pushary 1.9.136 → 1.9.138

package/dist/{chunk-NZD6ISCL.js → chunk-5ZK4RHYR.js}

@@ -1,6 +1,6 @@
 import {
   parseSseMessages
-} from "./chunk-WXUEOHYY.js";
+} from "./chunk-DK6CMXYI.js";
 import {
   fetchAsCredential
 } from "./chunk-VVN3RPV6.js";

package/dist/{chunk-FAF5RDWT.js → chunk-6TK3DWSF.js}

@@ -4,16 +4,16 @@ import {
 } from "./chunk-H6CL3T2S.js";
 import {
   getMachineId
-} from "./chunk-WNT4JHK3.js";
+} from "./chunk-EHQCMJHI.js";
 import {
   readControlMode
 } from "./chunk-PNVTPEO5.js";
 import {
   pusharyDir
-} from "./chunk-R7KC57PC.js";
+} from "./chunk-TN5PGMH5.js";
 import {
   resolveGlobalBinary
-} from "./chunk-GS5FH3C2.js";
+} from "./chunk-FYLYAVQG.js";
 import {
   getApiKey
 } from "./chunk-IKBTG3OT.js";
@@ -34,9 +34,158 @@ import {
   isRecord
 } from "./chunk-DL67HX3D.js";
 
+// src/daemon-entry-guard.ts
+import { mkdirSync, readFileSync } from "fs";
+import { basename, dirname, join } from "path";
+var DAEMON_ENTRY_GUARD_SOURCE = [
+  "const { existsSync } = require('node:fs')",
+  "if (process.argv[1] && !existsSync(process.argv[1])) process.exit(0)",
+  ""
+].join("\n");
+var DAEMON_ENTRY_GUARD_FILE = "daemon-entry-guard.cjs";
+var NODE_EXECUTABLE = /^node(?:\.exe)?$/i;
+var ENTRY_GUARD_PRELOAD_FLAG = "--require";
+var UNGUARDED = { kind: "unguarded" };
+var daemonEntryGuardPath = (stateDir) => join(stateDir, DAEMON_ENTRY_GUARD_FILE);
+var entryGuardApplies = (platform, execPath) => platform === "darwin" && NODE_EXECUTABLE.test(basename(execPath));
+var holdsDaemonEntryGuard = (path) => {
+  try {
+    return readFileSync(path, "utf8") === DAEMON_ENTRY_GUARD_SOURCE;
+  } catch {
+    return false;
+  }
+};
+var writeDaemonEntryGuardAt = (path) => {
+  if (holdsDaemonEntryGuard(path)) return { kind: "in-place" };
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    writeFileAtomic(path, DAEMON_ENTRY_GUARD_SOURCE, 384);
+    return { kind: "in-place" };
+  } catch (error) {
+    return { kind: "failed", detail: error instanceof Error ? error.message : String(error) };
+  }
+};
+var writeDaemonEntryGuard = (input) => {
+  if (!entryGuardApplies(input.platform, input.execPath)) return UNGUARDED;
+  const path = daemonEntryGuardPath(input.stateDir);
+  const written = writeDaemonEntryGuardAt(path);
+  if (written.kind === "in-place") return { kind: "guarded", path };
+  input.warn(`[pushary] could not write ${path}, so the background service was installed without its uninstall guard: ${written.detail}
+`);
+  return UNGUARDED;
+};
+
+// src/daemon-supervisor.ts
+import { join as join2 } from "path";
+var DAEMON_SUPERVISOR_SCRIPT = "pushary-daemon-supervisor.js";
+var SUPERVISOR_LAUNCH_FLAG = "--launch";
+var DAEMON_LOG_FILE = "daemon.log";
+var DAEMON_ERROR_LOG_FILE = "daemon-error.log";
+var supervisorTaskArguments = (daemonEntry, stateDir) => [daemonEntry, stateDir, SUPERVISOR_LAUNCH_FLAG];
+var parseSupervisorInvocation = (args) => {
+  const launching = args.length > 1 && args[args.length - 1] === SUPERVISOR_LAUNCH_FLAG;
+  const [daemonEntry, stateDir] = launching ? args.slice(0, -1) : args;
+  if (!daemonEntry || daemonEntry === SUPERVISOR_LAUNCH_FLAG) return { kind: "missing-entry" };
+  return { kind: launching ? "launch" : "supervise", daemonEntry, stateDir: stateDir || null };
+};
+
+// src/diagnostics/service-runtime.ts
+var unescapeXml = (value) => value.replaceAll("&quot;", '"').replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+var unquoteSystemdExecutable = (value) => value.replace(/\\(["\\])|%(%)/g, (_match, escaped, percent) => escaped ?? percent ?? "");
+var unquoteSystemdArgument = (value) => value.replace(/\\(["\\])|%(%)|\$(\$)/g, (_match, escaped, percent, dollar) => escaped ?? percent ?? dollar ?? "");
+var readServiceExecPath = (contents, platform) => {
+  if (platform === "darwin") {
+    const program = contents.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]*)<\/string>/)?.[1];
+    return program ? unescapeXml(program) : null;
+  }
+  if (platform === "linux") {
+    const exec = contents.match(/^ExecStart="((?:[^"\\]|\\.)*)"/m)?.[1];
+    return exec ? unquoteSystemdExecutable(exec) : null;
+  }
