@slock-ai/computer 0.0.14 → 0.0.16-alpha.0

package/dist/index.js

@@ -16617,8 +16617,8 @@ var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@7.24.8/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var { writeFile: writeFile12, readFile: readFile16, mkdir: mkdir16 } = __require("fs/promises");
-    var { dirname: dirname13, resolve } = __require("path");
+    var { writeFile: writeFile13, readFile: readFile17, mkdir: mkdir17 } = __require("fs/promises");
+    var { dirname: dirname14, resolve } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError: InvalidArgumentError2, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -16819,7 +16819,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile16(resolve(path3), "utf8");
+          const data = await readFile17(resolve(path3), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -16849,12 +16849,12 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         const resolvedPath = resolve(path3);
-        await mkdir16(dirname13(resolvedPath), { recursive: true });
+        await mkdir17(dirname14(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
         }));
-        await writeFile12(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile13(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -28469,8 +28469,8 @@ var require_graceful_fs = __commonJS({
       fs2.createReadStream = createReadStream;
       fs2.createWriteStream = createWriteStream;
       var fs$readFile = fs2.readFile;
-      fs2.readFile = readFile16;
-      function readFile16(path3, options, cb) {
+      fs2.readFile = readFile17;
+      function readFile17(path3, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path3, options, cb);
@@ -28486,8 +28486,8 @@ var require_graceful_fs = __commonJS({
         }
       }
       var fs$writeFile = fs2.writeFile;
-      fs2.writeFile = writeFile12;
-      function writeFile12(path3, data, options, cb) {
+      fs2.writeFile = writeFile13;
+      function writeFile13(path3, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$writeFile(path3, data, options, cb);
@@ -28504,8 +28504,8 @@ var require_graceful_fs = __commonJS({
       }
       var fs$appendFile = fs2.appendFile;
       if (fs$appendFile)
-        fs2.appendFile = appendFile2;
-      function appendFile2(path3, data, options, cb) {
+        fs2.appendFile = appendFile4;
+      function appendFile4(path3, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$appendFile(path3, data, options, cb);
@@ -29737,7 +29737,7 @@ var ComputerAttachClient = class {
    * over the machine. On success the server marks the machine row migrated
    * and mints a fresh `sk_computer_*`. The raw legacy key MUST NOT be
    * persisted by the caller — only the freshly-minted sk_computer_* lands
-   * in attachment.json.
+   * in runner.state.json.
    */
   async adoptLegacy(legacyApiKey, name) {
     const res = await (0, import_undici.fetch)(this.url("/api/computer/adopt-legacy"), {
@@ -29877,7 +29877,7 @@ function serverDir(slockHome, serverId) {
   return path2.join(serversDir(slockHome), assertValidServerId(serverId));
 }
 function serverAttachmentPath(slockHome, serverId) {
-  return path2.join(serverDir(slockHome, serverId), "attachment.json");
+  return path2.join(serverDir(slockHome, serverId), "runner.state.json");
 }
 function serverDaemonPidPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "daemon.pid");
@@ -29891,14 +29891,20 @@ function serverManagedFlagPath(slockHome, serverId) {
 function serverHealthPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "health.json");
 }
-function supervisorPidPath(slockHome) {
+function serviceStatePath(slockHome) {
+  return path2.join(computerDir(slockHome), "service.state.json");
+}
+function servicePidPath(slockHome) {
+  return path2.join(computerDir(slockHome), "service.pid");
+}
+function legacySupervisorPidPath(slockHome) {
   return path2.join(computerDir(slockHome), "supervisor.pid");
 }
-function supervisorLogPath(slockHome) {
-  return path2.join(computerDir(slockHome), "supervisor.log");
+function serviceLogPath(slockHome) {
+  return path2.join(computerDir(slockHome), "service.log");
 }
-function supervisorVersionPath(slockHome) {
-  return path2.join(computerDir(slockHome), "supervisor-version.json");
+function serviceVersionPath(slockHome) {
+  return path2.join(computerDir(slockHome), "service-version.json");
 }
 var HOSTNAME_SUFFIXES = [
   ".fritz.box",
@@ -30376,15 +30382,78 @@ async function runAttach(opts) {
   }
 }
 
-// src/adopt.ts
+// src/setup.ts
 init_esm_shims();
-import { readFile as readFile4 } from "fs/promises";
+var import_undici3 = __toESM(require_undici(), 1);
+import { chmod as chmod4, mkdir as mkdir9, readFile as readFile8, rename as rename3, rm as rm2, writeFile as writeFile8 } from "fs/promises";
+import { dirname as dirname9 } from "path";
+
+// src/lib/migration.ts
+init_esm_shims();
+import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
+import { join } from "path";
+var MACHINE_DIR_PREFIX = "machine-";
+async function readOwnerEvidence(installRoot, machineDirName) {
+  const ownerFile = join(
+    installRoot,
+    "machines",
+    machineDirName,
+    "daemon.lock",
+    "owner.json"
+  );
+  let raw;
+  try {
+    raw = await readFile3(ownerFile, "utf8");
+  } catch {
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  const machineName = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : void 0;
+  const serverUrl = typeof parsed.serverUrl === "string" && parsed.serverUrl.length > 0 ? parsed.serverUrl : void 0;
+  return { machineName, serverUrl };
+}
+async function detectLegacyMigration(installRoot, loggedInUserId) {
+  void loggedInUserId;
+  const machinesDir = join(installRoot, "machines");
+  let entries;
+  try {
+    entries = await readdir2(machinesDir);
+  } catch {
+    return { kind: "no-match" };
+  }
+  const candidates = [];
+  for (const name of entries) {
+    if (!name.startsWith(MACHINE_DIR_PREFIX)) continue;
+    const evidence = await readOwnerEvidence(installRoot, name);
+    candidates.push({
+      machineId: name,
+      machineName: evidence.machineName,
+      serverUrl: evidence.serverUrl
+    });
+  }
+  if (candidates.length === 0) return { kind: "no-match" };
+  if (candidates.length === 1) {
+    const only = candidates[0];
+    return {
+      kind: "match",
+      machineId: only.machineId,
+      machineName: only.machineName,
+      serverUrl: only.serverUrl
+    };
+  }
+  return { kind: "ambiguous", candidates };
+}
 
 // src/services/adoptLegacy.ts
 init_esm_shims();
-import { chmod as chmod3, mkdir as mkdir4, readFile as readFile3, writeFile as writeFile4, appendFile, stat } from "fs/promises";
+import { chmod as chmod3, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4, appendFile, stat } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
-import { dirname as dirname4, join } from "path";
+import { dirname as dirname4, join as join2 } from "path";
 import { setTimeout as delay } from "timers/promises";
 function emit3(opts, event) {
   const cb = opts?.onEvent;
@@ -30398,7 +30467,7 @@ var LEGACY_STOP_WAIT_MS = 1e4;
 var LEGACY_STOP_POLL_MS = 200;
 function legacyLockOwnerPath(slockHome, rawKey) {
   const fingerprint = createHash2("sha256").update(rawKey).digest("hex").slice(0, 16);
-  return join(slockHome, "machines", `machine-${fingerprint}`, "daemon.lock", "owner.json");
+  return join2(slockHome, "machines", `machine-${fingerprint}`, "daemon.lock", "owner.json");
 }
 function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -30413,7 +30482,7 @@ function isProcessAlive(pid) {
 async function stopLegacyDaemonByOwnerFile(ownerFile) {
   let raw;
   try {
-    raw = await readFile3(ownerFile, "utf8");
+    raw = await readFile4(ownerFile, "utf8");
   } catch {
     return { attempted: false, outcome: "absent" };
   }
@@ -30447,7 +30516,7 @@ async function stopLegacyDaemonByOwnerFile(ownerFile) {
 async function readLegacyOwnerEvidence(ownerFile) {
   let raw;
   try {
-    raw = await readFile3(ownerFile, "utf8");
+    raw = await readFile4(ownerFile, "utf8");
   } catch {
     return { ownerFile, reason: "owner_file_absent" };
   }
@@ -30487,7 +30556,7 @@ async function adoptLegacy(input, options = {}) {
   const sessionFile = userSessionPath(slockHome);
   let session;
   try {
-    session = JSON.parse(await readFile3(sessionFile, "utf8"));
+    session = JSON.parse(await readFile4(sessionFile, "utf8"));
   } catch (err) {
     throw new ComputerServiceError(
       "NO_USER_SESSION",
@@ -30733,134 +30802,18 @@ async function appendAdoptionLog(slockHome, line) {
   }
 }
 
-// src/adopt.ts
-async function resolveLegacyKey(inputs, env) {
-  const sources = [];
-  if (typeof inputs.legacyApiKey === "string" && inputs.legacyApiKey.length > 0) {
-    sources.push({
-      mode: "legacy_key_argv",
-      load: async () => inputs.legacyApiKey.trim()
-    });
-  }
-  if (typeof inputs.legacyApiKeyFile === "string" && inputs.legacyApiKeyFile.length > 0) {
-    sources.push({
-      mode: "legacy_key_file",
-      load: async () => {
-        const contents = await readFile4(inputs.legacyApiKeyFile, "utf8");
-        return contents.trim();
-      }
-    });
-  }
-  if (inputs.legacyApiKeyStdin) {
-    sources.push({
-      mode: "legacy_key_stdin",
-      load: async () => readAllStdin()
-    });
-  }
-  const envKey = env.SLOCK_LEGACY_API_KEY;
-  if (typeof envKey === "string" && envKey.trim().length > 0) {
-    sources.push({
-      mode: "legacy_key_env",
-      load: async () => envKey.trim()
-    });
-  }
-  if (sources.length === 0) {
-    fail(
-      "LEGACY_KEY_REQUIRED",
-      "No legacy api key provided. Pass exactly one of: --legacy-api-key <key>, --legacy-api-key-file <path>, --legacy-api-key-stdin, or SLOCK_LEGACY_API_KEY."
-    );
-  }
-  if (sources.length > 1) {
-    const modes = sources.map((s) => s.mode).join(", ");
-    fail(
-      "LEGACY_KEY_MULTIPLE_SOURCES",
-      `Multiple legacy api key sources provided (${modes}). Choose exactly one.`
-    );
-  }
-  const chosen = sources[0];
-  const rawKey = await chosen.load();
-  if (chosen.mode === "legacy_key_env") {
-    delete env.SLOCK_LEGACY_API_KEY;
-  }
-  if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
-    fail(
-      "LEGACY_KEY_INVALID",
-      "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
-    );
-  }
-  return {
-    rawKey,
-    mode: chosen.mode,
-    redactedPrefix: rawKey.slice(0, 8)
-  };
-}
-async function readAllStdin() {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8").trim()));
-    process.stdin.on("error", reject);
-  });
-}
-async function runAdoptLegacy(inputs) {
-  const legacy = await resolveLegacyKey(inputs, process.env);
-  try {
-    await adoptLegacy(
-      {
-        serverSlug: inputs.serverSlug,
-        serverUrl: inputs.serverUrl,
-        name: inputs.name,
-        rawKey: legacy.rawKey,
-        mode: legacy.mode,
-        redactedPrefix: legacy.redactedPrefix
-      },
-      {
-        onEvent: (event) => {
-          if (event.type === "adopting") {
-            info(
-              `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
-            );
-          } else if (event.type === "preflight") {
-            info(event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026");
-          } else if (event.type === "adopted") {
-            info(`Adopted. Computer state written to ${event.attachmentPath}`);
-            info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
-            info(`  serverMachine: ${event.serverMachineId}`);
-            info(`  legacyMachine: ${event.legacyMachineId}`);
-            switch (event.legacyStop.outcome) {
-              case "absent":
-                info("  legacy daemon: not detected on this Computer (no local lock file)");
-                break;
-              case "already_dead":
-                info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
-                break;
-              case "stopped":
-                info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
-                break;
-            }
-          }
-        }
-      }
-    );
-  } catch (err) {
-    if (err instanceof CliExit) throw err;
-    if (err instanceof ComputerServiceError) {
-      fail(err.code, err.message);
-    }
-    throw err;
-  } finally {
-    legacy.rawKey = void 0;
-  }
-  if (!inputs.orchestrated) {
-    info(`Next: run \`slock-computer start\` to bring this server online under the Computer supervisor.`);
-  }
-}
+// src/service.ts
+init_esm_shims();
+import { spawn as spawn2 } from "child_process";
+import { mkdir as mkdir8, readFile as readFile7, writeFile as writeFile7, open, rename as rename2 } from "fs/promises";
+import { dirname as dirname8, join as joinPath } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
-// src/setup.ts
+// src/cleanup.ts
 init_esm_shims();
-var import_undici3 = __toESM(require_undici(), 1);
-import { chmod as chmod4, mkdir as mkdir9, readdir as readdir3, readFile as readFile8, rename as rename3, rm as rm2, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname9, join as join3 } from "path";
+import { readdir as readdir3, stat as stat2, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
+import { spawn } from "child_process";
+import { join as join3 } from "path";
 
 // src/internal/process-primitives.ts
 init_esm_shims();
@@ -30895,18 +30848,7 @@ async function clearPidfileAt(pidfilePath) {
   }
 }
 
