@aspectlylabs/mikka 0.0.1 → 0.0.3

package/main.js

@@ -2208,8 +2208,8 @@ var EventQueue = class {
         if (next.type === "exit") return;
         continue;
       }
-      await new Promise((resolve9) => {
-        this.waiter = resolve9;
+      await new Promise((resolve10) => {
+        this.waiter = resolve10;
       });
     }
   }
@@ -2280,13 +2280,13 @@ async function spawnCli(sandbox, argv, options) {
     stderr = (stderr + data).slice(-STDERR_TAIL * 4);
   });
   const exited = new Promise(
-    (resolve9) => {
+    (resolve10) => {
       child.once("error", (error) => {
         stderr += `
 ${error.message}`;
-        resolve9({ code: null, signal: null });
+        resolve10({ code: null, signal: null });
       });
-      child.once("exit", (code, signal) => resolve9({ code, signal }));
+      child.once("exit", (code, signal) => resolve10({ code, signal }));
     }
   ).finally(() => {
     signalGroup(pgid, "SIGKILL");
@@ -2303,8 +2303,8 @@ ${error.message}`;
       let timer;
       await Promise.race([
         exited,
-        new Promise((resolve9) => {
-          timer = setTimeout(resolve9, graceMs);
+        new Promise((resolve10) => {
+          timer = setTimeout(resolve10, graceMs);
         })
       ]);
       clearTimeout(timer);
@@ -2313,17 +2313,17 @@ ${error.message}`;
     }
   };
 }
-async function untilReady(child, step, label, ms = 12e4) {
+async function untilReady(child, step, label2, ms = 12e4) {
   let timer;
   try {
     return await Promise.race([
       step,
       child.exited.then(({ code, signal }) => {
-        throw new Error(`${label}: the CLI exited (${signal ?? code})`);
+        throw new Error(`${label2}: the CLI exited (${signal ?? code})`);
       }),
       new Promise((_, reject) => {
         timer = setTimeout(
-          () => reject(new Error(`${label}: no answer after ${ms / 1e3} s`)),
+          () => reject(new Error(`${label2}: no answer after ${ms / 1e3} s`)),
           ms
         );
       })
@@ -2385,11 +2385,11 @@ var JsonlWriter = class extends AbstractMessageWriter {
   }
   stream;
   write(message) {
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       this.stream.write(
         `${JSON.stringify(message)}
 `,
-        (error) => error ? reject(error) : resolve9()
+        (error) => error ? reject(error) : resolve10()
       );
     });
   }
@@ -2625,13 +2625,18 @@ var runReport = z2.object({
     sha: z2.string().regex(/^[a-f0-9]{40}$/),
     readOnly: z2.literal(true)
   }).optional(),
+  /** Preview branch created or used by the producing run; descriptive metadata only. */
+  previewDatabaseBranch: z2.string().trim().min(1).max(500).optional(),
   /** Acceptance criteria the agent checked, with evidence. */
   criteria: z2.array(
     z2.object({
       criterionId: z2.uuid().optional(),
       text: z2.string().max(2e3).optional(),
       passed: z2.boolean(),
-      evidence: z2.string().max(1e4).optional()
+      evidence: z2.string().max(1e4).optional(),
+      /** Agent-reported criterion check; the daemon-owned verify remains authoritative. */
+      command: z2.string().trim().min(1).max(2e3).optional(),
+      exitCode: z2.number().int().nullable().optional()
     })
   ).max(200).optional(),
   /**
@@ -2821,7 +2826,7 @@ import { join as join2 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.1",
+  version: "0.0.3",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -2878,7 +2883,8 @@ var package_default = {
   },
   engines: {
     node: ">=24"
-  }
+  },
+  gitHead: "4d1f09bda63e1b86a6cf08c4c7f4dc159b2938a2"
 };
 
 // src/paths.ts
@@ -3837,7 +3843,7 @@ var heartbeatRunSchema = z14.object({
   /** Last tool call, turn boundary or file change (not raw output). */
   lastProgressAt: isoTime
 });
-var deviceManagementCommand = z14.object({ id: z14.uuid(), kind: z14.enum(["redetect", "restart", "update"]) });
+var deviceManagementCommand = z14.object({ id: z14.uuid(), kind: z14.enum(["redetect", "restart", "update", "uninstall"]) });
 var deviceHeartbeatSchema = z14.object({
   completedDeviceCommands: z14.array(z14.uuid()).max(100).optional(),
   failedDeviceCommands: z14.array(z14.object({ id: z14.uuid(), error: z14.string().max(500) })).max(100).optional(),
@@ -5157,6 +5163,7 @@ var RunContext = class {
       nextStep: file.nextStep ?? null,
       ...file.blockedOn ? { blockedOn: file.blockedOn } : {},
       ...plan ? { plan } : {},
+      ...typeof file.previewDatabaseBranch === "string" ? { previewDatabaseBranch: file.previewDatabaseBranch } : {},
       ...Array.isArray(file.criteria) ? { criteria: file.criteria } : {},
       ...runQuestion.safeParse(file.question).success ? { question: runQuestion.parse(file.question) } : {}
     };
@@ -5418,8 +5425,8 @@ async function runCodexCoordinator(input, host) {
   const messages = /* @__PURE__ */ new Map();
   let resolveEnd;
   let rejectEnd;
-  const ended = new Promise((resolve9, reject) => {
-    resolveEnd = resolve9;
+  const ended = new Promise((resolve10, reject) => {
+    resolveEnd = resolve10;
     rejectEnd = reject;
   });
   void ended.catch(() => void 0);
@@ -5599,10 +5606,11 @@ import {
   existsSync as existsSync6,
   mkdirSync as mkdirSync15,
   readFileSync as readFileSync11,
+  rmSync as rmSync16,
   realpathSync as realpathSync11
 } from "node:fs";
 import { arch, hostname, platform as platform2 } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/adapters/claude.ts
@@ -5728,8 +5736,8 @@ function spawnRunSandbox(options) {
   let outcome;
   let hardStop;
   let settle;
-  const exited = new Promise((resolve9) => {
-    settle = resolve9;
+  const exited = new Promise((resolve10) => {
+    settle = resolve10;
   });
   function send(message) {
     if (!child.connected || gone) return;
@@ -6002,9 +6010,9 @@ async function createNativeSubscriptionBroker(host) {
     }
   });
   try {
-    await new Promise((resolve9, reject) => {
