@alan-ai-hq/agent-manager 0.1.95 → 0.1.96

package/dist/index.cjs

@@ -3404,7 +3404,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes13, createHash: createHash19 } = require("crypto");
+    var { randomBytes: randomBytes13, createHash: createHash18 } = require("crypto");
     var { Duplex, Readable: Readable2 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -4061,7 +4061,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash19("sha1").update(key + GUID).digest("base64");
+        const digest = createHash18("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -4428,7 +4428,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash19 } = require("crypto");
+    var { createHash: createHash18 } = require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -4725,7 +4725,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash19("sha1").update(key + GUID).digest("base64");
+        const digest = createHash18("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -15451,7 +15451,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.95";
+var AGENT_VERSION = "0.1.96";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -49610,16 +49610,6 @@ async function probeLocalDaemon(port, token, timeoutMs = 750) {
   const probe = await probeLocalDaemonEndpoint(port, token, timeoutMs);
   return probe.state === "running" ? probe.status : null;
 }
-function requestLocalDaemonShutdown(port, token) {
-  return fetch(`http://127.0.0.1:${port}/shutdown?force=1`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      "x-alan-shutdown-reason": "runtime_shutdown"
-    },
-    signal: AbortSignal.timeout(5e3)
-  });
-}
 async function adoptLocalDaemonControl(input2) {
   const timeoutMs = input2.timeoutMs ?? 750;
   try {
@@ -76697,13 +76687,13 @@ var RuntimeRunJournal = class {
    * Keep the exact interruption outcome until a durable authenticated control
    * channel can prove both identity and ownership.
    */
-  assessRecovery(runId, isProcessAlive2) {
+  assessRecovery(runId, isProcessAlive) {
     const entry = this.entries.get(runId);
     if (!entry) return void 0;
     if (entry.providerPid === void 0) {
       return { reattachable: false, reason: "provider_not_recorded" };
     }
-    if (!isProcessAlive2(entry.providerPid)) {
+    if (!isProcessAlive(entry.providerPid)) {
       return {
         reattachable: false,
         reason: "provider_not_running",
@@ -80450,17 +80440,6 @@ async function runLocalDaemonRecoveryLadder(input2) {
     error: "The local daemon exhausted its reconnect and safe-restart recovery budget."
   };
 }
-function writeRegisteredRuntimeConfig(args, previousConfig, registered) {
-  writeConfig({
-    ...registered,
-    localApiPort: getLocalApiPort(args, {}),
-    localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto19.randomBytes)(24).toString("hex"),
-    localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto19.randomUUID)(),
-    localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
-    eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
-    daemonEpoch: previousConfig.daemonEpoch
-  });
-}
 async function setupDaemon(args) {
   bindConfigPath(args);
   const previousConfig = readConfigForRegistration();
@@ -80521,7 +80500,7 @@ async function setupDaemon(args) {
       credentialGeneration: body2.credentialGeneration,
       configPath: getConfigPath()
     });
-    return body2.runtimeId !== liveConfig.runtimeId;
+    return { daemonAlreadyRunning: true };
   }
   if (readLocalDaemonOwnerLease(getConfigPath())) {
     throw new Error(
@@ -80535,17 +80514,23 @@ async function setupDaemon(args) {
     if (setupToken && error61 instanceof RuntimeSetupGrantExpiredError) {
       console.info("[alan-agent] Setup link expired; continuing with browser authorization");
       await loginWithDeviceCode(args);
-      return false;
+      return { daemonAlreadyRunning: false };
     }
     throw error61;
   }
-  writeRegisteredRuntimeConfig(args, previousConfig, {
+  writeConfig({
     apiUrl,
     wsUrl,
     endpointProfile,
     runtimeId: body.runtimeId,
     runtimeToken: body.runtimeToken,
     runtimeRenewalToken: body.runtimeRenewalToken,
+    localApiPort: getLocalApiPort(args, {}),
+    localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto19.randomBytes)(24).toString("hex"),
+    localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto19.randomUUID)(),
+    localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+    eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+    daemonEpoch: previousConfig.daemonEpoch,
     displayName: body.displayName,
     installationId
   });
@@ -80554,7 +80539,7 @@ async function setupDaemon(args) {
     runtimeId: body.runtimeId,
     configPath: getConfigPath()
   });
-  return false;
+  return { daemonAlreadyRunning: false };
 }
 async function loginWithDeviceCode(args) {
   bindConfigPath(args);
@@ -80643,13 +80628,19 @@ async function loginWithDeviceCode(args) {
       if (ownedPending?.operationId !== operation.id) {
         throw new Error("browser authorization sidecar ownership was lost before finalization");
       }
-      writeRegisteredRuntimeConfig(args, previousConfig, {
+      writeConfig({
         apiUrl,
         wsUrl,
         endpointProfile,
         runtimeId: body.runtime.id,
         runtimeToken: body.runtimeToken,
         runtimeRenewalToken: body.runtimeRenewalToken,
+        localApiPort: getLocalApiPort(args, {}),
+        localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto19.randomBytes)(24).toString("hex"),
+        localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto19.randomUUID)(),
+        localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+        eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+        daemonEpoch: previousConfig.daemonEpoch,
         displayName: body.runtime.displayName ?? displayName,
         installationId
       });
@@ -80688,7 +80679,14 @@ async function stopDaemon(args) {
     console.info("[alan-agent] No daemon listening", { port: localApiPort });
     return;
   }
-  const response = await requestLocalDaemonShutdown(localApiPort, localApiToken);
+  const response = await fetch(`http://127.0.0.1:${localApiPort}/shutdown?force=1`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${localApiToken}`,