-// src/supervisor.ts
-init_esm_shims();
-import { spawn as spawn2 } from "child_process";
-import { mkdir as mkdir8, readFile as readFile7, writeFile as writeFile7, open, rename as rename2 } from "fs/promises";
-import { dirname as dirname8, join as joinPath } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-
 // src/cleanup.ts
-init_esm_shims();
-import { readdir as readdir2, stat as stat2, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
-import { spawn } from "child_process";
-import { join as join2 } from "path";
 function emptyCleanupReport() {
   return {
     stalePidfiles: [],
@@ -30930,8 +30872,8 @@ async function cleanupStalePidfile(pidfilePath) {
 }
 async function cleanupAllStalePidfiles(slockHome) {
   const cleaned = [];
-  if (await cleanupStalePidfile(supervisorPidPath(slockHome))) {
-    cleaned.push(supervisorPidPath(slockHome));
+  if (await cleanupStalePidfile(servicePidPath(slockHome))) {
+    cleaned.push(servicePidPath(slockHome));
   }
   const attached = await listAttachedServerIds(slockHome);
   for (const sid of attached) {
@@ -30980,7 +30922,7 @@ async function cleanupOrphanProcesses(slockHome, psSpawn) {
   const managed = new Set(await listManagedServerIds(slockHome));
   const signaled = [];
   const knownPids = /* @__PURE__ */ new Set();
-  const supPid = await readPidfileAt(supervisorPidPath(slockHome));
+  const supPid = await readPidfileAt(servicePidPath(slockHome));
   if (supPid !== null) knownPids.add(supPid);
   for (const sid of managed) {
     const pid = await readPidfileAt(serverDaemonPidPath(slockHome, sid));
@@ -31001,12 +30943,12 @@ async function cleanupOrphanProcesses(slockHome, psSpawn) {
   return signaled;
 }
 function quarantineDir(slockHome) {
-  return join2(computerDir(slockHome), ".quarantine");
+  return join3(computerDir(slockHome), ".quarantine");
 }
 async function quarantineServerSubtree(slockHome, serverId) {
-  const src = join2(serversDir(slockHome), serverId);
+  const src = join3(serversDir(slockHome), serverId);
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dest = join2(quarantineDir(slockHome), `${stamp}-${serverId}`);
+  const dest = join3(quarantineDir(slockHome), `${stamp}-${serverId}`);
   await mkdir6(dirname6(dest), { recursive: true });
   await rename(src, dest);
   return dest;
@@ -31018,7 +30960,7 @@ function dirname6(p) {
 async function cleanupPowerLossPartialState(slockHome) {
   let entries;
   try {
-    entries = await readdir2(serversDir(slockHome));
+    entries = await readdir3(serversDir(slockHome));
   } catch {
     return [];
   }
@@ -31045,11 +30987,11 @@ var TMP_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 async function cleanupTmpFiles(slockHome) {
   const removed = [];
   const cdir = computerDir(slockHome);
-  const stagingDir = join2(cdir, "upgrade-staging");
+  const stagingDir = join3(cdir, "upgrade-staging");
   try {
-    const versions = await readdir2(stagingDir);
+    const versions = await readdir3(stagingDir);
     for (const v of versions) {
-      const vdir = join2(stagingDir, v);
+      const vdir = join3(stagingDir, v);
       try {
         const s = await stat2(vdir);
         if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
@@ -31060,13 +31002,13 @@ async function cleanupTmpFiles(slockHome) {
       }
     }
     try {
-      const remaining = await readdir2(stagingDir);
+      const remaining = await readdir3(stagingDir);
       if (remaining.length === 0) await rmdir(stagingDir);
     } catch {
     }
   } catch {
   }
-  const snap = join2(cdir, "upgrade-snapshot.json");
+  const snap = join3(cdir, "upgrade-snapshot.json");
   try {
     const s = await stat2(snap);
     if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
@@ -31078,7 +31020,7 @@ async function cleanupTmpFiles(slockHome) {
   return removed;
 }
 async function cleanupStaleLock(slockHome) {
-  const lockDir = join2(computerDir(slockHome), ".lock");
+  const lockDir = join3(computerDir(slockHome), ".lock");
   try {
     const s = await stat2(lockDir);
     if (Date.now() - s.mtimeMs > 60 * 1e3) {
@@ -31090,7 +31032,7 @@ async function cleanupStaleLock(slockHome) {
   return [];
 }
 async function forceReleaseLock(slockHome) {
-  const lockDir = join2(computerDir(slockHome), ".lock");
+  const lockDir = join3(computerDir(slockHome), ".lock");
   try {
     await stat2(lockDir);
     await rm(lockDir, { recursive: true, force: true });
@@ -31114,7 +31056,7 @@ async function runFullCleanup(slockHome, options = {}) {
 
 // src/health.ts
 init_esm_shims();
-import { readFile as readFile6, writeFile as writeFile6, unlink as unlink4, mkdir as mkdir7 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile6, unlink as unlink4, mkdir as mkdir7, appendFile as appendFile2 } from "fs/promises";
 import { dirname as dirname7 } from "path";
 var CRASH_WINDOW_MS = 6e4;
 var DEGRADED_THRESHOLD = 3;
@@ -31186,6 +31128,43 @@ async function resetHealth(slockHome, serverId) {
   } catch {
   }
 }
+async function resetRunnerHealth(slockHome, serverId, nowMs = Date.now()) {
+  if (!isValidServerId(serverId)) {
+    return { status: "not-found" };
+  }
+  const wasDegraded = await isDegraded(slockHome, serverId, nowMs);
+  const recent = await readCrashHistory(slockHome, serverId, nowMs);
+  const previousState = wasDegraded ? "degraded" : "running";
+  await resetHealth(slockHome, serverId);
+  await emitRunnerStateTransition(
+    slockHome,
+    serverId,
+    previousState,
+    "running",
+    "reset-runner"
+  );
+  return {
+    status: "ok",
+    previousState,
+    clearedCrashCount: recent.length
+  };
+}
+async function emitRunnerStateTransition(slockHome, serverId, fromState, toState, trigger) {
+  const entry = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    kind: "runner-state-changed",
+    serverId,
+    fromState,
+    toState,
+    trigger
+  };
+  try {
+    const path3 = serviceLogPath(slockHome);
+    await mkdir7(dirname7(path3), { recursive: true });
+    await appendFile2(path3, JSON.stringify(entry) + "\n");
+  } catch {
+  }
+}
 
 // src/services/start.ts
 init_esm_shims();
@@ -31223,7 +31202,7 @@ async function waitForManagedDaemonPids(slockHome, serverIds, opts) {
 function buildTimeoutMessage(slockHome, serverIds, ready, input) {
   const missing = serverIds.filter((id) => !ready.has(id));
   const target = input.serverId && missing.length === 1 ? `${input.serverLabel ?? input.serverId}` : `${missing.length} daemon(s): ${missing.join(", ")}`;
-  return `Timed out waiting for ${target} to start. Run \`slock-computer status\` and inspect ${supervisorLogPath(slockHome)} plus per-server daemon logs under ~/.slock/computer/servers/<serverId>/daemon.log.`;
+  return `Timed out waiting for ${target} to start. Run \`slock-computer status\` and inspect ${serviceLogPath(slockHome)} plus per-server daemon logs under ~/.slock/computer/servers/<serverId>/daemon.log.`;
 }
 async function start(input, options = {}) {
   options.signal?.throwIfAborted?.();
@@ -31251,11 +31230,11 @@ async function start(input, options = {}) {
   for (const id of managedTargets) {
     await setServerManaged(slockHome, id);
   }
-  const existing = await readPidfileAt(supervisorPidPath(slockHome));
+  const existing = await readPidfileAt(servicePidPath(slockHome));
   if (existing && isProcessAlive2(existing)) {
     emit4(options, {
       type: "already_running",
-      supervisorPid: existing,
+      servicePid: existing,
       managedTargets,
       attachedCount: attached.length
     });
@@ -31272,8 +31251,8 @@ async function start(input, options = {}) {
       managedTargets,
       attachedCount: attached.length,
       ready: ready2,
-      supervisorPid: existing,
-      supervisorLogPath: supervisorLogPath(slockHome)
+      servicePid: existing,
+      serviceLogPath: serviceLogPath(slockHome)
     };
   }
   if (input.foreground) {
@@ -31282,41 +31261,48 @@ async function start(input, options = {}) {
       managedTargets,
       attachedCount: attached.length
     });
-    const supervise = options.runSupervise ?? runSupervise;
-    await supervise();
+    const service = options.runService ?? runService;
+    const previousParentLockMarker = process.env[PARENT_LOCK_HELD_ENV_VAR];
+    process.env[PARENT_LOCK_HELD_ENV_VAR] = "1";
+    try {
+      await service();
+    } finally {
+      if (previousParentLockMarker === void 0) delete process.env[PARENT_LOCK_HELD_ENV_VAR];
+      else process.env[PARENT_LOCK_HELD_ENV_VAR] = previousParentLockMarker;
+    }
     return {
       status: "running",
       managedTargets,
       attachedCount: attached.length,
       ready: /* @__PURE__ */ new Map(),
-      supervisorPid: null,
-      supervisorLogPath: supervisorLogPath(slockHome)
+      servicePid: null,
+      serviceLogPath: serviceLogPath(slockHome)
     };
   }
   options.signal?.throwIfAborted?.();
   let pid;
   try {
-    pid = await (options.spawnDetachedSupervisor ?? spawnDetachedSupervisor)(slockHome);
+    pid = await (options.spawnDetachedService ?? spawnDetachedService)(slockHome);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new ComputerServiceError("SUPERVISOR_SPAWN_FAILED", msg, err);
   }
   emit4(options, {
     type: "spawned",
-    supervisorPid: pid,
+    servicePid: pid,
     managedTargets,
     attachedCount: attached.length
   });
   if (options.signal?.aborted) {
     const ready2 = await pollReadyOnce(slockHome, managedTargets, options);
-    emit4(options, { type: "aborted", supervisorPid: pid, managedTargets, ready: ready2 });
+    emit4(options, { type: "aborted", servicePid: pid, managedTargets, ready: ready2 });
     return {
       status: "aborted",
       managedTargets,
       attachedCount: attached.length,
       ready: ready2,
-      supervisorPid: pid,
-      supervisorLogPath: supervisorLogPath(slockHome)
+      servicePid: pid,
+      serviceLogPath: serviceLogPath(slockHome)
     };
   }
   const ready = await waitForManagedDaemonPids(slockHome, managedTargets, options);
@@ -31332,8 +31318,8 @@ async function start(input, options = {}) {
     managedTargets,
     attachedCount: attached.length,
     ready,
-    supervisorPid: pid,
-    supervisorLogPath: supervisorLogPath(slockHome)
+    servicePid: pid,
+    serviceLogPath: serviceLogPath(slockHome)
   };
 }
 async function pollReadyOnce(slockHome, serverIds, opts) {
@@ -31365,14 +31351,22 @@ async function stop(input = {}, options = {}) {
   const slockHome = resolveSlockHome();
   const readPidfile = options.readPidfile ?? readPidfileAt;
   const isAlive = options.isProcessAlive ?? isProcessAlive2;
-  const killer = options.killSupervisor ?? ((pid2) => {
+  const killer = options.killService ?? ((pid2) => {
     process.kill(pid2, "SIGTERM");
   });
   const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const pollIntervalMs = options.pollIntervalMs ?? STOP_POLL_INTERVAL_MS;
   const timeoutMs = options.timeoutMs ?? STOP_TIMEOUT_MS;
-  const pidfilePath = supervisorPidPath(slockHome);
-  const pid = await readPidfile(pidfilePath);
+  let pidfilePath = servicePidPath(slockHome);
+  let pid = await readPidfile(pidfilePath);
+  if (pid === null) {
+    const legacyPidfilePath = legacySupervisorPidPath(slockHome);
+    const legacyPid = await readPidfile(legacyPidfilePath);
+    if (legacyPid !== null) {
+      pidfilePath = legacyPidfilePath;
+      pid = legacyPid;
+    }
+  }
   emit5(options, { type: "stopping", pid });
   if (pid === null) {
     emit5(options, { type: "not_running" });
@@ -31390,7 +31384,7 @@ async function stop(input = {}, options = {}) {
     const cause = err instanceof Error ? err : new Error(String(err));
     throw new ComputerServiceError(
       "STOP_SIGNAL_FAILED",
-      `Failed to send SIGTERM to supervisor (pid ${pid}): ${cause.message}. Check process permissions or run: kill ${pid}`,
+      `Failed to send SIGTERM to service (pid ${pid}): ${cause.message}. Check process permissions or run: kill ${pid}`,
       err
     );
   }
@@ -31409,7 +31403,7 @@ async function stop(input = {}, options = {}) {
   }
   throw new ComputerServiceError(
     "STOP_TIMEOUT",
-    `Supervisor (pid ${pid}) did not exit within ${timeoutMs}ms after SIGTERM. Force-kill with: kill -9 ${pid}`
+    `Service (pid ${pid}) did not exit within ${timeoutMs}ms after SIGTERM. Force-kill with: kill -9 ${pid}`
   );
 }
 
