@intutic/cli 1.10.0 → 2.0.0

package/dist/commands/install-daemon.js

@@ -1,8 +1,9 @@
 /**
- * install-daemon.ts — System-level sync-daemon & mcp-daemon persistence installer.
+ * install-daemon.ts — System-level sync-daemon, mcp-daemon & proxy persistence installer.
  *
- * Registers the Intutic sync-daemon or mcp-daemon as system-level services so they
- * auto-start on login/boot and restart automatically on any exit.
+ * Registers the Intutic sync-daemon, mcp-daemon, or the standalone `intutic-proxy`
+ * binary as system-level services so they auto-start on login/boot and restart
+ * automatically on any exit.
  *
  * Platform support:
  *   - macOS : LaunchAgent/LaunchDaemon (LaunchDaemon requires root/system flag)
@@ -16,9 +17,8 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { execFileSync } from 'node:child_process';
-import { createLogger } from '@intutic/logger';
 import { loadConfig } from '../config/store.js';
-const log = createLogger('cli-install-daemon');
+import { localProxyBinary } from '../lib/proxyBinary.js';
 // ── Error definitions ──────────────────────────────────────────────────
 export class ElevationRequiredError extends Error {
     constructor(targetPath) {
@@ -32,9 +32,13 @@ export function checkRootPrivileges(system, targetPath = '/Library/LaunchDaemons
         throw new ElevationRequiredError(targetPath);
     }
 }
-export function getPaths(system, isMcp, platform = process.platform) {
-    const label = isMcp ? 'ai.intutic.mcp-daemon' : 'ai.intutic.sync-daemon';
-    const unitName = isMcp ? 'intutic-mcp-daemon.service' : 'intutic-sync-daemon.service';
+const SERVICE_NAMES = {
+    sync: { label: 'ai.intutic.sync-daemon', unitName: 'intutic-sync-daemon.service', logStem: 'sync-daemon' },
+    mcp: { label: 'ai.intutic.mcp-daemon', unitName: 'intutic-mcp-daemon.service', logStem: 'mcp-daemon' },
+    proxy: { label: 'ai.intutic.proxy', unitName: 'intutic-proxy.service', logStem: 'proxy' },
+};
+export function getServicePaths(system, target, platform = process.platform) {
+    const { label, unitName, logStem } = SERVICE_NAMES[target];
     if (platform === 'darwin') {
         const dir = system ? '/Library/LaunchDaemons' : path.join(os.homedir(), 'Library', 'LaunchAgents');
         const plistPath = path.join(dir, `${label}.plist`);
@@ -44,8 +48,8 @@ export function getPaths(system, isMcp, platform = process.platform) {
             targetDir: dir,
             targetPath: plistPath,
             logsDir,
-            logPath: path.join(logsDir, isMcp ? 'mcp-daemon.log' : 'sync-daemon.log'),
-            errPath: path.join(logsDir, isMcp ? 'mcp-daemon.err' : 'sync-daemon.err'),
+            logPath: path.join(logsDir, `${logStem}.log`),
+            errPath: path.join(logsDir, `${logStem}.err`),
         };
     }
     else {
@@ -58,11 +62,15 @@ export function getPaths(system, isMcp, platform = process.platform) {
             targetDir: dir,
             targetPath: unitPath,
             logsDir,
-            logPath: path.join(logsDir, isMcp ? 'mcp-daemon.log' : 'sync-daemon.log'),
-            errPath: path.join(logsDir, isMcp ? 'mcp-daemon.err' : 'sync-daemon.err'),
+            logPath: path.join(logsDir, `${logStem}.log`),
+            errPath: path.join(logsDir, `${logStem}.err`),
         };
     }
 }
+/** The two-daemon shape every existing caller uses; `getServicePaths` is the general form. */
+export function getPaths(system, isMcp, platform = process.platform) {
+    return getServicePaths(system, isMcp ? 'mcp' : 'sync', platform);
+}
 // ── macOS LaunchAgent & LaunchDaemon ──────────────────────────────────
 export function buildPlist(opts, system = false) {
     const paths = getPaths(system, false, 'darwin');
@@ -122,19 +130,41 @@ ${argStrings.join('\n')}
 </plist>
 `;
 }
+/**
+ * Resolve the argv used to launch the MCP daemon from a service definition.
