@alan-ai-hq/agent-manager 0.1.113 → 0.1.115

package/dist/daemon.js

@@ -0,0 +1,681 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { hostname } from "node:os";
+// Desktop registers Electron powerSaveBlocker via registerSleepInhibitorBackend.
+export { registerSleepInhibitorBackend, SLEEP_PREVENTION_DISABLED_ENV, } from "./sleep-inhibitor.js";
+import { AGENT_VERSION } from "./version.js";
+export { AGENT_VERSION };
+export { ensureSharedCheckoutBranch, resolveRuntimeCwd, resolveSharedCheckoutTargets, statusLocalWorkspace, } from "./daemon-workspace.js";
+export async function runLocalDaemonRecoveryLadder(input) {
+    const healthy = (status) => status.connected === true && !status.recovering && !status.restartRecommended;
+    const waitForRecovery = async () => {
+        const timeoutMs = input.options?.connectTimeoutMs ?? 12_000;
+        const pollMs = input.options?.pollMs ?? 500;
+        const deadline = Date.now() + timeoutMs;
+        let status = await input.getStatus();
+        while (Date.now() < deadline) {
+            if (healthy(status) || input.stopWaiting?.(status))
+                return status;
+            await sleep(pollMs);
+            status = await input.getStatus();
+        }
+        return status;
+    };
+    const needsRestartBusy = (status) => {
+        const count = input.blockingRunCount(status);
+        return {
+            ...status,
+            activeRunCount: count,
+            recoveryCode: "needs_restart_busy",
+            error: `Connection is broken and fixing it will interrupt ${count} active run${count === 1 ? "" : "s"}`,
+        };
+    };
+    let status = input.initialStatus;
+    if (healthy(status) || input.stopWaiting?.(status))
+        return status;
+    if (await input.redial().catch(() => false)) {
+        status = await waitForRecovery();
+        if (healthy(status) || input.stopWaiting?.(status))
+            return status;
+    }
+    if (input.blockingRunCount(status) > 0)
+        return needsRestartBusy(status);
+    try {
+        status = await input.restart();
+    }
+    catch (error) {
+        return {
+            ...status,
+            recoveryCode: "daemon_recovery_failed",
+            error: error instanceof Error ? error.message : "Local daemon restart failed",
+        };
+    }
+    if (healthy(status) || input.stopWaiting?.(status))
+        return status;
+    if (input.blockingRunCount(status) > 0)
+        return needsRestartBusy(status);
+    status = await waitForRecovery();
+    if (healthy(status) || input.stopWaiting?.(status))
+        return status;
+    if (input.blockingRunCount(status) > 0)
+        return needsRestartBusy(status);
+    return {
+        ...status,
+        recoveryCode: "daemon_recovery_failed",
+        error: "The local daemon exhausted its reconnect and safe-restart recovery budget.",
+    };
+}
+export { acquireDeviceAuthorizationOperation, acquireLocalDaemonMaintenanceLease, acquireLocalDaemonOwnerLease, adoptConfiguredLocalDaemon, adoptLocalDaemonControl, assertDeviceAuthorizationOperationOwner, bindConfigPath, clearPendingDeviceAuthorization, clearPendingSetupIntent, describeOccupiedLocalDaemon, deviceAuthorizationOperationPath, equalHexDigest, extendDeviceAuthorizationOperation, getConfigPath, getEndpointDefaultsPath, getLocalApiPort, getOrCreateSetupAttemptId, inspectLocalDaemonRunJournal, isLocalDaemonListening, isNativeTaskLinkingEnabled, LOCAL_SERVICE_CHALLENGE_TTL_MS, LOCAL_SERVICE_OWNER_VERSION, localServiceOwnerPayload, observeLocalDaemonEndpoint, parseLocalServiceOwner, probeLocalDaemon, probeLocalDaemonEndpoint, readConfig, readConfigForRegistration, readEndpointDefaults, readLocalDaemonMaintenanceLease, readLocalDaemonOwnerLease, readPendingDeviceAuthorization, releaseLocalDaemonMaintenanceLease, releaseLocalDaemonOwnerLease, releaseOwnedJsonFile, removeAlanOwnedLocalArtifacts, signLocalServiceAdoption, signLocalServiceOwner, updateLocalDaemonOwnerEndpoint, writeConfig, writePendingDeviceAuthorization, } from "./daemon-local-control.js";