+  if (platform === "win32") {
+    const command = contents.match(/<Command>([^<]*)<\/Command>/)?.[1];
+    return command ? unescapeXml(command) : null;
+  }
+  return null;
+};
+var readLaunchdProgramArguments = (contents) => {
+  const array = contents.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/)?.[1] ?? "";
+  return [...array.matchAll(/<string>([^<]*)<\/string>/g)].map((match) => unescapeXml(match[1] ?? ""));
+};
+var systemdExecStartArguments = (contents) => {
+  const line = contents.match(/^ExecStart=(.*)$/m)?.[1] ?? "";
+  return [...line.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((match, index) => (index === 0 ? unquoteSystemdExecutable : unquoteSystemdArgument)(match[1] ?? ""));
+};
+var windowsTaskArguments = (contents) => {
+  const args = unescapeXml(contents.match(/<Arguments>([^<]*)<\/Arguments>/)?.[1] ?? "");
+  return [...args.matchAll(/"([^"]*)"/g)].map((match) => match[1] ?? "");
+};
+var serviceArguments = (contents, platform) => {
+  if (platform === "darwin") return readLaunchdProgramArguments(contents);
+  if (platform === "linux") return systemdExecStartArguments(contents);
+  if (platform === "win32") return windowsTaskArguments(contents);
+  return [];
+};
+var namesTheSupervisor = (path) => path.split(/[\\/]/).at(-1) === DAEMON_SUPERVISOR_SCRIPT;
+var windowsTaskDaemonEntry = (contents) => {
+  const [program, ...supervisorArguments] = windowsTaskArguments(contents);
+  if (program === void 0) return null;
+  if (!namesTheSupervisor(program)) return program;
+  const invocation = parseSupervisorInvocation(supervisorArguments);
+  return invocation.kind === "missing-entry" ? null : invocation.daemonEntry;
+};
+var readServiceDaemonEntry = (contents, platform) => platform === "win32" ? windowsTaskDaemonEntry(contents) : serviceArguments(contents, platform).at(-1) ?? null;
+var readServiceEntryGuard = (contents, platform) => {
+  if (platform !== "darwin") return null;
+  const [, flag, guard] = readLaunchdProgramArguments(contents);
+  return flag === ENTRY_GUARD_PRELOAD_FLAG && guard !== void 0 ? guard : null;
+};
+var serviceStartFileChecks = (contents, platform, exists) => {
+  const checks = [];
+  const entry = readServiceDaemonEntry(contents, platform);
+  if (entry !== null) {
+    const present = exists(entry);
+    checks.push({
+      label: "Remote-control service entry",
+      passed: present,
+      detail: present ? entry : `${entry} is gone, so the background service starts nothing at login; run \`pushary daemon install\` from the Pushary install you use`
+    });
+  }
+  const guard = readServiceEntryGuard(contents, platform);
+  if (guard !== null && !exists(guard)) {
+    checks.push({
+      label: "Remote-control service start guard",
+      passed: false,
+      detail: `${guard} is gone, so the background service cannot start; run \`pushary daemon install\` to restore it`
+    });
+  }
+  return checks;
+};
+var MANAGER_SEGMENTS = [
+  [".nvm", "nvm"],
+  ["nvm", "nvm"],
+  ["fnm", "fnm"],
+  [".fnm", "fnm"],
+  [".volta", "volta"],
+  ["volta", "volta"],
+  [".asdf", "asdf"],
+  ["asdf", "asdf"],
+  ["Cellar", "homebrew"]
+];
+var versionManagerOf = (execPath) => {
+  const segments = execPath.split(/[/\\]/);
+  for (const segment of segments) {
+    const hit = MANAGER_SEGMENTS.find(([name]) => name === segment);
+    if (hit) return hit[1];
+  }
+  return null;
+};
+var describeVersionManagerPin = (execPath, manager) => `The background service is pinned to ${execPath}, which ${manager} manages. Switching or upgrading Node strands it; run pushary daemon install afterwards.`;
+var describeServiceNodeRisk = (manager) => manager === "homebrew" ? "a Homebrew version folder; brew upgrade strands the service, and `pushary daemon install` repins it to the stable link" : `managed by ${manager}; a version switch strands the service`;
+
 // src/daemon-lifecycle.ts
-import { dirname, join, win32 as win32Path } from "path";
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { dirname as dirname2, join as join3, win32 as win32Path } from "path";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { createHash, randomUUID } from "crypto";
