@mnemonik/cli 7.109.2 → 7.110.0

package/dist/scanner/service.js

@@ -502,11 +502,73 @@ var require_ignore = __commonJS({
 });
 
 // packages/shared/dist/runtimeSigners.js
-var ttl;
+import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
+import { execFile, execFileSync } from "node:child_process";
+function windowsCommand(file) {
+  const root = process.env.SystemRoot;
+  if (!root || !win32.isAbsolute(root))
+    throw new Error("acl_system_root_unavailable");
+  return win32.join(root, "System32", file);
+}
+function readIdentity(stdout) {
+  const match = /^"([^"\r\n]+)","(S-1-(?:\d+-)+\d+)"$/.exec(stdout.trim());
+  if (!match?.[1] || !match[2] || stdout.includes("\uFFFD"))
+    throw new Error("acl_identity_unavailable");
+  return { name: match[1], sid: match[2] };
+}
+function* readWindowsIdentity() {
+  const user = readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  if (!ADMINISTRATOR_RID.test(user.sid))
+    return user;
+  const groups = yield [windowsCommand("whoami.exe"), groupArgs];
+  const local = /^"[^"\r\n]*","[^"\r\n]*","S-1-5-113",/m.test(groups);
+  return {
+    ...user,
+    localAdministratorSid: local ? `${user.sid.slice(0, user.sid.lastIndexOf("-"))}-500` : null
+  };
+}
+function windowsCurrentAccountSync() {
+  if (currentIdentity)
+    return currentIdentity;
+  const commands = readWindowsIdentity();
+  let step = commands.next();
+  while (!step.done)
+    step = commands.next(hookExecuteSync(...step.value));
+  return currentIdentity = step.value;
+}
+function hookInvocation(file, args2) {
+  if (win32.basename(file) === "whoami.exe") {
+    if ([file, ...args2].some((arg) => /[%!"\r\n]/.test(arg)))
+      throw new Error("acl_path_unavailable");
+    const command = args2.map((arg) => /^(?:[a-z0-9]+|\/[a-z]+)$/i.test(arg) ? arg : `"${arg}"`).join(" ");
+    return [
+      windowsCommand("cmd.exe"),
+      ["/d", "/v:off", "/s", "/c", `"chcp 65001>nul & "${file}" ${command}"`]
+    ];
+  }
+  if (win32.basename(file) === "cmd.exe")
+    return [file, ["/u", ...args2]];
+  return [file, args2];
+}
+function hookExecuteSync(file, args2, input) {
+  [file, args2] = hookInvocation(file, args2);
+  return execFileSync(file, args2, { ...hookOptions(file, args2), input });
+}
+var identityArgs, groupArgs, ADMINISTRATOR_RID, currentIdentity, ttl, hookOptions;
 var init_runtimeSigners = __esm({
   "packages/shared/dist/runtimeSigners.js"() {
     "use strict";
+    identityArgs = ["/user", "/fo", "csv", "/nh"];
+    groupArgs = ["/groups", "/fo", "csv", "/nh"];
+    ADMINISTRATOR_RID = /^S-1-5-21-\d+-\d+-\d+-500$/;
     ttl = 10 * 6e4;
+    hookOptions = (file, args2) => ({
+      encoding: args2.includes("/u") ? "utf16le" : "utf8",
+      timeout: win32.basename(file) === "powershell.exe" ? 3e4 : 5e3,
+      windowsHide: true,
+      maxBuffer: 16 * 1024 * 1024,
+      windowsVerbatimArguments: win32.basename(file) === "cmd.exe"
+    });
   }
 });
 
@@ -2075,12 +2137,12 @@ var require_adapter = __commonJS({
       return newFs;
     }
     function toPromise(method) {
-      return (...args2) => new Promise((resolve, reject) => {
+      return (...args2) => new Promise((resolve2, reject) => {
         args2.push((err2, result) => {
           if (err2) {
             reject(err2);
           } else {
-            resolve(result);
+            resolve2(result);
           }
         });
         method(...args2);
@@ -3763,13 +3825,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url) => {
         if (isFileURI(url)) {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve2, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve(xhr.response);
+                resolve2(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -3965,9 +4027,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info22 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve2, reject) => {
         Module["instantiateWasm"](info22, (mod, inst) => {
-          resolve(receiveInstance(mod, inst));
+          resolve2(receiveInstance(mod, inst));
         });
       });
     }
@@ -5298,8 +5360,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve, reject) => {
-      readyPromiseResolve = resolve;