@@ -31525,16 +31519,16 @@ async function detach(input, options = {}) {
   };
 }
 
-// src/supervisor.ts
+// src/service.ts
 function buildResidentSpawn(mode, serverId, selfEntry = process.argv[1] ?? "", execArgv = process.execArgv) {
   const tail = serverId ? [mode, serverId] : [mode];
   return { command: process.execPath, args: [...execArgv, selfEntry, ...tail] };
 }
 var PARENT_LOCK_HELD_ENV_VAR = "SLOCK_COMPUTER_PARENT_MUTATION_LOCK_HELD";
-async function spawnDetachedSupervisor(slockHome) {
+async function spawnDetachedService(slockHome) {
   await mkdir8(computerDir(slockHome), { recursive: true });
-  const supLogFd = await open(supervisorLogPath(slockHome), "a");
-  const { command, args } = buildResidentSpawn("__supervise", null);
+  const supLogFd = await open(serviceLogPath(slockHome), "a");
+  const { command, args } = buildResidentSpawn("__service", null);
   const child = spawn2(command, args, {
     detached: true,
     stdio: ["ignore", supLogFd.fd, supLogFd.fd],
@@ -31551,9 +31545,9 @@ async function spawnDetachedSupervisor(slockHome) {
   child.unref();
   await supLogFd.close();
   if (!pid) {
-    throw new Error("SUPERVISOR_SPAWN_FAILED: could not spawn the supervisor process");
+    throw new Error("SUPERVISOR_SPAWN_FAILED: could not spawn the service process");
   }
-  await writePidfileAt(supervisorPidPath(slockHome), pid);
+  await writePidfileAt(servicePidPath(slockHome), pid);
   return pid;
 }
 var EX_CONFIG_EXIT_CODE = 78;
@@ -31579,7 +31573,7 @@ var defaultCoreFactory = async (creds) => {
   }
   return new coreMod.DaemonCore({ serverUrl: creds.serverUrl, apiKey: creds.apiKey, localTrace: true });
 };
-function classifyChildExit(code, signal) {
+function classifyRunnerExit(code, signal) {
   if (code === EX_CONFIG_EXIT_CODE) return "config-error";
   if (signal === "SIGTERM" || signal === "SIGINT") return "graceful";
   if (code === 0) return "graceful";
@@ -31624,18 +31618,18 @@ function formatReadySummary(ready, serverIds, opts) {
   }
   return `Daemons for ${serverIds.length} managed server(s) are running.`;
 }
-async function runSupervisorStartupRecovery(slockHome) {
+async function runServiceStartupRecovery(slockHome) {
   const parentHoldsLock = process.env[PARENT_LOCK_HELD_ENV_VAR] === "1";
   try {
     if (parentHoldsLock) {
       process.stderr.write(
-        "Supervisor startup: parent CLI holds mutation lock \u2014 skipping lock cleanup.\n"
+        "Service startup: parent CLI holds mutation lock \u2014 skipping lock cleanup.\n"
       );
     } else {
       const releasedLocks = await forceReleaseLock(slockHome);
       if (releasedLocks.length > 0) {
         process.stderr.write(
-          `Supervisor startup: force-released ${releasedLocks.length} stale lock(s).
+          `Service startup: force-released ${releasedLocks.length} stale lock(s).
 `
         );
       }
@@ -31643,19 +31637,19 @@ async function runSupervisorStartupRecovery(slockHome) {
     const report = await runFullCleanup(slockHome, { skipLockCleanup: parentHoldsLock });
     if (report.anyAction) {
       process.stderr.write(
-        `Supervisor startup recovery: cleaned ${report.stalePidfiles.length} pidfile(s), ${report.powerLossRecovered.length} quarantined, ${report.tmpFilesCleared.length} tmp file(s), ${report.staleLocks.length} stale lock(s).
+        `Service startup recovery: cleaned ${report.stalePidfiles.length} pidfile(s), ${report.powerLossRecovered.length} quarantined, ${report.tmpFilesCleared.length} tmp file(s), ${report.staleLocks.length} stale lock(s).
 `
       );
     }
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(
-      `Supervisor startup recovery pass failed: ${msg}. Continuing; cleanup will retry on next supervisor restart.
+      `Service startup recovery pass failed: ${msg}. Continuing; cleanup will retry on next service restart.
 `
     );
   }
 }
-async function resolveSupervisorIdentity() {
+async function resolveServiceIdentity() {
   const here = fileURLToPath2(import.meta.url);
   const installRoot = dirname8(dirname8(here));
   let version = null;
@@ -31669,30 +31663,30 @@ async function resolveSupervisorIdentity() {
   }
   return { installRoot, version };
 }
-async function writeSupervisorVersionEvidence(slockHome) {
+async function writeServiceVersionEvidence(slockHome) {
   try {
-    const ident = await resolveSupervisorIdentity();
+    const ident = await resolveServiceIdentity();
     const payload = {
       version: ident.version,
       installRoot: ident.installRoot,
       pid: process.pid,
       writtenAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    const dest = supervisorVersionPath(slockHome);
+    const dest = serviceVersionPath(slockHome);
     const tmp = `${dest}.tmp`;
     await writeFile7(tmp, JSON.stringify(payload) + "\n", { mode: 384 });
     await rename2(tmp, dest);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(
-      `Supervisor: failed to write version evidence: ${msg}. Continuing.
+      `Service: failed to write version evidence: ${msg}. Continuing.
 `
     );
   }
 }
-async function readSupervisorVersionEvidence(slockHome) {
+async function readServiceVersionEvidence(slockHome) {
   try {
-    const raw = await readFile7(supervisorVersionPath(slockHome), "utf8");
+    const raw = await readFile7(serviceVersionPath(slockHome), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.installRoot !== "string" || typeof parsed.pid !== "number" || typeof parsed.writtenAt !== "string" || parsed.version !== null && typeof parsed.version !== "string") {
       return null;
@@ -31707,12 +31701,12 @@ async function readSupervisorVersionEvidence(slockHome) {
     return null;
   }
 }
-async function runSupervise() {
+async function runService() {
   const slockHome = resolveSlockHome();
   await mkdir8(computerDir(slockHome), { recursive: true });
-  await runSupervisorStartupRecovery(slockHome);
-  await writePidfileAt(supervisorPidPath(slockHome), process.pid);
-  await writeSupervisorVersionEvidence(slockHome);
+  await runServiceStartupRecovery(slockHome);
+  await writePidfileAt(servicePidPath(slockHome), process.pid);
+  await writeServiceVersionEvidence(slockHome);
   const children = /* @__PURE__ */ new Map();
   const { [PARENT_LOCK_HELD_ENV_VAR]: _parentLockMarker, ...childEnv } = process.env;
   const spawnChild = async (serverId) => {
@@ -31735,14 +31729,14 @@ async function runSupervise() {
         children.delete(serverId);
         await clearPidfileAt(serverDaemonPidPath(slockHome, serverId));
         if (handle.stopping) return;
-        const classification = classifyChildExit(code, signal);
+        const classification = classifyRunnerExit(code, signal);
         if (classification === "config-error") {
           try {
             await markFatalConfig(slockHome, serverId, code, signal);
           } catch {
           }
           process.stderr.write(
-            `Supervisor: server ${serverId} child exited with EX_CONFIG (${EX_CONFIG_EXIT_CODE}); marked degraded, NOT auto-restarting. See ${serverDaemonLogPath(slockHome, serverId)} for the actionable error.
+            `Service: server ${serverId} child exited with EX_CONFIG (${EX_CONFIG_EXIT_CODE}); marked degraded, NOT auto-restarting. See ${serverDaemonLogPath(slockHome, serverId)} for the actionable error.
 `
           );
           return;
@@ -31760,7 +31754,7 @@ async function runSupervise() {
         }
         if (await isDegraded(slockHome, serverId)) {
           process.stderr.write(
-            `Supervisor: server ${serverId} marked degraded (>=3 crashes in 60s); skipping auto-restart. Run \`slock-computer doctor ${serverId} --reset-health\` after fixing the underlying issue.
+            `Service: server ${serverId} marked degraded (>=3 crashes in 60s); skipping auto-restart. Run \`slock-computer doctor ${serverId} --reset-health\` after fixing the underlying issue.
 `
           );
           return;
@@ -31793,7 +31787,7 @@ async function runSupervise() {
     if (shuttingDown) return;
     shuttingDown = true;
     for (const handle of children.values()) killChild(handle);
-    void clearPidfileAt(supervisorPidPath(slockHome)).then(() => process.exit(0));
+    void clearPidfileAt(servicePidPath(slockHome)).then(() => process.exit(0));
   };
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
@@ -31815,7 +31809,7 @@ async function runStart(opts = {}, deps = {}) {
         serverLabel: opts.serverLabel ?? null
       },
       {
-        spawnDetachedSupervisor: deps.spawnDetachedSupervisor,
+        spawnDetachedService: deps.spawnDetachedService,
         readPidfile: deps.readPidfile,
         isProcessAlive: deps.isProcessAlive,
         sleep: deps.sleep,
@@ -31823,17 +31817,17 @@ async function runStart(opts = {}, deps = {}) {
         ensurePollIntervalMs: deps.ensurePollIntervalMs,
         onEvent: (event) => {
           if (event.type === "already_running") {
-            info(`Supervisor already running (pid ${event.supervisorPid}).`);
+            info(`Service already running (pid ${event.servicePid}).`);
           } else if (event.type === "running") {
             info(
-              `Running supervisor in the foreground (managing ${event.managedTargets.length} of ${event.attachedCount} attached server(s)). Ctrl-C to stop.`
+              `Running service in the foreground (managing ${event.managedTargets.length} of ${event.attachedCount} attached server(s)). Ctrl-C to stop.`
             );
           } else if (event.type === "spawned") {
-            info(`Supervisor started (pid ${event.supervisorPid}); keeps running after this terminal closes.`);
+            info(`Service started (pid ${event.servicePid}); keeps running after this terminal closes.`);
             spawnedBackground = {
               managedCount: event.managedTargets.length,
               attachedCount: event.attachedCount,
-              logPath: supervisorLogPath(resolveSlockHome())
+              logPath: serviceLogPath(resolveSlockHome())
             };
           } else if (event.type === "ready") {
             info(formatReadySummary(event.ready, event.managedTargets, opts));
@@ -31864,17 +31858,17 @@ async function runStop(deps = {}) {
       {
         readPidfile: deps.readPidfile,
         isProcessAlive: deps.isProcessAlive,
-        killSupervisor: deps.killSupervisor,
+        killService: deps.killService,
         sleep: deps.sleep,
         pollIntervalMs: deps.pollIntervalMs,
         timeoutMs: deps.timeoutMs,
         onEvent: (event) => {
           if (event.type === "not_running") {
-            info("Supervisor not running.");
+            info("Service not running.");
           } else if (event.type === "stale_pidfile_cleared") {
-            info(`Supervisor not running (cleared stale pidfile for pid ${event.pid}).`);
+            info(`Service not running (cleared stale pidfile for pid ${event.pid}).`);
           } else if (event.type === "stopped") {
-            info(`Stopped supervisor (pid ${event.pid}).`);
+            info(`Stopped service (pid ${event.pid}).`);
           }
         }
       }
@@ -31899,7 +31893,7 @@ async function runDetach(serverId, serverLabel = serverId) {
           } else if (event.type === "detached") {
             info(`Detached from server ${event.serverLabel}.`);
             info(
-              `The supervisor (if running) will stop that server's daemon on its next reconcile tick.`
+              `The service (if running) will stop that server's daemon on its next reconcile tick.`
             );
           }
         }
@@ -31916,6 +31910,14 @@ async function runDetach(serverId, serverLabel = serverId) {
 
