agent-anywhere-gateway 0.1.0 → 0.1.1

package/README.md

@@ -14,7 +14,7 @@ npm install -g agent-anywhere-gateway
 agent-anywhere-gateway \
   --server https://agent-anywhere.example.com \
   --id office-mac \
-  --token replace-me \
+  --token your-real-token \
   --allowed-roots /Users/me/gitrepo \
   --provider codex
 ```
@@ -30,6 +30,31 @@ agent-anywhere-gateway \
   --providers codex,claude-code
 ```
 
+## Service install
+
+Install the gateway as a current-user service:
+
+```bash
+agent-anywhere-gateway service install \
+  --server https://agent-anywhere.example.com \
+  --id office-mac \
+  --token replace-me \
+  --allowed-roots /Users/me/gitrepo \
+  --provider codex
+```
+
+Manage it with:
+
+```bash
+agent-anywhere-gateway service status
+agent-anywhere-gateway service logs --follow
+agent-anywhere-gateway service restart
+agent-anywhere-gateway service uninstall
+```
+
+The service command uses native user-level managers: macOS LaunchAgent,
+Linux user systemd, and Windows Task Scheduler.
+
 `--server` accepts the Control Server or Worker URL and expands it to
 `/api/gateways/{gateway_id}/ws`. Use `--server-ws-url` when you need to pass
 the exact WebSocket URL.
@@ -43,4 +68,4 @@ The same settings can be provided with environment variables:
 - `AGENT_PROVIDER`
 - `AGENT_PROVIDERS`
 
-Version: 0.1.0
+Version: 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-anywhere-gateway",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Standalone Agent Anywhere Gateway CLI for controlled machines.",
   "main": "src/gateway/main.js",
   "bin": {

package/src/gateway/main.js

@@ -5,6 +5,7 @@ const {
   serverWsUrl,
   startGateway
 } = require("./client");
+const { runServiceCli } = require("./service");
 
 function parseArgs(argv = process.argv.slice(2)) {
   const options = {};
@@ -159,6 +160,9 @@ function helpText() {
     "  --dry-run                  Print resolved config and exit",
     "  --help                     Show this help",
     "",
+    "Commands:",
+    "  service <command>          Install or manage the gateway as an OS service",
+    "",
     "Environment:",
     "  AGENT_ANYWHERE_SERVER_WS_URL Control Server WebSocket URL",
     "  AGENT_ANYWHERE_GATEWAY_ID    Stable gateway machine id",
@@ -179,6 +183,9 @@ function printPlan(plan, log = console.log) {
 }
 
 function runCli(argv = process.argv.slice(2), env = process.env) {
+  if (argv[0] === "service") {
+    return runServiceCli(argv.slice(1), { env });
+  }
   const options = parseArgs(argv);
   if (options.help) {
     console.log(helpText());
@@ -218,6 +225,7 @@ module.exports = {
   registerUrl,
   resolveServerWsUrl,
   runCli,
+  runServiceCli,
   serverWsUrl,
   startGateway,
   toGatewayWsUrl

package/src/gateway/service.js

@@ -0,0 +1,568 @@
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+const { parseProviderList } = require("../shared/providers");
+
+const DEFAULT_LABEL = "com.agent-anywhere.gateway";
+const DEFAULT_LINUX_SERVICE_NAME = "agent-anywhere-gateway";
+const DEFAULT_WINDOWS_TASK_NAME = "AgentAnywhereGateway";
+const DEFAULT_GATEWAY_ID = "gateway";
+
+function readValue(argv, index, name) {
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--")) {
+    throw new Error(`${name} requires a value`);
+  }
+  return value;
+}
+
+function parseServiceArgs(argv = []) {
+  const first = argv[0];
+  const command = first && !first.startsWith("-") ? first : "help";
+  const startIndex = command === "help" && first && first.startsWith("-") ? 0 : 1;
+  const options = { command };
+  for (let index = startIndex; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const read = (name) => {
+      const value = readValue(argv, index, name);
