@wlfi-agent/cli 1.4.12 → 1.4.14

package/src/lib/admin-reset.ts

@@ -0,0 +1,751 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import readline from 'node:readline';
+import { Command } from 'commander';
+import {
+  deleteConfigKey,
+  readConfig,
+  redactConfig,
+  resolveConfigPath,
+  resolveWlfiHome,
+  type WlfiConfig,
+} from '../../packages/config/src/index.js';
+import {
+  cleanupAutoGeneratedBootstrapArtifacts,
+  type CleanupBootstrapArtifactsResult,
+} from './bootstrap-artifacts.js';
+import {
+  AGENT_AUTH_TOKEN_KEYCHAIN_SERVICE,
+  DAEMON_PASSWORD_KEYCHAIN_SERVICE,
+  deleteAgentAuthTokenFromKeychain,
+} from './keychain.js';
+import { createSudoSession } from './sudo.js';
+
+const DEFAULT_LAUNCH_DAEMON_LABEL = 'com.wlfi.agent.daemon';
+const DEFAULT_MANAGED_DAEMON_SOCKET = '/Library/WLFI/run/daemon.sock';
+const DEFAULT_MANAGED_STATE_FILE = '/var/db/wlfi-agent/daemon-state.enc';
+const DEFAULT_LAUNCH_DAEMON_PLIST = `/Library/LaunchDaemons/${DEFAULT_LAUNCH_DAEMON_LABEL}.plist`;
+const DEFAULT_MANAGED_ROOT_DIR = '/Library/WLFI';
+const DEFAULT_MANAGED_STATE_DIR = '/var/db/wlfi-agent';
+const DEFAULT_MANAGED_LOG_DIR = '/var/log/wlfi-agent';
+const MAX_SECRET_STDIN_BYTES = 16 * 1024;
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+interface ProgressHandle {
+  succeed(message?: string): void;
+  fail(message?: string): void;
+}
+
+interface AdminResetOptions {
+  yes?: boolean;
+  nonInteractive?: boolean;
+  deleteConfig?: boolean;
+  json?: boolean;
+}
+
+interface AdminUninstallOptions {
+  yes?: boolean;
+  nonInteractive?: boolean;
+  json?: boolean;
+}
+
+export interface CleanupLocalAdminResetStateResult {
+  agentKeyId: string | null;
+  keychain: {
+    removed: boolean;
+    service: string | null;
+  };
+  config: {
+    path: string;
+    existed: boolean;
+    deleted: boolean;
+    clearedAgentKeyId: boolean;
+    clearedLegacyAgentAuthToken: boolean;
+    value: Record<string, unknown> | null;
+  };
+  bootstrapArtifacts: {
+    attempted: boolean;
+    action: 'deleted';
+    fileCount: number;
+    cleanedCount: number;
+    skippedCount: number;
+    error: string | null;
+  };
+}
+
+interface CleanupLocalAdminResetStateDeps {
+  platform?: NodeJS.Platform;
+  existsSync?: (targetPath: string) => boolean;
+  resolveConfigPath?: () => string;
+  resolveWlfiHome?: () => string;
+  readConfig?: () => WlfiConfig;
+  deleteConfigKey?: (key: keyof WlfiConfig) => WlfiConfig;
+  deleteAgentAuthToken?: (agentKeyId: string) => boolean;
+  unlinkSync?: (targetPath: string) => void;
+  cleanupBootstrapArtifacts?: (action: 'deleted') => CleanupBootstrapArtifactsResult;
+}
+
+export interface CleanupLocalAdminUninstallStateResult {
+  agentKeyId: string | null;
+  keychain: {
+    removed: boolean;
+    service: string | null;
+  };
+  config: {
+    path: string;
+    existed: boolean;
+    deleted: boolean;
+  };
+  wlfiHome: {
+    path: string;
+    existed: boolean;
+    deleted: boolean;
+  };
+}
+
+interface CleanupLocalAdminUninstallStateDeps {
+  platform?: NodeJS.Platform;
+  existsSync?: (targetPath: string) => boolean;
+  resolveConfigPath?: () => string;
+  resolveWlfiHome?: () => string;
+  readConfig?: () => WlfiConfig;
+  deleteAgentAuthToken?: (agentKeyId: string) => boolean;
+  rmSync?: (targetPath: string, options: { recursive: boolean; force: boolean }) => void;
+}
+
+function renderError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function validateSecret(value: string, label: string): string {
