@agentvault/claude-bridge 0.7.16 → 0.8.0

package/dist/log.d.ts

@@ -19,4 +19,16 @@ export declare function stamp(message: string): string;
  * just anchored to a clock.
  */
 export declare function logLine(...args: unknown[]): void;
+/**
+ * Plain stdout, no timestamp. For CLI answers a human or a script reads —
+ * `doctor`'s report — not for daemon logging.
+ *
+ * `logLine` stamps every line and writes to stderr, which is right for a daemon
+ * and wrong here: a report a customer is meant to read must not wear a date on
+ * every row. Anything a script would parse belongs on stdout.
+ *
+ * This lives in log.ts because the "no bare console sinks" guard excludes only
+ * this file — the sink belongs here, and nowhere else.
+ */
+export declare function printLine(text: string): void;
 //# sourceMappingURL=log.d.ts.map

package/dist/pending-invite.d.ts

@@ -0,0 +1,24 @@
+export declare function pendingInvitePath(dataDir: string): string;
+/** Persist the token for the service's first boot. Owner-only, unconditionally. */
+export declare function writePendingInvite(dataDir: string, token: string): void;
+/** The pending token, or undefined when there is none to consume. */
+export declare function readPendingInvite(dataDir: string): string | undefined;
+/** Remove it. Idempotent: nothing to remove is a success, not an error. */
+export declare function clearPendingInvite(dataDir: string): void;
+/**
+ * Delete the pending invite once there is EVIDENCE it was consumed — i.e.
+ * credentials have actually persisted to the data dir.
+ *
+ * Timing is the whole design here. Deleting on READ (inside loadConfig) would
+ * throw the token away before enrolment finished, so a process that died in
+ * between would leave a service that can never enrol and a customer whose
+ * single-use invite is gone. Never deleting leaves a credential on disk long
+ * after it is useless.
+ *
+ * `credsExist` is injected so the caller supplies `hasPersistedCreds` and this
+ * module stays free of a config import cycle.
+ *
+ * @returns true when a file was actually removed.
+ */
+export declare function clearPendingInviteIfConsumed(dataDir: string, credsExist: (dataDir: string) => boolean): boolean;
+//# sourceMappingURL=pending-invite.d.ts.map

package/dist/service/backend.d.ts

@@ -1,7 +1,18 @@
 import type { ServiceSpec } from "./spec.js";
+/** One installed service found on disk, with the env its definition bakes in. */
+export interface InstalledService {
+    label: string;
+    /** Absolute path of the plist / unit file. */
+    path: string;
+    env: Record<string, string>;
+}
 export interface ServiceBackend {
     install(spec: ServiceSpec): void;
     uninstall(label: string): void;
+    /** #913 item 3 — every installed service whose label starts with `prefix`,
+     *  read from the definition DIRECTORY, not from the running-service list. An
+     *  orphan is installed-but-not-running by construction. */
+    list(prefix: string): InstalledService[];
     /** Restart an ALREADY-INSTALLED service without touching its spec (#837).
      *  Distinct from install, which re-bakes the plist from the current shell. */
     restart(label: string): void;
@@ -23,6 +34,10 @@ export interface BackendDeps {
     chmod: (path: string, mode: number) => void;
     rm: (path: string) => void;
     exists: (path: string) => boolean;
+    /** Names in a directory. Returns [] when the directory does not exist — a
+     *  machine with no services installed is not an error. */
+    readdir: (path: string) => string[];
+    readFile: (path: string) => string;
 }
 export declare function defaultDeps(): BackendDeps;
 export declare function selectBackend(platform: NodeJS.Platform, deps?: BackendDeps): ServiceBackend;

package/dist/service/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/service/backend.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;kFAC8E;IAC9E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC;AAED,wBAAgB,WAAW,IAAI,WAAW,CAoBzC;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,cAAc,CAU3F"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/service/backend.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;+DAE2D;IAC3D,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAAC;IACzC;kFAC8E;IAC9E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC;8DAC0D;IAC1D,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACpC;AAED,wBAAgB,WAAW,IAAI,WAAW,CAoCzC;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,cAAc,CAU3F"}

