@longleash/cli 0.1.0-rc.1 → 0.1.0-rc.11

package/bin/longleash.mjs

@@ -1,11 +1,1106 @@
 #!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js
+var require_QRMode = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js"(exports, module) {
+    module.exports = {
+      MODE_NUMBER: 1 << 0,
+      MODE_ALPHA_NUM: 1 << 1,
+      MODE_8BIT_BYTE: 1 << 2,
+      MODE_KANJI: 1 << 3
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QR8bitByte.js
+var require_QR8bitByte = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QR8bitByte.js"(exports, module) {
+    var QRMode = require_QRMode();
+    function QR8bitByte(data) {
+      this.mode = QRMode.MODE_8BIT_BYTE;
+      this.data = data;
+    }
+    QR8bitByte.prototype = {
+      getLength: function() {
+        return this.data.length;
+      },
+      write: function(buffer) {
+        for (var i = 0; i < this.data.length; i++) {
+          buffer.put(this.data.charCodeAt(i), 8);
+        }
+      }
+    };
+    module.exports = QR8bitByte;
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMath.js
+var require_QRMath = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMath.js"(exports, module) {
+    var QRMath = {
+      glog: function(n) {
+        if (n < 1) {
+          throw new Error("glog(" + n + ")");
+        }
+        return QRMath.LOG_TABLE[n];
+      },
+      gexp: function(n) {
+        while (n < 0) {
+          n += 255;
+        }
+        while (n >= 256) {
+          n -= 255;
+        }
+        return QRMath.EXP_TABLE[n];
+      },
+      EXP_TABLE: new Array(256),
+      LOG_TABLE: new Array(256)
+    };
+    for (i = 0; i < 8; i++) {
+      QRMath.EXP_TABLE[i] = 1 << i;
+    }
+    var i;
+    for (i = 8; i < 256; i++) {
+      QRMath.EXP_TABLE[i] = QRMath.EXP_TABLE[i - 4] ^ QRMath.EXP_TABLE[i - 5] ^ QRMath.EXP_TABLE[i - 6] ^ QRMath.EXP_TABLE[i - 8];
+    }
+    var i;
+    for (i = 0; i < 255; i++) {
+      QRMath.LOG_TABLE[QRMath.EXP_TABLE[i]] = i;
+    }
+    var i;
+    module.exports = QRMath;
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRPolynomial.js
+var require_QRPolynomial = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRPolynomial.js"(exports, module) {
+    var QRMath = require_QRMath();
+    function QRPolynomial(num, shift) {
+      if (num.length === void 0) {
+        throw new Error(num.length + "/" + shift);
+      }
+      var offset = 0;
+      while (offset < num.length && num[offset] === 0) {
+        offset++;
+      }
+      this.num = new Array(num.length - offset + shift);
+      for (var i = 0; i < num.length - offset; i++) {
+        this.num[i] = num[i + offset];
+      }
+    }
+    QRPolynomial.prototype = {
+      get: function(index) {
+        return this.num[index];
+      },
+      getLength: function() {
+        return this.num.length;
+      },
+      multiply: function(e) {
+        var num = new Array(this.getLength() + e.getLength() - 1);
+        for (var i = 0; i < this.getLength(); i++) {
+          for (var j = 0; j < e.getLength(); j++) {
+            num[i + j] ^= QRMath.gexp(QRMath.glog(this.get(i)) + QRMath.glog(e.get(j)));
+          }
+        }
+        return new QRPolynomial(num, 0);
+      },
+      mod: function(e) {
+        if (this.getLength() - e.getLength() < 0) {
+          return this;
+        }
+        var ratio = QRMath.glog(this.get(0)) - QRMath.glog(e.get(0));
+        var num = new Array(this.getLength());
+        for (var i = 0; i < this.getLength(); i++) {
+          num[i] = this.get(i);
+        }
+        for (var x = 0; x < e.getLength(); x++) {
+          num[x] ^= QRMath.gexp(QRMath.glog(e.get(x)) + ratio);
+        }
+        return new QRPolynomial(num, 0).mod(e);
+      }
+    };
+    module.exports = QRPolynomial;
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMaskPattern.js
+var require_QRMaskPattern = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMaskPattern.js"(exports, module) {
+    module.exports = {
+      PATTERN000: 0,
+      PATTERN001: 1,
+      PATTERN010: 2,
+      PATTERN011: 3,
+      PATTERN100: 4,
+      PATTERN101: 5,
+      PATTERN110: 6,
+      PATTERN111: 7
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRUtil.js
+var require_QRUtil = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRUtil.js"(exports, module) {
+    var QRMode = require_QRMode();
+    var QRPolynomial = require_QRPolynomial();
+    var QRMath = require_QRMath();
+    var QRMaskPattern = require_QRMaskPattern();
+    var QRUtil = {
+      PATTERN_POSITION_TABLE: [
+        [],
+        [6, 18],
+        [6, 22],
+        [6, 26],
+        [6, 30],
+        [6, 34],
+        [6, 22, 38],
+        [6, 24, 42],
+        [6, 26, 46],
+        [6, 28, 50],
+        [6, 30, 54],
+        [6, 32, 58],
+        [6, 34, 62],
+        [6, 26, 46, 66],
+        [6, 26, 48, 70],
+        [6, 26, 50, 74],
+        [6, 30, 54, 78],
+        [6, 30, 56, 82],
+        [6, 30, 58, 86],
+        [6, 34, 62, 90],
+        [6, 28, 50, 72, 94],
+        [6, 26, 50, 74, 98],
+        [6, 30, 54, 78, 102],
+        [6, 28, 54, 80, 106],
+        [6, 32, 58, 84, 110],
+        [6, 30, 58, 86, 114],
+        [6, 34, 62, 90, 118],
+        [6, 26, 50, 74, 98, 122],
+        [6, 30, 54, 78, 102, 126],
+        [6, 26, 52, 78, 104, 130],
+        [6, 30, 56, 82, 108, 134],
+        [6, 34, 60, 86, 112, 138],
+        [6, 30, 58, 86, 114, 142],
+        [6, 34, 62, 90, 118, 146],
+        [6, 30, 54, 78, 102, 126, 150],
+        [6, 24, 50, 76, 102, 128, 154],
+        [6, 28, 54, 80, 106, 132, 158],
+        [6, 32, 58, 84, 110, 136, 162],
+        [6, 26, 54, 82, 110, 138, 166],
+        [6, 30, 58, 86, 114, 142, 170]
+      ],
+      G15: 1 << 10 | 1 << 8 | 1 << 5 | 1 << 4 | 1 << 2 | 1 << 1 | 1 << 0,
+      G18: 1 << 12 | 1 << 11 | 1 << 10 | 1 << 9 | 1 << 8 | 1 << 5 | 1 << 2 | 1 << 0,
+      G15_MASK: 1 << 14 | 1 << 12 | 1 << 10 | 1 << 4 | 1 << 1,
+      getBCHTypeInfo: function(data) {
+        var d = data << 10;
+        while (QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G15) >= 0) {
+          d ^= QRUtil.G15 << QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G15);
+        }
+        return (data << 10 | d) ^ QRUtil.G15_MASK;
+      },
+      getBCHTypeNumber: function(data) {
+        var d = data << 12;
+        while (QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G18) >= 0) {
+          d ^= QRUtil.G18 << QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G18);
+        }
+        return data << 12 | d;
+      },
+      getBCHDigit: function(data) {
+        var digit = 0;
+        while (data !== 0) {
+          digit++;
+          data >>>= 1;
+        }
+        return digit;
+      },
+      getPatternPosition: function(typeNumber) {
+        return QRUtil.PATTERN_POSITION_TABLE[typeNumber - 1];
+      },
+      getMask: function(maskPattern, i, j) {
+        switch (maskPattern) {
+          case QRMaskPattern.PATTERN000:
+            return (i + j) % 2 === 0;
+          case QRMaskPattern.PATTERN001:
+            return i % 2 === 0;
+          case QRMaskPattern.PATTERN010:
+            return j % 3 === 0;
+          case QRMaskPattern.PATTERN011:
+            return (i + j) % 3 === 0;
+          case QRMaskPattern.PATTERN100:
+            return (Math.floor(i / 2) + Math.floor(j / 3)) % 2 === 0;
+          case QRMaskPattern.PATTERN101:
+            return i * j % 2 + i * j % 3 === 0;
+          case QRMaskPattern.PATTERN110:
+            return (i * j % 2 + i * j % 3) % 2 === 0;
+          case QRMaskPattern.PATTERN111:
+            return (i * j % 3 + (i + j) % 2) % 2 === 0;
+          default:
+            throw new Error("bad maskPattern:" + maskPattern);
+        }
+      },
+      getErrorCorrectPolynomial: function(errorCorrectLength) {
+        var a = new QRPolynomial([1], 0);
+        for (var i = 0; i < errorCorrectLength; i++) {
+          a = a.multiply(new QRPolynomial([1, QRMath.gexp(i)], 0));
+        }
+        return a;
+      },
+      getLengthInBits: function(mode, type) {
+        if (1 <= type && type < 10) {
+          switch (mode) {
+            case QRMode.MODE_NUMBER:
+              return 10;
+            case QRMode.MODE_ALPHA_NUM:
+              return 9;
+            case QRMode.MODE_8BIT_BYTE:
+              return 8;
+            case QRMode.MODE_KANJI:
+              return 8;
+            default:
+              throw new Error("mode:" + mode);
+          }
+        } else if (type < 27) {
+          switch (mode) {
+            case QRMode.MODE_NUMBER:
+              return 12;
+            case QRMode.MODE_ALPHA_NUM:
+              return 11;
+            case QRMode.MODE_8BIT_BYTE:
+              return 16;
+            case QRMode.MODE_KANJI:
+              return 10;
+            default:
+              throw new Error("mode:" + mode);
+          }
+        } else if (type < 41) {
+          switch (mode) {
+            case QRMode.MODE_NUMBER:
+              return 14;
+            case QRMode.MODE_ALPHA_NUM:
+              return 13;
+            case QRMode.MODE_8BIT_BYTE:
+              return 16;
+            case QRMode.MODE_KANJI:
+              return 12;
+            default:
+              throw new Error("mode:" + mode);
+          }
+        } else {
+          throw new Error("type:" + type);
+        }
+      },
+      getLostPoint: function(qrCode) {
+        var moduleCount = qrCode.getModuleCount();
+        var lostPoint = 0;
+        var row = 0;
+        var col = 0;
+        for (row = 0; row < moduleCount; row++) {
+          for (col = 0; col < moduleCount; col++) {
+            var sameCount = 0;
+            var dark = qrCode.isDark(row, col);
+            for (var r = -1; r <= 1; r++) {
+              if (row + r < 0 || moduleCount <= row + r) {
+                continue;
+              }
+              for (var c = -1; c <= 1; c++) {
+                if (col + c < 0 || moduleCount <= col + c) {
+                  continue;
+                }
+                if (r === 0 && c === 0) {
+                  continue;
+                }
+                if (dark === qrCode.isDark(row + r, col + c)) {
+                  sameCount++;
+                }
+              }
+            }
+            if (sameCount > 5) {
+              lostPoint += 3 + sameCount - 5;
+            }
+          }
+        }
+        for (row = 0; row < moduleCount - 1; row++) {
+          for (col = 0; col < moduleCount - 1; col++) {
+            var count = 0;
+            if (qrCode.isDark(row, col)) count++;
+            if (qrCode.isDark(row + 1, col)) count++;
+            if (qrCode.isDark(row, col + 1)) count++;
+            if (qrCode.isDark(row + 1, col + 1)) count++;
