@ccmsg/cli 0.2.7 → 0.2.10

package/README.md

@@ -7,13 +7,25 @@ together with its CLI and the plugins it hands to agents.
 
 - `daemon` — holds sessions, delivery, topics and the mesh, and answers the contract's ops over UDS / WS
 - `cli` — the entry point a session calls its instance through (`ccmsg`)
-- `plugins/claude` / `plugins/codex` — the plugins agents receive (`ccmsg plugin install`)
+- `plugin` — the plugin an agent receives (`ccmsg plugin install claude`). Claude Code is the only
+  agent that has one; a codex plugin is not implemented, and what it would take is tracked in
+  [`docs/issue/2026-09-09-codex-plugin-delivery-via-thread-queue.md`](./docs/issue/2026-09-09-codex-plugin-delivery-via-thread-queue.md)
 
 The wire contract is [`@ccmsg/protocol`](https://github.com/kawaz/ccmsg-protocol), pinned to a
 version here. Who may call what, and what comes back, is decided by the contract's attribute
 table and schemas; the daemon reads them rather than carrying validation or authorization
 branches of its own.
 
+## What it does not do
+
+- Serve the webui, or keep a conversation log of its own — the webui is its own static site, and transcript is the source of truth
+- Separate privileges, or mesh with an instance of a different uid / config home — that boundary is the OS's uid and file permissions
+- Re-derive an upstream judgment (the gateway's severity, Claude Code's permission decisions) or observe another config home
+- Carry validation of its own, or serve v1 alongside — the contract's validator is called, and the new lineage stands as a separate instance
+
+Authenticating a person is not on that list: the daemon answers "who came" itself, with a
+passkey. [docs/DESIGN.md](./docs/DESIGN.md) §9 carries the reason each of these ties back to.
+
 ## Documentation
 
 - [docs/DESIGN.md](./docs/DESIGN.md) — layers, delivery, the state model, the mesh, and how it is tested

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccmsg/cli",
-  "version": "0.2.7",
+  "version": "0.2.10",
   "description": "The ccmsg daemon, CLI and agent plugins for one instance (= one config home)",
   "license": "MIT",
   "author": "kawaz",
@@ -20,7 +20,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ccmsg/protocol": "1.6.0"
+    "@ccmsg/protocol": "1.7.0"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",

package/src/auth/auth.ts

@@ -5,6 +5,7 @@ import type {
   AuthChallengeResult,
   AuthRecord,
   AuthRefreshArgs,
+  AuthRefreshReason,
   AuthRefreshResult,
   AuthRegisterArgs,
   AuthResolveArgs,
@@ -145,6 +146,18 @@ export interface MintedSession {
   readonly refresh: { readonly value: Base64Url; readonly expires_at: Timestamp };
 }
 
+/** What is known about the client that asked for a refresh: its own word for
+ * why, and what the carrier observed of it.
+ *
+ * Kept on the family as `last_refresh` and read by nobody but the person whose
+ * sessions they are — a run of `reconnect` at an hour they were asleep is
+ * something to recognise. Nothing here is checked, so nothing may turn on it. */
+export interface RefreshFrom {
+  readonly reason?: AuthRefreshReason;
+  readonly ip?: string;
+  readonly userAgent?: string;
+}
+
 /** What a registration URL is, as the command that made it prints it. */
 export interface IssuedRegistration {
   readonly sub: Subject;
@@ -455,6 +468,11 @@ export class Auth {
       endpoint: claims.endpoint,
       rp_id: claims.rp_id,
       sign_count: verified.signCount,
+      // What the authenticator said about backing this credential up, kept
+      // because it decides what removing the line costs the person and nothing
+      // else: neither flag is ever read to admit or refuse an exchange.
+      backup_eligible: verified.backupEligible,
+      backup_state: verified.backupState,
       ...(claims.issued_label === undefined ? {} : { issued_label: claims.issued_label }),
       ...(args.device_label === undefined ? {} : { device_label: args.device_label }),
       registered_at: at,
@@ -656,7 +674,7 @@ export class Auth {
    * a family minted elsewhere is carried there rather than done here — two
    * instances rotating one family in parallel would merge by last write and
    * read exactly like a stolen token being replayed (§2.4). */
-  async refreshToken(value: Base64Url): Promise<MintedSession> {
+  async refreshToken(value: Base64Url, from: RefreshFrom = {}): Promise<MintedSession> {
     const held = this.deps.records.byRefresh(value);
     if (held === undefined) {
       // Not the standing generation, nor the one before it. Either it never was
@@ -666,12 +684,16 @@ export class Auth {
       throw new OpError("auth_invalid", "この refresh token は使えません");
     }
     if (held.body.iss !== this.deps.self) {
+      // What the client said about this refresh stays here: `auth_rotate`
+      // carries the value and nothing else, and the address the issuer would
+      // see is this instance's rather than the person's. The issuer records
+      // that the family rotated, which is the part it can vouch for.
       const answer = (await this.#atIssuer(held.body.iss, "auth_rotate", {
         refresh_token: value,
       } satisfies AuthRotateArgs)) as AuthRotateResult;
       return { session: { sub: answer.sub, access: answer.access }, refresh: answer.refresh };
     }
-    const rotated = this.rotate(value);
+    const rotated = this.rotate(value, from);
     return { session: { sub: rotated.sub, access: rotated.access }, refresh: rotated.refresh };
   }
 
