@alan-ai-hq/agent-manager 0.1.113 → 0.1.115

package/dist/service-manager.js

@@ -0,0 +1,1065 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { homedir, platform, userInfo } from "node:os";
+import { dirname, join, resolve, win32 } from "node:path";
+import { acquireLocalDaemonMaintenanceLease, inspectLocalDaemonRunJournal, probeLocalDaemonEndpoint, readLocalDaemonOwnerLease, releaseLocalDaemonMaintenanceLease, requestLocalDaemonShutdown, } from "./daemon-local-control.js";
+import { configExistsAtPath, resolveAgentConfigDirectory, resolveAgentConfigPath, resolveEndpointProfileFromArgs, } from "./runtime-config.js";
+const SERVICE_LABEL = "ai.tryalan.agent";
+const SYSTEMD_UNIT = "alan-agent.service";
+const WINDOWS_TASK = "Alan Agent";
+const STOP_POLL_INTERVAL_MS = 200;
+function xml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&apos;");
+}
+function systemdArg(value) {
+    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function powershellLiteral(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function powershellCommand(script, tolerateFailure = false) {
+    return {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", script],
+        tolerateFailure,
+    };
+}
+function windowsCommandLineArgument(value) {
+    if (value && !/[\s"]/u.test(value))
+        return value;
+    const escaped = value
+        .replace(/(\\*)"/gu, (_match, slashes) => `${slashes}${slashes}\\"`)
+        .replace(/\\+$/u, (slashes) => `${slashes}${slashes}`);
+    return `"${escaped}"`;
+}
+function serviceNames(profile) {
+    if (profile === "production") {
+        return { launchd: SERVICE_LABEL, systemd: SYSTEMD_UNIT, windows: WINDOWS_TASK };
+    }
+    const suffix = profile === "custom" ? "prod" : profile;
+    const title = `${suffix[0]?.toUpperCase()}${suffix.slice(1)}`;
+    return {
+        launchd: `${SERVICE_LABEL}.${suffix}`,
+        systemd: `alan-agent-${suffix}.service`,
+        windows: `${WINDOWS_TASK} ${title}`,
+    };
+}
+export function buildDaemonServicePlan(input) {
+    const daemonArgs = [input.nodeExecutable, input.cliEntry, "daemon", "--profile", input.profile];
+    const names = serviceNames(input.profile);
+    if (input.platform === "darwin") {
+        const userId = input.userId ?? process.getuid?.();
+        if (userId === undefined)
+            throw new Error("Cannot determine the current macOS user ID");
+        const domain = `gui/${userId}`;
+        const serviceTarget = `${domain}/${names.launchd}`;
+        const manifestPath = join(input.homeDir, "Library", "LaunchAgents", `${names.launchd}.plist`);
+        const logDir = join(resolveAgentConfigDirectory(input.profile, input.homeDir), "logs");
+        const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
+        const environmentEntries = Object.entries(input.environment ?? {})
+            .map(([key, value]) => `    <key>${xml(key)}</key>\n    <string>${xml(value)}</string>`)
+            .join("\n");
+        const environmentBlock = environmentEntries
+            ? `  <key>EnvironmentVariables</key>\n  <dict>\n${environmentEntries}\n  </dict>\n`
+            : "";
+        const manifest = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${names.launchd}</string>
+  <key>ProgramArguments</key>
+  <array>
+${programArguments}
+  </array>
+${environmentBlock}  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>StandardOutPath</key>
+  <string>${xml(join(logDir, "daemon.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${xml(join(logDir, "daemon-error.log"))}</string>
+</dict>
+</plist>
+`;
+        return {
+            platform: "darwin",
+            manifestPath,
+            manifest,
+            logDirectory: logDir,
+            loadDefinitionCommands: [
+                {
+                    command: "launchctl",
+                    args: ["bootstrap", domain, manifestPath],
+                    tolerateFailure: true,
+                },
+            ],
+            reloadDefinitionCommands: [
+                {
+                    command: "launchctl",
+                    args: ["bootout", domain, manifestPath],
+                    tolerateFailure: true,
+                },
+                {
+                    command: "launchctl",
+                    args: ["bootstrap", domain, manifestPath],
+                    tolerateFailure: false,
+                },
+            ],
+            enableCommands: [
+                {
+                    command: "launchctl",
+                    args: ["enable", serviceTarget],
+                    tolerateFailure: true,
+                },
+            ],
+            startCommands: [
+                {
+                    command: "launchctl",
+                    args: ["kickstart", serviceTarget],
+                    tolerateFailure: false,
+                },
+            ],
+            stopCommands: [
+                {
+                    command: "launchctl",
+                    args: ["kill", "SIGTERM", serviceTarget],
+                    tolerateFailure: true,
+                },
+            ],
+            forceStopCommands: [
+                {
+                    command: "launchctl",
+                    args: ["bootout", domain, manifestPath],
+                    tolerateFailure: true,
+                },
+            ],
+            uninstallCommands: [
+                {
+                    command: "launchctl",
+                    args: ["bootout", domain, manifestPath],
+                    tolerateFailure: true,
+                },
+            ],
+            statusCommand: {
+                command: "launchctl",
+                args: ["print", serviceTarget],
+                tolerateFailure: true,
+            },
+            isActiveCommand: {
+                command: "launchctl",
+                args: ["print", serviceTarget],
+                tolerateFailure: true,
+            },
+        };
+    }
+    if (input.platform === "linux") {
+        const manifestPath = join(input.homeDir, ".config", "systemd", "user", names.systemd);
+        const environmentLines = Object.entries(input.environment ?? {})
+            .map(([key, value]) => `Environment=${systemdArg(`${key}=${value}`)}`)