+      index += 1;
+      return value;
+    };
+
+    if (arg === "--help" || arg === "-h") {
+      options.help = true;
+    } else if (arg === "--server" || arg === "--worker-url") {
+      options.server = read(arg);
+    } else if (arg === "--server-ws-url") {
+      options.serverWsUrl = read(arg);
+    } else if (arg === "--id") {
+      options.id = read(arg);
+    } else if (arg === "--name") {
+      options.name = read(arg);
+    } else if (arg === "--token") {
+      options.token = read(arg);
+    } else if (arg === "--allowed-roots") {
+      options.allowedRoots = read(arg);
+    } else if (arg === "--provider") {
+      options.provider = read(arg);
+    } else if (arg === "--providers") {
+      options.providers = read(arg);
+    } else if (arg === "--data-dir") {
+      options.dataDir = read(arg);
+    } else if (arg === "--replay-dir") {
+      options.replayDir = read(arg);
+    } else if (arg === "--reconnect-min-ms") {
+      options.reconnectMinMs = read(arg);
+    } else if (arg === "--reconnect-max-ms") {
+      options.reconnectMaxMs = read(arg);
+    } else if (arg === "--claude-auto-trust") {
+      options.claudeAutoTrust = true;
+    } else if (arg === "--label" || arg === "--service-name") {
+      options.label = read(arg);
+    } else if (arg === "--task-name") {
+      options.taskName = read(arg);
+    } else if (arg === "--cli-path") {
+      options.cliPath = read(arg);
+    } else if (arg === "--node-path") {
+      options.nodePath = read(arg);
+    } else if (arg === "--dry-run") {
+      options.dryRun = true;
+    } else if (arg === "--no-start") {
+      options.noStart = true;
+    } else if (arg === "--follow") {
+      options.follow = true;
+    } else {
+      throw new Error(`Unknown service option: ${arg}`);
+    }
+  }
+  return options;
+}
+
+function normalizeGatewayId(value) {
+  return String(value || os.hostname() || DEFAULT_GATEWAY_ID)
+    .trim()
+    .replace(/[^A-Za-z0-9_.-]+/g, "-")
+    .replace(/^-+|-+$/g, "") || DEFAULT_GATEWAY_ID;
+}
+
+function normalizeProviderList(value) {
+  return parseProviderList(value, ["codex"]).join(",");
+}
+
+function primaryProvider(value) {
+  return parseProviderList(value, ["codex"])[0] || "codex";
+}
+
+function toGatewayWsUrl(serverUrl, id) {
+  const url = new URL(serverUrl);
+  if (url.protocol === "http:") {
+    url.protocol = "ws:";
+  } else if (url.protocol === "https:") {
+    url.protocol = "wss:";
+  }
+  if (url.protocol !== "ws:" && url.protocol !== "wss:") {
+    throw new Error("--server must be an http(s) or ws(s) URL");
+  }
+  if (!url.pathname || url.pathname === "/") {
+    url.pathname = `/api/gateways/${encodeURIComponent(id)}/ws`;
+  }
+  return url.toString();
+}
+
+function windowsLocalAppData(env = process.env, homeDir = os.homedir()) {
+  return env.LOCALAPPDATA || path.join(homeDir, "AppData", "Local");
+}
+
+function defaultBaseDir(platform = process.platform, homeDir = os.homedir(), env = process.env) {
+  if (platform === "darwin") {
+    return path.join(homeDir, "Library", "Application Support", "agent-anywhere-gateway");
+  }
+  if (platform === "win32") {
+    return path.join(windowsLocalAppData(env, homeDir), "AgentAnywhereGateway");
+  }
+  return path.join(homeDir, ".local", "share", "agent-anywhere-gateway");
+}
+
+function defaultConfigDir(platform = process.platform, homeDir = os.homedir(), env = process.env) {
+  if (platform === "darwin") {
+    return path.join(homeDir, "Library", "Application Support", "agent-anywhere-gateway");
+  }
+  if (platform === "win32") {
+    return path.join(windowsLocalAppData(env, homeDir), "AgentAnywhereGateway");
+  }
