@c4roa0/agentpay-user 0.0.0-stage → 0.3.0

package/progress.md

@@ -0,0 +1,178 @@
+# AgentPay User progress
+
+## User 0.3.0 first publication prepared — 2026-11-07
+
+Owner authorized the first npm publication. The package's private gate is removed;
+README now describes the npm entry and exact Wallet dependency. GitHub `publish.yml`
+uses the `npm-publish` environment and OIDC for subsequent releases. Initial Token
+upload, public-registry verification and Trusted Publisher validation are pending.
+No published-success claim is made by the prepared package or workflow.
+
+
+## npm update and migration review fixes — 2026-11-07
+
+Approved `agentpay update [-f]`: query npm, confirm the exact User release and its
+pinned Wallet, check requirements, stop managed services, install and invoke the new
+repair/official-test digest. Other Skills, original test requests, Policies and keys
+are preserved. No paid test is triggered. Source/npm-link checkouts are not replaced.
+
+Review fixes: relocation-aware preparation validates without rewriting the client
+path before services stop; explicit data purge also retires matching legacy source
+checkpoints/configuration; packaged documentation includes its referenced public
+entry files. Independent regression suite: 374 passed; final targeted checks: 35
+passed. Real npm replacement between two local unpublished tarballs and new-process
+repair passed with controlled registry metadata/service readiness. User npm release
+and real published-version upgrade acceptance remain pending; no participant services changed.
+
+
+## User npm integration candidate complete — 2026-11-07
+
+User 0.3.0 now pins public Wallet 0.3.0 and Protocol 0.14.3, resolves public Wallet
+exports and exposes `agentpay`. Installer/setup, managed service paths, repair and
+explicit uninstall modes no longer require sibling Wallet source or a compiler.
+Private data remains outside program files. Old custom data selections are retained;
+repair can refresh a moved client-module path only with matching URL/credential.
+Service changes are covered by the installer lock.
+
+Independent User tests passed (366 in the complete suite, followed by targeted
+migration/concurrency regressions). A packed User installed from its tarball with
+public dependencies and passed real isolated Wallet/Runtime restart checks without
+sibling source. No participant service, Policy, key or Order was changed. User is
+still `private: true`; no User npm upload or Market guide deployment occurred.
+See the [User package integration record](doc/reference/npm-integration-verification.md) for evidence and remaining limits.
+
+Next: review the candidate, then participant install/upgrade/restart/uninstall
+acceptance. Running-daemon version negotiation, User OIDC publication and Market
+install instructions remain open. Wallet Trusted Publisher is configured by the
+owner and pending its first OIDC publication. Earlier sections below are historical
+milestones; their sibling-build and unpublished-Wallet statements are superseded.
+
+
+## Wallet first npm publication complete — 2026-11-07
+
+`@c4roa0/agentpay-wallet@0.3.0` is public; npm `latest` is 0.3.0. The owner
+published the verified artifact using a hidden-input Token. Registry SHA-512
+integrity matches the local artifact. A fresh public-registry installation with
+scripts disabled passed installed CLI and real IPC permission/unlock/restart checks;
+disposable test data was removed. Source revision: Wallet `082a8db`.
+
+The publication workflow is on GitHub, but Wallet's npm Trusted Publisher setup
+and first OIDC publication remain unverified. User 0.2.0 still rejects this Wallet
+pair; next development loop is User package adoption. No live Wallet services,
+keys, Policies or Orders were changed. Earlier candidate sections record pre-release
+evidence and are superseded for publication status by this section.
+
+
+## Wallet package review follow-up — 2026-11-07
+
+Review found a missing prepack build guard and stale internal-path examples in
+packaged documentation. Wallet now rebuilds compiled files before normal npm pack;
+installed tarballs need no build hook. Public client examples and package reading
+paths are corrected. Clean independent pack/install, a TypeScript consumer and real
+CLI/IPC unlock/restart checks passed. User integration remains the next loop;
+Wallet 0.3.0 is still unpublished and intentionally rejected by User 0.2.0 pairing.
+
+
+## Wallet npm candidate verified — 2026-11-07
+
+Steps 1–2 complete: Protocol migration baseline committed; Wallet 0.3.0 candidate
+provides public client/local-administration/CLI entries and compiled declarations.