+            .join("\n");
+        const manifest = `[Unit]
+Description=Alan local agent daemon
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=simple
+${environmentLines ? `${environmentLines}\n` : ""}ExecStart=${daemonArgs.map(systemdArg).join(" ")}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+        return {
+            platform: "linux",
+            manifestPath,
+            manifest,
+            logDirectory: null,
+            loadDefinitionCommands: [
+                {
+                    command: "systemctl",
+                    args: ["--user", "daemon-reload"],
+                    tolerateFailure: false,
+                },
+            ],
+            reloadDefinitionCommands: [
+                {
+                    command: "systemctl",
+                    args: ["--user", "daemon-reload"],
+                    tolerateFailure: false,
+                },
+            ],
+            enableCommands: [
+                {
+                    command: "systemctl",
+                    args: ["--user", "enable", names.systemd],
+                    tolerateFailure: false,
+                },
+            ],
+            startCommands: [
+                {
+                    command: "systemctl",
+                    args: ["--user", "start", names.systemd],
+                    tolerateFailure: false,
+                },
+            ],
+            stopCommands: [
+                {
+                    command: "systemctl",
+                    args: ["--user", "stop", names.systemd],
+                    tolerateFailure: true,
+                },
+            ],
+            forceStopCommands: [],
+            uninstallCommands: [
+                {
+                    command: "systemctl",
+                    args: ["--user", "disable", "--now", names.systemd],
+                    tolerateFailure: true,
+                },
+                {
+                    command: "systemctl",
+                    args: ["--user", "daemon-reload"],
+                    tolerateFailure: false,
+                },
+            ],
+            statusCommand: {
+                command: "systemctl",
+                args: ["--user", "status", names.systemd, "--no-pager"],
+                tolerateFailure: true,
+            },
+            isActiveCommand: {
+                command: "systemctl",
+                args: ["--user", "is-active", names.systemd],
+                tolerateFailure: true,
+            },
+        };
+    }
+    const logDir = win32.join(resolveAgentConfigDirectory(input.profile, input.homeDir), "logs");
+    const legacyEnvironmentPrefix = Object.entries(input.environment ?? {})
+        .map(([key, value]) => `$env:${key} = ${powershellLiteral(value)}`)
+        .join("; ");
+    const legacyDirectArguments = [input.cliEntry, "daemon", "--profile", input.profile]
+        .map((part) => (part.includes(" ") ? `"${part}"` : part))
+        .join(" ");
+    const legacyExecutable = legacyEnvironmentPrefix ? "powershell.exe" : input.nodeExecutable;
+    const legacyArguments = legacyEnvironmentPrefix
+        ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${legacyEnvironmentPrefix}; & ${powershellLiteral(input.nodeExecutable)} ${powershellLiteral(input.cliEntry)} daemon --profile ${input.profile}"`
+        : legacyDirectArguments;
+    const daemonArguments = [input.cliEntry, "daemon", "--profile", input.profile]
+        .map(windowsCommandLineArgument)
+        .join(" ");
+    const environmentStatements = Object.entries(input.environment ?? {}).map(([key, value]) => `$startInfo.EnvironmentVariables[${powershellLiteral(key)}] = ${powershellLiteral(value)}`);
+    const launcherScript = [
+        "$ErrorActionPreference = 'Stop'",
+        "$startInfo = [System.Diagnostics.ProcessStartInfo]::new()",
+        `$startInfo.FileName = ${powershellLiteral(input.nodeExecutable)}`,
+        `$startInfo.Arguments = ${powershellLiteral(daemonArguments)}`,
+        `$startInfo.WorkingDirectory = ${powershellLiteral(win32.dirname(input.cliEntry))}`,
+        "$startInfo.UseShellExecute = $false",
+        "$startInfo.CreateNoWindow = $true",
+        "$startInfo.RedirectStandardOutput = $true",
+        "$startInfo.RedirectStandardError = $true",
+        ...environmentStatements,
+        `$stdout = [System.IO.File]::Open(${powershellLiteral(win32.join(logDir, "daemon-launcher.log"))}, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::ReadWrite)`,
+        `$stderr = [System.IO.File]::Open(${powershellLiteral(win32.join(logDir, "daemon-launcher-error.log"))}, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::ReadWrite)`,
+        "$process = [System.Diagnostics.Process]::new()",
+        "$process.StartInfo = $startInfo",
+        "try { if (-not $process.Start()) { throw 'Alan daemon process did not start' }; $stdoutCopy = $process.StandardOutput.BaseStream.CopyToAsync($stdout); $stderrCopy = $process.StandardError.BaseStream.CopyToAsync($stderr); $process.WaitForExit(); [System.Threading.Tasks.Task]::WaitAll([System.Threading.Tasks.Task[]]@($stdoutCopy, $stderrCopy)); $exitCode = $process.ExitCode } finally { $stdout.Dispose(); $stderr.Dispose(); $process.Dispose() }",
+        "exit $exitCode",
+    ].join("; ");
+    const executable = powershellLiteral("powershell.exe");
+    const launcherArguments = `-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(launcherScript, "utf16le").toString("base64")}`;
+    const settingsScript = "New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries";
+    const ownerMarker = `Alan daemon owner v1 ${createHash("sha256")
+        .update(JSON.stringify({
+        executable: input.nodeExecutable,
+        cliEntry: input.cliEntry,
+        profile: input.profile,
+        taskBaseName: names.windows,
+    }))
+        .digest("hex")}`;
+    const definitionMarker = `${ownerMarker}; definition v3 ${createHash("sha256")
+        .update(JSON.stringify({
+        executable: "powershell.exe",
+        launcherArguments,
+        workingDirectory: win32.dirname(input.cliEntry),
+        settingsScript,
+        taskBaseName: names.windows,
+    }))
