orkestrator 2.26.2-beta → 2.27.0-beta

package/dist/client.js

@@ -131,22 +131,22 @@ __export(exports_standalone_service, {
   writeServiceConfig: () => writeServiceConfig
 });
 import { execFile } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3, readlinkSync } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3, readlinkSync } from "fs";
 import { copyFile, mkdir, readFile, rename, rm, symlink, writeFile } from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 import { promisify } from "util";
 function standaloneLayout(dataDir) {
-  const root = path12.join(dataDir, STANDALONE_DIRECTORY);
+  const root = path13.join(dataDir, STANDALONE_DIRECTORY);
   return {
     root,
-    releases: path12.join(root, "releases"),
-    current: path12.join(root, "current"),
-    previous: path12.join(root, "previous"),
-    serviceFile: path12.join(root, "service.json"),
-    stateFile: path12.join(root, "launcher-state.json"),
-    restartMarker: path12.join(root, "restart-requested"),
-    launcher: path12.join(root, "launcher.js"),
-    logs: path12.join(root, "logs")
+    releases: path13.join(root, "releases"),
+    current: path13.join(root, "current"),
+    previous: path13.join(root, "previous"),
+    serviceFile: path13.join(root, "service.json"),
+    stateFile: path13.join(root, "launcher-state.json"),
+    restartMarker: path13.join(root, "restart-requested"),
+    launcher: path13.join(root, "launcher.js"),
+    logs: path13.join(root, "logs")
   };
 }
 function readJson(file) {
@@ -192,28 +192,28 @@ async function writeAtomically(file, contents) {
 }
 function linkedVersion(link) {
   try {
-    return path12.basename(readlinkSync(link));
+    return path13.basename(readlinkSync(link));
   } catch {
     return null;
   }
 }
 function releaseDirectory(layout, version) {
-  return path12.join(layout.releases, version);
+  return path13.join(layout.releases, version);
 }
 function releasePackageRoot(releaseDir) {
-  return path12.join(releaseDir, "node_modules", STANDALONE_PACKAGE);
+  return path13.join(releaseDir, "node_modules", STANDALONE_PACKAGE);
 }
 function releaseEntry(releaseDir) {
-  return path12.join(releasePackageRoot(releaseDir), "bin", "orkestrator.js");
+  return path13.join(releasePackageRoot(releaseDir), "bin", "orkestrator.js");
 }
 function releaseLauncher(releaseDir) {
-  return path12.join(releasePackageRoot(releaseDir), "bin", "orkestrator-launcher.js");
+  return path13.join(releasePackageRoot(releaseDir), "bin", "orkestrator-launcher.js");
 }
 function readReleaseManifest(releaseDir) {
-  const manifest = readJson(path12.join(releasePackageRoot(releaseDir), "package.json"));
+  const manifest = readJson(path13.join(releasePackageRoot(releaseDir), "package.json"));
   if (!manifest || typeof manifest.version !== "string")
     return null;
-  if (!existsSync3(releaseEntry(releaseDir)))
+  if (!existsSync4(releaseEntry(releaseDir)))
     return null;
   return {
     version: manifest.version,
@@ -226,11 +226,11 @@ async function installRelease(layout, version, options2) {
     return target;
   const run = options2.run ?? runFile;
   await mkdir(layout.releases, { recursive: true });
-  const staging = path12.join(layout.releases, `.staging-${version}-${process.pid}`);
+  const staging = path13.join(layout.releases, `.staging-${version}-${process.pid}`);
   await rm(staging, { recursive: true, force: true });
   await mkdir(staging, { recursive: true });
   try {
-    await writeFile(path12.join(staging, "package.json"), `${JSON.stringify({
+    await writeFile(path13.join(staging, "package.json"), `${JSON.stringify({
       name: "orkestrator-release",
       private: true,
       dependencies: { [STANDALONE_PACKAGE]: version }
@@ -4876,26 +4876,26 @@ import {
   symlink as symlink2,
   utimes
 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 import { pipeline } from "stream/promises";
 import { createGunzip } from "zlib";
 function delay(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 function artifactDirectory(rootDir, artifact) {
-  return path14.join(rootDir, artifact.name, artifact.version, `${artifact.platform}-${artifact.architecture}`);
+  return path15.join(rootDir, artifact.name, artifact.version, `${artifact.platform}-${artifact.architecture}`);
 }
 function artifactExecutablePath(rootDir, artifact) {
-  return path14.join(artifactDirectory(rootDir, artifact), artifact.executable.fileName);
+  return path15.join(artifactDirectory(rootDir, artifact), artifact.executable.fileName);
 }
 function upstreamExecutablePath(rootDir, artifact) {
-  return path14.join(artifactDirectory(rootDir, artifact), `.upstream-${artifact.executable.fileName}`);
+  return path15.join(artifactDirectory(rootDir, artifact), `.upstream-${artifact.executable.fileName}`);
 }
 function artifactCompanions(artifact) {
   return artifact.companions ?? [];
 }
 function companionPath(rootDir, artifact, companion) {
-  return path14.join(artifactDirectory(rootDir, artifact), companion.fileName);
+  return path15.join(artifactDirectory(rootDir, artifact), companion.fileName);
 }
 function artifactArchiveBytes(artifact) {
   return artifactCompanions(artifact).reduce((total, companion) => total + companion.archive.size, artifact.archive.size);
@@ -4919,7 +4919,7 @@ function assertValidArtifactMetadata(artifact) {
     }
     const paths = new Set;
     for (const file of artifact.archive.bundleFiles) {
-      const normalized = path14.posix.normalize(file.path);
+      const normalized = path15.posix.normalize(file.path);
       if (normalized !== file.path || normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || paths.has(normalized) || !Number.isSafeInteger(file.size) || file.size < 1 || !/^[a-f0-9]{64}$/.test(file.sha256)) {
         throw new Error(`${artifact.name} manifest has an unsafe bundle file`);
