@rulemetric/cli 0.7.2 → 0.7.4

package/dist/commands/service/install.js

@@ -1,688 +1,48 @@
-import {
-  detectTmux
-} from "../../chunk-BO76WKJR.js";
-import "../../chunk-KRBQLMOP.js";
-import {
-  BaseCommand
-} from "../../chunk-2HK7RGZB.js";
-import "../../chunk-R56PH7YE.js";
-import {
-  emitSetupEvent
-} from "../../chunk-GQNJO2P2.js";
-import {
-  bootstrapActiveOrg
-} from "../../chunk-37LN5O7M.js";
-import "../../chunk-EKJ2CABV.js";
-import "../../chunk-ZUJBM6HE.js";
-import "../../chunk-W2YERO7E.js";
-import "../../chunk-NSBPE2FW.js";
-
-// src/commands/service/install.ts
-import { Flags } from "@oclif/core";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { execSync, execFileSync, spawnSync } from "node:child_process";
-import { homedir, userInfo } from "node:os";
-import { dirname, join } from "node:path";
-var ALLOWED_ENV_VARS = /* @__PURE__ */ new Set([
-  "SUPABASE_URL",
-  "SUPABASE_ANON_KEY",
-  "SUPABASE_SERVICE_ROLE_KEY",
-  // Enables local HS256 JWT verification in the API's authMiddleware —
-  // without it every authed request pays a /auth/v1/user network round-trip
-  // (measured p50 ~244ms) to Supabase.
-  "SUPABASE_JWT_SECRET",
-  "DATABASE_URL",
-  "RULEMETRIC_API_URL",
-  "RULEMETRIC_API_KEY",
-  "RULEMETRIC_ACCESS_TOKEN",
-  // Recipient for the weekly cron_data_integrity_audit notification.
-  // Without one of these, the audit cron runs but nobody is notified —
-  // see cron-data-integrity-audit.ts (defaults: NOTIFY_USER_ID then USER_ID).
-  "RULEMETRIC_AUDIT_NOTIFY_USER_ID",
-  "RULEMETRIC_USER_ID",
-  // cron_refresh_skills needs an authenticated GitHub API budget (5000
-  // req/hr) — without it the handler skips and the skills registry goes
-  // stale, which makes cron_suggest_instructions mark every suggestion
-  // stale on each nightly run.
-  "GITHUB_TOKEN",
-  // Pool-tuning overrides so the plist generators (buildPlist / buildWorkerPlist)
-  // actually honor a user-set value instead of always falling back to the pinned
-  // default — without these in the allow-list the `envVars.PG_* ?? '<default>'`
-  // escape hatch was silently dead. Pool-exhaustion RCA 2026-06-21.
-  "PG_POOL_MAX",
-  "PG_IDLE_TIMEOUT",
-  "PG_STATEMENT_TIMEOUT_MS",
-  // Heavy-read bulkhead size + client-side query deadline — prod sets both
-  // (fly.toml); without them here a local launchd install can't match prod
-  // pool math. See packages/db/src/client.ts (getHeavyDb / raceWithDeadline).
-  "PG_HEAVY_POOL_MAX",
-  "PG_QUERY_DEADLINE_MS",
-  // Resend transactional email. The worker (`evals agent`) sends changelog
-  // announcements via `@rulemetric/email` → `sendEmail()`, which picks the
-  // provider from `process.env.RESEND_API_KEY`. Without these in the allow-list
-  // the installer stripped them out of the worker plist, the CLI never loads
-  // `.env.local`, so the worker fell back to the `noop` provider and SILENTLY
-  // dropped every announcement email. RESEND_FROM_EMAIL must be the verified
-  // sender (noreply@rulemetric.com) — otherwise the provider defaults to
-  // Resend's shared sandbox `onboarding@resend.dev`, which Gmail spam-filters.
-  "RESEND_API_KEY",
-  "RESEND_FROM_EMAIL",
-  // Sentry error capture for the worker process. The worker (`evals agent`)
-  // calls initSentry(), which now keys off DSN presence alone. Without this in
-  // the allow-list the installer stripped SENTRY_DSN from the worker plist, so
-  // worker crashes went unreported even when the DSN was set in .env.local /
-  // ~/.config/rulemetric/env. The DSN is ingest-only (not a secret).
-  "SENTRY_DSN"
-]);
-var PLIST_LABEL = "com.rulemetric.api";
-var PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
-var WORKER_PLIST_LABEL = "com.rulemetric.worker";
-var WORKER_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${WORKER_PLIST_LABEL}.plist`);
-var GATEWAY_PLIST_LABEL = "com.rulemetric.gateway";
-var GATEWAY_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${GATEWAY_PLIST_LABEL}.plist`);
-var PROXY_PLIST_LABEL = "com.rulemetric.proxy";
-var PROXY_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${PROXY_PLIST_LABEL}.plist`);
-var WORKER_RESTART_PLIST_LABEL = "com.rulemetric.worker.restart";
-var WORKER_RESTART_PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${WORKER_RESTART_PLIST_LABEL}.plist`);
-var CONFIG_DIR = join(homedir(), ".config", "rulemetric");
-var LOG_DIR = join(CONFIG_DIR, "logs");
-var GATEWAY_PORT = 8787;
-var PROXY_PORT = 8788;
-var WORKER_SYSTEMD_DIR = join(homedir(), ".config", "systemd", "user");
-var WORKER_SYSTEMD_UNIT = "rulemetric-worker.service";
-var WORKER_SYSTEMD_PATH = join(WORKER_SYSTEMD_DIR, WORKER_SYSTEMD_UNIT);
-var ServiceInstall = class _ServiceInstall extends BaseCommand {
-  static description = "Install RuleMetric services. Default (in a repo checkout): API + worker + gateway + capture proxy as launchd agents. With --worker-only: just the job worker, targeting the globally-installed CLI \u2014 no repo, no build (works from `npm i -g @rulemetric/cli`, macOS launchd or Linux systemd).";
-  static examples = [
-    "<%= config.bin %> service install",
-    "<%= config.bin %> service install --port 3000",
-    "<%= config.bin %> service install --skip-build",
-    "<%= config.bin %> service install --no-proxy",
-    "<%= config.bin %> service install --worker-only"
-  ];
-  static flags = {
-    port: Flags.integer({
-      char: "p",
-      default: 3e3,
-      description: "API server port"
-    }),
-    force: Flags.boolean({
-      char: "f",
-      default: false,
-      description: "Overwrite existing service configuration and reclaim conflicting ports"
-    }),
-    "skip-build": Flags.boolean({
-      default: false,
-      description: "Skip the pre-install workspace build (API/web/cli dist must already exist)"
-    }),
-    "no-proxy": Flags.boolean({
-      default: false,
-      description: "Skip gateway + mitmproxy plists (just install API + worker)"
-    }),
-    "worker-only": Flags.boolean({
-      default: false,
-      description: "Install ONLY the job worker as a persistent service, targeting the globally-installed CLI (no repo checkout, no build, no API/gateway/proxy). Sources auth from ~/.config/rulemetric/env. macOS (launchd) + Linux (systemd --user)."
-    })
-  };
-  async run() {
-    const { flags } = await this.parse(_ServiceInstall);
-    const port = flags.port;
-    const skipBuild = flags["skip-build"];
-    const noProxy = flags["no-proxy"];
-    if (flags["worker-only"]) {
-      await this.runWorkerOnly(flags.force);
-      return;
-    }
-    if (process.platform !== "darwin") {
-      this.error(
-        "The full service install is macOS-only (launchd). For just the job worker on Linux (or a clean npm install), use: rulemetric service install --worker-only"
-      );
-    }
-    if (existsSync(PLIST_PATH) && !flags.force) {
-      this.log(`Service already installed at ${PLIST_PATH}`);
-      this.log("Use --force to overwrite, or run: rulemetric service status");
-      return;
-    }
-    try {
-      const res = await fetch(`http://localhost:${port}/health`);
-      if (res.ok && !flags.force) {
-        this.warn(`Port ${port} is already in use (API may be running via start.sh or in another terminal).`);
-        this.warn("Stop it first with scripts/stop.sh, or use --force to take over the port.");
-        return;
-      }
-    } catch {
-    }
-    const projectRoot = this.findProjectRoot();
-    if (!projectRoot) {
-      this.error(
-        "Could not find RuleMetric project root. Run this command from within the momento-mori repo, or set RULEMETRIC_PROJECT_ROOT."
-      );
-    }
-    const envLocal = join(projectRoot, ".env.local");