+Independent frozen install/build and 29 behavioral tests passed. The packed artifact
+installed without sibling sources; real CLI/IPC checks passed for capability denial,
+no generic signing, unlock and restart preserving the key while locking the service.
+No npm publication, service restart or participant data change was performed.
+
+Next: User consumes this reviewed Wallet package and resolves public entries instead
+of sibling `dist/src` files. Current User 0.2.0 pair checks deliberately reject Wallet
+0.3.0; do not update a participant Wallet alone. Publication remains blocked by
+`private: true`; package and User integration must be completed before synchronization.
+
+
+## npm client distribution plan — 2026-11-07
+
+Approved npm-first distribution for Protocol, Wallet and User; separate repositories
+and processes remain. Ordinary users will install User, which supplies a reviewed
+compiled Wallet dependency. Combined source ZIP is optional later work. See the
+local distribution plan for public entries, upgrades, service paths, private data
+and uninstall boundaries. Steps 1–2 are authorized: commit the verified Protocol
+dependency baseline, then prepare/test Wallet's public package. User package
+integration and npm uploads are later loops; present sibling installation remains
+until replaced and verified.
+
+
+## Public Protocol npm migration verified — 2026-11-06
+
+User now pins `@c4roa0/agentpay-protocol@0.14.3`; production imports, test fixtures
+and the public notice use that package. No unrelated locked dependencies changed.
+The v1 update-pair metadata retains its `typesDependency` field and pins 0.14.3;
+checks require both User and Wallet to use the new package at that exact version.
+Old archive-based Wallet and different Protocol versions are rejected. Version-range
+compatibility remains planned; no legacy alias or bypass was added.
+
+Installer/repair fingerprints no longer require a vendor directory. Manifests and
+lockfiles still bind dependency changes. Removed the old archive/license/manifest
+after independent verification; historical review records describe the earlier state.
+With only sibling User/Wallet source in a temporary directory, frozen Wallet install,
+Wallet build, User npm ci and all 364 tests passed (zero failures/skips). Real installer
+prepare-only execution also passed twice: first preparation ran the package managers
+and build, unchanged retry skipped them. Actual pair checks/snapshot reads passed
+without vendor directories. This proves preparation and controlled local behavior,
+not participant setup, owner approval or real-network payment acceptance.
+No running services, key files, Policies or Orders were modified.
+
+
+## Public-source preparation — 2026-11-06
+
+User's original code is MPL 2.0, as selected by the owner; public Protocol and
+attributed reference fixtures retain MIT. Wallet and Protocol are public. User
+history was replaced by the approved single-commit baseline `2a80f4a`; the owner
+confirmed public visibility. Anonymous refs were verified on 2026-11-06. Release
+assets and full anonymous clone/ZIP installation remain separate work.
+
+Current preparation removes private platform harnesses and historical dependency
+archives from the public tree, uses the reviewed public Protocol 0.14.1 archive,
+and makes tests independent of sibling Agent/Protocol/private platform checkouts.
+User still requires a built sibling Wallet. The exact version pair and internal
+Wallet imports remain current constraints, not the planned compatibility contract.
+See [source review](doc/security/public-source-review-2026-11-06.md).
+
+Current documentation is organized by role and feature. Private chronological records
+and previous TODO snapshots are preserved outside the repository; removing them from
+publication does not cancel outstanding acceptance. Independent User + built public Wallet verification passed all 364 tests with no
+failures or skips. Offline installation, 112-file syntax-tree comparison, local
+Markdown links and whitespace checks passed. This does not establish live-network
+or fresh participant installation acceptance.
+
+Follow-up public-document review corrected stale Market per-Policy grouping claims,
+expired-Policy connection guidance and owner-signing descriptions across setup,
+renewal, migration and deployment references. Installation prerequisites now include
+npm/Corepack. The old preview module is labelled as such; executable behavior is
+unchanged. Local links, stale-wording scan, syntax and whitespace checks passed.
+
+## Implemented product scope
+
+- One grouped `./run` entry for installation, repair, Wallet/Policy operations,
+  Linux user services, Market connection, Orders and local cache management.
+- External-owner browser approval with resumable operation plans; separate guarded
+  Anvil signer. Policy renewal/deployment replacement preserves key and Order history.