+            if (count === 0 || count === 4) {
+              lostPoint += 3;
+            }
+          }
+        }
+        for (row = 0; row < moduleCount; row++) {
+          for (col = 0; col < moduleCount - 6; col++) {
+            if (qrCode.isDark(row, col) && !qrCode.isDark(row, col + 1) && qrCode.isDark(row, col + 2) && qrCode.isDark(row, col + 3) && qrCode.isDark(row, col + 4) && !qrCode.isDark(row, col + 5) && qrCode.isDark(row, col + 6)) {
+              lostPoint += 40;
+            }
+          }
+        }
+        for (col = 0; col < moduleCount; col++) {
+          for (row = 0; row < moduleCount - 6; row++) {
+            if (qrCode.isDark(row, col) && !qrCode.isDark(row + 1, col) && qrCode.isDark(row + 2, col) && qrCode.isDark(row + 3, col) && qrCode.isDark(row + 4, col) && !qrCode.isDark(row + 5, col) && qrCode.isDark(row + 6, col)) {
+              lostPoint += 40;
+            }
+          }
+        }
+        var darkCount = 0;
+        for (col = 0; col < moduleCount; col++) {
+          for (row = 0; row < moduleCount; row++) {
+            if (qrCode.isDark(row, col)) {
+              darkCount++;
+            }
+          }
+        }
+        var ratio = Math.abs(100 * darkCount / moduleCount / moduleCount - 50) / 5;
+        lostPoint += ratio * 10;
+        return lostPoint;
+      }
+    };
+    module.exports = QRUtil;
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js
+var require_QRErrorCorrectLevel = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js"(exports, module) {
+    module.exports = {
+      L: 1,
+      M: 0,
+      Q: 3,
+      H: 2
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRRSBlock.js
+var require_QRRSBlock = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRRSBlock.js"(exports, module) {
+    var QRErrorCorrectLevel = require_QRErrorCorrectLevel();
+    function QRRSBlock(totalCount, dataCount) {
+      this.totalCount = totalCount;
+      this.dataCount = dataCount;
+    }
+    QRRSBlock.RS_BLOCK_TABLE = [
+      // L
+      // M
+      // Q
+      // H
+      // 1
+      [1, 26, 19],
+      [1, 26, 16],
+      [1, 26, 13],
+      [1, 26, 9],
+      // 2
+      [1, 44, 34],
+      [1, 44, 28],
+      [1, 44, 22],
+      [1, 44, 16],
+      // 3
+      [1, 70, 55],
+      [1, 70, 44],
+      [2, 35, 17],
+      [2, 35, 13],
+      // 4		
+      [1, 100, 80],
+      [2, 50, 32],
+      [2, 50, 24],
+      [4, 25, 9],
+      // 5
+      [1, 134, 108],
+      [2, 67, 43],
+      [2, 33, 15, 2, 34, 16],
+      [2, 33, 11, 2, 34, 12],
+      // 6
+      [2, 86, 68],
+      [4, 43, 27],
+      [4, 43, 19],
+      [4, 43, 15],
+      // 7		
+      [2, 98, 78],
+      [4, 49, 31],
+      [2, 32, 14, 4, 33, 15],
+      [4, 39, 13, 1, 40, 14],
+      // 8
+      [2, 121, 97],
+      [2, 60, 38, 2, 61, 39],
+      [4, 40, 18, 2, 41, 19],
+      [4, 40, 14, 2, 41, 15],
+      // 9
+      [2, 146, 116],
+      [3, 58, 36, 2, 59, 37],
+      [4, 36, 16, 4, 37, 17],
+      [4, 36, 12, 4, 37, 13],
+      // 10		
+      [2, 86, 68, 2, 87, 69],
+      [4, 69, 43, 1, 70, 44],
+      [6, 43, 19, 2, 44, 20],
+      [6, 43, 15, 2, 44, 16],
+      // 11
+      [4, 101, 81],
+      [1, 80, 50, 4, 81, 51],
+      [4, 50, 22, 4, 51, 23],
+      [3, 36, 12, 8, 37, 13],
+      // 12
+      [2, 116, 92, 2, 117, 93],
+      [6, 58, 36, 2, 59, 37],
+      [4, 46, 20, 6, 47, 21],
+      [7, 42, 14, 4, 43, 15],
+      // 13
+      [4, 133, 107],
+      [8, 59, 37, 1, 60, 38],
+      [8, 44, 20, 4, 45, 21],
+      [12, 33, 11, 4, 34, 12],
+      // 14
+      [3, 145, 115, 1, 146, 116],
+      [4, 64, 40, 5, 65, 41],
+      [11, 36, 16, 5, 37, 17],
+      [11, 36, 12, 5, 37, 13],
+      // 15
+      [5, 109, 87, 1, 110, 88],
+      [5, 65, 41, 5, 66, 42],
+      [5, 54, 24, 7, 55, 25],
+      [11, 36, 12],
+      // 16
+      [5, 122, 98, 1, 123, 99],
+      [7, 73, 45, 3, 74, 46],
+      [15, 43, 19, 2, 44, 20],
+      [3, 45, 15, 13, 46, 16],
+      // 17
+      [1, 135, 107, 5, 136, 108],
+      [10, 74, 46, 1, 75, 47],
+      [1, 50, 22, 15, 51, 23],
+      [2, 42, 14, 17, 43, 15],
+      // 18
+      [5, 150, 120, 1, 151, 121],
+      [9, 69, 43, 4, 70, 44],
+      [17, 50, 22, 1, 51, 23],
+      [2, 42, 14, 19, 43, 15],
+      // 19
+      [3, 141, 113, 4, 142, 114],
+      [3, 70, 44, 11, 71, 45],
+      [17, 47, 21, 4, 48, 22],
+      [9, 39, 13, 16, 40, 14],
+      // 20
+      [3, 135, 107, 5, 136, 108],
+      [3, 67, 41, 13, 68, 42],
+      [15, 54, 24, 5, 55, 25],
+      [15, 43, 15, 10, 44, 16],
+      // 21
+      [4, 144, 116, 4, 145, 117],
+      [17, 68, 42],
+      [17, 50, 22, 6, 51, 23],
+      [19, 46, 16, 6, 47, 17],
+      // 22
+      [2, 139, 111, 7, 140, 112],
+      [17, 74, 46],
+      [7, 54, 24, 16, 55, 25],
+      [34, 37, 13],
+      // 23
+      [4, 151, 121, 5, 152, 122],
+      [4, 75, 47, 14, 76, 48],
+      [11, 54, 24, 14, 55, 25],
+      [16, 45, 15, 14, 46, 16],
+      // 24
+      [6, 147, 117, 4, 148, 118],
+      [6, 73, 45, 14, 74, 46],
+      [11, 54, 24, 16, 55, 25],
+      [30, 46, 16, 2, 47, 17],
+      // 25
+      [8, 132, 106, 4, 133, 107],
+      [8, 75, 47, 13, 76, 48],
+      [7, 54, 24, 22, 55, 25],
+      [22, 45, 15, 13, 46, 16],
+      // 26
+      [10, 142, 114, 2, 143, 115],
+      [19, 74, 46, 4, 75, 47],
+      [28, 50, 22, 6, 51, 23],
+      [33, 46, 16, 4, 47, 17],
+      // 27
+      [8, 152, 122, 4, 153, 123],
+      [22, 73, 45, 3, 74, 46],
+      [8, 53, 23, 26, 54, 24],
+      [12, 45, 15, 28, 46, 16],
+      // 28
+      [3, 147, 117, 10, 148, 118],
+      [3, 73, 45, 23, 74, 46],
+      [4, 54, 24, 31, 55, 25],
+      [11, 45, 15, 31, 46, 16],
+      // 29
+      [7, 146, 116, 7, 147, 117],
+      [21, 73, 45, 7, 74, 46],
+      [1, 53, 23, 37, 54, 24],
+      [19, 45, 15, 26, 46, 16],
+      // 30
+      [5, 145, 115, 10, 146, 116],
+      [19, 75, 47, 10, 76, 48],
+      [15, 54, 24, 25, 55, 25],
+      [23, 45, 15, 25, 46, 16],
+      // 31
+      [13, 145, 115, 3, 146, 116],
+      [2, 74, 46, 29, 75, 47],
+      [42, 54, 24, 1, 55, 25],
+      [23, 45, 15, 28, 46, 16],
+      // 32
+      [17, 145, 115],
+      [10, 74, 46, 23, 75, 47],
+      [10, 54, 24, 35, 55, 25],
+      [19, 45, 15, 35, 46, 16],
+      // 33
+      [17, 145, 115, 1, 146, 116],
+      [14, 74, 46, 21, 75, 47],
+      [29, 54, 24, 19, 55, 25],
+      [11, 45, 15, 46, 46, 16],
+      // 34
+      [13, 145, 115, 6, 146, 116],
+      [14, 74, 46, 23, 75, 47],
+      [44, 54, 24, 7, 55, 25],
+      [59, 46, 16, 1, 47, 17],
+      // 35
+      [12, 151, 121, 7, 152, 122],
+      [12, 75, 47, 26, 76, 48],
+      [39, 54, 24, 14, 55, 25],
+      [22, 45, 15, 41, 46, 16],
+      // 36
+      [6, 151, 121, 14, 152, 122],
+      [6, 75, 47, 34, 76, 48],
+      [46, 54, 24, 10, 55, 25],
+      [2, 45, 15, 64, 46, 16],
+      // 37
+      [17, 152, 122, 4, 153, 123],
+      [29, 74, 46, 14, 75, 47],
+      [49, 54, 24, 10, 55, 25],
+      [24, 45, 15, 46, 46, 16],
+      // 38
+      [4, 152, 122, 18, 153, 123],
+      [13, 74, 46, 32, 75, 47],
+      [48, 54, 24, 14, 55, 25],
+      [42, 45, 15, 32, 46, 16],
+      // 39
+      [20, 147, 117, 4, 148, 118],
+      [40, 75, 47, 7, 76, 48],
+      [43, 54, 24, 22, 55, 25],
+      [10, 45, 15, 67, 46, 16],
+      // 40
+      [19, 148, 118, 6, 149, 119],
+      [18, 75, 47, 31, 76, 48],
+      [34, 54, 24, 34, 55, 25],
+      [20, 45, 15, 61, 46, 16]
+    ];
+    QRRSBlock.getRSBlocks = function(typeNumber, errorCorrectLevel) {
+      var rsBlock = QRRSBlock.getRsBlockTable(typeNumber, errorCorrectLevel);
+      if (rsBlock === void 0) {
+        throw new Error("bad rs block @ typeNumber:" + typeNumber + "/errorCorrectLevel:" + errorCorrectLevel);
+      }
+      var length = rsBlock.length / 3;
+      var list = [];
+      for (var i = 0; i < length; i++) {
+        var count = rsBlock[i * 3 + 0];
+        var totalCount = rsBlock[i * 3 + 1];
+        var dataCount = rsBlock[i * 3 + 2];
+        for (var j = 0; j < count; j++) {
+          list.push(new QRRSBlock(totalCount, dataCount));
+        }
+      }
+      return list;
+    };
+    QRRSBlock.getRsBlockTable = function(typeNumber, errorCorrectLevel) {
+      switch (errorCorrectLevel) {
+        case QRErrorCorrectLevel.L:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 0];
+        case QRErrorCorrectLevel.M:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 1];
+        case QRErrorCorrectLevel.Q:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 2];
+        case QRErrorCorrectLevel.H:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 3];
+        default:
+          return void 0;
+      }
+    };
+    module.exports = QRRSBlock;
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRBitBuffer.js
+var require_QRBitBuffer = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRBitBuffer.js"(exports, module) {
+    function QRBitBuffer() {
+      this.buffer = [];
+      this.length = 0;
+    }
+    QRBitBuffer.prototype = {
+      get: function(index) {
+        var bufIndex = Math.floor(index / 8);
+        return (this.buffer[bufIndex] >>> 7 - index % 8 & 1) == 1;
+      },
+      put: function(num, length) {
+        for (var i = 0; i < length; i++) {
+          this.putBit((num >>> length - i - 1 & 1) == 1);
+        }
+      },
+      getLengthInBits: function() {
+        return this.length;
+      },
+      putBit: function(bit) {
+        var bufIndex = Math.floor(this.length / 8);
+        if (this.buffer.length <= bufIndex) {
+          this.buffer.push(0);
+        }
+        if (bit) {
+          this.buffer[bufIndex] |= 128 >>> this.length % 8;
+        }
+        this.length++;
+      }
+    };
+    module.exports = QRBitBuffer;
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/index.js
+var require_QRCode = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/index.js"(exports, module) {
+    var QR8bitByte = require_QR8bitByte();
+    var QRUtil = require_QRUtil();
+    var QRPolynomial = require_QRPolynomial();
+    var QRRSBlock = require_QRRSBlock();
+    var QRBitBuffer = require_QRBitBuffer();
+    function QRCode(typeNumber, errorCorrectLevel) {
+      this.typeNumber = typeNumber;
+      this.errorCorrectLevel = errorCorrectLevel;
+      this.modules = null;
+      this.moduleCount = 0;
+      this.dataCache = null;
+      this.dataList = [];
+    }
+    QRCode.prototype = {
+      addData: function(data) {
+        var newData = new QR8bitByte(data);
+        this.dataList.push(newData);
+        this.dataCache = null;
+      },
+      isDark: function(row, col) {
+        if (row < 0 || this.moduleCount <= row || col < 0 || this.moduleCount <= col) {
+          throw new Error(row + "," + col);
+        }
+        return this.modules[row][col];
