@alan-ai-hq/agent-manager 0.1.89 → 0.1.91

package/dist/index.cjs

@@ -15167,6 +15167,10 @@ function hasRunSessionEnv(env) {
     env.ALAN_WS_URL && env.ALAN_SESSION_ID && env.ALAN_TASK_ID && env.ALAN_SESSION_TOKEN && env.ALAN_TASK !== void 0
   );
 }
+function resolveInstallConfigurationMode(args, configured) {
+  if (args.includes("--setup-token")) return "setup";
+  return configured.runtimeId && configured.runtimeToken ? "reuse" : "login";
+}
 function resolveCommand(args, env) {
   const [command, ...commandArgs] = args;
   if (!command) {
@@ -15447,7 +15451,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.89";
+var AGENT_VERSION = "0.1.91";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -35648,14 +35652,14 @@ function configuredConfigPathFromEnvironment() {
   const explicit = process.env.ALAN_AGENT_CONFIG_PATH?.trim() || process.env.ALAN_AGENT_CONFIG?.trim();
   return explicit || void 0;
 }
-function resolveIsolatedAgentBaseDir(profile) {
+function resolveIsolatedAgentBaseDir(profile, homeDirectory2 = (0, import_node_os4.homedir)()) {
   switch (profile) {
     case "local":
-      return (0, import_node_path5.join)((0, import_node_os4.homedir)(), ".alan-dev", "agent");
+      return (0, import_node_path5.join)(homeDirectory2, ".alan-dev", "agent");
     case "staging":
-      return (0, import_node_path5.join)((0, import_node_os4.homedir)(), ".alan-staging", "agent");
+      return (0, import_node_path5.join)(homeDirectory2, ".alan-staging", "agent");
     case "custom":
-      return (0, import_node_path5.join)((0, import_node_os4.homedir)(), ".alan-prod", "agent");
+      return (0, import_node_path5.join)(homeDirectory2, ".alan-prod", "agent");
     default:
       return null;
   }
@@ -35732,6 +35736,9 @@ function migrateLegacyAgentConfig(input2) {
     return false;
   }
 }
+function resolveAgentConfigDirectory(profile = "production", homeDirectory2 = (0, import_node_os4.homedir)()) {
+  return resolveIsolatedAgentBaseDir(profile, homeDirectory2) ?? (0, import_node_path5.join)(homeDirectory2, ".alan", "agent");
+}
 function resolveAgentConfigPath(input2) {
   if (input2?.explicitPath?.trim()) return input2.explicitPath.trim();
   const profile = normalizeAgentEndpointProfile(
@@ -35740,10 +35747,8 @@ function resolveAgentConfigPath(input2) {
   if (input2?.baseDir !== void 0) {
     return (0, import_node_path5.join)(input2.baseDir, resolveAgentConfigFileName(profile));
   }
-  const isolatedBaseDir = profile === "production" ? null : resolveIsolatedAgentBaseDir(profile);
-  if (isolatedBaseDir) return (0, import_node_path5.join)(isolatedBaseDir, "config.json");
-  migrateLegacyAgentConfig({ profile });
-  return (0, import_node_path5.join)(DEFAULT_AGENT_DIR, resolveAgentConfigFileName(profile));
+  if (profile === "production") migrateLegacyAgentConfig({ profile });
+  return (0, import_node_path5.join)(resolveAgentConfigDirectory(profile), "config.json");
 }
 function configExistsAtPath(configPath) {
   return (0, import_node_fs5.existsSync)(configPath);
@@ -42790,6 +42795,7 @@ function buildCodexEffortArgs(selectedEffortLevel, options) {
   return ["-c", `model_reasoning_effort=${level}`];
 }
 var CODEX_STARTUP_TIMEOUT_MS = 3e5;
+var ALAN_MCP_STARTUP_TIMEOUT_SEC = 30;
 function buildCodexManagedMcpArgs(registration) {
   const serverName = managedMcpServerName(registration);
   return [
@@ -42797,7 +42803,11 @@ function buildCodexManagedMcpArgs(registration) {
     "-c",
     `mcp_servers.${serverName}.url=${JSON.stringify(registration.url)}`,
     "-c",
-    `mcp_servers.${serverName}.env_http_headers.x-alan-run-reference=${JSON.stringify(ALAN_RUN_REFERENCE_ENV)}`
+    `mcp_servers.${serverName}.env_http_headers.x-alan-run-reference=${JSON.stringify(ALAN_RUN_REFERENCE_ENV)}`,
+    "-c",
+    `mcp_servers.${serverName}.required=true`,
+    "-c",
+    `mcp_servers.${serverName}.startup_timeout_sec=${ALAN_MCP_STARTUP_TIMEOUT_SEC}`
   ];
 }
 function createCodexRuntimeBackend(command = "codex", defaultArgs = []) {
@@ -49460,7 +49470,7 @@ function bindConfigPath(args) {
   return boundAgentConfigPath;
 }
 function getConfigPath() {
-  return process.env.ALAN_AGENT_CONFIG_PATH ?? boundAgentConfigPath ?? resolveAgentConfigPath({ profile: "production" });
+  return boundAgentConfigPath ?? process.env.ALAN_AGENT_CONFIG_PATH ?? resolveAgentConfigPath({ profile: "production" });
 }
 function getEndpointDefaultsPath() {
   return process.env.ALAN_AGENT_ENDPOINTS_PATH ?? (0, import_node_path11.join)((0, import_node_path11.dirname)(getConfigPath()), "endpoints.json");
@@ -49515,7 +49525,7 @@ function readLocalDaemonMaintenanceLease(configPath, nowMs = Date.now()) {
   if (!(0, import_node_fs13.existsSync)(path2)) return null;
   try {
     const lease = JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
-    if (lease.version !== 1 || typeof lease.id !== "string" || lease.reason !== "credential_cleanup" && lease.reason !== "daemon_startup" && lease.reason !== "watchdog" || !(lease.reason === "credential_cleanup" && lease.expiresAtMs === null || typeof lease.expiresAtMs === "number" && Number.isFinite(lease.expiresAtMs))) {
+    if (lease.version !== 1 || typeof lease.id !== "string" || lease.reason !== "credential_cleanup" && lease.reason !== "credential_swap" && lease.reason !== "daemon_startup" && lease.reason !== "watchdog" || !(lease.reason === "credential_cleanup" && lease.expiresAtMs === null || typeof lease.expiresAtMs === "number" && Number.isFinite(lease.expiresAtMs))) {
       throw new Error("invalid maintenance lease");
     }
     if (lease.reason !== "credential_cleanup" && lease.expiresAtMs <= nowMs) {
@@ -76529,6 +76539,7 @@ async function createRuntimeSetupGrant(input2) {
 }
 async function exchangeRuntimeSetupGrant(input2) {
   const registrationAttemptId = getOrCreateSetupAttemptId(input2.setupToken);
+  const signal = AbortSignal.timeout(15e3);
   const registrationInit = {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -76547,7 +76558,8 @@ async function exchangeRuntimeSetupGrant(input2) {
         ...await collectRuntimeMetadataWithProviderLimits(),
         installationId: input2.installationId
       }
-    })
+    }),
+    signal
   };
   let response;
   let transportError;
@@ -79398,11 +79410,24 @@ async function startDaemon(args) {
     releaseStartupLease();
     throw error61;
   }
+  let runtimeCredentialOperationTail = Promise.resolve();
+  const runCredentialOperation = (operation) => {
+    const result = runtimeCredentialOperationTail.catch(() => {
+    }).then(operation);
+    runtimeCredentialOperationTail = result.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    return result;
+  };
   let runtimeRenewalInFlight = null;
   const renewRuntimeLease = () => {
     if (runtimeRenewalInFlight) return runtimeRenewalInFlight;
-    const attempt = (async () => {
-      if (!stored.apiUrl || !runtimeRenewalToken) {
+    const attempt = runCredentialOperation(async () => {
+      const renewalToken = runtimeRenewalToken;
+      if (!stored.apiUrl || !renewalToken) {
         return false;
       }
       let response = null;
@@ -79412,7 +79437,7 @@ async function startDaemon(args) {
           response = await fetch(`${stored.apiUrl}/public/runtimes/${runtimeId}/tokens/renew`, {
             method: "POST",
             headers: {
-              authorization: `Bearer ${runtimeRenewalToken}`,
+              authorization: `Bearer ${renewalToken}`,
               "content-type": "application/json"
             },
             body: "{}",
@@ -79448,7 +79473,7 @@ async function startDaemon(args) {
         return false;
       }
       const current = readConfig();
-      if (current.runtimeId !== runtimeId || current.runtimeRenewalToken !== runtimeRenewalToken) {
+      if (current.runtimeId !== runtimeId || current.runtimeRenewalToken !== renewalToken) {
         rememberConnectErrorCode("runtime_renewal_superseded");
         lastConnectError = "Runtime credentials changed while renewal was in progress";
         pushLog("runtime-renewal-superseded");
@@ -79468,7 +79493,7 @@ async function startDaemon(args) {
       pushLog("runtime-renewal-succeeded");
       socket.connect();
       return true;
-    })();
+    });
     runtimeRenewalInFlight = attempt;
     void attempt.finally(() => {
       if (runtimeRenewalInFlight === attempt) runtimeRenewalInFlight = null;
@@ -79476,10 +79501,18 @@ async function startDaemon(args) {
     });
     return attempt;
   };
+  let queueIdentityRestart = () => {
+  };
   let runtimeSetupInFlight = null;
   const adoptRuntimeSetupGrant = (input2) => {
