amalgm 0.1.38 → 0.1.40

package/README.md

@@ -20,9 +20,9 @@ If you start from the Amalgm web app or are setting up a remote/headless machine
 amalgm login --setup-code ABCD-EFGH-JKLM-NPQR
 ```
 
-`amalgm doctor` checks the installed runtime, login record, required local ports, daemon state, and whether an HMAC proxy token is available.
+`amalgm doctor` checks the installed runtime, login record, service supervisor, required local ports, daemon state, and whether an HMAC proxy token is available.
 
-`amalgm start` runs the local essentials:
+`amalgm start` installs/starts the best available service supervisor for the machine, then the supervisor runs `amalgm run` and keeps the local essentials alive:
 
 - port monitor on `8081`
 - filesystem/auth watcher on `8082`
@@ -31,7 +31,7 @@ amalgm login --setup-code ABCD-EFGH-JKLM-NPQR
 - events/previews/artifact tunnel to `wire.events.amalgm.ai`
 - chat tunnel to `amalgm-chat-gateway`
 
-The npm supervisor binds local services to `127.0.0.1` by default and connects them outward through the registered Amalgm tunnels. For development without cloud registration, use `amalgm start --local-only`.
+The npm supervisor binds local services to `127.0.0.1` by default and connects them outward through the registered Amalgm tunnels. For development without cloud registration, use `amalgm start --local-only`. For direct foreground debugging, use `amalgm start --foreground`.
 
 Useful commands:
 
@@ -40,6 +40,7 @@ amalgm status
 amalgm update
 amalgm logs
 amalgm logs chat-server
+amalgm service status
 amalgm stop
 amalgm logout
 ```

package/lib/cli.js

@@ -18,8 +18,16 @@ const {
   RUNTIME_DIR,
   RUNTIME_STATE_FILE,
   RUNTIME_TOKEN_FILE,
+  SHUTDOWN_REASON_FILE,
 } = require('./paths');
 const { startSupervisor } = require('./supervisor');
+const {
+  getServiceStatus,
+  installService,
+  startService,
+  stopService,
+  uninstallService,
+} = require('./service');
 const {
   deleteComputerAuth,
   loadComputerRecord,
@@ -79,6 +87,7 @@ function usage() {
     '  amalgm stop',
     '  amalgm status',
     '  amalgm doctor',
+    '  amalgm service [install|start|stop|status|uninstall] [--mode auto|systemd|launchd|portable]',
     '  amalgm update [--tag latest|canary]',
     '  amalgm logs [service]',
     '  amalgm logout',
@@ -824,11 +833,16 @@ async function start(options) {
   const pid = readPid();
   if (isPidRunning(pid)) {
     const restartReason = runningDaemonRestartReason(pid, record, localOnly);
-    if (!restartReason) {
+    const serviceStatus = getServiceStatus();
+    if (!restartReason && (options['no-service'] || serviceStatus.running)) {
       console.log(`Amalgm is already running (pid ${pid}).`);
       return;
     }
-    console.log(`Amalgm is already running (pid ${pid}), but ${restartReason}. Restarting.`);
+    if (!restartReason) {
+      console.log(`Amalgm is already running (pid ${pid}) without a service supervisor. Moving it under service supervision.`);
+    } else {
+      console.log(`Amalgm is already running (pid ${pid}), but ${restartReason}. Restarting.`);
+    }
     await stop();
   }
 
@@ -843,6 +857,27 @@ async function start(options) {
     return;
   }
 
+  if (!options['no-service']) {
+    const statusBefore = getServiceStatus();
+    const statusAfter = startService({
+      localOnly,
+      mode: options.mode || process.env.AMALGM_SERVICE_MODE || 'auto',
+    });
+    const backend = statusAfter.backend || statusBefore.backend || 'service';
+    console.log(`Amalgm service ${statusBefore.installed ? 'started' : 'installed and started'} (${backend}).`);
+    const serviceDetail = statusAfter.detail || statusAfter.state?.detail;
+    if (serviceDetail) console.log(`Service: ${serviceDetail}`);
+
+    const ready = await waitForServices(8000);
+    const pending = ready.filter(([, ok]) => !ok).map(([name]) => name);
+    if (pending.length === 0) {
+      console.log('Services: all local essentials are up.');
+    } else {
+      console.log(`Services still warming up: ${pending.join(', ')}. Run \`amalgm status\` or \`amalgm logs\` if they stay down.`);
+    }
+    return;
+  }
+
   ensureDir(LOG_DIR);
   const logPath = path.join(LOG_DIR, 'daemon.log');
   const logFd = fs.openSync(logPath, 'a');
@@ -869,6 +904,23 @@ async function start(options) {
 }
 
 async function stop() {
+  const serviceStatus = getServiceStatus();
+  if (serviceStatus.installed || serviceStatus.running) {
+    const result = stopService();
+    if (result.service.backend) {
+      console.log(`Amalgm service stopped (${result.service.backend}).`);
+    }
+    if (!isPidRunning(readPid())) {
+      try {
+        fs.unlinkSync(PID_FILE);
+      } catch {
+        // noop
+      }
+      console.log('Amalgm stopped.');
+      return;
+    }
+  }
+
   const pid = readPid();
   if (!isPidRunning(pid)) {
     try {
@@ -944,10 +996,24 @@ async function status() {
   const pid = readPid();
   const record = loadComputerRecord({ migrate: true });
   const runtimeState = readJson(RUNTIME_STATE_FILE, null);
+  const serviceStatus = getServiceStatus();
+  const lastShutdown = readJson(SHUTDOWN_REASON_FILE, null);
 
