@rosthq/cli 0.7.9 → 0.7.11

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAiN3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAkN3D,CAAC"}

package/dist/index.js

@@ -46165,6 +46165,17 @@ var softwareGrantStatusSchema = external_exports2.enum(["active", "revoked"]);
 var softwareConfigValueKindSchema = external_exports2.enum(["plain", "secret_ref"]);
 var softwareCredentialRequestStatusSchema = external_exports2.enum(["pending", "fulfilled", "rejected", "canceled"]);
 var softwareSecretAccessOperationSchema = external_exports2.enum(["use", "vercel_env_sync", "test_execution"]);
+var softwareProjectSummarySchema = external_exports2.object({
+  id: uuid10,
+  name: external_exports2.string().min(1),
+  slug: external_exports2.string().min(1),
+  base_branch: external_exports2.string().min(1),
+  repo_ref: external_exports2.string().nullable()
+});
+var softwareProjectListInputSchema = external_exports2.object({}).strict();
+var softwareProjectListOutputSchema = external_exports2.object({
+  projects: external_exports2.array(softwareProjectSummarySchema)
+});
 var VAULT_REF_PROVIDER = /^(?:infisical|doppler|local-dev):\/\/\S+$/;
 var RAW_SECRET_SUBSTRING = /sk-ant-|sk-proj-|sk-live-|BEGIN |PRIVATE KEY|api[_-]?key=|secret=/i;
 var softwareVaultRefSchema = external_exports2.string().min(1).max(500).regex(VAULT_REF_PROVIDER, "vault_ref must be a provider URI, e.g. infisical://path, doppler://path, or local-dev://path").refine((value) => !RAW_SECRET_SUBSTRING.test(value), {
@@ -47444,11 +47455,11 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-03.1",
+    version: "2026-07-03.3",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
-    relatedCommandIds: ["confirmation.approve", "onboarding.status", "graph.get", "seat.get"],
+    relatedCommandIds: ["confirmation.approve", "onboarding.status", "graph.get", "seat.get", "mcp_token.list", "runner.list"],
     legal: {
       publicRisk: "low",
       notes: [
@@ -47484,6 +47495,14 @@ Each thread has a purpose:
 
 You can reopen prior threads, search thread titles and summaries, or start a new one. Session history is stored in tenant-scoped conversation tables so chat history is not reconstructed from analytics, events, or run logs.
 
+## Set up AICOS for an existing company
+
+New companies receive the governed AICOS foundation during provisioning. Existing companies can also set it up later from **Settings -> AICOS**. Owners and admins can see whether the foundation exists, repair it if needed, and choose the run location after setup.
+
+The repair action ensures the same structure new companies receive: a Founder/CEO root seat, an owner occupancy for stewardship, an **AI Chief of Staff** seat, the stock AICOS agent, and one active agent occupancy. It is idempotent; running it again repairs missing pieces instead of creating a second AICOS. If older setup attempts left more than one active AICOS occupancy, the repair path keeps the best current stock AICOS agent \u2014 live before dry-run, draft, or paused \u2014 and ends the extra AICOS occupancies so Settings, lane readiness, and chat resolve the same governed agent.
+
+Settings is the infrastructure surface for AICOS. Use it to confirm foundation status, inspect the current lane, see whether a seat-scoped MCP token exists, and choose **Cloud**, **Runner**, or **MCP** when the server-side readiness checks allow it. The richer agent controls remain with the agent itself: open the AICOS seat from Settings or the agent fleet to manage Charter, tool permissions, approvals, go-live state, and run evidence.
+
 ## What context AICOS receives
 