+      "x-alan-shutdown-reason": "runtime_shutdown"
+    },
+    signal: AbortSignal.timeout(5e3)
+  });
   if (!response.ok) {
     throw new Error(`Failed to stop daemon: HTTP ${response.status}`);
   }
@@ -80833,7 +80831,14 @@ async function drainAndStopLocalDaemonBeforeCredentialCleanup(args, stored) {
       `Logout could not safely drain the local daemon (HTTP ${prepare.status}). Stop or update the local service before removing credentials.`
     );
   }
-  const shutdown = await requestLocalDaemonShutdown(localApiPort, localApiToken);
+  const shutdown = await fetch(`http://127.0.0.1:${localApiPort}/shutdown?force=1`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${localApiToken}`,
+      "x-alan-shutdown-reason": "runtime_shutdown"
+    },
+    signal: AbortSignal.timeout(5e3)
+  });
   if (!shutdown.ok) {
     throw new Error(`Logout could not stop the local daemon (HTTP ${shutdown.status}).`);
   }
@@ -80994,9 +80999,6 @@ async function printDoctor(args = []) {
   );
 }
 
-// src/install-command.ts
-var import_promises6 = require("timers/promises");
-
 // src/mcp-config-adapters.ts
 var import_node_crypto20 = require("crypto");
 var import_node_fs23 = require("fs");
@@ -82381,14 +82383,12 @@ function runMcpIntegrationCommand(args, options = {}) {
 
 // src/service-manager.ts
 var import_node_child_process9 = require("child_process");
-var import_node_crypto21 = require("crypto");
 var import_node_fs25 = require("fs");
 var import_node_os16 = require("os");
 var import_node_path27 = require("path");
 var SERVICE_LABEL = "ai.tryalan.agent";
 var SYSTEMD_UNIT = "alan-agent.service";
 var WINDOWS_TASK = "Alan Agent";
-var STOP_POLL_INTERVAL_MS = 200;
 function xml(value2) {
   return value2.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
@@ -82398,18 +82398,6 @@ function systemdArg(value2) {
 function powershellLiteral(value2) {
   return `'${value2.replaceAll("'", "''")}'`;
 }
-function powershellCommand(script, tolerateFailure = false) {
-  return {
-    command: "powershell.exe",
-    args: ["-NoProfile", "-NonInteractive", "-Command", script],
-    tolerateFailure
-  };
-}
-function windowsCommandLineArgument(value2) {
-  if (value2 && !/[\s"]/u.test(value2)) return value2;
-  const escaped = value2.replace(/(\\*)"/gu, (_match, slashes) => `${slashes}${slashes}\\"`).replace(/\\+$/u, (slashes) => `${slashes}${slashes}`);
-  return `"${escaped}"`;
-}
 function serviceNames(profile) {
   if (profile === "production") {
     return { launchd: SERVICE_LABEL, systemd: SYSTEMD_UNIT, windows: WINDOWS_TASK };
@@ -82431,7 +82419,7 @@ function buildDaemonServicePlan(input2) {
     const domain2 = `gui/${userId}`;
     const serviceTarget = `${domain2}/${names.launchd}`;
     const manifestPath = (0, import_node_path27.join)(input2.homeDir, "Library", "LaunchAgents", `${names.launchd}.plist`);
-    const logDir2 = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
+    const logDir = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
     const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
     const environmentEntries = Object.entries(input2.environment ?? {}).map(([key, value2]) => `    <key>${xml(key)}</key>
     <string>${xml(value2)}</string>`).join("\n");
@@ -82460,9 +82448,9 @@ ${environmentBlock}  <key>RunAtLoad</key>
   <key>ThrottleInterval</key>
   <integer>5</integer>
   <key>StandardOutPath</key>
-  <string>${xml((0, import_node_path27.join)(logDir2, "daemon.log"))}</string>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xml((0, import_node_path27.join)(logDir2, "daemon-error.log"))}</string>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon-error.log"))}</string>
 </dict>
 </plist>
 `;
@@ -82470,7 +82458,7 @@ ${environmentBlock}  <key>RunAtLoad</key>
       platform: "darwin",
       manifestPath,
       manifest,
-      logDirectory: logDir2,
+      logDirectory: logDir,
       loadDefinitionCommands: [
         {
           command: "launchctl",
@@ -82511,6 +82499,23 @@ ${environmentBlock}  <key>RunAtLoad</key>
           tolerateFailure: true
         }
       ],
+      replaceCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        },
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: false
+        },
+        {
+          command: "launchctl",
+          args: ["kickstart", "-k", serviceTarget],
+          tolerateFailure: false
+        }
+      ],
       uninstallCommands: [
         {
           command: "launchctl",
@@ -82527,7 +82532,8 @@ ${environmentBlock}  <key>RunAtLoad</key>
         command: "launchctl",
         args: ["print", serviceTarget],
         tolerateFailure: true
-      }
+      },
+      lingerStatusCommand: null
     };
   }
   if (input2.platform === "linux") {
@@ -82590,6 +82596,18 @@ WantedBy=default.target
           tolerateFailure: true
         }
       ],
+      replaceCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        },
+        {
+          command: "systemctl",
+          args: ["--user", "restart", names.systemd],
+          tolerateFailure: false
+        }
+      ],
       uninstallCommands: [
         {
           command: "systemctl",
@@ -82611,179 +82629,117 @@ WantedBy=default.target
         command: "systemctl",
         args: ["--user", "is-active", names.systemd],
         tolerateFailure: true
+      },
+      lingerStatusCommand: {
+        command: "loginctl",
+        args: ["show-user", "$(id -un)", "-p", "Linger"],
+        tolerateFailure: true
       }
     };
   }
-  const logDir = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
-  const legacyEnvironmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
-  const legacyDirectArguments = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
-  const legacyExecutable = legacyEnvironmentPrefix ? "powershell.exe" : input2.nodeExecutable;
-  const legacyArguments = legacyEnvironmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${legacyEnvironmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : legacyDirectArguments;
-  const daemonArguments = [input2.cliEntry, "daemon", "--profile", input2.profile].map(windowsCommandLineArgument).join(" ");
-  const environmentStatements = Object.entries(input2.environment ?? {}).map(
-    ([key, value2]) => `$startInfo.EnvironmentVariables[${powershellLiteral(key)}] = ${powershellLiteral(value2)}`
