@alan-ai-hq/agent-manager 0.1.95 → 0.1.97

package/dist/index.cjs

@@ -3404,7 +3404,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes13, createHash: createHash19 } = require("crypto");
+    var { randomBytes: randomBytes13, createHash: createHash18 } = require("crypto");
     var { Duplex, Readable: Readable2 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -4061,7 +4061,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash19("sha1").update(key + GUID).digest("base64");
+        const digest = createHash18("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -4428,7 +4428,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash19 } = require("crypto");
+    var { createHash: createHash18 } = require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -4725,7 +4725,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash19("sha1").update(key + GUID).digest("base64");
+        const digest = createHash18("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -14583,6 +14583,15 @@ var import_node_os = require("os");
 var import_node_path = require("path");
 
 // ../sandbox-runtime-spec/dist/index.js
+var SANDBOX_AGENT_BROWSER_PACKAGE = "agent-browser";
+var SANDBOX_AGENT_BROWSER_VERSION_POLICY = ">=0.37.1 <1.0.0";
+var SANDBOX_AGENT_BROWSER_NPM_SPEC = `${SANDBOX_AGENT_BROWSER_PACKAGE}@${SANDBOX_AGENT_BROWSER_VERSION_POLICY}`;
+var SANDBOX_DESKTOP_BROWSER_ENV = Object.freeze({
+  DISPLAY: ":0",
+  AGENT_BROWSER_HEADED: "true",
+  AGENT_BROWSER_NO_XVFB: "1",
+  AGENT_BROWSER_EXECUTABLE_PATH: "/usr/bin/google-chrome-stable"
+});
 var definitions = [
   {
     id: "claude",
@@ -15451,7 +15460,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.95";
+var AGENT_VERSION = "0.1.97";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -20292,9 +20301,9 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
           }`;
     doc.write(`const input = payload.value;`);
     const ids = /* @__PURE__ */ Object.create(null);
-    let counter = 0;
+    let counter2 = 0;
     for (const key of normalized.allKeys) {
-      ids[key] = `key_${counter++}`;
+      ids[key] = `key_${counter2++}`;
     }
     doc.write(memo4 ? `const newResult = memo.alloc(inst, payload, {}, ctx);` : `const newResult = {};`);
     for (const key of normalized.allKeys) {
@@ -49610,16 +49619,6 @@ async function probeLocalDaemon(port, token, timeoutMs = 750) {
   const probe = await probeLocalDaemonEndpoint(port, token, timeoutMs);
   return probe.state === "running" ? probe.status : null;
 }
-function requestLocalDaemonShutdown(port, token) {
-  return fetch(`http://127.0.0.1:${port}/shutdown?force=1`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      "x-alan-shutdown-reason": "runtime_shutdown"
-    },
-    signal: AbortSignal.timeout(5e3)
-  });
-}
 async function adoptLocalDaemonControl(input2) {
   const timeoutMs = input2.timeoutMs ?? 750;
   try {
@@ -74439,6 +74438,14 @@ var skillVersionIdSchema = external_exports.uuid().transform((value2) => value2)
 var runtimeIdSchema = external_exports.uuid().transform((value2) => value2);
 var skillPreviewIdSchema = external_exports.uuid().transform((value2) => value2);
 var skillCommandIdSchema = external_exports.uuid().transform((value2) => value2);
+var skillPackageFileSchema = defineWireSchema()(external_exports.object({
+  path: external_exports.string().min(1),
+  kind: external_exports.enum(["instructions", "script", "reference", "asset", "license", "other"]),
+  size: external_exports.number().int().nonnegative(),
+  mode: external_exports.union([external_exports.literal(420), external_exports.literal(493)]),
+  sha256: sha256Schema,
+  preview: external_exports.enum(["markdown", "text", "code", "image", "binary"])
+}));
 var skillInvocationSchema = defineWireSchema()(external_exports.discriminatedUnion("kind", [
   external_exports.object({
     kind: external_exports.literal("skill_version"),
@@ -74540,6 +74547,7 @@ function projectSkillFrontmatter(admitted) {
   };
   const license = optionalText("license", 1024);
   const compatibility = optionalText("compatibility", 500);
+  const version2 = optionalText("version", 64);
   const allowedTools = optionalToolList("allowed-tools", 1024);
   const metadata = {};
   const rawMetadata = raw.metadata;
@@ -74588,6 +74596,7 @@ function projectSkillFrontmatter(admitted) {
       description: admitted.description,
       ...license ? { license } : {},
       ...compatibility ? { compatibility } : {},
+      ...version2 ? { version: version2 } : {},
       metadata,
       ...allowedTools ? { allowedTools } : {}
     },
@@ -76697,13 +76706,13 @@ var RuntimeRunJournal = class {
    * Keep the exact interruption outcome until a durable authenticated control
    * channel can prove both identity and ownership.
    */
-  assessRecovery(runId, isProcessAlive2) {
+  assessRecovery(runId, isProcessAlive) {
     const entry = this.entries.get(runId);
     if (!entry) return void 0;
     if (entry.providerPid === void 0) {
       return { reattachable: false, reason: "provider_not_recorded" };
     }
-    if (!isProcessAlive2(entry.providerPid)) {
+    if (!isProcessAlive(entry.providerPid)) {
       return {
         reattachable: false,
         reason: "provider_not_running",
@@ -80450,17 +80459,6 @@ async function runLocalDaemonRecoveryLadder(input2) {
     error: "The local daemon exhausted its reconnect and safe-restart recovery budget."
   };
 }
-function writeRegisteredRuntimeConfig(args, previousConfig, registered) {
-  writeConfig({
-    ...registered,
-    localApiPort: getLocalApiPort(args, {}),
-    localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto19.randomBytes)(24).toString("hex"),
-    localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto19.randomUUID)(),
-    localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
-    eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
-    daemonEpoch: previousConfig.daemonEpoch
-  });
-}
 async function setupDaemon(args) {
   bindConfigPath(args);
   const previousConfig = readConfigForRegistration();
@@ -80521,7 +80519,7 @@ async function setupDaemon(args) {
       credentialGeneration: body2.credentialGeneration,
       configPath: getConfigPath()
     });
-    return body2.runtimeId !== liveConfig.runtimeId;
+    return { daemonAlreadyRunning: true };
   }
   if (readLocalDaemonOwnerLease(getConfigPath())) {
     throw new Error(
@@ -80535,17 +80533,23 @@ async function setupDaemon(args) {
     if (setupToken && error61 instanceof RuntimeSetupGrantExpiredError) {
       console.info("[alan-agent] Setup link expired; continuing with browser authorization");
       await loginWithDeviceCode(args);
-      return false;
+      return { daemonAlreadyRunning: false };
     }
     throw error61;
   }
-  writeRegisteredRuntimeConfig(args, previousConfig, {
+  writeConfig({
     apiUrl,
     wsUrl,
     endpointProfile,
     runtimeId: body.runtimeId,
     runtimeToken: body.runtimeToken,
     runtimeRenewalToken: body.runtimeRenewalToken,
+    localApiPort: getLocalApiPort(args, {}),
+    localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto19.randomBytes)(24).toString("hex"),
+    localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto19.randomUUID)(),
+    localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+    eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+    daemonEpoch: previousConfig.daemonEpoch,
     displayName: body.displayName,
     installationId
   });
@@ -80554,7 +80558,7 @@ async function setupDaemon(args) {
     runtimeId: body.runtimeId,
     configPath: getConfigPath()
   });
-  return false;
+  return { daemonAlreadyRunning: false };
 }
 async function loginWithDeviceCode(args) {
   bindConfigPath(args);
@@ -80643,13 +80647,19 @@ async function loginWithDeviceCode(args) {
       if (ownedPending?.operationId !== operation.id) {
         throw new Error("browser authorization sidecar ownership was lost before finalization");
       }
-      writeRegisteredRuntimeConfig(args, previousConfig, {
+      writeConfig({
         apiUrl,
         wsUrl,
         endpointProfile,
         runtimeId: body.runtime.id,
         runtimeToken: body.runtimeToken,
         runtimeRenewalToken: body.runtimeRenewalToken,
+        localApiPort: getLocalApiPort(args, {}),
+        localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto19.randomBytes)(24).toString("hex"),
+        localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto19.randomUUID)(),
+        localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+        eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
+        daemonEpoch: previousConfig.daemonEpoch,
         displayName: body.runtime.displayName ?? displayName,
         installationId
       });
@@ -80688,7 +80698,14 @@ async function stopDaemon(args) {
     console.info("[alan-agent] No daemon listening", { port: localApiPort });
     return;
   }
-  const response = await requestLocalDaemonShutdown(localApiPort, localApiToken);
+  const response = await fetch(`http://127.0.0.1:${localApiPort}/shutdown?force=1`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${localApiToken}`,
+      "x-alan-shutdown-reason": "runtime_shutdown"
+    },
+    signal: AbortSignal.timeout(5e3)
+  });
   if (!response.ok) {
     throw new Error(`Failed to stop daemon: HTTP ${response.status}`);
   }
@@ -80833,7 +80850,14 @@ async function drainAndStopLocalDaemonBeforeCredentialCleanup(args, stored) {
       `Logout could not safely drain the local daemon (HTTP ${prepare.status}). Stop or update the local service before removing credentials.`
     );
   }
-  const shutdown = await requestLocalDaemonShutdown(localApiPort, localApiToken);
+  const shutdown = await fetch(`http://127.0.0.1:${localApiPort}/shutdown?force=1`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${localApiToken}`,
+      "x-alan-shutdown-reason": "runtime_shutdown"
+    },
+    signal: AbortSignal.timeout(5e3)
+  });
   if (!shutdown.ok) {
     throw new Error(`Logout could not stop the local daemon (HTTP ${shutdown.status}).`);
   }
@@ -80994,9 +81018,6 @@ async function printDoctor(args = []) {
   );
 }
 
