@beeos-ai/cli 1.0.3 → 1.0.5

package/dist/index.js

@@ -1,8 +1,14 @@
-// src/index.ts
-import { Command } from "commander";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // ../core/dist/platform-adapter.js
-var _adapter = null;
 function setPlatformAdapter(adapter) {
   _adapter = adapter;
 }
@@ -12,21 +18,30 @@ function getPlatformAdapter() {
   }
   return _adapter;
 }
+var _adapter;
+var init_platform_adapter = __esm({
+  "../core/dist/platform-adapter.js"() {
+    "use strict";
+    _adapter = null;
+  }
+});
 
 // ../core/dist/progress.js
-var noopReporter = {
-  onStatus() {
-  },
-  onComplete() {
+var noopReporter;
+var init_progress = __esm({
+  "../core/dist/progress.js"() {
+    "use strict";
+    noopReporter = {
+      onStatus() {
+      },
+      onComplete() {
+      }
+    };
   }
-};
+});
 
 // ../core/dist/config.js
 import * as TOML from "smol-toml";
-var DEFAULT_API_URL = "https://api.beeos.ai";
-var DEFAULT_AGENT_GATEWAY_URL = "https://agent-gw.beeos.ai";
-var DEFAULT_DASHBOARD_URL = "https://beeos.ai";
-var DEFAULT_BRIDGE_URL = "wss://bridge-sg.beeos.ai";
 function defaultPlatformConfig() {
   return {
     api_url: DEFAULT_API_URL,
@@ -47,6 +62,30 @@ function defaultConfig() {
     device: defaultDeviceConfig()
   };
 }
+function resolveAgentGatewayUrl(cfg) {
+  const envOverride = globalThis.process?.env?.BEEOS_AGENT_GATEWAY_URL;
+  if (envOverride && envOverride.trim() !== "")
+    return envOverride.trim();
+  const configured = cfg.platform.agent_gateway_url?.trim() ?? "";
+  const apiUrl = cfg.platform.api_url?.trim() ?? "";
+  const apiIsLocal = isLocalhostUrl(apiUrl);
+  const configuredIsDefault = configured === DEFAULT_AGENT_GATEWAY_URL || configured === "";
+  if (apiIsLocal && configuredIsDefault) {
+    return "http://localhost:8083";
+  }
+  return configured || DEFAULT_AGENT_GATEWAY_URL;
+}
+function isLocalhostUrl(url) {
+  if (!url)
+    return false;
+  try {
+    const u = new URL(url);
+    const h = u.hostname;
+    return h === "localhost" || h === "127.0.0.1" || h === "0.0.0.0" || h.endsWith(".local") || h.endsWith(".localhost");
+  } catch {
+    return false;
+  }
+}
 function beeoHome() {
   const p = getPlatformAdapter();
   return p.joinPath(p.homeDir(), ".beeos");
@@ -67,23 +106,23 @@ function bindingPath() {
   const p = getPlatformAdapter();
   return p.joinPath(beeoHome(), "binding.json");
 }
-function agentDir(agentType) {
+function agentDir(agentFramework) {
   const p = getPlatformAdapter();
-  return p.joinPath(beeoHome(), "agents", agentType);
+  return p.joinPath(beeoHome(), "agents", agentFramework);
 }
-function agentHome(agentType) {
+function agentHome(agentFramework) {
   const p = getPlatformAdapter();
-  return p.joinPath(agentDir(agentType), "home");
+  return p.joinPath(agentDir(agentFramework), "home");
 }
-function pidFile(agentType) {
+function pidFile(agentFramework) {
   const p = getPlatformAdapter();
-  return p.joinPath(beeoHome(), `${agentType}.pid`);
+  return p.joinPath(beeoHome(), `${agentFramework}.pid`);
 }
 async function loadOrCreateConfig() {
   const p = getPlatformAdapter();
-  const path2 = configPath();
-  if (await p.exists(path2)) {
-    const raw = await p.readFile(path2);
+  const path9 = configPath();
+  if (await p.exists(path9)) {
+    const raw = await p.readFile(path9);
     const parsed = TOML.parse(raw);
     const cfg2 = mergeWithDefaults(parsed);
     return cfg2;
@@ -94,8 +133,8 @@ async function loadOrCreateConfig() {
 }
 async function saveConfig(cfg) {
   const p = getPlatformAdapter();
-  const path2 = configPath();
-  await p.mkdir(p.dirname(path2));
+  const path9 = configPath();
+  await p.mkdir(p.dirname(path9));
   const serializable = {
     platform: {
       api_url: cfg.platform.api_url,
@@ -109,7 +148,7 @@ async function saveConfig(cfg) {
     }
   };
   const raw = TOML.stringify(serializable);
-  await p.writeFile(path2, raw);
+  await p.writeFile(path9, raw);
 }
 function mergeWithDefaults(parsed) {
   const platform = parsed.platform ?? {};
@@ -133,23 +172,23 @@ function mergeWithDefaults(parsed) {
 }
 async function loadBindingInfo() {
   const p = getPlatformAdapter();
-  const path2 = bindingPath();
-  if (!await p.exists(path2)) {
+  const path9 = bindingPath();
+  if (!await p.exists(path9)) {
     return migratePairedToBinding();
   }
-  const raw = await p.readFile(path2);
+  const raw = await p.readFile(path9);
   return JSON.parse(raw);
 }
 async function saveBindingInfo(info) {
   const p = getPlatformAdapter();
-  const path2 = bindingPath();
-  await p.writeFile(path2, JSON.stringify(info, null, 2));
+  const path9 = bindingPath();
+  await p.writeFile(path9, JSON.stringify(info, null, 2));
 }
 async function removeBindingInfo() {
   const p = getPlatformAdapter();
-  const path2 = bindingPath();
-  if (await p.exists(path2)) {
-    await p.rm(path2);
+  const path9 = bindingPath();
+  if (await p.exists(path9)) {
+    await p.rm(path9);
   }
 }
 async function migratePairedToBinding() {
@@ -174,61 +213,84 @@ async function migratePairedToBinding() {
 }
 async function loadOrCreateGatewayToken() {
   const p = getPlatformAdapter();
-  const path2 = p.joinPath(beeoHome(), "gateway_token");
-  if (await p.exists(path2)) {
-    const token2 = (await p.readFile(path2)).trim();
+  const path9 = p.joinPath(beeoHome(), "gateway_token");
+  if (await p.exists(path9)) {
+    const token2 = (await p.readFile(path9)).trim();
     if (token2)
       return token2;
   }
   const token = crypto.randomUUID();
-  await p.mkdir(p.dirname(path2));
-  await p.writeFile(path2, token);
+  await p.mkdir(p.dirname(path9));
+  await p.writeFile(path9, token);
   if (p.platform() !== "win32") {
-    await p.chmod(path2, 384);
+    await p.chmod(path9, 384);
   }
   return token;
 }
-async function readPid(agentType) {
+async function readPid(agentFramework) {
   const p = getPlatformAdapter();
-  const path2 = pidFile(agentType);
-  if (!await p.exists(path2))
+  const path9 = pidFile(agentFramework);
+  if (!await p.exists(path9))
     return null;
-  const raw = (await p.readFile(path2)).trim();
+  const raw = (await p.readFile(path9)).trim();
   const pid = parseInt(raw, 10);
   return isNaN(pid) ? null : pid;
 }
-async function writePid(agentType, pid) {
+async function writePid(agentFramework, pid) {
   const p = getPlatformAdapter();
-  await p.writeFile(pidFile(agentType), String(pid));
+  await p.writeFile(pidFile(agentFramework), String(pid));
 }
-async function removePid(agentType) {
+async function removePid(agentFramework) {
   const p = getPlatformAdapter();
-  const path2 = pidFile(agentType);
-  if (await p.exists(path2)) {
-    await p.rm(path2);
+  const path9 = pidFile(agentFramework);
+  if (await p.exists(path9)) {
+    await p.rm(path9);
   }
 }
+var DEFAULT_API_URL, DEFAULT_AGENT_GATEWAY_URL, DEFAULT_DASHBOARD_URL, DEFAULT_BRIDGE_URL;
+var init_config = __esm({
+  "../core/dist/config.js"() {
+    "use strict";
+    init_platform_adapter();
+    DEFAULT_API_URL = "https://api.beeos.ai";
+    DEFAULT_AGENT_GATEWAY_URL = "https://agent-gw.beeos.ai";
+    DEFAULT_DASHBOARD_URL = "https://beeos.ai";
+    DEFAULT_BRIDGE_URL = "wss://bridge-sg.beeos.ai";
+  }
+});
 
 // ../core/dist/identity/keypair.js
-import { createHash } from "crypto";
 import * as ed from "@noble/ed25519";
 import { sha512 } from "@noble/hashes/sha512";
-ed.etc.sha512Sync = (...m) => sha512(ed.etc.concatBytes(...m));
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@noble/hashes/utils";
+function toBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++)
+    binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+function fromBase64(b64) {
+  const binary = atob(b64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
 function publicKeyB64(id) {
-  return Buffer.from(id.publicKey).toString("base64");
+  return toBase64(id.publicKey);
 }
 function fingerprint(id) {
-  return createHash("sha256").update(id.publicKey).digest("hex");
+  return bytesToHex(sha256(id.publicKey));
 }
 function fingerprintFromB64(pubkeyB64) {
-  const raw = Buffer.from(pubkeyB64, "base64");
-  return createHash("sha256").update(raw).digest("hex");
+  return bytesToHex(sha256(fromBase64(pubkeyB64)));
 }
 async function loadOrCreateIdentity() {
   const p = getPlatformAdapter();
-  const path2 = keypairPath();
-  if (await p.exists(path2)) {
-    return loadFromFile(path2);
+  const path9 = keypairPath();
+  if (await p.exists(path9)) {
+    return loadFromFile(path9);
   }
   const id = generate();
   await save(id);
@@ -240,8 +302,8 @@ async function ensureDeviceKey(keyPath) {
     return;
   const id = generate();
   const stored = {
-    publicKey: Buffer.from(id.publicKey).toString("base64"),
-    privateKey: Buffer.from(id.privateKey).toString("base64")
+    publicKey: toBase64(id.publicKey),
+    privateKey: toBase64(id.privateKey)
   };
   await p.mkdir(p.dirname(keyPath));
   await p.writeFile(keyPath, JSON.stringify(stored, null, 2));
@@ -265,11 +327,11 @@ function fingerprintFilePath() {
   const p = getPlatformAdapter();
   return p.joinPath(beeoHome(), "identity", "fingerprint");
 }
-async function loadFromFile(path2) {
+async function loadFromFile(path9) {
   const p = getPlatformAdapter();
-  const raw = await p.readFile(path2);
+  const raw = await p.readFile(path9);
   const stored = JSON.parse(raw);
-  const privateKey = new Uint8Array(Buffer.from(stored.privateKey, "base64"));
+  const privateKey = fromBase64(stored.privateKey);
   if (privateKey.length !== 32) {
     throw new Error(`private key seed must be 32 bytes, got ${privateKey.length}`);
   }
@@ -284,8 +346,8 @@ function generate() {
 async function save(id) {
   const p = getPlatformAdapter();
   const stored = {
-    publicKey: Buffer.from(id.publicKey).toString("base64"),
-    privateKey: Buffer.from(id.privateKey).toString("base64")
+    publicKey: toBase64(id.publicKey),
+    privateKey: toBase64(id.privateKey)
   };
   const kpPath = keypairPath();
   await p.mkdir(p.dirname(kpPath));
@@ -296,6 +358,14 @@ async function save(id) {
   const fpPath = fingerprintFilePath();
   await p.writeFile(fpPath, fingerprint(id));
 }
+var init_keypair = __esm({
+  "../core/dist/identity/keypair.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    ed.etc.sha512Sync = (...m) => sha512(ed.etc.concatBytes(...m));
+  }
+});
 
 // ../core/dist/identity/qr.js
 import QRCode from "qrcode";
@@ -347,13 +417,18 @@ async function qrToTerminal(url) {
     lines.push(blankLine);
   return lines.join("\n");
 }
+var init_qr = __esm({
+  "../core/dist/identity/qr.js"() {
+    "use strict";
+  }
+});
 
 // ../core/dist/platform/client.js
 function buildBindUrl(dashboardBaseUrl, bindId) {
   const base = dashboardBaseUrl.replace(/\/+$/, "");
   return `${base}/bind/${bindId}`;
 }
-async function agentBind(apiUrl, publicKey, fingerprint2, agentType, hostname) {
+async function agentBind(apiUrl, publicKey, fingerprint2, agentFramework, hostname) {
   const p = getPlatformAdapter();
   const url = `${apiUrl}/api/v1/agent/bind`;
   const resp = await p.fetch(url, {
@@ -362,7 +437,7 @@ async function agentBind(apiUrl, publicKey, fingerprint2, agentType, hostname) {
     body: JSON.stringify({
       public_key: publicKey,
       fingerprint: fingerprint2,
-      agent_type: agentType,
+      agent_framework: agentFramework,
       hostname
     })
   });
@@ -405,6 +480,13 @@ async function getBindStatus(apiUrl, bindId) {
   }
   return await resp.json();
 }
+var init_client = __esm({
+  "../core/dist/platform/client.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_keypair();
+  }
+});
 
 // ../core/dist/platform/npm.js
 async function fetchNpmPackageInfo(packageName) {
@@ -428,6 +510,12 @@ async function downloadTarball(url) {
   const buf = await resp.arrayBuffer();
   return new Uint8Array(buf);
 }
+var init_npm = __esm({
+  "../core/dist/platform/npm.js"() {
+    "use strict";
+    init_platform_adapter();
+  }
+});
 
 // ../core/dist/process.js
 function killProcess(pid) {
@@ -451,6 +539,12 @@ function shouldOpenBrowser() {
     return true;
   return !!(p.env("DISPLAY") || p.env("WAYLAND_DISPLAY"));
 }
+var init_process = __esm({
+  "../core/dist/process.js"() {
+    "use strict";
+    init_platform_adapter();
+  }
+});
 
 // ../core/dist/bind.js
 async function presentBindUrl(bindUrl, forceHeadless, log = console.log) {
@@ -510,10 +604,17 @@ async function printQr(url, log) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+var init_bind = __esm({
+  "../core/dist/bind.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_client();
+    init_process();
+    init_qr();
+  }
+});
 
 // ../core/dist/device-setup.js
-var MIN_PYTHON_VERSION = [3, 11];
-var RECOMMENDED_AGENT_VERSION = "0.2.7";
 function agentBinCommandAndArgs(bin) {
   if (bin.type === "executable") {
     return { cmd: bin.path, args: [] };
@@ -758,123 +859,263 @@ async function runCmd(cmd, args) {
 ${stderr}`);
   }
 }
+var MIN_PYTHON_VERSION, RECOMMENDED_AGENT_VERSION;
+var init_device_setup = __esm({
+  "../core/dist/device-setup.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    MIN_PYTHON_VERSION = [3, 11];
+    RECOMMENDED_AGENT_VERSION = "0.2.7";
+  }
+});
 
-// ../core/dist/runtime/device.js
-var deviceRuntime = {
-  agentType() {
-    return "device";
-  },
-  displayName() {
-    return "Device Agent";
-  },
-  async detect() {
+// ../core/dist/adb-setup.js
+function managedAdbPath() {
+  const p = getPlatformAdapter();
+  const exe = p.platform() === "win32" ? "adb.exe" : "adb";
+  return p.joinPath(beeoHome(), "bin", "platform-tools", exe);
+}
+async function findAdb() {
+  const p = getPlatformAdapter();
+  const override = process.env?.BEEOS_ADB_BIN;
+  if (override && await p.exists(override))
+    return override;
+  const whichCmd = p.platform() === "win32" ? "where" : "which";
+  try {
+    const result = await p.exec(whichCmd, ["adb"]);
+    if (result.code === 0 && result.stdout.trim()) {
+      return result.stdout.trim().split("\n")[0].trim();
+    }
+  } catch {
+  }
+  const managed = managedAdbPath();
+  if (await p.exists(managed))
+    return managed;
+  return null;
+}
+async function installAdb(progress) {
+  const p = getPlatformAdapter();
+  const zipName = adbZipName();
+  if (!zipName) {
+    throw new Error(`No platform-tools archive for ${p.platform()}/${process.arch}. Install 'adb' manually and set $BEEOS_ADB_BIN, or add it to PATH.`);
+  }
+  const url = `${PLATFORM_TOOLS_BASE}/${zipName}`;
+  progress.onStatus(`Downloading Android platform-tools (${zipName})...`);
+  const resp = await p.fetch(url);
+  if (!resp.ok) {
+    throw new Error(`platform-tools download failed: ${resp.status} ${resp.statusText}`);
+  }
+  const data = new Uint8Array(await resp.arrayBuffer());
+  const binDir = p.joinPath(beeoHome(), "bin");
+  await p.mkdir(binDir);
+  const tmpZip = p.joinPath(binDir, `platform-tools.download.${Date.now()}.zip`);
+  await p.writeFileBytes(tmpZip, data);
+  try {
+    progress.onStatus("Extracting platform-tools...");
+    if (p.platform() === "win32") {
+      const exec2 = await p.exec("powershell", [
+        "-NoProfile",
+        "-Command",
+        `Expand-Archive -Force -Path "${tmpZip}" -DestinationPath "${binDir}"`
+      ]);
+      if (exec2.code !== 0) {
+        throw new Error(`Expand-Archive failed: ${exec2.stderr || exec2.stdout}`.trim());
+      }
+    } else {
+      const exec2 = await p.exec("unzip", ["-o", "-q", tmpZip, "-d", binDir]);
+      if (exec2.code !== 0) {
+        throw new Error(`unzip failed: ${exec2.stderr || exec2.stdout}`.trim());
+      }
+    }
+    const adb = managedAdbPath();
+    if (!await p.exists(adb)) {
+      throw new Error(`platform-tools zip did not contain ${p.basename(adb)}`);
+    }
+    if (p.platform() !== "win32") {
+      try {
+        await p.chmod(adb, 493);
+      } catch {
+      }
+    }
+    progress.onComplete(`adb installed: ${adb}`);
+    return adb;
+  } finally {
     try {
-      const bin = await ensureDeviceAgent(noopReporter);
-      const { cmd } = agentBinCommandAndArgs(bin);
-      return { binary: cmd, version: "", home: beeoHome() };
+      await p.rm(tmpZip);
     } catch {
-      return null;
     }
-  },
-  async ensure(_version, progress) {
-    const bin = await ensureDeviceAgent(progress);
-    const { cmd } = agentBinCommandAndArgs(bin);
-    return { binary: cmd, version: "", home: beeoHome() };
-  },
-  async launch(_ctx) {
-    throw new Error("DeviceRuntime.launch() should not be called directly \u2014 use spawnForDevice() instead");
-  },
-  async isHealthy() {
-    return false;
-  },
-  async stop() {
-  },
-  async update(progress) {
-    await upgradeDeviceAgent(progress);
-  },
-  // ── Device-specific extensions ──────────────────────────
-  async ensureAgent(progress) {
-    return ensureDeviceAgent(progress);
-  },
-  async upgradeAgent(progress) {
-    return upgradeDeviceAgent(progress);
-  },
-  async listAdbDevices() {
-    const p = getPlatformAdapter();
-    const result = await p.exec("adb", ["devices"]);
-    if (result.code !== 0) {
-      throw new Error("adb not found \u2014 install Android platform-tools");
-    }
-    const devices = [];
-    const lines = result.stdout.split("\n").slice(1);
-    for (const line of lines) {
-      const parts = line.trim().split(/\s+/);
-      if (parts.length >= 2 && parts[1] === "device") {
-        devices.push({ serial: parts[0] });
-      }
-    }
-    return devices;
-  },
-  async detectSingleDevice() {
-    const devices = await this.listAdbDevices();
-    if (devices.length === 0) {
-      throw new Error("No ADB devices found. Connect a device and try again.");
-    }
-    if (devices.length > 1) {
-      const serials = devices.map((d) => d.serial).join(", ");
-      throw new Error(`Multiple ADB devices found: ${serials}. Use --serial to specify one.`);
-    }
-    return devices[0].serial;
-  },
-  async spawnForDevice(serial, agentBin, bridgeUrl, httpEnabled, httpPort) {
-    const p = getPlatformAdapter();
-    const keyFile = this.deviceKeyPath(serial);
-    await ensureDeviceKey(keyFile);
-    if (!bridgeUrl) {
-      throw new Error("bridge_url is not configured in ~/.beeos/config.toml.\nSet [platform] bridge_url (e.g. wss://bridge.beeos.ai).");
-    }
-    const { cmd, args: baseArgs } = agentBinCommandAndArgs(agentBin);
-    const args = [
-      ...baseArgs,
-      "--key",
-      keyFile,
-      "--adb",
-      serial,
-      "--bridge",
-      bridgeUrl
-    ];
-    if (httpEnabled) {
-      args.push("--http", "--http-port", String(httpPort));
-    }
-    const logDir = p.joinPath(beeoHome(), "logs");
-    await p.mkdir(logDir);
-    const logFile = p.joinPath(logDir, `device-${serial}.log`);
-    const result = await p.spawn(cmd, args, {
-      detached: true,
-      stdoutFile: logFile,
-      stderrFile: logFile
-    });
-    return result.pid;
-  },
-  deviceKeyPath(serial) {
-    const p = getPlatformAdapter();
-    return p.joinPath(beeoHome(), "identity", `device-${serial}.key.json`);
-  },
-  async ensureKeyAndGetPubkey(serial) {
-    const keyFile = this.deviceKeyPath(serial);
-    await ensureDeviceKey(keyFile);
-    return readPubkeyFromKeyFile(keyFile);
   }
-};
+}
+async function ensureAdb(progress, options = {}) {
+  const existing = await findAdb();
+  if (existing)
+    return existing;
+  if (options.autoInstall)
+    return installAdb(progress);
+  return null;
+}
+function adbZipName() {
+  const p = getPlatformAdapter();
+  switch (p.platform()) {
+    case "darwin":
+      return "platform-tools-latest-darwin.zip";
+    case "linux":
+      return "platform-tools-latest-linux.zip";
+    case "win32":
+      return "platform-tools-latest-windows.zip";
+    default:
+      return null;
+  }
+}
+var PLATFORM_TOOLS_BASE;
+var init_adb_setup = __esm({
+  "../core/dist/adb-setup.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    PLATFORM_TOOLS_BASE = "https://dl.google.com/android/repository";
+  }
+});
+
+// ../core/dist/runtime/types.js
+var init_types = __esm({
+  "../core/dist/runtime/types.js"() {
+    "use strict";
+  }
+});
+
+// ../core/dist/runtime/device.js
+var deviceRuntime;
+var init_device = __esm({
+  "../core/dist/runtime/device.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    init_keypair();
+    init_device_setup();
+    init_progress();
+    deviceRuntime = {
+      agentFramework() {
+        return "device";
+      },
+      displayName() {
+        return "Device Agent";
+      },
+      async detect() {
+        try {
+          const bin = await ensureDeviceAgent(noopReporter);
+          const { cmd } = agentBinCommandAndArgs(bin);
+          return { binary: cmd, version: "", home: beeoHome() };
+        } catch {
+          return null;
+        }
+      },
+      async ensure(_version, progress) {
+        const bin = await ensureDeviceAgent(progress);
+        const { cmd } = agentBinCommandAndArgs(bin);
+        return { binary: cmd, version: "", home: beeoHome() };
+      },
+      async launch(_ctx) {
+        throw new Error("DeviceRuntime.launch() should not be called directly \u2014 use spawnForDevice() instead");
+      },
+      async isHealthy() {
+        return false;
+      },
+      async stop() {
+      },
+      async update(progress) {
+        await upgradeDeviceAgent(progress);
+      },
+      // ── Device-specific extensions ──────────────────────────
+      async ensureAgent(progress) {
+        return ensureDeviceAgent(progress);
+      },
+      async upgradeAgent(progress) {
+        return upgradeDeviceAgent(progress);
+      },
+      async listAdbDevices() {
+        const p = getPlatformAdapter();
+        const result = await p.exec("adb", ["devices"]);
+        if (result.code !== 0) {
+          throw new Error("adb not found \u2014 install Android platform-tools");
+        }
+        const devices = [];
+        const lines = result.stdout.split("\n").slice(1);
+        for (const line of lines) {
+          const parts = line.trim().split(/\s+/);
+          if (parts.length >= 2 && parts[1] === "device") {
+            devices.push({ serial: parts[0] });
+          }
+        }
+        return devices;
+      },
+      async detectSingleDevice() {
+        const devices = await this.listAdbDevices();
+        if (devices.length === 0) {
+          throw new Error("No ADB devices found. Connect a device and try again.");
+        }
+        if (devices.length > 1) {
+          const serials = devices.map((d) => d.serial).join(", ");
+          throw new Error(`Multiple ADB devices found: ${serials}. Use --serial to specify one.`);
+        }
+        return devices[0].serial;
+      },
+      async spawnForDevice(serial, agentBin, bridgeUrl, httpEnabled, httpPort, agentGatewayUrl) {
+        const p = getPlatformAdapter();
+        const keyFile = this.deviceKeyPath(serial);
+        await ensureDeviceKey(keyFile);
+        if (!bridgeUrl) {
+          throw new Error("bridge_url is not configured in ~/.beeos/config.toml.\nSet [platform] bridge_url (e.g. wss://bridge.beeos.ai).");
+        }
+        const { cmd, args: baseArgs } = agentBinCommandAndArgs(agentBin);
+        const args = [
+          ...baseArgs,
+          "--key",
+          keyFile,
+          "--adb",
+          serial,
+          "--bridge",
+          bridgeUrl
+        ];
+        if (httpEnabled) {
+          args.push("--http", "--http-port", String(httpPort));
+        }
+        const logDir = p.joinPath(beeoHome(), "logs");
+        await p.mkdir(logDir);
+        const logFile = p.joinPath(logDir, `device-${serial}.log`);
+        const env = {};
+        if (agentGatewayUrl) {
+          env.AGENT_GATEWAY_URL = agentGatewayUrl;
+        }
+        const result = await p.spawn(cmd, args, {
+          detached: true,
+          stdoutFile: logFile,
+          stderrFile: logFile,
+          env: Object.keys(env).length > 0 ? env : void 0
+        });
+        return result.pid;
+      },
+      deviceKeyPath(serial) {
+        const p = getPlatformAdapter();
+        return p.joinPath(beeoHome(), "identity", `device-${serial}.key.json`);
+      },
+      async ensureKeyAndGetPubkey(serial) {
+        const keyFile = this.deviceKeyPath(serial);
+        await ensureDeviceKey(keyFile);
+        return readPubkeyFromKeyFile(keyFile);
+      }
+    };
+  }
+});
 
