@alan-ai-hq/agent-manager 0.1.90 → 0.1.91

package/dist/index.cjs

@@ -15451,7 +15451,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.90";
+var AGENT_VERSION = "0.1.91";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -42795,6 +42795,7 @@ function buildCodexEffortArgs(selectedEffortLevel, options) {
   return ["-c", `model_reasoning_effort=${level}`];
 }
 var CODEX_STARTUP_TIMEOUT_MS = 3e5;
+var ALAN_MCP_STARTUP_TIMEOUT_SEC = 30;
 function buildCodexManagedMcpArgs(registration) {
   const serverName = managedMcpServerName(registration);
   return [
@@ -42802,7 +42803,11 @@ function buildCodexManagedMcpArgs(registration) {
     "-c",
     `mcp_servers.${serverName}.url=${JSON.stringify(registration.url)}`,
     "-c",
-    `mcp_servers.${serverName}.env_http_headers.x-alan-run-reference=${JSON.stringify(ALAN_RUN_REFERENCE_ENV)}`
+    `mcp_servers.${serverName}.env_http_headers.x-alan-run-reference=${JSON.stringify(ALAN_RUN_REFERENCE_ENV)}`,
+    "-c",
+    `mcp_servers.${serverName}.required=true`,
+    "-c",
+    `mcp_servers.${serverName}.startup_timeout_sec=${ALAN_MCP_STARTUP_TIMEOUT_SEC}`
   ];
 }
 function createCodexRuntimeBackend(command = "codex", defaultArgs = []) {
@@ -82145,164 +82150,785 @@ function runMcpIntegrationCommand(args, options = {}) {
   throw new Error(`Unknown integrations action: ${action}`);
 }
 
-// src/lifecycle-logger.ts
-var AgentLifecycleLogger = class _AgentLifecycleLogger {
-  context;
-  constructor(context = {}) {
-    this.context = normalizeContext(context);
-  }
-  setContext(context) {
-    this.context = normalizeContext({ ...this.context, ...context });
-  }
-  child(context) {
-    return new _AgentLifecycleLogger({ ...this.context, ...context });
-  }
-  debug(event, fields = {}) {
-    this.log("debug", event, fields);
-  }
-  info(event, fields = {}) {
-    this.log("info", event, fields);
-  }
-  warn(event, fields = {}) {
-    this.log("warn", event, fields);
-  }
-  error(event, fields = {}) {
-    this.log("error", event, fields);
-  }
-  log(level, event, fields) {
-    const record2 = omitUndefined({
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      level,
-      component: "agent-manager",
-      event,
-      ...this.context,
-      ...normalizeFields(fields)
-    });
-    console[level](JSON.stringify(record2));
-  }
-};
-function lifecycleContextFromEnv(env) {
-  return normalizeContext({
-    taskId: env.ALAN_TASK_ID,
-    conversationId: env.ALAN_SESSION_ID,
-    runId: env.ALAN_RUN_ID,
-    sandboxId: env.ALAN_SANDBOX_ID,
-    provider: env.ALAN_SANDBOX_PROVIDER,
-    backendKind: env.ALAN_BACKEND_KIND,
-    agentVersion: AGENT_VERSION
-  });
-}
-function normalizeContext(context) {
-  return omitUndefined({
-    ...context,
-    agentVersion: context.agentVersion ?? AGENT_VERSION
-  });
+// src/service-manager.ts
+var import_node_child_process9 = require("child_process");
+var import_node_fs25 = require("fs");
+var import_node_os16 = require("os");
+var import_node_path27 = require("path");
+var SERVICE_LABEL = "ai.tryalan.agent";
+var SYSTEMD_UNIT = "alan-agent.service";
+var WINDOWS_TASK = "Alan Agent";
+function xml(value2) {
+  return value2.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
-function normalizeFields(fields) {
-  const normalized = {};
-  for (const [key, value2] of Object.entries(fields)) {
-    if (value2 instanceof Error) {
-      normalized[key] = {
-        name: value2.name,
-        message: value2.message,
-        stack: value2.stack
-      };
-    } else {
-      normalized[key] = value2;
-    }
-  }
-  return normalized;
+function systemdArg(value2) {
+  return `"${value2.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
 }
-function omitUndefined(record2) {
-  return Object.fromEntries(Object.entries(record2).filter(([, value2]) => value2 !== void 0));
+function powershellLiteral(value2) {
+  return `'${value2.replaceAll("'", "''")}'`;
 }
-
-// ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
-var __create3 = Object.create;
-var __defProp3 = Object.defineProperty;
-var __getOwnPropDesc3 = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames3 = Object.getOwnPropertyNames;
-var __getProtoOf3 = Object.getPrototypeOf;
-var __hasOwnProp3 = Object.prototype.hasOwnProperty;
-var __commonJSMin2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __exportAll2 = (all, symbols) => {
-  let target = {};
-  for (var name in all) {
-    __defProp3(target, name, {
-      get: all[name],
-      enumerable: true
-    });
+function serviceNames(profile) {
+  if (profile === "production") {
+    return { launchd: SERVICE_LABEL, systemd: SYSTEMD_UNIT, windows: WINDOWS_TASK };
   }
-  if (symbols) {
-    __defProp3(target, Symbol.toStringTag, { value: "Module" });
+  const suffix = profile === "custom" ? "prod" : profile;
+  const title = `${suffix[0]?.toUpperCase()}${suffix.slice(1)}`;
+  return {
+    launchd: `${SERVICE_LABEL}.${suffix}`,
+    systemd: `alan-agent-${suffix}.service`,
+    windows: `${WINDOWS_TASK} ${title}`
+  };
+}
+function buildDaemonServicePlan(input2) {
+  const daemonArgs = [input2.nodeExecutable, input2.cliEntry, "daemon", "--profile", input2.profile];
+  const names = serviceNames(input2.profile);
+  if (input2.platform === "darwin") {
+    const userId = input2.userId ?? process.getuid?.();
+    if (userId === void 0) throw new Error("Cannot determine the current macOS user ID");
+    const domain2 = `gui/${userId}`;
+    const serviceTarget = `${domain2}/${names.launchd}`;
+    const manifestPath = (0, import_node_path27.join)(input2.homeDir, "Library", "LaunchAgents", `${names.launchd}.plist`);
+    const logDir = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
+    const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
+    const environmentEntries = Object.entries(input2.environment ?? {}).map(([key, value2]) => `    <key>${xml(key)}</key>
+    <string>${xml(value2)}</string>`).join("\n");
+    const environmentBlock = environmentEntries ? `  <key>EnvironmentVariables</key>
+  <dict>
+${environmentEntries}
+  </dict>
+` : "";
+    const manifest = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${names.launchd}</string>
+  <key>ProgramArguments</key>
+  <array>
+${programArguments}
+  </array>
+${environmentBlock}  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>StandardOutPath</key>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon-error.log"))}</string>
+</dict>
+</plist>
+`;
+    return {
+      platform: "darwin",
+      manifestPath,
+      manifest,
+      logDirectory: logDir,
+      loadDefinitionCommands: [
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: true
+        }
+      ],
+      reloadDefinitionCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        },
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: false
+        }
+      ],
+      enableCommands: [
+        {
+          command: "launchctl",
+          args: ["enable", serviceTarget],
+          tolerateFailure: true
+        }
+      ],
+      startCommands: [
+        {
+          command: "launchctl",
+          args: ["kickstart", serviceTarget],
+          tolerateFailure: false
+        }
+      ],
+      stopCommands: [
+        {
+          command: "launchctl",
+          args: ["kill", "SIGTERM", serviceTarget],
+          tolerateFailure: true
+        }
+      ],
+      replaceCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        },
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: false
+        },
+        {
+          command: "launchctl",
+          args: ["kickstart", "-k", serviceTarget],
+          tolerateFailure: false
+        }
+      ],
+      uninstallCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        }
