@pellux/goodvibes-sdk 0.38.0 → 1.1.0

package/dist/platform/daemon/http/webui-serving.d.ts

@@ -0,0 +1,68 @@
+/**
+ * webui-serving.ts
+ *
+ * Two opt-in capabilities that let a browser-hosted web UI reach the daemon:
+ *
+ *   1. Same-origin bundle serving (PRIMARY). When `controlPlane.webui.serve` is
+ *      on, the daemon serves a configured build directory at `/` so the bundle
+ *      and the API share an origin — the browser's same-origin policy is then a
+ *      non-issue. This is wire-compatible with `tailscale serve`, which fronts
+ *      the single daemon origin over HTTPS: bundle + API arrive same-origin.
+ *      The bundle is public (served without a token); the app itself
+ *      token-authenticates its API calls, so no wire data leaks from serving
+ *      static files.
+ *
+ *   2. Cross-origin request support (SECONDARY). When `controlPlane.cors.enabled`
+ *      is on, OPTIONS preflight is answered and Access-Control-Allow-* headers
+ *      are emitted ONLY for origins on the explicit `controlPlane.cors.allowedOrigins`
+ *      allowlist (the Vite dev server, a deliberately separate origin, etc.).
+ *      There is no wildcard: the matched origin is echoed back, credentials are
+ *      allowlist-gated, and `Vary: Origin` is always set so caches stay correct.
+ *
+ * BOTH default OFF. With both off the daemon behaves exactly as before: no bundle
+ * is served and no Access-Control-Allow-Origin is ever emitted. The loopback
+ * default posture is unchanged; these capabilities are explicit opt-ins, never
+ * auto-enabled by network host mode.
+ */
+import type { ConfigManager } from '../../config/manager.js';
+/** Resolved, per-request view of the two opt-in serving capabilities. */
+export interface WebuiServingPosture {
+    /** True when the daemon should serve the configured bundle directory at `/`. */
+    readonly serveBundle: boolean;
+    /** Absolute or working-dir-relative bundle directory; empty string when unset. */
+    readonly bundleDir: string;
+    /** Cross-origin request support (OPTIONS preflight + Access-Control-Allow-*). */
+    readonly cors: {
+        readonly enabled: boolean;
+        /** Explicit origin allowlist. Never wildcarded; empty means "refuse every origin". */
+        readonly allowedOrigins: readonly string[];
+    };
+    /** OpenAI-compatible path prefix (reserved so bundle serving never shadows it). */
+    readonly openaiPathPrefix: string;
+}
+/** Read the current serving posture from config. Cheap; called per request. */
+export declare function resolveWebuiServingPosture(configManager: ConfigManager): WebuiServingPosture;
+/**
+ * Answer a CORS preflight (OPTIONS). Emits Access-Control-Allow-* only for an
+ * allowlisted origin; a non-allowlisted origin is refused honestly (403, no
+ * Access-Control-Allow-Origin) so the browser preflight fails cleanly.
+ */
+export declare function handleCorsPreflight(req: Request, posture: WebuiServingPosture): Response;
+/**
+ * Decorate an actual (non-preflight) response with CORS headers when the request
+ * carries an allowlisted Origin. `Vary: Origin` is always added while CORS is
+ * enabled so caches never serve an allow-origin to the wrong origin. A
+ * non-allowlisted origin gets Vary but NO Access-Control-Allow-Origin — the
+ * browser then blocks the read honestly.
+ */
+export declare function applyCorsHeaders(req: Request, response: Response, posture: WebuiServingPosture): Response;
+/**
+ * Serve a file from the configured bundle directory, with SPA fallback to
+ * index.html for navigation routes. Returns null when serving is disabled, the
+ * request is not a GET/HEAD, or the path is a reserved API route — in every
+ * "null" case the caller continues with normal daemon routing, so behavior is
+ * unchanged when the capability is off. Path traversal outside the bundle
+ * directory is refused with 403.
+ */
+export declare function serveWebuiBundle(req: Request, posture: WebuiServingPosture): Promise<Response | null>;
+//# sourceMappingURL=webui-serving.d.ts.map

package/dist/platform/daemon/http/webui-serving.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webui-serving.d.ts","sourceRoot":"","sources":["../../../../src/platform/daemon/http/webui-serving.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG7D,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,sFAAsF;QACtF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5C,CAAC;IACF,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAOD,+EAA+E;AAC/E,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,aAAa,GAAG,mBAAmB,CAY5F;AAmBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,QAAQ,CA8BxF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,QAAQ,CAUzG;AA+ED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuC3G"}

