@ricsam/r5d-worker 0.0.27 → 0.0.29

package/README.md

@@ -19,6 +19,10 @@ Visible branch checkouts are the user/agent workbench. Their `origin` remains th
 
 Worker labels are mandatory and unique per user. Choose labels that describe host capabilities, such as `macos`, `linux`, `ios`, or `ec2-build`.
 
+`r5d-worker start` keeps a lightweight supervisor process attached to the launching terminal or service. When both r5d CLIs are updated from User Settings, the connected runtime verifies the installed versions, exits with a reload signal, and the supervisor reconnects using the new worker package. Updates only run while the worker has no active commands or shells.
+
+One-click updates use the current user's global npm prefix and never invoke `sudo`. If that prefix is not writable, User Settings provides the exact command to run manually.
+
 The agent runs commands through the virtual shell command:
 
 ```sh

package/dist/cjs/cli-update.cjs

@@ -0,0 +1,108 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var cli_update_exports = {};
+__export(cli_update_exports, {
+  getManualCliUpdateCommand: () => getManualCliUpdateCommand,
+  installCliUpdate: () => installCliUpdate,
+  parseCliVersion: () => parseCliVersion,
+  readInstalledCliVersion: () => readInstalledCliVersion,
+  runCommand: () => runCommand
+});
+module.exports = __toCommonJS(cli_update_exports);
+const UPDATE_OUTPUT_LIMIT = 8e3;
+function collectOutput(value) {
+  if (!value || typeof value === "number") {
+    return Promise.resolve("");
+  }
+  return new Response(value).text();
+}
+async function runCommand(argv) {
+  const child = Bun.spawn(argv, {
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([collectOutput(child.stdout), collectOutput(child.stderr), child.exited]);
+  return { exitCode, stdout, stderr };
+}
+function parseCliVersion(cliName, output) {
+  const escapedName = cliName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = output.trim().match(new RegExp(`(?:^|\\n)${escapedName}\\s+(\\S+)`));
+  return match?.[1]?.trim() || null;
+}
+function readInstalledCliVersion(cliName) {
+  try {
+    const result = Bun.spawnSync([cliName, "--version"], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      return null;
+    }
+    return parseCliVersion(cliName, Buffer.from(result.stdout).toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function getManualCliUpdateCommand(input) {
+  return `npm install -g --omit=dev ${shellQuote(input.workerPackageSpec)} ${shellQuote(input.r5dctlPackageSpec)}`;
+}
+function commandErrorDetail(result) {
+  const detail = `${result.stderr.trim()}${result.stderr.trim() && result.stdout.trim() ? "\n" : ""}${result.stdout.trim()}`.trim();
+  if (!detail) {
+    return `exit code ${result.exitCode}`;
+  }
+  return detail.slice(-UPDATE_OUTPUT_LIMIT);
+}
+async function readVerifiedVersion(cliName, targetVersion, runner) {
+  const result = await runner([cliName, "--version"]);
+  const installedVersion = result.exitCode === 0 ? parseCliVersion(cliName, result.stdout) : null;
+  if (!installedVersion) {
+    throw new Error(`${cliName} was installed but is not runnable: ${commandErrorDetail(result)}`);
+  }
+  if (installedVersion !== targetVersion) {
+    throw new Error(`${cliName} ${installedVersion} was installed; expected ${targetVersion}`);
+  }
+  return installedVersion;
+}
+async function installCliUpdate(input, runner = runCommand) {
+  const installArgs = ["npm", "install", "-g", "--omit=dev", input.workerPackageSpec, input.r5dctlPackageSpec];
+  const result = await runner(installArgs);
+  if (result.exitCode !== 0) {
+    throw new Error(`CLI update failed: ${commandErrorDetail(result)}
+Run manually: ${getManualCliUpdateCommand(input)}`);
+  }
+  const [installedWorkerVersion, installedR5dctlVersion] = await Promise.all([
+    readVerifiedVersion("r5d-worker", input.targetWorkerVersion, runner),
+    readVerifiedVersion("r5dctl", input.targetR5dctlVersion, runner)
+  ]);
+  return { installedWorkerVersion, installedR5dctlVersion };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getManualCliUpdateCommand,
+  installCliUpdate,
+  parseCliVersion,
+  readInstalledCliVersion,
+  runCommand
+});

package/dist/cjs/main.cjs

@@ -46,8 +46,10 @@ var import_node_path = __toESM(require("node:path"), 1);
 var import_node_crypto = require("node:crypto");