+  return path.join(homeDir, ".config", "agent-anywhere-gateway");
+}
+
+function defaultLogDir(platform = process.platform, homeDir = os.homedir(), env = process.env) {
+  if (platform === "darwin") {
+    return path.join(homeDir, "Library", "Logs");
+  }
+  if (platform === "win32") {
+    return path.join(windowsLocalAppData(env, homeDir), "AgentAnywhereGateway", "Logs");
+  }
+  return path.join(homeDir, ".local", "state", "agent-anywhere-gateway");
+}
+
+function fallbackCliPath() {
+  return path.resolve(__dirname, "..", "..", "bin", "agent-anywhere-gateway.js");
+}
+
+function resolveCliPath(value = process.argv[1]) {
+  return path.resolve(value || fallbackCliPath());
+}
+
+function resolveServiceSettings(options = {}, {
+  env = process.env,
+  platform = process.platform,
+  homeDir = os.homedir(),
+  nodePath = process.execPath,
+  cliPath = resolveCliPath()
+} = {}) {
+  const id = normalizeGatewayId(options.id || env.AGENT_ANYWHERE_GATEWAY_ID);
+  const rawServerWsUrl = options.serverWsUrl || env.AGENT_ANYWHERE_SERVER_WS_URL ||
+    (options.server ? toGatewayWsUrl(options.server, id) : `ws://localhost:8787/api/gateways/${encodeURIComponent(id)}/ws`);
+  const serverWsUrl = String(rawServerWsUrl).replace("{gateway_id}", encodeURIComponent(id));
+  const providers = normalizeProviderList(options.providers || options.provider || env.AGENT_PROVIDERS || env.AGENT_PROVIDER || "codex");
+  const token = options.token || env.AGENT_ANYWHERE_GATEWAY_TOKEN || "";
+  const baseDir = defaultBaseDir(platform, homeDir, env);
+  const logDir = defaultLogDir(platform, homeDir, env);
+  const configDir = defaultConfigDir(platform, homeDir, env);
+  return {
+    platform,
+    homeDir,
+    id,
+    name: options.name || env.AGENT_ANYWHERE_MACHINE_NAME || id,
+    token,
+    serverWsUrl,
+    allowedRoots: options.allowedRoots || env.AGENT_ANYWHERE_ALLOWED_ROOTS || "",
+    providers,
+    primaryProvider: primaryProvider(providers),
+    claudeAutoTrust: options.claudeAutoTrust ? "1" : env.AGENT_ANYWHERE_CLAUDE_AUTO_TRUST || "",
+    dataDir: options.dataDir || env.AGENT_ANYWHERE_DATA_DIR || path.join(baseDir, "data"),
+    replayDir: options.replayDir || env.AGENT_ANYWHERE_GATEWAY_REPLAY_DIR || "",
+    reconnectMinMs: options.reconnectMinMs || env.AGENT_ANYWHERE_GATEWAY_RECONNECT_MIN_MS || "",
+    reconnectMaxMs: options.reconnectMaxMs || env.AGENT_ANYWHERE_GATEWAY_RECONNECT_MAX_MS || "",
+    label: options.label || DEFAULT_LABEL,
+    linuxServiceName: options.label || DEFAULT_LINUX_SERVICE_NAME,
+    windowsTaskName: options.taskName || options.label || DEFAULT_WINDOWS_TASK_NAME,
+    nodePath: path.resolve(options.nodePath || nodePath),
+    cliPath: resolveCliPath(options.cliPath || cliPath),
+    configDir,
+    logDir,
+    stdoutPath: path.join(logDir, "agent-anywhere-gateway.log"),
+    stderrPath: path.join(logDir, "agent-anywhere-gateway.err.log"),
+    noStart: Boolean(options.noStart),
+    dryRun: Boolean(options.dryRun)
+  };
+}
+
+function assertInstallSettings(settings) {
+  if (!settings.token || /^please-change-me$/i.test(settings.token) || /^replace-/i.test(settings.token)) {
+    throw new Error("service install requires a real --token or AGENT_ANYWHERE_GATEWAY_TOKEN");
+  }
+  if (!settings.allowedRoots) {
+    throw new Error("service install requires --allowed-roots or AGENT_ANYWHERE_ALLOWED_ROOTS");
+  }
+}
+
+function gatewayEnv(settings) {
+  const env = {
+    AGENT_ANYWHERE_GATEWAY_ID: settings.id,
+    AGENT_ANYWHERE_MACHINE_NAME: settings.name,
+    AGENT_ANYWHERE_GATEWAY_TOKEN: settings.token,
+    AGENT_ANYWHERE_SERVER_WS_URL: settings.serverWsUrl,
+    AGENT_ANYWHERE_ALLOWED_ROOTS: settings.allowedRoots,
