aibex 0.0.0-stage → 0.0.1

package/dist/supervisor.js

@@ -0,0 +1,1781 @@
+import { spawn, fork } from "node:child_process";
+import { readFileSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:net";
+import { rename } from "node:fs/promises";
+function log(source, message) {
+  process.stdout.write(`[${source}] ${message}
+`);
+}
+function formatDuration(ms) {
+  if (ms < 1e3) return `${Math.round(ms)}ms`;
+  const seconds = Math.round(ms / 1e3);
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes >= 60) {
+    const hours = Math.floor(minutes / 60);
+    const restMinutes = minutes % 60;
+    return restMinutes === 0 ? `${hours}h` : `${hours}h${restMinutes}m`;
+  }
+  const rest = seconds % 60;
+  return rest === 0 ? `${minutes}m` : `${minutes}m${rest}s`;
+}
+const PACKAGE_ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  ".."
+);
+function readInstalledVersion(root = PACKAGE_ROOT) {
+  const manifest = JSON.parse(
+    readFileSync(path.join(root, "package.json"), "utf8")
+  );
+  if (typeof manifest.version !== "string") {
+    throw new TypeError(`${root}/package.json has no version`);
+  }
+  return manifest.version;
+}
+function aibexHome(env = process.env) {
+  const override = env.AIBEX_HOME;
+  return override ? path.resolve(override) : path.join(homedir(), ".aibex");
+}
+function statePaths(home) {
+  return {
+    home,
+    pidFile: path.join(home, "aibexd.pid"),
+    configFile: path.join(home, "config.json"),
+    stateFile: path.join(home, "state.json"),
+    socketFile: path.join(home, "supervisor.sock"),
+    versionsDir: path.join(home, "versions"),
+    hostsDir: path.join(home, "hosts")
+  };
+}
+function writeFileAtomicSync(file, content) {
+  mkdirSync(path.dirname(file), { recursive: true });
+  const temporary = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync(temporary, content);
+    renameSync(temporary, file);
+  } catch (error) {
+    rmSync(temporary, { force: true });
+    throw error;
+  }
+}
+function writeJsonAtomicSync(file, value) {
+  writeFileAtomicSync(file, `${JSON.stringify(value, void 0, 2)}
+`);
+}
+function readJsonSync(file) {
+  let text;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function writeSupervisorState(paths, state) {
+  writeJsonAtomicSync(paths.stateFile, state);
+}
+function readSupervisorState(paths) {
+  const value = readJsonSync(paths.stateFile);
+  if (typeof value !== "object" || value === null) return void 0;
+  const state = value;
+  if (typeof state.supervisor?.pid !== "number" || typeof state.link !== "object" || !Array.isArray(state.warnings)) {
+    return void 0;
+  }
+  return state;
+}
+function resolveLinkSource(env = process.env) {
+  const localPath = env.AIBEX_LINK_PATH;
+  if (!localPath) {
+    return { kind: "unavailable", reason: "AIBEX_LINK_PATH is not set" };
+  }
+  return resolveLocalLink(path.resolve(localPath));
+}
+function resolveLocalLink(directory) {
+  let manifest;
+  try {
+    manifest = JSON.parse(
+      readFileSync(path.join(directory, "package.json"), "utf8")
+    );
+  } catch {
+    return {
+      kind: "unavailable",
+      reason: `AIBEX_LINK_PATH ${directory} has no readable package.json`
+    };
+  }
+  const entry = path.join(
+    directory,
+    typeof manifest.main === "string" ? manifest.main : "dist/index.js"
+  );
+  if (!existsSync(entry)) {
+    return {
+      kind: "unavailable",
+      reason: `AIBEX_LINK_PATH ${directory} is not built: ${entry} is missing (run pnpm build)`
+    };
+  }
+  return {
+    kind: "local",
+    path: directory,
+    entry,
+    version: typeof manifest.version === "string" ? manifest.version : "unknown"
+  };
+}
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][\dA-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][\dA-Za-z-]*))*))?(?:\+[\dA-Za-z-]+(?:\.[\dA-Za-z-]+)*)?$/;
+function parseSemver(value) {
+  const match = SEMVER.exec(value);
+  if (!match) return void 0;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ? match[4].split(".") : []
+  };
+}
+function isSemver(value) {
+  return typeof value === "string" && parseSemver(value) !== void 0;
+}
+function compareIdentifiers(a, b) {
+  const aNumeric = /^\d+$/.test(a);
+  const bNumeric = /^\d+$/.test(b);
+  if (aNumeric && bNumeric) return Math.sign(Number(a) - Number(b));
+  if (aNumeric) return -1;
+  if (bNumeric) return 1;
+  if (a === b) return 0;
+  return a < b ? -1 : 1;
+}
+function compareSemver(a, b) {
+  const left = parseSemver(a);
+  const right = parseSemver(b);
+  if (!left || !right) throw new TypeError(`not semver: ${a} or ${b}`);
+  for (const key of ["major", "minor", "patch"]) {
+    if (left[key] !== right[key]) return Math.sign(left[key] - right[key]);
+  }
+  if (left.prerelease.length === 0 || right.prerelease.length === 0) {
+    return right.prerelease.length - left.prerelease.length === 0 ? 0 : left.prerelease.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.prerelease.length, right.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const l = left.prerelease[index];
+    const r = right.prerelease[index];
+    if (l === void 0) return -1;
+    if (r === void 0) return 1;
+    const order = compareIdentifiers(l, r);
+    if (order !== 0) return order;
+  }
+  return 0;
+}
+function isNewer(candidate, running) {
+  if (!isSemver(candidate)) return false;
+  if (running === null || !isSemver(running)) return true;
+  return compareSemver(candidate, running) > 0;
+}
+function machineConfig(timings) {
+  return {
+    backoffInitialMs: timings.backoffInitialMs,
+    backoffMaxMs: timings.backoffMaxMs,
+    backoffResetMs: timings.backoffResetMs,
+    hungMs: timings.hungMs,
+    linkStopMs: timings.linkStopMs,
+    failingAfter: 3,
+    updateCheckMs: timings.updateCheckMs,
+    attemptInitialMs: timings.attemptInitialMs,
+    attemptMaxMs: timings.attemptMaxMs,
+    probationMs: timings.probationMs,
+    readyTimeoutMs: timings.readyTimeoutMs,
+    rollbackAfter: 3,
+    aibexdCheckMs: timings.aibexdCheckMs
+  };
+}
+const WARNING_LINK_FAILING = "link-failing";
+const WARNING_LINK_UNAVAILABLE = "link-unavailable";
+const WARNING_LINK_UPDATE = "link-update";
+const WARNING_LINK_BAD = "link-bad";
+const WARNING_LINK_ROLLED_BACK = "link-rolled-back";
+const WARNING_AIBEXD_OUTDATED = "aibexd-outdated";
+function emptyVersions() {
+  return {
+    current: null,
+    previous: null,
+    bad: {},
+    attempts: {},
+    aibexdNotified: null
+  };
+}
+function initialState(config, versions) {
+  return {
+    mode: versions ? "installed" : "local",
+    status: "starting",
+    pid: null,
+    startedAt: null,
+    readyAt: null,
+    lastAliveAt: null,
+    restartAt: null,
+    killAt: null,
+    afterStop: "exit",
+    delayMs: config.backoffInitialMs,
+    failures: 0,
+    hung: false,
+    notReady: false,
+    reason: null,
+    warnings: [],