+- Per-call service-neutral Runtime, private caller authentication, original request
+  recovery, durable input/result snapshots and explicitly managed attachment cache.
+- Stable Wallet display identity with individually verified Policy scopes. Local
+  status distinguishes saved metadata, live observations and unresolved results.
+- Official digest-pinned paid connectivity test, with explicit price consent and
+  original-request continuation after interruption.
+
+The recorded private single-owner MetaMask/Anvil authorization and payment journey
+passed, including participant Market Order viewing and independent payout reconciliation.
+This is scoped private evidence, not public-network, multisig, real-funds or production
+approval. Detailed operational records are not distributed in this repository.
+
+## Next work
+
+Public source preparation is complete within the recorded review scope. Next is the approved
+[distribution plan](doc/plans/user-wallet-distribution.md): a supported public Wallet
+client/version boundary and combined release archive. No automatic source updater.
+
+Official test network mapping, deployment/artifact handoff, complete interrupted owner
+signing and real-network acceptance remain open. macOS and graphical unlock remain
+deferred. [TODO](doc/TODO.md) tracks these gates and the retained acceptance backlog.

package/run

@@ -0,0 +1,29 @@
+#!/bin/sh
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+# If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+# Use an explicit Node installation without requiring a global installation.
+if [ -n "${AGENTPAY_NODE:-}" ]; then
+  case "$AGENTPAY_NODE" in
+    /*) node_path=$AGENTPAY_NODE ;;
+    *) printf '%s\n' 'AGENTPAY_NODE must be the full path to your Node executable.' >&2; exit 1 ;;
+  esac
+else
+  node_path=$(command -v node) || {
+    printf '%s\n' 'Node was not found. Set AGENTPAY_NODE to its full path, then retry.' 'Example: AGENTPAY_NODE=/path/to/node ./run help' >&2
+    exit 1
+  }
+fi
+if [ ! -f "$node_path" ] || [ ! -x "$node_path" ]; then
+  printf '%s\n' 'The selected Node executable does not exist or is not executable. Check AGENTPAY_NODE.' >&2
+  exit 1
+fi
+case "$node_path" in
+  /*) ;;
+  *) node_path="$PWD/$node_path" ;;
+esac
+# npm and its child scripts must see the same selected Node installation.
+PATH="${node_path%/*}:${PATH:-/usr/bin:/bin}"
+export PATH
+run_dir=$(CDPATH= cd -- "${0%/*}" && pwd -P) || exit 1
+exec "$node_path" "$run_dir/scripts/agentpay-cli.mjs" "$@"

package/scripts/agentpay-cli.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { runUserCli } from "../src/user-cli.mjs";
+try {
+  process.exitCode = await runUserCli(process.argv.slice(2));
+} catch (error) {
+  console.error(error.message || "Local operation failed. Run agentpay help.");
+  process.exitCode = 1;
+}

package/scripts/authorize-existing-safe.mjs

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+// Private-Anvil existing-Safe authorization. Never accepts an owner key.
+import { readFile, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { Contract, getAddress, JsonRpcProvider } from "ethers";
+import { Phase0Wallet } from "@c4roa0/agentpay-wallet/local";
+import {
+  buildSafePolicyPlan,
+  inspectSafePolicy,
+  safeEthSignSignature,
+} from "../src/safe-policy-plan.mjs";
+
+const [command, privateDirArg, configArg] = process.argv.slice(2);
+if (
+  !["preview", "authorize", "bind", "check"].includes(command) ||
+  !privateDirArg ||
+  !configArg ||
+  process.argv.length !== 5
+)
+  throw new Error(
+    "usage: authorize-existing-safe.mjs <preview|authorize|bind|check> <private-user-data-dir> <public-policy-config.json>",
+  );
+const dataDir = resolve(privateDirArg);
+const config = JSON.parse(await readFile(resolve(configArg), "utf8"));
+const walletDir = join(dataDir, "wallet");
+const wallet = await Phase0Wallet.open(walletDir);
+const delegate = await wallet.address();
+const plan = buildSafePolicyPlan(config, delegate);
+const ownerAddress = getAddress(config.ownerAddress);
+const rpc = new JsonRpcProvider(plan.rpcUrl, plan.chainId, {
+  staticNetwork: true,
+});
