@rulemetric/cli 0.2.1 → 0.2.3

package/dist/commands/service/install.js

@@ -1,305 +1,485 @@
-import { Flags } from '@oclif/core';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { execSync, execFileSync } from 'node:child_process';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { BaseCommand } from '../../base-command.js';
-import { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';
-// Only these env vars are written to the plist — never leak unrelated secrets
-const ALLOWED_ENV_VARS = new Set([
-    'SUPABASE_URL',
-    'SUPABASE_ANON_KEY',
-    'SUPABASE_SERVICE_ROLE_KEY',
-    'DATABASE_URL',
-    'RULEMETRIC_API_URL',
-    'RULEMETRIC_API_KEY',
-    'RULEMETRIC_ACCESS_TOKEN',
-    // Recipient for the weekly cron_data_integrity_audit notification.
-    // Without one of these, the audit cron runs but nobody is notified —
-    // see cron-data-integrity-audit.ts (defaults: NOTIFY_USER_ID then USER_ID).
-    'RULEMETRIC_AUDIT_NOTIFY_USER_ID',
-    'RULEMETRIC_USER_ID',
+import {
+  detectTmux
+} from "../../chunk-BO76WKJR.js";
+import "../../chunk-KRBQLMOP.js";
+import {
+  BaseCommand
+} from "../../chunk-S56LOTGQ.js";
+import "../../chunk-OGVORIFM.js";
+import {
+  bootstrapActiveOrg
+} from "../../chunk-2AM54TUK.js";
+import "../../chunk-EJOI2ZGU.js";
+import "../../chunk-KZRFUXGF.js";
+import "../../chunk-EKJ2CABV.js";
+import "../../chunk-NSBPE2FW.js";
+
+// src/commands/service/install.ts
+import { Flags } from "@oclif/core";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { execSync, execFileSync, spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var ALLOWED_ENV_VARS = /* @__PURE__ */ new Set([
+  "SUPABASE_URL",
+  "SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY",
+  // Enables local HS256 JWT verification in the API's authMiddleware —
+  // without it every authed request pays a /auth/v1/user network round-trip
+  // (measured p50 ~244ms) to Supabase.
+  "SUPABASE_JWT_SECRET",
+  "DATABASE_URL",
+  "RULEMETRIC_API_URL",
+  "RULEMETRIC_API_KEY",
+  "RULEMETRIC_ACCESS_TOKEN",
+  // Recipient for the weekly cron_data_integrity_audit notification.
+  // Without one of these, the audit cron runs but nobody is notified —
+  // see cron-data-integrity-audit.ts (defaults: NOTIFY_USER_ID then USER_ID).
+  "RULEMETRIC_AUDIT_NOTIFY_USER_ID",
+  "RULEMETRIC_USER_ID",
+  // cron_refresh_skills needs an authenticated GitHub API budget (5000
+  // req/hr) — without it the handler skips and the skills registry goes
+  // stale, which makes cron_suggest_instructions mark every suggestion
+  // stale on each nightly run.
+  "GITHUB_TOKEN",
+  // Pool-tuning overrides so the plist generators (buildPlist / buildWorkerPlist)
+  // actually honor a user-set value instead of always falling back to the pinned
+  // default — without these in the allow-list the `envVars.PG_* ?? '<default>'`
+  // escape hatch was silently dead. Pool-exhaustion RCA 2026-06-21.
+  "PG_POOL_MAX",
+  "PG_IDLE_TIMEOUT",
+  "PG_STATEMENT_TIMEOUT_MS"
 ]);
-const PLIST_LABEL = 'com.rulemetric.api';
-const PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.plist`);
-const WORKER_PLIST_LABEL = 'com.rulemetric.worker';
-const WORKER_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${WORKER_PLIST_LABEL}.plist`);
-// Daily kickstart agent — closes the graphile-LISTEN-wedge class observed
-// at ~25h uptime by ensuring the worker is restarted clean every day at
-// 04:00 local time. Sibling agent, separate launchd job, depends on
-// WORKER_PLIST_LABEL existing. Without this, end users would hit the
-// same wedge every ~day and have to debug it manually.
-const WORKER_RESTART_PLIST_LABEL = 'com.rulemetric.worker.restart';
-const WORKER_RESTART_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${WORKER_RESTART_PLIST_LABEL}.plist`);
-const CONFIG_DIR = join(homedir(), '.config', 'rulemetric');
-const LOG_DIR = join(CONFIG_DIR, 'logs');
-export default class ServiceInstall extends BaseCommand {
-    static description = 'Install RuleMetric API as a persistent macOS service (launchd)';
-    static examples = [
-        '<%= config.bin %> service install',
-        '<%= config.bin %> service install --port 3000',
-    ];
-    static flags = {
-        port: Flags.integer({
-            char: 'p',
-            default: 3000,
-            description: 'API server port',
-        }),
-        force: Flags.boolean({
-            char: 'f',
-            default: false,
-            description: 'Overwrite existing service configuration',
-        }),
-    };
-    async run() {
-        const { flags } = await this.parse(ServiceInstall);
-        const port = flags.port;
-        // macOS only
-        if (process.platform !== 'darwin') {
-            this.error('Service install is currently macOS-only (launchd). For Linux, use systemd manually.');
-        }
-        // Check for existing service
-        if (existsSync(PLIST_PATH) && !flags.force) {
-            this.log(`Service already installed at ${PLIST_PATH}`);
-            this.log('Use --force to overwrite, or run: rulemetric service status');
-            return;
-        }
-        // Check for port conflict
-        try {
-            const res = await fetch(`http://localhost:${port}/health`);
-            if (res.ok && !flags.force) {
-                this.warn(`Port ${port} is already in use (API may be running via start.sh).`);
-                this.warn('Stop it first with scripts/stop.sh, or use --force to overwrite.');
-                return;
-            }
-        }
-        catch {
-            // Port free — good
-        }
-        // Find project root (where the API package lives)
-        const projectRoot = this.findProjectRoot();
-        if (!projectRoot) {