+    AGENT_ANYWHERE_DATA_DIR: settings.dataDir,
+    AGENT_PROVIDERS: settings.providers,
+    AGENT_PROVIDER: settings.primaryProvider
+  };
+  if (settings.claudeAutoTrust) env.AGENT_ANYWHERE_CLAUDE_AUTO_TRUST = settings.claudeAutoTrust;
+  if (settings.replayDir) env.AGENT_ANYWHERE_GATEWAY_REPLAY_DIR = settings.replayDir;
+  if (settings.reconnectMinMs) env.AGENT_ANYWHERE_GATEWAY_RECONNECT_MIN_MS = settings.reconnectMinMs;
+  if (settings.reconnectMaxMs) env.AGENT_ANYWHERE_GATEWAY_RECONNECT_MAX_MS = settings.reconnectMaxMs;
+  return env;
+}
+
+function xmlEscape(value) {
+  return String(value)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+function plistForSettings(settings) {
+  const env = gatewayEnv(settings);
+  const envXml = Object.keys(env).sort().map((key) => (
+    `    <key>${xmlEscape(key)}</key>\n    <string>${xmlEscape(env[key])}</string>`
+  )).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xmlEscape(settings.label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xmlEscape(settings.nodePath)}</string>
+    <string>${xmlEscape(settings.cliPath)}</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${xmlEscape(settings.homeDir || os.homedir())}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+${envXml}
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(settings.stdoutPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(settings.stderrPath)}</string>
+</dict>
+</plist>
+`;
+}
+
+function shellSingleQuote(value) {
+  return `'${String(value).replace(/'/g, "'\\''")}'`;
+}
+
+function systemdQuote(value) {
+  return `"${String(value).replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+
+function envFileContent(settings) {
+  return Object.keys(gatewayEnv(settings)).sort()
+    .map((key) => `${key}=${shellSingleQuote(gatewayEnv(settings)[key])}`)
+    .join("\n") + "\n";
+}
+
+function systemdUnitForSettings(settings) {
+  const envFile = path.join(settings.configDir, "gateway.env");
+  return `[Unit]
+Description=Agent Anywhere Gateway
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=${systemdQuote(envFile)}
+ExecStart=${systemdQuote(settings.nodePath)} ${systemdQuote(settings.cliPath)}
+Restart=always
+RestartSec=5
+WorkingDirectory=${systemdQuote(settings.homeDir || os.homedir())}
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+function windowsCmdEscape(value) {
+  return String(value).replace(/%/g, "%%");
+}
+
+function windowsRunnerForSettings(settings) {
+  const lines = ["@echo off"];
+  for (const key of Object.keys(gatewayEnv(settings)).sort()) {
+    lines.push(`set "${key}=${windowsCmdEscape(gatewayEnv(settings)[key])}"`);
+  }
+  lines.push(`if not exist "${windowsCmdEscape(settings.logDir)}" mkdir "${windowsCmdEscape(settings.logDir)}"`);
+  lines.push(`"${windowsCmdEscape(settings.nodePath)}" "${windowsCmdEscape(settings.cliPath)}" >> "${windowsCmdEscape(settings.stdoutPath)}" 2>> "${windowsCmdEscape(settings.stderrPath)}"`);
+  return `${lines.join("\r\n")}\r\n`;
+}
+
+function chmodPrivate(filePath) {
+  if (process.platform !== "win32") {
+    fs.chmodSync(filePath, 0o600);
+  }
+}
+
+function runCommand(command, args, { dryRun = false, executor = spawnSync, allowFailure = false } = {}) {
+  if (dryRun) {
+    console.log([command, ...args].join(" "));
+    return { status: 0 };
+  }
+  const result = executor(command, args, { stdio: "inherit" });
+  if (result.error && !allowFailure) {
+    throw result.error;
+  }
+  if (result.status !== 0 && !allowFailure) {
+    throw new Error(`${command} ${args.join(" ")} failed with status ${result.status}`);
+  }
+  return result;
+}
+
+function writeFile(filePath, content, { dryRun = false } = {}) {
+  if (dryRun) {
