+  claude: { npmPackage: "@anthropic-ai/claude-code", binName: "claude" }
+};
+function enginePackageFor(engineId) {
+  return Object.prototype.hasOwnProperty.call(ENGINE_PACKAGES, engineId) ? ENGINE_PACKAGES[engineId] : null;
+}
+function installableEngineIds() {
+  return Object.keys(ENGINE_PACKAGES);
+}
+var EXACT_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[A-Za-z0-9.-]+)?$/;
+function isExactVersion(version) {
+  return typeof version === "string" && version.length <= 64 && EXACT_VERSION.test(version);
+}
+var SEGMENT = /^[A-Za-z0-9_-]+$/;
+function assertPathSegment(segment) {
+  if (!SEGMENT.test(segment)) throw new Error(`not a valid path segment: ${JSON.stringify(segment)}`);
+}
+function enginePrefixDir(root, engineId) {
+  assertPathSegment(engineId);
+  return path3.join(root, "tools", engineId);
+}
+function engineBinPath(root, engineId, binName, platform = process.platform) {
+  assertPathSegment(engineId);
+  assertPathSegment(binName);
+  const prefix = enginePrefixDir(root, engineId);
+  return platform === "win32" ? path3.join(prefix, binName) : path3.join(prefix, "bin", binName);
+}
+function engineMarkerPath(root, engineId) {
+  return path3.join(enginePrefixDir(root, engineId), "installed.json");
+}
+var DEFAULT_ENGINE_POLICIES = {
+  codex: { knownGood: "0.152.0", blocked: [], minAgeHours: 24 },
+  claude: { knownGood: "2.1.258", blocked: [], minAgeHours: 24 }
+};
+var MAX_BLOCKED_VERSIONS = 20;
+var ENGINE_FIRST_CHECK_MS = 6e4;
+var ENGINE_CHECK_MS = 6 * 36e5;
+function resolveEnginePolicy(engineId, doc13) {
+  const shipped = DEFAULT_ENGINE_POLICIES[engineId] ?? { knownGood: "", blocked: [], minAgeHours: 24 };
+  const raw = doc13?.[engineId];
+  if (!raw || typeof raw !== "object") return shipped;
+  const entry = raw;
+  const blocked = Array.isArray(entry.blocked) ? entry.blocked.filter(isExactVersion) : shipped.blocked;
+  const age = typeof entry.minAgeHours === "number" && Number.isFinite(entry.minAgeHours) && entry.minAgeHours >= 0 ? Math.min(entry.minAgeHours, 24 * 30) : shipped.minAgeHours;
+  return {
+    knownGood: isExactVersion(entry.knownGood) ? entry.knownGood : shipped.knownGood,
+    blocked: blocked.slice(-MAX_BLOCKED_VERSIONS),
+    minAgeHours: age
+  };
+}
+function chooseEngineVersion(input) {
+  const { policy, latest, installed, firstSeen, now } = input;
+  const blocked = new Set(policy.blocked);
+  if (installed && blocked.has(installed)) {
+    return isExactVersion(policy.knownGood) && !blocked.has(policy.knownGood) ? { version: policy.knownGood, reason: "known-good" } : { version: null, reason: "no-policy" };
+  }
+  if (!installed) {
+    if (!isExactVersion(policy.knownGood) || blocked.has(policy.knownGood)) {
+      return { version: null, reason: "no-policy" };
+    }
+    return { version: policy.knownGood, reason: "known-good" };
+  }
+  if (!latest || !isExactVersion(latest)) return { version: null, reason: "no-registry" };
+  if (latest === installed) return { version: null, reason: "up-to-date" };
+  if (blocked.has(latest)) return { version: null, reason: "blocked-latest" };
+  if (!firstSeen || firstSeen.version !== latest) return { version: null, reason: "soaking" };
+  if (now - firstSeen.at < policy.minAgeHours * 36e5) return { version: null, reason: "soaking" };
+  return { version: latest, reason: "upgrade" };
+}
+var MAX_ENGINE_INSTALL_ATTEMPTS = 3;
+var ENGINE_BACKOFF_MS = [15 * 6e4, 2 * 36e5, 12 * 36e5];
+function decideEngineInstall(facts) {
+  if (!enginePackageFor(facts.engineId)) return { install: false, reason: "unknown-engine" };
+  if (!facts.autoInstall) return { install: false, reason: "disabled" };
+  if (facts.platform === "win32") return { install: false, reason: "windows" };
+  if (!isExactVersion(facts.target)) return { install: false, reason: "unknown-engine" };
+  const pkg = enginePackageFor(facts.engineId);
+  if (facts.marker && facts.marker.npmPackage === pkg.npmPackage && facts.marker.version === facts.target) {
+    return { install: false, reason: "already-installed" };
+  }
+  if (!facts.npmPresent()) return { install: false, reason: "no-npm" };
+  if (facts.locked) return { install: false, reason: "locked" };
+  const record = facts.record;
+  if (record && record.target === facts.target && record.outcome === "failed") {
+    if (record.attempts >= MAX_ENGINE_INSTALL_ATTEMPTS) return { install: false, reason: "exhausted" };
+    const wait = ENGINE_BACKOFF_MS[Math.min(record.attempts - 1, ENGINE_BACKOFF_MS.length - 1)] ?? 0;
+    if (facts.now - record.at < wait) return { install: false, reason: "backoff" };
+  }
+  return { install: true, target: facts.target };
+}
+function describeEngineInstallRefusal(reason, engineId, runnerBin) {
+  switch (reason) {
+    case "unknown-engine":
+      return `This runner has no installer for "${engineId}" \u2014 update it, or install that CLI yourself and point ${engineBinEnvHint(engineId)} at it.`;
+    case "disabled":
+      return `Installing engine CLIs is turned off on this machine (\`${runnerBin} config set autoInstallEngines on\` to allow it).`;
+    case "windows":
+      return `This runner does not install engine CLIs on Windows yet \u2014 install "${engineId}" yourself and point ${engineBinEnvHint(engineId)} at it.`;
+    case "no-npm":
+      return "`npm` is not on this machine's PATH, so there is nothing to install with.";
+    case "already-installed":
+      return `"${engineId}" is already installed at the version this machine wants.`;
+    case "locked":
+      return `Another install of "${engineId}" is already running on this machine.`;
+    case "backoff":
+      return `Waiting before trying "${engineId}" again \u2014 the last install failed (\`${runnerBin} engine install ${engineId}\` to try now).`;
+    case "exhausted":
+      return `Installing "${engineId}" failed ${MAX_ENGINE_INSTALL_ATTEMPTS} times on this machine \u2014 see \`${runnerBin} engine list\`.`;
+  }
+}
+function engineBinEnvHint(engineId) {
+  return `CREW_${engineId.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_BIN`;
+}
+
+// src/engines/install/state.ts
+import fs3 from "node:fs";
+import path4 from "node:path";
+var ENGINE_STATE_FILE = "engines.json";
+function engineStatePath(root) {
+  return path4.join(root, ENGINE_STATE_FILE);
+}
+function readEngineState(root) {
+  try {
+    const parsed = JSON.parse(fs3.readFileSync(engineStatePath(root), "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function recordEngineInstall(root, engineId, patch) {
+  try {
+    const state = readEngineState(root);
+    const previous = state[engineId];
+    state[engineId] = { ...previous ?? { target: "", npmPackage: "", attempts: 0, at: 0, outcome: "failed" }, ...patch };
+    fs3.mkdirSync(root, { recursive: true, mode: 448 });
+    fs3.writeFileSync(engineStatePath(root), `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readEngineMarker(root, engineId) {
+  try {
+    const parsed = JSON.parse(fs3.readFileSync(engineMarkerPath(root, engineId), "utf8"));
+    if (!parsed || typeof parsed !== "object") return null;
+    const marker = parsed;
+    if (typeof marker.npmPackage !== "string" || typeof marker.version !== "string") return null;
+    if (typeof marker.bin !== "string" || !marker.bin) return null;
+    return { npmPackage: marker.npmPackage, version: marker.version, bin: marker.bin, at: typeof marker.at === "number" ? marker.at : 0 };
+  } catch {
+    return null;
+  }
+}
+function writeEngineMarker(root, engineId, marker) {
+  try {
+    fs3.writeFileSync(engineMarkerPath(root, engineId), `${JSON.stringify(marker, null, 2)}
+`, { mode: 384 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function clearEngineMarker(root, engineId) {
+  try {
+    fs3.rmSync(engineMarkerPath(root, engineId), { force: true });
+  } catch {
+  }
+}
 
 // src/engines/binary.ts
 function engineBinaryEnvVar(engineId) {
   return `CREW_${engineId.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_BIN`;
 }
-function engineBinary(engineId, defaultName) {
-  return process.env[engineBinaryEnvVar(engineId)] || defaultName;
+function managedEngineBin(engineId, options = {}) {
+  const pkg = enginePackageFor(engineId);
+  if (!pkg) return null;
+  let root;
+  try {
+    root = options.root ?? configDir();
+  } catch {
+    return null;
+  }
+  const marker = readEngineMarker(root, engineId);
+  if (!marker || marker.npmPackage !== pkg.npmPackage) return null;
+  try {
+    fs4.accessSync(marker.bin, fs4.constants.X_OK);
+  } catch {
+    return null;
+  }
+  return marker.bin;
+}
+function engineBinary(engineId, defaultName, options = {}) {
+  const env = options.env ?? process.env;
+  const override = env[engineBinaryEnvVar(engineId)];
+  if (override) return override;
+  return managedEngineBin(engineId, options) ?? defaultName;
 }
 
 // src/engines/claudeEvents.ts
@@ -2576,6 +2789,30 @@ function mcpCallsFromClaudeEvent(event, pairing) {
   return calls;
 }
 
+// src/engines/engineFault.ts
+var ARGV_REJECTED = [
+  /unexpected argument/i,
+  /unrecognized (?:subcommand|option)/i,
+  /unknown (?:option|argument|command)/i,
+  /invalid value .* for/i,
+  /error: unexpected/i
+];
+function detectEngineFault(input) {
+  if (input.explained) return void 0;
+  if (input.exitCode === 0) return void 0;
+  const stderr = input.stderr.slice(-4e3);
+  for (const pattern of ARGV_REJECTED) {
+    if (pattern.test(stderr)) {
+      const line = stderr.split("\n").find((l) => pattern.test(l))?.trim() ?? "";
+      return `The CLI rejected the command line this runner builds: ${line.slice(0, 200)}`;
+    }
+  }
+  if (input.events === 0 && stderr.trim().length === 0) {
+    return `The CLI produced no output and exited ${input.exitCode ?? "on a signal"}.`;
+  }
+  return void 0;
+}
+
 // src/engines/githubEnv.ts
 function githubSessionEnv(token) {
   if (!token) return {};
@@ -2588,6 +2825,15 @@ function githubSessionEnv(token) {
   };
 }
 