@@ -703,7 +725,7 @@ export class Auth {
 
   /** Rotate a family this instance minted. The one writer's own operation, and
    * what `auth_rotate` runs on its behalf. */
-  rotate(value: Base64Url): AuthRotateResult {
+  rotate(value: Base64Url, from: RefreshFrom = {}): AuthRotateResult {
     const held = this.deps.records.byRefresh(value);
     if (held === undefined) {
       this.#failReused(value);
@@ -732,6 +754,16 @@ export class Auth {
       iss: this.deps.self,
       access,
       refresh: { value: token(), expires_at: at + REFRESH_TTL_MS },
+      // Written by this instance because it is the family's `iss`, and only for
+      // the rotation that just happened — the caller's word about why, and
+      // where it was asked from, are a hint for the person reading their own
+      // sessions back and are never checked (contract, `TokenFamily`).
+      last_refresh: {
+        at,
+        ...(from.reason === undefined ? {} : { reason: from.reason }),
+        ...(from.ip === undefined ? {} : { ip: from.ip }),
+        ...(from.userAgent === undefined ? {} : { user_agent: from.userAgent }),
+      },
       previous_refresh: { value: held.body.refresh.value, expires_at: at + PREVIOUS_GRACE_MS },
       // The value going out of service is remembered as a digest for as long as
       // it would have been accepted, so that presenting it later is recognised

package/src/auth/http.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import {
   type AuthAssertArgs,
+  type AuthRefreshTokenArgs,
   type AuthRegisterArgs,
   type ErrorCode,
   type InstanceId,
@@ -196,7 +197,12 @@ export async function handleAuth(
         if (held === undefined) {
           return refusal("auth_invalid", "この要求には refresh token がありません", cors);
         }
-        const minted = await deps.auth.refreshToken(held);
+        const { reason } = args as unknown as AuthRefreshTokenArgs;
+        const minted = await deps.auth.refreshToken(held, {
+          ...(reason === undefined ? {} : { reason }),
+          ...(seen.ip === undefined ? {} : { ip: seen.ip }),
+          ...(seen.userAgent === undefined ? {} : { userAgent: seen.userAgent }),
+        });
         return answer(minted.session, cors, setCookie(deps, url.pathname, minted));
       }
     }

package/src/auth/webauthn.ts

@@ -9,11 +9,15 @@ import { type CborValue, decodeCbor, decodeCborWhole, mapEntry } from "./cbor.ts
  * log; nothing branches on it. */
 export class WebAuthnError extends Error {}
 
-/** The flags of the authenticator data (L2 §6.1). Only two are read: that a
- * person was present, and that they were verified — the registration asks for
- * `userVerification: "required"`, so both have to hold on every exchange. */
+/** The flags of the authenticator data (L2 §6.1). Two of them decide whether an
+ * exchange is admitted: that a person was present, and that they were verified
+ * — the registration asks for `userVerification: "required"`, so both have to
+ * hold on every exchange. The two backup flags decide nothing; they are read at
+ * registration and kept as a hint for the person reading their own list. */
 const FLAG_USER_PRESENT = 0x01;
 const FLAG_USER_VERIFIED = 0x04;
+const FLAG_BACKUP_ELIGIBLE = 0x08;
+const FLAG_BACKUP_STATE = 0x10;
 const FLAG_ATTESTED_CREDENTIAL = 0x40;
 