+    moduleRtn = new Promise((resolve2, reject) => {
+      readyPromiseResolve = resolve2;
       readyPromiseReject = reject;
     });
   }
@@ -6361,7 +6423,7 @@ function scannerAttemptHealthy(receipt, attempt, paused = false) {
 // packages/shared/dist/launchdControl.js
 import { setTimeout as delay } from "node:timers/promises";
 import { mkdir, readFile, rm, writeFile, lstat } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 async function printLaunchdRegistration(domain, label, run2) {
   try {
     return await run2("launchctl", ["print", `${domain}/${label}`]);
@@ -6410,7 +6472,7 @@ async function removeMacScanner(state, home, uid, run2, options = {}) {
       return false;
     throw error;
   });
-  const receipt = await readFile(join2(state, "scanner/status.json"), "utf8").catch((error) => {
+  const receipt = await readFile(join3(state, "scanner/status.json"), "utf8").catch((error) => {
     if (error.code === "ENOENT")
       return null;
     throw error;
@@ -6430,20 +6492,20 @@ async function removeMacScanner(state, home, uid, run2, options = {}) {
   const legacy = [`user/${uid}`, `gui/${uid}`];
   await stopLaunchdRegistrations(legacy, "ai.mnemonik.scanner.replacement", run2, options);
   await stopLaunchdRegistrations(legacy, "ai.mnemonik.scanner", run2, { ...options, recordedPid });
-  await rm(join2(state, "scanner/service-replacement"), { recursive: true, force: true });
+  await rm(join3(state, "scanner/service-replacement"), { recursive: true, force: true });
   if (options.remove === false) {
-    await mkdir(join2(state, "scanner/service-replacement"), { recursive: true });
-    await writeFile(join2(state, "scanner/service-replacement/result.json"), JSON.stringify({ stopped: true }));
+    await mkdir(join3(state, "scanner/service-replacement"), { recursive: true });
+    await writeFile(join3(state, "scanner/service-replacement/result.json"), JSON.stringify({ stopped: true }));
     return;
   }
   if (present || launcherPresent)
     await run2("sudo", ["-n", "/bin/rm", "-f", plist, launcher]);
   for (const label of ["ai.mnemonik.scanner", "ai.mnemonik.scanner.replacement"])
-    await rm(join2(home, "Library/LaunchAgents", `${label}.plist`), { force: true });
-  await rm(join2(state, "scanner/assets"), { recursive: true, force: true });
-  await rm(join2(state, "scanner/service-supervisor.json"), { force: true });
-  await rm(join2(state, "scanner/service-migrated"), { force: true });
-  await rm(join2(state, "scanner/system-service.plist"), { force: true });
+    await rm(join3(home, "Library/LaunchAgents", `${label}.plist`), { force: true });
+  await rm(join3(state, "scanner/assets"), { recursive: true, force: true });
+  await rm(join3(state, "scanner/service-supervisor.json"), { force: true });
+  await rm(join3(state, "scanner/service-migrated"), { force: true });
+  await rm(join3(state, "scanner/system-service.plist"), { force: true });
 }
 async function stopLaunchdRegistrations(domains, label, run2, options = {}) {
   const now = options.now ?? Date.now;
@@ -6487,11 +6549,11 @@ async function stopLaunchdRegistrations(domains, label, run2, options = {}) {
 // packages/shared/dist/systemdControl.js
 import { existsSync } from "node:fs";
 import { rm as rm2 } from "node:fs/promises";
-import { basename, dirname as dirname2, join as join3 } from "node:path";
+import { basename as basename2, dirname as dirname3, join as join4 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 async function uninstallSystemdUnit(unitPath, run2, options = {}) {
   try {
-    const unit = basename(unitPath);
+    const unit = basename2(unitPath);
     if (!/^mnemonik-scanner(?:-test-[0-9]+)?\.service$/.test(unit))
       throw new Error("invalid_test_unit");
     const command = (args2) => run2("systemctl", ["--user", ...args2]);
@@ -6523,7 +6585,7 @@ async function uninstallSystemdUnit(unitPath, run2, options = {}) {
     } catch (error) {
       if (existsSync(unitPath) || !new RegExp(`Unit file ${unit.replaceAll(".", "\\.")} does not exist\\.?\\s*$`).test(error.message))
         throw error;
-      await rm2(join3(dirname2(unitPath), "default.target.wants", unit), { force: true });
