gisool 0.0.0-stage → 0.1.0

package/dist/cli/doctor.js

@@ -0,0 +1,197 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { createCatalog } from "../catalog/index.js";
+import { loadConfig, resolveGisoolHome, resolveHome } from "../config.js";
+import { PACKS } from "../packs/registry.js";
+import { selfCheck } from "../store/db.js";
+import { listBackupSets } from "./init.js";
+import { currentServicePlatform, dbPath, packageVersion, serviceLoaded, servicePath } from "./serve.js";
+const HOOK_LIMIT_S = 5;
+const isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function readJson(path) {
+    try {
+        const v = JSON.parse(readFileSync(path, "utf8"));
+        return isObj(v) ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function gisoolHookTimeouts(cfg, unitSeconds) {
+    const out = [];
+    const hooks = cfg && isObj(cfg.hooks) ? cfg.hooks : {};
+    const visit = (event, h) => {
+        if (!isObj(h) || typeof h.command !== "string" || !h.command.includes("hook-post.mjs"))
+            return;
+        if (typeof h.timeout === "number")
+            out.push({ event, seconds: h.timeout * unitSeconds });
+        if (Array.isArray(h.hooks))
+            for (const inner of h.hooks)
+                visit(event, inner);
+    };
+    for (const [event, groups] of Object.entries(hooks)) {
+        if (!Array.isArray(groups))
+            continue;
+        for (const g of groups) {
+            if (isObj(g) && Array.isArray(g.hooks))
+                for (const h of g.hooks)
+                    visit(event, h);
+            else
+                visit(event, g);
+        }
+    }
+    return out;
+}
+function hookTimeoutCheck(home, env) {
+    const sources = [
+        [join(env.CLAUDE_CONFIG_DIR || join(home, ".claude"), "settings.json"), 1],
+        [join(home, ".gemini", "settings.json"), 0.001],
+        [join(home, ".cursor", "hooks.json"), 1],
+    ];
+    const tooLong = [];
+    for (const [path, unit] of sources) {
+        for (const t of gisoolHookTimeouts(readJson(path), unit))
+            if (t.seconds > HOOK_LIMIT_S)
+                tooLong.push(`${path} ${t.event} ${t.seconds}s`);
+    }
+    return tooLong.length
+        ? { name: "hook_timeouts", status: "fail", code: "hook_timeout_too_long", detail: `gisool hooks must time out within ${HOOK_LIMIT_S}s: ${tooLong.join("; ")}` }
+        : { name: "hook_timeouts", status: "ok", detail: `all gisool hook timeouts <= ${HOOK_LIMIT_S}s` };
+}
+async function healthCheck(port, gisoolHome) {
+    try {
+        const res = await fetch(`http://127.0.0.1:${port}/healthz`, { signal: AbortSignal.timeout(1500) });
+        const body = (await res.json().catch(() => undefined));
+        if (res.status !== 200 || body?.ok !== true || typeof body.version !== "string") {
+            return { name: "daemon", status: "fail", code: "not_gisool", detail: `port ${port} answered /healthz with ${res.status} but it is not gisool` };
+        }
+        const mine = packageVersion();
+        if (body.version !== mine)
+            return { name: "daemon", status: "warn", code: "version_mismatch", detail: `daemon ${body.version}, CLI ${mine}` };
+        const tokenPath = join(gisoolHome, "token");
+        if (existsSync(tokenPath)) {
+            const stats = await fetch(`http://127.0.0.1:${port}/api/stats`, {
+                headers: { authorization: `Bearer ${readFileSync(tokenPath, "utf8").trim()}` },
+                signal: AbortSignal.timeout(1500),
+            });
+            if (stats.status === 401) {
+                return { name: "daemon", status: "fail", code: "token_mismatch", detail: `gisool ${body.version} on 127.0.0.1:${port} rejected this install's token: the port is held by another gisool instance, or the token was rotated; restart the daemon` };
+            }
+        }
+        return { name: "daemon", status: "ok", detail: `gisool ${body.version} on 127.0.0.1:${port}` };
+    }
+    catch (error) {
+        return { name: "daemon", status: "fail", code: "daemon_unreachable", detail: `no response from http://127.0.0.1:${port}/healthz (${error.message})` };
+    }