-            this.error('Could not find RuleMetric project root. Run this command from within the momento-mori repo, or set RULEMETRIC_PROJECT_ROOT.');
-        }
-        // Verify .env.local exists (needed for Supabase credentials)
-        const envLocal = join(projectRoot, '.env.local');
-        if (!existsSync(envLocal)) {
-            this.error(`.env.local not found at ${envLocal}. The API needs Supabase credentials to start.`);
-        }
-        // Load env vars from .env.local and ~/.config/rulemetric/env
-        const envVars = this.loadEnvVars(projectRoot);
-        // Find node and pnpm paths
-        const nodePath = this.findBinary('node');
-        const pnpmPath = this.findBinary('pnpm');
-        if (!nodePath || !pnpmPath) {
-            this.error('Could not find node or pnpm. Ensure they are in your PATH.');
-        }
-        // Build the plist
-        const plist = this.buildPlist({
-            port,
-            projectRoot,
-            nodePath,
-            pnpmPath,
-            envVars,
-        });
-        // Create directories
-        mkdirSync(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });
-        mkdirSync(LOG_DIR, { recursive: true });
-        // Unload existing service if running
-        const uid = execSync('id -u', { encoding: 'utf-8' }).trim();
-        try {
-            execFileSync('launchctl', ['bootout', `gui/${uid}`, PLIST_PATH], { encoding: 'utf-8' });
-            this.log('[OK] Unloaded existing service');
-        }
-        catch (err) {
-            const msg = err.message || '';
-            // Expected errors when service isn't loaded
-            if (!msg.includes('Could not find specified service') && !msg.includes('No such process') && !msg.includes('3: No such process')) {
-                this.warn(`Could not unload existing service: ${msg.trim()}`);
-            }
-        }
-        // Write plist with restrictive permissions (contains credentials)
-        writeFileSync(PLIST_PATH, plist, { mode: 0o600 });
-        this.log(`[OK] Service plist written to ${PLIST_PATH}`);
-        // Load the service
-        try {
-            execFileSync('launchctl', ['bootstrap', `gui/${uid}`, PLIST_PATH]);
-            this.log('[OK] Service loaded into launchd');
-        }
-        catch (bootstrapErr) {
-            this.warn(`bootstrap failed (${bootstrapErr.message.trim()}), trying legacy load...`);
-            try {
-                execFileSync('launchctl', ['load', PLIST_PATH]);
-                this.log('[OK] Service loaded into launchd (legacy)');
-            }
-            catch (loadErr) {
-                this.error(`Could not load service.\n` +
-                    `  bootstrap: ${bootstrapErr.message.trim()}\n` +
-                    `  load: ${loadErr.message.trim()}\n` +
-                    `Try manually: launchctl bootstrap gui/${uid} "${PLIST_PATH}"`);
-            }
-        }
-        // Wait for API to come up
-        this.log(`[..] Waiting for API on :${port}...`);
-        const started = await this.waitForApi(port, 15);
-        if (started) {
-            this.log(`[OK] RuleMetric API running on :${port}`);
-        }
-        else {
-            this.warn('API did not respond within 15s. Check logs:');
-            this.log(`  tail -f ${LOG_DIR}/api-stdout.log`);
-            this.log(`  tail -f ${LOG_DIR}/api-stderr.log`);
-        }
-        // --- Worker service (eval/insights job processor) ---
-        this.log('');
-        this.log('Installing worker service...');
-        const workerPlist = this.buildWorkerPlist({
-            projectRoot,
-            nodePath,
-            pnpmPath,
-            envVars,
-        });
-        // Unload existing worker service if running
-        try {
-            execFileSync('launchctl', ['bootout', `gui/${uid}`, WORKER_PLIST_PATH], { encoding: 'utf-8' });
-        }
-        catch {
-            // Expected if not loaded
-        }
-        writeFileSync(WORKER_PLIST_PATH, workerPlist, { mode: 0o600 });
-        this.log(`[OK] Worker plist written to ${WORKER_PLIST_PATH}`);
-        try {
-            execFileSync('launchctl', ['bootstrap', `gui/${uid}`, WORKER_PLIST_PATH]);
-            this.log('[OK] Worker service loaded into launchd');
-        }
-        catch (bootstrapErr) {
-            try {
-                execFileSync('launchctl', ['load', WORKER_PLIST_PATH]);
-                this.log('[OK] Worker service loaded into launchd (legacy)');
-            }
-            catch (loadErr) {
-                this.warn(`Could not load worker service: ${loadErr.message.trim()}`);
-            }
-        }
-        // --- Worker daily auto-restart agent ---
-        // Closes the graphile-LISTEN-wedge class (observed at ~25h worker uptime).
-        // Without this, end users would hit a silent wedge every ~day where the
-        // worker stays "alive" but stops claiming jobs. With this, launchd
-        // kickstarts the worker every day at 04:00 local time; KeepAlive on the
-        // worker plist then respawns it clean, and the reclaimStaleLocks() boot
-        // step in graphile-worker-runner.ts releases any in-flight locks the
-        // old process was holding. See worker:restart helper for the manual path.
-        this.log('');
-        this.log('Installing worker auto-restart agent (daily 04:00)...');
-        const restartPlist = this.buildWorkerRestartPlist({ uid });
-        try {
-            execFileSync('launchctl', ['bootout', `gui/${uid}`, WORKER_RESTART_PLIST_PATH], { encoding: 'utf-8' });
-        }
-        catch {
-            // Expected if not loaded
-        }
-        writeFileSync(WORKER_RESTART_PLIST_PATH, restartPlist, { mode: 0o600 });
