tesseract-agent 0.1.6 → 0.2.1

package/README.md

@@ -1,9 +1,9 @@
 # tesseract-agent
 
 Run your **tesseract** agents on a remote machine. Install this on a headless
-Linux server (or in Docker) to make that box available to your tesseract account —
-your laptop, phone, or the web app can then run agents on it, even with no GUI and
-even when nothing else is open.
+Linux/macOS/Windows box (or in Docker) to make that machine available to your
+tesseract account — your laptop, phone, or the web app can then run agents on it,
+even with no GUI and even when nothing else is open.
 
 It's the headless counterpart to the desktop app's "share this machine" hosting:
 the same agent runtime, no Electron.
@@ -14,29 +14,59 @@ the same agent runtime, no Electron.
 npm i -g tesseract-agent
 ```
 
-Requires Node 20+. Hosting is a paid-plan feature — a Free account will be denied
-and the daemon backs off.
+Requires Node 20+. Hosting is a paid-plan feature — a Free account is denied and
+the daemon backs off gracefully.
 
 ## Use
 
 ```bash
-tesseract-agent login            # sign in + provision this machine (device token)
-tesseract-agent install          # run as a background service (systemd; add --system for a root unit)
+tesseract-agent login            # browser sign-in (Google/email) → paste a one-time code
+tesseract-agent install          # run as a background service (launchd/systemd/Task Scheduler)
 tesseract-agent status           # is it running / connected?
 tesseract-agent logs             # tail the service logs
-tesseract-agent logout           # revoke this device + remove the service
+tesseract-agent logout           # revoke this device + wipe local state
 ```
 
-`login` takes `--token <jwt>` (or interactive email/password — set
-`CCB_LOGIN_PASSWORD` to script it), plus `--api` / `--relay` to point at a
-self-hosted backend (default: `https://tesseract.fineguide.ai`).
+`login` prints a URL (and a scannable QR) to `https://tesseract.fineguide.ai/?authorize=…`;
+sign in there, then paste the one-time code back in the terminal. For automation,
+`--token <device-JWT>` skips the browser. `--api` / `--relay` point at a self-hosted
+backend (default `https://tesseract.fineguide.ai`).
 
-### Docker / no systemd
+The service auto-starts at login/boot and restarts on crash: **launchd** LaunchAgent
+on macOS, **systemd `--user`** unit on Linux (with `loginctl enable-linger` so it
+survives logout), **Task Scheduler** ONLOGON task on Windows. Run `install` as your
+normal user — not `sudo` (a per-user service needs your own session, and finds your
+credentials + `~/.claude`).
+
+## Multiple agents under one user
+
+By default there's one agent per OS user. To run a **separate** agent under the same
+user, give it an instance id — it gets its own state dir, device, and service:
 
 ```bash
-tesseract-agent login --token "$TESSERACT_TOKEN"
-tesseract-agent run              # run the daemon in the foreground
+tesseract-agent login   --instance work2
+tesseract-agent install --instance work2
+tesseract-agent status  --instance work2
 ```
 
+`install` warns and asks for confirmation if a daemon is already running for the
+target instance (pass `--yes` to skip the prompt in scripts). Different OS users are
+always isolated — no instance id needed.
+
+## Docker / no init system
+
+A container has no launchd/systemd, so skip `install` and run the daemon as the
+entrypoint:
+
+```bash
+docker run --rm \
+  -e TESSERACT_TOKEN \
+  tesseract-agent \
+  sh -c 'tesseract-agent login --token "$TESSERACT_TOKEN" && tesseract-agent run'
+```
+
+Or pre-provision credentials and mount them (persist `~/.tesseract` or set
+`CCB_DAEMON_DIR` to a mounted volume), then just `tesseract-agent run`.
+
 The agent runs under the machine's own Claude credentials — a `claude` login in
 `~/.claude`, or an `ANTHROPIC_API_KEY` in the environment.

