@nowcrew/daemon 0.5.36 → 0.5.38

package/README.md

@@ -45,6 +45,11 @@ crew-daemon uninstall --profile work
 crew-daemon profile remove work
 ```
 
+`doctor` reports the native service, Agent root and execution journal plus managed-update diagnostics for
+the host registry, exact service identity, and installation lease. It is read-only: stale or corrupt lock
+state is reported but never acquired, repaired, or removed. Use these checks when the Web update action is
+hidden.
+
 Lifecycle installation is intentionally refused from an `npx`/temporary cache entry because the service
 must keep a stable executable path across cache cleanup and upgrades.
 
@@ -66,6 +71,12 @@ crew-daemon upgrade
 crew-daemon upgrade --profile work
 ```
 
+With `--profile`, upgrade validates isolation, stops the native service, acquires the installation lease,
+replaces only the entrypoint-derived npm prefix, releases the lease, and starts the service. If package
+replacement fails, it still attempts to start the previous installation. Without `--profile`, upgrade
+refuses to replace a prefix currently leased by a running daemon; use the profile form for a managed
+service.
+
 ## Managed Self-Update
 
 An owner or admin can update an eligible outdated daemon from the computer detail view. The HTTP request
@@ -76,10 +87,32 @@ only after the native service reconnects and reports that exact version.
 Existing installations need one manual bootstrap to a release containing managed self-update:
 
 ```bash
+# Default daemon home (~/.crew/daemon): upgrade, adopt the exact live descriptor, then reconnect.
 crew-daemon upgrade --profile work
+crew-daemon install --profile work
+crew-daemon restart --profile work
+crew-daemon doctor --profile work
 crew-daemon status --profile work
 ```
 
+For a non-default daemon home, the bootstrap release changes the native service ID to include the
+daemon-home fingerprint. Run the first command with the currently installed daemon: it upgrades and
+restarts the exact legacy service ID. Then use the upgraded CLI to migrate that profile instead of adopting
+the old ID:
+
+```bash
+CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon upgrade --profile work
+CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon uninstall --profile work
+CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon install --profile work
+CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon start --profile work
+CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon doctor --profile work
+CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon status --profile work
+```
+
+If migration is interrupted after `uninstall`, resume at `install` and `start`. If it is interrupted before
+`uninstall` completes, verify the exact legacy service with `status`, then repeat `uninstall`; identity checks
+prevent either path from removing a drifted descriptor.
+
 The daemon advertises `daemon_update_v1` only when all of these conditions hold:
 
 | Requirement | Supported shape |
@@ -87,18 +120,42 @@ The daemon advertises `daemon_update_v1` only when all of these conditions hold:
 | Platform | macOS LaunchAgent or Linux systemd user service |
 | Entrypoint | global `@nowcrew/daemon/dist/main.js`, not npx or source/tsx |
 | Startup | `crew-daemon serve --profile <name>` through the installed service |
-| Profiles | exactly one installed daemon service using the global package |
-| Service | the selected profile is currently running |
-| Install root | the current user can write the global npm modules root |
+| Registry | every NowCrew descriptor on the OS user account is registered and conflict-free |
+| Identity | service ID, descriptor, daemon home, Agent root, entrypoint, package root, and npm prefix match |
+| Service | the selected profile is running and holds the installation lease |
+| Install root | a standard writable Unix global npm prefix can be derived from the running entrypoint |
+
+Windows, npx/source runs, stopped or uninstalled services, legacy unregistered descriptors, shared roots,
+and read-only global package roots remain manually upgradeable. These shapes do not show an update button.
+For the default daemon home, `install` adopts only an exact legacy descriptor; the following restart makes
+the daemon reconnect and advertise the newly registered capability. A pre-namespace service in a non-default
+daemon home must be migrated with `uninstall` followed by `install`, because the new service ID includes the
+daemon-home fingerprint. A host that runs multiple environments can keep managed updates by isolating all
+three roots:
+
+| Environment | Agents root | Daemon home | npm prefix |
+| --- | --- | --- | --- |
+| in | `~/.crew/agents` | `~/.crew/daemon` | `~/.crew/daemon-runtimes/in` |
+| dev | `~/.crew/agents-dev` | `~/.crew/daemon-dev` | `~/.crew/daemon-runtimes/dev` |
 
