@botiverse/raft-computer 0.0.57 → 0.0.59

package/dist/index.js

@@ -5874,7 +5874,7 @@ var require_connect = __commonJS({
       const sessionCache = new SessionCache(maxCachedSessions == null ? 100 : maxCachedSessions);
       timeout = timeout == null ? 1e4 : timeout;
       allowH2 = allowH2 != null ? allowH2 : false;
-      return function connect({ hostname, host, protocol, port, servername, localAddress, httpSocket }, callback) {
+      return function connect3({ hostname, host, protocol, port, servername, localAddress, httpSocket }, callback) {
         let socket;
         if (protocol === "https:") {
           if (!tls) {
@@ -11552,7 +11552,7 @@ var require_client = __commonJS({
         tls,
         strictContentLength,
         maxCachedSessions,
-        connect: connect2,
+        connect: connect4,
         maxRequestsPerClient,
         localAddress,
         maxResponseSize,
@@ -11609,7 +11609,7 @@ var require_client = __commonJS({
         if (bodyTimeout != null && (!Number.isInteger(bodyTimeout) || bodyTimeout < 0)) {
           throw new InvalidArgumentError2("bodyTimeout must be a positive integer or zero");
         }
-        if (connect2 != null && typeof connect2 !== "function" && typeof connect2 !== "object") {
+        if (connect4 != null && typeof connect4 !== "function" && typeof connect4 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
@@ -11643,8 +11643,8 @@ var require_client = __commonJS({
           throw new InvalidArgumentError2("pingInterval must be a positive integer, greater or equal to 0");
         }
         super();
-        if (typeof connect2 !== "function") {
-          connect2 = buildConnector({
+        if (typeof connect4 !== "function") {
+          connect4 = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
@@ -11652,14 +11652,14 @@ var require_client = __commonJS({
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect2
+            ...connect4
           });
         } else if (socketPath != null) {
-          const customConnect = connect2;
-          connect2 = (opts, callback) => customConnect({ ...opts, socketPath }, callback);
+          const customConnect = connect4;
+          connect4 = (opts, callback) => customConnect({ ...opts, socketPath }, callback);
         }
         this[kUrl] = util.parseOrigin(url);
-        this[kConnector] = connect2;
+        this[kConnector] = connect4;
         this[kPipelining] = pipelining != null ? pipelining : 1;
         this[kMaxHeadersSize] = maxHeaderSize;
         this[kKeepAliveDefaultTimeout] = keepAliveTimeout == null ? 4e3 : keepAliveTimeout;
@@ -11717,7 +11717,7 @@ var require_client = __commonJS({
         );
       }
       [kConnect](cb) {
-        connect(this);
+        connect3(this);
         this.once("connect", cb);
       }
       [kDispatch](opts, handler) {
@@ -11779,7 +11779,7 @@ var require_client = __commonJS({
         assert(client[kSize] === 0);
       }
     }
-    function connect(client) {
+    function connect3(client) {
       assert(!client[kConnecting]);
       assert(!client[kHTTPContext]);
       let { host, hostname, protocol, port } = client[kUrl];
@@ -11958,7 +11958,7 @@ var require_client = __commonJS({
           return;
         }
         if (!client[kHTTPContext]) {
-          connect(client);
+          connect3(client);
           return;
         }
         if (client[kHTTPContext].destroyed) {
@@ -12257,7 +12257,7 @@ var require_pool = __commonJS({
       constructor(origin, {
         connections,
         factory = defaultFactory,
-        connect,
+        connect: connect3,
         connectTimeout,
         tls,
         maxCachedSessions,
@@ -12274,24 +12274,24 @@ var require_pool = __commonJS({
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
         }
-        if (connect != null && typeof connect !== "function" && typeof connect !== "object") {
+        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
-        if (typeof connect !== "function") {
-          connect = buildConnector({
+        if (typeof connect3 !== "function") {
+          connect3 = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect
+            ...connect3
           });
         }
         super();
         this[kConnections] = connections || null;
         this[kUrl] = util.parseOrigin(origin);
-        this[kOptions] = { ...util.deepClone(options), connect, allowH2, clientTtl, socketPath };
+        this[kOptions] = { ...util.deepClone(options), connect: connect3, allowH2, clientTtl, socketPath };
         this[kOptions].interceptors = options.interceptors ? { ...options.interceptors } : void 0;
         this[kFactory] = factory;
         this.on("connect", (origin2, targets) => {
@@ -12510,7 +12510,7 @@ var require_round_robin_pool = __commonJS({
       constructor(origin, {
         connections,
         factory = defaultFactory,
-        connect,
+        connect: connect3,
         connectTimeout,
         tls,
         maxCachedSessions,
@@ -12527,24 +12527,24 @@ var require_round_robin_pool = __commonJS({
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
         }
-        if (connect != null && typeof connect !== "function" && typeof connect !== "object") {
+        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
-        if (typeof connect !== "function") {
-          connect = buildConnector({
+        if (typeof connect3 !== "function") {
+          connect3 = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect
+            ...connect3
           });
         }
         super();
         this[kConnections] = connections || null;
         this[kUrl] = util.parseOrigin(origin);
-        this[kOptions] = { ...util.deepClone(options), connect, allowH2, clientTtl, socketPath };
+        this[kOptions] = { ...util.deepClone(options), connect: connect3, allowH2, clientTtl, socketPath };
         this[kOptions].interceptors = options.interceptors ? { ...options.interceptors } : void 0;
         this[kFactory] = factory;
         this[kIndex] = -1;
@@ -12619,21 +12619,21 @@ var require_agent = __commonJS({
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
     var Agent = class extends DispatcherBase {
-      constructor({ factory = defaultFactory, maxOrigins = Infinity, connect, ...options } = {}) {
+      constructor({ factory = defaultFactory, maxOrigins = Infinity, connect: connect3, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
         }
-        if (connect != null && typeof connect !== "function" && typeof connect !== "object") {
+        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
         if (typeof maxOrigins !== "number" || Number.isNaN(maxOrigins) || maxOrigins <= 0) {
           throw new InvalidArgumentError2("maxOrigins must be a number greater than 0");
         }
         super();
-        if (connect && typeof connect !== "function") {
-          connect = { ...connect };
+        if (connect3 && typeof connect3 !== "function") {
+          connect3 = { ...connect3 };
         }
-        this[kOptions] = { ...util.deepClone(options), maxOrigins, connect };
+        this[kOptions] = { ...util.deepClone(options), maxOrigins, connect: connect3 };
         this[kFactory] = factory;
         this[kClients] = /* @__PURE__ */ new Map();
         this[kOrigins] = /* @__PURE__ */ new Set();
@@ -13432,16 +13432,16 @@ var require_proxy_agent = __commonJS({
     }
     var Http1ProxyWrapper = class extends DispatcherBase {
       #client;
-      constructor(proxyUrl, { headers = {}, connect, factory }) {
+      constructor(proxyUrl, { headers = {}, connect: connect3, factory }) {
         if (!proxyUrl) {
           throw new InvalidArgumentError2("Proxy URL is mandatory");
         }
         super();
         this[kProxyHeaders] = headers;
         if (factory) {
-          this.#client = factory(proxyUrl, { connect });
+          this.#client = factory(proxyUrl, { connect: connect3 });
         } else {
-          this.#client = new Client(proxyUrl, { connect });
+          this.#client = new Client(proxyUrl, { connect: connect3 });
         }
       }
       [kDispatch](opts, handler) {
@@ -13502,7 +13502,7 @@ var require_proxy_agent = __commonJS({
         } else if (username && password) {
           this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`;
         }
-        const connect = buildConnector({ ...opts.proxyTls });
+        const connect3 = buildConnector({ ...opts.proxyTls });
         this[kConnectEndpoint] = buildConnector({ ...opts.requestTls });
         const agentFactory = opts.factory || defaultAgentFactory;
         const factory = (origin2, options) => {
@@ -13510,7 +13510,7 @@ var require_proxy_agent = __commonJS({
           if (this[kProxy].protocol === "socks5:" || this[kProxy].protocol === "socks:") {
             return new Socks5ProxyAgent(this[kProxy].uri, {
               headers: this[kProxyHeaders],
-              connect,
+              connect: connect3,
               factory: agentFactory,
               username: opts.username || username,
               password: opts.password || password,
@@ -13520,7 +13520,7 @@ var require_proxy_agent = __commonJS({
           if (!this[kTunnelProxy] && protocol2 === "http:" && this[kProxy].protocol === "http:") {
             return new Http1ProxyWrapper(this[kProxy].uri, {
               headers: this[kProxyHeaders],
-              connect,
+              connect: connect3,
               factory: agentFactory
             });
           }
@@ -13529,7 +13529,7 @@ var require_proxy_agent = __commonJS({
         if (protocol === "socks5:" || protocol === "socks:") {
           this[kClient] = null;
         } else {
-          this[kClient] = clientFactory(url, { connect });
+          this[kClient] = clientFactory(url, { connect: connect3 });
         }
         this[kAgent] = new Agent({
           ...opts,
@@ -14139,7 +14139,7 @@ var require_h2c_client = __commonJS({
             "h2c-client: Only h2c protocol is supported"
           );
         }
-        const { connect, maxConcurrentStreams, pipelining, ...opts } = clientOpts ?? {};
+        const { connect: connect3, maxConcurrentStreams, pipelining, ...opts } = clientOpts ?? {};
         let defaultMaxConcurrentStreams = 100;
         let defaultPipelining = 100;
         if (maxConcurrentStreams != null && Number.isInteger(maxConcurrentStreams) && maxConcurrentStreams > 0) {
@@ -15328,10 +15328,10 @@ var require_api_connect = __commonJS({
         }
       }
     };
-    function connect(opts, callback) {
+    function connect3(opts, callback) {
       if (callback === void 0) {
         return new Promise((resolve2, reject) => {
-          connect.call(this, opts, (err, data) => {
+          connect3.call(this, opts, (err, data) => {
             return err ? reject(err) : resolve2(data);
           });
         });
@@ -15348,7 +15348,7 @@ var require_api_connect = __commonJS({
         queueMicrotask(() => callback(err, { opaque }));
       }
     }
-    module.exports = connect;
+    module.exports = connect3;
   }
 });
 
@@ -16617,8 +16617,8 @@ var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var { writeFile: writeFile12, readFile: readFile15, mkdir: mkdir15 } = __require("fs/promises");
-    var { dirname: dirname13, resolve: resolve2 } = __require("path");
+    var { writeFile: writeFile12, readFile: readFile15, mkdir: mkdir16 } = __require("fs/promises");
+    var { dirname: dirname14, resolve: resolve2 } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError: InvalidArgumentError2, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -16849,7 +16849,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         const resolvedPath = resolve2(path3);
-        await mkdir15(dirname13(resolvedPath), { recursive: true });
+        await mkdir16(dirname14(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
@@ -29193,11 +29193,11 @@ var require_mtime_precision = __commonJS({
     function probe(file, fs, callback) {
       const cachedPrecision = fs[cacheSymbol];
       if (cachedPrecision) {
-        return fs.stat(file, (err, stat4) => {
+        return fs.stat(file, (err, stat5) => {
           if (err) {
             return callback(err);
           }
-          callback(null, stat4.mtime, cachedPrecision);
+          callback(null, stat5.mtime, cachedPrecision);
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
@@ -29205,13 +29205,13 @@ var require_mtime_precision = __commonJS({
         if (err) {
           return callback(err);
         }
-        fs.stat(file, (err2, stat4) => {
+        fs.stat(file, (err2, stat5) => {
           if (err2) {
             return callback(err2);
           }
-          const precision = stat4.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
+          const precision = stat5.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
           Object.defineProperty(fs, cacheSymbol, { value: precision });
-          callback(null, stat4.mtime, precision);
+          callback(null, stat5.mtime, precision);
         });
       });
     }
@@ -29266,14 +29266,14 @@ var require_lockfile = __commonJS({
         if (options.stale <= 0) {
           return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
         }
-        options.fs.stat(lockfilePath, (err2, stat4) => {