+  const environmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
+  const directArgument = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
+  const executable = powershellLiteral(environmentPrefix ? "powershell.exe" : input2.nodeExecutable);
+  const argument = powershellLiteral(
+    environmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${environmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : directArgument
   );
-  const launcherScript = [
-    "$ErrorActionPreference = 'Stop'",
-    "$startInfo = [System.Diagnostics.ProcessStartInfo]::new()",
-    `$startInfo.FileName = ${powershellLiteral(input2.nodeExecutable)}`,
-    `$startInfo.Arguments = ${powershellLiteral(daemonArguments)}`,
-    `$startInfo.WorkingDirectory = ${powershellLiteral((0, import_node_path27.dirname)(input2.cliEntry))}`,
-    "$startInfo.UseShellExecute = $false",
-    "$startInfo.CreateNoWindow = $true",
-    "$startInfo.RedirectStandardOutput = $true",
-    "$startInfo.RedirectStandardError = $true",
-    ...environmentStatements,
-    `$stdout = [System.IO.File]::Open(${powershellLiteral((0, import_node_path27.join)(logDir, "daemon-launcher.log"))}, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::ReadWrite)`,
-    `$stderr = [System.IO.File]::Open(${powershellLiteral((0, import_node_path27.join)(logDir, "daemon-launcher-error.log"))}, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::ReadWrite)`,
-    "$process = [System.Diagnostics.Process]::new()",
-    "$process.StartInfo = $startInfo",
-    "try { if (-not $process.Start()) { throw 'Alan daemon process did not start' }; $stdoutCopy = $process.StandardOutput.BaseStream.CopyToAsync($stdout); $stderrCopy = $process.StandardError.BaseStream.CopyToAsync($stderr); $process.WaitForExit(); [System.Threading.Tasks.Task]::WaitAll([System.Threading.Tasks.Task[]]@($stdoutCopy, $stderrCopy)); $exitCode = $process.ExitCode } finally { $stdout.Dispose(); $stderr.Dispose(); $process.Dispose() }",
-    "exit $exitCode"
-  ].join("; ");
-  const executable = powershellLiteral("powershell.exe");
-  const launcherArguments = `-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(launcherScript, "utf16le").toString("base64")}`;
-  const settingsScript = "New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries";
-  const ownerMarker = `Alan daemon owner v1 ${(0, import_node_crypto21.createHash)("sha256").update(
-    JSON.stringify({
-      executable: input2.nodeExecutable,
-      cliEntry: input2.cliEntry,
-      profile: input2.profile,
-      taskBaseName: names.windows
-    })
-  ).digest("hex")}`;
-  const definitionMarker = `${ownerMarker}; definition v3 ${(0, import_node_crypto21.createHash)("sha256").update(
-    JSON.stringify({
-      executable: "powershell.exe",
-      launcherArguments,
-      workingDirectory: (0, import_node_path27.dirname)(input2.cliEntry),
-      settingsScript,
-      taskBaseName: names.windows
-    })
-  ).digest("hex")}`;
-  const windowsDefinitionContext = [
-    `$expectedLauncherArguments = ${powershellLiteral(launcherArguments)}`,
-    `$expectedWorkingDirectory = ${powershellLiteral((0, import_node_path27.dirname)(input2.cliEntry))}`,
-    `$expectedOwnerMarker = ${powershellLiteral(`${ownerMarker};`)}`,
-    `$expectedDefinitionMarker = ${powershellLiteral(definitionMarker)}`,
-    `$expectedLegacyExecutable = ${powershellLiteral(legacyExecutable)}`,
-    `$expectedLegacyArguments = ${powershellLiteral(legacyArguments)}`
-  ].join("; ");
-  const taskContext = [
-    "$currentIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()",
-    "$currentUser = $currentIdentity.Name",
-    "$currentSid = $currentIdentity.User.Value",
-    `$taskName = ${powershellLiteral(names.windows)} + ' ' + $currentSid`
-  ].join("; ");
-  const resolveTaskSid = "function Resolve-TaskSid([string]$value) { try { return ([System.Security.Principal.NTAccount]$value).Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { try { return [System.Security.Principal.SecurityIdentifier]::new($value).Value } catch { return '' } } }";
-  const currentLookup = "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]";
-  const checkCurrentOwnership = [
-    currentLookup,
-    "$currentOwned = $false",
-    "if ($null -ne $task) { try {",
-    "$taskAction = @($task.Actions)[0]",
-    "$currentOwned = @($task.Actions).Count -eq 1 -and (Resolve-TaskSid ([string]$task.Principal.UserId)) -eq $currentSid -and (([string]$task.Description).StartsWith($expectedOwnerMarker, [System.StringComparison]::Ordinal) -or (([string]$taskAction.Execute) -ieq 'powershell.exe' -and ([string]$taskAction.Arguments) -ceq $expectedLauncherArguments -and ([string]$taskAction.WorkingDirectory) -ieq $expectedWorkingDirectory))",
-    "} catch { $currentOwned = $false } }"
-  ].join("; ");
-  const legacyLookup = `$legacyTask = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq ${powershellLiteral(names.windows)} })[0]`;
-  const checkLegacyOwnership = [
-    legacyLookup,
-    "$legacyOwned = $false",
-    "$legacyState = 'Missing'",
-    "if ($null -ne $legacyTask) { try {",
-    "$legacyState = [string]$legacyTask.State",
-    "$legacySid = Resolve-TaskSid ([string]$legacyTask.Principal.UserId)",
-    "$legacyAction = @($legacyTask.Actions)[0]",
-    "if ($null -ne $legacyAction) {",
-    "$legacyOwned = $legacySid -eq $currentSid -and @($legacyTask.Actions).Count -eq 1 -and ((([string]$legacyAction.Execute) -ieq $expectedLegacyExecutable -and ([string]$legacyAction.Arguments) -ieq $expectedLegacyArguments -and ([string]$legacyAction.WorkingDirectory) -eq '') -or (([string]$legacyAction.Execute) -ieq 'powershell.exe' -and ([string]$legacyAction.Arguments) -ceq $expectedLauncherArguments -and ([string]$legacyAction.WorkingDirectory) -ieq $expectedWorkingDirectory))",
-    "}",
-    "} catch { $legacyOwned = $false } }"
-  ].join("; ");
-  const assertOwnedTasks = [
-    checkCurrentOwnership,
-    checkLegacyOwnership,
-    `if ($null -ne $task -and -not $currentOwned) { throw ${powershellLiteral(`${names.windows} task is not owned by this Alan installation`)} }`,
-    `if ($null -ne $legacyTask -and -not $legacyOwned) { throw ${powershellLiteral(`Legacy ${names.windows} task is not owned by this Alan installation`)} }`,