       }
@@ -4945,7 +4945,7 @@ function assertValidArtifactMetadata(artifact) {
   }
   const activationNames = new Set([artifact.name, artifact.executable.fileName]);
   for (const alias of artifact.activationAliases ?? []) {
-    if (!alias || alias.startsWith(".") || alias.includes("/") || alias.includes("\\") || alias !== path14.basename(alias) || activationNames.has(alias)) {
+    if (!alias || alias.startsWith(".") || alias.includes("/") || alias.includes("\\") || alias !== path15.basename(alias) || activationNames.has(alias)) {
       throw new Error(`${artifact.name} manifest has an unsafe or duplicate activation alias`);
     }
     activationNames.add(alias);
@@ -4955,7 +4955,7 @@ function assertValidArtifactMetadata(artifact) {
     if (companion.archive.format !== "zip" && companion.archive.format !== "tar.gz") {
       throw new Error(`${artifact.name} companion has an unsupported archive format`);
     }
-    if (!companion.fileName || companion.fileName.startsWith(".") || companion.fileName.includes("/") || companion.fileName.includes("\\") || companion.fileName !== path14.basename(companion.fileName)) {
+    if (!companion.fileName || companion.fileName.startsWith(".") || companion.fileName.includes("/") || companion.fileName.includes("\\") || companion.fileName !== path15.basename(companion.fileName)) {
       throw new Error(`${artifact.name} companion has an unsafe file name`);
     }
     if (companionNames.has(companion.fileName)) {
@@ -5021,7 +5021,7 @@ async function isValidExecutable(rootDir, artifact) {
     if (!await isValidUpstreamExecutable(rootDir, artifact))
       return false;
     for (const bundled of artifact.archive.bundleFiles ?? []) {
-      if (!await isValidFile(path14.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
+      if (!await isValidFile(path15.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
         return false;
       }
     }
@@ -5038,7 +5038,7 @@ async function isValidExecutable(rootDir, artifact) {
     if ((file.mode & 511) !== 320)
       await chmod(executablePath, 320);
     for (const bundled of artifact.archive.bundleFiles ?? []) {
-      if (!await isValidFile(path14.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
+      if (!await isValidFile(path15.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
         return false;
       }
     }
@@ -5059,7 +5059,7 @@ async function bundleTreeEntries(directory, artifact) {
   const visit = async (currentDirectory, prefix = "") => {
     for (const entry of await readdir2(currentDirectory, { withFileTypes: true })) {
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
-      const filePath = path14.join(currentDirectory, entry.name);
+      const filePath = path15.join(currentDirectory, entry.name);
       if (entry.isDirectory()) {
         await visit(filePath, relativePath);
       } else if (entry.isFile() && !entry.isSymbolicLink()) {
@@ -5174,7 +5174,7 @@ async function initializeInstallLock(lockPath, owner, openLockFile) {
   }
 }
 async function acquireInstallLock(rootDir, onProgress, timings, openLockFile, ownerProcessExists) {
-  const lockPath = path14.join(rootDir, INSTALL_LOCK);
+  const lockPath = path15.join(rootDir, INSTALL_LOCK);
   const startedAt = Date.now();
   let announcedWait = false;
   while (Date.now() - startedAt < timings.lockWaitTimeoutMs) {
@@ -5355,8 +5355,8 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
       stream.resume();
       return;
     }
-    const normalized = path14.posix.normalize(relative);
-    if (normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || path14.isAbsolute(normalized)) {
+    const normalized = path15.posix.normalize(relative);
+    if (normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || path15.isAbsolute(normalized)) {
       extract2.destroy(new Error(`Unsafe path in ${label} bundle`));
       stream.resume();
       return;
@@ -5368,7 +5368,7 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
       stream.resume();
       return;
     }
-    const destination = path14.join(destinationDirectory, ...normalized.split("/"));
+    const destination = path15.join(destinationDirectory, ...normalized.split("/"));
     if (header.type === "directory") {
       stream.once("end", next);
       stream.resume();
@@ -5386,7 +5386,7 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
     }
     if (header.name === archive.entryPath)
       foundExecutable = true;
-    mkdir3(path14.dirname(destination), { recursive: true, mode: 448 }).then(() => pipeline(stream, createWriteStream(destination, {
+    mkdir3(path15.dirname(destination), { recursive: true, mode: 448 }).then(() => pipeline(stream, createWriteStream(destination, {
       flags: "wx",
       mode: (header.mode ?? 0) & 73 ? 320 : 256
     }))).then(() => next(), (error) => extract2.destroy(error instanceof Error ? error : new Error(String(error))));
@@ -5548,7 +5548,7 @@ async function repairInvalidMacSignature(executablePath, artifact, timeoutMs, sp
   await runCodesign(["--sign", "-", "--force", executablePath], `${artifact.name} could not be ad-hoc signed after source verification`, timeoutMs, spawnProcess);
 }
 async function prepareRepairableExecutable(sourcePath, executablePath, artifact, skipExecutableProbeForTests, processTimeoutMs, spawnProcess) {
-  const temporaryPath = path14.join(path14.dirname(executablePath), `.repair-${artifact.executable.fileName}-${randomUUID4()}.tmp`);
+  const temporaryPath = path15.join(path15.dirname(executablePath), `.repair-${artifact.executable.fileName}-${randomUUID4()}.tmp`);
   try {
     await copyFile2(sourcePath, temporaryPath);
     await chmod(temporaryPath, 448);
@@ -5580,8 +5580,8 @@ async function refreshRepairableArtifact(rootDir, artifact, skipExecutableProbeF