-        this.log(`[OK] Restart agent plist written to ${WORKER_RESTART_PLIST_PATH}`);
-        try {
-            execFileSync('launchctl', ['bootstrap', `gui/${uid}`, WORKER_RESTART_PLIST_PATH]);
-            this.log('[OK] Restart agent loaded into launchd (daily kickstart at 04:00)');
-        }
-        catch (bootstrapErr) {
-            try {
-                execFileSync('launchctl', ['load', WORKER_RESTART_PLIST_PATH]);
-                this.log('[OK] Restart agent loaded into launchd (legacy)');
-            }
-            catch (loadErr) {
-                this.warn(`Could not load restart agent: ${loadErr.message.trim()}`);
-            }
-        }
-        this.log('');
-        this.log('All three services installed: API + worker + daily worker restart.');
-        this.log('Both API and worker will start automatically on login and restart on crash.');
-        this.log('The worker processes eval jobs, insights jobs, and session analysis.');
-        this.log('');
-        this.log('NOTE: Env vars are baked in at install time. If you change');
-        this.log('.env.local or credentials, re-run: rulemetric service install --force');
-        this.log('');
-        this.log('Manage with:');
-        this.log('  rulemetric service status    — check if running');
-        this.log('  rulemetric service uninstall — remove the service');
-        // Ensure the active-org cache reflects the user's current active_org_id
-        // before the worker spawns its first capture. Belt-and-suspenders with
-        // BaseCommand's guarded refresh.
-        await bootstrapActiveOrg();
-    }
-    findProjectRoot() {
-        // Check env var override
-        if (process.env.RULEMETRIC_PROJECT_ROOT) {
-            return process.env.RULEMETRIC_PROJECT_ROOT;
+var PLIST_LABEL = "com.rulemetric.api";
+var PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+var WORKER_PLIST_LABEL = "com.rulemetric.worker";
+var WORKER_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${WORKER_PLIST_LABEL}.plist`);
+var GATEWAY_PLIST_LABEL = "com.rulemetric.gateway";
+var GATEWAY_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${GATEWAY_PLIST_LABEL}.plist`);
+var PROXY_PLIST_LABEL = "com.rulemetric.proxy";
+var PROXY_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${PROXY_PLIST_LABEL}.plist`);
+var WORKER_RESTART_PLIST_LABEL = "com.rulemetric.worker.restart";
+var WORKER_RESTART_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${WORKER_RESTART_PLIST_LABEL}.plist`);
+var CONFIG_DIR = join(homedir(), ".config", "rulemetric");
+var LOG_DIR = join(CONFIG_DIR, "logs");
+var GATEWAY_PORT = 8787;
+var PROXY_PORT = 8788;
+var ServiceInstall = class _ServiceInstall extends BaseCommand {
+  static description = "Install RuleMetric API, worker, gateway, and capture proxy as persistent macOS launchd services";
+  static examples = [
+    "<%= config.bin %> service install",
+    "<%= config.bin %> service install --port 3000",
+    "<%= config.bin %> service install --skip-build",
+    "<%= config.bin %> service install --no-proxy"
+  ];
+  static flags = {
+    port: Flags.integer({
+      char: "p",
+      default: 3e3,
+      description: "API server port"
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Overwrite existing service configuration and reclaim conflicting ports"
+    }),
+    "skip-build": Flags.boolean({
+      default: false,
+      description: "Skip the pre-install workspace build (API/web/cli dist must already exist)"
+    }),
+    "no-proxy": Flags.boolean({
+      default: false,
+      description: "Skip gateway + mitmproxy plists (just install API + worker)"
+    })
+  };
+  async run() {
+    const { flags } = await this.parse(_ServiceInstall);
+    const port = flags.port;
+    const skipBuild = flags["skip-build"];
+    const noProxy = flags["no-proxy"];
+    if (process.platform !== "darwin") {
+      this.error("Service install is currently macOS-only (launchd). For Linux, use systemd manually.");
+    }
+    if (existsSync(PLIST_PATH) && !flags.force) {
+      this.log(`Service already installed at ${PLIST_PATH}`);
+      this.log("Use --force to overwrite, or run: rulemetric service status");
+      return;
+    }
+    try {
+      const res = await fetch(`http://localhost:${port}/health`);
+      if (res.ok && !flags.force) {
+        this.warn(`Port ${port} is already in use (API may be running via start.sh or in another terminal).`);
+        this.warn("Stop it first with scripts/stop.sh, or use --force to take over the port.");
+        return;
+      }
+    } catch {
+    }
+    const projectRoot = this.findProjectRoot();
+    if (!projectRoot) {
+      this.error(
+        "Could not find RuleMetric project root. Run this command from within the momento-mori repo, or set RULEMETRIC_PROJECT_ROOT."
+      );
+    }
+    const envLocal = join(projectRoot, ".env.local");
+    if (!existsSync(envLocal)) {
+      this.error(`.env.local not found at ${envLocal}. The API needs Supabase credentials to start.`);
+    }
+    const envVars = this.guardAlwaysOnDatabaseUrl(this.loadEnvVars(projectRoot));
+    const nodePath = this.findBinary("node");
+    const pnpmPath = this.findBinary("pnpm");
+    if (!nodePath || !pnpmPath) {
+      this.error("Could not find node or pnpm. Ensure they are in your PATH.");
+    }
+    let mitmdumpPath = null;
+    if (!noProxy) {
+      mitmdumpPath = this.findBinary("mitmdump");
+      if (!mitmdumpPath) {
+        this.error(
+          "mitmdump not found in PATH. Install with: pipx install mitmproxy (or brew install mitmproxy), then re-run.\nOr skip the capture proxy with --no-proxy."
+        );
+      }
+    }
+    if (!skipBuild) {
+      this.log("[..] Building workspace artifacts (api, web, cli) via turbo...");