-    "if ($null -ne $task -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$task.State)) { throw 'Alan daemon task became active or has unknown state' }",
-    "if ($null -ne $legacyTask -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$legacyTask.State)) { throw 'Legacy Alan daemon task became active or has unknown state' }"
-  ].join("; ");
-  const cleanupLegacyTask = [
-    checkLegacyOwnership,
-    `if ($null -ne $legacyTask -and -not $legacyOwned) { throw ${powershellLiteral(`Legacy ${names.windows} task is not owned by this Alan installation`)} }`,
-    "if ($null -ne $legacyTask -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$legacyTask.State)) { throw 'Legacy Alan daemon task became active or has unknown state' }",
-    `if ($null -ne $legacyTask) { Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -TaskPath '\\' -Confirm:$false -ErrorAction Stop }`,
-    `$legacyRemaining = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq ${powershellLiteral(names.windows)} })[0]`,
-    "if ($null -ne $legacyRemaining) { throw 'Legacy Alan daemon task still exists after migration' }"
-  ].join("; ");
   const registerScript = [
-    taskContext,
-    resolveTaskSid,
-    windowsDefinitionContext,
-    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument $expectedLauncherArguments -WorkingDirectory $expectedWorkingDirectory`,
+    "$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name",
+    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument ${argument}`,
     "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $currentUser",
     "$principal = New-ScheduledTaskPrincipal -UserId $currentUser -LogonType Interactive -RunLevel Limited",
-    `$settings = ${settingsScript}`,
-    assertOwnedTasks,
-    "Register-ScheduledTask -TaskName $taskName -Description $expectedDefinitionMarker -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force -ErrorAction Stop | Out-Null",
-    cleanupLegacyTask,
-    "$registeredTask = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
-    "if ($null -eq $registeredTask -or $registeredTask.Description -cne $expectedDefinitionMarker) { throw 'Alan daemon task definition was not applied' }"
-  ].join("; ");
-  const uninstallScript = [
-    taskContext,
-    resolveTaskSid,
-    windowsDefinitionContext,
-    assertOwnedTasks,
-    "if ($null -ne $legacyTask) { Unregister-ScheduledTask -TaskName $legacyTask.TaskName -TaskPath $legacyTask.TaskPath -Confirm:$false -ErrorAction Stop }",
-    "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
-    "if ($null -ne $task) { Unregister-ScheduledTask -TaskName $taskName -TaskPath '\\' -Confirm:$false -ErrorAction Stop }",
-    "$remaining = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and ($_.TaskName -eq $taskName -or $_.TaskName -eq $legacyTask.TaskName) })",
-    "if ($remaining.Count -gt 0) { throw 'Alan daemon task still exists after unregister' }"
+    "$settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero)",
+    `Register-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null`
   ].join("; ");
-  const statusScript = [
-    taskContext,
-    resolveTaskSid,
-    windowsDefinitionContext,
-    checkCurrentOwnership,
-    checkLegacyOwnership,
-    "$definitionMatches = $false",
-    "if ($null -eq $task) { Write-Output 'State: Missing' } else {",
-    "$taskTrigger = @($task.Triggers)[0]",
-    "$definitionMatches = @($task.Actions).Count -eq 1 -and @($task.Triggers).Count -eq 1 -and $task.Description -ceq $expectedDefinitionMarker -and (Resolve-TaskSid ([string]$task.Principal.UserId)) -eq $currentSid -and [string]$task.Principal.LogonType -eq 'Interactive' -and [string]$task.Principal.RunLevel -eq 'Limited' -and [string]$taskAction.Execute -ieq 'powershell.exe' -and [string]$taskAction.Arguments -ceq $expectedLauncherArguments -and [string]$taskAction.WorkingDirectory -ieq $expectedWorkingDirectory -and $taskTrigger.CimClass.CimClassName -eq 'MSFT_TaskLogonTrigger' -and (Resolve-TaskSid ([string]$taskTrigger.UserId)) -eq $currentSid -and -not $task.Settings.DisallowStartIfOnBatteries -and -not $task.Settings.StopIfGoingOnBatteries -and $task.Settings.RestartCount -eq 3 -and [string]$task.Settings.RestartInterval -eq 'PT1M' -and [string]$task.Settings.ExecutionTimeLimit -eq 'PT0S'",
-    "Write-Output ('TaskName: ' + $task.TaskName); Write-Output ('State: ' + $task.State); Write-Output ('Definition: ' + $task.Description)",
-    "}",
-    "Write-Output ('DefinitionMatch: ' + $definitionMatches)",
-    "Write-Output ('CurrentOwned: ' + $currentOwned)",
-    "$legacyPresent = $null -ne $legacyTask",
-    "Write-Output ('LegacyTask: ' + $legacyPresent)",
-    "Write-Output ('LegacyOwned: ' + $legacyOwned)",
-    "Write-Output ('LegacyState: ' + $legacyState)"
-  ].join("; ");
-  const activeScript = [
-    taskContext,
-    "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
-    "if ($null -eq $task) { Write-Output 'Missing' } else { Write-Output $task.State }"
-  ].join("; ");
-  const registerCommand = powershellCommand(registerScript);
   return {
     platform: "win32",
     manifestPath: null,
     manifest: null,
-    logDirectory: logDir,
-    loadDefinitionCommands: [registerCommand],
-    reloadDefinitionCommands: [registerCommand],
+    logDirectory: null,
+    loadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
+    reloadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
     enableCommands: [],
-    startCommands: [powershellCommand(`${taskContext}; Start-ScheduledTask -TaskName $taskName`)],
+    startCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
+    ],
     stopCommands: [
-      powershellCommand(
-        `${taskContext}; Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue`,
-        true
-      )
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Stop-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
+    ],
+    replaceCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `${registerScript}; Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
     ],
-    uninstallCommands: [powershellCommand(uninstallScript)],
-    statusCommand: powershellCommand(statusScript, true),
-    isActiveCommand: powershellCommand(activeScript, true),
-    definitionMarker
+    uninstallCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Confirm:$false -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
+    ],
