@agentvault/grok-bridge 0.3.2 → 0.4.0

package/dist/bridge.d.ts

@@ -136,6 +136,15 @@ export declare function attachLifecycle(channel: LifecycleChannel, opts?: {
     onTerminal?: (reason: string, o: {
         restart: boolean;
     }) => void;
+    /** #913 item 2 — remove this agent's supervised service when its device is
+     *  gone for good. Injected for tests; defaults to the real remover, because
+     *  an opt-in default is a feature nobody gets.
+     *
+     *  Every terminal reason is offered to it and IT decides. Filtering here as
+     *  well would put the same rule in two files, and the two would eventually
+     *  disagree — which is how `session_replaced` (device still alive) would end
+     *  up removing a healthy install. */
+    selfUninstall?: (reason: string, env: NodeJS.ProcessEnv) => boolean;
 }): void;
 /**
  * How a ROOM turn is announced to the model (#366 / #499 Facet A).

package/dist/config.d.ts

@@ -1,16 +1,3 @@
-/**
- * The one-paste install flag: enrol, install the supervised service, then EXIT so
- * the customer's terminal comes back.
- *
- * WIRE LITERAL. `packages/web/lib/framework-install.ts` emits this exact string in
- * the connect command. The two packages cannot import each other, so the only
- * tripwire is a test on each side that names the other — see config.test.ts
- * "freezes the wire literal".
- *
- * Deliberately "-" prefixed: loadConfig's token slot rejects "-" args, so adding a
- * flag can never be mistaken for an invite token.
- */
-export declare const INSTALL_FLAG = "--install";
 /** Informational flags. Handled BEFORE loadConfig in index.ts, because asking
  *  "what version is this?" must not require an invite token. Listed here too so
  *  the strict unknown-flag check does not reject them. */
@@ -35,12 +22,38 @@ export declare function parseInfoFlags(argv: string[]): {
 export declare function isEphemeralEntrypoint(entrypoint: string): boolean;
 /** Throw unless `entrypoint` is durable enough to bake into a supervised service. */
 export declare function assertInstallableEntrypoint(entrypoint: string): void;
+/**
+ * #913 item 3 — the device id inside this data dir's credentials, or null.
+ *
+ * Lives HERE, beside CRED_FILES and BACKUP_FILE, because this module already
+ * owns the knowledge of which files hold credentials. `doctor` reading those
+ * names itself would make a second copy of the list, and the copy that is not
+ * next to the constant is the one that goes stale.
+ *
+ * Checks the same files in the same order as hasPersistedCreds, INCLUDING the
+ * .bak: a device_revoked wipe deletes agentvault.json and leaves the backup, so
+ * the .bak is exactly where the id lives for the machine most likely to be
+ * running doctor.
+ *
+ * Returns null rather than throwing on missing/unreadable/malformed input — a
+ * doctor that dies on one bad file reports nothing about the others.
+ */
+export declare function readPersistedDeviceId(dataDir: string): string | null;
 export declare function hasPersistedCreds(dataDir: string): boolean;
 export declare function slugify(name: string): string;
 export type DataDirSource = "explicit" | "per-agent";
+/** Where the agent name came from.
+ *
+ *  #927's test for a safe default is: can a reader of the output tell the input
+ *  was MISSING? A bare `agentName` cannot answer that — "Grok" reads the same
+ *  whether the customer typed it or the bridge chose it. This field is what
+ *  makes the two distinguishable, so callers can SAY which one happened. */
+export type AgentNameSource = "supplied" | "defaulted";
 export declare function resolveDataDir(env: NodeJS.ProcessEnv): {
     dataDir: string;
     source: DataDirSource;
+    agentName: string;
+    agentNameSource: AgentNameSource;
 };
 export interface BridgeConfig {
     inviteToken: string;
@@ -48,6 +61,8 @@ export interface BridgeConfig {
     dataDirSource: DataDirSource;
     apiUrl: string;
     agentName: string;
+    /** Whether AV_AGENT_NAME was given, or the package default was used (#927). */
+    agentNameSource: AgentNameSource;
     roomFilter?: string;
     /** Per-agent filesystem sandbox. Always set: auto-defaults to a sibling of
      *  the key/data dir unless AV_WORKSPACE_DIR overrides it. */
@@ -78,7 +93,6 @@ export interface BridgeConfig {
     /** Set by --install: enrol in the foreground, install the supervised service,
      *  then EXIT so the customer's terminal returns. False leaves a bare run
      *  byte-for-byte as it behaves today. */
-    installAfterEnroll: boolean;
     /** --version / -v. index.ts answers these before loadConfig runs. */
     showVersion: boolean;
     /** --help / -h. Same. */

package/dist/index.js

@@ -54,6 +54,24 @@ var init_pending_invite = __esm({
   }
 });
 