 // ../core/dist/agent/detector.js
-var GATEWAY_PORT = 18789;
 async function isGatewayRunning() {
   return getPlatformAdapter().tcpProbe("127.0.0.1", GATEWAY_PORT, 500);
 }
-async function managedBinary2(agentType) {
+async function managedBinary2(agentFramework) {
   const p = getPlatformAdapter();
-  const base = agentDir(agentType);
+  const base = agentDir(agentFramework);
   const currentLink = p.joinPath(base, "versions", "current");
   if (!await p.exists(currentLink))
     return null;
@@ -895,15 +1136,35 @@ async function managedBinary2(agentType) {
   const mjs = p.joinPath(resolved, "node_modules", "openclaw", "openclaw.mjs");
   if (await p.exists(mjs))
     return mjs;
+  const rootMjs = p.joinPath(resolved, "openclaw.mjs");
+  if (await p.exists(rootMjs))
+    return rootMjs;
+  return null;
+}
+async function readLocalPluginVersion(agentHome2) {
+  const p = getPlatformAdapter();
+  for (const rel of [
+    p.joinPath("extensions", "beeos-claw", "package.json"),
+    p.joinPath("extensions", "beeos-claw", "node_modules", "beeos-claw", "package.json")
+  ]) {
+    const fullPath = p.joinPath(agentHome2, rel);
+    try {
+      const raw = await p.readFile(fullPath);
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.version === "string")
+        return parsed.version;
+    } catch {
+    }
+  }
   return null;
 }
 async function findAgent(driver) {
-  const managed = await managedBinary2(driver.agentType());
+  const managed = await managedBinary2(driver.agentFramework());
   if (managed) {
     return {
       type: "managed",
       binary: managed,
-      home: agentHome(driver.agentType())
+      home: agentHome(driver.agentFramework())
     };
   }
   const local = await driver.detectLocal();
@@ -917,9 +1178,18 @@ async function findAgent(driver) {
   }
   return { type: "notFound" };
 }
+var GATEWAY_PORT;
+var init_detector = __esm({
+  "../core/dist/agent/detector.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    GATEWAY_PORT = 18789;
+  }
+});
 
 // ../core/dist/agent/downloader.js
-async function downloadAgent(npmPackage, requestedVersion, agentType, progress) {
+async function downloadAgent(npmPackage, requestedVersion, agentFramework, progress) {
   const p = getPlatformAdapter();
   const info = await fetchNpmPackageInfo(npmPackage);
   const version = requestedVersion ?? info["dist-tags"]["latest"];
@@ -928,7 +1198,7 @@ async function downloadAgent(npmPackage, requestedVersion, agentType, progress)
   const verInfo = info.versions[version];
   if (!verInfo)
     throw new Error(`version ${version} not found in npm registry`);
-  const versionsDir = p.joinPath(agentDir(agentType), "versions");
+  const versionsDir = p.joinPath(agentDir(agentFramework), "versions");
   const dest = p.joinPath(versionsDir, version);
   if (await p.exists(dest)) {
     progress.onStatus(`${npmPackage} v${version} already downloaded`);
@@ -954,19 +1224,28 @@ async function downloadAgent(npmPackage, requestedVersion, agentType, progress)
   }
   return dest;
 }
-async function downloadPlugin(pluginPackage, agentType, progress) {
+async function downloadPlugin(pluginPackage, agentFramework, progress, installedVersion) {
   const p = getPlatformAdapter();
   const info = await fetchNpmPackageInfo(pluginPackage);
   const version = info["dist-tags"]["latest"];
   if (!version)
     throw new Error("no 'latest' tag for plugin");
+  if (installedVersion && semverGte(installedVersion, version)) {
+    progress.onStatus(`${pluginPackage} v${installedVersion} is up to date`);
+    const cacheDir2 = p.joinPath(agentDir(agentFramework), "beeos-claw");
+    const existing = p.joinPath(cacheDir2, version);
+    if (await p.exists(existing))
+      return existing;
+  }
   const verInfo = info.versions[version];
   if (!verInfo)
     throw new Error("plugin version not found");
-  const cacheDir = p.joinPath(agentDir(agentType), "beeos-claw");
+  const cacheDir = p.joinPath(agentDir(agentFramework), "beeos-claw");
   const dest = p.joinPath(cacheDir, version);
-  if (await p.exists(dest))
+  if (await p.exists(dest)) {
+    progress.onStatus(`${pluginPackage} v${version} already cached`);
     return dest;
+  }
   progress.onStatus(`Downloading ${pluginPackage} v${version} ...`);
   const data = await downloadTarball(verInfo.dist.tarball);
   await extractTarball(data, dest);
@@ -974,6 +1253,7 @@ async function downloadPlugin(pluginPackage, agentType, progress) {
   if (await p.exists(pkgJson)) {
     await runNpmInstall(dest);
   }
+  progress.onComplete(`${pluginPackage} v${version} ready`);
   return dest;
 }
 async function extractTarball(data, dest) {
@@ -1004,10 +1284,30 @@ async function runNpmInstall(dir) {
     throw new Error(`npm install failed with exit code ${result.code}`);
   }
 }
+function semverGte(version, minVersion) {
+  const parse2 = (s) => s.split(".").map((p) => parseInt(p, 10) || 0);
+  const a = parse2(version);
+  const b = parse2(minVersion);
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) > (b[i] ?? 0))
+      return true;
+    if ((a[i] ?? 0) < (b[i] ?? 0))
+      return false;
+  }
+  return true;
+}
+var init_downloader = __esm({
+  "../core/dist/agent/downloader.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    init_npm();
+  }
+});
 
 // ../core/dist/agent/launcher.js
-import { createHash as createHash2 } from "crypto";
-var MAX_BACKUPS = 5;
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { bytesToHex as bytesToHex2 } from "@noble/hashes/utils";
 async function backupOpenclawConfig(agentHome2) {
   const p = getPlatformAdapter();
   const configPath2 = p.joinPath(agentHome2, "openclaw.json");
@@ -1071,12 +1371,12 @@ async function generateOpenclawConfig(ctx) {
   const env = { OPENCLAW_HOME: ctx.agentHome };
   const setupResult = await p.exec(ctx.agentBinary, ["setup", "--non-interactive", "--mode", "local"], { env });
   if (setupResult.code === 0) {
-    for (const [path2, value] of [
+    for (const [path9, value] of [
       ["gateway.auth.token", ctx.gatewayToken],
       ["gateway.remote.token", ctx.gatewayToken],
       ["gateway.bind", "lan"]
     ]) {
-      await runConfigSet(ctx.agentBinary, ctx.agentHome, path2, value, false, false);
+      await runConfigSet(ctx.agentBinary, ctx.agentHome, path9, value, false, false);
     }
     await configurePluginViaCli(ctx);
   } else {
@@ -1107,9 +1407,9 @@ async function generateConfigFallback(ctx) {
   await p.writeFile(configPath2, JSON.stringify(config, null, 2));
   await writePairedJson(ctx.agentHome, ctx.keyFile);
 }
-async function runConfigSet(bin, home, path2, value, json, isSystemHome) {
+async function runConfigSet(bin, home, path9, value, json, isSystemHome) {
   const p = getPlatformAdapter();
-  const args = ["config", "set", path2, value];
+  const args = ["config", "set", path9, value];
   if (json)
     args.push("--json");
   const env = {};
@@ -1117,7 +1417,7 @@ async function runConfigSet(bin, home, path2, value, json, isSystemHome) {
     env.OPENCLAW_HOME = home;
   const result = await p.exec(bin, args, { env });
   if (result.code !== 0) {
-    throw new Error(`\`openclaw config set ${path2}\` exited with ${result.code}`);
+    throw new Error(`\`openclaw config set ${path9}\` exited with ${result.code}`);
   }
 }
 async function restartGatewayViaCli(ctx) {
@@ -1152,6 +1452,28 @@ async function spawnOpenclaw(ctx) {
   });
   return result.pid;
 }
+async function installPluginToHome(agentHome2, pluginDir) {
+  const p = getPlatformAdapter();
+  const dest = p.joinPath(agentHome2, "extensions", "beeos-claw");
+  if (await p.exists(dest)) {
+    await p.rmdir(dest);
+  }
+  await copyDirRecursive(pluginDir, dest);
+}
+async function copyDirRecursive(src, dst) {
+  const p = getPlatformAdapter();
+  await p.mkdir(dst);
+  const entries = await p.readdir(src);
+  for (const name of entries) {
+    const srcPath = p.joinPath(src, name);
+    const dstPath = p.joinPath(dst, name);
+    if (await p.isDirectory(srcPath)) {
+      await copyDirRecursive(srcPath, dstPath);
+    } else {
+      await p.copyFile(srcPath, dstPath);
+    }
+  }
+}
 async function writePairedJson(home, keyFile) {
   const p = getPlatformAdapter();
   const devicesDir = p.joinPath(home, "devices");
@@ -1167,8 +1489,11 @@ async function writePairedJson(home, keyFile) {
   }
   let deviceId = "beeos-claw-device";
   if (pubKeyB64) {
-    const decoded = Buffer.from(pubKeyB64, "base64");
-    const hash = createHash2("sha256").update(decoded).digest("hex");
+    const binary = atob(pubKeyB64);
+    const decoded = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+      decoded[i] = binary.charCodeAt(i);
+    const hash = bytesToHex2(sha2562(decoded));
     deviceId = `beeos-claw-${hash.slice(0, 12)}`;
   }
   const paired = {
@@ -1185,157 +1510,2598 @@ async function writePairedJson(home, keyFile) {
   const pairedPath = p.joinPath(devicesDir, "paired.json");
   await p.writeFile(pairedPath, JSON.stringify(paired, null, 2));
 }
+var MAX_BACKUPS;
+var init_launcher = __esm({
+  "../core/dist/agent/launcher.js"() {
+    "use strict";
+    init_platform_adapter();
+    MAX_BACKUPS = 5;
+  }
+});
 
 // ../core/dist/agent/registry.js
-var openClawDriver = {
-  agentType() {
-    return "openclaw";
-  },
-  npmPackage() {
-    return "openclaw";
-  },
-  pluginPackage() {
-    return "beeos-claw";
-  },
-  async detectLocal() {
-    const p = getPlatformAdapter();
-    const cmd = p.platform() === "win32" ? "where" : "which";
-    let binary;
-    try {
-      const result = await p.exec(cmd, ["openclaw"]);
-      if (result.code !== 0)
-        return null;
-      binary = result.stdout.trim().split("\n")[0].trim();
-    } catch {
-      return null;
-    }
-    let version = "";
-    try {
-      const verResult = await p.exec(binary, ["--version"]);
-      version = verResult.stdout.trim();
-    } catch {
-    }
-    const homeDir = p.joinPath(p.homeDir(), ".openclaw");
-    return { binary, version, homeDir };
+var openClawDriver;
+var init_registry = __esm({
+  "../core/dist/agent/registry.js"() {
+    "use strict";
+    init_platform_adapter();
+    openClawDriver = {
+      agentFramework() {
+        return "openclaw";
+      },
+      npmPackage() {
+        return "openclaw";
+      },
+      pluginPackage() {
+        return "beeos-claw";
+      },
+      async detectLocal() {
+        const p = getPlatformAdapter();
+        const cmd = p.platform() === "win32" ? "where" : "which";
+        let binary;
+        try {
+          const result = await p.exec(cmd, ["openclaw"]);
+          if (result.code !== 0)
+            return null;
+          binary = result.stdout.trim().split("\n")[0].trim();
+        } catch {
+          return null;
+        }
+        let version = "";
+        try {
+          const verResult = await p.exec(binary, ["--version"]);
+          version = verResult.stdout.trim();
+        } catch {
+        }
+        const homeDir = p.joinPath(p.homeDir(), ".openclaw");
+        return { binary, version, homeDir };
+      }
+    };
   }
-};
+});
 
 // ../core/dist/runtime/openclaw.js
-var GATEWAY_PORT2 = 18789;
-var openclawRuntime = {
-  agentType() {
-    return "openclaw";
-  },
-  displayName() {
-    return "OpenClaw";
-  },
-  async detect() {
-    const location = await findAgent(openClawDriver);
-    if (location.type === "notFound")
-      return null;
-    return {
-      binary: location.binary,
-      version: location.type === "system" ? location.version : "",
-      home: location.home
+var GATEWAY_PORT2, openclawRuntime;
+var init_openclaw = __esm({
+  "../core/dist/runtime/openclaw.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    init_process();
+    init_detector();
+    init_downloader();
+    init_launcher();
+    init_registry();
+    GATEWAY_PORT2 = 18789;
+    openclawRuntime = {
+      agentFramework() {
+        return "openclaw";
+      },
+      displayName() {
+        return "OpenClaw";
+      },
+      async detect() {
+        const location = await findAgent(openClawDriver);
+        if (location.type === "notFound")
+          return null;
+        return {
+          binary: location.binary,
+          version: location.type === "system" ? location.version : "",
+          home: location.home
+        };
+      },
+      async ensure(version, progress) {
+        const location = await findAgent(openClawDriver);
+        if (location.type === "managed") {
+          return { binary: location.binary, version: "", home: location.home };
+        }
+        if (location.type === "system") {
+          return { binary: location.binary, version: location.version, home: location.home };
+        }
+        const dest = await downloadAgent(openClawDriver.npmPackage(), version ?? void 0, "openclaw", progress);
+        const home = agentHome("openclaw");
+        await getPlatformAdapter().mkdir(home);
+        await downloadPlugin(openClawDriver.pluginPackage(), "openclaw", progress);
+        return { binary: dest, version: "", home };
+      },
+      async launch(ctx) {
+        return spawnOpenclaw(ctx);
+      },
+      async isHealthy() {
+        return getPlatformAdapter().tcpProbe("127.0.0.1", GATEWAY_PORT2, 500);
+      },
+      async stop(agentFramework) {
+        const pid = await readPid(agentFramework);
+        if (pid != null) {
+          killProcess(pid);
+          await removePid(agentFramework);
+        }
+      },
+      async update(progress) {
+        await downloadAgent(openClawDriver.npmPackage(), void 0, "openclaw", progress);
+        await downloadPlugin(openClawDriver.pluginPackage(), "openclaw", progress);
+      }
     };
-  },
-  async ensure(version, progress) {
-    const location = await findAgent(openClawDriver);
-    if (location.type === "managed") {
-      return { binary: location.binary, version: "", home: location.home };
-    }
-    if (location.type === "system") {
-      return { binary: location.binary, version: location.version, home: location.home };
-    }
-    const dest = await downloadAgent(openClawDriver.npmPackage(), version ?? void 0, "openclaw", progress);
-    const home = agentHome("openclaw");
-    await getPlatformAdapter().mkdir(home);
-    await downloadPlugin(openClawDriver.pluginPackage(), "openclaw", progress);
-    return { binary: dest, version: "", home };
-  },
-  async launch(ctx) {
-    return spawnOpenclaw(ctx);
-  },
-  async isHealthy() {
-    return getPlatformAdapter().tcpProbe("127.0.0.1", GATEWAY_PORT2, 500);
-  },
-  async stop(agentType) {
-    const pid = await readPid(agentType);
-    if (pid != null) {
-      killProcess(pid);
-      await removePid(agentType);
-    }
-  },
-  async update(progress) {
-    await downloadAgent(openClawDriver.npmPackage(), void 0, "openclaw", progress);
-    await downloadPlugin(openClawDriver.pluginPackage(), "openclaw", progress);
   }
-};
+});
 