+        options.fs.stat(lockfilePath, (err2, stat5) => {
           if (err2) {
             if (err2.code === "ENOENT") {
               return acquireLock(file, { ...options, stale: 0 }, callback);
             }
             return callback(err2);
           }
-          if (!isLockStale(stat4, options)) {
+          if (!isLockStale(stat5, options)) {
             return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
           }
           removeLock(file, options, (err3) => {
@@ -29285,8 +29285,8 @@ var require_lockfile = __commonJS({
         });
       });
     }
-    function isLockStale(stat4, options) {
-      return stat4.mtime.getTime() < Date.now() - options.stale;
+    function isLockStale(stat5, options) {
+      return stat5.mtime.getTime() < Date.now() - options.stale;
     }
     function removeLock(file, options, callback) {
       options.fs.rmdir(getLockFile(file, options), (err) => {
@@ -29304,7 +29304,7 @@ var require_lockfile = __commonJS({
       lock2.updateDelay = lock2.updateDelay || options.update;
       lock2.updateTimeout = setTimeout(() => {
         lock2.updateTimeout = null;
-        options.fs.stat(lock2.lockfilePath, (err, stat4) => {
+        options.fs.stat(lock2.lockfilePath, (err, stat5) => {
           const isOverThreshold = lock2.lastUpdate + options.stale < Date.now();
           if (err) {
             if (err.code === "ENOENT" || isOverThreshold) {
@@ -29313,7 +29313,7 @@ var require_lockfile = __commonJS({
             lock2.updateDelay = 1e3;
             return updateLock(file, options);
           }
-          const isMtimeOurs = lock2.mtime.getTime() === stat4.mtime.getTime();
+          const isMtimeOurs = lock2.mtime.getTime() === stat5.mtime.getTime();
           if (!isMtimeOurs) {
             return setLockAsCompromised(
               file,
@@ -29438,11 +29438,11 @@ var require_lockfile = __commonJS({
         if (err) {
           return callback(err);
         }
-        options.fs.stat(getLockFile(file2, options), (err2, stat4) => {
+        options.fs.stat(getLockFile(file2, options), (err2, stat5) => {
           if (err2) {
             return err2.code === "ENOENT" ? callback(null, false) : callback(err2);
           }
-          return callback(null, !isLockStale(stat4, options));
+          return callback(null, !isLockStale(stat5, options));
         });
       });
     }
@@ -29971,9 +29971,6 @@ function serverDir(slockHome, serverId) {
 function serverAttachmentPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "runner.state.json");
 }
-function legacyServerAttachmentPath(slockHome, serverId) {
-  return path2.join(serverDir(slockHome, serverId), "attachment.json");
-}
 function serverRunnerPidPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "server-runner.pid");
 }
@@ -29995,22 +29992,19 @@ function serviceStatePath(slockHome) {
 function servicePidPath(slockHome) {
   return path2.join(serviceRunDir(slockHome), "service.pid");
 }
-function legacyServicePidPath(slockHome) {
-  return path2.join(computerDir(slockHome), "service.pid");
-}
-function legacySupervisorPidPath(slockHome) {
-  return path2.join(computerDir(slockHome), "supervisor.pid");
-}
 function servicePidReadFallback(slockHome) {
-  return [
-    servicePidPath(slockHome),
-    legacyServicePidPath(slockHome),
-    legacySupervisorPidPath(slockHome)
-  ];
+  return [servicePidPath(slockHome)];
 }
 function serviceLogPath(slockHome) {
   return path2.join(serviceRunDir(slockHome), "service.log");
 }
+function serviceSocketPath(slockHome) {
+  return path2.join(computerDir(slockHome), "run", "service.sock");
+}
+function serviceWindowsPipeName(slockHome) {
+  const hash = createHash("sha256").update(computerDir(slockHome)).digest("hex").slice(0, 16);
+  return `\\\\.\\pipe\\slock-computer-${hash}`;
+}
 function serviceVersionPath(slockHome) {
   return path2.join(computerDir(slockHome), "service-version.json");
 }
@@ -30237,14 +30231,7 @@ async function readAttachmentAt(path3) {
 }
 async function readServerAttachment(slockHome, serverId) {
   if (!isValidServerId(serverId)) return null;
-  const current = await readAttachmentAt(serverAttachmentPath(slockHome, serverId));
-  const legacy = await readAttachmentAt(legacyServerAttachmentPath(slockHome, serverId));
-  if (!current) return legacy;
-  if (!legacy) return current;
-  if (legacy.adoptedFromLegacy === true && current.adoptedFromLegacy !== true && legacy.serverMachineId !== current.serverMachineId) {
-    return legacy;
-  }
-  return current;
+  return readAttachmentAt(serverAttachmentPath(slockHome, serverId));
 }
 async function writeServerAttachment(slockHome, attachment) {
   if (!isValidServerId(attachment.serverId)) return;
@@ -30505,8 +30492,8 @@ async function runAttach(opts) {
 // src/setup.ts
 init_esm_shims();
 var import_undici3 = __toESM(require_undici(), 1);
-import { chmod as chmod5, mkdir as mkdir11, readFile as readFile10, rename as rename4, rm as rm3, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname10 } from "path";
+import { chmod as chmod6, mkdir as mkdir13, readFile as readFile12, rename as rename4, rm as rm3, writeFile as writeFile11 } from "fs/promises";
+import { dirname as dirname12 } from "path";
 
 // src/lib/migration.ts
 init_esm_shims();
@@ -31032,8 +31019,8 @@ function readComputerVersion(moduleUrl = import.meta.url) {
 var COMPUTER_VERSION = readComputerVersion();
 
 // src/service.ts
-import { mkdir as mkdir10, readFile as readFile9, writeFile as writeFile9, open, rename as rename3 } from "fs/promises";
-import { dirname as dirname9, join as joinPath } from "path";
+import { mkdir as mkdir12, readFile as readFile11, writeFile as writeFile10, open, rename as rename3 } from "fs/promises";
+import { dirname as dirname11, join as joinPath } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/cleanup.ts
@@ -31393,6 +31380,53 @@ async function emitRunnerStateTransition(slockHome, serverId, fromState, toState
   }
 }
 
+// src/lib/runnerStateMachine.ts
+init_esm_shims();
+var RUNNER_TRIGGER = {
+  spawn: "spawn",
+  spawnFailed: "spawn-failed",
+  ready: "ready",
+  exitGraceful: "exit-graceful",
+  exitCrash: "exit-crash",
+  exitCrashDegraded: "exit-crash-degraded",
+  exitConfigError: "exit-config-error",
+  detachStop: "detach-stop",
+  shutdownStop: "shutdown-stop",
+  reset: "reset"
+};
+function nextRunnerStateOnExit(exitClass, budgetBreached) {
+  if (exitClass === "config-error") return "degraded";
+  if (exitClass === "crash") return budgetBreached ? "degraded" : "crashed";
+  return "stopped";
+}
+function exitTrigger(exitClass, budgetBreached) {
+  if (exitClass === "config-error") return RUNNER_TRIGGER.exitConfigError;
+  if (exitClass === "crash") {
+    return budgetBreached ? RUNNER_TRIGGER.exitCrashDegraded : RUNNER_TRIGGER.exitCrash;
+  }
+  return RUNNER_TRIGGER.exitGraceful;
+}
+function canSpawn(rec, wanted, now) {
+  if (!wanted) return false;
+  if (!rec) return true;
+  if (rec.child) return false;
+  if (rec.lifecycle !== "crashed" && rec.lifecycle !== "stopped") return false;
+  return now >= (rec.backoffUntil ?? 0);
+}
+function rehydrateRunnerRecord(serverId, degraded) {
+  return {
+    serverId,
+    lifecycle: degraded ? "degraded" : "stopped",
+    stopping: false
+  };
+}
+function applyRunnerReset(rec) {
+  if (rec.lifecycle !== "degraded") return false;
+  rec.lifecycle = "stopped";
+  rec.backoffUntil = void 0;
+  return true;
+}
+
 // src/services/start.ts
 init_esm_shims();
 
@@ -32081,218 +32115,1151 @@ async function resolveAndRunSeaUpgrade(opts) {
   return { ...result, targetVersion };
 }
 
-// src/service.ts
-var seaRequire = createRequire2(import.meta.url);
-var cachedIsSea;
-function isSeaBinary() {
-  if (cachedIsSea !== void 0) return cachedIsSea;
-  try {
-    cachedIsSea = seaRequire("node:sea").isSea();
-  } catch {
-    cachedIsSea = false;
-  }
-  return cachedIsSea;
-}
-function buildResidentSpawn(mode, serverId, selfEntry = process.argv[1] ?? "", execArgv = process.execArgv, isSea = isSeaBinary()) {
-  const tail = serverId ? [mode, serverId] : [mode];
-  if (isSea) {
-    return { command: process.execPath, args: [...execArgv, ...tail] };
+// src/internal/ipc-server.ts
+init_esm_shims();
+import { connect, createServer } from "net";
+import { chmod as chmod5, mkdir as mkdir10, stat as stat4, unlink as unlink5 } from "fs/promises";
+import { dirname as dirname9 } from "path";
+
+// src/internal/ipc-codec.ts
+init_esm_shims();
+
+// src/lib/types.ts
+init_esm_shims();
+var ServiceClientError = class extends Error {
+  code;
+  cause;
+  constructor(code, message, cause) {
+    super(message);
+    this.name = "ServiceClientError";
+    this.code = code;
+    if (cause !== void 0) this.cause = cause;
   }
-  return { command: process.execPath, args: [...execArgv, selfEntry, ...tail] };
-}
-var PARENT_LOCK_HELD_ENV_VAR = "SLOCK_COMPUTER_PARENT_MUTATION_LOCK_HELD";
-async function spawnDetachedService(slockHome) {
-  await mkdir10(serviceRunDir(slockHome), { recursive: true });
-  const supLogFd = await open(serviceLogPath(slockHome), "a");
-  const { command, args } = buildResidentSpawn("__service", null);
-  const child = spawn2(command, args, {
-    detached: true,
-    stdio: ["ignore", supLogFd.fd, supLogFd.fd],
-    windowsHide: true,
-    env: { ...process.env, [PARENT_LOCK_HELD_ENV_VAR]: "1" }
-  });
-  child.on("error", (err) => {
-    process.stderr.write(
-      `${JSON.stringify({ ok: false, code: "SUPERVISOR_SPAWN_FAILED", message: err.message })}
-`
-    );
-  });
-  const pid = child.pid;
-  child.unref();
-  await supLogFd.close();
-  if (!pid) {
-    throw new Error("SUPERVISOR_SPAWN_FAILED: could not spawn the service process");
+};
+var StateReaderError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "StateReaderError";
+    this.code = code;
   }
-  await writePidfileAt(servicePidPath(slockHome), pid);
-  return pid;
-}
-var EX_CONFIG_EXIT_CODE = 78;
-async function ensureSeaRuntimePackageDir() {
-  if (!isSeaBinary() || process.env.PI_PACKAGE_DIR) return;
-  try {
-    const dir = joinPath(resolveSlockHome(), "runtime-pkg");
-    await mkdir10(dir, { recursive: true });
-    await writeFile9(
-      joinPath(dir, "package.json"),
-      `${JSON.stringify({ name: "slock-computer-sea-runtime", version: COMPUTER_VERSION })}
-`
+};
+
+// src/internal/ipc-codec.ts
+var MAX_FRAME_BYTES = 1024 * 1024;
+function encodeFrame(payload) {
+  const json = Buffer.from(JSON.stringify(payload), "utf8");
+  if (json.length > MAX_FRAME_BYTES) {
+    throw new ServiceClientError(
+      "IPC_FRAME_TOO_LARGE",
+      `outgoing frame ${json.length} bytes exceeds MAX_FRAME_BYTES ${MAX_FRAME_BYTES}`
     );
-    process.env.PI_PACKAGE_DIR = dir;
-  } catch {
   }
+  const header = Buffer.alloc(4);
+  header.writeUInt32BE(json.length, 0);
+  return Buffer.concat([header, json]);
 }
-var defaultCoreFactory = async (creds) => {
-  await ensureSeaRuntimePackageDir();
-  let coreMod;
-  try {
-    coreMod = await import("@botiverse/raft-daemon/core");
-  } catch (err) {
-    const code = err?.code;
-    const isModuleMissing = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || err instanceof Error && /Cannot find (module|package)/i.test(err.message);
-    if (isModuleMissing) {
-      process.stderr.write(
-        `slock-computer: per-server daemon failed to load \`@botiverse/raft-daemon/core\`.
-  Reason: ${err instanceof Error ? err.message : String(err)}
-  This usually means a source-run workspace without a built daemon dist.
-  Fix: run \`pnpm --filter @botiverse/raft-daemon build\` once, then \`slock-computer doctor <server> --reset-health && slock-computer start\`.
-  (Packaged/npx installs ship the dist already \u2014 this only affects local source-run setups.)
-`
-      );
-      process.exit(EX_CONFIG_EXIT_CODE);
-    }
-    throw err;
-  }
-  process.env.SLOCK_COMPUTER_VERSION = COMPUTER_VERSION;
-  return new coreMod.DaemonCore({
-    serverUrl: creds.serverUrl,
-    apiKey: creds.apiKey,
-    localTrace: true,
-    // In a SEA single-binary there is no sidecar `slock` CLI script for the
-    // daemon to resolve, so inject the `__cli` sentinel: the agent CLI wrapper
-    // then execs `<exe> __cli "$@"`, re-execing this binary in CLI mode
-    // (runBundledSlockCli). Normal installs leave this unset → the daemon
-    // resolves the bundled CLI dist path as before.
-    slockCliPath: isSeaBinary() ? "__cli" : void 0,
-    // Managed-Computer remote control (server → WS → runner). This runner
-    // is the service's in-process `__run` child, so:
-    //   restart → SIGTERM ourselves → runResident's shutdown does
-    //     core.stop() + exit 0 → classifyRunnerExit = graceful → the
-    //     service supervisor respawns this runner (effective restart).
-    //   upgrade (SEA + requestId) → run the SEA upgrade IN-PROCESS so we can
-    //     stream `computer:upgrade:progress` over this live WS, then SIGTERM
-    //     ourselves; the supervisor respawns the swapped binary and the new
-    //     process reports `done` via onComputerUpgradeReconcile on reconnect.
-    //   upgrade (non-SEA dev run, or no requestId) → SEA-only no-op. The
-    //     npm-install-root upgrade path is retired: a managed Computer is a
-    //     SEA single binary; a source/dev run has no binary to self-swap.
