@abelxiaoxing/cadence 2.0.4 → 2.0.6

package/src/service-cli.mjs

@@ -3,11 +3,48 @@
 
 // src/service/cli.ts
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync as mkdirSync4 } from "node:fs";
+import { existsSync, mkdirSync as mkdirSync5 } from "node:fs";
 import { request } from "node:http";
-import { dirname as dirname8, join as join8, resolve as resolve5 } from "node:path";
+import { dirname as dirname8, join as join10, resolve as resolve5 } from "node:path";
 import { fileURLToPath } from "node:url";
 
+// src/install-config.mjs
+import { closeSync, constants, mkdirSync, openSync, writeSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+var CONFIG_TEMPLATE = `# Cadence research configuration. Keep this file local and never commit it.
+# Context7 works anonymously with its default URL.
+# CONTEXT7_API_URL=https://context7.com/api/v2
+# CONTEXT7_API_KEY=
+
+# Required when using the Grok search skill.
+GROK_API_URL=https://api.x.ai/v1
+GROK_API_KEY=
+
+# Optional Tavily integration.
+# TAVILY_ENABLED=true
+# TAVILY_API_URL=https://api.tavily.com
+# TAVILY_API_KEY=
+`;
+function ensureUserConfig(home = homedir()) {
+  const directory = path.join(home, ".pi", "agent", "cadence");
+  const file = path.join(directory, ".env");
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  try {
+    const fd = openSync(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      writeSync(fd, CONFIG_TEMPLATE, undefined, "utf8");
+    } finally {
+      closeSync(fd);
+    }
+    return { created: true, path: file };
+  } catch (error) {
+    if (error?.code === "EEXIST")
+      return { created: false, path: file };
+    throw error;
+  }
+}
+
 // src/task-types.ts
 var TASK_SCHEMA = "cadence-workflow-assistant/1";
 var MAX_RECORD_BYTES = 128 * 1024;
@@ -2049,13 +2086,13 @@ class CaptureBudgetLease {
 import { spawnSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import {
-  closeSync,
-  constants,
+  closeSync as closeSync2,
+  constants as constants2,
   fstatSync,
   fsyncSync,
   lstatSync,
-  mkdirSync,
-  openSync,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
   readdirSync,
   readSync,
   realpathSync,
@@ -2063,7 +2100,7 @@ import {
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { homedir, hostname } from "node:os";
+import { homedir as homedir2, hostname } from "node:os";
 import {
   dirname,
   isAbsolute,
@@ -2100,8 +2137,8 @@ function parseRecord(data) {
 function absent(error) {
   return object(error) && error.code === "ENOENT";
 }
-function safeDirectory(path, create = false, inspectExisting) {
-  const full = resolve(path);
+function safeDirectory(path2, create = false, inspectExisting) {
+  const full = resolve(path2);
   const root = parse(full).root;
   if (inspectExisting) {
     const st = lstatSync(root);
@@ -2124,7 +2161,7 @@ function safeDirectory(path, create = false, inspectExisting) {
       if (!create)
         return false;
       try {
-        mkdirSync(at, { mode: 448 });
+        mkdirSync2(at, { mode: 448 });
       } catch (mkdirError) {
         if (!object(mkdirError) || mkdirError.code !== "EEXIST")
           throw mkdirError;
@@ -2154,15 +2191,15 @@ function retryWindowsFileOperation(operation, recheck) {
     }
   }
 }
-function readBounded(path, max, packaged = false) {
-  if (!safeDirectory(dirname(path)))
+function readBounded(path2, max, packaged = false) {
+  if (!safeDirectory(dirname(path2)))
     return;
   let fd;
   try {
-    const st = lstatSync(path);
+    const st = lstatSync(path2);
     if (!st.isFile() || st.isSymbolicLink() || !packaged && st.nlink !== 1 || st.size > max)
       throw new Error("Unsafe or oversized file");
-    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    fd = openSync2(path2, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
   } catch (error) {
     if (absent(error))
       return;
@@ -2184,7 +2221,7 @@ function readBounded(path, max, packaged = false) {
       throw new Error("Oversized file");
     return buffer.subarray(0, size);
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 }
 function gitEnvironment() {
@@ -2219,7 +2256,7 @@ function defaultStateHome() {
   const candidate = process.platform === "win32" ? process.env.LOCALAPPDATA : process.env.XDG_STATE_HOME;
   if (candidate && !isAbsolute(candidate))
     throw new Error("State home must be absolute");
-  return candidate ?? join(homedir(), process.platform === "win32" ? "AppData/Local" : ".local/state");
+  return candidate ?? join(homedir2(), process.platform === "win32" ? "AppData/Local" : ".local/state");
 }
 function recordText(record) {
   return `${JSON.stringify(record, null, 2)}
@@ -2228,8 +2265,8 @@ function recordText(record) {
 function contentIdentity(text2) {
   return createHash("sha256").update(text2).digest("hex");
 }
-function canonicalAmbientRoot(path) {
-  const full = resolve(path);
+function canonicalAmbientRoot(path2) {
+  const full = resolve(path2);
   try {
     return realpathSync(full);
   } catch (error) {
@@ -2251,8 +2288,8 @@ function canonicalAmbientRoot(path) {
 function privateRootFor(canonicalRoot, stateHome) {
   return join(canonicalAmbientRoot(stateHome), "cadence-assistant-v1", createHash("sha256").update(canonicalRoot).digest("hex"));
 }
-function contains(root, path) {
-  const within = relative(root, resolve(path));
+function contains(root, path2) {
+  const within = relative(root, resolve(path2));
   return !within || !within.startsWith(`..${sep}`) && within !== ".." && !isAbsolute(within);
 }
 function stateHomeInside(root, stateHome = defaultStateHome()) {
@@ -2260,7 +2297,7 @@ function stateHomeInside(root, stateHome = defaultStateHome()) {
   return contains(canonical, privateRootFor(canonical, stateHome));
 }
 var LANDING_WORKSPACE = "cadence";
-function effectiveWorkspace(requested, stateHome, home = homedir()) {
+function effectiveWorkspace(requested, stateHome, home = homedir2()) {
   if (!stateHomeInside(resolveWorkspace(requested).root, stateHome))
     return { workspace: requested, redirected: false };
   return { workspace: join(home, LANDING_WORKSPACE), redirected: true };
@@ -2282,20 +2319,20 @@ class TaskStore {
   }
   inspectPrivate() {
     const namespace = dirname(this.privateRoot);
-    for (const path of [namespace, this.privateRoot]) {
-      if (!safeDirectory(path))
+    for (const path2 of [namespace, this.privateRoot]) {
+      if (!safeDirectory(path2))
         continue;
-      const st = lstatSync(path);
+      const st = lstatSync(path2);
       if (process.platform !== "win32" && ((st.mode & 63) !== 0 || process.getuid && st.uid !== process.getuid()))
         throw new Error("Private state permissions refused");
     }
   }
-  inspectPrivateFile(path, max) {
+  inspectPrivateFile(path2, max) {
     this.inspectPrivate();
     if (!safeDirectory(this.privateRoot))
       return;
     try {
-      const st = lstatSync(path);
+      const st = lstatSync(path2);
       if (!st.isFile() || st.isSymbolicLink() || st.nlink !== 1 || st.size > max || process.platform !== "win32" && ((st.mode & 63) !== 0 || process.getuid && st.uid !== process.getuid()))
         throw new Error("Unsafe private state file");
     } catch (error) {
@@ -2326,7 +2363,7 @@ class TaskStore {
     };
     let fd;
     try {
-      fd = retryWindowsFileOperation(() => openSync(this.lockPath, "wx", 384));
+      fd = retryWindowsFileOperation(() => openSync2(this.lockPath, "wx", 384));
     } catch {
       throw new Error("Checkout busy or unresolved lock; inspect and explicitly recover only a dead owner");
     }
@@ -2334,7 +2371,7 @@ class TaskStore {
       writeFileSync(fd, JSON.stringify(lock));
       fsyncSync(fd);
     } finally {
-      closeSync(fd);
+      closeSync2(fd);
     }
     return lock;
   }
@@ -2415,12 +2452,12 @@ class TaskStore {
       if (!current && readdirSync(dir).length)
         throw new Error("Unknown task directory");
       const temporary = join(dir, `task.${randomUUID()}.tmp`);
-      const fd = openSync(temporary, "wx", 384);
+      const fd = openSync2(temporary, "wx", 384);
       try {
         writeFileSync(fd, text2);
         fsyncSync(fd);
       } finally {
-        closeSync(fd);
+        closeSync2(fd);
       }
       this.assertOwner(lock);
       const latest = readBounded(join(dir, "task.json"), MAX_RECORD_BYTES);
@@ -2475,7 +2512,7 @@ var TASK_CONFIG_SCHEMA = "cadence-assistant-checks/1";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import {
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   readFileSync,
   realpathSync as realpathSync2,
   renameSync as renameSync2,
@@ -2483,25 +2520,39 @@ import {
   statSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { delimiter, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, resolve as resolve2, sep as sep2 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import {
