cofluxd 2.14.0 → 2.16.0

package/cofluxd.mjs

@@ -1,14 +1,20 @@
 #!/usr/bin/env node
-// cofluxd —— coflux daemon 管理 CLI。
-// daemon 是三个 Rust 进程（ptyd 持 PTY、长生；supervisor 可随时替换；worker 频繁热升级，零 node 运行时）；
-// 本 CLI 只负责装/起/停/升级（用一下，不常驻）。systemd(Linux user) / launchd(macOS LaunchAgent)，
-// ptyd 与 supervisor 各自一份服务文件：重启 supervisor 不带走 ptyd，终端留在里面。
+// cofluxd: installs, starts, stops and updates the Coflux service on a device. It runs for one
+// command and never stays resident.
+//
+// The service is three Rust processes: ptyd owns every PTY and lives long; the launcher owns the
+// runtime version pointer and rollback and rarely changes; the runtime is updated by the server.
+// Three service backends start them:
+// - launchd (macOS) and systemd user units (Linux with systemd booted): ptyd and the launcher each
+//   get their own unit, so restarting the launcher leaves the terminals in ptyd.
+// - self-managed (Linux without systemd: containers, WSL, OpenRC): `coflux-launcher watch` starts
+//   and supervises both. `cofluxd up` runs it in the background; `cofluxd run` in the foreground.
 import { parseArgs } from "node:util";
 import { homedir, hostname, platform, arch } from "node:os";
-import { join, dirname } from "node:path";
+import { join, dirname, basename } from "node:path";
 import { createInterface } from "node:readline/promises";
 import fs from "node:fs";
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import dns from "node:dns/promises";
 import net from "node:net";
 import tls from "node:tls";
@@ -22,9 +28,10 @@ import {
   parseReleaseManifestEntry,
   verifyReleaseArtifact,
 } from "./release-trust.mjs";
-import { executorRuntime, plistXml, ptydPlistXml, ptydSystemdUnit, systemdUnit } from "./service-unit.mjs";
+import { executorRuntime, plistXml, ptydPlistXml, ptydSystemdUnit, systemdUnit, watcherEnv } from "./service-unit.mjs";
+import { bold, duration, error as printError, fail, info, step, success, table, warn } from "./output.mjs";
 
-// 默认中心服务（公共 SaaS）；自托管用 --server 覆盖。
+// The public server; self-hosted servers pass --server.
 const DEFAULT_SERVER = "wss://api.coflux.dev/daemon";
 
 const REPO = "myWsq/coflux";
@@ -41,44 +48,77 @@ const RELEASE_ARCHIVE_BASE = (
 const MAX_RELEASE_METADATA_BYTES = 1024 * 1024;
 const HOME = process.env.COFLUX_HOME || join(homedir(), ".coflux");
 const BIN_DIR = join(HOME, "bin");
-const SETTINGS = join(HOME, "settings.json"); // 用户配置（serverUrl/deviceName/shell）→ daemon 直接读；600 权限防同机其他用户窥探
+const SETTINGS = join(HOME, "settings.json"); // serverUrl / deviceName / shell, read by the service; 0600
 const LOG_FILE = join(HOME, "daemon.log");
 const CRED = join(HOME, "credentials.json");
-const PENDING_AUTH = join(HOME, "pending-auth.json"); // worker 落盘的待授权链接（daemon.authorizePending）
-// One-time join key (plan 20260924-device-join-keys): `up --key` writes it, the worker presents it once
+const PENDING_AUTH = join(HOME, "pending-auth.json"); // the authorization link the runtime writes
+// One-time join key (plan 20260924-device-join-keys): `up --key` writes it, the runtime presents it once
 // and deletes it on the server's answer, recording what happened in the outcome file (0600 each).
 const JOIN_KEY = join(HOME, "join-key.json");
 const JOIN_OUTCOME = join(HOME, "join-outcome.json");
-const CONN_STATE = join(HOME, "conn-state.json"); // worker 落盘的连接态快照（plan 033，见 crates/worker/src/conn_state.rs）
-const LOCAL_GATEWAY_STORE = join(HOME, "local-gateway.json"); // gateway key/origin/grant；doctor 只读结构与数量，绝不打印秘密
-const FDA_STATUS = join(HOME, "fda-status"); // supervisor 启动时探测落盘（仅 macOS，见 crates/supervisor/src/fda.rs）
-const SUP_BIN = join(BIN_DIR, "coflux-supervisor");
-const WRK_BIN = join(BIN_DIR, "coflux-worker");
-// PTY 托管进程（plan 20260918-ptyd-terminal-custody）：与 supervisor 平级的独立服务，supervisor 找不到它就拒绝启动。
+const CONN_STATE = join(HOME, "conn-state.json"); // connection snapshot (crates/runtime/src/conn_state.rs)
+const LOCAL_GATEWAY_STORE = join(HOME, "local-gateway.json"); // doctor reads its shape and counts only, never secrets
+const FDA_STATUS = join(HOME, "fda-status"); // macOS only, written by the runtime (crates/runtime/src/fda.rs)
+const LAUNCHER_BIN = join(BIN_DIR, "coflux-launcher");
+const RUNTIME_BIN = join(BIN_DIR, "coflux-runtime");
 const PTYD_BIN = join(BIN_DIR, "coflux-ptyd");
+const CLI_BIN = join(BIN_DIR, "coflux");
 const CLI_RELEASE_FLOOR = join(HOME, "cofluxd.release-floor");
-const WORKER_RELEASE_FLOOR = join(HOME, "worker.release-floor");
+const RUNTIME_RELEASE_FLOOR = join(HOME, "runtime.release-floor");
 const IS_MAC = platform() === "darwin";
 const IS_LINUX = platform() === "linux";
 const PLIST = join(homedir(), "Library", "LaunchAgents", "com.coflux.daemon.plist");
 const UNIT = join(homedir(), ".config", "systemd", "user", "coflux-daemon.service");
-// ptyd 是独立的服务（plan 20260918-ptyd-terminal-custody）：launchd 一个 plist 只能跑一个程序，systemd 默认
-// KillMode=control-group 会在 `systemctl restart` 时把整个 cgroup 一起杀——ptyd 必须在 supervisor 的进程组 /
-// cgroup 之外，重启 supervisor 才不会带走它。停止 daemon（down / uninstall）仍然一并停 ptyd。
+// ptyd runs as its own service (plan 20260918-ptyd-terminal-custody): one launchd plist runs one program,
+// and systemd's default KillMode=control-group would take the whole cgroup down on `systemctl restart`.
+// ptyd must sit outside the launcher's process group / cgroup for a restart to leave the terminals.
 const PTYD_PLIST = join(homedir(), "Library", "LaunchAgents", "com.coflux.ptyd.plist");
 const PTYD_UNIT = join(homedir(), ".config", "systemd", "user", "coflux-ptyd.service");
-const DEFAULT_LOCAL_GATEWAY_PORT = 8788; // 与 packages/crates protocol 的 LOCAL_GATEWAY_PORT 保持一致
+const DEFAULT_LOCAL_GATEWAY_PORT = 8788; // same as LOCAL_GATEWAY_PORT in the protocol packages
+
+// Self-managed mode (`coflux-launcher watch`, crates/launcher/src/watch.rs).
+const SERVICE_MODE_FILE = join(HOME, "service-mode"); // "self-managed" once `up` chose it on this device
+const WATCH_SOCK = join(HOME, "watch.sock");
+const WATCH_STATE = join(HOME, "watch.json");
+/** Found inside a launcher binary that has `watch`; an older launcher would ignore the argument. */
+const WATCH_PROTOCOL = "coflux-watch/1";
+/** The watcher's exit code when another service already owns this home. */
+const WATCH_EXIT_REFUSED = 3;
 
-const die = (m) => { console.error("✗ " + m); process.exit(1); };
+const SYSTEMD_NEXT = "Check that systemd user services work in this session (systemctl --user status), then try again.";
+const LAUNCHD_NEXT = "See cofluxd logs, then try again.";
+
+const die = (what, next = "Run cofluxd --help for usage.") => fail(what, next);
 const run = (cmd, args, opts = {}) => spawnSync(cmd, args, { encoding: "utf8", ...opts });
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const messageOf = (error) => (error instanceof Error ? error.message : String(error));
+
+/**
+ * A launchctl / systemctl call whose failure must stop the command: `up` never reports success over a
+ * service manager that refused. Calls that only clear whatever may be loaded use `run` instead.
+ */
+function runChecked(cmd, args, next) {
+  const result = run(cmd, args);
+  if (result.status === 0) return result;
+  const detail = (result.stderr || result.stdout || "").trim().split("\n")[0] || (result.error ? result.error.message : `exit status ${result.status}`);
+  die(`${cmd} ${args.join(" ")} failed: ${detail}`, next);
+}
 
 function rustTarget() {
   const p = platform(), a = arch();
   if (p === "darwin") return a === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin";
   if (p === "linux") return a === "arm64" ? "aarch64-unknown-linux-musl" : "x86_64-unknown-linux-musl";
-  die(`不支持的平台: ${p}/${a}（仅 macOS / Linux）`);
+  die(`This platform is not supported: ${p}/${a}.`, "Coflux runs on macOS and Linux.");
 }
 
+/** `linux-x64`, `macos-arm64`: the platform as people name it. */
+function platformLabel() {
+  return `${IS_MAC ? "macos" : platform()}-${arch()}`;
+}
+
+/** `2.15.0` for the tag `v2.15.0`. */
+const displayVersion = (tag) => String(tag).replace(/^v/, "");
+
 function readSettings() {
   try { return JSON.parse(fs.readFileSync(SETTINGS, "utf8")); } catch { return {}; }
 }
@@ -102,6 +142,11 @@ function readConnState() {
   try { return JSON.parse(fs.readFileSync(CONN_STATE, "utf8")); } catch { return null; }
 }
 
+/** The host people recognise in a server URL: `api.coflux.dev`. */
+function serverHost(serverUrl) {
+  try { return new URL(serverUrl).host || serverUrl; } catch { return serverUrl || "unknown server"; }
+}
+
 function readLocalGatewaySummary() {
   let store;
   try { store = JSON.parse(fs.readFileSync(LOCAL_GATEWAY_STORE, "utf8")); }
@@ -109,26 +154,24 @@ function readLocalGatewaySummary() {
     return {
       ok: false,
       ready: false,
-      // JSON.parse 的错误在部分 Node 版本会带原文片段；store 含私钥，诊断输出绝不能回显。
-      error: fs.existsSync(LOCAL_GATEWAY_STORE) ? "grant store 无法解析" : "grant store 尚未创建",
+      // JSON.parse errors can quote the file on some Node versions; the store holds private keys and
+      // diagnostics must never echo it.
+      error: fs.existsSync(LOCAL_GATEWAY_STORE) ? "pairing data cannot be read" : "no pairing data yet",
     };
   }
   if (store?.version !== 1 || !Array.isArray(store.origins) || !Array.isArray(store.grants)) {
-    return { ok: false, ready: false, error: "grant store 结构/版本无效" };
+    return { ok: false, ready: false, error: "pairing data is not valid" };
   }
   const origins = store.origins.filter((origin) => typeof origin === "string" && origin.length > 0);
   const grants = store.grants.filter((grant) => grant && typeof grant.origin === "string" && grant.origin.length > 0);
   const origin = grants.find((grant) => origins.includes(grant.origin))?.origin || origins[0];
   const ready = grants.length > 0 && !!origin;
-  const summary = ready
-    ? `${grants.length} 个持久 grant / ${origins.length} 个 Origin`
-    : `${grants.length} 个 grant / ${origins.length} 个 Origin（尚无可用浏览器配对）`;
   return {
     ok: ready,
     ready,
     origin,
-    detail: ready ? summary : undefined,
-    error: ready ? undefined : summary,
+    detail: ready ? `${grants.length} paired browser${grants.length === 1 ? "" : "s"}` : undefined,
+    error: ready ? undefined : "no paired browser yet",
   };
 }
 
@@ -137,44 +180,30 @@ function localGatewayPort() {
   if (raw === undefined || raw === "") return { ok: true, port: DEFAULT_LOCAL_GATEWAY_PORT };
   const port = Number(raw);
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    return { ok: false, error: `COFLUX_LOCAL_GATEWAY_PORT=${raw} 无法定位固定监听端口` };
+    return { ok: false, error: `COFLUX_LOCAL_GATEWAY_PORT=${raw} is not a valid port` };
   }
   return { ok: true, port };
 }
-const CONN_STATE_LABEL = { connecting: "连接中", connected: "已连接", reconnecting: "重连中" };
-function formatDuration(ms) {
-  const s = Math.max(0, Math.round(ms / 1000));
-  if (s < 60) return `${s}秒`;
-  const m = Math.floor(s / 60);
-  if (m < 60) return `${m}分钟`;
-  const h = Math.floor(m / 60);
-  return `${h}小时${m % 60}分钟`;
-}
 
