@ravefox/space 0.2.0 → 0.3.0

package/src/lib/credential-file.js

@@ -1,208 +0,0 @@
-/**
- * A per-spawn credential file: the launcher channel for the runtime token
- * (TASK-082/083, ruled 2026-09-19 — "a credential file, only its PATH in the
- * env").
- *
- * WHY A FILE AND NOT THE ENVIRONMENT. The token used to ride the runtime's own
- * environment (claude expands `${COMMONLY_AGENT_TOKEN}` from it, codex forwards
- * it through `mcp_servers.*.env_vars`), which means every child of the runtime
- * inherited it — measured on 2026-09-19: a `@playwright/mcp` process held the
- * seat's `COMMONLY_AGENT_TOKEN`, and a pi seat's MCP child held the daemon's
- * `COMMONLY_LITELLM_KEY`. A PATH is not a secret, so handing the path to the
- * runtime is safe even though the token it names is not, and an unrelated MCP
- * server that inherits the runtime's environment gets nothing it can use.
- *
- * WHY PER SPAWN. The file lives only as long as one spawn of one runtime, in a
- * directory only its owner can traverse (0700), with the file itself 0600. A
- * fixed path would widen the window to "since the first spawn" and would let two
- * concurrent seats share one credential by accident.
- *
- * The caller names the root; this module never invents one, because the only
- * root it could invent is a directory no adapter cleans up.
- *
- * The reader side is `readToken` in `commonly-mcp/src/client.js`, which resolves
- * fd, then file, then environment — by declaration, and refuses to fall through
- * from a declared source that cannot be read.
- */
-import {
-  chmodSync, existsSync, mkdirSync, rmSync, writeFileSync,
-} from 'node:fs';
-import { dirname, join } from 'node:path';
-import { randomBytes } from 'node:crypto';
-
-/** The variable a child reads to find the credential. Never carries the token. */
-export const CREDENTIAL_FILE_VAR = 'COMMONLY_TOKEN_FILE';
-
-/**
- * The variable that USED to carry the token itself, and still does for a server
- * that cannot read anything else. Kept beside the file var so the two channels
- * are named in one place rather than one per adapter.
- */
-export const CREDENTIAL_KEY = 'COMMONLY_AGENT_TOKEN';
-
-/**
- * Write `token` to a fresh 0600 file under `root` and return its path, or null
- * when there is no token to write (a seat bootstrapping without one).
- *
- * `root` is REQUIRED. It used to default to the CLI's own state directory, which
- * meant a caller that forgot it wrote a live credential into
- * `~/.commonly/credentials` — a directory no adapter cleans, because that is not
- * where adapters put theirs. Measured 2026-09-20: 32 such directories on the
- * fleet host, 24 of them written by this repo's own harnesses, all holding a
- * seat credential. A missing root is now an error instead of a silent write into
- * the operator's home. The token check stays first, so "no token, nothing
- * written" remains true without a root.
- *
- * `fs` is injectable so tests can assert the mode and the path shape without
- * writing into the operator's home.
- */
-export const writeCredentialFile = (token, {
-  agentName = 'agent',
-  root,
-  fs = { mkdirSync, writeFileSync, chmodSync, rmSync },
-  now = () => Date.now(),
-  random = () => randomBytes(4).toString('hex'),
-} = {}) => {
-  const value = typeof token === 'string' ? token.trim() : '';
-  if (!value) return null;
-  if (typeof root !== 'string' || !root.trim()) {
-    throw new Error(
-      'writeCredentialFile requires an explicit root: an omitted root used to fall back to '
-      + '~/.commonly/credentials, where nothing sweeps the credential files it writes',
-    );
-  }
-  const dir = join(root, `${agentName}-${now()}-${random()}`);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const path = join(dir, 'token');
-  fs.writeFileSync(path, value, { mode: 0o600 });
-  // writeFileSync's mode is subject to the process umask, so a 0022 umask still
-  // produces 0644. chmod is the assertion, not a courtesy.
-  fs.chmodSync(path, 0o600);
-  return { path, dir };
-};
-
-/**
- * Writes the token again at the path an earlier writeCredentialFile chose, for
- * a retry whose config already names that path (F460: the first run released
- * it once its readers had it).