+      const buildFilters = [
+        "--filter",
+        "@rulemetric/api...",
+        "--filter",
+        "@rulemetric/web...",
+        "--filter",
+        "@rulemetric/cli"
+      ];
+      const build = spawnSync(pnpmPath, ["exec", "turbo", "run", "build", ...buildFilters], {
+        cwd: projectRoot,
+        stdio: "inherit"
+      });
+      if (build.status !== 0) {
+        this.error(
+          `Workspace build failed (exit ${build.status}). Fix the build first, or use --skip-build if dist/ already exists.`
+        );
+      }
+      this.log("[OK] Build complete");
+    } else {
+      this.log("[..] Skipping pre-install build (--skip-build)");
+    }
+    const apiEntry = join(projectRoot, "apps", "api", "dist", "index.js");
+    if (!existsSync(apiEntry)) {
+      this.error(`API entry not found at ${apiEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/api... build`);
+    }
+    const webIndex = join(projectRoot, "apps", "web", "dist", "index.html");
+    if (!existsSync(webIndex)) {
+      this.warn(`Web bundle not found at ${webIndex}. Dashboard at :${port} will 404 until you build apps/web.`);
+    }
+    if (!noProxy) {
+      const gatewayEntry = join(projectRoot, "apps", "cli", "dist", "lib", "gateway-entry.js");
+      if (!existsSync(gatewayEntry)) {
+        this.error(`Gateway entry not found at ${gatewayEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/cli build`);
+      }
+    }
+    if (flags.force) {
+      this.killStaleProcess(port, null, "API on :" + port);
+    }
+    if (!noProxy) {
+      this.killStaleProcess(GATEWAY_PORT, join(CONFIG_DIR, "gateway.pid"), "gateway");
+      this.killStaleProcess(PROXY_PORT, join(CONFIG_DIR, "proxy.pid"), "mitmproxy");
+    }
+    mkdirSync(join(homedir(), "Library", "LaunchAgents"), { recursive: true });
+    mkdirSync(LOG_DIR, { recursive: true });
+    const uid = execSync("id -u", { encoding: "utf-8" }).trim();
+    const apiPlist = this.buildPlist({ port, projectRoot, nodePath, pnpmPath, envVars });
+    this.bootoutAndWrite(uid, PLIST_PATH, apiPlist, "API");
+    this.bootstrapPlist(uid, PLIST_PATH, "API");
+    this.log(`[..] Waiting for API on :${port}...`);
+    const apiStarted = await this.waitForApi(port, 15);
+    if (apiStarted) {
+      this.log(`[OK] RuleMetric API running on :${port}`);
+      if (existsSync(webIndex)) {
+        this.log(`[OK] Dashboard available at http://localhost:${port}`);
+      }
+    } else {
+      this.warn("API did not respond within 15s. Check logs:");
+      this.log(`  tail -f ${LOG_DIR}/api-stdout.log`);
+      this.log(`  tail -f ${LOG_DIR}/api-stderr.log`);
+    }
+    this.log("");
+    this.log("Installing worker service...");
+    this.killStaleAgents();
+    const workerPlist = this.buildWorkerPlist({ projectRoot, nodePath, pnpmPath, envVars });
+    this.bootoutAndWrite(uid, WORKER_PLIST_PATH, workerPlist, "Worker");
+    this.bootstrapPlist(uid, WORKER_PLIST_PATH, "Worker");
+    if (!noProxy) {
+      this.log("");
+      this.log("Installing gateway + capture proxy services...");
+      const gatewayPlist = this.buildGatewayPlist({ projectRoot, nodePath });
+      this.bootoutAndWrite(uid, GATEWAY_PLIST_PATH, gatewayPlist, "Gateway");
+      this.bootstrapPlist(uid, GATEWAY_PLIST_PATH, "Gateway");
+      const proxyPlist = this.buildProxyPlist({
+        projectRoot,
+        mitmdumpPath,
+        envVars
+      });
+      this.bootoutAndWrite(uid, PROXY_PLIST_PATH, proxyPlist, "Proxy");
+      this.bootstrapPlist(uid, PROXY_PLIST_PATH, "Proxy");
+    }
+    if (existsSync(WORKER_RESTART_PLIST_PATH)) {
+      try {
+        execFileSync("launchctl", ["bootout", `gui/${uid}`, WORKER_RESTART_PLIST_PATH], { encoding: "utf-8" });
+      } catch {
+      }
+      try {
+        execFileSync("rm", ["-f", WORKER_RESTART_PLIST_PATH]);
+        this.log("[OK] Removed stale daily worker-restart agent (no longer needed on agent path)");
+      } catch {
+      }
+    }
+    this.log("");
+    if (noProxy) {
+      this.log("Installed: API + worker. Gateway/proxy skipped (--no-proxy).");
+    } else {
+      this.log("Installed: API + worker + gateway + capture proxy.");
+    }
+    this.log("All services start at login, restart on crash, and pick up rebuilds via WatchPaths.");
+    this.log("");
+    this.log("NOTE: Env vars are baked in at install time. If you change");
+    this.log(".env.local or credentials, re-run: rulemetric service install --force");
+    this.log("");
+    this.log("Manage with:");
+    this.log("  rulemetric service status    \u2014 check if running");
+    this.log("  rulemetric service uninstall \u2014 remove all services");
+    await bootstrapActiveOrg();
+    const tmux = await detectTmux();
+    this.log("");
+    if (tmux.available) {
+      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ""} \u2014 live send enabled`);
+    } else {
+      this.log("[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux");
+    }
+  }
+  findProjectRoot() {
+    if (process.env.RULEMETRIC_PROJECT_ROOT) {
+      return process.env.RULEMETRIC_PROJECT_ROOT;
+    }
+    let dir = process.cwd();
+    for (let i = 0; i < 10; i++) {
+      if (existsSync(join(dir, "apps", "api", "package.json"))) {
+        return dir;
+      }
+      const parent = join(dir, "..");
+      if (parent === dir) break;
+      dir = parent;
+    }
+    return null;
+  }
+  findBinary(name) {
+    try {
+      return execFileSync("which", [name], { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }).trim() || null;
+    } catch {
+      return null;
+    }
+  }
+  loadEnvVars(projectRoot) {
+    const vars = {};
+    const envLocal = join(projectRoot, ".env.local");