+      },
+      getModuleCount: function() {
+        return this.moduleCount;
+      },
+      make: function() {
+        if (this.typeNumber < 1) {
+          var typeNumber = 1;
+          for (typeNumber = 1; typeNumber < 40; typeNumber++) {
+            var rsBlocks = QRRSBlock.getRSBlocks(typeNumber, this.errorCorrectLevel);
+            var buffer = new QRBitBuffer();
+            var totalDataCount = 0;
+            for (var i = 0; i < rsBlocks.length; i++) {
+              totalDataCount += rsBlocks[i].dataCount;
+            }
+            for (var x = 0; x < this.dataList.length; x++) {
+              var data = this.dataList[x];
+              buffer.put(data.mode, 4);
+              buffer.put(data.getLength(), QRUtil.getLengthInBits(data.mode, typeNumber));
+              data.write(buffer);
+            }
+            if (buffer.getLengthInBits() <= totalDataCount * 8)
+              break;
+          }
+          this.typeNumber = typeNumber;
+        }
+        this.makeImpl(false, this.getBestMaskPattern());
+      },
+      makeImpl: function(test, maskPattern) {
+        this.moduleCount = this.typeNumber * 4 + 17;
+        this.modules = new Array(this.moduleCount);
+        for (var row = 0; row < this.moduleCount; row++) {
+          this.modules[row] = new Array(this.moduleCount);
+          for (var col = 0; col < this.moduleCount; col++) {
+            this.modules[row][col] = null;
+          }
+        }
+        this.setupPositionProbePattern(0, 0);
+        this.setupPositionProbePattern(this.moduleCount - 7, 0);
+        this.setupPositionProbePattern(0, this.moduleCount - 7);
+        this.setupPositionAdjustPattern();
+        this.setupTimingPattern();
+        this.setupTypeInfo(test, maskPattern);
+        if (this.typeNumber >= 7) {
+          this.setupTypeNumber(test);
+        }
+        if (this.dataCache === null) {
+          this.dataCache = QRCode.createData(this.typeNumber, this.errorCorrectLevel, this.dataList);
+        }
+        this.mapData(this.dataCache, maskPattern);
+      },
+      setupPositionProbePattern: function(row, col) {
+        for (var r = -1; r <= 7; r++) {
+          if (row + r <= -1 || this.moduleCount <= row + r) continue;
+          for (var c = -1; c <= 7; c++) {
+            if (col + c <= -1 || this.moduleCount <= col + c) continue;
+            if (0 <= r && r <= 6 && (c === 0 || c === 6) || 0 <= c && c <= 6 && (r === 0 || r === 6) || 2 <= r && r <= 4 && 2 <= c && c <= 4) {
+              this.modules[row + r][col + c] = true;
+            } else {
+              this.modules[row + r][col + c] = false;
+            }
+          }
+        }
+      },
+      getBestMaskPattern: function() {
+        var minLostPoint = 0;
+        var pattern = 0;
+        for (var i = 0; i < 8; i++) {
+          this.makeImpl(true, i);
+          var lostPoint = QRUtil.getLostPoint(this);
+          if (i === 0 || minLostPoint > lostPoint) {
+            minLostPoint = lostPoint;
+            pattern = i;
+          }
+        }
+        return pattern;
+      },
+      createMovieClip: function(target_mc, instance_name, depth) {
+        var qr_mc = target_mc.createEmptyMovieClip(instance_name, depth);
+        var cs = 1;
+        this.make();
+        for (var row = 0; row < this.modules.length; row++) {
+          var y = row * cs;
+          for (var col = 0; col < this.modules[row].length; col++) {
+            var x = col * cs;
+            var dark = this.modules[row][col];
+            if (dark) {
+              qr_mc.beginFill(0, 100);
+              qr_mc.moveTo(x, y);
+              qr_mc.lineTo(x + cs, y);
+              qr_mc.lineTo(x + cs, y + cs);
+              qr_mc.lineTo(x, y + cs);
+              qr_mc.endFill();
+            }
+          }
+        }
+        return qr_mc;
+      },
+      setupTimingPattern: function() {
+        for (var r = 8; r < this.moduleCount - 8; r++) {
+          if (this.modules[r][6] !== null) {
+            continue;
+          }
+          this.modules[r][6] = r % 2 === 0;
+        }
+        for (var c = 8; c < this.moduleCount - 8; c++) {
+          if (this.modules[6][c] !== null) {
+            continue;
+          }
+          this.modules[6][c] = c % 2 === 0;
+        }
+      },
+      setupPositionAdjustPattern: function() {
+        var pos = QRUtil.getPatternPosition(this.typeNumber);
+        for (var i = 0; i < pos.length; i++) {
+          for (var j = 0; j < pos.length; j++) {
+            var row = pos[i];
+            var col = pos[j];
+            if (this.modules[row][col] !== null) {
+              continue;
+            }
+            for (var r = -2; r <= 2; r++) {
+              for (var c = -2; c <= 2; c++) {
+                if (Math.abs(r) === 2 || Math.abs(c) === 2 || r === 0 && c === 0) {
+                  this.modules[row + r][col + c] = true;
+                } else {
+                  this.modules[row + r][col + c] = false;
+                }
+              }
+            }
+          }
+        }
+      },
+      setupTypeNumber: function(test) {
+        var bits = QRUtil.getBCHTypeNumber(this.typeNumber);
+        var mod;
+        for (var i = 0; i < 18; i++) {
+          mod = !test && (bits >> i & 1) === 1;
+          this.modules[Math.floor(i / 3)][i % 3 + this.moduleCount - 8 - 3] = mod;
+        }
+        for (var x = 0; x < 18; x++) {
+          mod = !test && (bits >> x & 1) === 1;
+          this.modules[x % 3 + this.moduleCount - 8 - 3][Math.floor(x / 3)] = mod;
+        }
+      },
+      setupTypeInfo: function(test, maskPattern) {
+        var data = this.errorCorrectLevel << 3 | maskPattern;
+        var bits = QRUtil.getBCHTypeInfo(data);
+        var mod;
+        for (var v = 0; v < 15; v++) {
+          mod = !test && (bits >> v & 1) === 1;
+          if (v < 6) {
+            this.modules[v][8] = mod;
+          } else if (v < 8) {
+            this.modules[v + 1][8] = mod;
+          } else {
+            this.modules[this.moduleCount - 15 + v][8] = mod;
+          }
+        }
+        for (var h = 0; h < 15; h++) {
+          mod = !test && (bits >> h & 1) === 1;
+          if (h < 8) {
+            this.modules[8][this.moduleCount - h - 1] = mod;
+          } else if (h < 9) {
+            this.modules[8][15 - h - 1 + 1] = mod;
+          } else {
+            this.modules[8][15 - h - 1] = mod;
+          }
+        }
+        this.modules[this.moduleCount - 8][8] = !test;
+      },
+      mapData: function(data, maskPattern) {
+        var inc = -1;
+        var row = this.moduleCount - 1;
+        var bitIndex = 7;
+        var byteIndex = 0;
+        for (var col = this.moduleCount - 1; col > 0; col -= 2) {
+          if (col === 6) col--;
+          while (true) {
+            for (var c = 0; c < 2; c++) {
+              if (this.modules[row][col - c] === null) {
+                var dark = false;
+                if (byteIndex < data.length) {
+                  dark = (data[byteIndex] >>> bitIndex & 1) === 1;
+                }
+                var mask = QRUtil.getMask(maskPattern, row, col - c);
+                if (mask) {
+                  dark = !dark;
+                }
+                this.modules[row][col - c] = dark;
+                bitIndex--;
+                if (bitIndex === -1) {
+                  byteIndex++;
+                  bitIndex = 7;
+                }
+              }
+            }
+            row += inc;
+            if (row < 0 || this.moduleCount <= row) {
+              row -= inc;
+              inc = -inc;
+              break;
+            }
+          }
+        }
+      }
+    };
+    QRCode.PAD0 = 236;
+    QRCode.PAD1 = 17;
+    QRCode.createData = function(typeNumber, errorCorrectLevel, dataList) {
+      var rsBlocks = QRRSBlock.getRSBlocks(typeNumber, errorCorrectLevel);
+      var buffer = new QRBitBuffer();
+      for (var i = 0; i < dataList.length; i++) {
+        var data = dataList[i];
+        buffer.put(data.mode, 4);
+        buffer.put(data.getLength(), QRUtil.getLengthInBits(data.mode, typeNumber));
+        data.write(buffer);
+      }
+      var totalDataCount = 0;
+      for (var x = 0; x < rsBlocks.length; x++) {
+        totalDataCount += rsBlocks[x].dataCount;
+      }
+      if (buffer.getLengthInBits() > totalDataCount * 8) {
+        throw new Error("code length overflow. (" + buffer.getLengthInBits() + ">" + totalDataCount * 8 + ")");
+      }
+      if (buffer.getLengthInBits() + 4 <= totalDataCount * 8) {
+        buffer.put(0, 4);
+      }
+      while (buffer.getLengthInBits() % 8 !== 0) {
+        buffer.putBit(false);
+      }
+      while (true) {
+        if (buffer.getLengthInBits() >= totalDataCount * 8) {
+          break;
+        }
+        buffer.put(QRCode.PAD0, 8);
+        if (buffer.getLengthInBits() >= totalDataCount * 8) {
+          break;
+        }
+        buffer.put(QRCode.PAD1, 8);
+      }
+      return QRCode.createBytes(buffer, rsBlocks);
+    };
+    QRCode.createBytes = function(buffer, rsBlocks) {
+      var offset = 0;
+      var maxDcCount = 0;
+      var maxEcCount = 0;
+      var dcdata = new Array(rsBlocks.length);
+      var ecdata = new Array(rsBlocks.length);
+      for (var r = 0; r < rsBlocks.length; r++) {
+        var dcCount = rsBlocks[r].dataCount;
+        var ecCount = rsBlocks[r].totalCount - dcCount;
+        maxDcCount = Math.max(maxDcCount, dcCount);
+        maxEcCount = Math.max(maxEcCount, ecCount);
+        dcdata[r] = new Array(dcCount);
+        for (var i = 0; i < dcdata[r].length; i++) {
+          dcdata[r][i] = 255 & buffer.buffer[i + offset];
+        }
+        offset += dcCount;
+        var rsPoly = QRUtil.getErrorCorrectPolynomial(ecCount);
+        var rawPoly = new QRPolynomial(dcdata[r], rsPoly.getLength() - 1);
+        var modPoly = rawPoly.mod(rsPoly);
+        ecdata[r] = new Array(rsPoly.getLength() - 1);
+        for (var x = 0; x < ecdata[r].length; x++) {
+          var modIndex = x + modPoly.getLength() - ecdata[r].length;
+          ecdata[r][x] = modIndex >= 0 ? modPoly.get(modIndex) : 0;
+        }
+      }
+      var totalCodeCount = 0;
+      for (var y = 0; y < rsBlocks.length; y++) {
+        totalCodeCount += rsBlocks[y].totalCount;
+      }
+      var data = new Array(totalCodeCount);
+      var index = 0;
+      for (var z = 0; z < maxDcCount; z++) {
+        for (var s = 0; s < rsBlocks.length; s++) {
+          if (z < dcdata[s].length) {
+            data[index++] = dcdata[s][z];
+          }
+        }
+      }
+      for (var xx = 0; xx < maxEcCount; xx++) {
+        for (var t = 0; t < rsBlocks.length; t++) {
+          if (xx < ecdata[t].length) {
+            data[index++] = ecdata[t][xx];
