kandev 0.49.0 → 0.50.0

package/README.md

@@ -35,6 +35,17 @@ The package manager owns the runtime version. `kandev@X.Y.Z` ships with the matc
 kandev --runtime-version v0.16.0
 ```
 
+## Run as a Service
+
+Install kandev as a systemd (Linux) or launchd (macOS) service so it auto-starts and stays running across reboots:
+
+```bash
+kandev service install                   # user mode (laptop, single-user)
+sudo kandev service install --system     # system mode (VPS, shared host)
+```
+
+See [docs/run-as-a-service.md](../../docs/run-as-a-service.md) for the full guide — user vs system mode comparison, update workflow, troubleshooting.
+
 ## What You Get
 
 - **Multi-agent support** - Claude Code, Codex, GitHub Copilot, Gemini CLI, Amp, Auggie, OpenCode

package/dist/args.js

@@ -83,6 +83,10 @@ function parseArgs(argv) {
             opts.debug = true;
             continue;
         }
+        if (arg === "--headless" || arg === "--no-browser") {
+            opts.headless = true;
+            continue;
+        }
     }
     return { options: opts, showHelp, deprecatedFlags };
 }

package/dist/cli.js

@@ -9,6 +9,8 @@ const package_json_1 = __importDefault(require("../package.json"));
 const args_1 = require("./args");
 const dev_1 = require("./dev");
 const run_1 = require("./run");
+const service_1 = require("./service");
+const stale_check_1 = require("./service/stale_check");
 const start_1 = require("./start");
 const ports_1 = require("./ports");
 function printHelp() {
@@ -20,6 +22,7 @@ Usage:
   kandev start [--port <port>] [--verbose] [--debug]
   kandev [--port <port>] [--verbose] [--debug]
   kandev --dev [--port <port>]
+  kandev service install|uninstall|start|stop|restart|status|logs [--system]
 
 Examples:
   kandev
@@ -35,6 +38,8 @@ Options:
   dev              Use local repo for dev (make dev + next dev) if available.
   start            Use local production build (make build + next start).
   run              Use installed runtime bundle (default).
+  service          Manage kandev as an OS service (systemd / launchd).
+                   Run 'kandev service --help' for details.
   --dev            Alias for "dev".
   --version, -V    Print CLI version and exit.
   --port           Port for the Go backend (the URL kandev opens on in
@@ -42,6 +47,7 @@ Options:
                    KANDEV_PORT or KANDEV_BACKEND_PORT.
   --verbose, -v    Show info logs from backend + web.
   --debug          Show debug logs + agent message dumps.
+  --headless       Skip opening the browser. Used by service units.
   --help, -h       Show help.
 
 Advanced:
@@ -78,6 +84,12 @@ function findRepoRoot(startDir) {
     }
 }
 async function main() {
+    // The `service` subcommand has its own argv parser (own subcommands, flags).
+    // Handle it before the top-level flag parser to keep the two parsers isolated.
+    if (process.argv[2] === "service") {
+        await (0, service_1.runServiceCommand)(process.argv.slice(3));
+        return;
+    }
     const { options, showHelp, deprecatedFlags } = (0, args_1.parseArgs)(process.argv.slice(2));
     if (options.showVersion) {
         console.log(package_json_1.default.version);
@@ -93,6 +105,13 @@ async function main() {
     const resolved = (0, args_1.resolvePorts)(options, process.env);
     const backendPort = (0, ports_1.ensureValidPort)(resolved.backendPort, "backend port");
     const webPort = (0, ports_1.ensureValidPort)(resolved.webPort, "web port");
+    // After an npm/brew upgrade, paths baked into an installed service unit may
+    // be stale. Warn once before launch so the user knows to re-run install.
+    // Skip when invoked from a service unit (--headless) — the warning would
+    // land in journalctl/launchd logs and pile up on every restart.