     if (runtimeSetupInFlight) return runtimeSetupInFlight;
-    const attempt = (async () => {
+    const attempt = runCredentialOperation(async () => {
+      const activeRunCount = activeAgents.size + pendingRunStarts.size;
+      if (activeRunCount > 0) {
+        throw new Error(
+          `credential setup is deferred while ${activeRunCount} active run${activeRunCount === 1 ? " finishes" : "s finish"}`
+        );
+      }
       const current = readConfig();
       if (current.runtimeId !== runtimeId || current.installationId !== installationId || input2.installationId !== installationId) {
         throw new Error("credential setup does not belong to this daemon installation");
@@ -79489,7 +79522,23 @@ async function startDaemon(args) {
       }
       const bundle = await exchangeRuntimeSetupGrant(input2);
       if (bundle.runtimeId !== runtimeId) {
-        throw new Error("credential setup resolved to a different runtime");
+        writeConfig({
+          ...current,
+          runtimeId: bundle.runtimeId,
+          runtimeToken: bundle.runtimeToken,
+          runtimeRenewalToken: bundle.runtimeRenewalToken,
+          displayName: bundle.displayName
+        });
+        clearPendingSetupIntent();
+        pushLog(
+          `runtime-identity-switch-queued from=${runtimeId} to=${bundle.runtimeId} generation=${bundle.credentialGeneration}`
+        );
+        const restartTimer = setTimeout(queueIdentityRestart, 100);
+        restartTimer.unref?.();
+        return {
+          runtimeId: bundle.runtimeId,
+          credentialGeneration: bundle.credentialGeneration
+        };
       }
       writeConfig({
         ...current,
@@ -79526,7 +79575,7 @@ async function startDaemon(args) {
         runtimeId: bundle.runtimeId,
         credentialGeneration: bundle.credentialGeneration
       };
-    })();
+    });
     runtimeSetupInFlight = attempt;
     void attempt.finally(() => {
       if (runtimeSetupInFlight === attempt) runtimeSetupInFlight = null;
@@ -79741,6 +79790,16 @@ async function startDaemon(args) {
     const wsHint = isLocalEndpoint(wsUrl) ? ` Nothing is listening at ${wsUrl}. For local dev run setup with --profile local and start the stack (WS on ws://localhost:8401).` : ` Verify wsUrl in ${getConfigPath()} and that you can reach ${wsUrl}.`;
     console.warn("[alan-agent] Daemon connection error:", `${error61.message}.${wsHint}`);
   });
+  socket.on("connection_directive", (value2) => {
+    if (!value2 || typeof value2 !== "object") return;
+    const directive = value2;
+    if (directive.retryable !== false || typeof directive.code !== "string") return;
+    rememberConnectErrorCode(directive.code);
+    if (typeof directive.reason === "string") lastConnectError = directive.reason;
+    pushLog(
+      `connection_directive ${directive.code}${lastConnectError ? ` reason=${lastConnectError}` : ""}`
+    );
+  });
   socket.on("disconnect", (reason) => {
     setConnectedRuntimeSocket(null);
     relocationInFlight.clear();
@@ -80093,6 +80152,9 @@ async function startDaemon(args) {
   queueFullShutdown = () => {
     void stop().then(() => controller.whenExternallyStopped?.());
   };
+  queueIdentityRestart = () => {
+    void stop().then(() => controller.whenExternallyStopped?.("runtime_identity_changed"));
+  };
   return controller;
 }
 
@@ -80191,17 +80253,23 @@ async function setupDaemon(args) {
     if (!liveConfig.localApiToken) {
       throw new Error("running daemon could not be authenticated for credential setup");
     }
+    const liveSetup = {
+      ...setup,
+      apiUrl: liveConfig.apiUrl ?? setup.apiUrl,
+      wsUrl: liveConfig.wsUrl ?? setup.wsUrl,
+      endpointProfile: liveConfig.endpointProfile ?? setup.endpointProfile
+    };
     const body2 = await handoffRuntimeSetupGrant({
       port: localApiPort,
       localApiToken: liveConfig.localApiToken,
-      setup
+      setup: liveSetup
     });
     console.info("[alan-agent] Runtime credentials adopted by running daemon", {
       runtimeId: body2.runtimeId,
       credentialGeneration: body2.credentialGeneration,
       configPath: getConfigPath()
     });
-    return;
+    return { daemonAlreadyRunning: true };
   }
   if (readLocalDaemonOwnerLease(getConfigPath())) {
     throw new Error(
@@ -80215,7 +80283,7 @@ async function setupDaemon(args) {
     if (setupToken && error61 instanceof RuntimeSetupGrantExpiredError) {
       console.info("[alan-agent] Setup link expired; continuing with browser authorization");
       await loginWithDeviceCode(args);
-      return;
+      return { daemonAlreadyRunning: false };
     }
     throw error61;
   }
@@ -80240,6 +80308,7 @@ async function setupDaemon(args) {
     runtimeId: body.runtimeId,
     configPath: getConfigPath()
   });
+  return { daemonAlreadyRunning: false };
 }
 async function loginWithDeviceCode(args) {
   bindConfigPath(args);
@@ -80428,8 +80497,8 @@ async function runDaemon(args) {
     return;
   }
   const controller = await startDaemon(args);
-  const shutdown = () => {
-    void controller.stop().finally(() => process.exit(0));
+  const shutdown = (reason) => {
+    void controller.stop().finally(() => process.exit(daemonExternalStopExitCode(reason)));
   };
   controller.whenExternallyStopped = shutdown;
   process.once("SIGINT", shutdown);
@@ -80437,6 +80506,9 @@ async function runDaemon(args) {
   await new Promise(() => {
   });
 }
+function daemonExternalStopExitCode(reason) {
+  return reason === "runtime_identity_changed" ? 1 : 0;
+}
 async function recoverDaemonConnection(args = [], options) {
   bindConfigPath(args);
   const getStatus = async () => {
@@ -82078,107 +82150,728 @@ function runMcpIntegrationCommand(args, options = {}) {
   throw new Error(`Unknown integrations action: ${action}`);
 }
 
-// src/lifecycle-logger.ts
-var AgentLifecycleLogger = class _AgentLifecycleLogger {
-  context;
-  constructor(context = {}) {
-    this.context = normalizeContext(context);
-  }
-  setContext(context) {
-    this.context = normalizeContext({ ...this.context, ...context });
-  }
-  child(context) {
-    return new _AgentLifecycleLogger({ ...this.context, ...context });
+// src/service-manager.ts
+var import_node_child_process9 = require("child_process");
+var import_node_fs25 = require("fs");
+var import_node_os16 = require("os");
+var import_node_path27 = require("path");
+var SERVICE_LABEL = "ai.tryalan.agent";
+var SYSTEMD_UNIT = "alan-agent.service";
+var WINDOWS_TASK = "Alan Agent";
+function xml(value2) {
+  return value2.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function systemdArg(value2) {
+  return `"${value2.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function powershellLiteral(value2) {
+  return `'${value2.replaceAll("'", "''")}'`;
+}
+function serviceNames(profile) {
+  if (profile === "production") {
+    return { launchd: SERVICE_LABEL, systemd: SYSTEMD_UNIT, windows: WINDOWS_TASK };
   }
-  debug(event, fields = {}) {
-    this.log("debug", event, fields);
+  const suffix = profile === "custom" ? "prod" : profile;
+  const title = `${suffix[0]?.toUpperCase()}${suffix.slice(1)}`;
+  return {
+    launchd: `${SERVICE_LABEL}.${suffix}`,
+    systemd: `alan-agent-${suffix}.service`,
+    windows: `${WINDOWS_TASK} ${title}`
+  };
+}
+function buildDaemonServicePlan(input2) {
+  const daemonArgs = [input2.nodeExecutable, input2.cliEntry, "daemon", "--profile", input2.profile];
+  const names = serviceNames(input2.profile);
+  if (input2.platform === "darwin") {
+    const userId = input2.userId ?? process.getuid?.();
+    if (userId === void 0) throw new Error("Cannot determine the current macOS user ID");
+    const domain2 = `gui/${userId}`;
+    const serviceTarget = `${domain2}/${names.launchd}`;
+    const manifestPath = (0, import_node_path27.join)(input2.homeDir, "Library", "LaunchAgents", `${names.launchd}.plist`);
+    const logDir = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
+    const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
+    const environmentEntries = Object.entries(input2.environment ?? {}).map(([key, value2]) => `    <key>${xml(key)}</key>
+    <string>${xml(value2)}</string>`).join("\n");
+    const environmentBlock = environmentEntries ? `  <key>EnvironmentVariables</key>
+  <dict>
+${environmentEntries}
+  </dict>
+` : "";
+    const manifest = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${names.launchd}</string>
+  <key>ProgramArguments</key>
+  <array>
+${programArguments}
+  </array>