+// src/log.ts
+import { format } from "node:util";
+function stamp(message) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  return message.split("\n").map((line) => `${ts} ${line}`).join("\n");
+}
+function logLine(...args) {
+  console.error(stamp(format(...args)));
+}
+function printLine(text) {
+  console.log(text);
+}
+var init_log = __esm({
+  "src/log.ts"() {
+    "use strict";
+  }
+});
+
 // src/config.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "node:fs";
 import { join as join6, resolve as resolve2, sep, dirname } from "node:path";
@@ -71,7 +89,7 @@ function assertInstallableEntrypoint(entrypoint) {
   if (isEphemeralEntrypoint(entrypoint)) {
     throw new Error(
       `cannot install a background service from an ephemeral package cache (${entrypoint}) \u2014 it is deleted on cleanup and the service would silently die later. Install globally first:
-  npm i -g @agentvault/grok-bridge && agentvault-grok-bridge ` + INSTALL_FLAG
+  npm i -g @agentvault/grok-bridge && agentvault-grok-bridge install`
     );
   }
 }
@@ -83,6 +101,17 @@ function hasRecoverableBackup(dataDir) {
     return false;
   }
 }
+function readPersistedDeviceId(dataDir) {
+  for (const f2 of [...CRED_FILES, BACKUP_FILE]) {
+    try {
+      const parsed = JSON.parse(readFileSync3(join6(dataDir, f2), "utf-8"));
+      const id = parsed?.deviceId;
+      if (typeof id === "string" && id) return id;
+    } catch {
+    }
+  }
+  return null;
+}
 function hasPersistedCreds(dataDir) {
   if (CRED_FILES.some((f2) => existsSync2(join6(dataDir, f2)))) return true;
   return hasRecoverableBackup(dataDir);
@@ -91,20 +120,41 @@ function slugify2(name) {
   return name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
 }
 function resolveDataDir(env) {
-  if (env.AV_DATA_DIR) return { dataDir: env.AV_DATA_DIR, source: "explicit" };
+  const supplied = env.AV_AGENT_NAME?.trim();
+  const agentName = supplied || LEGACY_DEFAULT_AGENT_NAME;
+  const agentNameSource = supplied ? "supplied" : "defaulted";
+  if (env.AV_DATA_DIR)
+    return { dataDir: env.AV_DATA_DIR, source: "explicit", agentName, agentNameSource };
   const base = join6(env.HOME ?? "", ".agentvault", "grok-room-bridge");
-  return { dataDir: join6(base, slugify2(env.AV_AGENT_NAME ?? "grok")), source: "per-agent" };
+  const perAgent = join6(base, slugify2(agentName));
+  if (!supplied && !hasPersistedCreds(perAgent)) {
+    throw new Error(
+      `AV_AGENT_NAME is required \u2014 it names WHICH agent this bridge runs as, and therefore where its credentials live. No credentials were found at ${perAgent}, so there is no existing install to infer a name from. Re-run with AV_AGENT_NAME=<agent-name> set.`
+    );
+  }
+  return { dataDir: perAgent, source: "per-agent", agentName, agentNameSource };
 }
 function loadConfig(env, argv = []) {
-  const { dataDir, source: dataDirSource } = resolveDataDir(env);
+  const { dataDir, source: dataDirSource, agentName, agentNameSource } = resolveDataDir(env);
+  if (agentNameSource === "defaulted") {
+    logLine(
+      `[config] AV_AGENT_NAME was not set \u2014 running as "${agentName}" from the existing credentials at ${dataDir}. Set AV_AGENT_NAME to name this agent explicitly; a future install will require it.`
+    );
+  }
   const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || readPendingInvite(dataDir) || "";
+  if (argv.includes(REMOVED_INSTALL_FLAG)) {
+    throw new Error(
+      `${REMOVED_INSTALL_FLAG} was removed \u2014 it handed the agent over from a foreground process that could be reaped before the encrypted group finished forming, leaving an agent that was connected and mute (#909). Use the subcommand instead, which lets the service enrol itself:
+  npm i -g @agentvault/grok-bridge && AV_AGENT_NAME=<agent-name> AV_INVITE_TOKEN=<token> agentvault-grok-bridge install`
+    );
+  }
   const unknownFlags = argv.filter((a2) => a2.startsWith("-") && !KNOWN_FLAGS.has(a2));
   if (unknownFlags.length) {
     throw new Error(
       `unknown option(s): ${unknownFlags.join(", ")} \u2014 supported flags are ${[...KNOWN_FLAGS].join(", ")}`
     );
   }
-  const workspaceDir = env.AV_WORKSPACE_DIR || join6(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "grok"));
+  const workspaceDir = env.AV_WORKSPACE_DIR || join6(dirname(dataDir), "workspaces", slugify2(agentName));
   const wsReal = resolve2(workspaceDir);
   const ddReal = resolve2(dataDir);
   if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
@@ -129,17 +179,14 @@ function loadConfig(env, argv = []) {
     inviteToken,
     dataDir,
     dataDirSource,
-    // One-paste install (--install): enrol, hand off to the supervisor, exit.
-    // Default false keeps a bare `npx @agentvault/grok-bridge` run identical.
-    installAfterEnroll: argv.includes(INSTALL_FLAG),
     ...parseInfoFlags(argv),
     apiUrl: env.AV_API_URL ?? "https://api.agentvault.chat",
     // Identity shown to the agent's own session. Set this to the agent's
     // AgentVault name via AV_AGENT_NAME (the native connect command passes it).
-    // Defaults to "Grok" — this package IS the Grok bridge, so an unset
-    // AV_AGENT_NAME still names the actual model running the session, not a
-    // placeholder impersonating some other agent.
-    agentName: env.AV_AGENT_NAME ?? "Grok",
+    // Resolved in resolveDataDir so the name, the data dir and the workspace dir
+    // can never disagree about who this agent is (#921/#927).
+    agentName,
+    agentNameSource,
     roomFilter: env.AV_ROOM_ID || void 0,
     workspaceDir,
     grokPath: env.AV_GROK_PATH || void 0,
@@ -149,35 +196,19 @@ function loadConfig(env, argv = []) {
     systemPrompt: env.AV_SYSTEM_PROMPT || void 0
   };
 }
-var INSTALL_FLAG, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS, CRED_FILES, BACKUP_FILE;
+var REMOVED_INSTALL_FLAG, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS, CRED_FILES, BACKUP_FILE, LEGACY_DEFAULT_AGENT_NAME;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_pending_invite();
-    INSTALL_FLAG = "--install";
+    init_log();
+    REMOVED_INSTALL_FLAG = "--install";
     VERSION_FLAGS = ["--version", "-v"];
     HELP_FLAGS = ["--help", "-h"];
-    KNOWN_FLAGS = /* @__PURE__ */ new Set([INSTALL_FLAG, ...VERSION_FLAGS, ...HELP_FLAGS]);
+    KNOWN_FLAGS = /* @__PURE__ */ new Set([...VERSION_FLAGS, ...HELP_FLAGS]);
     CRED_FILES = ["agentvault.json", "secure-channel.json"];
     BACKUP_FILE = "agentvault.json.bak";
-  }
-});
-
-// src/log.ts
-import { format } from "node:util";
-function stamp(message) {
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  return message.split("\n").map((line) => `${ts} ${line}`).join("\n");
-}
-function logLine(...args) {
-  console.error(stamp(format(...args)));
-}
-function printLine(text) {
-  console.log(text);
-}
-var init_log = __esm({
-  "src/log.ts"() {
-    "use strict";
+    LEGACY_DEFAULT_AGENT_NAME = "Grok";
   }
 });
 