+  delimiter,
+  dirname as dirname2,
+  isAbsolute as isAbsolute2,
+  join as join2,
+  resolve as resolve2,
+  sep as sep2,
+  win32
+} from "node:path";
 var UNIT = "cadence.service";
 var MARKER = "# Generated by @abelxiaoxing/cadence";
-function hostSystem(root) {
+function wscript(env) {
+  const root = env.SystemRoot;
+  return win32.join(root && win32.isAbsolute(root) ? root : "C:\\Windows", "System32", "wscript.exe");
+}
+function hostSystem(root, owner) {
   const run = (command, args) => {
     const r = spawnSync2(command, args, {
       encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
     });
     return { status: r.error ? null : r.status, stdout: r.stdout ?? "" };
   };
   return {
     platform: process.platform,
     env: process.env,
-    home: homedir2(),
+    home: homedir3(),
     node: process.execPath,
     root,
     unit: UNIT,
+    uid: process.getuid?.(),
     systemctl: (args) => run("systemctl", ["--user", ...args]),
     linger: () => {
       const r = run("loginctl", [
@@ -2528,7 +2579,18 @@ function hostSystem(root) {
         "false"
       ], { stdio: "ignore", timeout: 20000 });
       return !r.error && r.status === 0;
-    }
+    },
+    launchctl: (args) => run("launchctl", args),
+    reg: (args) => run("reg", args),
+    launch: (path2) => {
+      const r = spawnSync2(wscript(process.env), [path2], {
+        stdio: "ignore",
+        windowsHide: true,
+        timeout: 20000
+      });
+      return !r.error && r.status === 0;
+    },
+    ...owner
   };
 }
 function expandHome(value, home) {
@@ -2602,14 +2664,14 @@ var argument = (value) => quoted(value).replaceAll("$", "$$$$");
 function buildUnit(u) {
   const command = (args) => [u.node, u.cli, ...args].map(argument).join(" ");
   return [
-    `${MARKER} on Pi package install/update; upgrades rewrite this file.`,
+    `${MARKER}; \`cadence server install\` and \`restart\` rewrite this file.`,
     "# Override with `systemctl --user edit cadence`; opt out with `systemctl --user disable --now cadence` or `mask`.",
     "[Unit]",
     "Description=Cadence shared task service and WebUI",
     "Documentation=https://github.com/abelxiaoxing/cadence/blob/main/docs/service-management.md",
     `ConditionPathExists=${specifiers(u.cli)}`,
     `ConditionPathExists=${specifiers(join2(u.agentDir, "auth.json"))}`,
-    ...u.sdk.map((path) => `ConditionPathExists=${specifiers(path)}`),
+    ...u.sdk.map((path2) => `ConditionPathExists=${specifiers(path2)}`),
     "StartLimitIntervalSec=300",
     "StartLimitBurst=3",
     "",
@@ -2630,67 +2692,76 @@ function buildUnit(u) {
   ].join(`
 `);
 }
-function readGenerated(path) {
+function readGenerated(path2, marker) {
   try {
-    if (!lstatSync2(path).isFile())
+    if (!lstatSync2(path2).isFile())
       return null;
-    const text2 = readFileSync(path, "utf8");
-    return text2.startsWith(MARKER) ? text2 : null;
+    const bytes = readFileSync(path2);
+    const text2 = bytes[0] === 255 && bytes[1] === 254 ? bytes.subarray(2).toString("utf16le") : bytes.toString("utf8");
+    return text2.startsWith(marker) ? text2 : null;
   } catch (error) {
     if (error.code === "ENOENT")
       return;
     throw error;
   }
 }
-function generatedWorkspace(text2) {
+function unitWorkspace(text2) {
   return text2?.match(/^WorkingDirectory=(.+)$/m)?.[1].replaceAll("%%", "%");
 }
-function directory(path) {
+function directory(path2) {
   try {
-    return isAbsolute2(path) && statSync(path).isDirectory();
+    return isAbsolute2(path2) && statSync(path2).isDirectory();
   } catch {
     return false;
   }
 }
-function unitStateHome(s) {
-  const state = s.env.XDG_STATE_HOME;
-  return state && isAbsolute2(state) ? state : join2(s.home, ".local", "state");
+function serviceStateHome(s) {
+  const state = s.platform === "win32" ? s.env.LOCALAPPDATA : s.env.XDG_STATE_HOME;
+  return state && isAbsolute2(state) ? state : join2(s.home, ...s.platform === "win32" ? ["AppData", "Local"] : [".local", "state"]);
 }
-function selectWorkspace(s, requested, previous) {
+function selectWorkspace(s, requested, kept) {
   let chosen;
   if (requested) {
     chosen = expandHome(requested, s.home);
     if (!directory(chosen))
       throw new ContractError("invalid");
     chosen = resolve2(chosen);
-  } else {
-    const kept = generatedWorkspace(previous);
-    if (kept && directory(kept))
-      chosen = kept;
-  }
-  const landing = chosen ? effectiveWorkspace(chosen, unitStateHome(s), s.home) : { workspace: join2(s.home, LANDING_WORKSPACE), redirected: false };
+  } else if (kept && directory(kept))
+    chosen = kept;
+  const landing = chosen ? effectiveWorkspace(chosen, serviceStateHome(s), s.home) : { workspace: join2(s.home, LANDING_WORKSPACE), redirected: false };
   if (landing.workspace !== chosen)
-    mkdirSync2(landing.workspace, { recursive: true });
+    mkdirSync3(landing.workspace, { recursive: true });
   return landing.redirected ? { workspace: landing.workspace, redirectedFrom: chosen } : { workspace: landing.workspace };
 }
-function write(path, content) {
-  mkdirSync2(dirname2(path), { recursive: true });
-  const temporary = `${path}.${process.pid}.tmp`;
+function write(path2, content) {
+  mkdirSync3(dirname2(path2), { recursive: true });
+  const temporary = `${path2}.${process.pid}.tmp`;
   try {
     writeFileSync2(temporary, content, { mode: 420, flag: "wx" });
-    renameSync2(temporary, path);
+    renameSync2(temporary, path2);
   } finally {
     rmSync(temporary, { force: true });
   }
 }
-function regularFile(path) {
+function regularFile(path2) {
   try {
-    return statSync(path).isFile();
+    return statSync(path2).isFile();
   } catch {
     return false;
   }
 }
-function bootStart(s, attempt, interactive) {
+async function settle(s, workspace) {
+  if (!workspace)
+    return;
+  const status = await s.stopOwner(workspace);
+  if (status === "stopped")
+    return;
+  return {
+    status: status === "quarantined" || status === "unavailable" ? status : "unconfirmed",
+    workspace
+  };
+}
+function bootStart(s, attempt) {
   const current = s.linger();
   if (current === undefined)
     return {};
@@ -2698,23 +2769,25 @@ function bootStart(s, attempt, interactive) {
     return { linger: "on" };
   if (!attempt)
     return { linger: "off" };
-  return { linger: s.enableLinger(interactive) ? "enabled" : "refused" };
+  return {
+    linger: s.enableLinger(false) || s.enableLinger(true) ? "enabled" : "refused"
+  };
 }
 function configureAutostart(s, mode, requested, linger = false) {
   if (s.platform !== "linux")
-    return { status: "skipped" };
-  if (mode === "refresh" && (s.env.CADENCE_AUTOSTART === "0" || !piUserInstall(s)))
-    return { status: "skipped" };
+    return { status: "unsupported" };
   if (s.systemctl(["show-environment"]).status !== 0)
     return { status: "unavailable" };
-  const path = unitPath(s);
-  const previous = readGenerated(path);
+  const path2 = unitPath(s);
+  const previous = readGenerated(path2, MARKER);
   if (previous === null)
-    return { status: "foreign", unit: path };
+    return { status: "foreign", unit: path2 };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
   const sdk = sdkPackages(s.root);
   if (!sdk)
     return { status: "missing-pi-sdk" };
-  const { workspace, redirectedFrom } = selectWorkspace(s, requested ?? s.env.CADENCE_WORKSPACE, previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, unitWorkspace(previous));
   const agentDir = agentDirectory(s);
   const content = buildUnit({
     node: s.node,
@@ -2728,60 +2801,74 @@ function configureAutostart(s, mode, requested, linger = false) {
   const active = s.systemctl(["is-active", "--quiet", s.unit]).status === 0;
   if (active)
     s.systemctl(["stop", s.unit]);
-  write(path, content);
+  write(path2, content);
   s.systemctl(["daemon-reload"]);
   const result = {
-    unit: path,
+    unit: path2,
     workspace,
     ...redirectedFrom ? { redirectedFrom } : {}
   };
   if (enabled.startsWith("masked"))
     return { status: "masked", ...result };
-  const wanted = mode === "install" || previous === undefined || enabled === "enabled";
-  if (wanted && enabled !== "enabled" && s.systemctl(["enable", s.unit]).status !== 0)
+  if (mode === "install" && enabled !== "enabled" && s.systemctl(["enable", s.unit]).status !== 0)
     return { status: "failed", ...result };
-  if (!wanted && !active)
-    return { status: "disabled", ...result };
-  const boot = () => wanted ? bootStart(s, mode === "install" ? linger : previous === undefined && s.env.CADENCE_LINGER !== "0", mode === "install") : {};
+  const boot = () => mode === "install" ? bootStart(s, linger) : {};
   if (!regularFile(join2(agentDir, "auth.json")))
     return { status: "waiting-for-pi-login", ...result, ...boot() };
   s.systemctl(["reset-failed", s.unit]);