- */
-export const restoreCredentialFile = (written, token, {
-  fs = {
-    mkdirSync, writeFileSync, chmodSync, rmSync,
-  },
-} = {}) => {
-  const value = typeof token === 'string' ? token.trim() : '';
-  if (!written?.path || !written?.dir || !value) return false;
-  fs.mkdirSync(written.dir, { recursive: true, mode: 0o700 });
-  // Exclusive create: whatever sits at the path is removed, never written through.
-  fs.rmSync(written.path, { force: true });
-  fs.writeFileSync(written.path, value, { mode: 0o600, flag: 'wx' });
-  fs.chmodSync(written.path, 0o600);
-  return true;
-};
-
-/** Best-effort removal once the spawn that owns the file has ended. */
-export const removeCredentialFile = (written, { fs = { rmSync } } = {}) => {
-  const dir = typeof written === 'string' ? dirname(written) : written?.dir;
-  if (!dir) return false;
-  try {
-    fs.rmSync(dir, { recursive: true, force: true });
-    return true;
-  } catch {
-    return false;
-  }
-};
-
-/** How long a public seat waits for its MCP servers' ready files (F460). */
-export const READY_DEADLINE_MS = 30_000;
-
-/**
- * F460. Delete this spawn's credential as soon as every process that reads it
- * has read it, so nothing the model does later in the turn (a tool, a link the
- * walk missed) can reach it. pi has done this since F146; this is the one
- * shared version.
- *
- * Two triggers, either of which may fire first:
- * - `release('stream')`, called by the adapter on an output event measured to
- *   come after every read (pi's first event, OpenCode's step_start);
- * - `readyFiles`: each Commonly MCP server writes its ready file on the host's
- *   first `tools/list`, after it read the credential at start, and the broker
- *   bridge does the same. Once every listed file exists, the credential goes.
- *   With a deadline: a server that never gets ready costs a degraded turn,
- *   never a credential left readable for the whole turn.
- *
- * A delete that fails stops the turn: `onFailure(error)` kills the child, and
- * the error (the path, never the value) is the turn's result. `stop()` belongs
- * in the spawn's `finally`, beside `removeCredentialFile`.
- */
-export const armCredentialRelease = (credential, {
-  readyFiles = null,
-  // An adapter with a trigger of its own (OpenCode's first step) calls
-  // release() itself; an empty list then waits for it, or the deadline.
-  ownTrigger = false,
-  deadlineMs = READY_DEADLINE_MS,
-  pollMs = 100,
-  label = 'this seat',
-  onFailure = () => {},
-  warn = () => {},
-  fs = { rmSync, existsSync },
-  timers = {
-    setTimeout, clearTimeout, setInterval, clearInterval,
-  },
-} = {}) => {
-  let armed = Boolean(credential?.dir);
-  let reason = null;
-  let error = null;
-  let poll = null;
-  let deadline = null;
-  const stop = () => {
-    if (poll !== null) timers.clearInterval(poll);
-    if (deadline !== null) timers.clearTimeout(deadline);
-    poll = null;
-    deadline = null;
-  };
-  const release = (why) => {
-    if (!armed) return error;
-    armed = false;
-    reason = why;
-    stop();
-    try {
-      fs.rmSync(credential.dir, { recursive: true, force: true });
-    } catch (err) {
-      error = new Error(
-        `${label} could not delete its runtime credential (${credential.path}) once its readers had it: `
-        + `${err?.code || err?.message || err}; the turn was stopped so the credential does not stay readable to its tools`,
-      );
-      onFailure(error);
-    }
-    return error;
-  };
-  if (armed && Array.isArray(readyFiles)) {
-    const waits = ownTrigger && !readyFiles.length;
-    const allReady = () => !waits && readyFiles.every((path) => fs.existsSync(path));
-    if (allReady()) {
-      release('ready');
-    } else {
-      if (!waits) {
-        poll = timers.setInterval(() => { if (allReady()) release('ready'); }, pollMs);
-        poll?.unref?.();
-      }
-      deadline = timers.setTimeout(() => {
-        const missing = readyFiles.filter((path) => !fs.existsSync(path));
-        warn(
-          `${label}: MCP servers not ready after ${Math.round(deadlineMs / 1000)}s `
-          + `(${missing.length ? missing.join(', ') : 'its runtime never reported them started'}); `
-          + 'the runtime credential was deleted anyway, so tools that still need it will fail this turn',
-        );
-        release('deadline');
-      }, deadlineMs);
-      deadline?.unref?.();
-    }
-  }
-  return {
-    release,
-    stop,
-    get reason() { return reason; },
-    get error() { return error; },
-  };
-};

package/src/lib/daemon-agent-states.js

@@ -1,95 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-
-// The server's verdict for each agent, as `daemon status --watch` shows it. The
-// verdict is deriveAgentState's (backend/services/agentStateService.ts), the
-// same one the Your Team row and the TASK-655 never-connected line use, so the
-// watch and the product name an agent's state the same way. It is read through
-// the operator's login, because the daemon's own credential cannot call the
-// per-pod agent-states route. Each agent's pod comes from its token record.