-// "granted" | "denied" | "unknown" | null（文件不存在——supervisor 还没起过/还没写）
+/** "granted" | "denied" | "unknown" | null (no file: the service has not written it yet). */
 function readFdaStatus() {
   try { return fs.readFileSync(FDA_STATUS, "utf8").trim(); } catch { return null; }
 }
-function fdaLabel(status) {
-  return status === "granted" ? "已授予" : status === "denied" ? "未授予" : "未知";
-}
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
 function fileSha256(path) {
   try { return crypto.createHash("sha256").update(fs.readFileSync(path)).digest("hex"); } catch { return null; }
 }
 
-// macOS：新落盘的二进制带 com.apple.provenance，launchd 顶层 spawn 会被 AMFI 以
-// OS_REASON_CODESIGNING 静默杀死——即使产物是 Developer ID 签名 + 已公证（2026-07-25
-// v0.13.0 实测仍被连杀）。本地 ad-hoc 重签使其成为"本机产物"绕开该检查。
-// 远端产物必须先完成 release statement 验签，再允许走到这里；绝不能替任意下载内容重签。
+// macOS: a freshly written binary carries com.apple.provenance, and launchd's top-level spawn gets it
+// killed by AMFI with OS_REASON_CODESIGNING, even when it is Developer ID signed and notarized
+// (observed with v0.13.0 on 2026-07-25). An ad-hoc local re-sign makes it a local product. Remote
+// artifacts must pass release statement verification before they get here; never re-sign anything else.
 function resignMacBinaries(paths) {
   if (!IS_MAC) return;
   for (const p of paths) {
     const r = run("codesign", ["--force", "-s", "-", p]);
     if (r.status !== 0) {
-      throw new Error(`macOS 本地重签失败: ${p}；保留当前 daemon 二进制`);
+      throw new Error(`could not re-sign ${basename(p)} for macOS`);
     }
   }
 }
@@ -184,12 +213,12 @@ async function fetchBounded(url, maxBytes, label) {
     redirect: "follow",
     signal: AbortSignal.timeout(30_000),
   });
-  if (!res.ok) throw new Error(`${label} 下载失败（HTTP ${res.status}）`);
+  if (!res.ok) throw new Error(`${label}: HTTP ${res.status}`);
   const declaredLength = Number(res.headers.get("content-length"));
   if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-    throw new Error(`${label} 超过大小上限`);
+    throw new Error(`${label} is larger than allowed`);
   }
-  if (!res.body) throw new Error(`${label} 响应没有 body`);
+  if (!res.body) throw new Error(`${label} came back empty`);
   const chunks = [];
   let total = 0;
   for await (const chunk of res.body) {
@@ -197,7 +226,7 @@ async function fetchBounded(url, maxBytes, label) {
     total += bytes.byteLength;
     if (total > maxBytes) {
       await res.body.cancel().catch(() => {});
-      throw new Error(`${label} 超过大小上限`);
+      throw new Error(`${label} is larger than allowed`);
     }
     chunks.push(bytes);
   }
@@ -210,34 +239,36 @@ function loadReleasePublicKey() {
   return createReleasePublicKey(publicKeyHex);
 }
 
+const FLOOR_NEXT = "Reinstall Coflux on this device: cofluxd uninstall --purge, then cofluxd up.";
+
 function readReleaseFloor(path, label) {
   let metadata;
   try { metadata = fs.lstatSync(path); }
   catch (error) {
     if (error?.code === "ENOENT") return undefined;
-    throw new Error(`${label} 元数据无法读取，拒绝远端升级`);
+    throw new Error(`The local version record ${label} cannot be read.`);
   }
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size <= 0 || metadata.size > 128) {
-    throw new Error(`${label} 不是安全且有界的普通文件，拒绝远端升级`);
+    throw new Error(`The local version record ${label} is not a small regular file.`);
   }
   let value;
   try { value = fs.readFileSync(path, "utf8").trim(); }
-  catch { throw new Error(`${label} 无法读取，拒绝远端升级`); }
+  catch { throw new Error(`The local version record ${label} cannot be read.`); }
   try { assertReleaseVersion(value); }
-  catch { throw new Error(`${label} 已损坏，拒绝远端升级`); }
+  catch { throw new Error(`The local version record ${label} is corrupted.`); }
   return value;
 }
 
 function currentReleaseFloor() {
   const floors = [
     readReleaseFloor(CLI_RELEASE_FLOOR, "cofluxd.release-floor"),
-    readReleaseFloor(WORKER_RELEASE_FLOOR, "worker.release-floor"),
+    readReleaseFloor(RUNTIME_RELEASE_FLOOR, "runtime.release-floor"),
   ].filter(Boolean);
   return floors.reduce((highest, candidate) => {
     if (!highest) return candidate;
     const order = compareReleaseVersions(candidate, highest);
     if (order === 0 && candidate !== highest) {
-      throw new Error(`本机 release floor precedence 相同但身份冲突：${highest} / ${candidate}`);
+      throw new Error(`The local version records disagree: ${highest} and ${candidate}.`);
     }
     return order > 0 ? candidate : highest;
   }, undefined);
@@ -270,7 +301,7 @@ async function readMirrorLatestTag() {
     const body = await fetchBounded(
       `${RELEASE_MIRROR_BASE}/latest.json`,
       MAX_RELEASE_METADATA_BYTES,
-      "release 下载镜像 latest.json",
+      "latest.json",
     );
     const tag = JSON.parse(body.toString("utf8"))?.version;
     if (typeof tag !== "string") return null;
@@ -281,18 +312,23 @@ async function readMirrorLatestTag() {
   }
 }
 
-// skipIfPresent：up 的幂等语义——二进制已存在且调用方未显式传 version 时跳过下载，
-// 避免重跑 up 变成隐式升级（用户拍板，见 plan 035 Decisions）。update/--bin-dir/显式 --version 不受影响。
+/**
+ * Put the binaries in place. Returns the version installed: a release tag, or "local build".
+ *
+ * skipIfPresent: `up` and `run` are idempotent. When the binaries exist and no --version was given they
+ * are not downloaded again, so running `up` twice never upgrades by surprise (plan 035). `update`,
+ * --bin-dir and an explicit --version are not affected.
+ */
 async function ensureBinaries({ version, binDir, skipIfPresent }) {
   fs.mkdirSync(BIN_DIR, { recursive: true });
   if (binDir) {
-    const localArtifacts = ["coflux-supervisor", "coflux-worker", "coflux-ptyd", ...(fs.existsSync(join(binDir, "coflux")) ? ["coflux"] : []), ...(fs.existsSync(join(binDir, "coflux-transport")) ? ["coflux-transport"] : [])].map((name) => ({
+    const localArtifacts = ["coflux-launcher", "coflux-runtime", "coflux-ptyd", ...(fs.existsSync(join(binDir, "coflux")) ? ["coflux"] : []), ...(fs.existsSync(join(binDir, "coflux-transport")) ? ["coflux-transport"] : [])].map((name) => ({
       name,
       path: join(binDir, name),
     }));
     for (const artifact of localArtifacts) {
       if (!fs.existsSync(artifact.path)) {
-        die(`本地产物缺失: ${artifact.path}（先 cargo build --release？）`);
+        die(`Missing local build: ${artifact.path}`, "Build it first, for example with cargo build --release.");
       }
     }
     const stageDir = fs.mkdtempSync(join(BIN_DIR, ".coflux-local-install-"));
@@ -319,14 +355,14 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
       fs.rmSync(stageDir, { recursive: true, force: true });
     }
     if (localFailure) {
-      die(`本地 daemon 安装失败：${localFailure instanceof Error ? localFailure.message : String(localFailure)}`);
+      die(`Could not install the local build: ${messageOf(localFailure)}`, "Check the files in --bin-dir, then try again.");
     }
-    console.log(`✓ 用本地二进制（${binDir}）`);
-    return;
+    success(`Using the local build in ${binDir}`);
+    return "local build";
   }
-  if (skipIfPresent && !version && fs.existsSync(SUP_BIN) && fs.existsSync(WRK_BIN) && fs.existsSync(PTYD_BIN)) {
-    console.log(`✓ 二进制已存在（${BIN_DIR}），跳过下载（用 cofluxd update 升级）`);
-    return;
+  if (skipIfPresent && !version && fs.existsSync(LAUNCHER_BIN) && fs.existsSync(RUNTIME_BIN) && fs.existsSync(PTYD_BIN)) {
+    success("Using the installed Coflux. To upgrade, run cofluxd update.");
+    return null;
   }
   const target = rustTarget();
   let releaseVersion;
@@ -335,13 +371,12 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
     const tag = await readMirrorLatestTag();
     if (!tag) {
       die(
-        `无法从下载镜像读取最新版本（${RELEASE_MIRROR_BASE}/latest.json），拒绝无版本身份的下载。\n` +
-        "  用 --version vX.Y.Z 指定版本即可从 GitHub Releases 安装。",
+        `Cannot read the latest version from ${RELEASE_MIRROR_BASE}/latest.json.`,
+        "Pass a version to install it from GitHub Releases: --version vX.Y.Z",
       );
     }
     releaseVersion = tag;
     releaseBase = RELEASE_MIRROR_BASE;
-    console.log(`最新版本: ${releaseVersion}`);
   } else {
     releaseVersion = version;
     // Only the tag the mirror's pointer names lives on the mirror; any other version (older, newer or a
@@ -351,7 +386,7 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
   try {
     assertReleaseVersion(releaseVersion);
   } catch (error) {
-    die(error instanceof Error ? error.message : String(error));
+    die(messageOf(error), "Pass a release tag such as --version v2.15.0, or --version latest.");
   }
   let releaseFloor;
   try {
@@ -360,15 +395,18 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
       ? compareReleaseVersions(releaseVersion, releaseFloor)
       : 1;
     if (floorOrder < 0 || (floorOrder === 0 && releaseVersion !== releaseFloor)) {
-      throw new Error(`远端 release ${releaseVersion} 不高于本机可信身份 ${releaseFloor}，拒绝降级/重放`);
+      throw Object.assign(
+        new Error(`Release ${releaseVersion} is not newer than the version this device already trusts (${releaseFloor}); refusing a downgrade or replay.`),
+        { next: "Install a newer release, or run cofluxd update for the latest one." },
+      );
     }
   } catch (error) {
-    die(error instanceof Error ? error.message : String(error));
+    die(messageOf(error), error?.next || FLOOR_NEXT);
   }
 