   const started = s.systemctl(["start", s.unit]).status === 0;
   return { status: started ? "started" : "failed", ...result, ...boot() };
 }
+function stopAutostart(s) {
+  if (s.platform !== "linux")
+    return { status: "unsupported" };
+  const path2 = unitPath(s);
+  const previous = readGenerated(path2, MARKER);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  if (s.systemctl(["show-environment"]).status !== 0)
+    return { status: "unavailable", unit: path2 };
+  return {
+    status: s.systemctl(["stop", s.unit]).status === 0 ? "stopped" : "failed",
+    unit: path2,
+    workspace: unitWorkspace(previous)
+  };
+}
 function removeAutostart(s) {
   if (s.platform !== "linux")
-    return { status: "skipped" };
-  const path = unitPath(s);
-  const previous = readGenerated(path);
+    return { status: "unsupported" };
+  const path2 = unitPath(s);
+  const previous = readGenerated(path2, MARKER);
   if (previous === null)
-    return { status: "foreign", unit: path };
+    return { status: "foreign", unit: path2 };
   if (previous === undefined)
     return { status: "absent" };
   if (s.systemctl(["show-environment"]).status !== 0)
-    return { status: "unavailable", unit: path };
+    return { status: "unavailable", unit: path2 };
   if (s.systemctl(["disable", "--now", s.unit]).status !== 0)
-    return { status: "failed", unit: path };
-  rmSync(path);
+    return { status: "failed", unit: path2 };
+  rmSync(path2);
   s.systemctl(["daemon-reload"]);
   s.systemctl(["reset-failed", s.unit]);
-  return { status: "removed", unit: path };
+  return { status: "removed", unit: path2 };
 }
 function autostartStatus(s) {
   if (s.platform !== "linux")
-    return { status: "skipped" };
-  const path = unitPath(s);
-  const previous = readGenerated(path);
+    return { status: "unsupported" };
+  const path2 = unitPath(s);
+  const previous = readGenerated(path2, MARKER);
   if (previous === null)
-    return { status: "foreign", unit: path };
+    return { status: "foreign", unit: path2 };
   if (previous === undefined)
     return { status: "absent" };
   return {
     status: s.systemctl(["is-active", s.unit]).stdout.trim() || "unknown",
     enabled: s.systemctl(["is-enabled", s.unit]).stdout.trim() || "unknown",
-    unit: path,
-    workspace: generatedWorkspace(previous),
-    ...bootStart(s, false, false)
+    unit: path2,
+    workspace: unitWorkspace(previous),
+    ...bootStart(s, false)
   };
 }
 
@@ -2794,13 +2881,13 @@ import { dirname as dirname4, isAbsolute as isAbsolute4, join as join4, relative
 // src/service/private-files.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import {
-  closeSync as closeSync2,
-  constants as constants2,
+  closeSync as closeSync3,
+  constants as constants3,
   fstatSync as fstatSync2,
   fsyncSync as fsyncSync2,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync3,
-  openSync as openSync2,
+  mkdirSync as mkdirSync4,
+  openSync as openSync3,
   readSync as readSync2,
   renameSync as renameSync3,
   unlinkSync as unlinkSync2,
@@ -2848,25 +2935,25 @@ class DirectoryWalks {
     this.walked.clear();
     return false;
   }
-  remember(path, st) {
+  remember(path2, st) {
     if (this.open())
-      this.walked.set(path, { dev: st.dev, ino: st.ino });
+      this.walked.set(path2, { dev: st.dev, ino: st.ino });
   }
-  reuse(path, ownerOnly = true) {
-    const walked = this.open() ? this.walked.get(path) : undefined;
+  reuse(path2, ownerOnly = true) {
+    const walked = this.open() ? this.walked.get(path2) : undefined;
     if (!walked)
       return false;
     let st;
     try {
-      st = lstatSync3(path);
+      st = lstatSync3(path2);
     } catch (error) {
       if (!missing(error))
         throw error;
-      this.walked.delete(path);
+      this.walked.delete(path2);
       return false;
     }
     if (!st.isDirectory() || st.isSymbolicLink() || st.dev !== walked.dev || st.ino !== walked.ino) {
-      this.walked.delete(path);
+      this.walked.delete(path2);
       return false;
     }
     privateMode(st, ownerOnly);
@@ -2881,17 +2968,17 @@ class PrivateFiles {
     this.namespace = namespace;
     this.ownerOnly = ownerOnly;
   }
-  directory(path, create = false, walks) {
-    const tail = relative2(this.namespace, path);
+  directory(path2, create = false, walks) {
+    const tail = relative2(this.namespace, path2);
     if (isAbsolute3(tail) || tail === ".." || tail.startsWith(`..${sep3}`))
       refused();
     if (!create) {
-      const full = resolve3(path);
+      const full = resolve3(path2);
       if (walks?.reuse(full, this.ownerOnly))
         return true;
       const namespace = resolve3(this.namespace);
       let inside = false, last;
-      const found = safeDirectory(path, false, (at2, st) => {
+      const found = safeDirectory(path2, false, (at2, st) => {
         if (at2 === namespace)
           inside = true;
         if (inside)
@@ -2915,7 +3002,7 @@ class PrivateFiles {
         if (!missing(error))
           throw error;
         try {
-          mkdirSync3(at, { mode: 448 });
+          mkdirSync4(at, { mode: 448 });
         } catch (mkdirError) {
           if (!(mkdirError instanceof Error && ("code" in mkdirError) && mkdirError.code === "EEXIST"))
             throw mkdirError;
@@ -2928,12 +3015,12 @@ class PrivateFiles {
     }
     return true;
   }
-  read(path, maximum = METADATA_BYTES, walks) {
-    if (!this.directory(dirname3(path), false, walks))
+  read(path2, maximum = METADATA_BYTES, walks) {
+    if (!this.directory(dirname3(path2), false, walks))
       return;
     let before;
     try {
-      before = lstatSync3(path);
+      before = lstatSync3(path2);
     } catch (error) {
       if (missing(error))
         return;
@@ -2942,7 +3029,7 @@ class PrivateFiles {
     if (!before.isFile() || before.nlink !== 1 || before.size > maximum)
       refused();
     privateMode(before, this.ownerOnly);
-    const fd = openSync2(path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+    const fd = openSync3(path2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
     try {
       const opened = fstatSync2(fd);
       if (!same(before, opened))
@@ -2956,60 +3043,60 @@ class PrivateFiles {
         size += n;
       }
       const bytes = buffer.subarray(0, size);
-      if (size !== opened.size || !same(opened, fstatSync2(fd)) || !same(opened, lstatSync3(path)))
+      if (size !== opened.size || !same(opened, fstatSync2(fd)) || !same(opened, lstatSync3(path2)))
         refused();
       return { bytes, identity: hash(bytes), stamp: stamp(opened) };
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
   }
-  assert(path, expected, maximum = METADATA_BYTES, walks) {
-    const current = this.read(path, maximum, walks);
+  assert(path2, expected, maximum = METADATA_BYTES, walks) {
+    const current = this.read(path2, maximum, walks);
     if (current?.identity !== expected?.identity || current?.stamp !== expected?.stamp)
       throw new ContractError("conflict");
   }
-  create(path, bytes, maximum = METADATA_BYTES) {
+  create(path2, bytes, maximum = METADATA_BYTES) {
     if (Buffer.byteLength(bytes) > maximum)
       throw new ContractError("oversize");
-    this.directory(dirname3(path), true);
-    const fd = retryWindowsFileOperation(() => openSync2(path, "wx", 384));
+    this.directory(dirname3(path2), true);
+    const fd = retryWindowsFileOperation(() => openSync3(path2, "wx", 384));
     try {
       writeFileSync3(fd, bytes);
       fsyncSync2(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
-    this.syncDirectory(dirname3(path));
-    const result = this.read(path, maximum);
+    this.syncDirectory(dirname3(path2));
+    const result = this.read(path2, maximum);
     if (!result || result.identity !== hash(bytes))
       refused();
     return result;
   }
-  replace(path, expected, bytes, maximum = METADATA_BYTES) {
-    this.assert(path, expected, maximum);
-    const temporary = join3(dirname3(path), `pending-${randomUUID2()}.json`);
+  replace(path2, expected, bytes, maximum = METADATA_BYTES) {
+    this.assert(path2, expected, maximum);
+    const temporary = join3(dirname3(path2), `pending-${randomUUID2()}.json`);
     this.create(temporary, bytes, maximum);
-    this.assert(path, expected, maximum);
-    retryWindowsFileOperation(() => renameSync3(temporary, path), () => this.assert(path, expected, maximum));
-    this.syncDirectory(dirname3(path));
-    const result = this.read(path, maximum);
+    this.assert(path2, expected, maximum);
+    retryWindowsFileOperation(() => renameSync3(temporary, path2), () => this.assert(path2, expected, maximum));
+    this.syncDirectory(dirname3(path2));
+    const result = this.read(path2, maximum);
     if (!result || result.identity !== hash(bytes))
       refused();
     return result;
   }