 // src/setup.ts
 var USER_SESSION_EXPIRY_LEEWAY_MS = 3e4;
+async function readUserSessionUserId(slockHome) {
+  try {
+    const parsed = JSON.parse(await readFile8(userSessionPath(slockHome), "utf8"));
+    return typeof parsed.userId === "string" ? parsed.userId : "";
+  } catch {
+    return "";
+  }
+}
 async function hasValidUserSession(slockHome) {
   try {
     const parsed = JSON.parse(await readFile8(userSessionPath(slockHome), "utf8"));
@@ -31983,49 +31985,74 @@ async function refreshUserSession(slockHome, serverUrl) {
     return false;
   }
 }
-async function hasLiveLegacyDaemon(slockHome) {
-  let machineDirs;
-  try {
-    machineDirs = await readdir3(join3(slockHome, "machines"));
-  } catch {
-    return false;
-  }
-  for (const name of machineDirs) {
-    if (!name.startsWith("machine-")) continue;
-    try {
-      const raw = await readFile8(join3(slockHome, "machines", name, "daemon.lock", "owner.json"), "utf8");
-      const owner = JSON.parse(raw);
-      if (typeof owner.pid === "number" && isProcessAlive2(owner.pid)) return true;
-    } catch {
-    }
-  }
-  return false;
+async function defaultConfirmMigrate(prompt) {
+  process.stdout.write(prompt);
+  const line = await readLine(false);
+  const norm = line.trim().toLowerCase();
+  return norm === "y" || norm === "yes";
 }
-function hasExplicitLegacyKeyInput(opts) {
-  return typeof opts.legacyApiKey === "string" && opts.legacyApiKey.length > 0 || typeof opts.legacyApiKeyFile === "string" && opts.legacyApiKeyFile.length > 0 || opts.legacyApiKeyStdin === true;
+async function defaultReadMigrateSecret(prompt) {
+  process.stdout.write(prompt);
+  const line = await readLine(true);
+  process.stdout.write("\n");
+  return line.trim();
 }
-function hasAmbientLegacyKeyInput() {
-  return typeof process.env.SLOCK_LEGACY_API_KEY === "string" && process.env.SLOCK_LEGACY_API_KEY.trim().length > 0;
+async function readLine(masked) {
+  const stdin = process.stdin;
+  const wasRaw = stdin.isTTY === true && stdin.isRaw === true;
+  const enterRaw = masked && stdin.isTTY === true && typeof stdin.setRawMode === "function";
+  if (enterRaw) stdin.setRawMode(true);
+  stdin.resume();
+  return await new Promise((resolve) => {
+    let buf = "";
+    const cleanup = () => {
+      stdin.off("data", onData);
+      stdin.off("end", onEnd);
+      stdin.pause();
+      if (enterRaw) stdin.setRawMode(wasRaw);
+    };
+    const onData = (chunk) => {
+      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const ch of text) {
+        if (ch === "\n" || ch === "\r") {
+          cleanup();
+          resolve(buf);
+          return;
+        }
+        if (ch === "") {
+          cleanup();
+          resolve("");
+          return;
+        }
+        if (ch === "\x7F" || ch === "\b") {
+          buf = buf.slice(0, -1);
+          continue;
+        }
+        buf += ch;
+      }
+    };
+    const onEnd = () => {
+      cleanup();
+      resolve(buf);
+    };
+    stdin.on("data", onData);
+    stdin.on("end", onEnd);
+  });
 }
 async function runSetup(opts, deps = {}) {
   const slockHome = resolveSlockHome();
   const isTty = deps.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
   const login2 = deps.runLogin ?? runLogin;
   const attach2 = deps.runAttach ?? runAttach;
-  const adopt = deps.runAdoptLegacy ?? runAdoptLegacy;
   const start2 = deps.runStart ?? runStart;
   const refreshSession = deps.refreshUserSession ?? refreshUserSession;
-  const legacyDaemonCheck = deps.hasLiveLegacyDaemon ?? hasLiveLegacyDaemon;
+  const detectMigration = deps.detectLegacyMigration ?? detectLegacyMigration;
+  const confirmMigrate = deps.confirmMigrate ?? defaultConfirmMigrate;
+  const readMigrateSecret = deps.readMigrateSecret ?? defaultReadMigrateSecret;
   if (!isTty && !opts.yes) {
     fail(
       "NON_INTERACTIVE_SETUP_REQUIRES_FLAGS",
-      "Non-interactive setup requires --yes after you have confirmed the login/attach/adopt/start actions. Run `slock-computer login`, `slock-computer attach`, and `slock-computer start` separately for fully explicit automation."
-    );
-  }
-  if (!opts.adoptLegacy && hasExplicitLegacyKeyInput(opts)) {
-    fail(
-      "LEGACY_KEY_OUTSIDE_ADOPT",
-      "`--legacy-api-key*` options are only accepted with `slock-computer setup --adopt-legacy` or `slock-computer adopt-legacy`."
+      "Non-interactive setup requires --yes after you have confirmed the login/attach/start actions. Run `slock-computer login`, `slock-computer attach`, and `slock-computer start` separately for fully explicit automation."
     );
   }
   const label = formatServerSlugDisplay(opts.serverSlug);
@@ -32050,34 +32077,82 @@ async function runSetup(opts, deps = {}) {
   if (attachment) {
     info(`Attachment: already attached to ${label}.`);
   } else {
-    const liveLegacy = await legacyDaemonCheck(slockHome);
-    const explicitLegacyKey = hasExplicitLegacyKeyInput(opts);
-    const hasLegacyKey = explicitLegacyKey || opts.adoptLegacy === true && hasAmbientLegacyKeyInput();
-    if (!opts.adoptLegacy && liveLegacy) {
-      fail(
-        "LEGACY_DAEMON_RUNNING",
-        `A legacy daemon appears to be running in ${slockHome}, so Computer setup stopped before creating a second attachment. To proceed: try the Computer beta in an isolated home with \`SLOCK_HOME=$HOME/.slock-computer-beta slock-computer setup ${label}\`; or stop the legacy daemon with \`pkill -f slock-daemon && rm -f ~/.slock/daemon.pid\`; or migrate the existing daemon with \`--adopt-legacy --legacy-api-key <key>\`.`
-      );
-    }
-    if (opts.adoptLegacy && hasLegacyKey) {
-      await adopt({
-        serverSlug: opts.serverSlug,
-        serverUrl: opts.serverUrl,
-        name: opts.name,
-        legacyApiKey: opts.legacyApiKey,
-        legacyApiKeyFile: opts.legacyApiKeyFile,
-        legacyApiKeyStdin: opts.legacyApiKeyStdin,
-        orchestrated: true
-      });
-    } else if (opts.adoptLegacy && liveLegacy) {
-      fail(
-        "LEGACY_DAEMON_RUNNING",
-        `A legacy daemon is running in ${slockHome}, but no legacy key was provided. To proceed: provide --legacy-api-key-file/--legacy-api-key/--legacy-api-key-stdin to adopt it; or stop the legacy daemon with \`pkill -f slock-daemon && rm -f ~/.slock/daemon.pid\`; or use an isolated home with \`SLOCK_HOME=$HOME/.slock-computer-beta slock-computer setup ${label}\` for a clean beta trial.`
-      );
-    } else {
-      if (opts.adoptLegacy) {
-        info("Legacy key: not provided; falling back to fresh device-login attach.");
+    let migrated = false;
+    if (isTty) {
+      const detection = await detectMigration(slockHome, await readUserSessionUserId(slockHome));
+      if (detection.kind === "match") {
+        const where = detection.serverUrl ? ` attached to ${detection.serverUrl}` : "";
+        const who = detection.machineName ? ` "${detection.machineName}"` : "";
+        const accepted = await confirmMigrate(
+          `Migration: detected legacy daemon machine${who}${where}. Migrate it under Computer instead of creating a fresh attachment? [y/N] `
+        );
+        if (accepted) {
+          const rawKey = await readMigrateSecret(
+            "Paste legacy api key (sk_machine_* or sk_daemon_*); input is hidden: "
+          );
+          if (rawKey.length === 0) {
+            info("Migration: no key provided; falling back to fresh attach.");
+          } else if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
+            fail(
+              "LEGACY_KEY_INVALID",
+              "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
+            );
+          } else {
+            try {
+              await adoptLegacy(
+                {
+                  serverSlug: opts.serverSlug,
+                  serverUrl: opts.serverUrl,
+                  name: opts.name,
+                  rawKey,
+                  mode: "legacy_key_stdin",
+                  redactedPrefix: rawKey.slice(0, 8)
+                },
+                {
+                  onEvent: (event) => {
+                    if (event.type === "adopting") {
+                      info(
+                        `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
+                      );
+                    } else if (event.type === "preflight") {
+                      info(
+                        event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026"
+                      );
+                    } else if (event.type === "adopted") {
+                      info(`Adopted. Computer state written to ${event.attachmentPath}`);
+                      info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
+                      info(`  serverMachine: ${event.serverMachineId}`);
+                      info(`  legacyMachine: ${event.legacyMachineId}`);
+                      switch (event.legacyStop.outcome) {
+                        case "absent":
+                          info("  legacy daemon: not detected on this Computer (no local lock file)");
+                          break;
+                        case "already_dead":
+                          info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
+                          break;
+                        case "stopped":
+                          info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
+                          break;
+                      }
+                    }
+                  }
+                }
+              );
+              migrated = true;
+            } catch (err) {
+              if (err instanceof CliExit) throw err;
+              if (err instanceof ComputerServiceError) {
+                fail(err.code, err.message);
+              }
+              throw err;
+            }
+          }
+        } else {
+          info("Migration: declined; falling back to fresh attach.");
+        }
       }
+    }
+    if (!migrated) {
       await attach2({
         serverSlug: opts.serverSlug,
         serverUrl: opts.serverUrl,
@@ -32090,7 +32165,7 @@ async function runSetup(opts, deps = {}) {
     if (!attachment) {
       fail(
         "SETUP_ATTACHMENT_MISSING",
-        `Setup did not produce a local attachment for ${label}. Re-run \`slock-computer attach ${label}\` or \`slock-computer adopt-legacy ${label}\`.`
+        `Setup did not produce a local attachment for ${label}. Re-run \`slock-computer attach ${label}\`.`
       );
     }
   }
@@ -32138,37 +32213,36 @@ async function deriveHealth(slockHome, serverId, daemon) {
   if (await isDegraded(slockHome, serverId)) return "degraded";
   return "ok";
 }
-async function buildStatusReport() {
-  const slockHome = resolveSlockHome();
-  const sessionRead = await readUserSession(userSessionPath(slockHome));
+async function buildStatusReport(installRoot) {
+  const sessionRead = await readUserSession(userSessionPath(installRoot));
   const session = sessionRead.session;
-  const attachments = await listServerAttachments(slockHome);
-  const supervisor = {
-    ...await pidStatus(supervisorPidPath(slockHome)),
-    logPath: supervisorLogPath(slockHome)
+  const attachments = await listServerAttachments(installRoot);
+  const service = {
+    ...await pidStatus(servicePidPath(installRoot)),
+    logPath: serviceLogPath(installRoot)
   };
   const servers = [];
   for (const a of attachments) {
-    const daemon = await pidStatus(serverDaemonPidPath(slockHome, a.serverId));
+    const daemon = await pidStatus(serverDaemonPidPath(installRoot, a.serverId));
     servers.push({
       serverId: a.serverId,
       serverSlug: a.serverSlug ?? null,
       serverMachineId: a.serverMachineId,
       serverUrl: a.serverUrl,
       attachedAt: a.attachedAt ?? null,
-      daemonLogPath: serverDaemonLogPath(slockHome, a.serverId),
+      daemonLogPath: serverDaemonLogPath(installRoot, a.serverId),
       daemon,
-      health: await deriveHealth(slockHome, a.serverId, daemon)
+      health: await deriveHealth(installRoot, a.serverId, daemon)
     });
   }
   const loggedIn = session?.kind === "user-session" && typeof session.accessToken === "string" && session.accessToken.length > 0;
   return {
-    slockHome,
+    slockHome: installRoot,
     loggedIn,
     userId: session ? str(session.userId) : null,
     loginServerUrl: session ? str(session.serverUrl) : null,
     userSessionError: sessionRead.state === "invalid" ? sessionRead.error : null,
-    supervisor,
+    service,
     servers
   };
 }
@@ -32176,7 +32250,7 @@ function pad(s, n) {
   return s.length >= n ? s : s + " ".repeat(n - s.length);
 }
 async function runStatus(opts) {
-  const report = await buildStatusReport();
+  const report = await buildStatusReport(resolveSlockHome());
   if (opts.json) {
     info(JSON.stringify(report, null, 2));
     return;
@@ -32189,9 +32263,9 @@ async function runStatus(opts) {
   );
   if (report.loginServerUrl) info(`Login server: ${report.loginServerUrl}`);
   info(
-    `Supervisor:   ${report.supervisor.running ? `running (pid ${report.supervisor.pid})` : "stopped \u2014 run `slock-computer start`"}`
+    `Service:   ${report.service.running ? `running (pid ${report.service.pid})` : "stopped \u2014 run `slock-computer start`"}`
   );
-  info(`Supervisor log: ${report.supervisor.logPath}`);
+  info(`Service log: ${report.service.logPath}`);
   info("");
   if (report.servers.length === 0) {
     info("Attachments:  none \u2014 run `slock-computer attach /<serverSlug>` (e.g. `/myserver`).");
@@ -32281,42 +32355,92 @@ async function resolveTargetAttachment(opts) {
   return a;
 }
 
+// src/lib/readers.ts
+init_esm_shims();
+
+// src/lib/types.ts
+init_esm_shims();
+var StateReaderError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "StateReaderError";
+    this.code = code;
+  }
+};
+
+// src/lib/readers.ts
+async function listRunners(installRoot, opts = {}) {
+  const all = await listServerAttachments(installRoot);
+  let subset = all;
+  if (opts.serverId !== void 0) {
+    const found = all.find((a) => a.serverId === opts.serverId);
+    if (!found) {
+      throw new StateReaderError(
+        "NOT_ATTACHED",
+        `Server ${opts.serverId} is not attached to this Computer.`
+      );
+    }
+    subset = [found];
+  }
+  const servers = [];
+  for (const a of subset) {
+    const client = new RunnersClient(a.serverUrl, a.apiKey);
+    const result = await client.list();
+    const idCols = { serverId: a.serverId, serverSlug: a.serverSlug ?? null };
+    if (result.status === "success") {
+      servers.push({
+        ...idCols,
+        status: "ok",
+        whitelist: result.whitelist,
+        runners: result.runners
+      });
+    } else if (result.status === "unauthorized") {
+      servers.push({ ...idCols, status: "unauthorized" });
+    } else {
+      servers.push({ ...idCols, status: "error", code: result.code });
+    }
+  }
+  return { servers };
+}
+
 // src/runners.ts
 async function runRunnersList(opts) {
-  const a = await resolveTargetAttachment({ server: opts.server });
-  const client = new RunnersClient(a.serverUrl, a.apiKey);
-  const result = await client.list();
-  const label = a.serverSlug ? formatServerSlugDisplay(a.serverSlug) : a.serverId;
-  if (result.status === "unauthorized") {
+  const serverId = await resolveTargetServerId({ server: opts.server });
+  const installRoot = resolveSlockHome();
+  const { servers } = await listRunners(installRoot, { serverId });
+  const block = servers[0];
+  const label = block.serverSlug ? formatServerSlugDisplay(block.serverSlug) : block.serverId;
+  if (block.status === "unauthorized") {
     fail(
       "RUNNERS_UNAUTHORIZED",
       `The Computer credential for ${label} was rejected. Re-run \`slock-computer attach ${label}\`.`
     );
   }
-  if (result.status === "error") {
+  if (block.status === "error") {
     fail(
       "RUNNERS_LIST_FAILED",
-      `Could not list runners on ${label} (${result.code}). Check --server-url / server version.`
+      `Could not list runners on ${label} (${block.code}). Check --server-url / server version.`
     );
   }
   if (opts.json) {
     info(
       JSON.stringify(
-        { server: label, serverId: a.serverId, whitelist: result.whitelist, runners: result.runners },
+        { server: label, serverId: block.serverId, whitelist: block.whitelist, runners: block.runners },
         null,
         2
       )
     );
     return;
   }
-  if (result.runners.length === 0) {
+  if (block.runners.length === 0) {
     info(`No runners on server ${label}.`);
     return;
   }
   info("");
   info(`Server ${label}:`);
   info("  AGENT                                 STATUS     RUNTIME   MODEL          NAME");
-  for (const r of result.runners) {
+  for (const r of block.runners) {
     info(
       `  ${r.agentId.padEnd(38)}${(r.status ?? "").padEnd(11)}${(r.runtime ?? "").padEnd(10)}${(r.model ?? "").padEnd(15)}${r.name ?? ""}`
     );
@@ -32365,20 +32489,20 @@ function redactSecrets(line) {
   return out;
 }
 async function runDoctorChecks() {
-  const report = await buildStatusReport();
+  const slockHome = resolveSlockHome();
+  const report = await buildStatusReport(slockHome);
   const checks = [];
   checks.push({ name: "SLOCK_HOME", ok: true, detail: report.slockHome });
   checks.push(
     report.userSessionError ? { name: "user session", ok: false, detail: "invalid user session file \u2014 re-run `slock-computer login`" } : report.loggedIn ? { name: "user session", ok: true, detail: `logged in (user ${report.userId ?? "?"})` } : { name: "user session", ok: false, detail: "not logged in \u2014 run `slock-computer login`" }
   );
   checks.push(
-    report.supervisor.running ? { name: "supervisor", ok: true, detail: `running (pid ${report.supervisor.pid})` } : {
-      name: "supervisor",
+    report.service.running ? { name: "service", ok: true, detail: `running (pid ${report.service.pid})` } : {
+      name: "service",
       ok: true,
       detail: "stopped (run `slock-computer start` when you want background)"
     }
   );
-  const slockHome = resolveSlockHome();
   const attachments = await listServerAttachments(slockHome);
   if (attachments.length === 0) {
     checks.push({
@@ -32420,7 +32544,7 @@ async function runDoctor(opts) {
   if (opts.resetHealth && opts.serverId) {
     await resetHealth(slockHome, opts.serverId);
     info(`Reset health state for server ${opts.serverLabel ?? opts.serverId}.`);
-    info(`Supervisor will resume auto-restart on next daemon exit.`);
+    info(`Service will resume auto-restart on next daemon exit.`);
   }
   const checks = await runDoctorChecks();
   const allOk = checks.every((c) => c.ok);
@@ -32494,14 +32618,14 @@ import { readFile as readFile10 } from "fs/promises";
 var DEFAULT_LINES = 200;
 async function runLogs(opts) {
   const home = resolveSlockHome();
-  const file = opts.supervisor ? supervisorLogPath(home) : serverDaemonLogPath(home, await resolveTargetServerId({ server: opts.server }));
+  const file = opts.service ? serviceLogPath(home) : serverDaemonLogPath(home, await resolveTargetServerId({ server: opts.server }));
   let content;
   try {
     content = await readFile10(file, "utf8");
   } catch {
     fail(
       "NO_DAEMON_LOG",
-      opts.supervisor ? `No supervisor log at ${file}. Start the supervisor first (\`slock-computer start\`).` : `No daemon log at ${file}. Start its daemon first (\`slock-computer start\`).`
+      opts.service ? `No service log at ${file}. Start the service first (\`slock-computer start\`).` : `No daemon log at ${file}. Start its daemon first (\`slock-computer start\`).`
     );
   }
   const n = Number.isInteger(opts.lines) && opts.lines > 0 ? opts.lines : DEFAULT_LINES;
@@ -32511,16 +32635,166 @@ async function runLogs(opts) {
   for (const line of tail) info(redactSecrets(line));
 }
 
