@sagentlab/navarch-runtime 0.1.5 → 0.1.7

package/dist/claim-loop.cjs

@@ -20,6 +20,7 @@ class ClaimLoop {
     timer = null;
     stopped = false;
     claimInFlight = false;
+    quiescenceWaiters = new Set();
     constructor(api, config, capacity, runSession) {
         this.api = api;
         this.config = config;
@@ -29,6 +30,7 @@ class ClaimLoop {
     start() {
         if (this.timer)
             return;
+        this.stopped = false;
         this.timer = setInterval(() => void this.tick(), this.config.pollIntervalMs);
     }
     stop() {
@@ -36,6 +38,18 @@ class ClaimLoop {
         if (this.timer)
             clearInterval(this.timer);
         this.timer = null;
+        this.resolveQuiescenceWaiters();
+    }
+    /**
+     * Stops new polls and waits for a claim request already on the wire to
+     * settle. If that request returns a lease, the session is still run; callers
+     * must then wait for CapacityTracker.waitForIdle() before restarting.
+     */
+    async drain() {
+        this.stop();
+        if (!this.claimInFlight)
+            return;
+        await new Promise((resolve) => this.quiescenceWaiters.add(resolve));
     }
     async tick() {
         if (this.stopped || this.claimInFlight || !this.capacity.hasCapacity())
@@ -75,7 +89,15 @@ class ClaimLoop {
         }
         finally {
             this.claimInFlight = false;
+            this.resolveQuiescenceWaiters();
         }
     }
+    resolveQuiescenceWaiters() {
+        if (this.claimInFlight)
+            return;
+        for (const resolve of this.quiescenceWaiters)
+            resolve();
+        this.quiescenceWaiters.clear();
+    }
 }
 exports.ClaimLoop = ClaimLoop;