-    onComputerControl: (action, ctx) => {
-      if (action === "restart") {
-        process.kill(process.pid, "SIGTERM");
-        return;
+var FrameDecoder = class {
+  buffer = Buffer.alloc(0);
+  push(chunk) {
+    this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+  }
+  drain() {
+    const frames = [];
+    while (this.buffer.length >= 4) {
+      const length = this.buffer.readUInt32BE(0);
+      if (length > MAX_FRAME_BYTES) {
+        throw new ServiceClientError(
+          "IPC_FRAME_TOO_LARGE",
+          `incoming frame ${length} bytes exceeds MAX_FRAME_BYTES ${MAX_FRAME_BYTES}`
+        );
       }
-      if (isSeaBinary() && ctx.requestId) {
-        return runManagedSeaUpgrade(ctx.requestId, ctx);
+      if (this.buffer.length < 4 + length) break;
+      const body = this.buffer.subarray(4, 4 + length);
+      this.buffer = this.buffer.subarray(4 + length);
+      let parsed;
+      try {
+        parsed = JSON.parse(body.toString("utf8"));
+      } catch (cause) {
+        throw new ServiceClientError("IPC_MALFORMED_FRAME", "frame body is not valid UTF-8 JSON", cause);
       }
-      console.warn(
-        `[Computer] Ignoring upgrade request: in-process SEA upgrade unavailable (isSea=${isSeaBinary()}, requestId=${ctx.requestId ? "present" : "absent"}). Managed upgrade requires a SEA binary invoked with a requestId.`
-      );
-    },
-    // Blip-stitch: on every (re)connect, if THIS process booted from a freshly
-    // swapped binary (a pending-upgrade marker is present), report the upgrade
-    // done with the version we actually are now, then clear the marker.
-    onComputerUpgradeReconcile: async (emitDone) => {
-      const slockHome = resolveSlockHome();
-      const marker = await readPendingUpgradeMarker(slockHome);
-      if (!marker) return;
-      const rolledBack = COMPUTER_VERSION !== marker.targetVersion;
-      emitDone({
-        requestId: marker.requestId,
-        ok: !rolledBack,
-        newVersion: COMPUTER_VERSION,
-        ...rolledBack ? { rolledBack: true } : {}
-      });
-      await clearPendingUpgradeMarker(slockHome);
+      frames.push(parsed);
     }
-  });
+    return frames;
+  }
 };
-function seaProgressToFrame(e) {
-  return { phase: e.phase, message: e.message, percent: e.percent };
+
+// src/internal/ipc-server.ts
+var SUPPORTED_PROTOCOL_VERSIONS = [1];
+var SERVICE_VERSION = "0.0.0";
+function resolveTransportPath(installRoot) {
+  return process.platform === "win32" ? serviceWindowsPipeName(installRoot) : serviceSocketPath(installRoot);
 }
-async function runManagedSeaUpgrade(requestId, ctx) {
-  const slockHome = resolveSlockHome();
-  let result;
+async function probeAndClearStaleSocket(socketPath) {
+  if (process.platform === "win32") return;
+  let isSocket = false;
   try {
-    result = await resolveAndRunSeaUpgrade({
-      slockHome,
-      requestId,
-      fromVersion: COMPUTER_VERSION,
-      currentBinaryPath: process.execPath,
-      nowIso: (/* @__PURE__ */ new Date()).toISOString(),
-      deps: {
-        onProgress: (e) => ctx.emitUpgradeProgress(seaProgressToFrame(e))
-      }
-    });
+    const stats = await stat4(socketPath);
+    isSocket = stats.isSocket();
   } catch (err) {
-    ctx.emitUpgradeDone({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    if (isErrnoException(err) && err.code === "ENOENT") return;
     return;
   }
-  if (!result.ok) {
-    ctx.emitUpgradeDone({ ok: false, error: result.reason ?? result.failedPhase ?? "upgrade_failed" });
+  if (!isSocket) {
     return;
   }
-  if (result.alreadyCurrent) {
-    ctx.emitUpgradeDone({ ok: true, newVersion: COMPUTER_VERSION });
+  const outcome = await new Promise((resolve2) => {
+    const probe = connect({ path: socketPath });
+    const finalize = (o) => {
+      probe.removeAllListeners();
+      probe.destroy();
+      resolve2(o);
+    };
+    const timer = setTimeout(() => finalize("indeterminate"), 500);
+    probe.once("connect", () => {
+      clearTimeout(timer);
+      finalize("connected");
+    });
+    probe.once("error", (err) => {
+      clearTimeout(timer);
+      finalize(err.code === "ECONNREFUSED" ? "refused" : "indeterminate");
+    });
+  });
+  if (outcome !== "refused") {
     return;
   }
-  process.kill(process.pid, "SIGTERM");
-}
-function classifyRunnerExit(code, signal) {
-  if (code === EX_CONFIG_EXIT_CODE) return "config-error";
-  if (signal === "SIGTERM" || signal === "SIGINT") return "graceful";
-  if (code === 0) return "graceful";
-  return "crash";
+  try {
+    await unlink5(socketPath);
+  } catch (err) {
+    if (isErrnoException(err) && err.code === "ENOENT") return;
+    throw err;
+  }
 }
-async function runResident(serverId, deps = {}) {
-  assertValidServerId(serverId);
-  const slockHome = resolveSlockHome();
-  const a = await readServerAttachment(slockHome, serverId);
-  if (!a) {
-    fail(
-      "NO_ATTACHMENT",
-      `No attachment for server ${serverId}. Run \`slock-computer attach ${serverId}\` first.`
-    );
+function createIpcServer(options) {
+  const { installRoot, handlers } = options;
+  const transportPath = resolveTransportPath(installRoot);
+  const connections = /* @__PURE__ */ new Set();
+  let server = null;
+  let closed = false;
+  function dispatchFrame(conn, frame) {
+    if (!isRecord(frame) || typeof frame.type !== "string") {
+      writeError(conn, null, "IPC_MALFORMED_FRAME", "frame is missing required `type` field");
+      conn.socket.destroy();
+      return;
+    }
+    if (!conn.handshakeDone) {
+      handleHello(conn, frame);
+      return;
+    }
+    if (frame.type === "request") {
+      void handleRequest(conn, frame);
+      return;
+    }
+    if (frame.type === "ping") {
+      conn.socket.write(encodeFrame({ type: "pong" }));
+      return;
+    }
+    if (frame.type === "pong") {
+      return;
+    }
   }
-  const core = await (deps.coreFactory ?? defaultCoreFactory)({
-    serverId: a.serverId,
-    serverMachineId: a.serverMachineId,
-    apiKey: a.apiKey,
-    serverUrl: a.serverUrl
-  });
-  let stopping = false;
-  const shutdown = async () => {
-    if (stopping) return;
-    stopping = true;
+  function handleHello(conn, frame) {
+    if (frame.type !== "hello") {
+      conn.socket.write(encodeFrame({
+        type: "hello-reject",
+        reason: "IPC_PROTOCOL_HANDSHAKE_FAILED",
+        message: `expected hello, got \`${String(frame.type)}\``
+      }));
+      conn.socket.destroy();
+      return;
+    }
+    const requested = Number(frame.protocolVersion);
+    if (!SUPPORTED_PROTOCOL_VERSIONS.includes(requested)) {
+      conn.socket.write(encodeFrame({
+        type: "hello-reject",
+        reason: "IPC_PROTOCOL_VERSION_UNSUPPORTED",
+        supported: [...SUPPORTED_PROTOCOL_VERSIONS]
+      }));
+      conn.socket.destroy();
+      return;
+    }
+    conn.handshakeDone = true;
+    conn.socket.write(encodeFrame({
+      type: "hello-ack",
+      protocolVersion: requested,
+      serviceVersion: SERVICE_VERSION
+    }));
+  }
+  async function handleRequest(conn, frame) {
+    const id = typeof frame.id === "string" ? frame.id : "";
+    const method = typeof frame.method === "string" ? frame.method : "";
+    if (id === "" || method === "") {
+      writeError(conn, id || null, "IPC_MALFORMED_FRAME", "request missing `id` or `method`");
+      return;
+    }
+    const handler = handlers[method];
+    if (!handler) {
+      writeError(conn, id, "IPC_MALFORMED_FRAME", `unknown method \`${method}\``);
+      return;
+    }
     try {
-      await core.stop();
-    } finally {
-      process.exit(0);
+      const result = await handler(
+        frame.params
+      );
+      if (conn.socket.destroyed) return;
+      conn.socket.write(encodeFrame({ type: "response", id, result }));
+    } catch (error) {
+      if (conn.socket.destroyed) return;
+      const { code, message } = normalizeHandlerError(error);
+      writeError(conn, id, code, message);
     }
-  };
-  process.on("SIGTERM", () => void shutdown());
-  process.on("SIGINT", () => void shutdown());
-  await core.start();
-}
-var RECONCILE_INTERVAL_MS = 5e3;
-var CHILD_RESTART_BACKOFF_MS = 2e3;
-function canSupervisorSpawnChild(serverId, running, restarting) {
-  return !running.has(serverId) && !restarting.has(serverId);
-}
-function formatReadySummary(ready, serverIds, opts) {
-  if (opts.serverId && serverIds.length === 1) {
-    const pid = ready.get(opts.serverId);
-    return `Daemon for server ${opts.serverLabel ?? opts.serverId} is running${pid ? ` (pid ${pid})` : ""}.`;
   }
-  return `Daemons for ${serverIds.length} managed server(s) are running.`;
+  function writeError(conn, id, code, message) {
+    if (conn.socket.destroyed) return;
+    try {
+      conn.socket.write(encodeFrame({
+        type: "response",
+        id: id ?? "",
+        error: { code, message }
+      }));
+    } catch {
+    }
+  }
+  function attachConnection(socket) {
+    if (closed) {
+      socket.destroy();
+      return;
+    }
+    const conn = {
+      socket,
+      decoder: new FrameDecoder(),
+      handshakeDone: false
+    };
+    connections.add(conn);
+    socket.on("data", (chunk) => {
+      try {
+        conn.decoder.push(chunk);
+        const frames = conn.decoder.drain();
+        for (const frame of frames) dispatchFrame(conn, frame);
+      } catch (error) {
+        const { code, message } = normalizeHandlerError(error);
+        writeError(conn, null, code, message);
+        socket.destroy();
+      }
+    });
+    socket.on("close", () => connections.delete(conn));
+    socket.on("error", () => {
+    });
+  }
+  return {
+    async listen() {
+      if (server) throw new Error("ipc-server: listen() called twice");
+      if (process.platform !== "win32") {
+        await mkdir10(dirname9(transportPath), { recursive: true });
+        await probeAndClearStaleSocket(transportPath);
+      }
+      const s = createServer(attachConnection);
+      server = s;
+      await new Promise((resolve2, reject) => {
+        const onError = (err) => {
+          s.removeListener("error", onError);
+          reject(err);
+        };
+        s.once("error", onError);
+        s.listen(transportPath, () => {
+          s.removeListener("error", onError);
+          resolve2();
+        });
+      });
+      if (process.platform !== "win32") {
+        try {
+          await chmod5(transportPath, 384);
+        } catch {
+        }
+      }
+      return transportPath;
+    },
+    broadcast(event) {
+      if (closed) return;
+      const payload = encodeFrame({ type: "event", kind: event.kind, payload: event.payload });
+      for (const conn of connections) {
+        if (!conn.handshakeDone || conn.socket.destroyed) continue;
+        try {
+          conn.socket.write(payload);
+        } catch {
+        }
+      }
+    },
+    async close() {
+      if (closed) return;
+      closed = true;
+      const s = server;
+      server = null;
+      for (const conn of connections) conn.socket.destroy();
+      connections.clear();
+      if (s) {
+        await new Promise((resolve2) => {
+          s.close(() => resolve2());
+        });
+      }
+    }
+  };
+}
+function normalizeHandlerError(error) {
+  if (error instanceof ServiceClientError) {
+    return { code: error.code, message: error.message };
+  }
+  const message = error instanceof Error ? error.message : "handler threw non-Error value";
+  return { code: "IPC_MALFORMED_FRAME", message };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isErrnoException(value) {
+  return value instanceof Error && typeof value.code === "string";
+}
+
+// src/lib/readers.ts
+init_esm_shims();
+
+// src/status.ts
+init_esm_shims();
+import { readFile as readFile9 } from "fs/promises";
+async function readUserSession(path3) {
+  try {
+    const parsed = JSON.parse(await readFile9(path3, "utf8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return { state: "present", session: parsed, error: null };
+    }
+    return { state: "invalid", session: null, error: "not a JSON object" };
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      return { state: "missing", session: null, error: null };
+    }
+    return {
+      state: "invalid",
+      session: null,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+async function pidStatus(pidfile) {
+  const pid = await readPidfileAt(pidfile);
+  return pid !== null && isProcessAlive2(pid) ? { running: true, pid } : { running: false };
+}
+async function serviceState(slockHome) {
+  const { pid } = await findLiveServicePidReadOnly(slockHome);
+  return pid !== null ? { running: true, pid } : { running: false };
+}
+async function deriveHealth(slockHome, serverId, daemon) {
+  if (!daemon.running) return "offline";
+  if (await isDegraded(slockHome, serverId)) return "degraded";
+  return "ok";
+}
+async function buildStatusReport(installRoot) {
+  const sessionRead = await readUserSession(userSessionPath(installRoot));
+  const session = sessionRead.session;
+  const attachments = await listServerAttachments(installRoot);
+  const service = {
+    ...await serviceState(installRoot),
+    logPath: serviceLogPath(installRoot)
+  };
+  const servers = [];
+  for (const a of attachments) {
+    const daemon = await pidStatus(serverRunnerPidPath(installRoot, a.serverId));
+    servers.push({
+      serverId: a.serverId,
+      serverSlug: a.serverSlug ?? null,
+      serverMachineId: a.serverMachineId,
+      serverUrl: a.serverUrl,
+      attachedAt: a.attachedAt ?? null,
+      serverRunnerLogPath: serverRunnerLogPath(installRoot, a.serverId),
+      daemon,
+      health: await deriveHealth(installRoot, a.serverId, daemon)
+    });
+  }
+  const loggedIn = session?.kind === "user-session" && typeof session.accessToken === "string" && session.accessToken.length > 0;
+  return {
+    slockHome: installRoot,
+    loggedIn,
+    userId: session ? str(session.userId) : null,
+    loginServerUrl: session ? str(session.serverUrl) : null,
+    userSessionError: sessionRead.state === "invalid" ? sessionRead.error : null,
+    service,
+    servers
+  };
+}
+function pad(s, n) {
+  return s.length >= n ? s : s + " ".repeat(n - s.length);
+}
+async function runStatus(opts) {
+  const report = await buildStatusReport(resolveSlockHome());
+  if (opts.json) {
+    info(JSON.stringify(report, null, 2));
+    return;
+  }
+  info("");
+  info(`SLOCK_HOME:   ${report.slockHome}`);
+  const loginDetail = report.userSessionError ? "no \u2014 user session file is invalid; re-run `slock-computer login`" : report.loggedIn ? `yes (user ${report.userId ?? "?"})` : "no \u2014 run `slock-computer login`";
+  info(
+    `Logged in:    ${loginDetail}`
+  );
+  if (report.loginServerUrl) info(`Login server: ${report.loginServerUrl}`);
+  info(
+    `Service:   ${report.service.running ? `running (pid ${report.service.pid})` : "stopped \u2014 run `slock-computer start`"}`
+  );
+  info(`Service log: ${report.service.logPath}`);
+  info("");
+  if (report.servers.length === 0) {
+    info("Attachments:  none \u2014 run `slock-computer attach /<serverSlug>` (e.g. `/myserver`).");
+  } else {
+    info("Attachments:");
+    info(`  ${pad("SERVER", 24)}${pad("HEALTH", 12)}${pad("DAEMON", 24)}${pad("MACHINE", 38)}URL`);
+    for (const s of report.servers) {
+      const dcol = s.daemon.running ? `running (pid ${s.daemon.pid})` : "stopped";
+      info(
+        `  ${pad(formatServerSlugDisplay(s.serverSlug), 24)}${pad(s.health, 12)}${pad(dcol, 24)}${pad(s.serverMachineId, 38)}${s.serverUrl}`
+      );
+      info(`    Server runner log: ${s.serverRunnerLogPath}`);
+    }
+    if (report.servers.some((s) => s.health === "degraded")) {
+      info("");
+      info(
+        "  Note: one or more servers are `degraded` (repeated crashes; auto-restart paused)."