-    if (!existsSync(envLocal)) {
-      this.error(`.env.local not found at ${envLocal}. The API needs Supabase credentials to start.`);
-    }
-    const envVars = this.guardAlwaysOnDatabaseUrl(this.loadEnvVars(projectRoot));
-    const nodePath = this.findBinary("node");
-    const pnpmPath = this.findBinary("pnpm");
-    if (!nodePath || !pnpmPath) {
-      this.error("Could not find node or pnpm. Ensure they are in your PATH.");
-    }
-    let mitmdumpPath = null;
-    if (!noProxy) {
-      mitmdumpPath = this.findBinary("mitmdump");
-      if (!mitmdumpPath) {
-        this.error(
-          "mitmdump not found in PATH. Install with: pipx install mitmproxy (or brew install mitmproxy), then re-run.\nOr skip the capture proxy with --no-proxy."
-        );
-      }
-    }
-    if (!skipBuild) {
-      this.log("[..] Building workspace artifacts (api, web, cli) via turbo...");
-      const buildFilters = [
-        "--filter",
-        "@rulemetric/api...",
-        "--filter",
-        "@rulemetric/web...",
-        "--filter",
-        "@rulemetric/cli"
-      ];
-      const build = spawnSync(pnpmPath, ["exec", "turbo", "run", "build", ...buildFilters], {
-        cwd: projectRoot,
-        stdio: "inherit"
-      });
-      if (build.status !== 0) {
-        this.error(
-          `Workspace build failed (exit ${build.status}). Fix the build first, or use --skip-build if dist/ already exists.`
-        );
-      }
-      this.log("[OK] Build complete");
-    } else {
-      this.log("[..] Skipping pre-install build (--skip-build)");
-    }
-    const apiEntry = join(projectRoot, "apps", "api", "dist", "index.js");
-    if (!existsSync(apiEntry)) {
-      this.error(`API entry not found at ${apiEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/api... build`);
-    }
-    const webIndex = join(projectRoot, "apps", "web", "dist", "index.html");
-    if (!existsSync(webIndex)) {
-      this.warn(`Web bundle not found at ${webIndex}. Dashboard at :${port} will 404 until you build apps/web.`);
-    }
-    if (!noProxy) {
-      const gatewayEntry = join(projectRoot, "apps", "cli", "dist", "lib", "gateway-entry.js");
-      if (!existsSync(gatewayEntry)) {
-        this.error(`Gateway entry not found at ${gatewayEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/cli build`);
-      }
-    }
-    if (flags.force) {
-      this.killStaleProcess(port, null, "API on :" + port);
-    }
-    if (!noProxy) {
-      this.killStaleProcess(GATEWAY_PORT, join(CONFIG_DIR, "gateway.pid"), "gateway");
-      this.killStaleProcess(PROXY_PORT, join(CONFIG_DIR, "proxy.pid"), "mitmproxy");
-    }
-    mkdirSync(join(homedir(), "Library", "LaunchAgents"), { recursive: true });
-    mkdirSync(LOG_DIR, { recursive: true });
-    const uid = execSync("id -u", { encoding: "utf-8" }).trim();
-    const apiPlist = this.buildPlist({ port, projectRoot, nodePath, pnpmPath, envVars });
-    this.bootoutAndWrite(uid, PLIST_PATH, apiPlist, "API");
-    this.bootstrapPlist(uid, PLIST_PATH, "API");
-    this.log(`[..] Waiting for API on :${port}...`);
-    const apiStarted = await this.waitForApi(port, 15);
-    if (apiStarted) {
-      this.log(`[OK] RuleMetric API running on :${port}`);
-      if (existsSync(webIndex)) {
-        this.log(`[OK] Dashboard available at http://localhost:${port}`);
-      }
-    } else {
-      this.warn("API did not respond within 15s. Check logs:");
-      this.log(`  tail -f ${LOG_DIR}/api-stdout.log`);
-      this.log(`  tail -f ${LOG_DIR}/api-stderr.log`);
-    }
-    this.log("");
-    this.log("Installing worker service...");
-    this.killStaleAgents();
-    const workerPlist = this.buildWorkerPlist({
-      cliBin: join(projectRoot, "apps", "cli", "bin", "run.js"),
-      cliDist: join(projectRoot, "apps", "cli", "dist"),
-      workingDir: projectRoot,
-      nodePath,
-      pnpmPath,
-      envVars
-    });
-    this.bootoutAndWrite(uid, WORKER_PLIST_PATH, workerPlist, "Worker");
-    this.bootstrapPlist(uid, WORKER_PLIST_PATH, "Worker");
-    if (!noProxy) {
-      this.log("");
-      this.log("Installing gateway + capture proxy services...");
-      const gatewayPlist = this.buildGatewayPlist({ projectRoot, nodePath });
-      this.bootoutAndWrite(uid, GATEWAY_PLIST_PATH, gatewayPlist, "Gateway");
-      this.bootstrapPlist(uid, GATEWAY_PLIST_PATH, "Gateway");
-      const proxyPlist = this.buildProxyPlist({
-        projectRoot,
-        mitmdumpPath,
-        envVars
-      });
-      this.bootoutAndWrite(uid, PROXY_PLIST_PATH, proxyPlist, "Proxy");
-      this.bootstrapPlist(uid, PROXY_PLIST_PATH, "Proxy");
-    }
-    if (existsSync(WORKER_RESTART_PLIST_PATH)) {
-      try {
-        execFileSync("launchctl", ["bootout", `gui/${uid}`, WORKER_RESTART_PLIST_PATH], { encoding: "utf-8" });
-      } catch {
-      }
-      try {
-        execFileSync("rm", ["-f", WORKER_RESTART_PLIST_PATH]);
-        this.log("[OK] Removed stale daily worker-restart agent (no longer needed on agent path)");
-      } catch {
-      }
-    }
-    this.log("");
-    if (noProxy) {
-      this.log("Installed: API + worker. Gateway/proxy skipped (--no-proxy).");
-    } else {
-      this.log("Installed: API + worker + gateway + capture proxy.");
-    }
-    this.log("All services start at login, restart on crash, and pick up rebuilds via WatchPaths.");
-    this.log("");
-    this.log("NOTE: Env vars are baked in at install time. If you change");
-    this.log(".env.local or credentials, re-run: rulemetric service install --force");
-    this.log("");
-    this.log("Manage with:");
-    this.log("  rulemetric service status    \u2014 check if running");
-    this.log("  rulemetric service uninstall \u2014 remove all services");
-    await bootstrapActiveOrg();
-    const tmux = await detectTmux();
-    this.log("");
-    if (tmux.available) {
-      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ""} \u2014 live send enabled`);
-    } else {
-      this.log("[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux");
-    }
-  }
-  /**
-   * Worker-only install: a persistent job worker for end users on the
-   * globally-installed CLI, with NO repo checkout, NO build, and NO
-   * API/gateway/proxy. macOS → launchd; Linux → systemd --user. Auth is
-   * sourced from ~/.config/rulemetric/env (written by `rulemetric auth
-   * login`); the thin-agent worker is HTTP-only (long-polls /api/work/next),
-   * so it needs only the API URL + a key/token, never DB credentials.
-   */
-  async runWorkerOnly(force) {
-    const platform = process.platform;
-    if (platform !== "darwin" && platform !== "linux") {
-      this.error(`--worker-only supports macOS (launchd) and Linux (systemd) only; detected '${platform}'.`);
-    }
-    const nodePath = this.findBinary("node");
-    if (!nodePath) {
-      this.error("Could not find `node` in PATH.");
-    }
-    const cliBin = join(this.config.root, "bin", "run.js");
-    if (!existsSync(cliBin)) {
-      this.error(
-        `Could not locate the installed CLI entry at ${cliBin}. Reinstall the CLI (e.g. npm i -g @rulemetric/cli) and re-run.`
-      );
-    }
-    const cliDist = join(this.config.root, "dist");
-    const envVars = this.loadGlobalWorkerEnv();
-    if (!envVars.RULEMETRIC_API_KEY && !envVars.RULEMETRIC_ACCESS_TOKEN) {
-      this.error(
-        "Not authenticated \u2014 no RULEMETRIC_API_KEY/RULEMETRIC_ACCESS_TOKEN in ~/.config/rulemetric/env.\nRun `rulemetric auth login` first, then re-run `rulemetric service install --worker-only`."
-      );
-    }
-    if (!envVars.RULEMETRIC_API_URL) {
-      envVars.RULEMETRIC_API_URL = "https://rulemetric.com";
-    }
-    mkdirSync(LOG_DIR, { recursive: true });
