@slock-ai/computer 0.0.14 → 0.0.15

package/dist/index.js

@@ -16617,8 +16617,8 @@ var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var { writeFile: writeFile12, readFile: readFile16, mkdir: mkdir16 } = __require("fs/promises");
-    var { dirname: dirname13, resolve } = __require("path");
+    var { writeFile: writeFile13, readFile: readFile17, mkdir: mkdir17 } = __require("fs/promises");
+    var { dirname: dirname14, resolve } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError: InvalidArgumentError2, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -16819,7 +16819,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile16(resolve(path3), "utf8");
+          const data = await readFile17(resolve(path3), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -16849,12 +16849,12 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         const resolvedPath = resolve(path3);
-        await mkdir16(dirname13(resolvedPath), { recursive: true });
+        await mkdir17(dirname14(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
         }));
-        await writeFile12(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile13(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -28469,8 +28469,8 @@ var require_graceful_fs = __commonJS({
       fs2.createReadStream = createReadStream;
       fs2.createWriteStream = createWriteStream;
       var fs$readFile = fs2.readFile;
-      fs2.readFile = readFile16;
-      function readFile16(path3, options, cb) {
+      fs2.readFile = readFile17;
+      function readFile17(path3, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path3, options, cb);
@@ -28486,8 +28486,8 @@ var require_graceful_fs = __commonJS({
         }
       }
       var fs$writeFile = fs2.writeFile;
-      fs2.writeFile = writeFile12;
-      function writeFile12(path3, data, options, cb) {
+      fs2.writeFile = writeFile13;
+      function writeFile13(path3, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$writeFile(path3, data, options, cb);
@@ -28504,8 +28504,8 @@ var require_graceful_fs = __commonJS({
       }
       var fs$appendFile = fs2.appendFile;
       if (fs$appendFile)
-        fs2.appendFile = appendFile2;
-      function appendFile2(path3, data, options, cb) {
+        fs2.appendFile = appendFile4;
+      function appendFile4(path3, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$appendFile(path3, data, options, cb);
@@ -29891,6 +29891,9 @@ function serverManagedFlagPath(slockHome, serverId) {
 function serverHealthPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "health.json");
 }
+function serviceStatePath(slockHome) {
+  return path2.join(computerDir(slockHome), "service.state.json");
+}
 function supervisorPidPath(slockHome) {
   return path2.join(computerDir(slockHome), "supervisor.pid");
 }
@@ -30376,15 +30379,78 @@ async function runAttach(opts) {
   }
 }
 
-// src/adopt.ts
+// src/setup.ts
 init_esm_shims();
-import { readFile as readFile4 } from "fs/promises";
+var import_undici3 = __toESM(require_undici(), 1);
+import { chmod as chmod4, mkdir as mkdir9, readFile as readFile8, rename as rename3, rm as rm2, writeFile as writeFile8 } from "fs/promises";
+import { dirname as dirname9 } from "path";
+
+// src/lib/migration.ts
+init_esm_shims();
+import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
+import { join } from "path";
+var MACHINE_DIR_PREFIX = "machine-";
+async function readOwnerEvidence(installRoot, machineDirName) {
+  const ownerFile = join(
+    installRoot,
+    "machines",
+    machineDirName,
+    "daemon.lock",
+    "owner.json"
+  );
+  let raw;
+  try {
+    raw = await readFile3(ownerFile, "utf8");
+  } catch {
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  const machineName = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : void 0;
+  const serverUrl = typeof parsed.serverUrl === "string" && parsed.serverUrl.length > 0 ? parsed.serverUrl : void 0;
+  return { machineName, serverUrl };
+}
+async function detectLegacyMigration(installRoot, loggedInUserId) {
+  void loggedInUserId;
+  const machinesDir = join(installRoot, "machines");
+  let entries;
+  try {
+    entries = await readdir2(machinesDir);
+  } catch {
+    return { kind: "no-match" };
+  }
+  const candidates = [];
+  for (const name of entries) {
+    if (!name.startsWith(MACHINE_DIR_PREFIX)) continue;
+    const evidence = await readOwnerEvidence(installRoot, name);
+    candidates.push({
+      machineId: name,
+      machineName: evidence.machineName,
+      serverUrl: evidence.serverUrl
+    });
+  }
+  if (candidates.length === 0) return { kind: "no-match" };
+  if (candidates.length === 1) {
+    const only = candidates[0];
+    return {
+      kind: "match",
+      machineId: only.machineId,
+      machineName: only.machineName,
+      serverUrl: only.serverUrl
+    };
+  }
+  return { kind: "ambiguous", candidates };
+}
 
 // src/services/adoptLegacy.ts
 init_esm_shims();
-import { chmod as chmod3, mkdir as mkdir4, readFile as readFile3, writeFile as writeFile4, appendFile, stat } from "fs/promises";
+import { chmod as chmod3, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4, appendFile, stat } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
-import { dirname as dirname4, join } from "path";
+import { dirname as dirname4, join as join2 } from "path";
 import { setTimeout as delay } from "timers/promises";
 function emit3(opts, event) {
   const cb = opts?.onEvent;
@@ -30398,7 +30464,7 @@ var LEGACY_STOP_WAIT_MS = 1e4;
 var LEGACY_STOP_POLL_MS = 200;
 function legacyLockOwnerPath(slockHome, rawKey) {
   const fingerprint = createHash2("sha256").update(rawKey).digest("hex").slice(0, 16);
-  return join(slockHome, "machines", `machine-${fingerprint}`, "daemon.lock", "owner.json");
+  return join2(slockHome, "machines", `machine-${fingerprint}`, "daemon.lock", "owner.json");
 }
 function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -30413,7 +30479,7 @@ function isProcessAlive(pid) {
 async function stopLegacyDaemonByOwnerFile(ownerFile) {
   let raw;
   try {
-    raw = await readFile3(ownerFile, "utf8");
+    raw = await readFile4(ownerFile, "utf8");
   } catch {
     return { attempted: false, outcome: "absent" };
   }
@@ -30447,7 +30513,7 @@ async function stopLegacyDaemonByOwnerFile(ownerFile) {
 async function readLegacyOwnerEvidence(ownerFile) {
   let raw;
   try {
-    raw = await readFile3(ownerFile, "utf8");
+    raw = await readFile4(ownerFile, "utf8");
   } catch {
     return { ownerFile, reason: "owner_file_absent" };
   }
@@ -30487,7 +30553,7 @@ async function adoptLegacy(input, options = {}) {
   const sessionFile = userSessionPath(slockHome);
   let session;
   try {
-    session = JSON.parse(await readFile3(sessionFile, "utf8"));
+    session = JSON.parse(await readFile4(sessionFile, "utf8"));
   } catch (err) {
     throw new ComputerServiceError(
       "NO_USER_SESSION",
@@ -30733,134 +30799,18 @@ async function appendAdoptionLog(slockHome, line) {
   }
 }
 