-// src/node-adapter.ts
-import {
-  execFile,
-  spawn as nodeSpawn
-} from "child_process";
-import fs from "fs";
-import fsp from "fs/promises";
-import net from "net";
-import os from "os";
-import path from "path";
-var NodePlatformAdapter = class {
-  // ── Filesystem ──────────────────────────────────────────
-  async readFile(filePath) {
-    return fsp.readFile(filePath, "utf-8");
+// ../core/dist/sidecars/cargo-dist.js
+import { createHash } from "crypto";
+function managedBinaryPath(cfg) {
+  const p = getPlatformAdapter();
+  const name = p.platform() === "win32" ? `${cfg.name}.exe` : cfg.name;
+  return p.joinPath(beeoHome(), "bin", name);
+}
+async function findSidecarBinary(cfg) {
+  const p = getPlatformAdapter();
+  const override = process.env?.[cfg.binaryEnv];
+  if (override && await p.exists(override))
+    return override;
+  const whichCmd = p.platform() === "win32" ? "where" : "which";
+  try {
+    const result = await p.exec(whichCmd, [cfg.name]);
+    if (result.code === 0 && result.stdout.trim()) {
+      return result.stdout.trim().split("\n")[0].trim();
+    }
+  } catch {
   }
-  async readFileBytes(filePath) {
-    const buf = await fsp.readFile(filePath);
-    return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+  const managed = managedBinaryPath(cfg);
+  if (await p.exists(managed))
+    return managed;
+  return null;
+}
+async function ensureSidecarInstalled(cfg, progress) {
+  const existing = await findSidecarBinary(cfg);
+  if (existing) {
+    progress.onStatus(`${cfg.name} found: ${existing}`);
+    return existing;
   }
-  async writeFile(filePath, content) {
-    await fsp.writeFile(filePath, content, "utf-8");
+  const target = cargoDistTarget();
+  if (!target) {
+    reportUnsupportedTarget(cfg, progress);
+    return null;
   }
-  async writeFileBytes(filePath, content) {
-    await fsp.writeFile(filePath, content);
+  return downloadManagedBinary(cfg, target, progress);
+}
+async function upgradeSidecar(cfg, progress) {
+  const target = cargoDistTarget();
+  if (!target) {
+    reportUnsupportedTarget(cfg, progress);
+    throw new Error(`No prebuilt ${cfg.name} archive available for ${platformKey()}. See the log above for fallback options.`);
   }
-  async exists(filePath) {
+  const p = getPlatformAdapter();
+  const managed = managedBinaryPath(cfg);
+  if (await p.exists(managed)) {
     try {
-      await fsp.access(filePath);
-      return true;
+      await p.rm(managed);
     } catch {
-      return false;
     }
   }
-  async mkdir(dirPath) {
-    await fsp.mkdir(dirPath, { recursive: true });
+  const installed = await downloadManagedBinary(cfg, target, progress);
+  if (!installed) {
+    throw new Error(`${cfg.name} upgrade failed`);
   }
-  async rm(filePath) {
-    await fsp.rm(filePath, { force: true });
+  return installed;
+}
+function cargoDistTarget() {
+  const p = getPlatformAdapter();
+  const plat = p.platform();
+  const arch = process.arch;
+  switch (plat) {
+    case "darwin":
+      if (arch === "arm64")
+        return "aarch64-apple-darwin";
+      if (arch === "x64")
+        return "x86_64-apple-darwin";
+      return null;
+    case "linux":
+      if (arch === "arm64")
+        return "aarch64-unknown-linux-gnu";
+      if (arch === "x64")
+        return "x86_64-unknown-linux-gnu";
+      return null;
+    case "win32":
+      if (arch === "x64")
+        return "x86_64-pc-windows-msvc";
+      return null;
+    default:
+      return null;
   }
-  async rmdir(dirPath) {
-    await fsp.rm(dirPath, { recursive: true, force: true });
+}
+function platformKey() {
+  const p = getPlatformAdapter();
+  return `${p.platform()}/${process.arch}`;
+}
+function reportUnsupportedTarget(cfg, progress) {
+  const repoHint = cfg.defaultReleaseUrl.replace(/\/releases\/(latest\/download|download\/[^/]+).*$/, "");
+  const lines = [
+    `${cfg.name}: no prebuilt archive for ${platformKey()}.`,
+    `Supported targets: darwin arm64/x64, linux arm64/x64, windows x64.`,
+    `Fallbacks:`,
+    `  1. Build from source and put the binary on PATH (see ${repoHint || cfg.defaultReleaseUrl}).`,
+    `  2. Copy an existing binary to ~/.beeos/bin/${cfg.name}${process.platform === "win32" ? ".exe" : ""}.`,
+    `  3. Point $${cfg.binaryEnv} at an absolute path to skip discovery entirely.`
+  ];
+  if (cfg.releaseUrlEnv) {
+    lines.push(`  4. Set $${cfg.releaseUrlEnv} to a custom release URL (e.g. an internal mirror).`);
+  }
+  for (const line of lines)
+    progress.onStatus(line);
+}
+function releaseBaseUrl(cfg) {
+  if (cfg.releaseUrlEnv) {
+    const v = process.env?.[cfg.releaseUrlEnv];
+    if (v)
+      return v;
   }
-  async readdir(dirPath) {
-    return fsp.readdir(dirPath);
+  return cfg.defaultReleaseUrl;
+}
+function archiveName(cfg, target) {
+  const suffix = target.includes("windows") ? "zip" : "tar.gz";
+  return `${cfg.name}-${target}.${suffix}`;
+}
+async function downloadManagedBinary(cfg, target, progress) {
+  const p = getPlatformAdapter();
+  const base = releaseBaseUrl(cfg);
+  const url = `${base}/${archiveName(cfg, target)}`;
+  progress.onStatus(`Downloading ${cfg.name} (${target})...`);
+  let resp;
+  try {
+    resp = await p.fetch(url);
+  } catch (e) {
+    progress.onStatus(`${cfg.name} download failed: ${String(e)}`);
+    return null;
   }
-  async chmod(filePath, mode) {
-    if (process.platform !== "win32") {
-      await fsp.chmod(filePath, mode);
+  if (!resp.ok) {
+    progress.onStatus(`${cfg.name} download: ${resp.status} ${resp.statusText} (${url})`);
+    if (resp.status === 404) {
+      progress.onStatus(`Hint: the current release may not include ${target}. Try setting $${cfg.binaryEnv} to a locally built binary, ` + (cfg.releaseUrlEnv ? `or $${cfg.releaseUrlEnv} to a different release URL.` : `or check for a newer release.`));
     }
+    return null;
   }
-  async symlink(target, linkPath) {
-    try {
-      await fsp.symlink(target, linkPath);
-    } catch (e) {
-      if (process.platform === "win32") {
-        await fsp.symlink(target, linkPath, "junction");
-      } else {
-        throw e;
-      }
+  const data = new Uint8Array(await resp.arrayBuffer());
+  const digestUrl = `${url}.sha256`;
+  let expected = null;
+  try {
+    const digResp = await p.fetch(digestUrl);
+    if (digResp.ok) {
+      const text = (await digResp.text()).trim();
+      const first = text.split(/\s+/)[0] ?? "";
+      if (/^[a-f0-9]{64}$/i.test(first))
+        expected = first.toLowerCase();
     }
+  } catch {
+  }
+  if (expected) {
+    const actual = createHash("sha256").update(data).digest("hex");
+    if (actual !== expected) {
+      progress.onStatus(`${cfg.name} checksum mismatch (expected ${expected.slice(0, 12)}\u2026, got ${actual.slice(0, 12)}\u2026) \u2014 aborting install.`);
+      return null;
+    }
+    progress.onStatus(`${cfg.name} checksum ok (${expected.slice(0, 12)}\u2026).`);
+  } else {
+    progress.onStatus(`${cfg.name}: no .sha256 sidecar at ${digestUrl} \u2014 continuing without integrity check`);
+  }
+  const binDir = p.joinPath(beeoHome(), "bin");
+  await p.mkdir(binDir);
+  const finalPath = managedBinaryPath(cfg);
+  const isZip = target.includes("windows");
+  const tmpArchive = p.joinPath(binDir, `${cfg.name}.download.${Date.now()}.${isZip ? "zip" : "tar.gz"}`);
+  await p.writeFileBytes(tmpArchive, data);
+  try {
+    progress.onStatus(`Extracting ${cfg.name}...`);
+    if (isZip) {
+      const exec2 = await p.exec("powershell", [
+        "-NoProfile",
+        "-Command",
+        `Expand-Archive -Force -Path "${tmpArchive}" -DestinationPath "${binDir}"`
+      ]);
+      if (exec2.code !== 0) {
+        throw new Error(`Expand-Archive failed: ${exec2.stderr || exec2.stdout}`.trim());
+      }
+    } else {
+      try {
+        const tar = await import("tar");
+        await tar.extract({ file: tmpArchive, cwd: binDir, strip: 1 });
+      } catch {
+        const exec2 = await p.exec("tar", [
+          "-xzf",
+          tmpArchive,
+          "--strip-components=1",
+          "-C",
+          binDir
+        ]);
+        if (exec2.code !== 0) {
+          throw new Error(`tar extract failed: ${exec2.stderr}`.trim());
+        }
+      }
+    }
+    if (!await p.exists(finalPath)) {
+      throw new Error(`extracted archive did not contain ${p.basename(finalPath)}`);
+    }
+    if (p.platform() !== "win32") {
+      try {
+        await p.chmod(finalPath, 493);
+      } catch {
+      }
+    }
+    if (p.platform() === "darwin") {
+      try {
+        await p.exec("xattr", ["-d", "com.apple.quarantine", finalPath]);
+      } catch {
+      }
+    }
+    progress.onComplete(`${cfg.name} installed: ${finalPath}`);
+    return finalPath;
+  } catch (e) {
+    progress.onStatus(`${cfg.name} install failed: ${String(e)}`);
+    return null;
+  } finally {
+    try {
+      await p.rm(tmpArchive);
+    } catch {
+    }
+  }
+}
+var init_cargo_dist = __esm({
+  "../core/dist/sidecars/cargo-dist.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+  }
+});
+
+// ../core/dist/runtime/scrcpy-bridge.js
+var CONFIG, scrcpyBridgeRuntime;
+var init_scrcpy_bridge = __esm({
+  "../core/dist/runtime/scrcpy-bridge.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    init_cargo_dist();
+    CONFIG = {
+      name: "scrcpy-bridge",
+      defaultReleaseUrl: "https://github.com/beeos-ai/scrcpy-bridge/releases/latest/download",
+      releaseUrlEnv: "BEEOS_SCRCPY_BRIDGE_RELEASE_URL",
+      binaryEnv: "BEEOS_SCRCPY_BRIDGE_BIN"
+    };
+    scrcpyBridgeRuntime = {
+      async findBinary() {
+        return findSidecarBinary(CONFIG);
+      },
+      async ensureInstalled(progress) {
+        return ensureSidecarInstalled(CONFIG, progress);
+      },
+      async upgrade(progress) {
+        return upgradeSidecar(CONFIG, progress);
+      },
+      /**
+       * Build the environment map used when launching scrcpy-bridge for a
+       * device. Exposed separately so the supervisor target-spec builder
+       * can reuse the same logic without duplicating it.
+       *
+       * scrcpy-bridge authenticates to EMQX exclusively via Agent Gateway
+       * bootstrap. `MQTT_URL` / `MQTT_TOKEN` / `MQTT_USERNAME` are
+       * intentionally NOT forwarded — the binary rejects a static token
+       * path because a Runtime-issued 10-minute JWT would silently expire
+       * and `rumqttc` reuses the initial password on reconnect.
+       */
+      buildEnv(opts) {
+        return {
+          DEVICE_ID: opts.deviceId,
+          ADB_SERIAL: opts.adbSerial,
+          AGENT_GATEWAY_URL: opts.agentGatewayUrl,
+          BRIDGE_PRIVATE_KEY_FILE: opts.bridgePrivateKeyFile,
+          BRIDGE_PUBLIC_KEY_FILE: opts.bridgePublicKeyFile,
+          LOG_FORMAT: "json",
+          ...opts.jwtRefreshLeadSecs != null ? { JWT_REFRESH_LEAD_SECS: String(opts.jwtRefreshLeadSecs) } : {},
+          ...opts.jwtRefreshMinIntervalSecs != null ? { JWT_REFRESH_MIN_INTERVAL_SECS: String(opts.jwtRefreshMinIntervalSecs) } : {},
+          ...opts.videoBitrateKbps ? { VIDEO_BITRATE_KBPS: String(opts.videoBitrateKbps) } : {},
+          ...opts.maxFps ? { MAX_FPS: String(opts.maxFps) } : {},
+          ...opts.iceUrls?.length ? { ICE_URLS: opts.iceUrls.join(",") } : {},
+          ...opts.turnUrls?.length ? { TURN_URLS: opts.turnUrls.join(",") } : {},
+          ...opts.turnUsername ? { TURN_USERNAME: opts.turnUsername } : {},
+          ...opts.turnCredential ? { TURN_CREDENTIAL: opts.turnCredential } : {},
+          ...opts.extraEnv ?? {}
+        };
+      },
+      /**
+       * Spawn scrcpy-bridge detached for a single device. Kept for callers
+       * that haven't migrated to the supervisor yet — new code should use
+       * `buildScrcpyBridgeTargetSpec` + supervisor `upsertTarget` instead.
+       */
+      async spawnForDevice(opts, progress) {
+        const binary = await this.ensureInstalled(progress);
+        if (!binary) {
+          progress.onStatus("scrcpy-bridge not installed \u2014 falling back to Python video path.");
+          return null;
+        }
+        const p = getPlatformAdapter();
+        const logDir = p.joinPath(beeoHome(), "logs");
+        await p.mkdir(logDir);
+        const logFile = p.joinPath(logDir, `scrcpy-bridge-${opts.deviceId}.log`);
+        const env = this.buildEnv(opts);
+        const result = await p.spawn(binary, [], {
+          detached: true,
+          env,
+          stdoutFile: logFile,
+          stderrFile: logFile
+        });
+        return { binary, pid: result.pid, logFile };
+      }
+    };
+  }
+});
+
+// ../core/dist/runtime/vnc-bridge.js
+var CONFIG2, vncBridgeRuntime;
+var init_vnc_bridge = __esm({
+  "../core/dist/runtime/vnc-bridge.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    init_cargo_dist();
+    CONFIG2 = {
+      name: "vnc-bridge",
+      defaultReleaseUrl: "https://github.com/beeos-ai/vnc-bridge/releases/latest/download",
+      releaseUrlEnv: "BEEOS_VNC_BRIDGE_RELEASE_URL",
+      binaryEnv: "BEEOS_VNC_BRIDGE_BIN"
+    };
+    vncBridgeRuntime = {
+      async findBinary() {
+        return findSidecarBinary(CONFIG2);
+      },
+      async ensureInstalled(progress) {
+        return ensureSidecarInstalled(CONFIG2, progress);
+      },
+      async upgrade(progress) {
+        return upgradeSidecar(CONFIG2, progress);
+      },
+      /**
+       * Build the environment map used when launching vnc-bridge for a
+       * device. Exposed separately so the supervisor target-spec builder
+       * can reuse the same logic without duplicating it.
+       */
+      buildEnv(opts) {
+        return {
+          DEVICE_ID: opts.deviceId,
+          VNC_HOST: opts.vncHost,
+          VNC_PORT: String(opts.vncPort ?? 5900),
+          AGENT_GATEWAY_URL: opts.agentGatewayUrl,
+          BRIDGE_PRIVATE_KEY_FILE: opts.bridgePrivateKeyFile,
+          BRIDGE_PUBLIC_KEY_FILE: opts.bridgePublicKeyFile,
+          LOG_FORMAT: "json",
+          ...opts.vncPassword ? { VNC_PASSWORD: opts.vncPassword } : {},
+          ...opts.jwtRefreshLeadSecs != null ? { JWT_REFRESH_LEAD_SECS: String(opts.jwtRefreshLeadSecs) } : {},
+          ...opts.jwtRefreshMinIntervalSecs != null ? { JWT_REFRESH_MIN_INTERVAL_SECS: String(opts.jwtRefreshMinIntervalSecs) } : {},
+          ...opts.videoBitrateKbps ? { VIDEO_BITRATE_KBPS: String(opts.videoBitrateKbps) } : {},
+          ...opts.maxFps ? { MAX_FPS: String(opts.maxFps) } : {},
+          ...opts.iceUrls?.length ? { ICE_URLS: opts.iceUrls.join(",") } : {},
+          ...opts.turnUrls?.length ? { TURN_URLS: opts.turnUrls.join(",") } : {},
+          ...opts.turnUsername ? { TURN_USERNAME: opts.turnUsername } : {},
+          ...opts.turnCredential ? { TURN_CREDENTIAL: opts.turnCredential } : {},
+          ...opts.extraEnv ?? {}
+        };
+      },
+      /**
+       * Spawn vnc-bridge detached for a single device. Kept for callers
+       * that haven't migrated to the supervisor yet — new code should use
+       * `buildVncBridgeTargetSpec` + supervisor `upsertTarget` instead.
+       */
+      async spawnForDevice(opts, progress) {
+        const binary = await this.ensureInstalled(progress);
+        if (!binary) {
+          progress.onStatus("vnc-bridge not installed \u2014 VNC streaming disabled for this device.");
+          return null;
+        }
+        const p = getPlatformAdapter();
+        const logDir = p.joinPath(beeoHome(), "logs");
+        await p.mkdir(logDir);
+        const logFile = p.joinPath(logDir, `vnc-bridge-${opts.deviceId}.log`);
+        const env = this.buildEnv(opts);
+        const result = await p.spawn(binary, [], {
+          detached: true,
+          env,
+          stdoutFile: logFile,
+          stderrFile: logFile
+        });
+        return { binary, pid: result.pid, logFile };
+      }
+    };
+  }
+});
+
+// ../core/dist/service/local-agent.js
+async function ensurePlugin(agentFramework, agentHomeDir, progress) {
+  const currentVersion = await readLocalPluginVersion(agentHomeDir) ?? void 0;
+  const pluginDir = await downloadPlugin(openClawDriver.pluginPackage(), agentFramework, progress, currentVersion);
+  await installPluginToHome(agentHomeDir, pluginDir);
+}
+async function bind(options) {
+  const resp = await agentBind(options.apiUrl, options.publicKey, options.fingerprint, options.agentFramework, options.hostname);
+  if (resp.status === "bound") {
+    const instanceId = resp.instance_id ?? "";
+    await saveBindingInfo({
+      fingerprint: options.fingerprint,
+      instance_id: instanceId,
+      bound_at: Math.floor(Date.now() / 1e3)
+    });
+    return { status: "bound", instanceId };
+  }
+  if (resp.status === "pending") {
+    const bindId = resp.bind_id ?? "";
+    const bindUrl = buildBindUrl(options.dashboardBaseUrl, bindId);
+    await removeBindingInfo();
+    if (options.confirmFn) {
+      const instanceId2 = await options.confirmFn(bindId);
+      await saveBindingInfo({
+        fingerprint: options.fingerprint,
+        instance_id: instanceId2,
+        bound_at: Math.floor(Date.now() / 1e3)
+      });
+      return { status: "bound", instanceId: instanceId2 };
+    }
+    await presentBindUrl(bindUrl, options.headless ?? false);
+    const instanceId = await pollUntilBound(options.apiUrl, bindId, 6e5);
+    await saveBindingInfo({
+      fingerprint: options.fingerprint,
+      instance_id: instanceId,
+      bound_at: Math.floor(Date.now() / 1e3)
+    });
+    return { status: "bound", instanceId };
+  }
+  throw new Error(`unexpected bind status: ${resp.status}`);
+}
+var init_local_agent = __esm({
+  "../core/dist/service/local-agent.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_keypair();
+    init_config();
+    init_detector();
+    init_downloader();
+    init_launcher();
+    init_registry();
+    init_client();
+    init_bind();
+  }
+});
+
+// ../core/dist/detect.js
+async function detectExistingInstall() {
+  const p = getPlatformAdapter();
+  const home = beeoHome();
+  const beeosHomeExists = await p.exists(home);
+  const keypairPath2 = p.joinPath(home, "identity", "keypair.json");
+  const fpPath = p.joinPath(home, "identity", "fingerprint");
+  const hasIdentity = await p.exists(keypairPath2);
+  let fingerprint2 = null;
+  if (await p.exists(fpPath)) {
+    try {
+      fingerprint2 = (await p.readFile(fpPath)).trim() || null;
+    } catch {
+      fingerprint2 = null;
+    }
+  }
+  let binding = null;
+  try {
+    binding = await loadBindingInfo();
+  } catch {
+    binding = null;
+  }
+  const openclaw = await detectOpenclaw();
+  const devices = await detectDevices();
+  const supervisor = await detectSupervisor();
+  return {
+    beeosHomeExists,
+    beeosHome: home,
+    hasIdentity,
+    fingerprint: fingerprint2,
+    binding,
+    openclaw,
+    devices,
+    supervisor
+  };
+}
+async function detectOpenclaw() {
+  const location = await findAgent(openClawDriver);
+  const running = await isGatewayRunning();
+  if (location.type === "managed") {
+    return {
+      found: true,
+      source: "managed",
+      binary: location.binary,
+      home: location.home,
+      version: null,
+      gatewayRunning: running
+    };
+  }
+  if (location.type === "system") {
+    return {
+      found: true,
+      source: "system",
+      binary: location.binary,
+      home: location.home,
+      version: location.version || null,
+      gatewayRunning: running
+    };
+  }
+  return {
+    found: false,
+    source: null,
+    binary: null,
+    home: null,
+    version: null,
+    gatewayRunning: running
+  };
+}
+async function detectDevices() {
+  const p = getPlatformAdapter();
+  const identityDir = p.joinPath(beeoHome(), "identity");
+  const legacyFile = p.joinPath(beeoHome(), "devices.json");
+  let keyedSerials = [];
+  try {
+    if (await p.exists(identityDir)) {
+      const entries2 = await p.readdir(identityDir);
+      keyedSerials = entries2.filter((name) => name.startsWith("device-") && name.endsWith(".key.json")).map((name) => name.replace(/^device-/, "").replace(/\.key\.json$/, ""));
+    }
+  } catch {
+    keyedSerials = [];
+  }
+  let entries = [];
+  if (await p.exists(legacyFile)) {
+    try {
+      const raw = await p.readFile(legacyFile);
+      const parsed = JSON.parse(raw);
+      entries = (parsed.devices ?? []).map((d) => ({
+        serial: String(d.serial ?? ""),
+        name: String(d.name ?? d.serial ?? ""),
+        pid: Number(d.pid ?? 0),
+        instanceId: d.instance_id ?? null,
+        bridgePid: typeof d.bridge_pid === "number" ? d.bridge_pid : void 0
+      }));
+    } catch {
+      entries = [];
+    }
+  }
+  return { legacyFile, keyedSerials, entries };
+}
+async function detectSupervisor() {
+  const p = getPlatformAdapter();
+  const stateFile = p.joinPath(beeoHome(), "supervisor", "state.json");
+  const ipcPath = supervisorSocketPath();
+  let ipcReachable = false;
+  try {
+    ipcReachable = await p.exists(ipcPath);
+  } catch {
+    ipcReachable = false;
+  }
+  let targets = [];
+  if (await p.exists(stateFile)) {
+    try {
+      const raw = await p.readFile(stateFile);
+      const parsed = JSON.parse(raw);
+      targets = (parsed.targets ?? []).map((t) => ({
+        id: String(t.id ?? ""),
+        kind: String(t.kind ?? ""),
+        restart: t.restart ?? void 0
+      }));
+    } catch {
+      targets = [];
+    }
+  }
+  return { stateFile, ipcPath, ipcReachable, targets };
+}
+function supervisorSocketPath() {
+  const p = getPlatformAdapter();
+  if (p.platform() === "win32") {
+    return "\\\\.\\pipe\\beeos-supervisor";
+  }
+  return p.joinPath(beeoHome(), "supervisor", "supervisor.sock");
+}
+function summarizeExistingInstall(state) {
+  const lines = [];
+  lines.push(`BeeOS home : ${state.beeosHome}${state.beeosHomeExists ? "" : " (not created)"}`);
+  lines.push(`Identity   : ${state.hasIdentity ? state.fingerprint ?? "(keypair present)" : "not created"}`);
+  lines.push(`Binding    : ${state.binding ? `bound \u2192 instance ${state.binding.instance_id}` : "not bound"}`);
+  lines.push(`OpenClaw   : ${state.openclaw.found ? `${state.openclaw.source}${state.openclaw.version ? ` v${state.openclaw.version}` : ""} (gateway ${state.openclaw.gatewayRunning ? "running" : "stopped"})` : "not installed"}`);
+  lines.push(`Devices    : ${state.devices.entries.length === 0 && state.devices.keyedSerials.length === 0 ? "none attached" : `${state.devices.entries.length} attached, ${state.devices.keyedSerials.length} key(s)`}`);
+  lines.push(`Supervisor : ${state.supervisor.ipcReachable ? `running (${state.supervisor.targets.length} target(s))` : state.supervisor.targets.length > 0 ? `stopped, ${state.supervisor.targets.length} persisted target(s)` : "not installed"}`);
+  return lines;
+}
+function inferInitChoices(state) {
+  if (!state.hasIdentity && !state.openclaw.found && state.devices.entries.length === 0) {
+    return { defaultDecision: "fresh", options: ["fresh"] };
+  }
+  if (state.hasIdentity && state.binding) {
+    return {
+      defaultDecision: "upgrade",
+      options: ["upgrade", "rebind-keep-key", "rebind-new-key", "skip"]
+    };
+  }
+  if (state.hasIdentity) {
+    return {
+      defaultDecision: "rebind-keep-key",
+      options: ["upgrade", "rebind-keep-key", "rebind-new-key", "skip"]
+    };
+  }
+  return { defaultDecision: "fresh", options: ["fresh", "skip"] };
+}
+function initDecisionLabel(decision) {
+  switch (decision) {
+    case "fresh":
+      return "Install + bind";
+    case "upgrade":
+      return "Upgrade CLI & agents (keep binding)";
+    case "rebind-keep-key":
+      return "Re-bind (keep existing Ed25519 key)";
+    case "rebind-new-key":
+      return "Re-bind (rotate Ed25519 key)";
+    case "skip":
+      return "Skip (do nothing)";
+  }
+}
+var init_detect = __esm({
+  "../core/dist/detect.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_config();
+    init_registry();
+    init_detector();
+  }
+});
+
+// ../core/dist/supervisor-spec.js
+function buildOpenclawTargetSpec(ctx) {
+  const isMjs = ctx.agentBinary.endsWith(".mjs") || ctx.agentBinary.endsWith(".js");
+  const command = isMjs ? "node" : ctx.agentBinary;
+  const baseArgs = isMjs ? [ctx.agentBinary] : [];
+  const env = {
+    AGENT_GATEWAY_URL: ctx.agentGatewayUrl
+  };
+  if (!ctx.isSystemHome) {
+    env.OPENCLAW_HOME = ctx.agentHome;
+    env.OPENCLAW_GATEWAY_TOKEN = ctx.gatewayToken;
+  }
+  return {
+    id: "openclaw",
+    kind: "openclaw",
+    command,
+    args: [...baseArgs, "gateway", "--allow-unconfigured", "--bind", "lan"],
+    env,
+    cwd: ctx.agentHome,
+    restart: "on-failure",
+    label: "OpenClaw Gateway"
+  };
+}
+function buildDeviceAgentTargetSpec(input) {
+  const args = [
+    ...input.args,
+    "--key",
+    input.keyFile,
+    "--adb",
+    input.serial,
+    "--bridge",
+    input.bridgeUrl
+  ];
+  if (input.httpEnabled) {
+    args.push("--http", "--http-port", String(input.httpPort));
+  }
+  const env = {};
+  if (input.agentGatewayUrl)
+    env.AGENT_GATEWAY_URL = input.agentGatewayUrl;
+  return {
+    id: `device-agent-${input.serial}`,
+    kind: "device-agent",
+    command: input.command,
+    args,
+    env: Object.keys(env).length > 0 ? env : void 0,
+    restart: "on-failure",
+    label: `device-agent (${input.serial})`
+  };
+}
+function buildScrcpyBridgeTargetSpec(binary, opts) {
+  return {
+    id: `scrcpy-bridge-${opts.deviceId}`,
+    kind: "scrcpy-bridge",
+    command: binary,
+    args: [],
+    env: scrcpyBridgeRuntime.buildEnv(opts),
+    restart: "on-failure",
+    label: `scrcpy-bridge (${opts.deviceId})`
+  };
+}
+function buildVncBridgeTargetSpec(binary, opts) {
+  return {
+    id: `vnc-bridge-${opts.deviceId}`,
+    kind: "vnc-bridge",
+    command: binary,
+    args: [],
+    env: vncBridgeRuntime.buildEnv(opts),
+    restart: "on-failure",
+    label: `vnc-bridge (${opts.deviceId})`
+  };
+}
+var init_supervisor_spec = __esm({
+  "../core/dist/supervisor-spec.js"() {
+    "use strict";
+    init_scrcpy_bridge();
+    init_vnc_bridge();
+  }
+});
+
+// ../core/dist/services/types.js
+var init_types2 = __esm({
+  "../core/dist/services/types.js"() {
+    "use strict";
+  }
+});
+
+// ../core/dist/services/ids.js
+import path from "path";
+function safeId(id) {
+  return id.replace(/[:/]+/g, "-").replace(/[^A-Za-z0-9._-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+}
+function launchdLabel(id) {
+  return `${LABEL_PREFIX}${safeId(id)}`;
+}
+function systemdUnit(id) {
+  return `${SYSTEMD_PREFIX}${safeId(id)}.service`;
+}
+function windowsTaskName(id) {
+  return `${WIN_TASK_PREFIX}${safeId(id)}`;
+}
+function serviceLogPath(id) {
+  return path.join(beeoHome(), "logs", "services", `${safeId(id)}.log`);
+}
+function idFromLaunchdLabel(label) {
+  if (!label.startsWith(LABEL_PREFIX))
+    return null;
+  return label.slice(LABEL_PREFIX.length);
+}
+function idFromSystemdUnit(unit) {
+  if (!unit.startsWith(SYSTEMD_PREFIX))
+    return null;
+  const base = unit.endsWith(".service") ? unit.slice(0, -".service".length) : unit;
+  return base.slice(SYSTEMD_PREFIX.length);
+}
+function idFromWindowsTaskName(task) {
+  if (!task.startsWith(WIN_TASK_PREFIX))
+    return null;
+  return task.slice(WIN_TASK_PREFIX.length);
+}
+var LABEL_PREFIX, SYSTEMD_PREFIX, WIN_TASK_PREFIX;
+var init_ids = __esm({
+  "../core/dist/services/ids.js"() {
+    "use strict";
+    init_config();
+    LABEL_PREFIX = "ai.beeos.";
+    SYSTEMD_PREFIX = "beeos-";
+    WIN_TASK_PREFIX = "BeeOS-";
+  }
+});
+
+// ../core/dist/services/launchd.js
+import fs from "fs/promises";
+import fsSync from "fs";
+import os from "os";
+import path2 from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+function renderPlist(spec, label, logFile) {
+  const args = [spec.command, ...spec.args].map((a) => `    <string>${escapeXml(a)}</string>`);
+  const envEntries = Object.entries(spec.env ?? {});
+  if (!envEntries.some(([k]) => k === "PATH")) {
+    envEntries.unshift([
+      "PATH",
+      "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin"
+    ]);
+  }
+  const envXml = envEntries.map(([k, v]) => `    <key>${escapeXml(k)}</key>
+    <string>${escapeXml(v)}</string>`).join("\n");
+  const restart = spec.restart ?? "on-failure";
+  let keepAliveXml = "";
+  if (restart === "always") {
+    keepAliveXml = `  <key>KeepAlive</key>
+  <true/>
+`;
+  } else if (restart === "on-failure") {
+    keepAliveXml = `  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+`;
+  }
+  const cwdXml = spec.cwd ? `  <key>WorkingDirectory</key>
+  <string>${escapeXml(spec.cwd)}</string>
+` : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapeXml(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args.join("\n")}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+${keepAliveXml}  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>ProcessType</key>
+  <string>Background</string>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(logFile)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(logFile)}</string>
+${cwdXml}  <key>EnvironmentVariables</key>
+  <dict>
+${envXml}
+  </dict>
+</dict>
+</plist>
+`;
+}
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function detectKind(id) {
+  if (id === "openclaw")
+    return "openclaw";
+  if (id.startsWith("device-agent-"))
+    return "device-agent";
+  if (id.startsWith("scrcpy-bridge-"))
+    return "scrcpy-bridge";
+  if (id.startsWith("vnc-bridge-"))
+    return "vnc-bridge";
+  return "unknown";
+}
+function fallbackStatus(spec, _label, logFile, running) {
+  return {
+    id: spec.id,
+    kind: spec.kind,
+    installed: true,
+    running,
+    pid: null,
+    lastExitCode: null,
+    logFile,
+    label: spec.label ?? null
+  };
+}
+var execFileP, LaunchdServiceManager;
+var init_launchd = __esm({
+  "../core/dist/services/launchd.js"() {
+    "use strict";
+    init_ids();
+    execFileP = promisify(execFile);
+    LaunchdServiceManager = class {
+      kind = "launchd";
+      launchAgentsDir = path2.join(os.homedir(), "Library", "LaunchAgents");
+      logPath(id) {
+        return serviceLogPath(id);
+      }
+      async install(spec) {
+        const label = launchdLabel(spec.id);
+        const plist = this.plistPath(label);
+        const logFile = this.logPath(spec.id);
+        await fs.mkdir(path2.dirname(plist), { recursive: true });
+        await fs.mkdir(path2.dirname(logFile), { recursive: true });
+        await fs.writeFile(plist, renderPlist(spec, label, logFile), {
+          mode: 420
+        });
+        const uid = process.getuid?.();
+        if (uid !== void 0) {
+          try {
+            await execFileP("launchctl", ["bootout", `gui/${uid}/${label}`]);
+          } catch {
+          }
+          try {
+            await execFileP("launchctl", ["bootstrap", `gui/${uid}`, plist]);
+          } catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            try {
+              await execFileP("launchctl", ["load", "-w", plist]);
+            } catch {
+              throw new Error(`launchctl bootstrap failed for ${label}: ${msg}`);
+            }
+          }
+          try {
+            await execFileP("launchctl", ["kickstart", "-k", `gui/${uid}/${label}`]);
+          } catch {
+          }
+        } else {
+          await execFileP("launchctl", ["load", "-w", plist]);
+        }
+        const status2 = await this.status(spec.id);
+        return status2 ?? fallbackStatus(spec, label, logFile, false);
+      }
+      async uninstall(id) {
+        const label = launchdLabel(id);
+        const plist = this.plistPath(label);
+        const existed = fsSync.existsSync(plist);
+        const uid = process.getuid?.();
+        if (uid !== void 0) {
+          try {
+            await execFileP("launchctl", ["bootout", `gui/${uid}/${label}`]);
+          } catch {
+            try {
+              await execFileP("launchctl", ["unload", "-w", plist]);
+            } catch {
+            }
+          }
+        } else {
+          try {
+            await execFileP("launchctl", ["unload", "-w", plist]);
+          } catch {
+          }
+        }
+        if (existed) {
+          try {
+            await fs.unlink(plist);
+          } catch {
+          }
+        }
+        return existed;
+      }
+      async restart(id) {
+        const label = launchdLabel(id);
+        const uid = process.getuid?.();
+        if (uid === void 0) {
+          throw new Error("launchctl restart requires a valid uid");
+        }
+        await execFileP("launchctl", ["kickstart", "-k", `gui/${uid}/${label}`]);
+      }
+      async status(id) {
+        const label = launchdLabel(id);
+        const plist = this.plistPath(label);
+        if (!fsSync.existsSync(plist))
+          return null;
+        const logFile = this.logPath(id);
+        try {
+          const { stdout } = await execFileP("launchctl", ["list", label]);
+          const pidMatch = /"PID"\s*=\s*(\d+)/.exec(stdout);
+          const exitMatch = /"LastExitStatus"\s*=\s*(-?\d+)/.exec(stdout);
+          const pid = pidMatch ? Number(pidMatch[1]) : null;
+          return {
+            id,
+            kind: detectKind(id),
+            installed: true,
+            running: pid !== null && pid > 0,
+            pid,
+            lastExitCode: exitMatch ? Number(exitMatch[1]) : null,
+            logFile,
+            label: null
+          };
+        } catch {
+          return {
+            id,
+            kind: detectKind(id),
+            installed: true,
+            running: false,
+            pid: null,
+            lastExitCode: null,
+            logFile,
+            label: null
+          };
+        }
+      }
+      async list() {
+        let stdout = "";
+        try {
+          ({ stdout } = await execFileP("launchctl", ["list"]));
+        } catch {
+          return [];
+        }
+        const results = [];
+        for (const raw of stdout.split("\n")) {
+          const line = raw.trim();
+          if (!line)
+            continue;
+          const cols = line.split(/\s+/);
+          if (cols.length < 3)
+            continue;
+          const label = cols[cols.length - 1];
+          const id = idFromLaunchdLabel(label);
+          if (!id)
+            continue;
+          const pidCol = cols[0];
+          const pid = pidCol === "-" ? null : Number(pidCol);
+          const exitCol = cols[1];
+          const lastExitCode = exitCol === "-" ? null : Number(exitCol);
+          results.push({
+            id,
+            kind: detectKind(id),
+            installed: true,
+            running: pid !== null && !Number.isNaN(pid) && pid > 0,
+            pid: pid !== null && !Number.isNaN(pid) ? pid : null,
+            lastExitCode: lastExitCode !== null && !Number.isNaN(lastExitCode) ? lastExitCode : null,
+            logFile: this.logPath(id),
+            label: null
+          });
+        }
+        try {
+          const files = await fs.readdir(this.launchAgentsDir);
+          for (const f of files) {
+            if (!f.startsWith(LABEL_PREFIX) || !f.endsWith(".plist"))
+              continue;
+            const label = f.slice(0, -".plist".length);
+            const id = idFromLaunchdLabel(label);
+            if (!id)
+              continue;
+            if (results.some((r) => r.id === id))
+              continue;
+            results.push({
+              id,
+              kind: detectKind(id),
+              installed: true,
+              running: false,
+              pid: null,
+              lastExitCode: null,
+              logFile: this.logPath(id),
+              label: null
+            });
+          }
+        } catch {
+        }
+        return results;
+      }
+      async selfCheck() {
+        try {
+          await execFileP("launchctl", ["help"]);
+          return { available: true, warnings: [], hints: [] };
+        } catch {
+          return {
+            available: false,
+            warnings: ["launchctl is not available on this system"],
+            hints: ["launchd is only available on macOS"]
+          };
+        }
+      }
+      plistPath(label) {
+        return path2.join(this.launchAgentsDir, `${label}.plist`);
+      }
+    };
+  }
+});
+
+// ../core/dist/services/systemd.js
+import fs2 from "fs/promises";
+import fsSync2 from "fs";
+import os2 from "os";
+import path3 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+function renderUnit(spec, logFile) {
+  const restart = spec.restart ?? "on-failure";
+  const restartValue = restart === "always" ? "always" : restart === "never" ? "no" : "on-failure";
+  const execStart = [shellQuote(spec.command), ...spec.args.map(shellQuote)].join(" ");
+  const envLines = Object.entries(spec.env ?? {}).map(([k, v]) => `Environment=${k}=${escapeSystemdValue(v)}`).join("\n");
+  const cwdLine = spec.cwd ? `WorkingDirectory=${spec.cwd}
+` : "";
+  const labelLine = spec.label ? spec.label : `BeeOS ${spec.kind} (${spec.id})`;
+  return `[Unit]
+Description=${labelLine}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${execStart}
+Restart=${restartValue}
+RestartSec=5
+StartLimitBurst=10
+StartLimitIntervalSec=60
+StandardOutput=append:${logFile}
+StandardError=append:${logFile}
+# Minimal PATH so spawned children can find interpreters.
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+${envLines ? envLines + "\n" : ""}${cwdLine}NoNewPrivileges=true
+
+[Install]
+WantedBy=default.target
+`;
+}
+function escapeSystemdValue(v) {
+  if (/[\s"'$]/.test(v))
+    return `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  return v;
+}
+function shellQuote(s) {
+  if (s === "")
+    return '""';
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(s))
+    return s;
+  return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function parseShowOutput(stdout) {
+  const out = {};
+  for (const line of stdout.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq < 0)
+      continue;
+    out[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+  }
+  return out;
+}
+function detectKind2(id) {
+  if (id === "openclaw")
+    return "openclaw";
+  if (id.startsWith("device-agent-"))
+    return "device-agent";
+  if (id.startsWith("scrcpy-bridge-"))
+    return "scrcpy-bridge";
+  if (id.startsWith("vnc-bridge-"))
+    return "vnc-bridge";
+  return "unknown";
+}
+var execFileP2, SystemdServiceManager;
+var init_systemd = __esm({
+  "../core/dist/services/systemd.js"() {
+    "use strict";
+    init_ids();
+    execFileP2 = promisify2(execFile2);
+    SystemdServiceManager = class {
+      kind = "systemd-user";
+      unitDir = path3.join(os2.homedir(), ".config", "systemd", "user");
+      logPath(id) {
+        return serviceLogPath(id);
+      }
+      async install(spec) {
+        const unit = systemdUnit(spec.id);
+        const unitFile = this.unitPath(unit);
+        const logFile = this.logPath(spec.id);
+        await fs2.mkdir(path3.dirname(unitFile), { recursive: true });
+        await fs2.mkdir(path3.dirname(logFile), { recursive: true });
+        await fs2.writeFile(unitFile, renderUnit(spec, logFile), { mode: 420 });
+        try {
+          await execFileP2("systemctl", ["--user", "daemon-reload"]);
+        } catch (e) {
+          throw new Error(`systemctl --user daemon-reload failed (is systemd --user available?): ${e}`);
+        }
+        await execFileP2("systemctl", ["--user", "enable", "--now", unit]);
+        try {
+          await execFileP2("systemctl", ["--user", "restart", unit]);
+        } catch {
+        }
+        const status2 = await this.status(spec.id);
+        return status2 ?? {
+          id: spec.id,
+          kind: spec.kind,
+          installed: true,
+          running: false,
+          pid: null,
+          lastExitCode: null,
+          logFile,
+          label: spec.label ?? null
+        };
+      }
+      async uninstall(id) {
+        const unit = systemdUnit(id);
+        const unitFile = this.unitPath(unit);
+        const existed = fsSync2.existsSync(unitFile);
+        if (existed) {
+          try {
+            await execFileP2("systemctl", ["--user", "disable", "--now", unit]);
+          } catch {
+          }
+          try {
+            await fs2.unlink(unitFile);
+          } catch {
+          }
+          try {
+            await execFileP2("systemctl", ["--user", "daemon-reload"]);
+          } catch {
+          }
+        } else {
+          try {
+            await execFileP2("systemctl", ["--user", "disable", "--now", unit]);
+          } catch {
+          }
+        }
+        return existed;
+      }
+      async restart(id) {
+        const unit = systemdUnit(id);
+        await execFileP2("systemctl", ["--user", "restart", unit]);
+      }
+      async status(id) {
+        const unit = systemdUnit(id);
+        const unitFile = this.unitPath(unit);
+        if (!fsSync2.existsSync(unitFile))
+          return null;
+        const logFile = this.logPath(id);
+        let active = false;
+        let pid = null;
+        let exitCode = null;
+        try {
+          const { stdout } = await execFileP2("systemctl", [
+            "--user",
+            "show",
+            unit,
+            "--property=ActiveState,MainPID,ExecMainStatus"
+          ]);
+          const props = parseShowOutput(stdout);
+          active = props.ActiveState === "active";
+          const mp = Number(props.MainPID);
+          pid = Number.isFinite(mp) && mp > 0 ? mp : null;
+          const ex = Number(props.ExecMainStatus);
+          exitCode = Number.isFinite(ex) ? ex : null;
+        } catch {
+        }
+        return {
+          id,
+          kind: detectKind2(id),
+          installed: true,
+          running: active && pid !== null,
+          pid,
+          lastExitCode: exitCode,