+ *
+ * Both launchd and systemd exec the program directly rather than through a
+ * shell, and neither searches PATH: launchd requires an absolute path in
+ * `ProgramArguments[0]`, and systemd rejects a unit whose `ExecStart` does not
+ * start with an absolute path. So `which` is run for its *output* — the
+ * absolute location — not merely as a presence check.
+ *
+ * Falls back to running the bundled daemon entry point under the current Node
+ * when `intutic-mcp-daemon` is not installed on PATH.
+ */
+function resolveMcpDaemonExec(daemonPath) {
+    const fallback = [process.execPath, daemonPath];
+    try {
+        // stderr is dropped so a "not found" message never reaches the CLI output;
+        // `which` exits non-zero in that case and the catch below handles it.
+        const resolved = execFileSync('which', ['intutic-mcp-daemon'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        })
+            .split('\n')[0]
+            .trim();
+        return path.isAbsolute(resolved) ? [resolved] : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
 export function buildMcpPlist(opts, system = false) {
     const paths = getPaths(system, true, 'darwin');
     const config = loadConfig();
     const workspaceRoot = config?.workspaceRoot ?? process.cwd();
     const daemonPath = path.join(workspaceRoot, 'packages', 'mcp-proxy', 'dist', 'daemon', 'index.js');
-    let execArgs = [];
-    try {
-        execFileSync('which', ['intutic-mcp-daemon'], { stdio: 'ignore' });
-        execArgs = ['intutic-mcp-daemon'];
-    }
-    catch {
-        execArgs = [process.execPath, daemonPath];
-    }
+    const execArgs = resolveMcpDaemonExec(daemonPath);
     const programArgsXml = execArgs.map(arg => `    <string>${arg}</string>`).join('\n');
     const runAtLoad = system ? '' : '\n  <key>RunAtLoad</key>\n  <true/>';
     return `<?xml version="1.0" encoding="UTF-8"?>
@@ -198,7 +228,13 @@ async function installMacos(opts, system = false, dryRun = false) {
     try {
         execFileSync('launchctl', ['unload', '-w', paths.targetPath], { stdio: 'ignore' });
     }
-    catch { }
+    catch {
+        // Best-effort: this unload exists only to release a previously installed
+        // agent before its plist is overwritten. On a first install there is no
+        // plist and nothing loaded, so launchctl exits non-zero — the expected
+        // case, not a failure. A real problem surfaces at the `load` below, which
+        // is deliberately not wrapped.
+    }
     await fs.writeFile(paths.targetPath, plist, 'utf-8');
     execFileSync('launchctl', ['load', '-w', paths.targetPath]);
     console.log(`\n✅ Launch${system ? 'Daemon' : 'Agent'} installed and started.`);
@@ -206,7 +242,7 @@ async function installMacos(opts, system = false, dryRun = false) {
 // ── Linux systemd ─────────────────────────────────────────────────────
 export function buildUnit(opts, system = false) {
     const paths = getPaths(system, false, 'linux');
-    let execStart = '';
+    let execStart;
     if (opts.binaryPath.endsWith('.js') || opts.binaryPath.endsWith('.ts')) {
         execStart = `${process.execPath} ${opts.binaryPath}`;
     }
@@ -249,14 +285,7 @@ export function buildMcpUnit(opts, system = false) {
     const config = loadConfig();
     const workspaceRoot = config?.workspaceRoot ?? process.cwd();
     const daemonPath = path.join(workspaceRoot, 'packages', 'mcp-proxy', 'dist', 'daemon', 'index.js');
-    let execStart = '';
-    try {
-        execFileSync('which', ['intutic-mcp-daemon'], { stdio: 'ignore' });
-        execStart = 'intutic-mcp-daemon';
-    }
-    catch {
-        execStart = `${process.execPath} ${daemonPath}`;
-    }
+    const execStart = resolveMcpDaemonExec(daemonPath).join(' ');
     return `[Unit]
 Description=Intutic MCP Daemon — Persistent policy and telemetry cache for MCP harnesses
 Documentation=https://docs.intutic.ai/daemon
@@ -278,6 +307,119 @@ Environment=CONTROL_PLANE_URL=${opts.controlPlaneUrl}
 StandardOutput=append:${paths.logPath}
 StandardError=append:${paths.errPath}
 
+[Install]
+WantedBy=${system ? 'multi-user.target' : 'default.target'}
+`;
+}
+// ── Standalone proxy (TD-465) ─────────────────────────────────────────
+/**
+ * The environment `intutic start` hands the proxy, as a service file has to
+ * fix it: `PORT` always; `VALKEY_URL` when a Valkey was named, else
+ * `INTUTIC_STANDALONE=1` so the proxy skips the probe and says why;
+ * `UPSTREAM_URL` only when given. Insertion order is the order it is written.