+    versions: versions ?? emptyVersions(),
+    probation: null,
+    update: null,
+    report: null,
+    nextCheckAt: null,
+    nextAibexdCheckAt: null
+  };
+}
+function setWarning(warnings, warning) {
+  return [...warnings.filter((w) => w.code !== warning.code), warning];
+}
+function clearWarning(warnings, code) {
+  return warnings.filter((w) => w.code !== code);
+}
+function clearSuperseded(warnings, current) {
+  return warnings.filter((warning) => {
+    const [code, version] = warning.code.split("@");
+    if (code !== WARNING_LINK_BAD && code !== WARNING_LINK_ROLLED_BACK) {
+      return true;
+    }
+    return !(version !== void 0 && isSemver(version) && isSemver(current) && compareSemver(version, current) < 0);
+  });
+}
+function describeExit(code, signal) {
+  return signal ? `killed by ${signal}` : `exited with code ${code ?? 0}`;
+}
+function resetIfHealthy(state, now, config) {
+  if (state.failures === 0 || state.startedAt === null || now - state.startedAt < config.backoffResetMs) {
+    return state;
+  }
+  return {
+    ...state,
+    delayMs: config.backoffInitialMs,
+    failures: 0,
+    warnings: clearWarning(state.warnings, WARNING_LINK_FAILING)
+  };
+}
+function fail(state, reason, now, config) {
+  const delay = state.delayMs;
+  const failures = state.failures + 1;
+  let warnings = state.warnings;
+  if (failures >= config.failingAfter) {
+    warnings = setWarning(warnings, {
+      code: WARNING_LINK_FAILING,
+      message: `the link has failed ${failures} times in a row (last: ${reason}); aibexd keeps restarting it`
+    });
+  }
+  return {
+    state: {
+      ...state,
+      status: "waiting",
+      pid: null,
+      startedAt: null,
+      readyAt: null,
+      lastAliveAt: null,
+      restartAt: now + delay,
+      killAt: null,
+      delayMs: Math.min(delay * 2, config.backoffMaxMs),
+      failures,
+      hung: false,
+      notReady: false,
+      reason,
+      warnings
+    },
+    actions: [
+      {
+        type: "log",
+        message: `${reason}; restarting in ${formatDuration(delay)}`
+      }
+    ]
+  };
+}
+function startFresh(state, config) {
+  return {
+    ...state,
+    status: "starting",
+    pid: null,
+    startedAt: null,
+    readyAt: null,
+    lastAliveAt: null,
+    restartAt: null,
+    killAt: null,
+    afterStop: "exit",
+    delayMs: config.backoffInitialMs,
+    failures: 0,
+    hung: false,
+    notReady: false,
+    reason: null,
+    warnings: clearWarning(state.warnings, WARNING_LINK_FAILING)
+  };
+}
+function rollBack(state, reason, config) {
+  const from = state.versions.current ?? "";
+  const to = state.versions.previous ?? "";
+  const failed = `failed ${config.rollbackAfter} times in its first ${formatDuration(config.probationMs)} (last: ${reason})`;
+  const why = `it ${failed}`;
+  const actions = [
+    {
+      type: "log",
+      message: `aibex-link ${from} ${failed}; rolling back to ${to}`
+    },
+    { type: "remove-version", version: from },
+    { type: "spawn" }
+  ];
+  if (state.report) {
+    actions.push({
+      type: "report",
+      report: { kind: "rolled-back", from, to, reason: why }
+    });
+  }
+  const fresh = startFresh(state, config);
+  return {
+    state: {
+      ...fresh,
+      versions: {
+        ...state.versions,
+        current: to,
+        previous: null,
+        bad: { ...state.versions.bad, [from]: `rolled back: ${why}` }
+      },
+      probation: null,
+      report: null,
+      warnings: setWarning(fresh.warnings, {
+        code: `${WARNING_LINK_ROLLED_BACK}@${from}`,
+        message: `aibex-link ${from} was rolled back to ${to}: ${why}; it will not be tried again`
+      })
+    },
+    actions
+  };
+}
+function linkFailed(state, reason, now, config) {
+  if (state.probation && state.versions.previous !== null) {
+    const failures = state.probation.failures + 1;
+    if (failures >= config.rollbackAfter) {
+      return rollBack(state, reason, config);
+    }
+    return fail({ ...state, probation: { failures } }, reason, now, config);
+  }
+  return fail(resetIfHealthy(state, now, config), reason, now, config);
+}
+function idle(state, reason) {
+  return {
+    ...state,
+    status: "idle",
+    pid: null,
+    reason,
+    warnings: setWarning(state.warnings, {
+      code: WARNING_LINK_UNAVAILABLE,
+      message: `the link is not running: ${reason}`
+    })
+  };
+}
+function checked(state, result, now, config) {
+  const update = state.update;
+  if (update?.phase !== "checking") return { state, actions: [] };
+  const force = update.force;
+  const { current } = state.versions;
+  const done = { ...state, update: null };
+  const report = (value) => force ? [{ type: "report", report: value }] : [];
+  if (!result.ok) {
+    const actions = [
+      { type: "log", message: `${result.reason}; checking again later` },
+      ...report({ kind: "failed", version: null, reason: result.reason })
+    ];
+    if (current === null) {
+      return {
+        state: idle(
+          {
+            ...done,
+            nextCheckAt: now + state.delayMs,
+            delayMs: Math.min(state.delayMs * 2, config.backoffMaxMs)
+          },
+          `no link installed, and ${result.reason}`
+        ),
+        actions
+      };
+    }
+    return {
+      state: { ...done, nextCheckAt: now + config.updateCheckMs },
+      actions
+    };
+  }
+  const target = result.version;
+  const nextCheckAt = now + config.updateCheckMs;
+  if (!isNewer(target, current)) {
+    return {
+      state: {
+        ...done,
+        nextCheckAt,
+        warnings: clearWarning(state.warnings, WARNING_LINK_UPDATE)
+      },
+      actions: report({ kind: "up-to-date", version: current ?? target })
+    };
+  }
+  const badReason = state.versions.bad[target];
+  if (badReason !== void 0) {
+    let next2 = { ...done, nextCheckAt };
+    if (current === null) {
+      next2 = idle(
+        next2,
+        `aibex-link ${target}, the latest, will not be run (${badReason}); waiting for a newer release`
+      );
+    }
+    return {
+      state: next2,
+      actions: report({ kind: "bad", version: target, reason: badReason })
+    };
+  }
+  const attempt = state.versions.attempts[target];
+  if (!force && attempt && attempt.nextAt > now) {
+    return {
+      state: { ...done, nextCheckAt: Math.min(nextCheckAt, attempt.nextAt) },
+      actions: []
+    };
+  }
+  let next = {
+    ...state,
+    update: { phase: "installing", version: target, force },
+    nextCheckAt: null
+  };
+  if (current === null) {
+    next = {
+      ...next,
+      status: "idle",
+      reason: `installing aibex-link ${target}`
+    };
+  }
+  return {
+    state: next,
+    actions: [
+      {
+        type: "log",
+        message: current === null ? `installing aibex-link ${target}` : `aibex-link ${target} is available (running ${current}); installing it`