+          logFile,
+          label: null
+        };
+      }
+      async list() {
+        const results = [];
+        let unitFiles = [];
+        try {
+          unitFiles = (await fs2.readdir(this.unitDir)).filter((f) => f.startsWith(SYSTEMD_PREFIX) && f.endsWith(".service"));
+        } catch {
+          return results;
+        }
+        for (const f of unitFiles) {
+          const id = idFromSystemdUnit(f);
+          if (!id)
+            continue;
+          const s = await this.status(id);
+          if (s)
+            results.push(s);
+        }
+        return results;
+      }
+      async selfCheck() {
+        const warnings = [];
+        const hints = [];
+        try {
+          await execFileP2("systemctl", ["--user", "--version"]);
+        } catch {
+          return {
+            available: false,
+            warnings: ["systemctl --user is not available"],
+            hints: [
+              "Install systemd or use a distro with systemd --user enabled."
+            ]
+          };
+        }
+        try {
+          const user = os2.userInfo().username;
+          const { stdout } = await execFileP2("loginctl", ["show-user", user]);
+          if (!/Linger=yes/i.test(stdout)) {
+            warnings.push("systemd --user linger is OFF \u2014 BeeOS services will stop when you log out.");
+            hints.push(`sudo loginctl enable-linger ${user}`);
+          }
+        } catch {
+          hints.push("Could not query loginctl; linger status unknown.");
+        }
+        return { available: true, warnings, hints };
+      }
+      unitPath(unit) {
+        return path3.join(this.unitDir, unit);
+      }
+    };
+  }
+});
+
+// ../core/dist/services/task-scheduler.js
+import fs3 from "fs/promises";
+import os3 from "os";
+import path4 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+function renderTaskXml(spec, logFile) {
+  const restart = spec.restart ?? "on-failure";
+  const restartXml = restart === "never" ? "" : `      <RestartOnFailure>
+        <Interval>PT1M</Interval>
+        <Count>999</Count>
+      </RestartOnFailure>`;
+  const cwdXml = spec.cwd ? `      <WorkingDirectory>${escapeXml2(spec.cwd)}</WorkingDirectory>
+` : "";
+  const author = (() => {
+    try {
+      return os3.userInfo().username;
+    } catch {
+      return "BeeOS";
+    }
+  })();
+  const innerArgs = spec.args.map(quoteCmdArg).join(" ");
+  const envPrefix = Object.entries(spec.env ?? {}).map(([k, v]) => `set ${cmdEscapeVar(k)}=${cmdEscapeValue(v)}&& `).join("");
+  const inner = `${envPrefix}${quoteCmdArg(spec.command)}${innerArgs ? " " + innerArgs : ""} >> ${quoteCmdArg(logFile)} 2>&1`;
+  const command = "cmd.exe";
+  const argsAttr = `/d /c "${inner}"`;
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Author>${escapeXml2(author)}</Author>
+    <Description>${escapeXml2(spec.label ?? `BeeOS ${spec.kind} (${spec.id})`)}</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${escapeXml2(author)}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${escapeXml2(author)}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+${restartXml ? restartXml + "\n" : ""}  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${escapeXml2(command)}</Command>
+      <Arguments>${escapeXml2(argsAttr)}</Arguments>
+${cwdXml}    </Exec>
+  </Actions>
+</Task>`;
+}
+function quoteCmdArg(s) {
+  return `"${s.replace(/"/g, '""')}"`;
+}
+function cmdEscapeVar(k) {
+  return k.replace(/[=]/g, "");
+}
+function cmdEscapeValue(v) {
+  return v.replace(/(["&|<>^])/g, "^$1");
+}
+function escapeXml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function detectKind3(id) {
+  if (id === "openclaw")
+    return "openclaw";
+  if (id.startsWith("device-agent-"))
+    return "device-agent";
+  if (id.startsWith("scrcpy-bridge-"))
+    return "scrcpy-bridge";
+  if (id.startsWith("vnc-bridge-"))
+    return "vnc-bridge";
+  return "unknown";
+}
+var execFileP3, TaskSchedulerServiceManager;
+var init_task_scheduler = __esm({
+  "../core/dist/services/task-scheduler.js"() {
+    "use strict";
+    init_ids();
+    execFileP3 = promisify3(execFile3);
+    TaskSchedulerServiceManager = class {
+      kind = "task-scheduler";
+      logPath(id) {
+        return serviceLogPath(id);
+      }
+      async install(spec) {
+        const task = windowsTaskName(spec.id);
+        const logFile = this.logPath(spec.id);
+        await fs3.mkdir(path4.dirname(logFile), { recursive: true });
+        const xml = renderTaskXml(spec, logFile);
+        const tmp = path4.join(os3.tmpdir(), `beeos-task-${Date.now()}-${spec.id.replace(/[^a-z0-9]/gi, "_")}.xml`);
+        await fs3.writeFile(tmp, "\uFEFF" + xml, { encoding: "utf16le" });
+        try {
+          await execFileP3("schtasks", ["/Create", "/TN", task, "/XML", tmp, "/F"]);
+          try {
+            await execFileP3("schtasks", ["/Run", "/TN", task]);
+          } catch {
+          }
+        } finally {
+          try {
+            await fs3.unlink(tmp);
+          } catch {
+          }
+        }
+        const status2 = await this.status(spec.id);
+        return status2 ?? {
+          id: spec.id,
+          kind: spec.kind,
+          installed: true,
+          running: false,
+          pid: null,
+          lastExitCode: null,
+          logFile,
+          label: spec.label ?? null
+        };
+      }
+      async uninstall(id) {
+        const task = windowsTaskName(id);
+        try {
+          await execFileP3("schtasks", ["/Delete", "/TN", task, "/F"]);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      async restart(id) {
+        const task = windowsTaskName(id);
+        try {
+          await execFileP3("schtasks", ["/End", "/TN", task]);
+        } catch {
+        }
+        await execFileP3("schtasks", ["/Run", "/TN", task]);
+      }
+      async status(id) {
+        const task = windowsTaskName(id);
+        const logFile = this.logPath(id);
+        try {
+          const { stdout } = await execFileP3("schtasks", [
+            "/Query",
+            "/TN",
+            task,
+            "/V",
+            "/FO",
+            "CSV"
+          ]);
+          const running = /"\s*Running\s*"/i.test(stdout);
+          const exitMatch = /"Last Result"\s*,\s*"(-?\d+)"/i.exec(stdout);
+          return {
+            id,
+            kind: detectKind3(id),
+            installed: true,
+            running,
+            pid: null,
+            lastExitCode: exitMatch ? Number(exitMatch[1]) : null,
+            logFile,
+            label: null
+          };
+        } catch {
+          return null;
+        }
+      }
+      async list() {
+        let stdout = "";
+        try {
+          ({ stdout } = await execFileP3("schtasks", ["/Query", "/FO", "CSV"]));
+        } catch {
+          return [];
+        }
+        const results = [];
+        const lines = stdout.split(/\r?\n/).slice(1);
+        for (const line of lines) {
+          const m = /^"([^"]+)","([^"]*)","([^"]*)"/.exec(line);
+          if (!m)
+            continue;
+          const rawName = m[1];
+          const bare = rawName.startsWith("\\") ? rawName.slice(1) : rawName;
+          if (!bare.startsWith(WIN_TASK_PREFIX))
+            continue;
+          const id = idFromWindowsTaskName(bare);
+          if (!id)
+            continue;
+          results.push({
+            id,
+            kind: detectKind3(id),
+            installed: true,
+            running: /Running/i.test(m[3]),
+            pid: null,
+            lastExitCode: null,
+            logFile: this.logPath(id),
+            label: null
+          });
+        }
+        return results;
+      }
+      async selfCheck() {
+        try {
+          await execFileP3("schtasks", ["/?"]);
+          return {
+            available: true,
+            warnings: ["Windows Task Scheduler support is in preview \u2014 restart-on-crash is best-effort."],
+            hints: []
+          };
+        } catch {
+          return {
+            available: false,
+            warnings: ["schtasks.exe is not available"],
+            hints: ["Windows Task Scheduler is only available on Windows."]
+          };
+        }
+      }
+    };
+  }
+});
+
+// ../core/dist/services/fallback.js
+import fs4 from "fs/promises";
+import fsSync3 from "fs";
+import path5 from "path";
+import { spawn } from "child_process";
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var FallbackServiceManager;
+var init_fallback = __esm({
+  "../core/dist/services/fallback.js"() {
+    "use strict";
+    init_ids();
+    init_config();
+    FallbackServiceManager = class {
+      kind = "fallback";
+      stateDir = path5.join(beeoHome(), "services", "fallback");
+      logPath(id) {
+        return serviceLogPath(id);
+      }
+      async install(spec) {
+        const logFile = this.logPath(spec.id);
+        await fs4.mkdir(path5.dirname(logFile), { recursive: true });
+        await fs4.mkdir(this.stateDir, { recursive: true });
+        await this.uninstall(spec.id);
+        const out = fsSync3.openSync(logFile, "a");
+        const err = fsSync3.openSync(logFile, "a");
+        const child = spawn(spec.command, spec.args, {
+          cwd: spec.cwd,
+          env: { ...process.env, ...spec.env ?? {} },
+          detached: true,
+          stdio: ["ignore", out, err]
+        });
+        child.unref();
+        if (child.pid) {
+          await fs4.writeFile(this.pidPath(spec.id), `${child.pid}
+${spec.id}
+`);
+          await fs4.writeFile(this.specPath(spec.id), JSON.stringify({ spec, startedAt: Date.now() }, null, 2));
+        }
+        return {
+          id: spec.id,
+          kind: spec.kind,
+          installed: true,
+          running: child.pid !== void 0,
+          pid: child.pid ?? null,
+          lastExitCode: null,
+          logFile,
+          label: spec.label ?? null
+        };
+      }
+      async uninstall(id) {
+        const pidFile2 = this.pidPath(id);
+        const specFile = this.specPath(id);
+        const existed = fsSync3.existsSync(pidFile2) || fsSync3.existsSync(specFile);
+        try {
+          const pid = await this.readPid(id);
+          if (pid !== null) {
+            try {
+              process.kill(pid, "SIGTERM");
+            } catch {
+            }
+          }
+        } catch {
+        }
+        try {
+          await fs4.unlink(pidFile2);
+        } catch {
+        }
+        try {
+          await fs4.unlink(specFile);
+        } catch {
+        }
+        return existed;
+      }
+      async restart(id) {
+        const specFile = this.specPath(id);
+        if (!fsSync3.existsSync(specFile)) {
+          throw new Error(`Fallback service '${id}' is not installed`);
+        }
+        const raw = JSON.parse(await fs4.readFile(specFile, "utf-8"));
+        await this.install(raw.spec);
+      }
+      async status(id) {
+        const specFile = this.specPath(id);
+        if (!fsSync3.existsSync(specFile))
+          return null;
+        const pid = await this.readPid(id);
+        const running = pid !== null && isAlive(pid);
+        const logFile = this.logPath(id);
+        let spec = null;
+        try {
+          const raw = JSON.parse(await fs4.readFile(specFile, "utf-8"));
+          spec = raw.spec;
+        } catch {
+        }
+        return {
+          id,
+          kind: spec?.kind ?? "unknown",
+          installed: true,
+          running,
+          pid: running ? pid : null,
+          lastExitCode: null,
+          logFile,
+          label: spec?.label ?? null
+        };
+      }
+      async list() {
+        let files = [];
+        try {
+          files = (await fs4.readdir(this.stateDir)).filter((f) => f.endsWith(".json"));
+        } catch {
+          return [];
+        }
+        const results = [];
+        for (const f of files) {
+          const id = path5.basename(f, ".json");
+          const s = await this.status(id);
+          if (s)
+            results.push(s);
+        }
+        return results;
+      }
+      async selfCheck() {
+        return {
+          available: true,
+          warnings: [
+            "Using fallback process manager \u2014 services will NOT restart on crash or reboot."
+          ],
+          hints: [
+            "Install a real service manager (systemd, launchd, or Task Scheduler) for production use."
+          ]
+        };
+      }
+      pidPath(id) {
+        return path5.join(this.stateDir, `${safeId(id)}.pid`);
+      }
+      specPath(id) {
+        return path5.join(this.stateDir, `${safeId(id)}.json`);
+      }
+      async readPid(id) {
+        try {
+          const raw = await fs4.readFile(this.pidPath(id), "utf-8");
+          const pid = Number(raw.split("\n")[0]?.trim());
+          return Number.isFinite(pid) && pid > 0 ? pid : null;
+        } catch {
+          return null;
+        }
+      }
+    };
+  }
+});
+
+// ../core/dist/services/factory.js
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+async function getServiceManager() {
+  if (cached)
+    return cached;
+  if (process.platform === "darwin") {
+    cached = new LaunchdServiceManager();
+    return cached;
+  }
+  if (process.platform === "win32") {
+    const mgr = new TaskSchedulerServiceManager();
+    const check = await mgr.selfCheck();
+    if (check.available) {
+      cached = mgr;
+      return cached;
+    }
+    fallbackReason = "schtasks.exe is not available";
+    cached = new FallbackServiceManager();
+    return cached;
+  }
+  if (process.platform === "linux") {
+    try {
+      await execFileP4("systemctl", ["--user", "--version"]);
+      cached = new SystemdServiceManager();
+      return cached;
+    } catch {
+      fallbackReason = "systemctl --user is not available (systemd-free distro?)";
+    }
+  } else {
+    fallbackReason = `no native service manager for platform '${process.platform}'`;
+  }
+  cached = new FallbackServiceManager();
+  return cached;
+}
+function activeFallbackReason() {
+  return fallbackReason;
+}
+var execFileP4, cached, fallbackReason;
+var init_factory = __esm({
+  "../core/dist/services/factory.js"() {
+    "use strict";
+    init_launchd();
+    init_systemd();
+    init_task_scheduler();
+    init_fallback();
+    execFileP4 = promisify4(execFile4);
+    cached = null;
+    fallbackReason = null;
+  }
+});
+
+// ../core/dist/services/migrate.js
+import fs5 from "fs/promises";
+import fsSync4 from "fs";
+import path6 from "path";
+import os4 from "os";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+async function migrateLegacySupervisor(mgr) {
+  const home = beeoHome();
+  const supervisorDir = path6.join(home, "supervisor");
+  const stateFile = path6.join(supervisorDir, "state.json");
+  const flagFile = path6.join(home, MIGRATION_FLAG);
+  if (fsSync4.existsSync(flagFile)) {
+    return { ran: false, migrated: 0, errors: [], backupPath: null };
+  }
+  if (!fsSync4.existsSync(stateFile)) {
+    try {
+      await fs5.writeFile(flagFile, (/* @__PURE__ */ new Date()).toISOString());
+    } catch {
+    }
+    return { ran: false, migrated: 0, errors: [], backupPath: null };
+  }
+  const backupPath = `${stateFile}.migration-backup-${Date.now()}`;
+  try {
+    await fs5.copyFile(stateFile, backupPath);
+  } catch {
+  }
+  let parsed;
+  try {
+    const raw = await fs5.readFile(stateFile, "utf-8");
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return {
+      ran: true,
+      migrated: 0,
+      errors: [{ id: "<state.json>", error: `unreadable: ${e}` }],
+      backupPath
+    };
+  }
+  const targets = parsed.targets ?? [];
+  const errors = [];
+  let migrated = 0;
+  for (const t of targets) {
+    const canonicalId = safeId(t.id);
+    try {
+      const spec = {
+        id: canonicalId,
+        kind: t.kind,
+        command: t.command,
+        args: t.args ?? [],
+        env: t.env,
+        cwd: t.cwd,
+        restart: t.restart ?? "on-failure",
+        label: t.label
+      };
+      await mgr.install(spec);
+      migrated++;
+    } catch (e) {
+      errors.push({ id: canonicalId, error: e instanceof Error ? e.message : String(e) });
+    }
+  }
+  await stopLegacyDaemon();
+  if (errors.length === 0) {
+    try {
+      await fs5.writeFile(flagFile, (/* @__PURE__ */ new Date()).toISOString());
+    } catch {
+    }
+    try {
+      await fs5.rm(supervisorDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+  return { ran: true, migrated, errors, backupPath };
+}
+async function stopLegacyDaemon() {
+  if (process.platform === "darwin") {
+    const uid = process.getuid?.();
+    if (uid !== void 0) {
+      try {
+        await execFileP5("launchctl", ["bootout", `gui/${uid}/${LEGACY_LABEL}`]);
+      } catch {
+      }
+    }
+    const legacyPlist = path6.join(os4.homedir(), "Library", "LaunchAgents", `${LEGACY_LABEL}.plist`);
+    try {
+      await fs5.unlink(legacyPlist);
+    } catch {
+    }
+  }
+  if (process.platform === "linux") {
+    try {
+      await execFileP5("systemctl", ["--user", "disable", "--now", LEGACY_SYSTEMD_UNIT]);
+    } catch {
+    }
+    const legacyUnit = path6.join(os4.homedir(), ".config", "systemd", "user", LEGACY_SYSTEMD_UNIT);
+    try {
+      await fs5.unlink(legacyUnit);
+    } catch {
+    }
+  }
+  if (process.platform !== "win32") {
+    try {
+      await execFileP5("pkill", ["-f", "beeos-supervisor"]);
+    } catch {
+    }
+  }
+}
+var execFileP5, LEGACY_LABEL, LEGACY_SYSTEMD_UNIT, MIGRATION_FLAG;
+var init_migrate = __esm({
+  "../core/dist/services/migrate.js"() {
+    "use strict";
+    init_config();
+    init_ids();
+    execFileP5 = promisify5(execFile5);
+    LEGACY_LABEL = "ai.beeos.supervisor";
+    LEGACY_SYSTEMD_UNIT = "beeos-supervisor.service";
+    MIGRATION_FLAG = "migrated-to-services.flag";
+  }
+});
+
+// ../core/dist/services/index.js
+var init_services = __esm({
+  "../core/dist/services/index.js"() {
+    "use strict";
+    init_types2();
+    init_ids();
+    init_launchd();
+    init_systemd();
+    init_task_scheduler();
+    init_fallback();
+    init_factory();
+    init_migrate();
+  }
+});
+
+// ../core/dist/index.js
+var init_dist = __esm({
+  "../core/dist/index.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_progress();
+    init_config();
+    init_keypair();
+    init_qr();
+    init_client();
+    init_npm();
+    init_process();
+    init_bind();
+    init_device_setup();
+    init_adb_setup();
+    init_types();
+    init_device();
+    init_openclaw();
+    init_scrcpy_bridge();
+    init_vnc_bridge();
+    init_cargo_dist();
+    init_detector();
+    init_downloader();
+    init_launcher();
+    init_registry();
+    init_local_agent();
+    init_detect();
+    init_supervisor_spec();
+    init_services();
+  }
+});
+
+// src/progress.ts
+import ora from "ora";
+var CliReporter;
+var init_progress2 = __esm({
+  "src/progress.ts"() {
+    "use strict";
+    CliReporter = class {
+      spinner;
+      constructor() {
+        this.spinner = ora({ stream: process.stderr });
+      }
+      onStatus(message) {
+        if (this.spinner.isSpinning) {
+          this.spinner.text = message;
+        } else {
+          this.spinner.start(message);
+        }
+      }
+      onComplete(message) {
+        if (this.spinner.isSpinning) {
+          this.spinner.succeed(message);
+        } else {
+          console.log(`\u2713 ${message}`);
+        }
+      }
+      stop() {
+        if (this.spinner.isSpinning) {
+          this.spinner.stop();
+        }
+      }
+    };
+  }
+});
+
+// src/commands/fallback-banner.ts
+function maybePrintFallbackBanner(kind) {
+  if (kind !== "fallback") return;
+  if (printed) return;
+  const reason = activeFallbackReason();
+  if (!reason) return;
+  printed = true;
+  const bar = "!".repeat(70);
+  console.log("");
+  console.log(`  ${bar}`);
+  console.log("  !! WARNING: no native OS service manager available");
+  console.log(`  !! Reason : ${reason}`);
+  console.log("  !! Impact : services will NOT restart on crash or reboot.");
+  console.log("  !! Fix    : use a distro with systemd --user (and run");
+  console.log("  !!          `loginctl enable-linger $USER` once), or");
+  console.log("  !!          launchd (macOS), or Task Scheduler (Windows).");
+  console.log(`  ${bar}`);
+  console.log("");
+}
+var printed;
+var init_fallback_banner = __esm({
+  "src/commands/fallback-banner.ts"() {
+    "use strict";
+    init_dist();
+    printed = false;
+  }
+});
+
+// src/commands/device.ts
+var device_exports = {};
+__export(device_exports, {
+  attach: () => attach,
+  detach: () => detach,
+  exec: () => exec,
+  list: () => list,
+  upgrade: () => upgrade
+});
+import lockfile from "proper-lockfile";
+function deviceAgentTargetId(serial) {
+  return `device-agent-${serial}`;
+}
+function scrcpyTargetId(serial) {
+  return `scrcpy-bridge-${serial}`;
+}
+function vncTargetId(serial) {
+  return `vnc-bridge-${serial}`;
+}
+function devicesPath() {
+  const p = getPlatformAdapter();
+  return p.joinPath(beeoHome(), "devices.json");
+}
+async function loadDeviceState() {
+  const p = getPlatformAdapter();
+  const path9 = devicesPath();
+  if (!await p.exists(path9)) return { devices: [] };
+  try {
+    const raw = await p.readFile(path9);
+    return JSON.parse(raw);
+  } catch {
+    return { devices: [] };
+  }
+}
+async function saveDeviceState(state) {
+  const p = getPlatformAdapter();
+  await p.writeFile(devicesPath(), JSON.stringify(state, null, 2));
+}
+async function withDeviceLock(fn) {
+  const p = getPlatformAdapter();
+  const path9 = devicesPath();
+  await p.mkdir(p.dirname(path9));
+  if (!await p.exists(path9)) {
+    await p.writeFile(path9, JSON.stringify({ devices: [] }));
+  }
+  const release = await lockfile.lock(path9, { retries: 3 });
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
+async function ensureAdbAvailable(reporter) {
+  const existing = await findAdb();
+  if (existing) return;
+  if (process.env.BEEOS_SKIP_ADB_INSTALL === "1") {
+    throw new Error(
+      "adb not found on PATH and BEEOS_SKIP_ADB_INSTALL=1 is set.\nInstall Android platform-tools manually and re-run, or unset the env var."
+    );
+  }
+  console.log("adb not found \u2014 downloading Android platform-tools (one-time, ~10MB)...");
+  try {
+    await ensureAdb(reporter, { autoInstall: true });
+  } catch (e) {
+    throw new Error(
+      "Failed to install adb automatically: " + String(e) + "\nWorkarounds:\n  \u2022 macOS: brew install android-platform-tools\n  \u2022 Linux: apt install android-tools-adb (or equivalent)\n  \u2022 Windows: install Android SDK Platform-Tools from https://developer.android.com/tools/releases/platform-tools\n  \u2022 Or point $BEEOS_ADB_BIN at an existing adb binary.",
+      { cause: e }
+    );
+  }
+}
+async function installService(mgr, spec) {
+  maybePrintFallbackBanner(mgr.kind);
+  await mgr.install(spec);
+}
+async function removeTargetsForSerial(mgr, serial) {
+  for (const id of [
+    deviceAgentTargetId(serial),
+    scrcpyTargetId(serial),
+    vncTargetId(serial)
+  ]) {
+    try {
+      await mgr.uninstall(id);
+    } catch {
+    }
+  }
+}
+async function attach(options) {
+  const cfg = await loadOrCreateConfig();
+  const reporter = new CliReporter();
+  const withVideo = options.video !== false;
+  const isDesktopAttach = Boolean(options.vncHost);
+  if (!isDesktopAttach) {
+    await ensureAdbAvailable(reporter);
+  }
+  if (options.all) {
+    return attachAll(cfg, reporter, withVideo, options);
+  }
+  const serial = options.serial ?? await deviceRuntime.detectSingleDevice();
+  const name = options.name ?? serial;
+  const agentBin = await deviceRuntime.ensureAgent(reporter);
+  reporter.stop();
+  const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(serial);
+  const instanceId = await tryBindDevice(pubkeyB64, name, cfg);
+  if (!instanceId) {
+    console.error("Bind was not completed \u2014 device-agent will not start without a platform binding.");
+    console.error("Run `beeos device attach` again to retry.");
+    return;
+  }
+  const mgr = await getServiceManager();
+  await withDeviceLock(async () => {
+    const state = await loadDeviceState();
+    const existingIdx = state.devices.findIndex((d) => d.serial === serial);
+    if (existingIdx >= 0) {
+      await removeTargetsForSerial(mgr, serial);
+      state.devices.splice(existingIdx, 1);
+    }
+    const httpPort = nextHttpPort(state, cfg.device.http_port);
+    const keyFile = deviceRuntime.deviceKeyPath(serial);
+    const agentGatewayUrl = resolveAgentGatewayUrl(cfg);
+    const agentSpec = buildDeviceAgentTargetSpecFromBin(
+      agentBin,
+      {
+        serial,
+        bridgeUrl: cfg.platform.bridge_url,
+        httpEnabled: cfg.device.http_enabled,
+        httpPort,
+        agentGatewayUrl,
+        keyFile
+      }
+    );
+    await installService(mgr, agentSpec);
+    const bridgeInfo = await registerVideoBridge(mgr, reporter, {
+      cfg,
+      serial,
+      instanceId,
+      keyFile,
+      withVideo,
+      vncHost: options.vncHost,
+      vncPort: options.vncPort,
+      vncPassword: options.vncPassword
+    });
+    state.devices.push({
+      serial,
+      name,
+      instance_id: instanceId,
+      key_file: keyFile,
+      http_port: httpPort,
+      video_mode: bridgeInfo.mode,
+      vnc_host: options.vncHost,
+      vnc_port: options.vncPort
+    });
+    await saveDeviceState(state);
+    const logPath = mgr.logPath(deviceAgentTargetId(serial));
+    console.log(`Attached device ${serial} (${name}) \u2014 instance ${instanceId}`);
+    console.log(`  local http: :${httpPort} (if enabled)`);
+    console.log(`  logs: ${logPath}`);
+    if (bridgeInfo.mode !== "none") {
+      console.log(`  video: ${bridgeInfo.mode}-bridge (managed by ${mgr.kind})`);
+    } else {
+      console.log("  video: disabled");
+    }
+  });
+}
+async function attachAll(cfg, reporter, withVideo, options) {
+  const devices = await deviceRuntime.listAdbDevices();
+  if (devices.length === 0) {
+    console.log("No ADB devices found");
+    return;
+  }
+  const agentBin = await deviceRuntime.ensureAgent(reporter);
+  reporter.stop();
+  const agentGatewayUrl = resolveAgentGatewayUrl(cfg);
+  const mgr = await getServiceManager();
+  const binds = [];
+  for (const device of devices) {
+    try {
+      const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(device.serial);
+      const instanceId = await tryBindDevice(pubkeyB64, device.serial, cfg);
+      if (!instanceId) {
+        console.error(`  Skipping ${device.serial} \u2014 bind not completed`);
+        continue;
+      }
+      binds.push({
+        serial: device.serial,
+        instanceId,
+        keyFile: deviceRuntime.deviceKeyPath(device.serial)
+      });
+    } catch (e) {
+      console.error(`  Failed to bind ${device.serial}: ${e}`);
+    }
+  }
+  if (binds.length === 0) {
+    console.log("No devices attached \u2014 all binds failed or were skipped.");
+    return;
+  }
+  await withDeviceLock(async () => {
+    const state = await loadDeviceState();
+    const alreadyAttached = new Set(state.devices.map((d) => d.serial));
+    await Promise.all(
+      binds.map(async ({ serial, instanceId, keyFile }) => {
+        try {
+          const existingIdx = state.devices.findIndex((d) => d.serial === serial);
+          if (existingIdx >= 0) {
+            await removeTargetsForSerial(mgr, serial);
+            state.devices.splice(existingIdx, 1);
+          }
+          const httpPort = nextHttpPort(state, cfg.device.http_port);
+          const agentSpec = buildDeviceAgentTargetSpecFromBin(agentBin, {
+            serial,
+            bridgeUrl: cfg.platform.bridge_url,
+            httpEnabled: cfg.device.http_enabled,
+            httpPort,
+            agentGatewayUrl,
+            keyFile
+          });
+          await installService(mgr, agentSpec);
+          const bridgeInfo = await registerVideoBridge(mgr, reporter, {
+            cfg,
+            serial,
+            instanceId,
+            keyFile,
+            withVideo,
+            vncHost: options.vncHost,
+            vncPort: options.vncPort,
+            vncPassword: options.vncPassword
+          });
+          state.devices.push({
+            serial,
+            name: serial,
+            instance_id: instanceId,
+            key_file: keyFile,
+            http_port: httpPort,
+            video_mode: bridgeInfo.mode,
+            vnc_host: options.vncHost,
+            vnc_port: options.vncPort
+          });
+          alreadyAttached.add(serial);
+          console.log(
+            `Attached device ${serial} \u2014 instance ${instanceId}` + (bridgeInfo.mode !== "none" ? ` (video: ${bridgeInfo.mode})` : "")
+          );
+        } catch (e) {
+          console.error(`Failed to attach ${serial}: ${e}`);
+        }
+      })
+    );
+    await saveDeviceState(state);
+    console.log(`Attached ${binds.length} device(s) via ${mgr.kind}.`);
+  });
+}
+function buildDeviceAgentTargetSpecFromBin(agentBin, input) {
+  if (!input.bridgeUrl) {
+    throw new Error(
+      "bridge_url is not configured in ~/.beeos/config.toml.\nSet [platform] bridge_url (e.g. wss://bridge.beeos.ai)."
+    );
+  }
+  const { cmd, args: baseArgs } = agentBinCommandAndArgs(agentBin);
+  return buildDeviceAgentTargetSpec({
+    serial: input.serial,
+    command: cmd,
+    args: baseArgs,
+    bridgeUrl: input.bridgeUrl,
+    keyFile: input.keyFile,
+    httpEnabled: input.httpEnabled,
+    httpPort: input.httpPort,
+    agentGatewayUrl: input.agentGatewayUrl
+  });
+}
+async function registerVideoBridge(mgr, reporter, params) {
+  if (!params.withVideo) return { mode: "none" };
+  const agentGatewayUrl = resolveAgentGatewayUrl(params.cfg);
+  if (params.vncHost) {
+    const binary2 = await vncBridgeRuntime.ensureInstalled(reporter);
+    if (!binary2) {
+      console.error(
+        `  vnc-bridge binary unavailable \u2014 ${params.serial} will run without VNC streaming.`
+      );
+      return { mode: "none" };
+    }
+    const spec2 = buildVncBridgeTargetSpec(binary2, {
+      deviceId: `device-${params.instanceId}`,
+      vncHost: params.vncHost,
+      vncPort: params.vncPort ?? 5900,
+      ...params.vncPassword ? { vncPassword: params.vncPassword } : {},
+      agentGatewayUrl,
+      bridgePrivateKeyFile: params.keyFile,
+      bridgePublicKeyFile: params.keyFile
+    });
+    await installService(mgr, spec2);
+    return { mode: "vnc" };
+  }
+  const binary = await scrcpyBridgeRuntime.ensureInstalled(reporter);
+  if (!binary) {
+    console.error(
+      `  scrcpy-bridge binary unavailable \u2014 ${params.serial} will run without WebRTC video.
+  Install from https://github.com/beeos-ai/scrcpy-bridge or set BEEOS_SCRCPY_BRIDGE_BIN.`
+    );
+    return { mode: "none" };
+  }
+  const spec = buildScrcpyBridgeTargetSpec(binary, {
+    deviceId: `device-${params.instanceId}`,
+    adbSerial: params.serial,
+    agentGatewayUrl,
+    bridgePrivateKeyFile: params.keyFile,
+    bridgePublicKeyFile: params.keyFile
+  });
+  await installService(mgr, spec);
+  return { mode: "scrcpy" };
+}
+async function detach(options) {
+  const cfg = await loadOrCreateConfig();
+  const mgr = await getServiceManager();
+  await withDeviceLock(async () => {
+    const state = await loadDeviceState();
+    if (options.all) {
+      for (const entry2 of state.devices) {
+        await removeTargetsForSerial(mgr, entry2.serial);
+        legacyKillDeviceEntry(entry2);
+        await notifyOffline(cfg.platform.api_url, entry2.instance_id);
+      }
+      const count = state.devices.length;
+      state.devices = [];
+      await saveDeviceState(state);
+      console.log(`Detached ${count} device(s)`);
+      return;
+    }
+    if (!options.serial) {
+      throw new Error("Specify --serial or use --all");
+    }
+    const idx = state.devices.findIndex((d) => d.serial === options.serial);
+    if (idx < 0) throw new Error(`Device ${options.serial} not found`);
+    const entry = state.devices.splice(idx, 1)[0];
+    await removeTargetsForSerial(mgr, entry.serial);
+    legacyKillDeviceEntry(entry);
+    await notifyOffline(cfg.platform.api_url, entry.instance_id);
+    await saveDeviceState(state);
+    console.log(`Detached device ${options.serial}`);
+  });
+}
+function legacyKillDeviceEntry(entry) {
+  if (entry.pid && isProcessAlive(entry.pid)) killProcess(entry.pid);
+  if (entry.bridge_pid && isProcessAlive(entry.bridge_pid)) killProcess(entry.bridge_pid);
+}
+async function notifyOffline(apiUrl, instanceId) {
+  if (!instanceId) return;
+  try {
+    await markInstanceOffline(apiUrl, instanceId);
+  } catch {
+  }
+}
+async function list(options) {
+  if (!options.local) {
+    console.log("Remote device listing requires platform API (use --local for local devices)");
+    return;
+  }
+  const state = await loadDeviceState();
+  if (state.devices.length === 0) {
+    console.log("No attached devices");
+    return;
+  }
+  const mgr = await getServiceManager();
+  const statusById = /* @__PURE__ */ new Map();
+  try {
+    const services = await mgr.list();
+    for (const s of services) {
+      statusById.set(s.id, s.running ? "running" : "stopped");
+    }
+  } catch {
+  }
+  console.log(
+    `${"SERIAL".padEnd(16)} ${"NAME".padEnd(20)} ${"STATUS".padEnd(12)} ${"HTTP".padEnd(6)} ${"VIDEO".padEnd(10)} INSTANCE`
+  );
+  for (const entry of state.devices) {
+    const agentState = statusById.get(deviceAgentTargetId(entry.serial)) ?? "unknown";
+    const videoId = entry.video_mode === "vnc" ? vncTargetId(entry.serial) : scrcpyTargetId(entry.serial);
+    const videoState = entry.video_mode === "none" ? "disabled" : statusById.get(videoId) ?? "unknown";
+    console.log(
+      `${entry.serial.padEnd(16)} ${entry.name.padEnd(20)} ${agentState.padEnd(
+        12
+      )} ${String(entry.http_port).padEnd(6)} ${videoState.padEnd(10)} ${entry.instance_id ?? "-"}`
+    );
+  }
+}
+async function exec(prompt2, options) {
+  const state = await loadDeviceState();
+  const entry = options.serial ? state.devices.find((d) => d.serial === options.serial) : state.devices[0];
+  if (!entry) {
+    throw new Error(options.serial ? `Device ${options.serial} not attached` : "No attached devices");
+  }
+  if (!entry.http_port) {
+    throw new Error(
+      `Device ${entry.serial} has no local HTTP port configured.
+Enable http_enabled in ~/.beeos/config.toml and re-attach.`
+    );
+  }
+  const p = getPlatformAdapter();
+  const url = `http://127.0.0.1:${entry.http_port}/prompt`;
+  console.log(`-> ${entry.serial} (local :${entry.http_port}): ${prompt2}`);
+  const resp = await p.fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ prompt: prompt2 })
+  });
+  if (!resp.ok) {
+    const body2 = await resp.text().catch(() => "");
+    throw new Error(`device-agent returned ${resp.status} \u2014 ${body2}`);
+  }
+  const body = await resp.json();
+  console.log(JSON.stringify(body, null, 2));
+}
+async function upgrade(options = {}) {
+  const reporter = new CliReporter();
+  await deviceRuntime.upgradeAgent(reporter);
+  if (options.bridges !== false) {
+    try {
+      await scrcpyBridgeRuntime.upgrade(reporter);
+    } catch (e) {
+      console.error(`scrcpy-bridge upgrade skipped: ${e}`);
+    }
+    try {
+      await vncBridgeRuntime.upgrade(reporter);
+    } catch (e) {
+      console.error(`vnc-bridge upgrade skipped: ${e}`);
+    }
+  }
+}
+async function tryBindDevice(pubkeyB64, name, cfg) {
+  const fp = fingerprintFromB64(pubkeyB64);
+  try {
+    const resp = await agentBind(
+      cfg.platform.api_url,
+      pubkeyB64,
+      fp,
+      "device",
+      name
+    );
+    if (resp.status === "bound") {
+      console.log(`  Already bound \u2014 instance: ${resp.instance_id}`);
+      return resp.instance_id ?? void 0;
+    }
+    if (resp.bind_id) {
+      const bindUrl = buildBindUrl(cfg.platform.dashboard_base_url, resp.bind_id);
+      await presentBindUrl(bindUrl, false);
+      console.log("");
+      console.log("  Waiting for bind approval (timeout: 10min)...");
+      try {
+        const instanceId = await pollUntilBound(
+          cfg.platform.api_url,
+          resp.bind_id,
+          6e5
+        );
+        console.log(`  Bind confirmed! Instance: ${instanceId}`);
+        return instanceId;
+      } catch (e) {
+        console.error(`  Bind polling stopped: ${e}`);
+      }
+    }
+    return void 0;
+  } catch (e) {
+    console.error(`  Platform bind failed: ${e}`);
+    return void 0;
+  }
+}
+function nextHttpPort(state, base) {
+  const used = new Set(state.devices.map((d) => d.http_port));
+  let port = base;
+  while (used.has(port)) port++;
+  return port;
+}
+var init_device2 = __esm({
+  "src/commands/device.ts"() {
+    "use strict";
+    init_dist();
+    init_progress2();
+    init_fallback_banner();
+  }
+});
+
+// src/index.ts
+init_dist();
+import { Command } from "commander";
+
+// src/node-adapter.ts
+import {
+  execFile as execFile6,
+  spawn as nodeSpawn
+} from "child_process";
+import fs6 from "fs";
+import fsp from "fs/promises";
+import net from "net";
+import os5 from "os";
+import path7 from "path";
+var NodePlatformAdapter = class {
+  // ── Filesystem ──────────────────────────────────────────
+  async readFile(filePath) {
+    return fsp.readFile(filePath, "utf-8");
+  }
+  async readFileBytes(filePath) {
+    const buf = await fsp.readFile(filePath);
+    return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+  }
+  async writeFile(filePath, content) {
+    await fsp.writeFile(filePath, content, "utf-8");
+  }
+  async writeFileBytes(filePath, content) {
+    await fsp.writeFile(filePath, content);
+  }
+  async exists(filePath) {
+    try {
+      await fsp.access(filePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async mkdir(dirPath) {
+    await fsp.mkdir(dirPath, { recursive: true });
+  }
+  async rm(filePath) {
+    await fsp.rm(filePath, { force: true });
+  }
+  async rmdir(dirPath) {
+    await fsp.rm(dirPath, { recursive: true, force: true });
+  }
+  async readdir(dirPath) {
+    return fsp.readdir(dirPath);
+  }
+  async chmod(filePath, mode) {
+    if (process.platform !== "win32") {
+      await fsp.chmod(filePath, mode);
+    }
+  }
+  async symlink(target, linkPath) {
+    try {
+      await fsp.symlink(target, linkPath);
+    } catch (e) {
+      if (process.platform === "win32") {
+        await fsp.symlink(target, linkPath, "junction");
+      } else {
+        throw e;
+      }
+    }
+  }
+  async readlink(linkPath) {
+    return fsp.readlink(linkPath);
   }
-  async readlink(linkPath) {
-    return fsp.readlink(linkPath);
-  }
   async copyFile(src, dest) {
     await fsp.copyFile(src, dest);
   }
@@ -1355,7 +4121,7 @@ var NodePlatformAdapter = class {
   exec(cmd, args, options) {
     return new Promise((resolve) => {
       const env = options?.env ? { ...process.env, ...options.env } : process.env;
-      execFile(
+      execFile6(
         cmd,
         args,
         {
@@ -1383,12 +4149,12 @@ var NodePlatformAdapter = class {
     let stdoutFd;
     let stderrFd;
     if (options?.stdoutFile) {
-      await fsp.mkdir(path.dirname(options.stdoutFile), { recursive: true });
-      stdoutFd = fs.openSync(options.stdoutFile, "a");
+      await fsp.mkdir(path7.dirname(options.stdoutFile), { recursive: true });
+      stdoutFd = fs6.openSync(options.stdoutFile, "a");
     }
     if (options?.stderrFile) {
-      await fsp.mkdir(path.dirname(options.stderrFile), { recursive: true });
-      stderrFd = options.stderrFile === options.stdoutFile ? stdoutFd : fs.openSync(options.stderrFile, "a");
+      await fsp.mkdir(path7.dirname(options.stderrFile), { recursive: true });
+      stderrFd = options.stderrFile === options.stdoutFile ? stdoutFd : fs6.openSync(options.stderrFile, "a");
     }
     const child = nodeSpawn(cmd, args, {
       cwd: options?.cwd,
@@ -1405,8 +4171,8 @@ var NodePlatformAdapter = class {
     if (options?.detached) {
       child.unref();
     }
-    if (stdoutFd != null) fs.closeSync(stdoutFd);
-    if (stderrFd != null && stderrFd !== stdoutFd) fs.closeSync(stderrFd);
+    if (stdoutFd != null) fs6.closeSync(stdoutFd);
+    if (stderrFd != null && stderrFd !== stdoutFd) fs6.closeSync(stderrFd);
     const pid = child.pid;
     if (pid == null) {
       throw new Error(`Failed to spawn process: ${cmd} ${args.join(" ")}`);
@@ -1452,10 +4218,10 @@ var NodePlatformAdapter = class {
   }
   // ── OS info ─────────────────────────────────────────────
   homeDir() {
-    return os.homedir();
+    return os5.homedir();
   }
   hostname() {
-    return os.hostname();
+    return os5.hostname();
   }
   platform() {
     return process.platform;
@@ -1473,55 +4239,28 @@ var NodePlatformAdapter = class {
   }
   // ── Path utilities ──────────────────────────────────────
   joinPath(...segments) {
-    return path.join(...segments);
+    return path7.join(...segments);
   }
   dirname(p) {
-    return path.dirname(p);
+    return path7.dirname(p);
   }
   basename(p) {
-    return path.basename(p);
-  }
-};
-
-// src/commands/start.ts
-import os2 from "os";
-
-// src/progress.ts
-import ora from "ora";
-var CliReporter = class {
-  spinner;
-  constructor() {
-    this.spinner = ora({ stream: process.stderr });
-  }
-  onStatus(message) {
-    if (this.spinner.isSpinning) {
-      this.spinner.text = message;
-    } else {
-      this.spinner.start(message);
-    }
-  }
-  onComplete(message) {
-    if (this.spinner.isSpinning) {
-      this.spinner.succeed(message);
-    } else {
-      console.log(`\u2713 ${message}`);
-    }
-  }
-  stop() {
-    if (this.spinner.isSpinning) {
-      this.spinner.stop();
-    }
+    return path7.basename(p);
   }
 };
 