-    this.killStaleAgents();
-    if (platform === "darwin") {
-      if (existsSync(WORKER_PLIST_PATH) && !force) {
-        this.log(`Worker already installed at ${WORKER_PLIST_PATH}.`);
-        this.log("Use --force to overwrite, or run: rulemetric service status");
-        return;
-      }
-      mkdirSync(join(homedir(), "Library", "LaunchAgents"), { recursive: true });
-      const uid = execSync("id -u", { encoding: "utf-8" }).trim();
-      const plist = this.buildWorkerPlist({
-        cliBin,
-        cliDist,
-        workingDir: homedir(),
-        nodePath,
-        nodeEnv: "production",
-        envVars
-      });
-      this.bootoutAndWrite(uid, WORKER_PLIST_PATH, plist, "Worker");
-      this.bootstrapPlist(uid, WORKER_PLIST_PATH, "Worker");
-      this.log("");
-      this.log("[OK] Worker installed (launchd). Starts at login, restarts on crash.");
-      this.log(`     Logs: tail -f ${join(LOG_DIR, "worker-stdout.log")}`);
-    } else {
-      if (existsSync(WORKER_SYSTEMD_PATH) && !force) {
-        this.log(`Worker already installed at ${WORKER_SYSTEMD_PATH}.`);
-        this.log(`Use --force to overwrite, or: systemctl --user status ${WORKER_SYSTEMD_UNIT}`);
-        return;
-      }
-      mkdirSync(WORKER_SYSTEMD_DIR, { recursive: true });
-      const unit = this.buildWorkerSystemdUnit({ cliBin, nodePath, envVars });
-      writeFileSync(WORKER_SYSTEMD_PATH, unit, { mode: 384 });
-      this.log(`[OK] Wrote ${WORKER_SYSTEMD_PATH}`);
-      try {
-        execFileSync("systemctl", ["--user", "daemon-reload"]);
-        execFileSync("systemctl", ["--user", "enable", "--now", WORKER_SYSTEMD_UNIT]);
-        this.log("[OK] Worker enabled + started (systemctl --user).");
-        try {
-          execFileSync("loginctl", ["enable-linger", userInfo().username]);
-          this.log("[OK] Enabled linger \u2014 worker survives logout/reboot.");
-        } catch {
-          this.log("[!!] Could not enable linger (worker will stop on logout).");
-          this.log('     Run: sudo loginctl enable-linger "$USER"');
-        }
-        this.log(`     Logs: journalctl --user -u ${WORKER_SYSTEMD_UNIT} -f`);
-      } catch (err) {
-        this.warn(
-          `Wrote the unit but \`systemctl --user\` failed: ${err instanceof Error ? err.message : String(err)}`
-        );
-        this.log(
-          `Enable it manually: systemctl --user daemon-reload && systemctl --user enable --now ${WORKER_SYSTEMD_UNIT}`
-        );
-      }
-    }
-    this.log("");
-    this.log("Manage with:");
-    this.log("  rulemetric service status    \u2014 check if running");
-    this.log("  rulemetric service uninstall \u2014 remove the worker");
-    await bootstrapActiveOrg();
-    void emitSetupEvent("worker_started", { mode: "worker-only" }, this.config.version);
-  }
-  /**
-   * Load worker env from ~/.config/rulemetric/env only (no repo .env.local).
-   * Filtered by ALLOWED_ENV_VARS, same as the full install's loader.
-   */
-  loadGlobalWorkerEnv() {
-    const vars = {};
-    const globalEnv = join(CONFIG_DIR, "env");
-    if (existsSync(globalEnv)) {
-      for (const line of readFileSync(globalEnv, "utf-8").split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#")) continue;
-        const eqIdx = trimmed.indexOf("=");
-        if (eqIdx > 0) {
-          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
-        }
-      }
-    }
-    return Object.fromEntries(Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k)));
-  }
-  /** systemd --user unit for the Linux worker-only path. */
-  buildWorkerSystemdUnit(opts) {
-    const { cliBin, nodePath, envVars } = opts;
-    const env = {
-      ...envVars,
-      NODE_ENV: "production",
-      // Mirror the launchd worker's pooler bound (RCA 2026-06-21).
-      PG_POOL_MAX: envVars.PG_POOL_MAX ?? "3",
-      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? "10"
-    };
-    const envLines = Object.entries(env).map(([k, v]) => `Environment="${k}=${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`).join("\n");
-    return `[Unit]
+import{a as N}from"../../chunk-6XEC6474.js";import"../../chunk-N7ODX6PO.js";import{a as W}from"../../chunk-LQRYQE6Q.js";import"../../chunk-IZTIYR5Q.js";import{c as M}from"../../chunk-CRAKDQ4H.js";import{b as D}from"../../chunk-WPJ2BND4.js";import"../../chunk-3AV3GTMP.js";import"../../chunk-TIQ7DQ3M.js";import"../../chunk-M6AJDVCL.js";import{a as $}from"../../chunk-ZLLER3HP.js";import{Flags as v}from"@oclif/core";import{existsSync as g,mkdirSync as T,readFileSync as R,writeFileSync as j}from"node:fs";import{execSync as B,execFileSync as h,spawnSync as x}from"node:child_process";import{homedir as y,userInfo as Z}from"node:os";import{dirname as E,join as o}from"node:path";var K=new Set(["SUPABASE_URL","SUPABASE_ANON_KEY","SUPABASE_SERVICE_ROLE_KEY","SUPABASE_JWT_SECRET","DATABASE_URL","RULEMETRIC_API_URL","RULEMETRIC_API_KEY","RULEMETRIC_ACCESS_TOKEN","RULEMETRIC_AUDIT_NOTIFY_USER_ID","RULEMETRIC_USER_ID","GITHUB_TOKEN","PG_POOL_MAX","PG_IDLE_TIMEOUT","PG_STATEMENT_TIMEOUT_MS","PG_HEAVY_POOL_MAX","PG_QUERY_DEADLINE_MS","RESEND_API_KEY","RESEND_FROM_EMAIL","SENTRY_DSN"]),H="com.rulemetric.api",I=o(y(),"Library","LaunchAgents",`${H}.plist`),F="com.rulemetric.worker",b=o(y(),"Library","LaunchAgents",`${F}.plist`),X="com.rulemetric.gateway",G=o(y(),"Library","LaunchAgents",`${X}.plist`),J="com.rulemetric.proxy",Y=o(y(),"Library","LaunchAgents",`${J}.plist`),tt="com.rulemetric.worker.restart",U=o(y(),"Library","LaunchAgents",`${tt}.plist`),w=o(y(),".config","rulemetric"),p=o(w,"logs"),et=8787,V=8788,q=o(y(),".config","systemd","user"),_="rulemetric-worker.service",S=o(q,_),C=class L extends W{static{$(this,"ServiceInstall")}static description="Install RuleMetric services. Default (in a repo checkout): API + worker + gateway + capture proxy as launchd agents. With --worker-only: just the job worker, targeting the globally-installed CLI \u2014 no repo, no build (works from `npm i -g @rulemetric/cli`, macOS launchd or Linux systemd).";static examples=["<%= config.bin %> service install","<%= config.bin %> service install --port 3000","<%= config.bin %> service install --skip-build","<%= config.bin %> service install --no-proxy","<%= config.bin %> service install --worker-only"];static flags={port:v.integer({char:"p",default:3e3,description:"API server port"}),force:v.boolean({char:"f",default:!1,description:"Overwrite existing service configuration and reclaim conflicting ports"}),"skip-build":v.boolean({default:!1,description:"Skip the pre-install workspace build (API/web/cli dist must already exist)"}),"no-proxy":v.boolean({default:!1,description:"Skip gateway + mitmproxy plists (just install API + worker)"}),"worker-only":v.boolean({default:!1,description:"Install ONLY the job worker as a persistent service, targeting the globally-installed CLI (no repo checkout, no build, no API/gateway/proxy). Sources auth from ~/.config/rulemetric/env. macOS (launchd) + Linux (systemd --user)."})};async run(){let{flags:r}=await this.parse(L),t=r.port,e=r["skip-build"],s=r["no-proxy"];if(r["worker-only"]){await this.runWorkerOnly(r.force);return}if(process.platform!=="darwin"&&this.error("The full service install is macOS-only (launchd). For just the job worker on Linux (or a clean npm install), use: rulemetric service install --worker-only"),g(I)&&!r.force){this.log(`Service already installed at ${I}`),this.log("Use --force to overwrite, or run: rulemetric service status");return}try{if((await fetch(`http://localhost:${t}/health`)).ok&&!r.force){this.warn(`Port ${t} is already in use (API may be running via start.sh or in another terminal).`),this.warn("Stop it first with scripts/stop.sh, or use --force to take over the port.");return}}catch{}let i=this.findProjectRoot();i||this.error("Could not find RuleMetric project root. Run this command from within the momento-mori repo, or set RULEMETRIC_PROJECT_ROOT.");let n=o(i,".env.local");g(n)||this.error(`.env.local not found at ${n}. The API needs Supabase credentials to start.`);let a=this.guardAlwaysOnDatabaseUrl(this.loadEnvVars(i)),c=this.findBinary("node"),d=this.findBinary("pnpm");(!c||!d)&&this.error("Could not find node or pnpm. Ensure they are in your PATH.");let u=null;if(s||(u=this.findBinary("mitmdump"),u||this.error(`mitmdump not found in PATH. Install with: pipx install mitmproxy (or brew install mitmproxy), then re-run.