+      );
+      info(
+        "  Run `slock-computer doctor /<serverSlug> --reset-health` (e.g. `/myserver`) after fixing the underlying issue."
+      );
+    }
+  }
+  info("");
+}
+
+// src/lib/readers.ts
+async function readServiceStatus(installRoot) {
+  return buildStatusReport(installRoot);
+}
+async function readRunnerStatus(installRoot, serverId) {
+  const report = await buildStatusReport(installRoot);
+  const server = report.servers.find((s) => s.serverId === serverId);
+  if (!server) {
+    throw new StateReaderError(
+      "NOT_ATTACHED",
+      `Server ${serverId} is not attached to this Computer.`
+    );
+  }
+  const attachment = await readServerAttachment(installRoot, serverId);
+  if (!attachment) {
+    throw new StateReaderError(
+      "INVALID_ATTACHMENT",
+      `Attachment for server ${serverId} is missing or invalid.`
+    );
+  }
+  const client = new RunnersClient(attachment.serverUrl, attachment.apiKey);
+  const result = await client.list();
+  if (result.status === "success") {
+    return { status: "ok", server, whitelist: result.whitelist, runners: result.runners };
+  }
+  if (result.status === "unauthorized") {
+    return { status: "unauthorized", server };
+  }
+  return { status: "error", server, code: result.code };
+}
+async function listRunners(installRoot, opts = {}) {
+  const all = await listServerAttachments(installRoot);
+  let subset = all;
+  if (opts.serverId !== void 0) {
+    const found = all.find((a) => a.serverId === opts.serverId);
+    if (!found) {
+      throw new StateReaderError(
+        "NOT_ATTACHED",
+        `Server ${opts.serverId} is not attached to this Computer.`
+      );
+    }
+    subset = [found];
+  }
+  const servers = [];
+  for (const a of subset) {
+    const client = new RunnersClient(a.serverUrl, a.apiKey);
+    const result = await client.list();
+    const idCols = { serverId: a.serverId, serverSlug: a.serverSlug ?? null };
+    if (result.status === "success") {
+      servers.push({
+        ...idCols,
+        status: "ok",
+        whitelist: result.whitelist,
+        runners: result.runners
+      });
+    } else if (result.status === "unauthorized") {
+      servers.push({ ...idCols, status: "unauthorized" });
+    } else {
+      servers.push({ ...idCols, status: "error", code: result.code });
+    }
+  }
+  return { servers };
+}
+
+// src/reset.ts
+init_esm_shims();
+
+// src/serviceState.ts
+init_esm_shims();
+import { mkdir as mkdir11, readFile as readFile10, writeFile as writeFile9, appendFile as appendFile3 } from "fs/promises";
+import { dirname as dirname10 } from "path";
+
+// src/lib/state.ts
+init_esm_shims();
+var SERVICE_STATE_VALUES = [
+  "starting",
+  "running",
+  "degraded",
+  "stopping",
+  "stopped"
+];
+function isServiceState(value) {
+  return typeof value === "string" && SERVICE_STATE_VALUES.includes(value);
+}
+
+// src/serviceState.ts
+var DEFAULT_STATE = {
+  state: "running",
+  crashHistory: []
+};
+async function readServiceState(slockHome) {
+  try {
+    const raw = await readFile10(serviceStatePath(slockHome), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return { ...DEFAULT_STATE };
+    const obj = parsed;
+    const state = isServiceState(obj.state) ? obj.state : "running";
+    const crashHistory = Array.isArray(obj.crashHistory) ? obj.crashHistory.filter(isCrashEntry) : [];
+    return { state, crashHistory };
+  } catch {
+    return { ...DEFAULT_STATE };
+  }
+}
+async function writeServiceState(slockHome, file) {
+  const path3 = serviceStatePath(slockHome);
+  await mkdir11(dirname10(path3), { recursive: true });
+  await writeFile9(path3, JSON.stringify(file), { mode: 384 });
+}
+function isCrashEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const obj = value;
+  return typeof obj.at === "string";
+}
+async function emitServiceStateTransition(slockHome, fromState, toState, trigger) {
+  const entry = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    kind: "service-state-changed",
+    fromState,
+    toState,
+    trigger
+  };
+  try {
+    const path3 = serviceLogPath(slockHome);
+    await mkdir11(dirname10(path3), { recursive: true });
+    await appendFile3(path3, JSON.stringify(entry) + "\n");
+  } catch {
+  }
+}
+async function clearServiceCrashHistory(slockHome) {
+  const current = await readServiceState(slockHome);
+  const previousState = current.state;
+  const clearedCrashCount = current.crashHistory.length;
+  const next = { state: "running", crashHistory: [] };
+  await writeServiceState(slockHome, next);
+  await emitServiceStateTransition(
+    slockHome,
+    previousState,
+    "running",
+    "reset-service"
+  );
+  return { previousState, clearedCrashCount };
+}
+
+// src/targetServer.ts
+init_esm_shims();
+function attachmentLabel(a) {
+  return formatServerSlugDisplay(a.serverSlug);
+}
+async function refreshAttachmentSlug(home, attachment) {
+  try {
+    const client = new ComputerAttachClient(attachment.serverUrl, "");
+    const result = await client.preflight(attachment.apiKey);
+    if (!result.ok || !result.serverSlug || result.serverSlug === attachment.serverSlug) {
+      return attachment;
+    }
+    const updated = { ...attachment, serverSlug: result.serverSlug };
+    await writeServerAttachment(home, updated);
+    return updated;
+  } catch {
+    return attachment;
+  }
+}
+async function listAttachmentsWithFreshSlugs(home) {
+  const attachments = await listServerAttachments(home);
+  return await Promise.all(attachments.map((a) => refreshAttachmentSlug(home, a)));
+}
+async function resolveTargetServerId(opts) {
+  const home = resolveSlockHome();
+  let attachments = await listServerAttachments(home);
+  if (attachments.length === 0) {
+    fail("NO_ATTACHMENT", "No server attachments yet. Run `slock-computer attach /<serverSlug>` (e.g. `/myserver`) first.");
+  }
+  const requested = normalizeServerSlug(opts.server ?? "");
+  if (requested) {
+    let found = attachments.find((a) => a.serverSlug === requested);
+    if (!found) {
+      attachments = await listAttachmentsWithFreshSlugs(home);
+      found = attachments.find((a) => a.serverSlug === requested);
+    }
+    if (!found) {
+      fail(
+        "NOT_ATTACHED",
+        `Server slug ${formatServerSlugDisplay(requested)} is not attached. Attached server slugs: ${attachments.map(attachmentLabel).join(", ")}.`
+      );
+    }
+    return found.serverId;
+  }
+  if (attachments.length === 1) return attachments[0].serverId;
+  fail(
+    "AMBIGUOUS_SERVER",
+    `Multiple servers attached (${attachments.map(attachmentLabel).join(", ")}). Pass \`--server /<serverSlug>\` (e.g. \`--server ${attachmentLabel(attachments[0])}\`) to choose one.`
+  );
+}
+async function resolveTargetAttachment(opts) {
+  const serverId = await resolveTargetServerId(opts);
+  const a = await readServerAttachment(resolveSlockHome(), serverId);
+  if (!a) {
+    const label = opts.server ?? serverId;
+    fail("INVALID_ATTACHMENT", `Attachment for ${label} is missing/invalid. Re-run \`slock-computer attach ${label}\`.`);
+  }
+  return a;
+}
+
+// src/lib/ipc-client.ts
+init_esm_shims();
+import { connect as connect2 } from "net";
+import { randomUUID } from "crypto";
+var DEFAULT_PROTOCOL_VERSION = 1;
+var CLIENT_KIND = "lib";
+var CLIENT_VERSION = "0.0.0";
+function resolveTransportPath2(installRoot) {
+  return process.platform === "win32" ? serviceWindowsPipeName(installRoot) : serviceSocketPath(installRoot);
+}
+async function connectService(installRoot, options = {}) {
+  const protocolVersion = options.protocolVersion ?? DEFAULT_PROTOCOL_VERSION;
+  const transportPath = resolveTransportPath2(installRoot);
+  const socket = await new Promise((resolve2, reject) => {
+    const s = connect2({ path: transportPath });
+    s.once("connect", () => resolve2(s));
+    s.once("error", (err) => reject(
+      new ServiceClientError("IPC_PROTOCOL_HANDSHAKE_FAILED", `unable to connect to ${transportPath}: ${err.message}`, err)
+    ));
+  });
+  const decoder = new FrameDecoder();
+  const pendingRequests = /* @__PURE__ */ new Map();
+  const eventQueue = [];
+  const eventWaiters = [];
+  let closed = false;
+  let protocolError = null;
+  function terminate(error) {
+    if (closed) return;
+    closed = true;
+    if (error) protocolError = error;
+    socket.destroy();
+    for (const pending of pendingRequests.values()) {
+      pending.reject(error ?? new ServiceClientError("IPC_CLIENT_CLOSED", "service client closed before response"));
+    }
+    pendingRequests.clear();
+    for (const waiter of eventWaiters) waiter.resolve(null);
+    eventWaiters.length = 0;
+  }
+  function dispatchFrame(frame) {
+    if (!isRecord2(frame) || typeof frame.type !== "string") {
+      throw new ServiceClientError("IPC_MALFORMED_FRAME", "frame is missing required `type` field");
+    }
+    if (frame.type === "event") {
+      const event = { kind: String(frame.kind), payload: frame.payload };
+      if (eventWaiters.length > 0) {
+        const waiter = eventWaiters.shift();
+        waiter.resolve(event);
+      } else {
+        eventQueue.push(event);
+      }
+      return;
+    }
+    if (frame.type === "response") {
+      const id = String(frame.id ?? "");
+      const pending = pendingRequests.get(id);
+      if (!pending) return;
+      pendingRequests.delete(id);
+      if ("error" in frame && isRecord2(frame.error)) {
+        const code = String(frame.error.code ?? "IPC_MALFORMED_FRAME");
+        const message = String(frame.error.message ?? "service request failed");
+        pending.reject(new ServiceClientError(code, message));
+      } else {
+        pending.resolve(frame.result);
+      }
+      return;
+    }
+    if (frame.type === "ping") {
+      socket.write(encodeFrame({ type: "pong" }));
+      return;
+    }
+    if (frame.type === "pong") {
+      return;
+    }
+  }
+  socket.on("data", (chunk) => {
+    try {
+      decoder.push(chunk);
+      const frames = decoder.drain();
+      for (const frame of frames) {
+        dispatchFrame(frame);
+      }
+    } catch (error) {
+      terminate(error instanceof ServiceClientError ? error : new ServiceClientError("IPC_MALFORMED_FRAME", "frame decode failed", error));
+    }
+  });
+  socket.on("close", () => terminate(null));
+  socket.on("error", (err) => terminate(
+    new ServiceClientError("IPC_MALFORMED_FRAME", `socket error: ${err.message}`, err)
+  ));
+  await new Promise((resolve2, reject) => {
+    let settled = false;
+    const settle = (action) => {
+      if (settled) return;
+      settled = true;
+      socket.removeListener("close", onHandshakeClose);
+      socket.removeListener("error", onHandshakeError);
+      action();
+    };
+    const onHandshakeClose = () => settle(() => {
+      reject(new ServiceClientError(
+        "IPC_PROTOCOL_HANDSHAKE_FAILED",
+        "service closed connection before sending hello-ack"
+      ));
+    });
+    const onHandshakeError = (err) => settle(() => {
+      reject(new ServiceClientError(
+        "IPC_PROTOCOL_HANDSHAKE_FAILED",
+        `handshake socket error: ${err.message}`,
+        err