   const base = `${releaseBase}/${releaseVersion}`;
-  console.log(`下载源: ${base}`);
   const stageDir = fs.mkdtempSync(join(BIN_DIR, ".coflux-release-install-"));
+  const download = step(`Downloading Coflux ${displayVersion(releaseVersion)} (${platformLabel()})`);
   let failure;
   try {
     const manifestBytes = await fetchBounded(
@@ -380,14 +418,13 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
     try {
       manifest = JSON.parse(manifestBytes.toString("utf8"));
     } catch {
-      throw new Error("release manifest 不是有效 JSON");
+      throw new Error("the release manifest is not valid JSON");
     }
     const publicKey = loadReleasePublicKey();
     const staged = [];
-    for (const component of ["supervisor", "worker", ...(manifest.cli ? ["cli"] : []), ...(manifest.transport ? ["transport"] : []), ...(manifest.ptyd ? ["ptyd"] : [])]) {
+    for (const component of ["launcher", "runtime", ...(manifest.cli ? ["cli"] : []), ...(manifest.transport ? ["transport"] : []), ...(manifest.ptyd ? ["ptyd"] : [])]) {
       const entry = parseReleaseManifestEntry(manifest, component, releaseVersion, target);
       const artifactName = `coflux-${component}-${target}`;
-      process.stdout.write(`下载并验签 ${artifactName} … `);
       const data = await fetchBounded(
         `${base}/${artifactName}`,
         Math.min(entry.size, MAX_RELEASE_ARTIFACT_BYTES),
@@ -399,11 +436,10 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
       fs.chmodSync(source, 0o755);
       staged.push({
         source,
-        destination: component === "cli" ? join(BIN_DIR, "coflux") : component === "supervisor" ? SUP_BIN : component === "transport" ? join(BIN_DIR, "coflux-transport") : component === "ptyd" ? PTYD_BIN : WRK_BIN,
+        destination: component === "cli" ? CLI_BIN : component === "launcher" ? LAUNCHER_BIN : component === "transport" ? join(BIN_DIR, "coflux-transport") : component === "ptyd" ? PTYD_BIN : RUNTIME_BIN,
       });
-      console.log("✓");
     }
-    // 两个远端产物均通过同一发布根的验签后，才允许做本地平台变换与替换。
+    // Every remote artifact verified against the same release root before any local transform / replacement.
     resignMacBinaries(staged.map(({ source }) => source));
     if (manifest.transport) {
       const source = join(stageDir, "TRANSPORT-NOTICES.txt");
@@ -412,8 +448,8 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
       fs.writeFileSync(source, notices, { mode: 0o644 });
       staged.push({ source, destination: join(BIN_DIR, "TRANSPORT-NOTICES.txt") });
     }
-    // floor 先于 pair 提交：若其后进程崩溃，最多是旧二进制配更高 floor；重跑同版仍允许，
-    // 但任何旧的合法 release 都不能趁窗口降级。
+    // The floor is committed before the binaries: a crash in between leaves at worst old binaries with
+    // a higher floor. Re-running the same version is still allowed; no older valid release can slip in.
     if (!releaseFloor || compareReleaseVersions(releaseVersion, releaseFloor) > 0) {
       persistCliReleaseFloor(releaseVersion);
     }
@@ -424,11 +460,18 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
     fs.rmSync(stageDir, { recursive: true, force: true });
   }
   if (failure) {
-    die(`release 安装失败：${failure instanceof Error ? failure.message : String(failure)}`);
+    download.failed();
+    die(
+      `Could not install Coflux ${displayVersion(releaseVersion)} from ${base}: ${messageOf(failure)}`,
+      "Nothing on this device was changed. Check your network, then try again.",
+    );
   }
+  download.done();
+  success("Signature verified");
+  return releaseVersion;
 }
 
-// 写 settings.json（daemon 直接读）。
+// settings.json, read by the service directly.
 function applyConfig({ serverUrl, deviceName, shell }) {
   fs.mkdirSync(HOME, { recursive: true });
   fs.chmodSync(HOME, 0o700);
@@ -439,320 +482,704 @@ function applyConfig({ serverUrl, deviceName, shell }) {
 }
 
 /**
- * The executor runtime recorded in the unit, worked out once per `cofluxd up`. See
+ * The executor runtime recorded for the service, worked out once per command. See
  * `service-unit.mjs`: null simply means this installation does not host an executor.
  */
 function executorUnitRuntime() {
   const runtime = executorRuntime();
-  if (!runtime) console.log("· 本次安装不托管 executor（找不到 @coflux/executor）；由 Coflux.app 托管或先重装 cofluxd");
+  if (!runtime) warn("This installation cannot run the executor.", "Reinstall cofluxd to add it, or use Coflux.app on this machine.");
   return runtime;
 }
 
-/** 四份服务文件的路径与文本（`cofluxd service-files` 原样打印，黑盒据此断言 ptyd 独立受管）。 */
+/** The four service files: paths and text (`cofluxd service-files` prints them as they are). */
 function serviceFiles(executor = executorRuntime()) {
   return {
     launchd: {
-      supervisor: { path: PLIST, text: plistXml({ supervisorBin: SUP_BIN, home: HOME, logFile: LOG_FILE, executor }) },
+      launcher: { path: PLIST, text: plistXml({ launcherBin: LAUNCHER_BIN, home: HOME, logFile: LOG_FILE, executor }) },
       ptyd: { path: PTYD_PLIST, text: ptydPlistXml({ ptydBin: PTYD_BIN, home: HOME, logFile: LOG_FILE }) },
     },
     systemd: {
-      supervisor: { path: UNIT, text: systemdUnit({ supervisorBin: SUP_BIN, home: HOME, executor }) },
+      launcher: { path: UNIT, text: systemdUnit({ launcherBin: LAUNCHER_BIN, home: HOME, executor }) },
       ptyd: { path: PTYD_UNIT, text: ptydSystemdUnit({ ptydBin: PTYD_BIN, home: HOME }) },
     },
   };
 }
-function installService(start) {
-  const files = serviceFiles(executorUnitRuntime());
-  if (IS_MAC) {
+
+/* ------------------------------ service modes ------------------------------ */
+
+/** sd_booted(): systemd is PID 1. A `systemctl` binary alone proves nothing in a container. */
+function systemdBooted() {
+  return fs.existsSync("/run/systemd/system");
+}
+
+function readServiceMode() {
+  try { return fs.readFileSync(SERVICE_MODE_FILE, "utf8").trim(); } catch { return ""; }
+}
+
+function writeServiceMode() {
+  fs.writeFileSync(SERVICE_MODE_FILE, "self-managed\n", { mode: 0o600 });
+}
+
+function clearServiceMode() {
+  try { fs.rmSync(SERVICE_MODE_FILE, { force: true }); } catch { /* */ }
+}
+
+/** The backend this device runs under: recorded once `up` chose self-managed, never re-detected. */
+function serviceMode() {
+  if (IS_MAC) return "launchd";
+  if (!IS_LINUX) die("Coflux runs only on macOS and Linux.", "Use a macOS or Linux machine.");
+  if (readServiceMode() === "self-managed") return "self-managed";
+  return systemdBooted() ? "systemd" : "self-managed";
+}
+
+/** One request to the running watcher; null when no watcher answers. */
+function watchRequest(op, timeoutMs = 5000) {
+  return new Promise((resolve) => {
+    const socket = net.createConnection(WATCH_SOCK);
+    let text = "";
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(value);
+    };
+    socket.setEncoding("utf8");
+    socket.setTimeout(timeoutMs, () => finish(null));
+    socket.on("error", () => finish(null));
+    socket.on("connect", () => socket.write(JSON.stringify({ op }) + "\n"));
+    socket.on("data", (chunk) => {
+      text += chunk;
+      const end = text.indexOf("\n");
+      if (end < 0) return;
+      try { finish(JSON.parse(text.slice(0, end))); } catch { finish(null); }
+    });
+    socket.on("end", () => finish(null));
+  });
+}
+
+/** A launcher from before `watch` ignores its arguments and would start next to nothing. */
+function launcherSupportsWatch() {
+  try { return fs.readFileSync(LAUNCHER_BIN).includes(WATCH_PROTOCOL); } catch { return false; }
+}
+
+function requireWatchSupport() {
+  if (!launcherSupportsWatch()) {
+    die("The installed Coflux is too old to run without systemd.", "Run cofluxd update, then try again.");
+  }
+}
+
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 1) return false;
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === "EPERM"; }
+}
+
+/** The executable name of a process, to make sure a recorded pid still is that process. */
+function processName(pid) {
+  try { return basename(fs.readlinkSync(`/proc/${pid}/exe`)).replace(/ \(deleted\)$/, ""); } catch { /* not Linux */ }
+  const result = run("ps", ["-p", String(pid), "-o", "comm="]);
+  return result.status === 0 ? basename(result.stdout.trim()) : "";
+}
+
+async function waitGone(pid, ms) {
+  const deadline = Date.now() + ms;
+  while (pidAlive(pid)) {
+    if (Date.now() >= deadline) return false;
+    await sleep(100);
+  }
+  return true;
+}
+
+/**
+ * No watcher answers, but a killed one may have left its children running (they live in their own
+ * sessions). Stop them in the watcher's order: the launcher first, then ptyd alone.
+ */
+async function stopLeftovers() {
+  let state;
+  try { state = JSON.parse(fs.readFileSync(WATCH_STATE, "utf8")); } catch { return; }
+  const launcher = Number(state?.launcherPid);
+  if (pidAlive(launcher) && processName(launcher).startsWith("coflux-launcher")) {
+    try { process.kill(launcher, "SIGTERM"); } catch { /* already gone */ }
+    if (!(await waitGone(launcher, 10_000))) {
+      try { process.kill(-launcher, "SIGKILL"); } catch { /* */ }
+    }
+  }
+  const ptyd = Number(state?.ptydPid);
+  if (pidAlive(ptyd) && processName(ptyd).startsWith("coflux-ptyd")) {
+    try { process.kill(ptyd, "SIGTERM"); } catch { /* already gone */ }
+    if (!(await waitGone(ptyd, 15_000))) {
+      try { process.kill(ptyd, "SIGKILL"); } catch { /* */ }
+    }
+  }
+  try { fs.rmSync(WATCH_STATE, { force: true }); } catch { /* */ }
+}
+
+/** Start the self-managed service in the background and wait until it runs. */
+async function startSelfManaged(executor) {
+  requireWatchSupport();
+  fs.mkdirSync(HOME, { recursive: true });
+  const logFd = fs.openSync(LOG_FILE, "a", 0o600);
+  let exited = null;
+  try {
+    // A new session, no stdin, output to daemon.log: logging out of SSH must not take it down.
+    const child = spawn(LAUNCHER_BIN, ["watch"], {
+      detached: true,
+      stdio: ["ignore", logFd, logFd],
+      env: watcherEnv(process.env, { home: HOME, executor }),
+    });
+    child.once("error", (error) => { exited = { error }; });
+    child.once("exit", (code, signal) => { exited = { code, signal }; });
+    child.unref();
+  } finally {
+    fs.closeSync(logFd);
+  }
+  const deadline = Date.now() + 20_000;
+  while (Date.now() < deadline) {
+    if (exited) break;
+    const status = await watchRequest("status", 1000);
+    if (status?.ok && status.launcher?.running) return;
+    await sleep(200);
+  }
+  if (exited?.code === WATCH_EXIT_REFUSED) {
+    die("Coflux is already running on this device under another service.", "Stop it first with cofluxd down. If the Coflux app runs on this machine, quit it.");
+  }
+  die(exited ? "The service exited while starting." : "The service did not start in time.", "See what went wrong with cofluxd logs.");
+}
+
+/** Stop the self-managed service: the watcher if one answers, else whatever a killed one left. */
+async function stopSelfManaged() {
+  const reply = await watchRequest("stop", 60_000);
+  if (reply) {
+    const deadline = Date.now() + 10_000;
+    while (Date.now() < deadline && (await watchRequest("status", 500))) await sleep(200);
+    return;
+  }
+  await stopLeftovers();
+}
+
+function installService(mode, start, executor) {
+  const files = serviceFiles(executor);
+  if (mode === "launchd") {
     fs.mkdirSync(dirname(PLIST), { recursive: true });
     fs.writeFileSync(PTYD_PLIST, files.launchd.ptyd.text);
-    fs.writeFileSync(PLIST, files.launchd.supervisor.text);
+    fs.writeFileSync(PLIST, files.launchd.launcher.text);
     if (start) {
-      // ptyd 先起：supervisor 连不上它会退出，KeepAlive 再拉一次也只是浪费。
+      // ptyd first: a runtime that cannot reach it exits, and a KeepAlive retry is wasted work.
       run("launchctl", ["unload", PLIST]);
       run("launchctl", ["unload", PTYD_PLIST]);
-      run("launchctl", ["load", PTYD_PLIST]);
-      run("launchctl", ["load", PLIST]);
+      runChecked("launchctl", ["load", PTYD_PLIST], LAUNCHD_NEXT);
+      runChecked("launchctl", ["load", PLIST], LAUNCHD_NEXT);
     }
-    console.log(`✓ launchd: ${PTYD_PLIST}\n✓ launchd: ${PLIST}`);
-  } else if (IS_LINUX) {
+  } else if (mode === "systemd") {
     fs.mkdirSync(dirname(UNIT), { recursive: true });
     fs.writeFileSync(PTYD_UNIT, files.systemd.ptyd.text);
-    fs.writeFileSync(UNIT, files.systemd.supervisor.text);
+    fs.writeFileSync(UNIT, files.systemd.launcher.text);
     if (start) {
-      run("systemctl", ["--user", "daemon-reload"]);
-      run("systemctl", ["--user", "enable", "--now", "coflux-ptyd.service"]);
-      run("systemctl", ["--user", "enable", "--now", "coflux-daemon.service"]);
+      runChecked("systemctl", ["--user", "daemon-reload"], SYSTEMD_NEXT);
+      runChecked("systemctl", ["--user", "enable", "--now", "coflux-ptyd.service"], SYSTEMD_NEXT);
+      runChecked("systemctl", ["--user", "enable", "--now", "coflux-daemon.service"], SYSTEMD_NEXT);
     }
-    console.log(`✓ systemd: ${PTYD_UNIT}\n✓ systemd: ${UNIT}`);
-  } else die("仅支持 macOS / Linux");
+  }
 }
-/** 只重启 supervisor：终端留在 ptyd 里。ptyd 若还没起（首次升到带 ptyd 的版本）先把它拉起来，已在跑则无事。 */
-function restartService() {
-  if (IS_MAC) {
-    run("launchctl", ["load", PTYD_PLIST]);
+
+/** Restart the launcher (and its runtime) only: the terminals stay in ptyd. Starts ptyd if it is not running. */
+async function restartService(mode, executor) {
+  if (mode === "launchd") {
+    run("launchctl", ["load", PTYD_PLIST]); // already loaded is fine
     run("launchctl", ["unload", PLIST]);
-    run("launchctl", ["load", PLIST]);
-  } else if (IS_LINUX) {
-    run("systemctl", ["--user", "daemon-reload"]);
-    run("systemctl", ["--user", "enable", "--now", "coflux-ptyd.service"]);
-    run("systemctl", ["--user", "restart", "coflux-daemon.service"]);
+    runChecked("launchctl", ["load", PLIST], LAUNCHD_NEXT);
+  } else if (mode === "systemd") {
+    runChecked("systemctl", ["--user", "daemon-reload"], SYSTEMD_NEXT);
+    runChecked("systemctl", ["--user", "enable", "--now", "coflux-ptyd.service"], SYSTEMD_NEXT);
+    runChecked("systemctl", ["--user", "restart", "coflux-daemon.service"], SYSTEMD_NEXT);
+  } else {
+    const reply = await watchRequest("restart", 60_000);
+    if (reply?.ok) return;
+    if (reply) die(`The service could not restart: ${reply.error || "unknown reason"}`, "See what went wrong with cofluxd logs.");
+    await startSelfManaged(executor);
   }
 }
-/** 重启两者（ptyd 自身更新）：会结束本机全部终端。 */
-function restartAllServices() {
-  stopService();
-  if (IS_MAC) { run("launchctl", ["load", PTYD_PLIST]); run("launchctl", ["load", PLIST]); }
-  else if (IS_LINUX) { run("systemctl", ["--user", "start", "coflux-ptyd.service"]); run("systemctl", ["--user", "start", "coflux-daemon.service"]); }
-}
-/** 停止本机 daemon = supervisor + ptyd 一起停（终端结束）。 */
-function stopService() {
-  if (IS_MAC) { run("launchctl", ["unload", PLIST]); run("launchctl", ["unload", PTYD_PLIST]); }
-  else if (IS_LINUX) { run("systemctl", ["--user", "stop", "coflux-daemon.service"]); run("systemctl", ["--user", "stop", "coflux-ptyd.service"]); }
-}
 