 import { homedir, uptime, userInfo } from "os";
 import { execFileSync } from "child_process";
@@ -55,7 +204,7 @@ var remoteProofIsFresh = (timestamp, now) => {
 };
 var daemonHasRemoteProof = (status, now = Date.now()) => status.kind === "running" && remoteProofIsFresh(status.lastSuccessfulHeartbeatAt, now) && remoteProofIsFresh(status.lastSuccessfulControlAt, now);
 var readServiceDefinitionFile = (path) => {
-  const bytes = readFileSync(path);
+  const bytes = readFileSync2(path);
   const encoding = bytes.length >= 2 && bytes[0] === 255 && bytes[1] === 254 ? "utf16le" : "utf-8";
   return { contents: bytes.toString(encoding), encoding };
 };
@@ -105,9 +254,9 @@ var daemonServiceManagerAvailable = (options = {}) => {
   }
 };
 var DAEMON_STATE_FILE = "daemon-state.json";
-var statePath = (dir) => join(dir, DAEMON_STATE_FILE);
-var lockPath = (dir) => join(dir, "daemon.lock");
-var targetPath = (dir) => join(dir, "daemon-target.json");
+var statePath = (dir) => join3(dir, DAEMON_STATE_FILE);
+var lockPath = (dir) => join3(dir, "daemon.lock");
+var targetPath = (dir) => join3(dir, "daemon-target.json");
 var DAEMON_LEASE_RENEW_INTERVAL_MS = 3e4;
 var LOCAL_LEASE_TIMEOUT_MS = DAEMON_LEASE_RENEW_INTERVAL_MS * 3;
 var DAEMON_YIELD_CHECK_INTERVAL_MS = 2e3;
@@ -117,28 +266,56 @@ var buildDaemonLaunch = (input) => input.siblingEntry ? { command: input.execPat
   shell: needsShell(input.daemonBinary, input.platform ?? process.platform)
 };
 var xml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-var systemdQuote = (value) => `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+var WINDOWS_TASK_NAME = "Pushary Daemon";
+var POWERSHELL_SINGLE_QUOTES = /['\u2018\u2019\u201A\u201B]/g;
+var powershellLiteral = (value) => `'${value.replace(POWERSHELL_SINGLE_QUOTES, (quote) => quote + quote)}'`;
+var WQL_LIKE_SPECIALS = /[[%_]/g;
+var wqlLikeLiteral = (value) => value.replace(WQL_LIKE_SPECIALS, (special) => `[${special}]`);
+var WINDOWS_TASK_LOOKUP = `$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq ${powershellLiteral(WINDOWS_TASK_NAME)} -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }`;
+var POWERSHELL_HOSTS = ["powershell.exe", "pwsh.exe"];
+var withoutTrailingSeparators = (path) => path.replace(/[\\/]+$/, "");
+var POWERSHELL_STOP_ON_ERROR = "$ErrorActionPreference = 'Stop'";
+var powershellCommandLineContains = (text) => `$_.CommandLine.ToUpperInvariant().Contains(${powershellLiteral(text)}.ToUpperInvariant())`;
+var powershellCommandLineEndsWithLaunchFlag = `$_.CommandLine.TrimEnd().TrimEnd([char]34).EndsWith(${powershellLiteral(SUPERVISOR_LAUNCH_FLAG)})`;
+var windowsSupervisorProcesses = (stateDir) => [
+  `@(Get-CimInstance -ClassName Win32_Process -Filter ${powershellLiteral(`CommandLine LIKE '%${wqlLikeLiteral(DAEMON_SUPERVISOR_SCRIPT)}%'`)}`,
+  `| Where-Object { $_.ProcessId -ne $PID -and ${POWERSHELL_HOSTS.map((host) => `$_.Name -ne ${powershellLiteral(host)}`).join(" -and ")}`,
+  `-and $null -ne $_.CommandLine -and ${powershellCommandLineContains(withoutTrailingSeparators(stateDir))} })`
+].join(" ");
+var windowsRunningSupervisors = (stateDir) => `@(${windowsSupervisorProcesses(stateDir)} | Where-Object { -not (${powershellCommandLineEndsWithLaunchFlag}) })`;
+var taskArgument = (value) => `&quot;${xml(value)}&quot;`;
+var systemdQuotedEnvironment = (value) => `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+var escapeSystemdSpecifiers = (value) => value.replaceAll("%", "%%");
+var systemdQuotedWord = (escaped) => `"${escaped.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+var systemdExecutableWord = (value) => systemdQuotedWord(escapeSystemdSpecifiers(value));
+var systemdArgumentWord = (value) => systemdQuotedWord(escapeSystemdSpecifiers(value).replaceAll("$", "$$$$"));
+var systemdExecLine = (executable, args) => [systemdExecutableWord(executable), ...args.map(systemdArgumentWord)].join(" ");
+var ENTRY_PRESENT_CHECK = "process.exit(require('node:fs').existsSync(process.argv[1]) ? 0 : 1)";
+var guardedLaunchdProgram = (input) => {
+  const guard = input.entryGuard ?? UNGUARDED;