+        .digest("hex")}`;
+    const windowsDefinitionContext = [
+        `$expectedLauncherArguments = ${powershellLiteral(launcherArguments)}`,
+        `$expectedWorkingDirectory = ${powershellLiteral(win32.dirname(input.cliEntry))}`,
+        `$expectedOwnerMarker = ${powershellLiteral(`${ownerMarker};`)}`,
+        `$expectedDefinitionMarker = ${powershellLiteral(definitionMarker)}`,
+        `$expectedLegacyExecutable = ${powershellLiteral(legacyExecutable)}`,
+        `$expectedLegacyArguments = ${powershellLiteral(legacyArguments)}`,
+    ].join("; ");
+    const taskContext = [
+        "$currentIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()",
+        "$currentUser = $currentIdentity.Name",
+        "$currentSid = $currentIdentity.User.Value",
+        `$taskName = ${powershellLiteral(names.windows)} + ' ' + $currentSid`,
+    ].join("; ");
+    const resolveTaskSid = "function Resolve-TaskSid([string]$value) { try { return ([System.Security.Principal.NTAccount]$value).Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { try { return [System.Security.Principal.SecurityIdentifier]::new($value).Value } catch { return '' } } }";
+    const currentLookup = "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]";
+    const checkCurrentOwnership = [
+        currentLookup,
+        "$currentOwned = $false",
+        "if ($null -ne $task) { try {",
+        "$taskAction = @($task.Actions)[0]",
+        "$currentOwned = @($task.Actions).Count -eq 1 -and (Resolve-TaskSid ([string]$task.Principal.UserId)) -eq $currentSid -and (([string]$task.Description).StartsWith($expectedOwnerMarker, [System.StringComparison]::Ordinal) -or (([string]$taskAction.Execute) -ieq 'powershell.exe' -and ([string]$taskAction.Arguments) -ceq $expectedLauncherArguments -and ([string]$taskAction.WorkingDirectory) -ieq $expectedWorkingDirectory))",
+        "} catch { $currentOwned = $false } }",
+    ].join("; ");
+    const legacyLookup = `$legacyTask = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq ${powershellLiteral(names.windows)} })[0]`;
+    const checkLegacyOwnership = [
+        legacyLookup,
+        "$legacyOwned = $false",
+        "$legacyState = 'Missing'",
+        "if ($null -ne $legacyTask) { try {",
+        "$legacyState = [string]$legacyTask.State",
+        "$legacySid = Resolve-TaskSid ([string]$legacyTask.Principal.UserId)",
+        "$legacyAction = @($legacyTask.Actions)[0]",
+        "if ($null -ne $legacyAction) {",
+        "$legacyOwned = $legacySid -eq $currentSid -and @($legacyTask.Actions).Count -eq 1 -and ((([string]$legacyAction.Execute) -ieq $expectedLegacyExecutable -and ([string]$legacyAction.Arguments) -ieq $expectedLegacyArguments -and ([string]$legacyAction.WorkingDirectory) -eq '') -or (([string]$legacyAction.Execute) -ieq 'powershell.exe' -and ([string]$legacyAction.Arguments) -ceq $expectedLauncherArguments -and ([string]$legacyAction.WorkingDirectory) -ieq $expectedWorkingDirectory))",
+        "}",
+        "} catch { $legacyOwned = $false } }",
+    ].join("; ");
+    const assertOwnedTasks = [
+        checkCurrentOwnership,
+        checkLegacyOwnership,
+        `if ($null -ne $task -and -not $currentOwned) { throw ${powershellLiteral(`${names.windows} task is not owned by this Alan installation`)} }`,
+        `if ($null -ne $legacyTask -and -not $legacyOwned) { throw ${powershellLiteral(`Legacy ${names.windows} task is not owned by this Alan installation`)} }`,
+        "if ($null -ne $task -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$task.State)) { throw 'Alan daemon task became active or has unknown state' }",
+        "if ($null -ne $legacyTask -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$legacyTask.State)) { throw 'Legacy Alan daemon task became active or has unknown state' }",
+    ].join("; ");
+    const cleanupLegacyTask = [
+        checkLegacyOwnership,
+        `if ($null -ne $legacyTask -and -not $legacyOwned) { throw ${powershellLiteral(`Legacy ${names.windows} task is not owned by this Alan installation`)} }`,
+        "if ($null -ne $legacyTask -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$legacyTask.State)) { throw 'Legacy Alan daemon task became active or has unknown state' }",
+        `if ($null -ne $legacyTask) { Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -TaskPath '\\' -Confirm:$false -ErrorAction Stop }`,
+        `$legacyRemaining = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq ${powershellLiteral(names.windows)} })[0]`,
+        "if ($null -ne $legacyRemaining) { throw 'Legacy Alan daemon task still exists after migration' }",
+    ].join("; ");
+    const registerScript = [
+        taskContext,
+        resolveTaskSid,
+        windowsDefinitionContext,
+        `$action = New-ScheduledTaskAction -Execute ${executable} -Argument $expectedLauncherArguments -WorkingDirectory $expectedWorkingDirectory`,
+        "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $currentUser",
+        "$principal = New-ScheduledTaskPrincipal -UserId $currentUser -LogonType Interactive -RunLevel Limited",
+        `$settings = ${settingsScript}`,
+        assertOwnedTasks,
+        "Register-ScheduledTask -TaskName $taskName -Description $expectedDefinitionMarker -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force -ErrorAction Stop | Out-Null",
+        cleanupLegacyTask,
+        "$registeredTask = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
+        "if ($null -eq $registeredTask -or $registeredTask.Description -cne $expectedDefinitionMarker) { throw 'Alan daemon task definition was not applied' }",
+    ].join("; ");
+    const uninstallScript = [
+        taskContext,
+        resolveTaskSid,
+        windowsDefinitionContext,
+        assertOwnedTasks,
+        "if ($null -ne $legacyTask) { Unregister-ScheduledTask -TaskName $legacyTask.TaskName -TaskPath $legacyTask.TaskPath -Confirm:$false -ErrorAction Stop }",
+        "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
+        "if ($null -ne $task) { Unregister-ScheduledTask -TaskName $taskName -TaskPath '\\' -Confirm:$false -ErrorAction Stop }",