 Each turn carries server-normalized page context: route template, current path, safe search state, selected seat or object ids when authorized, and onboarding state when relevant. The server derives tenant and user authority from the authenticated session. Client-supplied tenant context is never accepted as authority.
@@ -48311,7 +48330,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-03.6",
+    version: "2026-07-03.10",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49024,6 +49043,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_revoke_skill_from_seat\` | \`skill.revoke_from_seat\` | Human-gated revocation that stops future Skill use without deleting historical activations. | Tenant-admin | Call with \`{"assignment_id":"<assignment-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
 | \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"software_project_id":"<project-id>","title":"Add invoice export"}\`. |
+| \`rost_list_forge_projects\` | \`software_factory.project.list\` | List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. | Tenant | Call with \`{}\`; use the returned \`id\` as \`software_project_id\`. |
 | \`rost_list_forge_build_requests\` | \`software_factory.request.list\` | The Forge control-room board: build requests with status, current phase, and risk. Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"limit":20}\`. |
 | \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, phase-run history, and gates. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
 | \`rost_advance_a_forge_build_request_phase\` | \`software_factory.phase.advance\` | Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition. | Tenant | Call with \`{"build_request_id":"<request-id>","to_phase":"discovery_scoping"}\`. |
@@ -49038,18 +49058,20 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_forge_secret_requests\` | \`software_factory.secret_request.list\` | List missing-secret requests and their approval Task ids/statuses. It returns request metadata only \u2014 no secret values and no vault refs. | Tenant | Call with \`{}\` or \`{"status":"pending"}\`. |
 | \`rost_grant_a_forge_secret\` | \`software_factory.secret.grant\` | A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"production","seat_id":"<seat-id>","action":"vercel.env.sync","key_name":"OPENAI_API_KEY","vault_ref":"infisical://prod/OPENAI_API_KEY"}\`. |
 | \`rost_revoke_a_forge_secret_grant\` | \`software_factory.secret.revoke\` | Revoke a Forge secret grant (teardown \u2014 cut a compromised seat's access immediately). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_bind_a_forge_github_installation\` | \`software_factory.github.installation.bind\` | Bind a GitHub App installation and selected repositories to Forge projects. Owner-only and human-gated. | Tenant-admin | Call with \`{"installation_id":123,"account_login":"acme","account_id":456,"account_type":"Organization","repositories":[{"software_project_id":"<project-id>","repository_id":789,"repository_name":"app","repository_full_name":"acme/app"}]}\`. |
+| \`rost_bind_a_forge_github_installation\` | \`software_factory.github.installation.bind\` | Bind a GitHub App installation and selected repositories to Forge projects. Owner-only and human-gated; the settings UI uses the same command after GitHub redirects back with an installation id. | Tenant-admin | First run \`rost command software_factory.project.list --json '{}'\` to choose a project id. Then call \`{"installation_id":123,"account_login":"acme","account_id":456,"account_type":"Organization","repositories":[{"software_project_id":"<project-id>","repository_id":789,"repository_name":"app","repository_full_name":"acme/app","private":true,"default_branch":"main","permissions":{"metadata":"read","contents":"write","pull_requests":"write","issues":"write"}}]}\`. |
 | \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"]}\`. |
 | \`rost_create_a_forge_github_installation_token\` | \`software_factory.github.installation_token.create\` | Mint a short-lived GitHub App installation token for one bound repository after policy evaluation. The token is returned once and never stored. | Tenant | Call with \`{"software_project_id":"<project-id>","repository_id":789,"requested_actions":["read"],"requested_automation_mode":"plan_only"}\`. |
 | \`rost_list_forge_runner_capacity\` | \`software_factory.capacity.list\` | List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"runner_id":"<runner-id>"}\`. |
 
+The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, runner capacity, configuration status, and Developer Team template install. The template install button deliberately stages a pending confirmation before durable seats, Skills, or authority grants are applied.
+
 #### Forge GitHub App access
 
 Forge repository access is through a tenant-bound GitHub App installation, not through a human's ambient \`git\` or \`gh\` credentials. The server verifies GitHub webhook signatures before parsing payloads, resolves the installation and repository against active tenant bindings, records delivery ids for idempotency, and creates GitHub issue build requests only when an active repo binding and policy allow intake.
 
 Installation tokens are short lived and are not stored. The durable record is audit metadata: installation id, repository id, requested action, policy decision, reason, and related Forge request when one exists. GitHub issue titles, labels, and bodies are treated as untrusted source content; labels may request an automation mode, but only server-side Forge automation policy can allow \`pr_only\`, \`merge_after_checks\`, \`deploy_preview\`, or \`deploy_production\`. Production deploy remains human-gated.
 