+// src/engines/spawnEnv.ts
+import path5 from "node:path";
+function withNodeOnPath(env = process.env) {
+  const nodeDir = path5.dirname(process.execPath);
+  const current = env.PATH ?? "";
+  if (current === nodeDir || current.startsWith(nodeDir + path5.delimiter)) return { ...env };
+  return { ...env, PATH: current ? `${nodeDir}${path5.delimiter}${current}` : nodeDir };
+}
+
 // src/engines/limitWindow.ts
 var MAX_LIMIT_MS = 7 * 24 * 60 * 60 * 1e3 + 60 * 60 * 1e3;
 function saneResetAt(reported, now, maxMs = MAX_LIMIT_MS) {
@@ -2713,9 +2959,9 @@ function allowedTools(agent, extraServers = []) {
   return [...new Set(tools)];
 }
 function createSessionDirs(jobId) {
-  const workdir = fs3.mkdtempSync(path3.join(os2.tmpdir(), `crew-job-${jobId}-`));
-  const configDir2 = fs3.mkdtempSync(path3.join(os2.tmpdir(), `crew-cfg-${jobId}-`));
-  return { workdir, configDir: configDir2, mcpConfigPath: path3.join(configDir2, "mcp.json") };
+  const workdir = fs5.mkdtempSync(path6.join(os2.tmpdir(), `crew-job-${jobId}-`));
+  const configDir2 = fs5.mkdtempSync(path6.join(os2.tmpdir(), `crew-cfg-${jobId}-`));
+  return { workdir, configDir: configDir2, mcpConfigPath: path6.join(configDir2, "mcp.json") };
 }
 function buildMcpConfig(input) {
   const mcpServers = {
@@ -2762,11 +3008,11 @@ function buildMcpConfig(input) {
   return { mcpServers };
 }
 function writeMcpConfig(dirs, input) {
-  fs3.writeFileSync(dirs.mcpConfigPath, JSON.stringify(buildMcpConfig(input)), { mode: 384 });
+  fs5.writeFileSync(dirs.mcpConfigPath, JSON.stringify(buildMcpConfig(input)), { mode: 384 });
 }
 function cleanupSessionDirs(dirs) {
-  fs3.rmSync(dirs.workdir, { recursive: true, force: true });
-  fs3.rmSync(dirs.configDir, { recursive: true, force: true });
+  fs5.rmSync(dirs.workdir, { recursive: true, force: true });
+  fs5.rmSync(dirs.configDir, { recursive: true, force: true });
 }
 async function runClaudeSession(input) {
   const bin = claudeBinary();
@@ -2803,7 +3049,9 @@ async function runSession(input, bin, dirs) {
   ];
   const claudeToken = engineSecret(input.secrets, CLAUDE_SECRET_KEY);
   const env = {
-    ...process.env,
+    // Claude ships a native launcher and does not need this today; every engine gets it anyway,
+    // because which engines do is the vendor's packaging and changes in a release (spawnEnv.ts).
+    ...withNodeOnPath(),
     // THE INIT EVENT MUST BE TRUTHFUL, and one inherited variable is enough to make it lie.
     //
     // `MCP_CONNECTION_NONBLOCKING` lets the CLI start before its MCP servers have settled. The init
@@ -2921,6 +3169,12 @@ ${stderrLines.slice(-20).join("\n")}`,
     Date.now(),
     engineUsageWindows(CLAUDE_DRIVER_ID)?.fallbackMs ?? 5 * 60 * 60 * 1e3
   );
+  const engineFault = ok2 ? void 0 : detectEngineFault({
+    exitCode,
+    stderr: stderrLines.join("\n"),
+    events: lines.length,
+    explained: Boolean(limit4 || mcpProblem || resultEvent)
+  });
   return {
     ok: ok2,
     transcript: `${lines.join("\n")}
@@ -2928,7 +3182,8 @@ ${stderrLines.slice(-20).join("\n")}`,
     usage,
     resultText: resultText3,
     ...limit4 ? { limit: limit4 } : {},
-    ...mcpFailed.length ? { mcpFailed } : {}
+    ...mcpFailed.length ? { mcpFailed } : {},
+    ...engineFault ? { engineFault } : {}
   };
 }
 var CLAUDE_DRIVER_ID = "claude";
@@ -2948,8 +3203,8 @@ function emptyUsage() {
     durationS: 0
   };
 }
-async function claudeHealthCheck() {
-  const bin = claudeBinary();
+async function claudeHealthCheck(binOverride) {
+  const bin = binOverride ?? claudeBinary();
   return new Promise((resolve) => {
     let settled = false;
     const done = (health) => {
@@ -2958,7 +3213,7 @@ async function claudeHealthCheck() {
       resolve({ ...health, binary: bin });
     };
     let stdout = "";
-    const child = spawn3(bin, ["--version"], { stdio: ["ignore", "pipe", "ignore"] });
+    const child = spawn3(bin, ["--version"], { env: withNodeOnPath(), stdio: ["ignore", "pipe", "ignore"] });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
       done({ ok: false, detail: `\`${bin} --version\` timed out`, fix: "Check the Claude CLI install." });
@@ -3001,9 +3256,9 @@ var claudeDriver = {
 
 // src/engines/codex.ts
 import { spawn as spawn4 } from "node:child_process";
-import fs4 from "node:fs";
+import fs6 from "node:fs";
 import os3 from "node:os";
-import path4 from "node:path";
+import path7 from "node:path";
 
 // src/engines/ansi.ts
 var ANSI_RE = /\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-Z\\-_]/g;
@@ -3266,7 +3521,7 @@ var codexLogin = {
   logoutArgs: () => ["logout"],
   statusArgs: () => ["login", "status"],
   env: (home) => ({ CODEX_HOME: home }),
-  isSignedIn: (home) => fs4.existsSync(path4.join(home, AUTH_FILE)),
+  isSignedIn: (home) => fs6.existsSync(path7.join(home, AUTH_FILE)),
   parseGuidance(text2) {
     const clean = stripAnsi(text2);
     const url = GUIDANCE_URL_RE.exec(clean)?.[0];
@@ -3282,7 +3537,7 @@ var codexLogin = {
   readAccount(home) {
     let parsed;
     try {
-      parsed = JSON.parse(fs4.readFileSync(path4.join(home, AUTH_FILE), "utf8"));
+      parsed = JSON.parse(fs6.readFileSync(path7.join(home, AUTH_FILE), "utf8"));
     } catch {
       return null;
     }
@@ -3330,17 +3585,18 @@ async function runCodexSession(input) {
       { credentialLost: "The sign-in directory on this machine no longer holds a login." }
     );
   }
-  const workdir = fs4.mkdtempSync(path4.join(os3.tmpdir(), `crew-job-${input.job.id}-`));
+  const workdir = fs6.mkdtempSync(path7.join(os3.tmpdir(), `crew-job-${input.job.id}-`));
   try {
     return await runSession2(input, bin, home, workdir);
   } finally {
-    fs4.rmSync(workdir, { recursive: true, force: true });
+    fs6.rmSync(workdir, { recursive: true, force: true });
   }
 }
 async function runSession2(input, bin, home, workdir) {
   const args = codexArgs({ ...input, extraServers: input.extraMcpServers, workdir });
   const env = {
-    ...process.env,
+    // The CLI's command is a `#!/usr/bin/env node` script — see engines/spawnEnv.ts.
+    ...withNodeOnPath(),
     ...codexLogin.env(home),
     [WORKSPACE_TOKEN_ENV]: input.idToken,
     ...githubSessionEnv(input.githubToken)
@@ -3456,6 +3712,12 @@ async function runSession2(input, bin, home, workdir) {
   const limit4 = !ok2 && windows ? detectCodexLimit(failureText, Date.now(), windows.fallbackMs) : void 0;
   const credentialLost = !ok2 && !limit4 ? detectLoginLost(stderr) : void 0;
   const resultText3 = ok2 ? seen.lastMessage : failedMessage || stderr.trim().split("\n").slice(-3).join("\n") || `Codex exited ${exitCode}`;
+  const engineFault = ok2 ? void 0 : detectEngineFault({
+    exitCode,
+    stderr,
+    events: lines.length,
+    explained: Boolean(limit4 || credentialLost || mcpProblem || failedMessage)
+  });
   return {
     ok: ok2,
     transcript,
@@ -3463,11 +3725,12 @@ async function runSession2(input, bin, home, workdir) {
     resultText: resultText3.slice(0, 2e4),
     ...limit4 ? { limit: limit4 } : {},
     ...credentialLost ? { credentialLost } : {},
-    ...mcpFailed.length ? { mcpFailed } : {}
+    ...mcpFailed.length ? { mcpFailed } : {},
+    ...engineFault ? { engineFault } : {}
   };
 }
-async function codexHealthCheck() {
-  const bin = codexBinary();
+async function codexHealthCheck(binOverride) {
+  const bin = binOverride ?? codexBinary();
   return new Promise((resolve) => {
     let settled = false;
     const done = (health) => {
@@ -3476,7 +3739,7 @@ async function codexHealthCheck() {
       resolve({ ...health, binary: bin });
     };
     let stdout = "";
-    const child = spawn4(bin, ["--version"], { stdio: ["ignore", "pipe", "ignore"] });
+    const child = spawn4(bin, ["--version"], { env: withNodeOnPath(), stdio: ["ignore", "pipe", "ignore"] });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
       done({ ok: false, detail: `\`${bin} --version\` timed out`, fix: "Check the Codex CLI install." });
@@ -3885,19 +4148,16 @@ function credentialGate(agent, credentials, runnerId, busyCredentialIds, default
 }
 
 // src/jobs/engineHome.ts
-import path5 from "node:path";
-var SEGMENT = /^[A-Za-z0-9_-]+$/;
+import path8 from "node:path";
 function engineCredentialHome(root, engineId, shipId, credentialId) {
-  for (const segment of [engineId, shipId, credentialId]) {
-    if (!SEGMENT.test(segment)) throw new Error(`not a valid path segment: ${JSON.stringify(segment)}`);
-  }
-  return path5.join(root, "engines", engineId, shipId, credentialId);
+  for (const segment of [engineId, shipId, credentialId]) assertPathSegment(segment);
+  return path8.join(root, "engines", engineId, shipId, credentialId);
 }
 
 // src/jobs/engineLogin.ts
 import { spawn as nodeSpawn } from "node:child_process";
-import fs5 from "node:fs";
-import path6 from "node:path";
+import fs7 from "node:fs";
+import path9 from "node:path";
 var DEVICE_CODE_TTL_MS = 15 * 60 * 1e3;
 function machineLoginTimeoutMs() {
   const override = Number(process.env.CREW_MACHINE_LOGIN_TIMEOUT_MS);
@@ -3920,39 +4180,39 @@ function credentialsToForget(previouslyHeld, current) {
   return [...previouslyHeld].filter((id) => !live.has(id));
 }
 function orphanHomes(root, shipId, liveIds) {
-  const enginesDir = path6.join(root, "engines");
+  const enginesDir = path9.join(root, "engines");
   let engines = [];
   try {
-    engines = fs5.readdirSync(enginesDir);
+    engines = fs7.readdirSync(enginesDir);
   } catch {
     return [];
   }
   const out = [];
   for (const engineId of engines) {
-    const shipDir = path6.join(enginesDir, engineId, shipId);
+    const shipDir = path9.join(enginesDir, engineId, shipId);
     let creds = [];
     try {
-      creds = fs5.readdirSync(shipDir);
+      creds = fs7.readdirSync(shipDir);
     } catch {
       continue;
     }
-    for (const credId of creds) if (!liveIds.has(credId)) out.push(path6.join(shipDir, credId));
+    for (const credId of creds) if (!liveIds.has(credId)) out.push(path9.join(shipDir, credId));
   }
   return out;
 }
 async function runMachineLogin(input) {
-  const spawn8 = input.spawn ?? nodeSpawn;
+  const spawn9 = input.spawn ?? nodeSpawn;
   if (input.signal?.aborted) return { phase: "failed", error: "The runner was stopping." };
   try {
-    fs5.mkdirSync(input.home, { recursive: true, mode: 448 });
+    fs7.mkdirSync(input.home, { recursive: true, mode: 448 });
   } catch (e) {
     return { phase: "failed", error: `Could not create the sign-in directory: ${message2(e)}` };
   }
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn8(input.bin, input.driver.spawnArgs(), {
-        env: { ...process.env, ...input.driver.env(input.home) },
+      child = spawn9(input.bin, input.driver.spawnArgs(), {
+        env: { ...withNodeOnPath(), ...input.driver.env(input.home) },
         stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (e) {
@@ -4036,13 +4296,13 @@ function notInstalled(engineId, bin, detail) {
   return `\`${bin}\` is not installed on this machine (${detail}). Install the engine's CLI, or set ${engineBinaryEnvVar(engineId)} to its path.`;
 }
 async function logoutAndRemove(input) {
-  const spawn8 = input.spawn ?? nodeSpawn;
-  if (fs5.existsSync(input.home)) {
+  const spawn9 = input.spawn ?? nodeSpawn;
+  if (fs7.existsSync(input.home)) {
     await new Promise((resolve) => {
       let child;
       try {
-        child = spawn8(input.bin, input.driver.logoutArgs(), {
-          env: { ...process.env, ...input.driver.env(input.home) },
+        child = spawn9(input.bin, input.driver.logoutArgs(), {
+          env: { ...withNodeOnPath(), ...input.driver.env(input.home) },
           stdio: "ignore"
         });
       } catch {
@@ -4064,7 +4324,7 @@ async function logoutAndRemove(input) {
     });
   }
   try {
-    fs5.rmSync(input.home, { recursive: true, force: true });
+    fs7.rmSync(input.home, { recursive: true, force: true });
   } catch (e) {
     input.log(`Could not remove the sign-in directory ${input.home}: ${message2(e)}`);
   }
@@ -4095,6 +4355,13 @@ async function machineLoginAndReport(input) {
     await say2({ phase: "failed", error: message2(e) });
     return;
   }
+  if (input.ensureEngine) {
+    const ready = await input.ensureEngine(credential.engine);
+    if (!ready.ok) {
+      await say2({ phase: "failed", error: ready.detail });
+      return;
+    }
+  }
   input.log(`Signing this machine in for "${credential.label}" (${credential.engine}) \u2014 a captain asked.`);
   const outcome = await runMachineLogin({
     driver: driver.login,
@@ -4128,7 +4395,7 @@ async function machineLoginAndReport(input) {
   if (outcome.phase === "expired") {
     input.log(`The sign-in for "${credential.label}" expired before it was approved.`);
     try {
-      fs5.rmSync(home, { recursive: true, force: true });
+      fs7.rmSync(home, { recursive: true, force: true });
     } catch {
     }
     await say2({ phase: "expired" });
@@ -4136,7 +4403,7 @@ async function machineLoginAndReport(input) {
   }
   input.log(`The sign-in for "${credential.label}" failed: ${outcome.error}`);
   try {
-    fs5.rmSync(home, { recursive: true, force: true });
+    fs7.rmSync(home, { recursive: true, force: true });
   } catch {
   }
   await say2({ phase: "failed", error: outcome.error });
@@ -4303,11 +4570,11 @@ function redactTranscript(transcript, knownSecrets, patterns = []) {
   return out;
 }
 async function uploadTranscript(storage, shipId, jobId, redacted) {
-  const path13 = `crew/${shipId}/transcripts/${jobId}.jsonl`;
-  await uploadBytes(storageRef(storage, path13), new TextEncoder().encode(redacted), {
+  const path17 = `crew/${shipId}/transcripts/${jobId}.jsonl`;
+  await uploadBytes(storageRef(storage, path17), new TextEncoder().encode(redacted), {
     contentType: "application/x-ndjson"
   });
-  return path13;
+  return path17;
 }
 function utcDay(millis) {
   return new Date(millis).toISOString().slice(0, 10);
@@ -4665,118 +4932,658 @@ function createProgressWriter(deps) {
   };
 }
 