+Or skip the capture proxy with --no-proxy.`)),e)this.log("[..] Skipping pre-install build (--skip-build)");else{this.log("[..] Building workspace artifacts (api, web, cli) via turbo...");let A=x(d,["exec","turbo","run","build",...["--filter","@rulemetric/api...","--filter","@rulemetric/web...","--filter","@rulemetric/cli"]],{cwd:i,stdio:"inherit"});A.status!==0&&this.error(`Workspace build failed (exit ${A.status}). Fix the build first, or use --skip-build if dist/ already exists.`),this.log("[OK] Build complete")}let f=o(i,"apps","api","dist","index.js");g(f)||this.error(`API entry not found at ${f}. Re-run without --skip-build, or: pnpm --filter @rulemetric/api... build`);let k=o(i,"apps","web","dist","index.html");if(g(k)||this.warn(`Web bundle not found at ${k}. Dashboard at :${t} will 404 until you build apps/web.`),!s){let P=o(i,"apps","cli","dist","lib","gateway-entry.js");g(P)||this.error(`Gateway entry not found at ${P}. Re-run without --skip-build, or: pnpm --filter @rulemetric/cli build`)}r.force&&this.killStaleProcess(t,null,"API on :"+t),s||(this.killStaleProcess(et,o(w,"gateway.pid"),"gateway"),this.killStaleProcess(V,o(w,"proxy.pid"),"mitmproxy")),T(o(y(),"Library","LaunchAgents"),{recursive:!0}),T(p,{recursive:!0});let m=B("id -u",{encoding:"utf-8"}).trim(),z=this.buildPlist({port:t,projectRoot:i,nodePath:c,pnpmPath:d,envVars:a});this.bootoutAndWrite(m,I,z,"API"),this.bootstrapPlist(m,I,"API"),this.log(`[..] Waiting for API on :${t}...`),await this.waitForApi(t,15)?(this.log(`[OK] RuleMetric API running on :${t}`),g(k)&&this.log(`[OK] Dashboard available at http://localhost:${t}`)):(this.warn("API did not respond within 15s. Check logs:"),this.log(`  tail -f ${p}/api-stdout.log`),this.log(`  tail -f ${p}/api-stderr.log`)),this.log(""),this.log("Installing worker service..."),this.killStaleAgents();let Q=this.buildWorkerPlist({cliBin:o(i,"apps","cli","bin","run.js"),cliDist:o(i,"apps","cli","dist"),workingDir:i,nodePath:c,pnpmPath:d,envVars:a});if(this.bootoutAndWrite(m,b,Q,"Worker"),this.bootstrapPlist(m,b,"Worker"),!s){this.log(""),this.log("Installing gateway + capture proxy services...");let P=this.buildGatewayPlist({projectRoot:i,nodePath:c});this.bootoutAndWrite(m,G,P,"Gateway"),this.bootstrapPlist(m,G,"Gateway");let A=this.buildProxyPlist({projectRoot:i,mitmdumpPath:u,envVars:a});this.bootoutAndWrite(m,Y,A,"Proxy"),this.bootstrapPlist(m,Y,"Proxy")}if(g(U)){try{h("launchctl",["bootout",`gui/${m}`,U],{encoding:"utf-8"})}catch{}try{h("rm",["-f",U]),this.log("[OK] Removed stale daily worker-restart agent (no longer needed on agent path)")}catch{}}this.log(""),s?this.log("Installed: API + worker. Gateway/proxy skipped (--no-proxy)."):this.log("Installed: API + worker + gateway + capture proxy."),this.log("All services start at login, restart on crash, and pick up rebuilds via WatchPaths."),this.log(""),this.log("NOTE: Env vars are baked in at install time. If you change"),this.log(".env.local or credentials, re-run: rulemetric service install --force"),this.log(""),this.log("Manage with:"),this.log("  rulemetric service status    \u2014 check if running"),this.log("  rulemetric service uninstall \u2014 remove all services"),await D();let O=await N();this.log(""),O.available?this.log(`[OK] tmux found${O.version?` (v${O.version})`:""} \u2014 live send enabled`):this.log("[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux")}async runWorkerOnly(r){let t=process.platform;t!=="darwin"&&t!=="linux"&&this.error(`--worker-only supports macOS (launchd) and Linux (systemd) only; detected '${t}'.`);let e=this.findBinary("node");e||this.error("Could not find `node` in PATH.");let s=o(this.config.root,"bin","run.js");g(s)||this.error(`Could not locate the installed CLI entry at ${s}. Reinstall the CLI (e.g. npm i -g @rulemetric/cli) and re-run.`);let i=o(this.config.root,"dist"),n=this.loadGlobalWorkerEnv();if(!n.RULEMETRIC_API_KEY&&!n.RULEMETRIC_ACCESS_TOKEN&&this.error("Not authenticated \u2014 no RULEMETRIC_API_KEY/RULEMETRIC_ACCESS_TOKEN in ~/.config/rulemetric/env.\nRun `rulemetric auth login` first, then re-run `rulemetric service install --worker-only`."),n.RULEMETRIC_API_URL||(n.RULEMETRIC_API_URL="https://rulemetric.com"),T(p,{recursive:!0}),this.killStaleAgents(),t==="darwin"){if(g(b)&&!r){this.log(`Worker already installed at ${b}.`),this.log("Use --force to overwrite, or run: rulemetric service status");return}T(o(y(),"Library","LaunchAgents"),{recursive:!0});let a=B("id -u",{encoding:"utf-8"}).trim(),c=this.buildWorkerPlist({cliBin:s,cliDist:i,workingDir:y(),nodePath:e,nodeEnv:"production",envVars:n});this.bootoutAndWrite(a,b,c,"Worker"),this.bootstrapPlist(a,b,"Worker"),this.log(""),this.log("[OK] Worker installed (launchd). Starts at login, restarts on crash."),this.log(`     Logs: tail -f ${o(p,"worker-stdout.log")}`)}else{if(g(S)&&!r){this.log(`Worker already installed at ${S}.`),this.log(`Use --force to overwrite, or: systemctl --user status ${_}`);return}T(q,{recursive:!0});let a=this.buildWorkerSystemdUnit({cliBin:s,nodePath:e,envVars:n});j(S,a,{mode:384}),this.log(`[OK] Wrote ${S}`);try{h("systemctl",["--user","daemon-reload"]),h("systemctl",["--user","enable","--now",_]),this.log("[OK] Worker enabled + started (systemctl --user).");try{h("loginctl",["enable-linger",Z().username]),this.log("[OK] Enabled linger \u2014 worker survives logout/reboot.")}catch{this.log("[!!] Could not enable linger (worker will stop on logout)."),this.log('     Run: sudo loginctl enable-linger "$USER"')}this.log(`     Logs: journalctl --user -u ${_} -f`)}catch(c){this.warn(`Wrote the unit but \`systemctl --user\` failed: ${c instanceof Error?c.message:String(c)}`),this.log(`Enable it manually: systemctl --user daemon-reload && systemctl --user enable --now ${_}`)}}this.log(""),this.log("Manage with:"),this.log("  rulemetric service status    \u2014 check if running"),this.log("  rulemetric service uninstall \u2014 remove the worker"),await D(),M("worker_started",{mode:"worker-only"},this.config.version)}loadGlobalWorkerEnv(){let r={},t=o(w,"env");if(g(t))for(let e of R(t,"utf-8").split(`
+`)){let s=e.trim();if(!s||s.startsWith("#"))continue;let i=s.indexOf("=");i>0&&(r[s.slice(0,i)]=s.slice(i+1))}return Object.fromEntries(Object.entries(r).filter(([e])=>K.has(e)))}buildWorkerSystemdUnit(r){let{cliBin:t,nodePath:e,envVars:s}=r,i={...s,NODE_ENV:"production",PATH:[...new Set([E(e),o(y(),".local","bin"),"/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin"])].join(":"),PG_POOL_MAX:s.PG_POOL_MAX??"3",PG_IDLE_TIMEOUT:s.PG_IDLE_TIMEOUT??"10"},n=Object.entries(i).map(([a,c])=>`Environment="${a}=${c.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`).join(`
+`);return`[Unit]
 Description=RuleMetric job worker (evals agent)
 After=network-online.target
 Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=${nodePath} ${cliBin} evals agent
+ExecStart=${e} ${t} evals agent
 Restart=on-failure
 RestartSec=15
-${envLines}
+${n}
 