 async function stageCompanions(stagingDirectory, artifact, companions, fetchImpl, onBytes, startBytes, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
   let downloadedBytes = startBytes;
   for (const companion of companions) {
-    const companionArchivePath = path14.join(stagingDirectory, `.archive-${companion.fileName}.${archiveExtension(companion.archive)}`);
-    const companionFilePath = path14.join(stagingDirectory, companion.fileName);
+    const companionArchivePath = path15.join(stagingDirectory, `.archive-${companion.fileName}.${archiveExtension(companion.archive)}`);
+    const companionFilePath = path15.join(stagingDirectory, companion.fileName);
     const precedingBytes = downloadedBytes;
     await downloadArchive(companion.fileName, companion.archive, companionArchivePath, fetchImpl, (received) => onBytes(precedingBytes + received), allowInsecureDownloadsForTests, timings.downloadTimeoutMs);
     downloadedBytes += companion.archive.size;
@@ -5606,28 +5606,28 @@ async function stageCompanions(stagingDirectory, artifact, companions, fetchImpl
   }
 }
 async function repairArtifactCompanions(rootDir, artifact, companions, fetchImpl, onBytes, onVerify, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
-  const stagingDirectory = await mkdtemp2(path14.join(rootDir, `.staging-${artifact.name}-`));
+  const stagingDirectory = await mkdtemp2(path15.join(rootDir, `.staging-${artifact.name}-`));
   try {
     await stageCompanions(stagingDirectory, artifact, companions, fetchImpl, onBytes, 0, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess);
     onVerify();
     const destinationDirectory = artifactDirectory(rootDir, artifact);
     for (const companion of companions) {
-      await rename2(path14.join(stagingDirectory, companion.fileName), path14.join(destinationDirectory, companion.fileName));
+      await rename2(path15.join(stagingDirectory, companion.fileName), path15.join(destinationDirectory, companion.fileName));
     }
   } finally {
     await rm3(stagingDirectory, { recursive: true, force: true });
   }
 }
 async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
-  const stagingDirectory = await mkdtemp2(path14.join(rootDir, `.staging-${artifact.name}-`));
-  const archivePath = path14.join(stagingDirectory, `archive.${archiveExtension(artifact.archive)}`);
-  const executablePath = path14.join(stagingDirectory, artifact.executable.fileName);
-  const extractedPath = artifact.executable.repairInvalidMacSignature ? path14.join(stagingDirectory, `.upstream-${artifact.executable.fileName}`) : executablePath;
+  const stagingDirectory = await mkdtemp2(path15.join(rootDir, `.staging-${artifact.name}-`));
+  const archivePath = path15.join(stagingDirectory, `archive.${archiveExtension(artifact.archive)}`);
+  const executablePath = path15.join(stagingDirectory, artifact.executable.fileName);
+  const extractedPath = artifact.executable.repairInvalidMacSignature ? path15.join(stagingDirectory, `.upstream-${artifact.executable.fileName}`) : executablePath;
   try {
     await downloadArchive(artifact.name, artifact.archive, archivePath, fetchImpl, onBytes, allowInsecureDownloadsForTests, timings.downloadTimeoutMs);
     if (artifact.archive.bundleRoot) {
       await extractTarGzipBundle(archivePath, stagingDirectory, artifact.name, artifact.archive);
-      const bundledExecutable = path14.join(stagingDirectory, ...artifact.archive.entryPath.slice(artifact.archive.bundleRoot.length).split("/"));
+      const bundledExecutable = path15.join(stagingDirectory, ...artifact.archive.entryPath.slice(artifact.archive.bundleRoot.length).split("/"));
       if (bundledExecutable !== extractedPath) {
         await rename2(bundledExecutable, extractedPath);
       }
@@ -5678,7 +5678,7 @@ async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify,
     await stageCompanions(stagingDirectory, artifact, artifactCompanions(artifact), fetchImpl, onBytes, artifact.archive.size, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess);
     onVerify();
     const destinationDirectory = artifactDirectory(rootDir, artifact);
-    await mkdir3(path14.dirname(destinationDirectory), { recursive: true, mode: 448 });
+    await mkdir3(path15.dirname(destinationDirectory), { recursive: true, mode: 448 });
     await rm3(destinationDirectory, { recursive: true, force: true });
     await rename2(stagingDirectory, destinationDirectory);
     await chmod(destinationDirectory, 448);
@@ -5690,16 +5690,16 @@ async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify,
 }
 async function cleanStagingDirectories(rootDir) {
   const entries = await readdir2(rootDir, { withFileTypes: true });
-  await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith(".staging-")).map((entry) => rm3(path14.join(rootDir, entry.name), { recursive: true, force: true })));
+  await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith(".staging-")).map((entry) => rm3(path15.join(rootDir, entry.name), { recursive: true, force: true })));
 }
 async function touchArtifactDirectory(rootDir, artifact) {
   const now = new Date;
-  await utimes(path14.dirname(artifactDirectory(rootDir, artifact)), now, now).catch(() => {
+  await utimes(path15.dirname(artifactDirectory(rootDir, artifact)), now, now).catch(() => {
     return;
   });
 }
 function versionLeaseDirectory(rootDir, name, version) {
-  return path14.join(rootDir, LEASE_DIRECTORY, name, version);
+  return path15.join(rootDir, LEASE_DIRECTORY, name, version);
 }
 async function acquireVersionLease(rootDir, artifact, openLeaseFile) {
   const leaseKey = `${rootDir}\x00${artifact.name}\x00${artifact.version}`;
@@ -5714,7 +5714,7 @@ async function acquireVersionLease(rootDir, artifact, openLeaseFile) {
   };
   const directory = versionLeaseDirectory(rootDir, artifact.name, artifact.version);