-// src/service.ts
-import { spawnSync } from "node:child_process";
-import fs6 from "node:fs";
-import os4 from "node:os";
-import path7 from "node:path";
-import { fileURLToPath } from "node:url";
-var SERVICE_LABEL = `com.kilogent.${RUNNER_BIN.replace(/^kilogent-/, "")}`;
-var LINUX_UNIT = `${RUNNER_BIN}.service`;
-var WINDOWS_TASK = RUNNER_BIN.split("-").map((part) => part[0].toUpperCase() + part.slice(1)).join("");
-var LEGACY_SERVICE_LABEL = "com.lumi.crew-runner";
-var LEGACY_LINUX_UNIT = "crew-runner.service";
-var LEGACY_WINDOWS_TASK = "CrewRunner";
-var RETIRED_SERVICES = [
-  { label: LEGACY_SERVICE_LABEL, unit: LEGACY_LINUX_UNIT, task: LEGACY_WINDOWS_TASK },
-  { label: "com.lumi.runner", unit: "lumi-runner.service", task: "LumiRunner" }
-];
-var ServiceError = class extends Error {
-};
-function run(command, args) {
-  const result = spawnSync(command, args, { encoding: "utf8" });
-  return {
-    ok: result.status === 0,
-    out: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
-  };
+// src/engines/install/index.ts
+import fs10 from "node:fs";
+
+// src/engines/install/lock.ts
+import fs9 from "node:fs";
+import path10 from "node:path";
+
+// src/engines/install/npm.ts
+import { spawn as spawn6 } from "node:child_process";
+import fs8 from "node:fs";
+var ENGINE_INSTALL_TIMEOUT_MS = 5 * 6e4;
+var STDERR_KEEP = 600;
+function engineInstallArgs(pkg, version, prefix) {
+  if (!isExactVersion(version)) throw new Error(`refusing to install a version that is not exact: ${JSON.stringify(version)}`);
+  if (enginePackageFor_reverse(pkg.npmPackage) === null) {
+    throw new Error(`refusing to install a package that is not on the allowlist: ${JSON.stringify(pkg.npmPackage)}`);
+  }
+  return ["install", "--global", "--prefix", prefix, "--no-fund", "--no-audit", `${pkg.npmPackage}@${version}`];
 }
-function cliPath() {
-  return fileURLToPath(import.meta.url);
+function enginePackageFor_reverse(npmPackage) {
+  for (const id of ["codex", "claude"]) {
+    if (enginePackageFor(id)?.npmPackage === npmPackage) return id;
+  }
+  return null;
 }
-function uid() {
-  return String(process.getuid?.() ?? 0);
+function clearEnginePrefix(root, engineId) {
+  fs8.rmSync(enginePrefixDir(root, engineId), { recursive: true, force: true });
 }
-function launchAgentPath() {
-  return path7.join(os4.homedir(), "Library/LaunchAgents", `${SERVICE_LABEL}.plist`);
+async function installEnginePackage(pkg, version, prefix, options = {}) {
+  const args = engineInstallArgs(pkg, version, prefix);
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn6("npm", args, { stdio: ["ignore", "ignore", "pipe"] });
+    } catch (e) {
+      resolve({ ok: false, detail: e instanceof Error ? e.message : String(e) });
+      return;
+    }
+    let stderr = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      resolve(result);
+    };
+    const deadline = setTimeout(() => {
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 5e3).unref();
+      finish({ ok: false, detail: `npm install timed out after ${Math.round((options.timeoutMs ?? ENGINE_INSTALL_TIMEOUT_MS) / 6e4)} min` });
+    }, options.timeoutMs ?? ENGINE_INSTALL_TIMEOUT_MS);
+    deadline.unref();
+    child.stderr?.on("data", (chunk) => {
+      stderr = (stderr + chunk.toString("utf8")).slice(-STDERR_KEEP);
+    });
+    child.on("error", (e) => finish({ ok: false, detail: e.message }));
+    child.on("close", (code) => {
+      finish(code === 0 ? { ok: true, detail: "" } : { ok: false, detail: stderr.trim() || `npm exited ${code}` });
+    });
+  });
 }
-function systemdUnitPath() {
-  return path7.join(os4.homedir(), ".config/systemd/user", LINUX_UNIT);
+
+// src/engines/install/lock.ts
+var OWNER_FILE = "owner.json";
+var STALE_AFTER_MS = 2 * ENGINE_INSTALL_TIMEOUT_MS;
+function lockDir(root, engineId) {
+  return `${enginePrefixDir(root, engineId)}.lock`;
 }
-function serviceEnv() {
-  const env = { PATH: process.env.PATH ?? "" };
-  if (process.env.LUMI_RUNNER_HOME || process.env.CREW_RUNNER_HOME) {
-    env.LUMI_RUNNER_HOME = configDir();
+function readOwner(dir) {
+  try {
+    const parsed = JSON.parse(fs9.readFileSync(path10.join(dir, OWNER_FILE), "utf8"));
+    const owner = parsed;
+    if (typeof owner?.pid !== "number" || typeof owner?.at !== "number") return null;
+    return { pid: owner.pid, at: owner.at };
+  } catch {
+    return null;
   }
-  return env;
 }
-function serviceEnvDrift(current, installed) {
-  if (!installed) return [];
-  return Object.keys(current).filter((name) => current[name] !== installed[name]).sort();
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
 }
-function removeLegacyService() {
-  const removed = [];
-  for (const old of RETIRED_SERVICES) {
-    if (old.label === SERVICE_LABEL) continue;
-    if (process.platform === "darwin") {
-      const unitPath = path7.join(os4.homedir(), "Library/LaunchAgents", `${old.label}.plist`);
-      if (fs6.existsSync(unitPath)) {
-        run("launchctl", ["bootout", `gui/${uid()}/${old.label}`]);
-        fs6.rmSync(unitPath, { force: true });
-        removed.push(unitPath);
-      }
-      continue;
-    }
-    if (process.platform === "linux") {
-      const unitPath = path7.join(os4.homedir(), ".config/systemd/user", old.unit);
-      if (fs6.existsSync(unitPath)) {
-        run("systemctl", ["--user", "disable", "--now", old.unit]);
-        fs6.rmSync(unitPath, { force: true });
-        run("systemctl", ["--user", "daemon-reload"]);
-        removed.push(unitPath);
-      }
-      continue;
+function isStale(owner, now) {
+  if (!owner) return true;
+  return !alive(owner.pid) || now - owner.at > STALE_AFTER_MS;
+}
+async function withEngineInstallLock(root, engineId, fn, now = Date.now()) {
+  const dir = lockDir(root, engineId);
+  fs9.mkdirSync(path10.dirname(dir), { recursive: true, mode: 448 });
+  let held = false;
+  try {
+    fs9.mkdirSync(dir);
+    held = true;
+  } catch {
+    if (!isStale(readOwner(dir), now)) return { ran: false };
+    try {
+      fs9.rmSync(dir, { recursive: true, force: true });
+      fs9.mkdirSync(dir);
+      held = true;
+    } catch {
+      return { ran: false };
     }
-    if (process.platform === "win32") {
-      if (run("schtasks", ["/Query", "/TN", old.task]).ok) {
-        run("schtasks", ["/Delete", "/TN", old.task, "/F"]);
-        removed.push(old.task);
+  }
+  try {
+    fs9.writeFileSync(path10.join(dir, OWNER_FILE), `${JSON.stringify({ pid: process.pid, at: now })}
+`, { mode: 384 });
+  } catch {
+  }
+  try {
+    return { ran: true, value: await fn() };
+  } finally {
+    if (held) {
+      try {
+        fs9.rmSync(dir, { recursive: true, force: true });
+      } catch {
       }
     }
   }
-  return removed;
 }
-var BOOTSTRAP_RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 2e3];
-function isTransientBootstrapError(out) {
-  const text2 = out.toLowerCase();
-  return (
-    // The observed one: `Bootstrap failed: 5: Input/output error`.
-    text2.includes("input/output error") || // Same cause, different report: the old generation is still registered.
-    text2.includes("service already loaded") || text2.includes("service is already loaded") || text2.includes("eexist") || // launchd is mid-teardown and says so.
-    text2.includes("operation already in progress") || text2.includes("operation now in progress")
+
+// src/engines/install/index.ts
+async function installEngine(input) {
+  const { root, engineId, version, log: log2 } = input;
+  const now = input.now ?? Date.now();
+  const pkg = enginePackageFor(engineId);
+  if (!pkg) return { ok: false, ran: false, detail: `no installer for "${engineId}"` };
+  if (!isExactVersion(version)) return { ok: false, ran: false, detail: `not an exact version: ${version}` };
+  const held = await withEngineInstallLock(
+    root,
+    engineId,
+    async () => {
+      const record = readEngineState(root)[engineId];
+      const spent = record && record.target === version ? record.attempts : 0;
+      recordEngineInstall(root, engineId, {
+        target: version,
+        npmPackage: pkg.npmPackage,
+        attempts: spent + 1,
+        at: now,
+        outcome: "failed",
+        detail: "install started"
+      });
+      clearEngineMarker(root, engineId);
+      clearEnginePrefix(root, engineId);
+      const prefix = enginePrefixDir(root, engineId);
+      fs10.mkdirSync(prefix, { recursive: true, mode: 448 });
+      log2(`Installing ${pkg.npmPackage}@${version} for "${engineId}" (this is a few hundred MB).`);
+      const installed = await installEnginePackage(pkg, version, prefix, { timeoutMs: input.timeoutMs ?? ENGINE_INSTALL_TIMEOUT_MS });
+      if (!installed.ok) {
+        recordEngineInstall(root, engineId, { outcome: "failed", at: Date.now(), detail: installed.detail.slice(0, 400) });
+        return { ok: false, ran: true, detail: installed.detail };
+      }
+      const bin = engineBinPath(root, engineId, pkg.binName);
+      const health = await input.healthCheck(bin);
+      if (!health.ok || health.binary !== bin) {
+        const detail = health.ok ? `npm reported success, but the check ran ${health.binary ?? "something else"} rather than ${bin} \u2014 the install did not land where this runner looks.` : health.detail;
+        recordEngineInstall(root, engineId, { outcome: "failed", at: Date.now(), detail: detail.slice(0, 400) });
+        return { ok: false, ran: true, detail };
+      }
+      writeEngineMarker(root, engineId, { npmPackage: pkg.npmPackage, version, bin, at: Date.now() });
+      recordEngineInstall(root, engineId, { outcome: "installed", at: Date.now(), attempts: 0, detail: void 0 });
+      log2(`"${engineId}" is ready \u2014 ${pkg.npmPackage}@${version}.`);
+      return { ok: true, ran: true, detail: "", bin };
+    },
+    now
   );
+  return held.ran ? held.value : { ok: false, ran: false, detail: "another install of this engine is already running" };
 }
-function retryWhileTransient(attempt, wait, delays = BOOTSTRAP_RETRY_DELAYS_MS) {
-  let result = attempt();
-  for (const delay of delays) {
-    if (result.ok || !isTransientBootstrapError(result.out)) return result;
-    wait(delay);
-    result = attempt();
-  }
-  return result;
-}
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function plistXml() {
-  const env = serviceEnv();
-  const envEntries = Object.entries(env).map(([k, v]) => `      <key>${k}</key>
-      <string>${escapeXml(v)}</string>`).join("\n");
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${SERVICE_LABEL}</string>
+
+// src/update/install.ts
+import { spawn as spawn7, spawnSync } from "node:child_process";
+import fs11 from "node:fs";
+import path12 from "node:path";
+
+// src/update/plan.ts
+import path11 from "node:path";
+
+// src/update/semver.ts
+var DEV_VERSION = "0.0.0-dev";
+var NUMERIC = /^(0|[1-9]\d*)$/;
+function parseVersion(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  const [withoutBuild] = trimmed.split("+", 1);
+  const dash = withoutBuild.indexOf("-");
+  const core = dash < 0 ? withoutBuild : withoutBuild.slice(0, dash);
+  const pre = dash < 0 ? "" : withoutBuild.slice(dash + 1);
+  const parts = core.split(".");
+  if (parts.length !== 3) return null;
+  if (!parts.every((p) => NUMERIC.test(p))) return null;
+  const [major, minor, patch] = parts.map(Number);
+  if (dash >= 0 && pre === "") return null;
+  const prerelease = pre === "" ? [] : pre.split(".");
+  if (prerelease.some((id) => id === "")) return null;
+  return {
+    major,
+    minor,
+    patch,
+    prerelease: prerelease.map((id) => NUMERIC.test(id) ? Number(id) : id)
+  };
+}
+function comparePrerelease(a, b) {
+  if (a.length === 0) return b.length === 0 ? 0 : 1;
+  if (b.length === 0) return -1;
+  for (let i = 0; i < Math.min(a.length, b.length); i++) {
+    const x = a[i];
+    const y = b[i];
+    if (x === y) continue;
+    const xNum = typeof x === "number";
+    const yNum = typeof y === "number";
+    if (xNum !== yNum) return xNum ? -1 : 1;
+    if (xNum && yNum) return x < y ? -1 : 1;
+    return x < y ? -1 : 1;
+  }
+  if (a.length === b.length) return 0;
+  return a.length < b.length ? -1 : 1;
+}
+function compareVersions(a, b) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (a[key] !== b[key]) return a[key] < b[key] ? -1 : 1;
+  }
+  return comparePrerelease(a.prerelease, b.prerelease);
+}
+function isNewer(candidate, current) {
+  if (current === DEV_VERSION) return false;
+  const a = parseVersion(candidate);
+  const b = parseVersion(current);
+  if (!a || !b) return false;
+  return compareVersions(a, b) === 1;
+}
+
+// src/update/plan.ts
+var PACKAGE_NAME = RUNNER_PACKAGE;
+var UPDATE_DIST_TAG = "latest";
+var UPDATE_CHECK_MS = 30 * 6e4;
+var UPDATE_FIRST_CHECK_MS = 2 * 6e4;
+var UPDATE_JITTER_MS = 10 * 6e4;
+var CHECK_MINUTES_MIN = 5;
+var CHECK_MINUTES_MAX = 24 * 60;
+var UPDATE_DRAIN_MAX_MS = 30 * 6e4;
+var MAX_UPDATE_ATTEMPTS = 3;
+var UPDATE_BACKOFF_MS = [15 * 6e4, 2 * 36e5, 12 * 36e5];
+function checkIntervalMs(config2) {
+  const raw = config2.updateCheckMinutes;
+  if (typeof raw !== "number" || !Number.isFinite(raw)) return UPDATE_CHECK_MS;
+  const clamped2 = Math.min(CHECK_MINUTES_MAX, Math.max(CHECK_MINUTES_MIN, Math.floor(raw)));
+  return clamped2 * 6e4;
+}
+function nextAttemptAllowed(state, target, now) {
+  if (!state || typeof state !== "object") return { allowed: true };
+  if (state.target !== target) return { allowed: true };
+  const attempts = typeof state.attempts === "number" && state.attempts > 0 ? state.attempts : 0;
+  if (attempts === 0) return { allowed: true };
+  if (attempts >= MAX_UPDATE_ATTEMPTS) return { allowed: false, reason: "exhausted" };
+  if (typeof state.at !== "number" || !Number.isFinite(state.at)) return { allowed: true };
+  const wait = UPDATE_BACKOFF_MS[Math.min(attempts - 1, UPDATE_BACKOFF_MS.length - 1)];
+  return now - state.at >= wait ? { allowed: true } : { allowed: false, reason: "backoff" };
+}
+function reconcile(state, current) {
+  if (!state || typeof state.target !== "string") return { action: "none" };
+  if (state.target === current) return { action: "clear", target: state.target };
+  return { action: "keep", state };
+}
+function packageRootFrom(cliPath2) {
+  return path11.dirname(path11.dirname(cliPath2));
+}
+function globalPrefixFrom(cliPath2) {
+  const root = packageRootFrom(cliPath2);
+  const parts = root.split(path11.sep);
+  const i = parts.lastIndexOf("node_modules");
+  if (i < 1) return null;
+  const before = parts.slice(0, i);
+  if (before[before.length - 1] === "lib") before.pop();
+  const prefix = before.join(path11.sep);
+  return prefix || null;
+}
+function decideUpdate(f) {
+  if (f.platform === "win32") return { update: false, reason: "windows" };
+  if (f.current === DEV_VERSION) return { update: false, reason: "dev-build" };
+  if (!f.autoUpdate) return { update: false, reason: "disabled" };
+  const service2 = f.service();
+  if (service2.state !== "running") return { update: false, reason: "service-not-running" };
+  if (!service2.execPath || service2.execPath !== f.cliPath) {
+    return { update: false, reason: "foreign-unit" };
+  }
+  if (!f.npmPresent()) return { update: false, reason: "no-npm" };
+  if (f.distTags === null) return { update: false, reason: "registry-unreachable" };
+  const target = f.distTags[UPDATE_DIST_TAG];
+  if (!target) return { update: false, reason: "no-such-tag" };
+  if (!isNewer(target, f.current)) return { update: false, reason: "up-to-date" };
+  const attempt = nextAttemptAllowed(f.state, target, f.now);
+  if (!attempt.allowed) return { update: false, reason: attempt.reason };
+  return { update: true, target };
+}
+function describeRefusal(reason, f) {
+  switch (reason) {
+    case "windows":
+      return `Auto-update is not available on Windows \u2014 run \`${RUNNER_BIN} update\` to upgrade.`;
+    case "dev-build":
+      return "Development build \u2014 auto-update is off.";
+    case "disabled":
+      return `Auto-update is off (\`${RUNNER_BIN} config set autoUpdate on\` to enable).`;
+    case "service-not-running":
+      return `Auto-update needs the background service (this daemon would have nothing to restart it). Run \`${RUNNER_BIN} service install\`, or \`${RUNNER_BIN} update\` by hand.`;
+    case "foreign-unit":
+      return `This process is not the one the installed service runs, so auto-update is off for it. Run \`${RUNNER_BIN} update\` if you meant to upgrade the installed copy.`;
+    case "no-npm":
+      return "Auto-update needs `npm` on the service PATH and could not find it.";
+    case "registry-unreachable":
+      return "Could not reach the npm registry to check for updates \u2014 will retry.";
+    case "no-such-tag":
+      return `The npm registry has no release of ${PACKAGE_NAME} yet.`;
+    case "up-to-date":
+      return `Up to date (${f.current}).`;
+    case "backoff":
+      return "A recent update attempt did not take \u2014 waiting before trying again.";
+    case "exhausted":
+      return `Gave up updating after ${MAX_UPDATE_ATTEMPTS} attempts. Still on ${f.current} \u2014 run \`${RUNNER_BIN} update\` to see why, or wait for the next release.`;
+  }
+}
+
+// src/update/install.ts
+var INSTALL_TIMEOUT_MS = 5 * 6e4;
+var STDERR_KEEP2 = 400;
+function npmPresent() {
+  const probe2 = process.platform === "win32" ? "where" : "which";
+  try {
+    return spawnSync(probe2, ["npm"], { encoding: "utf8" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+function installArgs(target, cliPath2) {
+  const args = ["install", "--global", "--no-fund", "--no-audit", `${PACKAGE_NAME}@${target}`];
+  const prefix = globalPrefixFrom(cliPath2);
+  if (prefix) args.push("--prefix", prefix);
+  return args;
+}
+async function installGlobal(target, cliPath2, options = {}) {
+  const args = installArgs(target, cliPath2);
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn7("npm", args, { stdio: ["ignore", "ignore", "pipe"] });
+    } catch (e) {
+      resolve({ ok: false, detail: e instanceof Error ? e.message : String(e) });
+      return;
+    }
+    let stderr = "";
+    child.stderr?.on("data", (chunk) => {
+      stderr = `${stderr}${chunk.toString()}`.slice(-STDERR_KEEP2);
+    });
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS;
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 5e3).unref();
+      finish({ ok: false, detail: `npm install timed out after ${timeoutMs / 6e4} minutes.` });
+    }, timeoutMs);
+    timer.unref();
+    child.on("error", (e) => finish({ ok: false, detail: e.message }));
+    child.on(
+      "close",
+      (code) => finish({ ok: code === 0, detail: stderr.trim() || `npm exited ${code}` })
+    );
+  });
+}
+function installedVersionAt(cliPath2) {
+  try {
+    const pkg = JSON.parse(
+      fs11.readFileSync(path12.join(packageRootFrom(cliPath2), "package.json"), "utf8")
+    );
+    const version = pkg?.version;
+    return typeof version === "string" ? version : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/update/registry.ts
+var DEFAULT_REGISTRY = "https://registry.npmjs.org";
+var REGISTRY_TIMEOUT_MS = 1e4;
+function registryBase(env = process.env) {
+  return (env.LUMI_RUNNER_REGISTRY || DEFAULT_REGISTRY).replace(/\/+$/, "");
+}
+async function fetchDistTags(options = {}) {
+  const base = options.registry ?? registryBase();
+  const doFetch = options.fetchImpl ?? fetch;
+  const url = `${base}/${encodeURIComponent(options.packageName ?? PACKAGE_NAME)}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? REGISTRY_TIMEOUT_MS);
+  try {
+    const response = await doFetch(url, {
+      headers: { accept: "application/vnd.npm.install-v1+json" },
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const body = await response.json();
+    const tags = body?.["dist-tags"];
+    if (!tags || typeof tags !== "object" || Array.isArray(tags)) return null;
+    const out = {};
+    for (const [tag, version] of Object.entries(tags)) {
+      if (typeof version === "string") out[tag] = version;
+    }
+    return out;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/jobs/engineTools.ts
+async function refreshEngineTools(input) {
+  const now = input.now ?? Date.now();
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const engineId of input.engineIds) {
+    if (seen.has(engineId)) continue;
+    seen.add(engineId);
+    out.push(await refreshOne(engineId, input, now));
+  }
+  return out;
+}
+async function refreshOne(engineId, input, now) {
+  const { root, log: log2 } = input;
+  const pkg = enginePackageFor(engineId);
+  if (!pkg) {
+    return { engineId, state: "missing", detail: describeEngineInstallRefusal("unknown-engine", engineId, input.runnerBin) };
+  }
+  const policy = resolveEnginePolicy(engineId, input.policyDoc);
+  const marker = readEngineMarker(root, engineId);
+  const installed = managedEngineBin(engineId, { root }) ? marker?.version ?? null : null;
+  let latest = null;
+  if (installed) {
+    const ask = input.fetchLatest ?? (async (name) => (await fetchDistTags({ packageName: name }))?.latest ?? null);
+    latest = await ask(pkg.npmPackage).catch(() => null);
+    if (latest) rememberFirstSeen(root, engineId, latest, now);
+  }
+  const record = readEngineState(root)[engineId];
+  const choice = chooseEngineVersion({ policy, latest, installed, firstSeen: record?.firstSeen, now });
+  if (!choice.version) return describeCurrent(engineId, input, marker, record, choice.reason);
+  const decision = decideEngineInstall({
+    engineId,
+    target: choice.version,
+    platform: process.platform,
+    autoInstall: input.autoInstall,
+    npmPresent: npmPresentOnce(),
+    marker,
+    locked: false,
+    record: record ?? null,
+    now
+  });
+  if (!decision.install) {
+    if (decision.reason === "already-installed") return { engineId, state: "ready", version: marker?.version };
+    return describeRefused(engineId, input, marker, decision.reason);
+  }
+  input.onState?.({ engineId, state: "installing", version: choice.version });
+  const outcome = await installEngine({
+    root,
+    engineId,
+    version: choice.version,
+    healthCheck: (bin) => getDriver(engineId).healthCheck(bin),
+    log: log2,
+    now
+  });
+  if (outcome.ok) return { engineId, state: "ready", version: choice.version };
+  log2(`Could not install "${engineId}": ${outcome.detail.slice(0, 200)}`);
+  const fallback = await unmanagedVersion(engineId);
+  if (fallback && !policy.blocked.includes(fallback)) {
+    return { engineId, state: "unmanaged", version: fallback, detail: "Using a copy already on this machine \u2014 this runner cannot update or roll it back." };
+  }
+  return { engineId, state: "failed", detail: outcome.detail.slice(0, 300) };
+}
+async function ensureEngineReady(engineId, input) {
+  const [state] = await refreshEngineTools({ ...input, engineIds: [engineId] });