   console.log(`Daemon: ${isPidRunning(pid) ? `running (pid ${pid})` : 'stopped'}`);
+  console.log(
+    `Service: ${
+      serviceStatus.installed
+        ? `${serviceStatus.running ? 'running' : 'stopped'} (${serviceStatus.backend || 'unknown'})`
+        : 'not installed'
+    }`,
+  );
   console.log(`State: ${AMALGM_DIR}`);
   if (runtimeState?.gateway_url) console.log(`Gateway: ${runtimeState.gateway_url}`);
+  if (lastShutdown?.signal || lastShutdown?.reason) {
+    console.log(
+      `Last shutdown: ${lastShutdown.signal || lastShutdown.reason} at ${lastShutdown.at || lastShutdown.time || 'unknown time'}`,
+    );
+  }
   console.log(
     `Computer: ${
       record?.computer_id
@@ -1016,7 +1082,33 @@ async function doctor() {
 
   const pid = readPid();
   const daemonRunning = isPidRunning(pid);
+  const serviceStatus = getServiceStatus();
+  const lastShutdown = readJson(SHUTDOWN_REASON_FILE, null);
+  add(
+    'service',
+    serviceStatus.installed && serviceStatus.running,
+    serviceStatus.installed
+      ? `${serviceStatus.running ? 'running' : 'stopped'} (${serviceStatus.backend || 'unknown'})`
+      : 'not installed; `amalgm start` will install one',
+    serviceStatus.installed && serviceStatus.running ? 'ok' : 'warn',
+  );
+  if (serviceStatus.backend === 'portable' && /container/i.test(serviceStatus.detail || '')) {
+    add(
+      'service durability',
+      true,
+      'portable watchdog is best-effort inside managed containers; platform entrypoint/service is stronger',
+      'warn',
+    );
+  }
   add('daemon', daemonRunning, daemonRunning ? `pid ${pid}` : 'stopped', daemonRunning ? 'ok' : 'warn');
+  if (lastShutdown?.signal || lastShutdown?.reason) {
+    add(
+      'last shutdown',
+      true,
+      `${lastShutdown.signal || lastShutdown.reason} at ${lastShutdown.at || 'unknown time'}`,
+      'warn',
+    );
+  }
 
   for (const [name, port] of servicePorts()) {
     const envName = {
@@ -1057,13 +1149,104 @@ function readLastLines(file, maxLines = 120) {
   return buffer.toString('utf8').trimEnd().split('\n').slice(-maxLines).join('\n');
 }
 
+function readNativeServiceLogs(maxLines = 120) {
+  const serviceStatus = getServiceStatus();
+  const label = serviceStatus.state?.label || 'ai.amalgm.runtime';
+  const chunks = [];
+
+  if (serviceStatus.backend === 'systemd') {
+    const statusResult = spawnSync('systemctl', ['--user', 'status', label, '--no-pager', '-l'], {
+      encoding: 'utf8',
+      timeout: 5000,
+    });
+    const statusOutput = [statusResult.stdout, statusResult.stderr].filter(Boolean).join('\n').trim();
+    if (statusOutput) chunks.push(`===== systemctl --user status ${label} =====\n${statusOutput}`);
+
+    const journalResult = spawnSync('journalctl', ['--user', '-u', label, '-n', String(maxLines), '--no-pager'], {
+      encoding: 'utf8',
+      timeout: 5000,
+    });
+    const journalOutput = [journalResult.stdout, journalResult.stderr].filter(Boolean).join('\n').trim();
+    if (journalOutput) chunks.push(`===== journalctl --user -u ${label} =====\n${journalOutput}`);
+  } else if (serviceStatus.backend === 'launchd') {
+    const domain = `gui/${process.getuid ? process.getuid() : ''}`;
+    const result = spawnSync('launchctl', ['print', `${domain}/${label}`], {
+      encoding: 'utf8',
+      timeout: 5000,
+    });
+    const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+    if (output) chunks.push(`===== launchctl print ${domain}/${label} =====\n${output}`);
+  }
+
+  return chunks.join('\n\n');
+}
+
 async function logs(options, positionals) {
   const service = String(options.service || positionals[0] || 'daemon').replace(/[^a-z0-9_-]/gi, '');
+  const maxLines = Number(options.lines || 120);
+  if (service === 'service') {
+    const nativeLogs = readNativeServiceLogs(maxLines);
+    if (nativeLogs) {
+      console.log(nativeLogs);
+      return;
+    }
+  }
   const logPath = path.join(LOG_DIR, `${service}.log`);
   if (!fs.existsSync(logPath)) {
     throw new Error(`No log file found for "${service}" at ${logPath}`);
   }
-  console.log(readLastLines(logPath, Number(options.lines || 120)));
+  console.log(readLastLines(logPath, maxLines));
+}
+
+function printServiceStatus(statusInfo = getServiceStatus()) {
+  console.log(
+    `Service: ${
+      statusInfo.installed
+        ? `${statusInfo.running ? 'running' : 'stopped'} (${statusInfo.backend || 'unknown'})`
+        : 'not installed'
+    }`,
+  );
+  if (statusInfo.detail) console.log(`Backend: ${statusInfo.detail}`);
+  if (statusInfo.pid) console.log(`Service pid: ${statusInfo.pid}`);
+  if (statusInfo.stopRequested) console.log('Stop request: pending');
+}
+
+async function serviceCommand(options, positionals) {
+  const action = positionals[0] || 'status';
+  const localOnly = !!options['local-only'];
+  const mode = options.mode || process.env.AMALGM_SERVICE_MODE || 'auto';
+
+  if (action === 'install') {
+    const state = installService({ localOnly, mode });
+    console.log(`Amalgm service installed (${state.backend}).`);
+    if (state.detail) console.log(`Service: ${state.detail}`);
+    return;
+  }
+
+  if (action === 'start') {
+    const statusInfo = startService({ localOnly, mode });
+    printServiceStatus(statusInfo);
+    return;
+  }
+
+  if (action === 'stop') {
+    stopService();
+    printServiceStatus();
+    return;
+  }
+
+  if (action === 'status') {
+    printServiceStatus();
+    return;
+  }
+
+  if (action === 'uninstall') {
+    uninstallService();
+    console.log('Amalgm service uninstalled.');
+    return;
+  }
+
+  throw new Error(`Unknown service action "${action}". Use install, start, stop, status, or uninstall.`);
 }
 
