@proagentstore/cli 0.4.108 → 0.4.110

package/dist/bootstrap.js

@@ -8,7 +8,7 @@ import {
   newestPayload,
   olderThan,
   payloadAt
-} from "./chunk-JOWYSZOL.js";
+} from "./chunk-RGNU4W6B.js";
 
 // src/bootstrap.ts
 import { existsSync } from "fs";

package/dist/{chunk-JOWYSZOL.js → chunk-RGNU4W6B.js}

@@ -12,6 +12,9 @@ var KEEP = 2;
 function payloadRoot() {
   return process.env.PAGS_CLI_CACHE || join(homedir(), ".config", "proagentstore", "cli");
 }
+function isVersion(v) {
+  return typeof v === "string" && /^(\d+)\.(\d+)\.(\d+)/.test(v.trim());
+}
 function olderThan(a, b) {
   const parse = (v) => /^(\d+)\.(\d+)\.(\d+)/.exec(v.trim())?.slice(1).map(Number);
   const x = parse(a);
@@ -44,9 +47,9 @@ function cachedPayloads(root = payloadRoot()) {
 function newestPayload(payloads) {
   return payloads.reduce((best, p) => !best || olderThan(best.version, p.version) ? p : best, null);
 }
-async function latestPublishedVersion(timeoutMs = 3e4) {
+async function latestPublishedVersion(timeoutMs = 3e4, signal) {
   try {
-    const { stdout } = await run("npm", ["view", CLI_PACKAGE, "version"], { timeout: timeoutMs });
+    const { stdout } = await run("npm", ["view", CLI_PACKAGE, "version"], { timeout: timeoutMs, signal });
     return stdout.trim() || null;
   } catch {
     return null;
@@ -88,6 +91,7 @@ export {
   CLI_PACKAGE,
   BOOTSTRAP_ENV,
   NO_SELF_UPDATE_ENV,
+  isVersion,
   olderThan,
   payloadAt,
   cachedPayloads,

package/dist/index.js

@@ -3,9 +3,10 @@ import {
   BOOTSTRAP_ENV,
   CLI_PACKAGE,
   installPayload,
+  isVersion,
   latestPublishedVersion,
   olderThan
-} from "./chunk-JOWYSZOL.js";
+} from "./chunk-RGNU4W6B.js";
 
 // src/index.ts
 import { createRequire as createRequire3 } from "module";
@@ -688,16 +689,16 @@ function describeCandidate(candidate, nowMs) {
   const agents = `${candidate.agentCount} agent${candidate.agentCount === 1 ? "" : "s"}`;
   return `${relativeAge(candidate.lastSeenAt, nowMs)} \xB7 ${agents}`;
 }
-function parseSelection(input, count) {
+function parseSelection(input, count2) {
   const raw = input.trim().toLowerCase();
   if (!raw || raw === "n" || raw === "no" || raw === "s" || raw === "skip" || raw === "none") return { kind: "skip" };
-  if (raw === "a" || raw === "all") return { kind: "pick", indices: Array.from({ length: count }, (_, i) => i) };
+  if (raw === "a" || raw === "all") return { kind: "pick", indices: Array.from({ length: count2 }, (_, i) => i) };
   const parts = raw.split(/[\s,]+/).filter(Boolean);
   const indices = [];
   for (const part of parts) {
     if (!/^\d+$/.test(part)) return { kind: "invalid", message: `"${part}" is not a number.` };
     const n = Number.parseInt(part, 10);
-    if (n < 1 || n > count) return { kind: "invalid", message: `${n} is not on the list (1\u2013${count}).` };
+    if (n < 1 || n > count2) return { kind: "invalid", message: `${n} is not on the list (1\u2013${count2}).` };
     if (!indices.includes(n - 1)) indices.push(n - 1);
   }
   return indices.length ? { kind: "pick", indices } : { kind: "skip" };
@@ -832,7 +833,7 @@ function buildRuntimeRegistrationBody(opts, capabilities = []) {
     machineNames: machine.names
   };
 }
-async function requestRunner(method, path, opts, body) {
+async function requestRunner(method, path, opts, body, signal) {
   const headers = {
     ...runnerRequestHeaders(opts)
   };
@@ -840,7 +841,8 @@ async function requestRunner(method, path, opts, body) {
   const res = await fetch(`${runnerBaseUrl(opts.url)}${path}`, {
     method,
     headers,
-    body: body === void 0 ? void 0 : JSON.stringify(body)
+    body: body === void 0 ? void 0 : JSON.stringify(body),
+    signal
   });
   const { text, data } = await readResponse(res);
   if (!res.ok) {
@@ -849,7 +851,7 @@ async function requestRunner(method, path, opts, body) {
   }
   return data;
 }
-async function requestPags(method, path, opts, body) {
+async function requestPags(method, path, opts, body, signal) {
   const headers = {
     ...pagsHeaders(opts.pagsToken)
   };
@@ -860,7 +862,8 @@ async function requestPags(method, path, opts, body) {
   const res = await fetch(`${pagsApiBase(opts.apiBase)}${path}`, {
     method,
     headers,
-    body: body === void 0 ? void 0 : JSON.stringify(body)
+    body: body === void 0 ? void 0 : JSON.stringify(body),
+    signal
   });
   const { text, data } = await readResponse(res);
   if (!res.ok) {
@@ -1629,6 +1632,12 @@ function autoUpdateStatusWire(status) {
     failure: "failed"
   }[status] ?? status;
 }
+function parseRecovery(raw) {
+  const r = raw;
+  if (!r || typeof r.target !== "string" || r.target.length > 80 || typeof r.at !== "string" || !Array.isArray(r.attachments)) return void 0;
+  if (r.attachments.length > 200 || !r.attachments.every((a) => typeof a === "string" && a.length > 0 && a.length <= 128)) return void 0;
+  return { target: r.target, attachments: [...r.attachments], at: r.at };
+}
 var statuses = /* @__PURE__ */ new Set([
   "enabled",
   "checking",
@@ -1665,12 +1674,14 @@ function parseAutoUpdatePolicy(value) {
   const latestVersion = raw.latestVersion ?? raw.latest_version;
   const lastAttemptAt = raw.lastAttemptAt ?? raw.last_attempt_at;
   const reason = raw.reason;
+  const recovery = parseRecovery(raw.recovery);