+import { acquireDeviceAuthorizationOperation, adoptConfiguredLocalDaemon, assertDeviceAuthorizationOperationOwner, bindConfigPath, clearPendingDeviceAuthorization, clearPendingSetupIntent, deviceAuthorizationOperationPath, extendDeviceAuthorizationOperation, getConfigPath, getLocalApiPort, probeLocalDaemon, probeLocalDaemonEndpoint, readConfig, readConfigForRegistration, readLocalDaemonOwnerLease, readPendingDeviceAuthorization, releaseOwnedJsonFile, removeAlanOwnedLocalArtifacts, requestLocalDaemonShutdown, writeConfig, writePendingDeviceAuthorization, } from "./daemon-local-control.js";
+export { argValue, checkStoredEndpointConsistency, correlationLogFields, isLocalEndpoint, LOCAL_API_URL, LOCAL_WS_URL, PRODUCTION_API_URL, PRODUCTION_WS_URL, resolveEndpointProfile, resolveEndpoints, resolveWorkspaceRunLeaseTargets, STAGING_API_URL, STAGING_WS_URL, scheduleRuntimeModelScan, sleep, } from "./daemon-helpers.js";
+import { argValue, isLocalEndpoint, resolveEndpoints, sleep } from "./daemon-helpers.js";
+export { startDaemon } from "./daemon-start.js";
+export { addSkillSource } from "./skills/local-skill-source.js";
+import { startDaemon } from "./daemon-start.js";
+export { discoverCapabilities, normalizeBackendKind, printScanModels, refreshProviderAuthStates, refreshProviderModels, refreshProviderVersions, scanAgentCapabilities, VERSION_REFRESH_INTERVAL_MS, } from "./daemon-provider-scan.js";
+import { discoverCapabilities } from "./daemon-provider-scan.js";
+export { abortActiveAgent, buildAbortResult, buildActiveRunSlots, buildRunnerStatusPayload, collectRuntimeMetadata, collectRuntimeMetadataWithProviderLimits, DurablePendingRunStarts, flushPendingDeliveryLostEvents, isProviderProcessAlive, PENDING_RUN_START_TTL_MS, RUNNER_RECOVERY_GRACE_MS_LOCAL, reconcileActiveRuns, resolveRuntimeMaxActiveRuns, summarizeRunnerStatus, } from "./daemon-runner-status.js";
+export { EVENT_JOURNAL_ORDINARY_BATCH_MS, EVENT_JOURNAL_SEGMENT_BYTES, EVENT_JOURNAL_VERSION, } from "./event-journal-types.js";
+export { createLocalDaemonLifecycle, endpointObservationPresentation, hostAllowsReplacementConsideration, identitiesMatch, identityFromObservation, } from "./local-daemon-lifecycle.js";
+import { collectRuntimeMetadataWithProviderLimits } from "./daemon-runner-status.js";
+import { createRuntimeSetupGrant, exchangeRuntimeSetupGrant, handoffRuntimeSetupGrant, RuntimeSetupGrantExpiredError, } from "./runtime-registration.js";
+export { buildApplicationRunFailure, DELIVERY_LOST_ERROR, RuntimePresenter, } from "./runtime-presenter.js";
+function writeRegisteredRuntimeConfig(args, previousConfig, registered) {
+    writeConfig({
+        ...registered,
+        localApiPort: getLocalApiPort(args, {}),
+        localApiToken: previousConfig.localApiToken ?? randomBytes(24).toString("hex"),
+        localServiceId: previousConfig.localServiceId ?? randomUUID(),
+        localServiceSecret: previousConfig.localServiceSecret ?? randomBytes(32).toString("base64url"),
+        eventSpoolKey: previousConfig.eventSpoolKey ?? randomBytes(32).toString("base64url"),
+        daemonEpoch: previousConfig.daemonEpoch,
+    });
+}
+export async function setupDaemon(args, options = {}) {
+    const { signal } = options;
+    signal?.throwIfAborted();
+    bindConfigPath(args);