+      },
+      { type: "install", version: target }
+    ]
+  };
+}
+function switchTo(state, version, force, now, config) {
+  const { current } = state.versions;
+  const attempts = { ...state.versions.attempts };
+  delete attempts[version];
+  const base = {
+    ...state,
+    update: null,
+    nextCheckAt: now + config.updateCheckMs,
+    warnings: clearWarning(state.warnings, WARNING_LINK_UPDATE),
+    report: force ? { from: current, to: version } : null,
+    versions: {
+      ...state.versions,
+      current: version,
+      previous: current,
+      attempts
+    },
+    probation: current === null ? null : { failures: 0 }
+  };
+  const actions = [
+    {
+      type: "log",
+      message: current === null ? `installed aibex-link ${version}; starting it` : `installed aibex-link ${version}; switching from ${current}`
+    }
+  ];
+  switch (state.status) {
+    case "running": {
+      return {
+        state: {
+          ...base,
+          status: "stopping",
+          afterStop: "start",
+          restartAt: null,
+          killAt: now + config.linkStopMs
+        },
+        actions: [...actions, { type: "kill", signal: "SIGTERM" }]
+      };
+    }
+    case "waiting":
+    case "idle":
+    case "starting": {
+      return {
+        state: startFresh(base, config),
+        actions: [...actions, { type: "spawn" }]
+      };
+    }
+    case "stopping":
+    case "stopped": {
+      return { state: base, actions };
+    }
+  }
+}
+function installed(state, outcome, now, config) {
+  const update = state.update;
+  if (update?.phase !== "installing" || update.version !== outcome.version) {
+    return { state, actions: [] };
+  }
+  const force = update.force;
+  const version = outcome.version;
+  if (outcome.ok) return switchTo(state, version, force, now, config);
+  const { current } = state.versions;
+  const reportFailed = force ? [
+    {
+      type: "report",
+      report: { kind: "failed", version, reason: outcome.reason }
+    }
+  ] : [];
+  if (outcome.kind === "bad") {
+    const message2 = `aibex-link ${version} will not be run: ${outcome.reason}`;
+    let next2 = {
+      ...state,
+      update: null,
+      nextCheckAt: now + config.updateCheckMs,
+      versions: {
+        ...state.versions,
+        bad: { ...state.versions.bad, [version]: outcome.reason }
+      },
+      warnings: setWarning(state.warnings, {
+        code: `${WARNING_LINK_BAD}@${version}`,
+        message: message2
+      })
+    };
+    if (current === null) {
+      next2 = idle(
+        next2,
+        `aibex-link ${version}, the latest, will not be run (${outcome.reason}); waiting for a newer release`
+      );
+    }
+    return {
+      state: next2,
+      actions: [{ type: "log", message: message2 }, ...reportFailed]
+    };
+  }
+  const failures = (state.versions.attempts[version]?.failures ?? 0) + 1;
+  const wait = Math.min(
+    config.attemptInitialMs * 2 ** (failures - 1),
+    config.attemptMaxMs
+  );
+  const message = outcome.kind === "not-served" ? `aibex-link ${version} is not served by the registry yet (npm: ${outcome.reason}); trying again in ${formatDuration(wait)}` : `this machine cannot self-update aibex-link to ${version}: npm says: ${outcome.reason}; trying again in ${formatDuration(wait)}`;
+  let next = {
+    ...state,
+    update: null,
+    nextCheckAt: Math.min(now + config.updateCheckMs, now + wait),
+    versions: {
+      ...state.versions,
+      attempts: {
+        ...state.versions.attempts,
+        [version]: { failures, nextAt: now + wait }
+      }
+    },
+    warnings: setWarning(state.warnings, {
+      code: WARNING_LINK_UPDATE,
+      message
+    })
+  };
+  if (current === null) {
+    next = idle(next, `no link installed: ${message}`);
+  }
+  return {
+    state: next,
+    actions: [{ type: "log", message }, ...reportFailed]
+  };
+}
+function aibexdChecked(state, result, installedVersion, now, config) {
+  const next = { ...state, nextAibexdCheckAt: now + config.aibexdCheckMs };
+  if (!result.ok) return { state: next, actions: [] };
+  const latest = result.version;
+  if (!isNewer(latest, installedVersion)) {
+    return {
+      state: {
+        ...next,
+        warnings: clearWarning(state.warnings, WARNING_AIBEXD_OUTDATED)
+      },
+      actions: []
+    };
+  }
+  const message = `aibexd ${latest} is published (installed: ${installedVersion}). Run \`npm i -g aibex@${latest}\`; a running aibexd picks it up on its own within minutes, or at once with \`aibexd restart\``;
+  const warned = {
+    ...next,
+    warnings: setWarning(state.warnings, {
+      code: WARNING_AIBEXD_OUTDATED,
+      message
+    })
+  };
+  if (state.versions.aibexdNotified === latest) {
+    return { state: warned, actions: [] };
+  }
+  return {
+    state: {
+      ...warned,
+      versions: { ...warned.versions, aibexdNotified: latest }
+    },
+    actions: [{ type: "log", message }]
+  };
+}
+function transition(state, event, now, config) {
+  const none = { state, actions: [] };
+  switch (event.type) {
+    case "start": {
+      if (state.status !== "starting") return none;
+      const scheduled = {
+        ...state,
+        nextAibexdCheckAt: now,
+        nextCheckAt: state.mode === "installed" ? now : null
+      };
+      if (state.mode === "installed" && state.versions.current === null) {
+        return {
+          state: idle(
+            scheduled,
+            "no link installed yet; checking npm for the latest aibex-link"
+          ),
+          actions: []
+        };
+      }
+      return { state: scheduled, actions: [{ type: "spawn" }] };
+    }
+    case "spawned": {
+      if (state.status !== "starting") return none;
+      return {
+        state: {
+          ...state,
+          status: "running",
+          pid: event.pid,
+          startedAt: now,
+          readyAt: null,
+          lastAliveAt: null,
+          restartAt: null,
+          hung: false,
+          notReady: false,
+          reason: null,
+          warnings: clearWarning(state.warnings, WARNING_LINK_UNAVAILABLE)
+        },
+        actions: []
+      };
+    }
+    case "spawn-failed": {
+      if (state.status !== "starting") return none;
+      return linkFailed(
+        {
+          ...state,
+          warnings: setWarning(state.warnings, {
+            code: WARNING_LINK_UNAVAILABLE,
+            message: `the link is not running: ${event.reason}`
+          })
+        },
+        `link not started: ${event.reason}`,
+        now,
+        config
+      );
+    }
+    case "ready": {
+      if (state.status !== "running") return none;
+      const actions = [
+        { type: "log", message: `link ready (pid ${state.pid})` }
+      ];
+      let report = state.report;
+      if (report && report.to === state.versions.current) {