package/dist/platform/daemon/http/webui-serving.js

@@ -0,0 +1,230 @@
+/**
+ * webui-serving.ts
+ *
+ * Two opt-in capabilities that let a browser-hosted web UI reach the daemon:
+ *
+ *   1. Same-origin bundle serving (PRIMARY). When `controlPlane.webui.serve` is
+ *      on, the daemon serves a configured build directory at `/` so the bundle
+ *      and the API share an origin — the browser's same-origin policy is then a
+ *      non-issue. This is wire-compatible with `tailscale serve`, which fronts
+ *      the single daemon origin over HTTPS: bundle + API arrive same-origin.
+ *      The bundle is public (served without a token); the app itself
+ *      token-authenticates its API calls, so no wire data leaks from serving
+ *      static files.
+ *
+ *   2. Cross-origin request support (SECONDARY). When `controlPlane.cors.enabled`
+ *      is on, OPTIONS preflight is answered and Access-Control-Allow-* headers
+ *      are emitted ONLY for origins on the explicit `controlPlane.cors.allowedOrigins`
+ *      allowlist (the Vite dev server, a deliberately separate origin, etc.).
+ *      There is no wildcard: the matched origin is echoed back, credentials are
+ *      allowlist-gated, and `Vary: Origin` is always set so caches stay correct.
+ *
+ * BOTH default OFF. With both off the daemon behaves exactly as before: no bundle
+ * is served and no Access-Control-Allow-Origin is ever emitted. The loopback
+ * default posture is unchanged; these capabilities are explicit opt-ins, never
+ * auto-enabled by network host mode.
+ */
+import { resolve, sep } from 'node:path';
+import { readStringList } from '../helpers.js';
+function readConfig(configManager, key) {
+    const getter = configManager.get;
+    return typeof getter === 'function' ? getter.call(configManager, key) : undefined;
+}
+/** Read the current serving posture from config. Cheap; called per request. */
+export function resolveWebuiServingPosture(configManager) {
+    const serveBundle = readConfig(configManager, 'controlPlane.webui.serve') === true;
+    const bundleDirRaw = readConfig(configManager, 'controlPlane.webui.bundleDir');
+    const corsEnabled = readConfig(configManager, 'controlPlane.cors.enabled') === true;
+    const allowedOrigins = readStringList(readConfig(configManager, 'controlPlane.cors.allowedOrigins')) ?? [];
+    const openaiPrefixRaw = readConfig(configManager, 'controlPlane.openaiCompatible.pathPrefix');
+    return {
+        serveBundle,
+        bundleDir: typeof bundleDirRaw === 'string' ? bundleDirRaw.trim() : '',
+        cors: { enabled: corsEnabled, allowedOrigins },
+        openaiPathPrefix: typeof openaiPrefixRaw === 'string' && openaiPrefixRaw.trim() ? openaiPrefixRaw.trim() : '/v1',
+    };
+}
+// ---------------------------------------------------------------------------
+// CORS (secondary path)
+// ---------------------------------------------------------------------------
+/** Append a token to an existing Vary header without duplicating it. */
+function appendVary(existing, token) {
+    if (!existing)
+        return token;
+    const parts = existing.split(',').map((p) => p.trim()).filter(Boolean);
+    if (parts.some((p) => p.toLowerCase() === token.toLowerCase()))
+        return existing;
+    return [...parts, token].join(', ');
+}
+/** True when the origin is on the explicit allowlist (exact match, no wildcard). */
+function isOriginAllowed(origin, allowlist) {
+    return allowlist.includes(origin);
+}
+/**
+ * Answer a CORS preflight (OPTIONS). Emits Access-Control-Allow-* only for an
+ * allowlisted origin; a non-allowlisted origin is refused honestly (403, no
+ * Access-Control-Allow-Origin) so the browser preflight fails cleanly.
+ */
+export function handleCorsPreflight(req, posture) {
+    const origin = req.headers.get('origin');
+    // A preflight with no Origin is not a browser CORS preflight — answer 204 with
+    // no allow-origin (nothing to grant); never emit a wildcard.
+    if (origin === null) {
+        return new Response(null, { status: 204, headers: { Vary: 'Origin' } });
+    }
+    if (!isOriginAllowed(origin, posture.cors.allowedOrigins)) {
+        return Response.json({ error: 'ORIGIN_NOT_ALLOWED', code: 'ORIGIN_NOT_ALLOWED', message: 'Origin is not on controlPlane.cors.allowedOrigins.' }, { status: 403, headers: { Vary: 'Origin' } });
+    }
+    // Echo the requested headers when present, otherwise a safe default that always
+    // includes Authorization so the bearer-token API flow works cross-origin.
+    const requestedHeaders = req.headers.get('access-control-request-headers');
+    const allowHeaders = requestedHeaders && requestedHeaders.trim()
+        ? requestedHeaders
+        : 'Authorization, Content-Type';
+    return new Response(null, {
+        status: 204,
+        headers: {
+            'Access-Control-Allow-Origin': origin,
+            'Access-Control-Allow-Credentials': 'true',
+            'Access-Control-Allow-Methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
+            'Access-Control-Allow-Headers': allowHeaders,
+            'Access-Control-Max-Age': '600',
+            Vary: 'Origin',
+        },
+    });
+}
+/**
+ * Decorate an actual (non-preflight) response with CORS headers when the request
+ * carries an allowlisted Origin. `Vary: Origin` is always added while CORS is
+ * enabled so caches never serve an allow-origin to the wrong origin. A
+ * non-allowlisted origin gets Vary but NO Access-Control-Allow-Origin — the
+ * browser then blocks the read honestly.
+ */