+// src/reset.ts
+init_esm_shims();
+
+// src/serviceState.ts
+init_esm_shims();
+import { mkdir as mkdir10, readFile as readFile11, writeFile as writeFile9, appendFile as appendFile3 } from "fs/promises";
+import { dirname as dirname10 } from "path";
+
+// src/lib/state.ts
+init_esm_shims();
+var SERVICE_STATE_VALUES = [
+  "starting",
+  "running",
+  "degraded",
+  "stopping",
+  "stopped"
+];
+function isServiceState(value) {
+  return typeof value === "string" && SERVICE_STATE_VALUES.includes(value);
+}
+
+// src/serviceState.ts
+var DEFAULT_STATE = {
+  state: "running",
+  crashHistory: []
+};
+async function readServiceState(slockHome) {
+  try {
+    const raw = await readFile11(serviceStatePath(slockHome), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return { ...DEFAULT_STATE };
+    const obj = parsed;
+    const state = isServiceState(obj.state) ? obj.state : "running";
+    const crashHistory = Array.isArray(obj.crashHistory) ? obj.crashHistory.filter(isCrashEntry) : [];
+    return { state, crashHistory };
+  } catch {
+    return { ...DEFAULT_STATE };
+  }
+}
+async function writeServiceState(slockHome, file) {
+  const path3 = serviceStatePath(slockHome);
+  await mkdir10(dirname10(path3), { recursive: true });
+  await writeFile9(path3, JSON.stringify(file), { mode: 384 });
+}
+function isCrashEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const obj = value;
+  return typeof obj.at === "string";
+}
+async function emitServiceStateTransition(slockHome, fromState, toState, trigger) {
+  const entry = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    kind: "service-state-changed",
+    fromState,
+    toState,
+    trigger
+  };
+  try {
+    const path3 = serviceLogPath(slockHome);
+    await mkdir10(dirname10(path3), { recursive: true });
+    await appendFile3(path3, JSON.stringify(entry) + "\n");
+  } catch {
+  }
+}
+async function clearServiceCrashHistory(slockHome) {
+  const current = await readServiceState(slockHome);
+  const previousState = current.state;
+  const clearedCrashCount = current.crashHistory.length;
+  const next = { state: "running", crashHistory: [] };
+  await writeServiceState(slockHome, next);
+  await emitServiceStateTransition(
+    slockHome,
+    previousState,
+    "running",
+    "reset-service"
+  );
+  return { previousState, clearedCrashCount };
+}
+
+// src/reset.ts
+async function resetService(installRoot) {
+  const { previousState, clearedCrashCount } = await clearServiceCrashHistory(installRoot);
+  return {
+    status: "ok",
+    previousState,
+    clearedCrashCount
+  };
+}
+async function resetRunner(installRoot, serverId) {
+  const attachment = await readServerAttachment(installRoot, serverId);
+  if (!attachment) {
+    return { status: "not-found", serverId };
+  }
+  const outcome = await resetRunnerHealth(installRoot, serverId);
+  if (outcome.status === "not-found") {
+    return { status: "not-found", serverId };
+  }
+  return {
+    status: "ok",
+    serverId,
+    previousState: outcome.previousState ?? "running",
+    clearedCrashCount: outcome.clearedCrashCount ?? 0
+  };
+}
+async function runReset(opts) {
+  const wantsService = opts.service === true;
+  const wantsRunner = opts.runner === true;
+  if (wantsService && wantsRunner) {
+    fail(
+      "RESET_SCOPE_AMBIGUOUS",
+      "`--service` and `--runner` are mutually exclusive. Pass exactly one."
+    );
+  }
+  if (!wantsService && !wantsRunner) {
+    fail(
+      "RESET_SCOPE_MISSING",
+      "Pass `--service` to clear the service-level crash history, or `--runner` to clear a per-runner crash history."
+    );
+  }
+  const slockHome = resolveSlockHome();
+  if (wantsService) {
+    const result2 = await resetService(slockHome);
+    if (opts.json) {
+      info(JSON.stringify(result2));
+      return;
+    }
+    info(
+      `Reset service crash history (previous state: ${result2.previousState}; cleared ${result2.clearedCrashCount} entr${result2.clearedCrashCount === 1 ? "y" : "ies"}).`
+    );
+    info("Service state transitioned to `running`. Runners were not touched.");
+    return;
+  }
+  const serverId = await resolveTargetServerId({ server: opts.server });
+  const result = await resetRunner(slockHome, serverId);
+  if (result.status === "not-found") {
+    fail(
+      "RESET_RUNNER_NOT_FOUND",
+      `Runner for server ${serverId} was not found.`
+    );
+  }
+  if (opts.json) {
+    info(JSON.stringify(result));
+    return;
+  }
+  info(
+    `Reset runner crash history for server ${result.serverId} (previous state: ${result.previousState}; cleared ${result.clearedCrashCount} entr${result.clearedCrashCount === 1 ? "y" : "ies"}).`
+  );
+  info("Runner state transitioned to `running`. Process was not respawned.");
+}
+
 // src/concurrency.ts
 init_esm_shims();
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import { mkdir as mkdir10 } from "fs/promises";
+import { mkdir as mkdir11 } from "fs/promises";
 import { join as join4 } from "path";
 var STALE_LOCK_THRESHOLD_MS = 6e4;
 async function withMutationLock(fn) {
   const slockHome = resolveSlockHome();
   const lockTarget = computerDir(slockHome);
-  await mkdir10(lockTarget, { recursive: true });
+  await mkdir11(lockTarget, { recursive: true });
   const lockfilePath = join4(lockTarget, ".lock");
   let release = null;
   try {
@@ -32559,8 +32833,8 @@ async function withMutationLock(fn) {
 
 // src/channel.ts
 init_esm_shims();
-import { readFile as readFile11, writeFile as writeFile9, mkdir as mkdir11 } from "fs/promises";
-import { dirname as dirname10 } from "path";
+import { readFile as readFile12, writeFile as writeFile10, mkdir as mkdir12 } from "fs/promises";
+import { dirname as dirname11 } from "path";
 var DEFAULT_CHANNEL = "latest";
 var SEMVER_RE = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
 function parseChannel(raw) {
@@ -32575,7 +32849,7 @@ function parseChannel(raw) {
 }
 async function readChannel(slockHome) {
   try {
-    const raw = await readFile11(channelPath(slockHome), "utf8");
+    const raw = await readFile12(channelPath(slockHome), "utf8");
     const parsed = parseChannel(raw);
     if (parsed !== null) return parsed;
   } catch {
@@ -32584,8 +32858,8 @@ async function readChannel(slockHome) {
 }
 async function writeChannel(slockHome, channel2) {
   const p = channelPath(slockHome);
-  await mkdir11(dirname10(p), { recursive: true });
-  await writeFile9(p, `${channel2}
+  await mkdir12(dirname11(p), { recursive: true });
+  await writeFile10(p, `${channel2}
 `, { mode: 384 });
 }
 async function runChannelShow(slockHome) {
@@ -32603,25 +32877,25 @@ async function runChannelSet(slockHome, raw) {
   }
   await writeChannel(slockHome, parsed);
   info(`Channel set to ${parsed}.`);
-  info(`Note: supervisor reads channel at startup; restart \`slock-computer start\` to apply.`);
+  info(`Note: service reads channel at startup; restart \`slock-computer start\` to apply.`);
 }
 
 // src/upgradeCli.ts
 init_esm_shims();
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile15 } from "fs/promises";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname11, join as join7 } from "path";
+import { dirname as dirname12, join as join7 } from "path";
 
 // src/upgrade.ts
 init_esm_shims();
 import { spawn as spawn4 } from "child_process";
-import { mkdir as mkdir12, readFile as readFile13, writeFile as writeFile10, rm as rm3, rename as rename4 } from "fs/promises";
+import { mkdir as mkdir13, readFile as readFile14, writeFile as writeFile11, rm as rm3, rename as rename4 } from "fs/promises";
 import { join as join6 } from "path";
 import { createHash as createHash3 } from "crypto";
 