-The Forge GitHub App itself is org-owned. App private key, webhook secret, and client secret values are stored through the vault and configured by refs (\`GITHUB_APP_PRIVATE_KEY_REF\`, \`GITHUB_APP_WEBHOOK_SECRET_REF\`, \`GITHUB_APP_CLIENT_SECRET_REF\`); raw secret env vars are local/legacy compatibility only. The dogfood app is \`ROST Forge\` under \`agenticoperatingsystem\` with App ID \`4208495\` and Client ID \`Iv23liImH7qlBvXYQ0Wx\`. The base app omits \`administration\` and \`workflows\`; elevated repo creation or workflow mutation needs a separate human-approved power path.
+The Forge GitHub App itself is org-owned. App private key, webhook secret, and client secret values are platform-owned ROST operator credentials stored through the vault's reserved ROST system namespace, not through a customer tenant namespace or a tenant UUID deployment variable. Manifest conversion and manual secret storage also require the app-level \`GITHUB_APP_OPERATOR_EMAILS\` allowlist, which should contain only approved ROST platform operator emails. Deployment config carries only refs (\`GITHUB_APP_PRIVATE_KEY_REF\`, \`GITHUB_APP_WEBHOOK_SECRET_REF\`, \`GITHUB_APP_CLIENT_SECRET_REF\`); raw secret env vars are local/legacy compatibility only. The dogfood app is \`ROST Forge\` under \`agenticoperatingsystem\` with App ID \`4208495\` and Client ID \`Iv23liImH7qlBvXYQ0Wx\`. The base app omits \`administration\` and \`workflows\`; elevated repo creation or workflow mutation needs a separate human-approved power path.
 
 ### Seat-scoped operating tools
 
@@ -49390,7 +49412,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-07-03.1",
+    version: "2026-06-27.2",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -49887,7 +49909,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-06-27.2",
+    version: "2026-07-03.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -49924,6 +49946,8 @@ A gated command does not mutate when an agent calls it. It returns a pending con
 
 When an **agent** triggers a gate, {{brand}} also notifies the seat's steward (Slack with an email fallback) so the held action does not sit silent \u2014 a human is told a decision is waiting and given the approve link. A human pausing their own gated command does not self-notify. See the notifications guide.
 
+Approval replays are validated again before execution. If the stored confirmation input no longer matches the original command schema, the approval fails without consuming the pending confirmation or running the durable command; reject it and re-issue the gated action from the current product surface.
+
 \`\`\`bash
 # Human approves a pending confirmation
 {{cli}} command confirmation.approve --json '{"confirmation_id":"<confirmation-id>"}'
@@ -50149,7 +50173,7 @@ Agents may explain which setting is needed and why. They should not ask users to
     order: 73,
     title: "Members and invites guide",
     summary: "How to invite humans into the company without confusing user access with seat accountability.",
-    version: "2026-07-03.1",
+    version: "2026-07-03.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -50228,7 +50252,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-07-03.1",
+    version: "2026-07-03.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -50260,13 +50284,13 @@ Use Local Runner when a Seat should run on a machine you control. Install it fro
 
 Recommended paths:
 
-- **Always-on host:** \`{{cli}} runner install-service --name <runner-name> --execute\` installs a background service (macOS launchd user agent, \`user/<uid>\` domain) that keeps the runner online. Manage it with \`{{cli}} runner start|stop|restart|status|logs|uninstall --name <runner-name>\`. On macOS this loads reliably when the runner user is logged in at the console; on a purely headless SSH box where that user is not at the console, run \`{{cli}} runner serve\` under a process supervisor instead.
+- **Always-on host:** \`{{cli}} runner install-service --name <runner-name> --execute\` installs a background service (macOS launchd user agent) that keeps the runner online. Manage it with \`{{cli}} runner start|stop|restart|status|logs|uninstall --name <runner-name>\`. On macOS the CLI tries both \`user/<uid>\` and \`gui/<uid>\` launchd domains because session behavior differs across console and SSH contexts; \`runner status --name <runner-name>\` prints the loaded domain.
 - **Manual smoke:** \`{{cli}} runner serve --once\` heartbeats once and exits; \`{{cli}} runner serve --execute\` claims and executes runner work orders while it runs.
 
