@mono-agent/agent-app 0.20.11 → 0.21.0

package/dist/untrusted-text.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared deterministic checks for model-authored free text that the host is
+ * about to display to an operator or persist durably.
+ *
+ * These are defense in depth, not a guarantee. `SECURITY.md` is explicit that
+ * free-form model, user, and tool text may still contain sensitive data: what
+ * follows catches known credential shapes and this agent's own configured
+ * secrets, not every conceivable secret. Callers reject rather than redact, so
+ * a partial match never produces a silently mangled value that still reports
+ * success.
+ */
+/**
+ * Reject terminal and bidi control characters. Ordinary Unicode text and LF
+ * newlines stay intact; what goes is anything that could clear, overwrite, or
+ * visually reorder text an operator later reads.
+ */
+export declare function containsUnsafeReviewControl(value: string): boolean;
+/** Whether the text carries a value shaped like a well-known credential. */
+export declare function containsSecretLikeValue(value: string): boolean;
+/**
+ * The live credential values this process actually holds, taken from
+ * environment variables whose NAME looks credential-bearing. Matching against
+ * these is exact rather than heuristic: it catches the agent echoing back a
+ * secret it was configured with, which no shape rule can promise.
+ */
+export declare function knownEnvironmentSecretValues(env: Record<string, string | undefined>): readonly string[];
+/**
+ * Whether the text contains any of this agent's own configured secret values.
+ *
+ * Both sides are NFKC-folded before comparison. Callers normalize the text they
+ * are about to store, so comparing it against a raw environment value would
+ * miss a credential that is itself configured in a compatibility form (a
+ * fullwidth password matches only once both sides agree on a domain).
+ */
+export declare function containsKnownSecretValue(value: string, secrets: readonly string[]): boolean;
+//# sourceMappingURL=untrusted-text.d.ts.map

package/dist/untrusted-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-text.d.ts","sourceRoot":"","sources":["../src/untrusted-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA+DH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAYlE;AA4BD,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,MAAM,EAAE,CAWvG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAS3F"}

package/dist/untrusted-text.js

@@ -0,0 +1,150 @@
+/**
+ * Shared deterministic checks for model-authored free text that the host is
+ * about to display to an operator or persist durably.
+ *
+ * These are defense in depth, not a guarantee. `SECURITY.md` is explicit that
+ * free-form model, user, and tool text may still contain sensitive data: what
+ * follows catches known credential shapes and this agent's own configured
+ * secrets, not every conceivable secret. Callers reject rather than redact, so
+ * a partial match never produces a silently mangled value that still reports
+ * success.
+ */
+const BIDI_CONTROL = /\p{Bidi_Control}/u;
+/**
+ * Well-known credential shapes that are dangerous even with no surrounding
+ * label: OpenAI, GitHub, and Slack tokens, bearer headers, and Telegram bot
+ * tokens. Each requires a credential-specific alphabet and length, so prose
+ * that merely mentions `sk-` does not match.
+ */
+const SECRET_LIKE_VALUE = new RegExp([
+    // OpenAI, including project/service-account forms.
+    String.raw `sk-[A-Za-z0-9_-]{12,}`,
+    // GitHub classic/OAuth/refresh/server/user tokens, plus fine-grained PATs.
+    String.raw `gh[pousr]_[A-Za-z0-9]{20,}`,
+    String.raw `github_pat_[A-Za-z0-9_]{20,}`,
+    // Slack bot/user/app-level tokens.
+    String.raw `xox[baprs]-[A-Za-z0-9-]{12,}`,
+    String.raw `xapp-[A-Za-z0-9-]{12,}`,
+    // AWS access key ids, long-term (AKIA) and temporary STS (ASIA).
+    String.raw `A(?:KIA|SIA)[A-Z0-9]{16}`,
+    // Telegram bot tokens.