package/dist/cli.cjs

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
 const config_cjs_1 = require("./config.cjs");
+const node_crypto_1 = require("node:crypto");
 const machine_store_cjs_1 = require("./machine-store.cjs");
 const api_cjs_1 = require("./api.cjs");
 const capacity_cjs_1 = require("./capacity.cjs");
@@ -10,6 +11,8 @@ const claim_loop_cjs_1 = require("./claim-loop.cjs");
 const session_cjs_1 = require("./session.cjs");
 const sandbox_cjs_1 = require("./sandbox.cjs");
 const logger_cjs_1 = require("./logger.cjs");
+const update_coordinator_cjs_1 = require("./update-coordinator.cjs");
+const supervisor_cjs_1 = require("./supervisor.cjs");
 const log = (0, logger_cjs_1.createLogger)("cli");
 const PACKAGE_NAME = "@sagentlab/navarch-runtime";
 /**
@@ -99,7 +102,7 @@ async function registerCommand(flags) {
     console.log("Machine registered.");
     console.log(`  machine_id: ${result.machine_id}`);
     console.log(`  token:      ${result.token}`);
-    console.log(`\nStored in ${config.configDir}/machine.json (mode 0600). Run \`${invocation("start")}\` to begin serving tasks.`);
+    console.log(`\nStored in ${config.configDir}/machine.json (mode 0600). Run \`${invocation("supervise")}\` to begin serving tasks.`);
 }
 /**
  * `navarch-runtime connect` — "Connect an agent to a project"
@@ -147,7 +150,7 @@ async function connectCommand(flags) {
     console.log("Machine connected.");
     console.log(`  machine_id: ${result.machine_id}`);
     console.log(`  token:      ${result.token}`);
-    console.log(`\nStored in ${config.configDir}/machine.json (mode 0600). Run \`${invocation("start")}\` to begin serving tasks.`);
+    console.log(`\nStored in ${config.configDir}/machine.json (mode 0600). Run \`${invocation("supervise")}\` to begin serving tasks.`);
 }
 async function startCommand(flags) {
     const baseConfig = (0, config_cjs_1.loadRuntimeConfig)();
@@ -160,20 +163,52 @@ async function startCommand(flags) {
     const config = { ...baseConfig, agentType };
     const api = new api_cjs_1.NavarchApiClient({ baseUrl: identity.api_base, token: identity.token });
     const capacity = new capacity_cjs_1.CapacityTracker(config.maxSessions);
-    const heartbeat = new heartbeat_loop_cjs_1.MachineHeartbeatLoop(api, identity.machine_id, config, capacity);
     const claimLoop = new claim_loop_cjs_1.ClaimLoop(api, config, capacity, (claimed, sessionId) => (0, session_cjs_1.runSession)({ api, config }, claimed, sessionId));
+    const bootId = (0, node_crypto_1.randomUUID)();
+    const updateCoordinatorRef = {};
+    let readySent = false;
+    const heartbeat = new heartbeat_loop_cjs_1.MachineHeartbeatLoop(api, identity.machine_id, config, capacity, bootId, (result) => updateCoordinatorRef.current?.consider(result.update), () => {
+        if (!readySent && process.send) {
+            readySent = true;
+            process.send({ type: "navarch-ready", boot_id: bootId });
+        }
+    });
+    updateCoordinatorRef.current = new update_coordinator_cjs_1.RuntimeUpdateCoordinator({
+        config,
+        claimLoop,
+        capacity,
+        heartbeat,
+    });
     heartbeat.start();
     claimLoop.start();
     log.info(`navarch-runtime started: machine=${identity.name} agent=${config.agentType} max_sessions=${config.maxSessions} api_base=${identity.api_base}`);
+    let shuttingDown = false;
     const shutdown = () => {
-        log.info("shutting down...");
-        heartbeat.stop();
-        claimLoop.stop();
-        process.exit(0);
+        if (shuttingDown) {
+            log.warn("second shutdown signal received; forcing exit with active work");
+            process.exit(1);
+        }
+        shuttingDown = true;
+        void (async () => {
+            log.info("shutting down: draining active sessions...");
+            heartbeat.setUpdateState("draining");
+            await claimLoop.drain();
+            await capacity.waitForIdle();
+            heartbeat.stop();
+            log.info("shutdown drain complete");
+            process.exit(0);
+        })();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
 }
+async function superviseCommand(flags) {
+    const config = (0, config_cjs_1.loadRuntimeConfig)();
+    const agentType = agentFromFlag(flags);
+    const workerArgs = agentType ? ["--agent", agentType] : [];
+    const exitCode = await (0, supervisor_cjs_1.superviseRuntime)(config.configDir, process.argv[1] ?? "", workerArgs);
+    process.exitCode = exitCode;
+}
 async function doctorCommand(flags) {
     const config = (0, config_cjs_1.loadRuntimeConfig)();
     const dockerOk = await (0, sandbox_cjs_1.isDockerAvailable)();
@@ -206,6 +241,7 @@ Usage:
   navarch-runtime connect --token <enrollment-token> --name <machine-name> \\
       [--agent claude-code|codex] [--project <project-id>] [--capabilities a,b] [--max-sessions N] [--api-base url]
   navarch-runtime start [--agent claude-code|codex]
+  navarch-runtime supervise [--agent claude-code|codex]
   navarch-runtime doctor
 
 Configuration is via NAVARCH_* environment variables; see runtime/README.md.
@@ -224,6 +260,9 @@ async function main(argv = process.argv.slice(2)) {
             case "start":
                 await startCommand(flags);
                 break;
+            case "supervise":
+                await superviseCommand(flags);
+                break;
             case "doctor":
                 await doctorCommand(flags);
                 break;

package/dist/config.cjs

@@ -60,5 +60,15 @@ function loadRuntimeConfig(env = process.env) {
         mcpConfigPath: env.NAVARCH_MCP_CONFIG_PATH ?? null,
         sandboxMode,
         dockerImage: env.NAVARCH_DOCKER_IMAGE ?? "node:20-slim",
+        // Multiple sessions share one machine; keeping each agent inside its own
+        // worktree is the safe default, so disabling is the explicit opt-out.
+        worktreeGuard: !["off", "false", "0"].includes(env.NAVARCH_WORKTREE_GUARD ?? ""),
+        guardExtraRoots: (env.NAVARCH_GUARD_EXTRA_ROOTS ?? "")
+            .split(node_path_1.default.delimiter)
+            .map((s) => s.trim())
+            .filter(Boolean),
+        updateChannel: env.NAVARCH_UPDATE_CHANNEL === "canary" ? "canary" : "stable",
+        autoUpdate: env.NAVARCH_SUPERVISED === "1" &&
+            !["off", "false", "0"].includes(env.NAVARCH_AUTO_UPDATE ?? ""),
     };
 }