-// src/adopt.ts
-async function resolveLegacyKey(inputs, env) {
-  const sources = [];
-  if (typeof inputs.legacyApiKey === "string" && inputs.legacyApiKey.length > 0) {
-    sources.push({
-      mode: "legacy_key_argv",
-      load: async () => inputs.legacyApiKey.trim()
-    });
-  }
-  if (typeof inputs.legacyApiKeyFile === "string" && inputs.legacyApiKeyFile.length > 0) {
-    sources.push({
-      mode: "legacy_key_file",
-      load: async () => {
-        const contents = await readFile4(inputs.legacyApiKeyFile, "utf8");
-        return contents.trim();
-      }
-    });
-  }
-  if (inputs.legacyApiKeyStdin) {
-    sources.push({
-      mode: "legacy_key_stdin",
-      load: async () => readAllStdin()
-    });
-  }
-  const envKey = env.SLOCK_LEGACY_API_KEY;
-  if (typeof envKey === "string" && envKey.trim().length > 0) {
-    sources.push({
-      mode: "legacy_key_env",
-      load: async () => envKey.trim()
-    });
-  }
-  if (sources.length === 0) {
-    fail(
-      "LEGACY_KEY_REQUIRED",
-      "No legacy api key provided. Pass exactly one of: --legacy-api-key <key>, --legacy-api-key-file <path>, --legacy-api-key-stdin, or SLOCK_LEGACY_API_KEY."
-    );
-  }
-  if (sources.length > 1) {
-    const modes = sources.map((s) => s.mode).join(", ");
-    fail(
-      "LEGACY_KEY_MULTIPLE_SOURCES",
-      `Multiple legacy api key sources provided (${modes}). Choose exactly one.`
-    );
-  }
-  const chosen = sources[0];
-  const rawKey = await chosen.load();
-  if (chosen.mode === "legacy_key_env") {
-    delete env.SLOCK_LEGACY_API_KEY;
-  }
-  if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
-    fail(
-      "LEGACY_KEY_INVALID",
-      "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
-    );
-  }
-  return {
-    rawKey,
-    mode: chosen.mode,
-    redactedPrefix: rawKey.slice(0, 8)
-  };
-}
-async function readAllStdin() {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8").trim()));
-    process.stdin.on("error", reject);
-  });
-}
-async function runAdoptLegacy(inputs) {
-  const legacy = await resolveLegacyKey(inputs, process.env);
-  try {
-    await adoptLegacy(
-      {
-        serverSlug: inputs.serverSlug,
-        serverUrl: inputs.serverUrl,
-        name: inputs.name,
-        rawKey: legacy.rawKey,
-        mode: legacy.mode,
-        redactedPrefix: legacy.redactedPrefix
-      },
-      {
-        onEvent: (event) => {
-          if (event.type === "adopting") {
-            info(
-              `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
-            );
-          } else if (event.type === "preflight") {
-            info(event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026");
-          } else if (event.type === "adopted") {
-            info(`Adopted. Computer state written to ${event.attachmentPath}`);
-            info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
-            info(`  serverMachine: ${event.serverMachineId}`);
-            info(`  legacyMachine: ${event.legacyMachineId}`);
-            switch (event.legacyStop.outcome) {
-              case "absent":
-                info("  legacy daemon: not detected on this Computer (no local lock file)");
-                break;
-              case "already_dead":
-                info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
-                break;
-              case "stopped":
-                info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
-                break;
-            }
-          }
-        }
-      }
-    );
-  } catch (err) {
-    if (err instanceof CliExit) throw err;
-    if (err instanceof ComputerServiceError) {
-      fail(err.code, err.message);
-    }
-    throw err;
-  } finally {
-    legacy.rawKey = void 0;
-  }
-  if (!inputs.orchestrated) {
-    info(`Next: run \`slock-computer start\` to bring this server online under the Computer supervisor.`);
-  }
-}
+// src/supervisor.ts
+init_esm_shims();
+import { spawn as spawn2 } from "child_process";
+import { mkdir as mkdir8, readFile as readFile7, writeFile as writeFile7, open, rename as rename2 } from "fs/promises";
+import { dirname as dirname8, join as joinPath } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
-// src/setup.ts
+// src/cleanup.ts
 init_esm_shims();
-var import_undici3 = __toESM(require_undici(), 1);
-import { chmod as chmod4, mkdir as mkdir9, readdir as readdir3, readFile as readFile8, rename as rename3, rm as rm2, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname9, join as join3 } from "path";
+import { readdir as readdir3, stat as stat2, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
+import { spawn } from "child_process";
+import { join as join3 } from "path";
 
 // src/internal/process-primitives.ts
 init_esm_shims();
@@ -30895,18 +30845,7 @@ async function clearPidfileAt(pidfilePath) {
   }
 }
 
-// src/supervisor.ts
-init_esm_shims();
-import { spawn as spawn2 } from "child_process";
-import { mkdir as mkdir8, readFile as readFile7, writeFile as writeFile7, open, rename as rename2 } from "fs/promises";
-import { dirname as dirname8, join as joinPath } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-
 // src/cleanup.ts
-init_esm_shims();
-import { readdir as readdir2, stat as stat2, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
-import { spawn } from "child_process";
-import { join as join2 } from "path";
 function emptyCleanupReport() {
   return {
     stalePidfiles: [],
@@ -31001,12 +30940,12 @@ async function cleanupOrphanProcesses(slockHome, psSpawn) {
   return signaled;
 }
 function quarantineDir(slockHome) {
-  return join2(computerDir(slockHome), ".quarantine");
+  return join3(computerDir(slockHome), ".quarantine");
 }
 async function quarantineServerSubtree(slockHome, serverId) {
-  const src = join2(serversDir(slockHome), serverId);
+  const src = join3(serversDir(slockHome), serverId);
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dest = join2(quarantineDir(slockHome), `${stamp}-${serverId}`);
+  const dest = join3(quarantineDir(slockHome), `${stamp}-${serverId}`);
   await mkdir6(dirname6(dest), { recursive: true });
   await rename(src, dest);
   return dest;
@@ -31018,7 +30957,7 @@ function dirname6(p) {
 async function cleanupPowerLossPartialState(slockHome) {
   let entries;
   try {
-    entries = await readdir2(serversDir(slockHome));
+    entries = await readdir3(serversDir(slockHome));
   } catch {
     return [];
   }
@@ -31045,11 +30984,11 @@ var TMP_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 async function cleanupTmpFiles(slockHome) {
   const removed = [];
   const cdir = computerDir(slockHome);
-  const stagingDir = join2(cdir, "upgrade-staging");
+  const stagingDir = join3(cdir, "upgrade-staging");
   try {
-    const versions = await readdir2(stagingDir);
+    const versions = await readdir3(stagingDir);
     for (const v of versions) {
-      const vdir = join2(stagingDir, v);
+      const vdir = join3(stagingDir, v);
       try {
         const s = await stat2(vdir);
         if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
@@ -31060,13 +30999,13 @@ async function cleanupTmpFiles(slockHome) {
       }
     }
     try {
-      const remaining = await readdir2(stagingDir);
+      const remaining = await readdir3(stagingDir);
       if (remaining.length === 0) await rmdir(stagingDir);
     } catch {
     }
   } catch {
   }
-  const snap = join2(cdir, "upgrade-snapshot.json");
+  const snap = join3(cdir, "upgrade-snapshot.json");
   try {
     const s = await stat2(snap);
     if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
@@ -31078,7 +31017,7 @@ async function cleanupTmpFiles(slockHome) {
   return removed;
 }
 async function cleanupStaleLock(slockHome) {
-  const lockDir = join2(computerDir(slockHome), ".lock");
+  const lockDir = join3(computerDir(slockHome), ".lock");
   try {
     const s = await stat2(lockDir);
     if (Date.now() - s.mtimeMs > 60 * 1e3) {
@@ -31090,7 +31029,7 @@ async function cleanupStaleLock(slockHome) {
   return [];
 }
 async function forceReleaseLock(slockHome) {
-  const lockDir = join2(computerDir(slockHome), ".lock");
+  const lockDir = join3(computerDir(slockHome), ".lock");
   try {
     await stat2(lockDir);
     await rm(lockDir, { recursive: true, force: true });
@@ -31114,7 +31053,7 @@ async function runFullCleanup(slockHome, options = {}) {
 
 // src/health.ts
 init_esm_shims();
-import { readFile as readFile6, writeFile as writeFile6, unlink as unlink4, mkdir as mkdir7 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile6, unlink as unlink4, mkdir as mkdir7, appendFile as appendFile2 } from "fs/promises";
 import { dirname as dirname7 } from "path";
 var CRASH_WINDOW_MS = 6e4;
 var DEGRADED_THRESHOLD = 3;
@@ -31186,6 +31125,43 @@ async function resetHealth(slockHome, serverId) {
   } catch {
   }
 }
+async function resetRunnerHealth(slockHome, serverId, nowMs = Date.now()) {
+  if (!isValidServerId(serverId)) {
+    return { status: "not-found" };
+  }
+  const wasDegraded = await isDegraded(slockHome, serverId, nowMs);
+  const recent = await readCrashHistory(slockHome, serverId, nowMs);
+  const previousState = wasDegraded ? "degraded" : "running";
+  await resetHealth(slockHome, serverId);
+  await emitRunnerStateTransition(
+    slockHome,
+    serverId,
+    previousState,
+    "running",
+    "reset-runner"
+  );
+  return {
+    status: "ok",
+    previousState,
+    clearedCrashCount: recent.length
+  };
+}
+async function emitRunnerStateTransition(slockHome, serverId, fromState, toState, trigger) {
+  const entry = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    kind: "runner-state-changed",
+    serverId,
+    fromState,
+    toState,
+    trigger
+  };
+  try {
+    const path3 = supervisorLogPath(slockHome);
+    await mkdir7(dirname7(path3), { recursive: true });
+    await appendFile2(path3, JSON.stringify(entry) + "\n");
+  } catch {
+  }
+}
 