-// src/install-command.ts
-var import_promises6 = require("timers/promises");
-
 // src/mcp-config-adapters.ts
 var import_node_crypto20 = require("crypto");
 var import_node_fs23 = require("fs");
@@ -82381,14 +82402,12 @@ function runMcpIntegrationCommand(args, options = {}) {
 
 // src/service-manager.ts
 var import_node_child_process9 = require("child_process");
-var import_node_crypto21 = require("crypto");
 var import_node_fs25 = require("fs");
 var import_node_os16 = require("os");
 var import_node_path27 = require("path");
 var SERVICE_LABEL = "ai.tryalan.agent";
 var SYSTEMD_UNIT = "alan-agent.service";
 var WINDOWS_TASK = "Alan Agent";
-var STOP_POLL_INTERVAL_MS = 200;
 function xml(value2) {
   return value2.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
@@ -82398,18 +82417,6 @@ function systemdArg(value2) {
 function powershellLiteral(value2) {
   return `'${value2.replaceAll("'", "''")}'`;
 }
-function powershellCommand(script, tolerateFailure = false) {
-  return {
-    command: "powershell.exe",
-    args: ["-NoProfile", "-NonInteractive", "-Command", script],
-    tolerateFailure
-  };
-}
-function windowsCommandLineArgument(value2) {
-  if (value2 && !/[\s"]/u.test(value2)) return value2;
-  const escaped = value2.replace(/(\\*)"/gu, (_match, slashes) => `${slashes}${slashes}\\"`).replace(/\\+$/u, (slashes) => `${slashes}${slashes}`);
-  return `"${escaped}"`;
-}
 function serviceNames(profile) {
   if (profile === "production") {
     return { launchd: SERVICE_LABEL, systemd: SYSTEMD_UNIT, windows: WINDOWS_TASK };
@@ -82431,7 +82438,7 @@ function buildDaemonServicePlan(input2) {
     const domain2 = `gui/${userId}`;
     const serviceTarget = `${domain2}/${names.launchd}`;
     const manifestPath = (0, import_node_path27.join)(input2.homeDir, "Library", "LaunchAgents", `${names.launchd}.plist`);
-    const logDir2 = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
+    const logDir = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
     const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
     const environmentEntries = Object.entries(input2.environment ?? {}).map(([key, value2]) => `    <key>${xml(key)}</key>
     <string>${xml(value2)}</string>`).join("\n");
@@ -82460,9 +82467,9 @@ ${environmentBlock}  <key>RunAtLoad</key>
   <key>ThrottleInterval</key>
   <integer>5</integer>
   <key>StandardOutPath</key>
-  <string>${xml((0, import_node_path27.join)(logDir2, "daemon.log"))}</string>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xml((0, import_node_path27.join)(logDir2, "daemon-error.log"))}</string>
+  <string>${xml((0, import_node_path27.join)(logDir, "daemon-error.log"))}</string>
 </dict>
 </plist>
 `;
@@ -82470,7 +82477,7 @@ ${environmentBlock}  <key>RunAtLoad</key>
       platform: "darwin",
       manifestPath,
       manifest,
-      logDirectory: logDir2,
+      logDirectory: logDir,
       loadDefinitionCommands: [
         {
           command: "launchctl",
@@ -82511,6 +82518,23 @@ ${environmentBlock}  <key>RunAtLoad</key>
           tolerateFailure: true
         }
       ],
+      replaceCommands: [
+        {
+          command: "launchctl",
+          args: ["bootout", domain2, manifestPath],
+          tolerateFailure: true
+        },
+        {
+          command: "launchctl",
+          args: ["bootstrap", domain2, manifestPath],
+          tolerateFailure: false
+        },
+        {
+          command: "launchctl",
+          args: ["kickstart", "-k", serviceTarget],
+          tolerateFailure: false
+        }
+      ],
       uninstallCommands: [
         {
           command: "launchctl",
@@ -82527,7 +82551,8 @@ ${environmentBlock}  <key>RunAtLoad</key>
         command: "launchctl",
         args: ["print", serviceTarget],
         tolerateFailure: true
-      }
+      },
+      lingerStatusCommand: null
     };
   }
   if (input2.platform === "linux") {
@@ -82590,6 +82615,18 @@ WantedBy=default.target
           tolerateFailure: true
         }
       ],
+      replaceCommands: [
+        {
+          command: "systemctl",
+          args: ["--user", "daemon-reload"],
+          tolerateFailure: false
+        },
+        {
+          command: "systemctl",
+          args: ["--user", "restart", names.systemd],
+          tolerateFailure: false
+        }
+      ],
       uninstallCommands: [
         {
           command: "systemctl",
@@ -82611,179 +82648,117 @@ WantedBy=default.target
         command: "systemctl",
         args: ["--user", "is-active", names.systemd],
         tolerateFailure: true
+      },
+      lingerStatusCommand: {
+        command: "loginctl",
+        args: ["show-user", "$(id -un)", "-p", "Linger"],
+        tolerateFailure: true
       }
     };
   }
-  const logDir = (0, import_node_path27.join)(resolveAgentConfigDirectory(input2.profile, input2.homeDir), "logs");
-  const legacyEnvironmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
-  const legacyDirectArguments = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
-  const legacyExecutable = legacyEnvironmentPrefix ? "powershell.exe" : input2.nodeExecutable;
-  const legacyArguments = legacyEnvironmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${legacyEnvironmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : legacyDirectArguments;
-  const daemonArguments = [input2.cliEntry, "daemon", "--profile", input2.profile].map(windowsCommandLineArgument).join(" ");
-  const environmentStatements = Object.entries(input2.environment ?? {}).map(
-    ([key, value2]) => `$startInfo.EnvironmentVariables[${powershellLiteral(key)}] = ${powershellLiteral(value2)}`
+  const environmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
+  const directArgument = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
+  const executable = powershellLiteral(environmentPrefix ? "powershell.exe" : input2.nodeExecutable);
+  const argument = powershellLiteral(
+    environmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${environmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : directArgument
   );
-  const launcherScript = [
-    "$ErrorActionPreference = 'Stop'",
-    "$startInfo = [System.Diagnostics.ProcessStartInfo]::new()",
-    `$startInfo.FileName = ${powershellLiteral(input2.nodeExecutable)}`,
-    `$startInfo.Arguments = ${powershellLiteral(daemonArguments)}`,
-    `$startInfo.WorkingDirectory = ${powershellLiteral((0, import_node_path27.dirname)(input2.cliEntry))}`,
-    "$startInfo.UseShellExecute = $false",
-    "$startInfo.CreateNoWindow = $true",
-    "$startInfo.RedirectStandardOutput = $true",
-    "$startInfo.RedirectStandardError = $true",
-    ...environmentStatements,
-    `$stdout = [System.IO.File]::Open(${powershellLiteral((0, import_node_path27.join)(logDir, "daemon-launcher.log"))}, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::ReadWrite)`,
-    `$stderr = [System.IO.File]::Open(${powershellLiteral((0, import_node_path27.join)(logDir, "daemon-launcher-error.log"))}, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::ReadWrite)`,
-    "$process = [System.Diagnostics.Process]::new()",
-    "$process.StartInfo = $startInfo",
-    "try { if (-not $process.Start()) { throw 'Alan daemon process did not start' }; $stdoutCopy = $process.StandardOutput.BaseStream.CopyToAsync($stdout); $stderrCopy = $process.StandardError.BaseStream.CopyToAsync($stderr); $process.WaitForExit(); [System.Threading.Tasks.Task]::WaitAll([System.Threading.Tasks.Task[]]@($stdoutCopy, $stderrCopy)); $exitCode = $process.ExitCode } finally { $stdout.Dispose(); $stderr.Dispose(); $process.Dispose() }",
-    "exit $exitCode"
-  ].join("; ");
-  const executable = powershellLiteral("powershell.exe");
-  const launcherArguments = `-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(launcherScript, "utf16le").toString("base64")}`;
-  const settingsScript = "New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries";
-  const ownerMarker = `Alan daemon owner v1 ${(0, import_node_crypto21.createHash)("sha256").update(
-    JSON.stringify({
-      executable: input2.nodeExecutable,
-      cliEntry: input2.cliEntry,
-      profile: input2.profile,
-      taskBaseName: names.windows
-    })
-  ).digest("hex")}`;
-  const definitionMarker = `${ownerMarker}; definition v3 ${(0, import_node_crypto21.createHash)("sha256").update(
-    JSON.stringify({
-      executable: "powershell.exe",
-      launcherArguments,
-      workingDirectory: (0, import_node_path27.dirname)(input2.cliEntry),
-      settingsScript,
-      taskBaseName: names.windows
-    })
-  ).digest("hex")}`;
-  const windowsDefinitionContext = [
-    `$expectedLauncherArguments = ${powershellLiteral(launcherArguments)}`,
-    `$expectedWorkingDirectory = ${powershellLiteral((0, import_node_path27.dirname)(input2.cliEntry))}`,
-    `$expectedOwnerMarker = ${powershellLiteral(`${ownerMarker};`)}`,
-    `$expectedDefinitionMarker = ${powershellLiteral(definitionMarker)}`,
-    `$expectedLegacyExecutable = ${powershellLiteral(legacyExecutable)}`,
-    `$expectedLegacyArguments = ${powershellLiteral(legacyArguments)}`
-  ].join("; ");
-  const taskContext = [
-    "$currentIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()",
-    "$currentUser = $currentIdentity.Name",
-    "$currentSid = $currentIdentity.User.Value",
-    `$taskName = ${powershellLiteral(names.windows)} + ' ' + $currentSid`
-  ].join("; ");
-  const resolveTaskSid = "function Resolve-TaskSid([string]$value) { try { return ([System.Security.Principal.NTAccount]$value).Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { try { return [System.Security.Principal.SecurityIdentifier]::new($value).Value } catch { return '' } } }";
-  const currentLookup = "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]";
-  const checkCurrentOwnership = [
-    currentLookup,
-    "$currentOwned = $false",
-    "if ($null -ne $task) { try {",
-    "$taskAction = @($task.Actions)[0]",
-    "$currentOwned = @($task.Actions).Count -eq 1 -and (Resolve-TaskSid ([string]$task.Principal.UserId)) -eq $currentSid -and (([string]$task.Description).StartsWith($expectedOwnerMarker, [System.StringComparison]::Ordinal) -or (([string]$taskAction.Execute) -ieq 'powershell.exe' -and ([string]$taskAction.Arguments) -ceq $expectedLauncherArguments -and ([string]$taskAction.WorkingDirectory) -ieq $expectedWorkingDirectory))",
-    "} catch { $currentOwned = $false } }"
-  ].join("; ");
-  const legacyLookup = `$legacyTask = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq ${powershellLiteral(names.windows)} })[0]`;
-  const checkLegacyOwnership = [
-    legacyLookup,
-    "$legacyOwned = $false",
-    "$legacyState = 'Missing'",
-    "if ($null -ne $legacyTask) { try {",
-    "$legacyState = [string]$legacyTask.State",
-    "$legacySid = Resolve-TaskSid ([string]$legacyTask.Principal.UserId)",
-    "$legacyAction = @($legacyTask.Actions)[0]",
-    "if ($null -ne $legacyAction) {",
-    "$legacyOwned = $legacySid -eq $currentSid -and @($legacyTask.Actions).Count -eq 1 -and ((([string]$legacyAction.Execute) -ieq $expectedLegacyExecutable -and ([string]$legacyAction.Arguments) -ieq $expectedLegacyArguments -and ([string]$legacyAction.WorkingDirectory) -eq '') -or (([string]$legacyAction.Execute) -ieq 'powershell.exe' -and ([string]$legacyAction.Arguments) -ceq $expectedLauncherArguments -and ([string]$legacyAction.WorkingDirectory) -ieq $expectedWorkingDirectory))",
-    "}",
-    "} catch { $legacyOwned = $false } }"
-  ].join("; ");
-  const assertOwnedTasks = [
-    checkCurrentOwnership,
-    checkLegacyOwnership,
-    `if ($null -ne $task -and -not $currentOwned) { throw ${powershellLiteral(`${names.windows} task is not owned by this Alan installation`)} }`,
-    `if ($null -ne $legacyTask -and -not $legacyOwned) { throw ${powershellLiteral(`Legacy ${names.windows} task is not owned by this Alan installation`)} }`,