   return {
     autoUpdate,
     ...status ? { status } : {},
     ...typeof latestVersion === "string" ? { latestVersion } : {},
     ...typeof lastAttemptAt === "string" ? { lastAttemptAt } : {},
-    ...typeof reason === "string" ? { reason } : {}
+    ...typeof reason === "string" ? { reason } : {},
+    ...recovery ? { recovery } : {}
   };
 }
 function policyFromResponse(value) {
@@ -1726,12 +1737,25 @@ function policyScheduleAction(previous, next, wasAuthoritative) {
   return "keep";
 }
 function acceptPolicyResponse(local, wasAuthoritative, response) {
-  const remote = policyFromResponse(response);
-  if (!remote) return null;
+  const parsed = policyFromResponse(response);
+  if (!parsed) return null;
+  const { recovery: _fromService, ...remote } = parsed;
   const action = policyScheduleAction(local, remote, wasAuthoritative);
   const ownerTransition = action === "cancel" || !local.autoUpdate;
   return { policy: ownerTransition ? { ...local, ...remote } : { ...local, autoUpdate: remote.autoUpdate }, action };
 }
+var ResponseFence = class {
+  sent = 0;
+  accepted = 0;
+  next() {
+    return ++this.sent;
+  }
+  accepts(sentAs) {
+    if (sentAs < this.accepted) return false;
+    this.accepted = sentAs;
+    return true;
+  }
+};
 function mayAutomaticallyRestart(input) {
   return input.authoritative && input.enabled && input.workObserved && input.busy.length === 0;
 }
@@ -1739,6 +1763,50 @@ function mayAutomaticallyRestart(input) {
 // src/commands/runner/auto-update-controller.ts
 var MAX_OBSERVATIONS = 5;
 var IDLE_RETRY_MS = 15e3;
+var OBSERVATION_TIMEOUT_MS = 3e4;
+async function boundedWork(work, bound = {}) {
+  const abort = new AbortController();
+  let timer;
+  const expired = new Promise((resolve5) => {
+    timer = (bound.timer ?? ((fn, ms) => setTimeout(fn, ms)))(() => {
+      abort.abort();
+      resolve5(null);
+    }, bound.ms ?? OBSERVATION_TIMEOUT_MS);
+    timer.unref?.();
+  });
+  const running = work(abort.signal);
+  running.catch(() => void 0);
+  try {
+    return await Promise.race([running, expired]);
+  } finally {
+    if (timer) (bound.clear ?? ((t) => clearTimeout(t)))(timer);
+  }
+}
+function updateVerdict(attempt, facts, attachedNow = []) {
+  if (!isVersion(facts.current) || !isVersion(facts.latest)) return { kind: "unverified", reason: `the running (${facts.current}) or published (${facts.latest}) version could not be read` };
+  const cycle = attempt.recovery;
+  if (!cycle) {
+    if (attempt.status === "running" || attempt.status === "restarting") return { kind: "unknown", reason: "an update attempt was recorded by an older runner without the record needed to verify it" };
+    return { kind: "current" };
+  }
+  if (!isVersion(cycle.target)) return { kind: "unverified", reason: `the attempted update's target (${cycle.target}) could not be read` };
+  if (olderThan(facts.current, cycle.target)) return { kind: "unverified", reason: `the runner came back on ${facts.current}, not the attempted ${cycle.target}` };
+  const observed = facts.observations ?? [];
+  if (!observed.length) return { kind: "unverified", reason: `the runner is on ${facts.current}, but no health look was taken` };
+  const look = (source) => {
+    const o = observed.filter((x) => x.source === source).at(-1);
+    return !o ? "missing" : o.malformed ? "malformed" : o.success ? "ok" : "failed";
+  };
+  const sessions = look("sessions");
+  const health = look("health");
+  if (sessions !== "ok" || health !== "ok" || facts.busy.includes("runner-work-observation-unavailable")) {
+    return { kind: "unverified", reason: `the runner is on ${facts.current}, but its local work look was not readable (sessions ${sessions}, health ${health})` };
+  }
+  const back = new Set(attachedNow);
+  const missing = cycle.attachments.filter((id) => !back.has(id));
+  if (missing.length) return { kind: "unverified", reason: `the runner is on ${facts.current}, but only ${cycle.attachments.length - missing.length} of its ${cycle.attachments.length} original agents are attached again` };
+  return { kind: "verified" };
+}
 function blockerClassFor(waitingFor) {
   if (waitingFor.includes("runner-work-observation-unavailable")) return "observation_failure";
   return waitingFor.length ? "active_sessions" : "unknown";
@@ -1748,6 +1816,7 @@ var AutomaticUpdateController = class {
     this.deps = deps;
     this.setTimer = deps.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
     this.clearTimer = deps.clearTimer ?? ((timer) => clearTimeout(timer));
+    this.boundTimer = deps.boundTimer ?? ((fn, ms) => setTimeout(fn, ms));
     this.now = deps.now ?? Date.now;
   }
   deps;
@@ -1764,6 +1833,7 @@ var AutomaticUpdateController = class {
   now;
   setTimer;
   clearTimer;
+  boundTimer;
   /** The controller's own record, safe to report: times, a normalized class, and observation outcomes. */
   diagnostics() {
     return { checkAt: this.checkAt, decisionAt: this.decisionAt, nextRetryDueAt: this.nextRetryDueAt, blockerClass: this.blockerClass, observations: [...this.observations] };
@@ -1781,7 +1851,7 @@ var AutomaticUpdateController = class {
     if (this.checking || this.waiting || !this.retryable()) return;
     this.checking = true;
     try {