-async function applyAndStart({ serverUrl, deviceName, shell, version, binDir, noStart }) {
-  await ensureBinaries({ version, binDir, skipIfPresent: true });
-  applyConfig({ serverUrl, deviceName, shell });
-  // 非默认服务器醒目提示：保存值/--server 仍生效（不强制覆盖），但防止 staging 之类残留值静默错连。
-  if (serverUrl !== DEFAULT_SERVER) {
-    console.log(`⚠ 使用非默认服务器: ${serverUrl}`);
+/** Restart both, ptyd included (a ptyd update): this ends every terminal on the device. */
+async function restartAllServices(mode, executor) {
+  if (mode === "self-managed") {
+    const status = await watchRequest("status");
+    if (status?.mode === "foreground") {
+      // `cofluxd run` owns its watcher; it restarts everything in place.
+      const reply = await watchRequest("restart-all", 120_000);
+      if (!reply?.ok) die(`The service could not restart: ${reply?.error || "no answer"}`, "See what went wrong with cofluxd logs.");
+      return;
+    }
+    await stopSelfManaged();
+    await startSelfManaged(executor);
+    return;
   }
-  installService(!noStart);
-  console.log(noStart ? "已安装（未启动）。" : `✓ daemon 已启动 → ${serverUrl}`);
-  if (!noStart && !fs.existsSync(CRED)) {
-    // 未登记 → 走浏览器授权，轮询 daemon 落盘的链接/凭证文件。
-    await waitForAuthorization();
-  } else {
-    cmdStatus();
+  stopService(mode);
+  if (mode === "launchd") {
+    runChecked("launchctl", ["load", PTYD_PLIST], LAUNCHD_NEXT);
+    runChecked("launchctl", ["load", PLIST], LAUNCHD_NEXT);
+  } else if (mode === "systemd") {
+    runChecked("systemctl", ["--user", "start", "coflux-ptyd.service"], SYSTEMD_NEXT);
+    runChecked("systemctl", ["--user", "start", "coflux-daemon.service"], SYSTEMD_NEXT);
   }
-  if (IS_MAC && !noStart && readFdaStatus() !== "granted") {
-    console.log("\n⚠ 完全磁盘访问权限尚未授予：PTY 里访问桌面/文稿/下载等目录时，系统弹窗可能因无人点击而卡住。");
-    console.log("  运行 `cofluxd fda` 完成一次性授权（授予后需重启服务生效）。");
+}
+
+/**
+ * Stop the launcher and ptyd together (terminals end). `strict` (down / uninstall) fails on a systemctl
+ * that could not stop the units; a unit that is not loaded (exit 5) is already stopped.
+ */
+function stopService(mode, { strict = false } = {}) {
+  if (mode === "launchd") {
+    run("launchctl", ["unload", PLIST]);
+    run("launchctl", ["unload", PTYD_PLIST]);
+  } else if (mode === "systemd") {
+    for (const unit of ["coflux-daemon.service", "coflux-ptyd.service"]) {
+      const result = run("systemctl", ["--user", "stop", unit]);
+      if (strict && result.status !== 0 && result.status !== 5) {
+        const detail = (result.stderr || "").trim().split("\n")[0] || (result.error ? result.error.message : `exit status ${result.status}`);
+        die(`systemctl --user stop ${unit} failed: ${detail}`, SYSTEMD_NEXT);
+      }
+    }
+  }
+}
+
+/* --------------------------- authorization and join --------------------------- */
+
+const ADD_DEVICE_NEXT = "Copy the full command from Add Device in Coflux.";
+
+/** `✓ Device "name" connected to host`. */
+function deviceConnected(deviceName, serverUrl) {
+  success(`Device "${deviceName}" connected to ${serverHost(serverUrl)}`);
+}
+
+/** Minutes until a pending link expires, or null. */
+function minutesLeft(pending) {
+  return Number.isFinite(pending?.expiresAt) ? Math.max(1, Math.round((pending.expiresAt - Date.now()) / 60000)) : null;
+}
+
+function printAuthorizationLink(pending) {
+  const mins = minutesLeft(pending);
+  info("");
+  info("To add this device to your account, open:");
+  info("");
+  info(`    ${bold(pending.url)}`);
+  info("");
+  info(`Waiting for authorization...${mins ? ` (expires in ${mins}m)` : ""}`);
+}
+
+// Poll pending-auth.json (the link) and credentials.json (registered). The CLI never speaks the
+// protocol: it only reads files; the service renews an expired link on its own.
+async function waitForAuthorization({ deviceName, serverUrl }) {
+  const maxWaitMs = 11 * 60 * 1000; // only how long we wait in the foreground; the service keeps going
+  const start = Date.now();
+  let printedUrl = null;
+  let warned = false;
+  while (Date.now() - start < maxWaitMs) {
+    if (fs.existsSync(CRED)) {
+      deviceConnected(deviceName, serverUrl);
+      return;
+    }
+    const pending = readPendingAuth();
+    if (pending?.url && pending.url !== printedUrl) {
+      printedUrl = pending.url;
+      printAuthorizationLink(pending);
+    }
+    if (!printedUrl && !warned && Date.now() - start > 20_000) {
+      warned = true;
+      warn(`The device has not reached ${serverHost(serverUrl)} yet.`, "It keeps trying. Check it with cofluxd status, or see cofluxd logs.");
+    }
+    await sleep(1000);
   }
+  // Links expire and are renewed: never point at "the link above", it may be dead by now.
+  info("");
+  info("Still waiting. The service keeps running and renews the link; run cofluxd status to see the current one.");
 }
 
 /**
  * `cofluxd up --key` (plan 20260924-device-join-keys): join the account with a one-time key minted in
- * Coflux's 添加设备 dialog. Never prints a link and never enters the 11-minute link wait.
+ * Coflux's Add Device dialog. Never prints a link and never enters the 11-minute link wait.
  *
- * Order matters: stop the service before the key file exists, so a worker still running from the link
- * era can never pick it up in a renewal and then be killed mid-answer; starting the stopped unit again
- * (`enable --now` on Linux, unload/load on macOS) is the restart that makes the new worker read it.
- * The CLI still never speaks the protocol: it learns the result only from `credentials.json` and the
- * outcome file the worker writes.
+ * Order matters: stop the service before the key file exists, so a runtime still running from the
+ * link era can never pick it up in a renewal and then be killed mid-answer; starting it again is the
+ * restart that makes the new runtime read it. The CLI learns the result only from
+ * `credentials.json` and the outcome file the runtime writes.
  */
-async function joinWithKey({ serverUrl, deviceName, shell, version, binDir, key }) {
-  await ensureBinaries({ version, binDir, skipIfPresent: true });
-  applyConfig({ serverUrl, deviceName, shell });
-  if (serverUrl !== DEFAULT_SERVER) console.log(`⚠ 使用非默认服务器: ${serverUrl}`);
-  stopService();
-  // The worker clears pending-auth.json only at connection end, not on SIGTERM: a stale one would
-  // read as "daemon too old for keys" below.
+async function joinWithKey({ mode, serverUrl, deviceName, key, executor }) {
+  if (mode === "self-managed") {
+    requireWatchSupport();
+    await stopSelfManaged();
+  } else {
+    stopService(mode);
+  }
+  // The runtime clears pending-auth.json only at connection end, not on SIGTERM: a stale one would
+  // read as "too old for keys" below.
   for (const file of [JOIN_OUTCOME, PENDING_AUTH]) { try { fs.rmSync(file, { force: true }); } catch { /* */ } }
   fs.writeFileSync(JOIN_KEY, JSON.stringify({ key }) + "\n", { mode: 0o600 });
   fs.chmodSync(JOIN_KEY, 0o600);
-  installService(true);
-  console.log(`✓ daemon 已启动 → ${serverUrl}`);
-  console.log("\n  正在用接入密钥接入账号 …\n");
+  await startService(mode, executor);
+  const joining = step("Joining your account");
   const maxWaitMs = 2 * 60 * 1000;
   const start = Date.now();
   while (Date.now() - start < maxWaitMs) {
     const outcome = readJoinOutcome();
     if (fs.existsSync(CRED) || outcome?.status === "joined") {
-      console.log("✓ 已接入\n");
-      cmdStatus();
+      joining.done();
+      deviceConnected(deviceName, serverUrl);
       return;
     }
     if (outcome?.status === "rejected") {
-      die(`接入失败：${outcome.reason || "密钥无效、已过期或已被使用"}\n  在 Coflux 的添加设备里换一个密钥，再重新运行这条命令。`);
+      joining.failed();
+      die(`The join key was rejected: ${outcome.reason || "it is invalid, expired or already used"}`, "Copy a new command from Add Device in Coflux and run it.");
     }
     if (outcome?.status === "unsupported") {
-      die("服务器还不支持接入密钥（需要更新服务器）。");
+      joining.failed();
+      die("This server does not support join keys yet.", "Update the server, or run cofluxd up without --key to authorize in the browser.");
     }
     if (fs.existsSync(JOIN_KEY) && fs.existsSync(PENDING_AUTH)) {
-      // The daemon enrolled without reading the key: its binary predates join keys (up keeps existing
-      // binaries). Drop the key so a later worker never presents it behind the user's back.
+      // The service enrolled without reading the key: its binary predates join keys (up keeps existing
+      // binaries). Drop the key so a later runtime never presents it behind the user's back.
       try { fs.rmSync(JOIN_KEY, { force: true }); } catch { /* */ }
-      die("已安装的 daemon 版本过旧，不认识接入密钥：先运行 `cofluxd update`，再在 Coflux 的添加设备里换一个密钥重新运行这条命令。");
+      joining.failed();
+      die("The installed Coflux is too old for join keys.", "Run cofluxd update, then copy a new command from Add Device in Coflux.");
     }
     await sleep(500);
   }
-  die("等待接入超时：daemon 仍在后台尝试连接服务器。用 `cofluxd status` 查看状态，`cofluxd logs` 查看原因。");
+  joining.failed();
+  die("Timed out waiting to join your account.", "The service keeps trying. Check it with cofluxd status, and see cofluxd logs for the reason.");
 }
 