+    if (!options.headless) {
+        (0, stale_check_1.warnIfStaleServiceUnit)();
+    }
     if (options.command === "dev") {
         const repoRoot = findRepoRoot(process.cwd());
         if (!repoRoot) {
@@ -121,6 +140,7 @@ async function main() {
         webPort,
         verbose: options.verbose,
         debug: options.debug,
+        headless: options.headless,
     });
 }
 main().catch((err) => {

package/dist/dev.js

@@ -24,6 +24,7 @@ async function runDev({ repoRoot, backendPort, webPort }) {
     (0, shared_1.logStartupInfo)({
         header: "dev mode: using local repo",
         ports,
+        primary: "web",
         dbPath,
         logLevel,
     });
@@ -67,9 +68,13 @@ async function runDev({ repoRoot, backendPort, webPort }) {
 // is assumed to be leaked from the parent backend and is ignored. In a normal
 // shell, an explicit KANDEV_DATABASE_PATH is honored as an escape hatch.
 function resolveDevBackendEnv(repoRoot) {
+    // Profile-selector only: the backend reads profiles.yaml at startup
+    // and applies the matching `dev:` values (mock agent, pprof,
+    // feature flags, etc.) to its own env. We don't repeat those here —
+    // profiles.yaml at the repo root is the single source of truth.
+    // See docs/decisions/0007-runtime-feature-flags.md.
     const baseExtra = {
-        KANDEV_MOCK_AGENT: process.env.KANDEV_MOCK_AGENT || "true",
-        KANDEV_DEBUG_PPROF_ENABLED: "true",
+        KANDEV_DEBUG_DEV_MODE: "true",
     };
     const devHome = (0, constants_1.devKandevHome)(repoRoot);
     // Display only; the backend derives its own DB path from KANDEV_HOME_DIR

package/dist/ports.js

@@ -3,12 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.__testing = void 0;
 exports.ensureValidPort = ensureValidPort;
 exports.pickAvailablePort = pickAvailablePort;
 exports.pickAndReservePort = pickAndReservePort;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_net_1 = __importDefault(require("node:net"));
 const constants_1 = require("./constants");
+const CONNECT_PROBE_TIMEOUT_MS = 500;
 function ensureValidPort(port, name) {
     if (port === undefined) {
         return undefined;
@@ -20,22 +22,30 @@ function ensureValidPort(port, name) {
 }
 /**
  * Tries to connect to a port on the given host. Returns true if something
- * is already listening (i.e. the port is in use).
+ * is already listening (i.e. the port is in use). Returns false on connection
+ * refused, on any other socket error, or when the probe takes longer than
+ * `timeoutMs` — under WSL2 mirrored networking the kernel can silently drop
+ * the SYN to an unbound loopback port, so an unbounded connect would hang
+ * forever and deadlock isPortAvailable.
  *
- * This is more reliable than a bind-based check on macOS where
- * SO_REUSEADDR (set by default in Node.js) can allow a bind to succeed
- * even when another process is already listening on the same port.
+ * Used alongside canBindPort because it detects ports where a listener is
+ * bound with SO_REUSEADDR (Node's default on macOS), which a bind-only check
+ * would miss.
  */
-function isPortInUse(port, host) {
+function isPortInUse(port, host, timeoutMs = CONNECT_PROBE_TIMEOUT_MS) {
     return new Promise((resolve) => {
         const socket = node_net_1.default.createConnection({ port, host });
-        socket.once("connect", () => {
+        let settled = false;
+        const done = (v) => {
+            if (settled)
+                return;
+            settled = true;
             socket.destroy();
-            resolve(true);
-        });
-        socket.once("error", () => {
-            resolve(false);
-        });
+            resolve(v);
+        };
+        socket.once("connect", () => done(true));
+        socket.once("error", () => done(false));
+        setTimeout(() => done(false), timeoutMs).unref();
     });
 }
 /**
@@ -128,3 +138,5 @@ async function pickAndReservePort(preferred, retries = constants_1.RANDOM_PORT_R
     }
     throw new Error(`Unable to reserve a free port after ${retries + 1} attempts`);
 }
+// Exported for tests only.