+        actions.push({
+          type: "report",
+          report: { kind: "switched", from: report.from, to: report.to }
+        });
+        report = null;
+      }
+      return {
+        state: { ...state, readyAt: now, lastAliveAt: now, report },
+        actions
+      };
+    }
+    case "alive": {
+      if (state.status !== "running") return none;
+      return { state: { ...state, lastAliveAt: now }, actions: [] };
+    }
+    case "exited": {
+      if (state.status === "stopping") {
+        if (state.afterStop === "start") {
+          return {
+            state: startFresh(state, config),
+            actions: [{ type: "spawn" }]
+          };
+        }
+        return {
+          state: {
+            ...state,
+            status: "stopped",
+            pid: null,
+            killAt: null,
+            reason: "aibexd stopped the link"
+          },
+          actions: [{ type: "stopped" }]
+        };
+      }
+      if (state.status !== "running") return none;
+      let reason = `link ${describeExit(event.code, event.signal)}`;
+      if (state.hung) {
+        reason = `link sent no alive signal for ${formatDuration(config.hungMs)} and was killed`;
+      } else if (state.notReady) {
+        reason = `link did not report ready in ${formatDuration(config.readyTimeoutMs)} and was killed`;
+      }
+      return linkFailed(state, reason, now, config);
+    }
+    case "tick": {
+      return tick(state, now, config);
+    }
+    case "stop": {
+      if (state.status === "running") {
+        return {
+          state: {
+            ...state,
+            status: "stopping",
+            afterStop: "exit",
+            restartAt: null,
+            killAt: now + config.linkStopMs
+          },
+          actions: [
+            { type: "log", message: `stopping the link (pid ${state.pid})` },
+            { type: "kill", signal: "SIGTERM" }
+          ]
+        };
+      }
+      if (state.status === "stopping") {
+        return { state: { ...state, afterStop: "exit" }, actions: [] };
+      }
+      if (state.status === "stopped") return none;
+      return {
+        state: {
+          ...state,
+          status: "stopped",
+          restartAt: null,
+          reason: "aibexd stopped the link"
+        },
+        actions: [{ type: "stopped" }]
+      };
+    }
+    case "check-now": {
+      if (state.mode !== "installed" || state.status === "stopped") {
+        return none;
+      }
+      if (state.update !== null) {
+        return {
+          state: { ...state, update: { ...state.update, force: true } },
+          actions: []
+        };
+      }
+      return {
+        state: {
+          ...state,
+          update: { phase: "checking", version: null, force: true },
+          nextCheckAt: null
+        },
+        actions: [{ type: "check" }]
+      };
+    }
+    case "checked": {
+      return checked(state, event.result, now, config);
+    }
+    case "installed": {
+      return installed(state, event.outcome, now, config);
+    }
+    case "aibexd-checked": {
+      return aibexdChecked(state, event.result, event.installed, now, config);
+    }
+  }
+}
+function tickLink(state, now, config) {
+  if (state.status === "waiting" && state.restartAt !== null && now >= state.restartAt) {
+    return {
+      state: { ...state, status: "starting", restartAt: null },
+      actions: [{ type: "spawn" }]
+    };
+  }
+  if (state.status === "stopping" && state.killAt !== null && now >= state.killAt) {
+    return {
+      state: { ...state, killAt: null },
+      actions: [
+        {
+          type: "log",
+          message: `link (pid ${state.pid}) did not stop in ${formatDuration(config.linkStopMs)}; killing it`
+        },
+        { type: "kill", signal: "SIGKILL" }
+      ]
+    };
+  }
+  if (state.status !== "running" || state.startedAt === null) {
+    return { state, actions: [] };
+  }
+  const healthy = resetIfHealthy(state, now, config);
+  const killed = state.hung || state.notReady;
+  const lastHeard = state.lastAliveAt ?? state.startedAt;
+  if (!killed && now - lastHeard >= config.hungMs) {
+    return {
+      state: { ...healthy, hung: true },
+      actions: [
+        {
+          type: "log",
+          message: `link (pid ${state.pid}) sent no alive signal for ${formatDuration(config.hungMs)}; killing it`
+        },
+        { type: "kill", signal: "SIGKILL" }
+      ]
+    };
+  }
+  if (state.probation && !killed) {
+    if (state.readyAt === null && now - state.startedAt >= config.readyTimeoutMs) {
+      return {
+        state: { ...healthy, notReady: true },
+        actions: [
+          {
+            type: "log",
+            message: `link (pid ${state.pid}) did not report ready in ${formatDuration(config.readyTimeoutMs)}; killing it`
+          },
+          { type: "kill", signal: "SIGKILL" }
+        ]
+      };
+    }
+    if (state.readyAt !== null && now - state.startedAt >= config.probationMs) {
+      const { current, previous } = state.versions;
+      const keep = [current, previous].filter(
+        (version) => version !== null
+      );
+      return {
+        state: {
+          ...healthy,
+          probation: null,
+          warnings: current ? clearSuperseded(healthy.warnings, current) : healthy.warnings
+        },
+        actions: [
+          {
+            type: "log",
+            message: `aibex-link ${current} stayed up for ${formatDuration(config.probationMs)}; keeping it`
+          },
+          { type: "prune", keep }
+        ]
+      };
+    }
+  }
+  return { state: healthy, actions: [] };
+}
+function tick(state, now, config) {
+  const linked = tickLink(state, now, config);
+  let next = linked.state;
+  const actions = [...linked.actions];
+  if (next.mode === "installed" && next.status !== "stopped" && next.update === null && next.nextCheckAt !== null && now >= next.nextCheckAt) {
+    next = {
+      ...next,
+      update: { phase: "checking", version: null, force: false },
+      nextCheckAt: null
+    };
+    actions.push({ type: "check" });
+  }
+  if (next.status !== "stopped" && next.nextAibexdCheckAt !== null && now >= next.nextAibexdCheckAt) {
+    next = { ...next, nextAibexdCheckAt: null };
+    actions.push({ type: "check-aibexd" });
+  }
+  return { state: next, actions };
+}
+function linkWake(state, config) {
+  switch (state.status) {
+    case "waiting": {
+      return state.restartAt;
+    }
+    case "stopping": {
+      return state.killAt;
+    }
+    case "running": {
+      if (state.startedAt === null) return null;
+      const times = [];
+      const killed = state.hung || state.notReady;
+      if (!killed) {
+        times.push((state.lastAliveAt ?? state.startedAt) + config.hungMs);
+      }
+      if (state.failures > 0) {