package/dist/service/doctor-cli.d.ts

@@ -0,0 +1,36 @@
+import { type DeviceProbe, type DoctorDeps } from "./doctor.js";
+/**
+ * Ask the public status endpoint about one device.
+ *
+ * `GET /api/v1/devices/{id}/status` needs no auth and is rate limited per
+ * device_id, so checking several agents in a row is fine.
+ *
+ * ⚠️ A 404 is the strongest claim this command makes — it is what turns into
+ * "orphan, run uninstall". So it is only believed when the body is JSON, i.e.
+ * an actual API error shape. `agentvault.dev` serves a GoDaddy parked page that
+ * answers with confident HTTP codes and no API behind it, and on 2026-07-25
+ * that fooled a smoke check into reporting a healthy backend. A wrong
+ * AV_API_URL must read as "I could not check", never as "all your agents are
+ * dead".
+ */
+export declare function fetchDeviceStatus(apiUrl: string, deviceId: string, doFetch?: typeof fetch): Promise<DeviceProbe>;
+export declare function realDoctorDeps(env: NodeJS.ProcessEnv): DoctorDeps;
+/**
+ * Handle `agentvault-claude-bridge doctor`. Returns true when handled.
+ *
+ * Async, which is why it does not live in maybeRunServiceSubcommand: that
+ * dispatcher is synchronous and doctor has to await the network. index.ts runs
+ * this FIRST. If it ever did not, `doctor` would fall through to the
+ * unknown-subcommand guard and throw — loud, and safe. A typo must never boot a
+ * daemon (#921), and neither must a command we forgot to wire.
+ *
+ * READ-ONLY by construction: it never calls install, uninstall or restart. It
+ * prints the command instead, because deciding to remove a customer's service
+ * is theirs to make with the evidence in front of them.
+ */
+export declare function maybeRunDoctorSubcommand(argv: string[], opts?: {
+    log?: (msg: string) => void;
+    deps?: DoctorDeps;
+    env?: NodeJS.ProcessEnv;
+}): Promise<boolean>;
+//# sourceMappingURL=doctor-cli.d.ts.map

package/dist/service/doctor-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-cli.d.ts","sourceRoot":"","sources":["../../src/service/doctor-cli.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAsBrB;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,WAAW,CAAC,CAuBtB;AA+BD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrF,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/service/doctor.d.ts

@@ -0,0 +1,93 @@
+import type { ServiceBackend } from "./backend.js";
+/**
+ * #913 item 3 — `doctor`: list what is installed, check each against the API,
+ * and say which ones are orphaned.
+ *
+ * Deleting an agent in the dashboard removes the DEVICE ROW and nothing else.
+ * The service stays installed, pointing at a device that no longer exists, and
+ * the customer has no signal at all. Item 1 names the uninstall command AT
+ * DELETE TIME; item 2 removes the service when the running bridge is told the
+ * device is gone. Neither helps the machine that already accumulated orphans —
+ * from a delete done in another browser, before those shipped, or while the
+ * bridge was not running. That is what this reads.
+ *
+ * TWO RULES, both earned the hard way:
+ *
+ * 1. AN UNREACHABLE API IS NOT AN ORPHAN. #919: a default for a missing input is
+ *    a guess, and reporting on it is a lie. Every inconclusive probe is SKIP,
+ *    never FAIL — including a status string this build does not recognise.
+ *    Printing FAIL on a network blip sends a customer to uninstall a healthy
+ *    agent.
+ *
+ * 2. SILENCE ABOUT WHAT IT CANNOT SEE IS A FALSE ALL-CLEAR. #941: the delete
+ *    modal covered 3 of 15 devices and said nothing for the other 12, which
+ *    reads as "nothing to clean up". This command can only check its own family
+ *    — the agents whose credentials it can read — so it LISTS the other
+ *    AgentVault services it found and says it did not check them.
+ */
+export type Verdict = "PASS" | "WARN" | "FAIL" | "SKIP";
+/** What the server said about one device. Exactly one field is meaningful. */
+export interface DeviceProbe {
+    /** The device's status string, verbatim from the API. */
+    status?: string;
+    /** 404 — the device row does not exist. */
+    gone?: boolean;
+    /** Why the check could not conclude. Present => the answer is UNKNOWN. */
+    inconclusive?: string;
+}
+export interface ServiceFinding {
+    label: string;
+    agentName: string;
+    dataDir: string;
+    loaded: boolean;
+    deviceId: string;
+    verdict: Verdict;
+    detail: string;
+    /** The exact command that fixes it. Set ONLY for a confirmed orphan. */
+    fix?: string;
+}
+export interface UnsupervisedFinding {
+    dataDir: string;
+    agentName: string;
+    deviceId: string;
+    verdict: Verdict;
+    detail: string;
+    /** How to bring a live agent back. Never a suggestion to delete key material:
+     *  `uninstall` leaves credentials ON PURPOSE, and a doctor that says "remove
+     *  this directory" turns a recoverable mistake into a lost identity. */
+    fix?: string;
+}
+export interface DoctorReport {
+    labelPrefixes: string[];
+    services: ServiceFinding[];
+    /** Credentials on disk that no installed service points at — CHECKED against
+     *  the API, not merely listed. "Leftover from a deleted agent" and "a live
+     *  agent whose service was removed" look identical on disk and need opposite
+     *  responses, so the verdict is the whole point. */
+    unsupervised: UnsupervisedFinding[];
+    /** AgentVault services from other families. Found, listed, NOT checked. */
+    notChecked: string[];
+}
+export interface DoctorDeps {
+    backend: ServiceBackend;
+    /** Every label prefix this bridge OWNS — plural because #837 renamed the
+     *  claude label and pre-rename installs are still registered under the old
+     *  one. Those are the longest-running services on customer machines, i.e. the
+     *  ones most likely to have accumulated an orphan. */
+    labelPrefixes: string[];
+    base: string;
+    apiUrl: string;
+    uninstallCommand: (agentName: string) => string;
+    installCommand: (agentName: string) => string;
+    readCreds: (dataDir: string) => {
+        deviceId?: string;
+    } | null;
+    /** Absolute data dirs under `base` that hold credentials. */
+    credDirs: () => string[];
+    fetchStatus: (apiUrl: string, deviceId: string) => Promise<DeviceProbe>;
+    /** Labels belonging to other AgentVault families installed on this machine. */
+    otherLabels: () => string[];
+}
+export declare function buildDoctorReport(d: DoctorDeps): Promise<DoctorReport>;
+export declare function formatDoctorReport(r: DoctorReport): string[];
+//# sourceMappingURL=doctor.d.ts.map