+    const previousConfig = readConfigForRegistration();
+    const { apiUrl, wsUrl, endpointProfile } = resolveEndpoints(args);
+    const teamId = argValue(args, "--team") ?? process.env.ALAN_TEAM_ID;
+    const setupToken = argValue(args, "--setup-token") ?? process.env.ALAN_RUNTIME_SETUP_TOKEN;
+    const token = argValue(args, "--token") ?? process.env.ALAN_SETUP_TOKEN;
+    const displayName = argValue(args, "--name") ?? hostname();
+    const scope = argValue(args, "--scope") ?? process.env.ALAN_RUNTIME_SCOPE ?? (setupToken ? "team" : "user");
+    const installationId = argValue(args, "--installation-id") ?? previousConfig.installationId ?? randomUUID();
+    if (scope !== "team" && scope !== "user") {
+        throw new Error("setup --scope must be either 'team' or 'user'");
+    }
+    if (!setupToken && !token) {
+        throw new Error("setup requires --setup-token <token> or --token <Alan access token>.\n" +
+            "For normal setup, copy the setup token from Alan and run: alan-agent setup --setup-token <token>\n" +
+            "For browser authorization, run: alan-agent login");
+    }
+    const registrationGrant = setupToken ??
+        (await createRuntimeSetupGrant({
+            apiUrl,
+            accessToken: token,
+            scope: scope,
+            teamId,
+        }, signal));
+    const setup = {
+        apiUrl,
+        wsUrl,
+        endpointProfile,
+        setupToken: registrationGrant,
+        teamId,
+        displayName,
+        installationId,
+    };
+    signal?.throwIfAborted();
+    let liveConfig = previousConfig;
+    const localApiPort = getLocalApiPort(args, liveConfig);
+    let live = liveConfig.localApiToken
+        ? await probeLocalDaemon(localApiPort, liveConfig.localApiToken)
+        : null;
+    signal?.throwIfAborted();
+    if (!live && liveConfig.localServiceId && liveConfig.localServiceSecret) {
+        live = await adoptConfiguredLocalDaemon(args);
+        liveConfig = readConfigForRegistration();
+    }
+    signal?.throwIfAborted();
+    if (live) {
+        if (!liveConfig.localApiToken) {
+            throw new Error("running daemon could not be authenticated for credential setup");
+        }
+        // Endpoint flags bootstrap a fresh machine. An already-running daemon keeps
+        // its bound endpoints so a public setup URL cannot redirect a local desktop.
+        const liveSetup = {
+            ...setup,
+            apiUrl: liveConfig.apiUrl ?? setup.apiUrl,
+            wsUrl: liveConfig.wsUrl ?? setup.wsUrl,
+            endpointProfile: liveConfig.endpointProfile ?? setup.endpointProfile,
+        };
+        const body = await handoffRuntimeSetupGrant({
+            port: localApiPort,
+            localApiToken: liveConfig.localApiToken,
+            setup: liveSetup,
+            signal,
+        });
+        signal?.throwIfAborted();
+        console.info("[alan-agent] Runtime credentials adopted by running daemon", {
+            runtimeId: body.runtimeId,
+            credentialGeneration: body.credentialGeneration,
+            configPath: getConfigPath(),
+        });
+        return body.runtimeId !== liveConfig.runtimeId;
+    }
+    if (readLocalDaemonOwnerLease(getConfigPath())) {
+        throw new Error("the daemon still owns this runtime configuration, but its authenticated local API is unreachable; recover or stop the daemon before running setup again");
+    }
+    let body;
+    try {
+        body = await exchangeRuntimeSetupGrant(setup, signal);
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (setupToken && error instanceof RuntimeSetupGrantExpiredError) {
+            if (signal) {