+${environmentBlock}  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>StandardOutPath</key>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon-error.log"))}</string>
+</dict>
+</plist>
+`;
+    return {
+      platform: "darwin",
+      manifestPath,
+      manifest,
+      logDirectory: logDir,
+      loadDefinitionCommands: [
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: true
+        }
+      ],
+      reloadDefinitionCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        },
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: false
+        }
+      ],
+      enableCommands: [
+        {
+          command: "launchctl",
+          args: ["enable", serviceTarget],
+          tolerateFailure: true
+        }
+      ],
+      startCommands: [
+        {
+          command: "launchctl",
+          args: ["kickstart", serviceTarget],
+          tolerateFailure: false
+        }
+      ],
+      stopCommands: [
+        {
+          command: "launchctl",
+          args: ["kill", "SIGTERM", serviceTarget],
+          tolerateFailure: true
+        }
+      ],
+      replaceCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        },
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: false
+        },
+        {
+          command: "launchctl",
+          args: ["kickstart", "-k", serviceTarget],
+          tolerateFailure: false
+        }
+      ],
+      uninstallCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        }
+      ],
+      statusCommand: {
+        command: "launchctl",
+        args: ["print", serviceTarget],
+        tolerateFailure: true
+      },
+      isActiveCommand: {
+        command: "launchctl",
+        args: ["print", serviceTarget],
+        tolerateFailure: true
+      },
+      lingerStatusCommand: null
+    };
   }
-  info(event, fields = {}) {
-    this.log("info", event, fields);
+  if (input2.platform === "linux") {
+    const manifestPath = (0, import_node_path27.join)(input2.homeDir, ".config", "systemd", "user", names.systemd);
+    const environmentLines = Object.entries(input2.environment ?? {}).map(([key, value2]) => `Environment=${systemdArg(`${key}=${value2}`)}`).join("\n");
+    const manifest = `[Unit]
+Description=Alan local agent daemon
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=simple
+${environmentLines ? `${environmentLines}
+` : ""}ExecStart=${daemonArgs.map(systemdArg).join(" ")}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+    return {
+      platform: "linux",
+      manifestPath,
+      manifest,
+      logDirectory: null,
+      loadDefinitionCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        }
+      ],
+      reloadDefinitionCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        }
+      ],
+      enableCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "enable", names.systemd],
+          tolerateFailure: false
+        }
+      ],
+      startCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "start", names.systemd],
+          tolerateFailure: false
+        }
+      ],
+      stopCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "stop", names.systemd],
+          tolerateFailure: true
+        }
+      ],
+      replaceCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        },
+        {
+          command: "systemctl",
+          args: ["--user", "restart", names.systemd],
+          tolerateFailure: false
+        }
+      ],
+      uninstallCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "disable", "--now", names.systemd],
+          tolerateFailure: true
+        },
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        }
+      ],
+      statusCommand: {
+        command: "systemctl",
+        args: ["--user", "status", names.systemd, "--no-pager"],
+        tolerateFailure: true
+      },
+      isActiveCommand: {
+        command: "systemctl",
+        args: ["--user", "is-active", names.systemd],
+        tolerateFailure: true
+      },
+      lingerStatusCommand: {
+        command: "loginctl",
+        args: ["show-user", "$(id -un)", "-p", "Linger"],
+        tolerateFailure: true
+      }
+    };
   }
-  warn(event, fields = {}) {
-    this.log("warn", event, fields);
+  const environmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
+  const directArgument = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
+  const executable = powershellLiteral(environmentPrefix ? "powershell.exe" : input2.nodeExecutable);
+  const argument = powershellLiteral(
+    environmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${environmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : directArgument
+  );
+  const registerScript = [
+    "$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name",
+    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument ${argument}`,
+    "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $currentUser",
+    "$principal = New-ScheduledTaskPrincipal -UserId $currentUser -LogonType Interactive -RunLevel Limited",
+    "$settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero)",
+    `Register-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null`
+  ].join("; ");
+  return {
+    platform: "win32",
+    manifestPath: null,
+    manifest: null,
+    logDirectory: null,
+    loadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
+    reloadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
+    enableCommands: [],
+    startCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
+    ],
+    stopCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Stop-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
+    ],
+    replaceCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `${registerScript}; Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
+    ],
+    uninstallCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Confirm:$false -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
+    ],
+    statusCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} | Format-List TaskName,State`
+      ],
+      tolerateFailure: true
+    },
+    isActiveCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `(Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue).State`
+      ],
+      tolerateFailure: true
+    },
+    lingerStatusCommand: null
+  };
+}
+function resolveCurrentPlatform() {
+  const currentPlatform = (0, import_node_os16.platform)();
+  if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
+    throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
   }
-  error(event, fields = {}) {
-    this.log("error", event, fields);
+  return currentPlatform;
+}
+function currentServicePlan(args, runtime) {
+  const currentPlatform = resolveCurrentPlatform();
+  const profile = resolveEndpointProfileFromArgs(args);
+  const cliEntry = runtime?.cliEntry ?? process.argv[1];
+  if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
+  return buildDaemonServicePlan({
+    platform: currentPlatform,
+    homeDir: (0, import_node_os16.homedir)(),
+    nodeExecutable: runtime?.executable ?? process.execPath,
+    cliEntry: (0, import_node_path27.resolve)(cliEntry),
+    profile,
+    environment: runtime?.environment
+  });
+}
+function writeManifestAtomic(path2, contents) {
+  (0, import_node_fs25.mkdirSync)((0, import_node_path27.dirname)(path2), { recursive: true, mode: 448 });
+  const pendingPath = `${path2}.pending-${process.pid}`;
+  try {
+    (0, import_node_fs25.writeFileSync)(pendingPath, contents, { mode: 384 });
+    (0, import_node_fs25.chmodSync)(pendingPath, 384);
+    (0, import_node_fs25.renameSync)(pendingPath, path2);
+  } finally {
+    (0, import_node_fs25.rmSync)(pendingPath, { force: true });
   }
-  log(level, event, fields) {
-    const record2 = omitUndefined({
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      level,
-      component: "agent-manager",
-      event,
-      ...this.context,
-      ...normalizeFields(fields)
-    });
-    console[level](JSON.stringify(record2));
+}
+function defaultReadManifest(path2) {
+  if (!(0, import_node_fs25.existsSync)(path2)) return null;
+  return (0, import_node_fs25.readFileSync)(path2, "utf8");
+}
+function runServiceCommand(command) {
+  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, { encoding: "utf8", shell: false });
+  const status = result.status ?? 1;
+  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
+  if (status !== 0 && !command.tolerateFailure) {
+    throw new Error(
+      `Service command failed (${command.command} ${command.args.join(" ")}): ${output2 || `exit ${status}`}`
+    );
   }
-};
-function lifecycleContextFromEnv(env) {
-  return normalizeContext({