package/dist-bundle/cli.js

@@ -5841,7 +5841,9 @@ var require_main = __commonJS({
 
 // src/cli.ts
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { platform as platform2 } from "node:os";
+import { homedir as homedir6 } from "node:os";
+import { join as join12 } from "node:path";
+import { createInterface } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
 import { hostname, homedir } from "node:os";
@@ -6293,6 +6295,38 @@ function unwatchAllRemote() {
   remoteWatches.clear();
 }
 
+// ../../packages/host-core/dist/host-metrics.js
+import os from "node:os";
+function primaryIpv4(ifaces = os.networkInterfaces()) {
+  for (const name of Object.keys(ifaces)) {
+    for (const ni of ifaces[name] ?? []) {
+      if (ni.family === "IPv4" && !ni.internal)
+        return ni.address;
+    }
+  }
+  return void 0;
+}
+function staticMetrics(version) {
+  const cpus = os.cpus();
+  return {
+    version: version || void 0,
+    arch: os.arch(),
+    cpuModel: cpus[0]?.model?.trim() || void 0,
+    cpuCount: cpus.length || void 0,
+    totalMem: os.totalmem() || void 0,
+    ip: primaryIpv4()
+  };
+}
+function dynamicMetrics() {
+  const la = os.loadavg();
+  return {
+    load: la[0] > 0 ? Number(la[0].toFixed(2)) : void 0,
+    // loadavg is [0,0,0] on Windows
+    freeMem: os.freemem() || void 0,
+    uptime: Math.round(os.uptime()) || void 0
+  };
+}
+
 // ../../packages/host-core/dist/fs-transfer.js
 import { readdir as readdir2, lstat, mkdir as mkdir3, chmod, rm as rm2, readlink, symlink, stat as stat2 } from "node:fs/promises";
 import { openSync as openSync2, readSync as readSync2, closeSync as closeSync2, existsSync as existsSync3, createWriteStream } from "node:fs";
@@ -6679,6 +6713,7 @@ var SERVER_HOST_ID = "server";
 var cfg = null;
 var deviceId = "";
 var backendOrigin = "";
+var hostVersion;
 function getToken() {
   return cfg ? cfg.tokenSource.getToken() : null;
 }
@@ -6748,7 +6783,17 @@ function ownHostId() {
 function presentedHosts() {
   const out = serverHosts.slice();
   if (!out.some((h) => h.hostId.endsWith(`:${deviceId}`))) {
-    out.unshift({ hostId: "local", name: hostname(), kind: "electron", platform: process.platform, online: true, caps: ["agent", "fs"] });
+    out.unshift({
+      hostId: "local",
+      name: hostname(),
+      kind: "electron",
+      platform: process.platform,
+      online: true,
+      caps: ["agent", "fs"],
+      ...staticMetrics(hostVersion),
+      ...dynamicMetrics(),
+      lastSeen: Date.now()
+    });
   }
   return out;
 }
@@ -6971,9 +7016,9 @@ function stopHeartbeat() {
   }
 }
 function registerAsHost() {
-  send("host", { type: "host:register", name: hostname(), platform: process.platform, deviceId, caps: ["agent", "fs"] });
+  send("host", { type: "host:register", name: hostname(), platform: process.platform, deviceId, caps: ["agent", "fs"], ...staticMetrics(hostVersion) });
   if (!heartbeat)
-    heartbeat = setInterval(() => send("host", { type: "host:heartbeat" }), 2e4);
+    heartbeat = setInterval(() => send("host", { type: "host:heartbeat", ...dynamicMetrics() }), 2e4);
 }
 function cleanup() {
   stopHeartbeat();
@@ -7104,6 +7149,7 @@ function startControlLink(config, h) {
   cfg = config;
   deviceId = config.deviceId;
   backendOrigin = config.tokenSource.backendOrigin;
+  hostVersion = config.version;
   hooks = h;
   stopped = false;
   hooks.pushHosts(presentedHosts());
@@ -7395,7 +7441,7 @@ async function runDaemon(opts = {}) {
   const log2 = (...args) => console.log(`[${TAG} ${(/* @__PURE__ */ new Date()).toISOString()}]`, ...args);
   const pidfile = () => join6(daemonDir(), "daemon.lock");
   const statusFile = () => join6(daemonDir(), "status.json");
-  const isAlive = (pid) => {
+  const isAlive2 = (pid) => {
     try {
       process.kill(pid, 0);
       return true;
@@ -7408,7 +7454,7 @@ async function runDaemon(opts = {}) {
     try {
       if (existsSync5(f)) {
         const prev = Number(readFileSync2(f, "utf-8").trim());
-        if (prev && prev !== process.pid && isAlive(prev))
+        if (prev && prev !== process.pid && isAlive2(prev))
           return false;
       }