+    await new Promise((resolve10, reject) => {
       server.once("error", reject);
-      server.listen(socket, resolve9);
+      server.listen(socket, resolve10);
     });
     chmodSync(socket, 384);
   } catch {
@@ -6017,7 +6025,7 @@ async function createNativeSubscriptionBroker(host) {
       halted = true;
       for (const abort of pending) abort.abort();
       server.closeAllConnections();
-      await new Promise((resolve9) => server.close(() => resolve9()));
+      await new Promise((resolve10) => server.close(() => resolve10()));
       rmSync6(dir, { recursive: true, force: true });
     }
   };
@@ -6181,8 +6189,8 @@ var PromptQueue = class {
         continue;
       }
       if (this.closed) return;
-      await new Promise((resolve9) => {
-        this.waiter = resolve9;
+      await new Promise((resolve10) => {
+        this.waiter = resolve10;
       });
     }
   }
@@ -6196,8 +6204,8 @@ async function untilSpoken(spoken) {
   try {
     return await Promise.race([
       spoken,
-      new Promise((resolve9) => {
-        timer = setTimeout(() => resolve9(true), CONTINUE_SILENCE_MS);
+      new Promise((resolve10) => {
+        timer = setTimeout(() => resolve10(true), CONTINUE_SILENCE_MS);
       })
     ]);
   } finally {
@@ -6330,9 +6338,9 @@ var ClaudeAdapter = class {
     let stderr = "";
     const stderrTail = () => stderr.slice(-STDERR_TAIL2).trim() || "no output";
     let spoke = () => void 0;
-    const spoken = new Promise((resolve9) => spoke = resolve9);
+    const spoken = new Promise((resolve10) => spoke = resolve10);
     let finished = () => void 0;
-    const gone = new Promise((resolve9) => finished = resolve9);
+    const gone = new Promise((resolve10) => finished = resolve10);
     if (externalAuth && this.options.onHostedSession) {
       try {
         await this.options.onHostedSession(sessionId);
@@ -7033,7 +7041,7 @@ var CodexAdapter = class {
         error: externalAuth ? SUBSCRIPTION_EXECUTION_ERROR2 : `codex app-server exited (${signal ?? code}): ${child.stderrTail() || "no output"}`
       });
     });
-    const ready = (step, label) => untilReady(child, step, `codex ${label}`);
+    const ready = (step, label2) => untilReady(child, step, `codex ${label2}`);
     try {
       const initialized = await ready(
         rpc.sendRequest("initialize", {
@@ -7452,7 +7460,7 @@ var CursorAdapter = class {
         env: Object.entries(computerMcp.env).map(([name, value]) => ({ name, value }))
       }] : []
     ];
-    const ready = (step, label) => untilReady(child, step, `cursor ${label}`);
+    const ready = (step, label2) => untilReady(child, step, `cursor ${label2}`);
     try {
       await ready(
         conn.initialize({
@@ -7669,7 +7677,7 @@ var MockAdapter = class {
         if (line.hang) {
           if (!abort.signal.aborted) {
             await new Promise(
-              (resolve9) => abort.signal.addEventListener("abort", resolve9, { once: true })
+              (resolve10) => abort.signal.addEventListener("abort", resolve10, { once: true })
             );
           }
           yield { type: "exit", outcome: "cancelled" };
@@ -8593,7 +8601,11 @@ async function verifyExpectedOrigin(path, expected) {
 // src/service.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
+import { dirname as dirname9, join as join16, resolve as resolve7 } from "node:path";
 var exec = promisify2(execFile2);
+var label = "com.aspectlylabs.mikka.daemon";
 async function restartService(update, beforeRestart, dependencies = {
   manager: process.env.MIKKA_SERVICE,
   update: async () => {
@@ -8609,6 +8621,34 @@ async function restartService(update, beforeRestart, dependencies = {
   beforeRestart();
   dependencies.restart();
 }
+async function uninstallService(clearCredential, dependencies = {
+  manager: process.env.MIKKA_SERVICE,
+  home: homedir6(),
+  uid: process.getuid?.() ?? 0,
+  run: async (program, args) => {
+    await exec(program, args, { timeout: 1e4 });
+  },
+  exit: () => {
+    process.exit(0);
+  }
+}) {
+  try {
+    if (dependencies.manager === "systemd") {
+      await dependencies.run("systemctl", ["--user", "disable", "mikka-daemon.service"]);
+      await rm(join16(dependencies.home, ".config/systemd/user/mikka-daemon.service"), { force: true });
+      await dependencies.run("systemctl", ["--user", "daemon-reload"]);
+    } else if (dependencies.manager === "launchd") {
+      await rm(join16(dependencies.home, "Library/LaunchAgents", `${label}.plist`), { force: true });
+    }
+  } finally {
+    clearCredential();
+    try {
+      if (dependencies.manager === "launchd") await dependencies.run("launchctl", ["bootout", `gui/${dependencies.uid}/${label}`]);
+    } finally {
+      dependencies.exit();
+    }
+  }
+}
 
 // src/device-type.ts
 import { readdir as readdir3, readFile } from "node:fs/promises";
@@ -8765,7 +8805,7 @@ async function detectHarnesses() {
 // src/lock.ts
 import { mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync10 } from "node:fs";
 import { createConnection } from "node:net";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import lockfile from "proper-lockfile";
 var DaemonAlreadyRunningError = class extends Error {
@@ -8780,7 +8820,7 @@ var LOCK_STALE_MS = 5 * 6e4;
 var LOCK_UPDATE_MS = 3e4;
 var LOCK_TAKEOVER_MS = 6e3;
 function pidFile(dataDir) {
-  return join16(dataDir, "daemon.pid");
+  return join17(dataDir, "daemon.pid");
 }
 function holderPid(dataDir) {
   try {
@@ -8799,11 +8839,11 @@ function processAlive(pid) {
   }
 }
 function socketAnswers(socketPath) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const socket = createConnection(socketPath);
     const done = (alive) => {
       socket.destroy();
-      resolve9(alive);
+      resolve10(alive);
     };
     socket.once("connect", () => done(true));
     socket.once("error", () => done(false));
@@ -8912,7 +8952,7 @@ function closeLogger(logger) {