-  remove(path, expected, maximum = METADATA_BYTES) {
-    this.assert(path, expected, maximum);
-    retryWindowsFileOperation(() => unlinkSync2(path), () => this.assert(path, expected, maximum));
-    this.syncDirectory(dirname3(path));
+  remove(path2, expected, maximum = METADATA_BYTES) {
+    this.assert(path2, expected, maximum);
+    retryWindowsFileOperation(() => unlinkSync2(path2), () => this.assert(path2, expected, maximum));
+    this.syncDirectory(dirname3(path2));
   }
-  syncDirectory(path) {
+  syncDirectory(path2) {
     if (process.platform === "win32")
       return;
-    const fd = openSync2(path, constants2.O_RDONLY | constants2.O_DIRECTORY);
+    const fd = openSync3(path2, constants3.O_RDONLY | constants3.O_DIRECTORY);
     try {
       fsyncSync2(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
   }
 }
@@ -3053,10 +3140,10 @@ var registrationKeys = [
 ];
 var reservationKeys = registrationKeys.filter((k) => !["schema", "phase", "checkoutToken"].includes(k));
 function pathValue(value) {
-  const path = text(value, 4096, true);
-  if (!isAbsolute4(path))
+  const path2 = text(value, 4096, true);
+  if (!isAbsolute4(path2))
     refused();
-  return path;
+  return path2;
 }
 function endpoint(value, allowZero = false) {
   const s = text(value, 128, true);
@@ -3115,8 +3202,8 @@ function rootsOverlap(a, b) {
   };
   return within(a, b) || within(b, a);
 }
-function names(path, allowed) {
-  const dir = opendirSync(path);
+function names(path2, allowed) {
+  const dir = opendirSync(path2);
   try {
     let count = 0;
     for (let entry = dir.readSync();entry; entry = dir.readSync()) {
@@ -3641,13 +3728,277 @@ class OwnerLease {
   }
 }
 
+// src/service/launchd.ts
+import { rmSync as rmSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+var LABEL = "com.abelxiaoxing.cadence";
+var MARKER2 = `<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generated by @abelxiaoxing/cadence`;
+function plistPath(s) {
+  return join5(s.home, "Library", "LaunchAgents", `${LABEL}.plist`);
+}
+var xml = (value) => checked(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+function buildPlist(u) {
+  const string = (value) => `		<string>${xml(value)}</string>`;
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    "<!-- Generated by @abelxiaoxing/cadence; `cadence server install` and `restart` rewrite this file. -->",
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "\t<key>Label</key>",
+    `	<string>${LABEL}</string>`,
+    "\t<key>ProgramArguments</key>",
+    "\t<array>",
+    ...[u.node, u.cli, "start", "--foreground", "--workspace", u.workspace].map(string),
+    "\t</array>",
+    "\t<key>WorkingDirectory</key>",
+    `	<string>${xml(u.workspace)}</string>`,
+    "\t<key>EnvironmentVariables</key>",
+    "\t<dict>",
+    ...u.environment.flatMap(([k, v]) => [
+      `		<key>${xml(k)}</key>`,
+      string(v)
+    ]),
+    "\t</dict>",
+    "\t<key>RunAtLoad</key>",
+    "\t<true/>",
+    "\t<key>ProcessType</key>",
+    "\t<string>Background</string>",
+    "\t<key>StandardOutPath</key>",
+    `	<string>${xml(u.log)}</string>`,
+    "\t<key>StandardErrorPath</key>",
+    `	<string>${xml(u.log)}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ].join(`
+`);
+}
+function plistWorkspace(text2) {
+  const m = text2?.match(/^\t<key>WorkingDirectory<\/key>\n\t<string>([^<]*)<\/string>$/m);
+  return m?.[1].replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+}
+var domain = (s) => `gui/${s.uid}`;
+var target = (s) => `${domain(s)}/${LABEL}`;
+var loaded = (s) => s.launchctl(["print", target(s)]).status === 0;
+function disabled(s) {
+  return new RegExp(`"${LABEL.replaceAll(".", "\\.")}" => (true|disabled)`).test(s.launchctl(["print-disabled", domain(s)]).stdout);
+}
+async function configureLaunchAgent(s, mode, requested) {
+  if (s.uid === undefined)
+    return { status: "unavailable" };
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
+  const sdk = sdkPackages(s.root);
+  if (!sdk)
+    return { status: "missing-pi-sdk" };
+  const kept = plistWorkspace(previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, kept);
+  const refused2 = await settle(s, kept);
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  if (loaded(s))
+    s.launchctl(["bootout", target(s)]);
+  write(path2, buildPlist({
+    node: s.node,
+    cli: join5(s.root, "src", "service-cli.mjs"),
+    workspace,
+    environment: serviceEnvironment(s),
+    log: join5(s.home, "Library", "Logs", "cadence.log")
+  }));
+  const result = {
+    unit: path2,
+    workspace,
+    ...redirectedFrom ? { redirectedFrom } : {}
+  };
+  if (mode === "install")
+    s.launchctl(["enable", target(s)]);
+  else if (disabled(s))
+    return { status: "disabled", ...result };
+  if (!regularFile(join5(agentDirectory(s), "auth.json")))
+    return { status: "waiting-for-pi-login", ...result };
+  const started = s.launchctl(["bootstrap", domain(s), path2]).status === 0;
+  return { status: started ? "started" : "failed", ...result };
+}
+async function stopLaunchAgent(s) {
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = plistWorkspace(previous);
+  const refused2 = await settle(s, workspace);
+  return { ...refused2 ?? { status: "stopped", workspace }, unit: path2 };
+}
+async function removeLaunchAgent(s) {
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const refused2 = await settle(s, plistWorkspace(previous));
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  if (s.uid !== undefined && loaded(s))
+    s.launchctl(["bootout", target(s)]);
+  rmSync2(path2);
+  return { status: "removed", unit: path2 };
+}
+function launchAgentStatus(s) {
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const printed = s.uid === undefined ? undefined : s.launchctl(["print", target(s)]);
+  return {
+    status: printed?.status !== 0 ? "unloaded" : /^\s*state = running$/m.test(printed.stdout) ? "active" : "inactive",
+    enabled: s.uid !== undefined && disabled(s) ? "disabled" : "enabled",
+    unit: path2,
+    workspace: plistWorkspace(previous)
+  };
+}
+
+// src/service/login-run.ts
+import { rmSync as rmSync3 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join6 } from "node:path";
+var RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+var APPROVED_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run";
+var RUN_VALUE = "Cadence";
+var MARKER3 = "' Generated by @abelxiaoxing/cadence";
+function launcherPath(s) {
+  const local = s.env.LOCALAPPDATA;
+  return join6(local && isAbsolute5(local) ? local : join6(s.home, "AppData", "Local"), "cadence-server", "cadence.vbs");
+}
+var literal2 = (value) => `"${checked(value).replaceAll('"', '""')}"`;
+function argument2(value) {
+  if (checked(value).includes('"'))
+    throw new ContractError("invalid");
+  return `"${value}"`;
+}
+function buildLauncher(u) {
+  const command = `${argument2(u.node)} ${argument2(u.cli)} start --workspace ${argument2(u.workspace)}`;
+  return [
+    `${MARKER3}; \`cadence server install\` and \`restart\` rewrite this file.`,
+    `' Started at login by ${RUN_KEY}\\${RUN_VALUE}; window style 0 hides the console.`,
+    'Set shell = CreateObject("WScript.Shell")',
+    ...u.environment.length ? ['Set env = shell.Environment("Process")'] : [],
+    ...u.environment.map(([k, v]) => `env(${literal2(k)}) = ${literal2(v)}`),
+    `shell.CurrentDirectory = ${literal2(u.workspace)}`,
+    `shell.Run ${literal2(command)}, 0, False`,
+    ""
+  ].join(`\r
+`);
+}
+var utf16 = (text2) => Buffer.concat([Buffer.from([255, 254]), Buffer.from(text2, "utf16le")]);
+function launcherWorkspace(text2) {
+  return text2?.match(/^shell\.CurrentDirectory = "((?:[^"]|"")*)"\r?$/m)?.[1].replaceAll('""', '"');
+}
+var runEntry = (path2, s) => `"${wscript(s.env)}" "${path2}"`;
+var present = (s, key) => s.reg(["query", key, "/v", RUN_VALUE]).status === 0;
+function approvedOff(s) {
+  const r = s.reg(["query", APPROVED_KEY, "/v", RUN_VALUE]);
+  const first = r.status === 0 && /REG_BINARY\s+([0-9A-F]{2})/i.exec(r.stdout);
+  return !!first && (Number.parseInt(first[1], 16) & 1) === 1;
+}
+async function configureLoginRun(s, mode, requested) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined && present(s, RUN_KEY))
+    return { status: "foreign", unit: `${RUN_KEY}\\${RUN_VALUE}` };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
+  const sdk = sdkPackages(s.root);
+  if (!sdk)
+    return { status: "missing-pi-sdk" };
+  const kept = launcherWorkspace(previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, kept);
+  const refused2 = await settle(s, kept);
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  const environment = s.env.PI_CODING_AGENT_DIR ? [["PI_CODING_AGENT_DIR", agentDirectory(s)]] : [];
+  write(path2, utf16(buildLauncher({
+    node: s.node,
+    cli: join6(s.root, "src", "service-cli.mjs"),
+    workspace,