+    String.raw `\d{6,12}:[A-Za-z0-9_-]{20,}`,
+].map((shape) => String.raw `\b${shape}\b`).join("|")
+    // Bearer carries its own delimiter, so it is matched separately from the
+    // word-bounded shapes above. The payload must look like a token: `\S{12,}`
+    // also matched ordinary prose such as "Bearer authentication". Basic is
+    // handled by decoding rather than by length — see containsBasicCredential.
+    + String.raw `|\bBearer\s+[A-Za-z0-9+/._~-]{16,}={0,2}`, 
+// Case-insensitive: a lowercase `bearer ` or `akia…` is the same credential.
+"iu");
+/** Environment variable names whose values are treated as live credentials. */
+const CREDENTIAL_ENV_NAME = /(?:api.?key|credential|password|secret|token)/iu;
+/**
+ * Names whose value is provably a variable name or a filesystem location rather
+ * than a credential, mirroring the `env`/`path` carve-out that
+ * `secretBearingPointer` already applies to config pointers.
+ *
+ * Deliberately narrow. An earlier revision also excluded `_TOKENS`, `_NAME`,
+ * and `_URL`, which dropped genuine credential holders such as
+ * `SERVICE_API_TOKENS` and `SLACK_APP_TOKENS` from the scan — and because this
+ * helper is shared by security-sensitive persistence guards, so that weakened multiple surfaces
+ * at once. The residual cost is accepted and documented: a credential-named
+ * budget such as `..._KEEP_RECENT_TOKENS=8000` still makes the literal `8000`
+ * unstorable through `Remember`. Favouring a false rejection over a persisted
+ * credential is the intended trade here.
+ */
+const NON_CREDENTIAL_ENV_NAME = /(?:_ENV|_ENV_VAR|_PATH|_FILE|_DIR)$/iu;
+/**
+ * Shortest environment value worth matching.
+ *
+ * Deliberately low: a short PIN or numeric key is still a credential, and this
+ * guard is shared by other persistence checks, so raising it to reduce
+ * false positives would quietly widen what both surfaces let through. The
+ * name-based exclusion above is the targeted fix for operational settings.
+ */
+const MIN_KNOWN_SECRET_LENGTH = 4;
+/**
+ * Reject terminal and bidi control characters. Ordinary Unicode text and LF
+ * newlines stay intact; what goes is anything that could clear, overwrite, or
+ * visually reorder text an operator later reads.
+ */
+export function containsUnsafeReviewControl(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if ((codePoint <= 0x1f && codePoint !== 0x0a)
+            || (codePoint >= 0x7f && codePoint <= 0x9f)
+            || BIDI_CONTROL.test(character)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * HTTP Basic payloads are base64 of `user:password`, which can be as short as
+ * four characters and can contain non-UTF-8 legacy bytes. Decode the candidate
+ * instead: a real pair contains a colon and no control bytes, while prose that
+ * merely names the scheme ("Basic authentication") does not.
+ */
+const BASIC_SCHEME = /\bBasic\s+([A-Za-z0-9+/]{2,}={0,2})(?![A-Za-z0-9+/=])/giu;
+function containsBasicCredential(value) {
+    for (const match of value.matchAll(BASIC_SCHEME)) {
+        const payload = match[1];
+        if (payload === undefined)
+            continue;
+        const unpaddedPayload = payload.replace(/=+$/u, "");
+        if (unpaddedPayload.length % 4 === 1)
+            continue;
+        const bytes = Buffer.from(payload, "base64");
+        // Buffer's base64 decoder is intentionally permissive. Require a canonical
+        // round trip so malformed prose is never reinterpreted as a credential.
+        if (bytes.toString("base64").replace(/=+$/u, "") !== unpaddedPayload)
+            continue;
+        if (bytes.includes(0x3a)
+            && !bytes.some((byte) => byte <= 0x1f || byte === 0x7f))
+            return true;
+    }
+    return false;
+}
+/** Whether the text carries a value shaped like a well-known credential. */
+export function containsSecretLikeValue(value) {
+    // Callers outside Remember also use this guard. Fold compatibility
+    // characters here so no caller can accidentally scan a weaker raw form.