+ */
+export function proxyServiceEnv(opts) {
+    return {
+        PORT: opts.port,
+        ...(opts.valkeyUrl ? { VALKEY_URL: opts.valkeyUrl } : { INTUTIC_STANDALONE: '1' }),
+        ...(opts.upstreamUrl ? { UPSTREAM_URL: opts.upstreamUrl } : {}),
+    };
+}
+/**
+ * Resolve the absolute `intutic-proxy` path a service file may reference.
+ *
+ * Same rule as `resolveMcpDaemonExec`: launchd and systemd exec the program
+ * directly, do not search PATH, and refuse a relative `ExecStart`, so the PATH
+ * shim `intutic start` falls back to is not usable here. An explicit path is
+ * taken as given but must be absolute; otherwise the launcher's version-pinned
+ * binary, then `which`. Nothing found is an error rather than a unit that
+ * fails on its first start with a message only the log file sees.
+ */
+export function resolveProxyServiceBinary(explicit) {
+    if (explicit) {
+        if (!path.isAbsolute(explicit)) {
+            throw new Error(`--binary-path must be absolute (a service file cannot search PATH): ${explicit}`);
+        }
+        return explicit;
+    }
+    const pinned = localProxyBinary();
+    if (pinned)
+        return pinned;
+    try {
+        const resolved = execFileSync('which', ['intutic-proxy'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        })
+            .split('\n')[0]
+            .trim();
+        if (path.isAbsolute(resolved))
+            return resolved;
+    }
+    catch {
+        // `which` exits non-zero when nothing is on PATH; handled by the throw below.
+    }
+    throw new Error('Could not find the intutic-proxy binary. Install it with `npm install -g @intutic/proxy` ' +
+        'or pass --binary-path /absolute/path/to/intutic-proxy.');
+}
+export function buildProxyPlist(opts, system = false) {
+    const paths = getServicePaths(system, 'proxy', 'darwin');
+    const runAtLoad = system ? '' : '\n  <key>RunAtLoad</key>\n  <true/>';
+    const envXml = Object.entries(proxyServiceEnv(opts))
+        .map(([k, v]) => `    <key>${k}</key>\n    <string>${v}</string>`)
+        .join('\n');
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${paths.label}</string>
+
+  <key>ProgramArguments</key>
+  <array>
+    <string>${opts.binaryPath}</string>
+  </array>
+
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>${runAtLoad}
+
+  <key>StandardOutPath</key>
+  <string>${paths.logPath}</string>
+  <key>StandardErrorPath</key>
+  <string>${paths.errPath}</string>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+${envXml}
+  </dict>
+</dict>
+</plist>
+`;
+}
+export function buildProxyUnit(opts, system = false) {
+    const paths = getServicePaths(system, 'proxy', 'linux');
+    const envLines = Object.entries(proxyServiceEnv(opts))
+        .map(([k, v]) => `Environment=${k}=${v}`)
+        .join('\n');
+    return `[Unit]
+Description=Intutic Proxy — Standalone governed LLM gateway
+Documentation=https://docs.intutic.ai/integrations/standalone
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${opts.binaryPath}
+
+Restart=always
+RestartSec=5
+
+${envLines}
+
+StandardOutput=append:${paths.logPath}
+StandardError=append:${paths.errPath}
+
 [Install]
 WantedBy=${system ? 'multi-user.target' : 'default.target'}
 `;
@@ -337,11 +479,21 @@ export async function uninstallDaemon(opts = {}) {
                 try {
                     execFileSync('launchctl', ['unload', '-w', paths.targetPath], { stdio: 'ignore' });
                 }
-                catch { }
+                catch {
+                    // Best-effort: uninstall is idempotent. launchctl exits non-zero when
+                    // the agent is already unloaded or was never loaded, and in both cases
+                    // the desired end state is reached. The plist removal below is what
+                    // actually has to happen, so it must not be skipped on this failure.
