@slock-ai/computer 0.0.16-alpha.0 → 0.0.17

package/dist/index.js

@@ -5729,9 +5729,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve2, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve(data);
+              return err ? reject(err) : resolve2(data);
             });
           });
         }
@@ -5769,9 +5769,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve2, reject) => {
             this.destroy(err, (err2, data) => {
-              return err2 ? reject(err2) : resolve(data);
+              return err2 ? reject(err2) : resolve2(data);
             });
           });
         }
@@ -9264,8 +9264,8 @@ var require_promise = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve, reject) => {
-        res = resolve;
+      const promise = new Promise((resolve2, reject) => {
+        res = resolve2;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -10568,12 +10568,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve, reject) => {
+      const waitForDrain = () => new Promise((resolve2, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve;
+          callback = resolve2;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -11419,12 +11419,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve, reject) => {
+      const waitForDrain = () => new Promise((resolve2, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve;
+          callback = resolve2;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -11736,16 +11736,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve) => {
+        return new Promise((resolve2) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve;
+            this[kClosedResolve] = resolve2;
           } else {
-            resolve(null);
+            resolve2(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve) => {
+        return new Promise((resolve2) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -11756,7 +11756,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve(null);
+            resolve2(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -12163,8 +12163,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve) => {
-            this[kClosedResolve] = resolve;
+          return new Promise((resolve2) => {
+            this[kClosedResolve] = resolve2;
           });
         }
       }
@@ -13263,10 +13263,10 @@ var require_socks5_proxy_agent = __commonJS({
         const proxyHost = this[kProxyUrl].hostname;
         const proxyPort = parseInt(this[kProxyUrl].port) || 1080;
         debug("creating SOCKS5 connection to", proxyHost, proxyPort);
-        const socket = await new Promise((resolve, reject) => {
+        const socket = await new Promise((resolve2, reject) => {
           const onConnect = () => {
             socket2.removeListener("error", onError);
-            resolve(socket2);
+            resolve2(socket2);
           };
           const onError = (err) => {
             socket2.removeListener("connect", onConnect);
@@ -13285,14 +13285,14 @@ var require_socks5_proxy_agent = __commonJS({
           socket.destroy();
         });
         await socks5Client.handshake();
-        await new Promise((resolve, reject) => {
+        await new Promise((resolve2, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 authentication timeout"));
           }, 5e3);
           const onAuthenticated = () => {
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve();
+            resolve2();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -13301,14 +13301,14 @@ var require_socks5_proxy_agent = __commonJS({
           };
           if (socks5Client.state === "authenticated") {
             clearTimeout(timeout);
-            resolve();
+            resolve2();
           } else {
             socks5Client.once("authenticated", onAuthenticated);
             socks5Client.once("error", onError);
           }
         });
         await socks5Client.connect(targetHost, targetPort);
-        await new Promise((resolve, reject) => {
+        await new Promise((resolve2, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 connection timeout"));
           }, 5e3);
@@ -13316,7 +13316,7 @@ var require_socks5_proxy_agent = __commonJS({
             debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info2);
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve();
+            resolve2();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -13357,8 +13357,8 @@ var require_socks5_proxy_agent = __commonJS({
                       servername: targetHost,
                       ...connectOpts.tls || {}
                     });
-                    await new Promise((resolve, reject) => {
-                      finalSocket.once("secureConnect", resolve);
+                    await new Promise((resolve2, reject) => {
+                      finalSocket.once("secureConnect", resolve2);
                       finalSocket.once("error", reject);
                     });
                   }
@@ -14389,7 +14389,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit || this[kBytesRead] > limit) {
             this.destroy(new AbortError());
           }
@@ -14403,11 +14403,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError());
               } else {
-                resolve(null);
+                resolve2(null);
               }
             });
           } else {
-            this.on("close", resolve);
+            this.on("close", resolve2);
           }
           this.on("error", noop).on("data", () => {
             if (this[kBytesRead] > limit) {
@@ -14435,7 +14435,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve2, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -14450,7 +14450,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve,
+              resolve: resolve2,
               reject,
               length: 0,
               body: []
@@ -14524,18 +14524,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve, stream, length } = consume2;
+      const { type, body, resolve: resolve2, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve(chunksDecode(body, length, encoding));
+          resolve2(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve2(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve(chunksConcat(body, length).buffer);
+          resolve2(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve(new Blob(body, { type: stream[kContentType] }));
+          resolve2(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve(chunksConcat(body, length));
+          resolve2(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -14726,9 +14726,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -14942,9 +14942,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -15234,9 +15234,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -15330,9 +15330,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -16618,7 +16618,7 @@ var require_snapshot_recorder = __commonJS({
     "use strict";
     init_esm_shims();
     var { writeFile: writeFile13, readFile: readFile17, mkdir: mkdir17 } = __require("fs/promises");
-    var { dirname: dirname14, resolve } = __require("path");
+    var { dirname: dirname14, resolve: resolve2 } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError: InvalidArgumentError2, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -16819,7 +16819,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile17(resolve(path3), "utf8");
+          const data = await readFile17(resolve2(path3), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -16848,7 +16848,7 @@ var require_snapshot_recorder = __commonJS({
         if (!path3) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path3);
+        const resolvedPath = resolve2(path3);
         await mkdir17(dirname14(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
@@ -23714,7 +23714,7 @@ var require_fetch = __commonJS({
         const agent = fetchParams.controller.dispatcher;
         const path3 = url.pathname + url.search;
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
-        return new Promise((resolve, reject) => agent.dispatch(
+        return new Promise((resolve2, reject) => agent.dispatch(
           {
             path: hasTrailingQuestionMark ? `${path3}?` : path3,
             origin: url.origin,
@@ -23802,7 +23802,7 @@ var require_fetch = __commonJS({
                 }
               }
               const onError = this.onError.bind(this);
-              resolve({
+              resolve2({
                 status,
                 statusText,
                 headersList,
@@ -23855,7 +23855,7 @@ var require_fetch = __commonJS({
                   headersList.append(headerName, String(value), true);
                 }
               }
-              resolve({
+              resolve2({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -23879,7 +23879,7 @@ var require_fetch = __commonJS({
                   headersList.append(nameStr, value.toString("latin1"), true);
                 }
               }
-              resolve({
+              resolve2({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -29193,11 +29193,11 @@ var require_mtime_precision = __commonJS({
     function probe(file, fs, callback) {
       const cachedPrecision = fs[cacheSymbol];
       if (cachedPrecision) {
-        return fs.stat(file, (err, stat4) => {