+    const normalized = value.normalize("NFKC");
+    return SECRET_LIKE_VALUE.test(normalized) || containsBasicCredential(normalized);
+}
+/**
+ * The live credential values this process actually holds, taken from
+ * environment variables whose NAME looks credential-bearing. Matching against
+ * these is exact rather than heuristic: it catches the agent echoing back a
+ * secret it was configured with, which no shape rule can promise.
+ */
+export function knownEnvironmentSecretValues(env) {
+    return Object.entries(env)
+        .filter(([name, value]) => CREDENTIAL_ENV_NAME.test(name)
+        && !NON_CREDENTIAL_ENV_NAME.test(name)
+        // Remember persists in NFKC form. Retain a value when either its raw or
+        // folded representation reaches the floor so compatibility ligatures
+        // cannot disappear from the configured-secret set before comparison.
+        && value !== undefined
+        && Math.max(value.length, value.normalize("NFKC").length) >= MIN_KNOWN_SECRET_LENGTH)
+        .map(([, value]) => value);
+}
+/**
+ * Whether the text contains any of this agent's own configured secret values.
+ *
+ * Both sides are NFKC-folded before comparison. Callers normalize the text they
+ * are about to store, so comparing it against a raw environment value would
+ * miss a credential that is itself configured in a compatibility form (a
+ * fullwidth password matches only once both sides agree on a domain).
+ */
+export function containsKnownSecretValue(value, secrets) {
+    const folded = value.normalize("NFKC");
+    return secrets.some((secret) => {
+        const foldedSecret = secret.normalize("NFKC");
+        return value.includes(secret)
+            || folded.includes(foldedSecret)
+            || folded.includes(secret)
+            || value.includes(foldedSecret);
+    });
+}
+//# sourceMappingURL=untrusted-text.js.map

package/dist/untrusted-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-text.js","sourceRoot":"","sources":["../src/untrusted-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC;IACE,mDAAmD;IACnD,MAAM,CAAC,GAAG,CAAA,uBAAuB;IACjC,2EAA2E;IAC3E,MAAM,CAAC,GAAG,CAAA,4BAA4B;IACtC,MAAM,CAAC,GAAG,CAAA,8BAA8B;IACxC,mCAAmC;IACnC,MAAM,CAAC,GAAG,CAAA,8BAA8B;IACxC,MAAM,CAAC,GAAG,CAAA,wBAAwB;IAClC,iEAAiE;IACjE,MAAM,CAAC,GAAG,CAAA,0BAA0B;IACpC,uBAAuB;IACvB,MAAM,CAAC,GAAG,CAAA,6BAA6B;CACxC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAClD,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;MACzE,MAAM,CAAC,GAAG,CAAA,0CAA0C;AACxD,6EAA6E;AAC7E,IAAI,CACL,CAAC;AAEF,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,iDAAiD,CAAC;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC5C,IACE,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;eACtC,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;eACxC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAC/B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAEhF,SAAS,uBAAuB,CAAC,KAAa;IAC5C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,eAAe;YAAE,SAAS;QAC/E,IACE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;eACjB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;YACvD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,mEAAmE;IACnE,wEAAwE;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAuC;IAClF,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACxB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;WAC3B,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;WAClE,KAAK,KAAK,SAAS;WACnB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC;SACtF,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,OAA0B;IAChF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;eACxB,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;eAC7B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;eACvB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web-command.d.ts

@@ -19,6 +19,7 @@ interface StartWebServerOptions {
     readonly host?: string;
     readonly port?: number;
     readonly theme?: WebTheme;
+    readonly name?: string;
     readonly registryDirs?: readonly string[];
     readonly stateDir?: string;
     readonly env?: Record<string, string | undefined>;
@@ -37,6 +38,7 @@ export interface RunWebCommandOptions {
     readonly host?: string;
     readonly port?: number;
     readonly theme?: string;
+    readonly name?: string;
     readonly loopback?: boolean;
     readonly follow?: boolean;