 export function base64UrlDecode(value: string): Uint8Array {
@@ -131,6 +135,12 @@ export interface VerifiedRegistration {
   readonly credentialId: Base64Url;
   readonly publicKey: Base64Url;
   readonly signCount: number;
+  /** The BE flag: whether the authenticator may back this credential up, which
+   * is what separates a synced passkey from one that lives on a single device. */
+  readonly backupEligible: boolean;
+  /** The BS flag: whether it was backed up at this moment. Eligible and not yet
+   * backed up is an ordinary state on a device that has just made the key. */
+  readonly backupState: boolean;
 }
 
 /** Check a registration (L2 §7.1) and answer what is worth keeping.
@@ -180,6 +190,8 @@ export function verifyRegistration(
     credentialId: base64UrlEncode(data.credentialId),
     publicKey: base64UrlEncode(data.publicKey),
     signCount: data.signCount,
+    backupEligible: (data.flags & FLAG_BACKUP_ELIGIBLE) !== 0,
+    backupState: (data.flags & FLAG_BACKUP_STATE) !== 0,
   };
 }
 

package/src/plugin/claude.ts

@@ -77,6 +77,15 @@ ccmsg peers --all      他ホストの instance が知っている分も含め
 居なくなったセッションで、各行の \`repo\` / \`ws\` / \`branch\` / \`title\` で見分けて
 \`sid\` を取る。\`send_message\` が \`true\` の相手には harness 自身の機能でも届く。
 
+## 相手セッションの扱い
+
+相手は基本、自分にとってのサブエージェントだと思えばよい。対等な会議を開く場ではないので、
+冒頭の挨拶・賛辞・締めの社交辞令を省き、用件だけを 1〜3 文で送る。
+
+やり取りの中身を人へリレーしない。人は全セッションを直接見ているので、相手の完了報告や
+根拠をこちらで要約し直しても情報は増えず、時間とコンテキストだけが減る。人に言うのは
+自セッション目線の事実 (何を頼んだ・何が返り・その結果こちらが何をしたか) だけ。
+
 ## 見ている人へ知らせる
 