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_child_process = require("node:child_process");
+var import_cli_update = require("./cli-update.cjs");
 var import_git_identity = require("./git-identity.cjs");
 var import_heartbeat = require("./heartbeat.cjs");
+var import_supervisor = require("./supervisor.cjs");
 const import_meta = {};
 const DEFAULT_BASE_URL = "https://r5d.dev";
 const WORKER_PACKAGE_NAME = "@ricsam/r5d-worker";
@@ -2358,6 +2360,9 @@ async function startWorker(options) {
   import_node_fs.default.mkdirSync(planRoot, { recursive: true });
   const manifestByProjectId = /* @__PURE__ */ new Map();
   let repositorySyncQueue = Promise.resolve();
+  let repositorySyncInProgress = false;
+  let cliUpdateInProgress = false;
+  let reloadAfterClose = false;
   const ws = new WebSocket(websocketUrl(baseUrl, label), {
     headers: {
       Authorization: `Bearer ${token}`
@@ -2391,6 +2396,10 @@ async function startWorker(options) {
         arch: process.arch,
         pid: process.pid,
         version: getWorkerVersion(),
+        r5dctlVersion: (0, import_cli_update.readInstalledCliVersion)("r5dctl"),
+        capabilities: {
+          updateClis: true
+        },
         projectRoot: projectsRoot,
         artifactRoot,
         planRoot
@@ -2418,32 +2427,49 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "sync_projects") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "sync_projects_result",
+            requestId: message.requestId,
+            result: {
+              status: "blocked",
+              results: [],
+              blockedBy: []
+            }
+          });
+          return;
+        }
         let syncResult = { status: "completed", results: [], blockedBy: [] };
         const executeSync = async () => {
-          syncResult = await syncManifestProjectsFromInternal({
-            baseUrl,
-            token,
-            projectsRoot,
-            syncRoot,
-            manifests: [...manifestByProjectId.values()],
-            projectIds: message.projectIds
-          });
-          for (const result of syncResult.results) {
-            if (result.status !== "synced") continue;
-            try {
-              await syncProjectPlans({
-                baseUrl,
-                token,
-                projectId: result.projectId,
-                branchName: result.branchName,
-                planRoot
-              });
-            } catch (error) {
-              process.stderr.write(
-                `[r5d-worker] plan sync skipped for ${result.projectId}/${result.branchName}: ${error instanceof Error ? error.message : String(error)}
+          repositorySyncInProgress = true;
+          try {
+            syncResult = await syncManifestProjectsFromInternal({
+              baseUrl,
+              token,
+              projectsRoot,
+              syncRoot,
+              manifests: [...manifestByProjectId.values()],
+              projectIds: message.projectIds
+            });
+            for (const result of syncResult.results) {
+              if (result.status !== "synced") continue;
+              try {
+                await syncProjectPlans({
+                  baseUrl,
+                  token,
+                  projectId: result.projectId,
+                  branchName: result.branchName,
+                  planRoot
+                });
+              } catch (error) {
+                process.stderr.write(
+                  `[r5d-worker] plan sync skipped for ${result.projectId}/${result.branchName}: ${error instanceof Error ? error.message : String(error)}
 `
-              );
+                );
+              }
             }
+          } finally {
+            repositorySyncInProgress = false;
           }
         };
         const queued = repositorySyncQueue.then(executeSync, executeSync);
@@ -2475,6 +2501,43 @@ async function startWorker(options) {
         });
         return;
       }
+      if (message.type === "update_clis") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            error: "A CLI update is already in progress"
+          });
+          return;
+        }
+        if (activeProcesses.size > 0 || activePtys.size > 0 || repositorySyncInProgress) {
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            error: "Worker is busy. Stop active commands and shells, then retry the CLI update."