     readonly lines?: number;
@@ -87,6 +89,7 @@ export interface RunWebCommandDeps {
         stop(): void;
     };
     readonly homeDir?: string;
+    readonly systemd?: import("./systemd.js").SystemdDeps;
 }
 export interface TailscaleServeOwnership {
     readonly schema: typeof TAILSCALE_OWNERSHIP_SCHEMA;

package/dist/web-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-command.d.ts","sourceRoot":"","sources":["../src/web-command.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA4BhD,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EAGZ,yBAAyB,EAC1B,MAAM,cAAc,CAAC;AAetB,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAE9E,OAAO,EAAE,yCAAyC,EAAE,MAAM,wCAAwC,CAAC;AAEnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AASlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAGrC,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAGtE,QAAA,MAAM,0BAA0B,sCAAsC,CAAC;AAWvE,UAAU,eAAe;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAEhF,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;QACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,yCAAyC,CAAC;IACxF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,KACR,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAChG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAChC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC,EACjE,YAAY,EAAE,gCAAgC,KAC3C;QAAE,IAAI,IAAI,IAAI,CAAA;KAAE,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAsCD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,KAAK,oBAAoB,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClG;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;CACzC,CAAC;AAaN,MAAM,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEvC,wBAAgB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAEnD;AAED,wBAAgB,aAAa,IAAI,MAAM,CAiBtC;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAqoCD,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElE;AA0BD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAyH/B;AA6CD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc1F;AAyCD,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB9G;AAyDD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAM5F"}
+{"version":3,"file":"web-command.d.ts","sourceRoot":"","sources":["../src/web-command.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA4BhD,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EAGZ,yBAAyB,EAC1B,MAAM,cAAc,CAAC;AAetB,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAE9E,OAAO,EAAE,yCAAyC,EAAE,MAAM,wCAAwC,CAAC;AAEnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AASlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAGrC,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAGtE,QAAA,MAAM,0BAA0B,sCAAsC,CAAC;AAcvE,UAAU,eAAe;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAEhF,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;QACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,yCAAyC,CAAC;IACxF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,KACR,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAChG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAChC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC,EACjE,YAAY,EAAE,gCAAgC,KAC3C;QAAE,IAAI,IAAI,IAAI,CAAA;KAAE,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,WAAW,CAAC;CACvD;AAwCD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,KAAK,oBAAoB,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClG;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;CACzC,CAAC;AAaN,MAAM,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEvC,wBAAgB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAEnD;AAED,wBAAgB,aAAa,IAAI,MAAM,CAkBtC;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAsEjB;AAusCD,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElE;AA0BD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAyH/B;AA6CD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc1F;AAyCD,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB9G;AAyDD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAM5F"}

package/dist/web-command.js

@@ -37,6 +37,9 @@ const TAILSCALE_STATUS_RETRY_MS = 200;
 const WEB_PACKAGE_NAME = "@mono-agent/web";
 const WEB_THEMES = ["evergreen", "ocean", "plum", "terracotta"];
 const DEFAULT_WEB_THEME = "evergreen";
+// Mirrors WEB_CONSOLE_NAME_MAX_CHARACTERS in @mono-agent/web; declared locally so this
+// command keeps its type-only dependency on the lazily loaded web package.