 // src/preflightDepDrift.ts
 init_esm_shims();
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 import { spawn as spawn3 } from "child_process";
 import { createRequire } from "module";
 import { join as join5 } from "path";
@@ -32630,12 +32904,10 @@ var DAEMON_PACKAGE_NAME = "@slock-ai/daemon";
 async function preflightDepDriftCheck(currentBinaryDir, stagedTarballPath, deps = {}) {
   const readTarball = deps.readTarballPackageJson ?? defaultReadTarballPackageJson;
   const readCurrent = deps.readCurrentPackageJson ?? defaultReadCurrentPackageJson;
-  const readInstalled = deps.readInstalledDaemonVersion ?? defaultReadInstalledDaemonVersion;
   const satisfies = deps.semverSatisfies ?? defaultSemverSatisfies;
   const allowUnsafe = deps.allowUnsafeSpec === true;
   let targetPkg;
   let currentPkg;
-  let installedVersion;
   try {
     targetPkg = await readTarball(stagedTarballPath);
   } catch (e) {
@@ -32654,15 +32926,6 @@ async function preflightDepDriftCheck(currentBinaryDir, stagedTarballPath, deps
       detail: `cannot read current binary package.json: ${errMsg(e)}`
     };
   }
-  try {
-    installedVersion = await readInstalled(currentBinaryDir);
-  } catch (e) {
-    return {
-      ok: false,
-      reason: "read_failed",
-      detail: `cannot read installed ${DAEMON_PACKAGE_NAME} version: ${errMsg(e)}`
-    };
-  }
   const targetSpec = targetPkg.dependencies?.[DAEMON_PACKAGE_NAME];
   const currentSpec = currentPkg.dependencies?.[DAEMON_PACKAGE_NAME];
   if (typeof targetSpec !== "string" || targetSpec.length === 0) {
@@ -32673,60 +32936,64 @@ async function preflightDepDriftCheck(currentBinaryDir, stagedTarballPath, deps
       currentSpec
     };
   }
-  if (typeof currentSpec !== "string" || currentSpec.length === 0) {
+  const unsafeTarget = isUnsafeSpec(targetSpec) || isUnparseableRange(targetSpec);
+  if (!allowUnsafe && unsafeTarget) {
     return {
       ok: false,
-      reason: "read_failed",
-      detail: `current binary package.json has no ${DAEMON_PACKAGE_NAME} dependency entry`,
+      reason: "unsafe_spec",
+      detail: `${DAEMON_PACKAGE_NAME} target spec is not a safe semver range (target="${targetSpec}"). Auto-upgrade only supports target semver ranges that can be hydrated and verified before swap.`,
+      currentSpec,
       targetSpec
     };
   }
-  if (installedVersion === null || installedVersion.length === 0) {
+  void satisfies;
+  return { ok: true, currentSpec, targetSpec };
+}
+async function verifyHydratedDaemonDependency(extractedPackageDir, targetSpec, deps = {}) {
+  const readInstalled = deps.readInstalledDaemonVersion ?? defaultReadInstalledDaemonVersion;
+  const satisfies = deps.semverSatisfies ?? defaultSemverSatisfies;
+  const allowUnsafe = deps.allowUnsafeSpec === true;
+  const unsafeTarget = isUnsafeSpec(targetSpec) || isUnparseableRange(targetSpec);
+  if (!allowUnsafe && unsafeTarget) {
     return {
       ok: false,
-      reason: "read_failed",
-      detail: `${DAEMON_PACKAGE_NAME} is not installed at the expected location next to the current binary`,
-      currentSpec,
+      reason: "unsafe_spec",
+      detail: `${DAEMON_PACKAGE_NAME} target spec is not a safe semver range (target="${targetSpec}").`,
       targetSpec
     };
   }
-  const unsafeCurrent = isUnsafeSpec(currentSpec) || isUnparseableRange(currentSpec);
-  const unsafeTarget = isUnsafeSpec(targetSpec) || isUnparseableRange(targetSpec);
-  const anyUnsafe = unsafeCurrent || unsafeTarget;
-  if (!allowUnsafe && anyUnsafe) {
+  let installedVersion;
+  try {
+    installedVersion = await readInstalled(extractedPackageDir);
+  } catch (e) {
     return {
       ok: false,
-      reason: "unsafe_spec",
-      detail: `${DAEMON_PACKAGE_NAME} spec is not a safe semver range (current="${currentSpec}", target="${targetSpec}"). v1 auto-upgrade only supports semver ranges; re-install manually with \`npm install -g @slock-ai/computer@<version>\`.`,
-      currentSpec,
-      targetSpec,
-      installedVersion
+      reason: "read_failed",
+      detail: `cannot read hydrated ${DAEMON_PACKAGE_NAME} version: ${errMsg(e)}`,
+      targetSpec
     };
   }
-  if (currentSpec !== targetSpec) {
+  if (installedVersion === null || installedVersion.length === 0) {
     return {
       ok: false,
-      reason: "spec_changed",
-      detail: `${DAEMON_PACKAGE_NAME} dependency spec changed from "${currentSpec}" to "${targetSpec}". Auto-upgrade only swaps the Computer package root; the runtime dependency tree is not refreshed. Run \`npm install -g @slock-ai/computer@<version>\` manually.`,
-      currentSpec,
-      targetSpec,
-      installedVersion
+      reason: "read_failed",
+      detail: `${DAEMON_PACKAGE_NAME} is not installed in the hydrated staged package`,
+      targetSpec
     };
   }
-  if (allowUnsafe && anyUnsafe) {
-    return { ok: true, currentSpec, targetSpec, installedVersion };
+  if (allowUnsafe && unsafeTarget) {
+    return { ok: true, targetSpec, installedVersion };
   }
   if (!satisfies(installedVersion, targetSpec)) {
     return {
       ok: false,
       reason: "installed_unsatisfied",
-      detail: `installed ${DAEMON_PACKAGE_NAME}@${installedVersion} does not satisfy target spec "${targetSpec}". Re-install with \`npm install -g @slock-ai/computer@<version>\`.`,
-      currentSpec,
+      detail: `hydrated ${DAEMON_PACKAGE_NAME}@${installedVersion} does not satisfy target spec "${targetSpec}".`,
       targetSpec,
       installedVersion
     };
   }
-  return { ok: true, currentSpec, targetSpec, installedVersion };
+  return { ok: true, targetSpec, installedVersion };
 }
 function isUnparseableRange(spec) {
   const s = spec.trim();
@@ -32792,7 +33059,7 @@ async function defaultReadTarballPackageJson(tarballPath) {
   return JSON.parse(raw);
 }
 async function defaultReadCurrentPackageJson(currentBinaryDir) {
-  const raw = await readFile12(join5(currentBinaryDir, "package.json"), "utf8");
+  const raw = await readFile13(join5(currentBinaryDir, "package.json"), "utf8");
   return JSON.parse(raw);
 }
 async function defaultReadInstalledDaemonVersion(currentBinaryDir) {
@@ -32809,7 +33076,7 @@ async function defaultReadInstalledDaemonVersion(currentBinaryDir) {
   for (const base of searchPaths) {
     const candidate = join5(base, ...subPath, "package.json");
     try {
-      const raw = await readFile12(candidate, "utf8");
+      const raw = await readFile13(candidate, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed.name !== DAEMON_PACKAGE_NAME) continue;
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
@@ -32889,9 +33156,9 @@ function satisfiesTilde(ver, base) {
 // src/upgrade.ts
 async function stagePhase(slockHome, version, deps = {}) {
   const npmPack = deps.npmPack ?? defaultNpmPack;
-  const fsReadFile = deps.fsReadFile ?? readFile13;
+  const fsReadFile = deps.fsReadFile ?? readFile14;
   const stagedPath = upgradeStagingDir(slockHome, version);
-  await mkdir12(stagedPath, { recursive: true });
+  await mkdir13(stagedPath, { recursive: true });
   const packageRef = `@slock-ai/computer@${version}`;
   const result = await npmPack(stagedPath, packageRef);
   if (result.exitCode !== 0) {
@@ -32999,8 +33266,8 @@ async function cleanupStaged(slockHome, version) {
 async function snapshotPhase(slockHome, snap) {
   const path3 = upgradeSnapshotPath(slockHome);
   const tmp = `${path3}.tmp`;
-  await mkdir12(computerDir(slockHome), { recursive: true });
-  await writeFile10(tmp, JSON.stringify(snap, null, 2), { mode: 384 });
+  await mkdir13(computerDir(slockHome), { recursive: true });
+  await writeFile11(tmp, JSON.stringify(snap, null, 2), { mode: 384 });
   await rename4(tmp, path3);
 }
 async function clearUpgradeSnapshot(slockHome) {
@@ -33012,7 +33279,7 @@ async function clearUpgradeSnapshot(slockHome) {
 }
 async function extractTarball(tarballPath, destDir, deps = {}) {
   const tarSpawn = deps.tarSpawn ?? defaultTarSpawn;
-  await mkdir12(destDir, { recursive: true });
+  await mkdir13(destDir, { recursive: true });
   const result = await tarSpawn(tarballPath, destDir);
   if (result.exitCode !== 0) {
     const err = new Error(
@@ -33116,49 +33383,49 @@ async function rollbackSwap(currentBinaryDir, deps = {}) {
   }
 }
 async function rollbackRestart(slockHome, currentBinaryDir, deps = {}) {
-  const readSupervisorPid = deps.readSupervisorPid ?? (() => defaultReadSupervisorPid(slockHome));
+  const readServicePid = deps.readServicePid ?? (() => defaultReadServicePid(slockHome));
   const isProcessAlive4 = deps.isProcessAlive ?? defaultIsProcessAlive;
-  const killSupervisor = deps.killSupervisor ?? defaultKillSupervisor;
-  const forceKillSupervisor = deps.forceKillSupervisor ?? defaultForceKillSupervisor;
+  const killService = deps.killService ?? defaultKillService;
+  const forceKillService = deps.forceKillService ?? defaultForceKillService;
   const waitForExit = deps.waitForExit ?? defaultWaitForExit;
-  const spawnFreshSupervisor = deps.spawnFreshSupervisor;
+  const spawnFreshService = deps.spawnFreshService;
   const healthCheck = deps.healthCheck ?? (() => defaultHealthCheck(slockHome));
   const healthTimeoutMs = deps.healthTimeoutMs ?? 3e4;
   const healthPollIntervalMs = deps.healthPollIntervalMs ?? 500;
-  let supervisorStopped = false;
+  let serviceStopped = false;
   try {
-    const pid = await readSupervisorPid();
+    const pid = await readServicePid();
     if (pid === null || !isProcessAlive4(pid)) {
-      supervisorStopped = true;
+      serviceStopped = true;
     } else {
-      await killSupervisor(pid);
+      await killService(pid);
       const exited = await waitForExit(pid, 1e4);
       if (!exited) {
-        await forceKillSupervisor(pid);
+        await forceKillService(pid);
         const escalatedExit = await waitForExit(pid, 5e3);
-        supervisorStopped = escalatedExit;
+        serviceStopped = escalatedExit;
       } else {
-        supervisorStopped = true;
+        serviceStopped = true;
       }
     }
   } catch (e) {
     return {
       binaryRestored: false,
-      supervisorStopped: false,
-      supervisorRespawned: false,
-      supervisorHealthy: false,
+      serviceStopped: false,
+      serviceRespawned: false,
+      serviceHealthy: false,
       failedStep: "stop",
       reason: e instanceof Error ? e.message : String(e)
     };
   }
-  if (!supervisorStopped) {
+  if (!serviceStopped) {
     return {
       binaryRestored: false,
-      supervisorStopped: false,
-      supervisorRespawned: false,
-      supervisorHealthy: false,
+      serviceStopped: false,
+      serviceRespawned: false,
+      serviceHealthy: false,
       failedStep: "stop",
-      reason: "new-version supervisor did not exit (graceful + SIGKILL both timed out)"
+      reason: "new-version service did not exit (graceful + SIGKILL both timed out)"
     };
   }
   const swapRb = await rollbackSwap(currentBinaryDir, {
@@ -33168,31 +33435,31 @@ async function rollbackRestart(slockHome, currentBinaryDir, deps = {}) {
   if (!swapRb.rolledBack) {
     return {
       binaryRestored: false,
-      supervisorStopped: true,
-      supervisorRespawned: false,
-      supervisorHealthy: false,
+      serviceStopped: true,
+      serviceRespawned: false,
+      serviceHealthy: false,
       failedStep: "binary",
       reason: "could not restore .prev \u2192 currentBinaryDir"
     };
   }
-  if (!spawnFreshSupervisor) {
+  if (!spawnFreshService) {
     return {
       binaryRestored: true,
-      supervisorStopped: true,
-      supervisorRespawned: false,
-      supervisorHealthy: false,
+      serviceStopped: true,
+      serviceRespawned: false,
+      serviceHealthy: false,
       failedStep: "respawn",
-      reason: "no spawnFreshSupervisor callback wired; old supervisor not respawned"
+      reason: "no spawnFreshService callback wired; old service not respawned"
     };
   }
   try {
-    await spawnFreshSupervisor();
+    await spawnFreshService();
   } catch (e) {
     return {
       binaryRestored: true,
-      supervisorStopped: true,
-      supervisorRespawned: false,
-      supervisorHealthy: false,
+      serviceStopped: true,
+      serviceRespawned: false,
+      serviceHealthy: false,
       failedStep: "respawn",
       reason: e instanceof Error ? e.message : String(e)
     };
@@ -33209,53 +33476,53 @@ async function rollbackRestart(slockHome, currentBinaryDir, deps = {}) {
   if (!healthy) {
     return {
       binaryRestored: true,
-      supervisorStopped: true,
-      supervisorRespawned: true,
-      supervisorHealthy: false,
+      serviceStopped: true,
+      serviceRespawned: true,
+      serviceHealthy: false,
       failedStep: "health",
-      reason: "old supervisor failed health check after rollback respawn"
+      reason: "old service failed health check after rollback respawn"
     };
   }
   return {
     binaryRestored: true,
-    supervisorStopped: true,
-    supervisorRespawned: true,
-    supervisorHealthy: true
+    serviceStopped: true,
+    serviceRespawned: true,
+    serviceHealthy: true
   };
 }
 async function restartPhase(slockHome, deps = {}) {
-  const readSupervisorPid = deps.readSupervisorPid ?? (() => defaultReadSupervisorPid(slockHome));
-  const killSupervisor = deps.killSupervisor ?? defaultKillSupervisor;
-  const forceKillSupervisor = deps.forceKillSupervisor ?? defaultForceKillSupervisor;
+  const readServicePid = deps.readServicePid ?? (() => defaultReadServicePid(slockHome));
+  const killService = deps.killService ?? defaultKillService;
+  const forceKillService = deps.forceKillService ?? defaultForceKillService;
   const waitForExit = deps.waitForExit ?? defaultWaitForExit;
-  const spawnFreshSupervisor = deps.spawnFreshSupervisor;
+  const spawnFreshService = deps.spawnFreshService;
   const healthCheck = deps.healthCheck ?? (() => defaultHealthCheck(slockHome));
   const healthTimeoutMs = deps.healthTimeoutMs ?? 3e4;
   const healthPollIntervalMs = deps.healthPollIntervalMs ?? 500;
   const forceKill = deps.forceKill === true;
-  const oldPid = await readSupervisorPid();
+  const oldPid = await readServicePid();
   if (oldPid !== null) {
     try {
       if (forceKill) {
-        await forceKillSupervisor(oldPid);
+        await forceKillService(oldPid);
       } else {
-        await killSupervisor(oldPid);
+        await killService(oldPid);
         const exited = await waitForExit(oldPid, 1e4);
         if (!exited) {
-          await forceKillSupervisor(oldPid);
+          await forceKillService(oldPid);
           const escalatedExit = await waitForExit(oldPid, 5e3);
           if (!escalatedExit) {
-            return { ok: false, reason: "supervisor_kill_failed" };
+            return { ok: false, reason: "service_kill_failed" };
           }
         }
       }
     } catch {
-      return { ok: false, reason: "supervisor_kill_failed" };
+      return { ok: false, reason: "service_kill_failed" };
     }
   }
-  if (spawnFreshSupervisor) {
+  if (spawnFreshService) {
     try {
-      await spawnFreshSupervisor();
+      await spawnFreshService();
     } catch {
       return { ok: false, reason: "spawn_failed" };
     }
@@ -33269,16 +33536,16 @@ async function restartPhase(slockHome, deps = {}) {
   }
   return { ok: false, reason: "health_check_timeout" };
 }
-async function defaultReadSupervisorPid(slockHome) {
+async function defaultReadServicePid(slockHome) {
   try {
-    const raw = (await readFile13(supervisorPidPath(slockHome), "utf8")).trim();
+    const raw = (await readFile14(servicePidPath(slockHome), "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
   }
 }
-async function defaultKillSupervisor(pid) {
+async function defaultKillService(pid) {
   try {
     process.kill(pid, "SIGTERM");
   } catch (err) {
@@ -33286,7 +33553,7 @@ async function defaultKillSupervisor(pid) {
     throw err;
   }
 }
-async function defaultForceKillSupervisor(pid) {
+async function defaultForceKillService(pid) {
   try {
     process.kill(pid, "SIGKILL");
   } catch (err) {
@@ -33310,7 +33577,7 @@ async function defaultWaitForExit(pid, timeoutMs) {
   return false;
 }
 async function defaultHealthCheck(slockHome) {
-  const pid = await defaultReadSupervisorPid(slockHome);
+  const pid = await defaultReadServicePid(slockHome);
   if (pid === null) return false;
   try {
     process.kill(pid, 0);
@@ -33390,6 +33657,18 @@ async function runUpgrade(slockHome, opts) {
       preflight
     };
   }
+  const targetDaemonSpec = preflight.targetSpec;
+  if (typeof targetDaemonSpec !== "string" || targetDaemonSpec.length === 0) {
+    await cleanupStaged(slockHome, opts.targetVersion);
+    return {
+      ok: false,
+      phase: "preflight",
+      reason: `${preflight.detail ?? preflight.reason ?? "dep_drift"}: missing target ${DAEMON_PACKAGE_NAME} spec`,
+      staged,
+      verify,
+      preflight
+    };
+  }
   const snap = {
     at: (/* @__PURE__ */ new Date()).toISOString(),
     fromVersion: opts.fromVersion,
@@ -33440,6 +33719,24 @@ async function runUpgrade(slockHome, opts) {
       verify
     };
   }
+  const hydratedDaemon = await verifyHydratedDaemonDependency(
+    extractedPackageDir,
+    targetDaemonSpec,
+    deps.preflight ?? {}
+  );
+  if (!hydratedDaemon.ok) {
+    await cleanupStaged(slockHome, opts.targetVersion);
+    await clearUpgradeSnapshot(slockHome);
+    return {
+      ok: false,
+      phase: "hydrate",
+      reason: `staged dependency tree verification failed: ${hydratedDaemon.detail ?? hydratedDaemon.reason ?? "hydrated dependency verification failed"}`,
+      staged,
+      verify,
+      preflight,
+      hydratedDaemon
+    };
+  }
   let swap;
   try {
     swap = await swapPhase(opts.currentBinaryDir, extractedPackageDir, {
@@ -33456,11 +33753,11 @@ async function runUpgrade(slockHome, opts) {
     };
   }
   const restart = await restartPhase(slockHome, {
-    readSupervisorPid: deps.readSupervisorPid,
-    killSupervisor: deps.killSupervisor,
-    forceKillSupervisor: deps.forceKillSupervisor,
+    readServicePid: deps.readServicePid,
+    killService: deps.killService,
+    forceKillService: deps.forceKillService,
     waitForExit: deps.waitForExit,
-    spawnFreshSupervisor: deps.spawnFreshSupervisor,
+    spawnFreshService: deps.spawnFreshService,
     healthCheck: deps.healthCheck,
     healthTimeoutMs: deps.healthTimeoutMs,
     healthPollIntervalMs: deps.healthPollIntervalMs,
@@ -33468,12 +33765,12 @@ async function runUpgrade(slockHome, opts) {
   });
   if (!restart.ok) {
     const rb = await rollbackRestart(slockHome, opts.currentBinaryDir, {
-      readSupervisorPid: deps.readSupervisorPid,
+      readServicePid: deps.readServicePid,
       isProcessAlive: deps.isProcessAlive,
-      killSupervisor: deps.killSupervisor,
-      forceKillSupervisor: deps.forceKillSupervisor,
+      killService: deps.killService,
+      forceKillService: deps.forceKillService,
       waitForExit: deps.waitForExit,
-      spawnFreshSupervisor: deps.spawnFreshSupervisor,
+      spawnFreshService: deps.spawnFreshService,
       healthCheck: deps.healthCheck,
       healthTimeoutMs: deps.healthTimeoutMs,
       healthPollIntervalMs: deps.healthPollIntervalMs,
@@ -33488,7 +33785,7 @@ async function runUpgrade(slockHome, opts) {
       verify,
       swap,
       restart,
-      rolledBack: rb.binaryRestored && rb.supervisorHealthy,
+      rolledBack: rb.binaryRestored && rb.serviceHealthy,
       rollback: rb
     };
   }
@@ -33501,12 +33798,12 @@ async function runUpgrade(slockHome, opts) {
   });
   if (!rolling.ok) {
     const rb = await rollbackRestart(slockHome, opts.currentBinaryDir, {
-      readSupervisorPid: deps.readSupervisorPid,
+      readServicePid: deps.readServicePid,
       isProcessAlive: deps.isProcessAlive,
-      killSupervisor: deps.killSupervisor,
-      forceKillSupervisor: deps.forceKillSupervisor,
+      killService: deps.killService,
+      forceKillService: deps.forceKillService,
       waitForExit: deps.waitForExit,
-      spawnFreshSupervisor: deps.spawnFreshSupervisor,
+      spawnFreshService: deps.spawnFreshService,
       healthCheck: deps.healthCheck,
       healthTimeoutMs: deps.healthTimeoutMs,
       healthPollIntervalMs: deps.healthPollIntervalMs,
@@ -33523,12 +33820,12 @@ async function runUpgrade(slockHome, opts) {
       swap,
       restart,
       rolling,
-      rolledBack: rb.binaryRestored && rb.supervisorHealthy,
+      rolledBack: rb.binaryRestored && rb.serviceHealthy,
       rollback: rb
     };
   }
   await cleanupSuccessPhase(slockHome, opts.targetVersion, swap.prevBinaryDir);
-  return { ok: true, phase: "cleanup", staged, verify, swap, restart, rolling };
+  return { ok: true, phase: "cleanup", staged, verify, preflight, hydratedDaemon, swap, restart, rolling };
 }
 async function rollingDaemonHealthCheck(slockHome, deps = {}) {
   const list = deps.listManagedServerIds ?? listManagedServerIds;
@@ -33564,7 +33861,7 @@ async function rollingDaemonHealthCheck(slockHome, deps = {}) {
 }
 async function defaultReadDaemonPid(slockHome, serverId) {
   try {
-    const raw = (await readFile13(serverDaemonPidPath(slockHome, serverId), "utf8")).trim();
+    const raw = (await readFile14(serverDaemonPidPath(slockHome, serverId), "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -33592,7 +33889,7 @@ async function locateStagedTarball(stagedPath) {
 