   const file = files.get(logger);
   if (!file) return Promise.resolve();
   files.delete(logger);
-  return new Promise((resolve9) => file.end(resolve9));
+  return new Promise((resolve10) => file.end(resolve10));
 }
 
 // src/outbox.ts
@@ -8924,7 +8964,7 @@ import {
   rmSync as rmSync11,
   truncateSync
 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var Outbox = class {
   constructor(dir, link, log, retryMs = 1e3, onUndeliverable = () => void 0, retainResources = false) {
     this.dir = dir;
@@ -8947,10 +8987,10 @@ var Outbox = class {
   /** Runs whose file was checked for a torn tail since this process started. */
   repaired = /* @__PURE__ */ new Set();
   file(runId) {
-    return join17(this.dir, `${assertSafeId("run id", runId)}.jsonl`);
+    return join18(this.dir, `${assertSafeId("run id", runId)}.jsonl`);
   }
   ackFile(runId) {
-    return join17(this.dir, `${assertSafeId("run id", runId)}.ack.json`);
+    return join18(this.dir, `${assertSafeId("run id", runId)}.ack.json`);
   }
   parse(runId) {
     let data;
@@ -9134,8 +9174,8 @@ var Outbox = class {
 };
 
 // src/quota/local-credentials.ts
-import { homedir as homedir6 } from "node:os";
-import { join as join19 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join20 } from "node:path";
 
 // src/quota/files.ts
 import { execFile as execFile3 } from "node:child_process";
@@ -9321,17 +9361,17 @@ function claudePlanLabel(credential) {
   const tier = credential.rateLimitTier?.toLowerCase() ?? "";
   const hasMax20 = tier.includes("max_20x") || tier.includes("max20x") || tier.includes("max-20x");
   const hasMax = tier.includes("max");
-  let label = "Subscription";
+  let label2 = "Subscription";
   if (subscriptionType === "team" || subscriptionType === "" && tier.includes("team")) {
-    label = hasMax ? "Team Premium" : "Team";
+    label2 = hasMax ? "Team Premium" : "Team";
   } else if (subscriptionType === "enterprise" || subscriptionType === "" && tier.includes("enterprise")) {
-    label = hasMax ? "Enterprise Premium" : "Enterprise";
+    label2 = hasMax ? "Enterprise Premium" : "Enterprise";
   } else if (subscriptionType === "max" || hasMax) {
-    label = hasMax20 ? "Max 20x" : "Max 5x";
+    label2 = hasMax20 ? "Max 20x" : "Max 5x";
   } else if (subscriptionType === "pro" || tier.includes("pro")) {
-    label = "Pro";
+    label2 = "Pro";
   }
-  return cleanText(label);
+  return cleanText(label2);
 }
 function windowFrom(kind, value, model) {
   if (!value || typeof value !== "object") return null;
@@ -9633,12 +9673,12 @@ async function readCodexQuota(options) {
 
 // src/quota/cursor.ts
 import { lstat as lstat3 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 var ENDPOINT3 = "https://cursor.com/api/usage-summary";
 var ACCESS_TOKEN_KEY = "cursorAuth/accessToken";
 function cursorDatabasePath(platform3, home) {
   if (platform3 === "darwin") {
-    return join18(
+    return join19(
       home,
       "Library",
       "Application Support",
@@ -9649,7 +9689,7 @@ function cursorDatabasePath(platform3, home) {
     );
   }
   if (platform3 === "win32") {
-    return join18(
+    return join19(
       home,
       "AppData",
       "Roaming",
@@ -9659,7 +9699,7 @@ function cursorDatabasePath(platform3, home) {
       "state.vscdb"
     );
   }
-  return join18(home, ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return join19(home, ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 var CURSOR_PLANS = {
   pro: "Pro",
@@ -9831,10 +9871,10 @@ async function readCursorQuota(options) {
 // src/quota/local-credentials.ts
 var KEYCHAIN_SERVICE = "Claude Code-credentials";
 function claudeCredentialPath(home) {
-  return join19(home, ".claude", ".credentials.json");
+  return join20(home, ".claude", ".credentials.json");
 }
 function codexAuthPath(home) {
-  return join19(home, ".codex", "auth.json");
+  return join20(home, ".codex", "auth.json");
 }
 function unknown2(vendor, observedAt) {
   return {
@@ -9853,7 +9893,7 @@ var LocalCredentialsSource = class {
   options;
   id = "local_credentials";
   async read(signal) {
-    const home = this.options.home ?? homedir6();
+    const home = this.options.home ?? homedir7();
     const platform3 = this.options.platform ?? process.platform;
     const fetchImpl = this.options.fetch ?? globalThis.fetch;
     const now = this.options.now ?? Date.now;
@@ -10029,9 +10069,9 @@ var RpcServer = class {
     const { socketPath } = this.options;
     rmSync12(socketPath, { force: true });
     const server = createServer2((socket) => this.accept(socket));
-    await new Promise((resolve9, reject) => {
+    await new Promise((resolve10, reject) => {
       server.once("error", reject);
-      server.listen(socketPath, () => resolve9());
+      server.listen(socketPath, () => resolve10());
     });
     chmodSync2(socketPath, 384);
     this.server = server;
@@ -10095,9 +10135,9 @@ var RpcServer = class {
   }
   async close() {
     for (const socket of this.sockets) socket.destroy();
-    await new Promise((resolve9) => {
-      if (!this.server) return resolve9();
-      this.server.close(() => resolve9());
+    await new Promise((resolve10) => {
+      if (!this.server) return resolve10();
+      this.server.close(() => resolve10());
     });
     this.server = null;
     rmSync12(this.options.socketPath, { force: true });
@@ -10225,7 +10265,7 @@ function createRunMasker(secrets) {
   let pending = /* @__PURE__ */ new Map();
   const text3 = (value) => {
     let out = value;
-    for (const [needle, label] of needles) if (out.includes(needle)) out = out.split(needle).join(label);
+    for (const [needle, label2] of needles) if (out.includes(needle)) out = out.split(needle).join(label2);
     return out;
   };
   const holdback = (value) => {
@@ -10323,13 +10363,13 @@ function createRunMasker(secrets) {
 
 // src/runs/supervisor.ts
 import { createHash as createHash3, randomUUID as randomUUID5 } from "node:crypto";