-      if (!await this.deps.refreshPolicy() || !this.enabled()) {
+      if (!await this.bounded((signal) => this.deps.refreshPolicy(signal)) || !this.enabled()) {
         this.offline();
         return;
       }
@@ -1833,6 +1903,7 @@ var AutomaticUpdateController = class {
    */
   offline() {
     if (!this.retryable()) return;
+    this.checkAt = this.now();
     this.failures++;
     this.deps.status("offline", { reason: "The owner policy could not be refreshed; automatic update is deferred." });
     this.schedule();
@@ -1842,17 +1913,41 @@ var AutomaticUpdateController = class {
     this.deps.status("failure", { reason: error instanceof Error ? error.message : String(error) });
     this.schedule();
   }
+  /**
+   * One bounded piece of work (#1020): a policy refresh or a facts look. Past {@link OBSERVATION_TIMEOUT_MS} its
+   * signal is aborted (the relay drops that request's response, so a late answer can never restore authority) and
+   * this resolves null — the race has settled, so the late result cannot overwrite a newer one or reach planning,
+   * install or restart. A late rejection is absorbed rather than left unhandled.
+   */
+  bounded(work) {
+    return boundedWork(work, { timer: this.boundTimer, clear: this.clearTimer });
+  }
   async decide() {
-    const facts = await this.deps.facts();
+    const facts = await this.bounded((signal) => this.deps.facts(signal));
     this.checkAt = this.now();
+    if (!facts) {
+      this.failures++;
+      this.deps.status("failure", { reason: `The local work and registry check did not answer within ${OBSERVATION_TIMEOUT_MS / 1e3}s; it will be retried.` });
+      this.schedule();
+      return;
+    }
     if (facts.observations?.length) this.observations = [...this.observations, ...facts.observations].slice(-MAX_OBSERVATIONS);
     if (!this.enabled()) return this.offline();
     const plan = this.deps.plan(facts);
     this.decisionAt = this.now();
     this.blockerClass = plan.action === "wait" ? blockerClassFor(plan.waitingFor) : null;
     if (plan.action === "up-to-date") {
-      this.failures = 0;
-      this.deps.status("verified-success", { latestVersion: facts.latest ?? void 0, reason: void 0 });
+      const verdict = updateVerdict(this.deps.policy().value, facts, this.deps.attachments?.() ?? []);
+      if (verdict.kind === "unverified") {
+        this.failures++;
+        this.deps.status("failure", { reason: `Not verified: ${verdict.reason}.` });
+      } else if (verdict.kind === "unknown") {
+        this.failures = 0;
+        this.deps.status("enabled", { latestVersion: facts.latest ?? void 0, reason: `Not verified: ${verdict.reason}.` });
+      } else {
+        this.failures = 0;
+        this.deps.status(verdict.kind === "verified" ? "verified-success" : "enabled", { latestVersion: facts.latest ?? void 0, reason: void 0, recovery: void 0 });
+      }
       this.schedule();
       return;
     }
@@ -1866,7 +1961,7 @@ var AutomaticUpdateController = class {
       this.defer();
       return;
     }
-    this.deps.status("running", { latestVersion: plan.latest, reason: void 0 });
+    this.deps.status("running", { latestVersion: plan.latest, reason: void 0, recovery: { target: plan.latest, attachments: [...this.deps.attachments?.() ?? []], at: new Date(this.now()).toISOString() } });
     const restarted = await this.install(plan, true);
     if (restarted) {
       this.deps.status("restarting", { latestVersion: plan.latest, reason: void 0 });
@@ -1885,7 +1980,7 @@ var AutomaticUpdateController = class {
       void (async () => {
         this.waiting = false;
         try {
-          if (!await this.deps.refreshPolicy() || !this.enabled()) {
+          if (!await this.bounded((signal) => this.deps.refreshPolicy(signal)) || !this.enabled()) {
             this.offline();
             return;
           }
@@ -1937,14 +2032,17 @@ var RelayMutationAdmission = class {
 };
 
 // src/commands/runner/runner-work-observation.ts
+var count = (v) => typeof v === "number" && Number.isInteger(v) && v >= 0;
+function isWorkShape(work) {
+  if (!work || typeof work !== "object" || Array.isArray(work)) return false;
+  const w2 = work;
+  return count(w2.codingTurns) && count(w2.localRuns) && Array.isArray(w2.detail) && w2.detail.every((item) => typeof item === "string");
+}
 function observedRunnerWork(observation) {
   const sessions = observation.sessions;
   const work = observation.work;
-  if (!Array.isArray(sessions) || !work || typeof work !== "object") return ["runner-work-observation-unavailable"];
-  const codingTurns = typeof work.codingTurns === "number" && Number.isInteger(work.codingTurns) && work.codingTurns >= 0 ? work.codingTurns : null;
-  const localRuns = typeof work.localRuns === "number" && Number.isInteger(work.localRuns) && work.localRuns >= 0 ? work.localRuns : null;
-  const detail = Array.isArray(work.detail) && work.detail.every((item) => typeof item === "string") ? work.detail : null;
-  if (codingTurns === null || localRuns === null || detail === null) return ["runner-work-observation-unavailable"];
+  if (!Array.isArray(sessions) || !isWorkShape(work)) return ["runner-work-observation-unavailable"];
+  const { codingTurns, localRuns, detail } = work;
   const activeCoding = sessions.flatMap((session) => {