+export function applyCorsHeaders(req, response, posture) {
+    const origin = req.headers.get('origin');
+    if (origin === null)
+        return response;
+    const headers = new Headers(response.headers);
+    headers.set('Vary', appendVary(headers.get('Vary'), 'Origin'));
+    if (isOriginAllowed(origin, posture.cors.allowedOrigins)) {
+        headers.set('Access-Control-Allow-Origin', origin);
+        headers.set('Access-Control-Allow-Credentials', 'true');
+    }
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+// ---------------------------------------------------------------------------
+// Static bundle serving (primary path)
+// ---------------------------------------------------------------------------
+/** Extension → content type for the common web-bundle asset kinds. */
+const CONTENT_TYPES = {
+    html: 'text/html; charset=utf-8',
+    js: 'text/javascript; charset=utf-8',
+    mjs: 'text/javascript; charset=utf-8',
+    css: 'text/css; charset=utf-8',
+    json: 'application/json; charset=utf-8',
+    map: 'application/json; charset=utf-8',
+    svg: 'image/svg+xml',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    avif: 'image/avif',
+    ico: 'image/x-icon',
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    ttf: 'font/ttf',
+    wasm: 'application/wasm',
+    txt: 'text/plain; charset=utf-8',
+    webmanifest: 'application/manifest+json',
+};
+function extensionOf(pathname) {
+    const base = pathname.slice(pathname.lastIndexOf('/') + 1);
+    const dot = base.lastIndexOf('.');
+    return dot > 0 ? base.slice(dot + 1).toLowerCase() : '';
+}
+function contentTypeFor(pathname) {
+    return CONTENT_TYPES[extensionOf(pathname)] ?? 'application/octet-stream';
+}
+/** True when a path belongs to the daemon API/route surface and must never be
+ *  served as a static file (API routes keep precedence). Boundary-aware so a SPA
+ *  route like `/tasks` is not mistaken for the daemon's `/task` route. */
+function isReservedApiPath(pathname, openaiPrefix) {
+    const reserved = ['/api', '/login', '/webhook', '/task', openaiPrefix];
+    return reserved.some((base) => pathname === base || pathname.startsWith(`${base}/`));
+}
+/** True when the request looks like an SPA navigation (HTML document) rather than
+ *  a fetch for a concrete asset — used to decide whether the index.html fallback
+ *  applies. A missing concrete asset must 404, not return the HTML shell. */
+function isNavigationRequest(req, pathname) {
+    if (extensionOf(pathname) === '')
+        return true;
+    return (req.headers.get('accept') ?? '').includes('text/html');
+}
+function cacheControlFor(pathname, isShell) {
+    if (isShell || extensionOf(pathname) === 'html')
+        return 'no-cache';
+    if (pathname.includes('/assets/'))
+        return 'public, max-age=31536000, immutable';
+    return 'public, max-age=3600';
+}
+async function fileResponse(req, file, pathname, isShell) {
+    const headers = {
+        'Content-Type': contentTypeFor(pathname),
+        'Cache-Control': cacheControlFor(pathname, isShell),
+    };
+    if (req.method === 'HEAD') {
+        const size = await file.size;
+        return new Response(null, { status: 200, headers: { ...headers, 'Content-Length': String(size) } });
+    }
+    return new Response(file, { status: 200, headers });
+}
+/**
+ * Serve a file from the configured bundle directory, with SPA fallback to
+ * index.html for navigation routes. Returns null when serving is disabled, the
+ * request is not a GET/HEAD, or the path is a reserved API route — in every
+ * "null" case the caller continues with normal daemon routing, so behavior is
+ * unchanged when the capability is off. Path traversal outside the bundle
+ * directory is refused with 403.
+ */
+export async function serveWebuiBundle(req, posture) {
+    if (!posture.serveBundle || !posture.bundleDir)
+        return null;
+    if (req.method !== 'GET' && req.method !== 'HEAD')
+        return null;
+    const url = new URL(req.url);
+    let pathname;
+    try {
+        pathname = decodeURIComponent(url.pathname);
+    }
+    catch {
+        return new Response('Bad Request', { status: 400 });
+    }
+    if (pathname.includes('\0'))
+        return new Response('Bad Request', { status: 400 });
+    if (isReservedApiPath(pathname, posture.openaiPathPrefix))
+        return null;
+    const root = resolve(posture.bundleDir);
+    const relative = pathname === '/' ? 'index.html' : pathname.replace(/^\/+/, '');
+    const resolved = resolve(root, relative);
+    // Reject anything that escapes the bundle root (path traversal).
+    if (resolved !== root && !resolved.startsWith(root + sep)) {
+        return new Response('Forbidden', { status: 403 });
+    }
+    const file = Bun.file(resolved);
+    if (await file.exists()) {
+        const isShell = resolved === resolve(root, 'index.html');
+        // Derive the content type from the resolved file path, not the request path —
+        // a `GET /` serves index.html and must answer text/html, not octet-stream.
+        return fileResponse(req, file, resolved, isShell);
+    }
+    // SPA fallback: an unknown navigation route serves the app shell; a missing
+    // concrete asset is an honest 404 (never the HTML shell in a JS/CSS request).
+    if (isNavigationRequest(req, pathname)) {
+        const indexFile = Bun.file(resolve(root, 'index.html'));
+        if (await indexFile.exists()) {
+            return fileResponse(req, indexFile, '/index.html', true);
+        }
+    }
+    return new Response('Not Found', { status: 404 });
+}