@@ -211,16 +242,6 @@ function writeLauncher(deps, spec) {
   deps.writeFile(spec.launcherPath, spec.launcherScript);
   deps.chmod(spec.launcherPath, 493);
 }
-function parseLauncherEntrypoint(script) {
-  if (!script) return void 0;
-  const m2 = /^if n=\$\(command -v .+\); then exec "\$n" (.+) "\$@"; fi$/m.exec(script);
-  if (!m2) return void 0;
-  return unSq(m2[1]);
-}
-function unSq(quoted) {
-  if (quoted.length < 2 || !quoted.startsWith("'") || !quoted.endsWith("'")) return void 0;
-  return quoted.slice(1, -1).replace(/'\\''/g, "'");
-}
 var FALLBACK_NODES;
 var init_launcher = __esm({
   "src/service/launcher.ts"() {
@@ -314,6 +335,37 @@ ${envEntries}
 </plist>
 `;
 }
+function parsePlistEnv(xml) {
+  const out = {};
+  const keyIdx = xml.indexOf("<key>EnvironmentVariables</key>");
+  if (keyIdx < 0) return out;
+  const open = xml.indexOf("<dict>", keyIdx);
+  if (open < 0) return out;
+  let depth = 0;
+  let i2 = open;
+  let close = -1;
+  const tag = /<(\/?)dict>/g;
+  tag.lastIndex = open;
+  let m2;
+  while (m2 = tag.exec(xml)) {
+    depth += m2[1] ? -1 : 1;
+    if (depth === 0) {
+      close = m2.index;
+      break;
+    }
+    i2 = m2.index;
+  }
+  void i2;
+  if (close < 0) return out;
+  const body = xml.slice(open, close);
+  const pair = /<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/g;
+  let p2;
+  while (p2 = pair.exec(body)) out[unesc(p2[1])] = unesc(p2[2]);
+  return out;
+}
+function unesc(s2) {
+  return s2.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
 var LaunchdBackend;
 var init_launchd = __esm({
   "src/service/launchd.ts"() {
@@ -368,6 +420,26 @@ var init_launchd = __esm({
         const r2 = this.deps.exec("launchctl", ["print", `${this.domain()}/${label}`]);
         return { loaded: r2.code === 0, detail: r2.stdout };
       }
+      /** #913 item 3 — every installed service whose label starts with `prefix`.
+       *
+       *  Reads the plist directory rather than `launchctl list`, because an ORPHAN
+       *  is typically installed-but-not-loaded: the revoked device exits 0 and
+       *  KeepAlive leaves it down. `launchctl list` would not show the very thing
+       *  doctor exists to find. */
+      list(prefix) {
+        const dir = join11(this.deps.home, "Library", "LaunchAgents");
+        const out = [];
+        for (const name of this.deps.readdir(dir)) {
+          if (!name.startsWith(prefix) || !name.endsWith(".plist")) continue;
+          const path2 = join11(dir, name);
+          out.push({
+            label: name.slice(0, -".plist".length),
+            path: path2,
+            env: parsePlistEnv(this.deps.readFile(path2))
+          });
+        }
+        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
+      }
     };
   }
 });
@@ -399,6 +471,24 @@ StandardError=append:${spec.logErr}
 WantedBy=default.target
 `;
 }
+function parseUnitEnv(text) {
+  const out = {};
+  for (const line of text.split("\n")) {
+    const m2 = /^Environment="([\s\S]*)"\s*$/.exec(line.trim());
+    if (!m2) continue;
+    const eq = unq(m2[1]);
+    const at = eq.indexOf("=");
+    if (at <= 0) continue;
+    out[eq.slice(0, at)] = eq.slice(at + 1);
+  }
+  return out;
+}
+function unq(s2) {
+  return s2.replace(/%%/g, "%").replace(
+    /\\([\s\S])/g,
+    (_2, c2) => c2 === "n" ? "\n" : c2 === "r" ? "\r" : c2 === "t" ? "	" : c2
+  );
+}
 var SystemdBackend;
 var init_systemd = __esm({
   "src/service/systemd.ts"() {
@@ -439,18 +529,33 @@ var init_systemd = __esm({
         const active = this.deps.exec("systemctl", ["--user", "is-active", `${label}.service`]);
         return { loaded: enabled.code === 0, detail: `${enabled.stdout.trim() || "?"} / ${active.stdout.trim() || "?"}` };
       }
+      /** #913 item 3 — every installed unit whose label starts with `prefix`.
+       *
+       *  Reads the unit directory rather than `systemctl list-units`, because an
+       *  ORPHAN is installed-but-inactive: the revoked device exits 0, which
+       *  SuccessExitStatus=0 treats as success, so it is never restarted. A
+       *  running-units listing would not show the thing doctor exists to find. */
+      list(prefix) {
+        const dir = join12(this.deps.home, ".config", "systemd", "user");
+        const out = [];
+        for (const name of this.deps.readdir(dir)) {
+          if (!name.startsWith(prefix) || !name.endsWith(".service")) continue;
+          const path2 = join12(dir, name);
+          out.push({
+            label: name.slice(0, -".service".length),
+            path: path2,
+            env: parseUnitEnv(this.deps.readFile(path2))
+          });
+        }
+        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
+      }
     };
   }
 });
 
 // src/service/backend.ts
-var backend_exports = {};
-__export(backend_exports, {
-  defaultDeps: () => defaultDeps,
-  selectBackend: () => selectBackend
-});
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync2, existsSync as existsSync4, chmodSync as chmodSync5 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync2, existsSync as existsSync4, chmodSync as chmodSync5, readdirSync, readFileSync as readFileSync4 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -465,7 +570,21 @@ function defaultDeps() {
     mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
     chmod: (p2, m2) => chmodSync5(p2, m2),
     rm: (p2) => rmSync2(p2, { force: true }),
-    exists: (p2) => existsSync4(p2)
+    exists: (p2) => existsSync4(p2),
+    readdir: (p2) => {
+      try {
+        return readdirSync(p2);
+      } catch {
+        return [];
+      }
+    },
+    readFile: (p2) => {
+      try {
+        return readFileSync4(p2, "utf8");
+      } catch {
+        return "";
+      }
+    }
   };
 }
 function selectBackend(platform, deps) {
@@ -488,6 +607,7 @@ var init_backend = __esm({
 // src/service/subcommand.ts
 var subcommand_exports = {};
 __export(subcommand_exports, {
+  labelFor: () => labelFor,
   maybeRunServiceSubcommand: () => maybeRunServiceSubcommand
 });
 function requireAgentName(env) {
@@ -510,7 +630,9 @@ function maybeRunServiceSubcommand(argv, env, deps) {
     const looksLikeFlag = cmd.startsWith("-");
     if (!looksLikeToken && !looksLikeFlag) {
       throw new Error(
-        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS].join(", ")}, an invite token, or no argument at all`
+        // "doctor" is dispatched earlier, in index.ts, so it never reaches here.
+        // Named anyway: a customer who typed `doctr` should see it offered.
+        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS, "doctor"].join(", ")}, an invite token, or no argument at all`
       );
     }
     return false;
@@ -521,6 +643,7 @@ function maybeRunServiceSubcommand(argv, env, deps) {
   try {
     if (cmd === "install") {
       requireAgentName(env);
+      assertInstallableEntrypoint(entrypoint);
       const cfg = loadConfig(env, []);
       const firstBoot = !hasPersistedCreds(cfg.dataDir) && !!cfg.inviteToken;
       if (firstBoot) {
@@ -578,96 +701,313 @@ var init_subcommand = __esm({
   }
 });
 