+                throw new Error("Setup link expired. Run alan-agent login to authorize in your browser.");
+            }
+            console.info("[alan-agent] Setup link expired; continuing with browser authorization");
+            await loginWithDeviceCode(args);
+            return false;
+        }
+        throw error;
+    }
+    signal?.throwIfAborted();
+    writeRegisteredRuntimeConfig(args, previousConfig, {
+        apiUrl,
+        wsUrl,
+        endpointProfile,
+        runtimeId: body.runtimeId,
+        runtimeToken: body.runtimeToken,
+        runtimeRenewalToken: body.runtimeRenewalToken,
+        runtimeTokenExpiresAt: body.runtimeTokenExpiresAt,
+        displayName: body.displayName,
+        installationId,
+    });
+    clearPendingSetupIntent();
+    console.info("[alan-agent] Runtime registered", {
+        runtimeId: body.runtimeId,
+        configPath: getConfigPath(),
+    });
+    return false;
+}
+export async function loginWithDeviceCode(args) {
+    bindConfigPath(args);
+    const operation = acquireDeviceAuthorizationOperation();
+    if (!operation) {
+        throw new Error("browser authorization is already in progress in another Alan process; finish or cancel it first");
+    }
+    try {
+        if (args.includes("--cancel")) {
+            clearPendingDeviceAuthorization();
+            console.info("[alan-agent] Browser authorization canceled");
+            return;
+        }
+        const previousConfig = readConfigForRegistration();
+        const { apiUrl, wsUrl, endpointProfile } = resolveEndpoints(args);
+        const displayName = argValue(args, "--name") ?? hostname();
+        const maxPolls = Number.parseInt(argValue(args, "--max-polls") ?? "300", 10);
+        const resumed = readPendingDeviceAuthorization(apiUrl);
+        const installationId = resumed?.installationId ?? previousConfig.installationId ?? randomUUID();
+        let authorization = resumed
+            ? { ...resumed, operationId: operation.id }
+            : null;
+        if (!authorization) {
+            // This process owns the operation lease, so an invalid/expired abandoned
+            // sidecar can be removed before starting a replacement authorization.
+            clearPendingDeviceAuthorization();
+            const start = await fetch(`${apiUrl}/public/runtimes/device-authorizations`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({
+                    displayName,
+                    hostname: hostname(),
+                    capabilities: discoverCapabilities(),
+                    metadata: {
+                        ...(await collectRuntimeMetadataWithProviderLimits()),
+                        installationId,
+                    },
+                }),
+                signal: AbortSignal.timeout(30_000),
+            });
+            if (!start.ok) {
+                throw new Error(`device authorization failed: ${start.status} ${await start.text()}`);
+            }
+            const started = (await start.json());
+            authorization = {
+                ...started,
+                apiUrl,
+                installationId,
+                operationId: operation.id,
+                intervalSeconds: Math.max(0, started.intervalSeconds ?? 2),
+            };
+            if (!Number.isFinite(Date.parse(authorization.expiresAt))) {
+                throw new Error("device authorization returned an invalid expiry");
+            }
+        }
+        else {
+            console.info("[alan-agent] Resuming browser authorization");
+        }
+        // Keep exclusive ownership through the authorization's complete lifetime,
+        // including a grace window for the final token exchange and config write.