+      ],
+      statusCommand: {
+        command: "launchctl",
+        args: ["print", serviceTarget],
+        tolerateFailure: true
+      },
+      isActiveCommand: {
+        command: "launchctl",
+        args: ["print", serviceTarget],
+        tolerateFailure: true
+      },
+      lingerStatusCommand: null
+    };
   }
-  return target;
-};
-var __copyProps3 = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (var keys = __getOwnPropNames3(from), i = 0, n = keys.length, key; i < n; i++) {
-      key = keys[i];
-      if (!__hasOwnProp3.call(to, key) && key !== except) {
-        __defProp3(to, key, {
-          get: ((k) => from[k]).bind(null, key),
-          enumerable: !(desc = __getOwnPropDesc3(from, key)) || desc.enumerable
-        });
+  if (input2.platform === "linux") {
+    const manifestPath = (0, import_node_path27.join)(input2.homeDir, ".config", "systemd", "user", names.systemd);
+    const environmentLines = Object.entries(input2.environment ?? {}).map(([key, value2]) => `Environment=${systemdArg(`${key}=${value2}`)}`).join("\n");
+    const manifest = `[Unit]
+Description=Alan local agent daemon
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=simple
+${environmentLines ? `${environmentLines}
+` : ""}ExecStart=${daemonArgs.map(systemdArg).join(" ")}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+    return {
+      platform: "linux",
+      manifestPath,
+      manifest,
+      logDirectory: null,
+      loadDefinitionCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        }
+      ],
+      reloadDefinitionCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        }
+      ],
+      enableCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "enable", names.systemd],
+          tolerateFailure: false
+        }
+      ],
+      startCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "start", names.systemd],
+          tolerateFailure: false
+        }
+      ],
+      stopCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "stop", names.systemd],
+          tolerateFailure: true
+        }
+      ],
+      replaceCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        },
+        {
+          command: "systemctl",
+          args: ["--user", "restart", names.systemd],
+          tolerateFailure: false
+        }
+      ],
+      uninstallCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "disable", "--now", names.systemd],
+          tolerateFailure: true
+        },
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        }
+      ],
+      statusCommand: {
+        command: "systemctl",
+        args: ["--user", "status", names.systemd, "--no-pager"],
+        tolerateFailure: true
+      },
+      isActiveCommand: {
+        command: "systemctl",
+        args: ["--user", "is-active", names.systemd],
+        tolerateFailure: true
+      },
+      lingerStatusCommand: {
+        command: "loginctl",
+        args: ["show-user", "$(id -un)", "-p", "Linger"],
+        tolerateFailure: true
       }
-    }
+    };
   }
-  return to;
-};
-var __toESM3 = (mod, isNodeMode, target) => (target = mod != null ? __create3(__getProtoOf3(mod)) : {}, __copyProps3(isNodeMode || !mod || !mod.__esModule ? __defProp3(target, "default", {
-  value: mod,
-  enumerable: true
-}) : target, mod));
-
-// ../../node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
-var DRAFT_2020_12_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2020-12/schema", "http://json-schema.org/draft/2020-12/schema"]);
-var DRAFT_2019_09_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2019-09/schema", "http://json-schema.org/draft/2019-09/schema"]);
-var DRAFT_07_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft-07/schema", "http://json-schema.org/draft-07/schema"]);
-var DRAFT_06_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft-06/schema", "http://json-schema.org/draft-06/schema"]);
-function declares2019Dialect2($schema) {
-  return typeof $schema === "string" && DRAFT_2019_09_URIS2.has($schema.replace(/#$/, ""));
-}
-function declaredDialect2(schema, remedy) {
-  if (!("$schema" in schema) || typeof schema.$schema !== "string") return "2020-12";
-  const declared = schema.$schema.replace(/#$/, "");
-  if (DRAFT_2020_12_URIS2.has(declared)) return "2020-12";
-  if (DRAFT_2019_09_URIS2.has(declared)) return "2019-09";
-  if (DRAFT_07_URIS2.has(declared) || DRAFT_06_URIS2.has(declared)) return "draft-7";
-  throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${schema.$schema.slice(0, 200)}"). The default validator supports JSON Schema 2020-12, 2019-09, draft-07, and draft-06; ${remedy}`);
+  const environmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
+  const directArgument = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
+  const executable = powershellLiteral(environmentPrefix ? "powershell.exe" : input2.nodeExecutable);
+  const argument = powershellLiteral(
+    environmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${environmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : directArgument
+  );
+  const registerScript = [
+    "$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name",
+    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument ${argument}`,
+    "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $currentUser",
+    "$principal = New-ScheduledTaskPrincipal -UserId $currentUser -LogonType Interactive -RunLevel Limited",
+    "$settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero)",
+    `Register-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null`
+  ].join("; ");
+  return {
+    platform: "win32",
+    manifestPath: null,
+    manifest: null,
+    logDirectory: null,
+    loadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
+    reloadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
+    enableCommands: [],
+    startCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
+    ],
+    stopCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Stop-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
+    ],
+    replaceCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `${registerScript}; Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
+    ],
+    uninstallCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Confirm:$false -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
+    ],
+    statusCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} | Format-List TaskName,State`
+      ],
+      tolerateFailure: true
+    },
+    isActiveCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `(Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue).State`
+      ],
+      tolerateFailure: true
+    },
+    lingerStatusCommand: null
+  };
 }
-
-// ../../node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
-var BRANDS2 = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
-function stampErrorBrands2(instance, ctor) {
-  const brands = /* @__PURE__ */ new Set();
-  let current = ctor;
-  while (typeof current === "function") {
-    const brand = current.mcpBrand;
-    if (Object.prototype.hasOwnProperty.call(current, "mcpBrand") && typeof brand === "string") brands.add(brand);
-    current = Object.getPrototypeOf(current);
+function resolveCurrentPlatform() {
+  const currentPlatform = (0, import_node_os16.platform)();
+  if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
+    throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
   }
-  if (brands.size === 0) return;
-  Object.defineProperty(instance, BRANDS2, {
-    value: brands,
-    enumerable: false,
-    configurable: true
+  return currentPlatform;
+}
+function currentServicePlan(args, runtime) {
+  const currentPlatform = resolveCurrentPlatform();
+  const profile = resolveEndpointProfileFromArgs(args);