+    statusCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} | Format-List TaskName,State`
+      ],
+      tolerateFailure: true
+    },
+    isActiveCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `(Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue).State`
+      ],
+      tolerateFailure: true
+    },
+    lingerStatusCommand: null
   };
 }
 function resolveCurrentPlatform() {
@@ -82793,14 +82749,14 @@ function resolveCurrentPlatform() {
   }
   return currentPlatform;
 }
-function currentServicePlan(args, runtime, options = {}) {
-  const currentPlatform = options.platform ?? resolveCurrentPlatform();
+function currentServicePlan(args, runtime) {
+  const currentPlatform = resolveCurrentPlatform();
   const profile = resolveEndpointProfileFromArgs(args);
   const cliEntry = runtime?.cliEntry ?? process.argv[1];
   if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
   return buildDaemonServicePlan({
     platform: currentPlatform,
-    homeDir: options.homeDir ?? (0, import_node_os16.homedir)(),
+    homeDir: (0, import_node_os16.homedir)(),
     nodeExecutable: runtime?.executable ?? process.execPath,
     cliEntry: (0, import_node_path27.resolve)(cliEntry),
     profile,
@@ -82823,13 +82779,9 @@ function defaultReadManifest(path2) {
   return (0, import_node_fs25.readFileSync)(path2, "utf8");
 }
 function runServiceCommand(command) {
-  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, {
-    encoding: "utf8",
-    shell: false,
-    ...(0, import_node_os16.platform)() === "win32" ? { timeout: 15e3, windowsHide: true } : {}
-  });
+  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, { encoding: "utf8", shell: false });
   const status = result.status ?? 1;
-  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}${result.error?.message ?? ""}`.trim();
+  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
   if (status !== 0 && !command.tolerateFailure) {
     throw new Error(
       `Service command failed (${command.command} ${command.args.join(" ")}): ${output2 || `exit ${status}`}`
@@ -82842,23 +82794,6 @@ function defaultSleep(ms) {
     setTimeout(resolveSleep, ms);
   });
 }
-function isProcessAlive(pid) {
-  if (pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error61) {
-    return error61.code === "EPERM";
-  }
-}
-async function requestWindowsDaemonShutdown(owner) {
-  try {
-    const response = await requestLocalDaemonShutdown(owner.localApiPort, owner.localApiToken);
-    return response.ok ? "accepted" : "rejected";
-  } catch {
-    return "unreachable";
-  }
-}
 function parseServiceHostState(servicePlatform, result) {
   const output2 = result.output;
   if (servicePlatform === "linux") {
@@ -82884,62 +82819,9 @@ function parseServiceHostState(servicePlatform, result) {
   const stateMatch = output2.match(/\b(?:State|state)\s*[:=]\s*(\w+)/);
   const state = (stateMatch?.[1] ?? output2.trim()).toLowerCase();
   if (state === "running") return "running";
-  if (state === "queued") return "starting";
-  if (state === "ready" || state === "disabled") return "stopped";
+  if (state === "ready" || state === "disabled" || state === "queued") return "stopped";
   return "unknown";
 }
-function parseWindowsTaskInspection(result) {
-  if (result.status !== 0) {
-    throw new Error("Cannot inspect Windows daemon task definition");
-  }
-  const value2 = (name) => {
-    const match = result.output.match(new RegExp(`^${name}:\\s*(.*)$`, "imu"));
-    if (!match) throw new Error(`Incomplete Windows daemon task inspection: missing ${name}`);
-    return match[1]?.trim() ?? "";
-  };
-  const boolean4 = (name) => {
-    const parsed = value2(name).toLowerCase();
-    if (parsed === "true") return true;
-    if (parsed === "false") return false;
-    throw new Error(`Incomplete Windows daemon task inspection: invalid ${name}`);
-  };
-  const currentPresent = /^TaskName:\s*.+$/imu.test(result.output);
-  const currentStateValue = value2("State");
-  const currentOwned = boolean4("CurrentOwned");
-  const definitionMatches = boolean4("DefinitionMatch");
-  const legacyPresent = boolean4("LegacyTask");
-  const legacyOwned = boolean4("LegacyOwned");
-  const legacyStateValue = value2("LegacyState");
-  if (currentPresent !== (currentStateValue.toLowerCase() !== "missing")) {
-    throw new Error("Incomplete Windows daemon task inspection: inconsistent current task state");
-  }
-  if (!currentPresent && (currentOwned || definitionMatches)) {
-    throw new Error(
-      "Incomplete Windows daemon task inspection: absent current task is marked owned"
-    );
-  }
-  if (legacyPresent !== (legacyStateValue.toLowerCase() !== "missing") || !legacyPresent && legacyOwned) {
-    throw new Error("Incomplete Windows daemon task inspection: inconsistent legacy task state");
-  }
-  return {
-    currentPresent,
-    currentOwned,
-    currentState: currentPresent ? parseServiceHostState("win32", { status: 0, output: currentStateValue }) : "stopped",
-    definitionMatches,
-    definitionMarker: result.output.match(/^Definition:\s*(.+)$/imu)?.[1]?.trim(),
-    legacyPresent,
-    legacyOwned,
-    legacyState: legacyPresent ? parseServiceHostState("win32", { status: 0, output: legacyStateValue }) : "stopped"
-  };
-}
-function assertWindowsTaskOwnership(tasks) {
-  if (tasks.currentPresent && !tasks.currentOwned) {
-    throw new Error("Windows daemon task is not owned by this Alan installation");
-  }
-  if (tasks.legacyPresent && !tasks.legacyOwned) {
-    throw new Error("Legacy Windows daemon task is not owned by this Alan installation");
-  }
-}
 function resolveEnsureDefinitionOutcome(input2) {
   if (!input2.definitionChanged) {
     return { changed: false, updatePending: false };
@@ -82949,6 +82831,9 @@ function resolveEnsureDefinitionOutcome(input2) {
   }
   return { changed: true, updatePending: false };
 }
+function shouldStartOnInstall(hostState) {
+  return hostState === "stopped";
+}
 function resolveUsername(options) {
   if (options?.username) return options.username;
   try {
@@ -82957,14 +82842,17 @@ function resolveUsername(options) {
     return process.env.USER || process.env.USERNAME || "unknown";
   }
 }
-function assertSystemdUserLingerEnabled(options = {}) {
-  const username = resolveUsername(options);
-  const run = options.runCommand ?? runServiceCommand;