-    taskId: env.ALAN_TASK_ID,
-    conversationId: env.ALAN_SESSION_ID,
-    runId: env.ALAN_RUN_ID,
-    sandboxId: env.ALAN_SANDBOX_ID,
-    provider: env.ALAN_SANDBOX_PROVIDER,
-    backendKind: env.ALAN_BACKEND_KIND,
-    agentVersion: AGENT_VERSION
-  });
+  return { status, output: output2 };
 }
-function normalizeContext(context) {
-  return omitUndefined({
-    ...context,
-    agentVersion: context.agentVersion ?? AGENT_VERSION
+function defaultSleep(ms) {
+  return new Promise((resolveSleep) => {
+    setTimeout(resolveSleep, ms);
   });
 }
-function normalizeFields(fields) {
-  const normalized = {};
-  for (const [key, value2] of Object.entries(fields)) {
-    if (value2 instanceof Error) {
-      normalized[key] = {
-        name: value2.name,
-        message: value2.message,
-        stack: value2.stack
-      };
-    } else {
-      normalized[key] = value2;
+function parseServiceHostState(servicePlatform, result) {
+  const output2 = result.output;
+  if (servicePlatform === "linux") {
+    const trimmed = output2.trim().toLowerCase();
+    if (trimmed === "inactive" || trimmed === "failed" || trimmed === "dead" || /\binactive\b/i.test(output2) || /\bfailed\b/i.test(output2)) {
+      return "stopped";
     }
   }
-  return normalized;
-}
-function omitUndefined(record2) {
-  return Object.fromEntries(Object.entries(record2).filter(([, value2]) => value2 !== void 0));
+  if (result.status !== 0) return "unknown";
+  if (servicePlatform === "darwin") {
+    if (/\bstate\s*=\s*running\b/i.test(output2)) return "running";
+    if (/\bstate\s*=\s*(not running|waiting|stopped)\b/i.test(output2)) return "stopped";
+    if (/\bpid\s*=\s*[1-9]\d*\b/i.test(output2)) return "running";
+    if (/could not find service/i.test(output2)) return "stopped";
+    return "unknown";
+  }
+  if (servicePlatform === "linux") {
+    const trimmed = output2.trim().toLowerCase();
+    if (trimmed === "active" || /\bactive\s*\(running\)/i.test(output2)) return "running";
+    if (trimmed === "activating" || trimmed === "reloading") return "starting";
+    return "unknown";
+  }
+  const stateMatch = output2.match(/\b(?:State|state)\s*[:=]\s*(\w+)/);
+  const state = (stateMatch?.[1] ?? output2.trim()).toLowerCase();
+  if (state === "running") return "running";
+  if (state === "ready" || state === "disabled" || state === "queued") return "stopped";
+  return "unknown";
 }
-
-// ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
-var __create3 = Object.create;
-var __defProp3 = Object.defineProperty;
-var __getOwnPropDesc3 = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames3 = Object.getOwnPropertyNames;
-var __getProtoOf3 = Object.getPrototypeOf;
-var __hasOwnProp3 = Object.prototype.hasOwnProperty;
-var __commonJSMin2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __exportAll2 = (all, symbols) => {
-  let target = {};
-  for (var name in all) {
-    __defProp3(target, name, {
-      get: all[name],
-      enumerable: true
-    });
+function resolveEnsureDefinitionOutcome(input2) {
+  if (!input2.definitionChanged) {
+    return { changed: false, updatePending: false };
   }
-  if (symbols) {
-    __defProp3(target, Symbol.toStringTag, { value: "Module" });
+  if (input2.hostState === "running" || input2.hostState === "starting") {
+    return { changed: true, updatePending: true };
   }
-  return target;
-};
-var __copyProps3 = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (var keys = __getOwnPropNames3(from), i = 0, n = keys.length, key; i < n; i++) {
-      key = keys[i];
-      if (!__hasOwnProp3.call(to, key) && key !== except) {
-        __defProp3(to, key, {
-          get: ((k) => from[k]).bind(null, key),
-          enumerable: !(desc = __getOwnPropDesc3(from, key)) || desc.enumerable
+  return { changed: true, updatePending: false };
+}
+function shouldStartOnInstall(hostState) {
+  return hostState === "stopped";
+}
+function resolveUsername(options) {
+  if (options?.username) return options.username;
+  try {
+    return (0, import_node_os16.userInfo)().username;
+  } catch {
+    return process.env.USER || process.env.USERNAME || "unknown";
+  }
+}
+function buildLingerStatusCommand(username) {
+  return {
+    command: "loginctl",
+    args: ["show-user", username, "-p", "Linger"],
+    tolerateFailure: true
+  };
+}
+function assertSystemdUserLingerEnabled(options = {}) {
+  const username = resolveUsername(options);
+  const run = options.runCommand ?? runServiceCommand;
+  const result = run(buildLingerStatusCommand(username));
+  if (result.status !== 0) {
+    throw new Error(
+      `Cannot verify systemd user linger for ${username} (loginctl failed). For durable headless VM boot run: sudo loginctl enable-linger ${username}`
+    );
+  }
+  if (!/Linger=yes/i.test(result.output)) {
+    throw new Error(
+      `systemd user linger is disabled for ${username}. For durable headless VM boot run: sudo loginctl enable-linger ${username}`
+    );
+  }
+}
+function createHostContext(options = {}) {
+  const args = options.args ?? [];
+  const plan = currentServicePlan(args, options.runtime);
+  const run = options.runCommand ?? runServiceCommand;
+  const sleep4 = options.sleep ?? defaultSleep;
+  const nowMs = options.nowMs ?? Date.now;
+  const readManifest = options.readManifest ?? defaultReadManifest;
+  const writeManifest = options.writeManifest ?? writeManifestAtomic;
+  const removeManifest = options.removeManifest ?? ((path2) => (0, import_node_fs25.rmSync)(path2, { force: true }));
+  const ensureLogDir = options.ensureLogDir ?? (() => {
+    if (plan.logDirectory) (0, import_node_fs25.mkdirSync)(plan.logDirectory, { recursive: true, mode: 448 });
+  });
+  return {
+    args,
+    plan,
+    run,
+    sleep: sleep4,
+    nowMs,
+    readManifest,
+    writeManifest,
+    removeManifest,
+    ensureLogDir,
+    profile: resolveEndpointProfileFromArgs(args)
+  };
+}
+function inspectDaemonService(options = {}) {
+  const { plan, run, nowMs } = createHostContext(options);
+  const result = run(plan.isActiveCommand);
+  const state = parseServiceHostState(plan.platform, result);
+  return {
+    state,
+    platform: plan.platform,
+    detail: result.output || void 0,
+    observedAtMs: nowMs()
+  };
+}
+function ensureDaemonServiceDefinition(options = {}) {
+  const ctx = createHostContext(options);
+  const { plan, run, readManifest, writeManifest, ensureLogDir } = ctx;
+  let definitionChanged = false;
+  if (plan.manifestPath && plan.manifest) {
+    ensureLogDir();
+    const existing = readManifest(plan.manifestPath);
+    definitionChanged = existing !== plan.manifest;
+    if (definitionChanged) {
+      writeManifest(plan.manifestPath, plan.manifest);
+    }
+  } else if (plan.platform === "win32") {
+    definitionChanged = true;
+  }
+  const inspection = inspectDaemonService(options);
+  const outcome = resolveEnsureDefinitionOutcome({
+    definitionChanged,
+    hostState: inspection.state
+  });
+  if (outcome.updatePending) {
+    return outcome;
+  }
+  if (inspection.state === "running" || inspection.state === "starting") {
+    return outcome;
+  }
+  const definitionCommands = inspection.state === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
+  for (const command of definitionCommands) run(command);
+  return outcome;
+}
+function enableDaemonService(options = {}) {
+  const { plan, run } = createHostContext(options);
+  for (const command of plan.enableCommands) run(command);
+}
+function startDaemonService(options = {}) {
+  const { plan, run } = createHostContext(options);
+  for (const command of plan.startCommands) run(command);
+}
+function uninstallDaemonService(args = [], options = {}) {
+  const ctx = createHostContext({ ...options, args: options.args ?? args });
+  for (const command of ctx.plan.uninstallCommands) ctx.run(command);
+  if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
+  console.info("[alan-agent] Per-user daemon service removed");
+}
+function installDaemonService(args = [], runtime, options = {}) {
+  const profile = resolveEndpointProfileFromArgs(args);
+  const configPath = resolveAgentConfigPath({ profile });
+  if (!configExistsAtPath(configPath)) {
+    throw new Error(`No ${profile} runtime is configured. Run alan-agent setup or login first.`);
+  }
+  const headless = options.headless ?? args.includes("--headless");
+  const merged = { ...options, args, runtime, headless };
+  const ctx = createHostContext(merged);
+  if (headless) {
+    if (ctx.plan.platform !== "linux") {
+      throw new Error("--headless is only supported on Linux systemd user services");