-Windows, npx/source runs, stopped or uninstalled services, multiple installed profiles, and read-only
-global package roots remain manually upgradeable. These shapes do not show an update button.
+The host execution coordinator intentionally remains shared under `~/.crew/daemon/compute-execution`, so an
+update in either environment still refuses to run while any profile on the machine is executing Agent work.
+Managed service ownership and installation leases are shared under `~/.crew/daemon/managed-services`.
+Registry writes are private, atomic, schema-validated, and serialized across processes. Each non-default
+daemon home also contributes a stable hash to the native service ID, so equal profile names can coexist.
 
 Before replacing files, the daemon refuses new work, requires zero local active or queued work, and
 non-blockingly acquires every host execution slot. It then installs only the server-selected exact
-`x.y.z` version with npm, verifies the installed package version, and schedules the existing native
-service restart from a detached helper. No package name, registry, command, or free-form argument comes
-from the browser control message.
+`x.y.z` version with npm using the prefix derived from the running global entrypoint, verifies the installed
+package version, and schedules the existing native service restart from a detached helper. macOS uses
+`launchctl kickstart -k` to avoid the `bootout`/`bootstrap` race; Linux uses `systemctl --user --no-block
+restart`. The helper reports manager failure over IPC. A failed handoff releases both execution barriers and
+reports `restart_failed`; a SIGTERM/shutdown initiated by a successful handoff releases them during orderly
+shutdown. No package name, registry, command, or free-form argument comes from the browser control message.
+
+The release guard packs with pnpm so workspace dependencies become registry-compatible version ranges,
+rejects any runtime dependency that still uses `workspace:`, and installs the tarball into a clean npm
+prefix before a daemon version can be published.
 
 Failures are recoverable and keep a bounded code in the machine record:
 
@@ -117,11 +174,14 @@ Remote downgrade is intentionally unsupported. To roll back, install a known exa
 the service manually:
 
 ```bash
-npm install --global --ignore-scripts --no-audit --no-fund @nowcrew/daemon@<previous-x.y.z>
+npm install --global --prefix <environment-prefix> --ignore-scripts --no-audit --no-fund @nowcrew/daemon@<previous-x.y.z>
 crew-daemon restart --profile work
 crew-daemon status --profile work
 ```
 
+Use the `npmPrefix` reported by `crew-daemon doctor --profile work`; do not rely on the interactive shell's
+current global npm configuration on a multi-environment host.
+
 ## Execution Boundary
 
 The server selects the machine and sends a validated `execution:start` containing:

package/dist/computer-cli.js

@@ -3,10 +3,15 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertProfileAgentsRootUnique, daemonHome, inspectProfileAgentsRoot, listProfiles, loadProfile, PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, ProfileAgentsRootConflictError, profileIsPrivate, profilePath, publicProfile, removeProfile, resolveAgentsRoot, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
-import { buildServiceSpec, doctorService, hardenWindowsProfile, installService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, upgradeDaemon, windowsProfileIsPrivate, } from "./computer-service.js";
+import { buildServiceSpec, doctorService, hardenWindowsProfile, installService, readServiceDescriptor, serviceAction, serviceStatus, systemCommandRunner, uninstallService, upgradeDaemon, windowsProfileIsPrivate, } from "./computer-service.js";
 import { defaultProcessController } from "./execution-journal.js";
 import { inspectJournalLock } from "./execution-journal-lock.js";
 import { detectDaemonLang, formatDaemonText } from "./i18n.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { acquireDaemonInstallationLease, } from "./daemon-installation-lease.js";
+import { assertManagedServiceIdentity, buildManagedServiceRecord, installManagedService, uninstallUnregisteredManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
+import { inspectManagedServiceDiagnostics } from "./managed-service-diagnostics.js";
+import { readManagedServiceRegistry } from "./managed-service-registry.js";
 const COMPUTER_COMMANDS = new Set(["profile", "doctor", "install", "uninstall", "start", "stop", "restart", "status", "upgrade"]);
 export function builtDaemonEntry(moduleUrl = import.meta.url) {
     return moduleUrl.endsWith(".js")
@@ -31,6 +36,7 @@ function defaults() {
             }
             return result.stdout.trim();
         },
+        acquireInstallationLease: acquireDaemonInstallationLease,
         readStdin: async () => {
             if (process.stdin.isTTY)
                 throw new Error("--token-stdin requires a token on standard input");
@@ -153,6 +159,7 @@ export async function runComputerCommand(argv, overrides = {}) {
         }
         const profileName = parsed.values.profile;
         if (command === "upgrade") {
+            const installation = daemonGlobalInstallation(deps.entryPath, deps.platform);
             const restartProfile = profileName
                 ? await loadProfile(profileName, home, profileStorage)
                 : null;
@@ -163,29 +170,61 @@ export async function runComputerCommand(argv, overrides = {}) {
                     profileHome: home,
                 })
                 : null;
-            if (spec) {
-                if (!isGlobalDaemonEntry(deps.entryPath, await deps.resolveGlobalNodeModules())) {
+            if (spec && restartProfile) {
+                if (installation === null && !isGlobalDaemonEntry(deps.entryPath, await deps.resolveGlobalNodeModules())) {
                     throw new Error(td("Service lifecycle requires a global @nowcrew/daemon install; run npm install --global @nowcrew/daemon@latest"));
                 }
                 const before = await serviceStatus(spec, deps.runner);
                 if (!before.installed)
                     throw new Error(td("Service '{{id}}' is not installed", { id: spec.id }));
-            }
-            await upgradeDaemon(deps.platform, deps.runner);
-            if (restartProfile) {
                 try {
                     await assertProfileAgentsRootUnique(restartProfile, home, deps.userHome, profileStorage);
                 }
                 catch (error) {
                     if (!(error instanceof ProfileAgentsRootConflictError))
                         throw error;
-                    deps.stdout(`${td("Upgraded daemon but skipped restart for '{{name}}': {{reason}}", { name: restartProfile.name, reason: translatedError(error, td) })}\n`);
-                    return 0;
+                    throw new Error(td("Refused daemon upgrade for '{{name}}': {{reason}}", { name: restartProfile.name, reason: translatedError(error, td) }));
+                }
+                await serviceAction(spec, "stop", deps.runner);
+            }
+            let upgradeError;
+            let installationLease = null;
+            try {
+                installationLease = installation === null
+                    ? null
+                    : await deps.acquireInstallationLease(installation.npmPrefix, { userHome: deps.userHome });
+                await upgradeDaemon(deps.platform, deps.runner, installation?.npmPrefix);
+            }
+            catch (error) {
+                upgradeError = error;
+            }
+            finally {
+                try {
+                    await installationLease?.close();
+                }
+                catch (error) {
+                    upgradeError = upgradeError === undefined
+                        ? error
+                        : new Error(`${upgradeError.message}; installation lease release failed: ${error.message}`, { cause: upgradeError });
+                }
+            }
+            if (restartProfile) {
+                try {
+                    await serviceAction(spec, "start", deps.runner);
+                }
+                catch (restartError) {
+                    if (upgradeError !== undefined) {
+                        throw new Error(`${upgradeError.message}; service recovery failed: ${restartError.message}`, { cause: upgradeError });
+                    }
+                    throw restartError;
                 }
-                await serviceAction(spec, "restart", deps.runner);
+                if (upgradeError !== undefined)
+                    throw upgradeError;
                 deps.stdout(`${td("Upgraded daemon and restart request accepted for '{{name}}'. Verify with status.", { name: restartProfile.name })}\n`);
             }
             else {
+                if (upgradeError !== undefined)
+                    throw upgradeError;
                 deps.stdout(`${td("Upgraded daemon. Installed services were not restarted; pass --profile to restart one.")}\n`);
             }
             return 0;
@@ -201,20 +240,93 @@ export async function runComputerCommand(argv, overrides = {}) {