+  return guard.kind === "guarded" ? [input.execPath, ENTRY_GUARD_PRELOAD_FLAG, guard.path, input.daemonEntry] : [input.execPath, input.daemonEntry];
+};
 var buildDaemonService = (input) => {
   if (input.platform === "darwin") {
     if (!Number.isInteger(input.uid) || input.uid < 0) return null;
     const label = "com.pushary.daemon";
     const domain = `gui/${input.uid}`;
     const target = `${domain}/${label}`;
-    const definitionPath = join(input.homeDir, "Library", "LaunchAgents", `${label}.plist`);
+    const definitionPath = join3(input.homeDir, "Library", "LaunchAgents", `${label}.plist`);
     const contents = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key><string>${label}</string>
   <key>ProgramArguments</key>
-  <array><string>${xml(input.execPath)}</string><string>${xml(input.daemonEntry)}</string></array>
+  <array>${guardedLaunchdProgram(input).map((argument) => `<string>${xml(argument)}</string>`).join("")}</array>
   <key>WorkingDirectory</key><string>${xml(input.homeDir)}</string>
   <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(input.pathEnv)}</string></dict>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
   <key>ThrottleInterval</key><integer>10</integer>
-  <key>StandardOutPath</key><string>${xml(join(input.stateDir, "daemon.log"))}</string>
-  <key>StandardErrorPath</key><string>${xml(join(input.stateDir, "daemon-error.log"))}</string>
+  <key>StandardOutPath</key><string>${xml(join3(input.stateDir, DAEMON_LOG_FILE))}</string>
+  <key>StandardErrorPath</key><string>${xml(join3(input.stateDir, DAEMON_ERROR_LOG_FILE))}</string>
 </dict>
 </plist>
 `;
@@ -157,6 +334,8 @@ var buildDaemonService = (input) => {
       disable: [{ command: "launchctl", args: ["disable", target] }],
       canDisableWhenUnregistered: true,
       uninstall: [{ command: "launchctl", args: ["bootout", domain, definitionPath], ignoreFailure: true }],
+      platform: input.platform,
+      startGuardPath: daemonEntryGuardPath(input.stateDir),
       registrationProbe: {
         command: "launchctl",
         args: ["print", target],
@@ -177,15 +356,17 @@ var buildDaemonService = (input) => {
   }
   if (input.platform === "linux") {
     const unit = "pushary-daemon.service";
-    const definitionPath = join(input.homeDir, ".config", "systemd", "user", unit);
+    const definitionPath = join3(input.homeDir, ".config", "systemd", "user", unit);
     const contents = `[Unit]
 Description=Pushary phone-to-agent daemon
 After=network-online.target
+ConditionPathExists=${escapeSystemdSpecifiers(input.daemonEntry)}
 
 [Service]
 Type=simple
-ExecStart=${systemdQuote(input.execPath)} ${systemdQuote(input.daemonEntry)}
-Environment=${systemdQuote(`PATH=${input.pathEnv}`)}
+ExecCondition=${systemdExecLine(input.execPath, ["-e", ENTRY_PRESENT_CHECK, input.daemonEntry])}
+ExecStart=${systemdExecLine(input.execPath, [input.daemonEntry])}
+Environment=${systemdQuotedEnvironment(`PATH=${input.pathEnv}`)}
 Restart=on-failure
 RestartSec=10
 KillMode=process
@@ -216,18 +397,20 @@ WantedBy=default.target
         args: ["--user", "is-active", unit],
         negativeOutputPattern: /^(?:inactive|failed|unknown|activating|deactivating)\s*$/m
       },
-      reloadAfterUninstall: { command: "systemctl", args: ["--user", "daemon-reload"] }
+      reloadAfterUninstall: { command: "systemctl", args: ["--user", "daemon-reload"] },
+      platform: input.platform,
+      startGuardPath: null
     };
   }
   if (input.platform === "win32") {
-    const taskName = "Pushary Daemon";
+    const taskName = WINDOWS_TASK_NAME;
     const username = process.env.USERNAME?.trim() || userInfo().username;
     const domain = process.env.USERDOMAIN?.trim();
     const userId = input.userId?.trim() || (domain ? `${domain}\\${username}` : username);
     const definitionPath = win32Path.join(input.stateDir, "pushary-daemon-task.xml");
-    const supervisorPath = win32Path.join(win32Path.dirname(input.daemonEntry), "pushary-daemon-supervisor.js");
+    const supervisorPath = win32Path.join(win32Path.dirname(input.daemonEntry), DAEMON_SUPERVISOR_SCRIPT);
     const supervised = (input.entryExists ?? existsSync)(supervisorPath);