+          }
+        }
+      }
+      return data;
+    };
+    module.exports = QRCode;
+  }
+});
+
+// ../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/lib/main.js
+var require_main = __commonJS({
+  "../../node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/lib/main.js"(exports, module) {
+    var QRCode = require_QRCode();
+    var QRErrorCorrectLevel = require_QRErrorCorrectLevel();
+    var black = "\x1B[40m  \x1B[0m";
+    var white = "\x1B[47m  \x1B[0m";
+    var toCell = function(isBlack) {
+      return isBlack ? black : white;
+    };
+    var repeat = function(color) {
+      return {
+        times: function(count) {
+          return new Array(count).join(color);
+        }
+      };
+    };
+    var fill = function(length, value) {
+      var arr = new Array(length);
+      for (var i = 0; i < length; i++) {
+        arr[i] = value;
+      }
+      return arr;
+    };
+    module.exports = {
+      error: QRErrorCorrectLevel.L,
+      generate: function(input2, opts, cb) {
+        if (typeof opts === "function") {
+          cb = opts;
+          opts = {};
+        }
+        var qrcode2 = new QRCode(-1, this.error);
+        qrcode2.addData(input2);
+        qrcode2.make();
+        var output2 = "";
+        if (opts && opts.small) {
+          var BLACK = true, WHITE = false;
+          var moduleCount = qrcode2.getModuleCount();
+          var moduleData = qrcode2.modules.slice();
+          var oddRow = moduleCount % 2 === 1;
+          if (oddRow) {
+            moduleData.push(fill(moduleCount, WHITE));
+          }
+          var platte = {
+            WHITE_ALL: "\u2588",
+            WHITE_BLACK: "\u2580",
+            BLACK_WHITE: "\u2584",
+            BLACK_ALL: " "
+          };
+          var borderTop = repeat(platte.BLACK_WHITE).times(moduleCount + 3);
+          var borderBottom = repeat(platte.WHITE_BLACK).times(moduleCount + 3);
+          output2 += borderTop + "\n";
+          for (var row = 0; row < moduleCount; row += 2) {
+            output2 += platte.WHITE_ALL;
+            for (var col = 0; col < moduleCount; col++) {
+              if (moduleData[row][col] === WHITE && moduleData[row + 1][col] === WHITE) {
+                output2 += platte.WHITE_ALL;
+              } else if (moduleData[row][col] === WHITE && moduleData[row + 1][col] === BLACK) {
+                output2 += platte.WHITE_BLACK;
+              } else if (moduleData[row][col] === BLACK && moduleData[row + 1][col] === WHITE) {
+                output2 += platte.BLACK_WHITE;
+              } else {
+                output2 += platte.BLACK_ALL;
+              }
+            }
+            output2 += platte.WHITE_ALL + "\n";
+          }
+          if (!oddRow) {
+            output2 += borderBottom;
+          }
+        } else {
+          var border = repeat(white).times(qrcode2.getModuleCount() + 3);
+          output2 += border + "\n";
+          qrcode2.modules.forEach(function(row2) {
+            output2 += white;
+            output2 += row2.map(toCell).join("");
+            output2 += white + "\n";
+          });
+          output2 += border;
+        }
+        if (cb) cb(output2);
+        else console.log(output2);
+      },
+      setErrorLevel: function(error) {
+        this.error = QRErrorCorrectLevel[error] || this.error;
+      }
+    };
+  }
+});
 
 // src/cli.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { delimiter, dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { delimiter, dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { spawn, spawnSync as spawnSync3 } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 
@@ -100,12 +1195,12 @@ function captureConfigSnapshot(path = configPath()) {
     previous: captureFile(`${path}.previous`)
   };
 }
-function restoreConfigSnapshot(snapshot) {
-  const previous = `${snapshot.path}.previous`;
-  assertNotSymlink(snapshot.path);
+function restoreConfigSnapshot(snapshot2) {
+  const previous = `${snapshot2.path}.previous`;
+  assertNotSymlink(snapshot2.path);
   assertNotSymlink(previous);
-  restoreFile(previous, snapshot.previous);
-  restoreFile(snapshot.path, snapshot.config);
+  restoreFile(previous, snapshot2.previous);
+  restoreFile(snapshot2.path, snapshot2.config);
 }
 function configuredRoots(config) {
   return Array.isArray(config.allowedRoots) ? config.allowedRoots.filter((root) => typeof root === "string" && root !== "") : [];
@@ -129,13 +1224,13 @@ function pathExists(path) {
     throw error;
   }
 }
-function restoreFile(path, snapshot) {
-  if (snapshot.content === null) {
+function restoreFile(path, snapshot2) {
+  if (snapshot2.content === null) {
     rmSync(path, { force: true });
     return;
   }
   mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeBytesAtomically(path, snapshot.content, snapshot.mode);
+  writeBytesAtomically(path, snapshot2.content, snapshot2.mode);
 }
 function writeBytesAtomically(path, content, mode) {
   const temp = createTemporaryFile(path, content, mode, "atomic");
@@ -205,6 +1300,11 @@ function assertVersion(value) {
   }
   return value;
 }
+function updatePackageSpec(target, currentVersion) {
+  const selected = target ?? (currentVersion.includes("-") ? "rc" : "latest");
+  if (selected === "latest" || selected === "rc") return `@longleash/cli@${selected}`;
+  return `@longleash/cli@${assertVersion(selected)}`;
+}
 function packageLocation(prefix) {
   return join2(prefix, "node_modules", "@longleash", "cli");
 }
@@ -301,27 +1401,42 @@ function prepareManagedInstall(version, env = process.env) {
         const hadWrapper = pathExists2(paths.wrapper);
         const hadMarker = pathExists2(marker);
         let previousWrapper;
+        let previousWrapperMode = 448;
         let previousMarker;
         let wrapperWritten = false;
         let markerWritten = false;
+        let migratedLegacyWrapper = false;
+        let legacyWrapper;
         const tempLink = join2(paths.home, `.current-${process.pid}-${randomUUID2()}`);
         try {
           mkdirSync2(paths.bin, { recursive: true, mode: 448 });
           if (hadWrapper) {
-            if (lstatSync2(paths.wrapper).isSymbolicLink()) throw new Error(`Refusing symlinked executable: ${paths.wrapper}`);
+            const wrapperStat = lstatSync2(paths.wrapper);
+            if (wrapperStat.isSymbolicLink()) throw new Error(`Refusing symlinked executable: ${paths.wrapper}`);
+            if (!wrapperStat.isFile()) throw new Error(`Refusing non-file executable: ${paths.wrapper}`);
+            if (process.getuid !== void 0 && wrapperStat.uid !== process.getuid()) {
+              throw new Error(`Refusing executable owned by another user: ${paths.wrapper}`);
+            }
             previousWrapper = readFileSync2(paths.wrapper, "utf8");
+            previousWrapperMode = wrapperStat.mode & 511;
             if (!previousWrapper.includes(WRAPPER_MARKER)) {
-              throw new Error(`Refusing to replace an unmanaged executable: ${paths.wrapper}`);
+              legacyWrapper = recognizeLegacyWrapper(previousWrapper, wrapperStat.mode & 511, paths.wrapper);
+              migratedLegacyWrapper = true;
             }
           }
           if (hadMarker) {
             if (lstatSync2(marker).isSymbolicLink()) throw new Error(`Refusing symlinked install marker: ${marker}`);
             previousMarker = readFileSync2(marker, "utf8");
+            const parsed = parseInstallMarker(previousMarker, marker);
+            if (parsed.package !== PACKAGE_NAME) throw new Error(`Refusing unrecognized install marker: ${marker}`);
+            legacyWrapper = parsed.legacyWrapper ?? legacyWrapper;
           }
           const activeCli = join2(paths.current, "node_modules", "@longleash", "cli", "bin", "longleash.mjs");
-          writeExecutableAtomically(paths.wrapper, wrapper(activeCli));
+          writeExecutableAtomically(paths.wrapper, wrapper(activeCli, process.execPath));
           wrapperWritten = true;
-          writeFileAtomically(marker, `${JSON.stringify({ schema: 1, package: PACKAGE_NAME }, null, 2)}
+          const nextMarker = { schema: 1, package: PACKAGE_NAME };
+          if (legacyWrapper) nextMarker.legacyWrapper = legacyWrapper;
+          writeFileAtomically(marker, `${JSON.stringify(nextMarker, null, 2)}
 `, 384);
           markerWritten = true;
           symlinkSync(release, tempLink, "dir");
@@ -330,6 +1445,7 @@ function prepareManagedInstall(version, env = process.env) {
           }
           renameSync2(tempLink, paths.current);
           activated = true;
+          return { migratedLegacyWrapper };
         } catch (error) {
           try {
             rmSync2(tempLink, { force: true });
@@ -338,7 +1454,7 @@ function prepareManagedInstall(version, env = process.env) {
           const restorationFailures = [];
           if (wrapperWritten) {
             try {
-              restoreManagedFile(paths.wrapper, hadWrapper ? previousWrapper : void 0, 448);
+              restoreManagedFile(paths.wrapper, hadWrapper ? previousWrapper : void 0, previousWrapperMode);
             } catch (restoreError) {
               restorationFailures.push(`executable: ${String(restoreError)}`);
             }
@@ -378,23 +1494,83 @@ function prepareManagedInstall(version, env = process.env) {
 function uninstallManagedRuntime(env = process.env) {
   const paths = installPaths(env);
   const marker = join2(paths.home, MARKER);
-  if (!pathExists2(marker)) return { removed: false, configPreserved: resolve2(env.LONGLEASH_DATA ?? join2(homedir2(), ".longleash")) };
+  if (!pathExists2(marker)) {
+    return {
+      removed: false,
+      configPreserved: resolve2(env.LONGLEASH_DATA ?? join2(homedir2(), ".longleash")),
+      legacyWrapperRestored: false
+    };
+  }
   if (lstatSync2(marker).isSymbolicLink()) throw new Error(`Refusing symlinked install marker: ${marker}`);
-  const parsed = JSON.parse(readFileSync2(marker, "utf8"));
+  const parsed = parseInstallMarker(readFileSync2(marker, "utf8"), marker);
   if (parsed.package !== PACKAGE_NAME) throw new Error(`Refusing to remove unrecognized install directory: ${paths.home}`);
+  let legacyWrapperRestored = false;
   if (pathExists2(paths.wrapper)) {
     if (lstatSync2(paths.wrapper).isSymbolicLink()) throw new Error(`Refusing symlinked executable: ${paths.wrapper}`);
     const wrapperText = readFileSync2(paths.wrapper, "utf8");
     if (!wrapperText.includes(WRAPPER_MARKER)) throw new Error(`Refusing to remove an unmanaged executable: ${paths.wrapper}`);
-    rmSync2(paths.wrapper);
+    if (parsed.legacyWrapper) {
+      const backup = validateLegacyBackup(parsed.legacyWrapper, paths.wrapper);
+      writeFileAtomically(paths.wrapper, backup.content, backup.mode);