+  const cliEntry = runtime?.cliEntry ?? process.argv[1];
+  if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
+  return buildDaemonServicePlan({
+    platform: currentPlatform,
+    homeDir: (0, import_node_os16.homedir)(),
+    nodeExecutable: runtime?.executable ?? process.execPath,
+    cliEntry: (0, import_node_path27.resolve)(cliEntry),
+    profile,
+    environment: runtime?.environment
   });
 }
-function brandedHasInstance2(cls, value2) {
+function writeManifestAtomic(path2, contents) {
+  (0, import_node_fs25.mkdirSync)((0, import_node_path27.dirname)(path2), { recursive: true, mode: 448 });
+  const pendingPath = `${path2}.pending-${process.pid}`;
   try {
-    if (typeof value2 === "object" && value2 !== null && Object.prototype.hasOwnProperty.call(cls, "mcpBrand") && typeof cls.mcpBrand === "string" && Object.prototype.hasOwnProperty.call(value2, BRANDS2)) {
-      const carried = value2[BRANDS2];
-      if (carried && typeof carried.has === "function" && carried.has(cls.mcpBrand)) return true;
-    }
-  } catch {
+    (0, import_node_fs25.writeFileSync)(pendingPath, contents, { mode: 384 });
+    (0, import_node_fs25.chmodSync)(pendingPath, 384);
+    (0, import_node_fs25.renameSync)(pendingPath, path2);
+  } finally {
+    (0, import_node_fs25.rmSync)(pendingPath, { force: true });
   }
-  return Function.prototype[Symbol.hasInstance].call(cls, value2);
 }
-var OAuthError3 = class OAuthError4 extends Error {
-  static {
+function defaultReadManifest(path2) {
+  if (!(0, import_node_fs25.existsSync)(path2)) return null;
+  return (0, import_node_fs25.readFileSync)(path2, "utf8");
+}
+function runServiceCommand(command) {
+  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, { encoding: "utf8", shell: false });
+  const status = result.status ?? 1;
+  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
+  if (status !== 0 && !command.tolerateFailure) {
+    throw new Error(
+      `Service command failed (${command.command} ${command.args.join(" ")}): ${output2 || `exit ${status}`}`
+    );
+  }
+  return { status, output: output2 };
+}
+function defaultSleep(ms) {
+  return new Promise((resolveSleep) => {
+    setTimeout(resolveSleep, ms);
+  });
+}
+function parseServiceHostState(servicePlatform, result) {
+  const output2 = result.output;
+  if (servicePlatform === "linux") {
+    const trimmed = output2.trim().toLowerCase();
+    if (trimmed === "inactive" || trimmed === "failed" || trimmed === "dead" || /\binactive\b/i.test(output2) || /\bfailed\b/i.test(output2)) {
+      return "stopped";
+    }
+  }
+  if (result.status !== 0) return "unknown";
+  if (servicePlatform === "darwin") {
+    if (/\bstate\s*=\s*running\b/i.test(output2)) return "running";
+    if (/\bstate\s*=\s*(not running|waiting|stopped)\b/i.test(output2)) return "stopped";
+    if (/\bpid\s*=\s*[1-9]\d*\b/i.test(output2)) return "running";
+    if (/could not find service/i.test(output2)) return "stopped";
+    return "unknown";
+  }
+  if (servicePlatform === "linux") {
+    const trimmed = output2.trim().toLowerCase();
+    if (trimmed === "active" || /\bactive\s*\(running\)/i.test(output2)) return "running";
+    if (trimmed === "activating" || trimmed === "reloading") return "starting";
+    return "unknown";
+  }
+  const stateMatch = output2.match(/\b(?:State|state)\s*[:=]\s*(\w+)/);
+  const state = (stateMatch?.[1] ?? output2.trim()).toLowerCase();
+  if (state === "running") return "running";
+  if (state === "ready" || state === "disabled" || state === "queued") return "stopped";
+  return "unknown";
+}
+function resolveEnsureDefinitionOutcome(input2) {
+  if (!input2.definitionChanged) {
+    return { changed: false, updatePending: false };
+  }
+  if (input2.hostState === "running" || input2.hostState === "starting") {
+    return { changed: true, updatePending: true };
+  }
+  return { changed: true, updatePending: false };
+}
+function shouldStartOnInstall(hostState) {
+  return hostState === "stopped";
+}
+function resolveUsername(options) {
+  if (options?.username) return options.username;
+  try {
+    return (0, import_node_os16.userInfo)().username;
+  } catch {
+    return process.env.USER || process.env.USERNAME || "unknown";
+  }
+}
+function buildLingerStatusCommand(username) {
+  return {
+    command: "loginctl",
+    args: ["show-user", username, "-p", "Linger"],
+    tolerateFailure: true
+  };
+}
+function assertSystemdUserLingerEnabled(options = {}) {
+  const username = resolveUsername(options);
+  const run = options.runCommand ?? runServiceCommand;
+  const result = run(buildLingerStatusCommand(username));
+  if (result.status !== 0) {
+    throw new Error(
+      `Cannot verify systemd user linger for ${username} (loginctl failed). For durable headless VM boot run: sudo loginctl enable-linger ${username}`
+    );
+  }
+  if (!/Linger=yes/i.test(result.output)) {
+    throw new Error(
+      `systemd user linger is disabled for ${username}. For durable headless VM boot run: sudo loginctl enable-linger ${username}`
+    );
+  }
+}
+function createHostContext(options = {}) {
+  const args = options.args ?? [];
+  const plan = currentServicePlan(args, options.runtime);
+  const run = options.runCommand ?? runServiceCommand;
+  const sleep4 = options.sleep ?? defaultSleep;
+  const nowMs = options.nowMs ?? Date.now;
+  const readManifest = options.readManifest ?? defaultReadManifest;
+  const writeManifest = options.writeManifest ?? writeManifestAtomic;
+  const removeManifest = options.removeManifest ?? ((path2) => (0, import_node_fs25.rmSync)(path2, { force: true }));
+  const ensureLogDir = options.ensureLogDir ?? (() => {
+    if (plan.logDirectory) (0, import_node_fs25.mkdirSync)(plan.logDirectory, { recursive: true, mode: 448 });
+  });
+  return {
+    args,
+    plan,
+    run,
+    sleep: sleep4,
+    nowMs,
+    readManifest,
+    writeManifest,
+    removeManifest,
+    ensureLogDir,
+    profile: resolveEndpointProfileFromArgs(args)
+  };
+}
+function inspectDaemonService(options = {}) {
+  const { plan, run, nowMs } = createHostContext(options);
+  const result = run(plan.isActiveCommand);
+  const state = parseServiceHostState(plan.platform, result);
+  return {
+    state,
+    platform: plan.platform,
+    detail: result.output || void 0,
+    observedAtMs: nowMs()
+  };
+}
+function ensureDaemonServiceDefinition(options = {}) {
+  const ctx = createHostContext(options);
+  const { plan, run, readManifest, writeManifest, ensureLogDir } = ctx;
+  let definitionChanged = false;
+  if (plan.manifestPath && plan.manifest) {
+    ensureLogDir();
+    const existing = readManifest(plan.manifestPath);
+    definitionChanged = existing !== plan.manifest;
+    if (definitionChanged) {
+      writeManifest(plan.manifestPath, plan.manifest);
+    }
+  } else if (plan.platform === "win32") {
+    definitionChanged = true;
+  }
+  const inspection = inspectDaemonService(options);
+  const outcome = resolveEnsureDefinitionOutcome({
+    definitionChanged,
+    hostState: inspection.state
+  });
+  if (outcome.updatePending) {
+    return outcome;
+  }
+  if (inspection.state === "running" || inspection.state === "starting") {
+    return outcome;
+  }
+  const definitionCommands = inspection.state === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
+  for (const command of definitionCommands) run(command);
+  return outcome;
+}
+function enableDaemonService(options = {}) {
+  const { plan, run } = createHostContext(options);
+  for (const command of plan.enableCommands) run(command);
+}
+function startDaemonService(options = {}) {
+  const { plan, run } = createHostContext(options);
+  for (const command of plan.startCommands) run(command);
+}