+      await rm2(join4(dirname3(unitPath), "default.target.wants", unit), { force: true });
       await command(["daemon-reload"]);
     }
     if ((await inspect()).ActiveState === "failed")
@@ -6552,7 +6614,7 @@ async function uninstallSystemdUnit(unitPath, run2, options = {}) {
 }
 
 // packages/shared/dist/scannerPid.js
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { readFileSync } from "node:fs";
 var SCANNER_CMD_PATTERN = /(mnemonik-scanner|scanner[\\/]dist[\\/]index\.js)/;
 var capture = {
@@ -6560,7 +6622,7 @@ var capture = {
   stdio: ["ignore", "pipe", "ignore"],
   timeout: 5e3
 };
-function processCmdline(pid, platform, exec = execFileSync) {
+function processCmdline(pid, platform, exec = execFileSync2) {
   if (!Number.isSafeInteger(pid) || pid <= 0)
     return null;
   if (platform === "win32") {
@@ -6587,7 +6649,7 @@ function processCmdline(pid, platform, exec = execFileSync) {
     return null;
   }
 }
-function pidIsScanner(pid, platform = process.platform, exec = execFileSync, identity) {
+function pidIsScanner(pid, platform = process.platform, exec = execFileSync2, identity) {
   const cmdline = processCmdline(pid, platform, exec);
   if (cmdline === null)
     return false;
@@ -6604,11 +6666,13 @@ function pidIsScanner(pid, platform = process.platform, exec = execFileSync, ide
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();
+init_hookRuntime();
 import { createHash, randomUUID } from "node:crypto";
+import { execFile as nodeExecFile } from "node:child_process";
 import fs2 from "node:fs";
 import { open, rename, readFile as readFile2, mkdir as mkdir2, lstat as lstat2, chmod, writeFile as writeFile2, unlink, rmdir } from "node:fs/promises";
-init_hookRuntime();
-import { dirname as dirname3, join as join4, win32, posix } from "node:path";
+import { homedir } from "node:os";
+import { dirname as dirname4, join as join5, win32 as win322, posix } from "node:path";
 import { setTimeout as delay3 } from "node:timers/promises";
 var lockfileKey = /* @__PURE__ */ Symbol.for("mnemonik.proper-lockfile");
 function sharedLockfile() {
@@ -6616,6 +6680,15 @@ function sharedLockfile() {
   return shared[lockfileKey] ??= Promise.resolve().then(() => __toESM(require_proper_lockfile(), 1)).then((module2) => module2.default);
 }
 var codeIs = (error, code) => error.code === code;
+function stateDirectory(platform = process.platform, env = process.env, home = homedir()) {
+  if (env.MNEMONIK_STATE_DIR)
+    return env.MNEMONIK_STATE_DIR;
+  if (platform === "win32")
+    return win322.join(env.LOCALAPPDATA || win322.join(home, "AppData", "Local"), "Mnemonik");
+  if (platform === "darwin")
+    return posix.join(home, "Library", "Application Support", "Mnemonik");
+  return posix.join(env.XDG_STATE_HOME || posix.join(home, ".local", "state"), "mnemonik");
+}
 async function readBytes(path) {
   try {
     if (!(await lstat2(path)).isFile())
@@ -6627,11 +6700,69 @@ async function readBytes(path) {
     throw error;
   }
 }
+async function syncDirectory(path) {
+  if (process.platform === "win32")
+    return;
+  const fd = await open(path, "r");
+  try {
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+}
+var windowsCurrentAccount = windowsCurrentAccountSync;
+async function windowsCurrentUserAcl(path, directory = false, options = {}, created = false) {
+  const username = options.username ?? `*${windowsCurrentAccount().sid}`;
+  const grant = `${username}:${directory ? "(OI)(CI)F" : "F"}`;
+  const execFile3 = options.execFile ?? nodeExecFile;
+  await new Promise((resolve2, reject) => {
+    execFile3("icacls.exe", [
+      path,
+      "/inheritance:r",
+      "/grant:r",
+      grant,
+      ...created ? ["/remove:g", "*S-1-5-32-544", "*S-1-5-18"] : []
+    ], (error) => {
+      if (error)
+        reject(error);
+      else
+        resolve2();
+    });
+  });
+}
+async function protectStateFile(path, platform = process.platform, aclOptions) {
+  if (platform === "win32")
+    await windowsCurrentUserAcl(path, false, aclOptions);
+  else
+    await chmod(path, 384);
+  return "private";
+}
+async function atomicWrite(path, bytes, fault, assertOwned) {
+  await assertOwned?.();
+  const temp = `${path}.${randomUUID()}.tmp`;