     } catch {
@@ -7517,7 +7563,7 @@ async function runDaemon(opts = {}) {
     log2("local listener failed to start", e.message);
   }
   writeStatus({ deviceId: c.deviceId, connected: false });
-  startControlLink({ deviceId: c.deviceId, power: createNodePowerController(), tokenSource }, hooks2);
+  startControlLink({ deviceId: c.deviceId, power: createNodePowerController(), tokenSource, version: VERSION }, hooks2);
   log2(`started \u2014 device ${c.deviceId}, user ${c.userId}, relay ${c.backendOrigin}, local :${localInfo?.localPort ?? "off"}, version ${VERSION}`);
   await refresh();
   timer = setInterval(() => {
@@ -7527,11 +7573,295 @@ async function runDaemon(opts = {}) {
   process.on("SIGINT", () => shutdown(0));
 }
 
+// ../../packages/host-core/dist/service/index.js
+import { platform as platform2 } from "node:os";
+
+// ../../packages/host-core/dist/service/launchd.js
+import { writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "node:fs";
+import { dirname as dirname5, join as join7 } from "node:path";
+import { homedir as homedir4, userInfo } from "node:os";
+
+// ../../packages/host-core/dist/service/exec.js
+import { execFile, spawn as spawn3 } from "node:child_process";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+function runInherit(cmd, args) {
+  return new Promise((resolve3) => {
+    const p = spawn3(cmd, args, { stdio: "inherit" });
+    p.on("error", () => resolve3());
+    p.on("close", () => resolve3());
+  });
+}
+
+// ../../packages/host-core/dist/service/types.js
+var SERVICE_LABEL_BASE = "ai.fineguide.tesseract.host";
+
+// ../../packages/host-core/dist/service/launchd.js
+function xml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function makeLaunchd(instanceId) {
+  const label = SERVICE_LABEL_BASE + (instanceId ? `.${instanceId}` : "");
+  const plistPath = () => join7(homedir4(), "Library", "LaunchAgents", `${label}.plist`);
+  const domainTarget = () => `gui/${userInfo().uid}`;
+  const serviceTarget = () => `${domainTarget()}/${label}`;
+  const logFile = () => join7(daemonDir(), "daemon.log");
+  function buildPlist(spec) {
+    const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml(a)}</string>`).join("\n");
+    const env = Object.entries(spec.env).map(([k, v]) => `      <key>${xml(k)}</key>
+      <string>${xml(v)}</string>`).join("\n");
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>${label}</string>
+    <key>ProgramArguments</key>
+    <array>
+${args}
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+${env}
+    </dict>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <dict>
+      <key>SuccessfulExit</key>
+      <false/>
+    </dict>
+    <key>ThrottleInterval</key>
+    <integer>30</integer>
+    <key>ProcessType</key>
+    <string>Background</string>
+    <key>StandardOutPath</key>
+    <string>${xml(spec.logPath)}</string>
+    <key>StandardErrorPath</key>
+    <string>${xml(spec.logPath)}</string>
+  </dict>
+</plist>
+`;
+  }
+  return {
+    async install(spec) {
+      mkdirSync3(dirname5(plistPath()), { recursive: true });
+      mkdirSync3(dirname5(spec.logPath), { recursive: true });
+      writeFileSync3(plistPath(), buildPlist(spec));
+      await run("launchctl", ["bootout", serviceTarget()]).catch(() => {
+      });
+      await run("launchctl", ["bootstrap", domainTarget(), plistPath()]);
+      await run("launchctl", ["enable", serviceTarget()]).catch(() => {
+      });
+      await run("launchctl", ["kickstart", "-k", serviceTarget()]).catch(() => {
+      });
+    },
+    async uninstall() {
+      await run("launchctl", ["bootout", serviceTarget()]).catch(() => {
+      });
+      if (existsSync6(plistPath())) {
+        try {
+          unlinkSync2(plistPath());
+        } catch {
+        }
+      }
+    },
+    async restart(spec) {
+      await this.install(spec);
+    },
+    async isInstalled() {
+      return existsSync6(plistPath());
+    },
+    async start() {
+      await run("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
+      });
+      await run("launchctl", ["kickstart", serviceTarget()]).catch(() => {
+      });
+    },
+    async stop() {