 // src/services/start.ts
 init_esm_shims();
@@ -31283,7 +31259,14 @@ async function start(input, options = {}) {
       attachedCount: attached.length
     });
     const supervise = options.runSupervise ?? runSupervise;
-    await supervise();
+    const previousParentLockMarker = process.env[PARENT_LOCK_HELD_ENV_VAR];
+    process.env[PARENT_LOCK_HELD_ENV_VAR] = "1";
+    try {
+      await supervise();
+    } finally {
+      if (previousParentLockMarker === void 0) delete process.env[PARENT_LOCK_HELD_ENV_VAR];
+      else process.env[PARENT_LOCK_HELD_ENV_VAR] = previousParentLockMarker;
+    }
     return {
       status: "running",
       managedTargets,
@@ -31916,6 +31899,14 @@ async function runDetach(serverId, serverLabel = serverId) {
 
 // src/setup.ts
 var USER_SESSION_EXPIRY_LEEWAY_MS = 3e4;
+async function readUserSessionUserId(slockHome) {
+  try {
+    const parsed = JSON.parse(await readFile8(userSessionPath(slockHome), "utf8"));
+    return typeof parsed.userId === "string" ? parsed.userId : "";
+  } catch {
+    return "";
+  }
+}
 async function hasValidUserSession(slockHome) {
   try {
     const parsed = JSON.parse(await readFile8(userSessionPath(slockHome), "utf8"));
@@ -31983,49 +31974,74 @@ async function refreshUserSession(slockHome, serverUrl) {
     return false;
   }
 }
-async function hasLiveLegacyDaemon(slockHome) {
-  let machineDirs;
-  try {
-    machineDirs = await readdir3(join3(slockHome, "machines"));
-  } catch {
-    return false;
-  }
-  for (const name of machineDirs) {
-    if (!name.startsWith("machine-")) continue;
-    try {
-      const raw = await readFile8(join3(slockHome, "machines", name, "daemon.lock", "owner.json"), "utf8");
-      const owner = JSON.parse(raw);
-      if (typeof owner.pid === "number" && isProcessAlive2(owner.pid)) return true;
-    } catch {
-    }
-  }
-  return false;
+async function defaultConfirmMigrate(prompt) {
+  process.stdout.write(prompt);
+  const line = await readLine(false);
+  const norm = line.trim().toLowerCase();
+  return norm === "y" || norm === "yes";
 }
-function hasExplicitLegacyKeyInput(opts) {
-  return typeof opts.legacyApiKey === "string" && opts.legacyApiKey.length > 0 || typeof opts.legacyApiKeyFile === "string" && opts.legacyApiKeyFile.length > 0 || opts.legacyApiKeyStdin === true;
+async function defaultReadMigrateSecret(prompt) {
+  process.stdout.write(prompt);
+  const line = await readLine(true);
+  process.stdout.write("\n");
+  return line.trim();
 }
-function hasAmbientLegacyKeyInput() {
-  return typeof process.env.SLOCK_LEGACY_API_KEY === "string" && process.env.SLOCK_LEGACY_API_KEY.trim().length > 0;
+async function readLine(masked) {
+  const stdin = process.stdin;
+  const wasRaw = stdin.isTTY === true && stdin.isRaw === true;
+  const enterRaw = masked && stdin.isTTY === true && typeof stdin.setRawMode === "function";
+  if (enterRaw) stdin.setRawMode(true);
+  stdin.resume();
+  return await new Promise((resolve) => {
+    let buf = "";
+    const cleanup = () => {
+      stdin.off("data", onData);
+      stdin.off("end", onEnd);
+      stdin.pause();
+      if (enterRaw) stdin.setRawMode(wasRaw);
+    };
+    const onData = (chunk) => {
+      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const ch of text) {
+        if (ch === "\n" || ch === "\r") {
+          cleanup();
+          resolve(buf);
+          return;
+        }
+        if (ch === "") {
+          cleanup();
+          resolve("");
+          return;
+        }
+        if (ch === "\x7F" || ch === "\b") {
+          buf = buf.slice(0, -1);
+          continue;
+        }
+        buf += ch;
+      }
+    };
+    const onEnd = () => {
+      cleanup();
+      resolve(buf);
+    };
+    stdin.on("data", onData);
+    stdin.on("end", onEnd);
+  });
 }
 async function runSetup(opts, deps = {}) {
   const slockHome = resolveSlockHome();
   const isTty = deps.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
   const login2 = deps.runLogin ?? runLogin;
   const attach2 = deps.runAttach ?? runAttach;
-  const adopt = deps.runAdoptLegacy ?? runAdoptLegacy;
   const start2 = deps.runStart ?? runStart;
   const refreshSession = deps.refreshUserSession ?? refreshUserSession;
-  const legacyDaemonCheck = deps.hasLiveLegacyDaemon ?? hasLiveLegacyDaemon;
+  const detectMigration = deps.detectLegacyMigration ?? detectLegacyMigration;
+  const confirmMigrate = deps.confirmMigrate ?? defaultConfirmMigrate;
+  const readMigrateSecret = deps.readMigrateSecret ?? defaultReadMigrateSecret;
   if (!isTty && !opts.yes) {
     fail(
       "NON_INTERACTIVE_SETUP_REQUIRES_FLAGS",
-      "Non-interactive setup requires --yes after you have confirmed the login/attach/adopt/start actions. Run `slock-computer login`, `slock-computer attach`, and `slock-computer start` separately for fully explicit automation."
-    );
-  }
-  if (!opts.adoptLegacy && hasExplicitLegacyKeyInput(opts)) {
-    fail(
-      "LEGACY_KEY_OUTSIDE_ADOPT",
-      "`--legacy-api-key*` options are only accepted with `slock-computer setup --adopt-legacy` or `slock-computer adopt-legacy`."
+      "Non-interactive setup requires --yes after you have confirmed the login/attach/start actions. Run `slock-computer login`, `slock-computer attach`, and `slock-computer start` separately for fully explicit automation."
     );
   }
   const label = formatServerSlugDisplay(opts.serverSlug);
@@ -32050,34 +32066,82 @@ async function runSetup(opts, deps = {}) {
   if (attachment) {
     info(`Attachment: already attached to ${label}.`);
   } else {
-    const liveLegacy = await legacyDaemonCheck(slockHome);
-    const explicitLegacyKey = hasExplicitLegacyKeyInput(opts);
-    const hasLegacyKey = explicitLegacyKey || opts.adoptLegacy === true && hasAmbientLegacyKeyInput();
-    if (!opts.adoptLegacy && liveLegacy) {
-      fail(
-        "LEGACY_DAEMON_RUNNING",
-        `A legacy daemon appears to be running in ${slockHome}, so Computer setup stopped before creating a second attachment. To proceed: try the Computer beta in an isolated home with \`SLOCK_HOME=$HOME/.slock-computer-beta slock-computer setup ${label}\`; or stop the legacy daemon with \`pkill -f slock-daemon && rm -f ~/.slock/daemon.pid\`; or migrate the existing daemon with \`--adopt-legacy --legacy-api-key <key>\`.`
-      );
-    }
-    if (opts.adoptLegacy && hasLegacyKey) {
-      await adopt({
-        serverSlug: opts.serverSlug,
-        serverUrl: opts.serverUrl,
-        name: opts.name,
-        legacyApiKey: opts.legacyApiKey,
-        legacyApiKeyFile: opts.legacyApiKeyFile,
-        legacyApiKeyStdin: opts.legacyApiKeyStdin,
-        orchestrated: true
-      });
-    } else if (opts.adoptLegacy && liveLegacy) {
-      fail(
-        "LEGACY_DAEMON_RUNNING",
-        `A legacy daemon is running in ${slockHome}, but no legacy key was provided. To proceed: provide --legacy-api-key-file/--legacy-api-key/--legacy-api-key-stdin to adopt it; or stop the legacy daemon with \`pkill -f slock-daemon && rm -f ~/.slock/daemon.pid\`; or use an isolated home with \`SLOCK_HOME=$HOME/.slock-computer-beta slock-computer setup ${label}\` for a clean beta trial.`
-      );
-    } else {
-      if (opts.adoptLegacy) {
-        info("Legacy key: not provided; falling back to fresh device-login attach.");
+    let migrated = false;
+    if (isTty) {
+      const detection = await detectMigration(slockHome, await readUserSessionUserId(slockHome));
+      if (detection.kind === "match") {
+        const where = detection.serverUrl ? ` attached to ${detection.serverUrl}` : "";
+        const who = detection.machineName ? ` "${detection.machineName}"` : "";
+        const accepted = await confirmMigrate(
+          `Migration: detected legacy daemon machine${who}${where}. Migrate it under Computer instead of creating a fresh attachment? [y/N] `
+        );
+        if (accepted) {
+          const rawKey = await readMigrateSecret(
+            "Paste legacy api key (sk_machine_* or sk_daemon_*); input is hidden: "
+          );
+          if (rawKey.length === 0) {
+            info("Migration: no key provided; falling back to fresh attach.");
+          } else if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
+            fail(
+              "LEGACY_KEY_INVALID",
+              "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
+            );
+          } else {
+            try {
+              await adoptLegacy(
+                {
+                  serverSlug: opts.serverSlug,
+                  serverUrl: opts.serverUrl,
+                  name: opts.name,
+                  rawKey,
+                  mode: "legacy_key_stdin",
+                  redactedPrefix: rawKey.slice(0, 8)
+                },
+                {
+                  onEvent: (event) => {
+                    if (event.type === "adopting") {
+                      info(
+                        `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
+                      );
+                    } else if (event.type === "preflight") {
+                      info(
+                        event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026"
+                      );
+                    } else if (event.type === "adopted") {
+                      info(`Adopted. Computer state written to ${event.attachmentPath}`);
+                      info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
+                      info(`  serverMachine: ${event.serverMachineId}`);
+                      info(`  legacyMachine: ${event.legacyMachineId}`);
+                      switch (event.legacyStop.outcome) {
+                        case "absent":
+                          info("  legacy daemon: not detected on this Computer (no local lock file)");
+                          break;
+                        case "already_dead":
+                          info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
+                          break;
+                        case "stopped":
+                          info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
+                          break;
+                      }
+                    }
+                  }
+                }
+              );
+              migrated = true;
+            } catch (err) {
+              if (err instanceof CliExit) throw err;
+              if (err instanceof ComputerServiceError) {
+                fail(err.code, err.message);
+              }
+              throw err;
+            }
+          }
+        } else {
+          info("Migration: declined; falling back to fresh attach.");
+        }
       }
+    }
+    if (!migrated) {
       await attach2({
         serverSlug: opts.serverSlug,
         serverUrl: opts.serverUrl,
@@ -32090,7 +32154,7 @@ async function runSetup(opts, deps = {}) {
     if (!attachment) {
       fail(
         "SETUP_ATTACHMENT_MISSING",
-        `Setup did not produce a local attachment for ${label}. Re-run \`slock-computer attach ${label}\` or \`slock-computer adopt-legacy ${label}\`.`
+        `Setup did not produce a local attachment for ${label}. Re-run \`slock-computer attach ${label}\`.`
       );
     }
   }
@@ -32138,32 +32202,31 @@ async function deriveHealth(slockHome, serverId, daemon) {
   if (await isDegraded(slockHome, serverId)) return "degraded";
   return "ok";
 }
-async function buildStatusReport() {
-  const slockHome = resolveSlockHome();
-  const sessionRead = await readUserSession(userSessionPath(slockHome));
+async function buildStatusReport(installRoot) {
+  const sessionRead = await readUserSession(userSessionPath(installRoot));
   const session = sessionRead.session;
-  const attachments = await listServerAttachments(slockHome);
+  const attachments = await listServerAttachments(installRoot);
   const supervisor = {
-    ...await pidStatus(supervisorPidPath(slockHome)),
-    logPath: supervisorLogPath(slockHome)
+    ...await pidStatus(supervisorPidPath(installRoot)),
+    logPath: supervisorLogPath(installRoot)
   };
   const servers = [];
   for (const a of attachments) {
-    const daemon = await pidStatus(serverDaemonPidPath(slockHome, a.serverId));
+    const daemon = await pidStatus(serverDaemonPidPath(installRoot, a.serverId));
     servers.push({
       serverId: a.serverId,
       serverSlug: a.serverSlug ?? null,
       serverMachineId: a.serverMachineId,
       serverUrl: a.serverUrl,
       attachedAt: a.attachedAt ?? null,
-      daemonLogPath: serverDaemonLogPath(slockHome, a.serverId),
+      daemonLogPath: serverDaemonLogPath(installRoot, a.serverId),
       daemon,
-      health: await deriveHealth(slockHome, a.serverId, daemon)
+      health: await deriveHealth(installRoot, a.serverId, daemon)
     });
   }
   const loggedIn = session?.kind === "user-session" && typeof session.accessToken === "string" && session.accessToken.length > 0;
   return {
-    slockHome,
+    slockHome: installRoot,
     loggedIn,
     userId: session ? str(session.userId) : null,
     loginServerUrl: session ? str(session.serverUrl) : null,
@@ -32176,7 +32239,7 @@ function pad(s, n) {
   return s.length >= n ? s : s + " ".repeat(n - s.length);
 }
 async function runStatus(opts) {
-  const report = await buildStatusReport();
+  const report = await buildStatusReport(resolveSlockHome());
   if (opts.json) {
     info(JSON.stringify(report, null, 2));
     return;
@@ -32281,42 +32344,92 @@ async function resolveTargetAttachment(opts) {
   return a;
 }
 