+    console.log(`Would write ${filePath}`);
+    return;
+  }
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, "utf8");
+}
+
+function macPaths(settings, homeDir = os.homedir()) {
+  return {
+    plistPath: path.join(homeDir, "Library", "LaunchAgents", `${settings.label}.plist`)
+  };
+}
+
+function linuxPaths(settings, homeDir = os.homedir()) {
+  return {
+    envPath: path.join(settings.configDir, "gateway.env"),
+    servicePath: path.join(homeDir, ".config", "systemd", "user", `${settings.linuxServiceName}.service`)
+  };
+}
+
+function windowsPaths(settings) {
+  return {
+    runnerPath: path.join(settings.configDir, "run-gateway.cmd")
+  };
+}
+
+function installMacService(settings, options = {}) {
+  const { plistPath } = macPaths(settings, options.homeDir || settings.homeDir || os.homedir());
+  writeFile(plistPath, plistForSettings(settings), settings);
+  if (!settings.dryRun) {
+    fs.mkdirSync(settings.logDir, { recursive: true });
+    fs.mkdirSync(settings.dataDir, { recursive: true });
+    chmodPrivate(plistPath);
+  }
+  const domain = `gui/${typeof process.getuid === "function" ? process.getuid() : ""}`;
+  runCommand("launchctl", ["bootout", domain, plistPath], { ...options, dryRun: settings.dryRun, executor: options.executor || spawnSync, allowFailure: true });
+  runCommand("launchctl", ["bootstrap", domain, plistPath], { ...options, dryRun: settings.dryRun, executor: options.executor || spawnSync });
+  runCommand("launchctl", ["enable", `${domain}/${settings.label}`], { ...options, dryRun: settings.dryRun, executor: options.executor || spawnSync });
+  if (!settings.noStart) {
+    runCommand("launchctl", ["kickstart", "-k", `${domain}/${settings.label}`], { ...options, dryRun: settings.dryRun, executor: options.executor || spawnSync });
+  }
+  return { path: plistPath };
+}
+
+function installLinuxService(settings, options = {}) {
+  const { envPath, servicePath } = linuxPaths(settings, options.homeDir || settings.homeDir || os.homedir());
+  writeFile(envPath, envFileContent(settings), settings);
+  writeFile(servicePath, systemdUnitForSettings(settings), settings);
+  if (!settings.dryRun) {
+    fs.mkdirSync(settings.dataDir, { recursive: true });
+    fs.mkdirSync(settings.logDir, { recursive: true });
+    chmodPrivate(envPath);
+  }
+  const executor = options.executor || spawnSync;
+  runCommand("systemctl", ["--user", "daemon-reload"], { dryRun: settings.dryRun, executor });
+  runCommand("systemctl", ["--user", "enable", `${settings.linuxServiceName}.service`], { dryRun: settings.dryRun, executor });
+  if (!settings.noStart) {
+    runCommand("systemctl", ["--user", "restart", `${settings.linuxServiceName}.service`], { dryRun: settings.dryRun, executor });
+  }
+  return { path: servicePath, envPath };
+}
+
+function installWindowsService(settings, options = {}) {
+  const { runnerPath } = windowsPaths(settings);
+  writeFile(runnerPath, windowsRunnerForSettings(settings), settings);
+  const executor = options.executor || spawnSync;
+  runCommand("schtasks", ["/Create", "/TN", settings.windowsTaskName, "/TR", `"${runnerPath}"`, "/SC", "ONLOGON", "/F"], {
+    dryRun: settings.dryRun,
+    executor
+  });
+  if (!settings.noStart) {
+    runCommand("schtasks", ["/Run", "/TN", settings.windowsTaskName], { dryRun: settings.dryRun, executor });
+  }
+  return { path: runnerPath };
+}
+
+function installService(settings, options = {}) {
+  assertInstallSettings(settings);
+  if (settings.platform === "darwin") return installMacService(settings, options);
+  if (settings.platform === "win32") return installWindowsService(settings, options);
+  return installLinuxService(settings, options);