+        times.push(state.startedAt + config.backoffResetMs);
+      }
+      if (state.probation && !killed) {
+        times.push(
+          state.startedAt + (state.readyAt === null ? config.readyTimeoutMs : config.probationMs)
+        );
+      }
+      return times.length > 0 ? Math.min(...times) : null;
+    }
+    default: {
+      return null;
+    }
+  }
+}
+function nextWake(state, config) {
+  if (state.status === "stopped") return null;
+  const times = [];
+  const link = linkWake(state, config);
+  if (link !== null) times.push(link);
+  if (state.mode === "installed" && state.update === null && state.nextCheckAt !== null) {
+    times.push(state.nextCheckAt);
+  }
+  if (state.nextAibexdCheckAt !== null) times.push(state.nextAibexdCheckAt);
+  return times.length > 0 ? Math.min(...times) : null;
+}
+const MAX_REQUEST_BYTES = 64 * 1024;
+const MAX_SOCKET_PATH_BYTES = 100;
+function socketAddress(socketFile) {
+  if (Buffer.byteLength(socketFile) <= MAX_SOCKET_PATH_BYTES) return socketFile;
+  process.chdir(path.dirname(socketFile));
+  return path.basename(socketFile);
+}
+function listenOnSocket(socketFile, handle, onError) {
+  rmSync(socketFile, { force: true });
+  const server = createServer((connection) => {
+    let buffer = "";
+    let answered = false;
+    connection.setEncoding("utf8");
+    const answer = (response) => {
+      if (answered) return;
+      answered = true;
+      connection.end(`${JSON.stringify(response)}
+`);
+    };
+    connection.on("data", (chunk) => {
+      buffer += chunk;
+      if (buffer.length > MAX_REQUEST_BYTES) {
+        answer({ ok: false, error: "request too large" });
+        return;
+      }
+      const newline = buffer.indexOf("\n");
+      if (newline === -1) return;
+      let request;
+      try {
+        request = JSON.parse(buffer.slice(0, newline));
+      } catch {
+        answer({ ok: false, error: "the request is not JSON" });
+        return;
+      }
+      if (request?.type !== "update") {
+        answer({ ok: false, error: "unknown request" });
+        return;
+      }
+      void (async () => {
+        try {
+          answer(await handle({ type: "update" }));
+        } catch (error) {
+          answer({ ok: false, error: String(error) });
+        }
+      })();
+    });
+    connection.on("error", () => {
+    });
+  });
+  server.on("error", onError);
+  try {
+    server.listen(socketAddress(socketFile));
+  } catch (error) {
+    onError(error);
+  }
+  return server;
+}
+const LINK_PACKAGE = "@aibexhq/aibex-link";
+const AIBEXD_PACKAGE = "aibex";
+function runNpm(args, options) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const child = spawn("npm", args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, options.timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("error", (error) => {
+      finish({
+        code: null,
+        stdout,
+        stderr,
+        timedOut,
+        spawnError: error.message
+      });
+    });
+    child.once("close", (code) => {
+      finish({ code: timedOut ? null : code, stdout, stderr, timedOut });
+    });
+  });
+}
+function firstNpmErrorLine(output) {
+  for (const raw of output.split("\n")) {
+    const line = raw.trim();
+    const match = /^npm (?:error|ERR!)\s*(.*)$/.exec(line);
+    if (!match) continue;
+    const message = (match[1] ?? "").trim();
+    if (message === "" || /^(?:code|syscall|errno)\b/.test(message)) continue;
+    return message.replace(/^notarget\s+/, "");
+  }
+  return void 0;
+}
+function npmFailureReason(result, what) {
+  if (result.spawnError) return `could not run npm: ${result.spawnError}`;
+  if (result.timedOut) return `npm ${what} timed out`;
+  return firstNpmErrorLine(result.stderr) ?? `npm ${what} exited with code ${result.code}`;
+}
+async function checkLatest(packageName, options) {
+  const result = await runNpm(
+    ["view", packageName, "dist-tags.latest", "--json", "--prefer-online"],
+    options
+  );
+  if (result.code !== 0) {
+    return {
+      ok: false,
+      kind: "unreachable",
+      reason: `could not ask npm for ${packageName}: ${npmFailureReason(result, "view")}`
+    };
+  }
+  let answer;
+  try {
+    answer = JSON.parse(result.stdout);
+  } catch {
+    answer = result.stdout.trim();
+  }
+  if (!isSemver(answer)) {
+    return {
+      ok: false,
+      kind: "malformed",
+      reason: `npm answered ${JSON.stringify(answer)} for the latest ${packageName}, which is not a version`
+    };
+  }
+  return { ok: true, version: answer };
+}
+function classifyInstallFailure(result) {
+  if (result.spawnError) {
+    return {
+      kind: "cannot-self-update",
+      reason: `could not run npm: ${result.spawnError}`
+    };
+  }
+  if (result.timedOut) {
+    return { kind: "cannot-self-update", reason: "npm install timed out" };
+  }
+  const output = `${result.stderr}
+${result.stdout}`;
+  const code = /^npm (?:error|ERR!) code (\S+)/m.exec(output)?.[1];
+  const reason = firstNpmErrorLine(output) ?? `npm install exited with code ${result.code}`;
+  const releaseAge = /with a date before/.test(output);
+  if ((code === "ETARGET" || code === "E404") && !releaseAge) {
+    return { kind: "not-served", reason };
+  }
+  return { kind: "cannot-self-update", reason };
+}
+function versionDirectory(paths, version) {
+  return path.join(paths.versionsDir, version);
+}
+function partialDirectory(paths, version) {
+  return path.join(paths.versionsDir, `${version}.partial`);
+}
+function linkEntry(directory) {
+  const root = path.join(directory, "node_modules", ...LINK_PACKAGE.split("/"));
+  let main;
+  try {
+    main = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).main;
+  } catch {
+    return void 0;
+  }
+  const entry = path.join(
+    root,
+    typeof main === "string" ? main : "dist/index.js"
+  );
+  return existsSync(entry) ? entry : void 0;
+}
+function listInstalledVersions(paths) {
+  let names;
+  try {
+    names = readdirSync(paths.versionsDir);
+  } catch {
+    return [];
+  }
+  return names.filter(
+    (name) => isSemver(name) && linkEntry(versionDirectory(paths, name)) !== void 0
+  ).toSorted(compareSemver);
+}
+async function installLinkVersion(paths, version, deps) {
+  const target = versionDirectory(paths, version);
+  if (linkEntry(target) !== void 0) {
+    return { ok: true, version, directory: target };
+  }
+  const partial = partialDirectory(paths, version);
+  rmSync(partial, { recursive: true, force: true });
+  mkdirSync(partial, { recursive: true });
+  const fail2 = (kind, reason) => {
+    rmSync(partial, { recursive: true, force: true });
+    return { ok: false, version, kind, reason };
+  };
+  try {
+    writeJsonAtomicSync(path.join(partial, "package.json"), {
+      name: "aibex-link-install",
+      private: true,
+      description: `aibex-link ${version}, installed by aibexd`
+    });