+    }
+    assertSystemdUserLingerEnabled(merged);
+  }
+  const ensured = ensureDaemonServiceDefinition(merged);
+  enableDaemonService(merged);
+  const inspection = inspectDaemonService(merged);
+  if (ensured.updatePending) {
+    console.info("[alan-agent] Daemon service definition update pending; leaving running service", {
+      profile,
+      state: inspection.state
+    });
+    return;
+  }
+  if (!shouldStartOnInstall(inspection.state)) {
+    console.info("[alan-agent] Per-user daemon service already present", {
+      profile,
+      state: inspection.state
+    });
+    return;
+  }
+  startDaemonService(merged);
+  console.info("[alan-agent] Per-user daemon service installed", { profile });
+}
+function printDaemonServiceStatus(args = []) {
+  const plan = currentServicePlan(args);
+  const result = runServiceCommand({ ...plan.statusCommand, tolerateFailure: true });
+  if (result.status !== 0) {
+    process.stdout.write(`unknown
+${result.output}
+`);
+    return;
+  }
+  process.stdout.write(`${result.output}
+`);
+}
+
+// src/install-command.ts
+async function runInstallCommand(commandArgs) {
+  bindConfigPath(commandArgs);
+  const configured = readConfig();
+  const configurationMode = resolveInstallConfigurationMode(commandArgs, configured);
+  if (configurationMode === "setup") await setupDaemon(commandArgs);
+  if (configurationMode === "login") await loginWithDeviceCode(commandArgs);
+  installDaemonService(commandArgs);
+  runMcpIntegrationCommand(["reconcile", ...commandArgs]);
+}
+
+// src/lifecycle-logger.ts
+var AgentLifecycleLogger = class _AgentLifecycleLogger {
+  context;
+  constructor(context = {}) {
+    this.context = normalizeContext(context);
+  }
+  setContext(context) {
+    this.context = normalizeContext({ ...this.context, ...context });
+  }
+  child(context) {
+    return new _AgentLifecycleLogger({ ...this.context, ...context });
+  }
+  debug(event, fields = {}) {
+    this.log("debug", event, fields);
+  }
+  info(event, fields = {}) {
+    this.log("info", event, fields);
+  }
+  warn(event, fields = {}) {
+    this.log("warn", event, fields);
+  }
+  error(event, fields = {}) {
+    this.log("error", event, fields);
+  }
+  log(level, event, fields) {
+    const record2 = omitUndefined({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      level,
+      component: "agent-manager",
+      event,
+      ...this.context,
+      ...normalizeFields(fields)
+    });
+    console[level](JSON.stringify(record2));
+  }
+};
+function lifecycleContextFromEnv(env) {
+  return normalizeContext({
+    taskId: env.ALAN_TASK_ID,
+    conversationId: env.ALAN_SESSION_ID,
+    runId: env.ALAN_RUN_ID,
+    sandboxId: env.ALAN_SANDBOX_ID,
+    provider: env.ALAN_SANDBOX_PROVIDER,
+    backendKind: env.ALAN_BACKEND_KIND,
+    agentVersion: AGENT_VERSION
+  });
+}
+function normalizeContext(context) {
+  return omitUndefined({
+    ...context,
+    agentVersion: context.agentVersion ?? AGENT_VERSION
+  });
+}
+function normalizeFields(fields) {
+  const normalized = {};
+  for (const [key, value2] of Object.entries(fields)) {
+    if (value2 instanceof Error) {
+      normalized[key] = {
+        name: value2.name,
+        message: value2.message,
+        stack: value2.stack
+      };
+    } else {
+      normalized[key] = value2;
+    }
+  }
+  return normalized;
+}
+function omitUndefined(record2) {
+  return Object.fromEntries(Object.entries(record2).filter(([, value2]) => value2 !== void 0));
+}
+
+// ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+var __create3 = Object.create;
+var __defProp3 = Object.defineProperty;
+var __getOwnPropDesc3 = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames3 = Object.getOwnPropertyNames;
+var __getProtoOf3 = Object.getPrototypeOf;
+var __hasOwnProp3 = Object.prototype.hasOwnProperty;
+var __commonJSMin2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __exportAll2 = (all, symbols) => {
+  let target = {};
+  for (var name in all) {
+    __defProp3(target, name, {
+      get: all[name],
+      enumerable: true
+    });
+  }
+  if (symbols) {
+    __defProp3(target, Symbol.toStringTag, { value: "Module" });
+  }
+  return target;
+};
+var __copyProps3 = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var keys = __getOwnPropNames3(from), i = 0, n = keys.length, key; i < n; i++) {
+      key = keys[i];
+      if (!__hasOwnProp3.call(to, key) && key !== except) {
+        __defProp3(to, key, {
+          get: ((k) => from[k]).bind(null, key),
+          enumerable: !(desc = __getOwnPropDesc3(from, key)) || desc.enumerable
         });
       }
     }
@@ -94517,27 +95210,27 @@ async function runMcpStdioProxy(env = process.env, local = new StdioServerTransp
 
 // src/native-hook-command.ts
 var import_node_crypto21 = require("crypto");
-var import_node_fs26 = require("fs");
-var import_node_os16 = require("os");
-var import_node_path28 = require("path");
+var import_node_fs27 = require("fs");
+var import_node_os17 = require("os");
+var import_node_path29 = require("path");
 
 // src/native-project-config.ts
-var import_node_fs25 = require("fs");
-var import_node_path27 = require("path");
+var import_node_fs26 = require("fs");
+var import_node_path28 = require("path");
 var MAX_ALAN_PROJECT_CONFIG_BYTES = 64 * 1024;
 var ORGANIZATION_SLUG_PATTERN = /^[a-z0-9-]+$/;
 var TEAM_IDENTIFIER_PATTERN = /^[A-Z0-9]{2,4}$/i;
 function readAlanProjectPin(cwd) {
   let fd;
   try {
-    fd = (0, import_node_fs25.openSync)(
-      (0, import_node_path27.join)(cwd, "alan.json"),
-      import_node_fs25.constants.O_RDONLY | import_node_fs25.constants.O_NONBLOCK | (import_node_fs25.constants.O_NOFOLLOW ?? 0)
+    fd = (0, import_node_fs26.openSync)(
+      (0, import_node_path28.join)(cwd, "alan.json"),
+      import_node_fs26.constants.O_RDONLY | import_node_fs26.constants.O_NONBLOCK | (import_node_fs26.constants.O_NOFOLLOW ?? 0)
     );
-    const stat2 = (0, import_node_fs25.fstatSync)(fd);
+    const stat2 = (0, import_node_fs26.fstatSync)(fd);
     if (!stat2.isFile() || stat2.size > MAX_ALAN_PROJECT_CONFIG_BYTES) return void 0;
     const buffer = Buffer.allocUnsafe(MAX_ALAN_PROJECT_CONFIG_BYTES + 1);
-    const bytesRead = (0, import_node_fs25.readSync)(fd, buffer, 0, buffer.byteLength, 0);
+    const bytesRead = (0, import_node_fs26.readSync)(fd, buffer, 0, buffer.byteLength, 0);
     if (bytesRead > MAX_ALAN_PROJECT_CONFIG_BYTES) return void 0;
     const parsed = JSON.parse(buffer.subarray(0, bytesRead).toString("utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
@@ -94553,7 +95246,7 @@ function readAlanProjectPin(cwd) {
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs25.closeSync)(fd);
+        (0, import_node_fs26.closeSync)(fd);
       } catch {
       }
     }
@@ -94792,19 +95485,19 @@ function nonNegativeIntegerField(payload, ...names) {
   return void 0;
 }
 function resolveCodexSessionIdFromTranscriptPath(transcriptPath) {
-  const fileName = (0, import_node_path28.basename)(transcriptPath);
+  const fileName = (0, import_node_path29.basename)(transcriptPath);
   const match = /^rollout-.*-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i.exec(
     fileName
   );
   return match?.[1];
 }
-function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.KIMI_CODE_HOME?.trim() || (0, import_node_path28.join)((0, import_node_os16.homedir)(), ".kimi-code")) {
-  if ((0, import_node_path28.basename)(externalSessionId) !== externalSessionId) return void 0;
-  const sessionsDir = (0, import_node_path28.join)(kimiHomeDir, "sessions");
-  if (!(0, import_node_fs26.existsSync)(sessionsDir)) return void 0;
-  for (const workspace of (0, import_node_fs26.readdirSync)(sessionsDir, { withFileTypes: true })) {
+function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.KIMI_CODE_HOME?.trim() || (0, import_node_path29.join)((0, import_node_os17.homedir)(), ".kimi-code")) {
+  if ((0, import_node_path29.basename)(externalSessionId) !== externalSessionId) return void 0;
+  const sessionsDir = (0, import_node_path29.join)(kimiHomeDir, "sessions");
+  if (!(0, import_node_fs27.existsSync)(sessionsDir)) return void 0;
+  for (const workspace of (0, import_node_fs27.readdirSync)(sessionsDir, { withFileTypes: true })) {
     if (!workspace.isDirectory()) continue;
-    const transcriptPath = (0, import_node_path28.join)(
+    const transcriptPath = (0, import_node_path29.join)(
       sessionsDir,
       workspace.name,
       externalSessionId,
@@ -94812,7 +95505,7 @@ function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.