+        return fs.stat(file, (err, stat5) => {
           if (err) {
             return callback(err);
           }
-          callback(null, stat4.mtime, cachedPrecision);
+          callback(null, stat5.mtime, cachedPrecision);
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
@@ -29205,13 +29205,13 @@ var require_mtime_precision = __commonJS({
         if (err) {
           return callback(err);
         }
-        fs.stat(file, (err2, stat4) => {
+        fs.stat(file, (err2, stat5) => {
           if (err2) {
             return callback(err2);
           }
-          const precision = stat4.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
+          const precision = stat5.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
           Object.defineProperty(fs, cacheSymbol, { value: precision });
-          callback(null, stat4.mtime, precision);
+          callback(null, stat5.mtime, precision);
         });
       });
     }
@@ -29266,14 +29266,14 @@ var require_lockfile = __commonJS({
         if (options.stale <= 0) {
           return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
         }
-        options.fs.stat(lockfilePath, (err2, stat4) => {
+        options.fs.stat(lockfilePath, (err2, stat5) => {
           if (err2) {
             if (err2.code === "ENOENT") {
               return acquireLock(file, { ...options, stale: 0 }, callback);
             }
             return callback(err2);
           }
-          if (!isLockStale(stat4, options)) {
+          if (!isLockStale(stat5, options)) {
             return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
           }
           removeLock(file, options, (err3) => {
@@ -29285,8 +29285,8 @@ var require_lockfile = __commonJS({
         });
       });
     }
-    function isLockStale(stat4, options) {
-      return stat4.mtime.getTime() < Date.now() - options.stale;
+    function isLockStale(stat5, options) {
+      return stat5.mtime.getTime() < Date.now() - options.stale;
     }
     function removeLock(file, options, callback) {
       options.fs.rmdir(getLockFile(file, options), (err) => {
@@ -29304,7 +29304,7 @@ var require_lockfile = __commonJS({
       lock2.updateDelay = lock2.updateDelay || options.update;
       lock2.updateTimeout = setTimeout(() => {
         lock2.updateTimeout = null;
-        options.fs.stat(lock2.lockfilePath, (err, stat4) => {
+        options.fs.stat(lock2.lockfilePath, (err, stat5) => {
           const isOverThreshold = lock2.lastUpdate + options.stale < Date.now();
           if (err) {
             if (err.code === "ENOENT" || isOverThreshold) {
@@ -29313,7 +29313,7 @@ var require_lockfile = __commonJS({
             lock2.updateDelay = 1e3;
             return updateLock(file, options);
           }
-          const isMtimeOurs = lock2.mtime.getTime() === stat4.mtime.getTime();
+          const isMtimeOurs = lock2.mtime.getTime() === stat5.mtime.getTime();
           if (!isMtimeOurs) {
             return setLockAsCompromised(
               file,
@@ -29438,11 +29438,11 @@ var require_lockfile = __commonJS({
         if (err) {
           return callback(err);
         }
-        options.fs.stat(getLockFile(file2, options), (err2, stat4) => {
+        options.fs.stat(getLockFile(file2, options), (err2, stat5) => {
           if (err2) {
             return err2.code === "ENOENT" ? callback(null, false) : callback(err2);
           }
-          return callback(null, !isLockStale(stat4, options));
+          return callback(null, !isLockStale(stat5, options));
         });
       });
     }
@@ -29489,12 +29489,12 @@ var require_adapter = __commonJS({
       return newFs;
     }
     function toPromise(method) {
-      return (...args) => new Promise((resolve, reject) => {
+      return (...args) => new Promise((resolve2, reject) => {
         args.push((err, result) => {
           if (err) {
             reject(err);
           } else {
-            resolve(result);
+            resolve2(result);
           }
         });
         method(...args);
@@ -29799,6 +29799,52 @@ var ComputerAttachClient = class {
     return { ok: false, code };
   }
 };
+var LegacyMachinesClient = class {
+  constructor(baseUrl, accessToken) {
+    this.baseUrl = baseUrl;
+    this.accessToken = accessToken;
+  }
+  url(p) {
+    return new URL(p, this.baseUrl).toString();
+  }
+  async list(serverSlug) {
+    let res;
+    try {
+      res = await (0, import_undici.fetch)(
+        this.url(`/api/computer/legacy-machines?serverSlug=${encodeURIComponent(serverSlug)}`),
+        {
+          method: "GET",
+          headers: { Authorization: `Bearer ${this.accessToken}` }
+        }
+      );
+    } catch {
+      return { status: "error", code: "request_failed" };
+    }
+    const body = await res.json().catch(() => null);
+    if (res.status === 200 && body && Array.isArray(body.entries)) {
+      const entries = body.entries.map((raw) => {
+        if (!raw || typeof raw !== "object") return null;
+        const e = raw;
+        if (typeof e.daemonId !== "string" || typeof e.apiKeyFingerprint !== "string" || typeof e.machineName !== "string") {
+          return null;
+        }
+        return {
+          daemonId: e.daemonId,
+          apiKeyFingerprint: e.apiKeyFingerprint,
+          machineName: e.machineName,
+          hostname: typeof e.hostname === "string" ? e.hostname : null,
+          lastSeenAt: typeof e.lastSeenAt === "string" ? e.lastSeenAt : null
+        };
+      }).filter((entry) => entry !== null);
+      return { status: "success", entries };
+    }
+    if (res.status === 401) return { status: "auth_required" };
+    if (res.status === 403) return { status: "not_authorized" };
+    if (res.status === 404) return { status: "disabled" };
+    const code = body && typeof body.code === "string" ? body.code : `http_${res.status}`;
+    return { status: "error", code };
+  }
+};
 var RunnersClient = class {
   constructor(baseUrl, computerApiKey) {
     this.baseUrl = baseUrl;
@@ -29879,11 +29925,11 @@ function serverDir(slockHome, serverId) {
 function serverAttachmentPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "runner.state.json");
 }
-function serverDaemonPidPath(slockHome, serverId) {
-  return path2.join(serverDir(slockHome, serverId), "daemon.pid");
+function serverRunnerPidPath(slockHome, serverId) {
+  return path2.join(serverDir(slockHome, serverId), "server-runner.pid");
 }
-function serverDaemonLogPath(slockHome, serverId) {
-  return path2.join(serverDir(slockHome, serverId), "daemon.log");
+function serverRunnerLogPath(slockHome, serverId) {
+  return path2.join(serverDir(slockHome, serverId), "server-runner.log");
 }
 function serverManagedFlagPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "managed.flag");
@@ -29891,17 +29937,30 @@ function serverManagedFlagPath(slockHome, serverId) {
 function serverHealthPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "health.json");
 }
+function serviceRunDir(slockHome) {
+  return path2.join(computerDir(slockHome), "run");
+}
 function serviceStatePath(slockHome) {
-  return path2.join(computerDir(slockHome), "service.state.json");
+  return path2.join(serviceRunDir(slockHome), "service.state.json");
 }
 function servicePidPath(slockHome) {
+  return path2.join(serviceRunDir(slockHome), "service.pid");
+}
+function legacyServicePidPath(slockHome) {
   return path2.join(computerDir(slockHome), "service.pid");
 }
 function legacySupervisorPidPath(slockHome) {
   return path2.join(computerDir(slockHome), "supervisor.pid");
 }
+function servicePidReadFallback(slockHome) {
+  return [
+    servicePidPath(slockHome),
+    legacyServicePidPath(slockHome),
+    legacySupervisorPidPath(slockHome)
+  ];
+}
 function serviceLogPath(slockHome) {
-  return path2.join(computerDir(slockHome), "service.log");
+  return path2.join(serviceRunDir(slockHome), "service.log");
 }
 function serviceVersionPath(slockHome) {
   return path2.join(computerDir(slockHome), "service-version.json");
@@ -29962,14 +30021,14 @@ function resolveServerUrl(...candidates) {
 
 // src/services/login.ts
 function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     if (signal?.aborted) {
       reject(abortError(signal));
       return;
     }
     const t = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     const onAbort = () => {
       clearTimeout(t);
@@ -30390,68 +30449,153 @@ import { dirname as dirname9 } from "path";
 
 // src/lib/migration.ts
 init_esm_shims();
-import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
-import { join } from "path";
+import { readdir as readdir2, readFile as readFile3, stat } from "fs/promises";
+import { join, resolve } from "path";
 var MACHINE_DIR_PREFIX = "machine-";
-async function readOwnerEvidence(installRoot, machineDirName) {
-  const ownerFile = join(
-    installRoot,
-    "machines",
-    machineDirName,
-    "daemon.lock",
-    "owner.json"
-  );
+var FINGERPRINT_HEX_RE = /^[0-9a-f]{16}$/;
+async function readLocalOwners(installRoot) {
+  const machinesDir = join(installRoot, "machines");
+  let entries;
+  try {
+    entries = await readdir2(machinesDir);
+  } catch {
+    return [];
+  }
+  const owners = [];
+  for (const name of entries) {
+    if (!name.startsWith(MACHINE_DIR_PREFIX)) continue;