     if (session?.alive === false) return [];
     const id = typeof session?.sessionId === "string" && session.sessionId ? session.sessionId : "unidentified-session";
@@ -1960,6 +2058,155 @@ function observedRunnerWork(observation) {
     ...Array.from({ length: localRuns }, (_v, i) => localDetail[i] || `local-run-${i + 1}`)
   ];
 }
+function readWorkLook(sessions, health, sampledAt) {
+  const sessionsOk = sessions.status === "fulfilled" && Array.isArray(sessions.value?.sessions);
+  const healthOk = health.status === "fulfilled" && isWorkShape(health.value?.work);
+  const busy = sessions.status === "fulfilled" && health.status === "fulfilled" ? observedRunnerWork({ sessions: sessions.value?.sessions, work: health.value?.work }) : ["runner-work-observation-unavailable"];
+  return {
+    busy,
+    observations: [
+      { source: "sessions", success: sessionsOk, sampledAt, ...sessions.status === "fulfilled" && !sessionsOk ? { malformed: true } : {} },
+      { source: "health", success: healthOk, sampledAt, ...health.status === "fulfilled" && !healthOk ? { malformed: true } : {} }
+    ]
+  };
+}
+
+// src/commands/runner/update-bridge.ts
+var PolicyCell = class {
+  constructor(policy, persist, enabled = true) {
+    this.policy = policy;
+    this.persist = persist;
+    this.enabled = enabled;
+  }
+  policy;
+  persist;
+  enabled;
+  authoritative = false;
+  refreshing = false;
+  fence = new ResponseFence();
+  /** The status writer every update path uses. */
+  record(status, extra = {}) {
+    this.policy = { ...this.policy, ...extra, status, lastAttemptAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (this.enabled) this.persist(this.policy);
+  }
+  /** The number a registration/heartbeat takes as it is SENT. */
+  next() {
+    return this.fence.next();
+  }
+  /**
+   * Fold one service answer in. It is VALIDATED before it is ordered (#1020): an answer that carries no readable
+   * policy must not advance the fence, or it would suppress a valid older OFF still in flight. The owner's OFF ends
+   * any recovery cycle.
+   */
+  accept(response, sentAs) {
+    if (!this.enabled) return null;
+    const accepted = acceptPolicyResponse(this.policy, this.authoritative, response);
+    if (!accepted || !this.fence.accepts(sentAs)) return null;
+    this.policy = accepted.action === "cancel" ? { ...accepted.policy, recovery: void 0 } : accepted.policy;
+    this.authoritative = true;
+    this.persist(this.policy);
+    return accepted.action;
+  }
+};
+function createPolicyChannel(deps) {
+  const registered = /* @__PURE__ */ new Set();
+  const act = (action) => {
+    if (action === "cancel") deps.onAction("cancel");
+    else if (action === "start" && !deps.cell.refreshing) deps.onAction("start");
+  };
+  const accept = (response, sentAs) => act(deps.cell.accept(response, sentAs));
+  const register = async (id, force = deps.force, signal) => {
+    const sent = deps.cell.next();
+    try {
+      const result = await deps.post(`/v1/instances/${apiPathSegment(id)}/runtime`, deps.body(id, force), signal);
+      if (signal?.aborted) return false;
+      accept(result, sent);
+      registered.add(id);
+      return true;
+    } catch (e) {
+      if (signal?.aborted) return false;
+      registered.delete(id);
+      deps.onError(id, e instanceof Error ? e.message : String(e));
+      return false;
+    }
+  };
+  const refresh = async (signal) => {
+    const id = registered.values().next().value ?? [...deps.held()][0];
+    if (!id) return false;
+    deps.cell.authoritative = false;
+    deps.cell.refreshing = true;
+    try {
+      return await register(id, deps.force, signal) && deps.cell.authoritative;
+    } finally {
+      deps.cell.refreshing = false;
+    }
+  };
+  return { registered, register, refresh, accept };
+}
+var BoundExpired = class extends Error {
+  boundExpired = true;
+};
+function createInstallBridge(deps) {
+  let inFlight = false;
+  let installedPendingRestart = null;
+  const within = (work) => boundedWork(work, deps.bound);
+  const release = (drained) => {
+    if (drained) deps.admission.resume();
+    inFlight = false;
+  };
+  const expired = (drained, what) => {
+    release(drained);
+    throw new BoundExpired(`${what} did not answer within ${(deps.bound?.ms ?? 3e4) / 1e3}s; nothing restarted, and it will be retried.`);
+  };
+  const run2 = async (plan, automatic = false, lease) => {
+    if (inFlight || lease && !deps.leaseActive(lease)) return false;
+    inFlight = true;
+    if (automatic) {
+      const fresh = await within((signal) => deps.refresh(signal));
+      if (fresh === null) expired(false, "The owner policy refresh before installing");
+      if (!fresh || !deps.cell.policy.autoUpdate) {
+        release(false);
+        return false;
+      }
+    }
+    if (installedPendingRestart !== plan.latest) {
+      deps.log(`Updating ${plan.current} \u2192 ${plan.latest} (runner_update)\u2026`);
+      try {
+        await deps.install(plan.latest);
+        installedPendingRestart = plan.latest;
+      } catch (error) {
+        release(false);
+        throw error;
+      }
+    }
+    await deps.admission.drain();
+    await (deps.settle ?? (() => new Promise((resolve5) => setTimeout(resolve5, 500))))();