+      legacyWrapperRestored = true;
+    } else {
+      rmSync2(paths.wrapper);
+    }
   }
   rmSync2(paths.home, { recursive: true });
-  return { removed: true, configPreserved: resolve2(env.LONGLEASH_DATA ?? join2(homedir2(), ".longleash")) };
+  return {
+    removed: true,
+    configPreserved: resolve2(env.LONGLEASH_DATA ?? join2(homedir2(), ".longleash")),
+    legacyWrapperRestored
+  };
+}
+function recognizeLegacyWrapper(content, mode, wrapperPath) {
+  if (Buffer.byteLength(content, "utf8") > 16 * 1024) {
+    throw new Error(`Refusing to replace an unmanaged executable: ${wrapperPath}`);
+  }
+  const match = content.match(
+    /^#!\/usr\/bin\/env bash\n# Created by the LongLeash installer\. The three values below are the settings; the behaviour\n# lives in \$LONGLEASH_DIR\/scripts\/longleash\.sh and updates with the code\.\nset -euo pipefail\nexport LONGLEASH_DIR="([^"\n]+)"\nexport LONGLEASH_DEFAULT_ROOTS="([^"\n]*)"\nexport LONGLEASH_DEFAULT_RELAY="([^"\n]*)"\nexec bash "\$LONGLEASH_DIR\/scripts\/longleash\.sh" "\$@"\n?$/
+  );
+  if (!match) throw new Error(`Refusing to replace an unmanaged executable: ${wrapperPath}`);
+  const legacyRoot = match[1];
+  if (!legacyRoot || resolve2(legacyRoot) !== legacyRoot) {
+    throw new Error(`Refusing legacy executable with an unsafe checkout path: ${wrapperPath}`);
+  }
+  const legacyEntrypoint = join2(legacyRoot, "scripts", "longleash.sh");
+  if (!pathExists2(legacyEntrypoint) || lstatSync2(legacyEntrypoint).isSymbolicLink() || !lstatSync2(legacyEntrypoint).isFile()) {
+    throw new Error(`The verified legacy executable points to a missing checkout: ${legacyRoot}`);
+  }
+  return { content, mode: normalizeExecutableMode(mode) };
+}
+function validateLegacyBackup(value, wrapperPath) {
+  if (!value || typeof value.content !== "string" || !Number.isSafeInteger(value.mode)) {
+    throw new Error(`Refusing invalid legacy executable backup in the install marker: ${wrapperPath}`);
+  }
+  return recognizeLegacyWrapper(value.content, value.mode, wrapperPath);
+}
+function parseInstallMarker(content, markerPath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    throw new Error(`Refusing invalid install marker: ${markerPath}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Refusing invalid install marker: ${markerPath}`);
+  }
+  const marker = parsed;
+  if (marker.legacyWrapper !== void 0) validateLegacyBackup(marker.legacyWrapper, markerPath);
+  return marker;
+}
+function normalizeExecutableMode(mode) {
+  const normalized = mode & 511;
+  if ((normalized & 64) === 0) throw new Error("The legacy LongLeash executable is not owner-executable.");
+  return normalized;
 }
-function wrapper(cli) {
+function wrapper(cli, node) {
   return `#!/bin/sh
 ${WRAPPER_MARKER}
-exec node ${shellQuote(cli)} "$@"
+exec ${shellQuote(node)} ${shellQuote(cli)} "$@"
 `;
 }
 function shellQuote(value) {
@@ -516,15 +1692,544 @@ function processAlive(pid) {
   }
 }
 
+// src/setup-input.ts
+function resolveAllowedRootAnswer(answer, defaultRoot) {
+  const trimmed = answer.trim();
+  if (/^(?:y|yes|n|no)$/i.test(trimmed)) {
+    return {
+      ok: false,
+      message: `This question needs a folder path. Press Enter to use ${defaultRoot}, or type another existing folder.`
+    };
+  }
+  try {
+    const [root] = normalizeRoots([trimmed || defaultRoot]);
+    if (!root) throw new Error("At least one allowed project directory is required.");
+    return { ok: true, root };
+  } catch (error) {
+    return {
+      ok: false,
+      message: `That folder cannot be used: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+
+// src/service.ts
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync2,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { spawnSync as spawnSync2 } from "node:child_process";
+var SERVICE_LABEL = "dev.longleash.daemon";
+var SYSTEMD_UNIT = "longleash.service";
+var MANAGED_MARKER = "Managed by @longleash/cli";
+function servicePaths(context = {}) {
+  const env = context.env ?? process.env;
+  const platform = supportedPlatform(context.platform ?? process.platform);
+  const home = resolve3(context.home ?? homedir3());
+  const data = dataDir(env);
+  const logs = join3(data, "logs");
+  const wrapper2 = installPaths(env).wrapper;
+  if (platform === "darwin") {
+    return {
+      data,
+      logs,
+      stdout: join3(logs, "daemon.stdout.log"),
+      stderr: join3(logs, "daemon.stderr.log"),
+      definition: join3(home, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`),
+      wrapper: wrapper2
+    };
+  }
+  return {
+    data,
+    logs,
+    stdout: "journal",
+    stderr: "journal",
+    definition: join3(home, ".config", "systemd", "user", SYSTEMD_UNIT),
+    environment: join3(home, ".config", "longleash", "service.env"),
+    wrapper: wrapper2
+  };
+}
+function renderLaunchAgent(paths, env = process.env) {
+  const path = requiredEnvironment(env, "PATH", "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin");
+  const home = resolve3(env.HOME ?? homedir3());
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- ${MANAGED_MARKER} -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xml(SERVICE_LABEL)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xml(paths.wrapper)}</string>
+    <string>run</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>${xml(home)}</string>
+    <key>PATH</key>
+    <string>${xml(path)}</string>
+    <key>LONGLEASH_DATA</key>
+    <string>${xml(paths.data)}</string>
+    <key>LONGLEASH_SERVICE</key>
+    <string>1</string>
+  </dict>
+  <key>WorkingDirectory</key>
+  <string>${xml(home)}</string>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>15</integer>
+  <key>ProcessType</key>
+  <string>Background</string>
+  <key>Umask</key>
+  <integer>63</integer>
+  <key>StandardOutPath</key>
+  <string>${xml(paths.stdout)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xml(paths.stderr)}</string>
+</dict>
+</plist>
+`;
+}
+function renderSystemdUnit(paths, home) {
+  if (!paths.environment) throw new Error("The Linux service environment path is missing.");
+  return `# ${MANAGED_MARKER}
+[Unit]
+Description=LongLeash phone control plane
+Documentation=https://longleash.dev/docs/background-service
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+ExecStart=${systemdQuote(paths.wrapper)} run
+EnvironmentFile=${systemdPath(paths.environment)}
+WorkingDirectory=${systemdPath(home)}
+UMask=0077
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=30s
+KillMode=mixed
+
+[Install]
+WantedBy=default.target
+`;
+}
+function renderSystemdEnvironment(paths, env = process.env) {
+  const home = resolve3(env.HOME ?? homedir3());
+  const path = requiredEnvironment(env, "PATH", "/usr/local/bin:/usr/bin:/bin");
+  return `# ${MANAGED_MARKER}
+HOME=${environmentQuote(home)}
+PATH=${environmentQuote(path)}
+LONGLEASH_DATA=${environmentQuote(paths.data)}
+LONGLEASH_SERVICE=1
+`;
+}
+function serviceState(context = {}) {
+  const resolved = resolveContext(context);
+  const installed = managedDefinitionExists(resolved.paths.definition);
+  if (installed && resolved.paths.environment) assertManagedDefinition(resolved.paths.environment);
+  if (resolved.platform === "darwin") {
+    const loaded2 = launchdLoaded(resolved);
+    return {
+      platform: "darwin",
+      installed,
+      loaded: loaded2,
+      active: loaded2,
+      definition: resolved.paths.definition,
+      logs: resolved.paths.logs,
+      loginOnly: false
+    };
+  }
+  const loaded = run(resolved, "systemctl", ["--user", "is-enabled", "--quiet", SYSTEMD_UNIT]).status === 0;
+  const active = run(resolved, "systemctl", ["--user", "is-active", "--quiet", SYSTEMD_UNIT]).status === 0;
+  return {
+    platform: "linux",
+    installed,
+    loaded,
+    active,
+    definition: resolved.paths.definition,
+    logs: "journalctl --user-unit longleash.service",
+    loginOnly: !lingerEnabled(resolved)
+  };
+}
+function installService(context = {}) {
+  const resolved = resolveContext(context);
+  assertManagedWrapper(resolved.paths.wrapper);
+  mkdirSync3(resolved.paths.logs, { recursive: true, mode: 448 });
+  if (resolved.platform === "darwin") installLaunchAgent(resolved);
+  else installSystemdService(resolved);
+  return serviceState(context);
+}
+function startService(context = {}) {
+  const resolved = resolveContext(context);
+  assertServiceInstallation(resolved);
+  if (resolved.platform === "darwin") {
+    if (launchdLoaded(resolved)) requireSuccess(resolved, "/bin/launchctl", ["kickstart", "-k", serviceTarget(resolved)]);
+    else bootstrapLaunchAgent(resolved);
+  } else {
+    requireSuccess(resolved, "systemctl", ["--user", "start", SYSTEMD_UNIT]);
+  }
+  return serviceState(context);
+}
+function stopService(context = {}) {
+  const resolved = resolveContext(context);
+  if (resolved.platform === "darwin") {
+    const loaded = launchdLoaded(resolved);
+    if (loaded) {
+      assertManagedDefinition(resolved.paths.definition);
+      requireSuccess(resolved, "/bin/launchctl", ["bootout", serviceTarget(resolved)]);
+    }
+  } else if (run(resolved, "systemctl", ["--user", "is-active", "--quiet", SYSTEMD_UNIT]).status === 0) {
+    assertManagedDefinition(resolved.paths.definition);
+    requireSuccess(resolved, "systemctl", ["--user", "stop", SYSTEMD_UNIT]);
+  }
+  return serviceState(context);
+}
+function restartService(context = {}) {
+  const resolved = resolveContext(context);
+  assertServiceInstallation(resolved);
+  if (resolved.platform === "darwin") {
+    if (launchdLoaded(resolved)) requireSuccess(resolved, "/bin/launchctl", ["kickstart", "-k", serviceTarget(resolved)]);
+    else bootstrapLaunchAgent(resolved);
+  } else {
+    requireSuccess(resolved, "systemctl", ["--user", "restart", SYSTEMD_UNIT]);
+  }
+  return serviceState(context);
+}
+function uninstallService(context = {}) {
+  const resolved = resolveContext(context);
+  const installed = managedDefinitionExists(resolved.paths.definition);
+  if (resolved.platform === "darwin") {
+    const loaded = launchdLoaded(resolved);
+    if (loaded && !installed) {
+      throw new Error(`Refusing to stop an unowned launchd job without a managed definition: ${resolved.paths.definition}`);
+    }
+    if (loaded) requireSuccess(resolved, "/bin/launchctl", ["bootout", serviceTarget(resolved)]);
+    if (installed) rmSync3(resolved.paths.definition);
+  } else {
+    if (installed) {
+      const disabled = run(resolved, "systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT]);
+      if (disabled.status !== 0 && run(resolved, "systemctl", ["--user", "is-enabled", "--quiet", SYSTEMD_UNIT]).status === 0) {