package/dist/platform/daemon/index.d.ts

@@ -1,4 +1,6 @@
 export { DaemonServer } from './server.js';
+export { bootDaemon } from './boot.js';
+export type { BootDaemonOptions, BootedDaemon } from './boot.js';
 export { HttpListener } from './http-listener.js';
 export { PlatformServiceManager } from './service-manager.js';
 export type { ManagedServiceStatus } from './service-manager.js';

package/dist/platform/daemon/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/platform/daemon/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/platform/daemon/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/platform/daemon/index.js

@@ -1,4 +1,5 @@
 export { DaemonServer } from './server.js';
+export { bootDaemon } from './boot.js';
 export { HttpListener } from './http-listener.js';
 export { PlatformServiceManager } from './service-manager.js';
 export { isPortAvailable, requirePortAvailable } from './port-check.js';

package/dist/platform/daemon/service-manager.d.ts

@@ -12,6 +12,8 @@ export interface ManagedServiceDefinition {
 }
 export interface ManagedServiceStatus {
     readonly platform: ManagedServicePlatform;
+    /** The resolved service name (`service.serviceName` config, else the built-in default) — so a CLI/consumer never has to hardcode it. */
+    readonly serviceName: string;
     readonly path: string;
     readonly installed: boolean;
     readonly autostart: boolean;
@@ -67,6 +69,20 @@ export declare class PlatformServiceManager {
     private startManual;
     private stopManual;
     private runPlatformAction;
+    /**
+     * Resolves `running` (+ `pid` when known) for `status()`. Only the manual
+     * platform's `startManual` ever writes the pid file (`start()` branches on
+     * `platform === 'manual'` before ever calling `runPlatformAction`), so for
+     * systemd/launchd the pid file is permanently absent and a pid-file-only
+     * check would report `running: false` for a genuinely active unit. systemd
+     * and launchd are queried live instead, through the same injected
+     * `actionRunner` used by start/stop/restart (never a raw exec bypassing it,
+     * so tests can fake the query deterministically).
+     */
+    private queryRunning;
+    private queryPlatformRunning;
+    /** Runs a service-management query/action through the injected actionRunner when present, else a real spawnSync — the single choke point start/stop/restart/status share. */
+    private runQuery;
     private readPid;
     private isPidRunning;
 }

