@abelxiaoxing/cadence 2.0.4 → 2.0.5

package/src/service-cli.mjs

@@ -5,7 +5,7 @@
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync as mkdirSync4 } from "node:fs";
 import { request } from "node:http";
-import { dirname as dirname8, join as join8, resolve as resolve5 } from "node:path";
+import { dirname as dirname8, join as join10, resolve as resolve5 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/task-types.ts
@@ -2484,14 +2484,27 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { delimiter, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, resolve as resolve2, sep as sep2 } from "node:path";
+import {
+  delimiter,
+  dirname as dirname2,
+  isAbsolute as isAbsolute2,
+  join as join2,
+  resolve as resolve2,
+  sep as sep2,
+  win32
+} from "node:path";
 var UNIT = "cadence.service";
 var MARKER = "# Generated by @abelxiaoxing/cadence";
-function hostSystem(root) {
+function wscript(env) {
+  const root = env.SystemRoot;
+  return win32.join(root && win32.isAbsolute(root) ? root : "C:\\Windows", "System32", "wscript.exe");
+}
+function hostSystem(root, owner) {
   const run = (command, args) => {
     const r = spawnSync2(command, args, {
       encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
     });
     return { status: r.error ? null : r.status, stdout: r.stdout ?? "" };
   };
@@ -2502,6 +2515,7 @@ function hostSystem(root) {
     node: process.execPath,
     root,
     unit: UNIT,
+    uid: process.getuid?.(),
     systemctl: (args) => run("systemctl", ["--user", ...args]),
     linger: () => {
       const r = run("loginctl", [
@@ -2528,7 +2542,18 @@ function hostSystem(root) {
         "false"
       ], { stdio: "ignore", timeout: 20000 });
       return !r.error && r.status === 0;
-    }
+    },
+    launchctl: (args) => run("launchctl", args),
+    reg: (args) => run("reg", args),
+    launch: (path) => {
+      const r = spawnSync2(wscript(process.env), [path], {
+        stdio: "ignore",
+        windowsHide: true,
+        timeout: 20000
+      });
+      return !r.error && r.status === 0;
+    },
+    ...owner
   };
 }
 function expandHome(value, home) {
@@ -2602,7 +2627,7 @@ var argument = (value) => quoted(value).replaceAll("$", "$$$$");
 function buildUnit(u) {
   const command = (args) => [u.node, u.cli, ...args].map(argument).join(" ");
   return [
-    `${MARKER} on Pi package install/update; upgrades rewrite this file.`,
+    `${MARKER}; \`cadence server install\` and \`restart\` rewrite this file.`,
     "# Override with `systemctl --user edit cadence`; opt out with `systemctl --user disable --now cadence` or `mask`.",
     "[Unit]",
     "Description=Cadence shared task service and WebUI",
@@ -2630,19 +2655,20 @@ function buildUnit(u) {
   ].join(`
 `);
 }
-function readGenerated(path) {
+function readGenerated(path, marker) {
   try {
     if (!lstatSync2(path).isFile())
       return null;
-    const text2 = readFileSync(path, "utf8");
-    return text2.startsWith(MARKER) ? text2 : null;
+    const bytes = readFileSync(path);
+    const text2 = bytes[0] === 255 && bytes[1] === 254 ? bytes.subarray(2).toString("utf16le") : bytes.toString("utf8");
+    return text2.startsWith(marker) ? text2 : null;
   } catch (error) {
     if (error.code === "ENOENT")
       return;
     throw error;
   }
 }
-function generatedWorkspace(text2) {
+function unitWorkspace(text2) {
   return text2?.match(/^WorkingDirectory=(.+)$/m)?.[1].replaceAll("%%", "%");
 }
 function directory(path) {
@@ -2652,23 +2678,20 @@ function directory(path) {
     return false;
   }
 }
-function unitStateHome(s) {
-  const state = s.env.XDG_STATE_HOME;
-  return state && isAbsolute2(state) ? state : join2(s.home, ".local", "state");
+function serviceStateHome(s) {
+  const state = s.platform === "win32" ? s.env.LOCALAPPDATA : s.env.XDG_STATE_HOME;
+  return state && isAbsolute2(state) ? state : join2(s.home, ...s.platform === "win32" ? ["AppData", "Local"] : [".local", "state"]);
 }
-function selectWorkspace(s, requested, previous) {
+function selectWorkspace(s, requested, kept) {
   let chosen;
   if (requested) {
     chosen = expandHome(requested, s.home);
     if (!directory(chosen))
       throw new ContractError("invalid");
     chosen = resolve2(chosen);
-  } else {
-    const kept = generatedWorkspace(previous);
-    if (kept && directory(kept))
-      chosen = kept;
-  }
-  const landing = chosen ? effectiveWorkspace(chosen, unitStateHome(s), s.home) : { workspace: join2(s.home, LANDING_WORKSPACE), redirected: false };
+  } else if (kept && directory(kept))
+    chosen = kept;
+  const landing = chosen ? effectiveWorkspace(chosen, serviceStateHome(s), s.home) : { workspace: join2(s.home, LANDING_WORKSPACE), redirected: false };
   if (landing.workspace !== chosen)
     mkdirSync2(landing.workspace, { recursive: true });
   return landing.redirected ? { workspace: landing.workspace, redirectedFrom: chosen } : { workspace: landing.workspace };
@@ -2690,7 +2713,18 @@ function regularFile(path) {
     return false;
   }
 }
-function bootStart(s, attempt, interactive) {