+  if (!state) return { ok: false, detail: `This runner does not know the engine "${engineId}".` };
+  if (state.state === "ready" || state.state === "unmanaged") return { ok: true, detail: state.detail ?? "" };
+  return { ok: false, detail: state.detail ?? `The "${engineId}" CLI is not installed on this machine.` };
+}
+function describeCurrent(engineId, input, marker, record, reason) {
+  if (marker && managedEngineBin(engineId, { root: input.root })) {
+    return { engineId, state: "ready", version: marker.version };
+  }
+  if (reason === "no-policy") {
+    return { engineId, state: "missing", detail: `This runner has no version recorded for "${engineId}".` };
+  }
+  if (record?.outcome === "failed") return { engineId, state: "failed", detail: record.detail };
+  return { engineId, state: "missing" };
+}
+function describeRefused(engineId, input, marker, reason) {
+  const detail = describeEngineInstallRefusal(reason, engineId, input.runnerBin);
+  if (marker && managedEngineBin(engineId, { root: input.root })) {
+    return { engineId, state: "ready", version: marker.version, detail };
+  }
+  return { engineId, state: "missing", detail };
+}
+function rememberFirstSeen(root, engineId, version, now) {
+  const record = readEngineState(root)[engineId];
+  if (record?.firstSeen?.version === version) return;
+  recordEngineInstall(root, engineId, { firstSeen: { version, at: now } });
+}
+function npmPresentOnce() {
+  let answer = null;
+  return () => {
+    if (answer === null) answer = npmPresent();
+    return answer;
+  };
+}
+async function unmanagedVersion(engineId) {
+  try {
+    const health = await getDriver(engineId).healthCheck();
+    if (!health.ok) return null;
+    const match = /(\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?)/.exec(health.detail ?? "");
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// src/jobs/shipEngines.ts
+function enginesForAgents(agents) {
+  return engineSet(agents.map((agent) => agentEngine(agent)));
+}
+function engineSet(engineIds) {
+  const engines = new Set(engineIds);
+  if (engines.size === 0) engines.add(DEFAULT_ENGINE_ID);
+  return engines;
+}
+
+// src/service.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import fs12 from "node:fs";
+import os4 from "node:os";
+import path13 from "node:path";
+import { fileURLToPath } from "node:url";
+var SERVICE_LABEL = `com.kilogent.${RUNNER_BIN.replace(/^kilogent-/, "")}`;
+var LINUX_UNIT = `${RUNNER_BIN}.service`;
+var WINDOWS_TASK = RUNNER_BIN.split("-").map((part) => part[0].toUpperCase() + part.slice(1)).join("");
+var LEGACY_SERVICE_LABEL = "com.lumi.crew-runner";
+var LEGACY_LINUX_UNIT = "crew-runner.service";
+var LEGACY_WINDOWS_TASK = "CrewRunner";
+var RETIRED_SERVICES = [
+  { label: LEGACY_SERVICE_LABEL, unit: LEGACY_LINUX_UNIT, task: LEGACY_WINDOWS_TASK },
+  { label: "com.lumi.runner", unit: "lumi-runner.service", task: "LumiRunner" }
+];
+var ServiceError = class extends Error {
+};
+function run(command, args) {
+  const result = spawnSync2(command, args, { encoding: "utf8" });
+  return {
+    ok: result.status === 0,
+    out: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
+  };
+}
+function cliPath() {
+  return fileURLToPath(import.meta.url);
+}
+function uid() {
+  return String(process.getuid?.() ?? 0);
+}
+function launchAgentPath() {
+  return path13.join(os4.homedir(), "Library/LaunchAgents", `${SERVICE_LABEL}.plist`);
+}
+function systemdUnitPath() {
+  return path13.join(os4.homedir(), ".config/systemd/user", LINUX_UNIT);
+}
+function serviceEnv() {
+  const env = { PATH: process.env.PATH ?? "" };
+  if (process.env.LUMI_RUNNER_HOME || process.env.CREW_RUNNER_HOME) {
+    env.LUMI_RUNNER_HOME = configDir();
+  }
+  return env;
+}
+function serviceEnvDrift(current, installed) {
+  if (!installed) return [];
+  return Object.keys(current).filter((name) => current[name] !== installed[name]).sort();
+}
+function removeLegacyService() {
+  const removed = [];
+  for (const old of RETIRED_SERVICES) {
+    if (old.label === SERVICE_LABEL) continue;
+    if (process.platform === "darwin") {
+      const unitPath = path13.join(os4.homedir(), "Library/LaunchAgents", `${old.label}.plist`);
+      if (fs12.existsSync(unitPath)) {
+        run("launchctl", ["bootout", `gui/${uid()}/${old.label}`]);
+        fs12.rmSync(unitPath, { force: true });
+        removed.push(unitPath);
+      }
+      continue;
+    }
+    if (process.platform === "linux") {
+      const unitPath = path13.join(os4.homedir(), ".config/systemd/user", old.unit);
+      if (fs12.existsSync(unitPath)) {
+        run("systemctl", ["--user", "disable", "--now", old.unit]);
+        fs12.rmSync(unitPath, { force: true });
+        run("systemctl", ["--user", "daemon-reload"]);
+        removed.push(unitPath);
+      }
+      continue;
+    }
+    if (process.platform === "win32") {
+      if (run("schtasks", ["/Query", "/TN", old.task]).ok) {
+        run("schtasks", ["/Delete", "/TN", old.task, "/F"]);
+        removed.push(old.task);
+      }
+    }
+  }
+  return removed;
+}
+var BOOTSTRAP_RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 2e3];
+function isTransientBootstrapError(out) {
+  const text2 = out.toLowerCase();
+  return (
+    // The observed one: `Bootstrap failed: 5: Input/output error`.
+    text2.includes("input/output error") || // Same cause, different report: the old generation is still registered.
+    text2.includes("service already loaded") || text2.includes("service is already loaded") || text2.includes("eexist") || // launchd is mid-teardown and says so.
+    text2.includes("operation already in progress") || text2.includes("operation now in progress")
+  );
+}
+function retryWhileTransient(attempt, wait, delays = BOOTSTRAP_RETRY_DELAYS_MS) {
+  let result = attempt();
+  for (const delay of delays) {
+    if (result.ok || !isTransientBootstrapError(result.out)) return result;
+    wait(delay);
+    result = attempt();
+  }
+  return result;
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function plistXml() {
+  const env = serviceEnv();
+  const envEntries = Object.entries(env).map(([k, v]) => `      <key>${k}</key>
+      <string>${escapeXml(v)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${SERVICE_LABEL}</string>
   <key>ProgramArguments</key>
   <array>
     <string>${escapeXml(process.execPath)}</string>
@@ -4794,9 +5601,9 @@ function plistXml() {
 ${envEntries}
   </dict>
   <key>StandardOutPath</key>
-  <string>${escapeXml(path7.join(logDir(), "service.out.log"))}</string>
+  <string>${escapeXml(path13.join(logDir(), "service.out.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${escapeXml(path7.join(logDir(), "service.err.log"))}</string>
+  <string>${escapeXml(path13.join(logDir(), "service.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -4842,14 +5649,14 @@ function parseSystemdCliPath(unit) {
 function execFacts(unitPath, parse, parseEnv) {
   let text2;
   try {
-    text2 = fs6.readFileSync(unitPath, "utf8");
+    text2 = fs12.readFileSync(unitPath, "utf8");
   } catch {
     return {};
   }
   const unitEnv = parseEnv(text2);
   const execPath = parse(text2);
-  if (!execPath || !path7.isAbsolute(execPath)) return { ...unitEnv ? { unitEnv } : {} };
-  return { execPath, execMissing: !fs6.existsSync(execPath), ...unitEnv ? { unitEnv } : {} };
+  if (!execPath || !path13.isAbsolute(execPath)) return { ...unitEnv ? { unitEnv } : {} };
+  return { execPath, execMissing: !fs12.existsSync(execPath), ...unitEnv ? { unitEnv } : {} };
 }
 function systemdUnit() {
   const env = serviceEnv();
@@ -4875,7 +5682,7 @@ WantedBy=default.target
 function serviceStatus() {
   if (process.platform === "darwin") {
     const unitPath = launchAgentPath();
-    if (!fs6.existsSync(unitPath)) return { state: "not-installed", detail: "No LaunchAgent installed." };
+    if (!fs12.existsSync(unitPath)) return { state: "not-installed", detail: "No LaunchAgent installed." };
     const exec = execFacts(unitPath, parsePlistCliPath, parsePlistEnv);
     const printed = run("launchctl", ["print", `gui/${uid()}/${SERVICE_LABEL}`]);
     if (!printed.ok) {
@@ -4891,7 +5698,7 @@ function serviceStatus() {
   }
   if (process.platform === "linux") {
     const unitPath = systemdUnitPath();
-    if (!fs6.existsSync(unitPath)) return { state: "not-installed", detail: "No systemd user unit installed." };
+    if (!fs12.existsSync(unitPath)) return { state: "not-installed", detail: "No systemd user unit installed." };
     const active = run("systemctl", ["--user", "is-active", LINUX_UNIT]);
     return {
       state: active.out === "active" ? "running" : "installed",
@@ -4913,14 +5720,14 @@ function serviceStatus() {
 }
 function installService() {
   const notes = [];
-  fs6.mkdirSync(logDir(), { recursive: true, mode: 448 });
+  fs12.mkdirSync(logDir(), { recursive: true, mode: 448 });
   for (const unit of removeLegacyService()) {
     notes.push(`Removed the previous crew-runner service (${unit}).`);
   }
   if (process.platform === "darwin") {
     const unitPath = launchAgentPath();
-    fs6.mkdirSync(path7.dirname(unitPath), { recursive: true });
-    fs6.writeFileSync(unitPath, plistXml());
+    fs12.mkdirSync(path13.dirname(unitPath), { recursive: true });
+    fs12.writeFileSync(unitPath, plistXml());
     run("launchctl", ["bootout", `gui/${uid()}/${SERVICE_LABEL}`]);
     const boot = retryWhileTransient(
       () => run("launchctl", ["bootstrap", `gui/${uid()}`, unitPath]),
@@ -4931,272 +5738,91 @@ function installService() {
   }
   if (process.platform === "linux") {
     const unitPath = systemdUnitPath();
-    fs6.mkdirSync(path7.dirname(unitPath), { recursive: true });
-    fs6.writeFileSync(unitPath, systemdUnit());
+    fs12.mkdirSync(path13.dirname(unitPath), { recursive: true });
+    fs12.writeFileSync(unitPath, systemdUnit());
     const reload = run("systemctl", ["--user", "daemon-reload"]);
     if (!reload.ok) throw new ServiceError(`systemctl daemon-reload failed: ${reload.out}`);
     const enable = run("systemctl", ["--user", "enable", "--now", LINUX_UNIT]);
     if (!enable.ok) throw new ServiceError(`systemctl enable failed: ${enable.out}`);
     const linger = run("loginctl", ["show-user", os4.userInfo().username, "--property=Linger"]);
     if (!linger.out.includes("Linger=yes")) {
-      notes.push(
-        `Run \`sudo loginctl enable-linger ${os4.userInfo().username}\` so the daemon survives logout and starts at boot.`
-      );
-    }
-    return { unitPath, notes };
-  }
-  if (process.platform === "win32") {
-    const command = `"${process.execPath}" "${cliPath()}" start`;
-    const create = run("schtasks", [
-      "/Create",
-      "/TN",
-      WINDOWS_TASK,
-      "/TR",
-      command,
-      "/SC",
-      "ONLOGON",
-      "/RL",
-      "LIMITED",
-      "/F"
-    ]);
-    if (!create.ok) throw new ServiceError(`schtasks /Create failed: ${create.out}`);
-    notes.push(
-      "Task Scheduler starts the daemon at logon but does not restart it if it exits. For a true always-on box, run the daemon under pm2 or a Windows service wrapper instead."
-    );
-    return { unitPath: WINDOWS_TASK, notes };
-  }
-  throw new ServiceError(`Service install is not supported on ${process.platform}.`);
-}
-function uninstallService() {
-  removeLegacyService();
-  if (process.platform === "darwin") {
-    run("launchctl", ["bootout", `gui/${uid()}/${SERVICE_LABEL}`]);
-    fs6.rmSync(launchAgentPath(), { force: true });
-    return;
-  }
-  if (process.platform === "linux") {
-    run("systemctl", ["--user", "disable", "--now", LINUX_UNIT]);
-    fs6.rmSync(systemdUnitPath(), { force: true });
-    run("systemctl", ["--user", "daemon-reload"]);
-    return;
-  }
-  if (process.platform === "win32") {
-    run("schtasks", ["/Delete", "/TN", WINDOWS_TASK, "/F"]);
-    return;
-  }
-  throw new ServiceError(`Service uninstall is not supported on ${process.platform}.`);
-}
-function restartService() {
-  if (process.platform === "darwin") {
-    const result = run("launchctl", ["kickstart", "-k", `gui/${uid()}/${SERVICE_LABEL}`]);
-    if (!result.ok) throw new ServiceError(`launchctl kickstart failed: ${result.out}`);
-    return;
-  }
-  if (process.platform === "linux") {
-    const result = run("systemctl", ["--user", "restart", LINUX_UNIT]);
-    if (!result.ok) throw new ServiceError(`systemctl restart failed: ${result.out}`);
-    return;
-  }
-  if (process.platform === "win32") {
-    run("schtasks", ["/End", "/TN", WINDOWS_TASK]);
-    const result = run("schtasks", ["/Run", "/TN", WINDOWS_TASK]);
-    if (!result.ok) throw new ServiceError(`schtasks /Run failed: ${result.out}`);
-    return;
-  }
-  throw new ServiceError(`Service restart is not supported on ${process.platform}.`);
-}
-
-// src/update/plan.ts
-import path8 from "node:path";
-
-// src/update/semver.ts
-var DEV_VERSION = "0.0.0-dev";
-var NUMERIC = /^(0|[1-9]\d*)$/;
-function parseVersion(raw) {
-  if (typeof raw !== "string") return null;
-  const trimmed = raw.trim();
-  if (!trimmed) return null;
-  const [withoutBuild] = trimmed.split("+", 1);
-  const dash = withoutBuild.indexOf("-");
-  const core = dash < 0 ? withoutBuild : withoutBuild.slice(0, dash);
-  const pre = dash < 0 ? "" : withoutBuild.slice(dash + 1);
-  const parts = core.split(".");
-  if (parts.length !== 3) return null;
-  if (!parts.every((p) => NUMERIC.test(p))) return null;
-  const [major, minor, patch] = parts.map(Number);
-  if (dash >= 0 && pre === "") return null;
-  const prerelease = pre === "" ? [] : pre.split(".");
-  if (prerelease.some((id) => id === "")) return null;
-  return {
-    major,
-    minor,
-    patch,
-    prerelease: prerelease.map((id) => NUMERIC.test(id) ? Number(id) : id)
-  };
-}
-function comparePrerelease(a, b) {
-  if (a.length === 0) return b.length === 0 ? 0 : 1;
-  if (b.length === 0) return -1;
-  for (let i = 0; i < Math.min(a.length, b.length); i++) {
-    const x = a[i];
-    const y = b[i];
-    if (x === y) continue;
-    const xNum = typeof x === "number";
-    const yNum = typeof y === "number";
-    if (xNum !== yNum) return xNum ? -1 : 1;
-    if (xNum && yNum) return x < y ? -1 : 1;
-    return x < y ? -1 : 1;
-  }
-  if (a.length === b.length) return 0;
-  return a.length < b.length ? -1 : 1;
-}
-function compareVersions(a, b) {
-  for (const key of ["major", "minor", "patch"]) {
-    if (a[key] !== b[key]) return a[key] < b[key] ? -1 : 1;
-  }
-  return comparePrerelease(a.prerelease, b.prerelease);
-}
-function isNewer(candidate, current) {
-  if (current === DEV_VERSION) return false;
-  const a = parseVersion(candidate);
-  const b = parseVersion(current);
-  if (!a || !b) return false;
-  return compareVersions(a, b) === 1;
-}
-
-// src/update/plan.ts
-var PACKAGE_NAME = RUNNER_PACKAGE;
-var UPDATE_DIST_TAG = "latest";
-var UPDATE_CHECK_MS = 30 * 6e4;
-var UPDATE_FIRST_CHECK_MS = 2 * 6e4;
-var UPDATE_JITTER_MS = 10 * 6e4;
-var CHECK_MINUTES_MIN = 5;
-var CHECK_MINUTES_MAX = 24 * 60;
-var UPDATE_DRAIN_MAX_MS = 30 * 6e4;
-var MAX_UPDATE_ATTEMPTS = 3;
-var UPDATE_BACKOFF_MS = [15 * 6e4, 2 * 36e5, 12 * 36e5];
-function checkIntervalMs(config2) {
-  const raw = config2.updateCheckMinutes;
-  if (typeof raw !== "number" || !Number.isFinite(raw)) return UPDATE_CHECK_MS;
-  const clamped2 = Math.min(CHECK_MINUTES_MAX, Math.max(CHECK_MINUTES_MIN, Math.floor(raw)));
-  return clamped2 * 6e4;
-}
-function nextAttemptAllowed(state, target, now) {
-  if (!state || typeof state !== "object") return { allowed: true };
-  if (state.target !== target) return { allowed: true };
-  const attempts = typeof state.attempts === "number" && state.attempts > 0 ? state.attempts : 0;
-  if (attempts === 0) return { allowed: true };
-  if (attempts >= MAX_UPDATE_ATTEMPTS) return { allowed: false, reason: "exhausted" };
-  if (typeof state.at !== "number" || !Number.isFinite(state.at)) return { allowed: true };
-  const wait = UPDATE_BACKOFF_MS[Math.min(attempts - 1, UPDATE_BACKOFF_MS.length - 1)];
-  return now - state.at >= wait ? { allowed: true } : { allowed: false, reason: "backoff" };
-}
-function reconcile(state, current) {
-  if (!state || typeof state.target !== "string") return { action: "none" };
-  if (state.target === current) return { action: "clear", target: state.target };
-  return { action: "keep", state };
-}
-function packageRootFrom(cliPath2) {
-  return path8.dirname(path8.dirname(cliPath2));
-}
-function globalPrefixFrom(cliPath2) {
-  const root = packageRootFrom(cliPath2);
-  const parts = root.split(path8.sep);
-  const i = parts.lastIndexOf("node_modules");
-  if (i < 1) return null;
-  const before = parts.slice(0, i);
-  if (before[before.length - 1] === "lib") before.pop();
-  const prefix = before.join(path8.sep);
-  return prefix || null;
-}
-function decideUpdate(f) {
-  if (f.platform === "win32") return { update: false, reason: "windows" };
-  if (f.current === DEV_VERSION) return { update: false, reason: "dev-build" };
-  if (!f.autoUpdate) return { update: false, reason: "disabled" };
-  const service2 = f.service();
-  if (service2.state !== "running") return { update: false, reason: "service-not-running" };
-  if (!service2.execPath || service2.execPath !== f.cliPath) {
-    return { update: false, reason: "foreign-unit" };
+      notes.push(
+        `Run \`sudo loginctl enable-linger ${os4.userInfo().username}\` so the daemon survives logout and starts at boot.`
+      );
+    }
+    return { unitPath, notes };
   }
-  if (!f.npmPresent()) return { update: false, reason: "no-npm" };
-  if (f.distTags === null) return { update: false, reason: "registry-unreachable" };
-  const target = f.distTags[UPDATE_DIST_TAG];
-  if (!target) return { update: false, reason: "no-such-tag" };
-  if (!isNewer(target, f.current)) return { update: false, reason: "up-to-date" };
-  const attempt = nextAttemptAllowed(f.state, target, f.now);
-  if (!attempt.allowed) return { update: false, reason: attempt.reason };
-  return { update: true, target };
-}
-function describeRefusal(reason, f) {
-  switch (reason) {
-    case "windows":
-      return `Auto-update is not available on Windows \u2014 run \`${RUNNER_BIN} update\` to upgrade.`;
-    case "dev-build":
-      return "Development build \u2014 auto-update is off.";
-    case "disabled":
-      return `Auto-update is off (\`${RUNNER_BIN} config set autoUpdate on\` to enable).`;
-    case "service-not-running":
-      return `Auto-update needs the background service (this daemon would have nothing to restart it). Run \`${RUNNER_BIN} service install\`, or \`${RUNNER_BIN} update\` by hand.`;
-    case "foreign-unit":
-      return `This process is not the one the installed service runs, so auto-update is off for it. Run \`${RUNNER_BIN} update\` if you meant to upgrade the installed copy.`;
-    case "no-npm":
-      return "Auto-update needs `npm` on the service PATH and could not find it.";
-    case "registry-unreachable":
-      return "Could not reach the npm registry to check for updates \u2014 will retry.";
-    case "no-such-tag":
-      return `The npm registry has no release of ${PACKAGE_NAME} yet.`;
-    case "up-to-date":
-      return `Up to date (${f.current}).`;
-    case "backoff":
-      return "A recent update attempt did not take \u2014 waiting before trying again.";
-    case "exhausted":
-      return `Gave up updating after ${MAX_UPDATE_ATTEMPTS} attempts. Still on ${f.current} \u2014 run \`${RUNNER_BIN} update\` to see why, or wait for the next release.`;
+  if (process.platform === "win32") {
+    const command = `"${process.execPath}" "${cliPath()}" start`;
+    const create = run("schtasks", [
+      "/Create",
+      "/TN",
+      WINDOWS_TASK,
+      "/TR",
+      command,
+      "/SC",
+      "ONLOGON",
+      "/RL",
+      "LIMITED",
+      "/F"
+    ]);
+    if (!create.ok) throw new ServiceError(`schtasks /Create failed: ${create.out}`);
+    notes.push(
+      "Task Scheduler starts the daemon at logon but does not restart it if it exits. For a true always-on box, run the daemon under pm2 or a Windows service wrapper instead."
+    );
+    return { unitPath: WINDOWS_TASK, notes };
   }
+  throw new ServiceError(`Service install is not supported on ${process.platform}.`);
 }
-
-// src/update/registry.ts
-var DEFAULT_REGISTRY = "https://registry.npmjs.org";
-var REGISTRY_TIMEOUT_MS = 1e4;
-function registryBase(env = process.env) {
-  return (env.LUMI_RUNNER_REGISTRY || DEFAULT_REGISTRY).replace(/\/+$/, "");
+function uninstallService() {
+  removeLegacyService();
+  if (process.platform === "darwin") {
+    run("launchctl", ["bootout", `gui/${uid()}/${SERVICE_LABEL}`]);
+    fs12.rmSync(launchAgentPath(), { force: true });
+    return;
+  }
+  if (process.platform === "linux") {
+    run("systemctl", ["--user", "disable", "--now", LINUX_UNIT]);
+    fs12.rmSync(systemdUnitPath(), { force: true });
+    run("systemctl", ["--user", "daemon-reload"]);
+    return;
+  }
+  if (process.platform === "win32") {
+    run("schtasks", ["/Delete", "/TN", WINDOWS_TASK, "/F"]);
+    return;
+  }
+  throw new ServiceError(`Service uninstall is not supported on ${process.platform}.`);
 }
-async function fetchDistTags(options = {}) {
-  const base = options.registry ?? registryBase();
-  const doFetch = options.fetchImpl ?? fetch;
-  const url = `${base}/${encodeURIComponent(PACKAGE_NAME)}`;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? REGISTRY_TIMEOUT_MS);
-  try {
-    const response = await doFetch(url, {
-      headers: { accept: "application/vnd.npm.install-v1+json" },
-      signal: controller.signal
-    });
-    if (!response.ok) return null;
-    const body = await response.json();
-    const tags = body?.["dist-tags"];
-    if (!tags || typeof tags !== "object" || Array.isArray(tags)) return null;
-    const out = {};
-    for (const [tag, version] of Object.entries(tags)) {
-      if (typeof version === "string") out[tag] = version;
-    }
-    return out;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
+function restartService() {
+  if (process.platform === "darwin") {
+    const result = run("launchctl", ["kickstart", "-k", `gui/${uid()}/${SERVICE_LABEL}`]);
+    if (!result.ok) throw new ServiceError(`launchctl kickstart failed: ${result.out}`);
+    return;
+  }
+  if (process.platform === "linux") {
+    const result = run("systemctl", ["--user", "restart", LINUX_UNIT]);
+    if (!result.ok) throw new ServiceError(`systemctl restart failed: ${result.out}`);
+    return;
+  }
+  if (process.platform === "win32") {
+    run("schtasks", ["/End", "/TN", WINDOWS_TASK]);
+    const result = run("schtasks", ["/Run", "/TN", WINDOWS_TASK]);
+    if (!result.ok) throw new ServiceError(`schtasks /Run failed: ${result.out}`);
+    return;
   }
+  throw new ServiceError(`Service restart is not supported on ${process.platform}.`);
 }
 