+}
+function serviceCheck(home, env) {
+    if (env.GISOOL_NO_CLI)
+        return { name: "service", status: "skip", detail: "GISOOL_NO_CLI set" };
+    const platform = currentServicePlatform();
+    const path = servicePath(home, platform);
+    if (!existsSync(path))
+        return { name: "service", status: "warn", code: "service_not_installed", detail: `${path} missing; run gisool service install` };
+    return serviceLoaded(platform, process.getuid?.() ?? 0, env)
+        ? { name: "service", status: "ok", detail: `${path} loaded` }
+        : { name: "service", status: "fail", code: "service_not_loaded", detail: `${path} exists but the service is not loaded` };
+}
+function tokenCheck(gisoolHome) {
+    const path = join(gisoolHome, "token");
+    if (!existsSync(path))
+        return { name: "token_mode", status: "fail", code: "token_missing", detail: path };
+    const mode = statSync(path).mode & 0o777;
+    return mode === 0o600
+        ? { name: "token_mode", status: "ok", detail: `${path} 0600` }
+        : { name: "token_mode", status: "fail", code: "token_mode_insecure", detail: `${path} is 0${mode.toString(8)}; expected 0600` };
+}
+function ftsCheck() {
+    try {
+        selfCheck();
+        return { name: "fts5", status: "ok", detail: "FTS5 trigram tokenizer works" };
+    }
+    catch (error) {
+        return { name: "fts5", status: "fail", code: "fts5_trigram_unavailable", detail: error.message };
+    }
+}
+async function catalogChecks(config, gisoolHome) {
+    const catalog = createCatalog({ roots: config.roots, log: () => undefined });
+    try {
+        await catalog.refresh();
+        const report = catalog.report();
+        const unreadable = report.roots.filter((r) => !r.readable);
+        const nameByUri = new Map(catalog.list().map((e) => [e.uri, e.name]));
+        const families = report.families.map((f) => ({ id: f.id, members: [...new Set(f.uris.map((u) => nameByUri.get(u) ?? u))].sort() }));
+        const checks = [
+            unreadable.length
+                ? { name: "roots", status: "warn", code: "root_unreadable", detail: `unreadable or missing: ${unreadable.map((r) => r.path).join(", ")}` }
+                : { name: "roots", status: "ok", detail: `${report.roots.length} root(s) readable` },
+            { name: "duplicates", status: report.duplicates.length ? "warn" : "ok", detail: `${report.duplicates.length} duplicate skill name(s)${report.duplicates.length ? `: ${report.duplicates.map((d) => d.name).join(", ")}` : ""}` },
+            { name: "skill_families", status: "ok", detail: families.length ? families.map((f) => `${f.id}: ${f.members.join(", ")}`).join("; ") : "none" },
+        ];
+        const path = dbPath(gisoolHome);
+        if (!existsSync(path)) {
+            checks.push({ name: "index_freshness", status: "warn", code: "index_missing", detail: `${path} not created yet; start the daemon` });
+            return { checks, families };
+        }
+        const db = new DatabaseSync(path, { readOnly: true });
+        try {
+            const rows = db.prepare("SELECT uri, manifest_digest FROM skills WHERE removed_at IS NULL").all();
+            const indexed = new Map(rows.map((r) => [r.uri, r.manifest_digest]));
+            const live = catalog.list();
+            const stale = live.filter((e) => indexed.get(e.uri) !== e.manifestDigest).length + rows.filter((r) => !live.some((e) => e.uri === r.uri)).length;
+            checks.push(stale === 0
+                ? { name: "index_freshness", status: "ok", detail: `${live.length} skill(s) indexed and current` }
+                : { name: "index_freshness", status: "fail", code: "index_stale", detail: `${stale} skill(s) differ between the catalog and ${path}; restart the daemon` });
+        }
+        finally {
+            db.close();
+        }
+        return { checks, families };
+    }
+    finally {
+        catalog.close();
+    }
+}
+function lastBackupCheck(gisoolHome, now) {
+    const latest = listBackupSets(gisoolHome)[0];
+    if (!latest)
+        return { name: "last_backup", status: "ok", detail: "none" };