+  const fd = await open(temp, "wx", 384);
+  let permissionStatus;
+  try {
+    permissionStatus = await protectStateFile(temp);
+    const split = Math.ceil(bytes.length / 2);
+    await fd.writeFile(bytes.subarray(0, split));
+    await fault?.("mid_write");
+    await assertOwned?.();
+    await fd.writeFile(bytes.subarray(split));
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await assertOwned?.();
+  await rename(temp, path);
+  await syncDirectory(dirname4(path));
+  return permissionStatus;
+}
 async function withLock(path, waitMs, work) {
   const lockfile = await sharedLockfile();
-  await mkdir2(dirname3(path), { recursive: true, mode: 448 });
+  await mkdir2(dirname4(path), { recursive: true, mode: 448 });
   const generation = randomUUID();
-  const owner = join4(`${path}.lock`, "owner");
+  const owner = join5(`${path}.lock`, "owner");
   let compromised = false;
   let acquired = false;
   const assertOwned = async () => {
@@ -6646,14 +6777,14 @@ async function withLock(path, waitMs, work) {
       void mkdir2(dir).then(() => writeFile2(owner, generation, { mode: 384, flag: "wx" })).then(() => callback(), callback);
     },
     rmdir: (dir, callback) => {
-      void unlink(join4(dir, "owner")).catch((error) => {
+      void unlink(join5(dir, "owner")).catch((error) => {
         if (!codeIs(error, "ENOENT"))
           throw error;
       }).then(() => rmdir(dir)).then(() => callback(), callback);
     },
     rmdirSync: (dir) => {
       try {
-        fs2.unlinkSync(join4(dir, "owner"));
+        fs2.unlinkSync(join5(dir, "owner"));
       } catch (error) {
         if (!codeIs(error, "ENOENT"))
           throw error;
@@ -6695,14 +6826,108 @@ async function withLock(path, waitMs, work) {
   }
 }
 
+// packages/local-setup/dist/automaticUpdate.js
+import { spawn as nodeSpawn } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { stat as nodeStat, utimes } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var DAY_MS = 864e5;
+var statePath = (stateDir) => join6(stateDir, "automatic-update.json");
+function cliLauncherPath(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir2();
+  return platform === "win32" ? join6(options.env?.LOCALAPPDATA || join6(home, "AppData", "Local"), "Mnemonik", "bin", "mnemonik.cmd") : join6(home, ".local", "bin", "mnemonik");
+}
+async function readState(path) {
+  const bytes = await readBytes(path);
+  if (!bytes)
+    return {};
+  const value = JSON.parse(bytes.toString());
+  if (!value || typeof value !== "object" || value.lastAttempt !== void 0 && (!Number.isFinite(value.lastAttempt) || value.lastAttempt < 0))
+    throw new Error("automatic_update_state_invalid");
+  return value.lastAttempt === void 0 ? {} : { lastAttempt: value.lastAttempt };
+}
+async function maybeStartAutomaticUpdate(options = {}) {
+  const stateDir = options.stateDir ?? stateDirectory(options.platform, options.env, options.home);
+  const path = statePath(stateDir);
+  try {
+    const now = (options.now ?? Date.now)();
+    const stat = options.stat ?? nodeStat;
+    try {
+      if (now - (await stat(path)).mtimeMs < DAY_MS)
+        return false;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    if (!options.spawn && !(await stat(cliLauncherPath(options))).isFile())
+      return false;
+    return await withLock(path, 0, async (assertOwned) => {
+      const state = await readState(path);
+      if (state.lastAttempt !== void 0 && now - state.lastAttempt < DAY_MS)
+        return false;
+      await atomicWrite(path, Buffer.from(`${JSON.stringify({ lastAttempt: now })}
+`), void 0, assertOwned);
+      await utimes(path, now / 1e3, now / 1e3);
+      const platform = options.platform ?? process.platform;
+      const launcher = cliLauncherPath(options);
+      const command = platform === "win32" ? {
+        file: options.env?.ComSpec || "cmd.exe",
+        args: ["/d", "/s", "/c", `""${launcher}" update --automatic"`],
+        windowsVerbatimArguments: true
+      } : platform === "linux" && (options.env ?? process.env).INVOCATION_ID ? {
+        // detached creates a process group, not a new systemd cgroup. An
+        // updater spawned by the scanner must survive stopping that service.