+        throw commandError("systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT], disabled);
+      }
+      rmSync3(resolved.paths.definition);
+    }
+    if (resolved.paths.environment && managedFileExists(resolved.paths.environment)) {
+      assertManagedDefinition(resolved.paths.environment);
+      rmSync3(resolved.paths.environment);
+    }
+    requireSuccess(resolved, "systemctl", ["--user", "daemon-reload"]);
+    run(resolved, "systemctl", ["--user", "reset-failed", SYSTEMD_UNIT]);
+  }
+  return serviceState(context);
+}
+function showServiceLogs(follow, context = {}) {
+  const resolved = resolveContext(context);
+  if (resolved.platform === "darwin") {
+    mkdirSync3(resolved.paths.logs, { recursive: true, mode: 448 });
+    for (const path of [resolved.paths.stdout, resolved.paths.stderr]) {
+      if (!existsSync2(path)) writeFileSync3(path, "", { mode: 384 });
+    }
+    return passthrough(resolved, "/usr/bin/tail", [...follow ? ["-f"] : [], "-n", "200", resolved.paths.stdout, resolved.paths.stderr]);
+  }
+  return passthrough(resolved, "journalctl", ["--user-unit", SYSTEMD_UNIT, "-n", "200", "--no-pager", ...follow ? ["--follow"] : []]);
+}
+function installLaunchAgent(context) {
+  const content = renderLaunchAgent(context.paths, context.env);
+  const previous = snapshot(context.paths.definition);
+  const wasLoaded = launchdLoaded(context);
+  if (wasLoaded && previous === null) {
+    throw new Error(`Refusing to replace an unowned launchd job without a managed definition: ${context.paths.definition}`);
+  }
+  if (wasLoaded) requireSuccess(context, "/bin/launchctl", ["bootout", serviceTarget(context)]);
+  try {
+    writeManagedAtomically(context.paths.definition, content, 384, (temporary) => {
+      requireSuccess(context, "/usr/bin/plutil", ["-lint", temporary]);
+    });
+    bootstrapLaunchAgent(context);
+  } catch (error) {
+    restore(context.paths.definition, previous);
+    if (previous !== null && wasLoaded) run(context, "/bin/launchctl", ["bootstrap", launchDomain(context), context.paths.definition]);
+    throw error;
+  }
+}
+function bootstrapLaunchAgent(context) {
+  const args = ["bootstrap", launchDomain(context), context.paths.definition];
+  const first = run(context, "/bin/launchctl", args);
+  if (first.status === 0 || launchdLoaded(context)) return;
+  run(context, "/bin/launchctl", ["bootout", serviceTarget(context)]);
+  const retry = run(context, "/bin/launchctl", args);
+  if (retry.status === 0 || launchdLoaded(context)) return;
+  const failure = commandError("/bin/launchctl", args, retry);
+  const firstDetail = (first.stderr || first.stdout).trim().replace(/\s+/g, " ").slice(0, 240);
+  throw new Error(
+    `${failure.message} launchd still rejected the managed job after one stale-state recovery attempt${firstDetail ? ` (first response: ${firstDetail})` : ""}. Run \`longleash service logs\` for daemon output.`
+  );
+}
+function installSystemdService(context) {
+  if (!context.paths.environment) throw new Error("The Linux service environment path is missing.");
+  const previousUnit = snapshot(context.paths.definition);
+  const previousEnvironment = snapshot(context.paths.environment);
+  const wasEnabled = run(context, "systemctl", ["--user", "is-enabled", "--quiet", SYSTEMD_UNIT]).status === 0;
+  const wasActive = run(context, "systemctl", ["--user", "is-active", "--quiet", SYSTEMD_UNIT]).status === 0;
+  try {
+    writeManagedAtomically(context.paths.environment, renderSystemdEnvironment(context.paths, context.env), 384);
+    writeManagedAtomically(context.paths.definition, renderSystemdUnit(context.paths, context.home), 384);
+    requireSuccess(context, "systemctl", ["--user", "daemon-reload"]);
+    if (wasActive) {
+      if (!wasEnabled) requireSuccess(context, "systemctl", ["--user", "enable", SYSTEMD_UNIT]);
+      requireSuccess(context, "systemctl", ["--user", "restart", SYSTEMD_UNIT]);
+    } else {
+      requireSuccess(context, "systemctl", ["--user", "enable", "--now", SYSTEMD_UNIT]);
+    }
+  } catch (error) {
+    restore(context.paths.environment, previousEnvironment);
+    restore(context.paths.definition, previousUnit);
+    run(context, "systemctl", ["--user", "daemon-reload"]);
+    if (previousUnit !== null) {
+      if (wasEnabled) run(context, "systemctl", ["--user", "enable", SYSTEMD_UNIT]);
+      else run(context, "systemctl", ["--user", "disable", SYSTEMD_UNIT]);
+      if (wasActive) run(context, "systemctl", ["--user", "restart", SYSTEMD_UNIT]);
+      else run(context, "systemctl", ["--user", "stop", SYSTEMD_UNIT]);
+    }
+    throw error;
+  }
+}
+function resolveContext(context) {
+  const env = context.env ?? process.env;
+  const platform = supportedPlatform(context.platform ?? process.platform);
+  const home = resolve3(context.home ?? homedir3());
+  const uid = context.uid ?? process.getuid?.();
+  if (!Number.isSafeInteger(uid) || uid < 0) throw new Error("Could not determine the current user id for the service manager.");
+  return {
+    env,
+    platform,
+    home,
+    uid,
+    runner: context.runner ?? defaultRunner,
+    paths: servicePaths({ env, platform, home })
+  };
+}
+function supportedPlatform(platform) {
+  if (platform !== "darwin" && platform !== "linux") {
+    throw new Error(`Background services are supported on macOS and systemd Linux, not ${platform}. Use \`longleash run\` instead.`);
+  }
+  return platform;
+}
+function defaultRunner(file, args, options = { encoding: "utf8" }) {
+  const result = spawnSync2(file, args, { ...options, encoding: "utf8" });
+  return {
+    status: result.status ?? (result.error ? 1 : 0),
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? (result.error?.message ?? "")
+  };
+}
+function run(context, file, args) {
+  return context.runner(file, args, { encoding: "utf8", env: context.env });
+}
+function requireSuccess(context, file, args) {
+  const result = run(context, file, args);
+  if (result.status !== 0) throw commandError(file, args, result);
+  return result;
+}
+function commandError(file, args, result) {
+  const detail = (result.stderr || result.stdout).trim().replace(/\s+/g, " ").slice(0, 400);
+  return new Error(`${file} ${args.join(" ")} failed${detail ? `: ${detail}` : "."}`);
+}
+function passthrough(context, file, args) {
+  const result = spawnSync2(file, args, { stdio: "inherit", env: context.env });
+  return result.status ?? 1;
+}
+function launchDomain(context) {
+  return `gui/${context.uid}`;
+}
+function serviceTarget(context) {
+  return `${launchDomain(context)}/${SERVICE_LABEL}`;
+}
+function launchdLoaded(context) {
+  return run(context, "/bin/launchctl", ["print", serviceTarget(context)]).status === 0;
+}
+function lingerEnabled(context) {
+  const result = run(context, "loginctl", ["show-user", String(context.uid), "--property=Linger", "--value"]);
+  return result.status === 0 && result.stdout.trim().toLowerCase() === "yes";
+}
+function assertManagedWrapper(path) {
+  if (!existsSync2(path)) throw new Error(`Managed LongLeash executable is missing: ${path}. Run \`longleash setup\` first.`);
+  if (lstatSync3(path).isSymbolicLink()) throw new Error(`Refusing symlinked LongLeash executable: ${path}`);
+  if (!readFileSync3(path, "utf8").includes(MANAGED_MARKER)) throw new Error(`Refusing unmanaged LongLeash executable: ${path}`);
+}
+function assertManagedDefinition(path) {
+  if (!managedFileExists(path)) throw new Error(`LongLeash background service is not installed: ${path}`);
+  if (!readFileSync3(path, "utf8").includes(MANAGED_MARKER)) throw new Error(`Refusing unmanaged service definition: ${path}`);
+}
+function assertServiceInstallation(context) {
+  assertManagedDefinition(context.paths.definition);
+  if (context.paths.environment) assertManagedDefinition(context.paths.environment);
+  assertManagedWrapper(context.paths.wrapper);
+}
+function managedDefinitionExists(path) {
+  if (!managedFileExists(path)) return false;
+  assertManagedDefinition(path);
+  return true;
+}
+function managedFileExists(path) {
+  if (!existsSync2(path)) return false;
+  if (lstatSync3(path).isSymbolicLink()) throw new Error(`Refusing symlinked service path: ${path}`);
+  return true;
+}
+function snapshot(path) {
+  if (!managedFileExists(path)) return null;
+  assertManagedDefinition(path);
+  return { content: readFileSync3(path, "utf8"), mode: lstatSync3(path).mode & 511 };
+}
+function restore(path, previous) {
+  if (previous === null) rmSync3(path, { force: true });
+  else writeManagedAtomically(path, previous.content, previous.mode);
+}
+function writeManagedAtomically(path, content, mode, validate) {
+  if (!content.includes(MANAGED_MARKER)) throw new Error("Refusing to write an unmarked service definition.");
+  if (managedFileExists(path)) assertManagedDefinition(path);
+  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.${randomUUID3()}.tmp`;
+  try {
+    writeFileSync3(temporary, content, { encoding: "utf8", mode, flag: "wx" });
+    chmodSync2(temporary, mode);
+    validate?.(temporary);
+    renameSync3(temporary, path);
+  } catch (error) {
+    rmSync3(temporary, { force: true });
+    throw error;
+  }
+}
+function requiredEnvironment(env, name, fallback) {
+  const value = env[name] || fallback;
+  if (/[\0\r\n]/.test(value)) throw new Error(`Unsafe ${name} value for background service.`);
+  return value;
+}
+function xml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function systemdQuote(value) {
+  if (/[\0\r\n]/.test(value)) throw new Error("Service paths may not contain control characters.");
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%")}"`;
+}
+function systemdPath(value) {
+  if (/[\u0000-\u0008\u000a-\u001f\u007f-\u009f]/.test(value)) {
+    throw new Error("Service paths may not contain control characters.");
+  }
+  return value.replace(/%/g, "%%").replace(/\\/g, "\\x5c").replace(/ /g, "\\x20").replace(/\t/g, "\\x09").replace(/"/g, "\\x22").replace(/'/g, "\\x27");
+}
+function environmentQuote(value) {
+  if (/[\0\r\n]/.test(value)) throw new Error("Service environment values may not contain control characters.");
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
+// src/terminal-qr.ts
+var import_qrcode_terminal = __toESM(require_main(), 1);
+function terminalQr(input2) {
+  const source = qrModules(input2);
+  const quiet = 4;
+  const whiteRow = Array(source.length + quiet * 2).fill(false);
+  const padded = [
+    ...Array.from({ length: quiet }, () => [...whiteRow]),
+    ...source.map((row) => [
+      ...Array(quiet).fill(false),
+      ...row,
+      ...Array(quiet).fill(false)
+    ]),
+    ...Array.from({ length: quiet }, () => [...whiteRow])
+  ];
+  if (padded.length % 2 !== 0) padded.push([...whiteRow]);