+                }
                 try {
                     await fs.unlink(paths.targetPath);
                 }
-                catch { }
+                catch {
+                    // Best-effort: ENOENT means an earlier uninstall already removed the
+                    // plist, which is success for this command. Other errors (EACCES on a
+                    // /Library/LaunchDaemons plist) are already pre-empted by the
+                    // checkRootPrivileges call above.
+                }
             }
             console.log(`✅ Launch${system ? 'Daemon' : 'Agent'} removed.`);
             break;
@@ -353,12 +505,21 @@ export async function uninstallDaemon(opts = {}) {
                 try {
                     execFileSync('systemctl', [...cmdArgs, 'disable', '--now', paths.unitName], { stdio: 'ignore' });
                 }
-                catch { }
+                catch {
+                    // Best-effort: `disable --now` exits non-zero when the unit is not
+                    // enabled, not loaded, or absent entirely — all of which mean the work
+                    // this call was going to do is already done. The unit file removal
+                    // below is the part that must still run.
+                }
                 try {
                     await fs.unlink(paths.targetPath);
                     execFileSync('systemctl', [...cmdArgs, 'daemon-reload'], { stdio: 'ignore' });
                 }
-                catch { }
+                catch {
+                    // Best-effort: ENOENT means the unit file is already gone, and the
+                    // reload is deliberately inside the same block — if nothing was
+                    // removed there is no change for systemd to pick up.
+                }
             }
             console.log(`✅ systemd ${system ? 'system' : 'user'} unit removed.`);
             break;
@@ -419,7 +580,7 @@ export async function daemonStop() {
                         console.log(`✅ Successfully stopped ${system ? 'system' : 'user'} sync-daemon.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to stop ${system ? 'system' : 'user'} sync-daemon: ${e.message}`);
+                        console.log(`❌ Failed to stop ${system ? 'system' : 'user'} sync-daemon: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
@@ -436,7 +597,7 @@ export async function daemonStop() {
                         console.log(`✅ Successfully stopped ${system ? 'system' : 'user'} sync-daemon unit.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to stop ${system ? 'system' : 'user'} sync-daemon unit: ${e.message}`);
+                        console.log(`❌ Failed to stop ${system ? 'system' : 'user'} sync-daemon unit: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
@@ -456,7 +617,7 @@ export async function daemonStart() {
                         console.log(`✅ Successfully started ${system ? 'system' : 'user'} sync-daemon.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to start ${system ? 'system' : 'user'} sync-daemon: ${e.message}`);
+                        console.log(`❌ Failed to start ${system ? 'system' : 'user'} sync-daemon: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
@@ -473,7 +634,7 @@ export async function daemonStart() {
                         console.log(`✅ Successfully started ${system ? 'system' : 'user'} sync-daemon unit.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to start ${system ? 'system' : 'user'} sync-daemon unit: ${e.message}`);
+                        console.log(`❌ Failed to start ${system ? 'system' : 'user'} sync-daemon unit: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
@@ -507,7 +668,12 @@ export async function installMcpDaemon(opts) {
             try {
                 execFileSync('launchctl', ['unload', '-w', paths.targetPath], { stdio: 'ignore' });
             }
-            catch { }
+            catch {
+                // Best-effort: releases a previously installed MCP agent before its
+                // plist is overwritten. Nothing is loaded on a first install, so a
+                // non-zero exit here is the normal path. The `load` below is unwrapped
+                // and will report a genuine failure.