+        file: "systemd-run",
+        args: [
+          "--user",
+          "--collect",
+          "--quiet",
+          `--setenv=MNEMONIK_STATE_DIR=${stateDir}`,
+          "--",
+          launcher,
+          "update",
+          "--automatic"
+        ]
+      } : { file: launcher, args: ["update", "--automatic"] };
+      const child = (options.spawn ?? nodeSpawn)(command.file, command.args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        ..."windowsVerbatimArguments" in command ? { windowsVerbatimArguments: command.windowsVerbatimArguments } : {}
+      });
+      child.once("error", () => {
+      });
+      child.unref();
+      return true;
+    });
+  } catch {
+    return false;
+  }
+}
+var HELPER_FLAG = "--mnemonik-automatic-update";
+function isHelperInvocation() {
+  if (process.argv[2] !== HELPER_FLAG || !process.argv[3] || !process.argv[1])
+    return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath2(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isHelperInvocation())
+  void maybeStartAutomaticUpdate({ stateDir: process.argv[3] });
+
 // packages/local-setup/dist/index.js
 var MAX_ORIGINAL_BYTES = 64 * 1024;
 
 // packages/cli/src/scanner/service.ts
-import { execFile } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 import { readFile as readFile3, rm as rm3, lstat as lstat3 } from "node:fs/promises";
-import { join as join5, dirname as dirname4 } from "node:path";
-import { homedir } from "node:os";
+import { join as join7, dirname as dirname5 } from "node:path";
+import { homedir as homedir3 } from "node:os";
 import { promisify } from "node:util";
 import { setTimeout as delay4 } from "node:timers/promises";
 import { RuntimeStore } from "../runtime/store.js";
@@ -6778,7 +7003,7 @@ function scannerService(options) {
   const configureStore = async () => {
     if (!options.store) {
       const saved = JSON.parse(
-        await new RuntimeStore(options.stateDir).bytes(join5(options.stateDir, "scanner/state.json")).then((bytes) => bytes.toString()).catch((error) => {
+        await new RuntimeStore(options.stateDir).bytes(join7(options.stateDir, "scanner/state.json")).then((bytes) => bytes.toString()).catch((error) => {
           if (error.code === "ENOENT") return "null";
           throw error;
         })
@@ -6805,8 +7030,8 @@ function scannerService(options) {
     if (fixed && (!fixed.isFile() || fixed.uid !== 0 || fixed.mode & 18))
       throw new Error("service_runtime_permission");
     const entry = fixed ? macScannerLauncher : (retained ? await store.verifyRetainedRuntime("scanner", retained.reference) : await verify()).entry;
-    return new Promise((resolve, reject) => {
-      const child = execFile(
+    return new Promise((resolve2, reject) => {
+      const child = execFile2(
         entry,
         ["service", operation, "--json"],
         {
@@ -6829,7 +7054,7 @@ function scannerService(options) {
             return;
           }
           try {
-            resolve(JSON.parse(stdout));
+            resolve2(JSON.parse(stdout));
           } catch (error2) {
             reject(error2);
           }
@@ -6883,7 +7108,7 @@ function scannerService(options) {
   const describe = async () => {
     const runtime = await verify();
     return options.describe ? await options.describe() : JSON.parse(
-      (await promisify(execFile)(runtime.entry, ["service", "describe", "--json"], {
+      (await promisify(execFile2)(runtime.entry, ["service", "describe", "--json"], {
         env: {
           ...process.env,
           MNEMONIK_STATE_DIR: options.stateDir,
@@ -6898,13 +7123,13 @@ function scannerService(options) {
     async recover() {
       if ((options.platform ?? process.platform) !== "darwin") return false;
       return withLock(
-        join5(options.stateDir, "scanner/launchd-replacement-control"),
+        join7(options.stateDir, "scanner/launchd-replacement-control"),
         5e3,
         async () => {
           const receipt = await scannerReceipt(options.stateDir);
           const snapshot = receipt?.snapshot;
           const attempt = await readFile3(
-            join5(options.stateDir, "scanner/service-replacement/result.json"),
+            join7(options.stateDir, "scanner/service-replacement/result.json"),
             "utf8"
           ).then((text) => JSON.parse(text)).catch(() => null);
           const age = now() - Number(attempt?.startedAt);
@@ -6916,7 +7141,7 @@ function scannerService(options) {
           if (receipt && snapshot?.lifecycle.pid === pid && (snapshot.lifecycle.state === "paused" || now() - receipt.recordedAt <= SCANNER_RECEIPT_STALE_MS))