-// 轮询 ~/.coflux/pending-auth.json（授权链接）与 credentials.json（登记成功）给出全程反馈。
-// CLI 保持零协议：只读文件，不连 WS；daemon 断线重连会自动重发 enrollRequest、换发新链接。
-async function waitForAuthorization() {
-  console.log("\n  等待设备授权 …\n");
-  const maxWaitMs = 11 * 60 * 1000; // 只是前台等待的上限；daemon 会持续自动续期授权链接，超时后用 status 看最新链接即可
-  const start = Date.now();
-  let printedUrl = null;
-  while (Date.now() - start < maxWaitMs) {
-    if (fs.existsSync(CRED)) {
-      console.log("✓ 设备已登记\n");
-      cmdStatus();
-      return;
-    }
-    const pending = readPendingAuth();
-    if (pending?.url && pending.url !== printedUrl) {
-      printedUrl = pending.url;
-      const mins = Number.isFinite(pending.expiresAt) ? Math.max(1, Math.round((pending.expiresAt - Date.now()) / 60000)) : null;
-      console.log(`  在浏览器打开以下链接，用已登录账号授权此设备${mins ? `（约 ${mins} 分钟内有效）` : ""}：\n`);
-      console.log(`    ${pending.url}\n`);
+/* ------------------------------ commands ------------------------------ */
+
+/** The backend `up` installs: launchd, systemd when it is booted, otherwise self-managed. */
+async function upMode() {
+  if (IS_MAC) {
+    return (await watchRequest("status")) ? "self-managed" : "launchd";
+  }
+  if (!IS_LINUX) die("Coflux runs only on macOS and Linux.", "Use a macOS or Linux machine.");
+  if (await watchRequest("status")) return "self-managed";
+  if (systemdBooted()) {
+    clearServiceMode();
+    return "systemd";
+  }
+  return "self-managed";
+}
+
+/** Start (or, for a running self-managed service, restart) the service. */
+async function startService(mode, executor) {
+  if (mode === "self-managed") {
+    writeServiceMode();
+    if (await watchRequest("status")) {
+      await restartService(mode, executor);
+    } else {
+      await startSelfManaged(executor);
     }
-    await sleep(1000);
+  } else {
+    installService(mode, true, executor);
+  }
+  success("Service started");
+  if (mode === "self-managed") {
+    warn("This service does not start on boot.", "In a container, use cofluxd run as the entry point instead.");
   }
-  // 链接会过期换新（daemon 自动续期），别引导用户用"上面的链接"——过期后那是死链
-  console.log("  仍未完成授权；daemon 已在后台运行并会自动更换过期的授权链接，用 `cofluxd status` 查看最新链接。\n");
 }
 
-/* ------------------------------ 命令 ------------------------------ */
+function validateKey(raw) {
+  const key = raw.trim();
+  if (!/^cf_join_[A-Za-z0-9_-]+$/.test(key)) die("Invalid join key.", ADD_DEVICE_NEXT);
+  return key;
+}
 
-async function cmdUp(v) {
+/** Settings for up / run: flags first, then the saved settings, then defaults. */
+function resolveSettings(v) {
   const s = readSettings();
+  return {
+    serverUrl: v.server || s.serverUrl || DEFAULT_SERVER,
+    deviceName: v.name || s.deviceName || hostname(),
+    shell: v.shell || s.shell,
+  };
+}
+
+function noticeServer(serverUrl) {
+  // A saved non-default server stays in effect; say so, so a leftover staging URL cannot connect silently.
+  if (serverUrl !== DEFAULT_SERVER) warn(`Using the server ${serverUrl}`);
+}
+
+async function cmdUp(v) {
+  const settings = resolveSettings(v);
+  let key;
   if (v.key !== undefined) {
-    const key = v.key.trim();
-    if (!/^cf_join_[A-Za-z0-9_-]+$/.test(key)) die("--key 不是接入密钥：请完整复制 Coflux 添加设备里的命令（密钥以 cf_join_ 开头）");
-    if (v["no-start"]) die("--key 不能与 --no-start 同用：密钥只在启动时使用一次");
+    key = validateKey(v.key);
+    if (v["no-start"]) die("--key cannot be used with --no-start.", "The key is used once, when the service starts. Drop --no-start.");
     if (fs.existsSync(CRED)) {
       // Already registered: a key would never be presented, so change nothing at all.
       const c = readCredentialsSummary();
-      console.log(`✓ 此设备已接入 ${c.serverUrl || s.serverUrl || "(未知服务器)"}${c.daemonId ? `（设备 ${c.daemonId}）` : ""}，忽略 --key，未做任何改动。`);
+      success(`This device is already in your account on ${serverHost(c.serverUrl || settings.serverUrl)}. Nothing was changed.`);
       return;
     }
-    await joinWithKey({
-      serverUrl: v.server || s.serverUrl || DEFAULT_SERVER,
-      deviceName: v.name || s.deviceName || hostname(),
-      shell: v.shell || s.shell,
-      version: v.version, binDir: v["bin-dir"], key,
-    });
+  }
+  await ensureBinaries({ version: v.version, binDir: v["bin-dir"], skipIfPresent: true });
+  applyConfig(settings);
+  noticeServer(settings.serverUrl);
+  const mode = await upMode();
+  const executor = executorUnitRuntime();
+  if (key) {
+    await joinWithKey({ mode, ...settings, key, executor });
     return;
   }
-  await applyAndStart({
-    serverUrl: v.server || s.serverUrl || DEFAULT_SERVER,
-    deviceName: v.name || s.deviceName || hostname(),
-    shell: v.shell || s.shell,
-    version: v.version, binDir: v["bin-dir"], noStart: v["no-start"],
+  if (v["no-start"]) {
+    if (mode === "self-managed") writeServiceMode();
+    else installService(mode, false, executor);
+    success("Installed without starting. Start it with cofluxd up.");
+    return;
+  }
+  await startService(mode, executor);
+  if (!fs.existsSync(CRED)) {
+    await waitForAuthorization(settings);
+  } else {
+    info("");
+    await cmdStatus();
+  }
+  if (IS_MAC && readFdaStatus() !== "granted") {
+    warn("Full Disk Access is not granted. Terminals can hang on macOS permission prompts.", "Run cofluxd fda to grant it.");
+  }
+}
+
+/**
+ * `cofluxd run`: the self-managed service in the foreground, for containers and other supervisors.
+ * Node only forwards signals and mirrors the exit code; `coflux-launcher watch --foreground` does
+ * the supervising. Logs go to stdout/stderr. A rejected join key is reported and the service keeps
+ * running, so a restart policy cannot loop on a spent key.
+ */
+async function cmdRun(v) {
+  if (!IS_LINUX && !IS_MAC) die("Coflux runs only on macOS and Linux.", "Use a macOS or Linux machine.");
+  if (v["no-start"]) die("--no-start does not apply to cofluxd run.", "Use cofluxd up --no-start to install without starting.");
+  const settings = resolveSettings(v);
+  const key = v.key !== undefined ? validateKey(v.key) : undefined;
+  // Two launchers for one home would fight over launcher.sock: refuse while anything else owns it.
+  const otherOwner = (await watchRequest("status"))
+    || (IS_MAC && serviceRunningInfo("launchd").running)
+    || (IS_LINUX && systemdBooted() && serviceRunningInfo("systemd").running);
+  if (otherOwner) die("Coflux is already running on this device.", "Stop it first with cofluxd down, then run cofluxd run again.");
+  await ensureBinaries({ version: v.version, binDir: v["bin-dir"], skipIfPresent: true });
+  requireWatchSupport();
+  applyConfig(settings);
+  noticeServer(settings.serverUrl);
+  if (key) {
+    if (fs.existsSync(CRED)) {
+      success("This device is already in your account. The join key was not used.");
+    } else {
+      for (const file of [JOIN_OUTCOME, PENDING_AUTH]) { try { fs.rmSync(file, { force: true }); } catch { /* */ } }
+      fs.writeFileSync(JOIN_KEY, JSON.stringify({ key }) + "\n", { mode: 0o600 });
+      fs.chmodSync(JOIN_KEY, 0o600);
+    }
+  }
+  const executor = executorRuntime();
+  const child = spawn(LAUNCHER_BIN, ["watch", "--foreground"], {
+    stdio: ["ignore", "inherit", "inherit"],
+    env: watcherEnv(process.env, { home: HOME, executor }),
+  });
+  for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+    process.on(signal, () => { try { child.kill(signal); } catch { /* */ } });
+  }
+
+  // Report the authorization link, the join outcome and the first connection in the same output.
+  let printedUrl = null;
+  let reportedJoin = false;
+  let connected = fs.existsSync(CRED);
+  const monitor = setInterval(() => {
+    if (!connected && fs.existsSync(CRED)) {
+      connected = true;
+      deviceConnected(settings.deviceName, settings.serverUrl);
+      return;
+    }
+    if (connected) return;
+    const outcome = readJoinOutcome();
+    if (!reportedJoin && outcome?.status === "rejected") {
+      reportedJoin = true;
+      printError(`The join key was rejected: ${outcome.reason || "it is invalid, expired or already used"}`, "Copy a new command from Add Device in Coflux. The service keeps running.");
+    } else if (!reportedJoin && outcome?.status === "unsupported") {
+      reportedJoin = true;
+      printError("This server does not support join keys yet.", "Update the server, or authorize this device with the link printed below.");
+    }
+    const pending = readPendingAuth();
+    if (pending?.url && pending.url !== printedUrl) {
+      printedUrl = pending.url;
+      printAuthorizationLink(pending);
+    }
+  }, 1000);
+
+  child.once("error", (error) => {
+    clearInterval(monitor);
+    die(`Could not start the service: ${error.message}`, "Run cofluxd update, then try again.");
+  });
+  child.once("exit", (code, signal) => {
+    clearInterval(monitor);
+    if (code === WATCH_EXIT_REFUSED) {
+      printError("Coflux is already running on this device under another service.", "Stop it first with cofluxd down. If the Coflux app runs on this machine, quit it.");
+    } else if (code !== 0) {
+      printError("The service stopped.", "See the output above for the reason. Terminals that were open are closed.");
+    }
+    process.exit(code ?? (signal ? 1 : 0));
   });
 }
 
-function cmdDown() { stopService(); console.log("✓ 已停止"); }
+async function cmdDown() {
+  const mode = (await watchRequest("status")) ? "self-managed" : serviceMode();
+  const stopping = step("Stopping the service");
+  if (mode === "self-managed") await stopSelfManaged();
+  else stopService(mode, { strict: true });
+  stopping.done();
+}
 