+exports.__testing = { isPortInUse, isPortAvailable };

package/dist/run.js

@@ -229,7 +229,7 @@ function launchBundle(prepared) {
     }
     return { supervisor, backendProc, webServerPath, dumpBackendLogs };
 }
-async function runRelease({ runtimeVersion, backendPort, webPort, verbose = false, debug = false, }) {
+async function runRelease({ runtimeVersion, backendPort, webPort, verbose = false, debug = false, headless = false, }) {
     const prepared = await prepareBundleForLaunch({
         runtimeVersion,
         backendPort,
@@ -254,6 +254,10 @@ async function runRelease({ runtimeVersion, backendPort, webPort, verbose = fals
         quiet: !prepared.showOutput,
     });
     await (0, health_1.waitForUrlReady)(webUrl, webProc, healthTimeoutMs);
+    if (headless) {
+        console.log(`[kandev] ready (headless) at ${prepared.backendUrl}`);
+        return;
+    }
     console.log("[kandev] open: " + prepared.backendUrl);
     (0, web_1.openBrowser)(prepared.backendUrl);
 }

package/dist/service/args.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseServiceArgs = parseServiceArgs;
+const args_1 = require("../args");
+const VALID_ACTIONS = new Set([
+    "install",
+    "uninstall",
+    "start",
+    "stop",
+    "restart",
+    "status",
+    "logs",
+    "config",
+]);
+function parseServiceArgs(argv) {
+    if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+        return { action: "install", showHelp: true };
+    }
+    const head = argv[0];
+    if (!VALID_ACTIONS.has(head)) {
+        throw new args_1.ParseError(`unknown service action "${head}". expected one of: ${[...VALID_ACTIONS].join(", ")}`);
+    }
+    const out = { action: head };
+    for (let i = 1; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h") {
+            out.showHelp = true;
+            continue;
+        }
+        if (arg === "--system") {
+            out.system = true;
+            continue;
+        }
+        if (arg === "--no-boot-start") {
+            out.noBootStart = true;
+            continue;
+        }
+        if (arg === "-f" || arg === "--follow") {
+            out.follow = true;
+            continue;
+        }
+        if (arg === "--port") {
+            out.port = parsePort(takeValue(argv, i, "--port"), "--port");
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith("--port=")) {
+            out.port = parsePort(arg.slice("--port=".length), "--port");
+            continue;
+        }
+        if (arg === "--home-dir") {
+            out.homeDir = takeValue(argv, i, "--home-dir");
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith("--home-dir=")) {
+            const value = arg.slice("--home-dir=".length);
+            if (value.length === 0)
+                throw new args_1.ParseError("--home-dir requires a value");
+            out.homeDir = value;
+            continue;
+        }
+        throw new args_1.ParseError(`unknown flag "${arg}" for kandev service ${head}`);
+    }
+    validateActionFlags(out);
+    return out;
+}
+/**
+ * Reject flag combinations that silently no-op so the user gets immediate
+ * feedback instead of a successful command that ignored their input. The
+ * matrix is small enough that explicit checks beat a generic flag-applicability
+ * table.
+ */
+function validateActionFlags(args) {
+    if (args.follow && args.action !== "logs") {
+        throw new args_1.ParseError(`--follow only applies to 'kandev service logs', not '${args.action}'`);
+    }
+    const installOnly = ["port", "homeDir", "noBootStart"];
+    if (args.action !== "install") {
+        for (const flag of installOnly) {
+            if (args[flag] !== undefined) {
+                const display = flag === "homeDir"
+                    ? "--home-dir"
+                    : flag === "noBootStart"
+                        ? "--no-boot-start"
+                        : `--${flag}`;
+                throw new args_1.ParseError(`${display} only applies to 'kandev service install', not '${args.action}'`);
+            }
+        }
+    }
+}
+function takeValue(argv, i, flag) {
+    const v = argv[i + 1];
+    if (v === undefined || v.startsWith("-")) {
+        throw new args_1.ParseError(`${flag} requires a value`);
+    }
+    return v;
+}
+function parsePort(raw, flag) {
+    const n = Number(raw);
+    if (raw === "" || !Number.isInteger(n) || n < 1 || n > 65535) {
+        throw new args_1.ParseError(`${flag} value must be an integer between 1 and 65535, got "${raw}"`);
+    }
+    return n;
+}

package/dist/service/config.js

@@ -0,0 +1,111 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printServiceConfig = printServiceConfig;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const constants_1 = require("../constants");
+const paths_1 = require("./paths");
+const templates_1 = require("./templates");
+/**
+ * Print a human-readable summary of what kandev knows about the local
+ * service install: paths, env vars, whether a unit exists, whether it's
+ * active. Used for "why isn't it running?" diagnosis without needing to
+ * remember the right systemctl / launchctl invocation.