+// src/lib/readers.ts
+init_esm_shims();
+
+// src/lib/types.ts
+init_esm_shims();
+var StateReaderError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "StateReaderError";
+    this.code = code;
+  }
+};
+
+// src/lib/readers.ts
+async function listRunners(installRoot, opts = {}) {
+  const all = await listServerAttachments(installRoot);
+  let subset = all;
+  if (opts.serverId !== void 0) {
+    const found = all.find((a) => a.serverId === opts.serverId);
+    if (!found) {
+      throw new StateReaderError(
+        "NOT_ATTACHED",
+        `Server ${opts.serverId} is not attached to this Computer.`
+      );
+    }
+    subset = [found];
+  }
+  const servers = [];
+  for (const a of subset) {
+    const client = new RunnersClient(a.serverUrl, a.apiKey);
+    const result = await client.list();
+    const idCols = { serverId: a.serverId, serverSlug: a.serverSlug ?? null };
+    if (result.status === "success") {
+      servers.push({
+        ...idCols,
+        status: "ok",
+        whitelist: result.whitelist,
+        runners: result.runners
+      });
+    } else if (result.status === "unauthorized") {
+      servers.push({ ...idCols, status: "unauthorized" });
+    } else {
+      servers.push({ ...idCols, status: "error", code: result.code });
+    }
+  }
+  return { servers };
+}
+
 // src/runners.ts
 async function runRunnersList(opts) {
-  const a = await resolveTargetAttachment({ server: opts.server });
-  const client = new RunnersClient(a.serverUrl, a.apiKey);
-  const result = await client.list();
-  const label = a.serverSlug ? formatServerSlugDisplay(a.serverSlug) : a.serverId;
-  if (result.status === "unauthorized") {
+  const serverId = await resolveTargetServerId({ server: opts.server });
+  const installRoot = resolveSlockHome();
+  const { servers } = await listRunners(installRoot, { serverId });
+  const block = servers[0];
+  const label = block.serverSlug ? formatServerSlugDisplay(block.serverSlug) : block.serverId;
+  if (block.status === "unauthorized") {
     fail(
       "RUNNERS_UNAUTHORIZED",
       `The Computer credential for ${label} was rejected. Re-run \`slock-computer attach ${label}\`.`
     );
   }
-  if (result.status === "error") {
+  if (block.status === "error") {
     fail(
       "RUNNERS_LIST_FAILED",
-      `Could not list runners on ${label} (${result.code}). Check --server-url / server version.`
+      `Could not list runners on ${label} (${block.code}). Check --server-url / server version.`
     );
   }
   if (opts.json) {
     info(
       JSON.stringify(
-        { server: label, serverId: a.serverId, whitelist: result.whitelist, runners: result.runners },
+        { server: label, serverId: block.serverId, whitelist: block.whitelist, runners: block.runners },
         null,
         2
       )
     );
     return;
   }
-  if (result.runners.length === 0) {
+  if (block.runners.length === 0) {
     info(`No runners on server ${label}.`);
     return;
   }
   info("");
   info(`Server ${label}:`);
   info("  AGENT                                 STATUS     RUNTIME   MODEL          NAME");
-  for (const r of result.runners) {
+  for (const r of block.runners) {
     info(
       `  ${r.agentId.padEnd(38)}${(r.status ?? "").padEnd(11)}${(r.runtime ?? "").padEnd(10)}${(r.model ?? "").padEnd(15)}${r.name ?? ""}`
     );
@@ -32365,7 +32478,8 @@ function redactSecrets(line) {
   return out;
 }
 async function runDoctorChecks() {
-  const report = await buildStatusReport();
+  const slockHome = resolveSlockHome();
+  const report = await buildStatusReport(slockHome);
   const checks = [];
   checks.push({ name: "SLOCK_HOME", ok: true, detail: report.slockHome });
   checks.push(
@@ -32378,7 +32492,6 @@ async function runDoctorChecks() {
       detail: "stopped (run `slock-computer start` when you want background)"
     }
   );
-  const slockHome = resolveSlockHome();
   const attachments = await listServerAttachments(slockHome);
   if (attachments.length === 0) {
     checks.push({
@@ -32511,16 +32624,166 @@ async function runLogs(opts) {
   for (const line of tail) info(redactSecrets(line));
 }
 