package/dist/platform/daemon/service-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-manager.d.ts","sourceRoot":"","sources":["../../../src/platform/daemon/service-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAG3E,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,4BAA6B,SAAQ,mBAAmB;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,0BAA0B,CAAC,GAAG,SAAS,CAAC;IAC/G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACvD;AAmLD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAuC;IAC3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAyF;IACvH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;gBAErC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B;IAa/E,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,QAAQ;IAOhB,MAAM,IAAI,oBAAoB;IA0C9B,OAAO,IAAI,oBAAoB;IAqB/B,SAAS,IAAI,oBAAoB;IAgBjC,KAAK,IAAI,oBAAoB;IAS7B,IAAI,IAAI,oBAAoB;IAS5B,OAAO,IAAI,oBAAoB;IAU/B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,WAAW;IAuCnB,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,YAAY;CAQrB"}
+{"version":3,"file":"service-manager.d.ts","sourceRoot":"","sources":["../../../src/platform/daemon/service-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAG3E,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,wIAAwI;IACxI,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,4BAA6B,SAAQ,mBAAmB;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,0BAA0B,CAAC,GAAG,SAAS,CAAC;IAC/G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACvD;AAmLD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAuC;IAC3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAyF;IACvH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;gBAErC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B;IAa/E,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,QAAQ;IAOhB,MAAM,IAAI,oBAAoB;IAuC9B,OAAO,IAAI,oBAAoB;IAqB/B,SAAS,IAAI,oBAAoB;IAgBjC,KAAK,IAAI,oBAAoB;IAS7B,IAAI,IAAI,oBAAoB;IAS5B,OAAO,IAAI,oBAAoB;IAU/B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,WAAW;IAuCnB,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,iBAAiB;IA0CzB;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,oBAAoB;IA2B5B,6KAA6K;IAC7K,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,YAAY;CAQrB"}