package/dist/git-worktree.cjs

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitWorktree = void 0;
+exports.branchSlug = branchSlug;
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = require("node:fs");
 const sandbox_cjs_1 = require("./sandbox.cjs");
@@ -28,7 +29,7 @@ class GitWorktree {
         this.sessionRoot = node_path_1.default.join(options.workspaceRoot, "sessions", sessionKey);
         this.worktreePath = node_path_1.default.join(this.sessionRoot, "repo");
         this.repositoryPath = node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
-        this.branch = `navarch/${safePathSegment(options.taskId).slice(0, 32)}-${sessionKey.slice(0, 12)}`;
+        this.branch = `navarch/${branchSlug(options)}-${sessionKey.toLowerCase().slice(0, 8)}`;
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.cloneUrl = options.cloneUrl;
         this.githubToken = options.githubToken;
@@ -130,6 +131,32 @@ async function pathExists(value) {
         return false;
     }
 }
+/**
+ * Kebab-case slug for the session branch, derived from the task summary so
+ * branch names read like `navarch/fix-login-redirect-a1b2c3d4` instead of a
+ * UUID mash. Falls back to the task type, then a task-id prefix, when the
+ * summary yields nothing. Output contains only [a-z0-9-] with no leading or
+ * trailing dash, so it is always a valid git ref component (no `..`, no
+ * trailing `.lock`).
+ */
+function branchSlug(options) {
+    for (const candidate of [options.taskSummary, options.taskType]) {
+        const slug = (candidate ?? "")
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-+/, "")
+            .slice(0, 40)
+            .replace(/-+$/, "");
+        if (slug)
+            return slug;
+    }
+    const idSlug = safePathSegment(options.taskId)
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .slice(0, 8)
+        .replace(/^-+|-+$/g, "");
+    return idSlug || "task";
+}
 function safePathSegment(value) {
     const safe = value.replace(/[^A-Za-z0-9_.-]/g, "-").replace(/^-+|-+$/g, "");
     if (!safe)

package/dist/heartbeat-loop.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MachineHeartbeatLoop = void 0;
+const version_cjs_1 = require("./version.cjs");
 const logger_cjs_1 = require("./logger.cjs");
 const log = (0, logger_cjs_1.createLogger)("heartbeat");
 /**
@@ -14,12 +15,21 @@ class MachineHeartbeatLoop {
     machineId;
     config;
     capacity;
+    bootId;
+    onResult;
+    onHealthy;
     timer = null;
-    constructor(api, machineId, config, capacity) {
+    updateState = "idle";
+    lastUpdateError;
+    draining = false;
+    constructor(api, machineId, config, capacity, bootId, onResult, onHealthy) {
         this.api = api;
         this.machineId = machineId;
         this.config = config;
         this.capacity = capacity;
+        this.bootId = bootId;
+        this.onResult = onResult;
+        this.onHealthy = onHealthy;
     }
     start() {
         if (this.timer)
@@ -32,12 +42,28 @@ class MachineHeartbeatLoop {
             clearInterval(this.timer);
         this.timer = null;
     }
+    setUpdateState(state, error) {
+        this.updateState = state;
+        this.lastUpdateError = error;
+        this.draining = state === "draining";
+        void this.tick();
+    }
     async tick() {
         try {
-            await this.api.machineHeartbeat(this.machineId, {
-                available_capacity: this.capacity.available(),
+            const result = await this.api.machineHeartbeat(this.machineId, {
+                available_capacity: this.draining ? 0 : this.capacity.available(),
                 capabilities: this.config.capabilities,
+                runtime: {
+                    version: version_cjs_1.RUNTIME_VERSION,
+                    updater_protocol: version_cjs_1.UPDATER_PROTOCOL_VERSION,
+                    channel: this.config.updateChannel,
+                    state: this.updateState,
+                    boot_id: this.bootId,
+                    ...(this.lastUpdateError ? { last_update_error: this.lastUpdateError } : {}),
+                },
             });
+            this.onHealthy?.();
+            this.onResult?.(result);
         }
         catch (err) {
             log.warn(`machine heartbeat failed: ${String(err)}`);