+    const ownerPath = join(machinesDir, name, "daemon.lock", "owner.json");
+    let raw;
+    try {
+      raw = await readFile3(ownerPath, "utf8");
+    } catch {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    const fp = parsed.apiKeyFingerprint;
+    if (typeof fp !== "string" || !FINGERPRINT_HEX_RE.test(fp)) continue;
+    owners.push({ apiKeyFingerprint: fp, localPath: ownerPath });
+  }
+  return owners;
+}
+function indexLocalByFingerprint(owners) {
+  const map = /* @__PURE__ */ new Map();
+  for (const owner of owners) {
+    if (!map.has(owner.apiKeyFingerprint)) {
+      map.set(owner.apiKeyFingerprint, owner);
+    }
+  }
+  return map;
+}
+function intersect(localByFp, roster) {
+  const out = [];
+  for (const entry of roster) {
+    const local = localByFp.get(entry.apiKeyFingerprint);
+    if (!local) continue;
+    out.push({
+      apiKeyFingerprint: entry.apiKeyFingerprint,
+      daemonId: entry.daemonId,
+      localPath: local.localPath,
+      machineName: entry.machineName,
+      ...entry.hostname ? { hostname: entry.hostname } : {},
+      ...entry.lastSeenAt ? { lastSeenAt: entry.lastSeenAt } : {}
+    });
+  }
+  out.sort((a, b) => {
+    const aSeen = a.lastSeenAt ?? "";
+    const bSeen = b.lastSeenAt ?? "";
+    if (aSeen !== bSeen) {
+      if (aSeen === "") return 1;
+      if (bSeen === "") return -1;
+      return aSeen < bSeen ? 1 : -1;
+    }
+    return a.apiKeyFingerprint < b.apiKeyFingerprint ? -1 : a.apiKeyFingerprint > b.apiKeyFingerprint ? 1 : 0;
+  });
+  return out;
+}
+async function detectLegacyMigration(installRoot, serverSlug, client) {
+  const localOwners = await readLocalOwners(installRoot);
+  if (localOwners.length === 0) {
+    return { kind: "candidates", candidates: [] };
+  }
+  const result = await client.list(serverSlug);
+  if (result.status !== "success") {
+    return { kind: "server-unavailable" };
+  }
+  const localByFp = indexLocalByFingerprint(localOwners);
+  return { kind: "candidates", candidates: intersect(localByFp, result.entries) };
+}
+async function validateManualMigratePath(inputPath, roster) {
+  const absInput = resolve(inputPath);
+  let stats;
+  try {
+    stats = await stat(absInput);
+  } catch {
+    return { ok: false, code: "MIGRATE_FROM_NOT_FOUND" };
+  }
+  const ownerPath = stats.isDirectory() ? join(absInput, "daemon.lock", "owner.json") : absInput;
+  const candidateOwnerPath = await firstReadableOwner([
+    ownerPath,
+    join(absInput, "owner.json"),
+    absInput
+  ]);
+  if (!candidateOwnerPath) {
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
+  }
   let raw;
   try {
-    raw = await readFile3(ownerFile, "utf8");
+    raw = await readFile3(candidateOwnerPath, "utf8");
   } catch {
-    return {};
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return {};
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
   }
-  const machineName = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : void 0;
-  const serverUrl = typeof parsed.serverUrl === "string" && parsed.serverUrl.length > 0 ? parsed.serverUrl : void 0;
-  return { machineName, serverUrl };
-}
-async function detectLegacyMigration(installRoot, loggedInUserId) {
-  void loggedInUserId;
-  const machinesDir = join(installRoot, "machines");
-  let entries;
-  try {
-    entries = await readdir2(machinesDir);
-  } catch {
-    return { kind: "no-match" };
+  const fp = parsed.apiKeyFingerprint;
+  if (typeof fp !== "string" || !FINGERPRINT_HEX_RE.test(fp)) {
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
   }
-  const candidates = [];
-  for (const name of entries) {
-    if (!name.startsWith(MACHINE_DIR_PREFIX)) continue;
-    const evidence = await readOwnerEvidence(installRoot, name);
-    candidates.push({
-      machineId: name,
-      machineName: evidence.machineName,
-      serverUrl: evidence.serverUrl
-    });
+  const match = roster.find((r) => r.apiKeyFingerprint === fp);
+  if (!match) {
+    return { ok: false, code: "MIGRATE_FROM_NOT_OWNED" };
   }
-  if (candidates.length === 0) return { kind: "no-match" };
-  if (candidates.length === 1) {
-    const only = candidates[0];
-    return {
-      kind: "match",
-      machineId: only.machineId,
-      machineName: only.machineName,
-      serverUrl: only.serverUrl
-    };
+  return {
+    ok: true,
+    candidate: {
+      apiKeyFingerprint: match.apiKeyFingerprint,
+      daemonId: match.daemonId,
+      localPath: candidateOwnerPath,
+      machineName: match.machineName,
+      ...match.hostname ? { hostname: match.hostname } : {},
+      ...match.lastSeenAt ? { lastSeenAt: match.lastSeenAt } : {}
+    }
+  };
+}
+async function firstReadableOwner(paths) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of paths) {
+    if (seen.has(p)) continue;
+    seen.add(p);
+    try {
+      const st = await stat(p);
+      if (st.isFile()) return p;
+    } catch {
+    }
   }
-  return { kind: "ambiguous", candidates };
+  return null;
 }
 
 // src/services/adoptLegacy.ts
 init_esm_shims();
-import { chmod as chmod3, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4, appendFile, stat } from "fs/promises";
+import { chmod as chmod3, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4, appendFile, stat as stat2 } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
 import { dirname as dirname4, join as join2 } from "path";
 import { setTimeout as delay } from "timers/promises";
@@ -30794,7 +30938,7 @@ async function appendAdoptionLog(slockHome, line) {
     const path3 = adoptionLogPath(slockHome);
     await appendFile(path3, fields.join(" ") + "\n", { mode: 384 });
     try {
-      const st = await stat(path3);
+      const st = await stat2(path3);
       if ((st.mode & 63) !== 0) await chmod3(path3, 384);
     } catch {
     }
@@ -30811,7 +30955,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/cleanup.ts
 init_esm_shims();
-import { readdir as readdir3, stat as stat2, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
+import { readdir as readdir3, stat as stat3, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
 import { spawn } from "child_process";
 import { join as join3 } from "path";
 
@@ -30877,7 +31021,7 @@ async function cleanupAllStalePidfiles(slockHome) {
   }
   const attached = await listAttachedServerIds(slockHome);
   for (const sid of attached) {
-    const p = serverDaemonPidPath(slockHome, sid);
+    const p = serverRunnerPidPath(slockHome, sid);
     if (await cleanupStalePidfile(p)) cleaned.push(p);
   }
   return cleaned;
@@ -30905,7 +31049,7 @@ async function readPsTable(psSpawn = defaultPsSpawn) {
   }
 }
 function defaultPsSpawn() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn("ps", ["-o", "pid,ppid,comm", "-A"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -30913,8 +31057,8 @@ function defaultPsSpawn() {
     child.stdout.on("data", (chunk) => {
       out += String(chunk);
     });
-    child.on("error", () => resolve({ stdout: "", exitCode: 1 }));
-    child.on("close", (code) => resolve({ stdout: out, exitCode: code ?? 1 }));
+    child.on("error", () => resolve2({ stdout: "", exitCode: 1 }));
+    child.on("close", (code) => resolve2({ stdout: out, exitCode: code ?? 1 }));
   });
 }
 async function cleanupOrphanProcesses(slockHome, psSpawn) {
@@ -30925,7 +31069,7 @@ async function cleanupOrphanProcesses(slockHome, psSpawn) {
   const supPid = await readPidfileAt(servicePidPath(slockHome));
   if (supPid !== null) knownPids.add(supPid);
   for (const sid of managed) {
-    const pid = await readPidfileAt(serverDaemonPidPath(slockHome, sid));
+    const pid = await readPidfileAt(serverRunnerPidPath(slockHome, sid));
     if (pid !== null) knownPids.add(pid);
   }
   if (supPid === null) return signaled;
@@ -30993,7 +31137,7 @@ async function cleanupTmpFiles(slockHome) {
     for (const v of versions) {
       const vdir = join3(stagingDir, v);
       try {
-        const s = await stat2(vdir);
+        const s = await stat3(vdir);
         if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
           await rm(vdir, { recursive: true, force: true });
           removed.push(vdir);
@@ -31010,7 +31154,7 @@ async function cleanupTmpFiles(slockHome) {
   }
   const snap = join3(cdir, "upgrade-snapshot.json");
   try {
-    const s = await stat2(snap);
+    const s = await stat3(snap);
     if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
       await unlink3(snap);
       removed.push(snap);
@@ -31022,7 +31166,7 @@ async function cleanupTmpFiles(slockHome) {
 async function cleanupStaleLock(slockHome) {
   const lockDir = join3(computerDir(slockHome), ".lock");
   try {
-    const s = await stat2(lockDir);
+    const s = await stat3(lockDir);
     if (Date.now() - s.mtimeMs > 60 * 1e3) {
       await rm(lockDir, { recursive: true, force: true });
       return [lockDir];
@@ -31034,7 +31178,7 @@ async function cleanupStaleLock(slockHome) {
 async function forceReleaseLock(slockHome) {
   const lockDir = join3(computerDir(slockHome), ".lock");
   try {
-    await stat2(lockDir);
+    await stat3(lockDir);
     await rm(lockDir, { recursive: true, force: true });
     return [lockDir];
   } catch {
@@ -31168,6 +31312,50 @@ async function emitRunnerStateTransition(slockHome, serverId, fromState, toState
 