-    "if ($null -ne $task -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$task.State)) { throw 'Alan daemon task became active or has unknown state' }",
-    "if ($null -ne $legacyTask -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$legacyTask.State)) { throw 'Legacy Alan daemon task became active or has unknown state' }"
-  ].join("; ");
-  const cleanupLegacyTask = [
-    checkLegacyOwnership,
-    `if ($null -ne $legacyTask -and -not $legacyOwned) { throw ${powershellLiteral(`Legacy ${names.windows} task is not owned by this Alan installation`)} }`,
-    "if ($null -ne $legacyTask -and @('Ready', 'Disabled', 'Queued') -notcontains ([string]$legacyTask.State)) { throw 'Legacy Alan daemon task became active or has unknown state' }",
-    `if ($null -ne $legacyTask) { Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -TaskPath '\\' -Confirm:$false -ErrorAction Stop }`,
-    `$legacyRemaining = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq ${powershellLiteral(names.windows)} })[0]`,
-    "if ($null -ne $legacyRemaining) { throw 'Legacy Alan daemon task still exists after migration' }"
-  ].join("; ");
   const registerScript = [
-    taskContext,
-    resolveTaskSid,
-    windowsDefinitionContext,
-    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument $expectedLauncherArguments -WorkingDirectory $expectedWorkingDirectory`,
+    "$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name",
+    `$action = New-ScheduledTaskAction -Execute ${executable} -Argument ${argument}`,
     "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $currentUser",
     "$principal = New-ScheduledTaskPrincipal -UserId $currentUser -LogonType Interactive -RunLevel Limited",
-    `$settings = ${settingsScript}`,
-    assertOwnedTasks,
-    "Register-ScheduledTask -TaskName $taskName -Description $expectedDefinitionMarker -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force -ErrorAction Stop | Out-Null",
-    cleanupLegacyTask,
-    "$registeredTask = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
-    "if ($null -eq $registeredTask -or $registeredTask.Description -cne $expectedDefinitionMarker) { throw 'Alan daemon task definition was not applied' }"
-  ].join("; ");
-  const uninstallScript = [
-    taskContext,
-    resolveTaskSid,
-    windowsDefinitionContext,
-    assertOwnedTasks,
-    "if ($null -ne $legacyTask) { Unregister-ScheduledTask -TaskName $legacyTask.TaskName -TaskPath $legacyTask.TaskPath -Confirm:$false -ErrorAction Stop }",
-    "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
-    "if ($null -ne $task) { Unregister-ScheduledTask -TaskName $taskName -TaskPath '\\' -Confirm:$false -ErrorAction Stop }",
-    "$remaining = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and ($_.TaskName -eq $taskName -or $_.TaskName -eq $legacyTask.TaskName) })",
-    "if ($remaining.Count -gt 0) { throw 'Alan daemon task still exists after unregister' }"
+    "$settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero)",
+    `Register-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null`
   ].join("; ");
-  const statusScript = [
-    taskContext,
-    resolveTaskSid,
-    windowsDefinitionContext,
-    checkCurrentOwnership,
-    checkLegacyOwnership,
-    "$definitionMatches = $false",
-    "if ($null -eq $task) { Write-Output 'State: Missing' } else {",
-    "$taskTrigger = @($task.Triggers)[0]",
-    "$definitionMatches = @($task.Actions).Count -eq 1 -and @($task.Triggers).Count -eq 1 -and $task.Description -ceq $expectedDefinitionMarker -and (Resolve-TaskSid ([string]$task.Principal.UserId)) -eq $currentSid -and [string]$task.Principal.LogonType -eq 'Interactive' -and [string]$task.Principal.RunLevel -eq 'Limited' -and [string]$taskAction.Execute -ieq 'powershell.exe' -and [string]$taskAction.Arguments -ceq $expectedLauncherArguments -and [string]$taskAction.WorkingDirectory -ieq $expectedWorkingDirectory -and $taskTrigger.CimClass.CimClassName -eq 'MSFT_TaskLogonTrigger' -and (Resolve-TaskSid ([string]$taskTrigger.UserId)) -eq $currentSid -and -not $task.Settings.DisallowStartIfOnBatteries -and -not $task.Settings.StopIfGoingOnBatteries -and $task.Settings.RestartCount -eq 3 -and [string]$task.Settings.RestartInterval -eq 'PT1M' -and [string]$task.Settings.ExecutionTimeLimit -eq 'PT0S'",
-    "Write-Output ('TaskName: ' + $task.TaskName); Write-Output ('State: ' + $task.State); Write-Output ('Definition: ' + $task.Description)",
-    "}",
-    "Write-Output ('DefinitionMatch: ' + $definitionMatches)",
-    "Write-Output ('CurrentOwned: ' + $currentOwned)",
-    "$legacyPresent = $null -ne $legacyTask",
-    "Write-Output ('LegacyTask: ' + $legacyPresent)",
-    "Write-Output ('LegacyOwned: ' + $legacyOwned)",
-    "Write-Output ('LegacyState: ' + $legacyState)"
-  ].join("; ");
-  const activeScript = [
-    taskContext,
-    "$task = @(Get-ScheduledTask -ErrorAction Stop | Where-Object { $_.TaskPath -eq '\\' -and $_.TaskName -eq $taskName })[0]",
-    "if ($null -eq $task) { Write-Output 'Missing' } else { Write-Output $task.State }"
-  ].join("; ");
-  const registerCommand = powershellCommand(registerScript);
   return {
     platform: "win32",
     manifestPath: null,
     manifest: null,
-    logDirectory: logDir,
-    loadDefinitionCommands: [registerCommand],
-    reloadDefinitionCommands: [registerCommand],
+    logDirectory: null,
+    loadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
+    reloadDefinitionCommands: [
+      {
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", registerScript],
+        tolerateFailure: false
+      }
+    ],
     enableCommands: [],
-    startCommands: [powershellCommand(`${taskContext}; Start-ScheduledTask -TaskName $taskName`)],
+    startCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
+    ],
     stopCommands: [
-      powershellCommand(
-        `${taskContext}; Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue`,
-        true
-      )
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Stop-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
     ],
-    uninstallCommands: [powershellCommand(uninstallScript)],
-    statusCommand: powershellCommand(statusScript, true),
-    isActiveCommand: powershellCommand(activeScript, true),
-    definitionMarker
+    replaceCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `${registerScript}; Start-ScheduledTask -TaskName ${powershellLiteral(names.windows)}`
+        ],
+        tolerateFailure: false
+      }
+    ],
+    uninstallCommands: [
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Unregister-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -Confirm:$false -ErrorAction SilentlyContinue`
+        ],
+        tolerateFailure: true
+      }
+    ],
+    statusCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} | Format-List TaskName,State`
+      ],
+      tolerateFailure: true
+    },
+    isActiveCommand: {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `(Get-ScheduledTask -TaskName ${powershellLiteral(names.windows)} -ErrorAction SilentlyContinue).State`
+      ],
+      tolerateFailure: true
+    },
+    lingerStatusCommand: null
   };
 }
 function resolveCurrentPlatform() {
@@ -82793,14 +82768,14 @@ function resolveCurrentPlatform() {
   }
   return currentPlatform;
 }
-function currentServicePlan(args, runtime, options = {}) {
-  const currentPlatform = options.platform ?? resolveCurrentPlatform();
+function currentServicePlan(args, runtime) {
+  const currentPlatform = resolveCurrentPlatform();
   const profile = resolveEndpointProfileFromArgs(args);
   const cliEntry = runtime?.cliEntry ?? process.argv[1];
   if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
   return buildDaemonServicePlan({
     platform: currentPlatform,
-    homeDir: options.homeDir ?? (0, import_node_os16.homedir)(),
+    homeDir: (0, import_node_os16.homedir)(),
     nodeExecutable: runtime?.executable ?? process.execPath,
     cliEntry: (0, import_node_path27.resolve)(cliEntry),
     profile,
@@ -82823,13 +82798,9 @@ function defaultReadManifest(path2) {
   return (0, import_node_fs25.readFileSync)(path2, "utf8");
 }
 function runServiceCommand(command) {
-  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, {
-    encoding: "utf8",
-    shell: false,
-    ...(0, import_node_os16.platform)() === "win32" ? { timeout: 15e3, windowsHide: true } : {}
-  });
+  const result = (0, import_node_child_process9.spawnSync)(command.command, command.args, { encoding: "utf8", shell: false });
   const status = result.status ?? 1;
-  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}${result.error?.message ?? ""}`.trim();
+  const output2 = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
   if (status !== 0 && !command.tolerateFailure) {
     throw new Error(
       `Service command failed (${command.command} ${command.args.join(" ")}): ${output2 || `exit ${status}`}`
@@ -82842,23 +82813,6 @@ function defaultSleep(ms) {
     setTimeout(resolveSleep, ms);
   });
 }
-function isProcessAlive(pid) {
-  if (pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error61) {
-    return error61.code === "EPERM";
-  }
-}
-async function requestWindowsDaemonShutdown(owner) {
-  try {
-    const response = await requestLocalDaemonShutdown(owner.localApiPort, owner.localApiToken);
-    return response.ok ? "accepted" : "rejected";
-  } catch {
-    return "unreachable";
-  }
-}
 function parseServiceHostState(servicePlatform, result) {
   const output2 = result.output;
   if (servicePlatform === "linux") {
@@ -82884,62 +82838,9 @@ function parseServiceHostState(servicePlatform, result) {
   const stateMatch = output2.match(/\b(?:State|state)\s*[:=]\s*(\w+)/);
   const state = (stateMatch?.[1] ?? output2.trim()).toLowerCase();
   if (state === "running") return "running";
-  if (state === "queued") return "starting";
-  if (state === "ready" || state === "disabled") return "stopped";
+  if (state === "ready" || state === "disabled" || state === "queued") return "stopped";
   return "unknown";
 }
-function parseWindowsTaskInspection(result) {
-  if (result.status !== 0) {
-    throw new Error("Cannot inspect Windows daemon task definition");
-  }
-  const value2 = (name) => {
-    const match = result.output.match(new RegExp(`^${name}:\\s*(.*)$`, "imu"));
-    if (!match) throw new Error(`Incomplete Windows daemon task inspection: missing ${name}`);
-    return match[1]?.trim() ?? "";
-  };
-  const boolean4 = (name) => {
-    const parsed = value2(name).toLowerCase();
-    if (parsed === "true") return true;
-    if (parsed === "false") return false;
-    throw new Error(`Incomplete Windows daemon task inspection: invalid ${name}`);
-  };
-  const currentPresent = /^TaskName:\s*.+$/imu.test(result.output);
-  const currentStateValue = value2("State");
-  const currentOwned = boolean4("CurrentOwned");
-  const definitionMatches = boolean4("DefinitionMatch");
-  const legacyPresent = boolean4("LegacyTask");
-  const legacyOwned = boolean4("LegacyOwned");
-  const legacyStateValue = value2("LegacyState");
-  if (currentPresent !== (currentStateValue.toLowerCase() !== "missing")) {
-    throw new Error("Incomplete Windows daemon task inspection: inconsistent current task state");
-  }
-  if (!currentPresent && (currentOwned || definitionMatches)) {
-    throw new Error(
-      "Incomplete Windows daemon task inspection: absent current task is marked owned"
-    );
-  }
-  if (legacyPresent !== (legacyStateValue.toLowerCase() !== "missing") || !legacyPresent && legacyOwned) {
-    throw new Error("Incomplete Windows daemon task inspection: inconsistent legacy task state");
-  }
-  return {
-    currentPresent,
-    currentOwned,
-    currentState: currentPresent ? parseServiceHostState("win32", { status: 0, output: currentStateValue }) : "stopped",
-    definitionMatches,
-    definitionMarker: result.output.match(/^Definition:\s*(.+)$/imu)?.[1]?.trim(),
-    legacyPresent,
-    legacyOwned,