+          });
+          return;
+        }
+        cliUpdateInProgress = true;
+        try {
+          const result = await (0, import_cli_update.installCliUpdate)(message);
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            ...result
+          });
+          reloadAfterClose = true;
+          ws.close(1e3, "Activating updated CLIs");
+        } catch (error) {
+          cliUpdateInProgress = false;
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+        return;
+      }
       if (message.type === "ping") {
         lastServerHeartbeatAt = Date.now();
         ws.send(JSON.stringify({ type: "pong" }));
@@ -2499,6 +2562,15 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "pty_open") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "pty_error",
+            requestId: message.requestId,
+            ptyId: message.ptyId,
+            error: "Worker is activating a CLI update"
+          });
+          return;
+        }
         await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
@@ -2520,6 +2592,16 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "exec_result",
+            requestId: message.requestId,
+            stdout: "",
+            stderr: "Worker is activating a CLI update",
+            exitCode: 1
+          });
+          return;
+        }
         await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
@@ -2540,6 +2622,15 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec_start") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "exec_start_error",
+            requestId: message.requestId,
+            runId: message.runId,
+            error: "Worker is activating a CLI update"
+          });
+          return;
+        }
         await repositorySyncQueue;
         sendWorkerMessage(ws, {
           type: "exec_accepted",
@@ -2637,6 +2728,9 @@ async function startWorker(options) {
     const reason = event.reason ? `: ${event.reason}` : "";
     process.stderr.write(`[r5d-worker] disconnected (${event.code}${reason})
 `);
+    if (reloadAfterClose) {
+      process.exit(import_supervisor.WORKER_RELOAD_EXIT_CODE);
+    }
     if (activeProcesses.size > 0) {
       const delayMs = 2e3;
       process.stderr.write(`[r5d-worker] ${activeProcesses.size} process(es) still active; reconnecting in ${delayMs}ms
@@ -2675,7 +2769,15 @@ async function main() {
     printVersion();
     return;
   }
-  await startWorker(parsed.options);
+  if (process.env[import_supervisor.WORKER_RUNTIME_ENV] === "1") {
+    delete process.env[import_supervisor.WORKER_RUNTIME_ENV];
+    await startWorker(parsed.options);
+    return;
+  }
+  const exitCode = await (0, import_supervisor.superviseWorkerRuntime)(process.argv.slice(2));
+  if (exitCode !== 0) {
+    process.exit(exitCode);
+  }
 }
 function isCliEntrypoint() {
   if (import_meta.main) {

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.27",
+  "version": "0.0.29",
   "type": "commonjs"
 }

package/dist/cjs/supervisor.cjs

@@ -0,0 +1,58 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var supervisor_exports = {};
+__export(supervisor_exports, {
+  WORKER_RELOAD_EXIT_CODE: () => WORKER_RELOAD_EXIT_CODE,
+  WORKER_RUNTIME_ENV: () => WORKER_RUNTIME_ENV,
+  superviseWorkerRuntime: () => superviseWorkerRuntime
+});
+module.exports = __toCommonJS(supervisor_exports);
+const WORKER_RUNTIME_ENV = "R5D_WORKER_INTERNAL_RUNTIME";
+const WORKER_RELOAD_EXIT_CODE = 75;
+function defaultRuntimeSpawner(argv, options) {
+  return Bun.spawn(argv, options);
+}
+async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = defaultRuntimeSpawner) {
+  if (!process.argv[1]) {
+    throw new Error("Cannot locate the r5d-worker entrypoint");
+  }
+  while (true) {
+    const runtime = spawnRuntime([process.execPath, process.argv[1], ...argv], {
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit",
+      env: {
+        ...env,
+        [WORKER_RUNTIME_ENV]: "1"
+      }
+    });
+    const exitCode = await runtime.exited;
+    if (exitCode === WORKER_RELOAD_EXIT_CODE) {
+      process.stdout.write("[r5d-worker] activating updated worker runtime\n");
+      continue;
+    }
+    return exitCode;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  WORKER_RELOAD_EXIT_CODE,
+  WORKER_RUNTIME_ENV,
+  superviseWorkerRuntime
+});

package/dist/mjs/cli-update.mjs

@@ -0,0 +1,80 @@
+const UPDATE_OUTPUT_LIMIT = 8e3;