+  if (Buffer.byteLength(value, 'utf8') > MAX_SECRET_STDIN_BYTES) {
+    throw new Error(`${label} must not exceed ${MAX_SECRET_STDIN_BYTES} bytes`);
+  }
+  if (!value.trim()) {
+    throw new Error(`${label} must not be empty or whitespace`);
+  }
+  return value;
+}
+
+async function promptHidden(query: string, label: string): Promise<string> {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error(`${label} is required; rerun on a local TTY`);
+  }
+
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: true,
+  }) as readline.Interface & { stdoutMuted?: boolean; _writeToOutput?: (value: string) => void };
+
+  rl.stdoutMuted = true;
+  rl._writeToOutput = (value: string) => {
+    if (value.includes(query)) {
+      (rl as unknown as { output: NodeJS.WritableStream }).output.write(value);
+      return;
+    }
+    if (!rl.stdoutMuted) {
+      (rl as unknown as { output: NodeJS.WritableStream }).output.write(value);
+    }
+  };
+
+  const answer = await new Promise<string>((resolve) => {
+    rl.question(query, resolve);
+  });
+  rl.close();
+  process.stdout.write('\n');
+  return validateSecret(answer, label);
+}
+
+async function promptVisible(query: string): Promise<string> {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error('admin reset requires --yes in non-interactive environments');
+  }
+
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: true,
+  });
+
+  const answer = await new Promise<string>((resolve) => {
+    rl.question(query, resolve);
+  });
+  rl.close();
+  return answer.trim();
+}
+
+const sudoSession = createSudoSession({
+  promptPassword: async () =>
+    await promptHidden(
+      'Root password (input hidden; required to uninstall the root daemon and delete its state): ',
+      'root password',
+    ),
+});
+
+function createProgress(message: string, enabled = true): ProgressHandle {
+  if (!enabled) {
+    return {
+      succeed() {},
+      fail() {},
+    };
+  }
+
+  if (!process.stderr.isTTY) {
+    process.stderr.write(`==> ${message}\n`);
+    return {
+      succeed(finalMessage = message) {
+        process.stderr.write(`✓ ${finalMessage}\n`);
+      },
+      fail(finalMessage = `${message} failed`) {
+        process.stderr.write(`✗ ${finalMessage}\n`);
+      },
+    };
+  }
+
+  let frameIndex = 0;
+  const render = (prefix: string, currentMessage: string) => {
+    process.stderr.write(`\r\u001b[2K${prefix} ${currentMessage}`);
+  };
+
+  render(SPINNER_FRAMES[frameIndex], message);
+  const timer = setInterval(() => {
+    frameIndex = (frameIndex + 1) % SPINNER_FRAMES.length;
+    render(SPINNER_FRAMES[frameIndex], message);
+  }, 80);
+
+  const stop = (prefix: string, finalMessage: string) => {
+    clearInterval(timer);
+    render(prefix, finalMessage);
+    process.stderr.write('\n');
+  };
+
+  return {
+    succeed(finalMessage = message) {
+      stop('✓', finalMessage);
+    },
+    fail(finalMessage = `${message} failed`) {
+      stop('✗', finalMessage);
+    },
+  };
+}
+
+function print(payload: unknown, asJson: boolean | undefined): void {
+  if (asJson) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (typeof payload === 'string') {
+    console.log(payload);
+    return;
+  }
+  console.dir(payload, { depth: null, colors: process.stdout.isTTY });
+}
+
+function printResetSummary(result: {
+  daemon: {
+    label: string;