         const spec = buildServiceSpec({
             ...deps, profile: name, profileHome: home,
         });
+        const installation = daemonGlobalInstallation(deps.entryPath, deps.platform);
+        const managedRecord = installation !== null && spec.platform !== "win32"
+            ? buildManagedServiceRecord({
+                spec,
+                daemonHome: home,
+                agentsRoot: resolveAgentsRoot(profile.agentsRoot, deps.userHome, deps.platform),
+                nodePath: deps.nodePath,
+                entryPath: deps.entryPath,
+                ...installation,
+            })
+            : null;
         if (command === "install") {
-            if (!isGlobalDaemonEntry(deps.entryPath, await deps.resolveGlobalNodeModules())) {
+            if (installation === null && !isGlobalDaemonEntry(deps.entryPath, await deps.resolveGlobalNodeModules())) {
                 throw new Error(td("Service lifecycle requires a global @nowcrew/daemon install; run npm install --global @nowcrew/daemon@latest"));
             }
-            await installService(spec, deps.runner);
+            if (managedRecord === null)
+                await installService(spec, deps.runner);
+            else
+                await installManagedService({
+                    spec,
+                    record: managedRecord,
+                    runner: deps.runner,
+                    registry: { userHome: deps.userHome },
+                });
             deps.stdout(`${td("Installed '{{id}}'. Use status to confirm runtime state.", { id: spec.id })}\n`);
             return 0;
         }
         if (command === "uninstall") {
-            await uninstallService(spec, deps.runner);
+            if (managedRecord === null)
+                await uninstallService(spec, deps.runner);
+            else {
+                const current = (await readManagedServiceRegistry({ userHome: deps.userHome })).find((record) => record.serviceId === spec.id
+                    && record.daemonHome === managedRecord.daemonHome
+                    && record.profile === name);
+                if (current === undefined) {
+                    const descriptor = await readServiceDescriptor(spec);
+                    if (descriptor !== null) {
+                        await uninstallUnregisteredManagedService({
+                            spec,
+                            daemonHome: home,
+                            npmPrefix: installation.npmPrefix,
+                            runner: deps.runner,
+                            registry: { userHome: deps.userHome },
+                            acquireInstallationLease: deps.acquireInstallationLease,
+                        });
+                    }
+                    else {
+                        const legacySpec = buildServiceSpec({
+                            ...deps,
+                            profile: name,
+                            profileHome: home,
+                            legacyServiceId: true,
+                        });
+                        const legacyDescriptor = await readServiceDescriptor(legacySpec);
+                        if (legacyDescriptor === null) {
+                            throw new Error(`Managed service '${spec.id}' is not registered and no exact legacy descriptor exists`);
+                        }
+                        await uninstallUnregisteredManagedService({
+                            spec: legacySpec,
+                            daemonHome: home,
+                            npmPrefix: installation.npmPrefix,
+                            runner: deps.runner,
+                            registry: { userHome: deps.userHome },
+                            acquireInstallationLease: deps.acquireInstallationLease,
+                        });
+                    }
+                }
+                else {
+                    await uninstallManagedService({
+                        spec,
+                        record: current,
+                        runner: deps.runner,
+                        registry: { userHome: deps.userHome },
+                    });
+                }
+            }
             deps.stdout(`${td("Uninstalled '{{id}}'.", { id: spec.id })}\n`);
             return 0;
         }
         if (command === "start" || command === "stop" || command === "restart") {
+            if (command !== "stop" && managedRecord !== null) {
+                await assertManagedServiceIdentity({
+                    spec,
+                    record: managedRecord,
+                    registry: { userHome: deps.userHome },
+                });
+            }
             await serviceAction(spec, command, deps.runner);
             deps.stdout(`${td("{{action}} request accepted for '{{id}}'. Verify with status.", {
                 action: command,
@@ -238,6 +350,13 @@ export async function runComputerCommand(argv, overrides = {}) {
                 directory: journalPath,
                 inspectIdentity: defaultProcessController.inspectIdentity,
             });
+            const managedService = managedRecord === null
+                ? null
+                : await inspectManagedServiceDiagnostics({
+                    spec,
+                    expectedRecord: managedRecord,
+                    registry: { userHome: deps.userHome },
+                });
             const checks = [
                 ...serviceChecks,
                 {
@@ -252,6 +371,7 @@ export async function runComputerCommand(argv, overrides = {}) {
                     ok: journalLock.status === "unlocked" || journalLock.status === "owned",
                     detail: journalLock.detail,
                 },
+                ...(managedService?.checks ?? []),
             ];
             const registered = (await serviceStatus(spec, deps.runner)).installed;
             deps.stdout(`${JSON.stringify({
@@ -259,6 +379,7 @@ export async function runComputerCommand(argv, overrides = {}) {
                 journalPath,
                 duplicateProfiles: rootInspection.duplicateProfiles,
                 journalLock,
+                managedService,
                 checks,
                 registered,
             }, null, 2)}\n`);