+function uninstallDaemonService(args = [], options = {}) {
+  const ctx = createHostContext({ ...options, args: options.args ?? args });
+  for (const command of ctx.plan.uninstallCommands) ctx.run(command);
+  if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
+  console.info("[alan-agent] Per-user daemon service removed");
+}
+function installDaemonService(args = [], runtime, options = {}) {
+  const profile = resolveEndpointProfileFromArgs(args);
+  const configPath = resolveAgentConfigPath({ profile });
+  if (!configExistsAtPath(configPath)) {
+    throw new Error(`No ${profile} runtime is configured. Run alan-agent setup or login first.`);
+  }
+  const headless = options.headless ?? args.includes("--headless");
+  const merged = { ...options, args, runtime, headless };
+  const ctx = createHostContext(merged);
+  if (headless) {
+    if (ctx.plan.platform !== "linux") {
+      throw new Error("--headless is only supported on Linux systemd user services");
+    }
+    assertSystemdUserLingerEnabled(merged);
+  }
+  const ensured = ensureDaemonServiceDefinition(merged);
+  enableDaemonService(merged);
+  const inspection = inspectDaemonService(merged);
+  if (ensured.updatePending) {
+    console.info("[alan-agent] Daemon service definition update pending; leaving running service", {
+      profile,
+      state: inspection.state
+    });
+    return;
+  }
+  if (!shouldStartOnInstall(inspection.state)) {
+    console.info("[alan-agent] Per-user daemon service already present", {
+      profile,
+      state: inspection.state
+    });
+    return;
+  }
+  startDaemonService(merged);
+  console.info("[alan-agent] Per-user daemon service installed", { profile });
+}
+function printDaemonServiceStatus(args = []) {
+  const plan = currentServicePlan(args);
+  const result = runServiceCommand({ ...plan.statusCommand, tolerateFailure: true });
+  if (result.status !== 0) {
+    process.stdout.write(`unknown
+${result.output}
+`);
+    return;
+  }
+  process.stdout.write(`${result.output}
+`);
+}
+
+// src/install-command.ts
+async function runInstallCommand(commandArgs) {
+  bindConfigPath(commandArgs);
+  const configured = readConfig();
+  const configurationMode = resolveInstallConfigurationMode(commandArgs, configured);
+  if (configurationMode === "setup") await setupDaemon(commandArgs);
+  if (configurationMode === "login") await loginWithDeviceCode(commandArgs);
+  installDaemonService(commandArgs);
+  runMcpIntegrationCommand(["reconcile", ...commandArgs]);
+}
+
+// src/lifecycle-logger.ts
+var AgentLifecycleLogger = class _AgentLifecycleLogger {
+  context;
+  constructor(context = {}) {
+    this.context = normalizeContext(context);
+  }
+  setContext(context) {
+    this.context = normalizeContext({ ...this.context, ...context });
+  }
+  child(context) {
+    return new _AgentLifecycleLogger({ ...this.context, ...context });
+  }
+  debug(event, fields = {}) {
+    this.log("debug", event, fields);
+  }
+  info(event, fields = {}) {
+    this.log("info", event, fields);
+  }
+  warn(event, fields = {}) {
+    this.log("warn", event, fields);
+  }
+  error(event, fields = {}) {
+    this.log("error", event, fields);
+  }
+  log(level, event, fields) {
+    const record2 = omitUndefined({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      level,
+      component: "agent-manager",
+      event,
+      ...this.context,
+      ...normalizeFields(fields)
+    });
+    console[level](JSON.stringify(record2));
+  }
+};
+function lifecycleContextFromEnv(env) {
+  return normalizeContext({
+    taskId: env.ALAN_TASK_ID,
+    conversationId: env.ALAN_SESSION_ID,
+    runId: env.ALAN_RUN_ID,
+    sandboxId: env.ALAN_SANDBOX_ID,
+    provider: env.ALAN_SANDBOX_PROVIDER,
+    backendKind: env.ALAN_BACKEND_KIND,
+    agentVersion: AGENT_VERSION
+  });
+}
+function normalizeContext(context) {
+  return omitUndefined({
+    ...context,
+    agentVersion: context.agentVersion ?? AGENT_VERSION
+  });
+}
+function normalizeFields(fields) {
+  const normalized = {};
+  for (const [key, value2] of Object.entries(fields)) {
+    if (value2 instanceof Error) {
+      normalized[key] = {
+        name: value2.name,
+        message: value2.message,
+        stack: value2.stack
+      };
+    } else {
+      normalized[key] = value2;
+    }
+  }
+  return normalized;
+}
+function omitUndefined(record2) {
+  return Object.fromEntries(Object.entries(record2).filter(([, value2]) => value2 !== void 0));
+}
+
+// ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+var __create3 = Object.create;
+var __defProp3 = Object.defineProperty;
+var __getOwnPropDesc3 = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames3 = Object.getOwnPropertyNames;
+var __getProtoOf3 = Object.getPrototypeOf;
+var __hasOwnProp3 = Object.prototype.hasOwnProperty;
+var __commonJSMin2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __exportAll2 = (all, symbols) => {
+  let target = {};
+  for (var name in all) {
+    __defProp3(target, name, {
+      get: all[name],
+      enumerable: true
+    });
+  }
+  if (symbols) {
+    __defProp3(target, Symbol.toStringTag, { value: "Module" });
+  }
+  return target;
+};
+var __copyProps3 = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var keys = __getOwnPropNames3(from), i = 0, n = keys.length, key; i < n; i++) {
+      key = keys[i];
+      if (!__hasOwnProp3.call(to, key) && key !== except) {
+        __defProp3(to, key, {
+          get: ((k) => from[k]).bind(null, key),
+          enumerable: !(desc = __getOwnPropDesc3(from, key)) || desc.enumerable
+        });
+      }
+    }
+  }
+  return to;
+};
+var __toESM3 = (mod, isNodeMode, target) => (target = mod != null ? __create3(__getProtoOf3(mod)) : {}, __copyProps3(isNodeMode || !mod || !mod.__esModule ? __defProp3(target, "default", {
+  value: mod,
+  enumerable: true
+}) : target, mod));
+
+// ../../node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
+var DRAFT_2020_12_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2020-12/schema", "http://json-schema.org/draft/2020-12/schema"]);
+var DRAFT_2019_09_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2019-09/schema", "http://json-schema.org/draft/2019-09/schema"]);
+var DRAFT_07_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft-07/schema", "http://json-schema.org/draft-07/schema"]);
+var DRAFT_06_URIS2 = /* @__PURE__ */ new Set(["https://json-schema.org/draft-06/schema", "http://json-schema.org/draft-06/schema"]);
+function declares2019Dialect2($schema) {
+  return typeof $schema === "string" && DRAFT_2019_09_URIS2.has($schema.replace(/#$/, ""));
+}
+function declaredDialect2(schema, remedy) {
+  if (!("$schema" in schema) || typeof schema.$schema !== "string") return "2020-12";
+  const declared = schema.$schema.replace(/#$/, "");
+  if (DRAFT_2020_12_URIS2.has(declared)) return "2020-12";
+  if (DRAFT_2019_09_URIS2.has(declared)) return "2019-09";
+  if (DRAFT_07_URIS2.has(declared) || DRAFT_06_URIS2.has(declared)) return "draft-7";
+  throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${schema.$schema.slice(0, 200)}"). The default validator supports JSON Schema 2020-12, 2019-09, draft-07, and draft-06; ${remedy}`);
+}
+
+// ../../node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+var BRANDS2 = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
+function stampErrorBrands2(instance, ctor) {
+  const brands = /* @__PURE__ */ new Set();
+  let current = ctor;
+  while (typeof current === "function") {
+    const brand = current.mcpBrand;
+    if (Object.prototype.hasOwnProperty.call(current, "mcpBrand") && typeof brand === "string") brands.add(brand);
+    current = Object.getPrototypeOf(current);
+  }
+  if (brands.size === 0) return;