+  const output2 = [];
+  for (let row = 0; row < padded.length; row += 2) {
+    const top = padded[row];
+    const bottom = padded[row + 1];
+    if (!top || !bottom) throw new Error("QR row pairing failed");
+    let line = "";
+    let lastStyle = "";
+    for (let col = 0; col < top.length; col += 1) {
+      const rendered = cell(top[col] ?? false, bottom[col] ?? false);
+      if (rendered.style !== lastStyle) {
+        line += rendered.style;
+        lastStyle = rendered.style;
+      }
+      line += rendered.glyph;
+    }
+    output2.push(`${line}\x1B[0m`);
+  }
+  return output2.join("\n");
+}
+function qrModules(input2) {
+  let compact = "";
+  import_qrcode_terminal.default.generate(input2, { small: true }, (value) => {
+    compact = value;
+  });
+  const lines = compact.replace(/\n$/, "").split("\n");
+  if (lines.length < 2) throw new Error("QR renderer returned no module rows");
+  const moduleCount = [...lines[1] ?? ""].length - 2;
+  if (moduleCount < 21) throw new Error("QR renderer returned an invalid module grid");
+  const modules = [];
+  for (const line of lines.slice(1)) {
+    const cells = [...line].slice(1, moduleCount + 1);
+    if (cells.length !== moduleCount) throw new Error("QR renderer returned a ragged module grid");
+    const top = [];
+    const bottom = [];
+    for (const value of cells) {
+      if (value === "\u2588") {
+        top.push(false);
+        bottom.push(false);
+      } else if (value === "\u2580") {
+        top.push(false);
+        bottom.push(true);
+      } else if (value === "\u2584") {
+        top.push(true);
+        bottom.push(false);
+      } else if (value === " ") {
+        top.push(true);
+        bottom.push(true);
+      } else throw new Error(`QR renderer returned an unknown cell ${JSON.stringify(value)}`);
+    }
+    modules.push(top, bottom);
+  }
+  return modules.slice(0, moduleCount);
+}
+function cell(top, bottom) {
+  const black = "0;0;0";
+  const white = "255;255;255";
+  if (top === bottom) {
+    const colour = top ? black : white;
+    return { style: `\x1B[38;2;${colour};48;2;${colour}m`, glyph: "\u2588" };
+  }
+  return {
+    // Black remains the continuous cell background, avoiding font seams through finder patterns.
+    style: `\x1B[38;2;${white};48;2;${black}m`,
+    glyph: top ? "\u2584" : "\u2580"
+  };
+}
+
 // src/cli.ts
-var here = dirname3(fileURLToPath(import.meta.url));
-var packageRoot = resolve3(here, "..");
-var manifest = JSON.parse(readFileSync3(join3(packageRoot, "package.json"), "utf8"));
+var here = dirname4(fileURLToPath(import.meta.url));
+var packageRoot = resolve4(here, "..");
+var manifest = JSON.parse(readFileSync4(join4(packageRoot, "package.json"), "utf8"));
 var VERSION = manifest.version;
-var runtime = join3(packageRoot, "runtime", "daemon");
-var daemonEntry = join3(runtime, "bin", "longleashd.mjs");
-var hooks = join3(runtime, "hooks");
-var devicesEntry = join3(runtime, "bin", "longleash-devices.mjs");
+var runtime = join4(packageRoot, "runtime", "daemon");
+var daemonEntry = join4(runtime, "bin", "longleashd.mjs");
+var hooks = join4(runtime, "hooks");
+var devicesEntry = join4(runtime, "bin", "longleash-devices.mjs");
 async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
@@ -541,11 +2246,13 @@ async function main() {
     return 0;
   }
   if (command === "setup") return setup(parseSetup(args.slice(1)));
+  if (command === "service") return serviceCommand(args.slice(1));
+  if (command === "pair") return pair();
   if (command === "doctor") return doctor(args.includes("--json"));
   if (command === "hooks") return runHooks(args.slice(1));
   if (command === "devices") return runNode(devicesEntry, []);
   if (command === "revoke") return runNode(devicesEntry, ["revoke", ...args.slice(1)]);
-  if (command === "update") return update(args[1] ?? "latest");
+  if (command === "update") return update(args[1]);
   if (command === "uninstall") return uninstall();
   if (command === "run") return runDaemon(args.slice(1));
   if (command?.startsWith("-")) {
@@ -561,20 +2268,33 @@ function help() {
 
 Usage:
   longleash setup                 configure a stable user-local installation
+  longleash service status        show manager and authenticated daemon health
+  longleash service start         start the per-user background service
+  longleash service stop          stop it without removing settings or devices
+  longleash service restart       restart it after a configuration change
+  longleash service logs [-f]     show redacted persistent service logs
+  longleash service uninstall     remove only the background service
+  longleash pair                  print a fresh pairing QR from the running service
   longleash run [folders...]      run in the foreground (terminal stays open)
   longleash [folders...]          shorthand for run
   longleash doctor [--json]       report package, config, and daemon health
   longleash hooks [--remove]      install or remove supported provider hooks
   longleash devices               list paired phones
   longleash revoke <id|--all>     revoke paired phone access
-  longleash update [version]      atomically install latest or an exact version
+  longleash update [version]      atomically update this channel or install an exact version
   longleash uninstall             remove runtime and hooks; preserve user data
-  longleash where                 print the active npm package directory
-
-Setup never starts the daemon. Background service commands arrive in Workstream C.`);
+  longleash where                 print the active npm package directory`);
 }
 function parseSetup(args) {
-  const options = { roots: [], relay: "", yes: false, reuse: false, configureOnly: false, skipHooks: false };
+  const options = {
+    roots: [],
+    relay: "",
+    yes: false,
+    reuse: false,
+    configureOnly: false,
+    skipHooks: false,
+    service: "default"
+  };
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i];
     if (arg === "--root") {
@@ -589,6 +2309,8 @@ function parseSetup(args) {
     else if (arg === "--reuse-config") options.reuse = true;
     else if (arg === "--configure-only") options.configureOnly = true;
     else if (arg === "--skip-hooks") options.skipHooks = true;
+    else if (arg === "--service") options.service = "install";
+    else if (arg === "--no-service") options.service = "skip";
     else throw new Error(`Unknown setup option: ${arg}`);
   }
   return options;
@@ -608,6 +2330,11 @@ async function setup(options) {
     options.relay = typeof existing.relayUrl === "string" ? existing.relayUrl : "off";
     options.yes = true;
   }
+  let existingService = false;
+  try {
+    existingService = serviceState().installed;
+  } catch {
+  }
   if (options.roots.length === 0 && options.yes) {
     throw new Error("Non-interactive setup requires at least one explicit --root, or --reuse-config.");
   }
@@ -619,17 +2346,26 @@ async function setup(options) {
     try {
       console.log("\nLongLeash setup\n");
       console.log("Agents remain on this laptop. Choose only folders where they may work.");
-      const rootAnswer = await prompt.question(`Allowed project folder [${process.cwd()}]: `);
-      options.roots = [rootAnswer.trim() || process.cwd()];
+      const defaultRoot = process.cwd();
+      while (options.roots.length === 0) {
+        const rootAnswer = await prompt.question(`Allowed project folder (press Enter for ${defaultRoot}): `);
+        const resolved = resolveAllowedRootAnswer(rootAnswer, defaultRoot);
+        if (resolved.ok) options.roots = [resolved.root];
+        else console.log(`
+${resolved.message}
+`);
+      }
       console.log("\nConnectivity: hosted works away from home; LAN-only has no internet relay.");
       const relayAnswer = await prompt.question("Relay [hosted / lan / wss://your-relay/ws] (hosted): ");
       options.relay = relayAnswer.trim() || "hosted";
+      const serviceAnswer = await prompt.question("Keep LongLeash available after this terminal closes? [Y/n] ");
+      options.service = /^n(?:o)?$/i.test(serviceAnswer.trim()) ? "skip" : "install";
       const roots2 = normalizeRoots(options.roots);
       const relay2 = normalizeRelay(options.relay);
       console.log("\nReview before anything changes:");
       for (const root of roots2) console.log(`  allowed root  ${root}`);
       console.log(`  connectivity  ${relay2 ?? "LAN-only (no relay)"}`);
-      console.log("  service       not installed or started in this workstream");
+      console.log(`  service       ${options.service === "install" ? "per-user background service at login" : "foreground only"}`);
       const accepted = await prompt.question("\nApply this setup? [y/N] ");
       if (!/^y(?:es)?$/i.test(accepted.trim())) {
         console.log("Nothing changed.");
@@ -653,7 +2389,7 @@ async function setup(options) {
       relay ?? "off",
       "--skip-hooks"
     ];
-    const configured = spawnSync2(process.execPath, [prepared.cli, ...forwarded], {
+    const configured = spawnSync3(process.execPath, [prepared.cli, ...forwarded], {
       stdio: "inherit",
       env: { ...process.env, LONGLEASH_INTERNAL_CONFIGURE: VERSION }
     });
@@ -663,7 +2399,10 @@ async function setup(options) {
       throw new Error("The staged package could not be configured. The active version was not changed.");
     }
     try {
-      prepared.activate();
+      const activation = prepared.activate();
+      if (activation.migratedLegacyWrapper) {
+        console.log("Migrated the verified legacy LongLeash command. Its checkout was preserved and will be restored if you uninstall this runtime.");
+      }
     } catch (error) {
       prepared.rollback();
       restoreConfigSnapshot(configSnapshot);
@@ -672,7 +2411,7 @@ async function setup(options) {
     console.log(`
 Activated @longleash/cli ${VERSION}.`);
     if (!options.skipHooks) {
-      const hooked = spawnSync2(process.execPath, [prepared.cli, "hooks"], { stdio: "inherit", env: process.env });
+      const hooked = spawnSync3(process.execPath, [prepared.cli, "hooks"], { stdio: "inherit", env: process.env });
       if (hooked.error || hooked.status !== 0) {
         console.error("Provider hook setup needs attention. The runtime is installed; run `longleash hooks` after fixing the message above.");
       }
@@ -687,6 +2426,22 @@ The executable is installed at ${paths.wrapper}, but ${paths.bin} is not on PATH
       console.log(`  export PATH=${quoteForShell(paths.bin)}:"$PATH"`);
       console.log(`You can use ${paths.wrapper} immediately.`);
     }
+    const manageService = options.service === "install" || options.service === "default" && (options.reuse ? existingService : true);