+    daemonSocket: string;
+    stateFile: string;
+  };
+  local: CleanupLocalAdminResetStateResult;
+}): void {
+  const lines = [
+    'reset complete',
+    `managed daemon removed: ${result.daemon.label}`,
+    `managed state deleted: ${result.daemon.stateFile}`,
+    `managed socket removed: ${result.daemon.daemonSocket}`,
+  ];
+
+  if (result.local.agentKeyId) {
+    lines.push(`old agent key cleared: ${result.local.agentKeyId}`);
+  } else {
+    lines.push('old agent key cleared: no configured agent key was found');
+  }
+
+  if (result.local.config.deleted) {
+    lines.push(`config deleted: ${result.local.config.path}`);
+  } else if (result.local.config.existed) {
+    lines.push(`config kept: ${result.local.config.path}`);
+  } else {
+    lines.push(`config not found: ${result.local.config.path}`);
+  }
+
+  if (result.local.bootstrapArtifacts.error) {
+    lines.push(`bootstrap artifact cleanup warning: ${result.local.bootstrapArtifacts.error}`);
+  } else if (result.local.bootstrapArtifacts.attempted) {
+    lines.push(
+      `bootstrap artifacts deleted: ${result.local.bootstrapArtifacts.cleanedCount}/${result.local.bootstrapArtifacts.fileCount}`,
+    );
+  }
+
+  lines.push('next: run `wlfi-agent admin setup` to create a new wallet');
+  console.log(lines.join('\n'));
+}
+
+function resolveLaunchDaemonUninstallScriptPath(): string {
+  const candidates = [
+    path.resolve(__dirname, '../scripts/launchd/uninstall-user-daemon.sh'),
+    path.resolve(__dirname, '../../scripts/launchd/uninstall-user-daemon.sh'),
+    path.resolve(process.cwd(), 'scripts/launchd/uninstall-user-daemon.sh'),
+  ];
+
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+  }
+
+  return candidates[0];
+}
+
+export function cleanupLocalAdminResetState(
+  options: { deleteConfig?: boolean } = {},
+  deps: CleanupLocalAdminResetStateDeps = {},
+): CleanupLocalAdminResetStateResult {
+  const platform = deps.platform ?? process.platform;
+  const existsSync = deps.existsSync ?? fs.existsSync;
+  const resolveConfigPathImpl = deps.resolveConfigPath ?? resolveConfigPath;
+  const resolveWlfiHomeImpl = deps.resolveWlfiHome ?? resolveWlfiHome;
+  const readConfigImpl = deps.readConfig ?? readConfig;
+  const deleteConfigKeyImpl = deps.deleteConfigKey ?? deleteConfigKey;
+  const deleteAgentAuthTokenImpl = deps.deleteAgentAuthToken ?? deleteAgentAuthTokenFromKeychain;
+  const unlinkSyncImpl = deps.unlinkSync ?? fs.unlinkSync;
+  const cleanupBootstrapArtifactsImpl =
+    deps.cleanupBootstrapArtifacts ?? cleanupAutoGeneratedBootstrapArtifacts;
+
+  const configPath = resolveConfigPathImpl();
+  const wlfiHome = resolveWlfiHomeImpl();
+  const configExists = existsSync(configPath);
+  const currentConfig = configExists ? readConfigImpl() : null;
+  const agentKeyId = currentConfig?.agentKeyId ?? null;
+  const clearedAgentKeyId = currentConfig?.agentKeyId !== undefined;
+  const clearedLegacyAgentAuthToken = currentConfig?.agentAuthToken !== undefined;
+  const keychainRemoved = agentKeyId ? deleteAgentAuthTokenImpl(agentKeyId) : false;
+
+  let configDeleted = false;
+  let configValue: Record<string, unknown> | null = configExists ? redactConfig(currentConfig ?? {}) : null;
+  if (options.deleteConfig) {
+    if (configExists) {
+      unlinkSyncImpl(configPath);
+      configDeleted = true;
+      configValue = null;
+    }
+  } else if (configExists) {
+    if (clearedAgentKeyId) {