+            }
             await fs.writeFile(paths.targetPath, plist, 'utf-8');
             execFileSync('launchctl', ['load', '-w', paths.targetPath]);
             console.log(`\n✅ MCP Launch${system ? 'Daemon' : 'Agent'} installed and started.`);
@@ -551,11 +717,21 @@ export async function uninstallMcpDaemon(opts = {}) {
                 try {
                     execFileSync('launchctl', ['unload', '-w', paths.targetPath], { stdio: 'ignore' });
                 }
-                catch { }
+                catch {
+                    // Best-effort: uninstall is idempotent. An MCP agent that is already
+                    // unloaded (or never was) makes launchctl exit non-zero while leaving
+                    // the desired end state in place, and the plist removal below still
+                    // has to run.
+                }
                 try {
                     await fs.unlink(paths.targetPath);
                 }
-                catch { }
+                catch {
+                    // Best-effort: ENOENT means a previous uninstall already removed the
+                    // plist, which is the outcome this command wants. Permission failures
+                    // on the /Library/LaunchDaemons copy are pre-empted by the
+                    // checkRootPrivileges call above.
+                }
             }
             console.log(`✅ MCP Launch${system ? 'Daemon' : 'Agent'} removed.`);
             break;
@@ -567,12 +743,21 @@ export async function uninstallMcpDaemon(opts = {}) {
                 try {
                     execFileSync('systemctl', [...cmdArgs, 'disable', '--now', paths.unitName], { stdio: 'ignore' });
                 }
-                catch { }
+                catch {
+                    // Best-effort: a unit that is not enabled, not loaded, or absent makes
+                    // `disable --now` exit non-zero, and each of those already satisfies
+                    // what this call was for. Removal of the unit file below must not be
+                    // skipped because of it.
+                }
                 try {
                     await fs.unlink(paths.targetPath);
                     execFileSync('systemctl', [...cmdArgs, 'daemon-reload'], { stdio: 'ignore' });
                 }
-                catch { }
+                catch {
+                    // Best-effort: ENOENT means the unit file is already gone. The reload
+                    // shares this block on purpose — with nothing removed there is no
+                    // change for systemd to reload.
+                }
             }
             console.log(`✅ MCP systemd ${system ? 'system' : 'user'} unit removed.`);
             break;
@@ -631,7 +816,7 @@ export async function mcpDaemonStop() {
                         console.log(`✅ Successfully stopped MCP Launch${system ? 'Daemon' : 'Agent'}.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to stop MCP Launch${system ? 'Daemon' : 'Agent'}: ${e.message}`);
+                        console.log(`❌ Failed to stop MCP Launch${system ? 'Daemon' : 'Agent'}: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
@@ -648,7 +833,7 @@ export async function mcpDaemonStop() {
                         console.log(`✅ Successfully stopped MCP ${system ? 'system' : 'user'} unit.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to stop MCP ${system ? 'system' : 'user'} unit: ${e.message}`);
+                        console.log(`❌ Failed to stop MCP ${system ? 'system' : 'user'} unit: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
@@ -668,7 +853,7 @@ export async function mcpDaemonStart() {
                         console.log(`✅ Successfully started MCP Launch${system ? 'Daemon' : 'Agent'}.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to start MCP Launch${system ? 'Daemon' : 'Agent'}: ${e.message}`);
+                        console.log(`❌ Failed to start MCP Launch${system ? 'Daemon' : 'Agent'}: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
@@ -685,12 +870,262 @@ export async function mcpDaemonStart() {
                         console.log(`✅ Successfully started MCP ${system ? 'system' : 'user'} unit.`);
                     }
                     catch (e) {
-                        console.log(`❌ Failed to start MCP ${system ? 'system' : 'user'} unit: ${e.message}`);
+                        console.log(`❌ Failed to start MCP ${system ? 'system' : 'user'} unit: ${e instanceof Error ? e.message : String(e)}`);
+                    }
+                }
+            }
+            break;
+        }
+    }
+}
+/**
+ * `intutic daemon status|stop|start --proxy` — the same three verbs the
+ * sync daemon and the MCP daemon have, for the standalone proxy service
+ * `installProxyService` writes. Both scopes are checked, as for the others:
+ * a user-level LaunchAgent and a system-level LaunchDaemon can coexist.