-
-// The reach states mapped to the words the watch prints. `reachable` is a
-// native or push-webhook agent the server always treats as up.
-const LABEL = {
-  listening: 'running',
-  reachable: 'running',
-  'gone-dark': 'stalled',
-  'never-connected': 'not connected',
-};
-
-// When one agent is installed in several pods, the most alive verdict wins.
-const RANK = ['running', 'stalled', 'not connected', 'unknown'];
-
-export const reachLabel = (reach) => LABEL[reach] || 'unknown';
-
-export const seatKey = (agentName, instanceId) => (
-  `${String(agentName || '').toLowerCase()}:${String(instanceId || 'default').toLowerCase()}`
-);
-
-const moreAlive = (a, b) => (RANK.indexOf(a) <= RANK.indexOf(b) ? a : b);
-
-// Reads one pod's agents and returns Map<seatKey, label>. `client` is a
-// user-token client.
-export const loadPodReach = async ({ client, podId }) => {
-  const body = await client.get(`/api/pods/${podId}/agent-states`);
-  const byAgent = new Map();
-  for (const agent of body?.agents || []) {
-    byAgent.set(seatKey(agent.agentName, agent.instanceId), reachLabel(agent.state));
-  }
-  return byAgent;
-};
-
-// The server allows 60 agent-states reads a minute per IP. Each pod is refreshed
-// once per TTL, and the TTL stretches with the pod count, so N pods cost about 50
-// reads a minute whatever N is: 1.2 s per pod at least, and never below `ttlMs`.
-const PER_POD_SPACING_MS = 1_200;
-
-// Caches each pod's verdict, so the 2 s watch frame does not re-read every pod.
-// A failed refresh keeps the pod's last verdict and waits one TTL before trying
-// again, so a 429 is neither discarded nor retried every frame. A pod with no
-// earlier verdict throws, and the next call retries it. `load(podId)` returns
-// Map<seatKey, label>. Returns `reachFor(podIds)`, which merges the pods' maps.
-export const createReachCache = ({ load, ttlMs = 10_000, now = Date.now }) => {
-  const cached = new Map();
-  const reachFor = async (podIds) => {
-    const ttl = Math.max(ttlMs, podIds.length * PER_POD_SPACING_MS);
-    const merged = new Map();
-    for (const podId of podIds) {
-      const hit = cached.get(podId);
-      let agents;
-      if (hit && now() - hit.loadedAt < ttl) {
-        agents = hit.agents;
-      } else {
-        try {
-          agents = await load(podId);
-        } catch (error) {
-          if (!hit) throw error;
-          agents = hit.agents;
-        }
-        cached.set(podId, { agents, loadedAt: now() });
-      }
-      for (const [key, label] of agents) {
-        merged.set(key, merged.has(key) ? moreAlive(merged.get(key), label) : label);
-      }
-    }
-    return merged;
-  };
-  return reachFor;
-};
-
-// The agent's last supervised turn, from its session store, the record
-// `agent list` reads. The most recent entry across pods, or null. The
-// supervisor's own stamp is the spawn time, so the watch does not use it.