 \`\`\`

package/src/service/program.ts

@@ -0,0 +1,140 @@
+/** Which path the init system is told to run, and what became of the one it was
+ * told.
+ *
+ * A unit file outlives the machine's software. The path this process is running
+ * as is the path of one version of it — a runtime under a version manager lives
+ * in a directory named after the version, and the next upgrade puts an
+ * identical program somewhere else and takes that directory away. Registered as
+ * it is, the supervisor works until the day it silently does not: the init
+ * system goes on asking for a path nothing is at, and the person finds out when
+ * nothing answers after a reboot.
+ *
+ * So a durable path is looked for before anything is written down, and what was
+ * written down is read back by `service status`. The judgement here is the
+ * coarse half of what `stable-which` does — whether the path names a version
+ * rather than a program — and the reading back is what makes the other half
+ * unnecessary: a pick that turns out wrong says so as a missing file rather
+ * than as silence. */
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { basename, delimiter, join } from "node:path";
+import { ENTRY } from "../daemon/registry.ts";
+import type { Env } from "../instance/paths.ts";
+
+/** Directory names that belong to one version of something rather than to the
+ * thing itself. A path through any of them is gone at the next upgrade. */
+const VERSIONED = ["/nix/store/", "/Cellar/", "/installs/", "/versions/", "/node_modules/"];
+
+/** Whether this path is one a unit file may hold. */
+export function durable(path: string): boolean {
+  return !VERSIONED.some((mark) => path.includes(mark));
+}
+
+/** How large a file may be and still be read as a wrapper script. A wrapper is
+ * a few lines; anything else is the program itself. */
+const WRAPPER_MAX_BYTES = 64 * 1024;
+
+function isFile(path: string): boolean {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+
+function sameFile(one: string, other: string): boolean {
+  try {
+    return realpathSync(one) === realpathSync(other);
+  } catch {
+    return false;
+  }
+}
+
+/** Every entry of this name on `PATH`, in the order `PATH` states them. */
+function onPath(name: string, env: Env): string[] {
+  return (env["PATH"] ?? "")
+    .split(delimiter)
+    .filter((dir) => dir !== "")
+    .map((dir) => join(dir, name))
+    .filter((path) => isFile(path));
+}
+
+/** Whether running this path runs what this process is running: the same file,
+ * or a wrapper that names the script this process was started with. */
+function leadsHere(candidate: string, self: string): boolean {
+  if (sameFile(candidate, self)) return true;
+  try {
+    if (statSync(candidate).size > WRAPPER_MAX_BYTES) return false;
+    return readFileSync(candidate, "utf8").includes(ENTRY);
+  } catch {
+    return false;
+  }
+}
+
+export interface Program {
+  /** What the init system is told to run. */
+  readonly command: string[];
+  /** Whether that first path is one that survives an upgrade. False means the
+   * best that could be found still names a version, which is worth saying
+   * rather than hiding: the registration works now and is the one to redo
+   * after the next upgrade. */
+  readonly durable: boolean;
+}
+
+/** The supervisor as a path an init system can keep asking for.
+ *
+ * A `ccmsg` on `PATH` that leads back here is preferred over the runtime: it is
+ * the program by its own name, and it stays put across a runtime upgrade
+ * because it is what names the runtime rather than what the runtime is. Failing
+ * that, the runtime by name on `PATH`, which at least resolves through whatever
+ * the version manager keeps current. Failing both, this process's own path,
+ * which is where it started. */
+export function supervisorProgram(env: Env = process.env): Program {
+  const self = process.execPath;
+  for (const candidate of onPath("ccmsg", env)) {
+    if (durable(candidate) && leadsHere(candidate, self)) {
+      return { command: [candidate, "daemon", "supervise"], durable: true };
+    }
+  }
+  for (const candidate of onPath(basename(self), env)) {
+    if (durable(candidate) && sameFile(candidate, self)) {
+      return { command: [candidate, ENTRY, "daemon", "supervise"], durable: true };
+    }
+  }
+  return { command: [self, ENTRY, "daemon", "supervise"], durable: durable(self) };
+}
+
+/** What a unit file names as its program, and whether anything is there now. */
+export interface RegisteredProgram {
+  readonly path: string;
+  /** Whether the registered path is one that survives an upgrade. A false here
+   * is a registration that works today and will stop working quietly, which is
+   * worth seeing before it does. */
+  readonly durable: boolean;
+  /** False on a registration whose program has moved: the init system is
+   * asking for a path nothing is at, and re-registering is the answer. */
+  readonly exists: boolean;
+}
+
+const ENTITY: Record<string, string> = { "&amp;": "&", "&lt;": "<", "&gt;": ">" };
+
+/** The program the registered unit names — read from the file rather than
+ * worked out again, because the question is what the init system was told and
+ * not what it would be told today. */
+export function registeredProgram(
+  unitFile: string,
+  kind: "launchd" | "systemd",
+): RegisteredProgram | null {
+  let text: string;
+  try {
+    text = readFileSync(unitFile, "utf8");
+  } catch {
+    return null;
+  }
+  const found =
+    kind === "launchd"
+      ? /<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]*)<\/string>/.exec(text)?.[1]
+      : /^ExecStart=(\S+)/m.exec(text)?.[1];
+  if (found === undefined) return null;
+  const path = found.replace(/&amp;|&lt;|&gt;/g, (entity) => ENTITY[entity] as string);
+  return { path, durable: durable(path), exists: existsSync(path) };
+}

package/src/service/service.ts

@@ -2,8 +2,8 @@ import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { CommandError } from "../daemon/link.ts";
-import { ENTRY } from "../daemon/registry.ts";
 import { type Env, resolveStateRoot } from "../instance/paths.ts";
+import { type RegisteredProgram, registeredProgram, supervisorProgram } from "./program.ts";
 