+async function settle(s, workspace) {
+  if (!workspace)
+    return;
+  const status = await s.stopOwner(workspace);
+  if (status === "stopped")
+    return;
+  return {
+    status: status === "quarantined" || status === "unavailable" ? status : "unconfirmed",
+    workspace
+  };
+}
+function bootStart(s, attempt) {
   const current = s.linger();
   if (current === undefined)
     return {};
@@ -2698,23 +2732,25 @@ function bootStart(s, attempt, interactive) {
     return { linger: "on" };
   if (!attempt)
     return { linger: "off" };
-  return { linger: s.enableLinger(interactive) ? "enabled" : "refused" };
+  return {
+    linger: s.enableLinger(false) || s.enableLinger(true) ? "enabled" : "refused"
+  };
 }
 function configureAutostart(s, mode, requested, linger = false) {
   if (s.platform !== "linux")
-    return { status: "skipped" };
-  if (mode === "refresh" && (s.env.CADENCE_AUTOSTART === "0" || !piUserInstall(s)))
-    return { status: "skipped" };
+    return { status: "unsupported" };
   if (s.systemctl(["show-environment"]).status !== 0)
     return { status: "unavailable" };
   const path = unitPath(s);
-  const previous = readGenerated(path);
+  const previous = readGenerated(path, MARKER);
   if (previous === null)
     return { status: "foreign", unit: path };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
   const sdk = sdkPackages(s.root);
   if (!sdk)
     return { status: "missing-pi-sdk" };
-  const { workspace, redirectedFrom } = selectWorkspace(s, requested ?? s.env.CADENCE_WORKSPACE, previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, unitWorkspace(previous));
   const agentDir = agentDirectory(s);
   const content = buildUnit({
     node: s.node,
@@ -2737,23 +2773,37 @@ function configureAutostart(s, mode, requested, linger = false) {
   };
   if (enabled.startsWith("masked"))
     return { status: "masked", ...result };
-  const wanted = mode === "install" || previous === undefined || enabled === "enabled";
-  if (wanted && enabled !== "enabled" && s.systemctl(["enable", s.unit]).status !== 0)
+  if (mode === "install" && enabled !== "enabled" && s.systemctl(["enable", s.unit]).status !== 0)
     return { status: "failed", ...result };
-  if (!wanted && !active)
-    return { status: "disabled", ...result };
-  const boot = () => wanted ? bootStart(s, mode === "install" ? linger : previous === undefined && s.env.CADENCE_LINGER !== "0", mode === "install") : {};
+  const boot = () => mode === "install" ? bootStart(s, linger) : {};
   if (!regularFile(join2(agentDir, "auth.json")))
     return { status: "waiting-for-pi-login", ...result, ...boot() };
   s.systemctl(["reset-failed", s.unit]);
   const started = s.systemctl(["start", s.unit]).status === 0;
   return { status: started ? "started" : "failed", ...result, ...boot() };
 }
+function stopAutostart(s) {
+  if (s.platform !== "linux")
+    return { status: "unsupported" };
+  const path = unitPath(s);
+  const previous = readGenerated(path, MARKER);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined)
+    return { status: "absent" };
+  if (s.systemctl(["show-environment"]).status !== 0)
+    return { status: "unavailable", unit: path };
+  return {
+    status: s.systemctl(["stop", s.unit]).status === 0 ? "stopped" : "failed",
+    unit: path,
+    workspace: unitWorkspace(previous)
+  };
+}
 function removeAutostart(s) {
   if (s.platform !== "linux")
-    return { status: "skipped" };
+    return { status: "unsupported" };
   const path = unitPath(s);
-  const previous = readGenerated(path);
+  const previous = readGenerated(path, MARKER);
   if (previous === null)
     return { status: "foreign", unit: path };
   if (previous === undefined)
@@ -2769,9 +2819,9 @@ function removeAutostart(s) {
 }
 function autostartStatus(s) {
   if (s.platform !== "linux")
-    return { status: "skipped" };
+    return { status: "unsupported" };
   const path = unitPath(s);
-  const previous = readGenerated(path);
+  const previous = readGenerated(path, MARKER);
   if (previous === null)
     return { status: "foreign", unit: path };
   if (previous === undefined)
@@ -2780,8 +2830,8 @@ function autostartStatus(s) {
     status: s.systemctl(["is-active", s.unit]).stdout.trim() || "unknown",
     enabled: s.systemctl(["is-enabled", s.unit]).stdout.trim() || "unknown",
     unit: path,
-    workspace: generatedWorkspace(previous),
-    ...bootStart(s, false, false)
+    workspace: unitWorkspace(previous),
+    ...bootStart(s, false)
   };
 }
 
@@ -3641,13 +3691,277 @@ class OwnerLease {
   }
 }
 
+// src/service/launchd.ts
+import { rmSync as rmSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+var LABEL = "com.abelxiaoxing.cadence";
+var MARKER2 = `<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generated by @abelxiaoxing/cadence`;
+function plistPath(s) {
+  return join5(s.home, "Library", "LaunchAgents", `${LABEL}.plist`);
+}
+var xml = (value) => checked(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+function buildPlist(u) {