+ */
+function printServiceConfig(args) {
+    const isSystem = !!args.system;
+    const launcher = (0, paths_1.captureLauncher)();
+    const homeDir = (0, paths_1.resolveHomeDir)(args.homeDir, isSystem);
+    const logDir = (0, paths_1.resolveLogDir)(homeDir);
+    console.log("=== kandev service config ===");
+    console.log(`platform:        ${process.platform}`);
+    console.log(`mode:            ${isSystem ? "system" : "user"}`);
+    console.log(`launcher kind:   ${launcher.kind}`);
+    console.log(`node path:       ${launcher.nodePath}`);
+    console.log(`cli entry:       ${launcher.cliEntry}`);
+    if (launcher.bundleDir)
+        console.log(`bundle dir:      ${launcher.bundleDir}`);
+    if (launcher.version)
+        console.log(`version:         ${launcher.version}`);
+    console.log("");
+    console.log(`KANDEV_HOME_DIR: ${homeDir}`);
+    console.log(`log dir:         ${logDir}`);
+    console.log(`port:            ${args.port ?? `(default ${constants_1.DEFAULT_BACKEND_PORT})`}`);
+    if (isSystem) {
+        console.log(`run as user:     ${(0, paths_1.resolveServiceUser)(true)}`);
+    }
+    console.log("");
+    if (process.platform === "linux") {
+        printLinuxUnit(isSystem);
+    }
+    else if (process.platform === "darwin") {
+        printMacosUnit(isSystem);
+    }
+    else {
+        console.log(`unit:            (unsupported on ${process.platform})`);
+    }
+}
+function printLinuxUnit(isSystem) {
+    const unitPath = isSystem ? (0, paths_1.linuxSystemUnitPath)() : (0, paths_1.linuxUserUnitPath)();
+    console.log(`unit path:       ${unitPath}`);
+    const present = node_fs_1.default.existsSync(unitPath);
+    console.log(`installed:       ${present ? "yes" : "no"}`);
+    if (present) {
+        const content = safeRead(unitPath);
+        console.log(`managed by us:   ${content && (0, templates_1.looksLikeManagedUnit)(content) ? "yes" : "no"}`);
+    }
+    const active = systemctlIsActive(isSystem);
+    if (active !== null)
+        console.log(`active state:    ${active}`);
+}
+function printMacosUnit(isSystem) {
+    const plistPath = isSystem ? (0, paths_1.macosSystemPlistPath)() : (0, paths_1.macosUserPlistPath)();
+    console.log(`plist path:      ${plistPath}`);
+    const present = node_fs_1.default.existsSync(plistPath);
+    console.log(`installed:       ${present ? "yes" : "no"}`);
+    if (present) {
+        const content = safeRead(plistPath);
+        console.log(`managed by us:   ${content && (0, templates_1.looksLikeManagedUnit)(content) ? "yes" : "no"}`);
+    }
+    console.log(`loaded:          ${launchctlIsLoaded(isSystem) ? "yes" : "no"}`);
+}
+function safeRead(p) {
+    try {
+        return node_fs_1.default.readFileSync(p, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function systemctlIsActive(isSystem) {
+    try {
+        const args = isSystem ? ["is-active", paths_1.SERVICE_NAME] : ["--user", "is-active", paths_1.SERVICE_NAME];
+        const out = (0, node_child_process_1.execFileSync)("systemctl", args, { encoding: "utf8" });
+        return out.trim();
+    }
+    catch (err) {
+        // is-active returns nonzero for inactive/failed/unknown — read the output anyway.
+        // execFileSync attaches stdout to the thrown error; guard with a type check
+        // instead of an unsafe cast so this keeps working if the error shape changes.
+        if (err !== null && typeof err === "object" && "stdout" in err) {
+            const { stdout } = err;
+            if (stdout)
+                return String(stdout).trim();
+        }
+        return null;
+    }
+}
+function launchctlIsLoaded(isSystem) {
+    try {
+        const domain = isSystem ? "system" : `gui/${node_os_1.default.userInfo().uid}`;
+        (0, node_child_process_1.execFileSync)("launchctl", ["print", `${domain}/${paths_1.LAUNCHD_LABEL}`], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/service/health_check.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.waitForServiceHealth = waitForServiceHealth;
+exports.dumpJournalctlLogs = dumpJournalctlLogs;
+exports.dumpLaunchdLogs = dumpLaunchdLogs;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const constants_1 = require("../constants");
+const health_1 = require("../health");
+const DEFAULT_TIMEOUT_MS = 30000;
+const POLL_INTERVAL_MS = 500;
+// Per-request timeout. Without this, undici's default headersTimeout (5min)
+// can stall a single fetch — e.g. TCP accepted but the backend hangs before
+// writing response headers — and silently overrun the outer deadline.