+  Object.defineProperty(instance, BRANDS2, {
+    value: brands,
+    enumerable: false,
+    configurable: true
+  });
+}
+function brandedHasInstance2(cls, value2) {
+  try {
+    if (typeof value2 === "object" && value2 !== null && Object.prototype.hasOwnProperty.call(cls, "mcpBrand") && typeof cls.mcpBrand === "string" && Object.prototype.hasOwnProperty.call(value2, BRANDS2)) {
+      const carried = value2[BRANDS2];
+      if (carried && typeof carried.has === "function" && carried.has(cls.mcpBrand)) return true;
+    }
+  } catch {
+  }
+  return Function.prototype[Symbol.hasInstance].call(cls, value2);
+}
+var OAuthError3 = class OAuthError4 extends Error {
+  static {
     Object.defineProperty(this, "mcpBrand", { value: "mcp.OAuthError" });
   }
   static [Symbol.hasInstance](value2) {
@@ -94584,27 +95210,27 @@ async function runMcpStdioProxy(env = process.env, local = new StdioServerTransp
 
 // src/native-hook-command.ts
 var import_node_crypto21 = require("crypto");
-var import_node_fs26 = require("fs");
-var import_node_os16 = require("os");
-var import_node_path28 = require("path");
+var import_node_fs27 = require("fs");
+var import_node_os17 = require("os");
+var import_node_path29 = require("path");
 
 // src/native-project-config.ts
-var import_node_fs25 = require("fs");
-var import_node_path27 = require("path");
+var import_node_fs26 = require("fs");
+var import_node_path28 = require("path");
 var MAX_ALAN_PROJECT_CONFIG_BYTES = 64 * 1024;
 var ORGANIZATION_SLUG_PATTERN = /^[a-z0-9-]+$/;
 var TEAM_IDENTIFIER_PATTERN = /^[A-Z0-9]{2,4}$/i;
 function readAlanProjectPin(cwd) {
   let fd;
   try {
-    fd = (0, import_node_fs25.openSync)(
-      (0, import_node_path27.join)(cwd, "alan.json"),
-      import_node_fs25.constants.O_RDONLY | import_node_fs25.constants.O_NONBLOCK | (import_node_fs25.constants.O_NOFOLLOW ?? 0)
+    fd = (0, import_node_fs26.openSync)(
+      (0, import_node_path28.join)(cwd, "alan.json"),
+      import_node_fs26.constants.O_RDONLY | import_node_fs26.constants.O_NONBLOCK | (import_node_fs26.constants.O_NOFOLLOW ?? 0)
     );
-    const stat2 = (0, import_node_fs25.fstatSync)(fd);
+    const stat2 = (0, import_node_fs26.fstatSync)(fd);
     if (!stat2.isFile() || stat2.size > MAX_ALAN_PROJECT_CONFIG_BYTES) return void 0;
     const buffer = Buffer.allocUnsafe(MAX_ALAN_PROJECT_CONFIG_BYTES + 1);
-    const bytesRead = (0, import_node_fs25.readSync)(fd, buffer, 0, buffer.byteLength, 0);
+    const bytesRead = (0, import_node_fs26.readSync)(fd, buffer, 0, buffer.byteLength, 0);
     if (bytesRead > MAX_ALAN_PROJECT_CONFIG_BYTES) return void 0;
     const parsed = JSON.parse(buffer.subarray(0, bytesRead).toString("utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
@@ -94620,7 +95246,7 @@ function readAlanProjectPin(cwd) {
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs25.closeSync)(fd);
+        (0, import_node_fs26.closeSync)(fd);
       } catch {
       }
     }
@@ -94859,19 +95485,19 @@ function nonNegativeIntegerField(payload, ...names) {
   return void 0;
 }
 function resolveCodexSessionIdFromTranscriptPath(transcriptPath) {
-  const fileName = (0, import_node_path28.basename)(transcriptPath);
+  const fileName = (0, import_node_path29.basename)(transcriptPath);
   const match = /^rollout-.*-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i.exec(
     fileName
   );
   return match?.[1];
 }
-function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.KIMI_CODE_HOME?.trim() || (0, import_node_path28.join)((0, import_node_os16.homedir)(), ".kimi-code")) {
-  if ((0, import_node_path28.basename)(externalSessionId) !== externalSessionId) return void 0;
-  const sessionsDir = (0, import_node_path28.join)(kimiHomeDir, "sessions");
-  if (!(0, import_node_fs26.existsSync)(sessionsDir)) return void 0;
-  for (const workspace of (0, import_node_fs26.readdirSync)(sessionsDir, { withFileTypes: true })) {
+function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.KIMI_CODE_HOME?.trim() || (0, import_node_path29.join)((0, import_node_os17.homedir)(), ".kimi-code")) {
+  if ((0, import_node_path29.basename)(externalSessionId) !== externalSessionId) return void 0;
+  const sessionsDir = (0, import_node_path29.join)(kimiHomeDir, "sessions");
+  if (!(0, import_node_fs27.existsSync)(sessionsDir)) return void 0;
+  for (const workspace of (0, import_node_fs27.readdirSync)(sessionsDir, { withFileTypes: true })) {
     if (!workspace.isDirectory()) continue;
-    const transcriptPath = (0, import_node_path28.join)(
+    const transcriptPath = (0, import_node_path29.join)(
       sessionsDir,
       workspace.name,
       externalSessionId,
@@ -94879,7 +95505,7 @@ function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.
       "main",
       "wire.jsonl"
     );
-    if ((0, import_node_fs26.existsSync)(transcriptPath)) return transcriptPath;
+    if ((0, import_node_fs27.existsSync)(transcriptPath)) return transcriptPath;
   }
   return void 0;
 }
@@ -94914,7 +95540,7 @@ function parseNativeHookEnvelope(input2) {
   const rawHookEvent = input2.hookEvent ?? stringField4(payload, "hook_event_name", "hookEvent", "hookEventName", "type") ?? "notification";
   const eventType = normalizeHookEvent(rawHookEvent);
   const cwd = stringField4(payload, "cwd", "working_directory", "workingDirectory") ?? firstStringArrayField(payload, "workspace_roots", "workspaceRoots");
-  const resolvedCwd = cwd ? (0, import_node_path28.resolve)(cwd) : void 0;
+  const resolvedCwd = cwd ? (0, import_node_path29.resolve)(cwd) : void 0;
   const transcriptPath = eventType === "subagent_start" || eventType === "subagent_end" ? stringField4(
     payload,
     "agent_transcript_path",
@@ -94960,7 +95586,7 @@ function parseNativeHookEnvelope(input2) {
     ...(eventType === "subagent_start" || eventType === "subagent_end") && parentSessionId ? { parentExternalSessionId: parentSessionId } : {},
     ...resolvedCwd ? { cwd: resolvedCwd } : {},
     ...projectPin,
-    ...transcriptPath ? { transcriptPath: (0, import_node_path28.resolve)(transcriptPath) } : {},
+    ...transcriptPath ? { transcriptPath: (0, import_node_path29.resolve)(transcriptPath) } : {},
     ...cursor ? { sourceCursor: cursor } : {},
     providerPayload
   };
@@ -95007,7 +95633,7 @@ function readBoundedHookPayload(fd = 0, maxBytes = MAX_NATIVE_HOOK_STDIN_BYTES)
   let totalBytes = 0;
   while (true) {
     const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1 - totalBytes));
-    const bytesRead = (0, import_node_fs26.readSync)(fd, chunk, 0, chunk.byteLength, null);
+    const bytesRead = (0, import_node_fs27.readSync)(fd, chunk, 0, chunk.byteLength, null);
     if (bytesRead === 0) break;
     totalBytes += bytesRead;
     if (totalBytes > maxBytes) throw new Error(`hook input exceeds ${maxBytes} bytes`);
@@ -95090,7 +95716,7 @@ function collectNativeIntegrationStatus(args = []) {
   const config2 = readConfig();
   const configPath = getConfigPath();
   const env = getDaemonCliEnvironment();
-  const homeDir = (0, import_node_os16.homedir)();
+  const homeDir = (0, import_node_os17.homedir)();
   return NATIVE_SESSION_PROVIDER_CAPABILITIES.map((capability) => ({
     provider: capability.providerKind,
     command: capability.command,
@@ -95119,7 +95745,7 @@ function decodeResumeFallbackContext(encoded) {
 }
 
 // src/sandbox.ts
-var import_node_os17 = require("os");
+var import_node_os18 = require("os");
 
 // src/execution-activity-tracker.ts
 var ExecutionActivityTracker = class {
@@ -95733,7 +96359,7 @@ var agentProbeAckSchema = external_exports.object({
 
 // src/sandbox-outbox.ts
 var import_node_crypto23 = require("crypto");
-var import_node_fs27 = require("fs");
+var import_node_fs28 = require("fs");