-import { join as join21, resolve as resolve7 } from "node:path";
+import { join as join22, resolve as resolve8 } from "node:path";
 import { execa as execa11 } from "execa";
 
 // src/agents/checkpoint.ts
 import { mkdtempSync as mkdtempSync5, rmSync as rmSync13, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "node:zlib";
 import { execa as execa10 } from "execa";
 async function headCommit(repoPath, worktree) {
@@ -10363,8 +10403,8 @@ async function takeCheckpoint(options) {
 }
 async function applyCheckpoint(options) {
   const git2 = await pinnedGit(options.repoPath, options.worktree);
-  const dir = mkdtempSync5(join20(tmpdir2(), "mikka-checkpoint-"));
-  const file = join20(dir, "checkpoint.patch");
+  const dir = mkdtempSync5(join21(tmpdir2(), "mikka-checkpoint-"));
+  const file = join21(dir, "checkpoint.patch");
   try {
     writeFileSync6(
       file,
@@ -10613,12 +10653,12 @@ var MemoryServer = class {
         this.check();
         let pending = this.pendingCommands(deviceId, skip);
         if (pending.length === 0 && waitSeconds > 0 && !signal?.aborted) {
-          await new Promise((resolve9) => {
-            const timer = setTimeout(resolve9, waitSeconds * 1e3);
-            signal?.addEventListener("abort", () => resolve9(), { once: true });
+          await new Promise((resolve10) => {
+            const timer = setTimeout(resolve10, waitSeconds * 1e3);
+            signal?.addEventListener("abort", () => resolve10(), { once: true });
             this.wakeCommands.push(() => {
               clearTimeout(timer);
-              resolve9();
+              resolve10();
             });
           });
           this.check();
@@ -11026,9 +11066,9 @@ var RunSupervisor = class {
       run2.abort.abort();
     }
     let timer;
-    const grace = new Promise((resolve9) => {
+    const grace = new Promise((resolve10) => {
       timer = setTimeout(
-        resolve9,
+        resolve10,
         this.deps.stopGraceMs ?? DEFAULT_STOP_GRACE_MS
       );
     });
@@ -11220,8 +11260,8 @@ var RunSupervisor = class {
     let timer;
     await Promise.race([
       this.deps.captures.flush(runId),
-      new Promise((resolve9) => {
-        timer = setTimeout(resolve9, 6e4);
+      new Promise((resolve10) => {
+        timer = setTimeout(resolve10, 6e4);
       })
     ]).finally(() => clearTimeout(timer));
   }
@@ -11531,7 +11571,7 @@ var RunSupervisor = class {
       mailbox
     };
     const resuming = entry.sessionId !== null && adapter.capabilities.supportsResume;
-    const inEarlierWorktree = continued !== null || entry.worktree !== null && resolve7(entry.worktree) !== resolve7(this.deps.worktrees.pathFor(runId));
+    const inEarlierWorktree = continued !== null || entry.worktree !== null && resolve8(entry.worktree) !== resolve8(this.deps.worktrees.pathFor(runId));
     const continueSession = !resuming && assignment.resumeSessionId && assignment.continuesRunId && inEarlierWorktree && adapter.capabilities.supportsResume ? {
       sessionId: assignment.resumeSessionId,
       runId: assignment.continuesRunId,
@@ -11578,7 +11618,7 @@ var RunSupervisor = class {
         if (!this.deps.adapterStateDir || assignment.harness === "mock" || !session.sessionId || resuming && session.sessionId !== entry.sessionId || assignment.requireSessionResume && session.sessionId !== assignment.resumeSessionId)
           throw new Error("Skill mount requires the actual original harness session");
         verifySkillAssignment(assignment);
-        const file = join21(
+        const file = join22(
           runPaths(this.deps.adapterStateDir, runId).runDir,
           SKILLS_DIR,
           skillSlug(assignment.skills[0].name),
@@ -11756,10 +11796,10 @@ function trackParts(open2, chunk) {
 }
 var ABORTED = /* @__PURE__ */ Symbol("aborted");
 function abortPromise(signal) {
-  return new Promise((resolve9) => {
-    if (signal.aborted) resolve9(ABORTED);
+  return new Promise((resolve10) => {
+    if (signal.aborted) resolve10(ABORTED);
     else
-      signal.addEventListener("abort", () => resolve9(ABORTED), { once: true });
+      signal.addEventListener("abort", () => resolve10(ABORTED), { once: true });
   });
 }
 function pickAgentReport(agent) {
@@ -11777,18 +11817,21 @@ function pickAgentReport(agent) {
   const question = runQuestion.safeParse(agent.question);
   if (question.success) picked.question = question.data;
   if (agent.plan) picked.plan = agent.plan;
+  if (typeof agent.previewDatabaseBranch === "string" && agent.previewDatabaseBranch.trim())
+    picked.previewDatabaseBranch = agent.previewDatabaseBranch.trim().slice(0, 500);
   if (Array.isArray(agent.criteria)) {
     const criteria = [];
     for (const entry of agent.criteria) {
       if (criteria.length >= MAX_REPORTED_CRITERIA) break;
       if (!entry || typeof entry !== "object") continue;
-      const { criterionId, passed, evidence } = entry;
+      const { criterionId, passed, evidence, command, exitCode } = entry;
       if (typeof criterionId !== "string" || !UUID_RE.test(criterionId))
         continue;
       if (typeof passed !== "boolean") continue;
       criteria.push({
         criterionId,
         passed,
+        ...typeof command === "string" && command.trim() ? { command: command.trim().slice(0, 2e3), ...exitCode === null || typeof exitCode === "number" && Number.isSafeInteger(exitCode) ? { exitCode } : {} } : {},
         ...typeof evidence === "string" ? { evidence: evidence.slice(0, 1e4) } : {}
       });
     }
@@ -11848,7 +11891,7 @@ var SessionRejectedError = class extends DaemonError {
 // src/repositories.ts
 import { createHash as createHash4, randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync4, lstatSync as lstatSync7, mkdirSync as mkdirSync13, readdirSync as readdirSync5, realpathSync as realpathSync9, renameSync as renameSync2, rmSync as rmSync14 } from "node:fs";