 // src/update/state.ts
-import fs7 from "node:fs";
-import path9 from "node:path";
+import fs13 from "node:fs";
+import path14 from "node:path";
 var UPDATE_STATE_FILE = "update.json";
 function updateStatePath() {
-  return path9.join(configDir(), UPDATE_STATE_FILE);
+  return path14.join(configDir(), UPDATE_STATE_FILE);
 }
 function readUpdateState() {
   try {
-    const parsed = JSON.parse(fs7.readFileSync(updateStatePath(), "utf8"));
+    const parsed = JSON.parse(fs13.readFileSync(updateStatePath(), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -5205,8 +5831,8 @@ function readUpdateState() {
 }
 function writeUpdateState(state) {
   try {
-    fs7.mkdirSync(configDir(), { recursive: true, mode: 448 });
-    fs7.writeFileSync(updateStatePath(), `${JSON.stringify(state, null, 2)}
+    fs13.mkdirSync(configDir(), { recursive: true, mode: 448 });
+    fs13.writeFileSync(updateStatePath(), `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
     return true;
   } catch {
@@ -5215,75 +5841,8 @@ function writeUpdateState(state) {
 }
 function clearUpdateState() {
   try {
-    fs7.rmSync(updateStatePath(), { force: true });
-  } catch {
-  }
-}
-
-// src/update/install.ts
-import { spawn as spawn6, spawnSync as spawnSync2 } from "node:child_process";
-import fs8 from "node:fs";
-import path10 from "node:path";
-var INSTALL_TIMEOUT_MS = 5 * 6e4;
-var STDERR_KEEP = 400;
-function npmPresent() {
-  const probe2 = process.platform === "win32" ? "where" : "which";
-  try {
-    return spawnSync2(probe2, ["npm"], { encoding: "utf8" }).status === 0;
-  } catch {
-    return false;
-  }
-}
-function installArgs(target, cliPath2) {
-  const args = ["install", "--global", "--no-fund", "--no-audit", `${PACKAGE_NAME}@${target}`];
-  const prefix = globalPrefixFrom(cliPath2);
-  if (prefix) args.push("--prefix", prefix);
-  return args;
-}
-async function installGlobal(target, cliPath2, options = {}) {
-  const args = installArgs(target, cliPath2);
-  return new Promise((resolve) => {
-    let child;
-    try {
-      child = spawn6("npm", args, { stdio: ["ignore", "ignore", "pipe"] });
-    } catch (e) {
-      resolve({ ok: false, detail: e instanceof Error ? e.message : String(e) });
-      return;
-    }
-    let stderr = "";
-    child.stderr?.on("data", (chunk) => {
-      stderr = `${stderr}${chunk.toString()}`.slice(-STDERR_KEEP);
-    });
-    let settled = false;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve(result);
-    };
-    const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS;
-    const timer = setTimeout(() => {
-      child.kill("SIGTERM");
-      setTimeout(() => child.kill("SIGKILL"), 5e3).unref();
-      finish({ ok: false, detail: `npm install timed out after ${timeoutMs / 6e4} minutes.` });
-    }, timeoutMs);
-    timer.unref();
-    child.on("error", (e) => finish({ ok: false, detail: e.message }));
-    child.on(
-      "close",
-      (code) => finish({ ok: code === 0, detail: stderr.trim() || `npm exited ${code}` })
-    );
-  });
-}
-function installedVersionAt(cliPath2) {
-  try {
-    const pkg = JSON.parse(
-      fs8.readFileSync(path10.join(packageRootFrom(cliPath2), "package.json"), "utf8")
-    );
-    const version = pkg?.version;
-    return typeof version === "string" ? version : null;
+    fs13.rmSync(updateStatePath(), { force: true });
   } catch {
-    return null;
   }
 }
 