       "main",
       "wire.jsonl"
     );
-    if ((0, import_node_fs26.existsSync)(transcriptPath)) return transcriptPath;
+    if ((0, import_node_fs27.existsSync)(transcriptPath)) return transcriptPath;
   }
   return void 0;
 }
@@ -94847,7 +95540,7 @@ function parseNativeHookEnvelope(input2) {
   const rawHookEvent = input2.hookEvent ?? stringField4(payload, "hook_event_name", "hookEvent", "hookEventName", "type") ?? "notification";
   const eventType = normalizeHookEvent(rawHookEvent);
   const cwd = stringField4(payload, "cwd", "working_directory", "workingDirectory") ?? firstStringArrayField(payload, "workspace_roots", "workspaceRoots");
-  const resolvedCwd = cwd ? (0, import_node_path28.resolve)(cwd) : void 0;
+  const resolvedCwd = cwd ? (0, import_node_path29.resolve)(cwd) : void 0;
   const transcriptPath = eventType === "subagent_start" || eventType === "subagent_end" ? stringField4(
     payload,
     "agent_transcript_path",
@@ -94893,7 +95586,7 @@ function parseNativeHookEnvelope(input2) {
     ...(eventType === "subagent_start" || eventType === "subagent_end") && parentSessionId ? { parentExternalSessionId: parentSessionId } : {},
     ...resolvedCwd ? { cwd: resolvedCwd } : {},
     ...projectPin,
-    ...transcriptPath ? { transcriptPath: (0, import_node_path28.resolve)(transcriptPath) } : {},
+    ...transcriptPath ? { transcriptPath: (0, import_node_path29.resolve)(transcriptPath) } : {},
     ...cursor ? { sourceCursor: cursor } : {},
     providerPayload
   };
@@ -94940,7 +95633,7 @@ function readBoundedHookPayload(fd = 0, maxBytes = MAX_NATIVE_HOOK_STDIN_BYTES)
   let totalBytes = 0;
   while (true) {
     const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1 - totalBytes));
-    const bytesRead = (0, import_node_fs26.readSync)(fd, chunk, 0, chunk.byteLength, null);
+    const bytesRead = (0, import_node_fs27.readSync)(fd, chunk, 0, chunk.byteLength, null);
     if (bytesRead === 0) break;
     totalBytes += bytesRead;
     if (totalBytes > maxBytes) throw new Error(`hook input exceeds ${maxBytes} bytes`);
@@ -95023,7 +95716,7 @@ function collectNativeIntegrationStatus(args = []) {
   const config2 = readConfig();
   const configPath = getConfigPath();
   const env = getDaemonCliEnvironment();
-  const homeDir = (0, import_node_os16.homedir)();
+  const homeDir = (0, import_node_os17.homedir)();
   return NATIVE_SESSION_PROVIDER_CAPABILITIES.map((capability) => ({
     provider: capability.providerKind,
     command: capability.command,
@@ -95052,7 +95745,7 @@ function decodeResumeFallbackContext(encoded) {
 }
 
 // src/sandbox.ts
-var import_node_os17 = require("os");
+var import_node_os18 = require("os");
 
 // src/execution-activity-tracker.ts
 var ExecutionActivityTracker = class {
@@ -95666,7 +96359,7 @@ var agentProbeAckSchema = external_exports.object({
 
 // src/sandbox-outbox.ts
 var import_node_crypto23 = require("crypto");
-var import_node_fs27 = require("fs");
+var import_node_fs28 = require("fs");
 function deriveSandboxOutboxKey(sessionToken) {
   if (!sessionToken) {
     throw new Error("sandbox event outbox requires ALAN_SESSION_TOKEN for key derivation");
@@ -95676,17 +96369,50 @@ function deriveSandboxOutboxKey(sessionToken) {
 function sandboxOutboxSpoolPath(conversationId) {
   return `/tmp/alan-agent-outbox-${conversationId}.enc`;
 }
+function sandboxOutboxKeyPath(spoolPath) {
+  return `${spoolPath}.key`;
+}
+function assertValidOutboxKey(key, path2) {
+  if (Buffer.from(key, "base64url").length !== 32) {
+    throw new Error(`sandbox event outbox key at ${path2} must contain exactly 32 bytes`);
+  }
+  return key;
+}
+function loadOrCreateSandboxOutboxKey(input2) {
+  const keyPath = sandboxOutboxKeyPath(input2.spoolPath);
+  if ((0, import_node_fs28.existsSync)(keyPath)) {
+    (0, import_node_fs28.chmodSync)(keyPath, 384);
+    return assertValidOutboxKey((0, import_node_fs28.readFileSync)(keyPath, "utf8").trim(), keyPath);
+  }
+  const initialKey = deriveSandboxOutboxKey(input2.sessionToken);
+  try {
+    (0, import_node_fs28.writeFileSync)(keyPath, initialKey, { encoding: "utf8", flag: "wx", mode: 384 });
+    return initialKey;
+  } catch (error61) {
+    if (error61.code !== "EEXIST") throw error61;
+    (0, import_node_fs28.chmodSync)(keyPath, 384);
+    return assertValidOutboxKey((0, import_node_fs28.readFileSync)(keyPath, "utf8").trim(), keyPath);
+  }
+}
+function quarantineUnusableOutbox(path2) {
+  const suffix = `corrupt-${Date.now()}-${process.pid}`;
+  for (const candidate of [path2, eventJournalDir(path2)]) {
+    if ((0, import_node_fs28.existsSync)(candidate)) (0, import_node_fs28.renameSync)(candidate, `${candidate}.${suffix}`);
+  }
+}
 function createSandboxEventOutbox(input2) {
   const path2 = input2.spoolPath ?? sandboxOutboxSpoolPath(input2.conversationId);
-  const key = deriveSandboxOutboxKey(input2.sessionToken);
+  const key = loadOrCreateSandboxOutboxKey({
+    spoolPath: path2,
+    sessionToken: input2.sessionToken
+  });
   try {
     return new EncryptedEventOutbox(path2, key, input2.pushLog, input2.options);
   } catch (error61) {
     input2.pushLog?.(
-      `sandbox_outbox_spool_reset ${error61 instanceof Error ? error61.message : String(error61)}`
+      `sandbox_outbox_spool_quarantined ${error61 instanceof Error ? error61.message : String(error61)}`
     );
-    (0, import_node_fs27.rmSync)(path2, { force: true });
-    (0, import_node_fs27.rmSync)(eventJournalDir(path2), { recursive: true, force: true });
+    quarantineUnusableOutbox(path2);
     return new EncryptedEventOutbox(path2, key, input2.pushLog, input2.options);
   }
 }
@@ -95758,6 +96484,10 @@ var SandboxEventDispatcher = class {
   pendingCount() {
     return this.outbox.pendingCount();
   }
+  /** Drain the async writer so a replacement process can recover the journal. */
+  flushDurable() {
+    return this.outbox.flushDurable();
+  }
 };
 
 // src/ws-client.ts
@@ -96327,7 +97057,7 @@ async function runSandbox(config2) {
   }
   const presenter = new WebPresenter(wsClient, config2.sessionId, config2.projectPath);
   presenter.setSuppressSessionLifecycle(true);
-  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os17.homedir)() });
+  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os18.homedir)() });
   let lastProviderSessionId = config2.providerSessionId;
   let resumeFallbackContext = config2.resumeFallbackContext;
   let activeBackendKind = config2.backendKind || "claude_cli";
@@ -96624,572 +97354,6 @@ async function runSandbox(config2) {
   wsClient.close();
 }
 
-// src/service-manager.ts
-var import_node_child_process9 = require("child_process");
-var import_node_fs28 = require("fs");
-var import_node_os18 = require("os");
-var import_node_path29 = require("path");
-var SERVICE_LABEL = "ai.tryalan.agent";
-var SYSTEMD_UNIT = "alan-agent.service";
-var WINDOWS_TASK = "Alan Agent";
-function xml(value2) {
-  return value2.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function systemdArg(value2) {
-  return `"${value2.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-}
-function powershellLiteral(value2) {
-  return `'${value2.replaceAll("'", "''")}'`;
-}
-function buildDaemonServicePlan(input2) {
-  const daemonArgs = [input2.nodeExecutable, input2.cliEntry, "daemon", "--profile", input2.profile];
-  if (input2.platform === "darwin") {
-    const userId = input2.userId ?? process.getuid?.();
-    if (userId === void 0) throw new Error("Cannot determine the current macOS user ID");
-    const domain2 = `gui/${userId}`;
-    const serviceTarget = `${domain2}/${SERVICE_LABEL}`;
-    const manifestPath = (0, import_node_path29.join)(input2.homeDir, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
-    const logDir = (0, import_node_path29.join)(input2.homeDir, ".alan", "agent", "logs");
-    const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
-    const environmentEntries = Object.entries(input2.environment ?? {}).map(([key, value2]) => `    <key>${xml(key)}</key>
-    <string>${xml(value2)}</string>`).join("\n");
-    const environmentBlock = environmentEntries ? `  <key>EnvironmentVariables</key>
-  <dict>
-${environmentEntries}
-  </dict>
-` : "";
-    const manifest = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${SERVICE_LABEL}</string>
-  <key>ProgramArguments</key>
-  <array>
-${programArguments}
-  </array>
-${environmentBlock}  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <dict>
-    <key>SuccessfulExit</key>
-    <false/>
-  </dict>
-  <key>ThrottleInterval</key>
-  <integer>5</integer>
-  <key>StandardOutPath</key>
-  <string>${xml((0, import_node_path29.join)(logDir, "daemon.log"))}</string>