-import { dirname as dirname9, join as join22, resolve as resolve8 } from "node:path";
+import { dirname as dirname10, join as join23, resolve as resolve9 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 import { execa as execa12 } from "execa";
 import lockfile2 from "proper-lockfile";
@@ -11863,8 +11906,8 @@ var RepositoryCache = class {
   retainResources;
   pathFor(remoteUrl) {
     const { key: key2 } = normalizeRepository(remoteUrl, { allowFile: this.allowFile });
-    const path = resolve8(this.root, "v2", createHash4("sha256").update(key2).digest("hex"));
-    if (!isInside(resolve8(this.root), path) || path === resolve8(this.root)) throw new Error("Invalid repository cache path");
+    const path = resolve9(this.root, "v2", createHash4("sha256").update(key2).digest("hex"));
+    if (!isInside(resolve9(this.root), path) || path === resolve9(this.root)) throw new Error("Invalid repository cache path");
     return path;
   }
   /** Serialize clone/fetch against the same cache, including other processes. */
@@ -11872,7 +11915,7 @@ var RepositoryCache = class {
     signal?.throwIfAborted();
     const { remoteUrl: remote } = normalizeRepository(remoteUrl, { allowFile: this.allowFile });
     const path = this.pathFor(remote);
-    this.ensureParents(dirname9(path));
+    this.ensureParents(dirname10(path));
     const release = await this.lock(path, signal);
     try {
       signal?.throwIfAborted();
@@ -11916,28 +11959,28 @@ var RepositoryCache = class {
   paths() {
     const visit = (path) => {
       if (!existsSync4(path) || lstatSync7(path).isSymbolicLink()) return [];
-      if (existsSync4(join22(path, ".git"))) {
+      if (existsSync4(join23(path, ".git"))) {
         this.assertClone(path);
         return [path];
       }
-      return readdirSync5(path, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() && !entry.name.endsWith(".lock") && !entry.name.includes(".clone-") ? visit(join22(path, entry.name)) : []);
+      return readdirSync5(path, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() && !entry.name.endsWith(".lock") && !entry.name.includes(".clone-") ? visit(join23(path, entry.name)) : []);
     };
-    return visit(resolve8(this.root));
+    return visit(resolve9(this.root));
   }
   ensureParents(path) {
     mkdirSync13(this.root, { recursive: true, mode: 448 });
     if (lstatSync7(this.root).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
     const root = realpathSync9(this.root);
-    let current = resolve8(this.root);
+    let current = resolve9(this.root);
     for (const part of path.slice(current.length + 1).split("/").filter(Boolean)) {
-      current = join22(current, part);
+      current = join23(current, part);
       if (existsSync4(current) && lstatSync7(current).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
       mkdirSync13(current, { recursive: true, mode: 448 });
       if (!isInside(root, realpathSync9(current))) throw new Error("Repository cache escapes its directory");
     }
   }
   assertClone(path) {
-    if (lstatSync7(path).isSymbolicLink() || !lstatSync7(join22(path, ".git")).isDirectory() || lstatSync7(join22(path, ".git")).isSymbolicLink()) throw new Error("Repository cache is not a standard clone");
+    if (lstatSync7(path).isSymbolicLink() || !lstatSync7(join23(path, ".git")).isDirectory() || lstatSync7(join23(path, ".git")).isSymbolicLink()) throw new Error("Repository cache is not a standard clone");
     if (!isInside(realpathSync9(this.root), realpathSync9(path))) throw new Error("Repository cache escapes its directory");
   }
   async lock(path, signal) {
@@ -11967,17 +12010,17 @@ import {
   rmSync as rmSync15
 } from "node:fs";
 import { createRequire } from "node:module";
-import { delimiter, dirname as dirname10, join as join24 } from "node:path";
+import { delimiter, dirname as dirname11, join as join25 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { promisify as promisify4 } from "node:util";
 
 // src/agents/public-egress.ts
 import { lookup } from "node:dns/promises";
-import { chmod, mkdtemp, rm } from "node:fs/promises";
+import { chmod, mkdtemp, rm as rm2 } from "node:fs/promises";
 import { createServer as createServer3, request as httpRequest } from "node:http";
 import { connect, isIP as isIP3 } from "node:net";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 
 // ../../lib/search/url-policy.ts
 import { BlockList, isIP as isIP2 } from "node:net";
@@ -12046,9 +12089,9 @@ function endToEndHeaders(input) {
 }
 async function startPublicEgress(options) {
   options.signal.throwIfAborted();
-  const directory = await mkdtemp(join23(tmpdir3(), "mikka-egress-"));
+  const directory = await mkdtemp(join24(tmpdir3(), "mikka-egress-"));
   await chmod(directory, 448);
-  const socketPath = join23(directory, "egress.sock");
+  const socketPath = join24(directory, "egress.sock");
   const lifetime = new AbortController();
   const signal = AbortSignal.any([options.signal, lifetime.signal]);
   const sockets = /* @__PURE__ */ new Set();
@@ -12153,9 +12196,9 @@ async function startPublicEgress(options) {
     if (closing) return closing;
     lifetime.abort();
     for (const socket of sockets) socket.destroy();
-    closing = new Promise((resolve9, reject) => server.close((error) => {
+    closing = new Promise((resolve10, reject) => server.close((error) => {
       options.signal.removeEventListener("abort", onAbort);
-      void rm(directory, { recursive: true, force: true }).then(() => error && error.code !== "ERR_SERVER_NOT_RUNNING" ? reject(error) : resolve9(), reject);
+      void rm2(directory, { recursive: true, force: true }).then(() => error && error.code !== "ERR_SERVER_NOT_RUNNING" ? reject(error) : resolve10(), reject);
     }));
     return closing;
   };
@@ -12164,11 +12207,11 @@ async function startPublicEgress(options) {
   };
   options.signal.addEventListener("abort", onAbort, { once: true });