-  const result = run({
+function buildLingerStatusCommand(username) {
+  return {
     command: "loginctl",
     args: ["show-user", username, "-p", "Linger"],
     tolerateFailure: true
-  });
+  };
+}
+function assertSystemdUserLingerEnabled(options = {}) {
+  const username = resolveUsername(options);
+  const run = options.runCommand ?? runServiceCommand;
+  const result = run(buildLingerStatusCommand(username));
   if (result.status !== 0) {
     throw new Error(
       `Cannot verify systemd user linger for ${username} (loginctl failed). For durable headless VM boot run: sudo loginctl enable-linger ${username}`
@@ -82978,9 +82866,9 @@ function assertSystemdUserLingerEnabled(options = {}) {
 }
 function createHostContext(options = {}) {
   const args = options.args ?? [];
-  const plan = currentServicePlan(args, options.runtime, options);
+  const plan = currentServicePlan(args, options.runtime);
   const run = options.runCommand ?? runServiceCommand;
-  const sleep5 = options.sleep ?? defaultSleep;
+  const sleep4 = options.sleep ?? defaultSleep;
   const nowMs = options.nowMs ?? Date.now;
   const readManifest = options.readManifest ?? defaultReadManifest;
   const writeManifest = options.writeManifest ?? writeManifestAtomic;
@@ -82992,20 +82880,13 @@ function createHostContext(options = {}) {
     args,
     plan,
     run,
-    sleep: sleep5,
+    sleep: sleep4,
     nowMs,
     readManifest,
     writeManifest,
     removeManifest,
     ensureLogDir,
-    configPath: options.configPath ?? resolveAgentConfigPath({ profile: resolveEndpointProfileFromArgs(args) }),
-    readOwner: options.readOwner ?? readLocalDaemonOwnerLease,
-    isProcessAlive: options.isProcessAlive ?? isProcessAlive,
-    probeEndpoint: options.probeEndpoint ?? probeLocalDaemonEndpoint,
-    requestWindowsShutdown: options.requestWindowsShutdown ?? requestWindowsDaemonShutdown,
-    inspectJournal: options.inspectJournal ?? inspectLocalDaemonRunJournal,
-    acquireMaintenance: options.acquireMaintenance ?? acquireLocalDaemonMaintenanceLease,
-    releaseMaintenance: options.releaseMaintenance ?? releaseLocalDaemonMaintenanceLease
+    profile: resolveEndpointProfileFromArgs(args)
   };
 }
 function inspectDaemonService(options = {}) {
@@ -83021,9 +82902,8 @@ function inspectDaemonService(options = {}) {
 }
 function ensureDaemonServiceDefinition(options = {}) {
   const ctx = createHostContext(options);
-  const { plan, run, nowMs, readManifest, writeManifest, ensureLogDir } = ctx;
+  const { plan, run, readManifest, writeManifest, ensureLogDir } = ctx;
   let definitionChanged = false;
-  let inspection;
   if (plan.manifestPath && plan.manifest) {
     ensureLogDir();
     const existing = readManifest(plan.manifestPath);
@@ -83032,38 +82912,20 @@ function ensureDaemonServiceDefinition(options = {}) {
       writeManifest(plan.manifestPath, plan.manifest);
     }
   } else if (plan.platform === "win32") {
-    ensureLogDir();
-    const result = run(plan.statusCommand);
-    const tasks = parseWindowsTaskInspection(result);
-    assertWindowsTaskOwnership(tasks);
-    if (tasks.currentPresent && tasks.currentState === "unknown" || tasks.legacyPresent && tasks.legacyState === "unknown") {
-      throw new Error("Cannot safely update a Windows daemon task with unknown state");
-    }
-    definitionChanged = tasks.definitionMarker !== plan.definitionMarker || !tasks.definitionMatches || tasks.legacyPresent;
-    const running = tasks.currentState === "running" || tasks.legacyState === "running";
-    inspection = {
-      state: running ? "running" : tasks.currentState,
-      platform: plan.platform,
-      detail: result.output || void 0,
-      observedAtMs: nowMs()
-    };
+    definitionChanged = true;
   }
-  inspection ??= inspectDaemonService(options);
-  const definitionHostState = plan.platform === "win32" && inspection.state === "starting" ? "stopped" : inspection.state;
+  const inspection = inspectDaemonService(options);
   const outcome = resolveEnsureDefinitionOutcome({
     definitionChanged,
-    hostState: definitionHostState
+    hostState: inspection.state
   });
   if (outcome.updatePending) {
     return outcome;
   }
-  if (plan.platform === "win32" && !outcome.changed) {
+  if (inspection.state === "running" || inspection.state === "starting") {
     return outcome;
   }
-  if (definitionHostState === "running" || definitionHostState === "starting") {
-    return outcome;
-  }
-  const definitionCommands = definitionHostState === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
+  const definitionCommands = inspection.state === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
   for (const command of definitionCommands) run(command);
   return outcome;
 }
@@ -83075,140 +82937,10 @@ function startDaemonService(options = {}) {
   const { plan, run } = createHostContext(options);
   for (const command of plan.startCommands) run(command);
 }
-async function stopDaemonServiceAndWait(identity, timeoutMs, options = {}) {
-  const {
-    plan,
-    run,
-    sleep: sleep5,
-    nowMs,
-    configPath,
-    readOwner,
-    isProcessAlive: processIsAlive,
-    probeEndpoint,
-    requestWindowsShutdown: requestShutdown
-  } = createHostContext(options);
-  let owner;
-  try {
-    owner = readOwner(configPath);
-  } catch {
-    return "identity_changed";
-  }
-  const ownerMatches = (candidate) => candidate.pid === identity.pid && candidate.daemonSessionId === identity.daemonSessionId && candidate.localApiPort === identity.port && (identity.serviceId === void 0 || candidate.localServiceId === identity.serviceId) && (identity.startedAtMs === void 0 || candidate.startedAtMs === identity.startedAtMs);
-  if (!owner || !ownerMatches(owner)) {
-    return "identity_changed";
-  }
-  if (plan.platform === "win32") {
-    const shutdown = await requestShutdown(owner);
-    if (shutdown === "rejected") return "identity_changed";
-    if (shutdown === "unreachable") {
-      for (const command of plan.stopCommands) run(command);
-    }
-    const deadline2 = nowMs() + timeoutMs;
-    while (nowMs() < deadline2) {
-      let currentOwner;
-      try {
-        currentOwner = readOwner(configPath);
-      } catch {
-        return "identity_changed";
-      }
-      if (currentOwner && !ownerMatches(currentOwner)) {