+    environment
+  })));
+  const result = {
+    unit: path2,
+    workspace,
+    ...redirectedFrom ? { redirectedFrom } : {}
+  };
+  if (mode === "install") {
+    const entry = ["/v", RUN_VALUE, "/t", "REG_SZ", "/d", runEntry(path2, s)];
+    if (s.reg(["add", RUN_KEY, ...entry, "/f"]).status !== 0)
+      return { status: "failed", ...result };
+    s.reg(["delete", APPROVED_KEY, "/v", RUN_VALUE, "/f"]);
+  }
+  if (!regularFile(join6(agentDirectory(s), "auth.json")))
+    return { status: "waiting-for-pi-login", ...result };
+  return { status: s.launch(path2) ? "started" : "failed", ...result };
+}
+async function stopLoginRun(s) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = launcherWorkspace(previous);
+  const refused2 = await settle(s, workspace);
+  return { ...refused2 ?? { status: "stopped", workspace }, unit: path2 };
+}
+async function removeLoginRun(s) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const refused2 = await settle(s, launcherWorkspace(previous));
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  for (const key of [RUN_KEY, APPROVED_KEY])
+    if (present(s, key))
+      s.reg(["delete", key, "/v", RUN_VALUE, "/f"]);
+  rmSync3(path2);
+  return { status: "removed", unit: path2 };
+}
+async function loginRunStatus(s) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = launcherWorkspace(previous);
+  const owner = workspace ? await s.ownerStatus(workspace) : "unavailable";
+  return {
+    status: owner === "alive" ? "active" : "inactive",
+    enabled: present(s, RUN_KEY) && !approvedOff(s) ? "enabled" : "disabled",
+    unit: path2,
+    workspace
+  };
+}
+
 // src/service/recovery-cli.ts
 import { isatty } from "node:tty";
 
 // src/history/recovery.ts
 import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypto";
 import { lstatSync as lstatSync6, opendirSync as opendirSync3 } from "node:fs";
-import { join as join6, relative as relative4 } from "node:path";
+import { join as join8, relative as relative4 } from "node:path";
 
 // src/service/recovery.ts
 async function inspectRecovery(coordination, history) {
@@ -3697,17 +4048,17 @@ async function resolveRecovery(coordination, confirmation, history) {
 // src/history/files.ts
 import { createHash as createHash4, randomBytes as randomBytes2, randomUUID as randomUUID4 } from "node:crypto";
 import {
-  closeSync as closeSync4,
-  constants as constants4,
+  closeSync as closeSync5,
+  constants as constants5,
   fstatSync as fstatSync4,
   fsyncSync as fsyncSync3,
   lstatSync as lstatSync5,
   opendirSync as opendirSync2,
-  openSync as openSync4,
+  openSync as openSync5,
   statfsSync
 } from "node:fs";
 import { open } from "node:fs/promises";
-import { dirname as dirname6, join as join5 } from "node:path";
+import { dirname as dirname6, join as join7 } from "node:path";
 
 // src/history/admission.ts
 function decodeRunAdmission(value) {
@@ -3728,11 +4079,11 @@ function decodeRunAdmission(value) {
 
 // src/history/read-io.ts
 import {
-  closeSync as closeSync3,
-  constants as constants3,
+  closeSync as closeSync4,
+  constants as constants4,
   fstatSync as fstatSync3,
   lstatSync as lstatSync4,
-  openSync as openSync3,
+  openSync as openSync4,
   readSync as readSync3
 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
@@ -3740,32 +4091,32 @@ function bad() {
   throw new ContractError("corrupt-selected");
 }
 var stamp2 = (s) => [s.dev, s.ino, s.size, s.mode, s.uid, s.nlink, s.ctimeMs, s.mtimeMs].join(":");
-function selected(files, path, read, walks) {
-  if (!files.files.directory(dirname5(path), false, walks))
+function selected(files, path2, read, walks) {
+  if (!files.files.directory(dirname5(path2), false, walks))
     bad();
-  const before = lstatSync4(path);
+  const before = lstatSync4(path2);
   if (!before.isFile() || before.nlink !== 1 || process.platform !== "win32" && (before.mode & 63 || process.getuid && before.uid !== process.getuid()))
     bad();
-  const fd = openSync3(path, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+  const fd = openSync4(path2, constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0));
   try {
     if (stamp2(fstatSync3(fd)) !== stamp2(before))
       bad();
     const result = read(fd, before.size, stamp2(before));
-    if (stamp2(fstatSync3(fd)) !== stamp2(before) || stamp2(lstatSync4(path)) !== stamp2(before))
+    if (stamp2(fstatSync3(fd)) !== stamp2(before) || stamp2(lstatSync4(path2)) !== stamp2(before))
       bad();
     return result;
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
-function assertIncarnation(files, path, expected) {
-  selected(files, path, (_fd, _size, current) => {
+function assertIncarnation(files, path2, expected) {
+  selected(files, path2, (_fd, _size, current) => {
     if (current !== expected)
       bad();
   });
 }
-function statSize(files, path, maximum) {
-  return selected(files, path, (_fd, size) => {
+function statSize(files, path2, maximum) {
+  return selected(files, path2, (_fd, size) => {
     if (size > maximum)
       bad();
     return size;
@@ -4238,14 +4589,14 @@ class HistoryFiles {
     this.coordination = coordination;
     this.format = format;
     this.formatSnapshot = formatSnapshot;
-    this.directory = join5(coordination.directory, "history-v2");
+    this.directory = join7(coordination.directory, "history-v2");
     this.files = coordination.files;
   }
   static open(coordination) {
-    const dir = join5(coordination.directory, "history-v2");
+    const dir = join7(coordination.directory, "history-v2");
     if (!coordination.files.directory(dir))
       return;
-    const file = coordination.files.read(join5(dir, "format.json"));
+    const file = coordination.files.read(join7(dir, "format.json"));
     if (!file)
       corrupt();
     const format = decodeFormat(json(file));
@@ -4261,7 +4612,7 @@ class HistoryFiles {
       existing.assertWritable();
       return existing;
     }
-    const dir = join5(c.directory, "history-v2");
+    const dir = join7(c.directory, "history-v2");
     const format = {
       schema: FORMAT,
       storeId: randomUUID4(),
@@ -4271,19 +4622,19 @@ class HistoryFiles {
     c.files.directory(dir, true);
     for (const name of ["commands", "ledger", "runs", "indexes"]) {
       lease.assert();
-      c.files.directory(join5(dir, name), true);
+      c.files.directory(join7(dir, name), true);
     }
     lease.assert();
-    const keyPath = join5(dir, "read-proof-key.json");
+    const keyPath = join7(dir, "read-proof-key.json");
     c.files.create(keyPath, encoded({
       schema: "cadence-history-read-key/1",
       storeId: format.storeId,
       key: randomBytes2(32).toString("base64url")
     }));
     lease.assert();
-    const snapshot = c.files.create(join5(dir, "format.json"), encoded(format));
+    const snapshot = c.files.create(join7(dir, "format.json"), encoded(format));
     const result = new HistoryFiles(c, format, snapshot);
-    result.syncParents(join5(dir, "format.json"));
+    result.syncParents(join7(dir, "format.json"));
     result.assertWritable();
     return result;
   }
@@ -4318,7 +4669,7 @@ class HistoryFiles {
       throw new ContractError("quarantine");
   }
   assertFormat() {
-    this.files.assert(join5(this.directory, "format.json"), this.formatSnapshot);
+    this.files.assert(join7(this.directory, "format.json"), this.formatSnapshot);
   }
   readProofMaterial(budget) {
     if (this.format.schema !== FORMAT)
@@ -4327,7 +4678,7 @@ class HistoryFiles {
       this.assertReadFormat(budget);
     else
       this.assertFormat();
-    const selected2 = this.readBudgeted(join5(this.directory, "read-proof-key.json"), 512, budget);
+    const selected2 = this.readBudgeted(join7(this.directory, "read-proof-key.json"), 512, budget);
     if (!selected2 || this.proofSnapshot && (selected2.identity !== this.proofSnapshot.identity || selected2.stamp !== this.proofSnapshot.stamp))
       corrupt();
     try {
@@ -4355,17 +4706,17 @@ class HistoryFiles {
       return;
     }
     this.assertFormat();
-    assertIncarnation(this, join5(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
+    assertIncarnation(this, join7(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
   }
   segmentPath(segment) {
-    return join5(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
+    return join7(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
   }
   artifactPath(ref) {
-    return join5(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
+    return join7(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
   }
   admissionPath(runId) {
     decodeId(runId);
-    return join5(this.directory, "runs", runId, "admission.json");
+    return join7(this.directory, "runs", runId, "admission.json");
   }
   writeAdmission(lease, input) {
     lease.assert();
@@ -4374,24 +4725,24 @@ class HistoryFiles {