+      deleteConfigKeyImpl('agentKeyId');
+    }
+    if (clearedLegacyAgentAuthToken) {
+      deleteConfigKeyImpl('agentAuthToken');
+    }
+    configValue = redactConfig(readConfigImpl());
+  }
+
+  let bootstrapArtifacts: CleanupLocalAdminResetStateResult['bootstrapArtifacts'];
+  if (!existsSync(wlfiHome)) {
+    bootstrapArtifacts = {
+      attempted: false,
+      action: 'deleted',
+      fileCount: 0,
+      cleanedCount: 0,
+      skippedCount: 0,
+      error: null,
+    };
+  } else {
+    try {
+      const cleanup = cleanupBootstrapArtifactsImpl('deleted');
+      bootstrapArtifacts = {
+        attempted: true,
+        action: 'deleted',
+        fileCount: cleanup.files.length,
+        cleanedCount: cleanup.files.filter((file) => file.cleanup === 'deleted').length,
+        skippedCount: cleanup.files.filter((file) => file.cleanup === 'skipped').length,
+        error: null,
+      };
+    } catch (error) {
+      bootstrapArtifacts = {
+        attempted: true,
+        action: 'deleted',
+        fileCount: 0,
+        cleanedCount: 0,
+        skippedCount: 0,
+        error: renderError(error),
+      };
+    }
+  }
+
+  return {
+    agentKeyId,
+    keychain: {
+      removed: keychainRemoved,
+      service: platform === 'darwin' ? AGENT_AUTH_TOKEN_KEYCHAIN_SERVICE : null,
+    },
+    config: {
+      path: configPath,
+      existed: configExists,
+      deleted: configDeleted,
+      clearedAgentKeyId,
+      clearedLegacyAgentAuthToken,
+      value: configValue,
+    },
+    bootstrapArtifacts,
+  };
+}
+
+function isPathInside(parentPath: string, childPath: string): boolean {
+  const relative = path.relative(path.resolve(parentPath), path.resolve(childPath));
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+export function cleanupLocalAdminUninstallState(
+  deps: CleanupLocalAdminUninstallStateDeps = {},
+): CleanupLocalAdminUninstallStateResult {
+  const platform = deps.platform ?? process.platform;
+  const existsSync = deps.existsSync ?? fs.existsSync;
+  const resolveConfigPathImpl = deps.resolveConfigPath ?? resolveConfigPath;
+  const resolveWlfiHomeImpl = deps.resolveWlfiHome ?? resolveWlfiHome;
+  const readConfigImpl = deps.readConfig ?? readConfig;
+  const deleteAgentAuthTokenImpl = deps.deleteAgentAuthToken ?? deleteAgentAuthTokenFromKeychain;
+  const rmSyncImpl = deps.rmSync ?? fs.rmSync;
+
+  const configPath = resolveConfigPathImpl();
+  const wlfiHome = resolveWlfiHomeImpl();
+  const configExists = existsSync(configPath);
+  const wlfiHomeExists = existsSync(wlfiHome);
+  const currentConfig = configExists ? readConfigImpl() : null;
+  const agentKeyId = currentConfig?.agentKeyId ?? null;
+  const keychainRemoved = agentKeyId ? deleteAgentAuthTokenImpl(agentKeyId) : false;
+
+  let configDeleted = false;
+  if (configExists && (!wlfiHomeExists || !isPathInside(wlfiHome, configPath))) {
+    rmSyncImpl(configPath, { recursive: true, force: true });
+    configDeleted = true;
+  } else if (configExists && wlfiHomeExists) {
+    configDeleted = true;
+  }
+
+  let wlfiHomeDeleted = false;
+  if (wlfiHomeExists) {
+    rmSyncImpl(wlfiHome, { recursive: true, force: true });
+    wlfiHomeDeleted = true;
+  }
+
+  return {
+    agentKeyId,
+    keychain: {
+      removed: keychainRemoved,
+      service: platform === 'darwin' ? AGENT_AUTH_TOKEN_KEYCHAIN_SERVICE : null,
+    },
+    config: {
+      path: configPath,
+      existed: configExists,