 // src/services/start.ts
 init_esm_shims();
+
+// src/internal/service-pid-fallback.ts
+init_esm_shims();
+async function findLiveServicePid(slockHome, deps = {}) {
+  const readPidfile = deps.readPidfile ?? readPidfileAt;
+  const isAlive = deps.isProcessAlive ?? isProcessAlive2;
+  const clearStale = deps.clearPidfile ?? clearPidfileAt;
+  return walkFallback(slockHome, readPidfile, isAlive, clearStale);
+}
+async function findLiveServicePidReadOnly(slockHome, deps = {}) {
+  const readPidfile = deps.readPidfile ?? readPidfileAt;
+  const isAlive = deps.isProcessAlive ?? isProcessAlive2;
+  return walkFallback(slockHome, readPidfile, isAlive, async () => void 0);
+}
+async function walkFallback(slockHome, readPidfile, isAlive, clearStale) {
+  const candidates = servicePidReadFallback(slockHome);
+  let firstStalePidfile = null;
+  let firstStalePid = null;
+  for (const candidate of candidates) {
+    const candidatePid = await readPidfile(candidate);
+    if (candidatePid === null) continue;
+    if (isAlive(candidatePid)) {
+      return {
+        pid: candidatePid,
+        pidfilePath: candidate,
+        firstStalePidfile,
+        firstStalePid
+      };
+    }
+    await clearStale(candidate);
+    if (firstStalePidfile === null) {
+      firstStalePidfile = candidate;
+      firstStalePid = candidatePid;
+    }
+  }
+  return {
+    pid: null,
+    pidfilePath: candidates[0],
+    firstStalePidfile,
+    firstStalePid
+  };
+}
+
+// src/services/start.ts
 var START_ENSURE_TIMEOUT_MS = 15e3;
 var START_ENSURE_POLL_INTERVAL_MS = 100;
 function emit4(opts, event) {
@@ -31181,7 +31369,7 @@ function emit4(opts, event) {
 async function waitForManagedDaemonPids(slockHome, serverIds, opts) {
   const readPidfile = opts.readPidfile ?? readPidfileAt;
   const isAlive = opts.isProcessAlive ?? isProcessAlive2;
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const timeoutMs = opts.ensureTimeoutMs ?? START_ENSURE_TIMEOUT_MS;
   const pollIntervalMs = opts.ensurePollIntervalMs ?? START_ENSURE_POLL_INTERVAL_MS;
   const deadline = Date.now() + timeoutMs;
@@ -31189,7 +31377,7 @@ async function waitForManagedDaemonPids(slockHome, serverIds, opts) {
   while (ready.size < serverIds.length) {
     for (const serverId of serverIds) {
       if (ready.has(serverId)) continue;
-      const pid = await readPidfile(serverDaemonPidPath(slockHome, serverId));
+      const pid = await readPidfile(serverRunnerPidPath(slockHome, serverId));
       if (pid && isAlive(pid)) ready.set(serverId, pid);
     }
     if (ready.size === serverIds.length) return ready;
@@ -31201,8 +31389,8 @@ async function waitForManagedDaemonPids(slockHome, serverIds, opts) {
 }
 function buildTimeoutMessage(slockHome, serverIds, ready, input) {
   const missing = serverIds.filter((id) => !ready.has(id));
-  const target = input.serverId && missing.length === 1 ? `${input.serverLabel ?? input.serverId}` : `${missing.length} daemon(s): ${missing.join(", ")}`;
-  return `Timed out waiting for ${target} to start. Run \`slock-computer status\` and inspect ${serviceLogPath(slockHome)} plus per-server daemon logs under ~/.slock/computer/servers/<serverId>/daemon.log.`;
+  const target = input.serverId && missing.length === 1 ? `${input.serverLabel ?? input.serverId}` : `${missing.length} server runner(s): ${missing.join(", ")}`;
+  return `Timed out waiting for ${target} to start. Run \`slock-computer status\` and inspect ${serviceLogPath(slockHome)} plus per-server server-runner logs under ~/.slock/computer/servers/<serverId>/server-runner.log.`;
 }
 async function start(input, options = {}) {
   options.signal?.throwIfAborted?.();
@@ -31230,8 +31418,11 @@ async function start(input, options = {}) {
   for (const id of managedTargets) {
     await setServerManaged(slockHome, id);
   }
-  const existing = await readPidfileAt(servicePidPath(slockHome));
-  if (existing && isProcessAlive2(existing)) {
+  const { pid: existing } = await findLiveServicePid(slockHome, {
+    readPidfile: options.readPidfile,
+    isProcessAlive: options.isProcessAlive
+  });
+  if (existing !== null) {
     emit4(options, {
       type: "already_running",
       servicePid: existing,
@@ -31327,7 +31518,7 @@ async function pollReadyOnce(slockHome, serverIds, opts) {
   const isAlive = opts.isProcessAlive ?? isProcessAlive2;
   const ready = /* @__PURE__ */ new Map();
   for (const serverId of serverIds) {
-    const pid = await readPidfile(serverDaemonPidPath(slockHome, serverId));
+    const pid = await readPidfile(serverRunnerPidPath(slockHome, serverId));
     if (pid && isAlive(pid)) ready.set(serverId, pid);
   }
   return ready;
@@ -31354,29 +31545,26 @@ async function stop(input = {}, options = {}) {
   const killer = options.killService ?? ((pid2) => {
     process.kill(pid2, "SIGTERM");
   });
-  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const pollIntervalMs = options.pollIntervalMs ?? STOP_POLL_INTERVAL_MS;
   const timeoutMs = options.timeoutMs ?? STOP_TIMEOUT_MS;
-  let pidfilePath = servicePidPath(slockHome);
-  let pid = await readPidfile(pidfilePath);
-  if (pid === null) {
-    const legacyPidfilePath = legacySupervisorPidPath(slockHome);
-    const legacyPid = await readPidfile(legacyPidfilePath);
-    if (legacyPid !== null) {
-      pidfilePath = legacyPidfilePath;
-      pid = legacyPid;
-    }
-  }
+  const { pid, pidfilePath, firstStalePidfile, firstStalePid } = await findLiveServicePid(slockHome, {
+    readPidfile,
+    isProcessAlive: isAlive
+  });
   emit5(options, { type: "stopping", pid });
   if (pid === null) {
+    if (firstStalePidfile !== null && firstStalePid !== null) {
+      emit5(options, { type: "stale_pidfile_cleared", pid: firstStalePid });
+      return {
+        status: "stale_pidfile_cleared",
+        pid: firstStalePid,
+        pidfilePath: firstStalePidfile
+      };
+    }
     emit5(options, { type: "not_running" });
     return { status: "not_running", pid: null, pidfilePath };
   }
-  if (!isAlive(pid)) {
-    await clearPidfileAt(pidfilePath);
-    emit5(options, { type: "stale_pidfile_cleared", pid });
-    return { status: "stale_pidfile_cleared", pid, pidfilePath };
-  }
   options.signal?.throwIfAborted?.();
   try {
     killer(pid);
@@ -31504,8 +31692,8 @@ async function detach(input, options = {}) {
   await clearServerManaged(slockHome, serverId);
   const subtree = [
     serverAttachmentPath(slockHome, serverId),
-    serverDaemonPidPath(slockHome, serverId),
-    serverDaemonLogPath(slockHome, serverId)
+    serverRunnerPidPath(slockHome, serverId),
+    serverRunnerLogPath(slockHome, serverId)
   ];
   for (const p of subtree) await clearPidfileAt(p);
   emit6(options, { type: "subtree_cleared", serverId, serverLabel });
@@ -31526,7 +31714,7 @@ function buildResidentSpawn(mode, serverId, selfEntry = process.argv[1] ?? "", e
 }
 var PARENT_LOCK_HELD_ENV_VAR = "SLOCK_COMPUTER_PARENT_MUTATION_LOCK_HELD";
 async function spawnDetachedService(slockHome) {
-  await mkdir8(computerDir(slockHome), { recursive: true });
+  await mkdir8(serviceRunDir(slockHome), { recursive: true });
   const supLogFd = await open(serviceLogPath(slockHome), "a");
   const { command, args } = buildResidentSpawn("__service", null);
   const child = spawn2(command, args, {
@@ -31703,14 +31891,14 @@ async function readServiceVersionEvidence(slockHome) {
 }
 async function runService() {
   const slockHome = resolveSlockHome();
-  await mkdir8(computerDir(slockHome), { recursive: true });
+  await mkdir8(serviceRunDir(slockHome), { recursive: true });
   await runServiceStartupRecovery(slockHome);
   await writePidfileAt(servicePidPath(slockHome), process.pid);
   await writeServiceVersionEvidence(slockHome);
   const children = /* @__PURE__ */ new Map();
   const { [PARENT_LOCK_HELD_ENV_VAR]: _parentLockMarker, ...childEnv } = process.env;
   const spawnChild = async (serverId) => {
-    const logPath = serverDaemonLogPath(slockHome, serverId);
+    const logPath = serverRunnerLogPath(slockHome, serverId);
     await mkdir8(dirname8(logPath), { recursive: true });
     const logFd = await open(logPath, "a");
     const { command, args } = buildResidentSpawn("__run", serverId);
@@ -31723,11 +31911,11 @@ async function runService() {
     if (!child.pid) return;
     const handle = { serverId, child, stopping: false };
     children.set(serverId, handle);
-    await writePidfileAt(serverDaemonPidPath(slockHome, serverId), child.pid);
+    await writePidfileAt(serverRunnerPidPath(slockHome, serverId), child.pid);
     child.on("exit", (code, signal) => {
       void (async () => {
         children.delete(serverId);
-        await clearPidfileAt(serverDaemonPidPath(slockHome, serverId));
+        await clearPidfileAt(serverRunnerPidPath(slockHome, serverId));
         if (handle.stopping) return;
         const classification = classifyRunnerExit(code, signal);
         if (classification === "config-error") {
@@ -31736,7 +31924,7 @@ async function runService() {
           } catch {
           }
           process.stderr.write(
-            `Service: server ${serverId} child exited with EX_CONFIG (${EX_CONFIG_EXIT_CODE}); marked degraded, NOT auto-restarting. See ${serverDaemonLogPath(slockHome, serverId)} for the actionable error.