+        extendDeviceAuthorizationOperation(operation.id, Date.parse(authorization.expiresAt) + 60_000);
+        writePendingDeviceAuthorization(authorization);
+        const intervalMs = authorization.intervalSeconds * 1000;
+        console.info(`[alan-agent] Open ${authorization.verificationUri}`);
+        console.info(`[alan-agent] Enter code ${authorization.userCode}`);
+        for (let attempt = 0; attempt < maxPolls; attempt += 1) {
+            if (attempt > 0)
+                await sleep(intervalMs);
+            if (Date.parse(authorization.expiresAt) <= Date.now()) {
+                clearPendingDeviceAuthorization(operation.id);
+                throw new Error("device authorization expired before approval; run alan-agent login again");
+            }
+            assertDeviceAuthorizationOperationOwner(operation.id);
+            const token = await fetch(`${apiUrl}/public/runtimes/device-authorizations/token`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ deviceCode: authorization.deviceCode }),
+                signal: AbortSignal.timeout(30_000),
+            });
+            if (token.status === 428)
+                continue;
+            if (!token.ok) {
+                if (token.status === 400 || token.status === 401) {
+                    clearPendingDeviceAuthorization(operation.id);
+                }
+                throw new Error(`device authorization token exchange failed: ${token.status} ${await token.text()}`);
+            }
+            const body = (await token.json());
+            assertDeviceAuthorizationOperationOwner(operation.id);
+            const ownedPending = readPendingDeviceAuthorization(apiUrl);
+            if (ownedPending?.operationId !== operation.id) {
+                throw new Error("browser authorization sidecar ownership was lost before finalization");
+            }
+            writeRegisteredRuntimeConfig(args, previousConfig, {
+                apiUrl,
+                wsUrl,
+                endpointProfile,
+                runtimeId: body.runtime.id,
+                runtimeToken: body.runtimeToken,
+                runtimeRenewalToken: body.runtimeRenewalToken,
+                runtimeTokenExpiresAt: body.runtimeTokenExpiresAt,
+                displayName: body.runtime.displayName ?? displayName,
+                installationId,
+            });
+            clearPendingDeviceAuthorization(operation.id);
+            console.info("[alan-agent] Runtime registered", {
+                runtimeId: body.runtime.id,
+                configPath: getConfigPath(),
+            });
+            return;
+        }
+        throw new Error("device authorization timed out before approval");
+    }
+    finally {
+        releaseOwnedJsonFile(deviceAuthorizationOperationPath(), operation.id);
+    }
+}
+export async function stopDaemon(args) {
+    bindConfigPath(args);
+    const stored = readConfig();
+    const localApiPort = getLocalApiPort(args, stored);
+    let localApiToken = stored.localApiToken;
+    let probe = localApiToken
+        ? await probeLocalDaemonEndpoint(localApiPort, localApiToken)
+        : { state: "listening_unauthorized" };
+    if (!localApiToken || probe.state === "listening_unauthorized") {
+        const adopted = await adoptConfiguredLocalDaemon(args);
+        if (adopted) {
+            localApiToken = readConfig().localApiToken;
+            probe = { state: "running", status: adopted };
+        }
+    }
+    if (!localApiToken)
+        throw new Error("No local API token in config. Run setup or login first.");
+    if (probe.state === "listening_unauthorized") {
+        throw new Error(`Daemon is listening on port ${localApiPort} but rejected this config token. ` +
+            "Quit Alan desktop or rerun setup/login to refresh config.");
+    }
+    if (probe.state === "absent") {
+        console.info("[alan-agent] No daemon listening", { port: localApiPort });
+        return;
+    }
+    const response = await requestLocalDaemonShutdown(localApiPort, localApiToken);
+    if (!response.ok) {
+        throw new Error(`Failed to stop daemon: HTTP ${response.status}`);
+    }
+    console.info("[alan-agent] Daemon stopped", {
+        port: localApiPort,
+        runtimeId: probe.status.runtimeId,
+    });
+}
+export async function runDaemon(args) {
+    bindConfigPath(args);
+    const stored = readConfig();
+    const localApiPort = getLocalApiPort(args, stored);
+    const localApiToken = stored.localApiToken;
+    const existingProbe = await probeLocalDaemonEndpoint(localApiPort, localApiToken);
+    if (existingProbe.state === "running") {
+        console.info("[alan-agent] Daemon already running", {
+            port: localApiPort,
+            runtimeId: existingProbe.status.runtimeId,
+            connected: existingProbe.status.connected,
+            hint: "If Alan desktop is open, it manages the daemon automatically.",
+        });
+        return;
+    }
+    if (existingProbe.state === "listening_unauthorized") {
+        const adopted = await adoptConfiguredLocalDaemon(args);
+        if (adopted) {
+            console.info("[alan-agent] Daemon already running", {
+                port: localApiPort,
+                runtimeId: adopted.runtimeId,
+                connected: adopted.connected,
+                adopted: true,
+            });
+            return;
+        }
+        console.info("[alan-agent] Daemon already running", {
+            port: localApiPort,
+            hint: `Alan desktop is using a different local API token than ${getConfigPath()}. Quit the desktop app or rerun setup if you need a fresh daemon.`,
+        });
+        return;
+    }
+    const controller = await startDaemon(args);
+    const shutdown = (reason) => {
+        void controller.stop().then(() => process.exit(daemonExternalStopExitCode(reason)), (error) => {
+            console.error("[alan-agent] Shutdown failed; retaining daemon ownership", error);
+            process.exitCode = 1;
+        });
+    };
+    controller.whenExternallyStopped = shutdown;
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    if (process.send) {
+        process.once("disconnect", shutdown);
+        process.on("message", (message) => {
+            if (message &&
+                typeof message === "object" &&
+                "type" in message &&
+                message.type === "alan-daemon-stop")
+                shutdown();
+        });
+        if (!process.connected)
+            shutdown();
+        else
+            process.send({
+                type: "alan-daemon-ready",
+                runtimeId: controller.runtimeId,
+                wsUrl: controller.wsUrl,
+                localApiPort: controller.localApiPort,
+                localApiToken: controller.localApiToken,
+            }, (error) => {
+                if (error)
+                    shutdown();
+            });
+    }
+    await new Promise(() => { });
+}
+/**
+ * Native service plans restart failed processes, but a regular shutdown is
+ * intentional. An identity handoff needs the former so the replacement reads
+ * the newly committed credentials without requiring a manual restart.