   await mkdir3(directory, { recursive: true, mode: 448 });
-  const leasePath = path14.join(directory, `${owner.pid}-${owner.token}.json`);
+  const leasePath = path15.join(directory, `${owner.pid}-${owner.token}.json`);
   const handle = await openLeaseFile(leasePath, "wx", 384);
   try {
     await handle.writeFile(JSON.stringify(owner), "utf8");
@@ -5735,7 +5735,7 @@ async function versionHasLiveLease(rootDir, name, version, ownerProcessExists) {
   const entries = await readdir2(directory, { withFileTypes: true }).catch(() => []);
   let live = false;
   await Promise.all(entries.filter((entry) => entry.isFile()).map(async (entry) => {
-    const leasePath = path14.join(directory, entry.name);
+    const leasePath = path15.join(directory, entry.name);
     try {
       const parsed = JSON.parse(await readFile2(leasePath, "utf8"));
       if (typeof parsed.token === "string" && typeof parsed.pid === "number" && typeof parsed.createdAt === "string" && ownerProcessExists(parsed.pid)) {
@@ -5758,11 +5758,11 @@ async function pruneSupersededVersions(rootDir, artifacts, retainSupersededMs, o
   }
   const staleBefore = Date.now() - retainSupersededMs;
   await Promise.all(Array.from(keepByName, async ([name, keep]) => {
-    const toolDir = path14.join(rootDir, name);
+    const toolDir = path15.join(rootDir, name);
     try {
       const entries = await readdir2(toolDir, { withFileTypes: true });
       await Promise.all(entries.filter((entry) => entry.isDirectory() && !keep.has(entry.name)).map(async (entry) => {
-        const versionDir = path14.join(toolDir, entry.name);
+        const versionDir = path15.join(toolDir, entry.name);
         try {
           if ((await stat2(versionDir)).mtimeMs > staleBefore)
             return;
@@ -5803,8 +5803,8 @@ function activationSetId(artifacts) {
   return createHash4("sha256").update(JSON.stringify(identity)).digest("hex");
 }
 async function activateExecutables(rootDir, artifacts) {
-  const binRoot = path14.join(rootDir, "bin");
-  const binDir = path14.join(binRoot, activationSetId(artifacts));
+  const binRoot = path15.join(rootDir, "bin");
+  const binDir = path15.join(binRoot, activationSetId(artifacts));
   await mkdir3(binRoot, { recursive: true, mode: 448 });
   const binRootEntry = await lstat(binRoot);
   if (!binRootEntry.isDirectory() || binRootEntry.isSymbolicLink()) {
@@ -5819,8 +5819,8 @@ async function activateExecutables(rootDir, artifacts) {
   await chmod(binDir, 448);
   const executables = {};
   const activate = async (linkName, target) => {
-    const activePath = path14.join(binDir, linkName);
-    const temporaryLink = path14.join(binDir, `.${linkName}-${randomUUID4()}.tmp`);
+    const activePath = path15.join(binDir, linkName);
+    const temporaryLink = path15.join(binDir, `.${linkName}-${randomUUID4()}.tmp`);
     const existingTarget = await readlink(activePath).catch(() => null);
     if (existingTarget !== target) {
       await symlink2(target, temporaryLink, "file");
@@ -5868,7 +5868,7 @@ async function ensurePinnedToolchains(options2) {
   const timings = { ...DEFAULT_TIMINGS, ...options2.timingsForTests };
   const spawnProcess = options2.spawnForTests ?? spawn;
   const ownerProcessExists = options2.processExistsForTests ?? ((pid) => processExists(pid, options2.processKillForTests));
-  const rootDir = path14.join(options2.dataDir, TOOLCHAIN_DIRECTORY);
+  const rootDir = path15.join(options2.dataDir, TOOLCHAIN_DIRECTORY);
   const totalTools = artifacts.length;
   const toolFractions = new Map(artifacts.map((artifact) => [artifact.name, 0]));
   const progress = (value) => {
@@ -6033,7 +6033,7 @@ var init_agent_platforms = __esm(() => {
 
 // ../toolchain/src/platform-selection.ts
 import { promises as fs7 } from "fs";
-import path15 from "path";
+import path16 from "path";
 async function readJsonFile(filePath) {
   try {
     return JSON.parse(await fs7.readFile(filePath, "utf8"));
@@ -6042,7 +6042,7 @@ async function readJsonFile(filePath) {
   }
 }
 async function loadAgentPlatformSelection(dataDir) {
-  const config = await readJsonFile(path15.join(dataDir, AGENT_CONFIG_FILE));
+  const config = await readJsonFile(path16.join(dataDir, AGENT_CONFIG_FILE));
   if (config && typeof config === "object" && !Array.isArray(config)) {
     const global2 = config.global;
     if (global2 && typeof global2 === "object" && !Array.isArray(global2)) {
@@ -6058,7 +6058,7 @@ async function loadAgentPlatformSelection(dataDir) {
       needsFirstRunChoice: false
     };
   }
-  const sidecar = await readJsonFile(path15.join(dataDir, AGENT_PLATFORM_SELECTION_FILE));
+  const sidecar = await readJsonFile(path16.join(dataDir, AGENT_PLATFORM_SELECTION_FILE));
   if (sidecar && typeof sidecar === "object" && !Array.isArray(sidecar)) {
     const enabled = normalizeAgentPlatforms(sidecar.enabled, []);
     if (enabled.length > 0)
@@ -6074,7 +6074,7 @@ var init_platform_selection = __esm(() => {
 // ../toolchain/src/install.ts
 import { randomUUID as randomUUID5 } from "crypto";
 import { lstat as lstat2, mkdir as mkdir4, readdir as readdir3, readlink as readlink2, rename as rename3, rm as rm4, symlink as symlink3 } from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 async function resolveToolchainSelection(options2) {
   const known = Object.keys(PINNED_TOOL_VERSIONS);
   const withSupportTools = (chosen) => known.filter((name) => chosen.has(name) || isSupportToolName(name));
@@ -6133,16 +6133,16 @@ async function installPinnedToolchains(options2) {
   };
 }
 async function toolsInCurrent(rootDir) {
-  const entries = await readdir3(path16.join(rootDir, "bin", CURRENT_TOOLCHAIN_LINK)).catch(() => []);
+  const entries = await readdir3(path17.join(rootDir, "bin", CURRENT_TOOLCHAIN_LINK)).catch(() => []);