-        return "identity_changed";
-      }
-      if (!processIsAlive(identity.pid)) {
-        const endpoint = await probeEndpoint(identity.port, owner.localApiToken, 250);
-        if (endpoint.state === "absent") return "exited";
-        if (endpoint.state === "listening_unauthorized" || endpoint.status.daemonSessionId !== identity.daemonSessionId) {
-          return "identity_changed";
-        }
-      }
-      await sleep5(STOP_POLL_INTERVAL_MS);
-    }
-    return "timeout";
-  }
-  for (const command of plan.stopCommands) run(command);
-  const deadline = nowMs() + timeoutMs;
-  while (nowMs() < deadline) {
-    const result = run(plan.isActiveCommand);
-    const state = parseServiceHostState(plan.platform, result);
-    if (state === "stopped") return "exited";
-    if (state === "unknown") {
-    } else if (identity.pid > 0) {
-      try {
-        process.kill(identity.pid, 0);
-      } catch {
-        return "exited";
-      }
-    }
-    await sleep5(STOP_POLL_INTERVAL_MS);
-  }
-  return "timeout";
-}
-async function uninstallDaemonService(args = [], options = {}) {
+function uninstallDaemonService(args = [], options = {}) {
   const ctx = createHostContext({ ...options, args: options.args ?? args });
-  if (ctx.plan.platform === "win32") {
-    const ownership = ctx.run(ctx.plan.statusCommand);
-    let tasks;
-    try {
-      tasks = parseWindowsTaskInspection(ownership);
-    } catch (error61) {
-      throw new Error(
-        `Cannot inspect Windows daemon task ownership before uninstall: ${error61 instanceof Error ? error61.message : String(error61)}`
-      );
-    }
-    assertWindowsTaskOwnership(tasks);
-    if (!tasks.currentPresent && !tasks.legacyPresent) {
-      console.info("[alan-agent] Per-user daemon service removed");
-      return;
-    }
-    const acquired = ctx.acquireMaintenance(ctx.configPath, "watchdog", 3e4);
-    if (!acquired.acquired) {
-      throw new Error("Cannot uninstall the Windows daemon service while maintenance is active");
-    }
-    try {
-      const journal = ctx.inspectJournal(ctx.configPath);
-      if (!journal.safeToRestart) {
-        throw new Error(
-          `Windows daemon service uninstall is deferred while ${journal.activeRunCount} active run${journal.activeRunCount === 1 ? "" : "s"} finish`
-        );
-      }
-      let owner;
-      try {
-        owner = ctx.readOwner(ctx.configPath);
-      } catch (error61) {
-        throw new Error(
-          `Cannot verify Windows daemon ownership before uninstall: ${error61 instanceof Error ? error61.message : String(error61)}`
-        );
-      }
-      if (owner) {
-        const stopped = await stopDaemonServiceAndWait(
-          {
-            pid: owner.pid,
-            serviceId: owner.localServiceId,
-            daemonSessionId: owner.daemonSessionId,
-            port: owner.localApiPort,
-            startedAtMs: owner.startedAtMs
-          },
-          1e4,
-          { ...options, args: ctx.args }
-        );
-        if (stopped !== "exited") {
-          throw new Error(
-            stopped === "identity_changed" ? "Windows daemon ownership changed before uninstall" : "Timed out waiting for the Windows daemon to stop before uninstall"
-          );
-        }
-      } else {
-        if (tasks.currentState !== "stopped" || tasks.legacyState !== "stopped") {
-          throw new Error("Cannot uninstall a running Windows daemon without verified ownership");
-        }
-      }
-      for (const command of ctx.plan.uninstallCommands) ctx.run(command);
-    } finally {
-      ctx.releaseMaintenance(ctx.configPath, acquired.lease.id);
-    }
-  } else {
-    for (const command of ctx.plan.uninstallCommands) ctx.run(command);
-    if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
-  }
+  for (const command of ctx.plan.uninstallCommands) ctx.run(command);
+  if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
   console.info("[alan-agent] Per-user daemon service removed");
 }
 function installDaemonService(args = [], runtime, options = {}) {
@@ -83236,7 +82968,7 @@ function installDaemonService(args = [], runtime, options = {}) {
     });
     return;
   }
-  if (inspection.state !== "stopped") {
+  if (!shouldStartOnInstall(inspection.state)) {
     console.info("[alan-agent] Per-user daemon service already present", {
       profile,
       state: inspection.state
@@ -83260,48 +82992,14 @@ ${result.output}
 }
 
 // src/install-command.ts
-var WINDOWS_SETUP_READY_TIMEOUT_MS = 9e3;
-async function runInstallCommand(commandArgs, currentPlatform = process.platform) {
-  if (currentPlatform === "win32" && commandArgs.includes("--headless")) {
-    throw new Error("--headless is only supported on Linux systemd user services");
-  }
+async function runInstallCommand(commandArgs) {
   bindConfigPath(commandArgs);
   const configured = readConfig();
   const configurationMode = resolveInstallConfigurationMode(commandArgs, configured);
-  const isWindowsSetup = currentPlatform === "win32" && configurationMode === "setup";
-  const deadline = isWindowsSetup ? Date.now() + WINDOWS_SETUP_READY_TIMEOUT_MS : 0;
-  const runtimeIdentityChanged = configurationMode === "setup" ? await setupDaemon(commandArgs) : false;
+  if (configurationMode === "setup") await setupDaemon(commandArgs);
   if (configurationMode === "login") await loginWithDeviceCode(commandArgs);
-  if (!isWindowsSetup) {
-    installDaemonService(commandArgs);
-    runMcpIntegrationCommand(["reconcile", ...commandArgs]);
-    return;
-  }
-  const { runtimeId, localApiPort, localApiToken } = readConfig();
-  if (!runtimeId || !localApiPort || !localApiToken) {
-    throw new Error("Windows runtime setup completed without a local readiness endpoint");
-  }
-  if (runtimeIdentityChanged) {
-    while (Date.now() < deadline) {
-      const status = await probeLocalDaemon(localApiPort, localApiToken, 250);
-      if (status?.runtimeId === runtimeId && status.connected) break;
-      if (!status) {
-        const service = inspectDaemonService({ args: commandArgs });
-        if (service.state !== "running" && service.state !== "starting") break;
-      }
-      await (0, import_promises6.setTimeout)(100);
-    }
-  }
   installDaemonService(commandArgs);
-  while (Date.now() < deadline) {