+  const string = (value) => `		<string>${xml(value)}</string>`;
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    "<!-- Generated by @abelxiaoxing/cadence; `cadence server install` and `restart` rewrite this file. -->",
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "\t<key>Label</key>",
+    `	<string>${LABEL}</string>`,
+    "\t<key>ProgramArguments</key>",
+    "\t<array>",
+    ...[u.node, u.cli, "start", "--foreground", "--workspace", u.workspace].map(string),
+    "\t</array>",
+    "\t<key>WorkingDirectory</key>",
+    `	<string>${xml(u.workspace)}</string>`,
+    "\t<key>EnvironmentVariables</key>",
+    "\t<dict>",
+    ...u.environment.flatMap(([k, v]) => [
+      `		<key>${xml(k)}</key>`,
+      string(v)
+    ]),
+    "\t</dict>",
+    "\t<key>RunAtLoad</key>",
+    "\t<true/>",
+    "\t<key>ProcessType</key>",
+    "\t<string>Background</string>",
+    "\t<key>StandardOutPath</key>",
+    `	<string>${xml(u.log)}</string>`,
+    "\t<key>StandardErrorPath</key>",
+    `	<string>${xml(u.log)}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ].join(`
+`);
+}
+function plistWorkspace(text2) {
+  const m = text2?.match(/^\t<key>WorkingDirectory<\/key>\n\t<string>([^<]*)<\/string>$/m);
+  return m?.[1].replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+}
+var domain = (s) => `gui/${s.uid}`;
+var target = (s) => `${domain(s)}/${LABEL}`;
+var loaded = (s) => s.launchctl(["print", target(s)]).status === 0;
+function disabled(s) {
+  return new RegExp(`"${LABEL.replaceAll(".", "\\.")}" => (true|disabled)`).test(s.launchctl(["print-disabled", domain(s)]).stdout);
+}
+async function configureLaunchAgent(s, mode, requested) {
+  if (s.uid === undefined)
+    return { status: "unavailable" };
+  const path = plistPath(s);
+  const previous = readGenerated(path, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
+  const sdk = sdkPackages(s.root);
+  if (!sdk)
+    return { status: "missing-pi-sdk" };
+  const kept = plistWorkspace(previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, kept);
+  const refused2 = await settle(s, kept);
+  if (refused2)
+    return { ...refused2, unit: path };
+  if (loaded(s))
+    s.launchctl(["bootout", target(s)]);
+  write(path, buildPlist({
+    node: s.node,
+    cli: join5(s.root, "src", "service-cli.mjs"),
+    workspace,
+    environment: serviceEnvironment(s),
+    log: join5(s.home, "Library", "Logs", "cadence.log")
+  }));
+  const result = {
+    unit: path,
+    workspace,
+    ...redirectedFrom ? { redirectedFrom } : {}
+  };
+  if (mode === "install")
+    s.launchctl(["enable", target(s)]);
+  else if (disabled(s))
+    return { status: "disabled", ...result };
+  if (!regularFile(join5(agentDirectory(s), "auth.json")))
+    return { status: "waiting-for-pi-login", ...result };
+  const started = s.launchctl(["bootstrap", domain(s), path]).status === 0;
+  return { status: started ? "started" : "failed", ...result };
+}
+async function stopLaunchAgent(s) {
+  const path = plistPath(s);
+  const previous = readGenerated(path, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = plistWorkspace(previous);
+  const refused2 = await settle(s, workspace);
+  return { ...refused2 ?? { status: "stopped", workspace }, unit: path };
+}
+async function removeLaunchAgent(s) {
+  const path = plistPath(s);
+  const previous = readGenerated(path, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined)
+    return { status: "absent" };
+  const refused2 = await settle(s, plistWorkspace(previous));
+  if (refused2)
+    return { ...refused2, unit: path };
+  if (s.uid !== undefined && loaded(s))
+    s.launchctl(["bootout", target(s)]);
+  rmSync2(path);
+  return { status: "removed", unit: path };
+}
+function launchAgentStatus(s) {
+  const path = plistPath(s);
+  const previous = readGenerated(path, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined)
+    return { status: "absent" };
+  const printed = s.uid === undefined ? undefined : s.launchctl(["print", target(s)]);
+  return {
+    status: printed?.status !== 0 ? "unloaded" : /^\s*state = running$/m.test(printed.stdout) ? "active" : "inactive",
+    enabled: s.uid !== undefined && disabled(s) ? "disabled" : "enabled",
+    unit: path,
+    workspace: plistWorkspace(previous)
+  };
+}
+
+// src/service/login-run.ts
+import { rmSync as rmSync3 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join6 } from "node:path";
+var RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+var APPROVED_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run";
+var RUN_VALUE = "Cadence";
+var MARKER3 = "' Generated by @abelxiaoxing/cadence";
+function launcherPath(s) {
+  const local = s.env.LOCALAPPDATA;
+  return join6(local && isAbsolute5(local) ? local : join6(s.home, "AppData", "Local"), "cadence-server", "cadence.vbs");
+}
+var literal2 = (value) => `"${checked(value).replaceAll('"', '""')}"`;
+function argument2(value) {
+  if (checked(value).includes('"'))
+    throw new ContractError("invalid");
+  return `"${value}"`;
+}
+function buildLauncher(u) {