+        "$remaining = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and ($_.TaskName -eq $taskName -or $_.TaskName -eq $legacyTask.TaskName) })",
+        "if ($remaining.Count -gt 0) { throw 'Alan daemon task still exists after unregister' }",
+    ].join("; ");
+    const statusScript = [
+        taskContext,
+        resolveTaskSid,
+        windowsDefinitionContext,
+        checkCurrentOwnership,
+        checkLegacyOwnership,
+        "$definitionMatches = $false",
+        "if ($null -eq $task) { Write-Output 'State: Missing' } else {",
+        "$taskTrigger = @($task.Triggers)[0]",
+        "$definitionMatches = @($task.Actions).Count -eq 1 -and @($task.Triggers).Count -eq 1 -and $task.Description -ceq $expectedDefinitionMarker -and (Resolve-TaskSid ([string]$task.Principal.UserId)) -eq $currentSid -and [string]$task.Principal.LogonType -eq 'Interactive' -and [string]$task.Principal.RunLevel -eq 'Limited' -and [string]$taskAction.Execute -ieq 'powershell.exe' -and [string]$taskAction.Arguments -ceq $expectedLauncherArguments -and [string]$taskAction.WorkingDirectory -ieq $expectedWorkingDirectory -and $taskTrigger.CimClass.CimClassName -eq 'MSFT_TaskLogonTrigger' -and (Resolve-TaskSid ([string]$taskTrigger.UserId)) -eq $currentSid -and -not $task.Settings.DisallowStartIfOnBatteries -and -not $task.Settings.StopIfGoingOnBatteries -and $task.Settings.RestartCount -eq 3 -and [string]$task.Settings.RestartInterval -eq 'PT1M' -and [string]$task.Settings.ExecutionTimeLimit -eq 'PT0S'",
+        "Write-Output ('TaskName: ' + $task.TaskName); Write-Output ('State: ' + $task.State); Write-Output ('Definition: ' + $task.Description)",
+        "}",
+        "Write-Output ('DefinitionMatch: ' + $definitionMatches)",
+        "Write-Output ('CurrentOwned: ' + $currentOwned)",
+        "$legacyPresent = $null -ne $legacyTask",
+        "Write-Output ('LegacyTask: ' + $legacyPresent)",
+        "Write-Output ('LegacyOwned: ' + $legacyOwned)",
+        "Write-Output ('LegacyState: ' + $legacyState)",
+    ].join("; ");
+    const registerCommand = powershellCommand(registerScript);
+    return {
+        platform: "win32",
+        manifestPath: null,
+        manifest: null,
+        logDirectory: logDir,
+        loadDefinitionCommands: [registerCommand],
+        reloadDefinitionCommands: [registerCommand],
+        enableCommands: [],
+        startCommands: [powershellCommand(`${taskContext}; Start-ScheduledTask -TaskName $taskName`)],
+        stopCommands: [
+            powershellCommand(`${taskContext}; Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue`, true),
+        ],
+        forceStopCommands: [],
+        uninstallCommands: [powershellCommand(uninstallScript)],
+        statusCommand: powershellCommand(statusScript, true),
+        isActiveCommand: powershellCommand(statusScript, true),
+        definitionMarker,
+    };
+}
+function resolveCurrentPlatform() {
+    const currentPlatform = platform();
+    if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
+        throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
+    }
+    return currentPlatform;
+}
+function currentServicePlan(args, runtime, options = {}) {
+    const currentPlatform = options.platform ?? resolveCurrentPlatform();
+    const profile = resolveEndpointProfileFromArgs(args);
+    const cliEntry = runtime?.cliEntry ?? process.argv[1];
+    if (!cliEntry)
+        throw new Error("Cannot determine the alan-agent executable path");
+    return buildDaemonServicePlan({
+        platform: currentPlatform,
+        homeDir: options.homeDir ?? homedir(),
+        userId: options.userId,
+        nodeExecutable: runtime?.executable ?? process.execPath,
+        cliEntry: currentPlatform === "win32" ? win32.resolve(cliEntry) : resolve(cliEntry),
+        profile,
+        environment: runtime?.environment,
+    });
+}
+function writeManifestAtomic(path, contents) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const pendingPath = `${path}.pending-${process.pid}`;
+    try {
+        writeFileSync(pendingPath, contents, { mode: 0o600 });
+        chmodSync(pendingPath, 0o600);
+        renameSync(pendingPath, path);
+    }
+    finally {
+        rmSync(pendingPath, { force: true });
+    }
+}
+function defaultReadManifest(path) {
+    if (!existsSync(path))
+        return null;
+    return readFileSync(path, "utf8");
+}
+export function runServiceCommand(command, options = {}) {
+    return new Promise((resolveCommand, reject) => {
+        execFile(command.command, command.args, {
+            encoding: "utf8",
+            shell: false,
+            windowsHide: true,
+            timeout: options.commandTimeoutMs ?? 10_000,
+            killSignal: "SIGKILL",
+            maxBuffer: 256 * 1024,
+            signal: options.signal,
+        }, (error, stdout, stderr) => {
+            const status = error ? (typeof error.code === "number" ? error.code : 1) : 0;
+            const output = `${stdout ?? ""}${stderr ?? ""}`.trim();
+            if (error && (!command.tolerateFailure || error.killed || error.name === "AbortError")) {
+                reject(new Error(`Service command failed (${command.command}): ${output || error.message}`, {
+                    cause: error,
+                }));
+            }
+            else {
+                resolveCommand({ status, output: output || error?.message || "" });
+            }
+        });
+    });
+}
+function defaultSleep(ms) {
+    return new Promise((resolveSleep) => {
+        setTimeout(resolveSleep, ms);
+    });
+}
+function isProcessAlive(pid) {
+    if (pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+async function requestWindowsDaemonShutdown(owner) {
+    try {
+        const response = await requestLocalDaemonShutdown(owner.localApiPort, owner.localApiToken);
+        return response.ok ? "accepted" : "rejected";
+    }
+    catch {
+        return "unreachable";
+    }
+}
+export function parseServiceHostState(servicePlatform, result) {
+    const output = result.output;
+    // `systemctl is-active` deliberately exits non-zero for known inactive
+    // states. Parse those states before treating other command failures as
+    // unknown, otherwise a fresh enabled unit is never started.