package/dist/computer-service.js

@@ -1,7 +1,7 @@
-import { access, chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { access, chmod, mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import { constants } from "node:fs";
 import { execFile, spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { promisify } from "node:util";
 import { dirname, resolve } from "node:path";
 const execFileAsync = promisify(execFile);
@@ -21,6 +21,11 @@ export const systemCommandRunner = async (command, args) => {
         };
     }
 };
+function serviceIdentitySuffix(profileHome, userHome) {
+    if (profileHome === undefined || resolve(profileHome) === resolve(userHome, ".crew", "daemon"))
+        return "";
+    return `.${createHash("sha256").update(resolve(profileHome)).digest("hex").slice(0, 12)}`;
+}
 function assertSingleLine(value, field) {
     if (value.includes("\n") || value.includes("\r") || value.includes("\0")) {
         throw new Error(`${field} must not contain control characters`);
@@ -51,10 +56,13 @@ export function buildServiceSpec(input) {
         assertSingleLine(profile, "profile"),
         ...(input.profileHome ? ["--daemon-home", assertSingleLine(input.profileHome, "daemon home")] : []),
     ];
+    const identitySuffix = input.legacyServiceId === true
+        ? ""
+        : serviceIdentitySuffix(input.profileHome, userHome);
     if (platform === "darwin") {
         if (input.uid === undefined)
             throw new Error("Cannot install launchd service without a numeric uid");
-        const id = `com.nowcrew.daemon.${profile}`;
+        const id = `com.nowcrew.daemon.${profile}${identitySuffix}`;
         const args = daemonCommand.map((arg) => `      <string>${xml(arg)}</string>`).join("\n");
         return {
             platform,
@@ -67,7 +75,7 @@ export function buildServiceSpec(input) {
         };
     }
     if (platform === "linux") {
-        const id = `nowcrew-daemon-${profile}.service`;
+        const id = `nowcrew-daemon-${profile}${identitySuffix}.service`;
         return {
             platform,
             profile,
@@ -78,7 +86,7 @@ export function buildServiceSpec(input) {
             descriptor: `[Unit]\nDescription=NowCrew daemon (${profile})\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${daemonCommand.map(systemdArg).join(" ")}\nRestart=on-failure\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`,
         };
     }
-    const id = `NowCrew Daemon (${profile})`;
+    const id = `NowCrew Daemon (${profile}${identitySuffix})`;
     return { platform, profile, id, descriptorPath: null, descriptor: null, daemonCommand, managerDomain: null };
 }
 async function pathExists(path) {
@@ -93,15 +101,31 @@ async function pathExists(path) {
     }
 }
 async function writePrivateAtomic(path, content) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await chmod(dirname(path), 0o700);
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
     const temporary = `${path}.${randomUUID()}.tmp`;
+    let handle = null;
     try {
-        await writeFile(temporary, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        handle = await open(temporary, "wx", 0o600);
+        await handle.writeFile(content, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = null;
         await rename(temporary, path);
         await chmod(path, 0o600);
+        if (process.platform !== "win32") {
+            const directoryHandle = await open(directory, "r");
+            try {
+                await directoryHandle.sync();
+            }
+            finally {
+                await directoryHandle.close();
+            }
+        }
     }
     finally {
+        await handle?.close().catch(() => undefined);
         await rm(temporary, { force: true });
     }
 }
@@ -200,6 +224,15 @@ export async function installService(spec, runner = systemCommandRunner) {
         throw error;
     }
 }
+export async function ensureServiceEnabled(spec, runner = systemCommandRunner) {
+    if (spec.platform === "linux") {
+        if (spec.descriptorPath === null || !await pathExists(spec.descriptorPath)) {
+            throw new Error(`Service '${spec.id}' is not installed`);
+        }
+        await checked(runner, "systemctl", ["--user", "daemon-reload"], "systemd reload");
+        await checked(runner, "systemctl", ["--user", "enable", spec.id], "systemd enable");
+    }
+}
 export async function uninstallService(spec, runner = systemCommandRunner) {
     if (spec.platform === "win32") {
         const task = await windowsTaskState(spec, runner);
@@ -249,8 +282,9 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
         }
         else {
             if (status.loaded)
-                await checked(runner, "launchctl", ["bootout", target], "launchd stop");