+// src/reset.ts
+init_esm_shims();
+
+// src/serviceState.ts
+init_esm_shims();
+import { mkdir as mkdir10, readFile as readFile11, writeFile as writeFile9, appendFile as appendFile3 } from "fs/promises";
+import { dirname as dirname10 } from "path";
+
+// src/lib/state.ts
+init_esm_shims();
+var SERVICE_STATE_VALUES = [
+  "starting",
+  "running",
+  "degraded",
+  "stopping",
+  "stopped"
+];
+function isServiceState(value) {
+  return typeof value === "string" && SERVICE_STATE_VALUES.includes(value);
+}
+
+// src/serviceState.ts
+var DEFAULT_STATE = {
+  state: "running",
+  crashHistory: []
+};
+async function readServiceState(slockHome) {
+  try {
+    const raw = await readFile11(serviceStatePath(slockHome), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return { ...DEFAULT_STATE };
+    const obj = parsed;
+    const state = isServiceState(obj.state) ? obj.state : "running";
+    const crashHistory = Array.isArray(obj.crashHistory) ? obj.crashHistory.filter(isCrashEntry) : [];
+    return { state, crashHistory };
+  } catch {
+    return { ...DEFAULT_STATE };
+  }
+}
+async function writeServiceState(slockHome, file) {
+  const path3 = serviceStatePath(slockHome);
+  await mkdir10(dirname10(path3), { recursive: true });
+  await writeFile9(path3, JSON.stringify(file), { mode: 384 });
+}
+function isCrashEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const obj = value;
+  return typeof obj.at === "string";
+}
+async function emitServiceStateTransition(slockHome, fromState, toState, trigger) {
+  const entry = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    kind: "service-state-changed",
+    fromState,
+    toState,
+    trigger
+  };
+  try {
+    const path3 = supervisorLogPath(slockHome);
+    await mkdir10(dirname10(path3), { recursive: true });
+    await appendFile3(path3, JSON.stringify(entry) + "\n");
+  } catch {
+  }
+}
+async function clearServiceCrashHistory(slockHome) {
+  const current = await readServiceState(slockHome);
+  const previousState = current.state;
+  const clearedCrashCount = current.crashHistory.length;
+  const next = { state: "running", crashHistory: [] };
+  await writeServiceState(slockHome, next);
+  await emitServiceStateTransition(
+    slockHome,
+    previousState,
+    "running",
+    "reset-service"
+  );
+  return { previousState, clearedCrashCount };
+}
+
+// src/reset.ts
+async function resetService(installRoot) {
+  const { previousState, clearedCrashCount } = await clearServiceCrashHistory(installRoot);
+  return {
+    status: "ok",
+    previousState,
+    clearedCrashCount
+  };
+}
+async function resetRunner(installRoot, serverId) {
+  const attachment = await readServerAttachment(installRoot, serverId);
+  if (!attachment) {
+    return { status: "not-found", serverId };
+  }
+  const outcome = await resetRunnerHealth(installRoot, serverId);
+  if (outcome.status === "not-found") {
+    return { status: "not-found", serverId };
+  }
+  return {
+    status: "ok",
+    serverId,
+    previousState: outcome.previousState ?? "running",
+    clearedCrashCount: outcome.clearedCrashCount ?? 0
+  };
+}
+async function runReset(opts) {
+  const wantsService = opts.service === true;
+  const wantsRunner = opts.runner === true;
+  if (wantsService && wantsRunner) {
+    fail(
+      "RESET_SCOPE_AMBIGUOUS",
+      "`--service` and `--runner` are mutually exclusive. Pass exactly one."
+    );
+  }
+  if (!wantsService && !wantsRunner) {
+    fail(
+      "RESET_SCOPE_MISSING",
+      "Pass `--service` to clear the service-level crash history, or `--runner` to clear a per-runner crash history."
+    );
+  }
+  const slockHome = resolveSlockHome();
+  if (wantsService) {
+    const result2 = await resetService(slockHome);
+    if (opts.json) {
+      info(JSON.stringify(result2));
+      return;
+    }
+    info(
+      `Reset service crash history (previous state: ${result2.previousState}; cleared ${result2.clearedCrashCount} entr${result2.clearedCrashCount === 1 ? "y" : "ies"}).`
+    );
+    info("Service state transitioned to `running`. Runners were not touched.");
+    return;
+  }
+  const serverId = await resolveTargetServerId({ server: opts.server });
+  const result = await resetRunner(slockHome, serverId);
+  if (result.status === "not-found") {
+    fail(
+      "RESET_RUNNER_NOT_FOUND",
+      `Runner for server ${serverId} was not found.`
+    );
+  }
+  if (opts.json) {
+    info(JSON.stringify(result));
+    return;
+  }
+  info(
+    `Reset runner crash history for server ${result.serverId} (previous state: ${result.previousState}; cleared ${result.clearedCrashCount} entr${result.clearedCrashCount === 1 ? "y" : "ies"}).`
+  );
+  info("Runner state transitioned to `running`. Process was not respawned.");
+}
+
 // src/concurrency.ts
 init_esm_shims();
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import { mkdir as mkdir10 } from "fs/promises";
+import { mkdir as mkdir11 } from "fs/promises";
 import { join as join4 } from "path";
 var STALE_LOCK_THRESHOLD_MS = 6e4;
 async function withMutationLock(fn) {
   const slockHome = resolveSlockHome();
   const lockTarget = computerDir(slockHome);
-  await mkdir10(lockTarget, { recursive: true });
+  await mkdir11(lockTarget, { recursive: true });
   const lockfilePath = join4(lockTarget, ".lock");
   let release = null;
   try {
@@ -32559,8 +32822,8 @@ async function withMutationLock(fn) {
 
 // src/channel.ts
 init_esm_shims();
-import { readFile as readFile11, writeFile as writeFile9, mkdir as mkdir11 } from "fs/promises";
-import { dirname as dirname10 } from "path";
+import { readFile as readFile12, writeFile as writeFile10, mkdir as mkdir12 } from "fs/promises";
+import { dirname as dirname11 } from "path";
 var DEFAULT_CHANNEL = "latest";
 var SEMVER_RE = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
 function parseChannel(raw) {
@@ -32575,7 +32838,7 @@ function parseChannel(raw) {
 }
 async function readChannel(slockHome) {
   try {
-    const raw = await readFile11(channelPath(slockHome), "utf8");
+    const raw = await readFile12(channelPath(slockHome), "utf8");
     const parsed = parseChannel(raw);
     if (parsed !== null) return parsed;
   } catch {
@@ -32584,8 +32847,8 @@ async function readChannel(slockHome) {
 }
 async function writeChannel(slockHome, channel2) {
   const p = channelPath(slockHome);
-  await mkdir11(dirname10(p), { recursive: true });
-  await writeFile9(p, `${channel2}
+  await mkdir12(dirname11(p), { recursive: true });
+  await writeFile10(p, `${channel2}
 `, { mode: 384 });
 }
 async function runChannelShow(slockHome) {
@@ -32608,20 +32871,20 @@ async function runChannelSet(slockHome, raw) {
 
 // src/upgradeCli.ts
 init_esm_shims();
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile15 } from "fs/promises";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname11, join as join7 } from "path";
+import { dirname as dirname12, join as join7 } from "path";
 
 // src/upgrade.ts
 init_esm_shims();
 import { spawn as spawn4 } from "child_process";
-import { mkdir as mkdir12, readFile as readFile13, writeFile as writeFile10, rm as rm3, rename as rename4 } from "fs/promises";
+import { mkdir as mkdir13, readFile as readFile14, writeFile as writeFile11, rm as rm3, rename as rename4 } from "fs/promises";
 import { join as join6 } from "path";
 import { createHash as createHash3 } from "crypto";
 