+    if (lease && !deps.leaseActive(lease)) {
+      release(true);
+      return false;
+    }
+    if (automatic) {
+      const fresh = await within((signal) => deps.refresh(signal));
+      if (fresh === null) expired(true, "The owner policy refresh after installing");
+      if (!fresh || !deps.cell.policy.autoUpdate) {
+        release(true);
+        return false;
+      }
+    }
+    const final = await within((signal) => deps.facts(signal));
+    if (final === null) expired(true, "The final local work look before restarting");
+    const facts = final;
+    const workObserved = !facts.busy.includes("runner-work-observation-unavailable");
+    if (facts.busy.length || automatic && !mayAutomaticallyRestart({ authoritative: deps.cell.authoritative, enabled: deps.cell.policy.autoUpdate, workObserved, busy: facts.busy })) {
+      release(true);
+      return false;
+    }
+    deps.log(`Installed ${plan.latest} \u2014 restarting; every agent re-attaches on the way back up.`);
+    deps.detachAll();
+    return true;
+  };
+  return { run: run2, inFlight: () => inFlight, installedPendingRestart: () => installedPendingRestart };
+}
 
 // src/commands/runner/relay.ts
 var MEMBERSHIP_SYNC_PATH = "/pags/membership/sync";
@@ -1971,81 +2218,43 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   const runnerNode = hostname3();
   const machine = loadMachineIdentity(runnerNode);
   const autoUpdateKey = machine.id ? autoUpdatePolicyKey(machine.id) : "";
-  let autoUpdatePolicy = autoUpdateKey ? loadAutoUpdatePolicy(autoUpdateKey) ?? { autoUpdate: false } : { autoUpdate: false };
-  let autoUpdatePolicyAuthoritative = false;
-  let refreshingAutomaticPolicy = false;
+  const cell = new PolicyCell(autoUpdateKey ? loadAutoUpdatePolicy(autoUpdateKey) ?? { autoUpdate: false } : { autoUpdate: false }, (p) => saveAutoUpdatePolicy(autoUpdateKey, p), !!autoUpdateKey);
   let scheduleAutomaticUpdate = () => void 0;
   let autoUpdateDiagnostics = () => ({});
-  const saveAutoUpdateStatus = (status, extra = {}) => {
-    autoUpdatePolicy = {
-      ...autoUpdatePolicy,
-      ...extra,
-      status,
-      lastAttemptAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    if (autoUpdateKey) saveAutoUpdatePolicy(autoUpdateKey, autoUpdatePolicy);
-  };
-  const acceptAutoUpdatePolicy = (response) => {
-    if (!autoUpdateKey) return;
-    const accepted = acceptPolicyResponse(autoUpdatePolicy, autoUpdatePolicyAuthoritative, response);
-    if (!accepted) return;
-    autoUpdatePolicy = accepted.policy;
-    autoUpdatePolicyAuthoritative = true;
-    if (autoUpdateKey) saveAutoUpdatePolicy(autoUpdateKey, autoUpdatePolicy);
-    if (accepted.action === "cancel") {
-      scheduleAutomaticUpdate(false, true);
-      return;
-    }
-    if (refreshingAutomaticPolicy) return;
-    if (accepted.action === "start") {
-      scheduleAutomaticUpdate(true);
-    }
-  };
+  const autoUpdateStatusBody = () => ({
+    status: autoUpdateStatusWire(cell.policy.status),
+    latestVersion: cell.policy.latestVersion,
+    error: cell.policy.reason,
+    ...autoUpdateDiagnostics()
+  });
   const capabilities = await requestRunner("GET", "/capabilities", { url: localUrl, token: runnerToken, instanceId: instanceIds[0] });
   const caps = Array.isArray(capabilities.capabilities) ? capabilities.capabilities.filter((item) => typeof item === "string") : [];
-  const registered = /* @__PURE__ */ new Set();
   let lastRegisterError = "";
-  const registerRuntime = async (id, forceClaim = force) => {
-    try {
-      const result = await requestPags("POST", `/v1/instances/${apiPathSegment(id)}/runtime`, opts, {
-        endpointUrl: localUrl,
-        token: runnerToken,
-        placement: "local",
-        capabilities: caps,
-        runnerVersion: CLI_VERSION,
-        runnerNode,
-        machineId: machine.id,
-        machineNames: machine.names,
-        force: forceClaim,
-        autoUpdateStatus: {
-          status: autoUpdateStatusWire(autoUpdatePolicy.status),
-          latestVersion: autoUpdatePolicy.latestVersion,
-          error: autoUpdatePolicy.reason,
-          ...autoUpdateDiagnostics()
-        }
-      });
-      acceptAutoUpdatePolicy(result);
-      registered.add(id);
-      return true;
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      registered.delete(id);
+  const channel = createPolicyChannel({
+    cell,
+    post: (path, body, signal) => requestPags("POST", path, opts, body, signal),
+    body: (_id, forceClaim) => ({
+      endpointUrl: localUrl,
+      token: runnerToken,
+      placement: "local",
+      capabilities: caps,
+      runnerVersion: CLI_VERSION,
+      runnerNode,
+      machineId: machine.id,
+      machineNames: machine.names,
+      force: forceClaim,
+      autoUpdateStatus: autoUpdateStatusBody()
+    }),
+    force,
+    held: () => attached.keys(),
+    onError: (id, msg) => {
       lastRegisterError = msg;
       writeError(`register ${id.slice(0, 8)}\u2026 failed: ${msg}`);
-      return false;
-    }
-  };
-  const refreshAutomaticPolicy = async () => {
-    const id = registered.values().next().value;
-    if (!id) return false;
-    autoUpdatePolicyAuthoritative = false;
-    refreshingAutomaticPolicy = true;
-    try {