+    if (servicePlatform === "linux") {
+        const trimmed = output.trim().toLowerCase();
+        if (trimmed === "inactive" ||
+            trimmed === "failed" ||
+            trimmed === "dead" ||
+            /\binactive\b/i.test(output) ||
+            /\bfailed\b/i.test(output)) {
+            return "stopped";
+        }
+    }
+    if (result.status !== 0)
+        return "unknown";
+    if (servicePlatform === "darwin") {
+        if (/\bstate\s*=\s*running\b/i.test(output))
+            return "running";
+        if (/\bstate\s*=\s*(not running|waiting|stopped)\b/i.test(output))
+            return "stopped";
+        if (/\bpid\s*=\s*[1-9]\d*\b/i.test(output))
+            return "running";
+        if (/could not find service/i.test(output))
+            return "stopped";
+        return "unknown";
+    }
+    if (servicePlatform === "linux") {
+        const trimmed = output.trim().toLowerCase();
+        if (trimmed === "active" || /\bactive\s*\(running\)/i.test(output))
+            return "running";
+        if (trimmed === "activating" || trimmed === "reloading")
+            return "starting";
+        return "unknown";
+    }
+    const stateMatch = output.match(/\b(?:State|state)\s*[:=]\s*(\w+)/);
+    const state = (stateMatch?.[1] ?? output.trim()).toLowerCase();
+    if (state === "running")
+        return "running";
+    if (state === "queued")
+        return "starting";
+    if (state === "ready" || state === "disabled")
+        return "stopped";
+    return "unknown";
+}
+function parseWindowsTaskInspection(result) {
+    if (result.status !== 0) {
+        throw new Error("Cannot inspect Windows daemon task definition");
+    }
+    const value = (name) => {
+        const match = result.output.match(new RegExp(`^${name}:\\s*(.*)$`, "imu"));
+        if (!match)
+            throw new Error(`Incomplete Windows daemon task inspection: missing ${name}`);
+        return match[1]?.trim() ?? "";
+    };
+    const boolean = (name) => {
+        const parsed = value(name).toLowerCase();
+        if (parsed === "true")
+            return true;
+        if (parsed === "false")
+            return false;
+        throw new Error(`Incomplete Windows daemon task inspection: invalid ${name}`);
+    };
+    const currentPresent = /^TaskName:\s*.+$/imu.test(result.output);
+    const currentStateValue = value("State");
+    const currentOwned = boolean("CurrentOwned");
+    const definitionMatches = boolean("DefinitionMatch");
+    const legacyPresent = boolean("LegacyTask");
+    const legacyOwned = boolean("LegacyOwned");
+    const legacyStateValue = value("LegacyState");
+    if (currentPresent !== (currentStateValue.toLowerCase() !== "missing")) {
+        throw new Error("Incomplete Windows daemon task inspection: inconsistent current task state");
+    }
+    if (!currentPresent && (currentOwned || definitionMatches)) {
+        throw new Error("Incomplete Windows daemon task inspection: absent current task is marked owned");
+    }
+    if (legacyPresent !== (legacyStateValue.toLowerCase() !== "missing") ||
+        (!legacyPresent && legacyOwned)) {
+        throw new Error("Incomplete Windows daemon task inspection: inconsistent legacy task state");
+    }
+    return {
+        currentPresent,
+        currentOwned,
+        currentState: currentPresent
+            ? parseServiceHostState("win32", { status: 0, output: currentStateValue })
+            : "stopped",
+        definitionMatches,
+        definitionMarker: result.output.match(/^Definition:\s*(.+)$/imu)?.[1]?.trim(),
+        legacyPresent,
+        legacyOwned,
+        legacyState: legacyPresent
+            ? parseServiceHostState("win32", { status: 0, output: legacyStateValue })
+            : "stopped",
+    };
+}
+function windowsTaskHostState(tasks) {
+    const states = [tasks.currentState, tasks.legacyState];
+    if (states.includes("unknown"))
+        return "unknown";
+    if (states.includes("running"))
+        return "running";
+    if (states.includes("starting"))
+        return "starting";
+    return "stopped";
+}
+function assertWindowsTaskOwnership(tasks) {
+    if (tasks.currentPresent && !tasks.currentOwned) {
+        throw new Error("Windows daemon task is not owned by this Alan installation");
+    }
+    if (tasks.legacyPresent && !tasks.legacyOwned) {
+        throw new Error("Legacy Windows daemon task is not owned by this Alan installation");
+    }
+}
+export function resolveEnsureDefinitionOutcome(input) {
+    if (!input.definitionChanged) {
+        return { changed: false, updatePending: false };
+    }
+    if (input.hostState === "running" || input.hostState === "starting") {
+        return { changed: true, updatePending: true };
+    }
+    return { changed: true, updatePending: false };
+}
+function resolveUsername(options) {
+    if (options?.username)
+        return options.username;
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return process.env.USER || process.env.USERNAME || "unknown";