-// src/service/install-on-ready.ts
-var install_on_ready_exports = {};
-__export(install_on_ready_exports, {
-  installOnReady: () => installOnReady
+// src/service/doctor.ts
+import { basename } from "node:path";
+async function buildDoctorReport(d2) {
+  const installed = d2.labelPrefixes.flatMap((p2) => d2.backend.list(p2));
+  const services = [];
+  for (const s2 of installed) services.push(await inspect(s2, d2));
+  const claimed = new Set(installed.map((s2) => s2.env.AV_DATA_DIR).filter(Boolean));
+  const unsupervised = [];
+  for (const dataDir of d2.credDirs()) {
+    if (claimed.has(dataDir)) continue;
+    unsupervised.push(await inspectUnsupervised(dataDir, d2));
+  }
+  return {
+    labelPrefixes: d2.labelPrefixes,
+    services,
+    unsupervised,
+    notChecked: d2.otherLabels()
+  };
+}
+async function inspect(s2, d2) {
+  const agentName = s2.env.AV_AGENT_NAME ?? "";
+  const dataDir = s2.env.AV_DATA_DIR ?? "";
+  let loaded = false;
+  try {
+    loaded = d2.backend.status(s2.label).loaded;
+  } catch {
+  }
+  const base = { label: s2.label, agentName, dataDir, loaded, deviceId: "" };
+  if (!dataDir) {
+    return {
+      ...base,
+      verdict: "WARN",
+      detail: "the service definition bakes no AV_DATA_DIR, so doctor cannot find its credentials and cannot check its device"
+    };
+  }
+  const creds = d2.readCreds(dataDir);
+  if (!creds?.deviceId) {
+    return {
+      ...base,
+      verdict: "WARN",
+      detail: `no credentials at ${dataDir} \u2014 installed, but this agent never enrolled`
+    };
+  }
+  const deviceId = creds.deviceId;
+  let probe;
+  try {
+    probe = await d2.fetchStatus(d2.apiUrl, deviceId);
+  } catch (e) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${e.message}` };
+  }
+  if (probe.inconclusive) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${probe.inconclusive}` };
+  }
+  if (probe.gone) {
+    return {
+      ...base,
+      deviceId,
+      verdict: "FAIL",
+      detail: "the device no longer exists \u2014 this service is an orphan",
+      fix: d2.uninstallCommand(agentName)
+    };
+  }
+  switch (probe.status) {
+    case "ACTIVE":
+      return { ...base, deviceId, verdict: "PASS", detail: "device ACTIVE" };
+    case "PENDING":
+      return {
+        ...base,
+        deviceId,
+        verdict: "WARN",
+        detail: "device PENDING \u2014 enrolled, but never approved in AgentVault"
+      };
+    case "REVOKED":
+      return {
+        ...base,
+        deviceId,
+        verdict: "FAIL",
+        detail: "the device was REVOKED \u2014 this service is an orphan",
+        fix: d2.uninstallCommand(agentName)
+      };
+    default:
+      return {
+        ...base,
+        deviceId,
+        verdict: "SKIP",
+        detail: `the server reported a status this build does not recognise (${probe.status || "none"})`
+      };
+  }
+}
+async function inspectUnsupervised(dataDir, d2) {
+  const agentName = basename(dataDir);
+  const base = { dataDir, agentName, deviceId: "" };
+  const deviceId = d2.readCreds(dataDir)?.deviceId;
+  if (!deviceId) {
+    return { ...base, verdict: "WARN", detail: "credentials present but they hold no device id" };
+  }
+  let probe;
+  try {
+    probe = await d2.fetchStatus(d2.apiUrl, deviceId);
+  } catch (e) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${e.message}` };
+  }
+  if (probe.inconclusive) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${probe.inconclusive}` };
+  }
+  if (probe.gone) {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "the device no longer exists \u2014 these are leftover credentials for a deleted agent"
+    };
+  }
+  if (probe.status === "ACTIVE") {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "the device is ACTIVE but nothing supervises it \u2014 this agent is not running",
+      fix: d2.installCommand(agentName)
+    };
+  }
+  if (probe.status === "PENDING") {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "device PENDING \u2014 enrolled, but never approved in AgentVault"
+    };
+  }
+  if (probe.status === "REVOKED") {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "the device was REVOKED \u2014 these are leftover credentials"
+    };
+  }
+  return {
+    ...base,
+    deviceId,
+    verdict: "SKIP",
+    detail: `the server reported a status this build does not recognise (${probe.status || "none"})`
+  };
+}
+function formatDoctorReport(r2) {
+  const out = [];
+  out.push(`Services installed for this bridge (${r2.labelPrefixes.map((p2) => p2 + "*").join(", ")})`);
+  if (r2.services.length === 0) {
+    out.push(`  No services installed for this bridge on this machine.`);
+  }
+  for (const s2 of r2.services) {
+    out.push(
+      `  ${s2.verdict.padEnd(PAD)}${s2.label}  [${s2.agentName || "unnamed"}]  ${s2.loaded ? "loaded" : "not loaded"}  \u2014  ${s2.detail}`
+    );
+    if (s2.fix) out.push(`  ${"".padEnd(PAD)}fix: ${s2.fix}`);
+  }
+  if (r2.unsupervised.length) {
+    out.push("");
+    out.push("Credentials on disk that no installed service points at");
+    for (const u2 of r2.unsupervised) {
+      out.push(`  ${u2.verdict.padEnd(PAD)}${u2.agentName}  \u2014  ${u2.detail}`);
+      out.push(`  ${"".padEnd(PAD)}${u2.dataDir}`);
+      if (u2.fix) out.push(`  ${"".padEnd(PAD)}fix: ${u2.fix}`);
+    }
+  }
+  if (r2.notChecked.length) {
+    out.push("");
+    out.push("Found on this machine, NOT checked by this command");
+    for (const l2 of r2.notChecked) out.push(`  ${l2}`);
+    out.push(
+      "  These belong to other AgentVault agent families. This command can only read the credentials of its own, so it says nothing about their health."
+    );
+  }
+  const counts = { PASS: 0, WARN: 0, FAIL: 0, SKIP: 0 };
+  for (const s2 of r2.services) counts[s2.verdict]++;
+  for (const u2 of r2.unsupervised) counts[u2.verdict]++;
+  out.push("");
+  out.push(
+    `Summary: ${counts.PASS} PASS, ${counts.WARN} WARN, ${counts.FAIL} FAIL, ${counts.SKIP} SKIP` + (counts.SKIP ? " (SKIP = could not check, NOT a problem found)" : "")
+  );
+  if (counts.FAIL) {
+    out.push(
+      "`uninstall` removes the SERVICE only \u2014 your credentials stay on disk, so a mistake here costs a re-install, not an identity."
+    );
+  }
+  return out;
+}
+var PAD;
+var init_doctor = __esm({
+  "src/service/doctor.ts"() {
+    "use strict";
+    PAD = 6;
+  }
+});
+
+// src/service/doctor-cli.ts
+var doctor_cli_exports = {};
+__export(doctor_cli_exports, {
+  fetchDeviceStatus: () => fetchDeviceStatus,
+  maybeRunDoctorSubcommand: () => maybeRunDoctorSubcommand,
+  realDoctorDeps: () => realDoctorDeps
 });
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
 import { join as join13 } from "node:path";
-function installOnReady(channel, cfg, deps) {
-  const hasCreds = deps.hasCreds ?? hasPersistedCreds;
-  const readLauncher = deps.readLauncher ?? ((p2) => existsSync5(p2) ? readFileSync4(p2, "utf8") : void 0);