-    const args = supervised ? `&quot;${xml(supervisorPath)}&quot; &quot;${xml(input.daemonEntry)}&quot;` : `&quot;${xml(input.daemonEntry)}&quot;`;
+    const args = supervised ? [supervisorPath, ...supervisorTaskArguments(input.daemonEntry, withoutTrailingSeparators(input.stateDir))].map(taskArgument).join(" ") : taskArgument(input.daemonEntry);
     const contents = `\uFEFF<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo><Description>Pushary phone-to-agent daemon</Description></RegistrationInfo>
@@ -250,25 +433,41 @@ WantedBy=default.target
   </Actions>
 </Task>
 `;
+    const stopTaskAndSupervisors = [
+      { command: "schtasks.exe", args: ["/End", "/TN", taskName], ignoreFailure: true },
+      {
+        command: "powershell.exe",
+        args: [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `${POWERSHELL_STOP_ON_ERROR}; ${windowsSupervisorProcesses(input.stateDir)} | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }`
+        ],
+        ignoreFailure: true
+      }
+    ];
     return {
       definitionPath,
       contents,
       encoding: "utf16le",
       install: [
+        ...stopTaskAndSupervisors,
         { command: "schtasks.exe", args: ["/Create", "/TN", taskName, "/XML", definitionPath, "/F"] },
         { command: "schtasks.exe", args: ["/Run", "/TN", taskName] }
       ],
       start: [{ command: "schtasks.exe", args: ["/Run", "/TN", taskName] }],
-      stop: [{ command: "schtasks.exe", args: ["/End", "/TN", taskName], ignoreFailure: true }],
+      stop: stopTaskAndSupervisors,
       disable: [{ command: "schtasks.exe", args: ["/Change", "/TN", taskName, "/Disable"] }],
       uninstall: [{ command: "schtasks.exe", args: ["/Delete", "/TN", taskName, "/F"], ignoreFailure: true }],
+      platform: input.platform,
+      startGuardPath: null,
       registrationProbe: {
         command: "powershell.exe",
         args: [
           "-NoProfile",
           "-NonInteractive",
           "-Command",
-          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }"
+          WINDOWS_TASK_LOOKUP
         ],
         negativeExitCodes: [3]
       },
@@ -278,7 +477,7 @@ WantedBy=default.target
           "-NoProfile",
           "-NonInteractive",
           "-Command",
-          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($null -eq $task.Settings -or $null -eq $task.Settings.Enabled) { exit 5 }; if (-not $task.Settings.Enabled) { exit 4 }"
+          `${WINDOWS_TASK_LOOKUP}; if ($null -eq $task.Settings -or $null -eq $task.Settings.Enabled) { exit 5 }; if (-not $task.Settings.Enabled) { exit 4 }`
         ],
         negativeExitCodes: [3, 4]
       },
@@ -288,7 +487,7 @@ WantedBy=default.target
           "-NoProfile",
           "-NonInteractive",
           "-Command",
-          "$task = @(Get-ScheduledTask -ErrorAction Stop) | Where-Object { $_.TaskName -eq 'Pushary Daemon' -and $_.TaskPath -eq '\\' } | Select-Object -First 1; if ($null -eq $task) { exit 3 }; if ($task.State -ne 'Running') { exit 4 }"
+          `${POWERSHELL_STOP_ON_ERROR}; if (${windowsRunningSupervisors(input.stateDir)}.Count -gt 0) { exit 0 }; ${WINDOWS_TASK_LOOKUP}; if ($task.State -ne 'Running') { exit 4 }`
         ],
         negativeExitCodes: [3, 4]
       }
@@ -297,7 +496,7 @@ WantedBy=default.target
   return null;
 };
 var WINDOWS_DAEMON_ENTRY_SEGMENTS = ["dist", "bin", "pushary-daemon.js"];
-var readTextFile = (path) => readFileSync(path, "utf8");
+var readTextFile = (path) => readFileSync2(path, "utf8");
 var windowsPackageDaemonEntries = (globalPrefix) => {
   const root = globalRootFor(globalPrefix, "win32");
   return CLI_PACKAGE_NAMES.map((name) => win32Path.join(globalPackageFolder(root, name, "win32"), ...WINDOWS_DAEMON_ENTRY_SEGMENTS));
@@ -316,7 +515,8 @@ var serviceNodeFor = (execPath, exists) => {
   const linked = homebrewLinkedNodeFor(execPath);
   return linked !== null && exists(linked) ? linked : execPath;
 };
-var resolveDaemonServiceDefinition = (options = {}) => {
+var serviceExecPathFor = (options) => serviceNodeFor(options.execPath ?? process.execPath, options.entryExists ?? existsSync);
+var resolveDaemonServiceInput = (options) => {