-    const status = await probeLocalDaemon(localApiPort, localApiToken, 250);
-    if (status?.runtimeId === runtimeId && status.connected) {
-      runMcpIntegrationCommand(["reconcile", ...commandArgs]);
-      return;
-    }
-    await (0, import_promises6.setTimeout)(100);
-  }
-  throw new Error("Windows runtime did not become ready within 9 seconds");
+  runMcpIntegrationCommand(["reconcile", ...commandArgs]);
 }
 
 // src/lifecycle-logger.ts
@@ -86678,7 +86376,7 @@ var REQUEST_STATE_ONLY_LEG_PACING_MS2 = 250;
 function inputRequiredRoundsExceededMessage2(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
-function sleep4(ms, signal) {
+function sleep3(ms, signal) {
   return new Promise((resolve15, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError2 ? signal.reason : new SdkError2(SdkErrorCode2.RequestTimeout, String(signal.reason)));
@@ -94945,7 +94643,7 @@ var LegacyInputRequiredShim = class {
         } finally {
           roundAbort.dispose();
         }
-      } else await sleep4(REQUEST_STATE_ONLY_LEG_PACING_MS2, outerSignal);
+      } else await sleep3(REQUEST_STATE_ONLY_LEG_PACING_MS2, outerSignal);
       let ctxNext = {
         ...ctx,
         mcpReq: {
@@ -95742,7 +95440,7 @@ async function runMcpStdioProxy(env = process.env, local = new StdioServerTransp
 }
 
 // src/native-hook-command.ts
-var import_node_crypto22 = require("crypto");
+var import_node_crypto21 = require("crypto");
 var import_node_fs27 = require("fs");
 var import_node_os17 = require("os");
 var import_node_path29 = require("path");
@@ -96111,7 +95809,7 @@ function parseNativeHookEnvelope(input2) {
   const projectPin = eventType === "session_start" && resolvedCwd ? readAlanProjectPin(resolvedCwd) : void 0;
   return {
     schemaVersion: 1,
-    eventId: (0, import_node_crypto22.randomUUID)(),
+    eventId: (0, import_node_crypto21.randomUUID)(),
     provider: capability.provider,
     eventType,
     observedAt: (input2.now ?? /* @__PURE__ */ new Date()).toISOString(),
@@ -96607,7 +96305,7 @@ function delay2(ms) {
 }
 
 // src/web-presenter.ts
-var import_node_crypto23 = require("crypto");
+var import_node_crypto22 = require("crypto");
 var WebPresenter = class {
   constructor(wsClient, conversationId, cwd) {
     this.conversationId = conversationId;
@@ -96793,7 +96491,7 @@ var WebPresenter = class {
     this.applicationProblem = createAlanProblem({
       domain: "application",
       code: input2.code,
-      id: (0, import_node_crypto23.randomUUID)(),
+      id: (0, import_node_crypto22.randomUUID)(),
       title: APPLICATION_PROBLEM_TITLES[input2.code],
       detail: input2.message,
       // The schema's slot for the technical cause, so the problem carries it
@@ -96863,7 +96561,7 @@ var WebPresenter = class {
 };
 
 // src/ws-client.ts
-var import_node_crypto25 = require("crypto");
+var import_node_crypto24 = require("crypto");
 
 // ../shared/dist/agent-liveness.js
 var AGENT_LIVENESS_PROTOCOL_VERSION = 1;
@@ -96891,13 +96589,13 @@ var agentProbeAckSchema = external_exports.object({
 });
 
 // src/sandbox-outbox.ts
-var import_node_crypto24 = require("crypto");
+var import_node_crypto23 = require("crypto");
 var import_node_fs28 = require("fs");
 function deriveSandboxOutboxKey(sessionToken) {
   if (!sessionToken) {
     throw new Error("sandbox event outbox requires ALAN_SESSION_TOKEN for key derivation");
   }
-  return (0, import_node_crypto24.createHash)("sha256").update(sessionToken, "utf8").digest("base64url");
+  return (0, import_node_crypto23.createHash)("sha256").update(sessionToken, "utf8").digest("base64url");
 }
 function sandboxOutboxSpoolPath(conversationId) {
   return `/tmp/alan-agent-outbox-${conversationId}.enc`;
@@ -97074,7 +96772,7 @@ var WSClient = class {
   }
   socket;
   /** Stable id for this agent process; fences stale heartbeats server-side. */
-  agentSessionId = (0, import_node_crypto25.randomUUID)();
+  agentSessionId = (0, import_node_crypto24.randomUUID)();
   /** Monotonic heartbeat sequence — advances on every hello + heartbeat. */
   heartbeatSeq = 0;
   heartbeatTimer = null;
@@ -97906,7 +97604,7 @@ async function runSandbox(config2) {
 }
 
 // src/skills/skill-cli.ts
-var import_promises7 = require("fs/promises");
+var import_promises6 = require("fs/promises");
 var import_node_os19 = require("os");
 var import_node_path30 = require("path");
 async function runSkillsCommand(args) {
@@ -97953,7 +97651,7 @@ async function defaultScanInput(homeDirectory2) {
 }
 async function readProtectedJson(path2) {
   const absolutePath = (0, import_node_path30.resolve)(path2);
-  const stat2 = await (0, import_promises7.lstat)(absolutePath);
+  const stat2 = await (0, import_promises6.lstat)(absolutePath);
   if (!stat2.isFile()) throw new Error(`Skill input is not a regular file: ${absolutePath}`);
   if (process.platform !== "win32" && (stat2.mode & 63) !== 0) {
     throw new Error(`Skill input must not be accessible by group or other users: ${absolutePath}`);
@@ -97962,7 +97660,7 @@ async function readProtectedJson(path2) {
     throw new Error(`Skill input must be owned by the current user: ${absolutePath}`);
   }
   if (stat2.size > 2 * 1024 * 1024) throw new Error("Skill input exceeds 2 MiB");
-  return JSON.parse(await (0, import_promises7.readFile)(absolutePath, "utf8"));
+  return JSON.parse(await (0, import_promises6.readFile)(absolutePath, "utf8"));
 }
 function option(args, name) {
   const index = args.indexOf(name);
@@ -98120,7 +97818,7 @@ async function main() {
     return;
   }
   if (command === "service" && commandArgs[0] === "uninstall") {
-    await uninstallDaemonService(commandArgs.slice(1));
+    uninstallDaemonService(commandArgs.slice(1));
     return;
   }
   if (command === "service" && commandArgs[0] === "status") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alan-ai-hq/agent-manager",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "type": "module",
   "description": "Alan agent runtime — cloud sandbox and local daemon (alan-agent CLI)",
   "bin": {
@@ -27,8 +27,8 @@
     "tsx": "^4.19.0",
     "typescript": "~5.9.3",
     "@alan-ai/agent-core": "0.1.0",
-    "@alan-ai/shared": "0.1.0",
-    "@alan-ai/sandbox-runtime-spec": "0.1.0"
+    "@alan-ai/sandbox-runtime-spec": "0.1.0",
+    "@alan-ai/shared": "0.1.0"
   },
   "scripts": {
     "build": "tsup",