-  const fenceAuthExists = deps.fenceAuthExists ?? ((home) => existsSync5(join13(home, ".grok", "auth.json")));
-  let fired = false;
-  channel.on("ready", () => {
-    if (fired) return;
-    fired = true;
-    void (async () => {
-      try {
-        if (!hasCreds(cfg.dataDir)) {
-          throw new Error(
-            `enrolment did not persist credentials to ${cfg.dataDir} \u2014 refusing to install a service that would crash-loop`
-          );
-        }
-        if (!fenceAuthExists(cfg.fenceHome)) {
-          throw new Error(
-            "no grok credential in the fence \u2014 run `grok login`, then paste the same command again (your enrolment is already saved, so the token is not needed). Note that XAI_API_KEY from your shell is NOT inherited by the background service."
-          );
-        }
-        if (deps.waitForIdle) {
-          const timeoutMs = deps.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
-          let timer;
-          const timedOut = await Promise.race([
-            deps.waitForIdle().then(() => false),
-            new Promise((r2) => {
-              timer = setTimeout(() => r2(true), timeoutMs);
-            })
-          ]);
-          if (timer) clearTimeout(timer);
-          if (timedOut) {
-            deps.log(
-              `agent still busy after ${timeoutMs}ms \u2014 handing off anyway; that reply may be lost`
-            );
-          }
-        }
-        const reaped = await deps.reap();
-        if (!reaped.ok) {
-          throw new Error(
-            `teardown did not complete (${reaped.failures.join("; ")}) \u2014 refusing to install over a session that may still be open`
-          );
-        }
-        const backend = deps.backend ?? selectBackend(process.platform);
-        const spec = buildServiceSpec(cfg, {
-          entrypoint: deps.entrypoint,
-          home: deps.env.HOME ?? "",
-          path: deps.env.PATH ?? ""
-        });
-        const installedEntrypoint = parseLauncherEntrypoint(readLauncher(spec.launcherPath));
-        const entrypointIsCurrent = installedEntrypoint !== void 0 && !isEphemeralEntrypoint(installedEntrypoint) && installedEntrypoint === deps.entrypoint;
-        if (backend.status(spec.label).loaded && entrypointIsCurrent) {
-          backend.restart(spec.label);
-          deps.log(`service ${spec.label} already installed and current \u2014 restarted`);
-        } else {
-          backend.install(spec);
-          deps.log(
-            installedEntrypoint && !entrypointIsCurrent ? `service ${spec.label} pointed at a stale entrypoint (${installedEntrypoint}) \u2014 re-installed` : `installed service ${spec.label}`
-          );
-        }
-        const after = backend.status(spec.label);
-        if (!after.loaded) {
-          throw new Error(`service did not load: ${after.detail}`);
-        }
-        deps.log(`it is running now. logs: ${spec.logErr}`);
-        deps.log(`check it:   agentvault-grok-bridge status`);
-        deps.log(`restart it: agentvault-grok-bridge restart   (never 'install')`);
-        deps.exit(0);
-      } catch (e) {
-        deps.log(`--install failed: ${e instanceof Error ? e.message : String(e)}`);
-        deps.exit(1);
-      }
-    })();
+import { readdirSync as readdirSync2 } from "node:fs";
+async function fetchDeviceStatus(apiUrl, deviceId, doFetch = fetch) {
+  const res = await doFetch(`${apiUrl}/api/v1/devices/${deviceId}/status`, {
+    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
   });
+  if (res.status === 404) {
+    try {
+      await res.json();
+    } catch {
+      return {
+        inconclusive: `${apiUrl} answered 404 with a non-JSON body \u2014 check AV_API_URL points at the API`
+      };
+    }
+    return { gone: true };
+  }
+  if (res.status === 429) return { inconclusive: "rate limited by the API (429)" };
+  if (!res.ok) return { inconclusive: `the API answered ${res.status}` };
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return { inconclusive: `${apiUrl} answered 200 with a non-JSON body \u2014 check AV_API_URL` };
+  }
+  return { status: body?.status };
+}
+function listCredDirs(base) {
+  const out = [];
+  if (hasPersistedCreds(base)) out.push(base);
+  let names;
+  try {
+    names = readdirSync2(base);
+  } catch {
+    return out;
+  }
+  for (const name of names) {
+    const dir = join13(base, name);
+    if (hasPersistedCreds(dir)) out.push(dir);
+  }
+  return out;
+}
+function otherFamilyLabels(backend) {
+  const out = [];
+  for (const p2 of OTHER_FAMILY_PREFIXES) {
+    try {
+      for (const s2 of backend.list(p2)) out.push(s2.label);
+    } catch {
+    }
+  }
+  return out.sort();
+}
+function realDoctorDeps(env) {
+  const backend = selectBackend(process.platform);
+  const base = join13(env.HOME ?? "", ".agentvault", "grok-room-bridge");
+  return {
+    backend,
+    labelPrefixes: [LABEL_PREFIX],
+    base,
+    // Same default as config.ts. Read from the env directly rather than through
+    // loadConfig, which now REFUSES without AV_AGENT_NAME (#921) — and doctor's
+    // whole job is to run when you do not know which agents exist.
+    apiUrl: env.AV_API_URL ?? "https://api.agentvault.chat",
+    uninstallCommand: (n2) => `AV_AGENT_NAME=${n2 || "<agent-name>"} agentvault-grok-bridge uninstall`,
+    installCommand: (n2) => `AV_AGENT_NAME=${n2 || "<agent-name>"} agentvault-grok-bridge install`,
+    readCreds: (dir) => {
+      const deviceId = readPersistedDeviceId(dir);
+      return deviceId ? { deviceId } : null;
+    },
+    credDirs: () => listCredDirs(base),
+    fetchStatus: (apiUrl, deviceId) => fetchDeviceStatus(apiUrl, deviceId),
+    otherLabels: () => otherFamilyLabels(backend)
+  };
+}
+async function maybeRunDoctorSubcommand(argv, opts = {}) {
+  if (argv[2] !== "doctor") return false;
+  const log = opts.log ?? printLine;
+  try {
+    const report = await buildDoctorReport(opts.deps ?? realDoctorDeps(opts.env ?? process.env));
+    for (const line of formatDoctorReport(report)) log(line);
+    if (report.services.some((s2) => s2.verdict === "FAIL")) process.exitCode = 1;
+  } catch (e) {
+    log(`doctor could not run: ${e.message}`);
+    process.exitCode = 1;
+  }
+  return true;
 }
-var DEFAULT_IDLE_TIMEOUT_MS;
-var init_install_on_ready = __esm({
-  "src/service/install-on-ready.ts"() {
+var LABEL_PREFIX, OTHER_FAMILY_PREFIXES, PROBE_TIMEOUT_MS;
+var init_doctor_cli = __esm({
+  "src/service/doctor-cli.ts"() {
     "use strict";
-    init_config();
-    init_spec();
-    init_launcher();
     init_backend();
-    DEFAULT_IDLE_TIMEOUT_MS = 3e4;
+    init_config();
+    init_log();
+    init_doctor();
+    LABEL_PREFIX = "dev.agentvault.grok-";
+    OTHER_FAMILY_PREFIXES = [
+      "dev.agentvault.bridge-",
+      // claude bridge, current label
+      "com.agentvault.claude-bridge.",
+      // claude bridge, pre-rename label (#837)
+      "ai.hermes.gateway"
+      // hermes, one service per profile
+    ];
+    PROBE_TIMEOUT_MS = 8e3;
   }
 });
 