     this.files.create(this.admissionPath(value.runId), encoded(value), RECORD_BYTES);
     this.syncParents(this.admissionPath(value.runId));
   }
-  readBudgeted(path, maximum, budget) {
+  readBudgeted(path2, maximum, budget) {
     if (!budget)
-      return this.files.read(path, maximum);
+      return this.files.read(path2, maximum);
     let size;
     try {
-      size = lstatSync5(path).size;
+      size = lstatSync5(path2).size;
     } catch {
-      return this.files.read(path, 0, budget.walks);
+      return this.files.read(path2, 0, budget.walks);
     }
     if (size > maximum)
       corrupt();
     budget.reserve(size);
-    return this.files.read(path, size, budget.walks);
+    return this.files.read(path2, size, budget.walks);
   }
   readCommand(commandId, budget) {
     decodeId(commandId);
     this.assertReadFormat(budget);
-    return this.readBudgeted(join5(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
+    return this.readBudgeted(join7(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
   }
   readAdmission(runId, identity, budget) {
     return this.readAdmissionIdentity(runId, hash(canonicalJson(identity)), budget);
@@ -4412,24 +4763,24 @@ class HistoryFiles {
   syncParents(file) {
     if (process.platform === "win32")
       return;
-    for (let path = dirname6(file);; path = dirname6(path)) {
-      if (!this.files.directory(path))
+    for (let path2 = dirname6(file);; path2 = dirname6(path2)) {
+      if (!this.files.directory(path2))
         corrupt();
-      const fd = openSync4(path, constants4.O_RDONLY | constants4.O_DIRECTORY);
+      const fd = openSync5(path2, constants5.O_RDONLY | constants5.O_DIRECTORY);
       try {
         fsyncSync3(fd);
       } finally {
-        closeSync4(fd);
+        closeSync5(fd);
       }
-      if (path === this.coordination.directory)
+      if (path2 === this.coordination.directory)
         break;
-      if (path === dirname6(path))
+      if (path2 === dirname6(path2))
         corrupt();
     }
   }
   assertReadFormat(budget) {
     budget.reserve(this.formatSnapshot.bytes.length);
-    this.files.assert(join5(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
+    this.files.assert(join7(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
   }
   assertPublished(segment, end, seq) {
     const fence = publicationFences.get(this.directory);
@@ -4460,14 +4811,14 @@ class HistoryFiles {
     this.syncParents(this.artifactPath(ref));
   }
   usage() {
-    const walk = (path, depth) => {
-      if (depth > 8 || !this.files.directory(path))
+    const walk = (path2, depth) => {
+      if (depth > 8 || !this.files.directory(path2))
         corrupt();
       let bytes = 0;
-      const dir = opendirSync2(path);
+      const dir = opendirSync2(path2);
       try {
         for (let e = dir.readSync();e; e = dir.readSync()) {
-          const p = join5(path, e.name), st = lstatSync5(p);
+          const p = join7(path2, e.name), st = lstatSync5(p);
           if (st.isDirectory())
             bytes += walk(p, depth + 1);
           else {
@@ -4502,7 +4853,7 @@ class HistoryFiles {
     state.bytes = 0;
     state.identity = null;
     let count = 0;
-    const ledger = join5(this.directory, "ledger");
+    const ledger = join7(this.directory, "ledger");
     if (!this.files.directory(ledger))
       corrupt();
     const dir = opendirSync2(ledger);
@@ -4660,17 +5011,17 @@ class HistoryFiles {
     this.assertRecoveryIdle();
     this.validateRecovery(row.value);
     const { body, trailer, marker } = this.encodeBatch(state, [row]);
-    const segment = state.segment + 1, path = this.segmentPath(segment);
+    const segment = state.segment + 1, path2 = this.segmentPath(segment);
     publicationFences.set(this.directory, { ...state });
     this.activity().generation++;
-    const before = this.files.create(path, "", LIMITS.segmentBytes);
+    const before = this.files.create(path2, "", LIMITS.segmentBytes);
     let committed;
-    const fd = await open(path, constants4.O_WRONLY | constants4.O_APPEND | (constants4.O_NOFOLLOW ?? 0));
+    const fd = await open(path2, constants5.O_WRONLY | constants5.O_APPEND | (constants5.O_NOFOLLOW ?? 0));
     const assertOriginal = (bytes) => {
-      const original = fstatSync4(fd.fd), selected2 = lstatSync5(path);
+      const original = fstatSync4(fd.fd), selected2 = lstatSync5(path2);
       if (original.dev !== selected2.dev || original.ino !== selected2.ino || original.nlink !== 1)
         corrupt();
-      const snapshot = this.files.read(path, LIMITS.segmentBytes);
+      const snapshot = this.files.read(path2, LIMITS.segmentBytes);
       if (!snapshot || snapshot.identity !== hash(bytes))
         corrupt();
       return snapshot;
@@ -4678,7 +5029,7 @@ class HistoryFiles {
     try {
       await assertCurrent();
       this.assertWritable();
-      this.files.assert(path, before, LIMITS.segmentBytes);
+      this.files.assert(path2, before, LIMITS.segmentBytes);
       assertOriginal("");
       await fd.writeFile(body);
       await observer?.("journal");
@@ -4687,7 +5038,7 @@ class HistoryFiles {
       assertOriginal(body);
       await fd.writeFile(trailer);
       await fd.sync();
-      this.syncParents(path);
+      this.syncParents(path2);
       await observer?.("commit");
       await assertCurrent();
       this.assertWritable();
@@ -4699,7 +5050,7 @@ class HistoryFiles {
     this.assertWritable();
     if (!committed)
       corrupt();
-    this.files.assert(path, committed, LIMITS.segmentBytes);
+    this.files.assert(path2, committed, LIMITS.segmentBytes);
     publicationFences.delete(this.directory);
     return {
       snapshot: committed,
@@ -4771,20 +5122,20 @@ class HistoryFiles {
     if (state.bytes + Buffer.byteLength(body + trailer) > LIMITS.segmentBytes || state.records + rows.length + 1 > LIMITS.segmentRecords)
       segment++;
     lease.assert();
-    const path = this.segmentPath(segment);
-    let before = this.files.read(path, LIMITS.segmentBytes);
+    const path2 = this.segmentPath(segment);
+    let before = this.files.read(path2, LIMITS.segmentBytes);
     if (segment !== state.segment) {
       if (before)
         corrupt();
-      before = this.files.create(path, "", LIMITS.segmentBytes);
+      before = this.files.create(path2, "", LIMITS.segmentBytes);
     }
     if (!before || segment === state.segment && (before.bytes.length !== state.bytes || before.identity !== state.identity))
       corrupt();
-    const fd = await open(path, constants4.O_WRONLY | constants4.O_APPEND | (constants4.O_NOFOLLOW ?? 0));
+    const fd = await open(path2, constants5.O_WRONLY | constants5.O_APPEND | (constants5.O_NOFOLLOW ?? 0));
     try {
       lease.assert();
-      this.files.assert(path, before, LIMITS.segmentBytes);
-      const opened = await fd.stat(), selected2 = lstatSync5(path);
+      this.files.assert(path2, before, LIMITS.segmentBytes);
+      const opened = await fd.stat(), selected2 = lstatSync5(path2);
       if (opened.ino !== selected2.ino || opened.dev !== selected2.dev || opened.nlink !== 1)
         corrupt();
       beforeEffect?.();
@@ -4798,7 +5149,7 @@ class HistoryFiles {
       await observer?.("commit");
       lease.assert();
       this.assertWritable();
-      const after = this.files.read(path, LIMITS.segmentBytes);
+      const after = this.files.read(path2, LIMITS.segmentBytes);
       if (!after || after.identity !== createHash4("sha256").update(before.bytes).update(body).update(trailer).digest("hex"))
         corrupt();
       return {
@@ -4819,7 +5170,7 @@ class HistoryFiles {
   checkpoint(lease, state) {
     lease.assert();
     this.assertWritable();
-    const path = join5(this.directory, "checkpoint.json"), old = this.files.read(path);
+    const path2 = join7(this.directory, "checkpoint.json"), old = this.files.read(path2);
     const body = encoded({
       schema: "cadence-history-checkpoint/2",
       storeId: this.format.storeId,
@@ -4827,9 +5178,9 @@ class HistoryFiles {
       segment: state.segment
     });
     if (old)
-      this.files.replace(path, old, body);
+      this.files.replace(path2, old, body);
     else
-      this.files.create(path, body);
+      this.files.create(path2, body);
   }
 }
 function emptyScan() {
@@ -5229,13 +5580,13 @@ function digestHistory(files, exclude) {
   files.assertFormat();
   const digest = createHash5("sha256");
   let count = 0;
-  const walk = (path, depth) => {
-    if (depth > 8 || !files.files.directory(path))
+  const walk = (path2, depth) => {
+    if (depth > 8 || !files.files.directory(path2))
       throw new ContractError("corrupt-selected");
-    const directory2 = lstatSync6(path);
+    const directory2 = lstatSync6(path2);
     digest.update(`incarnation:${directory2.dev}:${directory2.ino}
 `);
-    const dir = opendirSync3(path), names2 = [];