+      deleted: configDeleted,
+    },
+    wlfiHome: {
+      path: wlfiHome,
+      existed: wlfiHomeExists,
+      deleted: wlfiHomeDeleted,
+    },
+  };
+}
+
+async function confirmReset(options: AdminResetOptions): Promise<void> {
+  if (options.yes) {
+    return;
+  }
+  if (options.nonInteractive) {
+    throw new Error('`wlfi-agent admin reset` requires --yes in non-interactive mode');
+  }
+
+  process.stderr.write(
+    'warning: admin reset permanently deletes the managed daemon state and the current wallet; if you do not have an external backup, the old address is lost forever.\n',
+  );
+  const confirmation = await promptVisible(
+    'Type RESET to delete the managed daemon state and local wallet credentials: ',
+  );
+  if (confirmation !== 'RESET') {
+    throw new Error('admin reset aborted');
+  }
+}
+
+async function runAdminReset(options: AdminResetOptions): Promise<void> {
+  await confirmReset(options);
+  const showProgress = !options.json;
+  const keychainAccount = os.userInfo().username;
+
+  if (!options.json && typeof process.geteuid === 'function' && process.geteuid() !== 0) {
+    process.stderr.write(
+      'Root password required: reset must uninstall the root LaunchDaemon and delete the root-managed daemon state.\n',
+    );
+  }
+  await sudoSession.prime();
+
+  const uninstallProgress = createProgress('Uninstalling managed daemon', showProgress);
+  let uninstallResult;
+  try {
+    uninstallResult = await sudoSession.run([
+      resolveLaunchDaemonUninstallScriptPath(),
+      '--label',
+      DEFAULT_LAUNCH_DAEMON_LABEL,
+      '--keychain-service',
+      DAEMON_PASSWORD_KEYCHAIN_SERVICE,
+      '--keychain-account',
+      keychainAccount,
+      '--delete-keychain-password',
+    ]);
+  } catch (error) {
+    uninstallProgress.fail();
+    throw error;
+  }
+  if (uninstallResult.code !== 0) {
+    uninstallProgress.fail();
+    throw new Error(
+      uninstallResult.stderr.trim()
+        || uninstallResult.stdout.trim()
+        || `failed to uninstall managed daemon (exit code ${uninstallResult.code})`,
+    );
+  }
+  uninstallProgress.succeed('Managed daemon uninstalled');
+
+  const stateProgress = createProgress('Deleting root-managed daemon state', showProgress);
+  let deleteRootArtifactsResult;
+  try {
+    deleteRootArtifactsResult = await sudoSession.run([
+      '/bin/rm',
+      '-f',
+      DEFAULT_MANAGED_STATE_FILE,
+      DEFAULT_MANAGED_DAEMON_SOCKET,
+    ]);
+  } catch (error) {
+    stateProgress.fail();
+    throw error;
+  }
+  if (deleteRootArtifactsResult.code !== 0) {
+    stateProgress.fail();
+    throw new Error(
+      deleteRootArtifactsResult.stderr.trim()
+        || deleteRootArtifactsResult.stdout.trim()
+        || `failed to delete managed daemon state (exit code ${deleteRootArtifactsResult.code})`,
+    );
+  }
+  stateProgress.succeed('Root-managed daemon state deleted');
+
+  const localProgress = createProgress('Removing local wallet credentials', showProgress);
+  const local = cleanupLocalAdminResetState({ deleteConfig: options.deleteConfig });
+  localProgress.succeed('Local wallet credentials removed');
+
+  const result = {
+    command: 'reset',
+    daemon: {
+      autostart: false,
+      label: DEFAULT_LAUNCH_DAEMON_LABEL,
+      launchdDomain: 'system',
+      plist: DEFAULT_LAUNCH_DAEMON_PLIST,
+      daemonSocket: DEFAULT_MANAGED_DAEMON_SOCKET,
+      stateFile: DEFAULT_MANAGED_STATE_FILE,