+ */
+export async function proxyServiceStatus() {
+    switch (process.platform) {
+        case 'darwin': {
+            for (const system of [false, true]) {
+                const paths = getServicePaths(system, 'proxy', 'darwin');
+                const plistExists = await fs.access(paths.targetPath).then(() => true).catch(() => false);
+                const scopeStr = system ? 'System-level (LaunchDaemon)' : 'User-level (LaunchAgent)';
+                if (plistExists) {
+                    console.log(`✅ Proxy: ${scopeStr} installed at ${paths.targetPath}`);
+                    try {
+                        execFileSync('launchctl', ['list', paths.label], { stdio: 'inherit' });
+                    }
+                    catch {
+                        console.log(`   ⚠️  Proxy ${scopeStr} plist exists but is not loaded.`);
+                    }
+                }
+                else {
+                    console.log(`⬜ Proxy: ${scopeStr} not installed`);
+                }
+            }
+            break;
+        }
+        case 'linux': {
+            for (const system of [false, true]) {
+                const paths = getServicePaths(system, 'proxy', 'linux');
+                const scopeStr = system ? 'System-level' : 'User-level';
+                const cmdArgs = system ? [] : ['--user'];
+                try {
+                    console.log(`\n--- Proxy ${scopeStr} Status ---`);
+                    execFileSync('systemctl', [...cmdArgs, 'status', paths.unitName], { stdio: 'inherit' });
+                }
+                catch {
+                    console.log(`⬜ Proxy: ${scopeStr} not running`);
+                }
+            }
+            break;
+        }
+    }
+}
+export async function proxyServiceStop() {
+    switch (process.platform) {
+        case 'darwin': {
+            for (const system of [false, true]) {
+                const paths = getServicePaths(system, 'proxy', 'darwin');
+                const plistExists = await fs.access(paths.targetPath).then(() => true).catch(() => false);
+                if (plistExists) {
+                    console.log(`\n🛑 Stopping proxy Launch${system ? 'Daemon' : 'Agent'}: ${paths.label}`);
+                    try {
+                        execFileSync('launchctl', ['unload', paths.targetPath], { stdio: 'ignore' });
+                        console.log(`✅ Successfully stopped proxy Launch${system ? 'Daemon' : 'Agent'}.`);
+                    }
+                    catch (e) {
+                        console.log(`❌ Failed to stop proxy Launch${system ? 'Daemon' : 'Agent'}: ${e instanceof Error ? e.message : String(e)}`);
                     }
                 }
             }
             break;
         }
+        case 'linux': {
+            for (const system of [false, true]) {
+                const paths = getServicePaths(system, 'proxy', 'linux');
+                const unitExists = await fs.access(paths.targetPath).then(() => true).catch(() => false);
+                if (unitExists) {
+                    try {
+                        const cmdArgs = system ? [] : ['--user'];
+                        execFileSync('systemctl', [...cmdArgs, 'stop', paths.unitName], { stdio: 'ignore' });
+                        console.log(`✅ Successfully stopped proxy ${system ? 'system' : 'user'} unit.`);
+                    }
+                    catch (e) {
+                        console.log(`❌ Failed to stop proxy ${system ? 'system' : 'user'} unit: ${e instanceof Error ? e.message : String(e)}`);
+                    }
+                }
+            }
+            break;
+        }