@@ -98965,6 +99305,40 @@ async function startRoomMcpServer(opts) {
   };
 }
 
+// src/service/self-uninstall.ts
+init_subcommand();
+init_backend();
+init_log();
+var DEVICE_IS_GONE = "device_revoked";
+function selfUninstallOnTerminal(reason, env, deps = {}) {
+  if (reason !== DEVICE_IS_GONE) return false;
+  const log = deps.log ?? ((m2) => logLine("[grok-bridge] " + m2));
+  let label;
+  try {
+    label = labelFor(env);
+  } catch (e) {
+    log(
+      `device was revoked, but ${e.message} \u2014 cannot tell which service to remove. Remove it by hand with: AV_AGENT_NAME=<agent-name> agentvault-grok-bridge uninstall`
+    );
+    return false;
+  }
+  try {
+    if (!deps.backend && process.platform !== "darwin" && process.platform !== "linux") return false;
+    const backend = deps.backend ?? selectBackend(process.platform);
+    if (!backend.status(label).loaded) return false;
+    backend.uninstall(label);
+    log(
+      `device was revoked \u2014 removed the supervised service ${label} so it does not sit installed on this machine pointing at an agent that no longer exists. Your credentials are still on disk and were NOT touched; re-install with a fresh invite token from AgentVault to reconnect.`
+    );
+    return true;
+  } catch (e) {
+    log(
+      `device was revoked, but removing the service ${label} failed: ${e.message}. Remove it by hand with: AV_AGENT_NAME=<agent-name> agentvault-grok-bridge uninstall`
+    );
+    return false;
+  }
+}
+
 // src/bridge.ts
 var RoomHushState = class {
   until = /* @__PURE__ */ new Map();
@@ -99020,11 +99394,13 @@ var ActiveTarget = class {
 function attachLifecycle2(channel, opts = {}) {
   const log = opts.log ?? (() => {
   });
+  const selfUninstall = opts.selfUninstall ?? selfUninstallOnTerminal;
   const onTerminal = opts.onTerminal ?? ((_reason, o2) => process.exit(o2.restart ? 1 : 0));
   const terminal = (reason, restart) => {
     log(
       `terminal condition (${reason}) \u2014 ${restart ? "gave up reconnecting; supervisor may respawn" : "this device must re-enroll or another session has taken over"}. Re-run/re-install with a fresh invite token from AgentVault if this persists.`
     );
+    selfUninstall(reason, process.env);
     onTerminal(reason, { restart });
   };
   channel.on("auth_failed", (e) => terminal(e.reason, false));
@@ -99178,6 +99554,10 @@ var shutdown = async (code = 0) => {
   }
 };
 async function main() {
+  const { maybeRunDoctorSubcommand: maybeRunDoctorSubcommand2 } = await Promise.resolve().then(() => (init_doctor_cli(), doctor_cli_exports));
+  if (await maybeRunDoctorSubcommand2(process.argv)) {
+    process.exit(process.exitCode ?? 0);
+  }
   const { maybeRunServiceSubcommand: maybeRunServiceSubcommand2 } = await Promise.resolve().then(() => (init_subcommand(), subcommand_exports));
   if (maybeRunServiceSubcommand2(process.argv, process.env, {
     log: (m2) => logLine("[grok-bridge] " + m2)
@@ -99187,7 +99567,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.3.2" : void 0
+      true ? "0.4.0" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -99226,11 +99606,6 @@ async function main() {
     process.exit(0);
   }
   const cfg = loadConfig(process.env, process.argv.slice(2));
-  if (cfg.installAfterEnroll) {
-    assertInstallableEntrypoint(process.argv[1]);
-    const { selectBackend: selectBackend2 } = await Promise.resolve().then(() => (init_backend(), backend_exports));
-    selectBackend2(process.platform);
-  }
   mkdirSync6(cfg.workspaceDir, { recursive: true });
   mkdirSync6(cfg.fenceHome, { recursive: true });
   seedFenceCredential({
@@ -99245,7 +99620,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.3.2" : void 0
+      true ? "0.4.0" : void 0
     )
   });
   channelRef = channel;
@@ -99336,23 +99711,6 @@ async function main() {
       logLine("[grok-bridge] enrolled \u2014 pending invite consumed and removed");
     }
   });
-  if (cfg.installAfterEnroll) {
-    const { installOnReady: installOnReady2 } = await Promise.resolve().then(() => (init_install_on_ready(), install_on_ready_exports));
-    installOnReady2(channel, cfg, {
-      entrypoint: process.argv[1],
-      env: process.env,
-      // FOUND LIVE 2026-08-16: the owner's activation greeting is usually already
-      // being answered when `ready` fires, and reaping mid-turn killed the reply
-      // for good — the message was acked, so the service never saw it again.
-      // GrokSession.idle() resolves when the queue drains.
-      waitForIdle: () => session.idle(),
-      // The one shared teardown. `exiting` is deliberately NOT set here: Ctrl-C
-      // must keep working for the whole multi-second launchctl window.
-      reap: reapAll,
-      exit: (code) => process.exit(code),
-      log: (m2) => logLine("[grok-bridge] " + m2)
-    });
-  }
   await channel.start();
 }
 main().catch(async (err) => {

package/dist/service/backend.d.ts

@@ -1,7 +1,18 @@
 import type { ServiceSpec } from "./spec.js";
+/** One installed service found on disk, with the env its definition bakes in. */
+export interface InstalledService {
+    label: string;
+    /** Absolute path of the plist / unit file. */
+    path: string;
+    env: Record<string, string>;
+}
 export interface ServiceBackend {
     install(spec: ServiceSpec): void;
     uninstall(label: string): void;
+    /** #913 item 3 — every installed service whose label starts with `prefix`,
+     *  read from the definition DIRECTORY, not from the running-service list. An
+     *  orphan is installed-but-not-running by construction. */
+    list(prefix: string): InstalledService[];
     /** Restart an ALREADY-INSTALLED service without touching its spec (#837).
      *  Distinct from install, which re-bakes the plist from the current shell. */
     restart(label: string): void;
@@ -23,6 +34,10 @@ export interface BackendDeps {
     chmod: (path: string, mode: number) => void;
     rm: (path: string) => void;
     exists: (path: string) => boolean;
+    /** Names in a directory. Returns [] when the directory does not exist — a
+     *  machine with no services installed is not an error. */
+    readdir: (path: string) => string[];
+    readFile: (path: string) => string;
 }
 export declare function defaultDeps(): BackendDeps;
 export declare function selectBackend(platform: NodeJS.Platform, deps?: BackendDeps): ServiceBackend;

package/dist/service/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/service/backend.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;kFAC8E;IAC9E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC;AAED,wBAAgB,WAAW,IAAI,WAAW,CAoBzC;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,cAAc,CAU3F"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/service/backend.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;+DAE2D;IAC3D,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAAC;IACzC;kFAC8E;IAC9E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC;8DAC0D;IAC1D,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACpC;AAED,wBAAgB,WAAW,IAAI,WAAW,CAoCzC;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,cAAc,CAU3F"}