 /** What the host's init system was asked, and what it said.
  *
@@ -34,6 +34,13 @@ export interface ServiceState {
   readonly registered: boolean;
   readonly running: boolean;
   readonly pid?: number;
+  /** The program the registered unit names, and whether anything is at that
+   * path now. `null` when nothing is registered, so there is no unit to read.
+   *
+   * Here rather than left to be worked out by a reader: a supervisor that
+   * cannot start because its program moved with a runtime upgrade looks, from
+   * every other field, exactly like one that was never started. */
+  readonly program: RegisteredProgram | null;
   /** What the init system itself says, or `null` when it could not be asked.
    *
    * Beside the two fields above rather than folded into them: those are ccmsg's
@@ -101,7 +108,7 @@ export type LogSource =
  * registered from a shell where these were exported and started without them
  * would quietly manage a different set of instances. */
 function supervisorCommand(): string[] {
-  return [process.execPath, ENTRY, "daemon", "supervise"];
+  return supervisorProgram().command;
 }
 
 const CARRIED = [
@@ -143,16 +150,43 @@ export function serviceFor(env: Env = process.env, platform = process.platform):
   throw new CommandError("capability_unavailable", `${platform} には登録先がありません`);
 }
 
-class LaunchdService implements Service {
+/** Whether launchd's refusal to bootstrap is it saying the unit is already
+ * there. Errno 37 is `EBUSY`, which is what a bootstrap racing the teardown of
+ * the same label gets. */
+function alreadyLoaded(answer: RunResult): boolean {
+  const said = `${answer.stdout} ${answer.stderr}`;
+  return /already (loaded|bootstrapped)|Operation already in progress|: 37:/.test(said);
+}
+
+/** What the init system said when it refused.
+ *
+ * The command and its stderr, unabridged: launchd's refusals are numbered
+ * rather than worded, and a `Bootstrap failed: 5: Input/output error` handed
+ * straight to the person is worth more than anything this could say instead. */
+function refuse(command: readonly string[], answer: RunResult): never {
+  const said = answer.stderr.trim() || answer.stdout.trim();
+  throw new CommandError(
+    "internal_error",
+    `${command.join(" ")} が失敗しました (exit ${String(answer.code)})${said === "" ? "" : `: ${said}`}`,
+  );
+}
+
+export class LaunchdService implements Service {
   readonly kind = "launchd" as const;
   readonly unitFile: string;
+  readonly #label: string;
   readonly #env: Env;
   readonly #domain: string;
 
-  constructor(env: Env) {
+  /** The label is a parameter for `Run`'s reason: a test that drives this
+   * machine's real launchd has to do it under a name that is not the one the
+   * machine's own supervisor is registered under. Nothing in ccmsg passes it —
+   * `serviceFor` is where the name is settled. */
+  constructor(env: Env, label: string = LAUNCHD_LABEL) {
     this.#env = env;
+    this.#label = label;
     const home = env["HOME"] ?? homedir();
-    this.unitFile = join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    this.unitFile = join(home, "Library", "LaunchAgents", `${label}.plist`);
     this.#domain = `gui/${String(process.getuid?.() ?? 0)}`;
   }
 
@@ -166,7 +200,7 @@ class LaunchdService implements Service {
       '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
       '<plist version="1.0">',
       "<dict>",
-      `  <key>Label</key><string>${LAUNCHD_LABEL}</string>`,
+      `  <key>Label</key><string>${this.#label}</string>`,
       "  <key>ProgramArguments</key>",
       "  <array>",
       ...supervisorCommand().map((arg) => `    <string>${escapeXml(arg)}</string>`),
@@ -187,32 +221,61 @@ class LaunchdService implements Service {
     ].join("\n");
   }
 
+  /** Registering is writing the unit and starting it: a supervisor nothing is
+   * supervising is not what the person asked for, and `RunAtLoad` means that a
+   * unit put in front of launchd at all is a unit launchd runs. What `start`
+   * adds is the case where the file is already there. */
   async register(run: Run): Promise<ServiceState> {
     write(this.unitFile, this.unitText(), serviceLogFile(this.#env));
-    await run(["launchctl", "bootstrap", this.#domain, this.unitFile]);
-    return await this.state(run);
+    return await this.start(run);
   }
 
   async unregister(run: Run): Promise<{ unregistered: boolean }> {
-    await run(["launchctl", "bootout", `${this.#domain}/${LAUNCHD_LABEL}`]);
+    await run(["launchctl", "bootout", `${this.#domain}/${this.#label}`]);
     const existed = existsSync(this.unitFile);
     rmSync(this.unitFile, { force: true });
     return { unregistered: existed };
   }
 