-    legacyState: legacyPresent ? parseServiceHostState("win32", { status: 0, output: legacyStateValue }) : "stopped"
-  };
-}
-function assertWindowsTaskOwnership(tasks) {
-  if (tasks.currentPresent && !tasks.currentOwned) {
-    throw new Error("Windows daemon task is not owned by this Alan installation");
-  }
-  if (tasks.legacyPresent && !tasks.legacyOwned) {
-    throw new Error("Legacy Windows daemon task is not owned by this Alan installation");
-  }
-}
 function resolveEnsureDefinitionOutcome(input2) {
   if (!input2.definitionChanged) {
     return { changed: false, updatePending: false };
@@ -82949,6 +82850,9 @@ function resolveEnsureDefinitionOutcome(input2) {
   }
   return { changed: true, updatePending: false };
 }
+function shouldStartOnInstall(hostState) {
+  return hostState === "stopped";
+}
 function resolveUsername(options) {
   if (options?.username) return options.username;
   try {
@@ -82957,14 +82861,17 @@ function resolveUsername(options) {
     return process.env.USER || process.env.USERNAME || "unknown";
   }
 }
-function assertSystemdUserLingerEnabled(options = {}) {
-  const username = resolveUsername(options);
-  const run = options.runCommand ?? runServiceCommand;
-  const result = run({
+function buildLingerStatusCommand(username) {
+  return {
     command: "loginctl",
     args: ["show-user", username, "-p", "Linger"],
     tolerateFailure: true
-  });
+  };
+}
+function assertSystemdUserLingerEnabled(options = {}) {
+  const username = resolveUsername(options);
+  const run = options.runCommand ?? runServiceCommand;
+  const result = run(buildLingerStatusCommand(username));
   if (result.status !== 0) {
     throw new Error(
       `Cannot verify systemd user linger for ${username} (loginctl failed). For durable headless VM boot run: sudo loginctl enable-linger ${username}`
@@ -82978,9 +82885,9 @@ function assertSystemdUserLingerEnabled(options = {}) {
 }
 function createHostContext(options = {}) {
   const args = options.args ?? [];
-  const plan = currentServicePlan(args, options.runtime, options);
+  const plan = currentServicePlan(args, options.runtime);
   const run = options.runCommand ?? runServiceCommand;
-  const sleep5 = options.sleep ?? defaultSleep;
+  const sleep4 = options.sleep ?? defaultSleep;
   const nowMs = options.nowMs ?? Date.now;
   const readManifest = options.readManifest ?? defaultReadManifest;
   const writeManifest = options.writeManifest ?? writeManifestAtomic;
@@ -82992,20 +82899,13 @@ function createHostContext(options = {}) {
     args,
     plan,
     run,
-    sleep: sleep5,
+    sleep: sleep4,
     nowMs,
     readManifest,
     writeManifest,
     removeManifest,
     ensureLogDir,
-    configPath: options.configPath ?? resolveAgentConfigPath({ profile: resolveEndpointProfileFromArgs(args) }),
-    readOwner: options.readOwner ?? readLocalDaemonOwnerLease,
-    isProcessAlive: options.isProcessAlive ?? isProcessAlive,
-    probeEndpoint: options.probeEndpoint ?? probeLocalDaemonEndpoint,
-    requestWindowsShutdown: options.requestWindowsShutdown ?? requestWindowsDaemonShutdown,
-    inspectJournal: options.inspectJournal ?? inspectLocalDaemonRunJournal,
-    acquireMaintenance: options.acquireMaintenance ?? acquireLocalDaemonMaintenanceLease,
-    releaseMaintenance: options.releaseMaintenance ?? releaseLocalDaemonMaintenanceLease
+    profile: resolveEndpointProfileFromArgs(args)
   };
 }
 function inspectDaemonService(options = {}) {
@@ -83021,9 +82921,8 @@ function inspectDaemonService(options = {}) {
 }
 function ensureDaemonServiceDefinition(options = {}) {
   const ctx = createHostContext(options);
-  const { plan, run, nowMs, readManifest, writeManifest, ensureLogDir } = ctx;
+  const { plan, run, readManifest, writeManifest, ensureLogDir } = ctx;
   let definitionChanged = false;
-  let inspection;
   if (plan.manifestPath && plan.manifest) {
     ensureLogDir();
     const existing = readManifest(plan.manifestPath);
@@ -83032,38 +82931,20 @@ function ensureDaemonServiceDefinition(options = {}) {
       writeManifest(plan.manifestPath, plan.manifest);
     }
   } else if (plan.platform === "win32") {
-    ensureLogDir();
-    const result = run(plan.statusCommand);
-    const tasks = parseWindowsTaskInspection(result);
-    assertWindowsTaskOwnership(tasks);
-    if (tasks.currentPresent && tasks.currentState === "unknown" || tasks.legacyPresent && tasks.legacyState === "unknown") {
-      throw new Error("Cannot safely update a Windows daemon task with unknown state");
-    }
-    definitionChanged = tasks.definitionMarker !== plan.definitionMarker || !tasks.definitionMatches || tasks.legacyPresent;
-    const running = tasks.currentState === "running" || tasks.legacyState === "running";
-    inspection = {
-      state: running ? "running" : tasks.currentState,
-      platform: plan.platform,
-      detail: result.output || void 0,
-      observedAtMs: nowMs()
-    };
+    definitionChanged = true;
   }
-  inspection ??= inspectDaemonService(options);
-  const definitionHostState = plan.platform === "win32" && inspection.state === "starting" ? "stopped" : inspection.state;
+  const inspection = inspectDaemonService(options);
   const outcome = resolveEnsureDefinitionOutcome({
     definitionChanged,
-    hostState: definitionHostState
+    hostState: inspection.state
   });
   if (outcome.updatePending) {
     return outcome;
   }
-  if (plan.platform === "win32" && !outcome.changed) {
-    return outcome;
-  }
-  if (definitionHostState === "running" || definitionHostState === "starting") {
+  if (inspection.state === "running" || inspection.state === "starting") {
     return outcome;
   }
-  const definitionCommands = definitionHostState === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
+  const definitionCommands = inspection.state === "stopped" ? plan.reloadDefinitionCommands : plan.loadDefinitionCommands;
   for (const command of definitionCommands) run(command);
   return outcome;
 }
@@ -83075,140 +82956,10 @@ function startDaemonService(options = {}) {
   const { plan, run } = createHostContext(options);
   for (const command of plan.startCommands) run(command);
 }
-async function stopDaemonServiceAndWait(identity, timeoutMs, options = {}) {
-  const {
-    plan,
-    run,
-    sleep: sleep5,
-    nowMs,
-    configPath,
-    readOwner,
-    isProcessAlive: processIsAlive,
-    probeEndpoint,
-    requestWindowsShutdown: requestShutdown
-  } = createHostContext(options);
-  let owner;
-  try {
-    owner = readOwner(configPath);
-  } catch {
-    return "identity_changed";
-  }
-  const ownerMatches = (candidate) => candidate.pid === identity.pid && candidate.daemonSessionId === identity.daemonSessionId && candidate.localApiPort === identity.port && (identity.serviceId === void 0 || candidate.localServiceId === identity.serviceId) && (identity.startedAtMs === void 0 || candidate.startedAtMs === identity.startedAtMs);
-  if (!owner || !ownerMatches(owner)) {
-    return "identity_changed";
-  }
-  if (plan.platform === "win32") {
-    const shutdown = await requestShutdown(owner);
-    if (shutdown === "rejected") return "identity_changed";
-    if (shutdown === "unreachable") {
-      for (const command of plan.stopCommands) run(command);
-    }
-    const deadline2 = nowMs() + timeoutMs;
-    while (nowMs() < deadline2) {
-      let currentOwner;
-      try {
-        currentOwner = readOwner(configPath);
-      } catch {
-        return "identity_changed";
-      }
-      if (currentOwner && !ownerMatches(currentOwner)) {
-        return "identity_changed";
-      }
-      if (!processIsAlive(identity.pid)) {
-        const endpoint = await probeEndpoint(identity.port, owner.localApiToken, 250);
-        if (endpoint.state === "absent") return "exited";
-        if (endpoint.state === "listening_unauthorized" || endpoint.status.daemonSessionId !== identity.daemonSessionId) {
-          return "identity_changed";
-        }
-      }
-      await sleep5(STOP_POLL_INTERVAL_MS);
-    }
-    return "timeout";
-  }
-  for (const command of plan.stopCommands) run(command);
-  const deadline = nowMs() + timeoutMs;
-  while (nowMs() < deadline) {
-    const result = run(plan.isActiveCommand);
-    const state = parseServiceHostState(plan.platform, result);
-    if (state === "stopped") return "exited";
-    if (state === "unknown") {
-    } else if (identity.pid > 0) {
-      try {
-        process.kill(identity.pid, 0);
-      } catch {
-        return "exited";
-      }
-    }
-    await sleep5(STOP_POLL_INTERVAL_MS);
-  }
-  return "timeout";
-}
-async function uninstallDaemonService(args = [], options = {}) {
+function uninstallDaemonService(args = [], options = {}) {
   const ctx = createHostContext({ ...options, args: options.args ?? args });
-  if (ctx.plan.platform === "win32") {
-    const ownership = ctx.run(ctx.plan.statusCommand);
-    let tasks;
-    try {
-      tasks = parseWindowsTaskInspection(ownership);
-    } catch (error61) {
-      throw new Error(
-        `Cannot inspect Windows daemon task ownership before uninstall: ${error61 instanceof Error ? error61.message : String(error61)}`
-      );
-    }
-    assertWindowsTaskOwnership(tasks);
-    if (!tasks.currentPresent && !tasks.legacyPresent) {
-      console.info("[alan-agent] Per-user daemon service removed");
-      return;
-    }
-    const acquired = ctx.acquireMaintenance(ctx.configPath, "watchdog", 3e4);
-    if (!acquired.acquired) {
-      throw new Error("Cannot uninstall the Windows daemon service while maintenance is active");
-    }
-    try {
-      const journal = ctx.inspectJournal(ctx.configPath);
-      if (!journal.safeToRestart) {
-        throw new Error(
-          `Windows daemon service uninstall is deferred while ${journal.activeRunCount} active run${journal.activeRunCount === 1 ? "" : "s"} finish`
-        );
-      }
-      let owner;
-      try {
-        owner = ctx.readOwner(ctx.configPath);
-      } catch (error61) {
-        throw new Error(
-          `Cannot verify Windows daemon ownership before uninstall: ${error61 instanceof Error ? error61.message : String(error61)}`
-        );
-      }
-      if (owner) {
-        const stopped = await stopDaemonServiceAndWait(
-          {
-            pid: owner.pid,
-            serviceId: owner.localServiceId,
-            daemonSessionId: owner.daemonSessionId,
-            port: owner.localApiPort,
-            startedAtMs: owner.startedAtMs
-          },
-          1e4,
-          { ...options, args: ctx.args }
-        );
-        if (stopped !== "exited") {
-          throw new Error(
-            stopped === "identity_changed" ? "Windows daemon ownership changed before uninstall" : "Timed out waiting for the Windows daemon to stop before uninstall"
-          );
-        }
-      } else {
-        if (tasks.currentState !== "stopped" || tasks.legacyState !== "stopped") {
-          throw new Error("Cannot uninstall a running Windows daemon without verified ownership");
-        }
-      }
-      for (const command of ctx.plan.uninstallCommands) ctx.run(command);
-    } finally {
-      ctx.releaseMaintenance(ctx.configPath, acquired.lease.id);
-    }
-  } else {
-    for (const command of ctx.plan.uninstallCommands) ctx.run(command);
-    if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
-  }
+  for (const command of ctx.plan.uninstallCommands) ctx.run(command);
+  if (ctx.plan.manifestPath) ctx.removeManifest(ctx.plan.manifestPath);
   console.info("[alan-agent] Per-user daemon service removed");
 }
 function installDaemonService(args = [], runtime, options = {}) {
@@ -83236,7 +82987,7 @@ function installDaemonService(args = [], runtime, options = {}) {
     });
     return;
   }
-  if (inspection.state !== "stopped") {
+  if (!shouldStartOnInstall(inspection.state)) {
     console.info("[alan-agent] Per-user daemon service already present", {
       profile,
       state: inspection.state
@@ -83260,48 +83011,14 @@ ${result.output}
 }
 