+const WEB_CONSOLE_NAME_MAX_CHARACTERS = 80;
 export function webPaths(homeDir) {
     return managedWebPaths(homeDir);
 }
@@ -45,16 +48,17 @@ export function renderWebHelp() {
         "mono-agent web — always-on multi-agent web console",
         "",
         "  mono-agent web",
-        "  mono-agent web start [--host <addr> | --loopback] [--port <n>] [--theme <name>]",
-        "  mono-agent web restart [--host <addr> | --loopback] [--port <n>] [--theme <name>]",
+        "  mono-agent web start [--host <addr> | --loopback] [--port <n>] [--theme <name>] [--name <label>]",
+        "  mono-agent web restart [--host <addr> | --loopback] [--port <n>] [--theme <name>] [--name <label>]",
         "  mono-agent web stop | status",
         "  mono-agent web logs [--follow|-f] [--lines <n>]",
-        "  mono-agent web run [--host <addr> | --loopback] [--port <n>] [--theme <name>]",
+        "  mono-agent web run [--host <addr> | --loopback] [--port <n>] [--theme <name>] [--name <label>]",
         "  mono-agent web reset --all --yes",
         "",
         `Default bind: ${DEFAULT_WEB_HOST}:${String(DEFAULT_WEB_PORT)} (LAN/Tailnet reachable; no app login).`,
         `Themes: ${WEB_THEMES.join(", ")} (default: ${DEFAULT_WEB_THEME}).`,
-        "--loopback narrows the bind to 127.0.0.1. start/restart claim a free Tailscale Serve HTTPS port without replacing existing handlers.",
+        "--name sets the installed PWA label, browser tab title, and rail brand; --name - restores the hostname default.",
+        "--loopback narrows the bind to 127.0.0.1. macOS start/restart claim a free Tailscale Serve HTTPS port; Linux HTTPS routes are externally managed.",
         "",
     ].join("\n");
 }
@@ -74,6 +78,40 @@ export async function runWebCommand(options, deps = {}) {
         stdout.write(renderWebHelp());
         return 2;
     }
+    if ((deps.platform ?? process.platform) === "linux" && action !== "run" && action !== "reset") {
+        if (action === undefined)
+            stdout.write(renderWebHelp());
+        const { runSystemdWebCommand } = await import("./systemd-command.js");
+        const { isSystemdUserManagerUnavailable } = await import("./systemd.js");
+        try {
+            return await runSystemdWebCommand(options, {
+                ...deps.systemd,
+                ...(deps.homeDir === undefined ? {} : { homeDir: deps.homeDir }),
+                stdout, stderr,
+            });
+        }
+        catch (error) {
+            if (!isSystemdUserManagerUnavailable(error) || (action !== undefined && action !== "status"))
+                throw error;
+            if (action === undefined) {
+                await statusWeb(options, deps, false);
+                return 0;
+            }
+            return await statusWeb(options, deps, true);
+        }
+    }
+    if ((deps.platform ?? process.platform) === "linux" && action === "reset") {
+        const { withSystemdLock, SYSTEMD_WEB_IDENTITY } = await import("./systemd.js");
+        try {
+            return await withSystemdLock(SYSTEMD_WEB_IDENTITY, {
+                ...deps.systemd, ...(deps.homeDir === undefined ? {} : { homeDir: deps.homeDir }),
+            }, () => resetWeb(options, deps));
+        }
+        catch (error) {
+            stderr.write(ui.errorLine(`Linux web reset failed: ${errorMessage(error)}`));
+            return 1;
+        }
+    }
     if (action === undefined) {
         stdout.write(renderWebHelp());
         await statusWeb(options, deps, false);
@@ -108,9 +146,15 @@ function validateWebFlags(action, options) {
     if (options.theme !== undefined && !isWebTheme(options.theme)) {
         return `--theme must be one of: ${WEB_THEMES.join(", ")}.`;
     }
-    if ((options.host !== undefined || options.port !== undefined || options.theme !== undefined || options.loopback === true)
+    if (options.name !== undefined) {
+        const nameError = invalidWebConsoleName(options.name);
+        if (nameError !== undefined)
+            return nameError;
+    }