+ */
+export function daemonExternalStopExitCode(reason) {
+    return reason === "runtime_identity_changed" ? 1 : 0;
+}
+export async function recoverDaemonConnection(args = [], options) {
+    bindConfigPath(args);
+    const getStatus = async () => {
+        const config = readConfig();
+        const localApiPort = getLocalApiPort(args, config);
+        let live = config.localApiToken
+            ? await probeLocalDaemon(localApiPort, config.localApiToken)
+            : null;
+        if (!live && config.localServiceId && config.localServiceSecret) {
+            live = await adoptConfiguredLocalDaemon(args);
+        }
+        if (live)
+            return { ...live, running: true };
+        return {
+            configured: Boolean(config.runtimeId && config.runtimeToken && config.wsUrl),
+            running: false,
+            connected: false,
+            activeRunCount: 0,
+            activeRunIds: [],
+            staleRunCount: 0,
+        };
+    };
+    const initialStatus = await getStatus();
+    const recovered = await runLocalDaemonRecoveryLadder({
+        initialStatus,
+        getStatus,
+        redial: async () => {
+            const config = readConfig();
+            if (!config.localApiToken)
+                return false;
+            const localApiPort = getLocalApiPort(args, config);
+            const response = await fetch(`http://127.0.0.1:${localApiPort}/reconnect`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${config.localApiToken}` },
+                signal: AbortSignal.timeout(5000),
+            });
+            return response.ok;
+        },
+        restart: async () => {
+            const beforeRestart = await getStatus();
+            const blockingRunCount = beforeRestart.activeRunCount ??
+                Math.max(0, (beforeRestart.activeRunIds?.length ?? 0) - (beforeRestart.staleRunCount ?? 0));
+            if (blockingRunCount > 0)
+                return beforeRestart;
+            if (beforeRestart.running) {
+                await stopDaemon(args);
+                for (let attempt = 0; attempt < 50; attempt += 1) {
+                    await sleep(50);
+                    if (!(await getStatus()).running)
+                        break;
+                }
+                if ((await getStatus()).running) {
+                    throw new Error("The existing local daemon did not stop within the recovery budget.");
+                }
+            }
+            await startDaemon(args);
+            return getStatus();
+        },
+        blockingRunCount: (status) => status.activeRunCount ??