 async function logout() {
@@ -1113,12 +1296,13 @@ async function main(argv) {
   if (command === 'run') {
     return startSupervisor({
       foreground: true,
-      localOnly: process.env.AMALGM_LOCAL_ONLY === 'true',
+      localOnly: !!options['local-only'] || process.env.AMALGM_LOCAL_ONLY === 'true',
     });
   }
   if (command === 'stop') return stop();
   if (command === 'status') return status();
   if (command === 'doctor') return doctor();
+  if (command === 'service') return serviceCommand(options, positionals);
   if (command === 'update') return update(options);
   if (command === 'logs') return logs(options, positionals);
   if (command === 'logout') return logout();

package/lib/paths.js

@@ -13,6 +13,11 @@ const RUNTIME_TOKEN_FILE = path.join(AMALGM_DIR, 'runtime-token.json');
 const PID_FILE = path.join(AMALGM_DIR, 'amalgm.pid');
 const RUNTIME_STATE_FILE = path.join(AMALGM_DIR, 'runtime-state.json');
 const LOG_DIR = path.join(AMALGM_DIR, 'logs');
+const SERVICE_DIR = path.join(AMALGM_DIR, 'service');
+const SERVICE_PID_FILE = path.join(AMALGM_DIR, 'amalgm-service.pid');
+const SERVICE_STATE_FILE = path.join(AMALGM_DIR, 'service-state.json');
+const SERVICE_STOP_FILE = path.join(AMALGM_DIR, 'amalgm-service.stop');
+const SHUTDOWN_REASON_FILE = path.join(AMALGM_DIR, 'shutdown-reason.json');
 const DEFAULT_APP_URL = process.env.AMALGM_APP_URL || 'https://amalgm.ai';
 
 module.exports = {
@@ -27,4 +32,9 @@ module.exports = {
   RUNTIME_DIR,
   RUNTIME_STATE_FILE,
   RUNTIME_TOKEN_FILE,
+  SERVICE_DIR,
+  SERVICE_PID_FILE,
+  SERVICE_STATE_FILE,
+  SERVICE_STOP_FILE,
+  SHUTDOWN_REASON_FILE,
 };