+    if ((options.host !== undefined || options.port !== undefined || options.theme !== undefined
+        || options.name !== undefined || options.loopback === true)
         && action !== "start" && action !== "restart" && action !== "run") {
-        return "--host, --port, --theme, and --loopback are only supported for web start, restart, or run.";
+        return "--host, --port, --theme, --name, and --loopback are only supported for web start, restart, or run.";
     }
     if ((options.follow === true || options.lines !== undefined) && action !== "logs") {
         return "--follow and --lines are only supported for mono-agent web logs.";
@@ -129,6 +173,7 @@ async function runWebForeground(options, deps) {
     const host = effectiveHost(options);
     const port = options.port ?? DEFAULT_WEB_PORT;
     const theme = selectedWebTheme(options.theme);
+    const consoleName = selectedWebConsoleName(options.name);
     const paths = webPaths(deps.homeDir);
     await (deps.prepareState ?? defaultPrepareWebState)({ stateDir: paths.stateDir, env: options.env });
     const registryDir = resolveGlobalTraceRegistryDir(options.env);
@@ -136,7 +181,15 @@ async function runWebForeground(options, deps) {
     let handle;
     try {
         const startServer = deps.startServer ?? defaultStartWebServer;
-        handle = await startServer({ host, port, theme, registryDirs: [registryDir], stateDir: paths.stateDir, env: options.env });
+        handle = await startServer({
+            host,
+            port,
+            theme,
+            ...(consoleName === undefined ? {} : { name: consoleName }),
+            registryDirs: [registryDir],
+            stateDir: paths.stateDir,
+            env: options.env,
+        });
     }
     catch (error) {
         stderr.write(ui.errorLine(`mono-agent web failed to start: ${errorMessage(error)}`));
@@ -242,6 +295,10 @@ async function startWebBackground(options, deps, restart) {
                 stderr.write(ui.errorLine(`mono-agent web is already managed by launchd; use \`mono-agent web restart --theme ${options.theme}\` to change its theme.`));
                 return 1;
             }
+            if (options.name !== undefined) {
+                stderr.write(ui.errorLine(`mono-agent web is already managed by launchd; use \`mono-agent web restart --name ${shellQuote(options.name)}\` to change its name.`));
+                return 1;
+            }
             if (helper.loaded) {
                 try {
                     const loadedHelper = await (deps.inspectMaintenanceService ?? launchdWebMaintenanceInfo)(launchctl, uid);
@@ -394,6 +451,7 @@ async function startWebBackground(options, deps, restart) {
         const host = effectiveHost(options, priorRecord?.host);
         const port = options.port ?? priorRecord?.port ?? DEFAULT_WEB_PORT;
         const theme = selectedWebTheme(options.theme, priorRecord?.theme);
+        const consoleName = selectedWebConsoleName(options.name, priorRecord?.name);
         if (existingPlist !== undefined) {
             try {
                 pendingMaintenanceIntent = await maintainStoppedWebLogsBeforePublication(paths, pendingMaintenanceIntent, deps.now ?? Date.now);
@@ -430,6 +488,7 @@ async function startWebBackground(options, deps, restart) {
             host,
             port,
             theme,
+            ...(consoleName === undefined ? {} : { name: consoleName }),
             updatedAt: new Date((deps.now ?? Date.now)()).toISOString(),
         };
         const plist = buildWebPlistXml({
@@ -440,6 +499,7 @@ async function startWebBackground(options, deps, restart) {
             host,
             port,
             theme,
+            ...(consoleName === undefined ? {} : { name: consoleName }),
             stdoutPath: paths.launchd.stdoutPath,
             stderrPath: paths.launchd.stderrPath,
             environment,
@@ -613,6 +673,7 @@ async function statusWeb(options, deps, strictExit) {
     const host = record?.host ?? DEFAULT_WEB_HOST;
     const port = record?.port ?? DEFAULT_WEB_PORT;