+            `Service: server ${serverId} child exited with EX_CONFIG (${EX_CONFIG_EXIT_CODE}); marked degraded, NOT auto-restarting. See ${serverRunnerLogPath(slockHome, serverId)} for the actionable error.
 `
           );
           return;
@@ -31847,7 +32035,7 @@ async function runStart(opts = {}, deps = {}) {
     info(
       `Managing ${sb.managedCount} of ${sb.attachedCount} attached server(s). Logs: ${sb.logPath}`
     );
-    info(`Per-server daemon logs: ~/.slock/computer/servers/<serverId>/daemon.log`);
+    info(`Per-server server-runner logs: ~/.slock/computer/servers/<serverId>/server-runner.log`);
     info(`Check state with \`slock-computer status\`.`);
   }
 }
@@ -31910,12 +32098,15 @@ async function runDetach(serverId, serverLabel = serverId) {
 
 // src/setup.ts
 var USER_SESSION_EXPIRY_LEEWAY_MS = 3e4;
-async function readUserSessionUserId(slockHome) {
+async function readUserSessionAuth(slockHome) {
   try {
     const parsed = JSON.parse(await readFile8(userSessionPath(slockHome), "utf8"));
-    return typeof parsed.userId === "string" ? parsed.userId : "";
+    return {
+      accessToken: typeof parsed.accessToken === "string" ? parsed.accessToken : "",
+      ...typeof parsed.serverUrl === "string" ? { serverUrl: parsed.serverUrl } : {}
+    };
   } catch {
-    return "";
+    return { accessToken: "" };
   }
 }
 async function hasValidUserSession(slockHome) {
@@ -31985,15 +32176,60 @@ async function refreshUserSession(slockHome, serverUrl) {
     return false;
   }
 }
-async function defaultConfirmMigrate(prompt) {
-  process.stdout.write(prompt);
-  const line = await readLine(false);
-  const norm = line.trim().toLowerCase();
-  return norm === "y" || norm === "yes";
+async function pickMigrationCandidateFromInput(candidates, read, write) {
+  write(
+    "Migration: detected legacy daemon(s) on this Computer that match the target server.\n"
+  );
+  candidates.forEach((c, i) => {
+    const host = c.hostname ? ` (${c.hostname})` : "";
+    const seen = c.lastSeenAt ? ` last seen ${c.lastSeenAt}` : "";
+    write(`  ${i + 1}. ${c.machineName}${host}${seen}
+`);
+    write(`     local: ${c.localPath}
+`);
+  });
+  write("  0. Fresh attach (skip migration)\n");
+  write("  m. Migrate from a different on-disk path\n");
+  while (true) {
+    write("Choose [1]: ");
+    const { line, eof } = await read();
+    if (eof) return { kind: "fresh" };
+    const trimmed = line.trim();
+    const norm = trimmed.toLowerCase();
+    if (norm === "m") {
+      write("Path to legacy machine dir or owner.json: ");
+      const { line: pathLine } = await read();
+      return { kind: "manual", path: pathLine.trim() };
+    }
+    if (norm.length === 0) return { kind: "candidate", index: 0 };
+    if (norm === "0") return { kind: "fresh" };
+    const n = Number.parseInt(norm, 10);
+    if (Number.isFinite(n) && String(n) === norm && n >= 1 && n <= candidates.length) {
+      return { kind: "candidate", index: n - 1 };
+    }
+    write(
+      `Invalid selection "${trimmed}". Enter 1..${candidates.length}, 0, or m.
+`
+    );
+  }
+}
+async function defaultPickMigrationCandidate(candidates) {
+  return pickMigrationCandidateFromInput(
+    candidates,
+    () => readLine(false),
+    (s) => {
+      process.stdout.write(s);
+    }
+  );
 }
-async function defaultReadMigrateSecret(prompt) {
-  process.stdout.write(prompt);
-  const line = await readLine(true);
+async function readLegacyApiKey(isTty) {
+  const fromEnv = process.env.SLOCK_LEGACY_API_KEY;
+  if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv.trim();
+  if (!isTty) return "";
+  process.stdout.write(
+    "Paste legacy api key (sk_machine_* or sk_daemon_*); input is hidden: "
+  );
+  const { line } = await readLine(true);
   process.stdout.write("\n");
   return line.trim();
 }
@@ -32003,7 +32239,7 @@ async function readLine(masked) {
   const enterRaw = masked && stdin.isTTY === true && typeof stdin.setRawMode === "function";
   if (enterRaw) stdin.setRawMode(true);
   stdin.resume();
-  return await new Promise((resolve) => {
+  return await new Promise((resolve2) => {
     let buf = "";
     const cleanup = () => {
       stdin.off("data", onData);
@@ -32016,12 +32252,17 @@ async function readLine(masked) {
       for (const ch of text) {
         if (ch === "\n" || ch === "\r") {
           cleanup();
-          resolve(buf);
+          resolve2({ line: buf, eof: false });
+          return;
+        }
+        if (ch === "") {
+          cleanup();
+          resolve2({ line: buf, eof: true });
           return;
         }
         if (ch === "") {
           cleanup();
-          resolve("");
+          resolve2({ line: "", eof: false });
           return;
         }
         if (ch === "\x7F" || ch === "\b") {
@@ -32033,12 +32274,88 @@ async function readLine(masked) {
     };
     const onEnd = () => {
       cleanup();
-      resolve(buf);
+      resolve2({ line: buf, eof: true });
     };
     stdin.on("data", onData);
     stdin.on("end", onEnd);
   });
 }
+async function runMigrateAdoption(opts, candidate, isTty, adoptLegacyImpl, readLegacyApiKeyImpl) {
+  const where = candidate.hostname ? ` (${candidate.hostname})` : "";
+  const seen = candidate.lastSeenAt ? ` last seen ${candidate.lastSeenAt}` : "";
+  info(`Migration: adopting legacy daemon "${candidate.machineName}"${where}${seen}.`);
+  info(`  local owner.json: ${candidate.localPath}`);
+  const rawKey = await readLegacyApiKeyImpl(isTty);
+  if (rawKey.length === 0) {
+    fail(
+      "LEGACY_KEY_REQUIRED",
+      "No legacy api key provided. Set `SLOCK_LEGACY_API_KEY` or paste the legacy `sk_machine_*` / `sk_daemon_*` key when prompted."