package/dist/session.cjs

@@ -16,6 +16,7 @@ const mcp_config_cjs_1 = require("./mcp-config.cjs");
 const logger_cjs_1 = require("./logger.cjs");
 const git_worktree_cjs_1 = require("./git-worktree.cjs");
 const github_pr_cjs_1 = require("./github-pr.cjs");
+const worktree_guard_cjs_1 = require("./worktree-guard.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
 const log = (0, logger_cjs_1.createLogger)("session");
@@ -42,7 +43,7 @@ async function runSession(deps, claimed, sessionId) {
     const { lease_id: leaseId, task, context_bundle: bundle } = claimed;
     const execution = bundle.execution ?? {
         profile: task.execution_profile ?? "standard",
-        model: config.agentType === "codex" ? "gpt-5.6" : "best",
+        model: config.agentType === "codex" ? "gpt-5.6-sol" : "best",
         reasoning_effort: "medium",
     };
     const executionReport = {
@@ -91,6 +92,8 @@ async function runSession(deps, claimed, sessionId) {
         workspaceRoot: config.workspaceRoot,
         projectId: task.project_id,
         taskId: task.id,
+        taskSummary: task.summary,
+        taskType: task.task_type,
         sessionId,
         cloneUrl,
         githubToken,
@@ -183,6 +186,39 @@ async function runSession(deps, claimed, sessionId) {
         await node_fs_1.promises.writeFile(node_path_1.default.join(workDir, MCP_CONFIG_FILENAME), JSON.stringify(mcpConfig, null, 2), "utf8");
         mcpConfigPath = node_path_1.default.join(workDir, MCP_CONFIG_FILENAME);
     }
+    // Worktree boundary guard (worktree-guard.cts): several sessions share this
+    // machine. Host-mode Claude gets a generated PreToolUse hook; host-mode
+    // Codex gets an OS-enforced native permission profile over the same roots.
+    // Docker mode already has a container boundary. NAVARCH_WORKTREE_GUARD=off
+    // opts out for either agent.
+    let claudeSettingsPath = null;
+    let codexGuardArgs;
+    if (config.sandboxMode === "host" && config.worktreeGuard) {
+        if (config.agentType === "claude-code") {
+            if (config.claudeExtraArgs.includes("--settings")) {
+                log.warn("NAVARCH_CLAUDE_EXTRA_ARGS supplies --settings; skipping the generated worktree-guard settings for this session.");
+            }
+            else {
+                const guard = await (0, worktree_guard_cjs_1.prepareWorktreeGuard)({
+                    workDir,
+                    worktreePath: gitWorktree.worktreePath,
+                    repositoryPath: gitWorktree.repositoryPath,
+                    workspaceRoot: config.workspaceRoot,
+                    extraRoots: config.guardExtraRoots,
+                });
+                claudeSettingsPath = guard.settingsPath;
+            }
+        }
+        else {
+            codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
+                workDir,
+                worktreePath: gitWorktree.worktreePath,
+                repositoryPath: gitWorktree.repositoryPath,
+                workspaceRoot: config.workspaceRoot,
+                extraRoots: config.guardExtraRoots,
+            });
+        }
+    }
     try {
         await gitWorktree.prepare();
         if (sandbox) {
@@ -220,6 +256,8 @@ async function runSession(deps, claimed, sessionId) {
                 reasoningEffort: execution.reasoning_effort,
                 timeoutMs: config.sessionTimeoutMs,
                 env: toEnvMap(secrets),
+                settingsPath: claudeSettingsPath,
+                codexGuardArgs,
                 cwd: sandbox ? undefined : gitWorktree.worktreePath,
                 dockerExec: sandbox ? { containerName: sandbox.name, runner: sandbox_cjs_1.nodeCommandRunner } : undefined,
                 signal: activeAbortController.signal,