+    if (manageService) {
+      try {
+        const state = installService();
+        const healthy = await waitForDaemon(15e3);
+        if (!healthy) {
+          throw new Error("The service manager started LongLeash, but its authenticated health check did not become ready. Run `longleash service logs`.");
+        }
+        console.log(`Background service installed and running (${state.platform}).`);
+        console.log("Run `longleash pair` for a fresh QR; pairing secrets are not stored in service logs.");
+      } catch (error) {
+        throw new Error(`The verified runtime is installed, but the background service could not be activated: ${message(error)} You can use \`longleash run\` while diagnosing it.`);
+      }
+    } else {
+      console.log("Background service was not installed. Run `longleash run` for foreground use or `longleash service install` later.");
+    }
     return 0;
   }
   const next = { ...existing, cliSchemaVersion: 1, allowedRoots: roots };
@@ -694,17 +2449,98 @@ The executable is installed at ${paths.wrapper}, but ${paths.bin} is not on PATH
   else next.relayUrl = relay;
   saveConfig(next);
   console.log(`Saved configuration to ${configPath()}`);
-  console.log("LongLeash was not started. Run `longleash run` when you are ready.");
+  console.log("Configuration saved. The outer setup transaction decides whether to start the service.");
+  return 0;
+}
+async function serviceCommand(args) {
+  const command = args[0] ?? "status";
+  if (command === "install") {
+    const state = installService();
+    if (!await waitForDaemon(15e3)) throw new Error("The service was installed but did not become healthy. Run `longleash service logs`.");
+    printServiceState(state, true);
+    return 0;
+  }
+  if (command === "start") {
+    const state = startService();
+    if (!await waitForDaemon(15e3)) throw new Error("The service manager started the job but the daemon did not become healthy. Run `longleash service logs`.");
+    printServiceState(state, true);
+    return 0;
+  }
+  if (command === "stop") {
+    const state = stopService();
+    printServiceState(state, false);
+    return 0;
+  }
+  if (command === "restart") {
+    const state = restartService();
+    if (!await waitForDaemon(15e3)) throw new Error("The service restarted but the daemon did not become healthy. Run `longleash service logs`.");
+    printServiceState(state, true);
+    return 0;
+  }
+  if (command === "uninstall") {
+    uninstallService();
+    console.log(`Removed the per-user background service. Settings, devices, audit data, and runtime remain in ${configPath()}.`);
+    return 0;
+  }
+  if (command === "logs") return showServiceLogs(args.includes("--follow") || args.includes("-f"));
+  if (command === "status") {
+    const state = serviceState();
+    const healthy = await daemonHealth();
+    if (args.includes("--json")) console.log(JSON.stringify({ ...state, healthy }, null, 2));
+    else printServiceState(state, healthy);
+    return state.installed && healthy ? 0 : 1;
+  }
+  throw new Error(`Unknown service command: ${command}`);
+}
+function printServiceState(state, healthy) {
+  console.log("");
+  console.log(`  service      ${state.installed ? "installed" : "not installed"} (${state.platform})`);
+  console.log(`  manager      ${state.loaded ? "loaded" : "not loaded"}${state.active ? " \xB7 active" : ""}`);
+  console.log(`  daemon       ${healthy ? "authenticated health check passed" : "not reachable"}`);
+  console.log(`  definition   ${state.definition}`);
+  console.log(`  logs         ${state.logs}`);
+  if (state.platform === "linux" && state.loginOnly) {
+    console.log("  login scope   stops after logout; optional lingering is not enabled by LongLeash");
+  }
+  console.log("");
+}
+async function pair() {
+  const response = await localDaemonRequest("/local/pairing", { method: "POST" });
+  if (!response.ok) throw new Error(`The running daemon could not create a pairing challenge (${response.status}).`);
+  const body = await response.json();
+  if (typeof body.url !== "string" || !/^https?:\/\//.test(body.url)) throw new Error("The daemon returned an invalid pairing challenge.");
+  console.log("\nScan this with your phone. The link is single-use and expires:\n");
+  console.log(terminalQr(body.url));
+  console.log(`
+  ${body.url}
+`);
   return 0;
 }
 async function runDaemon(explicitRoots) {
-  if (!existsSync2(daemonEntry)) throw new Error("The npm package is incomplete: daemon runtime is missing.");
+  if (!existsSync3(daemonEntry)) throw new Error("The npm package is incomplete: daemon runtime is missing.");
   const config = loadConfig();
   const roots = normalizeRoots(explicitRoots.length > 0 ? explicitRoots : configuredRoots(config));
   const child = spawn(process.execPath, [daemonEntry, ...roots], { stdio: "inherit", env: process.env });
   return await new Promise((resolveExit, reject) => {
-    child.once("error", reject);
-    child.once("exit", (code, signal) => resolveExit(code ?? (signal ? 1 : 0)));
+    const forward = (signal) => {
+      if (child.exitCode === null && child.signalCode === null) child.kill(signal);
+    };
+    const interrupt = () => forward("SIGINT");
+    const terminate = () => forward("SIGTERM");
+    const cleanup = () => {
+      process.off("SIGINT", interrupt);
+      process.off("SIGTERM", terminate);
+    };
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", terminate);
+    child.once("error", (error) => {
+      cleanup();
+      reject(error);
+    });
+    child.once("exit", (code, signal) => {
+      cleanup();
+      resolveExit(code ?? (signal ? 1 : 0));
+    });
   });
 }
 async function doctor(json) {
@@ -715,10 +2551,10 @@ async function doctor(json) {
   } catch (error) {
     configError = message(error);
   }
-  const endpointPath = join3(process.env.LONGLEASH_DATA ?? join3(homedir3(), ".longleash"), "hook-endpoint.json");
+  const endpointPath = join4(process.env.LONGLEASH_DATA ?? join4(homedir4(), ".longleash"), "hook-endpoint.json");
   let daemon = { reachable: false };
   try {
-    const endpoint = JSON.parse(readFileSync3(endpointPath, "utf8"));
+    const endpoint = JSON.parse(readFileSync4(endpointPath, "utf8"));
     if (endpoint.url && endpoint.secret) {
       const response = await fetch(endpoint.url.replace(/\/hook$/, "/health"), {
         headers: { "x-longleash-hook": endpoint.secret },
@@ -759,12 +2595,12 @@ LongLeash ${VERSION}`);
 async function runHooks(args) {
   const remove = args.includes("--remove");
   let failed = false;
-  if (commandAvailable("claude") || remove) failed = await runNode(join3(hooks, "install-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
-  if (commandAvailable("codex") || remove) failed = await runNode(join3(hooks, "install-codex-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
+  if (commandAvailable("claude") || remove) failed = await runNode(join4(hooks, "install-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
+  if (commandAvailable("codex") || remove) failed = await runNode(join4(hooks, "install-codex-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
   return failed ? 1 : 0;
 }
 async function update(target) {
-  const spec = target === "latest" ? "@longleash/cli@latest" : `@longleash/cli@${assertVersion(target)}`;
+  const spec = updatePackageSpec(target, VERSION);
   const child = spawn("npm", [
     "exec",
     "--yes",
@@ -785,18 +2621,69 @@ async function update(target) {
   });
 }
 async function uninstall() {
+  try {
+    if (serviceState().installed) uninstallService();
+  } catch (error) {
+    throw new Error(`The background service could not be removed safely, so the runtime was preserved: ${message(error)}`);
+  }
   const hooksRemoved = await runHooks(["--remove"]);
   if (hooksRemoved !== 0) throw new Error("Provider hooks could not be removed safely. The managed runtime was preserved.");
   const result = uninstallManagedRuntime();
   console.log(result.removed ? "Removed the managed LongLeash runtime and executable." : "No managed LongLeash runtime was installed.");
+  if (result.legacyWrapperRestored) console.log("Restored the verified legacy LongLeash command that existed before the npm migration.");
   console.log(`Preserved settings, paired devices, and audit data in ${result.configPreserved}.`);
   return 0;
 }
+async function daemonHealth() {
+  try {
+    const response = await localDaemonRequest("/health", { method: "GET" }, 1500);
+    if (!response.ok) return false;
+    const body = await response.json();
+    return body.name === "longleash";
+  } catch {
+    return false;
+  }
+}
+async function waitForDaemon(timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await daemonHealth()) return true;
+    await new Promise((resolveWait) => setTimeout(resolveWait, 200));
+  }
+  return false;
+}
+async function localDaemonRequest(path, init, timeoutMs = 5e3) {
+  const endpointPath = join4(process.env.LONGLEASH_DATA ?? join4(homedir4(), ".longleash"), "hook-endpoint.json");
+  let endpoint;
+  try {
+    endpoint = JSON.parse(readFileSync4(endpointPath, "utf8"));
+  } catch {
+    throw new Error("LongLeash is not reachable. Start it with `longleash service start` or `longleash run`.");
+  }
+  if (typeof endpoint.url !== "string" || typeof endpoint.secret !== "string" || endpoint.secret === "") {
+    throw new Error(`Invalid local daemon endpoint: ${endpointPath}`);
+  }
+  const url = new URL(endpoint.url);
+  if (url.protocol !== "http:" || url.pathname !== "/hook" || !localAddress(url.hostname)) {
+    throw new Error(`Refusing a non-local daemon endpoint in ${endpointPath}`);
+  }
+  return fetch(`${url.origin}${path}`, {
+    ...init,
+    headers: { ...init.headers, "x-longleash-hook": endpoint.secret },
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+}
+function localAddress(hostname) {
+  if (hostname === "localhost" || hostname === "::1") return true;
+  if (/^127\./.test(hostname) || /^10\./.test(hostname) || /^192\.168\./.test(hostname)) return true;
+  const match = hostname.match(/^172\.(\d+)\./);
+  return match !== null && Number(match[1]) >= 16 && Number(match[1]) <= 31;
+}
 function commandAvailable(command) {
-  return spawnSync2(command, ["--version"], { stdio: "ignore", timeout: 3e3 }).status === 0;
+  return spawnSync3(command, ["--version"], { stdio: "ignore", timeout: 3e3 }).status === 0;
 }
 function pathDirectories() {
-  return (process.env.PATH ?? "").split(delimiter).filter(Boolean).map((path) => resolve3(path));
+  return (process.env.PATH ?? "").split(delimiter).filter(Boolean).map((path) => resolve4(path));
 }
 function quoteForShell(value) {
   return `'${value.replace(/'/g, `'"'"'`)}'`;