   try {
-    await new Promise((resolve9, reject) => {
+    await new Promise((resolve10, reject) => {
       server.once("error", reject);
       server.listen(socketPath, () => {
         server.removeListener("error", reject);
-        resolve9();
+        resolve10();
       });
     });
     await chmod(socketPath, 384);
@@ -12205,7 +12248,7 @@ async function createHostedBotRunner(host) {
   }).catch(() => {
     throw unavailable2();
   });
-  const resources = join24(host.stateDir, "native-resources");
+  const resources = join25(host.stateDir, "native-resources");
   mkdirSync14(resources, { recursive: true, mode: 448 });
   const removeResource = async (file, record) => {
     if (!/^mikka-native-(?:verify-)?[a-f0-9-]{36}$/.test(record.name) || !/^[a-f0-9-]{36}$/.test(record.nonce))
@@ -12226,7 +12269,7 @@ async function createHostedBotRunner(host) {
       if (record.state === "created" && /No such (?:container|object)/i.test(
         String(error.stderr)
       )) {
-        if (record.assets?.startsWith(join24(host.stateDir, "native-verify-git-")))
+        if (record.assets?.startsWith(join25(host.stateDir, "native-verify-git-")))
           rmSync15(record.assets, { recursive: true, force: true });
         rmSync15(file, { force: true });
         return;
@@ -12237,13 +12280,13 @@ async function createHostedBotRunner(host) {
     if (labels?.["com.mikka.native.resource"] !== record.nonce || record.id && record.id !== id3)
       throw unavailable2();
     await exec2("docker", ["rm", "-f", id3], { env: bareEnv, timeout: 3e4 });
-    if (record.assets?.startsWith(join24(host.stateDir, "native-verify-git-")))
+    if (record.assets?.startsWith(join25(host.stateDir, "native-verify-git-")))
       rmSync15(record.assets, { recursive: true, force: true });
     rmSync15(file, { force: true });
   };
   for (const name of readdirSync6(resources))
     if (name.endsWith(".json")) {
-      const file = join24(resources, name);
+      const file = join25(resources, name);
       const record = readJson(file);
       if (!record) throw unavailable2();
       await removeResource(file, record);
@@ -12254,8 +12297,8 @@ async function createHostedBotRunner(host) {
     const bundled = createRequire(
       require2.resolve("@anthropic-ai/claude-agent-sdk")
     );
-    claude ??= join24(
-      dirname10(
+    claude ??= join25(
+      dirname11(
         bundled.resolve(
           "@anthropic-ai/claude-agent-sdk-linux-x64/package.json"
         )
@@ -12264,7 +12307,7 @@ async function createHostedBotRunner(host) {
     );
   } catch {
   }
-  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter).map((dir) => join24(dir, "codex")).find((path) => existsSync5(path));
+  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter).map((dir) => join25(dir, "codex")).find((path) => existsSync5(path));
   const binaries = { codex, claude_code: claude };
   for (const kind of ["codex", "claude_code"])
     if (binaries[kind]) {
@@ -12278,12 +12321,12 @@ async function createHostedBotRunner(host) {
   if (!binaries.codex && !binaries.claude_code) throw unavailable2();
   const command = async (worktree, script, readOnly, timeoutMs, signal) => {
     const name = `mikka-native-verify-${randomUUID7()}`;
-    const file = join24(resources, name + ".json");
+    const file = join25(resources, name + ".json");
     const resource = { name, nonce: randomUUID7(), state: "creating" };
     const timing = { createMs: 0, runMs: 0 };
     let phase = "create";
     let began = performance.now();
-    const gitCopy = mkdtempSync6(join24(host.stateDir, "native-verify-git-"));
+    const gitCopy = mkdtempSync6(join25(host.stateDir, "native-verify-git-"));
     resource.assets = gitCopy;
     try {
       const cwd = realpathSync10(worktree);
@@ -12299,7 +12342,7 @@ async function createHostedBotRunner(host) {
           "--no-checkout",
           "--",
           cwd,
-          join24(gitCopy, "repo")
+          join25(gitCopy, "repo")
         ],
         {
           env: {
@@ -12314,8 +12357,8 @@ async function createHostedBotRunner(host) {
           maxBuffer: 1024 * 1024
         }
       );
-      const safeGit = join24(gitCopy, "repo", ".git");
-      const protectedGit = lstatSync8(join24(cwd, ".git")).isFile() ? join24(cwd, ".git") : safeGit;
+      const safeGit = join25(gitCopy, "repo", ".git");
+      const protectedGit = lstatSync8(join25(cwd, ".git")).isFile() ? join25(cwd, ".git") : safeGit;
       writeJsonAtomic(file, resource);
       const created = await exec2(
         "docker",
@@ -12419,7 +12462,7 @@ async function createHostedBotRunner(host) {
         throw unavailable2();
       const name = `mikka-native-${randomUUID7()}`;
       const nonce = randomUUID7();
-      const resourceFile = join24(resources, name + ".json");
+      const resourceFile = join25(resources, name + ".json");
       const resource = { name, nonce, state: "creating" };
       const lifetime = new AbortController();
       let closed = false;
@@ -12492,8 +12535,8 @@ async function createHostedBotRunner(host) {
         };
         const paths = runPaths(host.stateDir, assignment.runId);
         mkdirSync14(paths.runDir, { recursive: true, mode: 448 });
-        const shadow = join24(paths.runDir, "runtime-git");
-        const emptyHome = join24(paths.runDir, "git-bootstrap-home");
+        const shadow = join25(paths.runDir, "runtime-git");
+        const emptyHome = join25(paths.runDir, "git-bootstrap-home");
         mkdirSync14(emptyHome, { recursive: true, mode: 448 });
         if (!existsSync5(shadow))
           await exec2(
@@ -12524,9 +12567,9 @@ async function createHostedBotRunner(host) {
             }
           );
         await live();
-        if (!lstatSync8(shadow).isDirectory() || !lstatSync8(join24(shadow, ".git")).isDirectory() || !realpathSync10(shadow).startsWith(realpathSync10(paths.runDir) + "/"))