+function collectOutput(value) {
+  if (!value || typeof value === "number") {
+    return Promise.resolve("");
+  }
+  return new Response(value).text();
+}
+async function runCommand(argv) {
+  const child = Bun.spawn(argv, {
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([collectOutput(child.stdout), collectOutput(child.stderr), child.exited]);
+  return { exitCode, stdout, stderr };
+}
+function parseCliVersion(cliName, output) {
+  const escapedName = cliName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = output.trim().match(new RegExp(`(?:^|\\n)${escapedName}\\s+(\\S+)`));
+  return match?.[1]?.trim() || null;
+}
+function readInstalledCliVersion(cliName) {
+  try {
+    const result = Bun.spawnSync([cliName, "--version"], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      return null;
+    }
+    return parseCliVersion(cliName, Buffer.from(result.stdout).toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function getManualCliUpdateCommand(input) {
+  return `npm install -g --omit=dev ${shellQuote(input.workerPackageSpec)} ${shellQuote(input.r5dctlPackageSpec)}`;
+}
+function commandErrorDetail(result) {
+  const detail = `${result.stderr.trim()}${result.stderr.trim() && result.stdout.trim() ? "\n" : ""}${result.stdout.trim()}`.trim();
+  if (!detail) {
+    return `exit code ${result.exitCode}`;
+  }
+  return detail.slice(-UPDATE_OUTPUT_LIMIT);
+}
+async function readVerifiedVersion(cliName, targetVersion, runner) {
+  const result = await runner([cliName, "--version"]);
+  const installedVersion = result.exitCode === 0 ? parseCliVersion(cliName, result.stdout) : null;
+  if (!installedVersion) {
+    throw new Error(`${cliName} was installed but is not runnable: ${commandErrorDetail(result)}`);
+  }
+  if (installedVersion !== targetVersion) {
+    throw new Error(`${cliName} ${installedVersion} was installed; expected ${targetVersion}`);
+  }
+  return installedVersion;
+}
+async function installCliUpdate(input, runner = runCommand) {
+  const installArgs = ["npm", "install", "-g", "--omit=dev", input.workerPackageSpec, input.r5dctlPackageSpec];
+  const result = await runner(installArgs);
+  if (result.exitCode !== 0) {
+    throw new Error(`CLI update failed: ${commandErrorDetail(result)}
+Run manually: ${getManualCliUpdateCommand(input)}`);
+  }
+  const [installedWorkerVersion, installedR5dctlVersion] = await Promise.all([
+    readVerifiedVersion("r5d-worker", input.targetWorkerVersion, runner),
+    readVerifiedVersion("r5dctl", input.targetR5dctlVersion, runner)
+  ]);
+  return { installedWorkerVersion, installedR5dctlVersion };
+}
+export {
+  getManualCliUpdateCommand,
+  installCliUpdate,
+  parseCliVersion,
+  readInstalledCliVersion,
+  runCommand
+};

package/dist/mjs/main.mjs

@@ -4,8 +4,10 @@ import path from "node:path";
 import { createHash } from "node:crypto";
 import os, { hostname } from "node:os";
 import { spawn as spawnChildProcess } from "node:child_process";
+import { installCliUpdate, readInstalledCliVersion } from "./cli-update.mjs";
 import { configureVisibleGitIdentity } from "./git-identity.mjs";
 import { hasWorkerHeartbeatTimedOut, WORKER_HEARTBEAT_INTERVAL_MS } from "./heartbeat.mjs";
+import { superviseWorkerRuntime, WORKER_RELOAD_EXIT_CODE, WORKER_RUNTIME_ENV } from "./supervisor.mjs";
 const DEFAULT_BASE_URL = "https://r5d.dev";
 const WORKER_PACKAGE_NAME = "@ricsam/r5d-worker";
 const LABEL_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/;
@@ -2315,6 +2317,9 @@ async function startWorker(options) {
   fs.mkdirSync(planRoot, { recursive: true });
   const manifestByProjectId = /* @__PURE__ */ new Map();
   let repositorySyncQueue = Promise.resolve();
+  let repositorySyncInProgress = false;
+  let cliUpdateInProgress = false;
+  let reloadAfterClose = false;
   const ws = new WebSocket(websocketUrl(baseUrl, label), {
     headers: {
       Authorization: `Bearer ${token}`
@@ -2348,6 +2353,10 @@ async function startWorker(options) {
         arch: process.arch,
         pid: process.pid,
         version: getWorkerVersion(),
+        r5dctlVersion: readInstalledCliVersion("r5dctl"),
+        capabilities: {
+          updateClis: true
+        },
         projectRoot: projectsRoot,
         artifactRoot,
         planRoot
@@ -2375,32 +2384,49 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "sync_projects") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "sync_projects_result",