 // src/preflightDepDrift.ts
 init_esm_shims();
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 import { spawn as spawn3 } from "child_process";
 import { createRequire } from "module";
 import { join as join5 } from "path";
@@ -32630,12 +32893,10 @@ var DAEMON_PACKAGE_NAME = "@slock-ai/daemon";
 async function preflightDepDriftCheck(currentBinaryDir, stagedTarballPath, deps = {}) {
   const readTarball = deps.readTarballPackageJson ?? defaultReadTarballPackageJson;
   const readCurrent = deps.readCurrentPackageJson ?? defaultReadCurrentPackageJson;
-  const readInstalled = deps.readInstalledDaemonVersion ?? defaultReadInstalledDaemonVersion;
   const satisfies = deps.semverSatisfies ?? defaultSemverSatisfies;
   const allowUnsafe = deps.allowUnsafeSpec === true;
   let targetPkg;
   let currentPkg;
-  let installedVersion;
   try {
     targetPkg = await readTarball(stagedTarballPath);
   } catch (e) {
@@ -32654,15 +32915,6 @@ async function preflightDepDriftCheck(currentBinaryDir, stagedTarballPath, deps
       detail: `cannot read current binary package.json: ${errMsg(e)}`
     };
   }
-  try {
-    installedVersion = await readInstalled(currentBinaryDir);
-  } catch (e) {
-    return {
-      ok: false,
-      reason: "read_failed",
-      detail: `cannot read installed ${DAEMON_PACKAGE_NAME} version: ${errMsg(e)}`
-    };
-  }
   const targetSpec = targetPkg.dependencies?.[DAEMON_PACKAGE_NAME];
   const currentSpec = currentPkg.dependencies?.[DAEMON_PACKAGE_NAME];
   if (typeof targetSpec !== "string" || targetSpec.length === 0) {
@@ -32673,60 +32925,64 @@ async function preflightDepDriftCheck(currentBinaryDir, stagedTarballPath, deps
       currentSpec
     };
   }
-  if (typeof currentSpec !== "string" || currentSpec.length === 0) {
+  const unsafeTarget = isUnsafeSpec(targetSpec) || isUnparseableRange(targetSpec);
+  if (!allowUnsafe && unsafeTarget) {
     return {
       ok: false,
-      reason: "read_failed",
-      detail: `current binary package.json has no ${DAEMON_PACKAGE_NAME} dependency entry`,
+      reason: "unsafe_spec",
+      detail: `${DAEMON_PACKAGE_NAME} target spec is not a safe semver range (target="${targetSpec}"). Auto-upgrade only supports target semver ranges that can be hydrated and verified before swap.`,
+      currentSpec,
       targetSpec
     };
   }
-  if (installedVersion === null || installedVersion.length === 0) {
+  void satisfies;
+  return { ok: true, currentSpec, targetSpec };
+}
+async function verifyHydratedDaemonDependency(extractedPackageDir, targetSpec, deps = {}) {
+  const readInstalled = deps.readInstalledDaemonVersion ?? defaultReadInstalledDaemonVersion;
+  const satisfies = deps.semverSatisfies ?? defaultSemverSatisfies;
+  const allowUnsafe = deps.allowUnsafeSpec === true;
+  const unsafeTarget = isUnsafeSpec(targetSpec) || isUnparseableRange(targetSpec);
+  if (!allowUnsafe && unsafeTarget) {
     return {
       ok: false,
-      reason: "read_failed",
-      detail: `${DAEMON_PACKAGE_NAME} is not installed at the expected location next to the current binary`,
-      currentSpec,
+      reason: "unsafe_spec",
+      detail: `${DAEMON_PACKAGE_NAME} target spec is not a safe semver range (target="${targetSpec}").`,
       targetSpec
     };
   }
-  const unsafeCurrent = isUnsafeSpec(currentSpec) || isUnparseableRange(currentSpec);
-  const unsafeTarget = isUnsafeSpec(targetSpec) || isUnparseableRange(targetSpec);
-  const anyUnsafe = unsafeCurrent || unsafeTarget;
-  if (!allowUnsafe && anyUnsafe) {
+  let installedVersion;
+  try {
+    installedVersion = await readInstalled(extractedPackageDir);
+  } catch (e) {
     return {
       ok: false,
-      reason: "unsafe_spec",
-      detail: `${DAEMON_PACKAGE_NAME} spec is not a safe semver range (current="${currentSpec}", target="${targetSpec}"). v1 auto-upgrade only supports semver ranges; re-install manually with \`npm install -g @slock-ai/computer@<version>\`.`,
-      currentSpec,
-      targetSpec,
-      installedVersion
+      reason: "read_failed",
+      detail: `cannot read hydrated ${DAEMON_PACKAGE_NAME} version: ${errMsg(e)}`,
+      targetSpec
     };
   }
-  if (currentSpec !== targetSpec) {
+  if (installedVersion === null || installedVersion.length === 0) {
     return {
       ok: false,
-      reason: "spec_changed",
-      detail: `${DAEMON_PACKAGE_NAME} dependency spec changed from "${currentSpec}" to "${targetSpec}". Auto-upgrade only swaps the Computer package root; the runtime dependency tree is not refreshed. Run \`npm install -g @slock-ai/computer@<version>\` manually.`,
-      currentSpec,
-      targetSpec,
-      installedVersion
+      reason: "read_failed",
+      detail: `${DAEMON_PACKAGE_NAME} is not installed in the hydrated staged package`,
+      targetSpec
     };
   }
-  if (allowUnsafe && anyUnsafe) {
-    return { ok: true, currentSpec, targetSpec, installedVersion };
+  if (allowUnsafe && unsafeTarget) {
+    return { ok: true, targetSpec, installedVersion };
   }
   if (!satisfies(installedVersion, targetSpec)) {
     return {
       ok: false,
       reason: "installed_unsatisfied",
-      detail: `installed ${DAEMON_PACKAGE_NAME}@${installedVersion} does not satisfy target spec "${targetSpec}". Re-install with \`npm install -g @slock-ai/computer@<version>\`.`,
-      currentSpec,
+      detail: `hydrated ${DAEMON_PACKAGE_NAME}@${installedVersion} does not satisfy target spec "${targetSpec}".`,
       targetSpec,
       installedVersion
     };
   }
-  return { ok: true, currentSpec, targetSpec, installedVersion };
+  return { ok: true, targetSpec, installedVersion };
 }
 function isUnparseableRange(spec) {
   const s = spec.trim();
@@ -32792,7 +33048,7 @@ async function defaultReadTarballPackageJson(tarballPath) {
   return JSON.parse(raw);
 }
 async function defaultReadCurrentPackageJson(currentBinaryDir) {
-  const raw = await readFile12(join5(currentBinaryDir, "package.json"), "utf8");
+  const raw = await readFile13(join5(currentBinaryDir, "package.json"), "utf8");
   return JSON.parse(raw);
 }
 async function defaultReadInstalledDaemonVersion(currentBinaryDir) {
@@ -32809,7 +33065,7 @@ async function defaultReadInstalledDaemonVersion(currentBinaryDir) {
   for (const base of searchPaths) {
     const candidate = join5(base, ...subPath, "package.json");
     try {
-      const raw = await readFile12(candidate, "utf8");
+      const raw = await readFile13(candidate, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed.name !== DAEMON_PACKAGE_NAME) continue;
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
@@ -32889,9 +33145,9 @@ function satisfiesTilde(ver, base) {
 // src/upgrade.ts
 async function stagePhase(slockHome, version, deps = {}) {
   const npmPack = deps.npmPack ?? defaultNpmPack;
-  const fsReadFile = deps.fsReadFile ?? readFile13;
+  const fsReadFile = deps.fsReadFile ?? readFile14;
   const stagedPath = upgradeStagingDir(slockHome, version);
-  await mkdir12(stagedPath, { recursive: true });
+  await mkdir13(stagedPath, { recursive: true });
   const packageRef = `@slock-ai/computer@${version}`;
   const result = await npmPack(stagedPath, packageRef);
   if (result.exitCode !== 0) {
@@ -32999,8 +33255,8 @@ async function cleanupStaged(slockHome, version) {
 async function snapshotPhase(slockHome, snap) {
   const path3 = upgradeSnapshotPath(slockHome);
   const tmp = `${path3}.tmp`;
-  await mkdir12(computerDir(slockHome), { recursive: true });
-  await writeFile10(tmp, JSON.stringify(snap, null, 2), { mode: 384 });
+  await mkdir13(computerDir(slockHome), { recursive: true });
+  await writeFile11(tmp, JSON.stringify(snap, null, 2), { mode: 384 });
   await rename4(tmp, path3);
 }
 async function clearUpgradeSnapshot(slockHome) {
@@ -33012,7 +33268,7 @@ async function clearUpgradeSnapshot(slockHome) {
 }
 async function extractTarball(tarballPath, destDir, deps = {}) {
   const tarSpawn = deps.tarSpawn ?? defaultTarSpawn;
-  await mkdir12(destDir, { recursive: true });
+  await mkdir13(destDir, { recursive: true });
   const result = await tarSpawn(tarballPath, destDir);
   if (result.exitCode !== 0) {
     const err = new Error(
@@ -33271,7 +33527,7 @@ async function restartPhase(slockHome, deps = {}) {
 }
 async function defaultReadSupervisorPid(slockHome) {
   try {
-    const raw = (await readFile13(supervisorPidPath(slockHome), "utf8")).trim();
+    const raw = (await readFile14(supervisorPidPath(slockHome), "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -33390,6 +33646,18 @@ async function runUpgrade(slockHome, opts) {
       preflight
     };
   }
+  const targetDaemonSpec = preflight.targetSpec;
+  if (typeof targetDaemonSpec !== "string" || targetDaemonSpec.length === 0) {
+    await cleanupStaged(slockHome, opts.targetVersion);
+    return {
+      ok: false,
+      phase: "preflight",
+      reason: `${preflight.detail ?? preflight.reason ?? "dep_drift"}: missing target ${DAEMON_PACKAGE_NAME} spec`,
+      staged,
+      verify,
+      preflight
+    };
+  }
   const snap = {
     at: (/* @__PURE__ */ new Date()).toISOString(),
     fromVersion: opts.fromVersion,
@@ -33440,6 +33708,24 @@ async function runUpgrade(slockHome, opts) {
       verify
     };
   }
+  const hydratedDaemon = await verifyHydratedDaemonDependency(
+    extractedPackageDir,
+    targetDaemonSpec,
+    deps.preflight ?? {}
+  );
+  if (!hydratedDaemon.ok) {
+    await cleanupStaged(slockHome, opts.targetVersion);
+    await clearUpgradeSnapshot(slockHome);
+    return {
+      ok: false,
+      phase: "hydrate",
+      reason: `staged dependency tree verification failed: ${hydratedDaemon.detail ?? hydratedDaemon.reason ?? "hydrated dependency verification failed"}`,
+      staged,
+      verify,
+      preflight,
+      hydratedDaemon
+    };
+  }
   let swap;
   try {
     swap = await swapPhase(opts.currentBinaryDir, extractedPackageDir, {
@@ -33528,7 +33814,7 @@ async function runUpgrade(slockHome, opts) {
     };
   }
   await cleanupSuccessPhase(slockHome, opts.targetVersion, swap.prevBinaryDir);
-  return { ok: true, phase: "cleanup", staged, verify, swap, restart, rolling };
+  return { ok: true, phase: "cleanup", staged, verify, preflight, hydratedDaemon, swap, restart, rolling };
 }
 async function rollingDaemonHealthCheck(slockHome, deps = {}) {
   const list = deps.listManagedServerIds ?? listManagedServerIds;
@@ -33564,7 +33850,7 @@ async function rollingDaemonHealthCheck(slockHome, deps = {}) {
 }
 async function defaultReadDaemonPid(slockHome, serverId) {
   try {
-    const raw = (await readFile13(serverDaemonPidPath(slockHome, serverId), "utf8")).trim();
+    const raw = (await readFile14(serverDaemonPidPath(slockHome, serverId), "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -33592,7 +33878,7 @@ async function locateStagedTarball(stagedPath) {
 