-      return await registerRuntime(id) && autoUpdatePolicyAuthoritative;
-    } finally {
-      refreshingAutomaticPolicy = false;
-    }
-  };
+    },
+    onAction: (action) => scheduleAutomaticUpdate(action === "start", action === "cancel")
+  });
+  const registered = channel.registered;
+  const registerRuntime = (id, forceClaim = force) => channel.register(id, forceClaim);
   const attached = /* @__PURE__ */ new Map();
   const processStartedAt = Date.now();
   const starts24h = recordRunnerStart(processStartedAt);
@@ -2058,26 +2267,20 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     writeLine(formatStatusLine({ registration: state, agents, reason: state === "ok" ? void 0 : lastRegisterError }));
   };
   for (const id of instanceIds) await registerRuntime(id);
-  const updateFacts = async () => {
+  const updateFacts = async (signal) => {
     const [sessionsResult, healthResult] = await Promise.allSettled([
       requestRunner("GET", "/coding/sessions", {
         url: localUrl,
         token: runnerToken,
         instanceId: instanceIds[0]
-      }),
-      requestRunner("GET", "/health", { url: localUrl, token: runnerToken, instanceId: instanceIds[0] })
+      }, void 0, signal),
+      requestRunner("GET", "/health", { url: localUrl, token: runnerToken, instanceId: instanceIds[0] }, void 0, signal)
     ]);
-    const busy = sessionsResult.status === "fulfilled" && healthResult.status === "fulfilled" ? observedRunnerWork({ sessions: sessionsResult.value.sessions, work: healthResult.value.work }) : ["runner-work-observation-unavailable"];
-    const sampledAt = Date.now();
-    const observations = [
-      // An answer is a success only when it has the shape the guard reads; malformed is a failed look.
-      { source: "sessions", success: sessionsResult.status === "fulfilled" && Array.isArray(sessionsResult.value.sessions), sampledAt },
-      { source: "health", success: healthResult.status === "fulfilled" && !!healthResult.value.work && typeof healthResult.value.work === "object", sampledAt }
-    ];
+    const { busy, observations } = readWorkLook(sessionsResult, healthResult, Date.now());
     return {
       observations,
       current: CLI_VERSION,
-      latest: await latestPublishedVersion(),
+      latest: await latestPublishedVersion(void 0, signal),
       fromSource: runsFromSource(),
       restarter: restarterFrom(process.env),
       // A restart ends browser/application work too. Give these durable names to the same
@@ -2085,94 +2288,47 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
       busy
     };
   };
-  let updateInstallInFlight = false;
-  let installedPendingRestart = null;
   const relayMutationAdmission = new RelayMutationAdmission();
-  const installAndRestart = async (plan, automatic = false, lease) => {
-    if (updateInstallInFlight || lease && !deferredUpdateLeaseActive(lease)) return false;
-    updateInstallInFlight = true;
-    if (automatic && (!await refreshAutomaticPolicy() || !autoUpdatePolicy.autoUpdate)) {
-      updateInstallInFlight = false;
-      return false;
-    }
-    if (installedPendingRestart !== plan.latest) {
-      writeLine(`Updating ${plan.current} \u2192 ${plan.latest} (runner_update)\u2026`);
-      try {
-        await installVersion(plan.latest);
-        installedPendingRestart = plan.latest;
-      } catch (error) {
-        updateInstallInFlight = false;
-        throw error;
-      }
-    }
-    await relayMutationAdmission.drain();
-    await new Promise((resolve5) => setTimeout(resolve5, 500));
-    if (lease && !deferredUpdateLeaseActive(lease)) {
-      relayMutationAdmission.resume();
-      updateInstallInFlight = false;
-      return false;
-    }
-    if (automatic) {
-      if (!await refreshAutomaticPolicy() || !autoUpdatePolicy.autoUpdate) {
-        relayMutationAdmission.resume();
-        updateInstallInFlight = false;
-        return false;
-      }
-    }
-    const finalFacts = await updateFacts();
-    if (finalFacts.busy.length || automatic && !mayAutomaticallyRestart({ authoritative: autoUpdatePolicyAuthoritative, enabled: autoUpdatePolicy.autoUpdate, workObserved: !finalFacts.busy.includes("runner-work-observation-unavailable"), busy: finalFacts.busy })) {
-      relayMutationAdmission.resume();
-      updateInstallInFlight = false;
-      return false;
-    }
-    writeLine(`Installed ${plan.latest} \u2014 restarting; every agent re-attaches on the way back up.`);
-    for (const id of [...attached.keys()]) detach(id);
-    return true;
-  };
+  const bridge = createInstallBridge({
+    cell,
+    refresh: channel.refresh,
+    facts: updateFacts,
+    install: installVersion,
+    admission: relayMutationAdmission,
+    leaseActive: deferredUpdateLeaseActive,
+    detachAll: () => {
+      for (const id of [...attached.keys()]) detach(id);
+    },
+    log: writeLine
+  });
   let updateWaiting = false;
   let deferredManualLease = null;
-  const updateWhenIdle = (automatic = false, lease) => {
-    if (updateWaiting || !automatic && !lease) return false;
+  const updateWhenIdle = (lease) => {
+    if (updateWaiting) return false;
     updateWaiting = true;
-    if (!automatic) deferredManualLease = lease;
-    const until = automatic ? Date.now() + 60 * 6e4 : lease.expiresAt;