+      systemKeychainPasswordService: DAEMON_PASSWORD_KEYCHAIN_SERVICE,
+      systemKeychainPasswordAccount: keychainAccount,
+    },
+    local,
+    nextStep: 'Run `wlfi-agent admin setup` to create a new wallet and re-install the managed daemon.',
+  };
+
+  if (options.json) {
+    print(result, true);
+    return;
+  }
+
+  printResetSummary({
+    daemon: {
+      label: result.daemon.label,
+      daemonSocket: result.daemon.daemonSocket,
+      stateFile: result.daemon.stateFile,
+    },
+    local,
+  });
+}
+
+async function confirmUninstall(options: AdminUninstallOptions): Promise<void> {
+  if (options.yes) {
+    return;
+  }
+  if (options.nonInteractive) {
+    throw new Error('`wlfi-agent admin uninstall` requires --yes in non-interactive mode');
+  }
+
+  process.stderr.write(
+    'warning: admin uninstall permanently removes the managed daemon, root-managed state, local wallet config, local binaries, and logs.\n',
+  );
+  const confirmation = await promptVisible(
+    'Type UNINSTALL to delete all WLFI managed files and local credentials: ',
+  );
+  if (confirmation !== 'UNINSTALL') {
+    throw new Error('admin uninstall aborted');
+  }
+}
+
+function printUninstallSummary(result: {
+  daemon: {
+    label: string;
+    daemonRoot: string;
+    stateDir: string;
+    logDir: string;
+  };
+  local: CleanupLocalAdminUninstallStateResult;
+}): void {
+  const lines = [
+    'uninstall complete',
+    `managed daemon removed: ${result.daemon.label}`,
+    `managed daemon files removed: ${result.daemon.daemonRoot}`,
+    `managed state directory removed: ${result.daemon.stateDir}`,
+    `managed log directory removed: ${result.daemon.logDir}`,
+    result.local.agentKeyId
+      ? `old agent key cleared: ${result.local.agentKeyId}`
+      : 'old agent key cleared: no configured agent key was found',
+    result.local.wlfiHome.existed
+      ? `local WLFI home removed: ${result.local.wlfiHome.path}`
+      : `local WLFI home not found: ${result.local.wlfiHome.path}`,
+    result.local.config.existed
+      ? `config removed: ${result.local.config.path}`
+      : `config not found: ${result.local.config.path}`,
+    'next: reinstall with `wlfi-agent admin setup` only if you want a fresh managed wallet again',
+  ];
+  console.log(lines.join('\n'));
+}
+
+async function runAdminUninstall(options: AdminUninstallOptions): Promise<void> {
+  await confirmUninstall(options);
+  const showProgress = !options.json;
+  const keychainAccount = os.userInfo().username;
+
+  if (!options.json && typeof process.geteuid === 'function' && process.geteuid() !== 0) {
+    process.stderr.write(
+      'Root password required: uninstall must remove the root LaunchDaemon and all managed root-owned files.\n',
+    );
+  }
+  await sudoSession.prime();
+
+  const uninstallProgress = createProgress('Uninstalling managed daemon', showProgress);
+  let uninstallResult;
+  try {
+    uninstallResult = await sudoSession.run([
+      resolveLaunchDaemonUninstallScriptPath(),
+      '--label',
+      DEFAULT_LAUNCH_DAEMON_LABEL,
+      '--keychain-service',
+      DAEMON_PASSWORD_KEYCHAIN_SERVICE,
+      '--keychain-account',
+      keychainAccount,
+      '--delete-keychain-password',
+    ]);
+  } catch (error) {
+    uninstallProgress.fail();
+    throw error;
+  }
+  if (uninstallResult.code !== 0) {
+    uninstallProgress.fail();
+    throw new Error(
+      uninstallResult.stderr.trim()