   return Object.keys(PINNED_TOOL_VERSIONS).filter((tool) => entries.includes(tool));
 }
 async function pointCurrentAt(rootDir, binDir) {
-  const binRoot = path16.join(rootDir, "bin");
-  if (path16.dirname(binDir) !== binRoot) {
+  const binRoot = path17.join(rootDir, "bin");
+  if (path17.dirname(binDir) !== binRoot) {
     throw new Error(`Activation directory ${binDir} is not directly inside ${binRoot}`);
   }
-  const link = path16.join(binRoot, CURRENT_TOOLCHAIN_LINK);
-  const target = path16.basename(binDir);
+  const link = path17.join(binRoot, CURRENT_TOOLCHAIN_LINK);
+  const target = path17.basename(binDir);
   await mkdir4(binRoot, { recursive: true, mode: 448 });
   const existing = await lstat2(link).catch(() => null);
   if (existing && !existing.isSymbolicLink()) {
@@ -6150,7 +6150,7 @@ async function pointCurrentAt(rootDir, binDir) {
   }
   if (existing && await readlink2(link) === target)
     return link;
-  const temporary = path16.join(binRoot, `.${CURRENT_TOOLCHAIN_LINK}-${randomUUID5()}.tmp`);
+  const temporary = path17.join(binRoot, `.${CURRENT_TOOLCHAIN_LINK}-${randomUUID5()}.tmp`);
   await symlink3(target, temporary, "dir");
   try {
     await rename3(temporary, link);
@@ -7444,7 +7444,7 @@ import path4 from "path";
 // ../../apps/backend/package.json
 var package_default = {
   name: "@orkestrator/backend",
-  version: "2.26.2-beta",
+  version: "2.27.0-beta",
   private: true,
   type: "module",
   exports: {
@@ -7508,6 +7508,7 @@ var DEFAULT_ALLOWED_DOMAINS = Object.freeze([
 var AGENT_NETWORK_DOMAINS_BY_PLATFORM = Object.freeze({
   codex: Object.freeze(["chatgpt.com", "auth.openai.com"]),
   cursor: Object.freeze([
+    "api.cursor.com",
     "api2.cursor.sh",
     "api3.cursor.sh",
     "api4.cursor.sh",
@@ -8257,6 +8258,10 @@ function defaultSleep(ms, signal) {
 function signalName(signal) {
   return signal?.reason === "SIGTERM" ? "SIGTERM" : "SIGINT";
 }
+function throwIfInterrupted(signal) {
+  if (signal?.aborted)
+    throw new CliError("observation-interrupted", "Interrupted");
+}
 async function observe(check, options2) {
   if (options2.timeoutMs > PUBLIC_API_LIMITS.waitMaxMs) {
     throw new CliError("invalid-input", "--timeout may be at most 24h");
@@ -10859,18 +10864,185 @@ var hostCommands = [
 
 // src/client/commands/service.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { mkdir as mkdir2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
+
+// src/client/service-connection.ts
+import path11 from "path";
+async function currentDescriptorGeneration(dataDir) {
+  try {
+    return (await readDescriptor(path11.join(dataDir, BACKEND_INSTANCE_DESCRIPTOR_FILE))).generation;
+  } catch {
+    return null;
+  }
+}
+async function awaitServiceConnection(dataDir, previousGeneration, options2) {
+  const file = path11.join(dataDir, BACKEND_INSTANCE_DESCRIPTOR_FILE);
+  try {
+    const descriptor = await observe(async () => {
+      try {
+        const value = await readDescriptor(file);
+        const fresh = value.generation !== previousGeneration && path11.resolve(value.dataDir) === path11.resolve(dataDir) && processIsAlive(value.pid);
+        return fresh ? { done: true, value } : { done: false };
+      } catch {
+        return { done: false };
+      }
+    }, options2);
+    const connection = {
+      browserUrl: descriptor.browserUrl ?? (isLoopbackHost(new URL(descriptor.url).hostname) || descriptor.endpoints?.some((endpoint) => endpoint.url === descriptor.url) ? null : descriptor.url),
+      authFile: descriptor.authFile,
+      token: null
+    };
+    try {
+      connection.token = await readTokenFile(descriptor.authFile, true);
+    } catch (error) {
+      if (!(error instanceof CliError))
+        throw error;
+      connection.credentialError = error.message;
+    }
+    throwIfInterrupted(options2.signal);
+    return connection;
+  } catch (error) {
+    if (error instanceof ObservationStopped) {
+      if (error.reason === "deadline")
+        return null;
+      throw new CliError("observation-interrupted", "Stopped waiting for the backend to start");
+    }
+    throw error;
+  }
+}
+
+// src/client/service-setup.ts
+import { existsSync as existsSync3 } from "fs";
+import os5 from "os";
+var HOSTED_WEB_ORIGINS = "https://orkestrator.dev,https://www.orkestrator.dev";
+var SSH_LOOPBACK_PORT = "34125";
+var MACOS_TAILSCALE_APP_CLI = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
+var systemSetupProbe = {
+  hasTailscaleAddress: () => Object.values(os5.networkInterfaces()).some((entries) => (entries ?? []).some((entry) => entry.family === "IPv4" && isTailscaleIPv4(entry.address))),
+  findTailscaleCli: () => {
+    if (process.platform === "darwin" && existsSync3(MACOS_TAILSCALE_APP_CLI)) {
+      return MACOS_TAILSCALE_APP_CLI;
+    }
+    return typeof Bun === "undefined" ? null : Bun.which("tailscale");
+  }
+};
+function isTailscaleIPv4(address) {
+  const [first, second] = address.split(".").map(Number);
+  return first === 100 && second !== undefined && second >= 64 && second <= 127;
+}
+function cancelled() {
+  return new CliError("invalid-input", "Setup cancelled; nothing was installed");
+}
+async function ask(io, prompt) {
+  const answer = await io.question(prompt);
+  if (answer === null)
+    throw cancelled();
+  return answer.trim();
+}
+async function choose(io, title, choices) {
+  io.stderr(`${title}
+`);
+  choices.forEach((choice, index) => io.stderr(`  ${index + 1}) ${choice.label}
+`));
+  for (;; ) {
+    const answer = await ask(io, `Choose 1-${choices.length} [1]: `);
+    if (answer === "")
+      return choices[0].value;
+    const picked = choices[Number(answer) - 1];
+    if (/^\d+$/.test(answer) && picked)
+      return picked.value;
+    io.stderr(`Enter a number from 1 to ${choices.length}.