package/lib/service.js

@@ -0,0 +1,823 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn, spawnSync } = require('child_process');
+
+const {
+  AMALGM_DIR,
+  LOG_DIR,
+  PACKAGE_ROOT,
+  PID_FILE,
+  SERVICE_DIR,
+  SERVICE_PID_FILE,
+  SERVICE_STATE_FILE,
+  SERVICE_STOP_FILE,
+} = require('./paths');
+
+const PACKAGE_VERSION = require('../package.json').version;
+const SERVICE_LABEL = 'ai.amalgm.runtime';
+const SERVICE_SCRIPT_FILE = path.join(SERVICE_DIR, 'amalgm-watchdog.sh');
+const SERVICE_NODE_SCRIPT_FILE = path.join(SERVICE_DIR, 'amalgm-watchdog.cjs');
+const SERVICE_LOG_FILE = path.join(LOG_DIR, 'service.log');
+const AMALGM_BIN = path.join(PACKAGE_ROOT, 'bin', 'amalgm.js');
+
+const SERVICE_ENV_KEYS = [
+  'AMALGM_APP_URL',
+  'AMALGM_AUTH_BACKUP_ENABLED',
+  'AMALGM_BIND_HOST',
+  'AMALGM_CREATE_AUTH_WATCH_DIRS',
+  'AMALGM_DEFAULT_CWD',
+  'AMALGM_GATEWAY_PORT',
+  'AMALGM_NATIVE_NODE_MODULES',
+  'AMALGM_PROJECTS_DIR',
+  'AMALGM_SKIP_NATIVE_INSTALL',
+  'AMALGM_WORKSPACES_DIR',
+  'CHAT_SERVER_PORT',
+  'ELECTRON_RUN_AS_NODE',
+  'FS_WATCHER_PORT',
+  'LANG',
+  'LC_ALL',
+  'NODE_PATH',
+  'PATH',
+  'PORT_MONITOR_PORT',
+  'SHELL',
+  'TERM',
+  'TMP',
+  'TMPDIR',
+  'TEMP',
+  'XDG_CACHE_HOME',
+  'XDG_CONFIG_HOME',
+  'XDG_DATA_HOME',
+];
+
+function ensureDir(dir, mode = 0o700) {
+  fs.mkdirSync(dir, { recursive: true, mode });
+  try {
+    fs.chmodSync(dir, mode);
+  } catch {
+    // Best effort on non-POSIX filesystems.
+  }
+}
+
+function readJson(file, fallback = null) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJson(file, data, mode = 0o600) {
+  ensureDir(path.dirname(file), 0o700);
+  const temp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(data, null, 2)}\n`, { mode });
+  fs.renameSync(temp, file);
+  try {
+    fs.chmodSync(file, mode);
+  } catch {
+    // Best effort.
+  }
+}
+
+function removeFile(file) {
+  try {
+    fs.unlinkSync(file);
+  } catch {
+    // noop
+  }
+}
+
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function plistEscape(value) {
+  return String(value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+function systemdQuote(value) {
+  return `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+
+function isPidRunning(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function readPidFile(file) {
+  const raw = readJson(file, null);
+  if (raw && Number.isInteger(raw.pid)) return raw.pid;
+  try {
+    const parsed = Number(fs.readFileSync(file, 'utf8').trim());
+    return Number.isInteger(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function commandExists(command) {
+  const pathValue = process.env.PATH || '';
+  const extensions = process.platform === 'win32' ? ['.exe', '.cmd', '.bat', ''] : [''];
+  for (const dir of pathValue.split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of extensions) {
+      const candidate = path.join(dir, `${command}${ext}`);
+      try {
+        fs.accessSync(candidate, fs.constants.X_OK);
+        return true;
+      } catch {
+        // keep looking
+      }
+    }
+  }
+  return false;
+}
+
+function systemdUnavailableOutput(output) {
+  return /systemd"? is not running|Failed to connect to bus|No medium found|Host is down|Connection refused/i.test(String(output || ''));
+}
+
+function systemdAvailable() {
+  if (process.platform !== 'linux' || !commandExists('systemctl')) return false;
+  const showEnvironment = spawnSync('systemctl', ['--user', 'show-environment'], {
+    encoding: 'utf8',
+    timeout: 2500,
+  });
+  const showEnvironmentOutput = [showEnvironment.stderr, showEnvironment.stdout].filter(Boolean).join('\n');
+  if (showEnvironment.status !== 0 || systemdUnavailableOutput(showEnvironmentOutput)) return false;
+
+  const showTarget = spawnSync('systemctl', ['--user', 'show', 'default.target', '--property=LoadState', '--property=ActiveState'], {
+    encoding: 'utf8',
+    timeout: 2500,
+  });
+  const showTargetOutput = [showTarget.stderr, showTarget.stdout].filter(Boolean).join('\n');
+  return showTarget.status === 0 && !systemdUnavailableOutput(showTargetOutput);
+}
+
+function launchdAvailable() {
+  return process.platform === 'darwin' && commandExists('launchctl');
+}
+
+function runningInContainer() {
+  if (fs.existsSync('/.dockerenv') || fs.existsSync('/run/.containerenv')) return true;
+  try {
+    const cgroup = fs.readFileSync('/proc/1/cgroup', 'utf8');
+    return /docker|kubepods|containerd|libpod|lxc|daytona|e2b/i.test(cgroup);
+  } catch {
+    return false;
+  }
+}
+
+function normalizeMode(mode) {
+  const value = String(mode || 'auto').trim().toLowerCase();
+  if (!value || value === 'auto') return 'auto';
+  if (value === 'watchdog') return 'portable';
+  if (['portable', 'systemd', 'launchd'].includes(value)) return value;
+  throw new Error(`Unsupported service mode "${mode}". Use auto, systemd, launchd, or portable.`);
+}
+
+function detectServiceBackend(mode = 'auto') {
+  const requested = normalizeMode(mode);
+  const inContainer = runningInContainer();
+  if (requested === 'launchd') {
+    if (!launchdAvailable()) throw new Error('launchd is not available on this machine.');
+    return { backend: 'launchd', detail: 'macOS LaunchAgent' };
+  }
+  if (requested === 'systemd') {
+    if (!systemdAvailable()) throw new Error('systemd --user is not available in this session.');
+    return { backend: 'systemd', detail: 'systemd user service' };
+  }
+  if (requested === 'portable') {
+    return {
+      backend: 'portable',
+      detail: inContainer ? 'portable watchdog in container' : 'portable watchdog',
+    };
+  }
+  if (launchdAvailable()) return { backend: 'launchd', detail: 'macOS LaunchAgent' };
+  if (inContainer) {
+    return {
+      backend: 'portable',
+      detail: 'portable watchdog in container',
+    };
+  }
+  if (systemdAvailable()) return { backend: 'systemd', detail: 'systemd user service' };
+  return {
+    backend: 'portable',
+    detail: inContainer ? 'portable watchdog in container' : 'portable watchdog',
+  };
+}
+
+function buildServiceEnv(localOnly) {
+  const env = {
+    AMALGM_DIR,
+    AMALGM_LOCAL_ONLY: localOnly ? 'true' : 'false',