 function deriveSandboxOutboxKey(sessionToken) {
   if (!sessionToken) {
     throw new Error("sandbox event outbox requires ALAN_SESSION_TOKEN for key derivation");
@@ -95754,24 +96380,24 @@ function assertValidOutboxKey(key, path2) {
 }
 function loadOrCreateSandboxOutboxKey(input2) {
   const keyPath = sandboxOutboxKeyPath(input2.spoolPath);
-  if ((0, import_node_fs27.existsSync)(keyPath)) {
-    (0, import_node_fs27.chmodSync)(keyPath, 384);
-    return assertValidOutboxKey((0, import_node_fs27.readFileSync)(keyPath, "utf8").trim(), keyPath);
+  if ((0, import_node_fs28.existsSync)(keyPath)) {
+    (0, import_node_fs28.chmodSync)(keyPath, 384);
+    return assertValidOutboxKey((0, import_node_fs28.readFileSync)(keyPath, "utf8").trim(), keyPath);
   }
   const initialKey = deriveSandboxOutboxKey(input2.sessionToken);
   try {
-    (0, import_node_fs27.writeFileSync)(keyPath, initialKey, { encoding: "utf8", flag: "wx", mode: 384 });
+    (0, import_node_fs28.writeFileSync)(keyPath, initialKey, { encoding: "utf8", flag: "wx", mode: 384 });
     return initialKey;
   } catch (error61) {
     if (error61.code !== "EEXIST") throw error61;
-    (0, import_node_fs27.chmodSync)(keyPath, 384);
-    return assertValidOutboxKey((0, import_node_fs27.readFileSync)(keyPath, "utf8").trim(), keyPath);
+    (0, import_node_fs28.chmodSync)(keyPath, 384);
+    return assertValidOutboxKey((0, import_node_fs28.readFileSync)(keyPath, "utf8").trim(), keyPath);
   }
 }
 function quarantineUnusableOutbox(path2) {
   const suffix = `corrupt-${Date.now()}-${process.pid}`;
   for (const candidate of [path2, eventJournalDir(path2)]) {
-    if ((0, import_node_fs27.existsSync)(candidate)) (0, import_node_fs27.renameSync)(candidate, `${candidate}.${suffix}`);
+    if ((0, import_node_fs28.existsSync)(candidate)) (0, import_node_fs28.renameSync)(candidate, `${candidate}.${suffix}`);
   }
 }
 function createSandboxEventOutbox(input2) {
@@ -96431,7 +97057,7 @@ async function runSandbox(config2) {
   }
   const presenter = new WebPresenter(wsClient, config2.sessionId, config2.projectPath);
   presenter.setSuppressSessionLifecycle(true);
-  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os17.homedir)() });
+  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os18.homedir)() });
   let lastProviderSessionId = config2.providerSessionId;
   let resumeFallbackContext = config2.resumeFallbackContext;
   let activeBackendKind = config2.backendKind || "claude_cli";
@@ -96728,616 +97354,6 @@ async function runSandbox(config2) {
   wsClient.close();
 }
 
-// src/service-manager.ts
-var import_node_child_process9 = require("child_process");
-var import_node_fs28 = require("fs");
-var import_node_os18 = require("os");
-var import_node_path29 = require("path");
-var SERVICE_LABEL = "ai.tryalan.agent";
-var SYSTEMD_UNIT = "alan-agent.service";
-var WINDOWS_TASK = "Alan Agent";
-function xml(value2) {
-  return value2.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function systemdArg(value2) {
-  return `"${value2.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-}
-function powershellLiteral(value2) {
-  return `'${value2.replaceAll("'", "''")}'`;
-}
-function serviceNames(profile) {
-  if (profile === "production") {
-    return { launchd: SERVICE_LABEL, systemd: SYSTEMD_UNIT, windows: WINDOWS_TASK };
-  }
-  const suffix = profile === "custom" ? "prod" : profile;
-  const title = `${suffix[0]?.toUpperCase()}${suffix.slice(1)}`;
-  return {
-    launchd: `${SERVICE_LABEL}.${suffix}`,
-    systemd: `alan-agent-${suffix}.service`,
-    windows: `${WINDOWS_TASK} ${title}`
-  };
-}
-function buildDaemonServicePlan(input2) {
-  const daemonArgs = [input2.nodeExecutable, input2.cliEntry, "daemon", "--profile", input2.profile];
-  const names = serviceNames(input2.profile);
-  if (input2.platform === "darwin") {
-    const userId = input2.userId ?? process.getuid?.();
-    if (userId === void 0) throw new Error("Cannot determine the current macOS user ID");
-    const domain2 = `gui/${userId}`;
-    const serviceTarget = `${domain2}/${names.launchd}`;
-    const manifestPath = (0, import_node_path29.join)(input2.homeDir, "Library", "LaunchAgents", `${names.launchd}.plist`);
-    const logDir = (0, import_node_path29.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
-    const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
-    const environmentEntries = Object.entries(input2.environment ?? {}).map(([key, value2]) => `    <key>${xml(key)}</key>
-    <string>${xml(value2)}</string>`).join("\n");
-    const environmentBlock = environmentEntries ? `  <key>EnvironmentVariables</key>
-  <dict>
-${environmentEntries}
-  </dict>
-` : "";
-    const manifest = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${names.launchd}</string>
-  <key>ProgramArguments</key>
-  <array>
-${programArguments}
-  </array>
-${environmentBlock}  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <dict>
-    <key>SuccessfulExit</key>
-    <false/>
-  </dict>
-  <key>ThrottleInterval</key>
-  <integer>5</integer>
-  <key>StandardOutPath</key>
-  <string>${xml((0, import_node_path29.join)(logDir, "daemon.log"))}</string>
-  <key>StandardErrorPath</key>
-  <string>${xml((0, import_node_path29.join)(logDir, "daemon-error.log"))}</string>
-</dict>
-</plist>
-`;
-    return {
-      platform: "darwin",
-      manifestPath,
-      manifest,
-      logDirectory: logDir,
-      loadDefinitionCommands: [
-        {
-          command: "launchctl",
-          args: ["bootstrap", domain2, manifestPath],
-          tolerateFailure: true
-        }
-      ],
-      reloadDefinitionCommands: [
-        {
-          command: "launchctl",
-          args: ["bootout", domain2, manifestPath],
-          tolerateFailure: true
-        },
-        {
-          command: "launchctl",
-          args: ["bootstrap", domain2, manifestPath],
-          tolerateFailure: false
-        }
-      ],
-      enableCommands: [
-        {
-          command: "launchctl",
-          args: ["enable", serviceTarget],
-          tolerateFailure: true
-        }
-      ],
-      startCommands: [
-        {
-          command: "launchctl",
-          args: ["kickstart", serviceTarget],
-          tolerateFailure: false
-        }
-      ],
-      stopCommands: [
-        {
-          command: "launchctl",
-          args: ["kill", "SIGTERM", serviceTarget],
-          tolerateFailure: true
-        }
-      ],
-      replaceCommands: [
-        {
-          command: "launchctl",
-          args: ["bootout", domain2, manifestPath],
-          tolerateFailure: true
-        },
-        {
-          command: "launchctl",
-          args: ["bootstrap", domain2, manifestPath],
-          tolerateFailure: false
-        },
-        {
-          command: "launchctl",
-          args: ["kickstart", "-k", serviceTarget],
-          tolerateFailure: false
-        }
-      ],
-      uninstallCommands: [
-        {
-          command: "launchctl",
-          args: ["bootout", domain2, manifestPath],
-          tolerateFailure: true
-        }
-      ],
-      statusCommand: {
-        command: "launchctl",
-        args: ["print", serviceTarget],
-        tolerateFailure: true
-      },
-      isActiveCommand: {
-        command: "launchctl",
-        args: ["print", serviceTarget],
-        tolerateFailure: true
-      },
-      lingerStatusCommand: null
-    };
-  }
-  if (input2.platform === "linux") {
-    const manifestPath = (0, import_node_path29.join)(input2.homeDir, ".config", "systemd", "user", names.systemd);
-    const environmentLines = Object.entries(input2.environment ?? {}).map(([key, value2]) => `Environment=${systemdArg(`${key}=${value2}`)}`).join("\n");
-    const manifest = `[Unit]