 Two ways to authenticate and pair \u2014 both first-class, an agent can drive either entirely from the terminal:
 
 - **CLI-native (agent):** \`{{cli}} login --device\` prints a code for one human OAuth approval; after that the session is stored locally and the agent runs unattended ("approve once, then autonomous"). Then \`{{cli}} runner serve\`/\`install-service\` pairs against your active company \u2014 an authenticated CLI can also self-issue a pairing code with \`runner.pairing.start\` and claim it.
-- **Web-guided (human):** issue a pairing code from Settings > Runners > Add a Runner, then on the host run \`{{cli}} runner serve --user-code <code>\`. The host stores only the runner bearer secret in an owner-only file and never logs in.
+- **Web-guided (human):** issue a pairing code from Settings > Runners > Add a Runner, then on the host run \`{{cli}} runner serve --user-code <code>\`. An explicit user code always claims that code, even if the host has an older local runner state file, so the browser and terminal do not accidentally point at different runner ids. The host stores only the runner bearer secret in an owner-only file and never logs in.
 
 Headless and service accounts are supported first-class: when no usable OS keychain exists (for example a service or SSH account), the CLI stores the session in an owner-only file (directory 0700, file 0600) automatically \u2014 no development flag. That file holds only the CLI session token, never tenant secrets, API keys, or vault refs.
 