-// 只有 supervisor 真正靠这条命令更新——它不自动升级（持 PTY，重启会杀会话，见 plan 017）。
-// worker 运行中会被 server 自动热升级到最新 stable（无需停服）；这里顺带刷新的是 worker 的
-// "内置兜底二进制"（supervisor 冷启动/热升级缓存皆无时的 fallback），日常可不管。
+// Only the launcher, ptyd and the coflux command need this (plan 20261002-runtime-launcher-merge): the
+// server updates the runtime itself. The runtime refreshed here is the fallback the launcher runs
+// when its store holds nothing better.
 //
-// update 与 restart 拆开（2026-07-25 用户拍板）：update 只落盘二进制、绝不重启——替换磁盘
-// 文件对运行中的 supervisor/PTY 零影响；supervisor 内容没变就明说不用重启（大多数发版
-// 都不动 supervisor，旧行为等于白丢一次全部会话）。真正的中断收敛到显式的 `cofluxd restart`。
+// update never restarts (decided 2026-07-25): replacing files on disk does not affect running
+// processes. Interruptions happen only on an explicit `cofluxd restart` (terminals stay) or
+// `cofluxd restart --ptyd` (terminals end).
 async function cmdUpdate(v) {
-  if (!fs.existsSync(SETTINGS)) die("尚未安装，先 cofluxd up");
+  if (!fs.existsSync(SETTINGS)) die("Coflux is not installed on this device.", "Run cofluxd up first.");
   const version = v.version || "latest";
-  const before = fileSha256(SUP_BIN);
-  const ptydBefore = fileSha256(PTYD_BIN);
-  await ensureBinaries({ version, binDir: v["bin-dir"] });
-  const supervisorChanged = before !== fileSha256(SUP_BIN);
-  const ptydChanged = ptydBefore !== fileSha256(PTYD_BIN);
-  if (!supervisorChanged && !ptydChanged) {
-    console.log("✓ 已更新：supervisor / ptyd 无变化——不需要重启，活会话不受影响");
-    console.log("  worker 由 server 自动热升级；本次刷新的只是兜底 worker 二进制。");
+  const before = {
+    launcher: fileSha256(LAUNCHER_BIN),
+    ptyd: fileSha256(PTYD_BIN),
+    runtime: fileSha256(RUNTIME_BIN),
+    cli: fileSha256(CLI_BIN),
+  };
+  const installed = await ensureBinaries({ version, binDir: v["bin-dir"] });
+  const label = installed === "local build" ? "the local build" : displayVersion(installed);
+  const launcherChanged = before.launcher !== fileSha256(LAUNCHER_BIN);
+  const ptydChanged = before.ptyd !== fileSha256(PTYD_BIN);
+  const runtimeChanged = before.runtime !== fileSha256(RUNTIME_BIN);
+  const cliChanged = before.cli !== fileSha256(CLI_BIN);
+  if (!launcherChanged && !ptydChanged && !runtimeChanged && !cliChanged) {
+    success(`Already up to date (${label})`);
     return;
   }
-  if (supervisorChanged) {
-    console.log(`✓ 新 supervisor 已就位（${v["bin-dir"] ? "本地产物" : version}），但尚未生效`);
-    console.log("  运行 `cofluxd restart` 应用——终端留在 ptyd 里，屏幕与回滚原样保留，只有几秒停顿。");
-  }
+  success(`Updated to ${label}`);
+  if (launcherChanged) info("Run cofluxd restart to apply it. Terminals stay open.");
   if (ptydChanged) {
-    console.log(`✓ 新 ptyd（终端托管进程）已就位${ptydBefore ? "" : "（首次安装）"}，但尚未生效`);
-    console.log("  ⚠ 运行 `cofluxd restart --ptyd` 应用——ptyd 自身更新无法保留终端，会结束本机所有活会话。");
+    warn("Part of this update takes effect only after a full restart, which closes all terminals.", "Run cofluxd restart --ptyd when that is convenient.");
   }
+  if (!launcherChanged && !ptydChanged) info("No restart needed.");
 }
 
-// 应用已就位的新 supervisor（或单纯重启 supervisor）：终端留在 ptyd 里不动。
-// `--ptyd`：连 ptyd 一起重启（ptyd 自身更新时才需要）——这才是会结束本机会话的那条命令。
-function cmdRestart(v) {
-  if (!fs.existsSync(SETTINGS)) die("尚未安装，先 cofluxd up");
-  // 服务文件与模板同步（首次升到带 ptyd 的版本时 ptyd 的 plist / unit 还不存在）；只写文件，不在这里启动。
-  installService(false);
+// Apply a new launcher (or just restart the service): the terminals stay in ptyd. `--ptyd` restarts
+// ptyd as well (only a ptyd update needs it), and that ends every terminal on the device.
+async function cmdRestart(v) {
+  if (!fs.existsSync(SETTINGS)) die("Coflux is not installed on this device.", "Run cofluxd up first.");
+  const mode = (await watchRequest("status")) ? "self-managed" : serviceMode();
+  const executor = executorRuntime();
+  // Keep the unit files in step with the templates (the first restart after an upgrade may still find
+  // units from an older layout); written only, started below.
+  if (mode !== "self-managed") installService(mode, false, executor);
   if (v.ptyd) {
-    console.log("⚠ 正在重启 ptyd 与 supervisor：本机所有活会话将结束…");
-    restartAllServices();
+    warn("This closes all terminals on this device.");
+    const restarting = step("Restarting the service and its terminals");
+    await restartAllServices(mode, executor);
+    restarting.done();
   } else {
-    console.log("正在重启 supervisor：本机终端留在 ptyd 里，屏幕与回滚原样保留…");
-    restartService();
+    const restarting = step("Restarting the service");
+    await restartService(mode, executor);
+    restarting.done();
+    info("Terminals stayed open.");
   }
-  console.log("✓ 已重启（cofluxd status 查看状态）");
 }
 
-/** 隐藏命令：把四份服务文件（launchd × 2、systemd × 2）以 JSON 打到 stdout，供黑盒断言与运维核对。 */
+/** Hidden: the four service files (launchd x 2, systemd x 2) as JSON on stdout. */
 function cmdServiceFiles() {
   console.log(JSON.stringify(serviceFiles(), null, 2));
 }
 
-// launchd(macOS) / systemd --user(Linux) 服务活跃态查询，status 与 doctor 共用。
-// macOS 必须以 launchctl list 输出里的 PID 为准：label 登记 ≠ 进程存活（supervisor 被
-// OS_REASON_CODESIGNING 杀掉时 label 仍在，旧实现会报假"运行中"，2026-07-25 实测踩过）。
-function serviceRunningInfo() {
-  if (IS_MAC) {
+// launchd / systemd service state, shared by status and doctor. On macOS only the PID in
+// `launchctl list` counts: a registered label is not a live process (a launcher killed with
+// OS_REASON_CODESIGNING keeps its label; observed 2026-07-25).
+function serviceRunningInfo(mode) {
+  if (mode === "launchd") {
     const out = run("launchctl", ["list", "com.coflux.daemon"]);
     const registered = out.status === 0;
     const running = registered && /"PID"\s*=\s*\d+/.test(out.stdout || "");
-    return { running, active: running ? "运行中" : registered ? "已登记但进程不在（看 cofluxd logs；常见于系统拒签杀进程）" : "未运行" };
+    return { running, label: running ? "running" : registered ? "not running (see cofluxd logs)" : "stopped" };
   }
-  if (IS_LINUX) {
-    const active = (run("systemctl", ["--user", "is-active", "coflux-daemon.service"]).stdout || "").trim() || "未运行";
-    return { running: active === "active", active };
+  if (mode === "systemd") {
+    const active = (run("systemctl", ["--user", "is-active", "coflux-daemon.service"]).stdout || "").trim();
+    const label = active === "active" ? "running"
+      : active === "activating" || active === "reloading" ? "starting"
+        : active === "failed" ? "failed (see cofluxd logs)"
+          : "stopped";
+    return { running: active === "active", label };
+  }
+  return { running: false, label: "stopped" };
+}
+
+/** The service state under whichever backend runs it, plus the terminal count when known. */
+async function serviceState() {
+  const watcher = await watchRequest("status");
+  if (watcher?.ok) {
+    const launcherUp = !!watcher.launcher?.running;
+    const label = !launcherUp ? "starting"
+      : watcher.mode === "foreground" ? "running (cofluxd run, no autostart)" : "running (self-managed, no autostart)";
+    return { running: launcherUp, label, terminals: Number.isInteger(watcher.terminals) ? watcher.terminals : undefined };
   }
-  return { running: false, active: "未运行" };
+  const mode = serviceMode();
+  if (mode === "self-managed") return { running: false, label: "stopped" };
+  return serviceRunningInfo(mode);
 }
 
-function cmdStatus() {
+const CONNECTION_LABEL = { connecting: "connecting", connected: "connected", reconnecting: "reconnecting" };
+
+async function cmdStatus() {
   const s = readSettings();
-  console.log(`服务器: ${s.serverUrl || "(未配置)"}`);
-  console.log(`设备名: ${s.deviceName || "(默认)"}`);
+  const { running, label, terminals } = await serviceState();
   const registered = fs.existsSync(CRED);
-  const pending = !registered ? readPendingAuth() : null;
+  let connection;
   if (registered) {
-    console.log("凭证:   已登记");
-  } else if (pending?.url) {
-    const mins = Number.isFinite(pending.expiresAt) ? Math.max(0, Math.round((pending.expiresAt - Date.now()) / 60000)) : null;
-    console.log(`凭证:   等待授权${mins !== null ? `（约 ${mins} 分钟内有效）` : ""}`);
-    console.log(`        ${pending.url}`);
+    // conn-state.json is a snapshot the runtime wrote while alive: with the service down it is stale and
+    // must not read as online.
+    if (running) {
+      const conn = readConnState();
+      const state = CONNECTION_LABEL[conn?.state];
+      if (state) {
+        connection = state === "connected" && Number.isFinite(conn.since) ? `connected for ${duration(Date.now() - conn.since)}` : state;
+      } else {
+        connection = "unknown";
+      }
+    } else {
+      connection = "offline";
+    }
   } else {
-    console.log("凭证:   未登记");
-  }
-  const { running, active } = serviceRunningInfo();
-  let pid = "";
-  if (running) {
-    try { pid = ` (worker pid ${fs.readFileSync(join(HOME, "worker.pid"), "utf8").trim()})`; } catch { /* */ }
-  }
-  console.log(`服务:   ${active}${pid}`);
-  // conn-state.json 是 worker 生前写的快照：进程不在时是 stale 数据，忽略——不能让"进程活着"
-  // 误当成"在线"，也不能让 stale 文件在进程死后继续显示假的连接态。
-  if (running) {
-    const conn = readConnState();
-    if (conn?.state && CONN_STATE_LABEL[conn.state]) {
-      const dur = Number.isFinite(conn.since) ? formatDuration(Date.now() - conn.since) : null;
-      console.log(`连接:   ${CONN_STATE_LABEL[conn.state]}${dur ? `（已 ${dur}）` : ""}`);
+    const pending = readPendingAuth();
+    if (pending?.url) {
+      const mins = Number.isFinite(pending.expiresAt) ? Math.max(0, Math.round((pending.expiresAt - Date.now()) / 60000)) : null;
+      connection = `waiting for authorization${mins !== null ? ` (expires in ${mins}m)` : ""}\n${pending.url}`;
+    } else {
+      connection = "not added to an account yet";
     }
   }
+  const rows = [
+    ["Device", s.deviceName || hostname()],
+    ["Server", s.serverUrl ? serverHost(s.serverUrl) : "not configured"],
+    ["Service", label],
+    ["Connection", connection],
+    ["Terminals", terminals === undefined ? undefined : `${terminals} open`],
+  ];
   if (IS_MAC) {
     const fda = readFdaStatus();
-    const hint = fda === "granted" ? "" : "（`cofluxd fda` 引导授权，避免弹窗卡住 PTY 会话）";
-    console.log(`FDA:    ${fdaLabel(fda)}${hint}`);
+    rows.push(["Disk access", fda === "granted" ? "granted" : fda === "denied" ? "not granted; run cofluxd fda" : "unknown; run cofluxd fda"]);
   }
+  table(rows);
 }
 
-/* ------------------------------ doctor：中心 + 本地直连分层自检 ------------------------------ */
-// 中心与 loopback 都只做传输层探测，不解析 coflux 协议消息——CLI 保持零协议。中心 WS
-// 成功升级后立即断开；loopback 只验证已持久 Origin 能拿到 101，不发送 browser 私钥或 grant。
+/* ------------------------------ doctor ------------------------------ */
+// Transport-level probes only: no coflux protocol message is parsed, so the CLI stays protocol-free.
+// The server WebSocket is closed right after the upgrade; the loopback probe only checks that a stored
+// Origin gets a 101 and never sends a browser key or grant.
 const DOCTOR_TIMEOUT_MS = 5000;
 
 function parseServerUrl(serverUrl) {
   const u = new URL(serverUrl);
   const useTls = u.protocol === "wss:";
-  if (!useTls && u.protocol !== "ws:") throw new Error(`不支持的协议: ${u.protocol}（需 ws:// 或 wss://）`);
+  if (!useTls && u.protocol !== "ws:") throw new Error(`unsupported scheme ${u.protocol}; use ws:// or wss://`);
   const port = u.port ? Number(u.port) : (useTls ? 443 : 80);
   const path = u.pathname || "/";
   return { host: u.hostname, port, path, useTls };
@@ -777,7 +1204,7 @@ function probeTcp(host, port) {
     const socket = net.connect({ host, port, timeout: DOCTOR_TIMEOUT_MS });
     const done = (ok, extra) => { socket.destroy(); resolve({ ok, ms: Date.now() - t0, ...extra }); };
     socket.once("connect", () => done(true, {}));
-    socket.once("timeout", () => done(false, { error: `连接超时（>${DOCTOR_TIMEOUT_MS}ms）` }));
+    socket.once("timeout", () => done(false, { error: `timed out after ${DOCTOR_TIMEOUT_MS}ms` }));
     socket.once("error", (e) => done(false, { error: e.message }));
   });
 }
@@ -786,16 +1213,16 @@ function probeTls(host, port) {
   return new Promise((resolve) => {
     const t0 = Date.now();
     const socket = tls.connect({ host, port, servername: host, timeout: DOCTOR_TIMEOUT_MS }, () => {
-      const detail = socket.authorized ? socket.getProtocol() : `${socket.getProtocol()}（证书未验证: ${socket.authorizationError}）`;
+      const detail = socket.authorized ? socket.getProtocol() : `${socket.getProtocol()}, certificate not verified: ${socket.authorizationError}`;
       socket.destroy();
       resolve({ ok: true, ms: Date.now() - t0, detail });
     });
-    socket.once("timeout", () => { socket.destroy(); resolve({ ok: false, ms: Date.now() - t0, error: `握手超时（>${DOCTOR_TIMEOUT_MS}ms）` }); });
+    socket.once("timeout", () => { socket.destroy(); resolve({ ok: false, ms: Date.now() - t0, error: `handshake timed out after ${DOCTOR_TIMEOUT_MS}ms` }); });
     socket.once("error", (e) => resolve({ ok: false, ms: Date.now() - t0, error: e.message }));
   });
 }
 