+    if (existsSync(envLocal)) {
+      for (const line of readFileSync(envLocal, "utf-8").split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) continue;
+        const eqIdx = trimmed.indexOf("=");
+        if (eqIdx > 0) {
+          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
         }
-        // Walk up from cwd looking for the monorepo marker
-        let dir = process.cwd();
-        for (let i = 0; i < 10; i++) {
-            if (existsSync(join(dir, 'apps', 'api', 'package.json'))) {
-                return dir;
-            }
-            const parent = join(dir, '..');
-            if (parent === dir)
-                break;
-            dir = parent;
+      }
+    }
+    const globalEnv = join(CONFIG_DIR, "env");
+    if (existsSync(globalEnv)) {
+      for (const line of readFileSync(globalEnv, "utf-8").split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) continue;
+        const eqIdx = trimmed.indexOf("=");
+        if (eqIdx > 0) {
+          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
         }
-        return null;
+      }
+    }
+    return Object.fromEntries(
+      Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k))
+    );
+  }
+  // Guard: the always-on API + worker MUST use the TRANSACTION-mode pooler
+  // (port 6543). A SESSION-mode URL (:5432, 15-slot cap) baked into these
+  // services was the trigger of the recurring pool saturation — a pool-cascade
+  // debugging override leaked into the plists through this very installer. Auto-
+  // correct the obvious session→transaction port and warn loudly; warn (but do
+  // not block) on a direct, non-pooler URL. Pool-exhaustion RCA 2026-06-21.
+  guardAlwaysOnDatabaseUrl(envVars) {
+    const url = envVars.DATABASE_URL;
+    if (!url) return envVars;
+    if (url.includes("pooler.supabase.com:5432")) {
+      this.warn(
+        "DATABASE_URL points at the SESSION-mode pooler (:5432, 15-slot cap). The always-on API/worker must use TRANSACTION mode (:6543) \u2014 auto-correcting for the installed services. Fix .env.local to silence this warning."
+      );
+      return { ...envVars, DATABASE_URL: url.replace("pooler.supabase.com:5432", "pooler.supabase.com:6543") };
+    }
+    if (/@db\.[a-z0-9]+\.supabase\.co[:/]/.test(url)) {
+      this.warn(
+        "DATABASE_URL is a DIRECT database connection (db.<ref>.supabase.co), not the pooler. Always-on services should use the transaction pooler (aws-*.pooler.supabase.com:6543) to avoid exhausting Postgres connections."
+      );
     }
-    findBinary(name) {
+    return envVars;
+  }
+  // Reap orphaned, unsupervised `evals agent` worker processes before
+  // (re)bootstrapping the launchd worker. The worker holds no listening port,
+  // so killStaleProcess (port/pidfile based) cannot find detached agents — a
+  // fleet of 4 ran 3+ days and helped saturate the pool (RCA 2026-06-21). pgrep
+  // the command line and SIGTERM every match except ourselves; the agent's own
+  // single-instance lock then keeps a fresh fleet from forming.
+  killStaleAgents() {
+    try {
+      const out = execFileSync("pgrep", ["-f", "bin/run.js evals agent"], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      const pids = out.trim().split("\n").filter(Boolean).map((s) => parseInt(s, 10)).filter((p) => !isNaN(p) && p !== process.pid);
+      for (const pid of pids) {
         try {
-            return execFileSync('which', [name], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).trim() || null;
-        }
-        catch {
-            return null;
+          process.kill(pid, "SIGTERM");
+          this.log(`[OK] Reaped orphan evals agent (PID ${pid})`);
+        } catch {
         }
+      }
+      if (pids.length) spawnSync("sleep", ["1"], { stdio: "ignore" });
+    } catch {
     }
-    loadEnvVars(projectRoot) {
-        const vars = {};
-        // Load from .env.local (Supabase credentials)
-        const envLocal = join(projectRoot, '.env.local');
-        if (existsSync(envLocal)) {
-            for (const line of readFileSync(envLocal, 'utf-8').split('\n')) {
-                const trimmed = line.trim();
-                if (!trimmed || trimmed.startsWith('#'))
-                    continue;
-                const eqIdx = trimmed.indexOf('=');
-                if (eqIdx > 0) {
-                    vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
-                }
-            }
+  }
+  // Best-effort cleanup of a process that would conflict with an
+  // about-to-bootstrap launchd plist. Tries two routes:
+  //   (a) the PID file written by the legacy spawn path
+  //       (gateway-lifecycle / proxy start), if pidFile is non-null
+  //   (b) anything actively listening on the expected port
+  // Either way: SIGTERM + small grace + SIGKILL fallback. Stale PID file
+  // gets unlinked.
+  killStaleProcess(port, pidFile, name) {
+    let killedAny = false;
+    if (pidFile && existsSync(pidFile)) {
+      try {
+        const pidStr = readFileSync(pidFile, "utf-8").trim();
+        const pid = parseInt(pidStr, 10);
+        if (!isNaN(pid)) {
+          try {
+            process.kill(pid, "SIGTERM");
+            killedAny = true;
+            this.log(`[OK] Stopped existing ${name} (PID ${pid} from ${pidFile})`);
+          } catch {
+          }
         }
-        // Load from ~/.config/rulemetric/env (API key)
-        const globalEnv = join(CONFIG_DIR, 'env');
-        if (existsSync(globalEnv)) {
-            for (const line of readFileSync(globalEnv, 'utf-8').split('\n')) {
-                const trimmed = line.trim();
-                if (!trimmed || trimmed.startsWith('#'))
-                    continue;
-                const eqIdx = trimmed.indexOf('=');