+    }
+}
+async function assertSystemdUserLingerEnabled(options = {}) {
+    const username = resolveUsername(options);
+    const run = options.runCommand ?? ((command) => runServiceCommand(command, options));
+    const result = await run({
+        command: "loginctl",
+        args: ["show-user", username, "-p", "Linger"],
+        tolerateFailure: true,
+    });
+    if (result.status !== 0) {
+        throw new Error(`Cannot verify systemd user linger for ${username} (loginctl failed). ` +
+            `For durable headless VM boot run: sudo loginctl enable-linger ${username}`);
+    }
+    if (!/Linger=yes/i.test(result.output)) {
+        throw new Error(`systemd user linger is disabled for ${username}. ` +
+            `For durable headless VM boot run: sudo loginctl enable-linger ${username}`);
+    }
+}
+function createHostContext(options = {}) {
+    const args = options.args ?? [];
+    const plan = currentServicePlan(args, options.runtime, options);
+    const sleep = options.sleep ?? defaultSleep;
+    const nowMs = options.nowMs ?? Date.now;
+    const run = async (command) => {
+        const remainingMs = options.deadlineMs === undefined ? 15_000 : options.deadlineMs - nowMs();
+        if (remainingMs <= 0)
+            throw new Error("Windows service setup deadline expired");
+        const result = options.runCommand
+            ? await options.runCommand(command)
+            : await runServiceCommand(command, {
+                signal: options.signal,
+                commandTimeoutMs: Math.min(options.commandTimeoutMs ?? 10_000, remainingMs),
+            });
+        if (options.deadlineMs !== undefined && nowMs() >= options.deadlineMs) {
+            throw new Error("Windows service setup deadline expired");
+        }
+        return result;
+    };
+    const readManifest = options.readManifest ?? defaultReadManifest;
+    const writeManifest = options.writeManifest ?? writeManifestAtomic;
+    const removeManifest = options.removeManifest ?? ((path) => rmSync(path, { force: true }));
+    const ensureLogDir = options.ensureLogDir ??
+        (() => {
+            if (plan.logDirectory)
+                mkdirSync(plan.logDirectory, { recursive: true, mode: 0o700 });
+        });
+    return {
+        args,
+        plan,
+        run,
+        sleep,
+        nowMs,
+        readManifest,
+        writeManifest,
+        removeManifest,
+        ensureLogDir,
+        configPath: options.configPath ??
+            resolveAgentConfigPath({ profile: resolveEndpointProfileFromArgs(args) }),
+        readOwner: options.readOwner ?? readLocalDaemonOwnerLease,
+        isProcessAlive: options.isProcessAlive ?? isProcessAlive,
+        probeEndpoint: options.probeEndpoint ?? probeLocalDaemonEndpoint,
+        requestWindowsShutdown: options.requestWindowsShutdown ?? requestWindowsDaemonShutdown,
+        inspectJournal: options.inspectJournal ?? inspectLocalDaemonRunJournal,
+        acquireMaintenance: options.acquireMaintenance ?? acquireLocalDaemonMaintenanceLease,
+        releaseMaintenance: options.releaseMaintenance ?? releaseLocalDaemonMaintenanceLease,
+    };
+}
+export async function inspectDaemonService(options = {}) {
+    const { plan, run, nowMs } = createHostContext(options);
+    const result = await run(plan.isActiveCommand);
+    let state;
+    if (plan.platform === "win32") {
+        try {
+            const tasks = parseWindowsTaskInspection(result);
+            assertWindowsTaskOwnership(tasks);
+            state = windowsTaskHostState(tasks);
+        }
+        catch {
+            state = "unknown";
+        }
+    }
+    else {
+        state = parseServiceHostState(plan.platform, result);
+    }
+    return {
+        state,
+        platform: plan.platform,
+        detail: result.output || undefined,
+        observedAtMs: nowMs(),
+    };
+}
+export async function ensureDaemonServiceDefinition(options = {}) {
+    const ctx = createHostContext(options);
+    const { plan, run, nowMs, readManifest, writeManifest, ensureLogDir } = ctx;
+    let definitionChanged = false;
+    let inspection;
+    if (plan.manifestPath && plan.manifest) {
+        ensureLogDir();
+        const existing = readManifest(plan.manifestPath);
+        definitionChanged = existing !== plan.manifest;
+        if (definitionChanged) {
+            writeManifest(plan.manifestPath, plan.manifest);
+        }
+    }
+    else if (plan.platform === "win32") {
+        ensureLogDir();
+        const result = await run(plan.statusCommand);
+        const tasks = parseWindowsTaskInspection(result);
+        assertWindowsTaskOwnership(tasks);
+        if ((tasks.currentPresent && tasks.currentState === "unknown") ||
+            (tasks.legacyPresent && tasks.legacyState === "unknown")) {
+            throw new Error("Cannot safely update a Windows daemon task with unknown state");
+        }
+        definitionChanged =
+            tasks.definitionMarker !== plan.definitionMarker ||