 [Install]
 WantedBy=default.target
-`;
-  }
-  findProjectRoot() {
-    if (process.env.RULEMETRIC_PROJECT_ROOT) {
-      return process.env.RULEMETRIC_PROJECT_ROOT;
-    }
-    let dir = process.cwd();
-    for (let i = 0; i < 10; i++) {
-      if (existsSync(join(dir, "apps", "api", "package.json"))) {
-        return dir;
-      }
-      const parent = join(dir, "..");
-      if (parent === dir) break;
-      dir = parent;
-    }
-    return null;
-  }
-  findBinary(name) {
-    try {
-      return execFileSync("which", [name], { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }).trim() || null;
-    } catch {
-      return null;
-    }
-  }
-  loadEnvVars(projectRoot) {
-    const vars = {};
-    const envLocal = join(projectRoot, ".env.local");
-    if (existsSync(envLocal)) {
-      for (const line of readFileSync(envLocal, "utf-8").split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#")) continue;
-        const eqIdx = trimmed.indexOf("=");
-        if (eqIdx > 0) {
-          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
-        }
-      }
-    }
-    const globalEnv = join(CONFIG_DIR, "env");
-    if (existsSync(globalEnv)) {
-      for (const line of readFileSync(globalEnv, "utf-8").split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#")) continue;
-        const eqIdx = trimmed.indexOf("=");
-        if (eqIdx > 0) {
-          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
-        }
-      }
-    }
-    return Object.fromEntries(
-      Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k))
-    );
-  }
-  // Guard: the always-on API + worker MUST use the TRANSACTION-mode pooler
-  // (port 6543). A SESSION-mode URL (:5432, 15-slot cap) baked into these
-  // services was the trigger of the recurring pool saturation — a pool-cascade
-  // debugging override leaked into the plists through this very installer. Auto-
-  // correct the obvious session→transaction port and warn loudly; warn (but do
-  // not block) on a direct, non-pooler URL. Pool-exhaustion RCA 2026-06-21.
-  guardAlwaysOnDatabaseUrl(envVars) {
-    const url = envVars.DATABASE_URL;
-    if (!url) return envVars;
-    if (url.includes("pooler.supabase.com:5432")) {
-      this.warn(
-        "DATABASE_URL points at the SESSION-mode pooler (:5432, 15-slot cap). The always-on API/worker must use TRANSACTION mode (:6543) \u2014 auto-correcting for the installed services. Fix .env.local to silence this warning."
-      );
-      return { ...envVars, DATABASE_URL: url.replace("pooler.supabase.com:5432", "pooler.supabase.com:6543") };
-    }
-    if (/@db\.[a-z0-9]+\.supabase\.co[:/]/.test(url)) {
-      this.warn(
-        "DATABASE_URL is a DIRECT database connection (db.<ref>.supabase.co), not the pooler. Always-on services should use the transaction pooler (aws-*.pooler.supabase.com:6543) to avoid exhausting Postgres connections."
-      );
-    }
-    return envVars;
-  }
-  // Reap orphaned, unsupervised `evals agent` worker processes before
-  // (re)bootstrapping the launchd worker. The worker holds no listening port,
-  // so killStaleProcess (port/pidfile based) cannot find detached agents — a
-  // fleet of 4 ran 3+ days and helped saturate the pool (RCA 2026-06-21). pgrep
-  // the command line and SIGTERM every match except ourselves; the agent's own
-  // single-instance lock then keeps a fresh fleet from forming.
-  killStaleAgents() {
-    try {
-      const out = execFileSync("pgrep", ["-f", "bin/run.js evals agent"], {
-        encoding: "utf-8",
-        stdio: ["ignore", "pipe", "ignore"]
-      });
-      const pids = out.trim().split("\n").filter(Boolean).map((s) => parseInt(s, 10)).filter((p) => !isNaN(p) && p !== process.pid);
-      for (const pid of pids) {
-        try {
-          process.kill(pid, "SIGTERM");
-          this.log(`[OK] Reaped orphan evals agent (PID ${pid})`);
-        } catch {
-        }
-      }
-      if (pids.length) spawnSync("sleep", ["1"], { stdio: "ignore" });
-    } catch {
-    }
-  }
-  // Best-effort cleanup of a process that would conflict with an
-  // about-to-bootstrap launchd plist. Tries two routes:
-  //   (a) the PID file written by the legacy spawn path
-  //       (gateway-lifecycle / proxy start), if pidFile is non-null
-  //   (b) anything actively listening on the expected port
-  // Either way: SIGTERM + small grace + SIGKILL fallback. Stale PID file
-  // gets unlinked.
-  killStaleProcess(port, pidFile, name) {
-    let killedAny = false;
-    if (pidFile && existsSync(pidFile)) {
-      try {
-        const pidStr = readFileSync(pidFile, "utf-8").trim();
-        const pid = parseInt(pidStr, 10);
-        if (!isNaN(pid)) {
-          try {
-            process.kill(pid, "SIGTERM");
-            killedAny = true;
-            this.log(`[OK] Stopped existing ${name} (PID ${pid} from ${pidFile})`);
-          } catch {
-          }
-        }
-      } catch {
-      }
-      try {
-        execFileSync("rm", ["-f", pidFile]);
-      } catch {
-      }
-    }
-    try {
-      const result = execFileSync("lsof", ["-ti", `:${port}`, "-sTCP:LISTEN"], {
-        encoding: "utf-8",
-        stdio: ["ignore", "pipe", "ignore"]
-      });
-      const pids = result.trim().split("\n").filter(Boolean);
-      for (const pidStr of pids) {
-        const pid = parseInt(pidStr, 10);
-        if (!isNaN(pid)) {
-          try {
-            process.kill(pid, "SIGTERM");
-            killedAny = true;
-            this.log(`[OK] Stopped orphan on :${port} (PID ${pid})`);
-          } catch {
-          }
-        }
-      }
-    } catch {
-    }
-    if (killedAny) {
-      spawnSync("sleep", ["1"], { stdio: "ignore" });
-    }
-  }
-  bootoutAndWrite(uid, plistPath, content, name) {
-    const benignBootoutPatterns = [
-      "Could not find specified service",
-      "No such process",
-      "3: No such process",
-      "5: Input/output error"
-    ];
-    try {
-      execFileSync("launchctl", ["bootout", `gui/${uid}`, plistPath], {
-        encoding: "utf-8",
-        // Capture stderr instead of letting it print to the user's terminal.
-        // The plist was either already-loaded (we unload it cleanly) or not
-        // loaded (we want to swallow the error) — the user shouldn't see
-        // launchctl's raw output either way.
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      this.log(`[OK] Unloaded existing ${name} service`);
-    } catch (err) {
-      const msg = err.message || "";
-      const stderr = (err.stderr ?? "").toString();
-      const combined = `${msg}
-${stderr}`;
-      if (!benignBootoutPatterns.some((p) => combined.includes(p))) {
-        this.warn(`Could not unload existing ${name} service: ${msg.trim()}`);