+    );
+  }
+  if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
+    fail(
+      "LEGACY_KEY_INVALID",
+      "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
+    );
+  }
+  try {
+    await adoptLegacyImpl(
+      {
+        serverSlug: opts.serverSlug,
+        ...opts.serverUrl ? { serverUrl: opts.serverUrl } : {},
+        ...opts.name ? { name: opts.name } : {},
+        rawKey,
+        mode: "legacy_key_stdin",
+        redactedPrefix: rawKey.slice(0, 8)
+      },
+      {
+        onEvent: (event) => {
+          if (event.type === "adopting") {
+            info(
+              `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
+            );
+          } else if (event.type === "preflight") {
+            info(
+              event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026"
+            );
+          } else if (event.type === "adopted") {
+            info(`Adopted. Computer state written to ${event.attachmentPath}`);
+            info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
+            info(`  serverMachine: ${event.serverMachineId}`);
+            info(`  legacyMachine: ${event.legacyMachineId}`);
+            switch (event.legacyStop.outcome) {
+              case "absent":
+                info("  legacy daemon: not detected on this Computer (no local lock file)");
+                break;
+              case "already_dead":
+                info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
+                break;
+              case "stopped":
+                info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
+                break;
+            }
+          }
+        }
+      }
+    );
+  } catch (err) {
+    if (err instanceof CliExit) throw err;
+    if (err instanceof ComputerServiceError) {
+      fail(err.code, err.message);
+    }
+    throw err;
+  }
+}
+function manualPathErrorMessage(code, inputPath) {
+  switch (code) {
+    case "MIGRATE_FROM_NOT_FOUND":
+      return `--migrate-from path not found: ${inputPath}. Pass the legacy machine directory, its daemon.lock/, or its owner.json file.`;
+    case "MIGRATE_FROM_INVALID":
+      return `--migrate-from path is not a valid legacy daemon install: ${inputPath}. Expected an owner.json with a 16-hex-char apiKeyFingerprint field.`;
+    case "MIGRATE_FROM_NOT_OWNED":
+      return `--migrate-from path's apiKeyFingerprint is not in this server's legacy machine roster for the logged-in user: ${inputPath}. Either the daemon is already migrated, the row is unowned by this user, or the fingerprint is from a different server.`;
+  }
+}
 async function runSetup(opts, deps = {}) {
   const slockHome = resolveSlockHome();
   const isTty = deps.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -32047,8 +32364,11 @@ async function runSetup(opts, deps = {}) {
   const start2 = deps.runStart ?? runStart;
   const refreshSession = deps.refreshUserSession ?? refreshUserSession;
   const detectMigration = deps.detectLegacyMigration ?? detectLegacyMigration;
-  const confirmMigrate = deps.confirmMigrate ?? defaultConfirmMigrate;
-  const readMigrateSecret = deps.readMigrateSecret ?? defaultReadMigrateSecret;
+  const validateManualPath = deps.validateManualMigratePath ?? validateManualMigratePath;
+  const buildRoster = deps.buildRosterClient ?? ((baseUrl, accessToken) => new LegacyMachinesClient(baseUrl, accessToken));
+  const pickCandidate = deps.pickMigrationCandidate ?? defaultPickMigrationCandidate;
+  const adoptLegacy2 = deps.adoptLegacy ?? adoptLegacy;
+  const readLegacyKey = deps.readLegacyApiKey ?? readLegacyApiKey;
   if (!isTty && !opts.yes) {
     fail(
       "NON_INTERACTIVE_SETUP_REQUIRES_FLAGS",
@@ -32077,78 +32397,85 @@ async function runSetup(opts, deps = {}) {
   if (attachment) {
     info(`Attachment: already attached to ${label}.`);
   } else {
+    const session = await readUserSessionAuth(slockHome);
+    const baseUrl = resolveServerUrl(
+      opts.serverUrl,
+      session.serverUrl,
+      process.env.SLOCK_SERVER_URL
+    );
+    const rosterClient = buildRoster(baseUrl, session.accessToken);
     let migrated = false;
-    if (isTty) {
-      const detection = await detectMigration(slockHome, await readUserSessionUserId(slockHome));
-      if (detection.kind === "match") {
-        const where = detection.serverUrl ? ` attached to ${detection.serverUrl}` : "";
-        const who = detection.machineName ? ` "${detection.machineName}"` : "";
-        const accepted = await confirmMigrate(
-          `Migration: detected legacy daemon machine${who}${where}. Migrate it under Computer instead of creating a fresh attachment? [y/N] `
+    if (typeof opts.migrateFrom === "string" && opts.migrateFrom.length > 0) {
+      const rosterResult = await rosterClient.list(opts.serverSlug);
+      if (rosterResult.status !== "success") {
+        fail(
+          "MIGRATE_FROM_ROSTER_UNAVAILABLE",
+          `Cannot validate --migrate-from path: legacy machine roster unavailable (${rosterResult.status}). Retry when the server is reachable, or remove --migrate-from to fall through to fresh attach.`
         );
-        if (accepted) {
-          const rawKey = await readMigrateSecret(
-            "Paste legacy api key (sk_machine_* or sk_daemon_*); input is hidden: "
-          );
-          if (rawKey.length === 0) {
-            info("Migration: no key provided; falling back to fresh attach.");
-          } else if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
-            fail(
-              "LEGACY_KEY_INVALID",
-              "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
-            );
-          } else {
-            try {
-              await adoptLegacy(
-                {
-                  serverSlug: opts.serverSlug,
-                  serverUrl: opts.serverUrl,
-                  name: opts.name,
-                  rawKey,
-                  mode: "legacy_key_stdin",
-                  redactedPrefix: rawKey.slice(0, 8)
-                },
-                {
-                  onEvent: (event) => {
-                    if (event.type === "adopting") {
-                      info(
-                        `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
-                      );
-                    } else if (event.type === "preflight") {
-                      info(
-                        event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026"
-                      );
-                    } else if (event.type === "adopted") {
-                      info(`Adopted. Computer state written to ${event.attachmentPath}`);
-                      info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
-                      info(`  serverMachine: ${event.serverMachineId}`);
-                      info(`  legacyMachine: ${event.legacyMachineId}`);
-                      switch (event.legacyStop.outcome) {
-                        case "absent":
-                          info("  legacy daemon: not detected on this Computer (no local lock file)");
-                          break;
-                        case "already_dead":
-                          info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
-                          break;
-                        case "stopped":
-                          info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
-                          break;
-                      }
-                    }
-                  }
-                }
+      }
+      const validation = await validateManualPath(opts.migrateFrom, rosterResult.entries);
+      if (!validation.ok) {
+        fail(validation.code, manualPathErrorMessage(validation.code, opts.migrateFrom));
+      }
+      await runMigrateAdoption(opts, validation.candidate, isTty, adoptLegacy2, readLegacyKey);
+      migrated = true;
+    } else {
+      const detection = await detectMigration(slockHome, opts.serverSlug, rosterClient);
+      if (detection.kind === "server-unavailable") {
+        info(
+          "Migration: legacy machine roster unavailable (fresh trigger: server-unavailable); falling back to fresh attach."