+  const command = `${argument2(u.node)} ${argument2(u.cli)} start --workspace ${argument2(u.workspace)}`;
+  return [
+    `${MARKER3}; \`cadence server install\` and \`restart\` rewrite this file.`,
+    `' Started at login by ${RUN_KEY}\\${RUN_VALUE}; window style 0 hides the console.`,
+    'Set shell = CreateObject("WScript.Shell")',
+    ...u.environment.length ? ['Set env = shell.Environment("Process")'] : [],
+    ...u.environment.map(([k, v]) => `env(${literal2(k)}) = ${literal2(v)}`),
+    `shell.CurrentDirectory = ${literal2(u.workspace)}`,
+    `shell.Run ${literal2(command)}, 0, False`,
+    ""
+  ].join(`\r
+`);
+}
+var utf16 = (text2) => Buffer.concat([Buffer.from([255, 254]), Buffer.from(text2, "utf16le")]);
+function launcherWorkspace(text2) {
+  return text2?.match(/^shell\.CurrentDirectory = "((?:[^"]|"")*)"\r?$/m)?.[1].replaceAll('""', '"');
+}
+var runEntry = (path, s) => `"${wscript(s.env)}" "${path}"`;
+var present = (s, key) => s.reg(["query", key, "/v", RUN_VALUE]).status === 0;
+function approvedOff(s) {
+  const r = s.reg(["query", APPROVED_KEY, "/v", RUN_VALUE]);
+  const first = r.status === 0 && /REG_BINARY\s+([0-9A-F]{2})/i.exec(r.stdout);
+  return !!first && (Number.parseInt(first[1], 16) & 1) === 1;
+}
+async function configureLoginRun(s, mode, requested) {
+  const path = launcherPath(s);
+  const previous = readGenerated(path, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined && present(s, RUN_KEY))
+    return { status: "foreign", unit: `${RUN_KEY}\\${RUN_VALUE}` };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
+  const sdk = sdkPackages(s.root);
+  if (!sdk)
+    return { status: "missing-pi-sdk" };
+  const kept = launcherWorkspace(previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, kept);
+  const refused2 = await settle(s, kept);
+  if (refused2)
+    return { ...refused2, unit: path };
+  const environment = s.env.PI_CODING_AGENT_DIR ? [["PI_CODING_AGENT_DIR", agentDirectory(s)]] : [];
+  write(path, utf16(buildLauncher({
+    node: s.node,
+    cli: join6(s.root, "src", "service-cli.mjs"),
+    workspace,
+    environment
+  })));
+  const result = {
+    unit: path,
+    workspace,
+    ...redirectedFrom ? { redirectedFrom } : {}
+  };
+  if (mode === "install") {
+    const entry = ["/v", RUN_VALUE, "/t", "REG_SZ", "/d", runEntry(path, s)];
+    if (s.reg(["add", RUN_KEY, ...entry, "/f"]).status !== 0)
+      return { status: "failed", ...result };
+    s.reg(["delete", APPROVED_KEY, "/v", RUN_VALUE, "/f"]);
+  }
+  if (!regularFile(join6(agentDirectory(s), "auth.json")))
+    return { status: "waiting-for-pi-login", ...result };
+  return { status: s.launch(path) ? "started" : "failed", ...result };
+}
+async function stopLoginRun(s) {
+  const path = launcherPath(s);
+  const previous = readGenerated(path, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = launcherWorkspace(previous);
+  const refused2 = await settle(s, workspace);
+  return { ...refused2 ?? { status: "stopped", workspace }, unit: path };
+}
+async function removeLoginRun(s) {
+  const path = launcherPath(s);
+  const previous = readGenerated(path, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined)
+    return { status: "absent" };
+  const refused2 = await settle(s, launcherWorkspace(previous));
+  if (refused2)
+    return { ...refused2, unit: path };
+  for (const key of [RUN_KEY, APPROVED_KEY])
+    if (present(s, key))
+      s.reg(["delete", key, "/v", RUN_VALUE, "/f"]);
+  rmSync3(path);
+  return { status: "removed", unit: path };
+}
+async function loginRunStatus(s) {
+  const path = launcherPath(s);
+  const previous = readGenerated(path, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = launcherWorkspace(previous);
+  const owner = workspace ? await s.ownerStatus(workspace) : "unavailable";
+  return {
+    status: owner === "alive" ? "active" : "inactive",
+    enabled: present(s, RUN_KEY) && !approvedOff(s) ? "enabled" : "disabled",
+    unit: path,
+    workspace
+  };
+}
+
 // src/service/recovery-cli.ts
 import { isatty } from "node:tty";
 
 // src/history/recovery.ts
 import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypto";
 import { lstatSync as lstatSync6, opendirSync as opendirSync3 } from "node:fs";
-import { join as join6, relative as relative4 } from "node:path";
+import { join as join8, relative as relative4 } from "node:path";
 
 // src/service/recovery.ts
 async function inspectRecovery(coordination, history) {
@@ -3707,7 +4021,7 @@ import {
   statfsSync
 } from "node:fs";
 import { open } from "node:fs/promises";
-import { dirname as dirname6, join as join5 } from "node:path";
+import { dirname as dirname6, join as join7 } from "node:path";
 
 // src/history/admission.ts
 function decodeRunAdmission(value) {
@@ -4238,14 +4552,14 @@ class HistoryFiles {
     this.coordination = coordination;
     this.format = format;
     this.formatSnapshot = formatSnapshot;
-    this.directory = join5(coordination.directory, "history-v2");
+    this.directory = join7(coordination.directory, "history-v2");
     this.files = coordination.files;