+    const result = await deps.npm(
+      [
+        "install",
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        `${LINK_PACKAGE}@${version}`
+      ],
+      partial
+    );
+    if (result.code !== 0) {
+      const failure = classifyInstallFailure(result);
+      return fail2(failure.kind, failure.reason);
+    }
+    if (linkEntry(partial) === void 0) {
+      return fail2(
+        "bad",
+        `npm installed ${LINK_PACKAGE}@${version} but it has no entry file`
+      );
+    }
+    for (const check of deps.checks) {
+      const checked2 = await check(partial, version);
+      if (!checked2.ok) {
+        return fail2(checked2.bad ? "bad" : "cannot-self-update", checked2.reason);
+      }
+    }
+    rmSync(target, { recursive: true, force: true });
+    await rename(partial, target);
+    return { ok: true, version, directory: target };
+  } catch (error) {
+    return fail2("cannot-self-update", `install failed: ${String(error)}`);
+  }
+}
+function removeVersion(paths, version) {
+  if (!isSemver(version)) return;
+  rmSync(versionDirectory(paths, version), { recursive: true, force: true });
+}
+function pruneVersions(paths, keep) {
+  let names;
+  try {
+    names = readdirSync(paths.versionsDir);
+  } catch {
+    return [];
+  }
+  const removed = [];
+  for (const name of names) {
+    if (!isSemver(name) || keep.includes(name)) continue;
+    rmSync(versionDirectory(paths, name), { recursive: true, force: true });
+    removed.push(name);
+  }
+  return removed.toSorted(compareSemver);
+}
+const SLSA_PROVENANCE_V1 = "https://slsa.dev/provenance/v1";
+const IN_TOTO_PAYLOAD = "application/vnd.in-toto+json";
+const DEFAULT_ATTESTATIONS_REGISTRY = "https://registry.npmjs.org";
+const AIBEX_LINK_PROVENANCE = {
+  packageName: LINK_PACKAGE,
+  repository: "https://github.com/aibexhq/aibex",
+  workflowPath: ".github/workflows/release-daemon.yml"
+};
+function record(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function attestationsUrl(registry, packageName, version) {
+  return `${registry.replace(/\/+$/, "")}/-/npm/v1/attestations/${packageName.replace("/", "%2f")}@${version}`;
+}
+const bad$1 = (reason) => ({ ok: false, bad: true, reason });
+function checkAttestations(body, version, expected) {
+  const label = `${expected.packageName}@${version}`;
+  const attestations = record(body)?.attestations;
+  if (!Array.isArray(attestations)) {
+    return bad$1(`${label} has no provenance attestation`);
+  }
+  const provenance = attestations.map((item) => record(item)).find((item) => item?.predicateType === SLSA_PROVENANCE_V1);
+  if (!provenance) return bad$1(`${label} has no provenance attestation`);
+  const envelope = record(record(provenance.bundle)?.dsseEnvelope);
+  if (envelope?.payloadType !== IN_TOTO_PAYLOAD || typeof envelope.payload !== "string") {
+    return bad$1(`${label} has an invalid provenance attestation`);
+  }
+  let statement;
+  try {
+    statement = record(
+      JSON.parse(Buffer.from(envelope.payload, "base64").toString("utf8"))
+    );
+  } catch {
+    statement = void 0;
+  }
+  if (!statement || statement.predicateType !== SLSA_PROVENANCE_V1) {
+    return bad$1(`${label} has an invalid provenance attestation`);
+  }
+  const subjectName = `pkg:npm/${expected.packageName}@${version}`;
+  const subjects = Array.isArray(statement.subject) ? statement.subject : [];
+  const about = subjects.some((subject) => {
+    const name = record(subject)?.name;
+    if (typeof name !== "string") return false;
+    try {
+      return decodeURIComponent(name) === subjectName;
+    } catch {
+      return false;
+    }
+  });
+  if (!about) {
+    return bad$1(`${label}'s provenance attestation is about another package`);
+  }
+  const workflow = record(
+    record(
+      record(record(statement.predicate)?.buildDefinition)?.externalParameters
+    )?.workflow
+  );
+  const repository = workflow?.repository;
+  const workflowPath = workflow?.path;
+  if (typeof repository !== "string" || typeof workflowPath !== "string") {
+    return bad$1(`${label}'s provenance names no source repository`);
+  }
+  if (repository.toLowerCase() !== expected.repository.toLowerCase()) {
+    return bad$1(
+      `${label} was built from ${repository}, not ${expected.repository}`
+    );
+  }
+  if (workflowPath !== expected.workflowPath) {
+    return bad$1(
+      `${label} was built by ${workflowPath}, not ${expected.workflowPath}`
+    );
+  }
+  return { ok: true };
+}
+function checkAuditSignatures(result, label) {
+  let report;
+  try {
+    report = record(JSON.parse(result.stdout));
+  } catch {
+    report = void 0;
+  }
+  const invalid = Array.isArray(report?.invalid) ? report.invalid : void 0;
+  const missing = Array.isArray(report?.missing) ? report.missing : void 0;
+  if (invalid && invalid.length > 0) {
+    return bad$1(`npm audit signatures found invalid signatures on ${label}`);
+  }
+  if (missing && missing.length > 0) {
+    return bad$1(`npm audit signatures found missing signatures on ${label}`);
+  }
+  if (result.code !== 0 || !invalid || !missing) {
+    return {
+      ok: false,
+      bad: false,
+      reason: `could not verify ${label}'s signatures: ${npmFailureReason(result, "audit signatures")}`
+    };
+  }
+  return { ok: true };
+}
+async function verifyProvenance(directory, version, deps) {
+  const label = `${deps.expected.packageName}@${version}`;
+  const audit = await deps.npm(["audit", "signatures", "--json"], directory);
+  const audited = checkAuditSignatures(audit, label);
+  if (!audited.ok) return audited;
+  const url = attestationsUrl(
+    deps.registry,
+    deps.expected.packageName,
+    version
+  );
+  let response;
+  try {
+    response = await deps.fetch(url, {
+      signal: AbortSignal.timeout(deps.timeoutMs)
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      bad: false,
+      reason: `could not fetch ${label}'s attestations: ${error.message}`
+    };
+  }
+  if (response.status === 404) {
+    return bad$1(`${label} has no provenance attestation`);
+  }
+  if (!response.ok) {
+    return {
+      ok: false,
+      bad: false,
+      reason: `could not fetch ${label}'s attestations: HTTP ${response.status}`
+    };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    return bad$1(`${label} has an invalid provenance attestation`);
+  }
+  return checkAttestations(body, version, deps.expected);
+}
+const bad = (reason) => ({ ok: false, bad: true, reason });
+function runSelfTest(entry, version, timeoutMs) {
+  const label = `${LINK_PACKAGE}@${version}`;
+  return new Promise((resolve) => {
+    let stdout = "";
+    let timedOut = false;
+    const child = spawn(process.execPath, [entry, "--self-test"], {
+      stdio: ["ignore", "pipe", "ignore"],
+      // The link gets nothing of aibexd's: it must not reach anything.