package/dist/supervisor.cjs

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.superviseRuntime = superviseRuntime;
+const node_child_process_1 = require("node:child_process");
+const logger_cjs_1 = require("./logger.cjs");
+const update_installer_cjs_1 = require("./update-installer.cjs");
+const log = (0, logger_cjs_1.createLogger)("supervisor");
+const UPDATE_RESTART_EXIT_CODE = 75;
+function runWorker(binPath, args, healthTimeoutMs, setCurrentChild, onHealthy) {
+    return new Promise((resolve) => {
+        const child = (0, node_child_process_1.spawn)(process.execPath, [binPath, "start", ...args], {
+            env: { ...process.env, NAVARCH_SUPERVISED: "1" },
+            stdio: ["inherit", "inherit", "inherit", "ipc"],
+        });
+        setCurrentChild(child);
+        let healthy = false;
+        let healthSignalReceived = false;
+        let healthTimedOut = false;
+        let healthCommit = Promise.resolve();
+        let healthTimer = null;
+        let forceKillTimer = null;
+        let settled = false;
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (healthTimer)
+                clearTimeout(healthTimer);
+            if (forceKillTimer)
+                clearTimeout(forceKillTimer);
+            setCurrentChild(null);
+            void healthCommit.finally(() => resolve({ code, healthy }));
+        };
+        if (healthTimeoutMs !== null) {
+            healthTimer = setTimeout(() => {
+                if (!healthy) {
+                    healthTimedOut = true;
+                    log.error("updated runtime missed its startup health deadline; rolling back");
+                    child.kill("SIGTERM");
+                    forceKillTimer = setTimeout(() => child.kill("SIGKILL"), 10_000);
+                }
+            }, healthTimeoutMs);
+        }
+        child.on("message", (message) => {
+            if (!healthSignalReceived &&
+                !healthTimedOut &&
+                typeof message === "object" &&
+                message !== null &&
+                message.type === "navarch-ready") {
+                healthSignalReceived = true;
+                healthCommit = onHealthy()
+                    .then(() => {
+                    healthy = true;
+                    if (healthTimer)
+                        clearTimeout(healthTimer);
+                    if (forceKillTimer)
+                        clearTimeout(forceKillTimer);
+                })
+                    .catch((error) => {
+                    log.error(`could not commit runtime activation: ${String(error)}`);
+                    child.kill("SIGTERM");
+                });
+            }
+        });
+        child.once("error", (error) => {
+            log.error(`could not start runtime worker: ${String(error)}`);
+            finish(1);
+        });
+        child.once("exit", (code) => finish(code ?? 1));
+    });
+}
+/** Runs the worker and owns update activation, health checking, and rollback. */
+async function superviseRuntime(configDir, initialBinPath, workerArgs = [], healthTimeoutMs = 120_000) {
+    let currentBin = initialBinPath;
+    let rollbackBin = null;
+    let candidatePending = null;
+    let awaitingCandidateHealth = false;
+    let currentChild = null;
+    let stopping = false;
+    const forwardSignal = (signal) => {
+        stopping = true;
+        currentChild?.kill(signal);
+    };
+    const onSigint = () => forwardSignal("SIGINT");
+    const onSigterm = () => forwardSignal("SIGTERM");
+    process.on("SIGINT", onSigint);
+    process.on("SIGTERM", onSigterm);
+    try {
+        const active = await (0, update_installer_cjs_1.readActiveRuntime)(configDir);
+        if (active) {
+            try {
+                const verified = await (0, update_installer_cjs_1.verifyManagedRuntime)(configDir, active);
+                currentBin = verified.bin_path;
+                log.info(`starting active managed runtime ${active.version}`);
+            }
+            catch (error) {
+                log.warn(`ignoring invalid active runtime pointer: ${String(error)}`);
+            }
+        }
+        while (!stopping) {
+            const candidateThisRun = awaitingCandidateHealth;
+            const result = await runWorker(currentBin, workerArgs, candidateThisRun ? healthTimeoutMs : null, (child) => {
+                currentChild = child;
+            }, async () => {
+                if (candidateThisRun) {
+                    if (!candidatePending)
+                        throw new Error("candidate has no pending release metadata");
+                    await (0, update_installer_cjs_1.writeActiveRuntime)(configDir, candidatePending);
+                    await (0, update_installer_cjs_1.clearPendingUpdate)(configDir);
+                    awaitingCandidateHealth = false;
+                    rollbackBin = null;
+                    candidatePending = null;
+                    log.info("updated runtime reported healthy; activation committed");
+                }
+            });
+            if (stopping)
+                return result.code;
+            if (candidateThisRun && !result.healthy) {
+                if (!rollbackBin)
+                    return 1;
+                log.warn("updated runtime failed before becoming healthy; restoring previous version");
+                currentBin = rollbackBin;
+                rollbackBin = null;
+                awaitingCandidateHealth = false;
+                candidatePending = null;
+                await (0, update_installer_cjs_1.clearPendingUpdate)(configDir);
+                continue;
+            }
+            if (result.code !== UPDATE_RESTART_EXIT_CODE)
+                return result.code;
+            const pending = await (0, update_installer_cjs_1.readPendingUpdate)(configDir);
+            if (!pending) {
+                log.error("worker requested an update restart without a pending update");
+                return 1;
+            }
+            const verified = await (0, update_installer_cjs_1.verifyManagedRuntime)(configDir, pending);
+            rollbackBin = currentBin;
+            currentBin = verified.bin_path;
+            candidatePending = pending;
+            awaitingCandidateHealth = true;
+            log.info(`activating staged runtime ${pending.version}`);
+        }
+        return 0;
+    }
+    finally {
+        process.off("SIGINT", onSigint);
+        process.off("SIGTERM", onSigterm);
+    }
+}