   }
   static open(coordination) {
-    const dir = join5(coordination.directory, "history-v2");
+    const dir = join7(coordination.directory, "history-v2");
     if (!coordination.files.directory(dir))
       return;
-    const file = coordination.files.read(join5(dir, "format.json"));
+    const file = coordination.files.read(join7(dir, "format.json"));
     if (!file)
       corrupt();
     const format = decodeFormat(json(file));
@@ -4261,7 +4575,7 @@ class HistoryFiles {
       existing.assertWritable();
       return existing;
     }
-    const dir = join5(c.directory, "history-v2");
+    const dir = join7(c.directory, "history-v2");
     const format = {
       schema: FORMAT,
       storeId: randomUUID4(),
@@ -4271,19 +4585,19 @@ class HistoryFiles {
     c.files.directory(dir, true);
     for (const name of ["commands", "ledger", "runs", "indexes"]) {
       lease.assert();
-      c.files.directory(join5(dir, name), true);
+      c.files.directory(join7(dir, name), true);
     }
     lease.assert();
-    const keyPath = join5(dir, "read-proof-key.json");
+    const keyPath = join7(dir, "read-proof-key.json");
     c.files.create(keyPath, encoded({
       schema: "cadence-history-read-key/1",
       storeId: format.storeId,
       key: randomBytes2(32).toString("base64url")
     }));
     lease.assert();
-    const snapshot = c.files.create(join5(dir, "format.json"), encoded(format));
+    const snapshot = c.files.create(join7(dir, "format.json"), encoded(format));
     const result = new HistoryFiles(c, format, snapshot);
-    result.syncParents(join5(dir, "format.json"));
+    result.syncParents(join7(dir, "format.json"));
     result.assertWritable();
     return result;
   }
@@ -4318,7 +4632,7 @@ class HistoryFiles {
       throw new ContractError("quarantine");
   }
   assertFormat() {
-    this.files.assert(join5(this.directory, "format.json"), this.formatSnapshot);
+    this.files.assert(join7(this.directory, "format.json"), this.formatSnapshot);
   }
   readProofMaterial(budget) {
     if (this.format.schema !== FORMAT)
@@ -4327,7 +4641,7 @@ class HistoryFiles {
       this.assertReadFormat(budget);
     else
       this.assertFormat();
-    const selected2 = this.readBudgeted(join5(this.directory, "read-proof-key.json"), 512, budget);
+    const selected2 = this.readBudgeted(join7(this.directory, "read-proof-key.json"), 512, budget);
     if (!selected2 || this.proofSnapshot && (selected2.identity !== this.proofSnapshot.identity || selected2.stamp !== this.proofSnapshot.stamp))
       corrupt();
     try {
@@ -4355,17 +4669,17 @@ class HistoryFiles {
       return;
     }
     this.assertFormat();
-    assertIncarnation(this, join5(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
+    assertIncarnation(this, join7(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
   }
   segmentPath(segment) {
-    return join5(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
+    return join7(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
   }
   artifactPath(ref) {
-    return join5(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
+    return join7(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
   }
   admissionPath(runId) {
     decodeId(runId);
-    return join5(this.directory, "runs", runId, "admission.json");
+    return join7(this.directory, "runs", runId, "admission.json");
   }
   writeAdmission(lease, input) {
     lease.assert();
@@ -4391,7 +4705,7 @@ class HistoryFiles {
   readCommand(commandId, budget) {
     decodeId(commandId);
     this.assertReadFormat(budget);
-    return this.readBudgeted(join5(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
+    return this.readBudgeted(join7(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
   }
   readAdmission(runId, identity, budget) {
     return this.readAdmissionIdentity(runId, hash(canonicalJson(identity)), budget);
@@ -4429,7 +4743,7 @@ class HistoryFiles {
   }
   assertReadFormat(budget) {
     budget.reserve(this.formatSnapshot.bytes.length);
-    this.files.assert(join5(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
+    this.files.assert(join7(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
   }
   assertPublished(segment, end, seq) {
     const fence = publicationFences.get(this.directory);
@@ -4467,7 +4781,7 @@ class HistoryFiles {
       const dir = opendirSync2(path);
       try {
         for (let e = dir.readSync();e; e = dir.readSync()) {
-          const p = join5(path, e.name), st = lstatSync5(p);
+          const p = join7(path, e.name), st = lstatSync5(p);
           if (st.isDirectory())
             bytes += walk(p, depth + 1);
           else {
@@ -4502,7 +4816,7 @@ class HistoryFiles {
     state.bytes = 0;
     state.identity = null;
     let count = 0;
-    const ledger = join5(this.directory, "ledger");
+    const ledger = join7(this.directory, "ledger");
     if (!this.files.directory(ledger))
       corrupt();
     const dir = opendirSync2(ledger);
@@ -4819,7 +5133,7 @@ class HistoryFiles {
   checkpoint(lease, state) {