 // src/install-command.ts
-var WINDOWS_SETUP_READY_TIMEOUT_MS = 9e3;
-async function runInstallCommand(commandArgs, currentPlatform = process.platform) {
-  if (currentPlatform === "win32" && commandArgs.includes("--headless")) {
-    throw new Error("--headless is only supported on Linux systemd user services");
-  }
+async function runInstallCommand(commandArgs) {
   bindConfigPath(commandArgs);
   const configured = readConfig();
   const configurationMode = resolveInstallConfigurationMode(commandArgs, configured);
-  const isWindowsSetup = currentPlatform === "win32" && configurationMode === "setup";
-  const deadline = isWindowsSetup ? Date.now() + WINDOWS_SETUP_READY_TIMEOUT_MS : 0;
-  const runtimeIdentityChanged = configurationMode === "setup" ? await setupDaemon(commandArgs) : false;
+  if (configurationMode === "setup") await setupDaemon(commandArgs);
   if (configurationMode === "login") await loginWithDeviceCode(commandArgs);
-  if (!isWindowsSetup) {
-    installDaemonService(commandArgs);
-    runMcpIntegrationCommand(["reconcile", ...commandArgs]);
-    return;
-  }
-  const { runtimeId, localApiPort, localApiToken } = readConfig();
-  if (!runtimeId || !localApiPort || !localApiToken) {
-    throw new Error("Windows runtime setup completed without a local readiness endpoint");
-  }
-  if (runtimeIdentityChanged) {
-    while (Date.now() < deadline) {
-      const status = await probeLocalDaemon(localApiPort, localApiToken, 250);
-      if (status?.runtimeId === runtimeId && status.connected) break;
-      if (!status) {
-        const service = inspectDaemonService({ args: commandArgs });
-        if (service.state !== "running" && service.state !== "starting") break;
-      }
-      await (0, import_promises6.setTimeout)(100);
-    }
-  }
   installDaemonService(commandArgs);
-  while (Date.now() < deadline) {
-    const status = await probeLocalDaemon(localApiPort, localApiToken, 250);
-    if (status?.runtimeId === runtimeId && status.connected) {
-      runMcpIntegrationCommand(["reconcile", ...commandArgs]);
-      return;
-    }
-    await (0, import_promises6.setTimeout)(100);
-  }
-  throw new Error("Windows runtime did not become ready within 9 seconds");
+  runMcpIntegrationCommand(["reconcile", ...commandArgs]);
 }
 