-export const readSessionLastTurn = (name, { home = homedir() } = {}) => {
-  try {
-    const sessions = JSON.parse(readFileSync(join(home, '.commonly', 'sessions', `${name}.json`), 'utf8'));
-    let latest = null;
-    for (const entry of Object.values(sessions || {})) {
-      if (entry?.lastTurn && (!latest || entry.lastTurn > latest)) latest = entry.lastTurn;
-    }
-    return latest;
-  } catch {
-    return null;
-  }
-};

package/src/lib/daemon-hint.js

@@ -1,18 +0,0 @@
-// The hint a foreground `commonly agent run` prints for keeping the agent
-// running. The daemon supervises only the agents placed on this computer, so
-// the hint depends on whether a daemon is registered here at all.
-//
-// The two daemon steps depend on each other, so on Windows they print one per
-// line instead of joined with `&&`, which Windows PowerShell 5.1 lacks (F435).
-import { cliName, cliSteps } from './cli-hint.js';
-
-export const foregroundDaemonHint = ({ daemonRegistered, platform = process.platform }) => {
-  const lead = 'foreground mode; this stops when the terminal closes. To keep it running, ';
-  const inWebApp = 'the web app: Agents → Bring your own → On my computer';
-  if (daemonRegistered) return `${lead}add the agent to this computer in ${inWebApp}`;
-  const cli = cliName(platform);
-  const steps = cliSteps([`${cli} daemon register`, `${cli} daemon install`], { platform, indent: '    ' });
-  return platform === 'win32'
-    ? `${lead}add this computer by running these two commands, one after the other:${steps}\n  then add the agent to it in ${inWebApp}`
-    : `${lead}add this computer with: ${steps}, then add the agent to it in ${inWebApp}`;
-};

package/src/lib/daemon-logs.js

@@ -1,43 +0,0 @@
-import { closeSync, openSync, readFileSync, readSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-
-export const daemonLogsDir = (home = homedir()) => join(home, '.commonly', 'logs', 'daemon');
-export const daemonSeatLogPath = (agentName, home = homedir()) => {
-  const safeName = String(agentName || 'unknown').replace(/[^A-Za-z0-9._-]/g, '_');
-  return join(daemonLogsDir(home), `${safeName}.log`);
-};
-
-export const tailLines = (text, count = 50) => {
-  const lines = String(text).split(/\r?\n/);
-  // A trailing newline is a separator, not an empty log line.
-  if (lines.at(-1) === '') lines.pop();
-  return lines.slice(-Math.max(0, Number(count) || 0)).join('\n');
-};
-
-export const readLogTail = (path, count = 50) => {
-  try {
-    return tailLines(readFileSync(path, 'utf8'), count);
-  } catch (error) {
-    if (error?.code === 'ENOENT') return null;
-    throw error;
-  }
-};
-
-export const logSize = (path) => statSync(path).size;
-
-// Bytes appended since `offset`, for `agent logs --follow`. A file that shrank
-// (rotated or truncated) is read from the start again.
-export const readAppended = (path, offset) => {
-  const size = logSize(path);
-  const start = size < offset ? 0 : offset;
-  if (size === start) return { text: '', offset: size };
-  const fd = openSync(path, 'r');
-  try {
-    const buffer = Buffer.alloc(size - start);
-    readSync(fd, buffer, 0, buffer.length, start);
-    return { text: buffer.toString('utf8'), offset: size };
-  } finally {
-    closeSync(fd);
-  }
-};

package/src/lib/daemon-service-windows.js

@@ -1,263 +0,0 @@
-/**
- * D245: the Windows form of `commonly daemon install` (ADR-026 D1).
- *
- * macOS has launchd and Linux has systemd; Windows has Task Scheduler. A
- * per-user task needs no administrator, so the install stays a one-liner a
- * person can run in their own PowerShell. The shape mirrors the other two:
- *
- * - The task starts at this user's logon (a LogonTrigger naming the user; a
- *   trigger for ANY user's logon needs an administrator).
- * - Keep-alive lives in the launcher, a PowerShell script that loops on
- *   `node <cli> daemon run --foreground`: it restarts on every exit except 77
- *   and 78, the same codes `RestartPreventExitStatus=77 78` exempts on systemd
- *   (a revoked key and a bad local registration). Task Scheduler's own
- *   "restart on failure" fires when a task fails to START, not when its
- *   program exits non-zero, so it cannot be the keep-alive.