+    AMALGM_SERVICE_MANAGED: 'true',
+    AMALGM_SERVICE_LABEL: SERVICE_LABEL,
+    ELECTRON_RUN_AS_NODE: process.env.ELECTRON_RUN_AS_NODE || '1',
+    PATH: process.env.PATH || '/usr/local/bin:/usr/bin:/bin',
+  };
+
+  for (const key of SERVICE_ENV_KEYS) {
+    if (process.env[key] && !env[key]) env[key] = process.env[key];
+  }
+  return env;
+}
+
+function writePortableScript(localOnly) {
+  ensureDir(SERVICE_DIR, 0o700);
+  ensureDir(LOG_DIR, 0o700);
+  const env = buildServiceEnv(localOnly);
+  const lines = [
+    '#!/bin/sh',
+    'set -u',
+    `AMALGM_DIR=${shellQuote(AMALGM_DIR)}`,
+    `LOG_DIR=${shellQuote(LOG_DIR)}`,
+    `PID_FILE=${shellQuote(SERVICE_PID_FILE)}`,
+    `WORKER_PID_FILE=${shellQuote(PID_FILE)}`,
+    `STOP_FILE=${shellQuote(SERVICE_STOP_FILE)}`,
+    `LOCK_DIR=${shellQuote(path.join(SERVICE_DIR, 'lock'))}`,
+    `NODE_BIN=${shellQuote(process.execPath)}`,
+    `AMALGM_BIN=${shellQuote(AMALGM_BIN)}`,
+    `DAEMON_LOG=${shellQuote(path.join(LOG_DIR, 'daemon.log'))}`,
+    `SERVICE_LOG=${shellQuote(SERVICE_LOG_FILE)}`,
+    `RESTART_DELAY=${shellQuote(String(process.env.AMALGM_SERVICE_RESTART_DELAY || '5'))}`,
+  ];
+
+  for (const [key, value] of Object.entries(env)) {
+    lines.push(`export ${key}=${shellQuote(value)}`);
+  }
+
+  lines.push(
+    'mkdir -p "$AMALGM_DIR" "$LOG_DIR"',
+    'if ! mkdir "$LOCK_DIR" 2>/dev/null; then',
+    '  existing="$(cat "$PID_FILE" 2>/dev/null | sed -n \'s/.*"pid"[[:space:]]*:[[:space:]]*\\([0-9][0-9]*\\).*/\\1/p\')"',
+    '  [ -n "$existing" ] || existing="$(cat "$PID_FILE" 2>/dev/null || true)"',
+    '  if [ -n "$existing" ] && kill -0 "$existing" 2>/dev/null; then',
+    '    exit 0',
+    '  fi',
+    '  rm -rf "$LOCK_DIR"',
+    '  mkdir "$LOCK_DIR" || exit 1',
+    'fi',
+    'child_pid=""',
+    'cleanup() {',
+    '  touch "$STOP_FILE" 2>/dev/null || true',
+    '  if [ -n "$child_pid" ] && kill -0 "$child_pid" 2>/dev/null; then',
+    '    kill "$child_pid" 2>/dev/null || true',
+    '    wait "$child_pid" 2>/dev/null || true',
+    '  fi',
+    '  rm -f "$PID_FILE"',
+    '  rm -rf "$LOCK_DIR"',
+    '  exit 0',
+    '}',
+    'trap cleanup TERM INT HUP',
+    'printf \'{"pid":%s,"started_at":"%s","backend":"portable"}\\n\' "$$" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$PID_FILE"',
+    'rm -f "$STOP_FILE"',
+    'while [ ! -f "$STOP_FILE" ]; do',
+    '  printf \'[%s] [service] starting amalgm run\\n\' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$SERVICE_LOG"',
+    '  "$NODE_BIN" "$AMALGM_BIN" run >> "$DAEMON_LOG" 2>&1 &',
+    '  child_pid=$!',
+    '  wait "$child_pid"',
+    '  code=$?',
+    '  child_pid=""',
+    '  printf \'[%s] [service] amalgm run exited code=%s\\n\' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$code" >> "$SERVICE_LOG"',
+    '  [ -f "$STOP_FILE" ] && break',
+    '  sleep "$RESTART_DELAY"',
+    'done',
+    'rm -f "$PID_FILE"',
+    'rm -rf "$LOCK_DIR"',
+  );
+
+  fs.writeFileSync(SERVICE_SCRIPT_FILE, `${lines.join('\n')}\n`, { mode: 0o700 });
+  try {
+    fs.chmodSync(SERVICE_SCRIPT_FILE, 0o700);
+  } catch {
+    // Best effort.
+  }
+  return SERVICE_SCRIPT_FILE;
+}
+
+function writePortableNodeScript(localOnly) {
+  ensureDir(SERVICE_DIR, 0o700);
+  ensureDir(LOG_DIR, 0o700);
+  const config = {
+    amalgmDir: AMALGM_DIR,
+    logDir: LOG_DIR,
+    pidFile: SERVICE_PID_FILE,
+    workerPidFile: PID_FILE,
+    stopFile: SERVICE_STOP_FILE,
+    lockDir: path.join(SERVICE_DIR, 'lock'),
+    nodeBin: process.execPath,
+    amalgmBin: AMALGM_BIN,
+    daemonLog: path.join(LOG_DIR, 'daemon.log'),
+    serviceLog: SERVICE_LOG_FILE,
+    restartDelayMs: Math.max(1000, Number(process.env.AMALGM_SERVICE_RESTART_DELAY || 5) * 1000),
+    env: buildServiceEnv(localOnly),
+  };
+  const source = `'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const config = ${JSON.stringify(config, null, 2)};
+let child = null;
+let stopping = false;
+let exiting = false;
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+
+function append(file, line) {
+  try {
+    fs.appendFileSync(file, \`[\${new Date().toISOString()}] [service] \${line}\\n\`);
+  } catch {
+    // noop
+  }
+}
+
+function readPid(file) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (Number.isInteger(parsed.pid)) return parsed.pid;
+  } catch {
+    // fall back to raw pid
+  }
+  try {
+    const raw = Number(fs.readFileSync(file, 'utf8').trim());
+    return Number.isInteger(raw) ? raw : null;
+  } catch {
+    return null;
+  }
+}
+
+function isPidRunning(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function acquireLock() {
+  try {
+    fs.mkdirSync(config.lockDir);
+    return true;
+  } catch {
+    const existing = readPid(config.pidFile);
+    if (isPidRunning(existing)) return false;
+    try { fs.rmSync(config.lockDir, { recursive: true, force: true }); } catch {}
+    fs.mkdirSync(config.lockDir);
+    return true;
+  }
+}
+
+function writePid() {
+  fs.writeFileSync(config.pidFile, JSON.stringify({
+    pid: process.pid,
+    backend: 'portable',
+    started_at: new Date().toISOString(),
+  }, null, 2) + '\\n', { mode: 0o600 });
+}
+
+function finish(exitCode = 0) {
+  try { fs.rmSync(config.pidFile, { force: true }); } catch {}
+  try { fs.rmSync(config.lockDir, { recursive: true, force: true }); } catch {}
+  process.exit(exitCode);
+}
+
+function cleanup(exitCode = 0) {
+  if (exiting) return;
+  exiting = true;
+  stopping = true;
+  try { fs.writeFileSync(config.stopFile, new Date().toISOString() + '\\n', { mode: 0o600 }); } catch {}
+  if (child && !child.killed) {
+    try { child.kill('SIGTERM'); } catch {}
+    const timer = setTimeout(() => {
+      if (child && !child.killed) {
+        try { child.kill('SIGKILL'); } catch {}
+      }
+      finish(exitCode);
+    }, 5000);
+    child.once('exit', () => {
+      clearTimeout(timer);
+      finish(exitCode);
+    });
+    return;
+  }
+  finish(exitCode);
+}
+
+function launch() {
+  if (stopping || fs.existsSync(config.stopFile)) return cleanup(0);
+  append(config.serviceLog, 'starting amalgm run');
+  const fd = fs.openSync(config.daemonLog, 'a');