 // src/lifecycle-logger.ts
@@ -86678,7 +86395,7 @@ var REQUEST_STATE_ONLY_LEG_PACING_MS2 = 250;
 function inputRequiredRoundsExceededMessage2(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
-function sleep4(ms, signal) {
+function sleep3(ms, signal) {
   return new Promise((resolve15, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError2 ? signal.reason : new SdkError2(SdkErrorCode2.RequestTimeout, String(signal.reason)));
@@ -94945,7 +94662,7 @@ var LegacyInputRequiredShim = class {
         } finally {
           roundAbort.dispose();
         }
-      } else await sleep4(REQUEST_STATE_ONLY_LEG_PACING_MS2, outerSignal);
+      } else await sleep3(REQUEST_STATE_ONLY_LEG_PACING_MS2, outerSignal);
       let ctxNext = {
         ...ctx,
         mcpReq: {
@@ -95742,7 +95459,7 @@ async function runMcpStdioProxy(env = process.env, local = new StdioServerTransp
 }
 
 // src/native-hook-command.ts
-var import_node_crypto22 = require("crypto");
+var import_node_crypto21 = require("crypto");
 var import_node_fs27 = require("fs");
 var import_node_os17 = require("os");
 var import_node_path29 = require("path");
@@ -96111,7 +95828,7 @@ function parseNativeHookEnvelope(input2) {
   const projectPin = eventType === "session_start" && resolvedCwd ? readAlanProjectPin(resolvedCwd) : void 0;
   return {
     schemaVersion: 1,
-    eventId: (0, import_node_crypto22.randomUUID)(),
+    eventId: (0, import_node_crypto21.randomUUID)(),
     provider: capability.provider,
     eventType,
     observedAt: (input2.now ?? /* @__PURE__ */ new Date()).toISOString(),
@@ -96278,7 +95995,7 @@ function decodeResumeFallbackContext(encoded) {
 }
 
 // src/sandbox.ts
-var import_node_os18 = require("os");
+var import_node_os19 = require("os");
 
 // src/execution-activity-tracker.ts
 var ExecutionActivityTracker = class {
@@ -96607,7 +96324,7 @@ function delay2(ms) {
 }
 