- * - A one-minute repeating trigger with `IgnoreNew` is the watchdog for the
- *   launcher itself: while the task runs it starts nothing, and if the
- *   launcher is killed the next minute brings it back.
- * - On 77/78 the launcher disables the task before it exits, so the watchdog
- *   does not restart a daemon that has been told to stop. That is launchd's
- *   "park on a successful exit" in Task Scheduler's terms; `daemon start` and
- *   `daemon restart` enable it again.
- *
- * A task cannot carry environment variables, so the provider keys the seats
- * need (TASK-049) go in a JSON file the launcher loads before it starts node.
- * The file is written through the same 0600-at-creation writer as the unit
- * files, and its ACL is then narrowed to this user (best effort; the profile
- * directory is already private by default).
- *
- * Windows has no Seatbelt or bwrap, so a daemon-run seat here is unconfined.
- * That is stated on the BYO page and in docs/agents/daemon-service-windows.md.
- */
-
-import { join } from 'path';
-
-export const WINDOWS_TASK_NAME = 'CommonlyDaemon';
-
-export const windowsServicePaths = (home) => {
-  const dir = join(home, '.commonly', 'daemon', 'service');
-  return {
-    kind: 'schtasks',
-    // The task definition doubles as the "is it installed" record, the way the
-    // plist and the unit file do on the other two platforms.
-    file: join(dir, 'commonly-daemon-task.xml'),
-    launcher: join(dir, 'commonly-daemon.ps1'),
-    envFile: join(dir, 'service-env.json'),
-    taskName: WINDOWS_TASK_NAME,
-  };
-};
-
-const xmlEscape = (value) => String(value)
-  .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-  .replace(/"/g, '&quot;');
-
-// A PowerShell single-quoted string ends at ANY of the four single-quote
-// characters it recognises (' and the curly ‘ ’ ‚ ‛), and each is escaped by
-// doubling. A user named O'Brien, or a path with a curly quote in it, would
-// otherwise close the string and run the rest of the path as script.
-export const psQuote = (value) => `'${String(value).replace(/['‘’‚‛]/g, (q) => q + q)}'`;
-
-export const windowsLauncherScript = ({ nodePath, cliPath, logPath, envFile, taskName = WINDOWS_TASK_NAME }) => `# Space daemon launcher. Written by \`commonly daemon install\`; re-run that command instead of editing this file.
-# It loads the service environment, then keeps \`commonly daemon run\` alive: every exit restarts it after 5 s,
-# except 77 (this computer's key was revoked) and 78 (no valid local registration), which disable the task and stop.
-$ErrorActionPreference = 'Continue'
-$node = ${psQuote(nodePath)}
-$cli = ${psQuote(cliPath)}
-$log = ${psQuote(logPath)}
-$envFile = ${psQuote(envFile)}
-$task = ${psQuote(taskName)}
-if (Test-Path -LiteralPath $envFile) {
-  $cfg = Get-Content -LiteralPath $envFile -Raw -Encoding UTF8 | ConvertFrom-Json
-  foreach ($p in $cfg.PSObject.Properties) { [Environment]::SetEnvironmentVariable($p.Name, [string]$p.Value, 'Process') }
-}
-$env:Path = (Split-Path -Parent $node) + ';' + $env:Path
-# Ending the task kills this script, not the node it started. The daemon watches this pid and
-# exits (stopping its seats) once it is gone, so stop, restart and reinstall leave no daemon behind.
-$env:COMMONLY_DAEMON_LAUNCHER_PID = "$PID"
-# Read node's output as UTF-8; Windows PowerShell 5.1 otherwise decodes it in the console code page.
-[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
-while ($true) {
-  & $node $cli daemon run --foreground 2>&1 | ForEach-Object { "$_" } | Add-Content -LiteralPath $log -Encoding UTF8
-  $code = $LASTEXITCODE
-  if ($code -eq 77 -or $code -eq 78) {
-    & schtasks.exe /Change /TN $task /DISABLE | Out-Null
-    if ($LASTEXITCODE -eq 0) { exit $code }
-    # The task could not be disabled, so exiting would let the watchdog start
-    # it again within a minute. Park here instead; stop or uninstall ends it.