 // src/upgradeLog.ts
 init_esm_shims();
-import { chmod as chmod5, mkdir as mkdir13, open as open2 } from "fs/promises";
+import { chmod as chmod5, mkdir as mkdir14, open as open2 } from "fs/promises";
 var FILE_MODE = 384;
 var UPGRADE_ERROR_CODES = [
   "UPGRADE_DEPS_CHANGED",
@@ -33637,7 +33934,7 @@ function assertUpgradeLogEntry(entry) {
 }
 async function appendUpgradeLogEntry(slockHome, entry) {
   assertUpgradeLogEntry(entry);
-  await mkdir13(computerDir(slockHome), { recursive: true });
+  await mkdir14(computerDir(slockHome), { recursive: true });
   const path3 = upgradeLogPath(slockHome);
   const at = entry.at ?? formatUpgradeLogTimestamp();
   const fullEntry = { ...entry, at };
@@ -33660,7 +33957,7 @@ function isEphemeralNpxContext(binaryDir) {
 async function readBundledDaemonVersion(binaryDir) {
   try {
     const pkgPath = join7(binaryDir, "package.json");
-    const raw = await readFile14(pkgPath, "utf8");
+    const raw = await readFile15(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     const pinned = parsed.dependencies?.["@slock-ai/daemon"];
     if (typeof pinned !== "string" || pinned.length === 0) return null;
@@ -33670,8 +33967,8 @@ async function readBundledDaemonVersion(binaryDir) {
     return null;
   }
 }
-async function defaultSpawnFreshSupervisor(slockHome) {
-  await spawnDetachedSupervisor(slockHome);
+async function defaultSpawnFreshService(slockHome) {
+  await spawnDetachedService(slockHome);
 }
 async function runUpgradeCli(slockHome, opts, deps = {}) {
   let channel2;
@@ -33771,7 +34068,7 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
     info(`Drain mode: ${drainMode}${drainMode === "force" ? " (in-flight turns will be dropped)" : ""}.`);
   }
   const runUpgradeFn = deps.runUpgradeFn ?? runUpgrade;
-  const spawnFreshSupervisor = deps.spawnFreshSupervisor ?? defaultSpawnFreshSupervisor;
+  const spawnFreshService = deps.spawnFreshService ?? defaultSpawnFreshService;
   const outcome = await runUpgradeFn(slockHome, {
     targetVersion,
     fromVersion,
@@ -33779,12 +34076,12 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
     currentBinaryDir,
     drainMode,
     deps: {
-      // Wire the production supervisor-spawn into BOTH phase 5 (happy)
+      // Wire the production service-spawn into BOTH phase 5 (happy)
       // and the operational-rollback respawn path inside `runUpgrade`.
       // Without this, phase 5 falls through to a no-spawn health-poll
       // and rollback later trips `failedStep="respawn"`. See Dayu
       // blocker (#wg-slock-computer:b43b36fb msg=911eb84e).
-      spawnFreshSupervisor: () => spawnFreshSupervisor(slockHome)
+      spawnFreshService: () => spawnFreshService(slockHome)
     }
   });
   const readBundledFn = deps.readBundledDaemonVersion ?? readBundledDaemonVersion;
@@ -33814,7 +34111,7 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
   }
   if (outcome.phase === "cleanup") {
     info(
-      `Upgrade ${fromVersion} \u2192 ${targetVersion} succeeded; cleanup phase reported a non-fatal issue: ${outcome.reason ?? "unknown"}. Active layout + supervisor are healthy.`
+      `Upgrade ${fromVersion} \u2192 ${targetVersion} succeeded; cleanup phase reported a non-fatal issue: ${outcome.reason ?? "unknown"}. Active layout + service are healthy.`
     );
     await appendUpgradeLogEntry(slockHome, {
       fromBundle: bundle(fromVersion),
@@ -33854,6 +34151,9 @@ function mapFailurePhaseToCode(outcome) {
     case "extract":
       return "UPGRADE_INTEGRITY_FAILED";
     case "hydrate":
+      if (outcome.hydratedDaemon?.ok === false) {
+        return "UPGRADE_INTEGRITY_FAILED";
+      }
       return "UPGRADE_NETWORK_FAILED";
     case "swap":
       return "UPGRADE_SWAP_FAILED";
@@ -33888,12 +34188,12 @@ async function defaultFetchDistTags() {
 }
 function defaultCurrentBinaryDir() {
   const here = fileURLToPath3(import.meta.url);
-  return dirname11(dirname11(here));
+  return dirname12(dirname12(here));
 }
 async function defaultCurrentVersion() {
   const pkgPath = join7(defaultCurrentBinaryDir(), "package.json");
   try {
-    const raw = await readFile14(pkgPath, "utf8");
+    const raw = await readFile15(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -33905,7 +34205,7 @@ async function defaultCurrentVersion() {
 
 // src/upgradeTestHarness.ts
 init_esm_shims();
-import { mkdir as mkdir14, readdir as readdir4, stat as stat3, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir15, readdir as readdir4, stat as stat3, writeFile as writeFile12 } from "fs/promises";
 import { join as join8 } from "path";
 import { createHash as createHash4 } from "crypto";
 var PHASES = /* @__PURE__ */ new Set([
@@ -33964,7 +34264,7 @@ function buildSimulatedDeps(slockHome, opts) {
             return { tarballPath: "", exitCode: 1, stderr: "simulated stage failure" };
           }
           const filename = `slock-ai-computer-${targetVersion}.tgz`;
-          await writeFile11(join8(cwd, filename), tarballBytes);
+          await writeFile12(join8(cwd, filename), tarballBytes);
           return { tarballPath: join8(cwd, filename), exitCode: 0, stderr: "" };
         },
         fetchAdvertisedHash: async () => {
@@ -33976,16 +34276,16 @@ function buildSimulatedDeps(slockHome, opts) {
           if (opts.simulateFail === "extract") {
             return { exitCode: 1, stderr: "simulated extract failure" };
           }
-          await mkdir14(join8(destDir, "package"), { recursive: true });
-          await writeFile11(join8(destDir, "package", "marker.txt"), `NEW@${targetVersion}`);
+          await mkdir15(join8(destDir, "package"), { recursive: true });
+          await writeFile12(join8(destDir, "package", "marker.txt"), `NEW@${targetVersion}`);
           return { exitCode: 0, stderr: "" };
         },
         npmInstall: async () => ({ exitCode: 0, stderr: "" }),
         fsRename: opts.simulateFail === "swap" ? async () => {
           throw new Error("simulated swap failure: fsRename");
         } : void 0,
-        readSupervisorPid: async () => null,
-        spawnFreshSupervisor: async () => {
+        readServicePid: async () => null,
+        spawnFreshService: async () => {
           await maybeSleep();
           spawnCalls += 1;
           if (opts.simulateFail === "restart" && spawnCalls === 1) {
@@ -34038,7 +34338,7 @@ function buildSimulatedDeps(slockHome, opts) {
 }
 async function arrangeSnapshotFailure(slockHome) {
   const snapshotPath = join8(slockHome, "computer", "upgrade-snapshot.json");
-  await mkdir14(snapshotPath, { recursive: true });
+  await mkdir15(snapshotPath, { recursive: true });
 }
 async function pathInfo(path3) {
   try {
@@ -34077,7 +34377,7 @@ async function captureStateSnapshot(slockHome, version, currentBinaryDir) {
     upgradeSnapshot: await pathInfo(upgradeSnapshotPath(slockHome)),
     stagingDir: stagingExists,
     stagingEntries,
-    supervisorPid: await pathInfo(supervisorPidPath(slockHome)),
+    servicePid: await pathInfo(servicePidPath(slockHome)),
     channelFile: await pathInfo(join8(computerDir(slockHome), "channel")),
     computerDir: await pathInfo(computerDir(slockHome)),
     servers,
@@ -34093,12 +34393,12 @@ async function runUpgradeTestHarness(slockHome, opts, writer = (s) => process.st
     process.exitCode = 1;
     return;
   }
-  await mkdir14(slockHome, { recursive: true });
+  await mkdir15(slockHome, { recursive: true });
   if (opts.simulateFail === "snapshot") {
     await arrangeSnapshotFailure(slockHome);
   }
   const { opts: upgradeOpts } = buildSimulatedDeps(slockHome, opts);
-  await mkdir14(upgradeOpts.currentBinaryDir, { recursive: true });
+  await mkdir15(upgradeOpts.currentBinaryDir, { recursive: true });
   let outcome;
   try {
     outcome = await runUpgrade(slockHome, upgradeOpts);
@@ -34136,9 +34436,9 @@ async function runUpgradeTestHarness(slockHome, opts, writer = (s) => process.st
 