+      ));
+    });
+    socket.once("close", onHandshakeClose);
+    socket.once("error", onHandshakeError);
+    const onFirstFrame = (chunk) => {
+      socket.removeListener("data", onFirstFrame);
+      try {
+        decoder.push(chunk);
+        const frames = decoder.drain();
+        if (frames.length === 0) {
+          socket.once("data", onFirstFrame);
+          return;
+        }
+        const [firstFrame, ...remaining] = frames;
+        if (!isRecord2(firstFrame) || typeof firstFrame.type !== "string") {
+          settle(() => reject(new ServiceClientError("IPC_PROTOCOL_HANDSHAKE_FAILED", "handshake response missing `type`")));
+          return;
+        }
+        if (firstFrame.type === "hello-reject") {
+          const reason = String(firstFrame.reason ?? "IPC_PROTOCOL_VERSION_UNSUPPORTED");
+          settle(() => reject(new ServiceClientError(
+            reason === "IPC_PROTOCOL_VERSION_UNSUPPORTED" ? "IPC_PROTOCOL_VERSION_UNSUPPORTED" : "IPC_PROTOCOL_HANDSHAKE_FAILED",
+            `service rejected handshake: ${String(firstFrame.reason ?? "unknown")}`
+          )));
+          return;
+        }
+        if (firstFrame.type !== "hello-ack") {
+          settle(() => reject(new ServiceClientError("IPC_PROTOCOL_HANDSHAKE_FAILED", `expected hello-ack, got \`${firstFrame.type}\``)));
+          return;
+        }
+        for (const frame of remaining) {
+          dispatchFrame(frame);
+        }
+        settle(resolve2);
+      } catch (error) {
+        settle(() => reject(error instanceof ServiceClientError ? error : new ServiceClientError("IPC_PROTOCOL_HANDSHAKE_FAILED", "handshake decode failed", error)));
+      }
+    };
+    socket.once("data", onFirstFrame);
+    socket.write(encodeFrame({
+      type: "hello",
+      protocolVersion,
+      clientKind: CLIENT_KIND,
+      clientVersion: CLIENT_VERSION
+    }));
+  });
+  const events = {
+    [Symbol.asyncIterator]() {
+      return {
+        async next() {
+          if (eventQueue.length > 0) {
+            return { value: eventQueue.shift(), done: false };
+          }
+          if (closed) {
+            if (protocolError) throw protocolError;
+            return { value: void 0, done: true };
+          }
+          return new Promise((resolve2, reject) => {
+            eventWaiters.push({
+              resolve: (event) => {
+                if (event === null) {
+                  if (protocolError) reject(protocolError);
+                  else resolve2({ value: void 0, done: true });
+                } else {
+                  resolve2({ value: event, done: false });
+                }
+              }
+            });
+          });
+        },
+        async return() {
+          terminate(null);
+          return { value: void 0, done: true };
+        }
+      };
+    }
+  };
+  const client = {
+    events,
+    async request(method, params, _options = {}) {
+      if (closed) {
+        throw protocolError ?? new ServiceClientError("IPC_CLIENT_CLOSED", "service client is closed");
+      }
+      const id = randomUUID();
+      return new Promise((resolve2, reject) => {
+        pendingRequests.set(id, {
+          resolve: (value) => resolve2(value),
+          reject
+        });
+        try {
+          socket.write(encodeFrame({ type: "request", id, method, params }));
+        } catch (error) {
+          pendingRequests.delete(id);
+          reject(error);
+        }
+      });
+    },
+    async close() {
+      terminate(null);
+    }
+  };
+  return client;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/reset.ts
+async function resetViaServiceOrDisk(slockHome, viaService, direct) {
+  let client = null;
+  try {
+    client = await connectService(slockHome);
+  } catch {
+    client = null;
+  }
+  if (!client) return direct();
+  try {
+    return await viaService(client);
+  } finally {
+    await client.close();
+  }
+}
+async function resetService(installRoot) {
+  const { previousState, clearedCrashCount } = await clearServiceCrashHistory(installRoot);
+  return {
+    status: "ok",
+    previousState,
+    clearedCrashCount
+  };
+}
+async function resetRunner(installRoot, serverId) {
+  const attachment = await readServerAttachment(installRoot, serverId);
+  if (!attachment) {
+    return { status: "not-found", serverId };
+  }
+  const outcome = await resetRunnerHealth(installRoot, serverId);
+  if (outcome.status === "not-found") {
+    return { status: "not-found", serverId };
+  }
+  return {
+    status: "ok",
+    serverId,
+    previousState: outcome.previousState ?? "running",
+    clearedCrashCount: outcome.clearedCrashCount ?? 0
+  };
+}
+async function runReset(opts) {
+  const wantsService = opts.service === true;
+  const wantsRunner = opts.runner === true;
+  if (wantsService && wantsRunner) {
+    fail(
+      "RESET_SCOPE_AMBIGUOUS",
+      "`--service` and `--runner` are mutually exclusive. Pass exactly one."
+    );
+  }
+  if (!wantsService && !wantsRunner) {
+    fail(
+      "RESET_SCOPE_MISSING",
+      "Pass `--service` to clear the service-level crash history, or `--runner` to clear a per-runner crash history."
+    );
+  }
+  const slockHome = resolveSlockHome();
+  if (wantsService) {
+    const result2 = await resetViaServiceOrDisk(
+      slockHome,
+      (client) => client.request("reset-service", void 0),
+      () => resetService(slockHome)
+    );
+    if (opts.json) {
+      info(JSON.stringify(result2));
+      return;
+    }
+    info(
+      `Reset service crash history (previous state: ${result2.previousState}; cleared ${result2.clearedCrashCount} entr${result2.clearedCrashCount === 1 ? "y" : "ies"}).`
+    );
+    info("Service state transitioned to `running`. Runners were not touched.");
+    return;
+  }
+  const serverId = await resolveTargetServerId({ server: opts.server });
+  const result = await resetViaServiceOrDisk(
+    slockHome,
+    (client) => client.request("reset-runner", { serverId }),
+    () => resetRunner(slockHome, serverId)
+  );
+  if (result.status === "not-found") {
+    fail(
+      "RESET_RUNNER_NOT_FOUND",
+      `Runner for server ${serverId} was not found.`
+    );
+  }
+  if (opts.json) {
+    info(JSON.stringify(result));
+    return;
+  }
+  info(
+    `Reset runner crash history for server ${result.serverId} (previous state: ${result.previousState}; cleared ${result.clearedCrashCount} entr${result.clearedCrashCount === 1 ? "y" : "ies"}).`
+  );
+  info("Runner state transitioned to `running`. Process was not respawned.");
+}
+
+// src/service.ts
+import { randomUUID as randomUUID2 } from "crypto";
+var seaRequire = createRequire2(import.meta.url);
+var cachedIsSea;
+function isSeaBinary() {
+  if (cachedIsSea !== void 0) return cachedIsSea;
+  try {
+    cachedIsSea = seaRequire("node:sea").isSea();
+  } catch {
+    cachedIsSea = false;
+  }
+  return cachedIsSea;
+}
+function buildResidentSpawn(mode, serverId, selfEntry = process.argv[1] ?? "", execArgv = process.execArgv, isSea = isSeaBinary()) {
+  const tail = serverId ? [mode, serverId] : [mode];
+  if (isSea) {
+    return { command: process.execPath, args: [...execArgv, ...tail] };
+  }
+  return { command: process.execPath, args: [...execArgv, selfEntry, ...tail] };
+}
+var PARENT_LOCK_HELD_ENV_VAR = "SLOCK_COMPUTER_PARENT_MUTATION_LOCK_HELD";
+async function spawnDetachedService(slockHome) {
+  await mkdir12(serviceRunDir(slockHome), { recursive: true });
+  const supLogFd = await open(serviceLogPath(slockHome), "a");
+  const { command, args } = buildResidentSpawn("__service", null);
+  const child = spawn2(command, args, {
+    detached: true,
+    stdio: ["ignore", supLogFd.fd, supLogFd.fd],
+    windowsHide: true,
+    env: { ...process.env, [PARENT_LOCK_HELD_ENV_VAR]: "1" }
+  });
+  child.on("error", (err) => {
+    process.stderr.write(
+      `${JSON.stringify({ ok: false, code: "SUPERVISOR_SPAWN_FAILED", message: err.message })}
+`
+    );
+  });
+  const pid = child.pid;
+  child.unref();
+  await supLogFd.close();
+  if (!pid) {
+    throw new Error("SUPERVISOR_SPAWN_FAILED: could not spawn the service process");
+  }
+  await writePidfileAt(servicePidPath(slockHome), pid);
+  return pid;
+}
+var EX_CONFIG_EXIT_CODE = 78;
+async function ensureSeaRuntimePackageDir() {
+  if (!isSeaBinary() || process.env.PI_PACKAGE_DIR) return;
+  try {
+    const dir = joinPath(resolveSlockHome(), "runtime-pkg");
+    await mkdir12(dir, { recursive: true });
+    await writeFile10(
+      joinPath(dir, "package.json"),
+      `${JSON.stringify({ name: "slock-computer-sea-runtime", version: COMPUTER_VERSION })}
+`
+    );
+    process.env.PI_PACKAGE_DIR = dir;
+  } catch {
+  }
+}
+var defaultCoreFactory = async (creds) => {
+  await ensureSeaRuntimePackageDir();
+  let coreMod;
+  try {
+    coreMod = await import("@botiverse/raft-daemon/core");
+  } catch (err) {
+    const code = err?.code;
+    const isModuleMissing = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || err instanceof Error && /Cannot find (module|package)/i.test(err.message);
+    if (isModuleMissing) {
+      process.stderr.write(
+        `slock-computer: per-server daemon failed to load \`@botiverse/raft-daemon/core\`.
+  Reason: ${err instanceof Error ? err.message : String(err)}
+  This usually means a source-run workspace without a built daemon dist.
+  Fix: run \`pnpm --filter @botiverse/raft-daemon build\` once, then \`slock-computer doctor <server> --reset-health && slock-computer start\`.
+  (Packaged/npx installs ship the dist already \u2014 this only affects local source-run setups.)
+`
+      );
+      process.exit(EX_CONFIG_EXIT_CODE);
+    }
+    throw err;
+  }
+  process.env.SLOCK_COMPUTER_VERSION = COMPUTER_VERSION;
+  return new coreMod.DaemonCore({
+    serverUrl: creds.serverUrl,
+    apiKey: creds.apiKey,
+    localTrace: true,
+    // In a SEA single-binary there is no sidecar `slock` CLI script for the
+    // daemon to resolve, so inject the `__cli` sentinel: the agent CLI wrapper
+    // then execs `<exe> __cli "$@"`, re-execing this binary in CLI mode
+    // (runBundledSlockCli). Normal installs leave this unset → the daemon
+    // resolves the bundled CLI dist path as before.
+    slockCliPath: isSeaBinary() ? "__cli" : void 0,
+    // Managed-Computer remote control (server → WS → runner). This runner
+    // is the service's in-process `__run` child, so:
+    //   restart → SIGTERM ourselves → runResident's shutdown does
+    //     core.stop() + exit 0 → classifyRunnerExit = graceful → the
+    //     service supervisor respawns this runner (effective restart).
+    //   upgrade (SEA + requestId) → run the SEA upgrade IN-PROCESS so we can
+    //     stream `computer:upgrade:progress` over this live WS, then SIGTERM
+    //     ourselves; the supervisor respawns the swapped binary and the new
+    //     process reports `done` via onComputerUpgradeReconcile on reconnect.
+    //   upgrade (non-SEA dev run, or no requestId) → SEA-only no-op. The
+    //     npm-install-root upgrade path is retired: a managed Computer is a
+    //     SEA single binary; a source/dev run has no binary to self-swap.