package/dist/service/doctor-cli.d.ts

@@ -0,0 +1,36 @@
+import { type DeviceProbe, type DoctorDeps } from "./doctor.js";
+/**
+ * Ask the public status endpoint about one device.
+ *
+ * `GET /api/v1/devices/{id}/status` needs no auth and is rate limited per
+ * device_id, so checking several agents in a row is fine.
+ *
+ * ⚠️ A 404 is the strongest claim this command makes — it is what turns into
+ * "orphan, run uninstall". So it is only believed when the body is JSON, i.e.
+ * an actual API error shape. `agentvault.dev` serves a GoDaddy parked page that
+ * answers with confident HTTP codes and no API behind it, and on 2026-07-25
+ * that fooled a smoke check into reporting a healthy backend. A wrong
+ * AV_API_URL must read as "I could not check", never as "all your agents are
+ * dead".
+ */
+export declare function fetchDeviceStatus(apiUrl: string, deviceId: string, doFetch?: typeof fetch): Promise<DeviceProbe>;
+export declare function realDoctorDeps(env: NodeJS.ProcessEnv): DoctorDeps;
+/**
+ * Handle `agentvault-grok-bridge doctor`. Returns true when handled.
+ *
+ * Async, which is why it does not live in maybeRunServiceSubcommand: that
+ * dispatcher is synchronous and doctor has to await the network. index.ts runs
+ * this FIRST. If it ever did not, `doctor` would fall through to the
+ * unknown-subcommand guard and throw — loud, and safe. A typo must never boot a
+ * daemon (#921), and neither must a command we forgot to wire.
+ *
+ * READ-ONLY by construction: it never calls install, uninstall or restart. It
+ * prints the command instead, because deciding to remove a customer's service
+ * is theirs to make with the evidence in front of them.
+ */
+export declare function maybeRunDoctorSubcommand(argv: string[], opts?: {
+    log?: (msg: string) => void;
+    deps?: DoctorDeps;
+    env?: NodeJS.ProcessEnv;
+}): Promise<boolean>;
+//# sourceMappingURL=doctor-cli.d.ts.map

package/dist/service/doctor-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-cli.d.ts","sourceRoot":"","sources":["../../src/service/doctor-cli.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAoBrB;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,WAAW,CAAC,CAuBtB;AA+BD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrF,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/service/doctor.d.ts

@@ -0,0 +1,93 @@
+import type { ServiceBackend } from "./backend.js";
+/**
+ * #913 item 3 — `doctor`: list what is installed, check each against the API,
+ * and say which ones are orphaned.
+ *
+ * Deleting an agent in the dashboard removes the DEVICE ROW and nothing else.
+ * The service stays installed, pointing at a device that no longer exists, and
+ * the customer has no signal at all. Item 1 names the uninstall command AT
+ * DELETE TIME; item 2 removes the service when the running bridge is told the
+ * device is gone. Neither helps the machine that already accumulated orphans —
+ * from a delete done in another browser, before those shipped, or while the
+ * bridge was not running. That is what this reads.
+ *
+ * TWO RULES, both earned the hard way:
+ *
+ * 1. AN UNREACHABLE API IS NOT AN ORPHAN. #919: a default for a missing input is
+ *    a guess, and reporting on it is a lie. Every inconclusive probe is SKIP,
+ *    never FAIL — including a status string this build does not recognise.
+ *    Printing FAIL on a network blip sends a customer to uninstall a healthy
+ *    agent.
+ *
+ * 2. SILENCE ABOUT WHAT IT CANNOT SEE IS A FALSE ALL-CLEAR. #941: the delete
+ *    modal covered 3 of 15 devices and said nothing for the other 12, which
+ *    reads as "nothing to clean up". This command can only check its own family
+ *    — the agents whose credentials it can read — so it LISTS the other
+ *    AgentVault services it found and says it did not check them.
+ */
+export type Verdict = "PASS" | "WARN" | "FAIL" | "SKIP";
+/** What the server said about one device. Exactly one field is meaningful. */
+export interface DeviceProbe {
+    /** The device's status string, verbatim from the API. */
+    status?: string;
+    /** 404 — the device row does not exist. */
+    gone?: boolean;
+    /** Why the check could not conclude. Present => the answer is UNKNOWN. */
+    inconclusive?: string;
+}
+export interface ServiceFinding {
+    label: string;
+    agentName: string;
+    dataDir: string;
+    loaded: boolean;
+    deviceId: string;
+    verdict: Verdict;
+    detail: string;
+    /** The exact command that fixes it. Set ONLY for a confirmed orphan. */
+    fix?: string;
+}
+export interface UnsupervisedFinding {
+    dataDir: string;
+    agentName: string;
+    deviceId: string;
+    verdict: Verdict;
+    detail: string;
+    /** How to bring a live agent back. Never a suggestion to delete key material:
+     *  `uninstall` leaves credentials ON PURPOSE, and a doctor that says "remove
+     *  this directory" turns a recoverable mistake into a lost identity. */
+    fix?: string;
+}
+export interface DoctorReport {
+    labelPrefixes: string[];
+    services: ServiceFinding[];
+    /** Credentials on disk that no installed service points at — CHECKED against
+     *  the API, not merely listed. "Leftover from a deleted agent" and "a live
+     *  agent whose service was removed" look identical on disk and need opposite
+     *  responses, so the verdict is the whole point. */
+    unsupervised: UnsupervisedFinding[];
+    /** AgentVault services from other families. Found, listed, NOT checked. */
+    notChecked: string[];
+}
+export interface DoctorDeps {
+    backend: ServiceBackend;
+    /** Every label prefix this bridge OWNS — plural because #837 renamed the
+     *  claude label and pre-rename installs are still registered under the old
+     *  one. Those are the longest-running services on customer machines, i.e. the
+     *  ones most likely to have accumulated an orphan. */
+    labelPrefixes: string[];
+    base: string;
+    apiUrl: string;
+    uninstallCommand: (agentName: string) => string;
+    installCommand: (agentName: string) => string;
+    readCreds: (dataDir: string) => {
+        deviceId?: string;
+    } | null;
+    /** Absolute data dirs under `base` that hold credentials. */
+    credDirs: () => string[];
+    fetchStatus: (apiUrl: string, deviceId: string) => Promise<DeviceProbe>;
+    /** Labels belonging to other AgentVault families installed on this machine. */
+    otherLabels: () => string[];
+}
+export declare function buildDoctorReport(d: DoctorDeps): Promise<DoctorReport>;
+export declare function formatDoctorReport(r: DoctorReport): string[];
+//# sourceMappingURL=doctor.d.ts.map

package/dist/service/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/service/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAExD,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;4EAEwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;wDAGoD;IACpD,YAAY,EAAE,mBAAmB,EAAE,CAAC;IACpC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB;;;0DAGsD;IACtD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7D,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxE,+EAA+E;IAC/E,WAAW,EAAE,MAAM,MAAM,EAAE,CAAC;CAC7B;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAqB5E;AAiJD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAqD5D"}