-                if (eqIdx > 0) {
-                    vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
-                }
-            }
+      } catch {
+      }
+      try {
+        execFileSync("rm", ["-f", pidFile]);
+      } catch {
+      }
+    }
+    try {
+      const result = execFileSync("lsof", ["-ti", `:${port}`, "-sTCP:LISTEN"], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      const pids = result.trim().split("\n").filter(Boolean);
+      for (const pidStr of pids) {
+        const pid = parseInt(pidStr, 10);
+        if (!isNaN(pid)) {
+          try {
+            process.kill(pid, "SIGTERM");
+            killedAny = true;
+            this.log(`[OK] Stopped orphan on :${port} (PID ${pid})`);
+          } catch {
+          }
         }
-        // Only keep allowed env vars — never leak unrelated secrets
-        return Object.fromEntries(Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k)));
-    }
-    buildPlist(opts) {
-        const { port, projectRoot, nodePath, pnpmPath, envVars } = opts;
-        // Derive PATH from resolved binary locations (works with nvm, volta, fnm, homebrew)
-        const pathDirs = [...new Set([dirname(nodePath), dirname(pnpmPath), '/usr/local/bin', '/usr/bin', '/bin'])];
-        // Build environment dict entries
-        const envEntries = Object.entries({
-            ...envVars,
-            PORT: String(port),
-            NODE_ENV: 'development',
-            PATH: pathDirs.join(':'),
-        })
-            .map(([k, v]) => `      <key>${escapeXml(k)}</key>\n      <string>${escapeXml(v)}</string>`)
-            .join('\n');
-        return `<?xml version="1.0" encoding="UTF-8"?>
+      }
+    } catch {
+    }
+    if (killedAny) {
+      spawnSync("sleep", ["1"], { stdio: "ignore" });
+    }
+  }
+  bootoutAndWrite(uid, plistPath, content, name) {
+    const benignBootoutPatterns = [
+      "Could not find specified service",
+      "No such process",
+      "3: No such process",
+      "5: Input/output error"
+    ];
+    try {
+      execFileSync("launchctl", ["bootout", `gui/${uid}`, plistPath], {
+        encoding: "utf-8",
+        // Capture stderr instead of letting it print to the user's terminal.
+        // The plist was either already-loaded (we unload it cleanly) or not
+        // loaded (we want to swallow the error) — the user shouldn't see
+        // launchctl's raw output either way.
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      this.log(`[OK] Unloaded existing ${name} service`);
+    } catch (err) {
+      const msg = err.message || "";
+      const stderr = (err.stderr ?? "").toString();
+      const combined = `${msg}
+${stderr}`;
+      if (!benignBootoutPatterns.some((p) => combined.includes(p))) {
+        this.warn(`Could not unload existing ${name} service: ${msg.trim()}`);
+      }
+    }
+    writeFileSync(plistPath, content, { mode: 384 });
+    this.log(`[OK] ${name} plist written to ${plistPath}`);
+  }
+  bootstrapPlist(uid, plistPath, name) {
+    try {
+      execFileSync("launchctl", ["bootstrap", `gui/${uid}`, plistPath]);
+      this.log(`[OK] ${name} service loaded into launchd`);
+    } catch (bootstrapErr) {
+      try {
+        execFileSync("launchctl", ["load", plistPath]);
+        this.log(`[OK] ${name} service loaded into launchd (legacy)`);
+      } catch (loadErr) {
+        this.warn(
+          `Could not load ${name} service.
+  bootstrap: ${bootstrapErr.message.trim()}
+  load: ${loadErr.message.trim()}`
+        );
+      }
+    }
+  }
+  buildPlist(opts) {
+    const { port, projectRoot, nodePath, pnpmPath, envVars } = opts;
+    const pathDirs = [.../* @__PURE__ */ new Set([dirname(nodePath), dirname(pnpmPath), "/usr/local/bin", "/usr/bin", "/bin"])];
+    const envEntries = Object.entries({
+      ...envVars,
+      PORT: String(port),
+      NODE_ENV: "production",
+      PATH: pathDirs.join(":"),
+      // Pool resilience for the always-on API (NOT the worker, which runs
+      // legitimately long analytics queries). A wedged Supavisor socket with
+      // the default max=3 pool and no query timeout hangs every authenticated
+      // request — the 2026-06-09 login-hang. statement_timeout lets Postgres
+      // cancel a stuck query so the connection returns to the pool (verified
+      // honored through the transaction pooler); the larger pool adds headroom.
+      // Both env-overridable. See packages/db/src/client.ts.
+      PG_POOL_MAX: envVars.PG_POOL_MAX ?? "10",
+      PG_STATEMENT_TIMEOUT_MS: envVars.PG_STATEMENT_TIMEOUT_MS ?? "10000",
+      // Keep the pool warm so the API stops reconnecting (and re-resolving the
+      // rotating pooler ELB) on nearly every request — the churn that exposed
+      // it to intermittent CONNECT_TIMEOUT/ENOTFOUND. Worker/tests keep the
+      // conservative 5s default. See packages/db/src/client.ts (2026-06-09).
+      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? "30",
+      // Silence per-span stdout dumps on the local API — it has no OTLP
+      // endpoint and a fixed (now rotated) log file; the ConsoleSpanExporter
+      // grew api-stdout to 370MB / ~400k spans. Fly leaves this unset so its
+      // console spans stay grep-able in the managed log stream.
+      OTEL_SPAN_EXPORT: envVars.OTEL_SPAN_EXPORT ?? "none"
+    }).map(([k, v]) => `      <key>${escapeXml(k)}</key>
+      <string>${escapeXml(v)}</string>`).join("\n");
+    const apiEntry = join(projectRoot, "apps", "api", "dist", "index.js");
+    const apiDist = join(projectRoot, "apps", "api", "dist");
+    return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -308,10 +488,8 @@ export default class ServiceInstall extends BaseCommand {
 