 // src/commands/start.ts
-async function run(agentType, options) {
+init_dist();
+init_progress2();
+init_fallback_banner();
+import os6 from "os";
+async function run(agentFramework, options) {
   const p = getPlatformAdapter();
   await ensureDirs();
   const cfg = await loadOrCreateConfig();
   const reporter = new CliReporter();
-  if (agentType !== "openclaw") {
-    throw new Error(`Agent type '${agentType}' is not yet supported. Use 'openclaw'.`);
+  if (agentFramework !== "openclaw") {
+    throw new Error(`Agent framework '${agentFramework}' is not yet supported. Use 'openclaw'.`);
   }
   const identity = await loadOrCreateIdentity();
   const fp = fingerprint(identity);
@@ -1536,20 +4275,23 @@ async function run(agentType, options) {
   if (location.type === "managed") {
     binary = location.binary;
     home = location.home;
+    try {
+      await ensurePlugin(agentFramework, home, reporter);
+    } catch {
+    }
   } else if (location.type === "system") {
     binary = location.binary;
     home = location.home;
     isSystemHome = true;
     try {
-      const pluginDir = await downloadPlugin(openClawDriver.pluginPackage(), agentType, reporter);
-      await installPluginToHome(home, pluginDir, binary);
+      await ensurePlugin(agentFramework, home, reporter);
     } catch {
     }
     const systemToken = await readExistingGatewayToken(home);
     effectiveToken = systemToken ?? gwToken;
     await backupOpenclawConfig(home);
     if (await isGatewayRunning()) {
-      const ctx = {
+      const ctx2 = {
         agentHome: home,
         agentBinary: binary,
         keyFile,
@@ -1559,46 +4301,44 @@ async function run(agentType, options) {
         isSystemHome: true
       };
       try {
-        await configurePluginViaCli(ctx);
+        await configurePluginViaCli(ctx2);
       } catch {
       }
       try {
-        await restartGatewayViaCli(ctx);
+        await restartGatewayViaCli(ctx2);
       } catch {
       }
     }
   } else {
     reporter.onStatus(`Downloading ${openClawDriver.npmPackage()}...`);
-    await downloadAgent(openClawDriver.npmPackage(), options.version ?? void 0, agentType, reporter);
-    home = agentHome(agentType);
+    await downloadAgent(openClawDriver.npmPackage(), options.version ?? void 0, agentFramework, reporter);
+    home = agentHome(agentFramework);
     await p.mkdir(home);
-    await downloadPlugin(openClawDriver.pluginPackage(), agentType, reporter);
-    const managedBin = await managedBinary2(agentType);
+    await ensurePlugin(agentFramework, home, reporter);
+    const managedBin = await managedBinary2(agentFramework);
     if (!managedBin) throw new Error("agent binary not found after download");
     binary = managedBin;
   }
   reporter.stop();
+  const ctx = {
+    agentHome: home,
+    agentBinary: binary,
+    keyFile,
+    bridgeUrl: cfg.platform.bridge_url,
+    agentGatewayUrl: cfg.platform.api_url,
+    gatewayToken: effectiveToken,
+    isSystemHome
+  };
   let gatewayPid;
   if (!await isGatewayRunning()) {
-    const ctx = {
-      agentHome: home,
-      agentBinary: binary,
-      keyFile,
-      bridgeUrl: cfg.platform.bridge_url,
-      agentGatewayUrl: cfg.platform.api_url,
-      gatewayToken: effectiveToken,
-      isSystemHome
-    };
     if (isSystemHome) {
       await configurePluginViaCli(ctx);
     } else {
       await generateOpenclawConfig(ctx);
     }
-    const pid = await spawnOpenclaw(ctx);
-    await writePid(agentType, pid);
-    gatewayPid = pid;
+    gatewayPid = await installOpenclawService(ctx);
     let alive = false;
-    for (let i = 0; i < 10; i++) {
+    for (let i = 0; i < 20; i++) {
       await sleep2(500);
       if (await isGatewayRunning()) {
         alive = true;
@@ -1606,62 +4346,59 @@ async function run(agentType, options) {
       }
     }
     if (!alive) {
-      throw new Error("Agent gateway did not start within 5s");
+      throw new Error(
+        "Agent gateway did not start within 10s. Check the service logs: `beeos doctor` or ~/.beeos/logs/services/openclaw.log"
+      );
     }
   } else {
-    gatewayPid = await readPid(agentType) ?? void 0;
+    try {
+      gatewayPid = await installOpenclawService(ctx);
+    } catch {
+    }
   }
   const hostname = buildHostname();
   try {
-    const resp = await agentBind(cfg.platform.api_url, pubkey, fp, agentType, hostname);
-    if (resp.status === "bound") {
-      const instanceId = resp.instance_id ?? "";
-      await saveBindingInfo({ fingerprint: fp, instance_id: instanceId, bound_at: nowUnix() });
-      const result = {
+    const result = await bind({
+      apiUrl: cfg.platform.api_url,
+      dashboardBaseUrl: cfg.platform.dashboard_base_url,
+      publicKey: pubkey,
+      fingerprint: fp,
+      agentFramework,
+      hostname,
+      headless: options.browser === false
+    });
+    if (result.status === "bound") {
+      const out = {
         status: "bound",
         public_key: pubkey,
         fingerprint: fp,
         gateway_url: "http://127.0.0.1:18789",
         gateway_pid: gatewayPid,
         bridge_url: cfg.platform.bridge_url,
-        instance_id: instanceId
+        instance_id: result.instanceId
       };
-      if (options.json) {
-        console.log(JSON.stringify(result, null, 2));
-      } else {
-        console.log(`Agent bound to instance: ${instanceId}`);
-      }
+      if (options.json) console.log(JSON.stringify(out, null, 2));
+      else console.log(`Agent bound to instance: ${result.instanceId}`);
       return;
     }
-    if (resp.status === "pending") {
-      const bindId = resp.bind_id ?? "";
-      const bindUrl = buildBindUrl(cfg.platform.dashboard_base_url, bindId);
-      await removeBindingInfo();
-      if (options.json) {
-        const result = {
-          status: "pending",
-          public_key: pubkey,
-          fingerprint: fp,
-          bind_id: bindId,
-          bind_url: bindUrl,
-          qr_data: bindUrl,
-          gateway_url: "http://127.0.0.1:18789",
-          gateway_pid: gatewayPid,
-          bridge_url: cfg.platform.bridge_url
-        };
-        console.log(JSON.stringify(result, null, 2));
-        return;
-      }
-      await presentBindUrl(bindUrl, options.browser === false);
-      console.log("");
-      console.log("  Waiting for bind approval (timeout: 10min)...");
-      const instanceId = await pollUntilBound(cfg.platform.api_url, bindId, 6e5);
-      await saveBindingInfo({ fingerprint: fp, instance_id: instanceId, bound_at: nowUnix() });
-      console.log(`  Bind confirmed! Instance: ${instanceId}`);
+    if (result.status === "pending" && options.json) {
+      const out = {
+        status: "pending",
+        public_key: pubkey,
+        fingerprint: fp,
+        bind_id: result.bindId,
+        bind_url: result.bindUrl,
+        qr_data: result.bindUrl,
+        gateway_url: "http://127.0.0.1:18789",
+        gateway_pid: gatewayPid,
+        bridge_url: cfg.platform.bridge_url
+      };
+      console.log(JSON.stringify(out, null, 2));
+      return;
     }
   } catch (e) {
-    const cached = await loadBindingInfo();
-    if (cached && cached.fingerprint === fp) {
+    const cached2 = await loadBindingInfo();
+    if (cached2 && cached2.fingerprint === fp) {
       if (options.json) {
         console.log(JSON.stringify({
           status: "bound_offline",
@@ -1670,63 +4407,70 @@ async function run(agentType, options) {
           gateway_url: "http://127.0.0.1:18789",
           gateway_pid: gatewayPid,
           bridge_url: cfg.platform.bridge_url,
-          instance_id: cached.instance_id
+          instance_id: cached2.instance_id
         }, null, 2));
       } else {
-        console.log(`Agent running (offline, cached instance: ${cached.instance_id})`);
+        console.log(`Agent running (offline, cached instance: ${cached2.instance_id})`);
       }
       return;
     }
-    throw new Error(`Cannot reach platform to bind agent: ${e}`);
-  }
-}
-async function installPluginToHome(home, pluginDir, binary) {
-  const p = getPlatformAdapter();
-  const dest = p.joinPath(home, "extensions", "beeos-claw");
-  if (await p.exists(dest)) {
-    await p.rmdir(dest);
+    throw new Error(`Cannot reach platform to bind agent: ${e}`, { cause: e });
   }
-  await copyDirRecursive(pluginDir, dest);
 }
-async function copyDirRecursive(src, dst) {
-  const p = getPlatformAdapter();
-  await p.mkdir(dst);
-  const entries = await p.readdir(src);
-  for (const name of entries) {
-    const srcPath = p.joinPath(src, name);
-    const dstPath = p.joinPath(dst, name);
-    if (await p.isDirectory(srcPath)) {
-      await copyDirRecursive(srcPath, dstPath);
-    } else {
-      await p.copyFile(srcPath, dstPath);
+async function installOpenclawService(ctx) {
+  const mgr = await getServiceManager();
+  maybePrintFallbackBanner(mgr.kind);
+  const spec = buildOpenclawTargetSpec(ctx);
+  const status2 = await mgr.install(spec);
+  if (status2.pid) {
+    try {
+      await writePid("openclaw", status2.pid);
+    } catch {
     }
   }
+  return status2.pid ?? void 0;
 }
 function buildHostname() {
-  const machine = os2.hostname();
+  const machine = os6.hostname();
   const user = process.env.USER || process.env.USERNAME || "";
   return user ? `${user}@${machine}` : machine;
 }
-function nowUnix() {
-  return Math.floor(Date.now() / 1e3);
-}
 function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
 // src/commands/stop.ts
-async function run2(agentType) {
-  const pid = await readPid(agentType);
+init_dist();
+async function run2(agentFramework) {
+  const mgr = await getServiceManager();
+  let handled = false;
+  try {
+    const status2 = await mgr.status(agentFramework);
+    if (status2?.installed) {
+      await mgr.uninstall(agentFramework);
+      console.log(
+        `Stopped ${agentFramework} agent${status2.pid ? ` (pid ${status2.pid})` : ""}`
+      );
+      handled = true;
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.log(`Service stop failed: ${msg} \u2014 falling back to legacy PID kill`);
+  }
+  const pid = await readPid(agentFramework);
   if (pid == null) {
-    console.log(`No running ${agentType} agent found`);
+    if (!handled) console.log(`No running ${agentFramework} agent found`);
+    await removePid(agentFramework).catch(() => {
+    });
     return;
   }
   killProcess(pid);
-  await removePid(agentType);
-  console.log(`Stopped ${agentType} agent (pid ${pid})`);
+  await removePid(agentFramework);
+  if (!handled) console.log(`Stopped ${agentFramework} agent (pid ${pid})`);
 }
 