+        if (!lstatSync8(shadow).isDirectory() || !lstatSync8(join25(shadow, ".git")).isDirectory() || !realpathSync10(shadow).startsWith(realpathSync10(paths.runDir) + "/"))
           throw unavailable2();
-        const ledger = join24(
+        const ledger = join25(
           host.stateDir,
           "native-ledgers",
           assignment.runId + ".json"
@@ -12545,13 +12588,13 @@ async function createHostedBotRunner(host) {
         const previous = readJson(ledger);
         if (existsSync5(ledger) && (!previous || JSON.stringify(previous.scope) !== JSON.stringify(scope) || typeof previous.sessionId !== "string"))
           throw unavailable2();
-        mkdirSync14(dirname10(ledger), { recursive: true, mode: 448 });
+        mkdirSync14(dirname11(ledger), { recursive: true, mode: 448 });
         const record = async (sessionId) => {
           assertOpen();
           writeJsonAtomic(ledger, { scope, sessionId });
         };
         brokerStarting = createNativeSubscriptionBroker({
-          root: join24(host.stateDir, "native-brokers"),
+          root: join25(host.stateDir, "native-brokers"),
           revision,
           check,
           worker: {
@@ -12592,7 +12635,7 @@ async function createHostedBotRunner(host) {
         }
         const cwd = realpathSync10(options.cwd);
         const runDir = realpathSync10(paths.runDir);
-        const protectedGit = lstatSync8(join24(cwd, ".git")).isFile() ? join24(cwd, ".git") : join24(shadow, ".git");
+        const protectedGit = lstatSync8(join25(cwd, ".git")).isFile() ? join25(cwd, ".git") : join25(shadow, ".git");
         if (!lstatSync8(runDir).isDirectory() || !runDir.startsWith(realpathSync10(host.stateDir) + "/runs/")) {
           await close();
           throw unavailable2();
@@ -12645,7 +12688,7 @@ async function createHostedBotRunner(host) {
           "-v",
           `${MCP_SERVER_SCRIPT}:${MCP_SERVER_SCRIPT}:ro`,
           "-v",
-          `${join24(dirname10(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join24(dirname10(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
+          `${join25(dirname11(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join25(dirname11(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
           "-v",
           `${readyBroker.socket}:/run/mikka-native.sock:ro`,
           ...computerGrant ? [
@@ -12688,13 +12731,13 @@ async function createHostedBotRunner(host) {
         }
         const spawnHosted = (config) => {
           assertOpen();
-          const home = join24(runDir, "runtime-home");
+          const home = join25(runDir, "runtime-home");
           mkdirSync14(home, { recursive: true, mode: 448 });
           const env = {
             ...config.env,
             HOME: kind === "claude_code" ? config.env.HOME ?? home : home,
             PATH: "/usr/local/bin:/usr/bin:/bin",
-            GIT_DIR: join24(shadow, ".git"),
+            GIT_DIR: join25(shadow, ".git"),
             GIT_WORK_TREE: cwd,
             GIT_CONFIG_GLOBAL: "/dev/null",
             GIT_CONFIG_SYSTEM: "/dev/null",
@@ -12727,9 +12770,9 @@ async function createHostedBotRunner(host) {
             signal: new AbortController().signal
           });
           child.stderr?.resume();
-          const exited = new Promise((resolve9) => {
-            child.once("exit", (code, signal) => resolve9({ code, signal }));
-            child.once("error", () => resolve9({ code: null, signal: null }));
+          const exited = new Promise((resolve10) => {
+            child.once("exit", (code, signal) => resolve10({ code, signal }));
+            child.once("error", () => resolve10({ code: null, signal: null }));
           });
           return {
             process: child,
@@ -12988,9 +13031,9 @@ async function executeDriver(driver, input, display, leaseGuard, assertLive = ()
       )
     )
   );
-  const request = (method, params) => new Promise((resolve9, reject) => {
+  const request = (method, params) => new Promise((resolve10, reject) => {
     const n = ++id3;
-    pending.set(n, { resolve: resolve9, reject });
+    pending.set(n, { resolve: resolve10, reject });
     child.stdin.write(
       JSON.stringify({ jsonrpc: "2.0", id: n, method, params }) + "\n"
     );
@@ -13091,10 +13134,10 @@ var ComputerBroker = class {
         })();
       });
     });
-    await new Promise((resolve9, reject) => {
+    await new Promise((resolve10, reject) => {
       this.server.once("error", reject);
-      if (this.transport === "tcp") this.server.listen({ host: "127.0.0.1", port: 0 }, resolve9);
-      else this.server.listen(this.socketPath, resolve9);
+      if (this.transport === "tcp") this.server.listen({ host: "127.0.0.1", port: 0 }, resolve10);
+      else this.server.listen(this.socketPath, resolve10);
     });
     if (this.transport === "tcp") this.socketPath = `tcp://127.0.0.1:${this.server.address().port}`;
     else chmodSync3(this.socketPath, 384);
@@ -13125,7 +13168,7 @@ var ComputerBroker = class {
       expiresAt: this.now() + this.ttl
     };
     const digest = createHash6("sha256").update(JSON.stringify(request)).digest("hex");
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(request.id);
         signal?.removeEventListener("abort", cancel);
@@ -13142,7 +13185,7 @@ var ComputerBroker = class {
         assertLive,
         cleanup: () => signal?.removeEventListener("abort", cancel),
         request: { ...request, digest },
-        resolve: resolve9,
+        resolve: resolve10,
         reject,
         timer
       });
@@ -13219,7 +13262,7 @@ var ComputerBroker = class {
   async close() {
     this.suspend();
     for (const socket of this.sockets) socket.destroy();
-    if (this.server?.listening) await new Promise((resolve9) => this.server.close(resolve9));
+    if (this.server?.listening) await new Promise((resolve10) => this.server.close(resolve10));
   }
 };
 