+      await run("launchctl", ["bootout", serviceTarget()]).catch(() => {
+      });
+    },
+    async status() {
+      await runInherit("launchctl", ["print", serviceTarget()]);
+    },
+    async logs(follow) {
+      const f = logFile();
+      if (!existsSync6(f)) {
+        console.log(`No log yet at ${f} \u2014 has the service started?`);
+        return;
+      }
+      await runInherit("tail", follow ? ["-f", f] : ["-n", "200", f]);
+    }
+  };
+}
+
+// ../../packages/host-core/dist/service/systemd.js
+import { writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync4, unlinkSync as unlinkSync3 } from "node:fs";
+import { dirname as dirname6, join as join8 } from "node:path";
+import { homedir as homedir5, userInfo as userInfo2 } from "node:os";
+function shq(s) {
+  return `"${s.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+function makeSystemd(instanceId) {
+  const unit = `tesseract-host${instanceId ? `-${instanceId}` : ""}.service`;
+  const unitPath = () => {
+    const base = process.env.XDG_CONFIG_HOME || join8(homedir5(), ".config");
+    return join8(base, "systemd", "user", unit);
+  };
+  function buildUnit(spec) {
+    const execStart = [spec.exec, ...spec.args].map(shq).join(" ");
+    const env = Object.entries(spec.env).map(([k, v]) => `Environment=${k}=${v}`).join("\n");
+    return `[Unit]
+Description=Fineguide Tesseract host daemon${instanceId ? ` (${instanceId})` : ""}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+${env}
+ExecStart=${execStart}
+Restart=on-failure
+RestartSec=30
+StandardOutput=append:${spec.logPath}
+StandardError=append:${spec.logPath}
+
+[Install]
+WantedBy=default.target
+`;
+  }
+  return {
+    async install(spec) {
+      mkdirSync4(dirname6(unitPath()), { recursive: true });
+      mkdirSync4(dirname6(spec.logPath), { recursive: true });
+      writeFileSync4(unitPath(), buildUnit(spec));
+      await run("loginctl", ["enable-linger", userInfo2().username]).catch(() => {
+      });
+      await run("systemctl", ["--user", "daemon-reload"]).catch(() => {
+      });
+      await run("systemctl", ["--user", "enable", unit]).catch(() => {
+      });
+      await run("systemctl", ["--user", "restart", unit]);
+    },
+    async uninstall() {
+      await run("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
+      });
+      if (existsSync7(unitPath())) {
+        try {
+          unlinkSync3(unitPath());
+        } catch {
+        }
+      }
+      await run("systemctl", ["--user", "daemon-reload"]).catch(() => {
+      });
+    },
+    async restart(spec) {
+      await this.install(spec);
+    },
+    async isInstalled() {
+      return existsSync7(unitPath());
+    },
+    async start() {
+      await run("systemctl", ["--user", "start", unit]);
+    },
+    async stop() {
+      await run("systemctl", ["--user", "stop", unit]);
+    },
+    async status() {
+      await runInherit("systemctl", ["--user", "status", unit, "--no-pager"]);
+    },
+    async logs(follow) {
+      await runInherit("journalctl", ["--user-unit", unit, "-n", "200", ...follow ? ["-f"] : ["--no-pager"]]);
+    }
+  };
+}
+
+// ../../packages/host-core/dist/service/windows.js
+import { writeFileSync as writeFileSync5, existsSync as existsSync8, mkdirSync as mkdirSync5, unlinkSync as unlinkSync4 } from "node:fs";
+import { dirname as dirname7, join as join9 } from "node:path";
+function makeWindowsTask(instanceId) {
+  const task = `Fineguide\\TesseractHost${instanceId ? `-${instanceId}` : ""}`;
+  const wrapperPath = () => join9(daemonDir(), `run-host${instanceId ? `-${instanceId}` : ""}.cmd`);
+  const logFile = () => join9(daemonDir(), "daemon.log");
+  function buildWrapper(spec) {
+    const env = Object.entries(spec.env).map(([k, v]) => `set "${k}=${v}"`).join("\r\n");
+    const cmd = [spec.exec, ...spec.args].map((a) => `"${a}"`).join(" ");
+    return `@echo off\r
+${env}\r
+start "" /b ${cmd} >> "${spec.logPath}" 2>&1\r
+`;
+  }
+  return {
+    async install(spec) {
+      mkdirSync5(dirname7(spec.logPath), { recursive: true });
+      mkdirSync5(dirname7(wrapperPath()), { recursive: true });
+      writeFileSync5(wrapperPath(), buildWrapper(spec));