+const REQUEST_TIMEOUT_MS = 2000;
+/**
+ * Poll the kandev /health endpoint to confirm the freshly-installed service
+ * actually came up. On success, the user gets immediate confirmation; on
+ * failure, we dump the tail of the service logs so the diagnosis isn't a
+ * scavenger hunt across `journalctl` / `tail`.
+ *
+ * Timeout is fixed at 30s — long enough to absorb a slow first launch
+ * (binary unpacking, sqlite migration), short enough to fail fast when the
+ * unit is genuinely broken.
+ */
+async function waitForServiceHealth(port, dumpLogs) {
+    const url = `http://localhost:${port ?? constants_1.DEFAULT_BACKEND_PORT}/health`;
+    const timeoutMs = (0, health_1.resolveHealthTimeoutMs)(DEFAULT_TIMEOUT_MS);
+    const deadline = Date.now() + timeoutMs;
+    process.stderr.write(`[kandev] waiting for service to be healthy at ${url}\n`);
+    while (Date.now() < deadline) {
+        try {
+            const res = await fetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+            if (res.ok) {
+                process.stderr.write(`[kandev] service is healthy\n`);
+                return;
+            }
+        }
+        catch {
+            // not up yet (or per-request timeout fired); keep polling
+        }
+        await (0, health_1.delay)(POLL_INTERVAL_MS);
+    }
+    process.stderr.write(`[kandev] service did not become healthy within ${timeoutMs}ms\n`);
+    process.stderr.write(`[kandev] dumping recent service logs:\n`);
+    dumpLogs();
+    throw new Error("kandev service was installed but the /health endpoint never responded. " +
+        "Inspect the logs above and re-run 'kandev service install' once fixed. " +
+        "If the service needs more time to come up, set KANDEV_HEALTH_TIMEOUT_MS=120000.");
+}
+/** Dump the last N lines of a systemd unit's logs via journalctl. */
+function dumpJournalctlLogs(opts) {
+    const args = opts.isSystem
+        ? ["-u", opts.unit, "-n", String(opts.lines), "--no-pager"]
+        : ["--user-unit", opts.unit, "-n", String(opts.lines), "--no-pager"];
+    try {
+        (0, node_child_process_1.spawnSync)("journalctl", args, { stdio: "inherit" });
+    }
+    catch (err) {
+        // journalctl may be unavailable in containerized or stripped-down setups.
+        // We're already in a failure path; don't compound it with a thrown error.
+        process.stderr.write(`[kandev]   (could not run journalctl: ${err instanceof Error ? err.message : String(err)})\n`);
+    }
+}
+/** Dump the last N lines of launchd-managed log files via `tail`. */
+function dumpLaunchdLogs(opts) {
+    const candidates = ["service.err", "service.out"]
+        .map((name) => node_path_1.default.join(opts.logDir, name))
+        .filter((p) => node_fs_1.default.existsSync(p));
+    if (candidates.length === 0) {
+        process.stderr.write(`[kandev]   (no logs found in ${opts.logDir})\n`);
+        return;
+    }
+    try {
+        (0, node_child_process_1.spawnSync)("tail", ["-n", String(opts.lines), ...candidates], { stdio: "inherit" });
+    }
+    catch (err) {
+        process.stderr.write(`[kandev]   (could not run tail: ${err instanceof Error ? err.message : String(err)})\n`);
+    }
+}

package/dist/service/index.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printServiceHelp = printServiceHelp;
+exports.runServiceCommand = runServiceCommand;
+const args_1 = require("./args");
+const config_1 = require("./config");
+const linux_1 = require("./linux");
+const macos_1 = require("./macos");
+function printServiceHelp() {
+    console.log(`kandev service — install kandev as an OS-managed service
+
+Usage:
+  kandev service install [--system] [--port <port>] [--home-dir <path>] [--no-boot-start]
+  kandev service uninstall [--system]
+  kandev service start|stop|restart|status [--system]
+  kandev service logs [-f] [--system]
+  kandev service config [--system]
+
+Modes:
+  default          User-level service.