+}
+
+function controlService(command, settings, options = {}) {
+  const executor = options.executor || spawnSync;
+  if (settings.platform === "darwin") {
+    const { plistPath } = macPaths(settings, options.homeDir || settings.homeDir || os.homedir());
+    const domain = `gui/${typeof process.getuid === "function" ? process.getuid() : ""}`;
+    if (command === "status") return runCommand("launchctl", ["print", `${domain}/${settings.label}`], { dryRun: settings.dryRun, executor });
+    if (command === "start") {
+      runCommand("launchctl", ["bootstrap", domain, plistPath], { dryRun: settings.dryRun, executor, allowFailure: true });
+      return runCommand("launchctl", ["kickstart", "-k", `${domain}/${settings.label}`], { dryRun: settings.dryRun, executor });
+    }
+    if (command === "restart") return runCommand("launchctl", ["kickstart", "-k", `${domain}/${settings.label}`], { dryRun: settings.dryRun, executor });
+    if (command === "stop") return runCommand("launchctl", ["bootout", domain, plistPath], { dryRun: settings.dryRun, executor });
+    if (command === "uninstall") {
+      runCommand("launchctl", ["bootout", domain, plistPath], { dryRun: settings.dryRun, executor, allowFailure: true });
+      if (!settings.dryRun && fs.existsSync(plistPath)) fs.unlinkSync(plistPath);
+      return { status: 0 };
+    }
+    if (command === "logs") {
+      const args = settings.follow ?
+        ["-f", settings.stdoutPath, settings.stderrPath] :
+        ["-n", "100", settings.stdoutPath, settings.stderrPath];
+      return runCommand("tail", args, { dryRun: settings.dryRun, executor });
+    }
+  }
+  if (settings.platform === "win32") {
+    if (command === "status") return runCommand("schtasks", ["/Query", "/TN", settings.windowsTaskName, "/V", "/FO", "LIST"], { dryRun: settings.dryRun, executor });
+    if (command === "start" || command === "restart") return runCommand("schtasks", ["/Run", "/TN", settings.windowsTaskName], { dryRun: settings.dryRun, executor });
+    if (command === "stop") return runCommand("schtasks", ["/End", "/TN", settings.windowsTaskName], { dryRun: settings.dryRun, executor });
+    if (command === "uninstall") return runCommand("schtasks", ["/Delete", "/TN", settings.windowsTaskName, "/F"], { dryRun: settings.dryRun, executor, allowFailure: true });
+    if (command === "logs") {
+      if (settings.follow) {
+        return runCommand("powershell.exe", [
+          "-NoProfile",
+          "-Command",
+          `Get-Content -LiteralPath '${settings.stdoutPath.replace(/'/g, "''")}', '${settings.stderrPath.replace(/'/g, "''")}' -Tail 100 -Wait`
+        ], { dryRun: settings.dryRun, executor });
+      }
+      return runCommand("cmd.exe", ["/d", "/c", "type", settings.stdoutPath, settings.stderrPath], { dryRun: settings.dryRun, executor });
+    }
+  }
+  const serviceName = `${settings.linuxServiceName}.service`;
+  if (command === "status") return runCommand("systemctl", ["--user", "status", serviceName, "--no-pager"], { dryRun: settings.dryRun, executor });
+  if (command === "start") return runCommand("systemctl", ["--user", "start", serviceName], { dryRun: settings.dryRun, executor });
+  if (command === "restart") return runCommand("systemctl", ["--user", "restart", serviceName], { dryRun: settings.dryRun, executor });
+  if (command === "stop") return runCommand("systemctl", ["--user", "stop", serviceName], { dryRun: settings.dryRun, executor });
+  if (command === "uninstall") {
+    runCommand("systemctl", ["--user", "disable", "--now", serviceName], { dryRun: settings.dryRun, executor, allowFailure: true });
+    const { envPath, servicePath } = linuxPaths(settings, options.homeDir || settings.homeDir || os.homedir());