-// 手写一条最小 HTTP/1.1 Upgrade 请求，只看是否拿到 101——不建立真实 WebSocket 帧连接。
+// One minimal HTTP/1.1 Upgrade request; only whether a 101 comes back matters. No WebSocket frames.
 function probeWsUpgrade({ host, port, path, useTls, origin }) {
   return new Promise((resolve) => {
     const t0 = Date.now();
@@ -811,7 +1238,7 @@ function probeWsUpgrade({ host, port, path, useTls, origin }) {
     };
     const onOpen = (socket) => {
       let buf = "";
-      const timer = setTimeout(() => { socket.destroy(); finish({ ok: false, error: `升级响应超时（>${DOCTOR_TIMEOUT_MS}ms）` }); }, DOCTOR_TIMEOUT_MS);
+      const timer = setTimeout(() => { socket.destroy(); finish({ ok: false, error: `no upgrade response after ${DOCTOR_TIMEOUT_MS}ms` }); }, DOCTOR_TIMEOUT_MS);
       socket.on("data", (chunk) => {
         buf += chunk.toString("latin1");
         if (!buf.includes("\r\n\r\n")) return;
@@ -819,7 +1246,7 @@ function probeWsUpgrade({ host, port, path, useTls, origin }) {
         const statusLine = buf.split("\r\n")[0];
         socket.destroy();
         const ok = /^HTTP\/1\.\d 101\b/.test(statusLine);
-        finish(ok ? { ok, detail: statusLine } : { ok, error: `未收到 101 切换协议响应: ${statusLine}` });
+        finish(ok ? { ok, detail: statusLine } : { ok, error: `expected 101 Switching Protocols, got: ${statusLine}` });
       });
       socket.once("error", (e) => { clearTimeout(timer); finish({ ok: false, error: e.message }); });
       socket.write(req);
@@ -828,83 +1255,41 @@ function probeWsUpgrade({ host, port, path, useTls, origin }) {
       ? tls.connect({ host, port, servername: host, timeout: DOCTOR_TIMEOUT_MS })
       : net.connect({ host, port, timeout: DOCTOR_TIMEOUT_MS });
     socket.once(useTls ? "secureConnect" : "connect", () => onOpen(socket));
-    socket.once("timeout", () => { socket.destroy(); finish({ ok: false, error: `连接超时（>${DOCTOR_TIMEOUT_MS}ms）` }); });
+    socket.once("timeout", () => { socket.destroy(); finish({ ok: false, error: `timed out after ${DOCTOR_TIMEOUT_MS}ms` }); });
     socket.once("error", (e) => finish({ ok: false, error: e.message }));
   });
 }
 
-function printLayer(name, r) {
-  const mark = r.ok ? "✓" : "✗";
-  const msg = r.ok ? (r.detail ? `→ ${r.detail}` : "") : (r.error || "");
-  console.log(`  ${mark} ${name} (${r.ms}ms)${msg ? `  ${msg}` : ""}`);
-}
-
-function printLocalLayer(name, r) {
-  const mark = r.ok ? "✓" : "⚠";
-  const msg = r.ok ? (r.detail ? `→ ${r.detail}` : "") : (r.error || "");
-  const elapsed = Number.isFinite(r.ms) ? ` (${r.ms}ms)` : "";
-  console.log(`  ${mark} ${name}${elapsed}${msg ? `  ${msg}` : ""}`);
-}
-
-// 本地事实汇总：服务进程存活、conn-state.json 连接态、凭证有无、FDA。返回连接态三态：
-// "connected" | "not-connected"（有快照但非 connected，如 connecting/reconnecting）
-// | "unknown"（服务未运行，或无快照——daemon 版本较旧还没写、或刚启动）。
-// 三态区分是因为"无快照"不等于"未连接"：旧版 worker 不写 conn-state.json，把它当"未连接"
-// 会把"连接态未知"误报成"认证/授权层有问题"（2026-07-23 实操验收发现）。
-function printLocalFacts() {
-  console.log("\n  Daemon 状态\n  ───────────");
-  const registered = fs.existsSync(CRED);
-  console.log(`  凭证:   ${registered ? "已登记" : "未登记"}`);
-  const { running, active } = serviceRunningInfo();
-  console.log(`  服务:   ${active}`);
-  let connState = "unknown";
-  if (running) {
-    const conn = readConnState();
-    if (conn?.state && CONN_STATE_LABEL[conn.state]) {
-      console.log(`  中心:   ${CONN_STATE_LABEL[conn.state]}`);
-      connState = conn.state === "connected" ? "connected" : "not-connected";
-    } else {
-      console.log("  中心:   (无连接态快照)");
-    }
-  } else {
-    console.log("  中心:   未探测（服务未运行）");
-  }
-  if (IS_MAC) console.log(`  FDA:    ${fdaLabel(readFdaStatus())}`);
-  console.log("");
-  return { registered, running, connState };
-}
-
-function printConclusion(level, msg) {
-  const mark = level === "ok" ? "✓" : level === "warning" ? "⚠" : "✗";
-  console.log(`  ${mark} ${msg}\n`);
+/** One probe row: `  ✓ Name        12ms  detail`. `soft` failures are warnings, not errors. */
+function printProbe(name, r, { soft = false } = {}) {
+  const mark = r.ok ? "✓" : soft ? "!" : "✗";
+  const elapsed = Number.isFinite(r.ms) ? `${r.ms}ms` : "";
+  const msg = r.ok ? (r.detail || "") : (r.error || "");
+  info(`  ${mark} ${name.padEnd(28)} ${elapsed.padStart(6)}  ${msg}`.trimEnd());
 }
 
-async function probeCenter(target) {
+async function probeServer(target) {
   const { host, port, useTls } = target;
   const dnsR = await probeDns(host);
-  printLayer("DNS 解析", dnsR);
-  if (!dnsR.ok) {
-    return { ok: false, reason: "DNS 解析失败——检查网络连接/DNS 配置，或该域名是否可达。" };
-  }
+  printProbe("DNS lookup", dnsR);
+  if (!dnsR.ok) return { ok: false, reason: "DNS lookup failed.", next: "Check your network and DNS settings." };
 
   const tcpR = await probeTcp(host, port);
-  printLayer(`TCP 连接 (${host}:${port})`, tcpR);
-  if (!tcpR.ok) {
-    return { ok: false, reason: "DNS 可解析但 TCP 连不上——防火墙/代理拦截，或目标端口未开放。" };
-  }
+  printProbe(`TCP connection (${host}:${port})`, tcpR);
+  if (!tcpR.ok) return { ok: false, reason: "DNS works, but the TCP connection failed.", next: "A firewall or proxy may block it, or the port is closed." };
 
   if (useTls) {
     const tlsR = await probeTls(host, port);
-    printLayer("TLS 握手", tlsR);
+    printProbe("TLS handshake", tlsR);
     if (!tlsR.ok) {
-      return { ok: false, reason: "TCP 可连但 TLS 握手失败——可能是企业代理 MITM 证书、系统时间错误，或服务端证书问题。" };
+      return { ok: false, reason: "TCP works, but the TLS handshake failed.", next: "A corporate proxy, a wrong system clock or the server's certificate may be the cause." };
     }
   }
 
   const wsR = await probeWsUpgrade(target);
-  printLayer("WS 升级握手", wsR);
+  printProbe("WebSocket upgrade", wsR);
   if (!wsR.ok) {
-    return { ok: false, reason: "网络层通但 WebSocket 升级被拒——可能是反代/负载均衡未正确转发 Upgrade 头，或路径不对。" };
+    return { ok: false, reason: "The network works, but the WebSocket upgrade was refused.", next: "A reverse proxy may not forward the Upgrade header, or the path is wrong." };
   }
   return { ok: true };
 }
@@ -912,140 +1297,213 @@ async function probeCenter(target) {
 async function probeLocalDirect() {
   const portResult = localGatewayPort();
   if (!portResult.ok) {
-    printLocalLayer("Gateway bind", { ok: false, error: portResult.error });
-    printLocalLayer("Loopback WS", { ok: false, error: "固定 gateway 端口未知，无法探测" });
-    const grant = readLocalGatewaySummary();
-    printLocalLayer("本地 grant", grant);
+    printProbe("Local port", { ok: false, error: portResult.error }, { soft: true });
+    printProbe("Local connection", { ok: false, error: "local port unknown; not checked" }, { soft: true });
+    printProbe("Browser pairing", readLocalGatewaySummary(), { soft: true });
     return { ready: false };
   }
 
   const bind = await probeTcp("127.0.0.1", portResult.port);
-  printLocalLayer(`Gateway bind (127.0.0.1:${portResult.port})`, bind);
+  printProbe(`Local port (127.0.0.1:${portResult.port})`, bind, { soft: true });
   const grant = readLocalGatewaySummary();
-  printLocalLayer("本地 grant", grant);
+  printProbe("Browser pairing", grant, { soft: true });
 
   let loopback;
   if (!bind.ok) {
-    loopback = { ok: false, error: "gateway 未监听，跳过 WS 握手" };
+    loopback = { ok: false, error: "local port not listening; skipped" };
   } else {
     loopback = await probeWsUpgrade({
       host: "127.0.0.1",
       port: portResult.port,
       path: "/device",
       useTls: false,
-      // 没有持久 Origin 时仍发一个合法 Origin；403 能区分“coflux gateway 可达但未配对”。
+      // Without a stored Origin still send a valid one: a 403 tells "reachable but not paired" apart.
       origin: grant.origin || "http://127.0.0.1",
     });
   }
-  printLocalLayer("Loopback WS（主机侧）", loopback);
+  printProbe("Local connection", loopback, { soft: true });
   return { ready: bind.ok && grant.ready && loopback.ok };
 }
 
 async function cmdDoctor() {
   const s = readSettings();
   const serverUrl = s.serverUrl || DEFAULT_SERVER;
-  console.log(`\n  中心网络 —— ${serverUrl}\n  ────────────────────────────`);
-  let center;
+  info(`Server  ${serverUrl}`);
+  let server;
   try {
-    center = await probeCenter(parseServerUrl(serverUrl));
+    server = await probeServer(parseServerUrl(serverUrl));
   } catch (error) {
-    printLayer("server URL", { ok: false, ms: 0, error: `${serverUrl}（${error.message}）` });
-    center = { ok: false, reason: "中心地址配置无效。" };
+    printProbe("Server URL", { ok: false, ms: 0, error: error.message });
+    server = { ok: false, reason: "The server URL is not valid.", next: "Fix it with cofluxd up --server <url>." };
   }
 
-  console.log("\n  本地直连\n  ────────");
+  info("");
+  info("Local access");
   const direct = await probeLocalDirect();
-  const facts = printLocalFacts();
-  const relayReady = center.ok && facts.running && facts.connState === "connected";
 