-Description=Alan local agent daemon
-After=network-online.target
-Wants=network-online.target
-StartLimitIntervalSec=300
-StartLimitBurst=3
-
-[Service]
-Type=simple
-${environmentLines ? `${environmentLines}
-` : ""}ExecStart=${daemonArgs.map(systemdArg).join(" ")}
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=default.target
-`;
-    return {
-      platform: "linux",
-      manifestPath,
-      manifest,
-      logDirectory: null,
-      loadDefinitionCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "daemon-reload"],
-          tolerateFailure: false
-        }
-      ],
-      reloadDefinitionCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "daemon-reload"],
-          tolerateFailure: false
-        }
-      ],
-      enableCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "enable", names.systemd],
-          tolerateFailure: false
-        }
-      ],
-      startCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "start", names.systemd],
-          tolerateFailure: false
-        }
-      ],
-      stopCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "stop", names.systemd],
-          tolerateFailure: true
-        }
-      ],
-      replaceCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "daemon-reload"],
-          tolerateFailure: false
-        },
-        {
-          command: "systemctl",
-          args: ["--user", "restart", names.systemd],
-          tolerateFailure: false
-        }
-      ],
-      uninstallCommands: [
-        {
-          command: "systemctl",
-          args: ["--user", "disable", "--now", names.systemd],
-          tolerateFailure: true
-        },
-        {
-          command: "systemctl",
-          args: ["--user", "daemon-reload"],
-          tolerateFailure: false
-        }
-      ],
-      statusCommand: {
-        command: "systemctl",
-        args: ["--user", "status", names.systemd, "--no-pager"],
-        tolerateFailure: true
-      },
-      isActiveCommand: {
-        command: "systemctl",
-        args: ["--user", "is-active", names.systemd],
-        tolerateFailure: true
-      },
-      lingerStatusCommand: {
-        command: "loginctl",
-        args: ["show-user", "$(id -un)", "-p", "Linger"],
-        tolerateFailure: true
-      }
-    };
-  }
-  const environmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
-  const directArgument = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
-  const executable = powershellLiteral(environmentPrefix ? "powershell.exe" : input2.nodeExecutable);
-  const argument = powershellLiteral(
-    environmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${environmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : directArgument
-  );
-  const registerScript = [
-    "$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name",
-    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument ${argument}`,
-    "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $currentUser",
-    "$principal = New-ScheduledTaskPrincipal -UserId $currentUser -LogonType Interactive -RunLevel Limited",
-    "$settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero)",
-    `Register-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null`
-  ].join("; ");
-  return {
-    platform: "win32",
-    manifestPath: null,
-    manifest: null,
-    logDirectory: null,
-    loadDefinitionCommands: [
-      {
-        command: "powershell.exe",
-        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
-        tolerateFailure: false
-      }
-    ],
-    reloadDefinitionCommands: [
-      {
-        command: "powershell.exe",
-        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
-        tolerateFailure: false
-      }
-    ],
-    enableCommands: [],
-    startCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
-        ],
-        tolerateFailure: false
-      }
-    ],
-    stopCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Stop-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue`
-        ],
-        tolerateFailure: true
-      }
-    ],
-    replaceCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `${registerScript}; Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
-        ],
-        tolerateFailure: false
-      }
-    ],
-    uninstallCommands: [
-      {
-        command: "powershell.exe",
-        args: [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Confirm:$false -ErrorAction SilentlyContinue`
-        ],
-        tolerateFailure: true
-      }
-    ],
-    statusCommand: {
-      command: "powershell.exe",
-      args: [
-        "-NoProfile",
-        "-NonInteractive",
-        "-Command",
-        `Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} | Format-List TaskName,State`
-      ],
-      tolerateFailure: true
-    },
-    isActiveCommand: {
-      command: "powershell.exe",
-      args: [
-        "-NoProfile",
-        "-NonInteractive",
-        "-Command",
-        `(Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue).State`
-      ],
-      tolerateFailure: true
-    },
-    lingerStatusCommand: null
-  };
-}
-function resolveCurrentPlatform() {
-  const currentPlatform = (0, import_node_os18.platform)();
-  if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
-    throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
-  }
-  return currentPlatform;
-}
-function currentServicePlan(args, runtime) {
-  const currentPlatform = resolveCurrentPlatform();
-  const profile = resolveEndpointProfileFromArgs(args);
-  const cliEntry = runtime?.cliEntry ?? process.argv[1];
-  if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
-  return buildDaemonServicePlan({
-    platform: currentPlatform,
-    homeDir: (0, import_node_os18.homedir)(),
-    nodeExecutable: runtime?.executable ?? process.execPath,
-    cliEntry: (0, import_node_path29.resolve)(cliEntry),
-    profile,
-    environment: runtime?.environment
-  });
-}
-function writeManifestAtomic(path2, contents) {
-  (0, import_node_fs28.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true, mode: 448 });
-  const pendingPath = `${path2}.pending-${process.pid}`;
-  try {
-    (0, import_node_fs28.writeFileSync)(pendingPath, contents, { mode: 384 });
-    (0, import_node_fs28.chmodSync)(pendingPath, 384);
-    (0, import_node_fs28.renameSync)(pendingPath, path2);
-  } finally {
-    (0, import_node_fs28.rmSync)(pendingPath, { force: true });
-  }
-}
-function defaultReadManifest(path2) {
-  if (!(0, import_node_fs28.existsSync)(path2)) return null;
-  return (0, import_node_fs28.readFileSync)(path2, "utf8");
-}
-function runServiceCommand(command) {
-  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, { encoding: "utf8", shell: false });
-  const status = result.status ?? 1;
-  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
-  if (status !== 0 && !command.tolerateFailure) {
-    throw new Error(
-      `Service command failed (${command.command} ${command.args.join(" ")}): ${output2 || `exit ${status}`}`
-    );
-  }
-  return { status, output: output2 };
-}
-function defaultSleep(ms) {
-  return new Promise((resolveSleep) => {
-    setTimeout(resolveSleep, ms);
-  });
-}
-function parseServiceHostState(servicePlatform, result) {
-  const output2 = result.output;
-  if (servicePlatform === "linux") {
-    const trimmed = output2.trim().toLowerCase();
-    if (trimmed === "inactive" || trimmed === "failed" || trimmed === "dead" || /\binactive\b/i.test(output2) || /\bfailed\b/i.test(output2)) {
-      return "stopped";
-    }
-  }
-  if (result.status !== 0) return "unknown";
-  if (servicePlatform === "darwin") {
-    if (/\bstate\s*=\s*running\b/i.test(output2)) return "running";
-    if (/\bstate\s*=\s*(not running|waiting|stopped)\b/i.test(output2)) return "stopped";