+    onComputerControl: (action, ctx) => {
+      if (action === "restart") {
+        process.kill(process.pid, "SIGTERM");
+        return;
+      }
+      if (isSeaBinary() && ctx.requestId) {
+        return runManagedSeaUpgrade(ctx.requestId, ctx);
+      }
+      console.warn(
+        `[Computer] Ignoring upgrade request: in-process SEA upgrade unavailable (isSea=${isSeaBinary()}, requestId=${ctx.requestId ? "present" : "absent"}). Managed upgrade requires a SEA binary invoked with a requestId.`
+      );
+    },
+    // Blip-stitch: on every (re)connect, if THIS process booted from a freshly
+    // swapped binary (a pending-upgrade marker is present), report the upgrade
+    // done with the version we actually are now, then clear the marker.
+    onComputerUpgradeReconcile: async (emitDone) => {
+      const slockHome = resolveSlockHome();
+      const marker = await readPendingUpgradeMarker(slockHome);
+      if (!marker) return;
+      const rolledBack = COMPUTER_VERSION !== marker.targetVersion;
+      emitDone({
+        requestId: marker.requestId,
+        ok: !rolledBack,
+        newVersion: COMPUTER_VERSION,
+        ...rolledBack ? { rolledBack: true } : {}
+      });
+      await clearPendingUpgradeMarker(slockHome);
+    }
+  });
+};
+function seaProgressToFrame(e) {
+  return { phase: e.phase, message: e.message, percent: e.percent };
+}
+async function runManagedSeaUpgrade(requestId, ctx) {
+  const slockHome = resolveSlockHome();
+  let result;
+  try {
+    result = await resolveAndRunSeaUpgrade({
+      slockHome,
+      requestId,
+      fromVersion: COMPUTER_VERSION,
+      currentBinaryPath: process.execPath,
+      nowIso: (/* @__PURE__ */ new Date()).toISOString(),
+      deps: {
+        onProgress: (e) => ctx.emitUpgradeProgress(seaProgressToFrame(e))
+      }
+    });
+  } catch (err) {
+    ctx.emitUpgradeDone({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    return;
+  }
+  if (!result.ok) {
+    ctx.emitUpgradeDone({ ok: false, error: result.reason ?? result.failedPhase ?? "upgrade_failed" });
+    return;
+  }
+  if (result.alreadyCurrent) {
+    ctx.emitUpgradeDone({ ok: true, newVersion: COMPUTER_VERSION });
+    return;
+  }
+  process.kill(process.pid, "SIGTERM");
+}
+function classifyRunnerExit(code, signal) {
+  if (code === EX_CONFIG_EXIT_CODE) return "config-error";
+  if (signal === "SIGTERM" || signal === "SIGINT") return "graceful";
+  if (code === 0) return "graceful";
+  return "crash";
+}
+async function runResident(serverId, deps = {}) {
+  assertValidServerId(serverId);
+  const slockHome = resolveSlockHome();
+  const a = await readServerAttachment(slockHome, serverId);
+  if (!a) {
+    fail(
+      "NO_ATTACHMENT",
+      `No attachment for server ${serverId}. Run \`slock-computer attach ${serverId}\` first.`
+    );
+  }
+  const core = await (deps.coreFactory ?? defaultCoreFactory)({
+    serverId: a.serverId,
+    serverMachineId: a.serverMachineId,
+    apiKey: a.apiKey,
+    serverUrl: a.serverUrl
+  });
+  let stopping = false;
+  const shutdown = async () => {
+    if (stopping) return;
+    stopping = true;
+    try {
+      await core.stop();
+    } finally {
+      process.exit(0);
+    }
+  };
+  process.on("SIGTERM", () => void shutdown());
+  process.on("SIGINT", () => void shutdown());
+  await core.start();
+}
+var RECONCILE_INTERVAL_MS = 5e3;
+var CHILD_RESTART_BACKOFF_MS = 2e3;
+function formatReadySummary(ready, serverIds, opts) {
+  if (opts.serverId && serverIds.length === 1) {
+    const pid = ready.get(opts.serverId);
+    return `Daemon for server ${opts.serverLabel ?? opts.serverId} is running${pid ? ` (pid ${pid})` : ""}.`;
+  }
+  return `Daemons for ${serverIds.length} managed server(s) are running.`;
 }
 async function runServiceStartupRecovery(slockHome) {
   const parentHoldsLock = process.env[PARENT_LOCK_HELD_ENV_VAR] === "1";
@@ -32327,10 +33294,10 @@ async function runServiceStartupRecovery(slockHome) {
 }
 async function resolveServiceIdentity() {
   const here = fileURLToPath2(import.meta.url);
-  const installRoot = dirname9(dirname9(here));
+  const installRoot = dirname11(dirname11(here));
   let version = null;
   try {
-    const raw = await readFile9(joinPath(installRoot, "package.json"), "utf8");
+    const raw = await readFile11(joinPath(installRoot, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       version = parsed.version;
@@ -32353,7 +33320,7 @@ async function writeServiceVersionEvidence(slockHome) {
     };
     const dest = serviceVersionPath(slockHome);
     const tmp = `${dest}.tmp`;
-    await writeFile9(tmp, JSON.stringify(payload) + "\n", { mode: 384 });
+    await writeFile10(tmp, JSON.stringify(payload) + "\n", { mode: 384 });
     await rename3(tmp, dest);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -32363,19 +33330,75 @@ async function writeServiceVersionEvidence(slockHome) {
     );
   }
 }
+async function startServiceIpcSeam(slockHome, mutations) {
+  const handlers = {
+    "service-status": async () => readServiceStatus(slockHome),
+    "runner-status": async ({ serverId }) => {
+      try {
+        return await readRunnerStatus(slockHome, serverId);
+      } catch (err) {
+        if (err instanceof StateReaderError) {
+          throw new ServiceClientError("IPC_MALFORMED_FRAME", `${err.code}: ${err.message}`);
+        }
+        throw err;
+      }
+    },
+    "list-runners": async () => listRunners(slockHome),
+    "reset-service": async () => mutations ? mutations.resetService() : resetService(slockHome),
+    "reset-runner": async ({ serverId }) => mutations ? mutations.resetRunner(serverId) : resetRunner(slockHome, serverId),
+    "upgrade-start": async (params) => {
+      if (!mutations) {
+        throw new ServiceClientError(
+          "IPC_MALFORMED_FRAME",
+          "upgrade-start requires a live supervisor mutation surface"
+        );
+      }
+      return mutations.upgradeStart(params);
+    }
+  };
+  const ipc = createIpcServer({ installRoot: slockHome, handlers });
+  try {
+    const transportPath = await ipc.listen();
+    process.stderr.write(`Service: IPC seam listening at ${transportPath}
+`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      `Service: IPC seam failed to bind (${msg}); continuing without typed-RPC surface.
+`
+    );
+  }
+  return ipc;
+}
 async function runService() {
   const slockHome = resolveSlockHome();
-  await mkdir10(serviceRunDir(slockHome), { recursive: true });
+  await mkdir12(serviceRunDir(slockHome), { recursive: true });
   await runServiceStartupRecovery(slockHome);
   await writePidfileAt(servicePidPath(slockHome), process.pid);
   await writeServiceVersionEvidence(slockHome);
-  const children = /* @__PURE__ */ new Map();
-  const restarting = /* @__PURE__ */ new Set();
+  const runners2 = /* @__PURE__ */ new Map();
+  let shuttingDown = false;
+  let inFlightUpgrade = null;
   const { [PARENT_LOCK_HELD_ENV_VAR]: _parentLockMarker, ...childEnv } = process.env;
+  const emitTransition = (serverId, from, to, trigger) => {
+    void emitRunnerStateTransition(slockHome, serverId, from, to, trigger);
+  };
+  let scheduleReconcile = () => {
+  };
   const spawnChild = async (serverId) => {
-    if (children.has(serverId)) return;
+    if (shuttingDown) return;
+    const existing = runners2.get(serverId);
+    if (existing?.child) return;
+    const fromState = existing?.lifecycle ?? "stopped";
+    const record = existing ?? { serverId, lifecycle: "stopped", stopping: false };
+    record.lifecycle = "starting";
+    record.stopping = false;
+    record.backoffUntil = void 0;
+    record.child = void 0;
+    runners2.set(serverId, record);
+    emitTransition(serverId, fromState, "starting", RUNNER_TRIGGER.spawn);
     const logPath = serverRunnerLogPath(slockHome, serverId);
-    await mkdir10(dirname9(logPath), { recursive: true });
+    await mkdir12(dirname11(logPath), { recursive: true });
     const logFd = await open(logPath, "a");
     const { command, args } = buildResidentSpawn("__run", serverId);
     const child = spawn2(command, args, {
@@ -32384,87 +33407,159 @@ async function runService() {
       env: childEnv
     });
     await logFd.close();
-    if (!child.pid) return;
-    const handle = { serverId, child, stopping: false };
-    children.set(serverId, handle);
+    if (!child.pid) {
+      record.lifecycle = "crashed";
+      record.backoffUntil = Date.now() + CHILD_RESTART_BACKOFF_MS;
+      emitTransition(serverId, "starting", "crashed", RUNNER_TRIGGER.spawnFailed);
+      scheduleReconcile(CHILD_RESTART_BACKOFF_MS);
+      return;
+    }
+    record.child = child;
+    record.lifecycle = "running";
+    emitTransition(serverId, "starting", "running", RUNNER_TRIGGER.ready);
     await writePidfileAt(serverRunnerPidPath(slockHome, serverId), child.pid);
     child.on("exit", (code, signal) => {
       void (async () => {
-        children.delete(serverId);
+        const rec = runners2.get(serverId);
+        if (!rec) return;
+        rec.child = void 0;
         await clearPidfileAt(serverRunnerPidPath(slockHome, serverId));
-        if (handle.stopping) return;
-        const classification = classifyRunnerExit(code, signal);
-        if (classification === "config-error") {
+        if (rec.stopping) {
+          const trigger = shuttingDown ? RUNNER_TRIGGER.shutdownStop : RUNNER_TRIGGER.detachStop;
+          const prev2 = rec.lifecycle;
+          rec.lifecycle = "stopped";
+          emitTransition(serverId, prev2, "stopped", trigger);
+          return;
+        }
+        const exitClass = classifyRunnerExit(code, signal);
+        if (exitClass === "config-error") {
           try {
             await markFatalConfig(slockHome, serverId, code, signal);
           } catch {
           }
+          const prev2 = rec.lifecycle;
+          rec.lifecycle = "degraded";
+          emitTransition(serverId, prev2, "degraded", RUNNER_TRIGGER.exitConfigError);
           process.stderr.write(
             `Service: server ${serverId} child exited with EX_CONFIG (${EX_CONFIG_EXIT_CODE}); marked degraded, NOT auto-restarting. See ${serverRunnerLogPath(slockHome, serverId)} for the actionable error.
 `
           );
           return;
         }
-        if (classification === "graceful") {
-          restarting.add(serverId);
+        if (exitClass === "crash") {
           try {
-            await new Promise((r) => setTimeout(r, CHILD_RESTART_BACKOFF_MS));
-            if (await readServerAttachment(slockHome, serverId) && !shuttingDown) {
-              await spawnChild(serverId);
-            }
-          } finally {
-            restarting.delete(serverId);
+            await recordCrash(slockHome, serverId, code, signal);
+          } catch {
           }
-          return;
         }
-        try {
-          await recordCrash(slockHome, serverId, code, signal);
-        } catch {
-        }
-        if (await isDegraded(slockHome, serverId)) {
+        const budgetBreached = exitClass === "crash" ? await isDegraded(slockHome, serverId) : false;
+        const prev = rec.lifecycle;
+        const to = nextRunnerStateOnExit(exitClass, budgetBreached);
+        rec.lifecycle = to;
+        emitTransition(serverId, prev, to, exitTrigger(exitClass, budgetBreached));
+        if (to === "degraded") {
           process.stderr.write(
             `Service: server ${serverId} marked degraded (>=3 crashes in 60s); skipping auto-restart. Run \`slock-computer doctor ${serverId} --reset-health\` after fixing the underlying issue.