 // src/upgradeLog.ts
 init_esm_shims();
-import { chmod as chmod5, mkdir as mkdir13, open as open2 } from "fs/promises";
+import { chmod as chmod5, mkdir as mkdir14, open as open2 } from "fs/promises";
 var FILE_MODE = 384;
 var UPGRADE_ERROR_CODES = [
   "UPGRADE_DEPS_CHANGED",
@@ -33637,7 +33923,7 @@ function assertUpgradeLogEntry(entry) {
 }
 async function appendUpgradeLogEntry(slockHome, entry) {
   assertUpgradeLogEntry(entry);
-  await mkdir13(computerDir(slockHome), { recursive: true });
+  await mkdir14(computerDir(slockHome), { recursive: true });
   const path3 = upgradeLogPath(slockHome);
   const at = entry.at ?? formatUpgradeLogTimestamp();
   const fullEntry = { ...entry, at };
@@ -33660,7 +33946,7 @@ function isEphemeralNpxContext(binaryDir) {
 async function readBundledDaemonVersion(binaryDir) {
   try {
     const pkgPath = join7(binaryDir, "package.json");
-    const raw = await readFile14(pkgPath, "utf8");
+    const raw = await readFile15(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     const pinned = parsed.dependencies?.["@slock-ai/daemon"];
     if (typeof pinned !== "string" || pinned.length === 0) return null;
@@ -33854,6 +34140,9 @@ function mapFailurePhaseToCode(outcome) {
     case "extract":
       return "UPGRADE_INTEGRITY_FAILED";
     case "hydrate":
+      if (outcome.hydratedDaemon?.ok === false) {
+        return "UPGRADE_INTEGRITY_FAILED";
+      }
       return "UPGRADE_NETWORK_FAILED";
     case "swap":
       return "UPGRADE_SWAP_FAILED";
@@ -33888,12 +34177,12 @@ async function defaultFetchDistTags() {
 }
 function defaultCurrentBinaryDir() {
   const here = fileURLToPath3(import.meta.url);
-  return dirname11(dirname11(here));
+  return dirname12(dirname12(here));
 }
 async function defaultCurrentVersion() {
   const pkgPath = join7(defaultCurrentBinaryDir(), "package.json");
   try {
-    const raw = await readFile14(pkgPath, "utf8");
+    const raw = await readFile15(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -33905,7 +34194,7 @@ async function defaultCurrentVersion() {
 
 // src/upgradeTestHarness.ts
 init_esm_shims();
-import { mkdir as mkdir14, readdir as readdir4, stat as stat3, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir15, readdir as readdir4, stat as stat3, writeFile as writeFile12 } from "fs/promises";
 import { join as join8 } from "path";
 import { createHash as createHash4 } from "crypto";
 var PHASES = /* @__PURE__ */ new Set([
@@ -33964,7 +34253,7 @@ function buildSimulatedDeps(slockHome, opts) {
             return { tarballPath: "", exitCode: 1, stderr: "simulated stage failure" };
           }
           const filename = `slock-ai-computer-${targetVersion}.tgz`;
-          await writeFile11(join8(cwd, filename), tarballBytes);
+          await writeFile12(join8(cwd, filename), tarballBytes);
           return { tarballPath: join8(cwd, filename), exitCode: 0, stderr: "" };
         },
         fetchAdvertisedHash: async () => {
@@ -33976,8 +34265,8 @@ function buildSimulatedDeps(slockHome, opts) {
           if (opts.simulateFail === "extract") {
             return { exitCode: 1, stderr: "simulated extract failure" };
           }
-          await mkdir14(join8(destDir, "package"), { recursive: true });
-          await writeFile11(join8(destDir, "package", "marker.txt"), `NEW@${targetVersion}`);
+          await mkdir15(join8(destDir, "package"), { recursive: true });
+          await writeFile12(join8(destDir, "package", "marker.txt"), `NEW@${targetVersion}`);
           return { exitCode: 0, stderr: "" };
         },
         npmInstall: async () => ({ exitCode: 0, stderr: "" }),
@@ -34038,7 +34327,7 @@ function buildSimulatedDeps(slockHome, opts) {
 }
 async function arrangeSnapshotFailure(slockHome) {
   const snapshotPath = join8(slockHome, "computer", "upgrade-snapshot.json");
-  await mkdir14(snapshotPath, { recursive: true });
+  await mkdir15(snapshotPath, { recursive: true });
 }
 async function pathInfo(path3) {
   try {
@@ -34093,12 +34382,12 @@ async function runUpgradeTestHarness(slockHome, opts, writer = (s) => process.st
     process.exitCode = 1;
     return;
   }
-  await mkdir14(slockHome, { recursive: true });
+  await mkdir15(slockHome, { recursive: true });
   if (opts.simulateFail === "snapshot") {
     await arrangeSnapshotFailure(slockHome);
   }
   const { opts: upgradeOpts } = buildSimulatedDeps(slockHome, opts);
-  await mkdir14(upgradeOpts.currentBinaryDir, { recursive: true });
+  await mkdir15(upgradeOpts.currentBinaryDir, { recursive: true });
   let outcome;
   try {
     outcome = await runUpgrade(slockHome, upgradeOpts);
@@ -34136,9 +34425,9 @@ async function runUpgradeTestHarness(slockHome, opts, writer = (s) => process.st
 