package/dist/platform/daemon/service-manager.js

@@ -200,6 +200,7 @@ export class PlatformServiceManager {
             const definition = this.resolveDefinition();
             return {
                 platform,
+                serviceName,
                 path,
                 installed: false,
                 autostart: false,
@@ -212,15 +213,11 @@ export class PlatformServiceManager {
             };
         }
         const installed = existsSync(path);
-        const pidPath = pidFilePath(platform, this.workingDirectory, this.surfaceRoot);
-        const pid = existsSync(pidPath) ? this.readPid(pidPath) : undefined;
-        const running = pid !== undefined ? this.isPidRunning(pid) : false;
-        if (!running && existsSync(pidPath)) {
-            rmSync(pidPath, { force: true });
-        }
+        const { running, pid } = this.queryRunning(platform, serviceName);
         const definition = this.resolveDefinition();
         return {
             platform,
+            serviceName,
             path,
             installed,
             autostart: Boolean(this.configManager.get('service.autostart')),
@@ -361,29 +358,96 @@ export class PlatformServiceManager {
     runPlatformAction(platform, action) {
         const serviceName = resolveServiceName(this.configManager, this.defaultServiceName);
         const path = definitionPath(platform, serviceName, this.getPaths(), this.surfaceRoot);
-        const command = platform === 'systemd'
-            ? ['systemctl', '--user', action === 'start' ? 'enable' : action, ...(action === 'start' ? ['--now'] : []), `${serviceName}.service`]
+        // Each step is an argv plus a bestEffort flag. launchd has no native restart
+        // verb, so restart is an honest unload-then-load; the unload is best-effort
+        // (the agent may simply not be loaded yet), mirroring suggestedCommands()'
+        // human-facing `launchctl unload <path> || true`.
+        const steps = platform === 'systemd'
+            ? [{ argv: ['systemctl', '--user', action === 'start' ? 'enable' : action, ...(action === 'start' ? ['--now'] : []), `${serviceName}.service`] }]
             : platform === 'launchd'
-                ? ['launchctl', action === 'stop' ? 'unload' : 'load', path]
+                ? action === 'restart'
+                    ? [
+                        { argv: ['launchctl', 'unload', path], bestEffort: true },
+                        { argv: ['launchctl', 'load', path] },
+                    ]
+                    : [{ argv: ['launchctl', action === 'stop' ? 'unload' : 'load', path] }]
                 : platform === 'windows'
-                    ? ['schtasks', action === 'start' ? '/Run' : action === 'stop' ? '/End' : '/Run', '/TN', serviceName]
+                    ? [{ argv: ['schtasks', action === 'start' ? '/Run' : action === 'stop' ? '/End' : '/Run', '/TN', serviceName] }]
                     : [];
-        if (command.length === 0) {
+        if (steps.length === 0) {
             return {
                 ...this.status(),
                 lastAction: action,
                 actionError: `Unsupported platform action: ${platform}`,
             };
         }
-        const result = this.actionRunner
-            ? this.actionRunner(command[0], command.slice(1))
-            : spawnSync(command[0], command.slice(1), { stdio: 'pipe', encoding: 'utf-8' });
+        let actionError;
+        for (const step of steps) {
+            const argv = step.argv;
+            const result = this.runQuery(argv[0], argv.slice(1));
+            if ((result.status ?? 1) !== 0 && !step.bestEffort) {
+                actionError = ((result.stderr ?? '') || (result.stdout ?? '') || `command exited with ${result.status}`).trim();
+                break;
+            }
+        }
         return {
             ...this.status(),
             lastAction: action,
-            ...((result.status ?? 1) === 0 ? {} : { actionError: ((result.stderr ?? '') || (result.stdout ?? '') || `command exited with ${result.status}`).trim() }),
+            ...(actionError === undefined ? {} : { actionError }),
         };
     }
+    /**
+     * Resolves `running` (+ `pid` when known) for `status()`. Only the manual
+     * platform's `startManual` ever writes the pid file (`start()` branches on
+     * `platform === 'manual'` before ever calling `runPlatformAction`), so for
+     * systemd/launchd the pid file is permanently absent and a pid-file-only
+     * check would report `running: false` for a genuinely active unit. systemd
+     * and launchd are queried live instead, through the same injected
+     * `actionRunner` used by start/stop/restart (never a raw exec bypassing it,
+     * so tests can fake the query deterministically).
+     */
+    queryRunning(platform, serviceName) {
+        if (platform === 'systemd' || platform === 'launchd') {
+            return this.queryPlatformRunning(platform, serviceName);
+        }
+        const pidPath = pidFilePath(platform, this.workingDirectory, this.surfaceRoot);
+        const pid = existsSync(pidPath) ? this.readPid(pidPath) : undefined;
+        const running = pid !== undefined ? this.isPidRunning(pid) : false;
+        if (!running && existsSync(pidPath)) {
+            rmSync(pidPath, { force: true });
+        }
+        return running ? { running, pid } : { running };
+    }
+    queryPlatformRunning(platform, serviceName) {
+        if (platform === 'systemd') {
+            const result = this.runQuery('systemctl', ['--user', 'is-active', `${serviceName}.service`]);
+            const state = (result.stdout ?? '').trim();
+            return { running: (result.status ?? 1) === 0 && state === 'active' };
+        }
+        // launchd: no single-job query is used here — `launchctl list <label>` prints
+        // a plist dump on modern macOS, not a stable parseable field. Instead run the
+        // plain `launchctl list` (same command this module's suggestedCommands()
+        // already tells operators to run: `launchctl list | grep <name>`) and find the
+        // job's own tabular line: `<pid-or-dash>\t<last-exit-status>\t<label>`. No
+        // matching line = not loaded = not running; a `-` PID column = loaded but
+        // stopped; a numeric PID = running.
+        const result = this.runQuery('launchctl', ['list']);
+        const match = (result.stdout ?? '')
+            .split('\n')
+            .map((line) => line.trim().split(/\s+/))
+            .find((fields) => fields[fields.length - 1] === serviceName);
+        if (!match)
+            return { running: false };
+        const pidToken = match[0];
+        const pid = pidToken && /^\d+$/.test(pidToken) ? Number(pidToken) : undefined;
+        return pid !== undefined ? { running: true, pid } : { running: false };
+    }
+    /** Runs a service-management query/action through the injected actionRunner when present, else a real spawnSync — the single choke point start/stop/restart/status share. */
+    runQuery(command, args) {
+        return this.actionRunner
+            ? this.actionRunner(command, args)
+            : spawnSync(command, args, { stdio: 'pipe', encoding: 'utf-8' });
+    }
     readPid(path) {
         const raw = readFileSync(path, 'utf-8').trim();
         const pid = Number.parseInt(raw, 10);