 `
           );
           return;
         }
-        restarting.add(serverId);
-        try {
-          await new Promise((r) => setTimeout(r, CHILD_RESTART_BACKOFF_MS));
-          if (await readServerAttachment(slockHome, serverId) && !shuttingDown) {
-            await spawnChild(serverId);
-          }
-        } finally {
-          restarting.delete(serverId);
-        }
+        rec.backoffUntil = Date.now() + CHILD_RESTART_BACKOFF_MS;
+        scheduleReconcile(CHILD_RESTART_BACKOFF_MS);
       })();
     });
   };
-  const killChild = (handle) => {
-    handle.stopping = true;
+  const killChild = (rec) => {
+    rec.stopping = true;
     try {
-      handle.child.kill("SIGTERM");
+      rec.child?.kill("SIGTERM");
     } catch {
     }
   };
   const reconcile = async () => {
+    if (shuttingDown) return;
     const wanted = new Set(await listManagedServerIds(slockHome));
+    const now = Date.now();
     for (const id of wanted) {
-      if (canSupervisorSpawnChild(id, children, restarting)) await spawnChild(id);
+      if (canSpawn(runners2.get(id), true, now)) await spawnChild(id);
     }
-    for (const [id, handle] of children) {
-      if (!wanted.has(id)) killChild(handle);
+    for (const [id, rec] of runners2) {
+      if (!wanted.has(id) && rec.child) killChild(rec);
     }
   };
-  let shuttingDown = false;
+  scheduleReconcile = (delayMs) => {
+    setTimeout(() => void reconcile(), Math.max(0, delayMs));
+  };
+  const ipc = await startServiceIpcSeam(slockHome, {
+    resetService: () => resetService(slockHome),
+    resetRunner: async (serverId) => {
+      const result = await resetRunner(slockHome, serverId);
+      if (result.status === "ok") {
+        const rec = runners2.get(serverId);
+        if (rec && applyRunnerReset(rec)) {
+          emitTransition(serverId, "degraded", "stopped", RUNNER_TRIGGER.reset);
+          scheduleReconcile(0);
+        }
+      }
+      return result;
+    },
+    // `upgrade-start` (phase ①b): the running service drives the SEA upgrade
+    // in-process (reusing the tested resolveAndRunSeaUpgrade) instead of the
+    // service spawning a `slock-computer upgrade` subprocess — single-writer
+    // initiation. Async: resolve the target version (so the `started` response
+    // carries it), then kick off download+verify+swap WITHOUT awaiting so the
+    // IPC response flushes first; the swap + self-restart use the EXISTING
+    // mechanism unchanged (path 1 — restart is orthogonal, evolving under XX).
+    // A second concurrent upgrade-start is reported `already-running`.
+    upgradeStart: async ({ targetVersion: explicit }) => {
+      if (!isSeaBinary()) {
+        throw new ServiceClientError(
+          "IPC_MALFORMED_FRAME",
+          "upgrade-start is SEA-only; this service is a non-SEA (dev/npm) run"
+        );
+      }
+      if (inFlightUpgrade) {
+        return { status: "already-running", ...inFlightUpgrade };
+      }
+      const channel2 = await readChannel(slockHome);
+      const baseUrl = resolveUpgradeBaseUrl();
+      const resolved = explicit ?? await resolveSeaTargetVersion(channel2, baseUrl) ?? COMPUTER_VERSION;
+      const upgradeId = randomUUID2();
+      inFlightUpgrade = { upgradeId, targetVersion: resolved };
+      void (async () => {
+        try {
+          await resolveAndRunSeaUpgrade({
+            slockHome,
+            requestId: upgradeId,
+            fromVersion: COMPUTER_VERSION,
+            currentBinaryPath: process.execPath,
+            nowIso: (/* @__PURE__ */ new Date()).toISOString(),
+            deps: explicit ? { resolveTargetVersion: async () => explicit } : void 0
+          });
+        } catch (err) {
+          process.stderr.write(
+            `Service: upgrade ${upgradeId} failed: ${err instanceof Error ? err.message : String(err)}
+`
+          );
+        } finally {
+          inFlightUpgrade = null;
+        }
+      })();
+      return { status: "started", upgradeId, targetVersion: resolved };
+    }
+  });
   const shutdown = () => {
     if (shuttingDown) return;
     shuttingDown = true;
-    for (const handle of children.values()) killChild(handle);
+    for (const rec of runners2.values()) if (rec.child) killChild(rec);
+    void ipc.close();
     void clearPidfileAt(servicePidPath(slockHome)).then(() => process.exit(0));
   };
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
+  for (const id of await listManagedServerIds(slockHome)) {
+    runners2.set(id, rehydrateRunnerRecord(id, await isDegraded(slockHome, id)));
+  }
   await reconcile();
   const timer = setInterval(() => {
     void reconcile();
@@ -32586,7 +33681,7 @@ async function runDetach(serverId, serverLabel = serverId) {
 var USER_SESSION_EXPIRY_LEEWAY_MS = 3e4;
 async function readUserSessionAuth(slockHome) {
   try {
-    const parsed = JSON.parse(await readFile10(userSessionPath(slockHome), "utf8"));
+    const parsed = JSON.parse(await readFile12(userSessionPath(slockHome), "utf8"));
     return {
       accessToken: typeof parsed.accessToken === "string" ? parsed.accessToken : "",
       ...typeof parsed.serverUrl === "string" ? { serverUrl: parsed.serverUrl } : {}
@@ -32597,7 +33692,7 @@ async function readUserSessionAuth(slockHome) {
 }
 async function hasValidUserSession(slockHome) {
   try {
-    const parsed = JSON.parse(await readFile10(userSessionPath(slockHome), "utf8"));
+    const parsed = JSON.parse(await readFile12(userSessionPath(slockHome), "utf8"));
     return parsed.kind === "user-session" && typeof parsed.accessToken === "string" && parsed.accessToken.length > 0 && !isJwtExpired(parsed.accessToken);
   } catch {
     return false;
@@ -32617,7 +33712,7 @@ async function refreshUserSession(slockHome, serverUrl) {
   const file = userSessionPath(slockHome);
   let session;
   try {
-    session = JSON.parse(await readFile10(file, "utf8"));
+    session = JSON.parse(await readFile12(file, "utf8"));
   } catch {
     return false;
   }
@@ -32636,8 +33731,8 @@ async function refreshUserSession(slockHome, serverUrl) {
     if (res.status !== 200 || typeof body?.accessToken !== "string" || typeof body.refreshToken !== "string") {
       return false;
     }
-    await mkdir11(dirname10(file), { recursive: true });
-    await writeFile10(
+    await mkdir13(dirname12(file), { recursive: true });
+    await writeFile11(
       tmpFile,
       JSON.stringify(
         {
@@ -32654,7 +33749,7 @@ async function refreshUserSession(slockHome, serverUrl) {
       ),
       { mode: 384 }
     );
-    await chmod5(tmpFile, 384);
+    await chmod6(tmpFile, 384);
     await rename4(tmpFile, file);
     return true;
   } catch {
@@ -32923,276 +34018,49 @@ async function runSetup(opts, deps = {}) {
             if (!validation.ok) {
               info(
                 `Migration: ${validation.code} \u2014 ${manualPathErrorMessage(validation.code, selection.path)} Returning to picker.`
-              );
-              continue pickerLoop;
-            }
-            await runRosterAdoption(opts, validation.candidate, adoptLegacyByFingerprint2);
-            migrated = true;
-            break pickerLoop;
-          } else {
-            info("Migration: fresh attach selected.");
-            break pickerLoop;
-          }
-        }
-      }
-    }
-    if (!migrated) {
-      await attach2({
-        serverSlug: opts.serverSlug,
-        serverUrl: opts.serverUrl,
-        name: opts.name,
-        run: false,
-        orchestrated: true
-      });
-    }
-    attachment = await resolveAttachedServerSlug(slockHome, opts.serverSlug);
-    if (!attachment) {
-      fail(
-        "SETUP_ATTACHMENT_MISSING",
-        `Setup did not produce a local attachment for ${label}. Re-run \`slock-computer attach ${label}\`.`
-      );
-    }
-  }
-  if (opts.start === false) {
-    info(`Start: skipped (--no-start). Run \`slock-computer start ${label}\` when ready.`);
-    return;
-  }
-  await start2({
-    serverId: attachment.serverId,
-    serverLabel: opts.serverSlug,
-    foreground: opts.foreground
-  });
-}
-
-// src/status.ts
-init_esm_shims();
-import { readFile as readFile11 } from "fs/promises";
-async function readUserSession(path3) {
-  try {
-    const parsed = JSON.parse(await readFile11(path3, "utf8"));
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return { state: "present", session: parsed, error: null };
-    }
-    return { state: "invalid", session: null, error: "not a JSON object" };
-  } catch (err) {
-    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
-      return { state: "missing", session: null, error: null };
-    }
-    return {
-      state: "invalid",
-      session: null,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-function str(v) {
-  return typeof v === "string" && v.length > 0 ? v : null;
-}
-async function pidStatus(pidfile) {
-  const pid = await readPidfileAt(pidfile);
-  return pid !== null && isProcessAlive2(pid) ? { running: true, pid } : { running: false };
-}
-async function serviceState(slockHome) {
-  const { pid } = await findLiveServicePidReadOnly(slockHome);
-  return pid !== null ? { running: true, pid } : { running: false };
-}
-async function deriveHealth(slockHome, serverId, daemon) {
-  if (!daemon.running) return "offline";
-  if (await isDegraded(slockHome, serverId)) return "degraded";
-  return "ok";
-}
-async function buildStatusReport(installRoot) {
-  const sessionRead = await readUserSession(userSessionPath(installRoot));
-  const session = sessionRead.session;
-  const attachments = await listServerAttachments(installRoot);
-  const service = {
-    ...await serviceState(installRoot),
-    logPath: serviceLogPath(installRoot)
-  };
-  const servers = [];
-  for (const a of attachments) {
-    const daemon = await pidStatus(serverRunnerPidPath(installRoot, a.serverId));
-    servers.push({
-      serverId: a.serverId,
-      serverSlug: a.serverSlug ?? null,
-      serverMachineId: a.serverMachineId,
-      serverUrl: a.serverUrl,
-      attachedAt: a.attachedAt ?? null,
-      serverRunnerLogPath: serverRunnerLogPath(installRoot, a.serverId),
-      daemon,
-      health: await deriveHealth(installRoot, a.serverId, daemon)
-    });
-  }
-  const loggedIn = session?.kind === "user-session" && typeof session.accessToken === "string" && session.accessToken.length > 0;
-  return {
-    slockHome: installRoot,
-    loggedIn,
-    userId: session ? str(session.userId) : null,
-    loginServerUrl: session ? str(session.serverUrl) : null,
-    userSessionError: sessionRead.state === "invalid" ? sessionRead.error : null,
-    service,
-    servers
-  };
-}
-function pad(s, n) {
-  return s.length >= n ? s : s + " ".repeat(n - s.length);
-}
-async function runStatus(opts) {
-  const report = await buildStatusReport(resolveSlockHome());
-  if (opts.json) {
-    info(JSON.stringify(report, null, 2));
-    return;
-  }
-  info("");
-  info(`SLOCK_HOME:   ${report.slockHome}`);
-  const loginDetail = report.userSessionError ? "no \u2014 user session file is invalid; re-run `slock-computer login`" : report.loggedIn ? `yes (user ${report.userId ?? "?"})` : "no \u2014 run `slock-computer login`";
-  info(
-    `Logged in:    ${loginDetail}`
-  );
-  if (report.loginServerUrl) info(`Login server: ${report.loginServerUrl}`);
-  info(
-    `Service:   ${report.service.running ? `running (pid ${report.service.pid})` : "stopped \u2014 run `slock-computer start`"}`
-  );
-  info(`Service log: ${report.service.logPath}`);
-  info("");
-  if (report.servers.length === 0) {
-    info("Attachments:  none \u2014 run `slock-computer attach /<serverSlug>` (e.g. `/myserver`).");
-  } else {
-    info("Attachments:");
-    info(`  ${pad("SERVER", 24)}${pad("HEALTH", 12)}${pad("DAEMON", 24)}${pad("MACHINE", 38)}URL`);
-    for (const s of report.servers) {
-      const dcol = s.daemon.running ? `running (pid ${s.daemon.pid})` : "stopped";
-      info(
-        `  ${pad(formatServerSlugDisplay(s.serverSlug), 24)}${pad(s.health, 12)}${pad(dcol, 24)}${pad(s.serverMachineId, 38)}${s.serverUrl}`
-      );
-      info(`    Server runner log: ${s.serverRunnerLogPath}`);
-    }
-    if (report.servers.some((s) => s.health === "degraded")) {
-      info("");
-      info(
-        "  Note: one or more servers are `degraded` (repeated crashes; auto-restart paused)."
-      );
-      info(
-        "  Run `slock-computer doctor /<serverSlug> --reset-health` (e.g. `/myserver`) after fixing the underlying issue."