+  child = spawn(config.nodeBin, [config.amalgmBin, 'run'], {
+    cwd: process.env.HOME || process.cwd(),
+    env: { ...process.env, ...config.env },
+    stdio: ['ignore', fd, fd],
+    windowsHide: true,
+  });
+  try { fs.closeSync(fd); } catch {}
+  child.on('exit', (code, signal) => {
+    append(config.serviceLog, \`amalgm run exited code=\${code ?? ''} signal=\${signal ?? ''}\`);
+    child = null;
+    if (stopping || fs.existsSync(config.stopFile)) return cleanup(0);
+    setTimeout(launch, config.restartDelayMs);
+  });
+}
+
+ensureDir(config.amalgmDir);
+ensureDir(config.logDir);
+if (!acquireLock()) process.exit(0);
+writePid();
+try { fs.rmSync(config.stopFile, { force: true }); } catch {}
+process.on('SIGTERM', () => cleanup(0));
+process.on('SIGINT', () => cleanup(0));
+if (process.platform !== 'win32') process.on('SIGHUP', () => cleanup(0));
+launch();
+`;
+  fs.writeFileSync(SERVICE_NODE_SCRIPT_FILE, source, { mode: 0o700 });
+  try {
+    fs.chmodSync(SERVICE_NODE_SCRIPT_FILE, 0o700);
+  } catch {
+    // Best effort.
+  }
+  return SERVICE_NODE_SCRIPT_FILE;
+}
+
+function launchdPlistPath() {
+  return path.join(os.homedir(), 'Library', 'LaunchAgents', `${SERVICE_LABEL}.plist`);
+}
+
+function writeLaunchdPlist(localOnly) {
+  const plistPath = launchdPlistPath();
+  ensureDir(path.dirname(plistPath), 0o700);
+  ensureDir(LOG_DIR, 0o700);
+  const env = buildServiceEnv(localOnly);
+  const envXml = Object.entries(env)
+    .map(([key, value]) => `    <key>${plistEscape(key)}</key>\n    <string>${plistEscape(value)}</string>`)
+    .join('\n');
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${plistEscape(SERVICE_LABEL)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${plistEscape(process.execPath)}</string>
+    <string>${plistEscape(AMALGM_BIN)}</string>
+    <string>run</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+${envXml}
+  </dict>
+  <key>WorkingDirectory</key>
+  <string>${plistEscape(os.homedir())}</string>
+  <key>KeepAlive</key>
+  <true/>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${plistEscape(path.join(LOG_DIR, 'daemon.log'))}</string>
+  <key>StandardErrorPath</key>
+  <string>${plistEscape(path.join(LOG_DIR, 'daemon.log'))}</string>
+</dict>
+</plist>
+`;
+  fs.writeFileSync(plistPath, plist, { mode: 0o600 });
+  return plistPath;
+}
+
+function systemdUnitPath() {
+  return path.join(os.homedir(), '.config', 'systemd', 'user', `${SERVICE_LABEL}.service`);
+}
+
+function writeSystemdUnit(localOnly) {
+  const unitPath = systemdUnitPath();
+  ensureDir(path.dirname(unitPath), 0o700);
+  ensureDir(LOG_DIR, 0o700);
+  const env = {
+    ...buildServiceEnv(localOnly),
+    AMALGM_NODE: process.execPath,
+    AMALGM_BIN,
+    AMALGM_DAEMON_LOG: path.join(LOG_DIR, 'daemon.log'),
+  };
+  const envLines = Object.entries(env)
+    .map(([key, value]) => `Environment=${systemdQuote(`${key}=${value}`)}`)
+    .join('\n');
+  const unit = `[Unit]
+Description=Amalgm local runtime
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${systemdQuote(os.homedir())}
+${envLines}
+ExecStart=/bin/sh -lc ${systemdQuote('exec "$AMALGM_NODE" "$AMALGM_BIN" run >> "$AMALGM_DAEMON_LOG" 2>&1')}
+Restart=always
+RestartSec=5
+KillSignal=SIGTERM
+TimeoutStopSec=20
+
+[Install]
+WantedBy=default.target
+`;
+  fs.writeFileSync(unitPath, unit, { mode: 0o600 });
+  return unitPath;
+}
+
+function serviceStateFor(backend, localOnly, files = {}) {
+  return {
+    backend,
+    label: SERVICE_LABEL,
+    local_only: !!localOnly,
+    package_version: PACKAGE_VERSION,
+    package_root: PACKAGE_ROOT,
+    node: process.execPath,
+    bin: AMALGM_BIN,
+    files,
+    updated_at: new Date().toISOString(),
+  };
+}
+
+function installService(options = {}) {
+  ensureDir(AMALGM_DIR, 0o700);
+  ensureDir(LOG_DIR, 0o700);
+  const localOnly = !!options.localOnly;
+  const { backend, detail } = detectServiceBackend(options.mode || 'auto');
+  let files = {};
+
+  if (backend === 'launchd') {
+    files.plist = writeLaunchdPlist(localOnly);
+  } else if (backend === 'systemd') {
+    files.unit = writeSystemdUnit(localOnly);
+    spawnSync('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore', timeout: 5000 });
+  } else {
+    files.script = writePortableScript(localOnly);
+    files.nodeScript = writePortableNodeScript(localOnly);
+  }
+
+  const state = {
+    ...serviceStateFor(backend, localOnly, files),
+    detail,
+    installed_at: new Date().toISOString(),
+  };
+  writeJson(SERVICE_STATE_FILE, state);
+  return state;
+}
+
+function stateMatchesRequest(state, options = {}) {
+  if (!state) return false;
+  if (state.package_root !== PACKAGE_ROOT) return false;
+  if (state.package_version !== PACKAGE_VERSION) return false;
+  if (!!state.local_only !== !!options.localOnly) return false;
+  const requested = normalizeMode(options.mode || 'auto');
+  if (requested === 'auto') {
+    const desired = detectServiceBackend('auto');
+    if (desired.backend !== state.backend) return false;
+  } else if (requested !== state.backend) {
+    return false;
+  }
+  return true;
+}
+
+function ensureServiceInstalled(options = {}) {
+  const state = readJson(SERVICE_STATE_FILE, null);
+  if (stateMatchesRequest(state, options)) return state;
+  return installService(options);
+}
+
+function runCommand(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: 'utf8',
+    timeout: options.timeout || 10000,
+    stdio: options.stdio || 'pipe',
+  });
+  if (result.status !== 0) {
+    const detail = [result.stderr, result.stdout].filter(Boolean).join('\n').trim();
+    throw new Error(`${command} ${args.join(' ')} failed${detail ? `: ${detail}` : ''}`);
+  }
+  return result;
+}
+
+function launchdDomain() {
+  return `gui/${process.getuid ? process.getuid() : ''}`;
+}
+
+function startLaunchd(state) {
+  const plist = state?.files?.plist || launchdPlistPath();
+  const domain = launchdDomain();
+  spawnSync('launchctl', ['bootout', domain, plist], { stdio: 'ignore', timeout: 5000 });
+  runCommand('launchctl', ['bootstrap', domain, plist], { timeout: 10000 });