 // src/web-presenter.ts
-var import_node_crypto23 = require("crypto");
+var import_node_crypto22 = require("crypto");
 var WebPresenter = class {
   constructor(wsClient, conversationId, cwd) {
     this.conversationId = conversationId;
@@ -96793,7 +96510,7 @@ var WebPresenter = class {
     this.applicationProblem = createAlanProblem({
       domain: "application",
       code: input2.code,
-      id: (0, import_node_crypto23.randomUUID)(),
+      id: (0, import_node_crypto22.randomUUID)(),
       title: APPLICATION_PROBLEM_TITLES[input2.code],
       detail: input2.message,
       // The schema's slot for the technical cause, so the problem carries it
@@ -96863,7 +96580,7 @@ var WebPresenter = class {
 };
 
 // src/ws-client.ts
-var import_node_crypto25 = require("crypto");
+var import_node_crypto24 = require("crypto");
 
 // ../shared/dist/agent-liveness.js
 var AGENT_LIVENESS_PROTOCOL_VERSION = 1;
@@ -96874,6 +96591,34 @@ var agentRunStateSchema = external_exports.object({
   /** Run ids currently executing (cloud sandbox agent runs one at a time, but keep it a list). */
   activeRunIds: external_exports.array(external_exports.string()).default([])
 });
+var AGENT_RESOURCE_SAMPLE_INTERVAL_MS = 6e4;
+var resourceCounter = external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var resourceMeasurement = external_exports.number().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var pressurePercentage = external_exports.number().min(0).max(100);
+var agentResourceDiagnosticsSchema = external_exports.object({
+  sampledAtMs: resourceCounter,
+  memoryTotalBytes: resourceCounter,
+  memoryFreeBytes: resourceCounter,
+  /** Linux MemAvailable includes reclaimable memory; free memory alone does not. */
+  memoryAvailableBytes: resourceCounter.optional(),
+  swapTotalBytes: resourceCounter.optional(),
+  swapFreeBytes: resourceCounter.optional(),
+  processRssBytes: resourceCounter,
+  cpuCount: external_exports.number().int().positive().max(65536),
+  /** Omitted on Windows, where os.loadavg() always returns zero. */
+  loadAverage1m: resourceMeasurement.optional(),
+  eventLoopDelayMaxMs: resourceMeasurement.optional(),
+  eventLoopDelayP99Ms: resourceMeasurement.optional(),
+  memoryPressureSomeAvg10: pressurePercentage.optional(),
+  memoryPressureFullAvg10: pressurePercentage.optional(),
+  cpuPressureSomeAvg10: pressurePercentage.optional(),
+  ioPressureSomeAvg10: pressurePercentage.optional(),
+  /** Counters for the agent's current cgroup v2, including its child workload. */
+  cgroupMemoryCurrentBytes: resourceCounter.optional(),
+  cgroupMemoryLimitBytes: resourceCounter.optional(),
+  cgroupMemoryOomEvents: resourceCounter.optional(),
+  cgroupMemoryOomKillEvents: resourceCounter.optional()
+});
 var agentHeartbeatSchema = external_exports.object({
   /** Stable id for this agent OS process; changes only on a fresh agent start. */
   agentSessionId: external_exports.string().min(1),
@@ -96882,7 +96627,9 @@ var agentHeartbeatSchema = external_exports.object({
   /** Capability marker — presence is what distinguishes a new agent from a legacy one. */
   protocolVersion: external_exports.number().int().positive(),
   runState: agentRunStateSchema,
-  agentVersion: external_exports.string().optional()
+  agentVersion: external_exports.string().optional(),
+  // Bad optional diagnostics must never discard otherwise valid liveness evidence.
+  resources: agentResourceDiagnosticsSchema.optional().catch(void 0)
 });
 var agentProbeAckSchema = external_exports.object({
   agentSessionId: external_exports.string().min(1),
@@ -96890,14 +96637,152 @@ var agentProbeAckSchema = external_exports.object({
   protocolVersion: external_exports.number().int().positive().optional()
 });
 