+    }
+}
+export async function proxyServiceStart() {
+    switch (process.platform) {
+        case 'darwin': {
+            for (const system of [false, true]) {
+                const paths = getServicePaths(system, 'proxy', 'darwin');
+                const plistExists = await fs.access(paths.targetPath).then(() => true).catch(() => false);
+                if (plistExists) {
+                    try {
+                        execFileSync('launchctl', ['load', '-w', paths.targetPath], { stdio: 'ignore' });
+                        console.log(`✅ Successfully started proxy Launch${system ? 'Daemon' : 'Agent'}.`);
+                    }
+                    catch (e) {
+                        console.log(`❌ Failed to start proxy Launch${system ? 'Daemon' : 'Agent'}: ${e instanceof Error ? e.message : String(e)}`);
+                    }
+                }
+            }
+            break;
+        }
+        case 'linux': {
+            for (const system of [false, true]) {
+                const paths = getServicePaths(system, 'proxy', 'linux');
+                const unitExists = await fs.access(paths.targetPath).then(() => true).catch(() => false);
+                if (unitExists) {
+                    try {
+                        const cmdArgs = system ? [] : ['--user'];
+                        execFileSync('systemctl', [...cmdArgs, 'start', paths.unitName], { stdio: 'ignore' });
+                        console.log(`✅ Successfully started proxy ${system ? 'system' : 'user'} unit.`);
+                    }
+                    catch (e) {
+                        console.log(`❌ Failed to start proxy ${system ? 'system' : 'user'} unit: ${e instanceof Error ? e.message : String(e)}`);
+                    }
+                }
+            }
+            break;
+        }
+    }
+}
+// ── Public API (standalone proxy, TD-465) ────────────────────────────
+export async function installProxyService(opts = {}) {
+    const resolved = {
+        binaryPath: resolveProxyServiceBinary(opts.binaryPath),
+        port: opts.port ?? '4000',
+        valkeyUrl: opts.valkeyUrl,
+        upstreamUrl: opts.upstreamUrl,
+    };
+    const system = !!opts.system;
+    const mode = resolved.valkeyUrl ? `Valkey ${resolved.valkeyUrl}` : 'standalone (INTUTIC_STANDALONE=1)';
+    switch (process.platform) {
+        case 'darwin': {
+            const paths = getServicePaths(system, 'proxy', 'darwin');
+            if (!opts.dryRun) {
+                checkRootPrivileges(system, paths.targetPath);
+            }
+            const plist = buildProxyPlist(resolved, system);
+            console.log(`\n📦 Installing proxy macOS Launch${system ? 'Daemon' : 'Agent'}: ${paths.targetPath}`);
+            console.log(`   Binary : ${resolved.binaryPath}`);
+            console.log(`   Port   : ${resolved.port} — ${mode}`);
+            if (opts.dryRun) {
+                console.log('\n[dry-run] Would write plist:');
+                console.log(plist);
+                return;
+            }
+            await fs.mkdir(paths.targetDir, { recursive: true });
+            await fs.mkdir(paths.logsDir, { recursive: true });
+            try {
+                execFileSync('launchctl', ['unload', '-w', paths.targetPath], { stdio: 'ignore' });
+            }
+            catch {
+                // Best-effort: releases a previously installed proxy agent before its
+                // plist is overwritten. Nothing is loaded on a first install, so a
+                // non-zero exit here is the normal path. The `load` below is unwrapped
+                // and will report a genuine failure.