@@ -52216,6 +52240,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind a Forge GitHub installation", "description": "Bind a signed GitHub App installation and selected repositories to Forge projects. Owner-only and human-gated; webhook payloads never supply tenant authority.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "account_login", "flag": "account-login", "type": "string", "required": true }, { "name": "account_id", "flag": "account-id", "type": "integer", "required": true }, { "name": "account_type", "flag": "account-type", "type": "string", "required": true }], "hasComplexInput": true, "help": "Bind a GitHub App installation and selected repositories to Forge projects. Owner-only and human-gated." },
   { "id": "software_factory.github.policy.upsert", "namespace": "software_factory", "action": "github.policy.upsert", "title": "Set a Forge GitHub automation policy", "description": "Set the server-side policy for GitHub actions and automation-mode ceilings. Owner-only and human-gated; production deploy remains human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": false }, { "name": "automation_mode_ceiling", "flag": "automation-mode-ceiling", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "allowed_actions", "flag": "allowed-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requires_human_for", "flag": "requires-human-for", "type": "array", "required": true, "itemType": "string" }], "hasComplexInput": false, "help": "Set Forge's server-side GitHub automation policy for actions, mode ceilings, and human-gated operations." },
   { "id": "software_factory.phase.advance", "namespace": "software_factory", "action": "phase.advance", "title": "Advance a Forge build request phase", "description": "Advance a build request to the next phase, enforcing the closed phase state machine server-side (an illegal transition is rejected). Writes a phase-run row and updates the current phase. Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "to_phase", "flag": "to-phase", "type": "enum", "required": true, "enumValues": ["intake", "discovery_scoping", "plan_review", "implementation", "plan_conformance_review", "security_review", "qa_verification", "release_preview", "merge_or_deploy_gate", "closeout"] }, { "name": "owning_seat_id", "flag": "owning-seat-id", "type": "string", "required": false }, { "name": "note", "flag": "note", "type": "string", "required": false }], "hasComplexInput": false, "help": "Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition." },
+  { "id": "software_factory.project.list", "namespace": "software_factory", "action": "project.list", "title": "List Forge projects", "description": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only and entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.create", "namespace": "software_factory", "action": "request.create", "title": "Create a Forge build request", "description": "Open a governed Forge build request against a connected software project. Records the request plus its initial intake phase run. Entitlement-gated (Forge add-on); the title is untrusted display text, never an instruction.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "source_channel", "flag": "source-channel", "type": "enum", "required": false, "enumValues": ["ui", "cli", "github_issue", "linear", "api"] }, { "name": "source_ref", "flag": "source-ref", "type": "string", "required": false }], "hasComplexInput": true, "help": "Open a governed Forge build request against a connected software project; the title is untrusted display text. Requires the Forge add-on." },
   { "id": "software_factory.request.list", "namespace": "software_factory", "action": "request.list", "title": "List Forge build requests", "description": "The Forge control-room board: the tenant's build requests with status, current phase, and risk/automation mode. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge build requests (the control-room board) with status, current phase, and risk. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.show", "namespace": "software_factory", "action": "request.show", "title": "Show a Forge build request", "description": "The Forge request detail: the build request, its current phase, phase-run history, and gates. Read-only, entitlement-gated, tenant-scoped.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Show a Forge build request's detail: current phase, phase-run history, and gates. Read-only; requires the Forge add-on." },
@@ -54906,11 +54931,13 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
       config2.expectedTenantId = expectedTenantId;
     }
   }
-  const existing = await loadState(config2.stateFile, config2.expectedTenantId);
-  if (existing) {
-    io.stdout.write(`reusing paired runner ${existing.runner_id}
+  if (config2.userCode === void 0) {
+    const existing = await loadState(config2.stateFile, config2.expectedTenantId);
+    if (existing) {
+      io.stdout.write(`reusing paired runner ${existing.runner_id}
 `);
-    return existing;
+      return existing;
+    }
   }
   let userCode;
   if (config2.userCode !== void 0) {
@@ -55265,7 +55292,12 @@ async function installService(options) {
   await writeFile3(paths.launchAgentPath, plist, { mode: 420 });
   await bootoutQuietly(options.exec, options.uid, paths.launchAgentPath);
   try {
-    await options.exec("launchctl", ["bootstrap", domainTarget(options.uid), paths.launchAgentPath]);
+    const bootstrapped = await bootstrapService(options.exec, options.uid, paths.launchAgentPath);
+    options.io.stdout.write(
+      bootstrapped.alreadyLoaded ? `Runner service was already loaded in launchd domain ${bootstrapped.domain}.
+` : `Loaded runner service in launchd domain ${bootstrapped.domain}.
+`
+    );
   } catch (error51) {
     options.io.stderr.write(
       `Failed to load the runner service: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
@@ -55300,15 +55332,13 @@ async function startService(options) {
     );
     return 1;
   }
+  let bootstrapped;
   try {
-    await options.exec("launchctl", ["bootstrap", domainTarget(options.uid), paths.launchAgentPath]);