+        );
+      } else if (detection.candidates.length === 0) {
+      } else if (!isTty) {
+        info(
+          `Migration: ${detection.candidates.length} legacy daemon(s) match this server but setup is non-interactive (fresh trigger: non-tty); falling back to fresh attach. Re-run on a TTY or pass --migrate-from <path> to adopt a specific install.`
+        );
+      } else {
+        pickerLoop: while (true) {
+          const selection = await pickCandidate(detection.candidates);
+          if (selection.kind === "candidate") {
+            const candidate = detection.candidates[selection.index];
+            if (!candidate) {
+              fail(
+                "MIGRATE_PICKER_OUT_OF_RANGE",
+                `Picker returned candidate index ${selection.index} but only ${detection.candidates.length} candidate(s) were detected.`
               );
-              migrated = true;
-            } catch (err) {
-              if (err instanceof CliExit) throw err;
-              if (err instanceof ComputerServiceError) {
-                fail(err.code, err.message);
-              }
-              throw err;
             }
+            await runMigrateAdoption(opts, candidate, isTty, adoptLegacy2, readLegacyKey);
+            migrated = true;
+            break pickerLoop;
+          } else if (selection.kind === "manual") {
+            if (selection.path.length === 0) {
+              info("Migration: no path provided; returning to picker.");
+              continue pickerLoop;
+            }
+            const rosterResult = await rosterClient.list(opts.serverSlug);
+            if (rosterResult.status !== "success") {
+              info(
+                `Migration: MIGRATE_FROM_ROSTER_UNAVAILABLE \u2014 legacy machine roster unavailable (${rosterResult.status}); returning to picker. Pick "0" to fall through to fresh attach if the server stays unreachable.`
+              );
+              continue pickerLoop;
+            }
+            const validation = await validateManualPath(selection.path, rosterResult.entries);
+            if (!validation.ok) {
+              info(
+                `Migration: ${validation.code} \u2014 ${manualPathErrorMessage(validation.code, selection.path)} Returning to picker.`
+              );
+              continue pickerLoop;
+            }
+            await runMigrateAdoption(
+              opts,
+              validation.candidate,
+              isTty,
+              adoptLegacy2,
+              readLegacyKey
+            );
+            migrated = true;
+            break pickerLoop;
+          } else {
+            info("Migration: fresh attach selected.");
+            break pickerLoop;
           }
-        } else {
-          info("Migration: declined; falling back to fresh attach.");
         }
       }
     }
@@ -32208,6 +32535,10 @@ async function pidStatus(pidfile) {
   const pid = await readPidfileAt(pidfile);
   return pid !== null && isProcessAlive2(pid) ? { running: true, pid } : { running: false };
 }
+async function serviceState(slockHome) {
+  const { pid } = await findLiveServicePidReadOnly(slockHome);
+  return pid !== null ? { running: true, pid } : { running: false };
+}
 async function deriveHealth(slockHome, serverId, daemon) {
   if (!daemon.running) return "offline";
   if (await isDegraded(slockHome, serverId)) return "degraded";
@@ -32218,19 +32549,19 @@ async function buildStatusReport(installRoot) {
   const session = sessionRead.session;
   const attachments = await listServerAttachments(installRoot);
   const service = {
-    ...await pidStatus(servicePidPath(installRoot)),
+    ...await serviceState(installRoot),
     logPath: serviceLogPath(installRoot)
   };
   const servers = [];
   for (const a of attachments) {
-    const daemon = await pidStatus(serverDaemonPidPath(installRoot, a.serverId));
+    const daemon = await pidStatus(serverRunnerPidPath(installRoot, a.serverId));
     servers.push({
       serverId: a.serverId,
       serverSlug: a.serverSlug ?? null,
       serverMachineId: a.serverMachineId,
       serverUrl: a.serverUrl,
       attachedAt: a.attachedAt ?? null,
-      daemonLogPath: serverDaemonLogPath(installRoot, a.serverId),
+      serverRunnerLogPath: serverRunnerLogPath(installRoot, a.serverId),
       daemon,
       health: await deriveHealth(installRoot, a.serverId, daemon)
     });
@@ -32277,7 +32608,7 @@ async function runStatus(opts) {
       info(
         `  ${pad(formatServerSlugDisplay(s.serverSlug), 24)}${pad(s.health, 12)}${pad(dcol, 24)}${pad(s.serverMachineId, 38)}${s.serverUrl}`
       );
-      info(`    Daemon log: ${s.daemonLogPath}`);
+      info(`    Server runner log: ${s.serverRunnerLogPath}`);
     }
     if (report.servers.some((s) => s.health === "degraded")) {
       info("");
@@ -32618,14 +32949,14 @@ import { readFile as readFile10 } from "fs/promises";
 var DEFAULT_LINES = 200;
 async function runLogs(opts) {
   const home = resolveSlockHome();
-  const file = opts.service ? serviceLogPath(home) : serverDaemonLogPath(home, await resolveTargetServerId({ server: opts.server }));
+  const file = opts.service ? serviceLogPath(home) : serverRunnerLogPath(home, await resolveTargetServerId({ server: opts.server }));
   let content;
   try {
     content = await readFile10(file, "utf8");
   } catch {
     fail(
       "NO_DAEMON_LOG",
-      opts.service ? `No service log at ${file}. Start the service first (\`slock-computer start\`).` : `No daemon log at ${file}. Start its daemon first (\`slock-computer start\`).`
+      opts.service ? `No service log at ${file}. Start the service first (\`slock-computer start\`).` : `No server runner log at ${file}. Start its server runner first (\`slock-computer start\`).`
     );
   }
   const n = Number.isInteger(opts.lines) && opts.lines > 0 ? opts.lines : DEFAULT_LINES;
@@ -33035,7 +33366,7 @@ function errMsg(e) {
   return e instanceof Error ? e.message : String(e);
 }
 async function defaultReadTarballPackageJson(tarballPath) {
-  const raw = await new Promise((resolve, reject) => {
+  const raw = await new Promise((resolve2, reject) => {
     const child = spawn3("tar", ["-xzOf", tarballPath, "package/package.json"], {
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -33053,7 +33384,7 @@ async function defaultReadTarballPackageJson(tarballPath) {
         reject(new Error(`tar -xzOf exited ${code}: ${stderrBuf.slice(0, 300)}`));
         return;
       }
-      resolve(stdoutBuf);
+      resolve2(stdoutBuf);
     });
   });
   return JSON.parse(raw);
@@ -33181,7 +33512,7 @@ async function stagePhase(slockHome, version, deps = {}) {
   return { stagedPath, version, tarballSha1 };
 }
 function defaultNpmPack(cwd, packageRef) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn4("npm", ["pack", packageRef, "--json"], {
       cwd,
       stdio: ["ignore", "pipe", "pipe"]
@@ -33195,23 +33526,23 @@ function defaultNpmPack(cwd, packageRef) {
       stderrBuf += String(chunk);
     });
     child.on("error", (err) => {
-      resolve({ tarballPath: "", exitCode: 1, stderr: String(err) });
+      resolve2({ tarballPath: "", exitCode: 1, stderr: String(err) });
     });
     child.on("close", (code) => {
       if (code !== 0) {
-        resolve({ tarballPath: "", exitCode: code ?? 1, stderr: stderrBuf });
+        resolve2({ tarballPath: "", exitCode: code ?? 1, stderr: stderrBuf });
         return;
       }
       try {
         const parsed = JSON.parse(stdoutBuf);
         const filename = parsed[0]?.filename;
         if (!filename) {
-          resolve({ tarballPath: "", exitCode: 1, stderr: "npm pack returned no filename" });
+          resolve2({ tarballPath: "", exitCode: 1, stderr: "npm pack returned no filename" });
           return;
         }
-        resolve({ tarballPath: join6(cwd, filename), exitCode: 0, stderr: stderrBuf });
+        resolve2({ tarballPath: join6(cwd, filename), exitCode: 0, stderr: stderrBuf });
       } catch (e) {
-        resolve({ tarballPath: "", exitCode: 1, stderr: `parse npm pack output: ${e}` });
+        resolve2({ tarballPath: "", exitCode: 1, stderr: `parse npm pack output: ${e}` });
       }
     });
   });
@@ -33291,7 +33622,7 @@ async function extractTarball(tarballPath, destDir, deps = {}) {
   return { extractedPackageDir: join6(destDir, "package") };
 }
 function defaultTarSpawn(tarballPath, destDir) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn4("tar", ["-xzf", tarballPath, "-C", destDir], {
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -33300,10 +33631,10 @@ function defaultTarSpawn(tarballPath, destDir) {
       stderrBuf += String(chunk);
     });
     child.on("error", (err) => {
-      resolve({ exitCode: 1, stderr: String(err) });
+      resolve2({ exitCode: 1, stderr: String(err) });
     });
     child.on("close", (code) => {
-      resolve({ exitCode: code ?? 1, stderr: stderrBuf });
+      resolve2({ exitCode: code ?? 1, stderr: stderrBuf });
     });
   });
 }
@@ -33319,7 +33650,7 @@ async function hydrateStagedDependencies(extractedPackageDir, deps = {}) {
   }
 }
 function defaultNpmInstallProductionDeps(cwd) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn4(
       "npm",
       [
@@ -33340,10 +33671,10 @@ function defaultNpmInstallProductionDeps(cwd) {
       stderrBuf += String(chunk);
     });