 // src/commands/status.ts
+init_dist();
 var KNOWN_RUNTIMES = ["openclaw", "device"];
 async function run3() {
   const home = beeoHome();
@@ -1744,10 +4488,27 @@ async function run3() {
     console.log("Identity: not yet created");
   }
   console.log("");
+  const mgr = await getServiceManager();
+  const reason = activeFallbackReason();
+  console.log(`Service manager: ${mgr.kind}${reason ? ` (${reason})` : ""}`);
+  let services = [];
+  try {
+    services = await mgr.list();
+  } catch {
+    services = [];
+  }
+  if (services.length === 0) {
+    console.log("  (no services registered)");
+  } else {
+    for (const s of services) console.log(`  ${formatService(s)}`);
+  }
+  console.log("");
+  const knownIds = new Set(services.map((s) => s.id));
   for (const rt of KNOWN_RUNTIMES) {
+    if (knownIds.has(rt)) continue;
     const pid = await readPid(rt);
     if (pid != null && isProcessAlive(pid)) {
-      console.log(`${rt}: running (pid ${pid})`);
+      console.log(`${rt}: running (pid ${pid}, legacy)`);
     } else if (pid != null) {
       console.log(`${rt}: stale pid ${pid} (process not alive)`);
     } else {
@@ -1755,31 +4516,40 @@ async function run3() {
     }
   }
 }
+function formatService(s) {
+  const state = s.running ? `\x1B[32mrunning\x1B[0m` : s.installed ? `\x1B[33mstopped\x1B[0m` : `\x1B[31muninstalled\x1B[0m`;
+  const pid = s.pid != null ? ` pid=${s.pid}` : "";
+  const exit = s.lastExitCode != null && s.lastExitCode !== 0 ? ` last_exit=${s.lastExitCode}` : "";
+  return `${s.id.padEnd(28)} ${state}${pid}${exit}`;
+}
 