@@ -13288,11 +13331,11 @@ async function pollWebComputerReviews(broker, deviceId, link, signal, intervalMs
     } catch {
     }
     if (signal.aborted) break;
-    await new Promise((resolve9) => {
+    await new Promise((resolve10) => {
       const done = () => {
         clearTimeout(timer);
         signal.removeEventListener("abort", done);
-        resolve9();
+        resolve10();
       };
       const timer = setTimeout(done, intervalMs);
       signal.addEventListener("abort", done, { once: true });
@@ -13401,7 +13444,7 @@ var Daemon = class {
     if (this.options.credential)
       this.saveDevice({ credential: this.options.credential });
     this.journal = new RunJournal(paths.journal);
-    this.captureUploader = new CaptureUploader((runId) => join25(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join25(paths.dataDir, "capture-pending"));
+    this.captureUploader = new CaptureUploader((runId) => join26(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join26(paths.dataDir, "capture-pending"));
     this.outbox = new Outbox(
       paths.outbox,
       this.options.link,
@@ -13418,7 +13461,7 @@ var Daemon = class {
     if (this.localComputerDriver && this.options.link.syncComputerReviews && this.options.link.localComputerAuthority) {
       this.localComputerBroker = new ComputerBroker({
         driver: this.localComputerDriver,
-        socketPath: join25(paths.dataDir, "local-computer.sock"),
+        socketPath: join26(paths.dataDir, "local-computer.sock"),
         transport: "tcp",
         permitted: (runId) => {
           const assignment = this.journal.get(runId)?.assignment;
@@ -13460,7 +13503,7 @@ var Daemon = class {
       };
       this.cloudComputerBroker = new ComputerBroker({
         driver,
-        socketPath: join25(paths.dataDir, "computer.sock"),
+        socketPath: join26(paths.dataDir, "computer.sock"),
         permitted: (runId) => {
           const entry = this.journal.get(runId);
           return Boolean(!this.stopped && this.registered && entry?.assignment.computer && this.supervisor?.computerRunAllowed(runId));
@@ -13729,12 +13772,12 @@ var Daemon = class {
   }
   /** Waits `ms`, or less if the daemon stops or the device registers. */
   pauseCommands(ms, signal) {
-    return new Promise((resolve9) => {
+    return new Promise((resolve10) => {
       const done = () => {
         clearTimeout(timer);
         signal.removeEventListener("abort", done);
         this.wakeCommands = null;
-        resolve9();
+        resolve10();
       };
       const timer = setTimeout(done, ms);
       signal.addEventListener("abort", done, { once: true });
@@ -13835,11 +13878,11 @@ var Daemon = class {
       return runVerify(sandbox, {
         command,
         worktree: realpathSync11(worktree),
-        tmpRoot: join25(this.paths.adapterState, "verify", runId),
+        tmpRoot: join26(this.paths.adapterState, "verify", runId),
         privateDir: paths.privateDir,
         pidFile: paths.pidFile.replace(/\.pgid$/, ".verify.pgid"),
         networkAllow: repo.networkAllow,
-        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join25(paths.runDir, "handoff.json") },
+        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join26(paths.runDir, "handoff.json") },
         timeoutMs,
         signal,
         readOnly
@@ -13961,7 +14004,7 @@ var Daemon = class {
       }
       const deviceId = this.device.deviceId;
       const quotas = this.quota?.snapshot().quotas;
-      const { leases, revoked, cloudCredential, deviceCommands } = await link.heartbeat(deviceId, {
+      const heartbeat = {
         completedDeviceCommands: this.device.completedDeviceCommands,
         failedDeviceCommands: this.device.failedDeviceCommands,
         harnesses: this.harnesses,
@@ -13969,7 +14012,8 @@ var Daemon = class {
         runs: this.supervisor.heartbeatRuns(),
         worktreeDiskBytes: await this.worktrees.diskUsage(),
         ...quotas ? { quotas } : {}
-      });
+      };
+      const { leases, revoked, cloudCredential, deviceCommands } = await link.heartbeat(deviceId, heartbeat);
       this.supervisor.renewLeases(leases);
       if (revoked) this.supervisor.revokeLeases(revoked);
       if (this.options.cloudComputer && cloudCredential && this.device.credential === credential) {
@@ -13978,6 +14022,26 @@ var Daemon = class {
         this.registered = false;
       }
       const command = deviceCommands?.[0];
+      if (command?.kind === "uninstall") {
+        this.draining = true;
+        if (this.supervisor.heartbeatRuns().length === 0) {
+          this.saveDevice({ completedDeviceCommands: [command.id], failedDeviceCommands: [] });
+          try {
+            await link.heartbeat(deviceId, { ...heartbeat, runs: [], completedDeviceCommands: [command.id], failedDeviceCommands: [] });
+          } catch {
+            this.log.warn("Could not confirm uninstall receipt");
+          }
+          setImmediate(() => {
+            void this.stop().then(() => uninstallService(() => {
+              this.saveDevice({ credential: void 0 });
+              rmSync16(this.paths.secret, { force: true });
+            })).catch(() => {
+              this.options.onDrained?.();
+            });
+          });
+        }
+        return;
+      }
       if (command && !this.device.completedDeviceCommands?.includes(command.id) && !this.device.failedDeviceCommands?.some((failure) => failure.id === command.id)) {
         if (command.kind === "redetect" || this.supervisor.heartbeatRuns().length === 0) {
           try {
@@ -14273,7 +14337,7 @@ var Daemon = class {
       if (!job || controller.signal.aborted) return;
       await runNativeCoordinatorJob(job, {
         deviceId,
-        stateDir: join25(this.paths.dataDir, "coordinator"),
+        stateDir: join26(this.paths.dataDir, "coordinator"),
         link,
         signal: controller.signal,
         sandbox,