+  spawnSync('launchctl', ['enable', `${domain}/${SERVICE_LABEL}`], { stdio: 'ignore', timeout: 5000 });
+  spawnSync('launchctl', ['kickstart', '-k', `${domain}/${SERVICE_LABEL}`], { stdio: 'ignore', timeout: 5000 });
+}
+
+function stopLaunchd(state) {
+  const plist = state?.files?.plist || launchdPlistPath();
+  spawnSync('launchctl', ['bootout', launchdDomain(), plist], { stdio: 'ignore', timeout: 10000 });
+}
+
+function startSystemd() {
+  runCommand('systemctl', ['--user', 'daemon-reload'], { timeout: 10000 });
+  spawnSync('systemctl', ['--user', 'enable', SERVICE_LABEL], { stdio: 'ignore', timeout: 10000 });
+  runCommand('systemctl', ['--user', 'start', SERVICE_LABEL], { timeout: 10000 });
+}
+
+function stopSystemd() {
+  spawnSync('systemctl', ['--user', 'stop', SERVICE_LABEL], { stdio: 'ignore', timeout: 10000 });
+}
+
+function startPortable() {
+  const state = readJson(SERVICE_STATE_FILE, null);
+  writePortableScript(state?.local_only);
+  writePortableNodeScript(state?.local_only);
+  const pid = readPidFile(SERVICE_PID_FILE);
+  if (isPidRunning(pid)) return;
+  removeFile(SERVICE_STOP_FILE);
+  ensureDir(LOG_DIR, 0o700);
+  const logFd = fs.openSync(SERVICE_LOG_FILE, 'a');
+  const command = process.platform === 'win32' ? process.execPath : '/bin/sh';
+  const args = process.platform === 'win32'
+    ? [state?.files?.nodeScript || SERVICE_NODE_SCRIPT_FILE]
+    : [state?.files?.script || SERVICE_SCRIPT_FILE];
+  const child = spawn(command, args, {
+    detached: true,
+    env: {
+      ...process.env,
+      ...buildServiceEnv(state?.local_only),
+    },
+    cwd: os.homedir(),
+    stdio: ['ignore', logFd, logFd],
+    windowsHide: true,
+  });
+  child.unref();
+  fs.closeSync(logFd);
+  writeJson(SERVICE_PID_FILE, {
+    pid: child.pid,
+    backend: 'portable',
+    started_at: new Date().toISOString(),
+  });
+}
+
+function stopDaemonProcess() {
+  const pid = readPidFile(PID_FILE);
+  if (!isPidRunning(pid)) {
+    removeFile(PID_FILE);
+    return false;
+  }
+  try {
+    process.kill(pid, 'SIGTERM');
+  } catch {
+    return false;
+  }
+  const deadline = Date.now() + 5000;
+  while (Date.now() < deadline && isPidRunning(pid)) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+  }
+  if (isPidRunning(pid)) {
+    try {
+      process.kill(pid, 'SIGKILL');
+    } catch {
+      // noop
+    }
+  }
+  removeFile(PID_FILE);
+  return true;
+}
+
+function stopPortable() {
+  ensureDir(AMALGM_DIR, 0o700);
+  fs.writeFileSync(SERVICE_STOP_FILE, `${new Date().toISOString()}\n`, { mode: 0o600 });
+  const pid = readPidFile(SERVICE_PID_FILE);
+  if (isPidRunning(pid)) {
+    try {
+      process.kill(pid, 'SIGTERM');
+    } catch {
+      // noop
+    }
+  }
+  const deadline = Date.now() + 5000;
+  while (Date.now() < deadline && isPidRunning(pid)) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+  }
+  removeFile(SERVICE_PID_FILE);
+}
+
+function startService(options = {}) {
+  const state = ensureServiceInstalled(options);
+  removeFile(SERVICE_STOP_FILE);
+  if (state.backend === 'launchd') startLaunchd(state);
+  else if (state.backend === 'systemd') startSystemd(state);
+  else startPortable(state);
+  return getServiceStatus();
+}
+
+function stopService(options = {}) {
+  const state = readJson(SERVICE_STATE_FILE, null);
+  ensureDir(AMALGM_DIR, 0o700);
+  fs.writeFileSync(SERVICE_STOP_FILE, `${new Date().toISOString()}\n`, { mode: 0o600 });
+
+  if (state?.backend === 'launchd') stopLaunchd(state);
+  else if (state?.backend === 'systemd') stopSystemd(state);
+  else stopPortable();
+
+  const stoppedDaemon = stopDaemonProcess();
+  if (!options.preserveStopFile) removeFile(SERVICE_STOP_FILE);
+  return { service: getServiceStatus(), stoppedDaemon };
+}
+
+function uninstallService() {
+  const state = readJson(SERVICE_STATE_FILE, null);
+  stopService({ preserveStopFile: true });
+  if (state?.backend === 'systemd') {
+    spawnSync('systemctl', ['--user', 'disable', SERVICE_LABEL], { stdio: 'ignore', timeout: 10000 });
+    removeFile(state?.files?.unit || systemdUnitPath());
+    spawnSync('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore', timeout: 5000 });
+  } else if (state?.backend === 'launchd') {
+    removeFile(state?.files?.plist || launchdPlistPath());
+  } else {
+    removeFile(SERVICE_SCRIPT_FILE);
+    removeFile(SERVICE_NODE_SCRIPT_FILE);
+  }
+  removeFile(SERVICE_STATE_FILE);
+  removeFile(SERVICE_STOP_FILE);
+  return true;
+}
+
+function systemdRunning() {
+  if (!systemdAvailable()) return false;
+  const result = spawnSync('systemctl', ['--user', 'is-active', '--quiet', SERVICE_LABEL], {
+    encoding: 'utf8',
+    timeout: 3000,
+  });
+  const output = [result.stderr, result.stdout].filter(Boolean).join('\n');
+  return result.status === 0 && !systemdUnavailableOutput(output);
+}
+
+function launchdRunning() {
+  const result = spawnSync('launchctl', ['print', `${launchdDomain()}/${SERVICE_LABEL}`], {
+    stdio: 'ignore',
+    timeout: 3000,
+  });
+  return result.status === 0;
+}
+
+function getServiceStatus() {
+  const state = readJson(SERVICE_STATE_FILE, null);
+  const backend = state?.backend || null;
+  let installed = false;
+  let running = false;
+  let pid = null;
+
+  if (backend === 'systemd') {
+    installed = fs.existsSync(state?.files?.unit || systemdUnitPath());
+    running = installed && systemdRunning();
+  } else if (backend === 'launchd') {
+    installed = fs.existsSync(state?.files?.plist || launchdPlistPath());
+    running = installed && launchdRunning();
+  } else if (backend === 'portable') {
+    installed = fs.existsSync(state?.files?.script || SERVICE_SCRIPT_FILE)
+      || fs.existsSync(state?.files?.nodeScript || SERVICE_NODE_SCRIPT_FILE);
+    pid = readPidFile(SERVICE_PID_FILE);
+    running = isPidRunning(pid);
+  }
+
+  return {
+    backend,
+    detail: state?.detail || null,
+    installed,
+    running,
+    pid,
+    state,
+    stopRequested: fs.existsSync(SERVICE_STOP_FILE),
+  };
+}
+
+module.exports = {
+  detectServiceBackend,
+  ensureServiceInstalled,
+  getServiceStatus,
+  installService,
+  startService,
+  stopService,
+  uninstallService,
+};