+    const dir = opendirSync3(path2), names2 = [];
     try {
       for (let e = dir.readSync();e; e = dir.readSync()) {
         if (++count > LIMITS.dataFrames)
@@ -5246,7 +5597,7 @@ function digestHistory(files, exclude) {
       dir.closeSync();
     }
     for (const name of names2.sort()) {
-      const selected2 = join6(path, name);
+      const selected2 = join8(path2, name);
       if (selected2 === exclude)
         continue;
       const rel = relative4(files.directory, selected2);
@@ -5386,13 +5737,13 @@ class HistoryRecovery {
       },
       acknowledgments: { processes: true, credentials: true, storage: true }
     };
-    const path = files.segmentPath(state.segment + 1);
+    const path2 = files.segmentPath(state.segment + 1);
     const assertCurrent = async () => {
       await confirmation.assertLocalAuthority(structuredClone(expected));
       const selected2 = await inspectRecovery(this.coordination);
       if (selected2.owner !== "absent")
         throw new ContractError("quarantine");
-      if (selected2.epoch !== expected.epoch || selected2.coordinationDigest !== expected.coordinationDigest || digestHistory(files, path) !== expected.history?.digest || this.coordination.recoverySnapshot().digest !== expected.coordinationDigest)
+      if (selected2.epoch !== expected.epoch || selected2.coordinationDigest !== expected.coordinationDigest || digestHistory(files, path2) !== expected.history?.digest || this.coordination.recoverySnapshot().digest !== expected.coordinationDigest)
         throw new ContractError("conflict");
     };
     await confirmation.assertLocalAuthority(structuredClone(expected));
@@ -5416,8 +5767,8 @@ class HistoryRecovery {
     const assert = () => {
       files.assertWritable();
       files.assertRecoveryIdle();
-      files.files.assert(path, after.snapshot, LIMITS.segmentBytes);
-      if (digestHistory(files, path) !== expected.history?.digest)
+      files.files.assert(path2, after.snapshot, LIMITS.segmentBytes);
+      if (digestHistory(files, path2) !== expected.history?.digest)
         throw new ContractError("conflict");
     };
     assert();
@@ -5556,8 +5907,8 @@ async function localRecovery(c, operation) {
 }
 
 // src/service/runtime.ts
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute5, join as join7, resolve as resolve4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname7, isAbsolute as isAbsolute6, join as join9, resolve as resolve4 } from "node:path";
 
 // src/service/config.ts
 import { isIP } from "node:net";
@@ -5611,7 +5962,7 @@ function localOrigin(policy, actualPort) {
 var STARTUP_INPUT_BYTES = 16 * 1024;
 function absolute(value) {
   const result = text(value, 4096, true);
-  if (!isAbsolute5(result))
+  if (!isAbsolute6(result))
     throw new ContractError("invalid");
   return result;
 }
@@ -5691,8 +6042,8 @@ function selectStart(options, ambient) {
     throw new ContractError("invalid");
   let fromFile;
   if (options.config) {
-    const path = resolve4(options.config), f = new PrivateFiles(dirname7(path));
-    const bytes = f.read(path);
+    const path2 = resolve4(options.config), f = new PrivateFiles(dirname7(path2));
+    const bytes = f.read(path2);
     if (!bytes)
       throw new ContractError("corrupt-selected");
     fromFile = decodeHostConfig(json(bytes));
@@ -5706,7 +6057,7 @@ function selectStart(options, ambient) {
       port: options.port ?? 17423,
       proxy: null
     },
-    agentDir: resolve4(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join7(ambient.HOME ?? ambient.USERPROFILE ?? homedir3(), ".pi", "agent")),
+    agentDir: resolve4(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join9(ambient.HOME ?? ambient.USERPROFILE ?? homedir4(), ".pi", "agent")),
     tokenSource: options.tokenFile ? "file" : env ? "environment" : "generated",
     tokenFile: options.tokenFile ? resolve4(options.tokenFile) : null
   });
@@ -5878,10 +6229,10 @@ function startupGuidance(result, input) {
       return `Pi's agent directory ${agent} must be an existing real directory (not a symlink) owned by you.
 `;
     case "pi-auth":
-      return `${join8(agent, "auth.json")} must be your own single-link regular file holding valid Pi credentials; log in to Pi first.
+      return `${join10(agent, "auth.json")} must be your own single-link regular file holding valid Pi credentials; log in to Pi first.
 `;
     case "pi-models":
-      return `${join8(agent, "models.json")} must be your own single-link regular file using only fields Cadence's pinned Pi SDK supports; a field only newer Pi understands is refused.
+      return `${join10(agent, "models.json")} must be your own single-link regular file using only fields Cadence's pinned Pi SDK supports; a field only newer Pi understands is refused.
 `;
     case "pi-runtime":
       return `Loading Pi's SDK model runtime failed after the owner registered (optional SDK packages missing, or sources the SDK refuses); it stays quarantined.
@@ -6007,14 +6358,59 @@ async function observeStarted(workspace) {
   }
   return { service };
 }
-function autostartGuidance(s, result) {
-  const name = s.unit.replace(/\.service$/, "");
-  const cli = JSON.stringify(join8(s.root, "src", "service-cli.mjs"));
-  const workspace = JSON.stringify(result.workspace ?? "");
-  const manage = `Manage: systemctl --user status|restart|stop ${name}; logs: journalctl --user -u ${name}; opt out: systemctl --user disable --now ${name}`;
+var ownerControl = {
+  async ownerStatus(workspace) {
+    try {
+      const observed = await serviceStatus(new ServiceCoordination(workspace));
+      return observed && typeof observed === "object" && "status" in observed ? String(observed.status) : "unavailable";
+    } catch {
+      return "unavailable";
+    }
+  },
+  async stopOwner(workspace) {
+    try {
+      const c = new ServiceCoordination(workspace);
+      const observed = await serviceStatus(c);
+      const status = observed && typeof observed === "object" && "status" in observed ? String(observed.status) : "unavailable";
+      if (status === "absent" || status === "stopped")
+        return "stopped";
+      return status === "alive" ? (await stopService(c)).status : status;
+    } catch {
+      return "unavailable";
+    }
+  }
+};
+async function serverAction(s, action, requested, linger) {
+  const install = action === "install" || action === "restart";
+  const mode = action === "install" ? "install" : "restart";
+  switch (s.platform) {
+    case "linux":
+      if (install)
+        return configureAutostart(s, mode, requested, linger);
+      if (action === "stop")
+        return stopAutostart(s);
+      return action === "uninstall" ? removeAutostart(s) : autostartStatus(s);
+    case "darwin":
+      if (install)
+        return configureLaunchAgent(s, mode, requested);
+      if (action === "stop")
+        return stopLaunchAgent(s);
+      return action === "uninstall" ? removeLaunchAgent(s) : launchAgentStatus(s);
+    case "win32":
+      if (install)
+        return configureLoginRun(s, mode, requested);
+      if (action === "stop")
+        return stopLoginRun(s);
+      return action === "uninstall" ? removeLoginRun(s) : loginRunStatus(s);
+    default:
+      return { status: "unsupported" };
+  }
+}
+function serverGuidance(s, action, result) {
+  const cli = piUserInstall(s) ? `node ${JSON.stringify(join10(s.root, "src", "service-cli.mjs"))}` : "cadence";
   const note = result.redirectedFrom ? `Cadence workspace: ${result.workspace} (${result.redirectedFrom} contains Cadence's private state)
 ` : "";
-  return note + autostartStatusGuidance(s, result, name, cli, workspace, manage);
+  return note + serverStatusGuidance(s, action, result, cli);
 }
 function lingerGuidance(linger) {
   switch (linger) {
@@ -6031,83 +6427,136 @@ function lingerGuidance(linger) {
       return "";
   }
 }
-function autostartStatusGuidance(s, result, name, cli, workspace, manage) {
+function managerDetail(s) {
+  switch (s.platform) {
+    case "linux":
+      return "see systemctl --user status cadence and journalctl --user -u cadence";
+    case "darwin":
+      return `see launchctl print gui/${s.uid}/${LABEL} and ~/Library/Logs/cadence.log`;
+    default:
+      return `run its launcher to see why: wscript ${JSON.stringify(launcherPath(s))}`;
+  }
+}
+function serverStatusGuidance(s, action, result, cli) {
+  const workspace = JSON.stringify(result.workspace ?? "");
+  const manage = `Manage: ${cli} server status|restart|stop|uninstall`;
+  const when = s.platform === "linux" ? "at boot or login" : "at login";
   switch (result.status) {
     case "started": {
       const linger = lingerGuidance(result.linger);
       if (result.service !== "alive")
-        return `${s.unit} started for ${result.workspace}, but the owner reports ${result.service}.