     child.on("error", (err) => {
-      resolve({ exitCode: 1, stderr: String(err) });
+      resolve2({ exitCode: 1, stderr: String(err) });
     });
     child.on("close", (code) => {
-      resolve({ exitCode: code ?? 1, stderr: stderrBuf });
+      resolve2({ exitCode: code ?? 1, stderr: stderrBuf });
     });
   });
 }
@@ -33537,13 +33868,8 @@ async function restartPhase(slockHome, deps = {}) {
   return { ok: false, reason: "health_check_timeout" };
 }
 async function defaultReadServicePid(slockHome) {
-  try {
-    const raw = (await readFile14(servicePidPath(slockHome), "utf8")).trim();
-    const pid = Number.parseInt(raw, 10);
-    return Number.isInteger(pid) && pid > 0 ? pid : null;
-  } catch {
-    return null;
-  }
+  const { pid } = await findLiveServicePid(slockHome);
+  return pid;
 }
 async function defaultKillService(pid) {
   try {
@@ -33861,7 +34187,7 @@ async function rollingDaemonHealthCheck(slockHome, deps = {}) {
 }
 async function defaultReadDaemonPid(slockHome, serverId) {
   try {
-    const raw = (await readFile14(serverDaemonPidPath(slockHome, serverId), "utf8")).trim();
+    const raw = (await readFile14(serverRunnerPidPath(slockHome, serverId), "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -34067,6 +34393,8 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
   if (drainMode !== void 0 && drainMode !== "drain") {
     info(`Drain mode: ${drainMode}${drainMode === "force" ? " (in-flight turns will be dropped)" : ""}.`);
   }
+  const readBundledFn = deps.readBundledDaemonVersion ?? readBundledDaemonVersion;
+  const fromBundledDaemonVersion = await readBundledFn(currentBinaryDir);
   const runUpgradeFn = deps.runUpgradeFn ?? runUpgrade;
   const spawnFreshService = deps.spawnFreshService ?? defaultSpawnFreshService;
   const outcome = await runUpgradeFn(slockHome, {
@@ -34084,17 +34412,18 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
       spawnFreshService: () => spawnFreshService(slockHome)
     }
   });
-  const readBundledFn = deps.readBundledDaemonVersion ?? readBundledDaemonVersion;
-  const bundledDaemonVersion = await readBundledFn(currentBinaryDir);
-  const bundle = (version) => bundledDaemonVersion !== null ? { computerVersion: version, bundledDaemonVersion } : { computerVersion: version };
+  const toBundledDaemonVersion = await readBundledFn(currentBinaryDir);
+  const bundle = (version, bundledDaemonVersion) => bundledDaemonVersion !== null ? { computerVersion: version, bundledDaemonVersion } : { computerVersion: version };
+  const fromBundle = bundle(fromVersion, fromBundledDaemonVersion);
+  const toBundle = bundle(targetVersion, toBundledDaemonVersion);
   const logTrigger = opts.trigger ?? "cli";
   if (outcome.ok) {
     info(
       `Upgrade ${fromVersion} \u2192 ${targetVersion} succeeded (health-OK in ${outcome.restart?.healthAfterMs ?? 0}ms).`
     );
     await appendUpgradeLogEntry(slockHome, {
-      fromBundle: bundle(fromVersion),
-      toBundle: bundle(targetVersion),
+      fromBundle,
+      toBundle,
       channel: channel2,
       trigger: logTrigger,
       outcome: "ok"
@@ -34114,8 +34443,8 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
       `Upgrade ${fromVersion} \u2192 ${targetVersion} succeeded; cleanup phase reported a non-fatal issue: ${outcome.reason ?? "unknown"}. Active layout + service are healthy.`
     );
     await appendUpgradeLogEntry(slockHome, {
-      fromBundle: bundle(fromVersion),
-      toBundle: bundle(targetVersion),
+      fromBundle,
+      toBundle,
       channel: channel2,
       trigger: logTrigger,
       outcome: "ok"
@@ -34125,8 +34454,8 @@ async function runUpgradeCli(slockHome, opts, deps = {}) {
   }
   const code = mapFailurePhaseToCode(outcome);
   await appendUpgradeLogEntry(slockHome, {
-    fromBundle: bundle(fromVersion),
-    toBundle: bundle(targetVersion),
+    fromBundle,
+    toBundle,
     channel: channel2,
     trigger: logTrigger,
     outcome: "err",
@@ -34205,7 +34534,7 @@ async function defaultCurrentVersion() {
 
 // src/upgradeTestHarness.ts
 init_esm_shims();
-import { mkdir as mkdir15, readdir as readdir4, stat as stat3, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir15, readdir as readdir4, stat as stat4, writeFile as writeFile12 } from "fs/promises";
 import { join as join8 } from "path";
 import { createHash as createHash4 } from "crypto";
 var PHASES = /* @__PURE__ */ new Set([
@@ -34342,7 +34671,7 @@ async function arrangeSnapshotFailure(slockHome) {
 }
 async function pathInfo(path3) {
   try {
-    const s = await stat3(path3);
+    const s = await stat4(path3);
     if (s.isDirectory()) return { kind: "dir", size: 0 };
     if (s.isFile()) return { kind: "file", size: s.size };
     return null;
@@ -34499,10 +34828,10 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   const activeVersion = await readServiceVersionEvidence(slockHome);
   return { outcome, activeVersion };
 }
-async function runUpgradeInstallSmokeCli(slockHome, opts, writer = (s) => process.stdout.write(s)) {
+async function runUpgradeInstallSmokeCli(slockHome, opts, writer = (s) => process.stdout.write(s), deps = {}) {
   let report;
   try {
-    report = await runUpgradeInstallSmoke(slockHome, opts);
+    report = await runUpgradeInstallSmoke(slockHome, opts, deps);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     writer(
@@ -34589,10 +34918,10 @@ program2.command("setup").argument("<serverSlug>", "target Slock server slug (ca
 program2.command("detach").argument("<serverSlug>", "server slug to detach from this Computer (canonical form `/myserver`)").description("Remove ONE server's local attachment; never touches user-session or other servers.").action(withCliExit(async (serverSlug) => {
   await withMutationLock(async () => runDetach(await resolveTargetServerId({ server: serverSlug }), serverSlug));
 }));
-program2.command("status").description("Show this Computer's aggregate state (login + service + per-server daemons).").option("--json", "emit the machine-readable report").action(withCliExit(async (opts) => {
+program2.command("status").description("Show this Computer's aggregate state (login + service + per-server server-runners).").option("--json", "emit the machine-readable report").action(withCliExit(async (opts) => {
   await runStatus({ json: opts.json });
 }));
-program2.command("start").argument("[serverSlug]", "optional: verify this server is attached and ensure its daemon is reconciled (default: ensure all attached)").description("Start/ensure the Computer service (manages all per-server daemons).").option("--foreground", "stay in this terminal instead of detaching").action(withCliExit(async (serverSlug, opts) => {
+program2.command("start").argument("[serverSlug]", "optional: verify this server is attached and ensure its server-runner is reconciled (default: ensure all attached)").description("Start/ensure the Computer service (manages all per-server server-runners).").option("--foreground", "stay in this terminal instead of detaching").action(withCliExit(async (serverSlug, opts) => {
   await withMutationLock(
     async () => runStart({
       foreground: opts.foreground,
@@ -34601,7 +34930,7 @@ program2.command("start").argument("[serverSlug]", "optional: verify this server
     })
   );
 }));
-program2.command("stop").description("Stop the Computer service (and all managed per-server daemons).").action(withCliExit(async () => {
+program2.command("stop").description("Stop the Computer service (and all managed per-server server-runners).").action(withCliExit(async () => {
   await withMutationLock(() => runStop());
 }));
 program2.command("doctor").argument("[serverSlug]", "optional: scope detail (recent crashes) to one server").description("Diagnose login + per-server attachments + per-server preflight (no secrets).").option("--json", "emit the machine-readable report").option("--cleanup", "after diagnosis, run the local residue cleanup pass").option("--fix", "alias for --cleanup (same behavior)").option("--reset-health", "clear <serverSlug>'s crash history so service resumes auto-restart").action(
@@ -34631,7 +34960,7 @@ program2.command("reset").description("Clear a degraded state and resume the ser
     );
   })
 );
-program2.command("logs").description("Tail one server's daemon log (or the service log); secrets redacted.").option("--lines <n>", "trailing lines to show (default 200)", (v) => Number.parseInt(v, 10)).option("--server <slug>", "select target server slug (required when \u22652 attached)").option("--service", "tail the global service log instead of a per-server daemon log").action(withCliExit(async (opts) => {
+program2.command("logs").description("Tail one server's server-runner log (or the service log); secrets redacted.").option("--lines <n>", "trailing lines to show (default 200)", (v) => Number.parseInt(v, 10)).option("--server <slug>", "select target server slug (required when \u22652 attached)").option("--service", "tail the global service log instead of a per-server server-runner log").action(withCliExit(async (opts) => {
   await runLogs({ lines: opts.lines, server: opts.server ?? null, service: !!opts.service });
 }));
 var runners = program2.command("runners").description("Computer runner control plane (per-server scoped; \xA712 whitelist server-side).");