package/dist/service/launchd.d.ts

@@ -1,7 +1,26 @@
 import type { ServiceSpec } from "./spec.js";
-import type { BackendDeps, ServiceBackend } from "./backend.js";
+import type { BackendDeps, ServiceBackend, InstalledService } from "./backend.js";
 /** Render a launchd LaunchAgent plist for a bridge ServiceSpec. Pure string. */
 export declare function renderLaunchdPlist(spec: ServiceSpec): string;
+/**
+ * Read the EnvironmentVariables dict back out of an installed plist.
+ *
+ * Deliberately tolerant of formatting, and deliberately NOT tolerant of scope.
+ *
+ * TOLERANT: `loopita`'s plist is hand-edited, so it keeps none of the
+ * whitespace `renderLaunchdPlist` writes. A parser that only understood its own
+ * output would report "no data dir" for precisely the long-lived install a
+ * customer is most likely to be asking `doctor` about.
+ *
+ * NOT TOLERANT: it reads ONLY the EnvironmentVariables dict. `Label`,
+ * `WorkingDirectory` and `StandardOutPath` are <key>/<string> pairs too, so a
+ * whole-file scan would hand back a log path as if it were AV_DATA_DIR and then
+ * go looking for credentials in it.
+ *
+ * Returns {} for junk. A doctor that throws on one malformed plist reports
+ * nothing about the other five.
+ */
+export declare function parsePlistEnv(xml: string): Record<string, string>;
 export declare class LaunchdBackend implements ServiceBackend {
     private deps;
     constructor(deps: BackendDeps);
@@ -17,5 +36,12 @@ export declare class LaunchdBackend implements ServiceBackend {
         loaded: boolean;
         detail: string;
     };
+    /** #913 item 3 — every installed service whose label starts with `prefix`.
+     *
+     *  Reads the plist directory rather than `launchctl list`, because an ORPHAN
+     *  is typically installed-but-not-loaded: the revoked device exits 0 and
+     *  KeepAlive leaves it down. `launchctl list` would not show the very thing
+     *  doctor exists to find. */
+    list(prefix: string): InstalledService[];
 }
 //# sourceMappingURL=launchd.d.ts.map

package/dist/service/launchd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../../src/service/launchd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAUhE,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAkC5D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IA2BhC,OAAO,CAAC,aAAa;IAOrB;+EAC2E;IAC3E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAM9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAI3D"}
+{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../../src/service/launchd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUlF,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAkC5D;AAGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BjE;AAOD,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IA2BhC,OAAO,CAAC,aAAa;IAOrB;+EAC2E;IAC3E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAM9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAK1D;;;;;iCAK6B;IAC7B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,EAAE;CAezC"}

package/dist/service/self-uninstall.d.ts

@@ -0,0 +1,19 @@
+import { type ServiceBackend } from "./backend.js";
+export interface SelfUninstallDeps {
+    backend?: ServiceBackend;
+    log?: (msg: string) => void;
+}
+/**
+ * Remove this agent's supervised service after its device was revoked.
+ *
+ * Returns whether a service was actually removed. NEVER throws: this runs on
+ * the shutdown path, and a cleanup that cannot happen must not stop the bridge
+ * exiting cleanly — `KeepAlive {SuccessfulExit: false}` depends on that exit(0)
+ * to leave the service down rather than crash-looping it.
+ *
+ * The stakes are asymmetric and worth stating: `uninstall` removes the SERVICE
+ * and LEAVES the credentials on disk. A false positive therefore costs the
+ * customer a re-install, not their identity.
+ */
+export declare function selfUninstallOnTerminal(reason: string, env: NodeJS.ProcessEnv, deps?: SelfUninstallDeps): boolean;
+//# sourceMappingURL=self-uninstall.d.ts.map

package/dist/service/self-uninstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-uninstall.d.ts","sourceRoot":"","sources":["../../src/service/self-uninstall.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAuBlE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAyCT"}

package/dist/service/subcommand.d.ts

@@ -4,6 +4,7 @@ export interface ServiceCmdDeps {
     entrypoint?: string;
     log?: (msg: string) => void;
 }
+export declare function labelFor(env: NodeJS.ProcessEnv): string;
 /** Handle `agentvault-grok-bridge <install|uninstall|status|logs>` before boot.
  *  Returns true when handled (caller should exit). Secrets are never placed on
  *  the service command line — config flows via the plist env; the token is omitted. */

package/dist/service/subcommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAiDD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAqHT"}
+{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AA6CD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEvD;AAED;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAgIT"}

package/dist/service/systemd.d.ts

@@ -1,10 +1,21 @@
 import type { ServiceSpec } from "./spec.js";
-import type { BackendDeps, ServiceBackend } from "./backend.js";
+import type { BackendDeps, ServiceBackend, InstalledService } from "./backend.js";
 /** Render a systemd --user service unit for a bridge ServiceSpec. Pure string.
  *  Restart=on-failure + SuccessExitStatus=0 is the KeepAlive={SuccessfulExit:false}
  *  equivalent: a clean exit(0) (revoked device) is treated as success => NOT
  *  restarted; a non-zero crash is restarted. WantedBy=default.target is RunAtLoad. */
 export declare function renderSystemdUnit(spec: ServiceSpec): string;
+/**
+ * Read `Environment=` back out of an installed systemd unit.
+ *
+ * Reverses `q` exactly: un-double the '%' first, then walk the backslash
+ * escapes left to right in ONE pass. Two passes would turn a literal
+ * backslash-n (written as \\n) into a newline.
+ *
+ * Returns {} for junk — a doctor that throws on one malformed unit reports
+ * nothing about the others.
+ */
+export declare function parseUnitEnv(text: string): Record<string, string>;
 export declare class SystemdBackend implements ServiceBackend {
     private deps;
     constructor(deps: BackendDeps);
@@ -18,5 +29,12 @@ export declare class SystemdBackend implements ServiceBackend {
         loaded: boolean;
         detail: string;
     };
+    /** #913 item 3 — every installed unit whose label starts with `prefix`.
+     *
+     *  Reads the unit directory rather than `systemctl list-units`, because an
+     *  ORPHAN is installed-but-inactive: the revoked device exits 0, which
+     *  SuccessExitStatus=0 treats as success, so it is never restarted. A
+     *  running-units listing would not show the thing doctor exists to find. */
+    list(prefix: string): InstalledService[];
 }
 //# sourceMappingURL=systemd.d.ts.map

package/dist/service/systemd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"systemd.d.ts","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAmBhE;;;sFAGsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAsB3D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAoBhC;2DACuD;IACvD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAU9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAQ3D"}
+{"version":3,"file":"systemd.d.ts","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAmBlF;;;sFAGsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAsB3D;AAGD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWjE;AAQD,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAoBhC;2DACuD;IACvD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAU9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAS1D;;;;;gFAK4E;IAC5E,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,EAAE;CAczC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",