+    deferredManualLease = lease;
     const tick = () => setTimeout(async () => {
-      if (!automatic && (!deferredManualLease || !deferredUpdateLeaseActive(deferredManualLease))) {
+      if (!deferredManualLease || !deferredUpdateLeaseActive(deferredManualLease)) {
         writeLine("runner_update: the deferred operation lease expired; no delayed restart was performed.");
         deferredManualLease = null;
         updateWaiting = false;
         return;
       }
-      if (automatic && (!await refreshAutomaticPolicy() || !autoUpdatePolicy.autoUpdate)) {
-        saveAutoUpdateStatus("offline", { reason: "The owner policy could not be refreshed; automatic update is deferred." });
-        updateWaiting = false;
-        return;
-      }
-      const plan = planRunnerUpdate(await updateFacts());
-      if (plan.action === "update") {
-        if (automatic && !autoUpdatePolicy.autoUpdate) {
-          updateWaiting = false;
-          return;
-        }
-        if (automatic) saveAutoUpdateStatus("running", { latestVersion: plan.latest, reason: void 0 });
-        const installed = await installAndRestart(plan, automatic, automatic ? void 0 : deferredManualLease ?? void 0).catch((e) => {
-          if (automatic) saveAutoUpdateStatus("failure", { reason: e instanceof Error ? e.message : String(e) });
+      const facts = await boundedWork((signal) => updateFacts(signal));
+      const plan = facts ? planRunnerUpdate(facts) : null;
+      if (plan?.action === "update") {
+        const installed = await bridge.run(plan, false, deferredManualLease).catch((e) => {
           writeError(`runner_update: install failed \u2014 ${e instanceof Error ? e.message : String(e)}`);
           return false;
         });
-        if (!installed && Date.now() < until) {
-          saveAutoUpdateStatus("waiting-for-idle", { latestVersion: plan.latest });
-          tick();
-        } else {
+        if (!installed && Date.now() < lease.expiresAt) tick();
+        else {
           deferredManualLease = null;
           updateWaiting = false;
           if (installed) leaveForRestart(plan.restarter);
         }
-      } else if (plan.action === "wait" && Date.now() < until) {
-        if (automatic) saveAutoUpdateStatus("waiting-for-idle", { latestVersion: plan.latest, reason: void 0 });
-        tick();
-      } else {
-        if (automatic && plan.action === "refused") saveAutoUpdateStatus("unsupported", { reason: plan.reason });
+      } else if ((!plan || plan.action === "wait") && Date.now() < lease.expiresAt) tick();
+      else {
         deferredManualLease = null;
         updateWaiting = false;
       }
@@ -2180,107 +2336,41 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     tick();
     return true;
   };
-  let automaticTimer = null;
-  let automaticChecking = false;
-  let automaticFailures = 0;
-  const runAutomaticUpdateCheck = async () => {
-    if (!autoUpdatePolicy.autoUpdate || !autoUpdatePolicyAuthoritative || automaticChecking || updateWaiting) return;
-    automaticChecking = true;
-    try {
-      if (!await refreshAutomaticPolicy() || !autoUpdatePolicy.autoUpdate) {
-        saveAutoUpdateStatus("offline", { reason: "The owner policy could not be refreshed; automatic update is deferred." });
-        scheduleAutomaticUpdate();
-        return;
-      }
-      saveAutoUpdateStatus("checking", { reason: void 0 });
-      const facts = await updateFacts();
-      if (!autoUpdatePolicy.autoUpdate || !autoUpdatePolicyAuthoritative) return;
-      if (!facts.latest) {
-        automaticFailures++;
-        saveAutoUpdateStatus("failure", { reason: "Could not check the trusted npm registry for a newer CLI release." });
-        scheduleAutomaticUpdate();
-        return;
-      }
-      automaticFailures = 0;
-      const plan = planRunnerUpdate(facts);
-      if (plan.action === "up-to-date") {
-        saveAutoUpdateStatus("verified-success", { latestVersion: facts.latest, reason: void 0 });
-        scheduleAutomaticUpdate();
-        return;
-      }
-      if (plan.action === "refused") {
-        saveAutoUpdateStatus("unsupported", { latestVersion: facts.latest, reason: plan.reason });
-        scheduleAutomaticUpdate();
-        return;
-      }
-      if (plan.action === "wait") {
-        saveAutoUpdateStatus("waiting-for-idle", { latestVersion: plan.latest, reason: void 0 });
-        updateWhenIdle(true);
-        return;
-      }
-      if (!autoUpdatePolicy.autoUpdate || !autoUpdatePolicyAuthoritative) return;
-      saveAutoUpdateStatus("running", { latestVersion: plan.latest, reason: void 0 });
-      try {
-        const installed = await installAndRestart(plan, true);
-        if (!installed) {
-          saveAutoUpdateStatus("waiting-for-idle", { latestVersion: plan.latest });
-          updateWhenIdle(true);
-          return;
-        }
-        saveAutoUpdateStatus("restarting", { latestVersion: plan.latest, reason: void 0 });
-      } catch (e) {
-        automaticFailures++;
-        saveAutoUpdateStatus("failure", { latestVersion: plan.latest, reason: e instanceof Error ? e.message : String(e) });
-        scheduleAutomaticUpdate();
-      }
-    } finally {
-      automaticChecking = false;
-    }
-  };
-  scheduleAutomaticUpdate = (initial = false, cancel = false) => {