+`);
+  }
+}
+async function confirm(io, prompt, fallback) {
+  for (;; ) {
+    const answer = (await ask(io, `${prompt} ${fallback ? "[Y/n]" : "[y/N]"} `)).toLowerCase();
+    if (answer === "")
+      return fallback;
+    if (answer === "y" || answer === "yes")
+      return true;
+    if (answer === "n" || answer === "no")
+      return false;
+    io.stderr(`Answer y or n.
+`);
+  }
+}
+function quote(arg) {
+  return /^[\w@%+=:,./-]+$/.test(arg) ? arg : `'${arg.replaceAll("'", `'\\''`)}'`;
+}
+async function askServeArguments(io, options2) {
+  const source = io;
+  io = {
+    ...source,
+    question: async (prompt) => {
+      throwIfInterrupted(options2.signal);
+      const answer = await source.question(prompt, options2.signal);
+      throwIfInterrupted(options2.signal);
+      return answer;
+    }
+  };
+  throwIfInterrupted(options2.signal);
+  const probe = options2.probe ?? systemSetupProbe;
+  io.stderr(`Set up the Orkestrator backend service.
+
+`);
+  const access = await choose(io, "How will you connect to this machine?", [
+    {
+      value: "serve",
+      label: "Tailscale with HTTPS (Tailscale Serve): the desktop app, the CLI and orkestrator.dev"
+    },
+    { value: "tailnet", label: "Tailscale address over HTTP: the desktop app and the CLI" },
+    { value: "ssh", label: "SSH only: the desktop app through an SSH tunnel, no Tailscale" }
+  ]);
+  const args = [];
+  if (access === "ssh")
+    args.push("--host", "127.0.0.1", "--allow-non-tailscale-bind");
+  if (access !== "ssh" && !probe.hasTailscaleAddress()) {
+    io.stderr(`
+This machine has no Tailscale address yet. Connect Tailscale before the service starts, or it will not serve.
+`);
+  }
+  if (access === "serve") {
+    args.push("--tailscale-serve");
+    if (!probe.findTailscaleCli()) {
+      io.stderr(`
+The Tailscale CLI was not found, and Tailscale Serve needs it.
+`);
+      const cli = await ask(io, "Path to the tailscale executable (empty to keep `tailscale`): ");
+      if (cli !== "")
+        args.push("--tailscale-bin", cli);
+    }
+    if (await confirm(io, `
+Allow the hosted web client at orkestrator.dev?`, true)) {
+      args.push("--allowed-origins", HOSTED_WEB_ORIGINS);
+    }
+  }
+  const ssh = access === "ssh" || await confirm(io, `
+Also accept desktop connections over SSH (loopback port ${SSH_LOOPBACK_PORT})?`, false);
+  if (ssh)
+    args.push("--loopback-client-port", SSH_LOOPBACK_PORT);
+  const command = [...options2.installCommand, "--", ...args].map(quote).join(" ");
+  io.stderr(`
+Equivalent command, for scripts:
+  ${command}
+
+`);
+  if (!await confirm(io, "Install with these settings?", true))
+    throw cancelled();
+  return args;
+}
 
 // src/client/service-units.ts
 import { createHash as createHash3 } from "crypto";
-import os5 from "os";
-import path11 from "path";
+import os6 from "os";
+import path12 from "path";
 function suffix(dataDir, defaultDataDir) {
-  if (path11.resolve(dataDir) === path11.resolve(defaultDataDir))
+  if (path12.resolve(dataDir) === path12.resolve(defaultDataDir))
     return "";
-  return `-${createHash3("sha256").update(path11.resolve(dataDir)).digest("hex").slice(0, 8)}`;
+  return `-${createHash3("sha256").update(path12.resolve(dataDir)).digest("hex").slice(0, 8)}`;
 }
 function xml(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
@@ -10879,7 +11051,7 @@ function systemdWord(text) {
   return `"${text.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("%", "%%")}"`;
 }
 function serviceUnit(options2) {
-  const home = options2.home ?? os5.homedir();
+  const home = options2.home ?? os6.homedir();
   const tag = suffix(options2.dataDir, options2.defaultDataDir);
   const pathValue = options2.env.PATH ?? "/usr/local/bin:/usr/bin:/bin";
   if (options2.platform === "darwin") {
@@ -10889,7 +11061,7 @@ function serviceUnit(options2) {
     return {
       manager: "launchd",
       name,
-      file: path11.join(home, "Library", "LaunchAgents", `${name}.plist`),
+      file: path12.join(home, "Library", "LaunchAgents", `${name}.plist`),
       contents: `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -10923,11 +11095,11 @@ ${args}
     };
   }
   const name = `orkestrator-backend${tag}.service`;
-  const configHome = options2.env.XDG_CONFIG_HOME ?? path11.join(home, ".config");
+  const configHome = options2.env.XDG_CONFIG_HOME ?? path12.join(home, ".config");
   return {
     manager: "systemd",
     name,
-    file: path11.join(configHome, "systemd", "user", name),
+    file: path12.join(configHome, "systemd", "user", name),
     contents: `[Unit]
 Description=Orkestrator backend (${options2.dataDir})
 After=network-online.target
@@ -10980,9 +11152,26 @@ var DATA_DIR_OPTION = {
   valueName: "DIR",
   description: "Backend data directory. Defaults to ORKESTRATOR_DATA_DIR, then the platform default."