+            Math.max(0, (status.activeRunIds?.length ?? 0) - (status.staleRunCount ?? 0)),
+        options,
+    });
+    console.info(JSON.stringify({ recovery: recovered }, null, 2));
+    return recovered;
+}
+async function drainAndStopLocalDaemonBeforeCredentialCleanup(args, stored) {
+    const localApiPort = getLocalApiPort(args, stored);
+    let localApiToken = stored.localApiToken;
+    let probe = await probeLocalDaemonEndpoint(localApiPort, localApiToken);
+    if (probe.state === "listening_unauthorized") {
+        const adopted = await adoptConfiguredLocalDaemon(args);
+        if (adopted) {
+            localApiToken = readConfig().localApiToken;
+            probe = { state: "running", status: adopted };
+        }
+    }
+    if (probe.state === "absent")
+        return;
+    if (probe.state === "listening_unauthorized" || !localApiToken) {
+        throw new Error(`Logout cannot verify the local daemon on port ${localApiPort}. Stop the local service before removing credentials.`);
+    }
+    const prepare = await fetch(`http://127.0.0.1:${localApiPort}/prepare_logout`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${localApiToken}` },
+        signal: AbortSignal.timeout(5000),
+    });
+    if (prepare.status === 409) {
+        const body = (await prepare.json().catch(() => ({})));
+        const activeRunCount = typeof body.activeRunCount === "number" && Number.isSafeInteger(body.activeRunCount)
+            ? Math.max(1, body.activeRunCount)
+            : 1;
+        throw new Error(`Logout is deferred while ${activeRunCount} active run${activeRunCount === 1 ? "" : "s"} finish. New runs are paused; retry logout afterward.`);
+    }
+    if (!prepare.ok) {
+        throw new Error(`Logout could not safely drain the local daemon (HTTP ${prepare.status}). Stop or update the local service before removing credentials.`);
+    }
+    const shutdown = await requestLocalDaemonShutdown(localApiPort, localApiToken);
+    if (!shutdown.ok) {
+        throw new Error(`Logout could not stop the local daemon (HTTP ${shutdown.status}).`);
+    }
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+        await sleep(50);
+        if ((await probeLocalDaemonEndpoint(localApiPort, localApiToken, 250)).state === "absent") {
+            return;
+        }
+    }
+    throw new Error("Logout could not confirm that the local daemon stopped; credentials were kept.");
+}
+export async function rotateRuntimeToken(args) {
+    bindConfigPath(args);
+    const stored = readConfig();
+    const apiUrl = argValue(args, "--api-url") ?? process.env.ALAN_API_URL ?? stored.apiUrl;
+    const runtimeId = argValue(args, "--runtime-id") ?? process.env.ALAN_RUNTIME_ID ?? stored.runtimeId;
+    const token = argValue(args, "--token") ?? process.env.ALAN_SETUP_TOKEN;
+    if (!apiUrl || !runtimeId || !token) {
+        throw new Error("token rotate requires configured api/runtime plus --token <alan PAT>");
+    }
+    const response = await fetch(`${apiUrl}/public/runtimes/${runtimeId}/tokens/rotate`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}` },
+    });
+    if (!response.ok) {
+        throw new Error(`runtime token rotation failed: HTTP ${response.status}`);
+    }
+    const body = (await response.json());
+    writeConfig({
+        ...stored,
+        apiUrl,
+        runtimeId,
+        runtimeToken: body.runtimeToken,
+        runtimeRenewalToken: body.runtimeRenewalToken,
+        runtimeTokenExpiresAt: body.runtimeTokenExpiresAt,
+    });
+    console.info("[alan-agent] Runtime token rotated", { runtimeId });
+}
+export async function revokeRuntimeToken(args) {
+    bindConfigPath(args);
+    const stored = readConfig();
+    const apiUrl = argValue(args, "--api-url") ?? process.env.ALAN_API_URL ?? stored.apiUrl;
+    const runtimeId = argValue(args, "--runtime-id") ?? process.env.ALAN_RUNTIME_ID ?? stored.runtimeId;
+    const token = argValue(args, "--token") ?? process.env.ALAN_SETUP_TOKEN;
+    if (!apiUrl || !runtimeId || !token) {
+        throw new Error("token revoke requires configured api/runtime plus --token <alan PAT>");
+    }
+    await drainAndStopLocalDaemonBeforeCredentialCleanup(args, stored);
+    const response = await fetch(`${apiUrl}/public/runtimes/${runtimeId}/tokens/revoke`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}` },
+    });
+    if (!response.ok) {
+        throw new Error(`runtime token revoke failed: HTTP ${response.status}`);