+    const ageH = Math.round((now - Date.parse(latest.manifest.createdAt)) / 3_600_000);
+    return { name: "last_backup", status: "ok", detail: `${latest.dir} (${ageH} h ago)` };
+}
+export async function collectDoctor(env) {
+    const home = resolveHome(env);
+    const gisoolHome = resolveGisoolHome(env);
+    const config = loadConfig(env);
+    const checks = [serviceCheck(home, env), await healthCheck(config.port, gisoolHome)];
+    const remote = [];
+    const packChecks = [];
+    for (const pack of PACKS) {
+        const d = await pack.detect({ home, env });
+        if (d.remoteGisulRegistered)
+            remote.push(pack.id);
+        if (!d.installed || config.runtimes[pack.id]?.enabled === false)
+            continue;
+        for (const c of await pack.doctorChecks({ home, env, port: config.port })) {
+            packChecks.push({ name: `${pack.id}: ${c.name}`, status: c.ok ? "ok" : "fail", detail: c.detail });
+        }
+    }
+    checks.push(remote.length
+        ? { name: "remote_gisul", status: "warn", code: "remote_gisul_registered", detail: `remote gisul is also registered in: ${remote.join(", ")} (gisool init --disable-remote turns it off)` }
+        : { name: "remote_gisul", status: "ok", detail: "no remote gisul registration found" });
+    const catalogResult = await catalogChecks(config, gisoolHome);
+    checks.push(tokenCheck(gisoolHome), ftsCheck(), ...catalogResult.checks, ...packChecks, hookTimeoutCheck(home, env), lastBackupCheck(gisoolHome, Date.now()));
+    return { ok: checks.every((c) => c.status !== "fail"), version: packageVersion(), checks, families: catalogResult.families };
+}
+export async function runDoctor(opts, env, io) {
+    const report = await collectDoctor(env);
+    if (opts.json)
+        io.out(JSON.stringify(report, null, 2) + "\n");
+    else {
+        for (const c of report.checks)
+            io.out(`[${c.status}] ${c.name}: ${c.detail}${c.code ? ` (${c.code})` : ""}\n`);
+        io.out(report.ok ? "doctor: all checks passed\n" : "doctor: some checks failed\n");
+    }
+    return report.ok ? 0 : 1;
+}

package/dist/cli/eval.js

@@ -0,0 +1,64 @@
+import { readFileSync } from "node:fs";
+import { createCatalog } from "../catalog/index.js";
+import { createSearchIndex } from "../search/index.js";
+import { openDb } from "../store/db.js";
+export async function runEval(opts, deps) {
+    const store = deps.openStore();
+    const catalog = createCatalog({ roots: deps.config.roots, log: () => { } });
+    const db = openDb(":memory:");
+    try {
+        let cases = store.evalCases();
+        if (opts.cases) {
+            const extra = JSON.parse(readFileSync(opts.cases, "utf8"));
+            if (!Array.isArray(extra))
+                throw new Error("cases file must be a JSON array of { query, expectedUri? }");
+            cases = [...cases, ...extra];
+        }
+        const index = createSearchIndex(db);
+        await catalog.refresh();
+        index.rebuild(catalog.list());
+        let judged = 0, h1 = 0, h3 = 0, rr = 0, abstained = 0;
+        const misses = [];
+        for (const c of cases) {
+            const out = index.search(c.query, { mode: "discovery", limit: 10 });
+            if (out.abstained)
+                abstained++;
+            if (!c.expectedUri)
+                continue;
+            judged++;
+            const pos = out.candidates.findIndex((x) => x.uri === c.expectedUri);
+            if (pos === 0)
+                h1++;
+            if (pos >= 0 && pos < 3)
+                h3++;
+            if (pos >= 0)
+                rr += 1 / (pos + 1);
+            if (pos !== 0)
+                misses.push({ query: c.query, expectedUri: c.expectedUri, rank: pos >= 0 ? pos + 1 : null });
+        }
+        const ratio = (n, d) => (d === 0 ? 0 : n / d);
+        const report = { cases: cases.length, judged, hitAt1: ratio(h1, judged), hitAt3: ratio(h3, judged), mrr: ratio(rr, judged),
+            abstainRate: ratio(abstained, cases.length), misses };
+        if (opts.json)
+            console.log(JSON.stringify(report, null, 2));
+        else {