-    "commonly daemon exited $code and the task could not be disabled; parked" | Add-Content -LiteralPath $log -Encoding UTF8
-    while ($true) { Start-Sleep -Seconds 3600 }
-  }
-  Start-Sleep -Seconds 5
-}
-`;
-
-// UTF-8 with a BOM: Windows PowerShell 5.1 reads a BOM-less .ps1 in the ANSI
-// code page, which would mangle a non-ASCII user name in any of the paths.
-export const encodeLauncher = (script) => Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), Buffer.from(script, 'utf8')]);
-
-export const POWERSHELL = '%SystemRoot%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
-
-export const windowsTaskXml = ({ launcher, userId, home }) => `<?xml version="1.0" encoding="UTF-16"?>
-<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
-  <RegistrationInfo>
-    <Description>Space local agent daemon (ADR-026). Installed by: commonly daemon install</Description>
-  </RegistrationInfo>
-  <Triggers>
-    <LogonTrigger>
-      <Enabled>true</Enabled>
-      <UserId>${xmlEscape(userId)}</UserId>
-    </LogonTrigger>
-    <TimeTrigger>
-      <Repetition>
-        <Interval>PT1M</Interval>
-        <StopAtDurationEnd>false</StopAtDurationEnd>
-      </Repetition>
-      <StartBoundary>2026-01-01T00:00:00</StartBoundary>
-      <Enabled>true</Enabled>
-    </TimeTrigger>
-  </Triggers>
-  <Principals>
-    <Principal id="Author">
-      <UserId>${xmlEscape(userId)}</UserId>
-      <LogonType>InteractiveToken</LogonType>
-      <RunLevel>LeastPrivilege</RunLevel>
-    </Principal>
-  </Principals>
-  <Settings>
-    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
-    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
-    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
-    <AllowHardTerminate>true</AllowHardTerminate>
-    <StartWhenAvailable>true</StartWhenAvailable>
-    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
-    <IdleSettings>
-      <StopOnIdleEnd>false</StopOnIdleEnd>
-      <RestartOnIdle>false</RestartOnIdle>
-    </IdleSettings>
-    <AllowStartOnDemand>true</AllowStartOnDemand>
-    <Enabled>true</Enabled>
-    <Hidden>false</Hidden>
-    <RunOnlyIfIdle>false</RunOnlyIfIdle>
-    <WakeToRun>false</WakeToRun>
-    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
-    <Priority>7</Priority>
-  </Settings>
-  <Actions Context="Author">
-    <Exec>
-      <Command>${xmlEscape(POWERSHELL)}</Command>
-      <Arguments>${xmlEscape(`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "${launcher}"`)}</Arguments>
-      <WorkingDirectory>${xmlEscape(home)}</WorkingDirectory>
-    </Exec>
-  </Actions>
-</Task>
-`;
-
-// schtasks reads a task file as UTF-16; the declaration above says so, and the
-// bytes must agree with it (little-endian, with the BOM).
-export const encodeTaskXml = (xml) => Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(xml, 'utf16le')]);
-
-// Task Scheduler names a user DOMAIN\user. A bare name resolves too, but the
-// qualified one cannot be mistaken for a same-named account on the domain.
-export const windowsUserId = ({ env = process.env, lookupUsername }) => {
-  if (env.USERNAME) return env.USERDOMAIN ? `${env.USERDOMAIN}\\${env.USERNAME}` : env.USERNAME;
-  return lookupUsername();
-};
-
-export const installWindowsService = async ({
-  home, nodePath, cliPath, logPath, providerEnv, env, writeFile, execCmd, lookupUsername, warn,
-}) => {
-  const target = windowsServicePaths(home);
-  const userId = windowsUserId({ env, lookupUsername });
-  writeFile(target.envFile, `${JSON.stringify(Object.fromEntries(providerEnv), null, 2)}\n`);
-  try {
-    await execCmd(['icacls', target.envFile, '/inheritance:r', '/grant:r', `${userId}:F`]);
-  } catch (error) {
-    warn(`Could not narrow the permissions on ${target.envFile} (${error.message}). It holds your provider keys; it sits in your profile, which only you can read by default.`);
-  }
-  writeFile(target.launcher, encodeLauncher(windowsLauncherScript({ nodePath, cliPath, logPath, envFile: target.envFile })));
-  writeFile(target.file, encodeTaskXml(windowsTaskXml({ launcher: target.launcher, userId, home })));
-  // A running launcher keeps the environment it started with, so end it first
-  // (an absent task fails by design) and start the new definition after.