   const platform = options.platform ?? process.platform;
   const exists = options.entryExists ?? existsSync;
   const globalBinary = options.globalBinary ?? resolveGlobalBinary("pushary-daemon");
@@ -333,18 +533,22 @@ var resolveDaemonServiceDefinition = (options = {}) => {
     }
   }
   if (!daemonEntry || !exists(daemonEntry)) return null;
-  const homeDir = options.homeDir ?? homedir();
-  return buildDaemonService({
+  return {
     platform,
-    homeDir,
+    homeDir: options.homeDir ?? homedir(),
     stateDir: options.stateDir ?? pusharyDir(),
-    execPath: serviceNodeFor(options.execPath ?? process.execPath, exists),
+    execPath: serviceExecPathFor(options),
     daemonEntry,
     pathEnv: options.pathEnv ?? process.env.PATH ?? "",
     uid: options.uid ?? process.getuid?.(),
     entryExists: exists
-  });
+  };
+};
+var resolveDaemonServiceDefinition = (options = {}) => {
+  const input = resolveDaemonServiceInput(options);
+  return input ? buildDaemonService(input) : null;
 };
+var daemonEntryGuardPathFor = (options = {}) => entryGuardApplies(options.platform ?? process.platform, serviceExecPathFor(options)) ? daemonEntryGuardPath(options.stateDir ?? pusharyDir()) : null;
 var runDaemonServiceSteps = (steps, run) => {
   for (const step of steps) {
     try {
@@ -409,7 +613,17 @@ var manageDaemonService = (action, options = {}) => {
   if (action === "uninstall" && !daemonServiceManagerAvailable(options)) {
     return { kind: "failed", detail: "Native background-service manager is unavailable" };
   }
-  return applyDaemonService(action, definition, { run: options.run });
+  const applied = applyDaemonService(action, definition, { run: options.run });
+  return action === "uninstall" && applied.kind === "ok" ? removeEntryGuardOf(definition) : applied;
+};
+var removeEntryGuardOf = (definition) => {
+  if (!definition.startGuardPath) return { kind: "ok" };
+  try {
+    safeUnlink(definition.startGuardPath);
+    return { kind: "ok" };
+  } catch (err) {
+    return { kind: "failed", detail: `the background service is removed, but its start guard ${definition.startGuardPath} could not be: ${err instanceof Error ? err.message : String(err)}` };
+  }
 };
 var nominalDaemonService = (options) => buildDaemonService({
   platform: options.platform ?? process.platform,
@@ -431,7 +645,7 @@ var readInstalledDaemonService = (options = {}) => {
   try {
     return {
       path: definition.definitionPath,
-      contents: readFileSync(definition.definitionPath, definition.encoding ?? "utf-8")
+      contents: readFileSync2(definition.definitionPath, definition.encoding ?? "utf-8")
     };
   } catch {
     return null;
@@ -595,7 +809,7 @@ var acquireDaemonLease = (options = {}) => {
   const instanceId = randomUUID();
   const startedAt = new Date(now()).toISOString();
   const writeLock = () => {
-    mkdirSync(dir, { recursive: true });
+    mkdirSync2(dir, { recursive: true });
     writeFileSync(lockPath(dir), JSON.stringify({ instanceId, pid }), { flag: "wx", mode: 384 });
   };
   try {
@@ -619,7 +833,7 @@ var acquireDaemonLease = (options = {}) => {
     if (owner && ownerIsFromThisBoot && (options.isProcessAlive ?? processIsAlive)(owner.pid)) {
       return { kind: "unavailable", detail: "daemon owner is still running or starting" };
     }
-    const stale = join(dir, `daemon.lock.${instanceId}.stale`);
+    const stale = join3(dir, `daemon.lock.${instanceId}.stale`);
     let ownsReplacement = false;
     try {
       renameSync(lockPath(dir), stale);
@@ -763,8 +977,16 @@ var stopDaemonRunning = async (options = {}) => {
   safeUnlink(lockPath(dir));
   return { kind: "stopped" };
 };
+var writeEntryGuardForService = (input, options) => writeDaemonEntryGuard({
+  stateDir: input.stateDir,
+  platform: input.platform,
+  execPath: input.execPath,
+  warn: options.warn ?? ((message) => {
+    process.stderr.write(message);
+  })
+});
 var DAEMON_LOGIN_REASONS = ["key_rejected", "plan_inactive", "key_missing", "mac_signed_out"];
-var needsLoginPath = (dir) => join(dir, "daemon-needs-login.json");
+var needsLoginPath = (dir) => join3(dir, "daemon-needs-login.json");