-Inspect: node ${cli} diagnose --workspace ${workspace}
+        return `Cadence started for ${result.workspace}, but the owner reports ${result.service}.
+Inspect: ${cli} diagnose --workspace ${workspace}
 ${manage}
 ${linger}`;
-      return `Cadence WebUI: ${result.endpoint} (${s.unit}, workspace ${result.workspace})
-Enter with your private link: node ${cli} token-link --workspace ${workspace} --reveal
+      return `Cadence WebUI: ${result.endpoint} (workspace ${result.workspace}; starts ${when})
+Enter with your private link: ${cli} token-link --workspace ${workspace} --reveal
 ${manage}
 ${linger}`;
     }
     case "waiting-for-pi-login":
-      return `${s.unit} is enabled for ${result.workspace}; it starts once Pi has ${join8(agentDirectory(s), "auth.json")}.
-Log in to Pi, then: systemctl --user start ${name}
+      return `Cadence is registered for ${result.workspace}; it starts once Pi has ${join10(agentDirectory(s), "auth.json")}.
+Log in to Pi, then: ${cli} server restart
 ${lingerGuidance(result.linger)}`;
+    case "stopped":
+      return action === "stop" ? `Cadence stopped; it starts again ${when}, or now with: ${cli} server restart
+` : "";
+    case "absent":
+      return action === "restart" || action === "stop" ? `Cadence's background service is not installed: ${cli} server install
+` : "";
     case "disabled":
-      return `${s.unit} refreshed for ${result.workspace}; left disabled as configured.
+      return `Cadence's service definition was rewritten for ${result.workspace}; left disabled as configured.
 `;
     case "masked":
-      return `${s.unit} is masked; Cadence did not enable or start it.
+      return `cadence.service is masked; Cadence did not enable or start it.
 `;
     case "missing-pi-sdk":
-      return `Cadence did not register or refresh ${s.unit}: the Pi SDK packages pi-coding-agent and pi-ai (scope @earendil-works) do not resolve from ${s.root}, for example after installing without optional dependencies; an owner without them would quarantine.
+      return `Cadence did not register its service: the Pi SDK packages pi-coding-agent and pi-ai (scope @earendil-works) do not resolve from ${s.root}, for example after installing without optional dependencies; an owner without them would quarantine.
 `;
     case "foreign":
       return `${result.unit} was not generated by Cadence; left unchanged.
 `;
     case "unavailable":
-      return `No systemd user manager; start Cadence explicitly: node ${cli} start --workspace /absolute/project
+      return result.workspace ? `Cadence changed nothing: its owner could not be observed. Inspect: ${cli} diagnose --workspace ${workspace}
+` : `No user service manager; start Cadence explicitly: ${cli} start --workspace /absolute/project
+`;
+    case "unsupported":
+      return `Cadence has no background service for ${s.platform}; start it explicitly: ${cli} start --workspace /absolute/project
+`;
+    case "unconfirmed":
+    case "quarantined":
+      return `Cadence changed nothing: its owner's orderly Stop was not confirmed (${result.status}). Inspect: ${cli} diagnose --workspace ${workspace}
 `;
     case "failed":
-      return `Could not enable or start ${s.unit}; see systemctl --user status ${name} and journalctl --user -u ${name}.
+      return `Could not register or start Cadence's service; ${managerDetail(s)}.
 ${lingerGuidance(result.linger)}`;
     default:
       return "";
   }
 }
-async function autostartMain(argv, hostUrl) {
-  const action = argv.shift();
+function researchTemplate(home) {
+  try {
+    const result = ensureUserConfig(home);
+    return result.created ? `Cadence created the research configuration template ${result.path}
+` : "";
+  } catch (error) {
+    return `Cadence could not create the research configuration template: ${error instanceof Error ? error.message : String(error)}
+`;
+  }
+}
+var SERVER_ACTIONS = [
+  "install",
+  "status",
+  "restart",
+  "stop",
+  "uninstall"
+];
+async function serverMain(argv, hostUrl) {
+  const action = SERVER_ACTIONS.find((a) => a === argv[0]);
+  if (!action)
+    throw new ContractError("invalid");
+  argv.shift();
   let requested;
-  let linger = false;
+  let linger = process.env.CADENCE_LINGER !== "0";
+  let noLinger = false;
   while (action === "install" && argv.length) {
     if (argv[0] === "--workspace" && argv[1] && requested === undefined)
       requested = resolve5(argv.splice(0, 2)[1]);
-    else if (argv[0] === "--linger" && !linger) {
+    else if (argv[0] === "--no-linger" && !noLinger) {
       argv.shift();
-      linger = true;
+      noLinger = true;
+      linger = false;
     } else
       break;
   }
-  if (argv.length || !["install", "refresh", "remove", "status"].includes(action ?? ""))
+  if (argv.length)
     throw new ContractError("invalid");
-  const s = hostSystem(dirname8(dirname8(fileURLToPath(hostUrl))));
+  const s = hostSystem(dirname8(dirname8(fileURLToPath(hostUrl))), ownerControl);
+  if (action === "install")
+    process.stderr.write(researchTemplate(s.home));
   let result;
-  if (action === "remove")
-    result = removeAutostart(s);
-  else if (action === "status")
-    result = autostartStatus(s);
-  else {
-    try {
-      result = configureAutostart(s, action === "install" ? "install" : "refresh", requested, linger);
-    } catch (error) {
-      if (error instanceof ContractError && error.code === "invalid")
-        process.stderr.write(`Cadence autostart needs an existing absolute workspace directory (--workspace or CADENCE_WORKSPACE).
+  try {
+    result = await serverAction(s, action, requested, linger);
+  } catch (error) {
+    if (error instanceof ContractError && error.code === "invalid")
+      process.stderr.write(`Cadence server install needs an existing absolute --workspace directory.
 `);
-      throw error;
-    }
-    if (result.status === "started" && result.workspace)
-      Object.assign(result, await observeStarted(result.workspace));
-    process.stderr.write(autostartGuidance(s, result));
+    throw error;
   }
+  if (result.status === "started" && result.workspace)
+    Object.assign(result, await observeStarted(result.workspace));
+  process.stderr.write(serverGuidance(s, action, result));
   process.stdout.write(`${JSON.stringify(result)}
 `);
-  if (["failed", "foreign", "unavailable"].includes(result.status))
+  if ([
+    "failed",
+    "foreign",
+    "unavailable",
+    "unsupported",
+    "unconfirmed",
+    "quarantined",
+    "missing-pi-sdk"
+  ].includes(result.status) || result.status === "absent" && (action === "restart" || action === "stop"))
     process.exitCode = 1;
 }
 async function managementMain(argv, hostUrl) {
@@ -6116,16 +6565,16 @@ async function managementMain(argv, hostUrl) {
       throw new ContractError("unsupported-context");
     const command = argv.shift();
     if (command === "--help" && !argv.length) {
-      process.stdout.write(`cadence-service start|status|diagnose|stop|token-link --reveal|token-rotate|recover inspect|recover resolve [--workspace PATH] [--state-home PATH]
-cadence-service autostart install [--workspace PATH] [--linger]|refresh|remove|status
-Start is explicit, or the Linux systemd user unit that Pi's user-scope install registers (CADENCE_AUTOSTART=0, disable or mask opts out); its first registration also enables linger for boot start when logind allows it without a password (CADENCE_LINGER=0 opts out), and --linger asks for it explicitly. Default detached or --foreground. Start accepts --config, --agent-dir, --host, --port, --token-file.
+      process.stdout.write(`cadence start|status|diagnose|stop|token-link --reveal|token-rotate|recover inspect|recover resolve [--workspace PATH] [--state-home PATH]
+cadence server install [--workspace PATH] [--no-linger]|status|restart|stop|uninstall
+Start is explicit, or the background service that server install registers: a systemd user unit on Linux, started at boot through linger (--no-linger or CADENCE_LINGER=0 keeps it to login), a LaunchAgent on macOS and a Run entry on Windows, both started at login. Server restart, stop and uninstall use the orderly Stop. cadence-service is the same command. Default detached or --foreground. Start accepts --config, --agent-dir, --host, --port, --token-file.
 Return/quit detaches clients; only explicit Cancel/Stop requests stop. Unconfirmed/quarantined is not stopped.
 Recovery resolve requires this local native terminal, exact unchanged dead-owner resources and separate process/credential/storage acknowledgments. No --yes, network recovery, killing, repair or cleanup.
 `);
       return;
     }
-    if (command === "autostart") {
-      await autostartMain(argv, hostUrl);
+    if (command === "server") {
+      await serverMain(argv, hostUrl);
       return;
     }
     let recovery;
@@ -6192,7 +6641,7 @@ Recovery resolve requires this local native terminal, exact unchanged dead-owner
 `);
       options.workspace = landing.workspace;
       if (command === "start")
-        mkdirSync4(landing.workspace, { recursive: true });
+        mkdirSync5(landing.workspace, { recursive: true });
     }
     let result;
     if (command === "start")