+try {
+  const state = await inspectSafePolicy(rpc, plan);
+  if (!state.owners.includes(ownerAddress) || state.threshold !== 1) {
+    throw new Error(
+      "C6 first rehearsal requires the selected Anvil owner to be the sole Safe signature threshold",
+    );
+  }
+  const publicPlan = {
+    chainId: plan.chainId,
+    safe: plan.safe,
+    ownerAddress,
+    delegate: plan.delegate,
+    module: plan.module,
+    factory: plan.factory,
+    registry: plan.registry,
+    token: plan.token,
+    policyId: plan.policyId,
+    maxPerPaymentAtomic: plan.maxPerPayment.toString(),
+    totalBudgetAtomic: plan.totalBudget.toString(),
+    validAfter: plan.validAfter,
+    validUntil: plan.validUntil,
+    dynamicQualification:
+      "AgentPay Registry at the fixed address; future qualified Skills need no new Policy",
+    currentState: state,
+    safeCalls: plan.calls,
+  };
+  if (command === "preview") {
+    process.stdout.write(
+      `${JSON.stringify({ ok: true, plan: publicPlan }, null, 2)}\n`,
+    );
+  } else {
+    if (command === "authorize") {
+      const url = new URL(plan.rpcUrl);
+      if (
+        plan.chainId !== 31337 ||
+        url.protocol !== "http:" ||
+        !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+      ) {
+        throw new Error("ANVIL_OWNER_SIGNING_TEST_ONLY");
+      }
+      if (state.policyExists && !state.policyMatches)
+        throw new Error("EXISTING_POLICY_CONFLICT");
+      if (!state.moduleEnabled || !state.policyExists) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, authorizationPreview: publicPlan }, null, 2)}\n`,
+        );
+        const expected = `AUTHORIZE ${plan.policyId}`;
+        if (!process.stdin.isTTY || !process.stderr.isTTY)
+          throw new Error("OWNER_AUTHORIZATION_TTY_REQUIRED");
+        const prompt = createInterface({
+          input: process.stdin,
+          output: process.stderr,
+        });
+        let answer;
+        try {
+          answer = await prompt.question(
+            `Type '${expected}' to submit the displayed Safe calls: `,
+          );
+        } finally {
+          prompt.close();
+        }
+        if (answer.trim() !== expected)
+          throw new Error("OWNER_AUTHORIZATION_NOT_CONFIRMED");
+        const calls = [
+          ...(!state.moduleEnabled ? [plan.calls[0]] : []),
+          ...(!state.policyExists ? [plan.calls[1]] : []),
+        ];
+        for (const call of calls)
+          await executeSafeCall(rpc, plan.safe, ownerAddress, call);
+      }
+    }
+    const final = await inspectSafePolicy(rpc, plan);
+    if (!final.moduleEnabled || !final.policyMatches)
+      throw new Error("CHAIN_POLICY_NOT_VERIFIED");
+    if (command === "bind") {
+      if (
+        await stat(join(walletDir, "wallet.sock")).then(
+          () => true,
+          (error) => {
+            if (error.code === "ENOENT") return false;
+            throw error;
+          },
+        )
+      )
+        throw new Error("STOP_WALLET_SERVICE_BEFORE_LOCAL_BIND");
+      if (wallet.policy) {
+        if (JSON.stringify(wallet.policy) !== JSON.stringify(plan.walletPolicy))
+          throw new Error("LOCAL_POLICY_CONFLICT");
+      } else await wallet.bindPolicy(plan.walletPolicy);
+    }
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          ok: true,
+          chainPolicyVerified: true,
+          moduleEnabled: final.moduleEnabled,
+          policyMatches: final.policyMatches,
+          localWalletBound: command === "bind" ? true : wallet.policy !== null,
+          remainingBudgetAtomic: (
+            plan.totalBudget - BigInt(final.policySpent)
+          ).toString(),
+        },
+        null,
+        2,
+      )}\n`,
+    );
+  }
+} finally {
+  rpc.destroy();
+}
+
+async function executeSafeCall(rpc, safeAddress, ownerAddress, call) {
+  const zero = "0x0000000000000000000000000000000000000000";
+  const safe = new Contract(
+    safeAddress,
+    [
+      "function nonce() view returns (uint256)",
+      "function getTransactionHash(address to,uint256 value,bytes data,uint8 operation,uint256 safeTxGas,uint256 baseGas,uint256 gasPrice,address gasToken,address refundReceiver,uint256 nonce) view returns (bytes32)",