+    if (!settings.dryRun) {
+      if (fs.existsSync(servicePath)) fs.unlinkSync(servicePath);
+      if (fs.existsSync(envPath)) fs.unlinkSync(envPath);
+    }
+    runCommand("systemctl", ["--user", "daemon-reload"], { dryRun: settings.dryRun, executor });
+    return { status: 0 };
+  }
+  if (command === "logs") {
+    const args = ["--user", "-u", serviceName, "-n", "100", "--no-pager"];
+    if (settings.follow) args.push("-f");
+    return runCommand("journalctl", args, { dryRun: settings.dryRun, executor });
+  }
+  throw new Error(`Unknown service command: ${command}`);
+}
+
+function redacted(value) {
+  if (!value) return "";
+  const text = String(value);
+  return `${text.slice(0, 4)}...${text.slice(-4)}`;
+}
+
+function printServicePlan(settings, log = console.log) {
+  log(`Service platform: ${settings.platform}`);
+  log(`Gateway id: ${settings.id}`);
+  log(`Machine name: ${settings.name}`);
+  log(`Server WS URL: ${settings.serverWsUrl}`);
+  log(`Allowed roots: ${settings.allowedRoots}`);
+  log(`Providers: ${settings.providers}`);
+  log(`Gateway token: ${settings.token ? redacted(settings.token) : "(missing)"}`);
+  log(`Data dir: ${settings.dataDir}`);
+  log(`Log dir: ${settings.logDir}`);
+}
+
+function serviceHelpText() {
+  return `Usage:
+  agent-anywhere-gateway service install --server <url> --id <id> --token <token> --allowed-roots <paths> [--provider <provider>]
+  agent-anywhere-gateway service status
+  agent-anywhere-gateway service start
+  agent-anywhere-gateway service stop
+  agent-anywhere-gateway service restart
+  agent-anywhere-gateway service logs [--follow]
+  agent-anywhere-gateway service uninstall
+
+Install options:
+  --server <url>             Control Server or Worker URL, http(s) or ws(s).
+  --server-ws-url <url>      Explicit gateway WebSocket URL.
+  --id <id>                  Stable gateway machine id.
+  --name <name>              Human-readable machine name.
+  --token <token>            Shared gateway token.
+  --allowed-roots <paths>    Comma-separated allowed project roots.
+  --provider <provider>      Local provider. Default: codex.
+  --providers <providers>    Comma-separated local providers, e.g. codex,claude-code.
+  --data-dir <path>          Gateway data directory.
+  --claude-auto-trust        Trust allowed project paths for Claude Remote Control.
+  --label <name>             Service label/name. macOS default: ${DEFAULT_LABEL}; Linux default: ${DEFAULT_LINUX_SERVICE_NAME}.
+  --task-name <name>         Windows scheduled task name. Default: ${DEFAULT_WINDOWS_TASK_NAME}.
+  --no-start                 Install and enable without starting immediately.
+  --dry-run                  Print service actions without writing or running commands.
+`;
+}
+
+function runServiceCli(argv = process.argv.slice(2), options = {}) {
+  const parsed = parseServiceArgs(argv);
+  if (parsed.help || parsed.command === "help") {
+    console.log(serviceHelpText());
+    return Promise.resolve();
+  }
+  const settings = resolveServiceSettings(parsed, options);
+  if (parsed.command === "install") {
+    printServicePlan(settings);
+    installService(settings, options);
+    return Promise.resolve();
+  }
+  controlService(parsed.command, settings, options);
+  return Promise.resolve();
+}
+
+module.exports = {
+  DEFAULT_LABEL,
+  DEFAULT_LINUX_SERVICE_NAME,
+  DEFAULT_WINDOWS_TASK_NAME,
+  controlService,
+  envFileContent,
+  gatewayEnv,
+  installService,
+  parseServiceArgs,
+  plistForSettings,
+  resolveServiceSettings,
+  runServiceCli,
+  serviceHelpText,
+  systemdUnitForSettings,
+  toGatewayWsUrl,
+  windowsRunnerForSettings
+};