-// src/sandbox-outbox.ts
-var import_node_crypto24 = require("crypto");
+// src/resource-diagnostics.ts
 var import_node_fs28 = require("fs");
+var import_node_os18 = require("os");
+var import_node_path30 = require("path");
+var import_node_perf_hooks = require("perf_hooks");
+var MAX_RESOURCE_FILE_BYTES = 16384;
+var RESOURCE_READ_TIMEOUT_MS = 500;
+async function readResourceFile(path2) {
+  try {
+    const stream = (0, import_node_fs28.createReadStream)(path2, {
+      encoding: "utf8",
+      start: 0,
+      end: MAX_RESOURCE_FILE_BYTES,
+      signal: AbortSignal.timeout(RESOURCE_READ_TIMEOUT_MS)
+    });
+    let text = "";
+    for await (const chunk of stream) {
+      text += chunk;
+      if (text.length > MAX_RESOURCE_FILE_BYTES) return void 0;
+    }
+    return text;
+  } catch {
+    return void 0;
+  }
+}
+function counter(value2) {
+  if (!value2 || !/^\d+$/.test(value2)) return void 0;
+  const parsed = Number(value2);
+  return Number.isSafeInteger(parsed) ? parsed : void 0;
+}
+function pressure(text, kind) {
+  const value2 = text?.match(new RegExp(`^${kind} avg10=(\\d+(?:\\.\\d+)?) `, "m"))?.[1];
+  if (value2 === void 0) return void 0;
+  const parsed = Number(value2);
+  return Number.isFinite(parsed) && parsed <= 100 ? parsed : void 0;
+}
+function meminfoBytes(text, field) {
+  const kb = counter(text?.match(new RegExp(`^${field}:\\s+(\\d+) kB$`, "m"))?.[1]);
+  return kb !== void 0 && Number.isSafeInteger(kb * 1024) ? kb * 1024 : void 0;
+}
+function cgroupDirectory(text) {
+  const path2 = text?.match(/^0::(\/[^\n]*)$/m)?.[1];
+  if (!path2 || path2.split("/").includes("..")) return void 0;
+  return import_node_path30.posix.join("/sys/fs/cgroup", path2);
+}
+async function collectAgentResourceDiagnostics(options = {}) {
+  const platform6 = options.platform ?? process.platform;
+  const readFile7 = async (path2) => {
+    try {
+      return await (options.readFile ?? readResourceFile)(path2);
+    } catch {
+      return void 0;
+    }
+  };
+  const sample = {
+    sampledAtMs: Date.now(),
+    memoryTotalBytes: (0, import_node_os18.totalmem)(),
+    memoryFreeBytes: (0, import_node_os18.freemem)(),
+    processRssBytes: process.memoryUsage.rss(),
+    cpuCount: (0, import_node_os18.availableParallelism)(),
+    ...platform6 === "win32" ? {} : { loadAverage1m: (0, import_node_os18.loadavg)()[0] }
+  };
+  if (platform6 !== "linux") return sample;
+  const [meminfo, memoryPsi, cpuPsi, ioPsi, cgroup] = await Promise.all([
+    readFile7("/proc/meminfo"),
+    readFile7("/proc/pressure/memory"),
+    readFile7("/proc/pressure/cpu"),
+    readFile7("/proc/pressure/io"),
+    readFile7("/proc/self/cgroup")
+  ]);
+  sample.memoryAvailableBytes = meminfoBytes(meminfo, "MemAvailable");
+  sample.swapTotalBytes = meminfoBytes(meminfo, "SwapTotal");
+  sample.swapFreeBytes = meminfoBytes(meminfo, "SwapFree");
+  sample.memoryPressureSomeAvg10 = pressure(memoryPsi, "some");
+  sample.memoryPressureFullAvg10 = pressure(memoryPsi, "full");
+  sample.cpuPressureSomeAvg10 = pressure(cpuPsi, "some");
+  sample.ioPressureSomeAvg10 = pressure(ioPsi, "some");
+  const directory = cgroupDirectory(cgroup);
+  if (!directory) return sample;
+  const [current, limit, events] = await Promise.all([
+    readFile7(`${directory}/memory.current`),
+    readFile7(`${directory}/memory.max`),
+    readFile7(`${directory}/memory.events`)
+  ]);
+  sample.cgroupMemoryCurrentBytes = counter(current?.trim());
+  sample.cgroupMemoryLimitBytes = counter(limit?.trim());
+  sample.cgroupMemoryOomEvents = counter(events?.match(/^oom (\d+)$/m)?.[1]);
+  sample.cgroupMemoryOomKillEvents = counter(events?.match(/^oom_kill (\d+)$/m)?.[1]);
+  return sample;
+}
+var AgentResourceSampler = class {
+  constructor(collect = collectAgentResourceDiagnostics) {
+    this.collect = collect;
+  }
+  delay = (0, import_node_perf_hooks.monitorEventLoopDelay)({ resolution: 20 });
+  timer;
+  inFlight = false;
+  generation = 0;
+  sample;
+  start() {
+    if (this.timer) return;
+    this.generation += 1;
+    this.delay.reset();
+    this.delay.enable();
+    this.timer = setInterval(() => void this.refresh(), AGENT_RESOURCE_SAMPLE_INTERVAL_MS);
+    this.timer.unref();
+    void this.refresh();
+  }
+  stop() {
+    this.generation += 1;
+    if (this.timer) clearInterval(this.timer);
+    this.timer = void 0;
+    this.delay.disable();
+    this.sample = void 0;
+  }
+  latest() {
+    return this.sample;
+  }
+  async refresh() {
+    if (this.inFlight) return;
+    this.inFlight = true;
+    const generation = this.generation;
+    const delay3 = this.delay.count > 0 ? {
+      eventLoopDelayMaxMs: this.delay.max / 1e6,
+      eventLoopDelayP99Ms: this.delay.percentile(99) / 1e6
+    } : {};
+    this.delay.reset();
+    try {
+      const sample = await this.collect();
+      if (generation === this.generation) this.sample = { ...sample, ...delay3 };
+    } catch {
+      if (generation === this.generation) this.sample = void 0;
+    } finally {
+      this.inFlight = false;
+    }
+  }
+};
+
+// src/sandbox-outbox.ts
+var import_node_crypto23 = require("crypto");
+var import_node_fs29 = require("fs");
 function deriveSandboxOutboxKey(sessionToken) {
   if (!sessionToken) {
     throw new Error("sandbox event outbox requires ALAN_SESSION_TOKEN for key derivation");
   }
-  return (0, import_node_crypto24.createHash)("sha256").update(sessionToken, "utf8").digest("base64url");
+  return (0, import_node_crypto23.createHash)("sha256").update(sessionToken, "utf8").digest("base64url");
 }
 function sandboxOutboxSpoolPath(conversationId) {
   return `/tmp/alan-agent-outbox-${conversationId}.enc`;
@@ -96913,24 +96798,24 @@ function assertValidOutboxKey(key, path2) {
 }
 function loadOrCreateSandboxOutboxKey(input2) {
   const keyPath = sandboxOutboxKeyPath(input2.spoolPath);
-  if ((0, import_node_fs28.existsSync)(keyPath)) {
-    (0, import_node_fs28.chmodSync)(keyPath, 384);
-    return assertValidOutboxKey((0, import_node_fs28.readFileSync)(keyPath, "utf8").trim(), keyPath);
+  if ((0, import_node_fs29.existsSync)(keyPath)) {
+    (0, import_node_fs29.chmodSync)(keyPath, 384);
+    return assertValidOutboxKey((0, import_node_fs29.readFileSync)(keyPath, "utf8").trim(), keyPath);
   }
   const initialKey = deriveSandboxOutboxKey(input2.sessionToken);
   try {
-    (0, import_node_fs28.writeFileSync)(keyPath, initialKey, { encoding: "utf8", flag: "wx", mode: 384 });
+    (0, import_node_fs29.writeFileSync)(keyPath, initialKey, { encoding: "utf8", flag: "wx", mode: 384 });
     return initialKey;
   } catch (error61) {
     if (error61.code !== "EEXIST") throw error61;
-    (0, import_node_fs28.chmodSync)(keyPath, 384);
-    return assertValidOutboxKey((0, import_node_fs28.readFileSync)(keyPath, "utf8").trim(), keyPath);
+    (0, import_node_fs29.chmodSync)(keyPath, 384);
+    return assertValidOutboxKey((0, import_node_fs29.readFileSync)(keyPath, "utf8").trim(), keyPath);
   }
 }
 function quarantineUnusableOutbox(path2) {
   const suffix = `corrupt-${Date.now()}-${process.pid}`;
   for (const candidate of [path2, eventJournalDir(path2)]) {
-    if ((0, import_node_fs28.existsSync)(candidate)) (0, import_node_fs28.renameSync)(candidate, `${candidate}.${suffix}`);
+    if ((0, import_node_fs29.existsSync)(candidate)) (0, import_node_fs29.renameSync)(candidate, `${candidate}.${suffix}`);
   }
 }
 function createSandboxEventOutbox(input2) {
@@ -97074,10 +96959,11 @@ var WSClient = class {
   }
   socket;
   /** Stable id for this agent process; fences stale heartbeats server-side. */
-  agentSessionId = (0, import_node_crypto25.randomUUID)();
+  agentSessionId = (0, import_node_crypto24.randomUUID)();
   /** Monotonic heartbeat sequence — advances on every hello + heartbeat. */
   heartbeatSeq = 0;
   heartbeatTimer = null;
+  resourceSampler = new AgentResourceSampler();
   supervisedReconnectTimer = null;
   supervisedReconnectAttempt = 0;
   connectionDirective = null;
@@ -97126,11 +97012,13 @@ var WSClient = class {
       seq: this.heartbeatSeq,
       protocolVersion: AGENT_LIVENESS_PROTOCOL_VERSION,
       runState: this.currentRunState(),
-      agentVersion: this.agentVersion || void 0
+      agentVersion: this.agentVersion || void 0,
+      resources: this.resourceSampler.latest()
     };
   }
   /** Emit `agent.hello` on (re)connect and (re)start the heartbeat interval. */
   startHeartbeat() {
+    this.resourceSampler.start();
     if (this.socket.connected) {
       this.socket.emit("agent.hello", this.buildHeartbeat());
     }
@@ -97142,6 +97030,7 @@ var WSClient = class {
     this.heartbeatTimer.unref?.();
   }
   stopHeartbeat() {
+    this.resourceSampler.stop();
     if (this.heartbeatTimer) {
       clearInterval(this.heartbeatTimer);
       this.heartbeatTimer = null;
@@ -97606,7 +97495,7 @@ async function runSandbox(config2) {
   }
   const presenter = new WebPresenter(wsClient, config2.sessionId, config2.projectPath);
   presenter.setSuppressSessionLifecycle(true);
-  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os18.homedir)() });
+  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os19.homedir)() });
   let lastProviderSessionId = config2.providerSessionId;
   let resumeFallbackContext = config2.resumeFallbackContext;
   let activeBackendKind = config2.backendKind || "claude_cli";
@@ -97906,12 +97795,12 @@ async function runSandbox(config2) {
 }
 
 // src/skills/skill-cli.ts
-var import_promises7 = require("fs/promises");
-var import_node_os19 = require("os");
-var import_node_path30 = require("path");
+var import_promises6 = require("fs/promises");
+var import_node_os20 = require("os");
+var import_node_path31 = require("path");
 async function runSkillsCommand(args) {
   const [subcommand, ...options] = args;
-  const homeDirectory2 = option(options, "--home") ?? (0, import_node_os19.homedir)();
+  const homeDirectory2 = option(options, "--home") ?? (0, import_node_os20.homedir)();
   const manager = await RuntimeSkillManager.open({ homeDirectory: homeDirectory2 });
   if (subcommand === "scan") {
     const inputPath = option(options, "--input");
@@ -97952,8 +97841,8 @@ async function defaultScanInput(homeDirectory2) {
   });
 }
 async function readProtectedJson(path2) {
-  const absolutePath = (0, import_node_path30.resolve)(path2);
-  const stat2 = await (0, import_promises7.lstat)(absolutePath);
+  const absolutePath = (0, import_node_path31.resolve)(path2);
+  const stat2 = await (0, import_promises6.lstat)(absolutePath);
   if (!stat2.isFile()) throw new Error(`Skill input is not a regular file: ${absolutePath}`);
   if (process.platform !== "win32" && (stat2.mode & 63) !== 0) {
     throw new Error(`Skill input must not be accessible by group or other users: ${absolutePath}`);
@@ -97962,7 +97851,7 @@ async function readProtectedJson(path2) {
     throw new Error(`Skill input must be owned by the current user: ${absolutePath}`);
   }
   if (stat2.size > 2 * 1024 * 1024) throw new Error("Skill input exceeds 2 MiB");
-  return JSON.parse(await (0, import_promises7.readFile)(absolutePath, "utf8"));
+  return JSON.parse(await (0, import_promises6.readFile)(absolutePath, "utf8"));
 }
 function option(args, name) {
   const index = args.indexOf(name);
@@ -98120,7 +98009,7 @@ async function main() {
     return;
   }
   if (command === "service" && commandArgs[0] === "uninstall") {
-    await uninstallDaemonService(commandArgs.slice(1));
+    uninstallDaemonService(commandArgs.slice(1));
     return;
   }
   if (command === "service" && commandArgs[0] === "status") {