     lease.assert();
     this.assertWritable();
-    const path = join5(this.directory, "checkpoint.json"), old = this.files.read(path);
+    const path = join7(this.directory, "checkpoint.json"), old = this.files.read(path);
     const body = encoded({
       schema: "cadence-history-checkpoint/2",
       storeId: this.format.storeId,
@@ -5246,7 +5560,7 @@ function digestHistory(files, exclude) {
       dir.closeSync();
     }
     for (const name of names2.sort()) {
-      const selected2 = join6(path, name);
+      const selected2 = join8(path, name);
       if (selected2 === exclude)
         continue;
       const rel = relative4(files.directory, selected2);
@@ -5557,7 +5871,7 @@ async function localRecovery(c, operation) {
 
 // src/service/runtime.ts
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute5, join as join7, resolve as resolve4 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute6, join as join9, resolve as resolve4 } from "node:path";
 
 // src/service/config.ts
 import { isIP } from "node:net";
@@ -5611,7 +5925,7 @@ function localOrigin(policy, actualPort) {
 var STARTUP_INPUT_BYTES = 16 * 1024;
 function absolute(value) {
   const result = text(value, 4096, true);
-  if (!isAbsolute5(result))
+  if (!isAbsolute6(result))
     throw new ContractError("invalid");
   return result;
 }
@@ -5706,7 +6020,7 @@ function selectStart(options, ambient) {
       port: options.port ?? 17423,
       proxy: null
     },
-    agentDir: resolve4(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join7(ambient.HOME ?? ambient.USERPROFILE ?? homedir3(), ".pi", "agent")),
+    agentDir: resolve4(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join9(ambient.HOME ?? ambient.USERPROFILE ?? homedir3(), ".pi", "agent")),
     tokenSource: options.tokenFile ? "file" : env ? "environment" : "generated",
     tokenFile: options.tokenFile ? resolve4(options.tokenFile) : null
   });
@@ -5878,10 +6192,10 @@ function startupGuidance(result, input) {
       return `Pi's agent directory ${agent} must be an existing real directory (not a symlink) owned by you.
 `;
     case "pi-auth":
-      return `${join8(agent, "auth.json")} must be your own single-link regular file holding valid Pi credentials; log in to Pi first.
+      return `${join10(agent, "auth.json")} must be your own single-link regular file holding valid Pi credentials; log in to Pi first.
 `;
     case "pi-models":
-      return `${join8(agent, "models.json")} must be your own single-link regular file using only fields Cadence's pinned Pi SDK supports; a field only newer Pi understands is refused.
+      return `${join10(agent, "models.json")} must be your own single-link regular file using only fields Cadence's pinned Pi SDK supports; a field only newer Pi understands is refused.
 `;
     case "pi-runtime":
       return `Loading Pi's SDK model runtime failed after the owner registered (optional SDK packages missing, or sources the SDK refuses); it stays quarantined.
@@ -6007,14 +6321,59 @@ async function observeStarted(workspace) {
   }
   return { service };
 }
-function autostartGuidance(s, result) {
-  const name = s.unit.replace(/\.service$/, "");
-  const cli = JSON.stringify(join8(s.root, "src", "service-cli.mjs"));
-  const workspace = JSON.stringify(result.workspace ?? "");
-  const manage = `Manage: systemctl --user status|restart|stop ${name}; logs: journalctl --user -u ${name}; opt out: systemctl --user disable --now ${name}`;
+var ownerControl = {
+  async ownerStatus(workspace) {
+    try {
+      const observed = await serviceStatus(new ServiceCoordination(workspace));
+      return observed && typeof observed === "object" && "status" in observed ? String(observed.status) : "unavailable";
+    } catch {
+      return "unavailable";
+    }
+  },
+  async stopOwner(workspace) {
+    try {
+      const c = new ServiceCoordination(workspace);
+      const observed = await serviceStatus(c);
+      const status = observed && typeof observed === "object" && "status" in observed ? String(observed.status) : "unavailable";
+      if (status === "absent" || status === "stopped")
+        return "stopped";
+      return status === "alive" ? (await stopService(c)).status : status;
+    } catch {
+      return "unavailable";
+    }
+  }
+};
+async function serverAction(s, action, requested, linger) {
+  const install = action === "install" || action === "restart";
+  const mode = action === "install" ? "install" : "restart";
+  switch (s.platform) {
+    case "linux":
+      if (install)
+        return configureAutostart(s, mode, requested, linger);
+      if (action === "stop")
+        return stopAutostart(s);
+      return action === "uninstall" ? removeAutostart(s) : autostartStatus(s);
+    case "darwin":
+      if (install)
+        return configureLaunchAgent(s, mode, requested);
+      if (action === "stop")
+        return stopLaunchAgent(s);
+      return action === "uninstall" ? removeLaunchAgent(s) : launchAgentStatus(s);
+    case "win32":
+      if (install)
+        return configureLoginRun(s, mode, requested);