@@ -5406,7 +5965,12 @@ async function startDaemon() {
               // published: `hasOnly()` fails the whole write for one unlisted key, which would
               // take every heartbeat down, not just the badge.
               updateAvailable: updateAvailableVersion,
-              updatePhase
+              updatePhase,
+              // §15.82, and the same rule the paragraph above states: `engineTools` must be in
+              // `liveFields()` in the DEPLOYED rules before this version is published. It shipped
+              // in its own change ahead of this one for exactly that reason. `null` when the
+              // machine has nothing to say, so a badge clears itself.
+              engineTools: engineToolStates.size > 0 ? [...engineToolStates.values()] : null
             },
             { merge: true }
           );
@@ -5578,8 +6142,8 @@ async function startDaemon() {
             held.delete(id);
             loginsInFlight.get(id)?.abort();
             for (const dir of orphanHomes(configDir(), shipId, new Set(list.map((c) => c.id)))) {
-              if (!dir.endsWith(`${path11.sep}${id}`)) continue;
-              const engineId = path11.basename(path11.dirname(path11.dirname(dir)));
+              if (!dir.endsWith(`${path15.sep}${id}`)) continue;
+              const engineId = path15.basename(path15.dirname(path15.dirname(dir)));
               const driver = getDriver(engineId);
               if (!driver.login) continue;
               void logoutAndRemove({ driver: driver.login, bin: driver.binary(), home: dir, log: log2 }).then(
@@ -5589,7 +6153,7 @@ async function startDaemon() {
           }
           if (!heldCredentialIds.has(shipId)) {
             for (const dir of orphanHomes(configDir(), shipId, new Set(list.map((c) => c.id)))) {
-              const engineId = path11.basename(path11.dirname(path11.dirname(dir)));
+              const engineId = path15.basename(path15.dirname(path15.dirname(dir)));
               const driver = getDriver(engineId);
               if (!driver.login) continue;
               void logoutAndRemove({ driver: driver.login, bin: driver.binary(), home: dir, log: log2 }).then(
@@ -5623,7 +6187,9 @@ async function startDaemon() {
               credential,
               root: configDir(),
               signal: abort.signal,
-              log: log2
+              log: log2,
+              // §15.82 — a captain asking a machine to sign in is also asking it to have the CLI.
+              ensureEngine: (engineId) => ensureEngineForCaller(engineId)
             }).catch((e) => log2(`Sign-in for ${credential.id} ended abnormally: ${e instanceof Error ? e.message : e}`)).finally(() => loginsInFlight.delete(credential.id));
           }
           poke();
@@ -5678,12 +6244,12 @@ async function startDaemon() {
     heldCredentialIds.delete(shipId);
     for (const engineId of (() => {
       try {
-        return fs9.readdirSync(path11.join(configDir(), "engines"));
+        return fs14.readdirSync(path15.join(configDir(), "engines"));
       } catch {
         return [];
       }
     })()) {
-      fs9.rmSync(path11.join(configDir(), "engines", engineId, shipId), { recursive: true, force: true });
+      fs14.rmSync(path15.join(configDir(), "engines", engineId, shipId), { recursive: true, force: true });
     }
     approved.delete(shipId);
     warnedUnapproved.delete(shipId);
@@ -5722,6 +6288,11 @@ async function startDaemon() {
       DEFAULT_ENGINE_ID
     );
   };
+  function engineUsable(engineId) {
+    const state = engineToolStates.get(engineId);
+    if (!state) return true;
+    return state.state !== "installing";
+  }
   let dispatching = false;
   let pokeRequested = false;
   let shuttingDown = false;
@@ -5730,6 +6301,10 @@ async function startDaemon() {
   let nextUpdateCheckAt = Date.now() + UPDATE_FIRST_CHECK_MS + Math.floor(Math.random() * UPDATE_JITTER_MS);
   let updateAvailableVersion = null;
   let updatePhase = null;
+  const engineToolStates = /* @__PURE__ */ new Map();
+  let checkingEngines = false;
+  let nextEngineCheckAt = Date.now() + ENGINE_FIRST_CHECK_MS + Math.floor(Math.random() * UPDATE_JITTER_MS);
+  const loggedEngineRefusals = /* @__PURE__ */ new Set();
   function poke() {
     if (dispatching || shuttingDown || updating) {
       pokeRequested = !shuttingDown && !updating;
@@ -5798,7 +6373,13 @@ async function startDaemon() {
           // `pending`, which is what lets a reset resume them with only a poke.
           eligible: (p) => approved.get(p.shipId) === true && !isLimited(engineLimits, p.shipId, engineForJob(p.shipId, p.job), now) && // §15.81: a job on a machine-held credential is that machine's job. Skipped entries
           // STAY in `pending`; the credentials listener pokes when the sign-in lands.
-          credentialVerdict(p.shipId, p.job) === "ok" && // The connection cooldown. Same "skip, don't stop" shape as the limit gate above, and
+          credentialVerdict(p.shipId, p.job) === "ok" && // §15.82: a machine that cannot run this engine should not take work it will fail.
+          // Skipped entries STAY in `pending` and the engine check pokes when an install lands
+          // — but only while the install is still going to happen. Once it is refused for good
+          // the job IS claimed and fails with the driver's own message, because a job that never
+          // runs and never fails is invisible, while a failed one at least names the missing CLI
+          // (`E10`, `A21`).
+          engineUsable(engineForJob(p.shipId, p.job)) && // The connection cooldown. Same "skip, don't stop" shape as the limit gate above, and
           // skipped entries STAY in `pending` for the same reason — `sweepBackoff` resumes them
           // with a poke. Without this the `transient` release below re-claims what it just put
           // down, every three seconds, forever (jobs/claimBackoff.ts).
@@ -6087,7 +6668,7 @@ async function startDaemon() {
         // `mcpSecretsToRedact` for why one of them is not enough.
         ...mcpSecretsToRedact(extraMcpServers)
       ];
-      const session = await getDriver(engineId).run({
+      const runSession3 = () => getDriver(engineId).run({
         prompt,
         agent,
         job,
@@ -6105,6 +6686,21 @@ async function startDaemon() {
         // swallows everything.
         onStep: (step2) => progress.push(step2)
       });
+      let session = await runSession3();
+      if (session.engineFault && !slot.abort.signal.aborted) {
+        const rolledBackTo = await rollBackEngine(engineId, session.engineFault, log2);
+        if (rolledBackTo) {
+          log2(`Re-running this job on ${engineId} ${rolledBackTo.goodVersion} to find out whether ${rolledBackTo.badVersion} was the cause.`);
+          const second = await runSession3();
+          if (second.ok) {
+            log2(`It was: ${engineId} ${rolledBackTo.badVersion} is broken, and this machine is reporting it.`);
+            void reportBrokenEngineVersion(shipId, engineId, rolledBackTo, job.id);
+          } else {
+            log2(`It was not the version \u2014 ${engineId} ${rolledBackTo.badVersion} is left alone.`);
+          }
+          session = second;
+        }
+      }
       transcript = redactTranscript(
         session.transcript,
         knownSecrets,
@@ -6303,6 +6899,7 @@ async function startDaemon() {
     void heartbeat();
     sweepLimits();
     void maybeCheckForUpdate();
+    void maybeCheckEngines();
   }, HEARTBEAT_MS);
   let stopping = false;
   const shutdown = async (reason) => {
@@ -6403,6 +7000,104 @@ async function startDaemon() {
       nextUpdateCheckAt = Date.now() + checkIntervalMs(config2);
     }
   }
+  async function ensureEngineForCaller(engineId) {
+    const shipIds = [...byShip.keys()];
+    const policySnap = shipIds.length ? await getDoc8(doc9(sess(shipIds[0]).fb.db, COLLECTIONS.crewConfig, CONFIG_DOCS.engines)).catch(() => null) : null;
+    const result = await ensureEngineReady(engineId, {
+      root: configDir(),
+      runnerBin: RUNNER_BIN,
+      autoInstall: engineInstallAllowed(config2),
+      policyDoc: policySnap?.exists() ? policySnap.data() : null,
+      log: (line) => log2(line),
+      onState: (state) => {
+        engineToolStates.set(state.engineId, state);
+        void heartbeat();
+      }
+    });
+    void maybeCheckEnginesSoon();
+    return result;
+  }
+  function maybeCheckEnginesSoon() {
+    nextEngineCheckAt = 0;
+  }
+  async function rollBackEngine(engineId, fault, say2) {
+    const root = configDir();
+    const marker = readEngineMarker(root, engineId);
+    if (!marker || !managedEngineBin(engineId, { root })) return null;
+    const shipIds = [...byShip.keys()];
+    const policySnap = shipIds.length ? await getDoc8(doc9(sess(shipIds[0]).fb.db, COLLECTIONS.crewConfig, CONFIG_DOCS.engines)).catch(() => null) : null;
+    const policy = resolveEnginePolicy(engineId, policySnap?.exists() ? policySnap.data() : null);
+    if (!policy.knownGood || policy.knownGood === marker.version) return null;
+    say2(`A ${engineId} session failed before the model did anything: ${fault}`);
+    say2(`Putting ${engineId} ${policy.knownGood} back to check whether ${marker.version} is at fault.`);
+    const outcome = await installEngine({
+      root,
+      engineId,
+      version: policy.knownGood,
+      healthCheck: (bin) => getDriver(engineId).healthCheck(bin),
+      log: say2
+    });
+    if (!outcome.ok) {
+      say2(`Could not put ${engineId} ${policy.knownGood} back: ${outcome.detail.slice(0, 200)}`);
+      return null;
+    }
+    maybeCheckEnginesSoon();
+    return { badVersion: marker.version, goodVersion: policy.knownGood };
+  }
+  async function reportBrokenEngineVersion(shipId, engineId, versions, jobId) {
+    try {
+      const idToken = await sess(shipId).user.getIdToken();
+      await callFunction(functionsBaseUrl(config2), idToken, "crewShips", "reportEngineVersion", {
+        shipId,
+        engineId,
+        badVersion: versions.badVersion,
+        goodVersion: versions.goodVersion,
+        jobId
+      });
+    } catch (e) {
+      log2(`Could not report ${engineId} ${versions.badVersion} as broken: ${e instanceof Error ? e.message : e}`);
+    }
+  }
+  async function maybeCheckEngines() {
+    if (checkingEngines || shuttingDown || Date.now() < nextEngineCheckAt) return;
+    const shipIds = [...byShip.keys()];
+    if (shipIds.length === 0) return;
+    checkingEngines = true;
+    try {
+      const engineIds = engineSet(agentEngines.values());
+      const firstShip = shipIds[0];
+      const policySnap = await getDoc8(
+        doc9(sess(firstShip).fb.db, COLLECTIONS.crewConfig, CONFIG_DOCS.engines)
+      ).catch(() => null);
+      const states = await refreshEngineTools({
+        engineIds,
+        root: configDir(),
+        runnerBin: RUNNER_BIN,
+        autoInstall: engineInstallAllowed(config2),
+        policyDoc: policySnap?.exists() ? policySnap.data() : null,
+        log: (line) => log2(line),
+        onState: (state) => {
+          engineToolStates.set(state.engineId, state);
+          void heartbeat();
+        }
+      });
+      for (const state of states) {
+        const key = `${state.engineId}:${state.state}:${state.detail ?? ""}`;
+        if ((state.state === "missing" || state.state === "failed") && !loggedEngineRefusals.has(key)) {
+          loggedEngineRefusals.add(key);
+          log2(`Engine "${state.engineId}": ${state.detail ?? "not installed on this machine"}`);
+        }
+        if (state.state === "ready") loggedEngineRefusals.delete(key);
+        engineToolStates.set(state.engineId, state);
+      }
+      poke();
+    } catch (e) {
+      log2(`Engine check failed: ${e instanceof Error ? e.message : e}`);
+    } finally {
+      checkingEngines = false;
+      nextEngineCheckAt = Date.now() + ENGINE_CHECK_MS;
+    }
+  }
   function beginUpdate(target) {
     updating = { target };
     updateAvailableVersion = target;
@@ -6629,7 +7324,8 @@ function glyph(level) {
 var TOGGLES = {
   notifications: "Desktop notifications when a job starts, finishes or fails (off by default)",
   keepAwake: "Keep this machine awake while a job is running",
-  autoUpdate: "Install new versions of the runner by itself and restart (PRD \xA715.37)"
+  autoUpdate: "Install new versions of the runner by itself and restart (PRD \xA715.37)",
+  autoInstallEngines: "Install the engine CLIs this machine's crews need \u2014 a few hundred MB each (PRD \xA715.82)"
 };
 var PARALLEL = "parallel";
 var PARALLEL_HELP = "How many jobs to run at once (1 = one at a time, as before)";
@@ -6821,8 +7517,8 @@ function setParallel(config2, value, ship2) {
 