+      await run("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
+      await run("schtasks", ["/Run", "/TN", task]).catch(() => {
+      });
+    },
+    async uninstall() {
+      await run("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
+      });
+      if (existsSync8(wrapperPath())) {
+        try {
+          unlinkSync4(wrapperPath());
+        } catch {
+        }
+      }
+    },
+    async restart(spec) {
+      await this.install(spec);
+    },
+    async isInstalled() {
+      try {
+        await run("schtasks", ["/Query", "/TN", task]);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    async start() {
+      await run("schtasks", ["/Run", "/TN", task]);
+    },
+    async stop() {
+      await run("schtasks", ["/End", "/TN", task]).catch(() => {
+      });
+    },
+    async status() {
+      await runInherit("schtasks", ["/Query", "/TN", task, "/V", "/FO", "LIST"]);
+    },
+    async logs(follow) {
+      const f = logFile();
+      if (!existsSync8(f)) {
+        console.log(`No log yet at ${f} \u2014 has the task run?`);
+        return;
+      }
+      await runInherit("powershell", ["-NoProfile", "-Command", `Get-Content -Path "${f}" -Tail 200${follow ? " -Wait" : ""}`]);
+    }
+  };
+}
+
+// ../../packages/host-core/dist/service/index.js
+function getServiceController(instanceId) {
+  const id = instanceId && instanceId.length ? instanceId : void 0;
+  switch (platform2()) {
+    case "darwin":
+      return makeLaunchd(id);
+    case "linux":
+      return makeSystemd(id);
+    case "win32":
+      return makeWindowsTask(id);
+    default:
+      return null;
+  }
+}
+
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { existsSync as existsSync6, rmSync } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync9, rmSync } from "node:fs";
+import { join as join10 } from "node:path";
 
 // src/config.ts
 import { hostname as hostname2 } from "node:os";
@@ -7708,8 +8038,8 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join7(daemonDir(), f);
-      if (existsSync6(p)) rmSync(p);
+      const p = join10(daemonDir(), f);
+      if (existsSync9(p)) rmSync(p);
     } catch {
     }
   }
@@ -7728,109 +8058,72 @@ function whoami() {
   console.log(`expires: ${c.expiresAt}`);
 }
 
-// src/systemd.ts
-import { writeFileSync as writeFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "node:fs";
-import { dirname as dirname5, join as join8 } from "node:path";
-import { homedir as homedir4, userInfo } from "node:os";
-import { execFileSync, spawnSync } from "node:child_process";
-var UNIT = "tesseract-host.service";
-function unitPath(system) {
-  if (system) return join8("/etc/systemd/system", UNIT);
-  const base = process.env.XDG_CONFIG_HOME || join8(homedir4(), ".config");
-  return join8(base, "systemd", "user", UNIT);
-}
-function shq(s) {
-  return `"${s.replace(/(["\\$`])/g, "\\$1")}"`;
-}
-function sc(system, args) {
-  return system ? args : ["--user", ...args];
-}
-function buildUnit(o) {
-  const execStart = `${shq(o.node)} ${shq(o.cliEntry)} run`;
-  const env = [
-    `Environment=CCB_DAEMON_DIR=${o.daemonDir}`,
-    `Environment=CCB_DAEMON_VERSION=${o.version}`
-  ];
-  const userLines = o.system ? [`User=${userInfo().username}`, `Environment=HOME=${homedir4()}`] : [];
-  return `[Unit]
-Description=Fineguide Tesseract host daemon
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-${userLines.join("\n")}
-${env.join("\n")}
-ExecStart=${execStart}
-Restart=on-failure
-RestartSec=30
-
-[Install]
-WantedBy=${o.system ? "multi-user.target" : "default.target"}
-`;
-}
-function run(cmd, args) {
-  const r = spawnSync(cmd, args, { stdio: "inherit" });
-  if (r.error) throw r.error;
-  if (r.status !== 0) throw new Error(`\`${cmd} ${args.join(" ")}\` exited ${r.status}`);
-}
-function install(o) {
-  if (!o.system && typeof process.getuid === "function" && process.getuid() === 0) {
-    throw new Error(
-      "Run `tesseract-agent install` as your normal user (no sudo) \u2014 it installs a per-user systemd service.\nFor a root-managed system service instead, use `sudo tesseract-agent install --system`."