+      "function execTransaction(address to,uint256 value,bytes data,uint8 operation,uint256 safeTxGas,uint256 baseGas,uint256 gasPrice,address gasToken,address refundReceiver,bytes signatures) returns (bool)",
+      "event ExecutionSuccess(bytes32 indexed txHash,uint256 payment)",
+      "event ExecutionFailure(bytes32 indexed txHash,uint256 payment)",
+    ],
+    await rpc.getSigner(ownerAddress),
+  );
+  const nonce = await safe.nonce();
+  const hash = await safe.getTransactionHash(
+    call.to,
+    0,
+    call.data,
+    0,
+    0,
+    0,
+    0,
+    zero,
+    zero,
+    nonce,
+  );
+  const signedMessage = await rpc.send("eth_sign", [ownerAddress, hash]);
+  const safeSignature = safeEthSignSignature(hash, signedMessage, ownerAddress);
+  const receipt = await (
+    await safe.execTransaction(
+      call.to,
+      0,
+      call.data,
+      0,
+      0,
+      0,
+      0,
+      zero,
+      zero,
+      safeSignature,
+    )
+  ).wait();
+  const events = receipt.logs.map((log) => {
+    try {
+      return safe.interface.parseLog(log);
+    } catch {
+      return null;
+    }
+  });
+  if (
+    receipt.status !== 1 ||
+    !events.some((event) => event?.name === "ExecutionSuccess") ||
+    events.some((event) => event?.name === "ExecutionFailure")
+  )
+    throw new Error("SAFE_OWNER_CALL_FAILED");
+  process.stdout.write(
+    `${JSON.stringify({
+      safeCall: call.purpose,
+      transactionHash: receipt.hash,
+      safeNonce: nonce.toString(),
+      confirmed: true,
+    })}\n`,
+  );
+}

package/scripts/autostart.mjs

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { randomUUID } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { lstat, mkdir, readFile, writeFile, unlink, rename } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import {
+  resolveUserDataDir,
+  installedUserDir,
+} from "../src/local-data-directory.mjs";
+import {
+  autostartFiles,
+  isManagedUnit,
+  units,
+  runtimeUnits,
+} from "../src/autostart-files.mjs";
+import {
+  readServiceSettings,
+  saveServiceSettings,
+} from "../src/local-services.mjs";
+import { ensureLocalServices } from "../src/prepare-local-services.mjs";
+const ctl = (...args) =>
+  execFileSync("systemctl", ["--user", ...args], {
+    stdio: "inherit",
+    timeout: 30000,
+  });
+try {
+  const [action, ...args] = process.argv.slice(2);
+  if (
+    ![
+      "prepare",
+      "prepare-repair",
+      "enable",
+      "disable",
+      "remove",
+      "start",
+      "restart",
+      "stop",
+      "status",
+      "configure",
+    ].includes(action) ||
+    args.length !== (action === "configure" ? 2 : 0)
+  )
+    throw Error(
+      "Usage: node scripts/autostart.mjs <prepare|enable|disable|remove|start|restart|stop|status> or configure RUNTIME_URL SETTLEMENT_URL",
+    );
+  if (process.platform !== "linux")
+    throw Error(
+      "Automatic startup currently supports Linux with systemd user services. macOS support is pending.",
+    );
+  const dataDir = await resolveUserDataDir();
+  if (action === "configure") {
+    await saveServiceSettings({
+      dataDir,
+      runtimeUrl: args[0],
+      settlementUrl: args[1],
+    });
+    console.log("Local startup settings saved. No service was started.");
+  } else {
+    const files = autostartFiles({
+      node: process.execPath,
+      userDir: installedUserDir,
+      dataDir,
+    });
+    const config = join(homedir(), ".config"),
+      unitDir = join(config, "systemd/user");
+    for (const directory of [config, join(config, "systemd"), unitDir]) {
+      if (["enable", "prepare", "prepare-repair"].includes(action))
+        await mkdir(directory, { mode: 0o700 }).catch((e) => {
+          if (e.code !== "EEXIST") throw e;
+        });
+      const info = await lstat(directory);
+      if (
+        !info.isDirectory() ||
+        info.isSymbolicLink() ||
+        info.uid !== process.getuid() ||
+        info.mode & 0o022
+      )
+        throw Error(
+          `User configuration directory is not safely owned: ${directory}`,