+            }
+            await fs.writeFile(paths.targetPath, plist, 'utf-8');
+            execFileSync('launchctl', ['load', '-w', paths.targetPath]);
+            console.log(`\n✅ Proxy Launch${system ? 'Daemon' : 'Agent'} installed and started.`);
+            break;
+        }
+        case 'linux': {
+            const paths = getServicePaths(system, 'proxy', 'linux');
+            if (!opts.dryRun) {
+                checkRootPrivileges(system, paths.targetPath);
+            }
+            const unit = buildProxyUnit(resolved, system);
+            console.log(`\n📦 Installing proxy systemd ${system ? 'system' : 'user'} unit: ${paths.targetPath}`);
+            console.log(`   Binary : ${resolved.binaryPath}`);
+            console.log(`   Port   : ${resolved.port} — ${mode}`);
+            if (opts.dryRun) {
+                console.log('\n[dry-run] Would write unit:');
+                console.log(unit);
+                return;
+            }
+            await fs.mkdir(paths.targetDir, { recursive: true });
+            await fs.mkdir(paths.logsDir, { recursive: true });
+            await fs.writeFile(paths.targetPath, unit, 'utf-8');
+            const cmdArgs = system ? [] : ['--user'];
+            execFileSync('systemctl', [...cmdArgs, 'daemon-reload']);
+            execFileSync('systemctl', [...cmdArgs, 'enable', '--now', paths.unitName]);
+            console.log(`\n✅ Proxy systemd ${system ? 'system' : 'user'} unit installed and started.`);
+            break;
+        }
+        default:
+            console.log(`\n⚠️  Platform '${process.platform}' not supported.`);
+    }
+}
+export async function uninstallProxyService(opts = {}) {
+    const system = !!opts.system;
+    const paths = getServicePaths(system, 'proxy');
+    if (!opts.dryRun) {
+        checkRootPrivileges(system, paths.targetPath);
+    }
+    switch (process.platform) {
+        case 'darwin': {
+            console.log(`\n🗑  Removing proxy Launch${system ? 'Daemon' : 'Agent'}: ${paths.targetPath}`);
+            if (!opts.dryRun) {
+                try {
+                    execFileSync('launchctl', ['unload', '-w', paths.targetPath], { stdio: 'ignore' });
+                }
+                catch {
+                    // Best-effort: uninstall is idempotent. An agent that is already
+                    // unloaded (or never was) makes launchctl exit non-zero while leaving
+                    // the desired end state in place, and the plist removal below still
+                    // has to run.
+                }
+                try {
+                    await fs.unlink(paths.targetPath);
+                }
+                catch {
+                    // Best-effort: ENOENT means a previous uninstall already removed the
+                    // plist, which is the outcome this command wants. Permission failures
+                    // on the /Library/LaunchDaemons copy are pre-empted by the
+                    // checkRootPrivileges call above.
+                }
+            }
+            console.log(`✅ Proxy Launch${system ? 'Daemon' : 'Agent'} removed.`);
+            break;
+        }
+        case 'linux': {
+            console.log(`\n🗑  Removing proxy systemd ${system ? 'system' : 'user'} unit: ${paths.targetPath}`);
+            if (!opts.dryRun) {
+                const cmdArgs = system ? [] : ['--user'];
+                try {
+                    execFileSync('systemctl', [...cmdArgs, 'disable', '--now', paths.unitName], { stdio: 'ignore' });
+                }
+                catch {
+                    // Best-effort: a unit that is not enabled, not loaded, or absent makes
+                    // `disable --now` exit non-zero, and each of those already satisfies
+                    // what this call was for. Removal of the unit file below must not be
+                    // skipped because of it.
+                }
+                try {
+                    await fs.unlink(paths.targetPath);
+                    execFileSync('systemctl', [...cmdArgs, 'daemon-reload'], { stdio: 'ignore' });
+                }
+                catch {
+                    // Best-effort: ENOENT means the unit file is already gone. The reload
+                    // shares this block on purpose — with nothing removed there is no
+                    // change for systemd to reload.
+                }
+            }
+            console.log(`✅ Proxy systemd ${system ? 'system' : 'user'} unit removed.`);
+            break;
+        }
+        default:
+            console.log(`\n⚠️  Platform '${process.platform}' is not supported.`);
     }
 }
 //# sourceMappingURL=install-daemon.js.map