+            requestId: message.requestId,
+            result: {
+              status: "blocked",
+              results: [],
+              blockedBy: []
+            }
+          });
+          return;
+        }
         let syncResult = { status: "completed", results: [], blockedBy: [] };
         const executeSync = async () => {
-          syncResult = await syncManifestProjectsFromInternal({
-            baseUrl,
-            token,
-            projectsRoot,
-            syncRoot,
-            manifests: [...manifestByProjectId.values()],
-            projectIds: message.projectIds
-          });
-          for (const result of syncResult.results) {
-            if (result.status !== "synced") continue;
-            try {
-              await syncProjectPlans({
-                baseUrl,
-                token,
-                projectId: result.projectId,
-                branchName: result.branchName,
-                planRoot
-              });
-            } catch (error) {
-              process.stderr.write(
-                `[r5d-worker] plan sync skipped for ${result.projectId}/${result.branchName}: ${error instanceof Error ? error.message : String(error)}
+          repositorySyncInProgress = true;
+          try {
+            syncResult = await syncManifestProjectsFromInternal({
+              baseUrl,
+              token,
+              projectsRoot,
+              syncRoot,
+              manifests: [...manifestByProjectId.values()],
+              projectIds: message.projectIds
+            });
+            for (const result of syncResult.results) {
+              if (result.status !== "synced") continue;
+              try {
+                await syncProjectPlans({
+                  baseUrl,
+                  token,
+                  projectId: result.projectId,
+                  branchName: result.branchName,
+                  planRoot
+                });
+              } catch (error) {
+                process.stderr.write(
+                  `[r5d-worker] plan sync skipped for ${result.projectId}/${result.branchName}: ${error instanceof Error ? error.message : String(error)}
 `
-              );
+                );
+              }
             }
+          } finally {
+            repositorySyncInProgress = false;
           }
         };
         const queued = repositorySyncQueue.then(executeSync, executeSync);
@@ -2432,6 +2458,43 @@ async function startWorker(options) {
         });
         return;
       }
+      if (message.type === "update_clis") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            error: "A CLI update is already in progress"
+          });
+          return;
+        }
+        if (activeProcesses.size > 0 || activePtys.size > 0 || repositorySyncInProgress) {
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            error: "Worker is busy. Stop active commands and shells, then retry the CLI update."
+          });
+          return;
+        }
+        cliUpdateInProgress = true;
+        try {
+          const result = await installCliUpdate(message);
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            ...result
+          });
+          reloadAfterClose = true;
+          ws.close(1e3, "Activating updated CLIs");
+        } catch (error) {
+          cliUpdateInProgress = false;
+          sendWorkerMessage(ws, {
+            type: "update_clis_result",
+            requestId: message.requestId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+        return;
+      }
       if (message.type === "ping") {
         lastServerHeartbeatAt = Date.now();
         ws.send(JSON.stringify({ type: "pong" }));
@@ -2456,6 +2519,15 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "pty_open") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "pty_error",
+            requestId: message.requestId,
+            ptyId: message.ptyId,
+            error: "Worker is activating a CLI update"
+          });
+          return;
+        }
         await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
@@ -2477,6 +2549,16 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "exec_result",
+            requestId: message.requestId,
+            stdout: "",
+            stderr: "Worker is activating a CLI update",
+            exitCode: 1