+            console.log(`cases: ${report.cases} (with expectation: ${judged})`);
+            console.log(`hit@1: ${report.hitAt1.toFixed(3)}`);
+            console.log(`hit@3: ${report.hitAt3.toFixed(3)}`);
+            console.log(`MRR: ${report.mrr.toFixed(3)}`);
+            console.log(`abstain rate: ${report.abstainRate.toFixed(3)}`);
+            for (const m of misses)
+                console.log(`miss: "${m.query}" expected ${m.expectedUri} rank ${m.rank ?? "none"}`);
+        }
+        return 0;
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    finally {
+        catalog.close();
+        db.close();
+        store.close();
+    }
+}

package/dist/cli/export-import.js

@@ -0,0 +1,66 @@
+import { claudeCodePack } from "../packs/claude-code.js";
+import { codexPack } from "../packs/codex.js";
+import { cursorPack } from "../packs/cursor.js";
+import { gajaePack } from "../packs/gajae.js";
+import { geminiPack } from "../packs/gemini.js";
+import { omoPack } from "../packs/omo.js";
+import { openclawPack } from "../packs/openclaw.js";
+const PACKS = [claudeCodePack, codexPack, geminiPack, cursorPack, omoPack, gajaePack, openclawPack];
+function fail(error) {
+    const code = error?.code;
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(typeof code === "string" ? `${code}: ${message}` : message);
+    return 1;
+}
+export const runExport = async (dir, opts, deps) => {
+    const store = deps.openStore();
+    try {
+        store.exportTo(dir, { withHistory: opts.withHistory });
+        console.log(`exported to ${dir}${opts.withHistory ? " (with history)" : ""}`);
+        return 0;
+    }
+    catch (error) {
+        return fail(error);
+    }
+    finally {
+        store.close();
+    }
+};
+function list(label, items) {
+    return `  ${label}: ${items.length > 0 ? items.join(", ") : "none"}`;
+}
+async function printDetection(deps) {
+    console.log("runtime detection:");
+    for (const pack of PACKS) {
+        const d = await pack.detect({ home: deps.home, env: deps.env });
+        console.log(`  ${pack.id}: ${d.installed ? "detected" : "not detected"}`);
+    }
+}
+export const runImport = async (dir, opts, deps) => {
+    const store = deps.openStore();
+    try {
+        const preview = store.importFrom(dir, { merge: false });
+        const d = preview.details;
+        console.log(opts.dryRun ? "import preview (dry run, nothing written):" : "import preview:");
+        console.log(list("roots to add", d.roots.added));
+        console.log(`  eval cases to add: ${d.evalCases.added} (already present: ${d.evalCases.skipped})`);
+        console.log(list("config keys to add", d.configKeys.added));
+        console.log(list("config keys already present (kept)", d.configKeys.kept));
+        console.log(list("aliases to add", d.aliases.added));
+        if (d.history)
+            console.log(`  history to add: ${d.history.sessions} sessions, ${d.history.events} events, ${d.history.loads} loads`);
+        if (opts.dryRun)
+            return 0;
+        store.importFrom(dir, { merge: true });
+        console.log("import applied");
+        await printDetection(deps);
+        console.log("next: run `gisool init`");
+        return 0;
+    }
+    catch (error) {
+        return fail(error);
+    }
+    finally {
+        store.close();
+    }
+};

package/dist/cli/init.js

@@ -0,0 +1,271 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { DEFAULT_PORT, defaultConfigFile, ensureGisoolHome, expandHome, loadConfig, resolveGisoolHome, resolveHome } from "../config.js";
+import { PACKS, getPack } from "../packs/registry.js";
+import { assertPlatform } from "../version.js";
+import { WriterError, applyFiles, changedFiles, maskSecrets, removeEmptyDirs, restoreFiles, unifiedDiff, unparseable } from "./config-writer.js";
+import { currentServicePlatform, daemonLogPath, nodePath, packageRoot, planService, servicePath } from "./serve.js";
+// Planning never writes: a first run plans against default config and an in-memory token, and materialize() persists
+// both only once the apply starts, so dry runs and aborted runs leave HOME byte-identical.