-    if (/\bpid\s*=\s*[1-9]\d*\b/i.test(output2)) return "running";
-    if (/could not find service/i.test(output2)) return "stopped";
-    return "unknown";
-  }
-  if (servicePlatform === "linux") {
-    const trimmed = output2.trim().toLowerCase();
-    if (trimmed === "active" || /\bactive\s*\(running\)/i.test(output2)) return "running";
-    if (trimmed === "activating" || trimmed === "reloading") return "starting";
-    return "unknown";
-  }
-  const stateMatch = output2.match(/\b(?:State|state)\s*[:=]\s*(\w+)/);
-  const state = (stateMatch?.[1] ?? output2.trim()).toLowerCase();
-  if (state === "running") return "running";
-  if (state === "ready" || state === "disabled" || state === "queued") return "stopped";
-  return "unknown";
-}
-function resolveEnsureDefinitionOutcome(input2) {
-  if (!input2.definitionChanged) {
-    return { changed: false, updatePending: false };
-  }
-  if (input2.hostState === "running" || input2.hostState === "starting") {
-    return { changed: true, updatePending: true };
-  }
-  return { changed: true, updatePending: false };
-}
-function shouldStartOnInstall(hostState) {
-  return hostState === "stopped";
-}
-function resolveUsername(options) {
-  if (options?.username) return options.username;
-  try {
-    return (0, import_node_os18.userInfo)().username;
-  } catch {
-    return process.env.USER || process.env.USERNAME || "unknown";
-  }
-}
-function buildLingerStatusCommand(username) {
-  return {
-    command: "loginctl",
-    args: ["show-user", username, "-p", "Linger"],
-    tolerateFailure: true
-  };
-}
-function assertSystemdUserLingerEnabled(options = {}) {
-  const username = resolveUsername(options);
-  const run = options.runCommand ?? runServiceCommand;
-  const result = run(buildLingerStatusCommand(username));
-  if (result.status !== 0) {
-    throw new Error(
-      `Cannot verify systemd user linger for ${username} (loginctl failed). For durable headless VM boot run: sudo loginctl enable-linger ${username}`
-    );
-  }
-  if (!/Linger=yes/i.test(result.output)) {
-    throw new Error(
-      `systemd user linger is disabled for ${username}. For durable headless VM boot run: sudo loginctl enable-linger ${username}`
-    );
-  }
-}
-function createHostContext(options = {}) {
-  const args = options.args ?? [];
-  const plan = currentServicePlan(args, options.runtime);
-  const run = options.runCommand ?? runServiceCommand;
-  const sleep4 = options.sleep ?? defaultSleep;
-  const nowMs = options.nowMs ?? Date.now;
-  const readManifest = options.readManifest ?? defaultReadManifest;
-  const writeManifest = options.writeManifest ?? writeManifestAtomic;
-  const removeManifest = options.removeManifest ?? ((path2) => (0, import_node_fs28.rmSync)(path2, { force: true }));
-  const ensureLogDir = options.ensureLogDir ?? (() => {
-    if (plan.logDirectory) (0, import_node_fs28.mkdirSync)(plan.logDirectory, { recursive: true, mode: 448 });
-  });
-  return {
-    args,
-    plan,
-    run,
-    sleep: sleep4,
-    nowMs,
-    readManifest,
-    writeManifest,
-    removeManifest,
-    ensureLogDir,
-    profile: resolveEndpointProfileFromArgs(args)
-  };
-}
-function inspectDaemonService(options = {}) {
-  const { plan, run, nowMs } = createHostContext(options);
-  const result = run(plan.isActiveCommand);
-  const state = parseServiceHostState(plan.platform, result);
-  return {
-    state,
-    platform: plan.platform,
-    detail: result.output || void 0,
-    observedAtMs: nowMs()
-  };
-}
-function ensureDaemonServiceDefinition(options = {}) {
-  const ctx = createHostContext(options);
-  const { plan, run, readManifest, writeManifest, ensureLogDir } = ctx;
-  let definitionChanged = false;
-  if (plan.manifestPath && plan.manifest) {
-    ensureLogDir();
-    const existing = readManifest(plan.manifestPath);
-    definitionChanged = existing !== plan.manifest;
-    if (definitionChanged) {
-      writeManifest(plan.manifestPath, plan.manifest);
-    }
-  } else if (plan.platform === "win32") {
-    definitionChanged = true;
-  }
-  const inspection = inspectDaemonService(options);
-  const outcome = resolveEnsureDefinitionOutcome({
-    definitionChanged,
-    hostState: inspection.state
-  });
-  if (outcome.updatePending) {
-    return outcome;
-  }
-  if (inspection.state === "running" || inspection.state === "starting") {
-    return outcome;
-  }
-  const definitionCommands = inspection.state === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
-  for (const command of definitionCommands) run(command);
-  return outcome;
-}
-function enableDaemonService(options = {}) {
-  const { plan, run } = createHostContext(options);
-  for (const command of plan.enableCommands) run(command);
-}
-function startDaemonService(options = {}) {
-  const { plan, run } = createHostContext(options);
-  for (const command of plan.startCommands) run(command);
-}
-function uninstallDaemonService(args = [], options = {}) {
-  const ctx = createHostContext({ ...options, args: options.args ?? args });
-  for (const command of ctx.plan.uninstallCommands) ctx.run(command);
-  if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
-  console.info("[alan-agent] Per-user daemon service removed");
-}
-function installDaemonService(args = [], runtime, options = {}) {
-  const profile = resolveEndpointProfileFromArgs(args);
-  const configPath = resolveAgentConfigPath({ profile });
-  if (!configExistsAtPath(configPath)) {
-    throw new Error(`No ${profile} runtime is configured. Run alan-agent setup or login first.`);
-  }
-  const headless = options.headless ?? args.includes("--headless");
-  const merged = { ...options, args, runtime, headless };
-  const ctx = createHostContext(merged);
-  if (headless) {
-    if (ctx.plan.platform !== "linux") {
-      throw new Error("--headless is only supported on Linux systemd user services");
-    }
-    assertSystemdUserLingerEnabled(merged);
-  }
-  const ensured = ensureDaemonServiceDefinition(merged);
-  enableDaemonService(merged);
-  const inspection = inspectDaemonService(merged);
-  if (ensured.updatePending) {
-    console.info("[alan-agent] Daemon service definition update pending; leaving running service", {
-      profile,
-      state: inspection.state
-    });
-    return;
-  }
-  if (!shouldStartOnInstall(inspection.state)) {
-    console.info("[alan-agent] Per-user daemon service already present", {
-      profile,
-      state: inspection.state
-    });
-    return;
-  }
-  startDaemonService(merged);
-  console.info("[alan-agent] Per-user daemon service installed", { profile });
-}
-function printDaemonServiceStatus(args = []) {
-  const plan = currentServicePlan(args);
-  const result = runServiceCommand({ ...plan.statusCommand, tolerateFailure: true });
-  if (result.status !== 0) {
-    process.stdout.write(`unknown
-${result.output}
-`);
-    return;
-  }
-  process.stdout.write(`${result.output}
-`);
-}
-
 // src/skills/skill-cli.ts
 var import_promises6 = require("fs/promises");
 var import_node_os19 = require("os");
@@ -97536,13 +97552,7 @@ async function main() {
     return;
   }
   if (command === "install") {
-    bindConfigPath(commandArgs);
-    const configured = readConfig();
-    const configurationMode = resolveInstallConfigurationMode(commandArgs, configured);
-    const setup = configurationMode === "setup" ? await setupDaemon(commandArgs) : null;
-    if (configurationMode === "login") await loginWithDeviceCode(commandArgs);
-    if (!setup?.daemonAlreadyRunning) installDaemonService(commandArgs);
-    runMcpIntegrationCommand(["reconcile", ...commandArgs]);
+    await runInstallCommand(commandArgs);
     return;
   }
   if (command === "login") {