-            await checked(runner, "launchctl", ["bootstrap", spec.managerDomain, spec.descriptorPath], "launchd start");
+                await checked(runner, "launchctl", ["kickstart", "-k", target], "launchd restart");
+            else
+                await checked(runner, "launchctl", ["bootstrap", spec.managerDomain, spec.descriptorPath], "launchd restart");
         }
     }
     else if (spec.platform === "linux") {
@@ -273,20 +307,25 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
         }
     }
 }
+const systemDetachedSpawn = (command, args, options) => spawn(command, [...args], options);
 const RESTART_HELPER_SOURCE = String.raw `
 const { spawnSync } = require("node:child_process");
 const spec = JSON.parse(process.argv[1]);
 setTimeout(() => {
+  let restarted;
   if (spec.platform === "darwin") {
-    spawnSync("launchctl", ["bootout", spec.target], { stdio: "ignore", shell: false });
-    const started = spawnSync("launchctl", ["bootstrap", spec.domain, spec.descriptorPath], { stdio: "ignore", shell: false });
-    process.exit(started.status === 0 ? 0 : 1);
+    restarted = spawnSync("launchctl", ["kickstart", "-k", spec.target], { stdio: "ignore", shell: false });
+  } else {
+    restarted = spawnSync("systemctl", ["--user", "--no-block", "restart", spec.id], { stdio: "ignore", shell: false });
   }
-  const restarted = spawnSync("systemctl", ["--user", "restart", spec.id], { stdio: "ignore", shell: false });
-  process.exit(restarted.status === 0 ? 0 : 1);
+  if (restarted.status !== 0) process.send?.({ type: "restart-failed", status: restarted.status });
+  setTimeout(() => {
+    process.send?.({ type: "restart-failed", status: "daemon-still-running" });
+    process.exit(1);
+  }, 10000);
 }, 250);
 `;
-export function scheduleServiceRestart(spec, spawnDetached = spawn) {
+export function scheduleServiceRestart(spec, spawnDetached = systemDetachedSpawn) {
     if (spec.platform === "win32")
         throw new Error("Windows detached restart is not supported");
     if (spec.descriptorPath === null)
@@ -295,12 +334,30 @@ export function scheduleServiceRestart(spec, spawnDetached = spawn) {
         ? {
             platform: spec.platform,
             target: `${spec.managerDomain}/${spec.id}`,
-            domain: spec.managerDomain,
-            descriptorPath: spec.descriptorPath,
         }
         : { platform: spec.platform, id: spec.id };
-    const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: "ignore", shell: false });
+    const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"], shell: false });
     child.unref();
+    let settleFailure;
+    const failed = new Promise((resolveFailure) => { settleFailure = resolveFailure; });
+    let reported = false;
+    const reportFailure = (error) => {
+        if (reported)
+            return;
+        reported = true;
+        settleFailure(error);
+    };
+    child.on("message", (message) => {
+        if (message && typeof message === "object" && "type" in message && message.type === "restart-failed") {
+            reportFailure(new Error("Detached service restart failed"));
+        }
+    });
+    child.on("error", (error) => reportFailure(error));
+    child.on("exit", (code, signal) => {
+        reportFailure(new Error(`Detached service restart helper exited before daemon shutdown (${signal ?? code ?? "unknown"})`));
+    });
+    child.channel?.unref();
+    return { failed };
 }
 export async function serviceStatus(spec, runner = systemCommandRunner) {
     if (spec.platform === "win32") {
@@ -337,11 +394,19 @@ export async function doctorService(spec, profilePrivate, runner = systemCommand
         { name: "service-running", ok: status.running === true, detail: status.running ? "running" : "not running" },
     ];
 }
-export function buildUpgradeCommand(platform) {
-    return [platform === "win32" ? "npm.cmd" : "npm", ["install", "--global", "@nowcrew/daemon@latest"]];
+export function buildUpgradeCommand(platform, npmPrefix) {
+    return [
+        platform === "win32" ? "npm.cmd" : "npm",
+        [
+            "install",
+            "--global",
+            ...(npmPrefix === undefined ? [] : ["--prefix", npmPrefix]),
+            "@nowcrew/daemon@latest",
+        ],
+    ];
 }
-export async function upgradeDaemon(platform, runner = systemCommandRunner) {
-    const [command, args] = buildUpgradeCommand(platform);
+export async function upgradeDaemon(platform, runner = systemCommandRunner, npmPrefix) {
+    const [command, args] = buildUpgradeCommand(platform, npmPrefix);
     await checked(runner, command, args, "Daemon upgrade");
 }
 const WINDOWS_SID_SCRIPT = "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value";