+  /** Put the unit in front of launchd if it is not already there, then start
+   * the program.
+   *
+   * `kickstart` alone is what a loaded unit needs, and launchd answers a unit
+   * it has never heard of with `No such process` — which is exactly the state
+   * a login leaves behind, and the state `unregister` leaves behind however
+   * quickly a `register` follows it. So what is loaded is read first and the
+   * missing half is done here rather than assumed to have been done by
+   * whoever wrote the file. */
   async start(run: Run): Promise<ServiceState> {
-    await run(["launchctl", "kickstart", `${this.#domain}/${LAUNCHD_LABEL}`]);
+    const before = await this.#report(run);
+    if (before.service?.loaded !== true) {
+      const bootstrap = ["launchctl", "bootstrap", this.#domain, this.unitFile];
+      const answer = await run(bootstrap);
+      // `Operation already in progress` and `Service is already loaded` are
+      // launchd saying the unit is there, which is all this asked for.
+      if (answer.code !== 0 && !alreadyLoaded(answer)) refuse(bootstrap, answer);
+    }
+    const kickstart = ["launchctl", "kickstart", `${this.#domain}/${this.#label}`];
+    const answer = await run(kickstart);
+    if (answer.code !== 0) refuse(kickstart, answer);
     return await this.state(run);
   }
 
   async stop(run: Run): Promise<ServiceState> {
-    await run(["launchctl", "kill", "SIGTERM", `${this.#domain}/${LAUNCHD_LABEL}`]);
+    await run(["launchctl", "kill", "SIGTERM", `${this.#domain}/${this.#label}`]);
     return await this.state(run);
   }
 
   async state(run: Run): Promise<ServiceState> {
+    return {
+      ...(await this.#report(run)),
+      program: registeredProgram(this.unitFile, this.kind),
+    };
+  }
+
+  async #report(run: Run): Promise<Omit<ServiceState, "program">> {
     const registered = existsSync(this.unitFile);
-    const printed = await run(["launchctl", "print", `${this.#domain}/${LAUNCHD_LABEL}`]);
+    const printed = await run(["launchctl", "print", `${this.#domain}/${this.#label}`]);
     // A non-zero exit is launchd saying it has no such service, which is not
     // the same as having nothing to say: the report stays `null` only when the
     // question could not be put, and here it was and the answer was "no".
@@ -280,11 +343,10 @@ class SystemdService implements Service {
     return { kind: "command", show: [...unit, "--no-pager"], follow: [...unit, "-f"] };
   }
 
+  /** `LaunchdService.register`'s reasoning, in systemd's vocabulary. */
   async register(run: Run): Promise<ServiceState> {
     write(this.unitFile, this.unitText(), serviceLogFile(this.#env));
-    await run(["systemctl", "--user", "daemon-reload"]);
-    await run(["systemctl", "--user", "enable", "--now", SYSTEMD_UNIT]);
-    return await this.state(run);
+    return await this.start(run);
   }
 
   async unregister(run: Run): Promise<{ unregistered: boolean }> {
@@ -295,8 +357,20 @@ class SystemdService implements Service {
     return { unregistered: existed };
   }
 
+  /** `LaunchdService.start`'s reasoning: a unit systemd has not read is a unit
+   * `start` answers `not found` for, and a file written since the last reload
+   * is exactly that. `enable --now` starts it and puts it in the target, so a
+   * supervisor registered today is running after the next login. */
   async start(run: Run): Promise<ServiceState> {
-    await run(["systemctl", "--user", "start", SYSTEMD_UNIT]);
+    const before = await this.#report(run);
+    if (before.service?.loaded !== true) {
+      const reload = ["systemctl", "--user", "daemon-reload"];
+      const reloaded = await run(reload);
+      if (reloaded.code !== 0) refuse(reload, reloaded);
+    }
+    const enable = ["systemctl", "--user", "enable", "--now", SYSTEMD_UNIT];
+    const answer = await run(enable);
+    if (answer.code !== 0) refuse(enable, answer);
     return await this.state(run);
   }
 
@@ -306,6 +380,13 @@ class SystemdService implements Service {
   }
 
   async state(run: Run): Promise<ServiceState> {
+    return {
+      ...(await this.#report(run)),
+      program: registeredProgram(this.unitFile, this.kind),
+    };
+  }
+
+  async #report(run: Run): Promise<Omit<ServiceState, "program">> {
     const registered = existsSync(this.unitFile);
     const shown = await run([
       "systemctl",