package/lib/supervisor.js

@@ -4,7 +4,7 @@ const crypto = require('crypto');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { spawn } = require('child_process');
+const { spawn, spawnSync } = require('child_process');
 const net = require('net');
 
 const {
@@ -14,6 +14,7 @@ const {
   RUNTIME_DIR,
   RUNTIME_STATE_FILE,
   RUNTIME_TOKEN_FILE,
+  SHUTDOWN_REASON_FILE,
 } = require('./paths');
 const {
   loadComputerRecord,
@@ -56,6 +57,42 @@ function writeJsonSecret(file, data) {
   }
 }
 
+function readProcessCommand(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return '';
+  try {
+    const raw = fs.readFileSync(`/proc/${pid}/cmdline`);
+    const cmd = raw.toString('utf8').replace(/\0/g, ' ').trim();
+    if (cmd) return cmd;
+  } catch {
+    // /proc is Linux-only.
+  }
+  try {
+    const result = spawnSync('ps', ['-p', String(pid), '-o', 'command='], {
+      encoding: 'utf8',
+      timeout: 1000,
+    });
+    return String(result.stdout || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+function writeShutdownReason(signal) {
+  const at = new Date().toISOString();
+  const reason = {
+    at,
+    signal,
+    reason: signal ? `received ${signal}` : 'cleanup requested',
+    pid: process.pid,
+    ppid: process.ppid,
+    parent_command: readProcessCommand(process.ppid) || null,
+    uptime_seconds: Math.round(process.uptime()),
+    package_version: PACKAGE_VERSION,
+  };
+  writeJsonSecret(SHUTDOWN_REASON_FILE, reason);
+  console.log(`[supervisor] shutdown requested signal=${signal || 'unknown'} pid=${process.pid} ppid=${process.ppid} parent=${reason.parent_command || 'unknown'} uptime=${reason.uptime_seconds}s`);
+}
+
 function runtimeEntry(relativePath) {
   return path.join(RUNTIME_DIR, relativePath);
 }
@@ -447,9 +484,10 @@ async function startSupervisor(options = {}) {
 
   await new Promise((resolve) => {
     let cleaned = false;
-    const cleanup = () => {
+    const cleanup = (signal) => {
       if (cleaned) return;
       cleaned = true;
+      writeShutdownReason(signal);
       for (const tunnel of tunnels) tunnel.stop();
       for (const proc of managed) proc.stop();
       try {
@@ -467,9 +505,9 @@ async function startSupervisor(options = {}) {
       resolve();
     };
 
-    process.once('SIGINT', cleanup);
-    process.once('SIGTERM', cleanup);
-    process.once('SIGHUP', cleanup);
+    process.once('SIGINT', () => cleanup('SIGINT'));
+    process.once('SIGTERM', () => cleanup('SIGTERM'));
+    process.once('SIGHUP', () => cleanup('SIGHUP'));
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,
@@ -17,7 +17,7 @@
     "sync-runtime": "node ../../scripts/sync-npm-package-runtime.mjs",
     "prepack": "node ../../scripts/sync-npm-package-runtime.mjs",
     "pack:dry": "npm pack --dry-run",
-    "check": "node --check bin/amalgm.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/paths.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/fs-watcher.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js"
+    "check": "node --check bin/amalgm.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/paths.js && node --check lib/service.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/fs-watcher.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js"
   },
   "engines": {
     "node": ">=20"