+      if (action === "stop")
+        return stopLoginRun(s);
+      return action === "uninstall" ? removeLoginRun(s) : loginRunStatus(s);
+    default:
+      return { status: "unsupported" };
+  }
+}
+function serverGuidance(s, action, result) {
+  const cli = piUserInstall(s) ? `node ${JSON.stringify(join10(s.root, "src", "service-cli.mjs"))}` : "cadence";
   const note = result.redirectedFrom ? `Cadence workspace: ${result.workspace} (${result.redirectedFrom} contains Cadence's private state)
 ` : "";
-  return note + autostartStatusGuidance(s, result, name, cli, workspace, manage);
+  return note + serverStatusGuidance(s, action, result, cli);
 }
 function lingerGuidance(linger) {
   switch (linger) {
@@ -6031,83 +6390,124 @@ function lingerGuidance(linger) {
       return "";
   }
 }
-function autostartStatusGuidance(s, result, name, cli, workspace, manage) {
+function managerDetail(s) {
+  switch (s.platform) {
+    case "linux":
+      return "see systemctl --user status cadence and journalctl --user -u cadence";
+    case "darwin":
+      return `see launchctl print gui/${s.uid}/${LABEL} and ~/Library/Logs/cadence.log`;
+    default:
+      return `run its launcher to see why: wscript ${JSON.stringify(launcherPath(s))}`;
+  }
+}
+function serverStatusGuidance(s, action, result, cli) {
+  const workspace = JSON.stringify(result.workspace ?? "");
+  const manage = `Manage: ${cli} server status|restart|stop|uninstall`;
+  const when = s.platform === "linux" ? "at boot or login" : "at login";
   switch (result.status) {
     case "started": {
       const linger = lingerGuidance(result.linger);
       if (result.service !== "alive")
-        return `${s.unit} started for ${result.workspace}, but the owner reports ${result.service}.
-Inspect: node ${cli} diagnose --workspace ${workspace}
+        return `Cadence started for ${result.workspace}, but the owner reports ${result.service}.
+Inspect: ${cli} diagnose --workspace ${workspace}
 ${manage}
 ${linger}`;
-      return `Cadence WebUI: ${result.endpoint} (${s.unit}, workspace ${result.workspace})
-Enter with your private link: node ${cli} token-link --workspace ${workspace} --reveal
+      return `Cadence WebUI: ${result.endpoint} (workspace ${result.workspace}; starts ${when})
+Enter with your private link: ${cli} token-link --workspace ${workspace} --reveal
 ${manage}
 ${linger}`;
     }
     case "waiting-for-pi-login":
-      return `${s.unit} is enabled for ${result.workspace}; it starts once Pi has ${join8(agentDirectory(s), "auth.json")}.
-Log in to Pi, then: systemctl --user start ${name}
+      return `Cadence is registered for ${result.workspace}; it starts once Pi has ${join10(agentDirectory(s), "auth.json")}.
+Log in to Pi, then: ${cli} server restart
 ${lingerGuidance(result.linger)}`;
+    case "stopped":
+      return action === "stop" ? `Cadence stopped; it starts again ${when}, or now with: ${cli} server restart
+` : "";
+    case "absent":
+      return action === "restart" || action === "stop" ? `Cadence's background service is not installed: ${cli} server install
+` : "";
     case "disabled":
-      return `${s.unit} refreshed for ${result.workspace}; left disabled as configured.
+      return `Cadence's service definition was rewritten for ${result.workspace}; left disabled as configured.
 `;
     case "masked":
-      return `${s.unit} is masked; Cadence did not enable or start it.
+      return `cadence.service is masked; Cadence did not enable or start it.
 `;
     case "missing-pi-sdk":
-      return `Cadence did not register or refresh ${s.unit}: the Pi SDK packages pi-coding-agent and pi-ai (scope @earendil-works) do not resolve from ${s.root}, for example after installing without optional dependencies; an owner without them would quarantine.
+      return `Cadence did not register its service: the Pi SDK packages pi-coding-agent and pi-ai (scope @earendil-works) do not resolve from ${s.root}, for example after installing without optional dependencies; an owner without them would quarantine.
 `;
     case "foreign":
       return `${result.unit} was not generated by Cadence; left unchanged.
 `;
     case "unavailable":
-      return `No systemd user manager; start Cadence explicitly: node ${cli} start --workspace /absolute/project
+      return result.workspace ? `Cadence changed nothing: its owner could not be observed. Inspect: ${cli} diagnose --workspace ${workspace}
+` : `No user service manager; start Cadence explicitly: ${cli} start --workspace /absolute/project
+`;
+    case "unsupported":
+      return `Cadence has no background service for ${s.platform}; start it explicitly: ${cli} start --workspace /absolute/project
+`;
+    case "unconfirmed":
+    case "quarantined":
+      return `Cadence changed nothing: its owner's orderly Stop was not confirmed (${result.status}). Inspect: ${cli} diagnose --workspace ${workspace}
 `;
     case "failed":
-      return `Could not enable or start ${s.unit}; see systemctl --user status ${name} and journalctl --user -u ${name}.