-  <key>StandardErrorPath</key>
-  <string>${xml((0, import_node_path29.join)(logDir, "daemon-error.log"))}</string>
-</dict>
-</plist>
-`;
-    return {
-      platform: "darwin",
-      manifestPath,
-      manifest,
-      loadDefinitionCommands: [
-        {
-          command: "launchctl",
-          args: ["bootstrap", domain2, manifestPath],
-          tolerateFailure: true
-        }
-      ],
-      enableCommands: [
-        {
-          command: "launchctl",
-          args: ["enable", serviceTarget],
-          tolerateFailure: true
-        }
-      ],
-      startCommands: [
-        {
-          command: "launchctl",
-          args: ["kickstart", serviceTarget],
-          tolerateFailure: false
-        }
-      ],
-      stopCommands: [
-        {
-          command: "launchctl",
-          args: ["kill", "SIGTERM", serviceTarget],
-          tolerateFailure: true
-        }
-      ],
-      replaceCommands: [
-        {
-          command: "launchctl",
-          args: ["bootout", domain2, manifestPath],
-          tolerateFailure: true
-        },
-        {
-          command: "launchctl",
-          args: ["bootstrap", domain2, manifestPath],
-          tolerateFailure: false
-        },
-        {
-          command: "launchctl",
-          args: ["kickstart", "-k", serviceTarget],
-          tolerateFailure: false
-        }
-      ],
-      uninstallCommands: [
-        {
-          command: "launchctl",
-          args: ["bootout", domain2, manifestPath],
-          tolerateFailure: true
-        }
-      ],
-      statusCommand: {
-        command: "launchctl",
-        args: ["print", serviceTarget],
-        tolerateFailure: true
-      },
-      isActiveCommand: {
-        command: "launchctl",
-        args: ["print", serviceTarget],
-        tolerateFailure: true
-      },
-      lingerStatusCommand: null
-    };
-  }
-  if (input2.platform === "linux") {
-    const manifestPath = (0, import_node_path29.join)(input2.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
-    const environmentLines = Object.entries(input2.environment ?? {}).map(([key, value2]) => `Environment=${systemdArg(`${key}=${value2}`)}`).join("\n");
-    const manifest = `[Unit]
-Description=Alan local agent daemon
-After=network-online.target
-Wants=network-online.target
-StartLimitIntervalSec=300
-StartLimitBurst=3
-
-[Service]
-Type=simple
-${environmentLines ? `${environmentLines}
-` : ""}ExecStart=${daemonArgs.map(systemdArg).join(" ")}
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=default.target
-`;
-    return {
-      platform: "linux",
-      manifestPath,
-      manifest,
-      loadDefinitionCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "daemon-reload"],
-          tolerateFailure: false
-        }
-      ],
-      enableCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "enable", SYSTEMD_UNIT],
-          tolerateFailure: false
-        }
-      ],
-      startCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "start", SYSTEMD_UNIT],
-          tolerateFailure: false
-        }
-      ],
-      stopCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "stop", SYSTEMD_UNIT],
-          tolerateFailure: true
-        }
-      ],
-      replaceCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "daemon-reload"],
-          tolerateFailure: false
-        },
-        {
-          command: "systemctl",
-          args: ["--user", "restart", SYSTEMD_UNIT],
-          tolerateFailure: false
-        }
-      ],
-      uninstallCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "disable", "--now", SYSTEMD_UNIT],
-          tolerateFailure: true
-        },
-        {
-          command: "systemctl",
-          args: ["--user", "daemon-reload"],
-          tolerateFailure: false
-        }
-      ],
-      statusCommand: {
-        command: "systemctl",
-        args: ["--user", "status", SYSTEMD_UNIT, "--no-pager"],
-        tolerateFailure: true
-      },
-      isActiveCommand: {
-        command: "systemctl",
-        args: ["--user", "is-active", SYSTEMD_UNIT],
-        tolerateFailure: true
-      },
-      lingerStatusCommand: {
-        command: "loginctl",
-        args: ["show-user", "$(id -un)", "-p", "Linger"],
-        tolerateFailure: true
-      }
-    };
-  }
-  const environmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
-  const directArgument = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
-  const executable = powershellLiteral(environmentPrefix ? "powershell.exe" : input2.nodeExecutable);
-  const argument = powershellLiteral(
-    environmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${environmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : directArgument
-  );
-  const registerScript = [
-    "$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name",
-    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument ${argument}`,
-    "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $currentUser",
-    "$principal = New-ScheduledTaskPrincipal -UserId $currentUser -LogonType Interactive -RunLevel Limited",
-    "$settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero)",
-    `Register-ScheduledTask -TaskName ${powershellLiteral(WINDOWS_TASK)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null`
-  ].join("; ");
-  return {
-    platform: "win32",
-    manifestPath: null,
-    manifest: null,
-    loadDefinitionCommands: [
-      {
-        command: "powershell.exe",
-        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
-        tolerateFailure: false
-      }
-    ],
-    enableCommands: [],
-    startCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Start-ScheduledTask -TaskName ${powershellLiteral(WINDOWS_TASK)}`
-        ],
-        tolerateFailure: false
-      }
-    ],
-    stopCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Stop-ScheduledTask -TaskName ${powershellLiteral(WINDOWS_TASK)} -ErrorAction SilentlyContinue`
-        ],
-        tolerateFailure: true
-      }
-    ],
-    replaceCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `${registerScript}; Start-ScheduledTask -TaskName ${powershellLiteral(WINDOWS_TASK)}`
-        ],
-        tolerateFailure: false
-      }
-    ],
-    uninstallCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Unregister-ScheduledTask -TaskName ${powershellLiteral(WINDOWS_TASK)} -Confirm:$false -ErrorAction SilentlyContinue`
-        ],
-        tolerateFailure: true
-      }
-    ],
-    statusCommand: {
-      command: "powershell.exe",
-      args: [
-        "-NoProfile",
-        "-NonInteractive",
-        "-Command",
-        `Get-ScheduledTask -TaskName ${powershellLiteral(WINDOWS_TASK)} | Format-List TaskName,State`
-      ],
-      tolerateFailure: true
-    },
-    isActiveCommand: {
-      command: "powershell.exe",
-      args: [
-        "-NoProfile",
-        "-NonInteractive",
-        "-Command",
-        `(Get-ScheduledTask -TaskName ${powershellLiteral(WINDOWS_TASK)} -ErrorAction SilentlyContinue).State`
-      ],
-      tolerateFailure: true
-    },
-    lingerStatusCommand: null
-  };
-}
-function resolveCurrentPlatform() {
-  const currentPlatform = (0, import_node_os18.platform)();
-  if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
-    throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
-  }
-  return currentPlatform;
-}
-function currentServicePlan(args, runtime) {
-  const currentPlatform = resolveCurrentPlatform();
-  const profile = resolveEndpointProfileFromArgs(args);
-  const cliEntry = runtime?.cliEntry ?? process.argv[1];
-  if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
-  return buildDaemonServicePlan({
-    platform: currentPlatform,
-    homeDir: (0, import_node_os18.homedir)(),
-    nodeExecutable: runtime?.executable ?? process.execPath,
-    cliEntry: (0, import_node_path29.resolve)(cliEntry),
-    profile,
-    environment: runtime?.environment
-  });
-}
-function writeManifestAtomic(path2, contents) {
-  (0, import_node_fs28.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true, mode: 448 });
-  const pendingPath = `${path2}.pending-${process.pid}`;
-  try {
-    (0, import_node_fs28.writeFileSync)(pendingPath, contents, { mode: 384 });
-    (0, import_node_fs28.chmodSync)(pendingPath, 384);
-    (0, import_node_fs28.renameSync)(pendingPath, path2);
-  } finally {
-    (0, import_node_fs28.rmSync)(pendingPath, { force: true });
-  }
-}
-function defaultReadManifest(path2) {
-  if (!(0, import_node_fs28.existsSync)(path2)) return null;
-  return (0, import_node_fs28.readFileSync)(path2, "utf8");
-}
-function runServiceCommand(command) {