-    options.io.stdout.write(`Started runner service ${label}.
-`);
-    return 0;
-  } catch (bootstrapError) {
+    bootstrapped = await bootstrapService(options.exec, options.uid, paths.launchAgentPath);
+  } catch {
     try {
-      await options.exec("launchctl", ["kickstart", "-k", serviceTarget(options.uid, label)]);
-      options.io.stdout.write(`Runner service ${label} was already loaded; restarted it.
+      const target2 = await kickstartService(options.exec, options.uid, label);
+      options.io.stdout.write(`Runner service ${label} was already loaded at ${target2}; restarted it.
 `);
       return 0;
     } catch (kickstartError) {
@@ -55319,6 +55349,24 @@ async function startService(options) {
       return 1;
     }
   }
+  if (!bootstrapped.alreadyLoaded) {
+    options.io.stdout.write(`Started runner service ${label} in launchd domain ${bootstrapped.domain}.
+`);
+    return 0;
+  }
+  const target = `${bootstrapped.domain}/${label}`;
+  try {
+    await kickstartServiceTarget(options.exec, target);
+    options.io.stdout.write(`Runner service ${label} was already loaded at ${target}; restarted it.
+`);
+    return 0;
+  } catch (kickstartError) {
+    options.io.stderr.write(
+      `Failed to start runner service ${label}: ${redactForLog(kickstartError instanceof Error ? kickstartError.message : String(kickstartError))}
+`
+    );
+    return 1;
+  }
 }
 async function stopService(options) {
   if (options.platform !== "darwin") {
@@ -55327,11 +55375,11 @@ async function stopService(options) {
   const safeName = safeRunnerName(options.runnerName);
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
-  try {
-    await options.exec("launchctl", ["bootout", domainTarget(options.uid), paths.launchAgentPath]);
+  const stopped = await bootoutAllDomains(options.exec, options.uid, paths.launchAgentPath);
+  if (stopped) {
     options.io.stdout.write(`Stopped runner service ${label}.
 `);
-  } catch {
+  } else {
     options.io.stdout.write(`Runner service ${label} was not running.
 `);
   }
@@ -55344,8 +55392,8 @@ async function restartService(options) {
   const safeName = safeRunnerName(options.runnerName);
   const label = serviceLabel(safeName);
   try {
-    await options.exec("launchctl", ["kickstart", "-k", serviceTarget(options.uid, label)]);
-    options.io.stdout.write(`Restarted runner service ${label}.
+    const target = await kickstartService(options.exec, options.uid, label);
+    options.io.stdout.write(`Restarted runner service ${label} at ${target}.
 `);
     return 0;
   } catch (error51) {
@@ -55365,13 +55413,14 @@ async function statusService(options) {
   const label = serviceLabel(safeName);
   const installed = await fileExists(paths.launchAgentPath);
   try {
-    const { stdout } = await options.exec("launchctl", ["print", serviceTarget(options.uid, label)]);
-    const state = extractLaunchdState(stdout);
+    const printed = await printService(options.exec, options.uid, label);
+    const state = extractLaunchdState(printed.stdout);
     options.io.stdout.write(
       `${[
         `runner service: ${label}`,
         `installed: ${installed ? "yes" : "no"}`,
         `loaded: yes`,
+        `domain: ${printed.target}`,
         `state: ${state ?? "unknown"}`,
         `plist: ${paths.launchAgentPath}`,
         `logs: ${paths.logDir}`
@@ -55489,17 +55538,72 @@ function safeRunnerName(runnerName) {
 function serviceLabel(safeName) {
   return `com.${cliBrand.binName}.runner.${safeName}`;
 }
-function domainTarget(uid) {
-  return `user/${uid}`;
+function launchdDomains(uid) {
+  return [`user/${uid}`, `gui/${uid}`];
 }
-function serviceTarget(uid, label) {
-  return `user/${uid}/${label}`;
+function serviceTargets(uid, label) {
+  return launchdDomains(uid).map((domain2) => `${domain2}/${label}`);
 }
 async function bootoutQuietly(exec, uid, plistPath) {
-  try {
-    await exec("launchctl", ["bootout", domainTarget(uid), plistPath]);
-  } catch {
+  await bootoutAllDomains(exec, uid, plistPath);
+}
+async function bootoutAllDomains(exec, uid, plistPath) {
+  let bootedOut = false;
+  for (const domain2 of launchdDomains(uid)) {
+    try {
+      await exec("launchctl", ["bootout", domain2, plistPath]);
+      bootedOut = true;
+    } catch {
+    }
+  }
+  return bootedOut;
+}
+async function bootstrapService(exec, uid, plistPath) {
+  const errors = [];
+  for (const domain2 of launchdDomains(uid)) {
+    try {
+      await exec("launchctl", ["bootstrap", domain2, plistPath]);
+      return { domain: domain2, alreadyLoaded: false };
+    } catch (error51) {
+      const message = error51 instanceof Error ? error51.message : String(error51);
+      if (isLaunchdAlreadyLoadedError(message)) {
+        return { domain: domain2, alreadyLoaded: true };
+      }
+      errors.push(`${domain2}: ${message}`);
+    }
+  }
+  throw new Error(errors.join("; "));
+}
+function isLaunchdAlreadyLoadedError(message) {
+  const normalized = message.toLowerCase();
+  return normalized.includes("service is already loaded") || normalized.includes("service already loaded") || normalized.includes("already bootstrapped") || normalized.includes("already exists");
+}
+async function kickstartService(exec, uid, label) {
+  const errors = [];
+  for (const target of serviceTargets(uid, label)) {
+    try {
+      await kickstartServiceTarget(exec, target);
+      return target;
+    } catch (error51) {
+      errors.push(`${target}: ${error51 instanceof Error ? error51.message : String(error51)}`);
+    }
+  }
+  throw new Error(errors.join("; "));
+}
+async function kickstartServiceTarget(exec, target) {
+  await exec("launchctl", ["kickstart", "-k", target]);
+}
+async function printService(exec, uid, label) {
+  const errors = [];
+  for (const target of serviceTargets(uid, label)) {
+    try {
+      const { stdout } = await exec("launchctl", ["print", target]);
+      return { target, stdout };
+    } catch (error51) {
+      errors.push(`${target}: ${error51 instanceof Error ? error51.message : String(error51)}`);
+    }
   }
+  throw new Error(errors.join("; "));
 }
 function unsupportedPlatform(io, platform2) {
   io.stderr.write(