-      );
-    }
-  }
-  info("");
-}
-
-// src/runners.ts
-init_esm_shims();
-
-// src/targetServer.ts
-init_esm_shims();
-function attachmentLabel(a) {
-  return formatServerSlugDisplay(a.serverSlug);
-}
-async function refreshAttachmentSlug(home, attachment) {
-  try {
-    const client = new ComputerAttachClient(attachment.serverUrl, "");
-    const result = await client.preflight(attachment.apiKey);
-    if (!result.ok || !result.serverSlug || result.serverSlug === attachment.serverSlug) {
-      return attachment;
-    }
-    const updated = { ...attachment, serverSlug: result.serverSlug };
-    await writeServerAttachment(home, updated);
-    return updated;
-  } catch {
-    return attachment;
-  }
-}
-async function listAttachmentsWithFreshSlugs(home) {
-  const attachments = await listServerAttachments(home);
-  return await Promise.all(attachments.map((a) => refreshAttachmentSlug(home, a)));
-}
-async function resolveTargetServerId(opts) {
-  const home = resolveSlockHome();
-  let attachments = await listServerAttachments(home);
-  if (attachments.length === 0) {
-    fail("NO_ATTACHMENT", "No server attachments yet. Run `slock-computer attach /<serverSlug>` (e.g. `/myserver`) first.");
-  }
-  const requested = normalizeServerSlug(opts.server ?? "");
-  if (requested) {
-    let found = attachments.find((a) => a.serverSlug === requested);
-    if (!found) {
-      attachments = await listAttachmentsWithFreshSlugs(home);
-      found = attachments.find((a) => a.serverSlug === requested);
+              );
+              continue pickerLoop;
+            }
+            await runRosterAdoption(opts, validation.candidate, adoptLegacyByFingerprint2);
+            migrated = true;
+            break pickerLoop;
+          } else {
+            info("Migration: fresh attach selected.");
+            break pickerLoop;
+          }
+        }
+      }
     }
-    if (!found) {
-      fail(
-        "NOT_ATTACHED",
-        `Server slug ${formatServerSlugDisplay(requested)} is not attached. Attached server slugs: ${attachments.map(attachmentLabel).join(", ")}.`
-      );
+    if (!migrated) {
+      await attach2({
+        serverSlug: opts.serverSlug,
+        serverUrl: opts.serverUrl,
+        name: opts.name,
+        run: false,
+        orchestrated: true
+      });
     }
-    return found.serverId;
-  }
-  if (attachments.length === 1) return attachments[0].serverId;
-  fail(
-    "AMBIGUOUS_SERVER",
-    `Multiple servers attached (${attachments.map(attachmentLabel).join(", ")}). Pass \`--server /<serverSlug>\` (e.g. \`--server ${attachmentLabel(attachments[0])}\`) to choose one.`
-  );
-}
-async function resolveTargetAttachment(opts) {
-  const serverId = await resolveTargetServerId(opts);
-  const a = await readServerAttachment(resolveSlockHome(), serverId);
-  if (!a) {
-    const label = opts.server ?? serverId;
-    fail("INVALID_ATTACHMENT", `Attachment for ${label} is missing/invalid. Re-run \`slock-computer attach ${label}\`.`);
-  }
-  return a;
-}
-
-// src/lib/readers.ts
-init_esm_shims();
-
-// src/lib/types.ts
-init_esm_shims();
-var StateReaderError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "StateReaderError";
-    this.code = code;
-  }
-};
-
-// src/lib/readers.ts
-async function listRunners(installRoot, opts = {}) {
-  const all = await listServerAttachments(installRoot);
-  let subset = all;
-  if (opts.serverId !== void 0) {
-    const found = all.find((a) => a.serverId === opts.serverId);
-    if (!found) {
-      throw new StateReaderError(
-        "NOT_ATTACHED",
-        `Server ${opts.serverId} is not attached to this Computer.`
+    attachment = await resolveAttachedServerSlug(slockHome, opts.serverSlug);
+    if (!attachment) {
+      fail(
+        "SETUP_ATTACHMENT_MISSING",
+        `Setup did not produce a local attachment for ${label}. Re-run \`slock-computer attach ${label}\`.`
       );
     }
-    subset = [found];
   }
-  const servers = [];
-  for (const a of subset) {
-    const client = new RunnersClient(a.serverUrl, a.apiKey);
-    const result = await client.list();
-    const idCols = { serverId: a.serverId, serverSlug: a.serverSlug ?? null };
-    if (result.status === "success") {
-      servers.push({
-        ...idCols,
-        status: "ok",
-        whitelist: result.whitelist,
-        runners: result.runners
-      });
-    } else if (result.status === "unauthorized") {
-      servers.push({ ...idCols, status: "unauthorized" });
-    } else {
-      servers.push({ ...idCols, status: "error", code: result.code });
-    }
+  if (opts.start === false) {
+    info(`Start: skipped (--no-start). Run \`slock-computer start ${label}\` when ready.`);
+    return;
   }
-  return { servers };
+  await start2({
+    serverId: attachment.serverId,
+    serverLabel: opts.serverSlug,
+    foreground: opts.foreground
+  });
 }
 
 // src/runners.ts
+init_esm_shims();
 async function runRunnersList(opts) {
   const serverId = await resolveTargetServerId({ server: opts.server });
   const installRoot = resolveSlockHome();
@@ -33397,14 +34265,14 @@ async function runDoctor(opts) {
 
 // src/logs.ts
 init_esm_shims();
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 var DEFAULT_LINES = 200;
 async function runLogs(opts) {
   const home = resolveSlockHome();
   const file = opts.service ? serviceLogPath(home) : serverRunnerLogPath(home, await resolveTargetServerId({ server: opts.server }));
   let content;
   try {
-    content = await readFile12(file, "utf8");
+    content = await readFile13(file, "utf8");
   } catch {
     fail(
       "NO_DAEMON_LOG",
@@ -33418,166 +34286,16 @@ async function runLogs(opts) {
   for (const line of tail) info(redactSecrets(line));
 }
 
-// src/reset.ts
-init_esm_shims();
-
-// src/serviceState.ts
-init_esm_shims();
-import { mkdir as mkdir12, readFile as readFile13, writeFile as writeFile11, appendFile as appendFile3 } from "fs/promises";
-import { dirname as dirname11 } from "path";
-
-// src/lib/state.ts
-init_esm_shims();
-var SERVICE_STATE_VALUES = [
-  "starting",
-  "running",
-  "degraded",
-  "stopping",
-  "stopped"
-];
-function isServiceState(value) {
-  return typeof value === "string" && SERVICE_STATE_VALUES.includes(value);
-}
-
-// src/serviceState.ts
-var DEFAULT_STATE = {
-  state: "running",
-  crashHistory: []
-};
-async function readServiceState(slockHome) {
-  try {
-    const raw = await readFile13(serviceStatePath(slockHome), "utf8");
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object") return { ...DEFAULT_STATE };
-    const obj = parsed;
-    const state = isServiceState(obj.state) ? obj.state : "running";
-    const crashHistory = Array.isArray(obj.crashHistory) ? obj.crashHistory.filter(isCrashEntry) : [];
-    return { state, crashHistory };
-  } catch {
-    return { ...DEFAULT_STATE };
-  }
-}
-async function writeServiceState(slockHome, file) {
-  const path3 = serviceStatePath(slockHome);
-  await mkdir12(dirname11(path3), { recursive: true });
-  await writeFile11(path3, JSON.stringify(file), { mode: 384 });
-}
-function isCrashEntry(value) {
-  if (!value || typeof value !== "object") return false;
-  const obj = value;
-  return typeof obj.at === "string";
-}
-async function emitServiceStateTransition(slockHome, fromState, toState, trigger) {
-  const entry = {
-    at: (/* @__PURE__ */ new Date()).toISOString(),
-    kind: "service-state-changed",
-    fromState,
-    toState,
-    trigger
-  };
-  try {
-    const path3 = serviceLogPath(slockHome);
-    await mkdir12(dirname11(path3), { recursive: true });
-    await appendFile3(path3, JSON.stringify(entry) + "\n");
-  } catch {
-  }
-}
-async function clearServiceCrashHistory(slockHome) {
-  const current = await readServiceState(slockHome);
-  const previousState = current.state;
-  const clearedCrashCount = current.crashHistory.length;
-  const next = { state: "running", crashHistory: [] };
-  await writeServiceState(slockHome, next);
-  await emitServiceStateTransition(
-    slockHome,
-    previousState,
-    "running",
-    "reset-service"
-  );
-  return { previousState, clearedCrashCount };
-}
-
-// src/reset.ts
-async function resetService(installRoot) {
-  const { previousState, clearedCrashCount } = await clearServiceCrashHistory(installRoot);
-  return {
-    status: "ok",
-    previousState,
-    clearedCrashCount
-  };
-}
-async function resetRunner(installRoot, serverId) {
-  const attachment = await readServerAttachment(installRoot, serverId);
-  if (!attachment) {
-    return { status: "not-found", serverId };
-  }
-  const outcome = await resetRunnerHealth(installRoot, serverId);
-  if (outcome.status === "not-found") {
-    return { status: "not-found", serverId };
-  }
-  return {
-    status: "ok",
-    serverId,
-    previousState: outcome.previousState ?? "running",
-    clearedCrashCount: outcome.clearedCrashCount ?? 0
-  };
-}
-async function runReset(opts) {
-  const wantsService = opts.service === true;
-  const wantsRunner = opts.runner === true;
-  if (wantsService && wantsRunner) {
-    fail(
-      "RESET_SCOPE_AMBIGUOUS",
-      "`--service` and `--runner` are mutually exclusive. Pass exactly one."
-    );
-  }
-  if (!wantsService && !wantsRunner) {
-    fail(
-      "RESET_SCOPE_MISSING",
-      "Pass `--service` to clear the service-level crash history, or `--runner` to clear a per-runner crash history."
-    );
-  }
-  const slockHome = resolveSlockHome();
-  if (wantsService) {
-    const result2 = await resetService(slockHome);
-    if (opts.json) {
-      info(JSON.stringify(result2));
-      return;
-    }
-    info(
-      `Reset service crash history (previous state: ${result2.previousState}; cleared ${result2.clearedCrashCount} entr${result2.clearedCrashCount === 1 ? "y" : "ies"}).`
-    );
-    info("Service state transitioned to `running`. Runners were not touched.");
-    return;
-  }
-  const serverId = await resolveTargetServerId({ server: opts.server });
-  const result = await resetRunner(slockHome, serverId);
-  if (result.status === "not-found") {
-    fail(
-      "RESET_RUNNER_NOT_FOUND",
-      `Runner for server ${serverId} was not found.`
-    );
-  }
-  if (opts.json) {
-    info(JSON.stringify(result));
-    return;
-  }
-  info(
-    `Reset runner crash history for server ${result.serverId} (previous state: ${result.previousState}; cleared ${result.clearedCrashCount} entr${result.clearedCrashCount === 1 ? "y" : "ies"}).`
-  );
-  info("Runner state transitioned to `running`. Process was not respawned.");
-}
-
 // src/concurrency.ts
 init_esm_shims();
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import { mkdir as mkdir13 } from "fs/promises";
+import { mkdir as mkdir14 } from "fs/promises";
 import { join as join5 } from "path";
 var STALE_LOCK_THRESHOLD_MS = 6e4;
 async function withMutationLock(fn) {
   const slockHome = resolveSlockHome();
   const lockTarget = computerDir(slockHome);
-  await mkdir13(lockTarget, { recursive: true });
+  await mkdir14(lockTarget, { recursive: true });
   const lockfilePath = join5(lockTarget, ".lock");
   let release = null;
   try {
@@ -33618,21 +34336,19 @@ async function withMutationLock(fn) {
 init_esm_shims();
 import { readFile as readFile14, rm as rm4 } from "fs/promises";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname12, join as join6 } from "path";
+import { dirname as dirname13, join as join6 } from "path";
 
 // src/upgradeLog.ts
 init_esm_shims();
-import { chmod as chmod6, mkdir as mkdir14, open as open2 } from "fs/promises";
+import { chmod as chmod7, mkdir as mkdir15, open as open2 } from "fs/promises";
 var FILE_MODE = 384;
 function resolveUpgradeTrigger(raw) {
   return raw === "web" || raw === "tray" ? raw : "cli";
 }
 var UPGRADE_ERROR_CODES = [
-  "UPGRADE_DEPS_CHANGED",
   "UPGRADE_NETWORK_FAILED",
   "UPGRADE_INTEGRITY_FAILED",
   "UPGRADE_SWAP_FAILED",
-  "UPGRADE_RESTART_FAILED",
   "UPGRADE_NO_TARGET",
   "UPGRADE_ALREADY_RUNNING"
 ];
@@ -33670,7 +34386,7 @@ function assertUpgradeLogEntry(entry) {
 }
 async function appendUpgradeLogEntry(slockHome, entry) {
   assertUpgradeLogEntry(entry);
-  await mkdir14(computerDir(slockHome), { recursive: true });
+  await mkdir15(computerDir(slockHome), { recursive: true });
   const path3 = upgradeLogPath(slockHome);
   const at = entry.at ?? formatUpgradeLogTimestamp();
   const fullEntry = { ...entry, at };
@@ -33682,7 +34398,7 @@ async function appendUpgradeLogEntry(slockHome, entry) {
     await handle.close();
   }
   if (process.platform !== "win32") {
-    await chmod6(path3, FILE_MODE);
+    await chmod7(path3, FILE_MODE);
   }
 }
 
@@ -33840,7 +34556,7 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
 }
 function defaultCurrentBinaryDir() {
   const here = fileURLToPath3(import.meta.url);
-  return dirname12(dirname12(here));
+  return dirname13(dirname13(here));
 }
 async function defaultCurrentVersion() {
   if (isSeaBinary()) return COMPUTER_VERSION;
@@ -33985,6 +34701,31 @@ program2.command("upgrade").description(
     async (opts) => {
       const slockHome = resolveSlockHome();
       const trigger = resolveUpgradeTrigger(process.env.SLOCK_UPGRADE_TRIGGER);
+      if (!opts.dryRun && !opts.channel) {
+        let client = null;
+        try {
+          client = await connectService(slockHome);
+        } catch {
+          client = null;
+        }
+        if (client) {
+          try {
+            const r = await client.request("upgrade-start", {
+              targetVersion: opts.targetVersion
+            });
+            if (r.status === "already-running") {
+              info(`An upgrade to ${r.targetVersion} is already running (id ${r.upgradeId}).`);
+            } else {
+              info(
+                `Upgrade to ${r.targetVersion} started (id ${r.upgradeId}). The service downloads, verifies, swaps the binary, and restarts on it; run \`slock-computer status\` to confirm.`
+              );
+            }
+          } finally {
+            await client.close();
+          }
+          return;
+        }
+      }
       try {
         await withMutationLock(
           () => runUpgradeCli(slockHome, {