+      env: { PATH: process.env.PATH ?? "" }
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      resolve(bad(`${label}'s self-test did not run: ${error.message}`));
+    });
+    child.once("close", (code, signal) => {
+      clearTimeout(timer);
+      if (timedOut) {
+        resolve(
+          bad(
+            `${label}'s self-test did not finish in ${formatDuration(timeoutMs)}`
+          )
+        );
+        return;
+      }
+      if (code !== 0) {
+        resolve(
+          bad(
+            `${label}'s self-test ${signal ? `was killed by ${signal}` : `exited with code ${code}`}`
+          )
+        );
+        return;
+      }
+      const last = stdout.trim().split("\n").at(-1) ?? "";
+      let report;
+      try {
+        report = JSON.parse(last);
+      } catch {
+        report = void 0;
+      }
+      if (report?.name !== LINK_PACKAGE || report.version !== version) {
+        resolve(
+          bad(
+            `${label}'s self-test reported ${last === "" ? "nothing" : last}, not ${JSON.stringify({ name: LINK_PACKAGE, version })}`
+          )
+        );
+        return;
+      }
+      resolve({ ok: true });
+    });
+  });
+}
+function createUpdater(paths, env, timings) {
+  const npm = (args, cwd) => runNpm(args, { cwd, env, timeoutMs: timings.npmInstallMs });
+  const deps = {
+    npm,
+    checks: [
+      (directory, version) => verifyProvenance(directory, version, {
+        npm,
+        fetch,
+        registry: env.AIBEX_ATTESTATIONS_REGISTRY ?? DEFAULT_ATTESTATIONS_REGISTRY,
+        expected: AIBEX_LINK_PROVENANCE,
+        timeoutMs: timings.npmViewMs
+      }),
+      (directory, version) => {
+        const entry = linkEntry(directory);
+        return entry ? runSelfTest(entry, version, timings.selfTestMs) : Promise.resolve({
+          ok: false,
+          bad: true,
+          reason: `${LINK_PACKAGE}@${version} has no entry file`
+        });
+      }
+    ]
+  };
+  return {
+    latestLink: () => checkLatest(LINK_PACKAGE, { env, timeoutMs: timings.npmViewMs }),
+    latestAibexd: () => checkLatest(AIBEXD_PACKAGE, { env, timeoutMs: timings.npmViewMs }),
+    install: (version) => installLinkVersion(paths, version, deps)
+  };
+}
+function iso$1(time) {
+  return new Date(time).toISOString();
+}
+function serializeVersions(versions) {
+  const attempts = {};
+  for (const [version, attempt] of Object.entries(versions.attempts)) {
+    attempts[version] = {
+      failures: attempt.failures,
+      nextAt: iso$1(attempt.nextAt)
+    };
+  }
+  return { ...versions, bad: { ...versions.bad }, attempts };
+}
+function stringRecord(value) {
+  const result = {};
+  if (typeof value !== "object" || value === null) return result;
+  for (const [key, item] of Object.entries(value)) {
+    if (isSemver(key) && typeof item === "string") result[key] = item;
+  }
+  return result;
+}
+function restoreVersions(paths) {
+  const versions = emptyVersions();
+  const recorded = readSupervisorState(paths)?.versions;
+  if (recorded && typeof recorded === "object") {
+    versions.bad = stringRecord(recorded.bad);
+    if (typeof recorded.attempts === "object" && recorded.attempts !== null) {
+      for (const [version, attempt] of Object.entries(recorded.attempts)) {
+        const nextAt = Date.parse(String(attempt?.nextAt));
+        if (isSemver(version) && typeof attempt?.failures === "number" && Number.isFinite(nextAt)) {
+          versions.attempts[version] = { failures: attempt.failures, nextAt };
+        }
+      }
+    }
+    if (typeof recorded.aibexdNotified === "string") {
+      versions.aibexdNotified = recorded.aibexdNotified;
+    }
+  }
+  const installed2 = listInstalledVersions(paths).filter(
+    (version) => versions.bad[version] === void 0
+  );
+  const usable = (version) => typeof version === "string" && installed2.includes(version);
+  versions.current = usable(recorded?.current) ? recorded.current : installed2.at(-1) ?? null;
+  versions.previous = usable(recorded?.previous) && recorded.previous !== versions.current ? recorded.previous : null;
+  return versions;
+}
+const DEFAULT_TIMINGS = {
+  backoffInitialMs: 1e3,
+  backoffMaxMs: 5 * 6e4,
+  backoffResetMs: 10 * 6e4,
+  hungMs: 9e4,
+  linkStopMs: 1e4,
+  supervisorStopMs: 12e3,
+  versionCheckMs: 5 * 6e4,
+  stopWaitMs: 15e3,
+  updateCheckMs: 60 * 6e4,
+  attemptInitialMs: 15 * 6e4,
+  attemptMaxMs: 6 * 60 * 6e4,
+  probationMs: 2 * 6e4,
+  readyTimeoutMs: 3e4,
+  selfTestMs: 3e4,
+  npmViewMs: 6e4,
+  npmInstallMs: 10 * 6e4,
+  aibexdCheckMs: 24 * 60 * 6e4,
+  updateWaitMs: 15 * 6e4
+};
+function readTimings(env = process.env) {
+  const timings = { ...DEFAULT_TIMINGS };
+  const raw = env.AIBEX_TIMINGS;
+  if (!raw) return timings;
+  let overrides;
+  try {
+    overrides = JSON.parse(raw);
+  } catch {
+    return timings;
+  }
+  if (typeof overrides !== "object" || overrides === null) return timings;
+  for (const key of Object.keys(timings)) {
+    const value = overrides[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      timings[key] = value;
+    }
+  }
+  return timings;
+}
+function iso(time) {
+  return time === null ? null : new Date(time).toISOString();
+}
+function linkEnvironment(env) {
+  const result = { ...env };
+  delete result.AIBEX_HOME;
+  delete result.AIBEX_LINK_PATH;
+  delete result.AIBEX_ATTESTATIONS_REGISTRY;
+  return result;
+}
+function runSupervisor(env = process.env) {
+  const paths = statePaths(aibexHome(env));
+  const host = env.AIBEX_HOST ?? "";
+  const timings = readTimings(env);
+  const config = machineConfig(timings);
+  const version = readInstalledVersion();
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const localLink = env.AIBEX_LINK_PATH;
+  const updater = createUpdater(paths, env, timings);
+  let state = initialState(
+    config,
+    localLink ? void 0 : restoreVersions(paths)
+  );
+  let child;
+  let link;
+  let wakeTimer;
+  const queue = [];
+  let dispatching = false;
+  const waiting = [];
+  const save = () => {
+    const file = {
+      supervisor: { pid: process.pid, version, startedAt },
+      host,
+      link: {
+        status: state.status,
+        pid: state.pid,
+        version: link?.version ?? state.versions.current,
+        source: link?.source ?? (localLink ? "local" : null),
+        path: link?.path ?? null,
+        startedAt: iso(state.startedAt),
+        readyAt: iso(state.readyAt),
+        lastAliveAt: iso(state.lastAliveAt),
+        restartAt: iso(state.restartAt),
+        reason: state.reason
+      },
+      warnings: state.warnings,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (state.mode === "installed") {
+      file.versions = serializeVersions(state.versions);
+    }
+    try {
+      writeSupervisorState(paths, file);
+    } catch (error) {