+function readConfigForPlan(env) {
+    const gisoolHome = resolveGisoolHome(env);
+    const tokenPath = join(gisoolHome, "token");
+    const configPath = join(gisoolHome, "config.json");
+    if (existsSync(configPath) && existsSync(tokenPath)) {
+        const config = loadConfig(env);
+        return { config, token: readFileSync(tokenPath, "utf8").trim(), materialize: () => undefined };
+    }
+    const home = resolveHome(env);
+    const d = defaultConfigFile();
+    let port = DEFAULT_PORT;
+    if (existsSync(configPath)) {
+        const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+        if (typeof parsed.port === "number")
+            port = parsed.port;
+    }
+    const config = { port, captureLevel: d.captureLevel, retentionDays: d.retentionDays, roots: d.roots.map((r) => ({ id: r.id, path: expandHome(r.path, home) })), runtimes: {} };
+    const token = existsSync(tokenPath) ? readFileSync(tokenPath, "utf8").trim() : randomBytes(32).toString("hex");
+    return {
+        config,
+        token,
+        materialize() {
+            ensureGisoolHome(env);
+            if (!existsSync(tokenPath)) {
+                writeFileSync(tokenPath, token + "\n", { mode: 0o600, flag: "wx" });
+                chmodSync(tokenPath, 0o600);
+            }
+            loadConfig(env);
+        },
+    };
+}
+export function backupsDir(gisoolHome) {
+    return join(gisoolHome, "backups");
+}
+function newBackupDir(gisoolHome) {
+    const root = backupsDir(gisoolHome);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const stamp = new Date().toISOString().replace(/[-:.]/g, "");
+    let dir = join(root, stamp);
+    for (let i = 1; existsSync(dir); i++)
+        dir = join(root, `${stamp}-${String(i).padStart(3, "0")}`);
+    mkdirSync(dir, { mode: 0o700 });
+    return dir;
+}
+export function listBackupSets(gisoolHome) {
+    const root = backupsDir(gisoolHome);
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root)
+        .sort()
+        .reverse()
+        .flatMap((name) => {
+        const path = join(root, name, "manifest.json");
+        if (!existsSync(path))
+            return [];
+        return [{ dir: join(root, name), manifest: JSON.parse(readFileSync(path, "utf8")) }];
+    });
+}
+function writeManifest(dir, manifest) {
+    const path = join(dir, "manifest.json");
+    writeFileSync(path, JSON.stringify(manifest, null, 2) + "\n", { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+function run(argv, env, io) {
+    const r = spawnSync(argv[0], argv.slice(1), { env, encoding: "utf8" });
+    if (r.stdout)
+        io.out(r.stdout);
+    if (r.stderr)
+        io.err(r.stderr);
+    if (r.error)
+        io.err(`failed to run ${argv[0]}: ${r.error.message}\n`);
+    return r.status;
+}
+function parseRuntimeIds(ids) {
+    const ok = [];
+    const unknown = [];
+    for (const id of ids) {
+        const pack = getPack(id);
+        if (pack)
+            ok.push(pack);
+        else
+            unknown.push(id);
+    }
+    return { ok, unknown };
+}
+export async function runInit(opts, env, io, hooks = {}) {
+    assertPlatform();
+    if (opts.rollback)
+        return runRollback({ all: opts.all ?? false }, env, io);
+    const home = resolveHome(env);
+    const gisoolHome = resolveGisoolHome(env);
+    const { config, token, materialize } = readConfigForPlan(env);
+    const mask = (t) => maskSecrets(t, [token]);
+    const ctx = { home, env, port: config.port, token, nodePath: nodePath(), packageRoot: packageRoot(), disableRemote: opts.disableRemote ?? false };
+    const selected = [];
+    if (!opts.serviceOnly) {
+        const requested = parseRuntimeIds(opts.runtimes ?? []);
+        if (requested.unknown.length) {