 // src/cli/commands/doctor.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import fs10 from "node:fs";
-import path12 from "node:path";
+import fs15 from "node:fs";
+import path16 from "node:path";
 import { collection as collection9, doc as doc10, getDoc as getDoc9, getDocs as getDocs8 } from "firebase/firestore";
 
 // src/cli/session.ts
@@ -6898,7 +7594,7 @@ function serviceBinaryCheckFrom(input) {
   if (status.state === "not-installed" || status.state === "unsupported") return null;
   const pathValue = status.unitEnv?.PATH;
   if (pathValue === void 0) return null;
-  const relative = [...new Set(binaries)].filter((b) => !path12.isAbsolute(b));
+  const relative = [...new Set(binaries)].filter((b) => !path16.isAbsolute(b));
   if (relative.length === 0) return null;
   const missing = relative.filter((b) => !resolves(b, pathValue));
   const id = "service:path";
@@ -6914,10 +7610,10 @@ function serviceBinaryCheckFrom(input) {
   );
 }
 function resolvesOnPath(binary, pathValue) {
-  for (const dir of pathValue.split(path12.delimiter)) {
+  for (const dir of pathValue.split(path16.delimiter)) {
     if (!dir) continue;
     try {
-      fs10.accessSync(path12.join(dir, binary), fs10.constants.X_OK);
+      fs15.accessSync(path16.join(dir, binary), fs15.constants.X_OK);
       return true;
     } catch {
     }
@@ -7037,8 +7733,7 @@ async function checkShips(config2) {
       agents = snap.docs.map((d) => ({ id: d.id, ...d.data() }));
     } catch {
     }
-    const shipEngines = new Set(agents.map((agent) => agentEngine(agent)));
-    if (shipEngines.size === 0) shipEngines.add(DEFAULT_ENGINE_ID);
+    const shipEngines = enginesForAgents(agents);
     for (const id of shipEngines) engines.add(id);
     if (agents.some((agent) => effectiveAgentTools(agent).github.enabled)) needsGithub = true;
     try {
@@ -7173,9 +7868,20 @@ async function runDoctor() {
   for (const engineId of engines) {
     const health = await getDriver(engineId).healthCheck();
     if (health.binary) jobBinaries.push(health.binary);
+    const managed = managedEngineBin(engineId, {});
+    const version = managed ? readEngineMarker(configDir(), engineId)?.version : null;
+    const origin = managed ? ` \u2014 installed by this runner${version ? ` (${version})` : ""}` : health.binary && health.binary !== engineId ? " \u2014 from CREW_*_BIN" : " \u2014 already on this machine";
     checks.push(
-      health.ok ? ok(`engine:${engineId}`, `Engine "${engineId}"`, health.detail) : fail(`engine:${engineId}`, `Engine "${engineId}"`, health.detail, health.fix)
+      health.ok ? ok(`engine:${engineId}`, `Engine "${engineId}"`, `${health.detail}${origin}`) : fail(
+        `engine:${engineId}`,
+        `Engine "${engineId}"`,
+        health.detail,
+        // A way forward the operator can type, ahead of the vendor's download page: this
+        // runner installs it itself, and the old message never said so.
+        enginePackageFor(engineId) ? `Run \`${RUNNER_BIN} engine install ${engineId}\` (a few hundred MB), or ${health.fix ?? "install the CLI yourself"}` : health.fix
+      )
     );
+    if (managed) jobBinaries.push("node");
   }
   if (needsGithub) {
     for (const binary of ["git", "gh"]) {
@@ -7231,8 +7937,142 @@ function report2(checks) {
   return failed.length === 0 ? 0 : 1;
 }
 