package/dist/platform/intelligence/tree-sitter/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/platform/intelligence/tree-sitter/service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAU,QAAQ,EAAS,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAalD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,SAAS,CAAsC;IACvD;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAuB5D;;;OAGG;IACG,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+CvB,gEAAgE;IAChE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAQlC;;;OAGG;IACH,KAAK,CACH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,MAAM,GAClB,UAAU,EAAE;IAYf,sCAAsC;IACtC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,2BAA2B;IAC3B,IAAI,eAAe,IAAI,MAAM,EAAE,CAE9B;IAED;;OAEG;IACH,OAAO,IAAI,IAAI;CAahB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/platform/intelligence/tree-sitter/service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAU,QAAQ,EAAS,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAyBlD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,SAAS,CAAsC;IACvD;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA0BjC;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAwB5D;;;OAGG;IACG,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+CvB,gEAAgE;IAChE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAQlC;;;OAGG;IACH,KAAK,CACH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,MAAM,GAClB,UAAU,EAAE;IAYf,sCAAsC;IACtC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,2BAA2B;IAC3B,IAAI,eAAe,IAAI,MAAM,EAAE,CAE9B;IAED;;OAEG;IACH,OAAO,IAAI,IAAI;CAahB"}

package/dist/platform/intelligence/tree-sitter/service.js

@@ -9,9 +9,20 @@
 import { Parser, Language, Query, Tree } from 'web-tree-sitter';
 import { logger } from '../../utils/logger.js';
 import { detectLanguage } from './languages.js';
-import { TREE_SITTER_WASM, GRAMMAR_WASM } from './embedded-wasm.js';
 import { summarizeError } from '../../utils/error-display.js';
 const MAX_CACHE_SIZE = 100;
+// The embedded-wasm module uses Bun's `with { type: 'file' }` import attribute,
+// which is invalid under any non-Bun runtime (Node throws
+// ERR_IMPORT_ATTRIBUTE_UNSUPPORTED the instant the module is evaluated). Loading
+// it lazily keeps it OUT of the static import graph of `platform/runtime` etc.,
+// so a Node consumer (or the release install-smoke check) can import those
+// surfaces without ever evaluating it. It is only pulled when tree-sitter
+// actually initializes / loads a grammar — a Bun-only code path — so real Bun
+// behavior is unchanged.
+let embeddedWasmPromise = null;
+function loadEmbeddedWasm() {
+    return (embeddedWasmPromise ??= import('./embedded-wasm.js'));
+}
 export class TreeSitterService {
     parser = null;
     initialized = false;
@@ -31,7 +42,9 @@ export class TreeSitterService {
             try {
                 // TREE_SITTER_WASM is the embedded WASM path from embedded-wasm.ts.
                 // In compiled binaries it resolves to the embedded file; in dev mode
-                // it resolves to the absolute filesystem path. Both work.
+                // it resolves to the absolute filesystem path. Both work. Loaded lazily
+                // (see loadEmbeddedWasm) so this Bun-only module stays off the static graph.
+                const { TREE_SITTER_WASM } = await loadEmbeddedWasm();
                 await Parser.init({
                     locateFile: (_path) => TREE_SITTER_WASM,
                 });
@@ -56,6 +69,7 @@ export class TreeSitterService {
             return cached;
         // Look up the embedded WASM path. If not present, the grammar package is
         // not installed — return null rather than throwing.
+        const { GRAMMAR_WASM } = await loadEmbeddedWasm();
         const wasmPath = GRAMMAR_WASM[langId];
         if (!wasmPath) {
             logger.warn('TreeSitterService: grammar WASM not embedded', { langId });

package/dist/platform/knowledge/browser-history/readers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readers.d.ts","sourceRoot":"","sources":["../../../../src/platform/knowledge/browser-history/readers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAGV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,GAAG,SAAS,CAAC;CACxE;AA8YD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,uBAAuB,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAclC"}
+{"version":3,"file":"readers.d.ts","sourceRoot":"","sources":["../../../../src/platform/knowledge/browser-history/readers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAGV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAiBpB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,GAAG,SAAS,CAAC;CACxE;AA8YD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,uBAAuB,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAclC"}