-      }
-    }
-    writeFileSync(plistPath, content, { mode: 384 });
-    this.log(`[OK] ${name} plist written to ${plistPath}`);
-  }
-  bootstrapPlist(uid, plistPath, name) {
-    try {
-      execFileSync("launchctl", ["bootstrap", `gui/${uid}`, plistPath]);
-      this.log(`[OK] ${name} service loaded into launchd`);
-    } catch (bootstrapErr) {
-      try {
-        execFileSync("launchctl", ["load", plistPath]);
-        this.log(`[OK] ${name} service loaded into launchd (legacy)`);
-      } catch (loadErr) {
-        this.warn(
-          `Could not load ${name} service.
-  bootstrap: ${bootstrapErr.message.trim()}
-  load: ${loadErr.message.trim()}`
-        );
-      }
-    }
-  }
-  buildPlist(opts) {
-    const { port, projectRoot, nodePath, pnpmPath, envVars } = opts;
-    const pathDirs = [.../* @__PURE__ */ new Set([dirname(nodePath), dirname(pnpmPath), "/usr/local/bin", "/usr/bin", "/bin"])];
-    const envEntries = Object.entries({
-      ...envVars,
-      PORT: String(port),
-      NODE_ENV: "production",
-      PATH: pathDirs.join(":"),
-      // Pool resilience for the always-on API (NOT the worker, which runs
-      // legitimately long analytics queries). A wedged Supavisor socket with
-      // the default max=3 pool and no query timeout hangs every authenticated
-      // request — the 2026-06-09 login-hang. statement_timeout lets Postgres
-      // cancel a stuck query so the connection returns to the pool (verified
-      // honored through the transaction pooler); the larger pool adds headroom.
-      // Both env-overridable. See packages/db/src/client.ts.
-      PG_POOL_MAX: envVars.PG_POOL_MAX ?? "10",
-      PG_STATEMENT_TIMEOUT_MS: envVars.PG_STATEMENT_TIMEOUT_MS ?? "10000",
-      // Keep the pool warm so the API stops reconnecting (and re-resolving the
-      // rotating pooler ELB) on nearly every request — the churn that exposed
-      // it to intermittent CONNECT_TIMEOUT/ENOTFOUND. Worker/tests keep the
-      // conservative 5s default. See packages/db/src/client.ts (2026-06-09).
-      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? "30",
-      // Silence per-span stdout dumps on the local API — it has no OTLP
-      // endpoint and a fixed (now rotated) log file; the ConsoleSpanExporter
-      // grew api-stdout to 370MB / ~400k spans. Fly leaves this unset so its
-      // console spans stay grep-able in the managed log stream.
-      OTEL_SPAN_EXPORT: envVars.OTEL_SPAN_EXPORT ?? "none"
-    }).map(([k, v]) => `      <key>${escapeXml(k)}</key>
-      <string>${escapeXml(v)}</string>`).join("\n");
-    const apiEntry = join(projectRoot, "apps", "api", "dist", "index.js");
-    const apiDist = join(projectRoot, "apps", "api", "dist");
-    return `<?xml version="1.0" encoding="UTF-8"?>
+`}findProjectRoot(){if(process.env.RULEMETRIC_PROJECT_ROOT)return process.env.RULEMETRIC_PROJECT_ROOT;let r=process.cwd();for(let t=0;t<10;t++){if(g(o(r,"apps","api","package.json")))return r;let e=o(r,"..");if(e===r)break;r=e}return null}findBinary(r){try{return h("which",[r],{encoding:"utf-8",stdio:["pipe","pipe","ignore"]}).trim()||null}catch{return null}}loadEnvVars(r){let t={},e=o(r,".env.local");if(g(e))for(let i of R(e,"utf-8").split(`
+`)){let n=i.trim();if(!n||n.startsWith("#"))continue;let a=n.indexOf("=");a>0&&(t[n.slice(0,a)]=n.slice(a+1))}let s=o(w,"env");if(g(s))for(let i of R(s,"utf-8").split(`
+`)){let n=i.trim();if(!n||n.startsWith("#"))continue;let a=n.indexOf("=");a>0&&(t[n.slice(0,a)]=n.slice(a+1))}return Object.fromEntries(Object.entries(t).filter(([i])=>K.has(i)))}guardAlwaysOnDatabaseUrl(r){let t=r.DATABASE_URL;return t?t.includes("pooler.supabase.com:5432")?(this.warn("DATABASE_URL points at the SESSION-mode pooler (:5432, 15-slot cap). The always-on API/worker must use TRANSACTION mode (:6543) \u2014 auto-correcting for the installed services. Fix .env.local to silence this warning."),{...r,DATABASE_URL:t.replace("pooler.supabase.com:5432","pooler.supabase.com:6543")}):(/@db\.[a-z0-9]+\.supabase\.co[:/]/.test(t)&&this.warn("DATABASE_URL is a DIRECT database connection (db.<ref>.supabase.co), not the pooler. Always-on services should use the transaction pooler (aws-*.pooler.supabase.com:6543) to avoid exhausting Postgres connections."),r):r}killStaleAgents(){try{let t=h("pgrep",["-f","bin/run.js evals agent"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]}).trim().split(`
+`).filter(Boolean).map(e=>parseInt(e,10)).filter(e=>!isNaN(e)&&e!==process.pid);for(let e of t)try{process.kill(e,"SIGTERM"),this.log(`[OK] Reaped orphan evals agent (PID ${e})`)}catch{}t.length&&x("sleep",["1"],{stdio:"ignore"})}catch{}}killStaleProcess(r,t,e){let s=!1;if(t&&g(t)){try{let i=R(t,"utf-8").trim(),n=parseInt(i,10);if(!isNaN(n))try{process.kill(n,"SIGTERM"),s=!0,this.log(`[OK] Stopped existing ${e} (PID ${n} from ${t})`)}catch{}}catch{}try{h("rm",["-f",t])}catch{}}try{let n=h("lsof",["-ti",`:${r}`,"-sTCP:LISTEN"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]}).trim().split(`
+`).filter(Boolean);for(let a of n){let c=parseInt(a,10);if(!isNaN(c))try{process.kill(c,"SIGTERM"),s=!0,this.log(`[OK] Stopped orphan on :${r} (PID ${c})`)}catch{}}}catch{}s&&x("sleep",["1"],{stdio:"ignore"})}bootoutAndWrite(r,t,e,s){let i=["Could not find specified service","No such process","3: No such process","5: Input/output error"];try{h("launchctl",["bootout",`gui/${r}`,t],{encoding:"utf-8",stdio:["ignore","pipe","pipe"]}),this.log(`[OK] Unloaded existing ${s} service`)}catch(n){let a=n.message||"",c=(n.stderr??"").toString(),d=`${a}
+${c}`;i.some(u=>d.includes(u))||this.warn(`Could not unload existing ${s} service: ${a.trim()}`)}j(t,e,{mode:384}),this.log(`[OK] ${s} plist written to ${t}`)}bootstrapPlist(r,t,e){try{h("launchctl",["bootstrap",`gui/${r}`,t]),this.log(`[OK] ${e} service loaded into launchd`)}catch(s){try{h("launchctl",["load",t]),this.log(`[OK] ${e} service loaded into launchd (legacy)`)}catch(i){this.warn(`Could not load ${e} service.
+  bootstrap: ${s.message.trim()}
+  load: ${i.message.trim()}`)}}}buildPlist(r){let{port:t,projectRoot:e,nodePath:s,pnpmPath:i,envVars:n}=r,a=[...new Set([E(s),E(i),"/usr/local/bin","/usr/bin","/bin"])],c=Object.entries({...n,PORT:String(t),NODE_ENV:"production",PATH:a.join(":"),PG_POOL_MAX:n.PG_POOL_MAX??"10",PG_STATEMENT_TIMEOUT_MS:n.PG_STATEMENT_TIMEOUT_MS??"10000",PG_IDLE_TIMEOUT:n.PG_IDLE_TIMEOUT??"30",OTEL_SPAN_EXPORT:n.OTEL_SPAN_EXPORT??"none"}).map(([f,k])=>`      <key>${l(f)}</key>
+      <string>${l(k)}</string>`).join(`
+`),d=o(e,"apps","api","dist","index.js"),u=o(e,"apps","api","dist");return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${PLIST_LABEL}</string>
+  <string>${H}</string>
 