+            io.err(`unknown_runtime: ${requested.unknown.join(", ")} (known: ${PACKS.map((p) => p.id).join(", ")})\n`);
+            return 2;
+        }
+        for (const pack of PACKS) {
+            const d = await pack.detect({ home, env });
+            io.out(`runtime ${pack.id}: ${d.installed ? `detected (${d.evidence.join(", ")})` : "not detected"}; remoteGisulRegistered=${d.remoteGisulRegistered}\n`);
+            const wanted = requested.ok.length ? requested.ok.includes(pack) : d.installed && config.runtimes[pack.id]?.enabled !== false;
+            if (wanted)
+                selected.push(pack);
+        }
+    }
+    const plans = [];
+    for (const pack of selected) {
+        try {
+            plans.push({ id: pack.id, plan: await pack.plan(ctx) });
+        }
+        catch (error) {
+            plans.push({ id: pack.id, plan: { files: [], commands: [], notes: [], conflicts: [{ path: pack.id, code: "plan_failed", detail: error.message }] } });
+        }
+    }
+    let serviceFile = null;
+    if (!opts.noService) {
+        const svc = planService({ home, gisoolHome, env, nodePath: ctx.nodePath, packageRoot: ctx.packageRoot, platform: currentServicePlatform(), uid: process.getuid?.() ?? 0 });
+        plans.push({ id: "service", plan: { files: [svc.file], commands: svc.commands, notes: svc.notes, conflicts: [] } });
+        serviceFile = svc.file.path;
+    }
+    const files = plans.flatMap((p) => p.plan.files);
+    const commands = plans.flatMap((p) => p.plan.commands);
+    const conflicts = plans.flatMap((p) => p.plan.conflicts.map((c) => ({ ...c, runtime: p.id })));
+    for (const f of changedFiles(files)) {
+        const why = unparseable(f);
+        if (why)
+            conflicts.push({ path: f.path, code: "unparseable_config", detail: why, runtime: "writer" });
+    }
+    const seen = new Set();
+    for (const f of changedFiles(files)) {
+        if (seen.has(f.path))
+            conflicts.push({ path: f.path, code: "duplicate_target", detail: "planned by more than one pack", runtime: "writer" });
+        seen.add(f.path);
+    }
+    if (conflicts.length) {
+        for (const c of conflicts)
+            io.err(`conflict [${c.runtime}] ${c.path}: ${c.code}: ${c.detail}\n`);
+        io.err(`aborting: ${conflicts.length} conflict(s) in ${[...new Set(conflicts.map((c) => c.path))].join(", ")}; no files were changed\n`);
+        return 1;
+    }
+    for (const p of plans) {
+        for (const f of changedFiles(p.plan.files))
+            io.out(mask(unifiedDiff(f.path, f.before, f.after)));
+        for (const c of p.plan.commands)
+            io.out(mask(`command [${p.id}]: ${c.argv.join(" ")}${c.undo ? `  (undo: ${c.undo.argv.join(" ")})` : ""}\n`));
+        for (const n of p.plan.notes)
+            io.out(mask(`note [${p.id}]: ${n}\n`));
+    }
+    const toWrite = changedFiles(files);
+    if (opts.dryRun) {
+        io.out(`dry run: ${toWrite.length} file(s) and ${commands.length} command(s) planned; nothing written\n`);
+        return 0;
+    }
+    await hooks.afterPlan?.();
+    materialize();
+    const backupDir = newBackupDir(gisoolHome);
+    if (serviceFile)
+        mkdirSync(join(gisoolHome, "logs"), { recursive: true, mode: 0o700 });
+    let applied;
+    try {
+        applied = applyFiles(files, { backupDir, home });
+    }
+    catch (error) {
+        rmSync(backupDir, { recursive: true, force: true });
+        if (error instanceof WriterError) {
+            io.err(`${error.message}\naborting: no files were changed (${error.paths.join(", ")})\n`);
+            return 1;
+        }
+        throw error;
+    }
+    const manifest = { version: 1, createdAt: new Date().toISOString(), status: "applied", home, runtimes: selected.map((p) => p.id),
+        service: serviceFile, files: applied.files, createdDirs: applied.createdDirs, commands: [] };