+        || uninstallResult.stdout.trim()
+        || `failed to uninstall managed daemon (exit code ${uninstallResult.code})`,
+    );
+  }
+  uninstallProgress.succeed('Managed daemon uninstalled');
+
+  const rootProgress = createProgress('Removing managed root-owned files', showProgress);
+  let deleteRootArtifactsResult;
+  try {
+    deleteRootArtifactsResult = await sudoSession.run([
+      '/bin/rm',
+      '-rf',
+      DEFAULT_MANAGED_ROOT_DIR,
+      DEFAULT_MANAGED_STATE_DIR,
+      DEFAULT_MANAGED_LOG_DIR,
+    ]);
+  } catch (error) {
+    rootProgress.fail();
+    throw error;
+  }
+  if (deleteRootArtifactsResult.code !== 0) {
+    rootProgress.fail();
+    throw new Error(
+      deleteRootArtifactsResult.stderr.trim()
+        || deleteRootArtifactsResult.stdout.trim()
+        || `failed to delete managed root-owned files (exit code ${deleteRootArtifactsResult.code})`,
+    );
+  }
+  rootProgress.succeed('Managed root-owned files removed');
+
+  const localProgress = createProgress('Removing local WLFI files and credentials', showProgress);
+  const local = cleanupLocalAdminUninstallState();
+  localProgress.succeed('Local WLFI files and credentials removed');
+
+  const result = {
+    command: 'uninstall',
+    daemon: {
+      autostart: false,
+      label: DEFAULT_LAUNCH_DAEMON_LABEL,
+      launchdDomain: 'system',
+      plist: DEFAULT_LAUNCH_DAEMON_PLIST,
+      daemonSocket: DEFAULT_MANAGED_DAEMON_SOCKET,
+      stateFile: DEFAULT_MANAGED_STATE_FILE,
+      daemonRoot: DEFAULT_MANAGED_ROOT_DIR,
+      stateDir: DEFAULT_MANAGED_STATE_DIR,
+      logDir: DEFAULT_MANAGED_LOG_DIR,
+      systemKeychainPasswordService: DAEMON_PASSWORD_KEYCHAIN_SERVICE,
+      systemKeychainPasswordAccount: keychainAccount,
+    },
+    local,
+  };
+
+  if (options.json) {
+    print(result, true);
+    return;
+  }
+
+  printUninstallSummary({
+    daemon: {
+      label: result.daemon.label,
+      daemonRoot: result.daemon.daemonRoot,
+      stateDir: result.daemon.stateDir,
+      logDir: result.daemon.logDir,
+    },
+    local,
+  });
+}
+
+export async function runAdminResetCli(argv: string[]): Promise<void> {
+  const program = new Command();
+  program
+    .name('wlfi-agent admin reset')
+    .description(
+      'Delete the root-managed daemon state and local wallet credentials so a fresh wallet can be set up',
+    )
+    .option('-y, --yes', 'Skip the destructive confirmation prompt', false)
+    .option('--non-interactive', 'Disable confirmation prompts; requires --yes', false)
+    .option(
+      '--delete-config',
+      'Delete ~/.wlfi_agent/config.json instead of only clearing wallet-specific credentials',
+      false,
+    )
+    .option('--json', 'Print JSON output', false)
+    .action(runAdminReset);
+
+  await program.parseAsync(argv, { from: 'user' });
+}
+
+export async function runAdminUninstallCli(argv: string[]): Promise<void> {
+  const program = new Command();
+  program
+    .name('wlfi-agent admin uninstall')
+    .description(
+      'Fully remove the managed daemon, root-owned state, local wallet config, local binaries, and logs',
+    )
+    .option('-y, --yes', 'Skip the destructive confirmation prompt', false)
+    .option('--non-interactive', 'Disable confirmation prompts; requires --yes', false)
+    .option('--json', 'Print JSON output', false)
+    .action(runAdminUninstall);
+
+  await program.parseAsync(argv, { from: 'user' });
+}