 // src/upgradeInstallSmoke.ts
 init_esm_shims();
-import { copyFile, mkdir as mkdir15, readFile as readFile15 } from "fs/promises";
+import { copyFile, mkdir as mkdir16, readFile as readFile16 } from "fs/promises";
 import { createHash as createHash5 } from "crypto";
-import { dirname as dirname12, isAbsolute, join as join9, resolve as pathResolve } from "path";
+import { dirname as dirname13, isAbsolute, join as join9, resolve as pathResolve } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   if (typeof opts.packageTarball !== "string" || opts.packageTarball.trim().length === 0) {
@@ -34147,7 +34447,7 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   const tarballPath = isAbsolute(opts.packageTarball) ? opts.packageTarball : pathResolve(opts.packageTarball);
   let tarballBytes;
   try {
-    tarballBytes = await readFile15(tarballPath);
+    tarballBytes = await readFile16(tarballPath);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     throw new Error(`__upgrade-install-smoke: cannot read --package-tarball ${tarballPath}: ${msg}`);
@@ -34156,10 +34456,10 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   const currentBinaryDir = opts.currentBinaryDir ?? (deps.currentBinaryDir ?? defaultCurrentBinaryDirLocal)();
   const fromVersion = opts.fromVersion ?? await (deps.currentVersion ?? defaultCurrentVersionLocal)();
   const channel2 = opts.channel ?? "latest";
-  const spawnFreshSupervisor = deps.spawnFreshSupervisor ?? (async (h) => {
-    await spawnDetachedSupervisor(h);
+  const spawnFreshService = deps.spawnFreshService ?? (async (h) => {
+    await spawnDetachedService(h);
   });
-  await mkdir15(slockHome, { recursive: true });
+  await mkdir16(slockHome, { recursive: true });
   const outcome = await runUpgrade(slockHome, {
     targetVersion: opts.targetVersion,
     fromVersion,
@@ -34185,7 +34485,7 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
       // dependencies from the registry; this smoke isolates the swap /
       // restart mechanics and keeps dependency hydration out of scope.
       npmInstall: async () => ({ exitCode: 0, stderr: "" }),
-      spawnFreshSupervisor: () => spawnFreshSupervisor(slockHome),
+      spawnFreshService: () => spawnFreshService(slockHome),
       // PR-E 18/n: the workspace-built tarball still carries
       // `workspace:*` (or `file:` after pack-rewrite in some workflows)
       // for `@slock-ai/daemon`, which production preflight rejects as
@@ -34196,7 +34496,7 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
       preflight: { allowUnsafeSpec: true }
     }
   });
-  const activeVersion = await readSupervisorVersionEvidence(slockHome);
+  const activeVersion = await readServiceVersionEvidence(slockHome);
   return { outcome, activeVersion };
 }
 async function runUpgradeInstallSmokeCli(slockHome, opts, writer = (s) => process.stdout.write(s)) {
@@ -34217,12 +34517,12 @@ async function runUpgradeInstallSmokeCli(slockHome, opts, writer = (s) => proces
 }
 function defaultCurrentBinaryDirLocal() {
   const here = fileURLToPath4(import.meta.url);
-  return dirname12(dirname12(here));
+  return dirname13(dirname13(here));
 }
 async function defaultCurrentVersionLocal() {
   const pkgPath = join9(defaultCurrentBinaryDirLocal(), "package.json");
   try {
-    const raw = await readFile15(pkgPath, "utf8");
+    const raw = await readFile16(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -34267,22 +34567,18 @@ program2.name("slock-computer").description("Slock Computer \u2014 local-machine
 program2.command("login").description("Log in via device-code (one user identity per Computer / SLOCK_HOME).").option("--server-url <url>", `Slock API base URL; defaults to SLOCK_SERVER_URL or ${DEFAULT_SLOCK_SERVER_URL}`).action(withCliExit(async (opts) => {
   await runLogin({ serverUrl: opts.serverUrl });
 }));
-program2.command("attach").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Attach this Computer to one Slock server (add-not-replace; multi-server OK).").option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "Computer display name; defaults to a sanitized hostname").option("--no-run", "only authorize + write local state; do not start the supervisor").option("--foreground", "run the supervisor in this terminal instead of the background").action(withCliExit(async (serverSlug, opts) => {
+program2.command("attach").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Attach this Computer to one Slock server (add-not-replace; multi-server OK).").option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "Computer display name; defaults to a sanitized hostname").option("--no-run", "only authorize + write local state; do not start the service").option("--foreground", "run the service in this terminal instead of the background").action(withCliExit(async (serverSlug, opts) => {
   await withMutationLock(
     () => runAttach({ serverSlug, serverUrl: opts.serverUrl, name: opts.name, run: opts.run, foreground: opts.foreground })
   );
 }));
-program2.command("setup").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Set up this Computer for one server: login if needed, attach/adopt if needed, then start.").option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "Computer display name for a new attachment/adoption; defaults to a sanitized hostname").option("--adopt-legacy", "attempt one-time migration from a legacy daemon before fresh attach fallback").option("--legacy-api-key <key>", "legacy key for --adopt-legacy (migration-only; prefer file/stdin)").option("--legacy-api-key-file <path>", "path to a file containing the legacy key for --adopt-legacy").option("--legacy-api-key-stdin", "read the legacy key from stdin for --adopt-legacy").option("--no-start", "stop after login + attach/adopt; do not start the supervisor").option("--foreground", "run the supervisor in this terminal instead of the background").option("-y, --yes", "allow non-interactive setup after confirming the planned actions").action(
+program2.command("setup").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Set up this Computer for one server: login if needed, attach (or \xA7X.1 migrate-prompt) if needed, then start.").option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "Computer display name for a new attachment; defaults to a sanitized hostname").option("--no-start", "stop after login + attach; do not start the service").option("--foreground", "run the service in this terminal instead of the background").option("-y, --yes", "allow non-interactive setup after confirming the planned actions").action(
   withCliExit(async (serverSlug, opts) => {
     await withMutationLock(
       () => runSetup({
         serverSlug,
         serverUrl: opts.serverUrl,
         name: opts.name,
-        adoptLegacy: opts.adoptLegacy,
-        legacyApiKey: opts.legacyApiKey,
-        legacyApiKeyFile: opts.legacyApiKeyFile,
-        legacyApiKeyStdin: opts.legacyApiKeyStdin,
         start: opts.start,
         foreground: opts.foreground,
         yes: opts.yes
@@ -34290,29 +34586,13 @@ program2.command("setup").argument("<serverSlug>", "target Slock server slug (ca
     );
   })
 );
-program2.command("adopt-legacy").argument("<serverSlug>", "target Slock server slug (the legacy machine's server)").description(
-  "One-time migration: trade a legacy sk_machine_* / sk_daemon_* key for a fresh Computer attachment (sk_computer_*)."
-).option("--server-url <url>", `Slock API base URL; defaults to the saved user session, SLOCK_SERVER_URL, or ${DEFAULT_SLOCK_SERVER_URL}`).option("--name <name>", "name to record on the new Computer attachment (default: existing machine name)").option("--legacy-api-key <key>", "raw legacy key on argv (insecure on shared shells; prefer --legacy-api-key-file or stdin)").option("--legacy-api-key-file <path>", "path to a 0600 file containing the legacy key (one line)").option("--legacy-api-key-stdin", "read the legacy key from stdin").action(
-  withCliExit(async (serverSlug, opts) => {
-    await withMutationLock(
-      () => runAdoptLegacy({
-        serverSlug,
-        serverUrl: opts.serverUrl,
-        name: opts.name,
-        legacyApiKey: opts.legacyApiKey,
-        legacyApiKeyFile: opts.legacyApiKeyFile,
-        legacyApiKeyStdin: opts.legacyApiKeyStdin
-      })
-    );
-  })
-);
 program2.command("detach").argument("<serverSlug>", "server slug to detach from this Computer (canonical form `/myserver`)").description("Remove ONE server's local attachment; never touches user-session or other servers.").action(withCliExit(async (serverSlug) => {
   await withMutationLock(async () => runDetach(await resolveTargetServerId({ server: serverSlug }), serverSlug));
 }));
-program2.command("status").description("Show this Computer's aggregate state (login + supervisor + per-server daemons).").option("--json", "emit the machine-readable report").action(withCliExit(async (opts) => {
+program2.command("status").description("Show this Computer's aggregate state (login + service + per-server daemons).").option("--json", "emit the machine-readable report").action(withCliExit(async (opts) => {
   await runStatus({ json: opts.json });
 }));
-program2.command("start").argument("[serverSlug]", "optional: verify this server is attached and ensure its daemon is reconciled (default: ensure all attached)").description("Start/ensure the Computer supervisor (manages all per-server daemons).").option("--foreground", "stay in this terminal instead of detaching").action(withCliExit(async (serverSlug, opts) => {
+program2.command("start").argument("[serverSlug]", "optional: verify this server is attached and ensure its daemon is reconciled (default: ensure all attached)").description("Start/ensure the Computer service (manages all per-server daemons).").option("--foreground", "stay in this terminal instead of detaching").action(withCliExit(async (serverSlug, opts) => {
   await withMutationLock(
     async () => runStart({
       foreground: opts.foreground,
@@ -34321,10 +34601,10 @@ program2.command("start").argument("[serverSlug]", "optional: verify this server
     })
   );
 }));
-program2.command("stop").description("Stop the Computer supervisor (and all managed per-server daemons).").action(withCliExit(async () => {
+program2.command("stop").description("Stop the Computer service (and all managed per-server daemons).").action(withCliExit(async () => {
   await withMutationLock(() => runStop());
 }));
-program2.command("doctor").argument("[serverSlug]", "optional: scope detail (recent crashes) to one server").description("Diagnose login + per-server attachments + per-server preflight (no secrets).").option("--json", "emit the machine-readable report").option("--cleanup", "after diagnosis, run the local residue cleanup pass").option("--fix", "alias for --cleanup (same behavior)").option("--reset-health", "clear <serverSlug>'s crash history so supervisor resumes auto-restart").action(
+program2.command("doctor").argument("[serverSlug]", "optional: scope detail (recent crashes) to one server").description("Diagnose login + per-server attachments + per-server preflight (no secrets).").option("--json", "emit the machine-readable report").option("--cleanup", "after diagnosis, run the local residue cleanup pass").option("--fix", "alias for --cleanup (same behavior)").option("--reset-health", "clear <serverSlug>'s crash history so service resumes auto-restart").action(
   withCliExit(
     async (serverSlug, opts) => {
       const serverId = serverSlug ? await resolveTargetServerId({ server: serverSlug }) : void 0;
@@ -34339,8 +34619,20 @@ program2.command("doctor").argument("[serverSlug]", "optional: scope detail (rec
     }
   )
 );
-program2.command("logs").description("Tail one server's daemon log (or the supervisor log); secrets redacted.").option("--lines <n>", "trailing lines to show (default 200)", (v) => Number.parseInt(v, 10)).option("--server <slug>", "select target server slug (required when \u22652 attached)").option("--supervisor", "tail the global supervisor log instead of a per-server daemon log").action(withCliExit(async (opts) => {
-  await runLogs({ lines: opts.lines, server: opts.server ?? null, supervisor: !!opts.supervisor });
+program2.command("reset").description("Clear a degraded state and resume the service's auto-restart loop.").option("--service", "clear the service-level crash history (cascade record)").option("--runner", "clear a runner's crash history (selected by `--server`)").option("--server <slug>", "with `--runner`, select target server slug (required when \u22652 attached)").option("--json", "emit the machine-readable result").action(
+  withCliExit(async (opts) => {
+    await withMutationLock(
+      () => runReset({
+        service: opts.service,
+        runner: opts.runner,
+        server: opts.server,
+        json: opts.json
+      })
+    );
+  })
+);
+program2.command("logs").description("Tail one server's daemon log (or the service log); secrets redacted.").option("--lines <n>", "trailing lines to show (default 200)", (v) => Number.parseInt(v, 10)).option("--server <slug>", "select target server slug (required when \u22652 attached)").option("--service", "tail the global service log instead of a per-server daemon log").action(withCliExit(async (opts) => {
+  await runLogs({ lines: opts.lines, server: opts.server ?? null, service: !!opts.service });
 }));
 var runners = program2.command("runners").description("Computer runner control plane (per-server scoped; \xA712 whitelist server-side).");
 runners.command("list").description("List runners on one attached server.").option("--json", "emit the machine-readable list").option("--server <slug>", "select target server slug (required when \u22652 attached)").action(withCliExit(async (opts) => {
@@ -34364,9 +34656,8 @@ program2.command("upgrade").description(
   [
     "Auto-upgrade this Computer to the latest version in its channel (or --target-version <semver>).",
     "",
-    "v1 swaps the @slock-ai/computer package root only. Releases that change runtime",
-    "dependency requirements (e.g. @slock-ai/daemon version range) fail closed with",
-    "UPGRADE_DEPS_CHANGED and require manual `npm install -g @slock-ai/computer@<version>`."
+    "Stages the target package, hydrates production dependencies, verifies the",
+    "hydrated @slock-ai/daemon version, then swaps the Computer package root."
   ].join("\n")
 ).option("--dry-run", "stage + verify only; do not swap or restart").option("--channel <name>", "override channel for this invocation (latest | alpha | pinned:<semver>)").option("--target-version <semver>", "override target version explicitly (bypasses channel resolution)").option("--drain <mode>", "\xA72.7 drain mode: drain (default) | defer (abort if daemon busy) | force (SIGKILL, drop in-flight)").option("--force", "alias for --drain force (stuck-daemon recovery; drops in-flight turns)").action(
   withCliExit(
@@ -34421,8 +34712,8 @@ program2.command("upgrade").description(
     }
   )
 );
-program2.command("__supervise", { hidden: true }).action(withCliExit(async () => {
-  await runSupervise();
+program2.command("__service", { hidden: true }).action(withCliExit(async () => {
+  await runService();
 }));
 program2.command("__run", { hidden: true }).argument("<serverId>", "server id this daemon child is bound to").action(withCliExit(async (serverId) => {
   await runResident(serverId);
@@ -34459,21 +34750,6 @@ program2.command("__upgrade-install-smoke", { hidden: true }).requiredOption("--
     );
   })
 );
-{
-  const argv = process.argv.slice(2);
-  const isAdopt = argv[0] === "adopt-legacy";
-  const isSetup = argv[0] === "setup";
-  const strayLegacyFlag = argv.find(
-    (a) => a === "--legacy-api-key" || a.startsWith("--legacy-api-key=") || a === "--legacy-api-key-file" || a.startsWith("--legacy-api-key-file=") || a === "--legacy-api-key-stdin"
-  );
-  if (strayLegacyFlag && !isAdopt && !isSetup) {
-    process.stderr.write(
-      `slock-computer: LEGACY_KEY_OUTSIDE_ADOPT: ${strayLegacyFlag} is only accepted by \`slock-computer adopt-legacy\` or \`slock-computer setup --adopt-legacy\`. Remove it or run an adopt flow.
-`
-    );
-    process.exit(2);
-  }
-}
 program2.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`slock-computer: ${err instanceof Error ? err.message : String(err)}
 `);