             return false;
           const state = JSON.parse(
-            await readFile3(join5(options.stateDir, "scanner/state.json"), "utf8")
+            await readFile3(join7(options.stateDir, "scanner/state.json"), "utf8")
           );
           if (state.paused) return false;
           let runtime = await verify();
@@ -6985,7 +7210,7 @@ function scannerService(options) {
     },
     async exportPreview(out2) {
       const runtime = await verify();
-      return promisify(execFile)(runtime.entry, ["export-preview", "--out", out2], {
+      return promisify(execFile2)(runtime.entry, ["export-preview", "--out", out2], {
         env: {
           ...process.env,
           MNEMONIK_STATE_DIR: options.stateDir,
@@ -6998,7 +7223,7 @@ function scannerService(options) {
       replacementRuntime = runtime;
       verified = false;
       const saved = JSON.parse(
-        replacement.state?.after ?? await readFile3(join5(options.stateDir, "scanner/state.json"), "utf8")
+        replacement.state?.after ?? await readFile3(join7(options.stateDir, "scanner/state.json"), "utf8")
       );
       const startedAt = now();
       await invoke("install", {
@@ -7009,13 +7234,13 @@ function scannerService(options) {
         credentialFamilyId: saved.config?.credentialFamilyId,
         runAtLogin: true,
         restart: { policy: "on-failure", delayMs: 3e3 },
-        logDestination: join5(options.stateDir, "scanner/scanner.log"),
+        logDestination: join7(options.stateDir, "scanner/scanner.log"),
         replacement
       });
       const deadline = now() + SCANNER_HANDOFF_BUDGET_MS;
       while (now() < deadline) {
         const attempt = await readFile3(
-          join5(options.stateDir, "scanner/service-replacement/result.json"),
+          join7(options.stateDir, "scanner/service-replacement/result.json"),
           "utf8"
         ).then(JSON.parse).catch(() => null);
         if (attempt && attempt.startedAt >= startedAt) {
@@ -7051,34 +7276,34 @@ function scannerService(options) {
       await invoke("stop");
     },
     async uninstall() {
-      const native = (timeout) => options.supervisorRun ?? (async (file, args2) => (await promisify(execFile)(file, args2, { encoding: "utf8", timeout })).stdout);
+      const native = (timeout) => options.supervisorRun ?? (async (file, args2) => (await promisify(execFile2)(file, args2, { encoding: "utf8", timeout })).stdout);
       try {
         if ((options.platform ?? process.platform) === "darwin") {
           return await withLock(
-            join5(options.stateDir, "scanner/launchd-replacement-control"),
+            join7(options.stateDir, "scanner/launchd-replacement-control"),
             SCANNER_REMOVAL_BUDGET_MS,
             async () => {
               await removeMacScanner(
                 options.stateDir,
-                options.home ?? homedir(),
+                options.home ?? homedir3(),
                 options.uid ?? process.getuid?.() ?? -1,
                 native(SCANNER_REMOVAL_BUDGET_MS),
                 { now, sleep, plist: options.systemPlist }
               );
-              await rm3(dirname4(store.pointerPath("scanner")), { recursive: true, force: true });
+              await rm3(dirname5(store.pointerPath("scanner")), { recursive: true, force: true });
             }
           );
         }
         if ((options.platform ?? process.platform) === "linux") {
-          const recordedPid = await readFile3(join5(options.stateDir, "scanner/status.json"), "utf8").then(
+          const recordedPid = await readFile3(join7(options.stateDir, "scanner/status.json"), "utf8").then(
             (text) => JSON.parse(text).snapshot?.lifecycle?.pid
           ).catch((error) => {
             if (error.code === "ENOENT") return void 0;
             throw error;
           });
           await uninstallSystemdUnit(
-            join5(
-              process.env.XDG_CONFIG_HOME ?? join5(options.home ?? homedir(), ".config"),
+            join7(
+              process.env.XDG_CONFIG_HOME ?? join7(options.home ?? homedir3(), ".config"),
               "systemd/user/mnemonik-scanner.service"
             ),
             native(SCANNER_STOP_BUDGET_MS),
@@ -7088,7 +7313,7 @@ function scannerService(options) {
           await invoke("stop");
           await invoke("uninstall");
         }
-        await rm3(dirname4(store.pointerPath("scanner")), { recursive: true, force: true });
+        await rm3(dirname5(store.pointerPath("scanner")), { recursive: true, force: true });
       } catch (error) {
         const cause = error.cause;
         throw new ScannerServiceLimited(