   <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(nodePath)}</string>
-    <string>${escapeXml(apiEntry)}</string>
+    <string>${l(s)}</string>
+    <string>${l(d)}</string>
   </array>
 
   <key>WorkingDirectory</key>
-  <string>${escapeXml(projectRoot)}</string>
+  <string>${l(e)}</string>
 
   <key>EnvironmentVariables</key>
   <dict>
-${envEntries}
+${c}
   </dict>
 
   <key>RunAtLoad</key>
@@ -699,65 +59,42 @@ ${envEntries}
 
   <key>WatchPaths</key>
   <array>
-    <string>${escapeXml(apiDist)}</string>
+    <string>${l(u)}</string>
   </array>
 
   <key>StandardOutPath</key>
-  <string>${escapeXml(join(LOG_DIR, "api-stdout.log"))}</string>
+  <string>${l(o(p,"api-stdout.log"))}</string>
 
   <key>StandardErrorPath</key>
-  <string>${escapeXml(join(LOG_DIR, "api-stderr.log"))}</string>
+  <string>${l(o(p,"api-stderr.log"))}</string>
 
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
 </plist>
-`;
-  }
-  buildWorkerPlist(opts) {
-    const { cliBin, cliDist, workingDir, nodePath, pnpmPath, envVars } = opts;
-    const nodeEnv = opts.nodeEnv ?? "development";
-    const pathDirs = [
-      ...new Set(
-        [dirname(nodePath), pnpmPath ? dirname(pnpmPath) : null, "/usr/local/bin", "/usr/bin", "/bin"].filter(
-          (d) => Boolean(d)
-        )
-      )
-    ];
-    const envEntries = Object.entries({
-      ...envVars,
-      NODE_ENV: nodeEnv,
-      PATH: pathDirs.join(":"),
-      // Bound the worker's pooler footprint. The worker is mostly idle (HTTP
-      // long-poll); an UNPINNED pool plus the previously-missing single-instance
-      // guard let an orphaned fleet of agents each hold a pool and saturate
-      // Supavisor's 200-client cap. A small pool + short idle timeout releases
-      // sessions promptly. Pool-exhaustion RCA 2026-06-21.
-      PG_POOL_MAX: envVars.PG_POOL_MAX ?? "3",
-      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? "10"
-    }).map(([k, v]) => `      <key>${escapeXml(k)}</key>
-      <string>${escapeXml(v)}</string>`).join("\n");
-    return `<?xml version="1.0" encoding="UTF-8"?>
+`}buildWorkerPlist(r){let{cliBin:t,cliDist:e,workingDir:s,nodePath:i,pnpmPath:n,envVars:a}=r,c=r.nodeEnv??"development",d=[...new Set([E(i),n?E(n):null,o(y(),".local","bin"),"/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin"].filter(f=>!!f))],u=Object.entries({...a,NODE_ENV:c,PATH:d.join(":"),PG_POOL_MAX:a.PG_POOL_MAX??"3",PG_IDLE_TIMEOUT:a.PG_IDLE_TIMEOUT??"10"}).map(([f,k])=>`      <key>${l(f)}</key>
+      <string>${l(k)}</string>`).join(`
+`);return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${WORKER_PLIST_LABEL}</string>
+  <string>${F}</string>
 
   <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(nodePath)}</string>
-    <string>${escapeXml(cliBin)}</string>
+    <string>${l(i)}</string>
+    <string>${l(t)}</string>
     <string>evals</string>
     <string>agent</string>
   </array>
 
   <key>WorkingDirectory</key>
-  <string>${escapeXml(workingDir)}</string>
+  <string>${l(s)}</string>
 
   <key>EnvironmentVariables</key>
   <dict>
-${envEntries}
+${u}
   </dict>
 
   <key>RunAtLoad</key>
@@ -774,58 +111,40 @@ ${envEntries}
 
   <key>WatchPaths</key>
   <array>
-    <string>${escapeXml(cliDist)}</string>
+    <string>${l(e)}</string>
   </array>
 