-    if (cancel || !autoUpdatePolicy.autoUpdate || !autoUpdatePolicyAuthoritative) {
-      if (automaticTimer) clearTimeout(automaticTimer);
-      automaticTimer = null;
-      return;
-    }
-    if (automaticTimer || updateWaiting) return;
-    const delay = initial ? Math.round(5e3 + Math.random() * 25e3) : nextAutoUpdateDelayMs(automaticFailures);
-    automaticTimer = setTimeout(() => {
-      automaticTimer = null;
-      void runAutomaticUpdateCheck();
-    }, delay);
-    automaticTimer.unref();
-  };
   const automaticUpdateController = new AutomaticUpdateController({
-    policy: () => ({ value: autoUpdatePolicy, authoritative: autoUpdatePolicyAuthoritative }),
-    refreshPolicy: refreshAutomaticPolicy,
+    policy: () => ({ value: cell.policy, authoritative: cell.authoritative }),
+    refreshPolicy: channel.refresh,
     facts: updateFacts,
     plan: planRunnerUpdate,
-    // This bridge is deliberately the same function used by explicit runner_update. It owns npm,
-    // a fresh authoritative policy, the mutation drain, final local-work observation and restart.
+    // The same bridge an explicit runner_update uses: npm, a fresh authoritative policy, the mutation drain, the
+    // final local-work observation and restart — each wait bounded.
     installAndRestart: async (plan, automatic) => {
-      const installed = await installAndRestart(plan, automatic);
+      const installed = await bridge.run(plan, automatic);
       if (installed) setTimeout(() => leaveForRestart(plan.restarter), 0).unref();
       return installed;
     },
-    status: saveAutoUpdateStatus
+    status: (status, extra) => cell.record(status, extra),
+    // The agents held now: attached AND registered — recorded with an install, required back after it.
+    attachments: () => [...attached.keys()].filter((id) => registered.has(id))
   });
   autoUpdateDiagnostics = () => automaticUpdateController.diagnostics();
   scheduleAutomaticUpdate = (initial = false, cancel = false) => automaticUpdateController.onPolicy(cancel ? "cancel" : initial ? "start" : "keep");
-  if (autoUpdatePolicyAuthoritative && autoUpdatePolicy.autoUpdate) scheduleAutomaticUpdate(true);
+  if (cell.authoritative && cell.policy.autoUpdate) scheduleAutomaticUpdate(true);
   const answerUpdate = async (body) => {
     const dryRun = body?.dryRun === true;
-    const plan = planRunnerUpdate(await updateFacts());
+    const facts = await boundedWork((signal) => updateFacts(signal));
+    if (!facts) return { status: 504, result: { error: "The local work and registry look did not answer within 30s; nothing was installed or restarted." } };
+    const plan = planRunnerUpdate(facts);
     if (dryRun || plan.action === "up-to-date" || plan.action === "refused") return { status: 200, result: { ...plan, dryRun } };
     if (plan.action === "wait") {
       const lease = deferredUpdateLease(body);
       if (!lease) return { status: 400, result: { error: "A busy runner_update needs a current operation lease; no delayed restart was scheduled." } };
-      if (!updateWhenIdle(false, lease)) return { status: 409, result: { error: "A runner update is already waiting for active work to finish." } };
+      if (!updateWhenIdle(lease)) return { status: 409, result: { error: "A runner update is already waiting for active work to finish." } };
       return { status: 200, result: { ...plan, operationId: lease.operationId, deferredUntil: lease.expiresAt, detail: "This operation may restart only before its recorded lease expires; no delayed restart survives an expired or terminal operation." } };
     }
     try {
-      if (!await installAndRestart(plan)) return { status: 409, result: { error: "A runner update is already installing or restarting." } };
+      if (!await bridge.run(plan)) return { status: 409, result: { error: "A runner update is already installing or restarting." } };
     } catch (e) {
+      if (e instanceof BoundExpired) return { status: 504, result: { error: e.message } };
       return { status: 500, result: { error: `npm could not install ${plan.latest}: ${e instanceof Error ? e.message : String(e)}` } };
     }
     const supervisor = supervisorNote(plan.restarter);
@@ -2394,18 +2484,14 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
       });
       for (const id of [...attached.keys()]) {
         try {
+          const sent = cell.next();
           const response = await requestPags("POST", `/v1/instances/${apiPathSegment(id)}/runtime/heartbeat`, opts, {
             runnerNode,
             machineId: machine.id,
             resources,
-            autoUpdateStatus: {
-              status: autoUpdateStatusWire(autoUpdatePolicy.status),
-              latestVersion: autoUpdatePolicy.latestVersion,
-              error: autoUpdatePolicy.reason,
-              ...autoUpdateDiagnostics()
-            }
+            autoUpdateStatus: autoUpdateStatusBody()
           });
-          acceptAutoUpdatePolicy(response);
+          channel.accept(response, sent);
         } catch (e) {
           failure = e instanceof Error ? e.message : String(e);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.108",
+  "version": "0.4.110",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",