 };
+var DEFAULT_READY_WAIT_MS = 3 * 60 * 1000;
 var RESERVED_SERVE_FLAGS = new Set(["--data-dir", "--standalone-updater", "--desktop-updater"]);
 function dataDirectory(context, parsed) {
-  return path13.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
+  return path14.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
+}
+function installCommandLine(parsed) {
+  const line = ["bunx", "orkestrator", "service", "install"];
+  for (const name of ["data-dir", "release", "timeout"]) {
+    const value = parsed.options[name];
+    if (typeof value === "string")
+      line.push(`--${name}`, value);
+    else if (typeof value === "number")
+      line.push(`--${name}`, `${Math.ceil(value / 1000)}s`);
+  }
+  for (const name of ["skip-start", "dry-run"]) {
+    if (parsed.options[name] === true)
+      line.push(`--${name}`);
+  }
+  line.push("--yes");
+  return line;
 }
 function unitFor(context, dataDir, bun) {
   if (process.platform !== "darwin" && process.platform !== "linux") {
@@ -10999,7 +11188,7 @@ function unitFor(context, dataDir, bun) {
         defaultDataDir: defaultDataDir(process.platform, context.io.env),
         bun,
         launcher: layout.launcher,
-        logFile: path13.join(layout.logs, "service.log"),
+        logFile: path14.join(layout.logs, "service.log"),
         env: context.io.env
       })
     };
@@ -11025,8 +11214,13 @@ var serviceCommands = [
       "previous release when a new one fails to start twice.",
       "",
       "Arguments after `--` are passed to `orkestrator serve` (for example `--tailscale-serve`).",
+      "With none, in a terminal, it asks how clients will connect (Tailscale Serve, the",
+      "tailnet address or SSH) and prints the equivalent command; --yes skips the questions.",
       "The Bun running this command is the Bun the service uses; reinstall to change it.",
-      "On Linux, run `loginctl enable-linger $USER` so the service runs without a login."
+      "On Linux, run `loginctl enable-linger $USER` so the service runs without a login.",
+      "",
+      "Once the service is running, the address it serves and its gateway token are printed.",
+      "The token is shown only in this terminal: never in --output json or the service log."
     ].join(`
 `),
     positionals: [],
@@ -11047,11 +11241,23 @@ var serviceCommands = [
         name: "dry-run",
         kind: "boolean",
         description: "Show what would be written without installing anything."
+      },
+      {
+        name: "yes",
+        kind: "boolean",
+        description: "Install with the arguments after `--` (or none) without asking."
+      },
+      {
+        name: "timeout",
+        kind: "duration",
+        valueName: "DURATION",
+        description: "How long to wait for the service to start before printing its address and token. Default 3m; 0 skips the wait."
       }
     ],
     acceptsRest: true,
     local: true,
     examples: [
+      "orkestrator service install",
       "orkestrator service install -- --tailscale-serve",
       "orkestrator service install --release 2.22.0 -- --host 100.64.0.1",
       "orkestrator service install --dry-run"
@@ -11066,6 +11272,15 @@ var serviceCommands = [
       if (reserved) {
         throw new CliError("invalid-input", `${reserved} is set by the service; leave it out`);
       }
+      const interactive = parsed.rest.length === 0 && parsed.options.yes !== true && context.global.output === "human" && context.io.stdinIsTty && context.io.question !== undefined;
+      const readyWaitMs = typeof parsed.options.timeout === "number" ? parsed.options.timeout : DEFAULT_READY_WAIT_MS;
+      if (readyWaitMs > PUBLIC_API_LIMITS.waitMaxMs) {
+        throw new CliError("invalid-input", "--timeout may be at most 24h");
+      }
+      const serveArgs = interactive ? await askServeArguments(context.io, {
+        installCommand: installCommandLine(parsed),
+        signal: context.signal
+      }) : parsed.rest;
       const bun = process.execPath;
       const bunVersion = typeof Bun === "undefined" ? "" : Bun.version;
       const { service, layout, unit } = await unitFor(context, dataDir, bun);
@@ -11074,7 +11289,7 @@ var serviceCommands = [
         version,
         bun,
         bunVersion,
-        args: parsed.rest,
+        args: serveArgs,
         unit: { manager: unit.manager, name: unit.name, file: unit.file },
         release: service.releaseDirectory(layout, version)
       };
@@ -11088,7 +11303,7 @@ var serviceCommands = [
               ["release", `${version} \u2192 ${summary.release}`],
               ["bun", `${bun} (${bunVersion})`],
               ["unit", `${unit.manager} ${unit.name} \u2192 ${unit.file}`],
-              ["serve arguments", parsed.rest.join(" ") || "(none)"]
+              ["serve arguments", serveArgs.join(" ") || "(none)"]
             ]),
             "",
             "Dry run: nothing was installed."