+      log("supervisor", `could not write ${paths.stateFile}: ${String(error)}`);
+    }
+  };
+  const resolveLink = () => {
+    if (state.mode === "local") {
+      const source = resolveLinkSource(env);
+      if (source.kind === "unavailable") {
+        return { ok: false, reason: source.reason };
+      }
+      return {
+        ok: true,
+        entry: source.entry,
+        link: { version: source.version, source: "local", path: source.path }
+      };
+    }
+    const current = state.versions.current;
+    if (current === null) return { ok: false, reason: "no link installed" };
+    const directory = versionDirectory(paths, current);
+    const entry = linkEntry(directory);
+    if (!entry) {
+      return {
+        ok: false,
+        reason: `aibex-link ${current} is not installed in ${directory}`
+      };
+    }
+    return {
+      ok: true,
+      entry,
+      link: { version: current, source: "installed", path: directory }
+    };
+  };
+  const spawnLink = () => {
+    const resolved = resolveLink();
+    if (!resolved.ok) {
+      queue.push({ type: "spawn-failed", reason: resolved.reason });
+      return;
+    }
+    let started;
+    try {
+      started = fork(resolved.entry, [], {
+        stdio: ["inherit", "inherit", "inherit", "ipc"],
+        env: linkEnvironment(env)
+      });
+    } catch (error) {
+      queue.push({ type: "spawn-failed", reason: String(error) });
+      return;
+    }
+    if (started.pid === void 0) {
+      started.once("error", (error) => {
+        dispatch({ type: "spawn-failed", reason: error.message });
+      });
+      return;
+    }
+    child = started;
+    link = resolved.link;
+    log(
+      "supervisor",
+      `started aibex-link ${resolved.link.version} from ${resolved.link.path} (pid ${started.pid})`
+    );
+    started.on("message", (message) => {
+      if (child !== started) return;
+      if (message.type === "ready") dispatch({ type: "ready" });
+      else if (message.type === "alive") dispatch({ type: "alive" });
+    });
+    started.on("error", (error) => {
+      log("supervisor", `link error: ${error.message}`);
+    });
+    started.on("exit", (code, signal) => {
+      if (child !== started) return;
+      child = void 0;
+      dispatch({ type: "exited", code, signal });
+    });
+    queue.push({ type: "spawned", pid: started.pid });
+  };
+  const background = (work) => {
+    void (async () => {
+      let event;
+      try {
+        event = await work();
+      } catch (error) {
+        log("supervisor", `update step failed: ${String(error)}`);
+        return;
+      }
+      dispatch(event);
+    })();
+  };
+  const perform = (action) => {
+    switch (action.type) {
+      case "spawn": {
+        spawnLink();
+        break;
+      }
+      case "kill": {
+        child?.kill(action.signal);
+        break;
+      }
+      case "log": {
+        log("supervisor", action.message);
+        break;
+      }
+      case "stopped": {
+        clearTimeout(wakeTimer);
+        save();
+        log("supervisor", "stopped");
+        rmSync(paths.socketFile, { force: true });
+        process.exit(0);
+        break;
+      }
+      case "check": {
+        background(async () => ({
+          type: "checked",
+          result: await updater.latestLink()
+        }));
+        break;
+      }
+      case "install": {
+        const target = action.version;
+        background(async () => ({
+          type: "installed",
+          outcome: await updater.install(target)
+        }));
+        break;
+      }
+      case "remove-version": {
+        removeVersion(paths, action.version);
+        break;
+      }
+      case "prune": {
+        const removed = pruneVersions(paths, action.keep);
+        if (removed.length > 0) {
+          log("supervisor", `removed aibex-link ${removed.join(", ")}`);
+        }
+        break;
+      }
+      case "check-aibexd": {
+        background(async () => {
+          const result = await updater.latestAibexd();
+          let installed2 = version;
+          try {
+            installed2 = readInstalledVersion(PACKAGE_ROOT);
+          } catch {
+          }
+          return { type: "aibexd-checked", result, installed: installed2 };
+        });
+        break;
+      }
+      case "report": {
+        for (const resolve of waiting.splice(0)) resolve(action.report);
+        break;
+      }
+    }
+  };
+  const schedule = () => {
+    clearTimeout(wakeTimer);
+    const wake = nextWake(state, config);
+    if (wake === null) return;
+    wakeTimer = setTimeout(
+      () => dispatch({ type: "tick" }),
+      Math.max(0, wake - Date.now())
+    );
+  };
+  function dispatch(event) {
+    queue.push(event);
+    if (dispatching) return;
+    dispatching = true;
+    try {
+      let next;
+      while (next = queue.shift()) {
+        const result = transition(state, next, Date.now(), config);
+        state = result.state;
+        for (const action of result.actions) perform(action);
+      }
+    } finally {
+      dispatching = false;
+    }
+    save();
+    schedule();
+  }
+  const stop = () => dispatch({ type: "stop" });
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  process.on("disconnect", stop);
+  const versionTimer = setInterval(() => {
+    let installed2;
+    try {
+      installed2 = readInstalledVersion(PACKAGE_ROOT);
+    } catch {
+      return;
+    }
+    if (installed2 === version) return;
+    clearInterval(versionTimer);
+    log(
+      "supervisor",
+      `aibexd ${installed2} is installed (running ${version}); restarting the supervisor`
+    );
+    stop();
+  }, timings.versionCheckMs);
+  log(
+    "supervisor",
+    `aibexd ${version} supervisor started (pid ${process.pid}) for ${host}`
+  );
+  if (state.mode === "installed") {
+    const { current, previous } = state.versions;
+    log(
+      "supervisor",
+      current ? `aibex-link ${current} installed${previous ? ` (previous: ${previous})` : ""}` : "no aibex-link installed yet"
+    );
+  }
+  dispatch({ type: "start" });
+  const updateNow = () => new Promise((resolve) => {
+    waiting.push(resolve);
+    dispatch({ type: "check-now" });
+  });
+  listenOnSocket(
+    paths.socketFile,
+    async () => {
+      if (localLink) {
+        return {
+          ok: false,
+          error: `aibexd is running the local link at ${localLink} (AIBEX_LINK_PATH), which it never installs or updates. Stop aibexd and start it without AIBEX_LINK_PATH to run installed versions.`
+        };
+      }
+      return { ok: true, report: await updateNow() };
+    },
+    (error) => {
+      log(
+        "supervisor",
+        `cannot listen on ${paths.socketFile}, so \`aibexd update\` will not reach it: ${error.message}`
+      );
+    }
+  );
+  return { localLink, updateNow };
+}
+runSupervisor();