-    );
-  }
-  const p = unitPath(o.system);
-  mkdirSync3(dirname5(p), { recursive: true });
-  writeFileSync3(p, buildUnit(o));
-  if (!o.system) {
-    try {
-      execFileSync("loginctl", ["enable-linger", userInfo().username], { stdio: "ignore" });
-    } catch {
-    }
+// src/service.ts
+import { join as join11 } from "node:path";
+import { platform as platform3 } from "node:os";
+import { existsSync as existsSync10, readFileSync as readFileSync3 } from "node:fs";
+function controller(instanceId) {
+  const c = getServiceController(instanceId);
+  if (!c) {
+    throw new Error(`tesseract-agent can't manage a background service on ${platform3()}. Run it in the foreground instead: \`tesseract-agent run\` (e.g. as a Docker entrypoint).`);
   }
-  run("systemctl", sc(o.system, ["daemon-reload"]));
-  run("systemctl", sc(o.system, ["enable", UNIT]));
-  run("systemctl", sc(o.system, ["restart", UNIT]));
-  console.log(`\u2713 Installed + started ${UNIT} (${o.system ? "system" : "user"}). Check it with \`tesseract-agent status\`.`);
+  return c;
 }
-function uninstall(system) {
+function buildSpec(cliEntry, version) {
+  return {
+    exec: process.execPath,
+    args: [cliEntry, "run"],
+    env: { CCB_DAEMON_DIR: daemonDir(), CCB_DAEMON_VERSION: version },
+    logPath: join11(daemonDir(), "daemon.log")
+  };
+}
+var isAlive = (pid) => {
   try {
-    run("systemctl", sc(system, ["disable", "--now", UNIT]));
+    process.kill(pid, 0);
+    return true;
   } catch {
+    return false;
   }
-  const p = unitPath(system);
-  if (existsSync7(p)) {
-    try {
-      unlinkSync2(p);
-    } catch {
-    }
-  }
+};
+function runningDaemonInfo() {
+  const lock = join11(daemonDir(), "daemon.lock");
   try {
-    run("systemctl", sc(system, ["daemon-reload"]));
+    if (!existsSync10(lock)) return null;
+    const pid = Number(readFileSync3(lock, "utf-8").trim());
+    if (!pid || !isAlive(pid)) return null;
+    return { pid, device: readCredentials()?.deviceId };
   } catch {
+    return null;
   }
-  console.log(`\u2713 Removed ${UNIT}.`);
 }
-function start(system) {
-  run("systemctl", sc(system, ["start", UNIT]));
+async function install(instanceId, cliEntry, version) {
+  await controller(instanceId).install(buildSpec(cliEntry, version));
+  const where = instanceId ? `instance "${instanceId}"` : "this machine";
+  console.log(`\u2713 Installed + started the tesseract-agent service for ${where}. Check it with \`tesseract-agent status${instanceId ? ` --instance ${instanceId}` : ""}\`.`);
+}
+async function uninstall(instanceId) {
+  await controller(instanceId).uninstall();
+  console.log(`\u2713 Removed the tesseract-agent service${instanceId ? ` (instance "${instanceId}")` : ""}.`);
+}
+async function restart(instanceId, cliEntry, version) {
+  await controller(instanceId).restart(buildSpec(cliEntry, version));
+  console.log(`\u2713 Restarted the tesseract-agent service${instanceId ? ` (instance "${instanceId}")` : ""}.`);
 }
-function stop(system) {
-  run("systemctl", sc(system, ["stop", UNIT]));
+async function start(instanceId) {
+  await controller(instanceId).start();
 }
-function restart(system) {
-  run("systemctl", sc(system, ["restart", UNIT]));
+async function stop(instanceId) {
+  await controller(instanceId).stop();
 }
-function status(system) {
-  run("systemctl", sc(system, ["status", UNIT, "--no-pager"]));
+async function status(instanceId) {
+  await controller(instanceId).status();
 }
-function logs(system, follow) {
-  const base = system ? ["-u", UNIT] : ["--user-unit", UNIT];
-  run("journalctl", [...base, "-n", "200", ...follow ? ["-f"] : ["--no-pager"]]);
+async function logs(instanceId, follow) {
+  await controller(instanceId).logs(follow);
 }
 
 // src/cli.ts
-var CLI_VERSION = process.env.CCB_DAEMON_VERSION ?? "0.1.6";
+var CLI_VERSION = process.env.CCB_DAEMON_VERSION ?? "0.2.1";
 function parseFlags(argv) {
   const out = {};
   for (let i = 0; i < argv.length; i++) {
@@ -7851,29 +8144,56 @@ var HELP = `tesseract-agent v${CLI_VERSION} \u2014 run agents on this machine re
 
 Usage:
   tesseract-agent login [--token JWT] [--name LABEL] [--api URL] [--relay URL]
-  tesseract-agent install [--system]      Install + start the background service (systemd)
-  tesseract-agent uninstall [--system]    Stop + remove the service
+  tesseract-agent install [--yes]         Install + start the background service
+  tesseract-agent uninstall               Stop + remove the service
   tesseract-agent start | stop | restart  Control the service
   tesseract-agent status                  Show the service status
-  tesseract-agent logs [--no-follow]      Tail the service logs (journalctl)
+  tesseract-agent logs [--no-follow]      Tail the service logs
   tesseract-agent run                     Run the daemon in the foreground (Docker/manual)
   tesseract-agent whoami                  Show the provisioned device summary
   tesseract-agent logout                  Revoke this device's token + wipe local state
+  tesseract-agent --version
   tesseract-agent --help
 
+Common flags:
+  --instance ID   Run/manage a SEPARATE agent under this OS user (its own state +
+                  device + service). Omit for the default agent. Valid id: A-Z a-z 0-9 _ -
+  --yes           Skip the confirmation when install finds a running daemon.