+                !tasks.definitionMatches ||
+                tasks.legacyPresent;
+        inspection = {
+            state: windowsTaskHostState(tasks),
+            platform: plan.platform,
+            detail: result.output || undefined,
+            observedAtMs: nowMs(),
+        };
+    }
+    inspection ??= await inspectDaemonService(options);
+    const definitionHostState = plan.platform === "win32" && inspection.state === "starting" ? "stopped" : inspection.state;
+    const outcome = resolveEnsureDefinitionOutcome({
+        definitionChanged,
+        hostState: definitionHostState,
+    });
+    if (outcome.updatePending) {
+        return outcome;
+    }
+    if (plan.platform === "win32" && !outcome.changed) {
+        return outcome;
+    }
+    if (definitionHostState === "running" || definitionHostState === "starting") {
+        return outcome;
+    }
+    const definitionCommands = definitionHostState === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
+    for (const command of definitionCommands)
+        await run(command);
+    return outcome;
+}
+async function enableDaemonService(options = {}) {
+    const { plan, run } = createHostContext(options);
+    for (const command of plan.enableCommands)
+        await run(command);
+}
+async function startDaemonService(options = {}) {
+    const { plan, run } = createHostContext(options);
+    for (const command of plan.startCommands)
+        await run(command);
+}
+export function ownerMatchesDaemonIdentity(owner, identity) {
+    return Boolean(owner &&
+        owner.pid === identity.pid &&
+        owner.daemonSessionId === identity.daemonSessionId &&
+        owner.localApiPort === identity.port &&
+        (identity.serviceId === undefined || owner.localServiceId === identity.serviceId) &&
+        (identity.startedAtMs === undefined || owner.startedAtMs === identity.startedAtMs));
+}
+export async function stopDaemonServiceAndWait(identity, timeoutMs, options = {}) {
+    const { plan, run, sleep, nowMs, configPath, readOwner, isProcessAlive: processIsAlive, probeEndpoint, requestWindowsShutdown: requestShutdown, } = createHostContext(options);
+    let owner;
+    try {
+        owner = readOwner(configPath);
+    }
+    catch {
+        return "identity_changed";
+    }
+    if (!owner || !ownerMatchesDaemonIdentity(owner, identity)) {
+        return "identity_changed";
+    }
+    const deadline = nowMs() + Math.max(0, timeoutMs);
+    if (plan.platform === "win32") {
+        const shutdown = await requestShutdown(owner);
+        if (shutdown === "rejected")
+            return "identity_changed";
+        if (shutdown === "unreachable") {
+            for (const command of plan.stopCommands)
+                await run(command);
+        }
+        while (nowMs() < deadline) {
+            let currentOwner;
+            try {
+                currentOwner = readOwner(configPath);
+            }
+            catch {
+                return "identity_changed";
+            }
+            if (currentOwner && !ownerMatchesDaemonIdentity(currentOwner, identity)) {
+                return "identity_changed";
+            }
+            if (!processIsAlive(identity.pid)) {
+                const endpoint = await probeEndpoint(identity.port, owner.localApiToken, 250);
+                if (endpoint.state === "absent")
+                    return "exited";
+                if (endpoint.state === "listening_unauthorized" ||
+                    endpoint.status.daemonSessionId !== identity.daemonSessionId) {
+                    return "identity_changed";
+                }
+            }
+            await sleep(STOP_POLL_INTERVAL_MS);
+        }
+        return "timeout";
+    }
+    for (const command of plan.stopCommands)
+        await run(command);
+    while (nowMs() < deadline) {
+        let currentOwner;
+        try {
+            currentOwner = readOwner(configPath);
+        }
+        catch {
+            return "identity_changed";
+        }
+        if (currentOwner && !ownerMatchesDaemonIdentity(currentOwner, identity)) {
+            return "identity_changed";
+        }
+        const result = await run(plan.isActiveCommand);
+        const state = parseServiceHostState(plan.platform, result);
+        let processExited = false;
+        if (identity.pid > 0) {
+            try {
+                process.kill(identity.pid, 0);
+            }
+            catch (error) {
+                processExited = error.code === "ESRCH";
+            }
+        }
+        if (processExited && state === "stopped")
+            return "exited";
+        await sleep(Math.max(0, Math.min(STOP_POLL_INTERVAL_MS, deadline - nowMs())));
+    }
+    return "timeout";
+}
+/**
+ * macOS-only escalation for a captured daemon that ignored graceful SIGTERM.
+ * Booting the job out prevents launchd KeepAlive from racing a replacement;
+ * LocalDaemonLifecycle revalidates work and identity immediately before this.