     const theme = record?.theme ?? DEFAULT_WEB_THEME;
+    const consoleName = record?.name;
     let service = { loaded: false };
     let helper = { loaded: false };
     if ((deps.platform ?? process.platform) === "darwin") {
@@ -719,6 +780,9 @@ async function statusWeb(options, deps, strictExit) {
                 : "stopped"],
         ["bind", recordRead.kind === "invalid" ? "invalid service record" : `${host}:${String(port)}`],
         ["theme", recordRead.kind === "invalid" ? "invalid service record" : theme],
+        ["name", recordRead.kind === "invalid"
+                ? "invalid service record"
+                : consoleName ?? "— (machine hostname)"],
         ["state", paths.stateDir],
         ["pid", service.pid === undefined ? "—" : String(service.pid)],
         ["log maintenance", maintenanceSummary],
@@ -773,6 +837,16 @@ async function resetWeb(options, deps) {
     const stderr = deps.stderr ?? process.stderr;
     const stdout = deps.stdout ?? process.stdout;
     const paths = webPaths(deps.homeDir);
+    if ((deps.platform ?? process.platform) === "linux") {
+        const { inspectSystemd, readSystemdDefinition, SYSTEMD_WEB_IDENTITY } = await import("./systemd.js");
+        const systemdDeps = { ...deps.systemd, ...(deps.homeDir === undefined ? {} : { homeDir: deps.homeDir }) };
+        const service = await inspectSystemd(SYSTEMD_WEB_IDENTITY, systemdDeps).catch(() => undefined);
+        const definition = await readSystemdDefinition(SYSTEMD_WEB_IDENTITY, systemdDeps);
+        if (definition !== undefined || (service?.pid ?? 0) > 0 || service?.activeState === "activating") {
+            stderr.write(ui.errorLine("Run mono-agent web stop before resetting the systemd console."));
+            return 1;
+        }
+    }
     if ((deps.platform ?? process.platform) === "darwin") {
         const launchctl = deps.launchctl ?? makeLaunchctlRunner();
         const uid = (deps.getuid ?? requiredUid)();
@@ -843,6 +917,35 @@ function selectedWebTheme(value, priorTheme) {
         return priorTheme ?? DEFAULT_WEB_THEME;
     return value;
 }
+/**
+ * Console label precedence: this invocation's flag, then the persisted record, then
+ * undefined so the worker falls back to the machine hostname. A single hyphen resets
+ * the persisted choice to that fallback.
+ */
+function selectedWebConsoleName(value, priorName) {
+    if (value === undefined)
+        return priorName;
+    const name = value.trim();
+    return name === "-" ? undefined : name;
+}
+/** Reject labels the manifest, launchd argv, or launcher cannot carry faithfully. */
+function invalidWebConsoleName(value) {
+    const name = value.trim();
+    if (name.length === 0)
+        return "--name must not be empty.";
+    if (/[\u0000-\u001f\u007f-\u009f\u2028-\u202e]/u.test(name)) {
+        return "--name must not contain control characters, line separators, or bidirectional overrides.";
+    }
+    if ([...name].length > WEB_CONSOLE_NAME_MAX_CHARACTERS) {
+        return `--name must be at most ${String(WEB_CONSOLE_NAME_MAX_CHARACTERS)} characters.`;
+    }
+    return undefined;
+}
+function shellQuote(value) {
+    if (/^[A-Za-z0-9_./:@%+=,-]+$/u.test(value))
+        return value;
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 async function ensureWebDirectories(paths) {
     for (const path of [
         dirname(paths.stateDir),
@@ -1556,6 +1659,8 @@ async function readServiceRecord(path) {
     if (!isRecord(value) || value.schema !== WEB_SERVICE_SCHEMA || typeof value.host !== "string"
         || !Number.isSafeInteger(value.port) || value.port < 1 || value.port > 65_535
         || (value.theme !== undefined && !isWebTheme(value.theme))
+        || (value.name !== undefined
+            && (typeof value.name !== "string" || invalidWebConsoleName(value.name) !== undefined))
         || typeof value.updatedAt !== "string") {
         return { kind: "invalid", detail: "the web service record has an invalid schema; repair or remove ~/.mono-agent/web/service.json" };
     }