 var isLoginReason = (value) => DAEMON_LOGIN_REASONS.includes(value);
 var parseDaemonNeedsLogin = (value) => {
   if (typeof value !== "object" || value === null) return null;
@@ -804,7 +1026,7 @@ var DAEMON_LOGIN_BLOCK_DESCRIPTIONS = {
 var describeDaemonLoginBlock = (record) => DAEMON_LOGIN_BLOCK_DESCRIPTIONS[record.reason](record.at);
 var recoverDaemonAfterLogin = (options = {}) => {
   const cleared = clearDaemonNeedsLogin(options);
-  if (!cleared || readControlMode(join(options.dir ?? pusharyDir(), "config.json")) === "off" || !hasDaemonServiceDefinition(options)) {
+  if (!cleared || readControlMode(join3(options.dir ?? pusharyDir(), "config.json")) === "off" || !hasDaemonServiceDefinition(options)) {
     return { cleared, restarted: false, detail: null };
   }
   const started = manageDaemonService("start", options);
@@ -878,12 +1100,26 @@ var probeDaemonServiceState = (definition, run) => {
   }
 };
 var previousEncoding = (snapshot) => snapshot.previousEncoding ?? "utf-8";
+var launchdEntryGuardArguments = (guard) => `<string>${xml(ENTRY_GUARD_PRELOAD_FLAG)}</string><string>${xml(guard)}</string>`;
+var restorableContents = (definition, contents) => {
+  const guard = definition.startGuardPath;
+  if (!guard || contents === null || readServiceEntryGuard(contents, definition.platform) !== guard) {
+    return { kind: "ready", contents };
+  }
+  const written = writeDaemonEntryGuardAt(guard);
+  if (written.kind === "in-place") return { kind: "ready", contents };
+  const unguarded = contents.replace(launchdEntryGuardArguments(guard), "");
+  return readServiceEntryGuard(unguarded, definition.platform) === null ? { kind: "ready", contents: unguarded } : { kind: "failed", detail: `could not write the start guard ${guard} the previous service names (${written.detail}), or restore that service without it` };
+};
 var restoreDaemonServiceSnapshot = (definition, snapshot, run) => {
+  const restorable = restorableContents(definition, snapshot.previousContents);
+  if (restorable.kind !== "ready") return restorable;
+  const previousContents = restorable.contents;
   const removed = applyDaemonService("uninstall", definition, { run });
   if (removed.kind !== "ok") return removed;
   try {
-    if (snapshot.previousContents === null) safeUnlink(definition.definitionPath);
-    else writeFileAtomic(definition.definitionPath, snapshot.previousContents, 384, previousEncoding(snapshot));
+    if (previousContents === null) safeUnlink(definition.definitionPath);
+    else writeFileAtomic(definition.definitionPath, previousContents, 384, previousEncoding(snapshot));
   } catch (err) {
     return {
       kind: "failed",
@@ -892,7 +1128,7 @@ var restoreDaemonServiceSnapshot = (definition, snapshot, run) => {
   }
   if (!snapshot.previousRegistered) {
     const reload = definition.reloadAfterUninstall;
-    if (snapshot.previousContents !== null && reload) {
+    if (previousContents !== null && reload) {
       try {
         run(reload.command, reload.args);
       } catch (err) {
@@ -917,12 +1153,12 @@ var restoreDaemonServiceSnapshot = (definition, snapshot, run) => {
     }
     return { kind: "ok" };
   }
-  if (snapshot.previousContents === null) {
+  if (previousContents === null) {
     return { kind: "failed", detail: "the previous registered service had no recoverable definition" };
   }
   const restored = applyDaemonService("install", {
     ...definition,
-    contents: snapshot.previousContents,
+    contents: previousContents,
     encoding: previousEncoding(snapshot)
   }, { run });
   if (restored.kind !== "ok") return restored;
@@ -971,19 +1207,22 @@ var recoverDaemonServiceTransaction = (definition, path, run) => {
   return { kind: "ok" };
 };
 var replaceDaemonService = async (options = {}) => {
-  const definition = resolveDaemonServiceDefinition(options);
-  if (!definition) {
+  const input = resolveDaemonServiceInput(options);
+  const unguarded = input ? buildDaemonService(input) : null;
+  if (!input || !unguarded) {
     return {
       kind: "unavailable",
       detail: "Could not find the globally installed daemon entry. Run Pushary setup again."