+          });
+          return;
+        }
         await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
@@ -2497,6 +2579,15 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec_start") {
+        if (cliUpdateInProgress) {
+          sendWorkerMessage(ws, {
+            type: "exec_start_error",
+            requestId: message.requestId,
+            runId: message.runId,
+            error: "Worker is activating a CLI update"
+          });
+          return;
+        }
         await repositorySyncQueue;
         sendWorkerMessage(ws, {
           type: "exec_accepted",
@@ -2594,6 +2685,9 @@ async function startWorker(options) {
     const reason = event.reason ? `: ${event.reason}` : "";
     process.stderr.write(`[r5d-worker] disconnected (${event.code}${reason})
 `);
+    if (reloadAfterClose) {
+      process.exit(WORKER_RELOAD_EXIT_CODE);
+    }
     if (activeProcesses.size > 0) {
       const delayMs = 2e3;
       process.stderr.write(`[r5d-worker] ${activeProcesses.size} process(es) still active; reconnecting in ${delayMs}ms
@@ -2632,7 +2726,15 @@ async function main() {
     printVersion();
     return;
   }
-  await startWorker(parsed.options);
+  if (process.env[WORKER_RUNTIME_ENV] === "1") {
+    delete process.env[WORKER_RUNTIME_ENV];
+    await startWorker(parsed.options);
+    return;
+  }
+  const exitCode = await superviseWorkerRuntime(process.argv.slice(2));
+  if (exitCode !== 0) {
+    process.exit(exitCode);
+  }
 }
 function isCliEntrypoint() {
   if (import.meta.main) {

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.27",
+  "version": "0.0.29",
   "type": "module"
 }

package/dist/mjs/supervisor.mjs

@@ -0,0 +1,32 @@
+const WORKER_RUNTIME_ENV = "R5D_WORKER_INTERNAL_RUNTIME";
+const WORKER_RELOAD_EXIT_CODE = 75;
+function defaultRuntimeSpawner(argv, options) {
+  return Bun.spawn(argv, options);
+}
+async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = defaultRuntimeSpawner) {
+  if (!process.argv[1]) {
+    throw new Error("Cannot locate the r5d-worker entrypoint");
+  }
+  while (true) {
+    const runtime = spawnRuntime([process.execPath, process.argv[1], ...argv], {
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit",
+      env: {
+        ...env,
+        [WORKER_RUNTIME_ENV]: "1"
+      }
+    });
+    const exitCode = await runtime.exited;
+    if (exitCode === WORKER_RELOAD_EXIT_CODE) {
+      process.stdout.write("[r5d-worker] activating updated worker runtime\n");
+      continue;
+    }
+    return exitCode;
+  }
+}
+export {
+  WORKER_RELOAD_EXIT_CODE,
+  WORKER_RUNTIME_ENV,
+  superviseWorkerRuntime
+};

package/dist/types/cli-update.d.ts

@@ -0,0 +1,21 @@
+export type CommandResult = {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+};
+export type CommandRunner = (argv: string[]) => Promise<CommandResult>;
+export type CliUpdateRequest = {
+    workerPackageSpec: string;
+    r5dctlPackageSpec: string;
+    targetWorkerVersion: string;
+    targetR5dctlVersion: string;
+};
+export type CliUpdateResult = {
+    installedWorkerVersion: string;
+    installedR5dctlVersion: string;
+};
+export declare function runCommand(argv: string[]): Promise<CommandResult>;
+export declare function parseCliVersion(cliName: "r5d-worker" | "r5dctl", output: string): string | null;
+export declare function readInstalledCliVersion(cliName: "r5d-worker" | "r5dctl"): string | null;
+export declare function getManualCliUpdateCommand(input: Pick<CliUpdateRequest, "workerPackageSpec" | "r5dctlPackageSpec">): string;
+export declare function installCliUpdate(input: CliUpdateRequest, runner?: CommandRunner): Promise<CliUpdateResult>;

package/dist/types/supervisor.d.ts

@@ -0,0 +1,13 @@
+export declare const WORKER_RUNTIME_ENV = "R5D_WORKER_INTERNAL_RUNTIME";
+export declare const WORKER_RELOAD_EXIT_CODE = 75;
+type RuntimeProcess = {
+    exited: Promise<number>;
+};
+export type RuntimeSpawner = (argv: string[], options: {
+    stdin: "inherit";
+    stdout: "inherit";
+    stderr: "inherit";
+    env: Record<string, string | undefined>;
+}) => RuntimeProcess;
+export declare function superviseWorkerRuntime(argv: string[], env?: Record<string, string | undefined>, spawnRuntime?: RuntimeSpawner): Promise<number>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.27",
+  "version": "0.0.29",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",