+    for (const c of commands) {
+        const exitCode = run(c.argv, { ...env, ...c.env }, io);
+        manifest.commands.push({ argv: c.argv, description: c.description, ...(c.undo ? { undo: c.undo } : {}), exitCode, ...(c.allowFailure ? { allowFailure: true } : {}) });
+        if (exitCode !== 0 && !c.allowFailure) {
+            io.err(mask(`command failed (exit ${exitCode}): ${c.argv.join(" ")}; rolling back this run\n`));
+            manifest.status = "failed";
+            manifest.rolledBackAt = new Date().toISOString();
+            manifest.rollback = undoRun(manifest, backupDir, env, io);
+            writeManifest(backupDir, manifest);
+            return 1;
+        }
+    }
+    writeManifest(backupDir, manifest);
+    if (applied.files.some((f) => f.path === serviceFile))
+        io.out(`service log: ${daemonLogPath(gisoolHome)}\n`);
+    io.out(`applied ${applied.files.length} file(s) and ${manifest.commands.length} command(s); backup set ${backupDir}\n`);
+    return 0;
+}
+function undoRun(manifest, dir, env, io) {
+    const commands = [];
+    for (const c of [...manifest.commands].reverse()) {
+        if (c.exitCode !== 0 || !c.undo)
+            continue;
+        if (env.GISOOL_NO_CLI) {
+            io.err(`GISOOL_NO_CLI set: run manually: ${c.undo.argv.join(" ")}\n`);
+            commands.push({ argv: c.undo.argv, description: c.undo.description, exitCode: null });
+            continue;
+        }
+        commands.push({ argv: c.undo.argv, description: c.undo.description, exitCode: run(c.undo.argv, env, io) });
+    }
+    const files = restoreFiles(manifest.files, dir);
+    removeEmptyDirs(manifest.createdDirs);
+    return { files, commands };
+}
+export async function runRollback(opts, env, io) {
+    const gisoolHome = resolveGisoolHome(env);
+    const sets = listBackupSets(gisoolHome).filter((s) => s.manifest.status === "applied" && !s.manifest.rolledBackAt && (s.manifest.files.length > 0 || s.manifest.commands.length > 0));
+    if (sets.length === 0) {
+        io.out("nothing to roll back\n");
+        return 0;
+    }
+    let failed = false;
+    for (const s of opts.all ? sets : sets.slice(0, 1)) {
+        const result = undoRun(s.manifest, s.dir, env, io);
+        for (const c of result.commands) {
+            io.out(`undo: ${c.argv.join(" ")} -> ${c.exitCode === null ? "skipped" : `exit ${c.exitCode}`}\n`);
+            if (c.exitCode !== 0)
+                failed = true;
+        }
+        for (const f of result.files) {
+            io.out(`${f.action}: ${f.path}\n`);
+            if (f.action === "skipped_modified")
+                failed = true;
+        }
+        s.manifest.rolledBackAt = new Date().toISOString();
+        s.manifest.rollback = result;
+        writeManifest(s.dir, s.manifest);
+        io.out(`rolled back ${s.dir}\n`);
+    }
+    return failed ? 1 : 0;
+}
+export async function serviceInstall(opts, env, io) {
+    return runInit({ dryRun: opts.dryRun ?? false, serviceOnly: true }, env, io);
+}
+export async function serviceRemove(env, io) {
+    assertPlatform();
+    const home = resolveHome(env);
+    const platform = currentServicePlatform();
+    const path = servicePath(home, platform);
+    if (!existsSync(path)) {
+        io.out("service not installed\n");
+        return 0;
+    }
+    const argv = platform === "darwin"
+        ? ["launchctl", "bootout", `gui/${process.getuid?.() ?? 0}/dev.gisool.daemon`]
+        : ["systemctl", "--user", "disable", "--now", "gisool.service"];
+    if (env.GISOOL_NO_CLI)
+        io.out(`GISOOL_NO_CLI set: run manually: ${argv.join(" ")}\n`);
+    else
+        run(argv, env, io);
+    rmSync(path, { force: true });
+    io.out(`removed ${path}\n`);
+    return 0;
+}