+      return `Could not register or start Cadence's service; ${managerDetail(s)}.
 ${lingerGuidance(result.linger)}`;
     default:
       return "";
   }
 }
-async function autostartMain(argv, hostUrl) {
-  const action = argv.shift();
+var SERVER_ACTIONS = [
+  "install",
+  "status",
+  "restart",
+  "stop",
+  "uninstall"
+];
+async function serverMain(argv, hostUrl) {
+  const action = SERVER_ACTIONS.find((a) => a === argv[0]);
+  if (!action)
+    throw new ContractError("invalid");
+  argv.shift();
   let requested;
-  let linger = false;
+  let linger = process.env.CADENCE_LINGER !== "0";
+  let noLinger = false;
   while (action === "install" && argv.length) {
     if (argv[0] === "--workspace" && argv[1] && requested === undefined)
       requested = resolve5(argv.splice(0, 2)[1]);
-    else if (argv[0] === "--linger" && !linger) {
+    else if (argv[0] === "--no-linger" && !noLinger) {
       argv.shift();
-      linger = true;
+      noLinger = true;
+      linger = false;
     } else
       break;
   }
-  if (argv.length || !["install", "refresh", "remove", "status"].includes(action ?? ""))
+  if (argv.length)
     throw new ContractError("invalid");
-  const s = hostSystem(dirname8(dirname8(fileURLToPath(hostUrl))));
+  const s = hostSystem(dirname8(dirname8(fileURLToPath(hostUrl))), ownerControl);
   let result;
-  if (action === "remove")
-    result = removeAutostart(s);
-  else if (action === "status")
-    result = autostartStatus(s);
-  else {
-    try {
-      result = configureAutostart(s, action === "install" ? "install" : "refresh", requested, linger);
-    } catch (error) {
-      if (error instanceof ContractError && error.code === "invalid")
-        process.stderr.write(`Cadence autostart needs an existing absolute workspace directory (--workspace or CADENCE_WORKSPACE).
+  try {
+    result = await serverAction(s, action, requested, linger);
+  } catch (error) {
+    if (error instanceof ContractError && error.code === "invalid")
+      process.stderr.write(`Cadence server install needs an existing absolute --workspace directory.
 `);
-      throw error;
-    }
-    if (result.status === "started" && result.workspace)
-      Object.assign(result, await observeStarted(result.workspace));
-    process.stderr.write(autostartGuidance(s, result));
+    throw error;
   }
+  if (result.status === "started" && result.workspace)
+    Object.assign(result, await observeStarted(result.workspace));
+  process.stderr.write(serverGuidance(s, action, result));
   process.stdout.write(`${JSON.stringify(result)}
 `);
-  if (["failed", "foreign", "unavailable"].includes(result.status))
+  if ([
+    "failed",
+    "foreign",
+    "unavailable",
+    "unsupported",
+    "unconfirmed",
+    "quarantined",
+    "missing-pi-sdk"
+  ].includes(result.status) || result.status === "absent" && (action === "restart" || action === "stop"))
     process.exitCode = 1;
 }
 async function managementMain(argv, hostUrl) {
@@ -6116,16 +6516,16 @@ async function managementMain(argv, hostUrl) {
       throw new ContractError("unsupported-context");
     const command = argv.shift();
     if (command === "--help" && !argv.length) {
-      process.stdout.write(`cadence-service start|status|diagnose|stop|token-link --reveal|token-rotate|recover inspect|recover resolve [--workspace PATH] [--state-home PATH]
-cadence-service autostart install [--workspace PATH] [--linger]|refresh|remove|status
-Start is explicit, or the Linux systemd user unit that Pi's user-scope install registers (CADENCE_AUTOSTART=0, disable or mask opts out); its first registration also enables linger for boot start when logind allows it without a password (CADENCE_LINGER=0 opts out), and --linger asks for it explicitly. Default detached or --foreground. Start accepts --config, --agent-dir, --host, --port, --token-file.
+      process.stdout.write(`cadence start|status|diagnose|stop|token-link --reveal|token-rotate|recover inspect|recover resolve [--workspace PATH] [--state-home PATH]
+cadence server install [--workspace PATH] [--no-linger]|status|restart|stop|uninstall
+Start is explicit, or the background service that server install registers: a systemd user unit on Linux, started at boot through linger (--no-linger or CADENCE_LINGER=0 keeps it to login), a LaunchAgent on macOS and a Run entry on Windows, both started at login. Server restart, stop and uninstall use the orderly Stop. cadence-service is the same command. Default detached or --foreground. Start accepts --config, --agent-dir, --host, --port, --token-file.
 Return/quit detaches clients; only explicit Cancel/Stop requests stop. Unconfirmed/quarantined is not stopped.
 Recovery resolve requires this local native terminal, exact unchanged dead-owner resources and separate process/credential/storage acknowledgments. No --yes, network recovery, killing, repair or cleanup.
 `);
       return;
     }
-    if (command === "autostart") {
-      await autostartMain(argv, hostUrl);
+    if (command === "server") {
+      await serverMain(argv, hostUrl);
       return;
     }
     let recovery;