+ */
+export async function forceStopDaemonServiceAndWait(identity, timeoutMs, options = {}) {
+    const { plan, run, sleep, nowMs, configPath, readOwner, isProcessAlive: processIsAlive, } = createHostContext(options);
+    if (plan.platform !== "darwin" || plan.forceStopCommands.length === 0)
+        return "timeout";
+    let owner;
+    try {
+        owner = readOwner(configPath);
+    }
+    catch {
+        return "identity_changed";
+    }
+    if (!owner || !ownerMatchesDaemonIdentity(owner, identity))
+        return "identity_changed";
+    for (const command of plan.forceStopCommands)
+        await run(command);
+    const deadline = nowMs() + Math.max(0, timeoutMs);
+    while (nowMs() < deadline) {
+        let currentOwner;
+        try {
+            currentOwner = readOwner(configPath);
+        }
+        catch {
+            return "identity_changed";
+        }
+        if (currentOwner && !ownerMatchesDaemonIdentity(currentOwner, identity)) {
+            return "identity_changed";
+        }
+        const result = await run(plan.isActiveCommand);
+        const state = parseServiceHostState(plan.platform, result);
+        const serviceAbsent = state === "stopped" ||
+            (result.status !== 0 && /could not find service/iu.test(result.output));
+        if (!processIsAlive(identity.pid) && serviceAbsent)
+            return "exited";
+        await sleep(Math.max(0, Math.min(STOP_POLL_INTERVAL_MS, deadline - nowMs())));
+    }
+    return "timeout";
+}
+export async function uninstallDaemonService(args = [], options = {}) {
+    const ctx = createHostContext({ ...options, args: options.args ?? args });
+    if (ctx.plan.platform === "win32") {
+        const ownership = await ctx.run(ctx.plan.statusCommand);
+        let tasks;
+        try {
+            tasks = parseWindowsTaskInspection(ownership);
+        }
+        catch (error) {
+            throw new Error(`Cannot inspect Windows daemon task ownership before uninstall: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        assertWindowsTaskOwnership(tasks);
+        if (!tasks.currentPresent && !tasks.legacyPresent) {
+            console.info("[alan-agent] Per-user daemon service removed");
+            return;
+        }
+        const acquired = ctx.acquireMaintenance(ctx.configPath, "watchdog", 30_000);
+        if (!acquired.acquired) {
+            throw new Error("Cannot uninstall the Windows daemon service while maintenance is active");
+        }
+        try {
+            const journal = ctx.inspectJournal(ctx.configPath);
+            if (!journal.safeToRestart) {
+                throw new Error(`Windows daemon service uninstall is deferred while ${journal.activeRunCount} active run${journal.activeRunCount === 1 ? "" : "s"} finish`);
+            }
+            let owner;
+            try {
+                owner = ctx.readOwner(ctx.configPath);
+            }
+            catch (error) {
+                throw new Error(`Cannot verify Windows daemon ownership before uninstall: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (owner) {
+                const stopped = await stopDaemonServiceAndWait({
+                    pid: owner.pid,
+                    serviceId: owner.localServiceId,
+                    daemonSessionId: owner.daemonSessionId,
+                    port: owner.localApiPort,
+                    startedAtMs: owner.startedAtMs,
+                }, 10_000, { ...options, args: ctx.args });
+                if (stopped !== "exited") {
+                    throw new Error(stopped === "identity_changed"
+                        ? "Windows daemon ownership changed before uninstall"
+                        : "Timed out waiting for the Windows daemon to stop before uninstall");
+                }
+            }
+            else {
+                if (tasks.currentState !== "stopped" || tasks.legacyState !== "stopped") {
+                    throw new Error("Cannot uninstall a running Windows daemon without verified ownership");
+                }
+            }
+            for (const command of ctx.plan.uninstallCommands)
+                await ctx.run(command);
+        }
+        finally {
+            ctx.releaseMaintenance(ctx.configPath, acquired.lease.id);
+        }
+    }
+    else {
+        for (const command of ctx.plan.uninstallCommands)
+            await ctx.run(command);
+        if (ctx.plan.manifestPath)
+            ctx.removeManifest(ctx.plan.manifestPath);
+    }
+    console.info("[alan-agent] Per-user daemon service removed");
+}
+/**
+ * Compatibility wrapper: ensure definition + enable + start only when stopped.
+ * Never force-restarts an already-running service.
+ */
+export async function installDaemonService(args = [], runtime, options = {}) {
+    const profile = resolveEndpointProfileFromArgs(args);
+    const configPath = resolveAgentConfigPath({ profile });
+    if (!configExistsAtPath(configPath)) {
+        throw new Error(`No ${profile} runtime is configured. Run alan-agent setup or login first.`);
+    }
+    const headless = options.headless ?? args.includes("--headless");
+    const merged = { ...options, args, runtime, headless };
+    const ctx = createHostContext(merged);
+    if (headless) {
+        if (ctx.plan.platform !== "linux") {
+            throw new Error("--headless is only supported on Linux systemd user services");
+        }
+        await assertSystemdUserLingerEnabled(merged);
+    }
+    const ensured = await ensureDaemonServiceDefinition(merged);
+    await enableDaemonService(merged);
+    const inspection = await inspectDaemonService(merged);
+    if (ensured.updatePending) {
+        console.info("[alan-agent] Daemon service definition update pending; leaving running service", {
+            profile,
+            state: inspection.state,
+        });
+        return;
+    }
+    if (inspection.state !== "stopped") {
+        console.info("[alan-agent] Per-user daemon service already present", {
+            profile,
+            state: inspection.state,
+        });
+        return;
+    }
+    await startDaemonService(merged);
+    console.info("[alan-agent] Per-user daemon service installed", { profile });
+}
+export async function printDaemonServiceStatus(args = []) {
+    const plan = currentServicePlan(args);
+    const result = await runServiceCommand({ ...plan.statusCommand, tolerateFailure: true });
+    if (result.status !== 0) {
+        process.stdout.write(`unknown\n${result.output}\n`);
+        return;
+    }
+    process.stdout.write(`${result.output}\n`);
+}
+export function createOsDaemonServiceHost(options = {}) {
+    const host = {
+        async inspect() {
+            return inspectDaemonService(options);
+        },
+        async ensureDefinition() {
+            return ensureDaemonServiceDefinition(options);
+        },
+        async enable() {
+            await enableDaemonService(options);
+        },
+        async start() {
+            await startDaemonService(options);
+        },
+        async stopAndWait(identity, timeoutMs) {
+            return stopDaemonServiceAndWait(identity, timeoutMs, options);
+        },
+        async uninstall() {
+            await uninstallDaemonService(options.args ?? [], options);
+        },
+    };
+    if (currentServicePlan(options.args ?? [], options.runtime, options).platform === "darwin") {
+        host.forceStopAndWait = async (identity, timeoutMs) => forceStopDaemonServiceAndWait(identity, timeoutMs, options);
+    }
+    return host;
+}
+//# sourceMappingURL=service-manager.js.map