+// src/cli/commands/engine.ts
+import fs16 from "node:fs";
+function originOf(engineId) {
+  const override = process.env[`CREW_${engineId.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_BIN`];
+  if (override) return { origin: "override", bin: override, version: null };
+  const managed = managedEngineBin(engineId, {});
+  if (managed) return { origin: "runner", bin: managed, version: readEngineMarker(configDir(), engineId)?.version ?? null };
+  return { origin: "none", bin: null, version: null };
+}
+async function runEngineList() {
+  const root = configDir();
+  const state = readEngineState(root);
+  const rows = [];
+  for (const engineId of installableEngineIds()) {
+    const pkg = enginePackageFor(engineId);
+    const { origin, bin, version } = originOf(engineId);
+    const health = await getDriver(engineId).healthCheck();
+    const record = state[engineId];
+    rows.push({
+      engine: engineId,
+      label: getEngine(engineId)?.label ?? engineId,
+      package: pkg?.npmPackage ?? null,
+      shipped: DEFAULT_ENGINE_POLICIES[engineId]?.knownGood ?? null,
+      installed: version,
+      origin: origin === "none" && health.ok ? "path" : origin,
+      binary: bin ?? health.binary ?? null,
+      ok: health.ok,
+      detail: health.ok ? void 0 : health.detail,
+      lastAttempt: record ? { target: record.target, outcome: record.outcome, attempts: record.attempts, detail: record.detail } : null,
+      diskBytes: dirSize(enginePrefixDir(root, engineId))
+    });
+  }
+  if (isJson()) {
+    emitJson({ autoInstall: engineInstallAllowed(loadConfig()), engines: rows });
+    return 0;
+  }
+  say.line(`Engine CLIs (${engineInstallAllowed(loadConfig()) ? "installed automatically" : "automatic installs are OFF"})`);
+  for (const row of rows) {
+    const where6 = row.origin === "runner" ? "installed by this runner" : row.origin === "override" ? "from CREW_*_BIN" : row.origin === "path" ? "already on this machine \u2014 this runner cannot update or roll it back" : "not installed";
+    say.line("");
+    say.line(`  ${row.label} (${row.engine})`);
+    say.line(`    ${row.ok ? "\u2713" : "\u2717"} ${row.binary ?? row.package ?? row.engine} \u2014 ${where6}`);
+    if (row.installed) say.line(`    version ${row.installed}${row.diskBytes ? ` \xB7 ${mb(row.diskBytes)}` : ""}`);
+    if (!row.ok && row.detail) say.line(`    ${row.detail}`);
+    if (row.lastAttempt?.outcome === "failed" && row.lastAttempt.detail) {
+      say.line(`    last attempt (${row.lastAttempt.target}, ${row.lastAttempt.attempts}x): ${row.lastAttempt.detail}`);
+    }
+  }
+  say.line("");
+  say.line(`  A CLI is a few hundred MB. \`${RUNNER_BIN} config set autoInstallEngines off\` declines them.`);
+  return 0;
+}
+async function runEngineInstall(engineIds, options = {}) {
+  const root = configDir();
+  const wanted = engineIds.length > 0 ? engineIds : installableEngineIds();
+  const results = [];
+  for (const engineId of wanted) {
+    const pkg = enginePackageFor(engineId);
+    if (!pkg) throw new CliError(`This runner has no installer for "${engineId}". Known: ${installableEngineIds().join(", ")}.`);
+    const version = DEFAULT_ENGINE_POLICIES[engineId]?.knownGood;
+    if (!version) throw new CliError(`This runner has no version recorded for "${engineId}".`);
+    const marker = readEngineMarker(root, engineId);
+    const already = Boolean(marker && marker.npmPackage === pkg.npmPackage && marker.version === version && managedEngineBin(engineId, {}));
+    if (options.check || options.dryRun) {
+      results.push({
+        engine: engineId,
+        package: pkg.npmPackage,
+        version,
+        installed: false,
+        alreadyInstalled: already,
+        command: `npm ${engineInstallArgs(pkg, version, enginePrefixDir(root, engineId)).join(" ")}`
+      });
+      continue;
+    }
+    if (already && !options.force) {
+      say.info(`${engineId} is already at ${version} \u2014 pass --force to reinstall.`);
+      results.push({ engine: engineId, package: pkg.npmPackage, version, installed: false, alreadyInstalled: true });
+      continue;
+    }
+    const outcome = await installEngine({
+      root,
+      engineId,
+      version,
+      healthCheck: (bin) => getDriver(engineId).healthCheck(bin),
+      // An install takes minutes, so it narrates — but `--json` promises that stdout is ONE
+      // document, and a caller piping this into a parser must not have to strip progress out of
+      // it. Under `--json` the same lines go to stderr, where a person still sees them.
+      log: (line) => isJson() ? console.error(line) : say.line(`  ${line}`)
+    });
+    if (!outcome.ok) throw new CliError(`Could not install ${pkg.npmPackage}@${version}: ${outcome.detail}`);
+    results.push({ engine: engineId, package: pkg.npmPackage, version, installed: true, alreadyInstalled: false, binary: outcome.bin });
+  }
+  if (isJson()) {
+    emitJson({ engines: results });
+    return 0;
+  }
+  for (const r of results) {
+    if (r.command) say.info(`Would run: ${r.command}`);
+    else if (r.installed) say.line(`\u2713 ${r.engine} \u2014 ${r.package}@${r.version}`);
+  }
+  return 0;
+}
+async function runEngineUninstall(engineId) {
+  if (!enginePackageFor(engineId)) throw new CliError(`This runner has no installer for "${engineId}".`);
+  const dir = enginePrefixDir(configDir(), engineId);
+  const existed = fs16.existsSync(dir);
+  fs16.rmSync(dir, { recursive: true, force: true });
+  if (isJson()) {
+    emitJson({ engine: engineId, removed: existed, directory: dir });
+    return 0;
+  }
+  say.line(existed ? `Removed this runner's copy of ${engineId} (${dir}).` : `This runner had no copy of ${engineId}.`);
+  say.line("A copy you installed yourself is untouched.");
+  return 0;
+}
+function dirSize(dir) {
+  try {
+    let total = 0;
+    for (const entry of fs16.readdirSync(dir, { recursive: true, withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      try {
+        total += fs16.statSync(`${entry.parentPath ?? entry.path}/${entry.name}`).size;
+      } catch {
+      }
+    }
+    return total || null;
+  } catch {
+    return null;
+  }
+}
+function mb(bytes) {
+  return `${Math.round(bytes / 1e6)} MB`;
+}
+
 // src/cli/commands/login.ts
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import os6 from "node:os";
 import { signInWithCustomToken as signInWithCustomToken2 } from "firebase/auth";
 function buildLoginResult(approved, existing, fallbackProjectId, mcpUrl2) {
@@ -7274,7 +8114,7 @@ function buildLoginResult(approved, existing, fallbackProjectId, mcpUrl2) {
 function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    const child = spawn7(command, args, { stdio: "ignore", detached: true });
+    const child = spawn8(command, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -7542,20 +8382,20 @@ async function runServiceStatus() {
 }
 
 // src/cli/commands/uninstall.ts
-import fs11 from "node:fs";
+import fs17 from "node:fs";
 async function runUninstall(options) {
   const before = serviceStatus();
   const dir = configDir();
   const hadService = before.state !== "not-installed" && before.state !== "unsupported";
   if (hadService) uninstallService();
   let purged = false;
-  if (options.purge && fs11.existsSync(dir)) {
+  if (options.purge && fs17.existsSync(dir)) {
     const confirmed = await promptConfirm({
       message: `Delete ${dir}? This machine loses its identity \u2014 a captain has to approve it again after reinstalling.`,
       initialValue: false
     });
     if (confirmed) {
-      fs11.rmSync(dir, { recursive: true, force: true });
+      fs17.rmSync(dir, { recursive: true, force: true });
       purged = true;
     }
   }
@@ -8022,6 +8862,10 @@ program.command("start").description("Run the daemon in the foreground").action(
     return 0;
   })
 );
+var engine = program.command("engine").description("The engine CLIs this machine runs agents on");
+engine.command("list").description("What each engine needs, what this machine has, and where it came from").action(action(runEngineList));
+engine.command("install [engineIds...]").description("Install an engine's CLI into this runner's own folder (a few hundred MB each)").option("--check", "report what would be installed, and install nothing").option("--dry-run", "print the npm command that would run").option("--force", "reinstall even when this runner already has that version").action(action((engineIds, options) => runEngineInstall(engineIds ?? [], options)));
+engine.command("uninstall <engineId>").description("Remove this runner's own copy \u2014 never one you installed yourself").action(action((engineId) => runEngineUninstall(engineId)));
 program.command("doctor").description("Check whether this machine can run jobs").action(action(runDoctor));
 program.command("status").description("Show what this machine is doing").action(action(runStatus));
 program.command("update").description("Update this machine to the latest published version").option("--check", "report whether a newer version exists, and install nothing").option("--dry-run", "print the npm command that would run").action(action((options) => runUpdate(options)));