package/dist/daemon-installation-lease.js

@@ -0,0 +1,86 @@
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { mkdir, open } from "node:fs/promises";
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { defaultProcessController } from "./execution-journal.js";
+import { createJournalLease, createJournalLeaseRegistry, inspectJournalLock, } from "./execution-journal-lock.js";
+const registry = createJournalLeaseRegistry();
+const heldPrefixes = new Map();
+function canonicalPrefix(npmPrefix) {
+    const absolute = resolve(npmPrefix);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        return absolute;
+    }
+}
+function leaseDirectory(npmPrefix, userHome) {
+    const fingerprint = createHash("sha256").update(resolve(npmPrefix)).digest("hex");
+    return resolve(userHome, ".crew", "daemon", "managed-services", "installation-leases", fingerprint);
+}
+async function syncDirectory(path) {
+    if (process.platform === "win32")
+        return;
+    const handle = await open(path, "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function acquireDaemonInstallationLease(npmPrefix, options = {}) {
+    const normalizedPrefix = canonicalPrefix(npmPrefix);
+    const directory = leaseDirectory(normalizedPrefix, options.userHome ?? homedir());
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const lease = createJournalLease({
+        directory,
+        currentPid: options.currentPid ?? process.pid,
+        captureCurrentIdentity: options.captureCurrentIdentity
+            ?? (async () => {
+                const identity = await defaultProcessController.inspectIdentity(process.pid);
+                if (identity === null)
+                    throw new Error("Failed to capture daemon installation lease identity");
+                return identity;
+            }),
+        inspectIdentity: options.inspectIdentity ?? defaultProcessController.inspectIdentity,
+        syncDirectory,
+        registry: options.registry ?? registry,
+    });
+    await lease.acquire();
+    heldPrefixes.set(normalizedPrefix, (heldPrefixes.get(normalizedPrefix) ?? 0) + 1);
+    let closed = false;
+    return {
+        npmPrefix: normalizedPrefix,
+        close: async () => {
+            if (closed)
+                return;
+            await lease.close();
+            const remaining = (heldPrefixes.get(normalizedPrefix) ?? 1) - 1;
+            if (remaining <= 0)
+                heldPrefixes.delete(normalizedPrefix);
+            else
+                heldPrefixes.set(normalizedPrefix, remaining);
+            closed = true;
+        },
+    };
+}
+export function daemonInstallationLeaseHeld(npmPrefix) {
+    return (heldPrefixes.get(canonicalPrefix(npmPrefix)) ?? 0) > 0;
+}
+export async function inspectDaemonInstallationLease(npmPrefix, options = {}) {
+    const normalizedPrefix = canonicalPrefix(npmPrefix);
+    return inspectJournalLock({
+        directory: leaseDirectory(normalizedPrefix, options.userHome ?? homedir()),
+        inspectIdentity: options.inspectIdentity ?? defaultProcessController.inspectIdentity,
+    });
+}
+export async function runWithDaemonInstallationLease(lease, lifecycle) {
+    const result = await lifecycle();
+    await lease?.close();
+    return result;
+}