package/dist/service/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/service/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAExD,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;4EAEwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;wDAGoD;IACpD,YAAY,EAAE,mBAAmB,EAAE,CAAC;IACpC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB;;;0DAGsD;IACtD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7D,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxE,+EAA+E;IAC/E,WAAW,EAAE,MAAM,MAAM,EAAE,CAAC;CAC7B;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAqB5E;AAiJD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAqD5D"}

package/dist/service/launchd.d.ts

@@ -1,7 +1,26 @@
 import type { ServiceSpec } from "./spec.js";
-import type { BackendDeps, ServiceBackend } from "./backend.js";
+import type { BackendDeps, ServiceBackend, InstalledService } from "./backend.js";
 /** Render a launchd LaunchAgent plist for a bridge ServiceSpec. Pure string. */
 export declare function renderLaunchdPlist(spec: ServiceSpec): string;
+/**
+ * Read the EnvironmentVariables dict back out of an installed plist.
+ *
+ * Deliberately tolerant of formatting, and deliberately NOT tolerant of scope.
+ *
+ * TOLERANT: `loopita`'s plist is hand-edited, so it keeps none of the
+ * whitespace `renderLaunchdPlist` writes. A parser that only understood its own
+ * output would report "no data dir" for precisely the long-lived install a
+ * customer is most likely to be asking `doctor` about.
+ *
+ * NOT TOLERANT: it reads ONLY the EnvironmentVariables dict. `Label`,
+ * `WorkingDirectory` and `StandardOutPath` are <key>/<string> pairs too, so a
+ * whole-file scan would hand back a log path as if it were AV_DATA_DIR and then
+ * go looking for credentials in it.
+ *
+ * Returns {} for junk. A doctor that throws on one malformed plist reports
+ * nothing about the other five.
+ */
+export declare function parsePlistEnv(xml: string): Record<string, string>;
 export declare class LaunchdBackend implements ServiceBackend {
     private deps;
     constructor(deps: BackendDeps);
@@ -17,5 +36,12 @@ export declare class LaunchdBackend implements ServiceBackend {
         loaded: boolean;
         detail: string;
     };
+    /** #913 item 3 — every installed service whose label starts with `prefix`.
+     *
+     *  Reads the plist directory rather than `launchctl list`, because an ORPHAN
+     *  is typically installed-but-not-loaded: the revoked device exits 0 and
+     *  KeepAlive leaves it down. `launchctl list` would not show the very thing
+     *  doctor exists to find. */
+    list(prefix: string): InstalledService[];
 }
 //# sourceMappingURL=launchd.d.ts.map

package/dist/service/launchd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../../src/service/launchd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAUhE,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAkC5D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IA2BhC,OAAO,CAAC,aAAa;IAOrB;+EAC2E;IAC3E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAM9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAI3D"}
+{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../../src/service/launchd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUlF,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAkC5D;AAGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BjE;AAOD,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IA2BhC,OAAO,CAAC,aAAa;IAOrB;+EAC2E;IAC3E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAM9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAK1D;;;;;iCAK6B;IAC7B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,EAAE;CAezC"}