package/dist/update-coordinator.cjs

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeUpdateCoordinator = void 0;
+const logger_cjs_1 = require("./logger.cjs");
+const update_installer_cjs_1 = require("./update-installer.cjs");
+const version_cjs_1 = require("./version.cjs");
+const log = (0, logger_cjs_1.createLogger)("update");
+class RuntimeUpdateCoordinator {
+    options;
+    targetInProgress = null;
+    warnedUnsupervised = false;
+    constructor(options) {
+        this.options = options;
+    }
+    consider(directive) {
+        if (!directive || directive.target_version === version_cjs_1.RUNTIME_VERSION)
+            return;
+        if (!this.options.config.autoUpdate) {
+            if (!this.warnedUnsupervised) {
+                log.warn(`runtime ${directive.target_version} is available; run under \`navarch-runtime supervise\` to activate updates automatically`);
+                this.warnedUnsupervised = true;
+            }
+            return;
+        }
+        if (this.targetInProgress)
+            return;
+        this.targetInProgress = directive.target_version;
+        void this.apply(directive);
+    }
+    async apply(directive) {
+        const { config, heartbeat, claimLoop, capacity } = this.options;
+        try {
+            heartbeat.setUpdateState("staging");
+            log.info(`staging runtime ${directive.target_version}`);
+            const staged = await (this.options.stage ?? update_installer_cjs_1.stageRuntimeUpdate)(config.configDir, directive);
+            heartbeat.setUpdateState("draining");
+            log.info("runtime update staged; draining active sessions before restart");
+            await claimLoop.drain();
+            await capacity.waitForIdle();
+            await (0, update_installer_cjs_1.writePendingUpdate)(config.configDir, staged, directive.rollout_id);
+            log.info(`runtime ${directive.target_version} ready; handing off to supervisor`);
+            (this.options.requestRestart ?? ((code) => process.exit(code)))(75);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            log.error(`runtime update failed: ${message}`);
+            heartbeat.setUpdateState("failed", message.slice(0, 500));
+            claimLoop.start();
+            this.targetInProgress = null;
+        }
+    }
+}
+exports.RuntimeUpdateCoordinator = RuntimeUpdateCoordinator;