 // src/commands/update.ts
-async function run4(agentType) {
+init_dist();
+init_progress2();
+async function run4(agentFramework) {
   const reporter = new CliReporter();
-  const pid = await readPid(agentType);
+  const pid = await readPid(agentFramework);
   const wasRunning = pid != null && isProcessAlive(pid);
   if (wasRunning) {
-    await run2(agentType);
+    await run2(agentFramework);
   }
-  if (agentType === "openclaw") {
+  if (agentFramework === "openclaw") {
     await openclawRuntime.update(reporter);
-  } else if (agentType === "device") {
+  } else if (agentFramework === "device") {
     await deviceRuntime.update(reporter);
   } else {
-    throw new Error(`Unknown agent type: ${agentType}`);
+    throw new Error(`Unknown agent framework: ${agentFramework}`);
   }
   reporter.stop();
-  console.log(`${agentType} updated`);
+  console.log(`${agentFramework} updated`);
   if (wasRunning) {
     console.log("Restarting agent...");
-    await run(agentType, { force: true });
+    await run(agentFramework, { force: true });
   }
 }
 
 // src/commands/bind-status.ts
+init_dist();
 async function run5(bindId, options) {
   const cfg = await loadOrCreateConfig();
   const resp = await getBindStatus(cfg.platform.api_url, bindId);
@@ -1813,320 +4583,483 @@ async function run5(bindId, options) {
   }
 }
 