-  await execCmd(['schtasks', '/End', '/TN', target.taskName]).catch(() => {});
-  await execCmd(['schtasks', '/Create', '/TN', target.taskName, '/XML', target.file, '/F']);
-  await execCmd(['schtasks', '/Run', '/TN', target.taskName]);
-  return target;
-};
-
-export const LAUNCHER_PID_ENV = 'COMMONLY_DAEMON_LAUNCHER_PID';
-
-const pidAlive = (pid) => {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === 'EPERM';
-  }
-};
-
-/**
- * `schtasks /End` terminates the launcher only; the node it started would
- * keep running, unsupervised and invisible to the task (seen on windows-latest,
- * 11-04: a stopped task left its daemon checking in). A daemon started by the
- * launcher therefore polls the launcher's pid and calls `onGone` once it has
- * exited, at once if it is already gone when the watch is armed. Returns a
- * stop function; does nothing outside the launcher.
- */
-export const watchWindowsLauncher = ({
-  env = process.env,
-  platform = process.platform,
-  isAlive = pidAlive,
-  onGone,
-  everyMs = 2000,
-  setIntervalFn = setInterval,
-  clearIntervalFn = clearInterval,
-  streams = [process.stdout, process.stderr],
-}) => {
-  const pid = Number(env[LAUNCHER_PID_ENV]);
-  if (platform !== 'win32' || !Number.isInteger(pid) || pid <= 0) return () => {};
-  // The launcher holds this process's stdout and stderr. Once it exits, any
-  // log line (a poll, a heartbeat) fails with EPIPE, and an unhandled stream
-  // error would end the daemon before it stops its seats. So the streams
-  // swallow errors from the moment the watch is armed, not only after the
-  // launcher's exit is noticed up to two seconds later.
-  for (const stream of streams) stream?.on?.('error', () => {});
-  // Already gone when armed (the daemon is armed before its first tick): say
-  // so now, rather than after a poll and a heartbeat logged into a dead pipe.
-  if (!isAlive(pid)) {
-    onGone(pid);
-    return () => {};
-  }
-  const timer = setIntervalFn(() => {
-    if (isAlive(pid)) return;
-    clearIntervalFn(timer);
-    onGone(pid);
-  }, everyMs);
-  if (typeof timer?.unref === 'function') timer.unref();
-  return () => clearIntervalFn(timer);
-};
-
-export const uninstallWindowsService = async ({ home, execCmd, removeFile, existsFile }) => {
-  const target = windowsServicePaths(home);
-  await execCmd(['schtasks', '/End', '/TN', target.taskName]).catch(() => {});
-  await execCmd(['schtasks', '/Delete', '/TN', target.taskName, '/F']).catch(() => {});
-  for (const file of [target.file, target.launcher, target.envFile]) {
-    if (existsFile(file)) removeFile(file);
-  }
-  return target;
-};
-
-export const windowsServiceAction = async ({ action, home, execCmd }) => {
-  const target = windowsServicePaths(home);
-  const name = target.taskName;
-  if (action === 'stop') {
-    // Disabled first, so the one-minute watchdog cannot start it again.
-    await execCmd(['schtasks', '/Change', '/TN', name, '/DISABLE']);
-    await execCmd(['schtasks', '/End', '/TN', name]).catch(() => {});
-    return target;
-  }
-  if (action === 'restart') await execCmd(['schtasks', '/End', '/TN', name]).catch(() => {});
-  await execCmd(['schtasks', '/Change', '/TN', name, '/ENABLE']);
-  await execCmd(['schtasks', '/Run', '/TN', name]);
-  return target;
-};