 // src/upgradeInstallSmoke.ts
 init_esm_shims();
-import { copyFile, mkdir as mkdir15, readFile as readFile15 } from "fs/promises";
+import { copyFile, mkdir as mkdir16, readFile as readFile16 } from "fs/promises";
 import { createHash as createHash5 } from "crypto";
-import { dirname as dirname12, isAbsolute, join as join9, resolve as pathResolve } from "path";
+import { dirname as dirname13, isAbsolute, join as join9, resolve as pathResolve } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   if (typeof opts.packageTarball !== "string" || opts.packageTarball.trim().length === 0) {
@@ -34147,7 +34436,7 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   const tarballPath = isAbsolute(opts.packageTarball) ? opts.packageTarball : pathResolve(opts.packageTarball);
   let tarballBytes;
   try {
-    tarballBytes = await readFile15(tarballPath);
+    tarballBytes = await readFile16(tarballPath);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     throw new Error(`__upgrade-install-smoke: cannot read --package-tarball ${tarballPath}: ${msg}`);
@@ -34159,7 +34448,7 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   const spawnFreshSupervisor = deps.spawnFreshSupervisor ?? (async (h) => {
     await spawnDetachedSupervisor(h);
   });
-  await mkdir15(slockHome, { recursive: true });
+  await mkdir16(slockHome, { recursive: true });
   const outcome = await runUpgrade(slockHome, {
     targetVersion: opts.targetVersion,
     fromVersion,
@@ -34217,12 +34506,12 @@ async function runUpgradeInstallSmokeCli(slockHome, opts, writer = (s) => proces
 }
 function defaultCurrentBinaryDirLocal() {
   const here = fileURLToPath4(import.meta.url);
-  return dirname12(dirname12(here));
+  return dirname13(dirname13(here));
 }
 async function defaultCurrentVersionLocal() {
   const pkgPath = join9(defaultCurrentBinaryDirLocal(), "package.json");
   try {
-    const raw = await readFile15(pkgPath, "utf8");
+    const raw = await readFile16(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -34272,17 +34561,13 @@ program2.command("attach").argument("<serverSlug>", "target Slock server slug (c
     () => runAttach({ serverSlug, serverUrl: opts.serverUrl, name: opts.name, run: opts.run, foreground: opts.foreground })
   );
 }));
-program2.command("setup").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Set up this Computer for one server: login if needed, attach/adopt if needed, then start.").option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "Computer display name for a new attachment/adoption; defaults to a sanitized hostname").option("--adopt-legacy", "attempt one-time migration from a legacy daemon before fresh attach fallback").option("--legacy-api-key <key>", "legacy key for --adopt-legacy (migration-only; prefer file/stdin)").option("--legacy-api-key-file <path>", "path to a file containing the legacy key for --adopt-legacy").option("--legacy-api-key-stdin", "read the legacy key from stdin for --adopt-legacy").option("--no-start", "stop after login + attach/adopt; do not start the supervisor").option("--foreground", "run the supervisor in this terminal instead of the background").option("-y, --yes", "allow non-interactive setup after confirming the planned actions").action(
+program2.command("setup").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Set up this Computer for one server: login if needed, attach (or \xA7X.1 migrate-prompt) if needed, then start.").option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "Computer display name for a new attachment; defaults to a sanitized hostname").option("--no-start", "stop after login + attach; do not start the supervisor").option("--foreground", "run the supervisor in this terminal instead of the background").option("-y, --yes", "allow non-interactive setup after confirming the planned actions").action(
   withCliExit(async (serverSlug, opts) => {
     await withMutationLock(
       () => runSetup({
         serverSlug,
         serverUrl: opts.serverUrl,
         name: opts.name,
-        adoptLegacy: opts.adoptLegacy,
-        legacyApiKey: opts.legacyApiKey,
-        legacyApiKeyFile: opts.legacyApiKeyFile,
-        legacyApiKeyStdin: opts.legacyApiKeyStdin,
         start: opts.start,
         foreground: opts.foreground,
         yes: opts.yes
@@ -34290,22 +34575,6 @@ program2.command("setup").argument("<serverSlug>", "target Slock server slug (ca
     );
   })
 );
-program2.command("adopt-legacy").argument("<serverSlug>", "target Slock server slug (the legacy machine's server)").description(
-  "One-time migration: trade a legacy sk_machine_* / sk_daemon_* key for a fresh Computer attachment (sk_computer_*)."
-).option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "name to record on the new Computer attachment (default: existing machine name)").option("--legacy-api-key <key>", "raw legacy key on argv (insecure on shared shells; prefer --legacy-api-key-file or stdin)").option("--legacy-api-key-file <path>", "path to a 0600 file containing the legacy key (one line)").option("--legacy-api-key-stdin", "read the legacy key from stdin").action(
-  withCliExit(async (serverSlug, opts) => {
-    await withMutationLock(
-      () => runAdoptLegacy({
-        serverSlug,
-        serverUrl: opts.serverUrl,
-        name: opts.name,
-        legacyApiKey: opts.legacyApiKey,
-        legacyApiKeyFile: opts.legacyApiKeyFile,
-        legacyApiKeyStdin: opts.legacyApiKeyStdin
-      })
-    );
-  })
-);
 program2.command("detach").argument("<serverSlug>", "server slug to detach from this Computer (canonical form `/myserver`)").description("Remove ONE server's local attachment; never touches user-session or other servers.").action(withCliExit(async (serverSlug) => {
   await withMutationLock(async () => runDetach(await resolveTargetServerId({ server: serverSlug }), serverSlug));
 }));
@@ -34339,6 +34608,18 @@ program2.command("doctor").argument("[serverSlug]", "optional: scope detail (rec
     }
   )
 );
+program2.command("reset").description("Clear a degraded state and resume the supervisor's auto-restart loop.").option("--service", "clear the service-level crash history (cascade record)").option("--runner", "clear a runner's crash history (selected by `--server`)").option("--server <slug>", "with `--runner`, select target server slug (required when \u22652 attached)").option("--json", "emit the machine-readable result").action(
+  withCliExit(async (opts) => {
+    await withMutationLock(
+      () => runReset({
+        service: opts.service,
+        runner: opts.runner,
+        server: opts.server,
+        json: opts.json
+      })
+    );
+  })
+);
 program2.command("logs").description("Tail one server's daemon log (or the supervisor log); secrets redacted.").option("--lines <n>", "trailing lines to show (default 200)", (v) => Number.parseInt(v, 10)).option("--server <slug>", "select target server slug (required when \u22652 attached)").option("--supervisor", "tail the global supervisor log instead of a per-server daemon log").action(withCliExit(async (opts) => {
   await runLogs({ lines: opts.lines, server: opts.server ?? null, supervisor: !!opts.supervisor });
 }));
@@ -34364,9 +34645,8 @@ program2.command("upgrade").description(
   [
     "Auto-upgrade this Computer to the latest version in its channel (or --target-version <semver>).",
     "",
-    "v1 swaps the @slock-ai/computer package root only. Releases that change runtime",
-    "dependency requirements (e.g. @slock-ai/daemon version range) fail closed with",
-    "UPGRADE_DEPS_CHANGED and require manual `npm install -g @slock-ai/computer@<version>`."
+    "Stages the target package, hydrates production dependencies, verifies the",
+    "hydrated @slock-ai/daemon version, then swaps the Computer package root."
   ].join("\n")
 ).option("--dry-run", "stage + verify only; do not swap or restart").option("--channel <name>", "override channel for this invocation (latest | alpha | pinned:<semver>)").option("--target-version <semver>", "override target version explicitly (bypasses channel resolution)").option("--drain <mode>", "\xA72.7 drain mode: drain (default) | defer (abort if daemon busy) | force (SIGKILL, drop in-flight)").option("--force", "alias for --drain force (stuck-daemon recovery; drops in-flight turns)").action(
   withCliExit(
@@ -34459,21 +34739,6 @@ program2.command("__upgrade-install-smoke", { hidden: true }).requiredOption("--
     );
   })
 );
-{
-  const argv = process.argv.slice(2);
-  const isAdopt = argv[0] === "adopt-legacy";
-  const isSetup = argv[0] === "setup";
-  const strayLegacyFlag = argv.find(
-    (a) => a === "--legacy-api-key" || a.startsWith("--legacy-api-key=") || a === "--legacy-api-key-file" || a.startsWith("--legacy-api-key-file=") || a === "--legacy-api-key-stdin"
-  );
-  if (strayLegacyFlag && !isAdopt && !isSetup) {
-    process.stderr.write(
-      `slock-computer: LEGACY_KEY_OUTSIDE_ADOPT: ${strayLegacyFlag} is only accepted by \`slock-computer adopt-legacy\` or \`slock-computer setup --adopt-legacy\`. Remove it or run an adopt flow.
-`
-    );
-    process.exit(2);
-  }
-}
 program2.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`slock-computer: ${err instanceof Error ? err.message : String(err)}
 `);