+  info("");
+  const { running, label } = await serviceState();
+  const registered = fs.existsSync(CRED);
+  // Three states, because "no snapshot" is not "not connected": an older runtime does not write one.
+  let connState = "unknown";
+  let connection = running ? "unknown" : "not checked; the service is not running";
+  if (running) {
+    const conn = readConnState();
+    if (CONNECTION_LABEL[conn?.state]) {
+      connection = CONNECTION_LABEL[conn.state];
+      connState = conn.state === "connected" ? "connected" : "not-connected";
+    }
+  }
+  table([
+    ["Service", label],
+    ["Account", registered ? "added" : "not added yet"],
+    ["Connection", connection],
+    ...(IS_MAC ? [["Disk access", readFdaStatus() === "granted" ? "granted" : "not granted; run cofluxd fda"]] : []),
+  ]);
+  info("");
+
+  const relayReady = server.ok && running && connState === "connected";
   if (direct.ready && relayReady) {
-    printConclusion("ok", "本地直连与中心 relay 均可用。");
+    success("The server connection and direct local access both work.");
   } else if (!direct.ready && relayReady) {
-    printConclusion("warning", "直连降级：中心 relay 仍可用，daemon 不是离线；检查上面的 gateway/grant/loopback 项。");
-  } else if (direct.ready && !center.ok) {
-    printConclusion("warning", "中心不可达，但本地直连可用；已加载且已配对页面可继续会话，刷新/冷启动不保证。");
+    warn("Direct local access is degraded, but the server connection works: the device is online.", "Check the local access items above.");
+  } else if (direct.ready && !server.ok) {
+    warn("The server is unreachable, but direct local access works.", "Pages already open keep working; reloading them may not.");
   } else if (direct.ready) {
-    printConclusion("warning", "本地直连可用；中心网络可达，但 daemon→中心连接未确认，relay 状态未知。");
-  } else if (center.ok) {
-    printConclusion("warning", "直连降级；中心网络可达，但 daemon→中心连接未确认。不要据此把 daemon 判为离线，查 `cofluxd logs`。");
+    warn("Direct local access works. The server is reachable, but the device has not confirmed its connection.", "Check again in a moment with cofluxd status, or see cofluxd logs.");
+  } else if (server.ok) {
+    warn("Direct local access is degraded, and the device has not confirmed its server connection.", "This does not mean the device is offline. See cofluxd logs.");
   } else {
-    printConclusion("error", `${center.reason || "中心不可达"} 同时本地直连降级；当前两条路径都未确认可用。`);
+    printError(`${server.reason} Direct local access is degraded too.`, server.next);
   }
 }
 
-function cmdLogs(v) {
-  if (IS_MAC) {
-    if (!fs.existsSync(LOG_FILE)) die(`暂无日志 ${LOG_FILE}`);
+async function cmdLogs(v) {
+  const watcher = await watchRequest("status");
+  if (IS_MAC || watcher || serviceMode() === "self-managed") {
+    if (!fs.existsSync(LOG_FILE)) die("There is no log yet.", "Start the service with cofluxd up.");
     run("tail", v.follow ? ["-f", LOG_FILE] : ["-n", "100", LOG_FILE], { stdio: "inherit" });
   } else if (IS_LINUX) {
     run("journalctl", ["--user", "-u", "coflux-daemon.service", ...(v.follow ? ["-f"] : ["-n", "100"])], { stdio: "inherit" });
   }
 }
 
-// 完全磁盘访问权限（FDA）引导：macOS 不允许程序自动弹出 FDA 授权窗（Apple 刻意设计），
-// 上限就是检测 + 跳转系统设置 + 引导手动添加。授权对象是 supervisor 二进制本身——worker/PTY/agent
-// 都是它的子进程，TCC 按 launchd 服务的 responsible process 归属，一次授权覆盖全树。
+// Full Disk Access (FDA): macOS never lets a program open the FDA prompt itself, by design. The best
+// this can do is detect, open System Settings and guide. The grant goes to the launcher binary: the
+// runtime and agents are its children, and TCC attributes them to the launchd job's responsible process.
 async function cmdFda() {
-  if (!IS_MAC) die("此命令仅 macOS 可用（Linux 无 TCC/FDA 概念，无需授权）");
-  console.log("\n  完全磁盘访问权限（FDA）引导\n  ──────────────────────────\n");
-  console.log("  macOS 不支持程序自动弹出 FDA 授权窗，需手动在「系统设置」里添加。");
-  console.log("  请把下面这个二进制拖进「隐私与安全性 → 完全磁盘访问权限」列表并勾选：\n");
-  console.log(`    ${SUP_BIN}\n`);
-  console.log("  即将打开系统设置面板，并在 Finder 中定位该二进制……\n");
+  if (!IS_MAC) die("cofluxd fda is only for macOS.", "Linux needs no extra permission.");
+  info("Grant Full Disk Access to Coflux");
+  info("");
+  info("macOS asks you to add the program yourself. In System Settings, open");
+  info("Privacy & Security > Full Disk Access, then drag in this file and turn it on:");
+  info("");
+  info(`    ${bold(LAUNCHER_BIN)}`);
+  info("");
+  info("Opening System Settings and showing the file in Finder...");
   run("open", ["x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles"]);
-  run("open", ["-R", SUP_BIN]);
+  run("open", ["-R", LAUNCHER_BIN]);
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    await rl.question("  添加并勾选后按回车，重启服务使授权生效… ");
+    await rl.question("Press Enter once it is added and turned on... ");
   } finally {
     rl.close();
   }
-  restartService();
-  console.log("\n✓ 已重启服务（FDA 对已运行进程不生效，必须重启才能生效）。稍候用 `cofluxd status` 确认已授予。");
+  // The grant only applies to processes started after it.
+  await restartService("launchd", executorRuntime());
+  success("Service restarted. Check the result with cofluxd status in a moment.");
 }
 
-function cmdUninstall(v) {
-  stopService();
+async function cmdUninstall(v) {
+  const watcher = await watchRequest("status");
+  const mode = watcher ? "self-managed" : serviceMode();
+  if (mode === "self-managed") await stopSelfManaged();
+  else stopService(mode, { strict: true });
   for (const file of IS_MAC ? [PLIST, PTYD_PLIST] : [UNIT, PTYD_UNIT]) {
     try { fs.rmSync(file); } catch { /* */ }
   }
-  if (IS_LINUX) run("systemctl", ["--user", "daemon-reload"]);
-  if (v.purge) { try { fs.rmSync(HOME, { recursive: true, force: true }); } catch { /* */ } console.log("✓ 已卸载并清除 " + HOME); }
-  else console.log(`✓ 已卸载服务（保留二进制/配置/凭证于 ${HOME}；--purge 可全清）`);
-}
-
-const HELP = `cofluxd —— coflux daemon 管理
-
-  cofluxd                 首次=up（打印浏览器授权链接），已配置=status
-  cofluxd up [flags]      幂等：首次装+起，已装则按当前 settings.json 重装服务并重启
-  cofluxd up --key <密钥>  用 Coflux 添加设备里生成的一次性密钥直接接入账号（不打印授权链接；已接入则不做改动）
-  cofluxd status          服务器/登记（含"等待授权"）/服务/连接状态
-  cofluxd doctor          中心网络 + gateway bind/grant/loopback + daemon 状态分层自检
-  cofluxd update          下载新二进制（不重启；supervisor / ptyd 有变化时提示用 restart 应用）
-  cofluxd restart         重启 supervisor 应用新版本（终端留在 ptyd 里，不结束会话）
-  cofluxd restart --ptyd  连 ptyd 一起重启（⚠ 结束本机所有活会话；仅 ptyd 自身更新时需要）
-  cofluxd fda             [仅 macOS] 引导授予完全磁盘访问权限（避免 PTY 因 TCC 弹窗卡住）
-  cofluxd logs [-f]       看 daemon 日志
-  cofluxd down            停止
-  cofluxd uninstall [--purge]   卸载（--purge 连二进制/配置/凭证一并删）
-
-up flags: --server <ws://.../daemon>  --name <名>  --shell <路径>  --key <cf_join_…>(一次性接入密钥，1 小时内有效)
-通用: --version <vX|latest>(不传时 up 沿用已有二进制，update 默认 latest)  --bin-dir <dir>(用本地 cargo 产物)  --no-start
-配置都在 ~/.coflux/settings.json（serverUrl/deviceName/shell），daemon 直接读；改后重跑 cofluxd up 生效。`;
-
-const { values, positionals } = parseArgs({
-  allowPositionals: true,
-  options: {
-    server: { type: "string" }, name: { type: "string" }, shell: { type: "string" }, key: { type: "string" },
-    version: { type: "string" }, "bin-dir": { type: "string" },
-    "no-start": { type: "boolean", default: false }, purge: { type: "boolean", default: false },
-    ptyd: { type: "boolean", default: false },
-    follow: { type: "boolean", short: "f", default: false }, help: { type: "boolean", short: "h", default: false },
-  },
-});
+  if (IS_LINUX && systemdBooted()) run("systemctl", ["--user", "daemon-reload"]);
+  clearServiceMode();
+  if (v.purge) {
+    try { fs.rmSync(HOME, { recursive: true, force: true }); } catch { /* */ }
+    success(`Removed Coflux and everything in ${HOME}`);
+  } else {
+    success("Service removed");
+    info(`Binaries, settings and credentials stay in ${HOME}. Run cofluxd uninstall --purge to remove them too.`);
+  }
+}
+
+const HELP = `Run this machine as a Coflux device: install, start, stop and update its service.
+
+Usage:
+  cofluxd <command> [flags]
+
+Commands:
+  up                Install and start the service, then add this device to your account
+  run               Run the service in the foreground, as a container's entry point
+  status            Show the device, its service and its connection
+  doctor            Check the connection to the server and local access
+  update            Download the latest version; restart afterwards to apply it
+  restart           Restart the service; terminals stay open
+  restart --ptyd    Restart everything; closes all terminals on this device
+  fda               Grant Full Disk Access (macOS only)
+  logs [-f]         Show the service log
+  down              Stop the service; closes all terminals
+  uninstall         Remove the service
+
+With no command, cofluxd runs up on a new device and status on a configured one.
+
+Flags for up and run:
+  --server <url>        Server to connect to (default ${DEFAULT_SERVER})
+  --name <name>         Device name (default: the hostname)
+  --shell <path>        Shell for new terminals
+  --key <key>           One-time join key from Add Device in Coflux, valid for 1 hour
+  --no-start            Install without starting (up only)
+
+Flags for up, run and update:
+  --version <tag>       Version to install, such as v2.15.0, or latest. up and run keep the
+                        installed version; update installs the latest.
+  --bin-dir <dir>       Install from a local build instead of downloading
+
+Other flags:
+  --purge               With uninstall: also remove binaries, settings and credentials
+  -f, --follow          With logs: keep printing new lines
+  -h, --help            Show this help
+
+Settings are kept in ~/.coflux/settings.json; run cofluxd up again after editing it.
+
+On Linux without systemd, cofluxd runs the service itself. It does not start on boot; in a
+container, use cofluxd run as the entry point. For sign-in and terminals, use coflux.`;
+
+/** parseArgs errors, first sentence only (the same wording as coflux). */
+function argumentError(error) {
+  const first = String(error?.message ?? error).split(". ")[0];
+  const missing = /^Option '(.+)' argument missing/.exec(first);
+  if (missing) return `Option '${missing[1]}' needs a value`;
+  const unexpected = /^Option '(.+)' does not take an argument/.exec(first);
+  if (unexpected) return `Option '${unexpected[1]}' does not take a value`;
+  return first;
+}
+
+let parsedArgs;
+try {
+  parsedArgs = parseArgs({
+    allowPositionals: true,
+    options: {
+      server: { type: "string" }, name: { type: "string" }, shell: { type: "string" }, key: { type: "string" },
+      version: { type: "string" }, "bin-dir": { type: "string" },
+      "no-start": { type: "boolean", default: false }, purge: { type: "boolean", default: false },
+      ptyd: { type: "boolean", default: false },
+      follow: { type: "boolean", short: "f", default: false }, help: { type: "boolean", short: "h", default: false },
+    },
+  });
+} catch (error) {
+  die(argumentError(error));
+}
+const { values, positionals } = parsedArgs;
 const cmd = positionals[0] || (fs.existsSync(SETTINGS) ? "status" : "up");
 if (values.help || cmd === "help") { console.log(HELP); process.exit(0); }
-const handlers = { up: cmdUp, update: cmdUpdate, restart: cmdRestart, down: cmdDown, status: cmdStatus, doctor: cmdDoctor, fda: cmdFda, logs: cmdLogs, uninstall: cmdUninstall, "service-files": cmdServiceFiles };
+const handlers = { up: cmdUp, run: cmdRun, update: cmdUpdate, restart: cmdRestart, down: cmdDown, status: cmdStatus, doctor: cmdDoctor, fda: cmdFda, logs: cmdLogs, uninstall: cmdUninstall, "service-files": cmdServiceFiles };
 const handler = handlers[cmd];
-if (!handler) die(`未知命令: ${cmd}\n登录与终端操作请使用 coflux。\n\n${HELP}`);
+if (!handler) die(`Unknown command: ${cmd}`, "Run cofluxd --help to see the commands. For sign-in and terminals, use coflux.");
 await handler(values);