+                     Linux:  ~/.config/systemd/user/kandev.service
+                     macOS:  ~/Library/LaunchAgents/com.kdlbs.kandev.plist
+                   Runs as the current user. On Linux, only starts at boot
+                   if 'loginctl enable-linger <user>' has been run.
+  --system         System-level service. Requires sudo.
+                     Linux:  /etc/systemd/system/kandev.service
+                     macOS:  /Library/LaunchDaemons/com.kdlbs.kandev.plist
+                   Starts at boot regardless of login state.
+
+Flags:
+  --port <port>        Backend port baked into the unit (KANDEV_SERVER_PORT).
+  --home-dir <path>    KANDEV_HOME_DIR baked into the unit.
+                       Defaults: ~/.kandev (user), /var/lib/kandev (system).
+  --no-boot-start      (Linux user mode) Skip the enable-linger hint.
+  -f, --follow         (logs) Stream logs instead of dumping the tail.
+
+Updates:
+  After 'npm update -g kandev' or 'brew upgrade kandev', re-run
+  'kandev service install' to refresh paths in the unit file.
+`);
+}
+async function runServiceCommand(argv) {
+    const args = (0, args_1.parseServiceArgs)(argv);
+    if (args.showHelp) {
+        printServiceHelp();
+        return;
+    }
+    // 'config' is read-only and identical across platforms — handle here so we
+    // don't need to duplicate it in both linux.ts and macos.ts.
+    if (args.action === "config") {
+        (0, config_1.printServiceConfig)(args);
+        return;
+    }
+    switch (process.platform) {
+        case "linux":
+            return (0, linux_1.runLinuxService)(args);
+        case "darwin":
+            return (0, macos_1.runMacosService)(args);
+        default:
+            throw new Error(`kandev service is not yet supported on ${process.platform}. ` +
+                `Currently supported: linux (systemd), darwin (launchd).`);
+    }
+}

package/dist/service/install_helpers.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandExists = commandExists;
+exports.writeUnitFile = writeUnitFile;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = __importDefault(require("node:fs"));
+const templates_1 = require("./templates");
+/** Cheap PATH lookup; returns true if `cmd` resolves via `which`. */
+function commandExists(cmd) {
+    const res = (0, node_child_process_1.spawnSync)("which", [cmd], { stdio: "ignore" });
+    return res.status === 0;
+}
+/**
+ * Write `content` to `targetPath` with idempotent + foreign-file handling.
+ *
+ * - Missing file → created (no warning)
+ * - Existing managed file, same content → unchanged (no write, no warning)
+ * - Existing managed file, different content → updated (overwrite, brief log)
+ * - Existing file that doesn't look managed → replaced-foreign (overwrite,
+ *   loud warning so the user notices we clobbered something)
+ *
+ * The "managed" check looks for kandev's marker substring; users who hand-edit
+ * past the marker lose the no-op shortcut but still get an "updated" log line,
+ * which is the expected workflow.
+ */
+function writeUnitFile(targetPath, content) {
+    if (!node_fs_1.default.existsSync(targetPath)) {
+        node_fs_1.default.writeFileSync(targetPath, content, { mode: 0o644 });
+        console.log(`[kandev] wrote ${targetPath}`);
+        return "created";
+    }
+    const existing = node_fs_1.default.readFileSync(targetPath, "utf8");
+    if (existing === content) {
+        console.log(`[kandev] ${targetPath} is already up to date`);
+        return "unchanged";
+    }
+    if (!(0, templates_1.looksLikeManagedUnit)(existing)) {
+        console.log(`[kandev] WARNING: ${targetPath} exists but doesn't look like a kandev-managed file.`);
+        console.log(`[kandev]   The existing file will be replaced. A backup is saved alongside.`);
+        node_fs_1.default.copyFileSync(targetPath, `${targetPath}.bak`);
+        node_fs_1.default.writeFileSync(targetPath, content, { mode: 0o644 });
+        console.log(`[kandev] replaced ${targetPath} (backup: ${targetPath}.bak)`);
+        return "replaced-foreign";
+    }
+    node_fs_1.default.writeFileSync(targetPath, content, { mode: 0o644 });
+    console.log(`[kandev] updated ${targetPath}`);
+    return "updated";
+}