     };
   }
   const run = options.run ?? runDaemonServiceCommand;
-  const transactionPath = join(options.stateDir ?? options.dir ?? pusharyDir(), "daemon-service-transaction.json");
-  const recovered = recoverDaemonServiceTransaction(definition, transactionPath, run);
+  const transactionPath = join3(options.stateDir ?? options.dir ?? pusharyDir(), "daemon-service-transaction.json");
+  const recovered = recoverDaemonServiceTransaction(unguarded, transactionPath, run);
   if (recovered.kind !== "ok") {
     return { kind: "failed", detail: `Could not recover interrupted service replacement: ${recovered.detail}` };
   }
+  const definition = buildDaemonService({ ...input, entryGuard: writeEntryGuardForService(input, options) });
+  if (!definition) return { kind: "unavailable", detail: "Could not build the daemon service definition for this platform." };
   let previousContents = null;
   let previousDefinitionEncoding = "utf-8";
   try {
@@ -1088,7 +1327,7 @@ var replaceDaemonService = async (options = {}) => {
 var launchInstalledDaemon = (options) => {
   const entryExists = options.entryExists ?? existsSync;
   const argvEntry = process.argv[1];
-  const candidate = options.daemonEntry !== void 0 ? options.daemonEntry : argvEntry ? join(dirname(argvEntry), "pushary-daemon.js") : null;
+  const candidate = options.daemonEntry !== void 0 ? options.daemonEntry : argvEntry ? join3(dirname2(argvEntry), "pushary-daemon.js") : null;
   const siblingEntry = candidate && entryExists(candidate) ? candidate : null;
   const platform = options.platform ?? process.platform;
   const daemonBinary = options.daemonBinary ?? resolveGlobalBinary("pushary-daemon") ?? (platform === "win32" ? "pushary-daemon.cmd" : "pushary-daemon");
@@ -1163,6 +1402,11 @@ var waitForDaemonRemoteProof = async (options = {}) => {
 };
 
 export {
+  readServiceExecPath,
+  serviceStartFileChecks,
+  versionManagerOf,
+  describeVersionManagerPin,
+  describeServiceNodeRisk,
   daemonIsServing,
   daemonProcessIsThere,
   DAEMON_COLD_START_TIMEOUT_MS,
@@ -1172,6 +1416,7 @@ export {
   DAEMON_YIELD_CHECK_INTERVAL_MS,
   xml,
   serviceNodeFor,
+  daemonEntryGuardPathFor,
   parseDaemonAction,
   manageDaemonService,
   hasDaemonServiceDefinition,

package/dist/{chunk-DBIPNY7J.js → chunk-7WR3FDDX.js}

@@ -1,6 +1,6 @@
 import {
   realpath
-} from "./chunk-EJHD44ZN.js";
+} from "./chunk-NLJ2ILA7.js";
 import {
   findNativeClaudeInstall
 } from "./chunk-CYTPQDQY.js";
@@ -13,7 +13,7 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-GS5FH3C2.js";
+} from "./chunk-FYLYAVQG.js";
 import {
   MANAGED_PROVIDERS
 } from "./chunk-DL67HX3D.js";

package/dist/{chunk-6SWFS4GU.js → chunk-AGVE7MXF.js}

@@ -7,10 +7,10 @@ import {
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand
-} from "./chunk-R7KC57PC.js";
+} from "./chunk-TN5PGMH5.js";
 import {
   resolvePathBinary
-} from "./chunk-GS5FH3C2.js";
+} from "./chunk-FYLYAVQG.js";
 import {
   getPackageVersion
 } from "./chunk-WIIMW5YO.js";