   <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(pnpmPath)}</string>
-    <string>--filter</string>
-    <string>@rulemetric/api</string>
-    <string>dev</string>
+    <string>${escapeXml(nodePath)}</string>
+    <string>${escapeXml(apiEntry)}</string>
   </array>
 
   <key>WorkingDirectory</key>
@@ -334,40 +512,42 @@ ${envEntries}
   <key>ThrottleInterval</key>
   <integer>10</integer>
 
+  <key>WatchPaths</key>
+  <array>
+    <string>${escapeXml(apiDist)}</string>
+  </array>
+
   <key>StandardOutPath</key>
-  <string>${escapeXml(join(LOG_DIR, 'api-stdout.log'))}</string>
+  <string>${escapeXml(join(LOG_DIR, "api-stdout.log"))}</string>
 
   <key>StandardErrorPath</key>
-  <string>${escapeXml(join(LOG_DIR, 'api-stderr.log'))}</string>
+  <string>${escapeXml(join(LOG_DIR, "api-stderr.log"))}</string>
 
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
 </plist>
 `;
-    }
-    buildWorkerPlist(opts) {
-        const { projectRoot, nodePath, pnpmPath, envVars } = opts;
-        const pathDirs = [...new Set([dirname(nodePath), dirname(pnpmPath), '/usr/local/bin', '/usr/bin', '/bin'])];
-        const envEntries = Object.entries({
-            ...envVars,
-            NODE_ENV: 'development',
-            PATH: pathDirs.join(':'),
-        })
-            .map(([k, v]) => `      <key>${escapeXml(k)}</key>\n      <string>${escapeXml(v)}</string>`)
-            .join('\n');
-        // Run the CLI bin directly via node. Earlier this used
-        // `pnpm --filter @rulemetric/cli exec rulemetric` but pnpm-exec couldn't
-        // resolve the workspace bin symlink reliably under launchd, crash-looping
-        // with `Command "rulemetric" not found`. Direct node invocation is both
-        // simpler (one process less) and avoids the bin-symlink lookup entirely.
-        const cliBin = join(projectRoot, 'apps', 'cli', 'bin', 'run.js');
-        // Watch the CLI's dist directory: when `pnpm build` overwrites it, launchd
-        // bounces the worker so a freshly-built version of the eval-worker code
-        // (e.g. with a new job-kind capability) takes effect without a manual
-        // kickstart. WatchPaths fires on any change beneath the directory.
-        const cliDist = join(projectRoot, 'apps', 'cli', 'dist');
-        return `<?xml version="1.0" encoding="UTF-8"?>
+  }
+  buildWorkerPlist(opts) {
+    const { projectRoot, nodePath, pnpmPath, envVars } = opts;
+    const pathDirs = [.../* @__PURE__ */ new Set([dirname(nodePath), dirname(pnpmPath), "/usr/local/bin", "/usr/bin", "/bin"])];
+    const envEntries = Object.entries({
+      ...envVars,
+      NODE_ENV: "development",
+      PATH: pathDirs.join(":"),
+      // Bound the worker's pooler footprint. The worker is mostly idle (HTTP
+      // long-poll); an UNPINNED pool plus the previously-missing single-instance
+      // guard let an orphaned fleet of agents each hold a pool and saturate
+      // Supavisor's 200-client cap. A small pool + short idle timeout releases
+      // sessions promptly. Pool-exhaustion RCA 2026-06-21.
+      PG_POOL_MAX: envVars.PG_POOL_MAX ?? "3",
+      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? "10"
+    }).map(([k, v]) => `      <key>${escapeXml(k)}</key>
+      <string>${escapeXml(v)}</string>`).join("\n");
+    const cliBin = join(projectRoot, "apps", "cli", "bin", "run.js");
+    const cliDist = join(projectRoot, "apps", "cli", "dist");
+    return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -379,7 +559,7 @@ ${envEntries}
     <string>${escapeXml(nodePath)}</string>
     <string>${escapeXml(cliBin)}</string>
     <string>evals</string>
-    <string>listen</string>
+    <string>agent</string>
   </array>
 
   <key>WorkingDirectory</key>
@@ -408,115 +588,169 @@ ${envEntries}
   </array>
 
   <key>StandardOutPath</key>
-  <string>${escapeXml(join(LOG_DIR, 'worker-stdout.log'))}</string>
+  <string>${escapeXml(join(LOG_DIR, "worker-stdout.log"))}</string>
 
   <key>StandardErrorPath</key>
-  <string>${escapeXml(join(LOG_DIR, 'worker-stderr.log'))}</string>
+  <string>${escapeXml(join(LOG_DIR, "worker-stderr.log"))}</string>
 
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
 </plist>
 `;
-    }
-    /**
-     * Plist for the daily worker auto-restart agent. Fires at 04:00 local
-     * time and runs `launchctl kickstart -k gui/<uid>/com.rulemetric.worker`
-     * which terminates the running worker process; KeepAlive on the worker
-     * plist then respawns it clean. UID is dynamic (caller passes id -u
-     * output) so this works on any laptop, not just the developer's.
-     *
-     * Without this agent, the worker silently wedges around ~25h of uptime
-     * (graphile-worker's LISTEN socket dies, heartbeats continue, but no new
-     * jobs claimed). The watchdog correctly refuses to suicide the process
-     * (per the 2026-05-18 supavisor cascade lessons), so without auto-restart
-     * the wedge sits indefinitely until an operator notices and kicks it.
-     * End users shouldn't have to debug this — that's why it's part of
-     * `service install`.
-     */
-    buildWorkerRestartPlist(opts) {
-        const { uid } = opts;
-        return `<?xml version="1.0" encoding="UTF-8"?>
+  }
+  // CONNECT-proxy router that fronts mitmproxy on :8787. Always-on so
+  // .claude/settings.json's HTTPS_PROXY pointer never resolves to a dead
+  // socket (which would break Claude Code entirely — see CLAUDE.md).
+  // NOT watched on rebuild: bouncing the gateway mid-request would drop
+  // in-flight streaming responses. Gateway code changes rarely; on
+  // upgrade, the user can `launchctl kickstart gui/<uid>/com.rulemetric.gateway`.
+  buildGatewayPlist(opts) {
+    const { projectRoot, nodePath } = opts;
+    const gatewayEntry = join(projectRoot, "apps", "cli", "dist", "lib", "gateway-entry.js");
+    const cliBin = join(projectRoot, "apps", "cli", "bin", "run.js");
+    const pathDirs = [.../* @__PURE__ */ new Set([dirname(nodePath), "/usr/local/bin", "/usr/bin", "/bin"])];
+    const env = {
+      RULEMETRIC_CLI_VERSION: this.config.version,
+      RULEMETRIC_CLI_ENTRY: cliBin,
+      PATH: pathDirs.join(":")
+    };
+    const envEntries = Object.entries(env).map(([k, v]) => `      <key>${escapeXml(k)}</key>
+      <string>${escapeXml(v)}</string>`).join("\n");
+    return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${WORKER_RESTART_PLIST_LABEL}</string>
+  <string>${GATEWAY_PLIST_LABEL}</string>
 