-  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, { encoding: "utf8", shell: false });
-  const status = result.status ?? 1;
-  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
-  if (status !== 0 && !command.tolerateFailure) {
-    throw new Error(
-      `Service command failed (${command.command} ${command.args.join(" ")}): ${output2 || `exit ${status}`}`
-    );
-  }
-  return { status, output: output2 };
-}
-function defaultSleep(ms) {
-  return new Promise((resolveSleep) => {
-    setTimeout(resolveSleep, ms);
-  });
-}
-function parseServiceHostState(servicePlatform, result) {
-  const output2 = result.output;
-  if (servicePlatform === "linux") {
-    const trimmed = output2.trim().toLowerCase();
-    if (trimmed === "inactive" || trimmed === "failed" || trimmed === "dead" || /\binactive\b/i.test(output2) || /\bfailed\b/i.test(output2)) {
-      return "stopped";
-    }
-  }
-  if (result.status !== 0) return "unknown";
-  if (servicePlatform === "darwin") {
-    if (/\bstate\s*=\s*running\b/i.test(output2)) return "running";
-    if (/\bstate\s*=\s*(not running|waiting|stopped)\b/i.test(output2)) return "stopped";
-    if (/\bpid\s*=\s*[1-9]\d*\b/i.test(output2)) return "running";
-    if (/could not find service/i.test(output2)) return "stopped";
-    return "unknown";
-  }
-  if (servicePlatform === "linux") {
-    const trimmed = output2.trim().toLowerCase();
-    if (trimmed === "active" || /\bactive\s*\(running\)/i.test(output2)) return "running";
-    if (trimmed === "activating" || trimmed === "reloading") return "starting";
-    return "unknown";
-  }
-  const stateMatch = output2.match(/\b(?:State|state)\s*[:=]\s*(\w+)/);
-  const state = (stateMatch?.[1] ?? output2.trim()).toLowerCase();
-  if (state === "running") return "running";
-  if (state === "ready" || state === "disabled" || state === "queued") return "stopped";
-  return "unknown";
-}
-function resolveEnsureDefinitionOutcome(input2) {
-  if (!input2.definitionChanged) {
-    return { changed: false, updatePending: false };
-  }
-  if (input2.hostState === "running" || input2.hostState === "starting") {
-    return { changed: true, updatePending: true };
-  }
-  return { changed: true, updatePending: false };
-}
-function shouldStartOnInstall(hostState) {
-  return hostState === "stopped";
-}
-function resolveUsername(options) {
-  if (options?.username) return options.username;
-  try {
-    return (0, import_node_os18.userInfo)().username;
-  } catch {
-    return process.env.USER || process.env.USERNAME || "unknown";
-  }
-}
-function buildLingerStatusCommand(username) {
-  return {
-    command: "loginctl",
-    args: ["show-user", username, "-p", "Linger"],
-    tolerateFailure: true
-  };
-}
-function assertSystemdUserLingerEnabled(options = {}) {
-  const username = resolveUsername(options);
-  const run = options.runCommand ?? runServiceCommand;
-  const result = run(buildLingerStatusCommand(username));
-  if (result.status !== 0) {
-    throw new Error(
-      `Cannot verify systemd user linger for ${username} (loginctl failed). For durable headless VM boot run: sudo loginctl enable-linger ${username}`
-    );
-  }
-  if (!/Linger=yes/i.test(result.output)) {
-    throw new Error(
-      `systemd user linger is disabled for ${username}. For durable headless VM boot run: sudo loginctl enable-linger ${username}`
-    );
-  }
-}
-function createHostContext(options = {}) {
-  const args = options.args ?? [];
-  const plan = currentServicePlan(args, options.runtime);
-  const run = options.runCommand ?? runServiceCommand;
-  const sleep4 = options.sleep ?? defaultSleep;
-  const nowMs = options.nowMs ?? Date.now;
-  const readManifest = options.readManifest ?? defaultReadManifest;
-  const writeManifest = options.writeManifest ?? writeManifestAtomic;
-  const removeManifest = options.removeManifest ?? ((path2) => (0, import_node_fs28.rmSync)(path2, { force: true }));
-  const ensureLogDir = options.ensureLogDir ?? (() => {
-    if (plan.platform === "darwin") {
-      (0, import_node_fs28.mkdirSync)((0, import_node_path29.join)((0, import_node_os18.homedir)(), ".alan", "agent", "logs"), { recursive: true, mode: 448 });
-    }
-  });
-  return {
-    args,
-    plan,
-    run,
-    sleep: sleep4,
-    nowMs,
-    readManifest,
-    writeManifest,
-    removeManifest,
-    ensureLogDir,
-    profile: resolveEndpointProfileFromArgs(args)
-  };
-}
-function inspectDaemonService(options = {}) {
-  const { plan, run, nowMs } = createHostContext(options);
-  const result = run(plan.isActiveCommand);
-  const state = parseServiceHostState(plan.platform, result);
-  return {
-    state,
-    platform: plan.platform,
-    detail: result.output || void 0,
-    observedAtMs: nowMs()
-  };
-}
-function ensureDaemonServiceDefinition(options = {}) {
-  const ctx = createHostContext(options);
-  const { plan, run, readManifest, writeManifest, ensureLogDir } = ctx;
-  let definitionChanged = false;
-  if (plan.manifestPath && plan.manifest) {
-    ensureLogDir();
-    const existing = readManifest(plan.manifestPath);
-    definitionChanged = existing !== plan.manifest;
-    if (definitionChanged) {
-      writeManifest(plan.manifestPath, plan.manifest);
-    }
-  } else if (plan.platform === "win32") {
-    definitionChanged = true;
-  }
-  const inspection = inspectDaemonService(options);
-  const outcome = resolveEnsureDefinitionOutcome({
-    definitionChanged,
-    hostState: inspection.state
-  });
-  if (outcome.updatePending) {
-    return outcome;
-  }
-  for (const command of plan.loadDefinitionCommands) run(command);
-  return outcome;
-}
-function enableDaemonService(options = {}) {
-  const { plan, run } = createHostContext(options);
-  for (const command of plan.enableCommands) run(command);
-}
-function startDaemonService(options = {}) {
-  const { plan, run } = createHostContext(options);
-  for (const command of plan.startCommands) run(command);
-}
-function uninstallDaemonService(args = [], options = {}) {
-  const ctx = createHostContext({ ...options, args: options.args ?? args });
-  for (const command of ctx.plan.uninstallCommands) ctx.run(command);
-  if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
-  console.info("[alan-agent] Per-user daemon service removed");
-}
-function installDaemonService(args = [], runtime, options = {}) {
-  const profile = resolveEndpointProfileFromArgs(args);
-  const configPath = resolveAgentConfigPath({ profile });
-  if (!configExistsAtPath(configPath)) {
-    throw new Error(`No ${profile} runtime is configured. Run alan-agent setup or login first.`);
-  }
-  const headless = options.headless ?? args.includes("--headless");
-  const merged = { ...options, args, runtime, headless };
-  const ctx = createHostContext(merged);
-  if (headless) {
-    if (ctx.plan.platform !== "linux") {
-      throw new Error("--headless is only supported on Linux systemd user services");
-    }
-    assertSystemdUserLingerEnabled(merged);
-  }
-  const ensured = ensureDaemonServiceDefinition(merged);
-  enableDaemonService(merged);
-  const inspection = inspectDaemonService(merged);
-  if (ensured.updatePending) {
-    console.info("[alan-agent] Daemon service definition update pending; leaving running service", {
-      profile,
-      state: inspection.state
-    });
-    return;
-  }
-  if (!shouldStartOnInstall(inspection.state)) {
-    console.info("[alan-agent] Per-user daemon service already present", {
-      profile,
-      state: inspection.state
-    });
-    return;
-  }
-  startDaemonService(merged);
-  console.info("[alan-agent] Per-user daemon service installed", { profile });
-}
-function printDaemonServiceStatus(args = []) {
-  const plan = currentServicePlan(args);
-  const result = runServiceCommand({ ...plan.statusCommand, tolerateFailure: true });
-  if (result.status !== 0) {
-    process.stdout.write(`unknown
-${result.output}
-`);
-    return;
-  }
-  process.stdout.write(`${result.output}
-`);
-}
-
 // src/skills/skill-cli.ts
 var import_promises6 = require("fs/promises");
 var import_node_os19 = require("os");
@@ -97388,14 +97552,7 @@ async function main() {
     return;
   }
   if (command === "install") {
-    bindConfigPath(commandArgs);
-    const configured = readConfig();
-    if (!configured.runtimeId || !configured.runtimeToken) {
-      if (commandArgs.includes("--setup-token")) await setupDaemon(commandArgs);
-      else await loginWithDeviceCode(commandArgs);
-    }
-    installDaemonService(commandArgs);
-    runMcpIntegrationCommand(["reconcile", ...commandArgs]);
+    await runInstallCommand(commandArgs);
     return;
   }
   if (command === "login") {