@@ -11097,6 +11312,7 @@ var serviceCommands = [
       }
       context.io.stderr(`Installing orkestrator@${version}\u2026
 `);
+      throwIfInterrupted(context.signal);
       let releaseDir;
       try {
         releaseDir = await service.installRelease(layout, version, { bun });
@@ -11110,28 +11326,59 @@ var serviceCommands = [
         dataDir,
         bun,
         bunVersion,
-        args: parsed.rest,
+        args: serveArgs,
         installedAt: new Date().toISOString()
       });
       await mkdir2(layout.logs, { recursive: true });
-      await mkdir2(path13.dirname(unit.file), { recursive: true });
+      await mkdir2(path14.dirname(unit.file), { recursive: true });
       await writeFile2(unit.file, unit.contents);
       const started = parsed.options["skip-start"] !== true;
+      const logFile = path14.join(layout.logs, "service.log");
+      let connection = null;
       if (started) {
+        const previousGeneration = await currentDescriptorGeneration(dataDir);
         const commands = serviceManagerCommands(unit);
         commands.load.forEach((argv, index) => runManager(argv, unit.manager === "launchd" && index === 0));
+        if (readyWaitMs > 0) {
+          context.io.stderr(`Waiting for the backend to start\u2026
+`);
+          connection = await awaitServiceConnection(dataDir, previousGeneration, {
+            timeoutMs: readyWaitMs,
+            signal: context.signal
+          });
+        }
       }
       return {
         action: "service.install",
-        result: { dryRun: false, started, ...summary },
+        result: {
+          dryRun: false,
+          started,
+          ready: connection !== null,
+          browserUrl: connection?.browserUrl ?? null,
+          authFile: connection?.authFile ?? null,
+          ...connection?.credentialError ? { credentialError: connection.credentialError } : {},
+          ...summary
+        },
         human: [
           ...keyValues([
             ["release", `${version} (${releaseDir})`],
             ["unit", `${unit.manager} ${unit.name}`],
-            ["logs", path13.join(layout.logs, "service.log")]
+            ["logs", logFile]
           ]),
           "",
           started ? "The service is running. Remote clients can update it from Settings \u2192 Machines or `orkestrator host update`." : `The unit is written but not loaded; load it with: ${serviceManagerCommands(unit).load.at(-1).join(" ")}`,
+          ...connection ? [
+            "",
+            ...keyValues([
+              ["address", connection.browserUrl ?? "(no browser listener; see the log)"],
+              ["auth file", connection.authFile],
+              ...context.io.stdoutIsTty && context.global.output === "human" && connection.token ? [["token", connection.token]] : []
+            ]),
+            ...connection.credentialError ? [`Credential file error: ${connection.credentialError}`] : context.io.stdoutIsTty && context.global.output === "human" ? ["Keep the token private: it grants full access to this backend."] : ["Read the gateway token locally from the private auth file."]
+          ] : started && readyWaitMs > 0 ? [
+            "",
+            `The backend has not reported ready yet. Follow ${logFile}; its address and token file are logged there.`
+          ] : [],
           ...unit.manager === "systemd" ? ["Run `loginctl enable-linger $USER` so it keeps running after you log out."] : []
         ]
       };
@@ -11154,7 +11401,7 @@ var serviceCommands = [
       const dataDir = dataDirectory(context, parsed);
       const { service, layout, unit } = await unitFor(context, dataDir, process.execPath);
       const config = service.readServiceConfig(layout);
-      if (existsSync4(unit.file)) {
+      if (existsSync5(unit.file)) {
         for (const argv of serviceManagerCommands(unit).unload)
           runManager(argv, true);
         await rm2(unit.file, { force: true });
@@ -11182,7 +11429,7 @@ var serviceCommands = [
       const { service, layout, unit } = await unitFor(context, dataDir, process.execPath);
       const config = service.readServiceConfig(layout);
       const state = service.readLauncherState(layout);
-      const installed = existsSync4(unit.file);
+      const installed = existsSync5(unit.file);
       const running = installed ? runManager(serviceManagerCommands(unit).status, true).ok : false;
       const result = {
         dataDir,
@@ -12375,9 +12622,9 @@ var sessionCommands = [
 ];
 
 // src/client/commands/toolchain.ts
-import path17 from "path";
+import path18 from "path";
 function dataDirectory2(context, parsed) {
-  return path17.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
+  return path18.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
 }
 function requestedTools(parsed) {
   const raw = parsed.options.tool;
@@ -12480,7 +12727,7 @@ var toolchainCommands = [
       const rows = installed.tools.map((tool) => ({
         tool,
         version: installed.versions[tool] ?? "",
-        executable: path17.join(installed.currentBinDir, path17.basename(installed.executables[tool]))
+        executable: path18.join(installed.currentBinDir, path18.basename(installed.executables[tool]))
       }));
       return {
         action: "toolchain.install",
@@ -12744,6 +12991,53 @@ function defaultHuman(result) {
 `);
 }
 
+// src/client/questions.ts
+import { createInterface } from "readline/promises";
+function terminalQuestions(input, output, onInterrupt) {
+  let reader;
+  let ended = false;
+  return {
+    async question(prompt, signal) {
+      throwIfInterrupted(signal);
+      if (ended)
+        return null;
+      if (!reader) {
+        reader = createInterface({ input, output });
+        reader.once("close", () => {
+          ended = true;
+        });
+        reader.on("SIGINT", onInterrupt);
+      }
+      const current = reader;
+      let onClose = () => {};
+      let onAbort = () => {};
+      try {
+        return await new Promise((resolve, reject) => {
+          onClose = () => resolve(null);
+          onAbort = () => {
+            reject(new CliError("observation-interrupted", "Interrupted"));
+            current.close();
+          };
+          current.once("close", onClose);
+          signal?.addEventListener("abort", onAbort, { once: true });
+          if (signal?.aborted) {
+            onAbort();
+            return;
+          }
+          current.question(prompt).then(resolve, reject);
+        });
+      } finally {
+        current.off("close", onClose);
+        signal?.removeEventListener("abort", onAbort);
+      }
+    },
+    close() {
+      ended = true;
+      reader?.close();
+    }
+  };
+}
+
 // src/client/main.ts
 var CLIENT_COMMANDS = [
   ...connectionCommands,
@@ -12864,6 +13158,7 @@ async function runClientProcess(argv, version) {
   };
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
+  const questions = terminalQuestions(process.stdin, process.stderr, () => onSignal("SIGINT"));
   const io = {
     stdout: (text) => process.stdout.write(text),
     stdoutBytes: (bytes) => process.stdout.write(Buffer.from(bytes)),
@@ -12875,11 +13170,14 @@ async function runClientProcess(argv, version) {
     env: process.env,
     cwd: process.cwd(),
     now: () => Date.now(),
-    stdinIsTty: Boolean(process.stdin.isTTY)
+    stdinIsTty: Boolean(process.stdin.isTTY),
+    stdoutIsTty: Boolean(process.stdout.isTTY),
+    question: questions.question
   };
   try {
     return await runClient(argv, { io, version, signal: controller.signal });
   } finally {
+    questions.close();
     process.off("SIGINT", onSignal);
     process.off("SIGTERM", onSignal);
   }