package/dist/service/self-uninstall.d.ts

@@ -0,0 +1,19 @@
+import { type ServiceBackend } from "./backend.js";
+export interface SelfUninstallDeps {
+    backend?: ServiceBackend;
+    log?: (msg: string) => void;
+}
+/**
+ * Remove this agent's supervised service after its device was revoked.
+ *
+ * Returns whether a service was actually removed. NEVER throws: this runs on
+ * the shutdown path, and a cleanup that cannot happen must not stop the bridge
+ * exiting cleanly — `KeepAlive {SuccessfulExit: false}` depends on that exit(0)
+ * to leave the service down rather than crash-looping it.
+ *
+ * The stakes are asymmetric and worth stating: `uninstall` removes the SERVICE
+ * and LEAVES the credentials on disk. A false positive therefore costs the
+ * customer a re-install, not their identity.
+ */
+export declare function selfUninstallOnTerminal(reason: string, env: NodeJS.ProcessEnv, deps?: SelfUninstallDeps): boolean;
+//# sourceMappingURL=self-uninstall.d.ts.map

package/dist/service/self-uninstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-uninstall.d.ts","sourceRoot":"","sources":["../../src/service/self-uninstall.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAuBlE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAoCT"}

package/dist/service/subcommand.d.ts

@@ -4,6 +4,18 @@ export interface ServiceCmdDeps {
     entrypoint: string;
     log: (msg: string) => void;
 }
+/**
+ * #837: resolve the label that is ACTUALLY loaded rather than assuming the
+ * computed one.
+ *
+ * The launchd label was renamed (`com.agentvault.claude-bridge.<name>` ->
+ * `dev.agentvault.bridge-<name>`), so a hardcoded name fails with "Could not
+ * find service" on precisely the long-standing installs where an operator most
+ * needs `restart` or `status` to work. Prefer the current label, fall back to
+ * the legacy one, and if neither is loaded return the current label so the
+ * error names what we tried.
+ */
+export declare function resolveLabel(backend: ServiceBackend, env: NodeJS.ProcessEnv): string;
 /** Handle `agentvault-claude-bridge <install|uninstall|status|logs>` before boot.
  *  Returns true when handled (caller should exit). Secrets are never placed on
  *  the service command line — config flows via the plist env; the token is omitted. */

package/dist/service/subcommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAuDD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA0FT"}
+{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAMpF;AAED;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAsHT"}

package/dist/service/systemd.d.ts

@@ -1,10 +1,21 @@
 import type { ServiceSpec } from "./spec.js";
-import type { BackendDeps, ServiceBackend } from "./backend.js";
+import type { BackendDeps, ServiceBackend, InstalledService } from "./backend.js";
 /** Render a systemd --user service unit for a bridge ServiceSpec. Pure string.
  *  Restart=on-failure + SuccessExitStatus=0 is the KeepAlive={SuccessfulExit:false}
  *  equivalent: a clean exit(0) (revoked device) is treated as success => NOT
  *  restarted; a non-zero crash is restarted. WantedBy=default.target is RunAtLoad. */
 export declare function renderSystemdUnit(spec: ServiceSpec): string;
+/**
+ * Read `Environment=` back out of an installed systemd unit.
+ *
+ * Reverses `q` exactly: un-double the '%' first, then walk the backslash
+ * escapes left to right in ONE pass. Two passes would turn a literal
+ * backslash-n (written as \\n) into a newline.
+ *
+ * Returns {} for junk — a doctor that throws on one malformed unit reports
+ * nothing about the others.
+ */
+export declare function parseUnitEnv(text: string): Record<string, string>;
 export declare class SystemdBackend implements ServiceBackend {
     private deps;
     constructor(deps: BackendDeps);
@@ -18,5 +29,12 @@ export declare class SystemdBackend implements ServiceBackend {
         loaded: boolean;
         detail: string;
     };
+    /** #913 item 3 — every installed unit whose label starts with `prefix`.
+     *
+     *  Reads the unit directory rather than `systemctl list-units`, because an
+     *  ORPHAN is installed-but-inactive: the revoked device exits 0, which
+     *  SuccessExitStatus=0 treats as success, so it is never restarted. A
+     *  running-units listing would not show the thing doctor exists to find. */
+    list(prefix: string): InstalledService[];
 }
 //# sourceMappingURL=systemd.d.ts.map

package/dist/service/systemd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"systemd.d.ts","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAmBhE;;;sFAGsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAsB3D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAoBhC;2DACuD;IACvD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAQ9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAQ3D"}
+{"version":3,"file":"systemd.d.ts","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAmBlF;;;sFAGsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAsB3D;AAGD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWjE;AAQD,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAoBhC;2DACuD;IACvD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAQ9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAS1D;;;;;gFAK4E;IAC5E,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,EAAE;CAczC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.16",
+  "version": "0.8.0",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",