package/dist/platform/knowledge/browser-history/readers.js

@@ -1,8 +1,18 @@
 import { readFile } from 'node:fs/promises';
-import { Database } from 'bun:sqlite';
+import { createRequire } from 'node:module';
 import bplistParserDefault from 'bplist-parser';
 import { copyLockedBrowserSqlite } from './locked-db.js';
 const bplistParser = bplistParserDefault;
+// bun:sqlite is a Bun-only builtin; a static import makes this module unloadable
+// under any non-Bun runtime (Node's ESM linker rejects the `bun:` scheme at link
+// time, breaking the release install-smoke check and any Node import of the
+// surfaces that transitively reach this module). Resolve the Database constructor
+// lazily via require so the `bun:` specifier stays off the static import graph —
+// it is only pulled on the Bun-only code path that opens a browser database.
+let bunDatabaseCtor = null;
+function bunSqliteDatabase() {
+    return (bunDatabaseCtor ??= createRequire(import.meta.url)('bun:sqlite').Database);
+}
 const CHROMIUM_EPOCH_OFFSET_MS = 11_644_473_600_000;
 const MAC_ABSOLUTE_TIME_OFFSET_S = 978_307_200;
 function chromiumMicrosToMs(micros) {
@@ -65,7 +75,7 @@ async function readChromiumHistory(profile, options) {
     const since = typeof options.sinceMs === 'number' ? msToChromiumMicros(options.sinceMs) : 0;
     const copy = await copyLockedBrowserSqlite(profile.historyPath);
     try {
-        const db = new Database(copy.copiedDbPath, { readonly: true });
+        const db = new (bunSqliteDatabase())(copy.copiedDbPath, { readonly: true });
         try {
             const urlRows = db.query('SELECT id, url, title, visit_count FROM urls').all();
             const urlMap = new Map(urlRows.map((row) => [row.id, row]));
@@ -153,7 +163,7 @@ async function readGeckoHistory(profile, options) {
         return [];
     const copy = await copyLockedBrowserSqlite(profile.historyPath);
     try {
-        const db = new Database(copy.copiedDbPath, { readonly: true });
+        const db = new (bunSqliteDatabase())(copy.copiedDbPath, { readonly: true });
         try {
             const since = typeof options.sinceMs === 'number' ? Math.floor(options.sinceMs * 1000) : 0;
             const rows = db.query(`SELECT p.id AS place_id, p.url, p.title, p.visit_count, h.visit_date, h.visit_type
@@ -218,7 +228,7 @@ async function readGeckoBookmarks(profile, options) {
         return [];
     const copy = await copyLockedBrowserSqlite(path);
     try {
-        const db = new Database(copy.copiedDbPath, { readonly: true });
+        const db = new (bunSqliteDatabase())(copy.copiedDbPath, { readonly: true });
         try {
             const rows = db.query('SELECT id, type, parent, title, fk, dateAdded FROM moz_bookmarks ORDER BY id').all();
             const places = db.query('SELECT id, url, title FROM moz_places').all();
@@ -262,7 +272,7 @@ async function readWebKitHistory(profile, options) {
         return [];
     const copy = await copyLockedBrowserSqlite(profile.historyPath);
     try {
-        const db = new Database(copy.copiedDbPath, { readonly: true });
+        const db = new (bunSqliteDatabase())(copy.copiedDbPath, { readonly: true });
         try {
             if (profile.browser === 'epiphany') {
                 const since = typeof options.sinceMs === 'number' ? Math.floor(options.sinceMs / 1000) : 0;

package/dist/platform/knowledge/knowledge-api.d.ts

@@ -75,7 +75,7 @@ export interface MemoryApi {
 export type MemoryApiRegistry = Pick<MemoryRegistry, 'add' | 'doctor' | 'delete' | 'exportBundle' | 'get' | 'getAll' | 'importBundle' | 'link' | 'linksFor' | 'rebuildVectors' | 'rebuildVectorsAsync' | 'review' | 'reviewQueue' | 'search' | 'searchSemantic' | 'update' | 'vectorStats'>;
 /**
  * memory-api-parallel query surface for the repo source-tree code index
- * (Wave-5 wo802, W5.3 Stage A). Deliberately NOT folded into MemoryApi:
+ * (Stage A, see CHANGELOG 0.38.0). Deliberately NOT folded into MemoryApi:
  * CodeContextResult/CodeIndexStats are a different record shape than
  * MemoryRecord, and code-index retrieval carries no cls/reviewState/trustTier
  * provenance semantics — see createCodeIndexApi / createMemoryApi below.