+    }
+    removeAlanOwnedLocalArtifacts();
+    console.info("[alan-agent] Runtime token revoked", { runtimeId });
+}
+export async function logoutDaemon(args = []) {
+    bindConfigPath(args);
+    const stored = readConfig();
+    await drainAndStopLocalDaemonBeforeCredentialCleanup(args, stored);
+    removeAlanOwnedLocalArtifacts();
+    console.info("[alan-agent] Runtime config removed", { configPath: getConfigPath() });
+}
+export async function printStatus(args = []) {
+    bindConfigPath(args);
+    const config = readConfig();
+    const configured = Boolean(config.runtimeId && config.runtimeToken && config.wsUrl);
+    const warnings = [];
+    if ((isLocalEndpoint(config.apiUrl) || isLocalEndpoint(config.wsUrl)) &&
+        config.endpointProfile !== "local") {
+        warnings.push("Configured endpoint points at localhost. Use --profile local only for local development.");
+    }
+    const localApiPort = config.localApiPort && config.localApiPort > 0
+        ? config.localApiPort
+        : getLocalApiPort([], config);
+    let localDaemonProbe = config.localApiToken
+        ? await probeLocalDaemonEndpoint(localApiPort, config.localApiToken)
+        : { state: "absent" };
+    if (localDaemonProbe.state !== "running" && config.localServiceId && config.localServiceSecret) {
+        const adopted = await adoptConfiguredLocalDaemon(args);
+        if (adopted)
+            localDaemonProbe = { state: "running", status: adopted };
+    }
+    const localDaemonRunning = localDaemonProbe.state === "running";
+    console.info(JSON.stringify({
+        mode: "runtime",
+        configured,
+        runtimeId: config.runtimeId ?? null,
+        apiUrl: config.apiUrl ?? null,
+        wsUrl: config.wsUrl ?? null,
+        endpointProfile: config.endpointProfile ?? null,
+        localApiPort: config.localApiPort ?? null,
+        localDaemonRunning,
+        hasLocalApiToken: Boolean(config.localApiToken),
+        configPath: getConfigPath(),
+        note: configured
+            ? localDaemonRunning
+                ? "Local daemon is running. Stop it with: alan-agent stop"
+                : "Durable runtime config is present. Start it with: alan-agent daemon"
+            : "No durable runtime configured. Cloud sandbox sessions are launched by Alan with session env vars and do not appear in this local config.",
+        warnings,
+    }, null, 2));
+}
+export async function printDoctor(args = []) {
+    bindConfigPath(args);
+    const config = readConfig();
+    const capabilities = discoverCapabilities();
+    let synced = false;
+    let syncError = null;
+    if (args.includes("--sync")) {
+        if (!config.apiUrl || !config.runtimeId || !config.runtimeToken) {
+            throw new Error("doctor --sync requires configured apiUrl, runtimeId, and runtimeToken. Run setup first.");
+        }
+        const response = await fetch(`${config.apiUrl}/public/runtimes/${config.runtimeId}/capabilities/self`, {
+            method: "PATCH",
+            headers: {
+                authorization: `Bearer ${config.runtimeToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                capabilities,
+                metadata: {
+                    ...(await collectRuntimeMetadataWithProviderLimits()),
+                    ...(config.installationId ? { installationId: config.installationId } : {}),
+                },
+            }),
+        });
+        if (!response.ok) {
+            syncError = `${response.status} ${await response.text()}`;
+            throw new Error(`doctor sync failed: ${syncError}`);
+        }
+        synced = true;
+    }
+    console.info(JSON.stringify({
+        version: AGENT_VERSION,
+        configPath: getConfigPath(),
+        configured: Boolean(config.runtimeId && config.runtimeToken && config.wsUrl),
+        runtimeId: config.runtimeId ?? null,
+        apiUrl: config.apiUrl ?? null,
+        wsUrl: config.wsUrl ?? null,
+        endpointProfile: config.endpointProfile ?? null,
+        warnings: (isLocalEndpoint(config.apiUrl) || isLocalEndpoint(config.wsUrl)) &&
+            config.endpointProfile !== "local"
+            ? [
+                "Configured endpoint points at localhost. Use --profile local only for local development.",
+            ]
+            : [],
+        synced,
+        syncError,
+        capabilities,
+    }, null, 2));
+}
+//# sourceMappingURL=daemon.js.map