   <key>StandardOutPath</key>
-  <string>${escapeXml(join(LOG_DIR, "worker-stdout.log"))}</string>
+  <string>${l(o(p,"worker-stdout.log"))}</string>
 
   <key>StandardErrorPath</key>
-  <string>${escapeXml(join(LOG_DIR, "worker-stderr.log"))}</string>
+  <string>${l(o(p,"worker-stderr.log"))}</string>
 
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
 </plist>
-`;
-  }
-  // CONNECT-proxy router that fronts mitmproxy on :8787. Always-on so
-  // .claude/settings.json's HTTPS_PROXY pointer never resolves to a dead
-  // socket (which would break Claude Code entirely — see CLAUDE.md).
-  // NOT watched on rebuild: bouncing the gateway mid-request would drop
-  // in-flight streaming responses. Gateway code changes rarely; on
-  // upgrade, the user can `launchctl kickstart gui/<uid>/com.rulemetric.gateway`.
-  buildGatewayPlist(opts) {
-    const { projectRoot, nodePath } = opts;
-    const gatewayEntry = join(projectRoot, "apps", "cli", "dist", "lib", "gateway-entry.js");
-    const cliBin = join(projectRoot, "apps", "cli", "bin", "run.js");
-    const pathDirs = [.../* @__PURE__ */ new Set([dirname(nodePath), "/usr/local/bin", "/usr/bin", "/bin"])];
-    const env = {
-      RULEMETRIC_CLI_VERSION: this.config.version,
-      RULEMETRIC_CLI_ENTRY: cliBin,
-      PATH: pathDirs.join(":")
-    };
-    const envEntries = Object.entries(env).map(([k, v]) => `      <key>${escapeXml(k)}</key>
-      <string>${escapeXml(v)}</string>`).join("\n");
-    return `<?xml version="1.0" encoding="UTF-8"?>
+`}buildGatewayPlist(r){let{projectRoot:t,nodePath:e}=r,s=o(t,"apps","cli","dist","lib","gateway-entry.js"),i=o(t,"apps","cli","bin","run.js"),n=[...new Set([E(e),"/usr/local/bin","/usr/bin","/bin"])],a={RULEMETRIC_CLI_VERSION:this.config.version,RULEMETRIC_CLI_ENTRY:i,PATH:n.join(":")},c=Object.entries(a).map(([d,u])=>`      <key>${l(d)}</key>
+      <string>${l(u)}</string>`).join(`
+`);return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${GATEWAY_PLIST_LABEL}</string>
+  <string>${X}</string>
 
   <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(nodePath)}</string>
-    <string>${escapeXml(gatewayEntry)}</string>
+    <string>${l(e)}</string>
+    <string>${l(s)}</string>
   </array>
 
   <key>WorkingDirectory</key>
-  <string>${escapeXml(projectRoot)}</string>
+  <string>${l(t)}</string>
 
   <key>EnvironmentVariables</key>
   <dict>
-${envEntries}
+${c}
   </dict>
 
   <key>RunAtLoad</key>
@@ -841,58 +160,41 @@ ${envEntries}
   <integer>10</integer>
 
   <key>StandardOutPath</key>
-  <string>${escapeXml(join(LOG_DIR, "gateway-stdout.log"))}</string>
+  <string>${l(o(p,"gateway-stdout.log"))}</string>
 
   <key>StandardErrorPath</key>
-  <string>${escapeXml(join(LOG_DIR, "gateway-stderr.log"))}</string>
+  <string>${l(o(p,"gateway-stderr.log"))}</string>
 
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
 </plist>
-`;
-  }
-  // mitmproxy with the RuleMetric capture addon. Same invocation as
-  // `rulemetric proxy start` (see commands/proxy/start.ts:308) so the
-  // launchd path and the CLI path are interchangeable. We don't WatchPath
-  // the Python addon — mitmdump has its own addon reload that handles
-  // edits without a full process restart.
-  buildProxyPlist(opts) {
-    const { projectRoot, mitmdumpPath, envVars } = opts;
-    const addonPath = join(projectRoot, "packages", "proxy", "addon", "rulemetric_addon.py");
-    const pathDirs = [.../* @__PURE__ */ new Set([dirname(mitmdumpPath), "/usr/local/bin", "/usr/bin", "/bin"])];
-    const env = {
-      ...envVars,
-      RULEMETRIC_PROJECT_PATH: projectRoot,
-      RULEMETRIC_CLI_VERSION: this.config.version,
-      PATH: pathDirs.join(":")
-    };
-    const envEntries = Object.entries(env).map(([k, v]) => `      <key>${escapeXml(k)}</key>
-      <string>${escapeXml(v)}</string>`).join("\n");
-    return `<?xml version="1.0" encoding="UTF-8"?>
+`}buildProxyPlist(r){let{projectRoot:t,mitmdumpPath:e,envVars:s}=r,i=o(t,"packages","proxy","addon","rulemetric_addon.py"),n=[...new Set([E(e),"/usr/local/bin","/usr/bin","/bin"])],a={...s,RULEMETRIC_PROJECT_PATH:t,RULEMETRIC_CLI_VERSION:this.config.version,PATH:n.join(":")},c=Object.entries(a).map(([d,u])=>`      <key>${l(d)}</key>
+      <string>${l(u)}</string>`).join(`
+`);return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${PROXY_PLIST_LABEL}</string>
+  <string>${J}</string>
 
   <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(mitmdumpPath)}</string>
+    <string>${l(e)}</string>
     <string>--listen-port</string>
-    <string>${PROXY_PORT}</string>
+    <string>${V}</string>
     <string>-s</string>
-    <string>${escapeXml(addonPath)}</string>
+    <string>${l(i)}</string>
     <string>--set</string>
     <string>console_eventlog_verbosity=info</string>
   </array>
 
   <key>WorkingDirectory</key>
-  <string>${escapeXml(projectRoot)}</string>
+  <string>${l(t)}</string>
 
   <key>EnvironmentVariables</key>
   <dict>
-${envEntries}
+${c}
   </dict>
 
   <key>RunAtLoad</key>
@@ -908,39 +210,13 @@ ${envEntries}
   <integer>15</integer>
 
   <key>StandardOutPath</key>
-  <string>${escapeXml(join(LOG_DIR, "proxy-stdout.log"))}</string>
+  <string>${l(o(p,"proxy-stdout.log"))}</string>
 
   <key>StandardErrorPath</key>
-  <string>${escapeXml(join(LOG_DIR, "proxy-stderr.log"))}</string>
+  <string>${l(o(p,"proxy-stderr.log"))}</string>
 
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
 </plist>
-`;
-  }
-  async waitForApi(port, timeoutSecs) {
-    let lastError = null;
-    for (let i = 0; i < timeoutSecs; i++) {
-      try {
-        const res = await fetch(`http://localhost:${port}/health`);
-        if (res.ok) return true;
-        lastError = `health check returned ${res.status}`;
-      } catch (err) {
-        lastError = err.message;
-      }
-      await new Promise((r) => setTimeout(r, 1e3));
-    }
-    if (lastError) {
-      this.warn(`Last health check error: ${lastError}`);
-    }
-    return false;
-  }
-};
-function escapeXml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-export {
-  ServiceInstall as default
-};
-//# sourceMappingURL=install.js.map
+`}async waitForApi(r,t){let e=null;for(let s=0;s<t;s++){try{let i=await fetch(`http://localhost:${r}/health`);if(i.ok)return!0;e=`health check returned ${i.status}`}catch(i){e=i.message}await new Promise(i=>setTimeout(i,1e3))}return e&&this.warn(`Last health check error: ${e}`),!1}};function l(L){return L.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}$(l,"escapeXml");export{C as default};