-// src/commands/device.ts
-import lockfile from "proper-lockfile";
-function devicesPath() {
-  const p = getPlatformAdapter();
-  return p.joinPath(beeoHome(), "devices.json");
-}
-async function loadDeviceState() {
+// src/index.ts
+init_device2();
+
+// src/commands/init.ts
+init_dist();
+import readline from "readline";
+
+// src/commands/doctor.ts
+init_dist();
+import fs7 from "fs/promises";
+import path8 from "path";
+var LOG_SIZE_WARN_BYTES = 50 * 1024 * 1024;
+async function run6(options) {
+  const state = await detectExistingInstall();
+  const cfg = await loadOrCreateConfig();
   const p = getPlatformAdapter();
-  const path2 = devicesPath();
-  if (!await p.exists(path2)) return { devices: [] };
+  const mgr = await getServiceManager();
+  const fallbackReason2 = activeFallbackReason();
+  const serviceCheck = await mgr.selfCheck();
   try {
-    const raw = await p.readFile(path2);
-    return JSON.parse(raw);
+    await migrateLegacySupervisor(mgr);
   } catch {
-    return { devices: [] };
-  }
-}
-async function saveDeviceState(state) {
-  const p = getPlatformAdapter();
-  await p.writeFile(devicesPath(), JSON.stringify(state, null, 2));
-}
-async function withDeviceLock(fn) {
-  const p = getPlatformAdapter();
-  const path2 = devicesPath();
-  await p.mkdir(p.dirname(path2));
-  if (!await p.exists(path2)) {
-    await p.writeFile(path2, JSON.stringify({ devices: [] }));
   }
-  const release = await lockfile.lock(path2, { retries: 3 });
+  let services = [];
   try {
-    return await fn();
-  } finally {
-    await release();
+    services = await mgr.list();
+  } catch {
   }
-}
-async function attach(options) {
-  const cfg = await loadOrCreateConfig();
-  const reporter = new CliReporter();
-  if (options.all) {
-    return attachAll(cfg, reporter);
+  const tools = await collectToolStatus(p);
+  const warnings = [];
+  const hints = [];
+  if (!state.hasIdentity) {
+    warnings.push("identity keypair missing \u2014 will be generated on next bind");
   }
-  const serial = options.serial ?? await deviceRuntime.detectSingleDevice();
-  const name = options.name ?? serial;
-  const agentBin = await deviceRuntime.ensureAgent(reporter);
-  reporter.stop();
-  const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(serial);
-  const instanceId = await tryBindDevice(pubkeyB64, name, cfg);
-  if (!instanceId) {
-    console.error("Bind was not completed \u2014 device-agent will not start without a platform binding.");
-    console.error("Run `beeos device attach` again to retry.");
-    return;
+  if (state.openclaw.gatewayRunning && !state.openclaw.found) {
+    warnings.push("port 18789 is in use but no OpenClaw install detected \u2014 another app may conflict");
   }
-  await withDeviceLock(async () => {
-    const state = await loadDeviceState();
-    const idx = state.devices.findIndex((d) => d.serial === serial);
-    if (idx >= 0) {
-      if (isProcessAlive(state.devices[idx].pid)) {
-        console.log(`Device ${serial} is already attached (pid ${state.devices[idx].pid})`);
-        return;
-      }
-      console.error(`  Cleaning stale entry for ${serial} (pid ${state.devices[idx].pid} no longer alive)`);
-      state.devices.splice(idx, 1);
-    }
-    const httpPort = nextHttpPort(state, cfg.device.http_port);
-    const pid = await deviceRuntime.spawnForDevice(
-      serial,
-      agentBin,
-      cfg.platform.bridge_url,
-      cfg.device.http_enabled,
-      httpPort
+  if (state.devices.entries.length > 0 && services.length === 0) {
+    warnings.push(
+      "devices tracked via legacy devices.json \u2014 no OS services registered. Re-run `beeos device attach` to migrate them to the OS service manager."
     );
-    await sleep3(2e3);
-    if (!isProcessAlive(pid)) {
-      const p2 = getPlatformAdapter();
-      const logPath2 = p2.joinPath(beeoHome(), "logs", `device-${serial}.log`);
-      const tail = await readLogTail(logPath2, 20);
-      throw new Error(
-        `device-agent for ${serial} exited immediately (pid ${pid}). Check logs:
-  ${logPath2}
-
-${tail}`
+  }
+  if (fallbackReason2) {
+    warnings.push(
+      `No native OS service manager available (${fallbackReason2}) \u2014 using fallback, services WON'T persist across reboots.`
+    );
+  }
+  for (const w of serviceCheck.warnings) warnings.push(w);
+  for (const h of serviceCheck.hints) hints.push(h);
+  for (const s of services) {
+    if (!s.running && s.installed) {
+      warnings.push(
+        `service '${s.id}' is installed but not running \u2014 see log ${s.logFile}`
       );
     }
-    const keyFile = deviceRuntime.deviceKeyPath(serial);
-    state.devices.push({
-      serial,
-      name,
-      pid,
-      instance_id: instanceId,
-      key_file: keyFile,
-      http_port: httpPort
-    });
-    await saveDeviceState(state);
-    const p = getPlatformAdapter();
-    const logPath = p.joinPath(beeoHome(), "logs", `device-${serial}.log`);
-    console.log(`  logs: ${logPath}`);
+    if (s.lastExitCode !== null && s.lastExitCode !== 0) {
+      warnings.push(
+        `service '${s.id}' last exited with code ${s.lastExitCode} \u2014 see log ${s.logFile}`
+      );
+    }
+  }
+  if (!tools.adb.path) {
+    warnings.push(
+      "adb not found \u2014 `beeos device attach` will download Android platform-tools on first use"
+    );
+  }
+  if (!tools.python.path) {
+    warnings.push(
+      "python3 not found on PATH \u2014 device-agent uses a uv-managed interpreter; install python 3.11+ if uv is unavailable"
+    );
+  }
+  const bloatedLogs = await checkLogFileSizes();
+  for (const l of bloatedLogs) {
+    warnings.push(
+      `Service log large: ${path8.basename(l.path)} = ${formatBytes(l.size)}`
+    );
+    hints.push(`truncate safely: : > ${l.path}`);
+  }
+  if (options.json) {
     console.log(
-      `Attached device ${serial} (${name}) \u2014 pid ${pid} (http :${httpPort}) \u2014 instance ${instanceId}`
+      JSON.stringify(
+        {
+          platform: p.platform(),
+          arch: process.arch,
+          node: process.version,
+          beeosHome: state.beeosHome,
+          config: cfg,
+          state,
+          serviceManager: {
+            kind: mgr.kind,
+            available: serviceCheck.available,
+            fallbackReason: fallbackReason2,
+            services
+          },
+          tools,
+          warnings,
+          hints
+        },
+        null,
+        2
+      )
     );
-  });
-}
-async function attachAll(cfg, reporter) {
-  const devices = await deviceRuntime.listAdbDevices();
-  if (devices.length === 0) {
-    console.log("No ADB devices found");
     return;
   }
-  const agentBin = await deviceRuntime.ensureAgent(reporter);
-  reporter.stop();
-  await withDeviceLock(async () => {
-    const state = await loadDeviceState();
-    state.devices = state.devices.filter((d) => isProcessAlive(d.pid));
-    const alreadyAttached = new Set(state.devices.map((d) => d.serial));
-    let count = 0;
-    for (const device of devices) {
-      if (alreadyAttached.has(device.serial)) continue;
-      const httpPort = nextHttpPort(state, cfg.device.http_port);
-      try {
-        const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(device.serial);
-        const instanceId = await tryBindDevice(pubkeyB64, device.serial, cfg);
-        if (!instanceId) {
-          console.error(`  Skipping ${device.serial} \u2014 bind not completed`);
-          continue;
-        }
-        const pid = await deviceRuntime.spawnForDevice(
-          device.serial,
-          agentBin,
-          cfg.platform.bridge_url,
-          cfg.device.http_enabled,
-          httpPort
-        );
-        await sleep3(2e3);
-        if (!isProcessAlive(pid)) {
-          const p = getPlatformAdapter();
-          const logPath = p.joinPath(beeoHome(), "logs", `device-${device.serial}.log`);
-          const tail = await readLogTail(logPath, 10);
-          console.error(`device-agent for ${device.serial} exited immediately (pid ${pid}): ${tail}`);
-          continue;
-        }
-        const keyFile = deviceRuntime.deviceKeyPath(device.serial);
-        state.devices.push({
-          serial: device.serial,
-          name: device.serial,
-          pid,
-          instance_id: instanceId,
-          key_file: keyFile,
-          http_port: httpPort
-        });
-        console.log(`Attached device ${device.serial} \u2014 pid ${pid} (http :${httpPort})`);
-        count++;
-      } catch (e) {
-        console.error(`Failed to attach ${device.serial}: ${e}`);
-      }
+  console.log("");
+  console.log(`  OS/Arch  : ${p.platform()}/${process.arch}`);
+  console.log(`  Node.js  : ${process.version}`);
+  console.log(`  API URL  : ${cfg.platform.api_url}`);
+  console.log(`  Bridge   : ${cfg.platform.bridge_url}`);
+  console.log("");
+  for (const line of summarizeExistingInstall(state)) {
+    console.log(`  ${line}`);
+  }
+  console.log(
+    `  Service manager: ${mgr.kind}${fallbackReason2 ? " (fallback)" : ""} \u2014 ${services.length} service(s) registered`
+  );
+  for (const s of services) {
+    const status2 = s.running ? "running" : s.installed ? "stopped" : "uninstalled";
+    const pid = s.pid != null ? ` pid=${s.pid}` : "";
+    console.log(`    - ${s.id.padEnd(28)} ${status2}${pid}`);
+  }
+  console.log(`  adb          : ${tools.adb.path ?? "not found"}`);
+  console.log(`  python3      : ${tools.python.path ?? "not found"}`);
+  console.log(`  scrcpy-bridge: ${tools.scrcpyBridge.path ?? "not installed (auto on attach)"}`);
+  console.log(`  vnc-bridge   : ${tools.vncBridge.path ?? "not installed (auto on --vnc-host)"}`);
+  console.log("");
+  if (warnings.length > 0) {
+    console.log("  Warnings:");
+    for (const w of warnings) {
+      console.log(`    - ${w}`);
     }
-    await saveDeviceState(state);
-    console.log(`Attached ${count} new device(s)`);
-  });
+    console.log("");
+  } else {
+    console.log("  No warnings \u2014 machine looks good.\n");
+  }
+  if (hints.length > 0) {
+    console.log("  Hints:");
+    for (const h of hints) {
+      console.log(`    $ ${h}`);
+    }
+    console.log("");
+  }
 }
-async function detach(options) {
-  const cfg = await loadOrCreateConfig();
-  await withDeviceLock(async () => {
-    const state = await loadDeviceState();
-    if (options.all) {
-      for (const entry2 of state.devices) {
-        killProcess(entry2.pid);
-        await notifyOffline(cfg.platform.api_url, entry2.instance_id);
+async function collectToolStatus(p) {
+  const [adbPath, pythonPath, scrcpyPath, vncPath] = await Promise.all([
+    findAdb().catch(() => null),
+    findPython2(p).catch(() => null),
+    scrcpyBridgeRuntime.findBinary().catch(() => null),
+    vncBridgeRuntime.findBinary().catch(() => null)
+  ]);
+  return {
+    adb: { path: adbPath },
+    python: { path: pythonPath },
+    scrcpyBridge: { path: scrcpyPath },
+    vncBridge: { path: vncPath }
+  };
+}
+async function findPython2(p) {
+  const whichCmd = p.platform() === "win32" ? "where" : "which";
+  for (const bin of ["python3", "python"]) {
+    try {
+      const r = await p.exec(whichCmd, [bin]);
+      if (r.code === 0 && r.stdout.trim()) {
+        return r.stdout.trim().split("\n")[0].trim();
       }
-      const count = state.devices.length;
-      state.devices = [];
-      await saveDeviceState(state);
-      console.log(`Detached ${count} device(s)`);
-      return;
-    }
-    if (!options.serial) {
-      throw new Error("Specify --serial or use --all");
+    } catch {
     }
-    const idx = state.devices.findIndex((d) => d.serial === options.serial);
-    if (idx < 0) throw new Error(`Device ${options.serial} not found`);
-    const entry = state.devices.splice(idx, 1)[0];
-    killProcess(entry.pid);
-    await notifyOffline(cfg.platform.api_url, entry.instance_id);
-    await saveDeviceState(state);
-    console.log(`Detached device ${options.serial}`);
-  });
+  }
+  return null;
 }
-async function notifyOffline(apiUrl, instanceId) {
-  if (!instanceId) return;
+async function checkLogFileSizes() {
+  const dir = path8.join(beeoHome(), "logs", "services");
+  let entries;
   try {
-    await markInstanceOffline(apiUrl, instanceId);
+    entries = await fs7.readdir(dir);
   } catch {
+    return [];
+  }
+  const bloated = [];
+  for (const name of entries) {
+    if (!name.endsWith(".log")) continue;
+    const full = path8.join(dir, name);
+    try {
+      const st = await fs7.stat(full);
+      if (st.isFile() && st.size >= LOG_SIZE_WARN_BYTES) {
+        bloated.push({ path: full, size: st.size });
+      }
+    } catch {
+    }
   }
+  return bloated;
 }
-async function list(options) {
-  if (options.local) {
-    const state = await loadDeviceState();
-    if (state.devices.length === 0) {
-      console.log("No attached devices");
-      return;
+function formatBytes(n) {
+  if (n >= 1024 * 1024 * 1024) return `${(n / (1024 * 1024 * 1024)).toFixed(1)}GB`;
+  if (n >= 1024 * 1024) return `${(n / (1024 * 1024)).toFixed(0)}MB`;
+  if (n >= 1024) return `${(n / 1024).toFixed(0)}KB`;
+  return `${n}B`;
+}
+
+// src/commands/init.ts
+init_fallback_banner();
+async function run7(options) {
+  await ensureDirs();
+  try {
+    const mgr = await getServiceManager();
+    const mig = await migrateLegacySupervisor(mgr);
+    if (!options.json && mig.ran) {
+      if (mig.errors.length === 0) {
+        console.log(
+          `  Migrated ${mig.migrated} service(s) from the legacy supervisor to ${mgr.kind}.`
+        );
+      } else {
+        console.log(
+          `  Migrated ${mig.migrated} service(s) with ${mig.errors.length} error(s); backup at ${mig.backupPath ?? "(unknown)"}.`
+        );
+        for (const e of mig.errors) console.log(`    - ${e.id}: ${e.error}`);
+      }
     }
-    console.log(`${"SERIAL".padEnd(16)} ${"NAME".padEnd(20)} ${"STATUS".padEnd(12)} PID`);
-    for (const entry of state.devices) {
-      const status = isProcessAlive(entry.pid) ? "running" : "stopped";
-      console.log(
-        `${entry.serial.padEnd(16)} ${entry.name.padEnd(20)} ${status.padEnd(12)} ${entry.pid}`
-      );
+  } catch (e) {
+    if (!options.json) {
+      console.log(`  (legacy supervisor migration skipped: ${e instanceof Error ? e.message : String(e)})`);
     }
+  }
+  if (options.device) {
+    const { attach: attach2 } = await Promise.resolve().then(() => (init_device2(), device_exports));
+    await attach2({});
+    return;
+  }
+  const state = await detectExistingInstall();
+  if (options.json) {
+    await run6({ json: true });
   } else {
-    console.log("Remote device listing requires platform API (use --local for local devices)");
+    printBanner();
+    for (const line of summarizeExistingInstall(state)) {
+      console.log(`  ${line}`);
+    }
+    console.log("");
   }
-}
-async function exec(prompt, options) {
-  const state = await loadDeviceState();
-  const entry = options.serial ? state.devices.find((d) => d.serial === options.serial) : state.devices[0];
-  if (!entry) {
-    throw new Error(options.serial ? `Device ${options.serial} not attached` : "No attached devices");
+  const decision = await decideAction(state, options);
+  if (decision === "skip") {
+    console.log("Nothing to do. Run `beeos init` again or `beeos device attach` when ready.");
+    return;
   }
-  if (!entry.http_port) {
+  if (decision === "upgrade") {
+    console.log("Upgrading / ensuring OpenClaw is running...\n");
+  }
+  if (decision === "rebind-new-key") {
+    await rotateIdentity();
+  }
+  if (decision === "rebind-keep-key" || decision === "rebind-new-key") {
+    await removeBindingInfo();
+  }
+  const framework = options.framework ?? "openclaw";
+  if (framework !== "openclaw") {
     throw new Error(
-      `Device ${entry.serial} has no local HTTP port configured.
-Enable http_enabled in ~/.beeos/config.toml and re-attach.`
+      `Agent framework '${framework}' is not yet supported. Only 'openclaw' is available today.`
     );
   }
-  const p = getPlatformAdapter();
-  const url = `http://127.0.0.1:${entry.http_port}/prompt`;
-  console.log(`-> ${entry.serial} (local :${entry.http_port}): ${prompt}`);
-  const resp = await p.fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ prompt })
+  await run(framework, {
+    force: true,
+    json: options.json,
+    browser: options.browser !== false
   });
-  if (!resp.ok) {
-    const body2 = await resp.text().catch(() => "");
-    throw new Error(`device-agent returned ${resp.status} \u2014 ${body2}`);
+  if (!options.json && !options.skipServicePrompt) {
+    await maybePromptServiceInstall();
+  }
+  if (!options.json) {
+    printNextSteps();
   }
-  const body = await resp.json();
-  console.log(JSON.stringify(body, null, 2));
 }
-async function upgrade() {
-  const reporter = new CliReporter();
-  await deviceRuntime.upgradeAgent(reporter);
+async function decideAction(state, options) {
+  const choice = inferInitChoices(state);
+  if (choice.options.length === 1) {
+    return choice.defaultDecision;
+  }
+  if (options.yes || options.json) {
+    return choice.defaultDecision;
+  }
+  if (!process.stdin.isTTY) {
+    return choice.defaultDecision;
+  }
+  console.log("Detected existing install. Choose an action:");
+  choice.options.forEach((d, i) => {
+    const marker = d === choice.defaultDecision ? "*" : " ";
+    console.log(`  ${marker} [${i + 1}] ${initDecisionLabel(d)}`);
+  });
+  console.log("");
+  const answer = await prompt(`Choose [1-${choice.options.length}] (default ${choice.options.indexOf(choice.defaultDecision) + 1}): `);
+  const trimmed = answer.trim();
+  if (!trimmed) return choice.defaultDecision;
+  const idx = parseInt(trimmed, 10);
+  if (!Number.isFinite(idx) || idx < 1 || idx > choice.options.length) {
+    return choice.defaultDecision;
+  }
+  return choice.options[idx - 1];
 }
-async function tryBindDevice(pubkeyB64, name, cfg) {
-  const fp = fingerprintFromB64(pubkeyB64);
+async function maybePromptServiceInstall() {
   try {
-    const resp = await agentBind(
-      cfg.platform.api_url,
-      pubkeyB64,
-      fp,
-      "device",
-      name
-    );
-    if (resp.status === "bound") {
-      console.log(`  Already bound \u2014 instance: ${resp.instance_id}`);
-      return resp.instance_id ?? void 0;
-    }
-    if (resp.bind_id) {
-      const bindUrl = buildBindUrl(cfg.platform.dashboard_base_url, resp.bind_id);
-      await presentBindUrl(bindUrl, false);
-      console.log("");
-      console.log("  Waiting for bind approval (timeout: 10min)...");
-      try {
-        const instanceId = await pollUntilBound(
-          cfg.platform.api_url,
-          resp.bind_id,
-          6e5
-        );
-        console.log(`  Bind confirmed! Instance: ${instanceId}`);
-        return instanceId;
-      } catch (e) {
-        console.error(`  Bind polling stopped: ${e}`);
-      }
+    const mgr = await getServiceManager();
+    maybePrintFallbackBanner(mgr.kind);
+    const check = await mgr.selfCheck();
+    if (!check.available) {
+      console.log(`  \u26A0 Service manager '${mgr.kind}' is not fully available \u2014 persistence limited.`);
     }
-    return void 0;
+    for (const w of check.warnings) console.log(`  ! ${w}`);
+    for (const h of check.hints) console.log(`  $ ${h}`);
   } catch (e) {
-    console.error(`  Platform bind failed: ${e}`);
-    return void 0;
+    console.log(`  (service-manager self-check skipped: ${e instanceof Error ? e.message : String(e)})`);
   }
 }
-function nextHttpPort(state, base) {
-  const used = new Set(state.devices.map((d) => d.http_port));
-  let port = base;
-  while (used.has(port)) port++;
-  return port;
-}
-async function readLogTail(path2, lines) {
+async function rotateIdentity() {
   const p = getPlatformAdapter();
+  const home = beeoHome();
+  const identityDir = p.joinPath(home, "identity");
+  const keypair = p.joinPath(identityDir, "keypair.json");
+  const fp = p.joinPath(identityDir, "fingerprint");
+  if (!await p.exists(keypair)) return;
+  const ts = Math.floor(Date.now() / 1e3);
+  const backup = p.joinPath(identityDir, `keypair.json.backup-${ts}`);
+  try {
+    await p.copyFile(keypair, backup);
+  } catch {
+  }
   try {
-    const content = await p.readFile(path2);
-    const allLines = content.split("\n");
-    const start = Math.max(0, allLines.length - lines);
-    return allLines.slice(start).join("\n");
+    await p.rm(keypair);
   } catch {
-    return "(could not read log file)";
   }
+  try {
+    await p.rm(fp);
+  } catch {
+  }
+  console.log(`Rotated identity. Previous keypair saved at ${backup}`);
 }
-function sleep3(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function printBanner() {
+  console.log("");
+  console.log("  BeeOS init");
+  console.log("");
+}
+function printNextSteps() {
+  console.log("");
+  console.log("Next steps:");
+  console.log("  beeos status                  # show running agents");
+  console.log("  beeos device attach           # bind a physical Android device");
+  console.log("  beeos doctor                  # health check & diagnostics");
+  console.log("");
+}
+function prompt(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+
+// src/commands/service.ts
+init_dist();
+async function install2(options) {
+  const mgr = await getServiceManager();
+  const check = await mgr.selfCheck();
+  const reason = activeFallbackReason();
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: check.available,
+          manager: mgr.kind,
+          fallbackReason: reason,
+          warnings: check.warnings,
+          hints: check.hints
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`Service manager: ${mgr.kind}${reason ? ` (fallback \u2014 ${reason})` : ""}`);
+  if (check.available) {
+    console.log("  \u2713 available \u2014 BeeOS services will persist across reboots.");
+  } else {
+    console.log("  \u2717 not available \u2014 using fallback process runner (NO persistence).");
+  }
+  for (const w of check.warnings) console.log(`  ! ${w}`);
+  for (const h of check.hints) console.log(`  $ ${h}`);
+  console.log(
+    "\nNote: per-target services are registered automatically by `beeos start` / `beeos device attach`."
+  );
+}
+async function uninstall(options) {
+  const mgr = await getServiceManager();
+  let services = [];
+  try {
+    services = await mgr.list();
+  } catch {
+    services = [];
+  }
+  const removed = [];
+  const errors = [];
+  for (const s of services) {
+    try {
+      await mgr.uninstall(s.id);
+      removed.push(s.id);
+    } catch (e) {
+      errors.push({ id: s.id, error: e instanceof Error ? e.message : String(e) });
+    }
+  }
+  if (options.json) {
+    console.log(JSON.stringify({ removed, errors }, null, 2));
+    return;
+  }
+  if (removed.length === 0 && errors.length === 0) {
+    console.log("No BeeOS services registered.");
+  } else {
+    for (const id of removed) console.log(`  uninstalled ${id}`);
+    for (const err of errors) console.log(`  ! failed to uninstall ${err.id}: ${err.error}`);
+  }
+}
+async function status(options) {
+  const mgr = await getServiceManager();
+  const reason = activeFallbackReason();
+  let services = [];
+  try {
+    services = await mgr.list();
+  } catch {
+    services = [];
+  }
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        { manager: mgr.kind, fallbackReason: reason, services },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`Service manager: ${mgr.kind}${reason ? ` (fallback)` : ""}`);
+  if (services.length === 0) {
+    console.log("  (no services registered)");
+    return;
+  }
+  for (const s of services) {
+    const state = s.running ? "running" : s.installed ? "stopped" : "uninstalled";
+    const pid = s.pid != null ? ` pid=${s.pid}` : "";
+    console.log(`  ${s.id.padEnd(28)} ${state}${pid}`);
+  }
 }
 
 // src/index.ts
 setPlatformAdapter(new NodePlatformAdapter());
 var program = new Command();
 program.name("beeos").version("1.0.0").description("BeeOS \u2014 run AI agents from your desktop");
-program.command("start").description("Install and start an agent").argument("<agent_type>", "Agent type to start (e.g. openclaw)").option("--version <version>", "Pin to a specific version instead of latest").option("--force", "Skip confirmation prompts", false).option("--json", "Output machine-readable JSON to stdout (implies --force)", false).option("--no-browser", "Don't auto-open browser for bind confirmation").action(run);
-program.command("stop").description("Stop a running agent").argument("<agent_type>", "Agent type to stop").action(run2);
+program.command("init").description("One-shot install + bind flow (default entry from the curl installer)").option("--framework <name>", "Agent framework to install (default: openclaw)").option("--yes", "Non-interactive \u2014 accept the default action", false).option("--json", "Output machine-readable JSON (implies --yes)", false).option("--no-browser", "Don't auto-open a browser for bind confirmation").option("--headless", "Never open a browser (use terminal QR only)", false).option("--skip-service-prompt", "Skip the system-service install prompt", false).option("--device", "Jump straight into `beeos device attach` instead", false).action((opts) => run7(opts));
+program.command("doctor").description("Inspect local BeeOS state (install, binding, services, warnings)").option("--json", "Output machine-readable JSON", false).action((opts) => run6(opts));
+var serviceCmd = program.command("service").description("Inspect and manage the OS-native service manager (launchd / systemd --user / Task Scheduler)");
+serviceCmd.command("install").description("Verify the OS service manager is available (per-target services install automatically)").option("--json", "Output machine-readable JSON", false).action((opts) => install2(opts));
+serviceCmd.command("uninstall").description("Uninstall every BeeOS-managed OS service").option("--json", "Output machine-readable JSON", false).action((opts) => uninstall(opts));
+serviceCmd.command("status").description("List every BeeOS-managed OS service").option("--json", "Output machine-readable JSON", false).action((opts) => status(opts));
+program.command("start").description("Install and start an agent").argument("<agent_type>", "Agent type to start (e.g. openclaw)").option("--version <version>", "Pin to a specific version instead of latest").option("--force", "Skip confirmation prompts", false).option("--json", "Output machine-readable JSON to stdout (implies --force)", false).option("--no-browser", "Don't auto-open browser for bind confirmation").action((agentFramework, options) => run(agentFramework, options));
+program.command("stop").description("Stop a running agent").argument("<agent_type>", "Agent type to stop").action((agentFramework) => run2(agentFramework));
 program.command("status").description("Show status of managed agents").action(run3);
-program.command("update").description("Update an agent to the latest version").argument("<agent_type>", "Agent type to update").action(run4);
+program.command("update").description("Update an agent to the latest version").argument("<agent_type>", "Agent type to update").action((agentFramework) => run4(agentFramework));
 program.command("bind-status").description("Check agent binding status").argument("<bind_id>", "Bind session ID returned by `beeos start --json`").option("--json", "Output machine-readable JSON", false).action(run5);
 var deviceCmd = program.command("device").description("Manage device agents (Android/Desktop/ChromeOS)");
-deviceCmd.command("attach").description("Attach an ADB-connected device as an AI agent").option("--serial <serial>", "ADB device serial number").option("--name <name>", "Human-readable device name").option("--all", "Attach all connected ADB devices", false).action(attach);
+deviceCmd.command("attach").description("Attach an ADB-connected device as an AI agent").option("--serial <serial>", "ADB device serial number").option("--name <name>", "Human-readable device name").option("--all", "Attach all connected ADB devices", false).option(
+  "--no-video",
+  "Skip the scrcpy-bridge WebRTC sidecar; only run device-agent. Useful when iterating on ACP / Python code without the video stream."
+).option(
+  "--vnc-host <host>",
+  "Use vnc-bridge against a VNC server at this host (desktop/Linux/macOS). Implies video mode = vnc instead of scrcpy."
+).option("--vnc-port <port>", "VNC TCP port (default 5900)", (v) => Number(v)).option("--vnc-password <password>", "VNC password (forwarded via env)").action(attach);
 deviceCmd.command("detach").description("Detach a device agent").option("--serial <serial>", "ADB device serial number").option("--all", "Detach all devices", false).action(detach);
 deviceCmd.command("list").description("List attached devices").option("--local", "Only show locally running device agents", false).action(list);
 deviceCmd.command("exec").description("Send a natural language command to a device").option("--serial <serial>", "ADB device serial number").argument("<prompt>", "The command/prompt to execute").action(exec);
-deviceCmd.command("upgrade").description("Upgrade the device-agent to the latest version").action(upgrade);
+deviceCmd.command("upgrade").description("Upgrade the device-agent (and scrcpy/vnc bridges) to the latest version").option("--no-bridges", "Skip upgrading scrcpy-bridge / vnc-bridge binaries").action(upgrade);
 program.parseAsync(process.argv).catch((err) => {
   console.error(err.message);
   process.exit(1);