   <key>ProgramArguments</key>
   <array>
-    <string>/bin/launchctl</string>
-    <string>kickstart</string>
-    <string>-k</string>
-    <string>gui/${escapeXml(uid)}/${WORKER_PLIST_LABEL}</string>
+    <string>${escapeXml(nodePath)}</string>
+    <string>${escapeXml(gatewayEntry)}</string>
   </array>
 
-  <!-- Fire every 6 hours (00:00, 06:00, 12:00, 18:00 local). The original
-       daily schedule (04:00 only) capped the wedge window at <=24h, but
-       we observed the graphile-LISTEN-wedge firing 4x in 28h during the
-       2026-05-24 testing — well before the 24h cap. Quartering the
-       cadence drops the worst-case end-user-blocking window to <=6h.
-       Each restart is ~5s of worker downtime; 4x/day = 20s/day total. -->
-  <key>StartCalendarInterval</key>
+  <key>WorkingDirectory</key>
+  <string>${escapeXml(projectRoot)}</string>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+${envEntries}
+  </dict>
+
+  <key>RunAtLoad</key>
+  <true/>
+
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+
+  <key>StandardOutPath</key>
+  <string>${escapeXml(join(LOG_DIR, "gateway-stdout.log"))}</string>
+
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(join(LOG_DIR, "gateway-stderr.log"))}</string>
+
+  <key>ProcessType</key>
+  <string>Background</string>
+</dict>
+</plist>
+`;
+  }
+  // mitmproxy with the RuleMetric capture addon. Same invocation as
+  // `rulemetric proxy start` (see commands/proxy/start.ts:308) so the
+  // launchd path and the CLI path are interchangeable. We don't WatchPath
+  // the Python addon — mitmdump has its own addon reload that handles
+  // edits without a full process restart.
+  buildProxyPlist(opts) {
+    const { projectRoot, mitmdumpPath, envVars } = opts;
+    const addonPath = join(projectRoot, "packages", "proxy", "addon", "rulemetric_addon.py");
+    const pathDirs = [.../* @__PURE__ */ new Set([dirname(mitmdumpPath), "/usr/local/bin", "/usr/bin", "/bin"])];
+    const env = {
+      ...envVars,
+      RULEMETRIC_PROJECT_PATH: projectRoot,
+      RULEMETRIC_CLI_VERSION: this.config.version,
+      PATH: pathDirs.join(":")
+    };
+    const envEntries = Object.entries(env).map(([k, v]) => `      <key>${escapeXml(k)}</key>
+      <string>${escapeXml(v)}</string>`).join("\n");
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${PROXY_PLIST_LABEL}</string>
+
+  <key>ProgramArguments</key>
   <array>
-    <dict>
-      <key>Hour</key>
-      <integer>0</integer>
-      <key>Minute</key>
-      <integer>0</integer>
-    </dict>
-    <dict>
-      <key>Hour</key>
-      <integer>6</integer>
-      <key>Minute</key>
-      <integer>0</integer>
-    </dict>
-    <dict>
-      <key>Hour</key>
-      <integer>12</integer>
-      <key>Minute</key>
-      <integer>0</integer>
-    </dict>
-    <dict>
-      <key>Hour</key>
-      <integer>18</integer>
-      <key>Minute</key>
-      <integer>0</integer>
-    </dict>
+    <string>${escapeXml(mitmdumpPath)}</string>
+    <string>--listen-port</string>
+    <string>${PROXY_PORT}</string>
+    <string>-s</string>
+    <string>${escapeXml(addonPath)}</string>
+    <string>--set</string>
+    <string>console_eventlog_verbosity=info</string>
   </array>
 
+  <key>WorkingDirectory</key>
+  <string>${escapeXml(projectRoot)}</string>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+${envEntries}
+  </dict>
+
   <key>RunAtLoad</key>
-  <false/>
+  <true/>
+
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+
+  <key>ThrottleInterval</key>
+  <integer>15</integer>
 
-  <key>StandardErrorPath</key>
-  <string>${escapeXml(join(LOG_DIR, 'worker-restart.log'))}</string>
   <key>StandardOutPath</key>
-  <string>${escapeXml(join(LOG_DIR, 'worker-restart.log'))}</string>
+  <string>${escapeXml(join(LOG_DIR, "proxy-stdout.log"))}</string>
+
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(join(LOG_DIR, "proxy-stderr.log"))}</string>
+
+  <key>ProcessType</key>
+  <string>Background</string>
 </dict>
 </plist>
 `;
+  }
+  async waitForApi(port, timeoutSecs) {
+    let lastError = null;
+    for (let i = 0; i < timeoutSecs; i++) {
+      try {
+        const res = await fetch(`http://localhost:${port}/health`);
+        if (res.ok) return true;
+        lastError = `health check returned ${res.status}`;
+      } catch (err) {
+        lastError = err.message;
+      }
+      await new Promise((r) => setTimeout(r, 1e3));
     }
-    async waitForApi(port, timeoutSecs) {
-        let lastError = null;
-        for (let i = 0; i < timeoutSecs; i++) {
-            try {
-                const res = await fetch(`http://localhost:${port}/health`);
-                if (res.ok)
-                    return true;
-                lastError = `health check returned ${res.status}`;
-            }
-            catch (err) {
-                lastError = err.message;
-            }
-            await new Promise(r => setTimeout(r, 1000));
-        }
-        if (lastError) {
-            this.warn(`Last health check error: ${lastError}`);
-        }
-        return false;
+    if (lastError) {
+      this.warn(`Last health check error: ${lastError}`);
     }
-}
+    return false;
+  }
+};
 function escapeXml(s) {
-    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-//# sourceMappingURL=install.js.map
+export {
+  ServiceInstall as default
+};
+//# sourceMappingURL=install.js.map