+        );
+    }
+    const paths = Object.entries(files).map(([name, body]) => ({
+      name,
+      path: join(unitDir, name),
+      body,
+    }));
+    for (const { path, body, name } of paths) {
+      try {
+        const info = await lstat(path);
+        if (
+          !info.isFile() ||
+          info.isSymbolicLink() ||
+          info.uid !== process.getuid() ||
+          info.mode & 0o022 ||
+          !isManagedUnit(await readFile(path, "utf8"), name, dataDir)
+        )
+          throw Error(
+            "An existing startup file belongs to another configuration. Preserve it and review before switching.",
+          );
+      } catch (e) {
+        if (e.code !== "ENOENT") throw e;
+      }
+    }
+    if (action === "status") {
+      ctl("status", "--no-pager", ...runtimeUnits);
+      console.log(
+        "The login reminder runs once per graphical session; it can be inactive outside a desktop login.",
+      );
+    } else if (["start", "restart", "stop"].includes(action)) {
+      if (action !== "stop") await readServiceSettings(dataDir);
+      for (const { path } of paths) await lstat(path);
+      ctl(action, ...(action !== "stop" ? runtimeUnits : units));
+      console.log(
+        action !== "stop"
+          ? `${action === "restart" ? "Restart" : "Start"} requested through systemd. This does not confirm readiness.\nNext: agentpay status`
+          : "Stop requested through systemd. Login startup and saved Wallet data are unchanged.\nNext: agentpay status",
+      );
+    } else if (["enable", "prepare", "prepare-repair"].includes(action)) {
+      await ensureLocalServices({ dataDir, connectionOptions: action === "prepare-repair" ? { refreshClientModule: true, checkOnly: true } : {} });
+      // No --now: avoid replacing a Wallet currently owned by terminal setup/system services.
+      for (const { path, body } of paths)
+        try {
+          await writeFile(path, body, { flag: "wx", mode: 0o600 });
+        } catch (e) {
+          if (e.code !== "EEXIST") throw e;
+          const temporary = path + '.' + randomUUID();
+          try {
+            await writeFile(temporary, body, {flag:'wx',mode:0o600});
+            await rename(temporary,path);
+          } finally { await unlink(temporary).catch(e => { if(e.code !== 'ENOENT') throw e; }); }
+        }
+      ctl("daemon-reload");
+      if (action === "enable") {
+        ctl("enable", ...units);
+        await saveServiceSettings({
+          dataDir,
+          ...(await readServiceSettings(dataDir)),
+          startupChoice: "enabled",
+        });
+        console.log(
+          "Login startup enabled for Wallet and Runtime. Current processes were not changed.\nTo start now: agentpay service start",
+        );
+      } else
+        console.log(
+          "Local service files prepared. Automatic startup was not changed.",
+        );
+    } else if (action === "disable") {
+      await readServiceSettings(dataDir);
+      ctl("disable", ...units);
+      await saveServiceSettings({
+        dataDir,
+        ...(await readServiceSettings(dataDir)),
+        startupChoice: "disabled",
+      });
+      console.log(
+        "Login startup disabled for Wallet and Runtime. Current processes were not stopped.\nTo stop now: agentpay service stop",
+      );
+    } else {
+      await saveServiceSettings({
+        dataDir,
+        ...(await readServiceSettings(dataDir)),
+        startupChoice: "disabled",
+      });
+      ctl("disable", "--now", ...units);
+      for (const { path } of paths)
+        await unlink(path).catch((e) => {
+          if (e.code !== "ENOENT") throw e;
+        });
+      ctl("daemon-reload");
+      console.log(
+        "Automatic startup and its reminder removed. Wallet data, Policy and request history are kept.",
+      );
+    }
+  }
+} catch (error) {
+  console.error(
+    error.status === undefined
+      ? error.message
+      : "The systemd command failed; some service changes may already have applied. Wallet keys and request history were kept. Run agentpay status before retrying.",
+  );
+  process.exitCode = 1;
+}