+
+Services: launchd (macOS), systemd --user (Linux), Task Scheduler (Windows). In a
+container there's no init system \u2014 run \`tesseract-agent run\` as the entrypoint.
+
 login: opens a browser sign-in (Google or email) and prints a URL + QR; sign in
 there and paste the one-time code shown. --token JWT skips the browser (automation).
 --api defaults to https://tesseract.fineguide.ai; --relay defaults to --api.`;
-function requireLinux(cmd) {
-  if (platform2() !== "linux") {
-    console.error(`\`tesseract-agent ${cmd}\` manages a systemd service and is Linux-only. Use \`tesseract-agent run\` elsewhere (e.g. in Docker, or under launchd via the desktop app).`);
-    process.exit(1);
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const a = (await rl.question(question)).trim().toLowerCase();
+    return a === "y" || a === "yes";
+  } finally {
+    rl.close();
   }
 }
 async function main() {
   const [cmd, ...rest] = process.argv.slice(2);
   const flags = parseFlags(rest);
-  const system = flags.system === true;
+  let instance;
+  if (flags.instance !== void 0) {
+    if (flags.instance === true || typeof flags.instance !== "string") {
+      console.error("--instance needs an id, e.g. `--instance work2`.");
+      process.exit(1);
+    }
+    if (!/^[A-Za-z0-9_-]+$/.test(flags.instance)) {
+      console.error("Invalid --instance id \u2014 use letters, digits, dash or underscore only.");
+      process.exit(1);
+    }
+    instance = flags.instance;
+    process.env.CCB_DAEMON_DIR = join12(homedir6(), ".tesseract", `daemon-${instance}`);
+  }
+  const force = flags.yes === true || flags.force === true;
+  const cliEntry = fileURLToPath2(import.meta.url);
   switch (cmd) {
     case "login":
       await login({
@@ -7892,33 +8212,44 @@ async function main() {
     case "run":
       await runDaemon({ tag: "tesseract", version: CLI_VERSION });
       break;
-    case "install":
-      requireLinux("install");
-      install({ system, cliEntry: fileURLToPath2(import.meta.url), node: process.execPath, daemonDir: daemonDir(), version: CLI_VERSION });
+    case "install": {
+      const info = runningDaemonInfo();
+      if (info && !force) {
+        const where = instance ? `the "${instance}" instance` : "this machine (default instance)";
+        const dev = info.device ? `, device ${info.device}` : "";
+        const msg = `A tesseract-agent daemon is already running for ${where} (pid ${info.pid}${dev}).`;
+        if (!process.stdin.isTTY) {
+          console.error(`${msg}
+Re-run with --yes to replace it, or --instance <id> to install a SEPARATE agent.`);
+          process.exit(1);
+        }
+        console.log(msg);
+        console.log("(To run a separate agent instead, cancel and use `--instance <id>`.)");
+        if (!await confirm("Reinstall/replace it? [y/N] ")) {
+          console.log("Cancelled.");
+          break;
+        }
+      }
+      await install(instance, cliEntry, CLI_VERSION);
       break;
+    }
     case "uninstall":
-      requireLinux("uninstall");
-      uninstall(system);
+      await uninstall(instance);
       break;
     case "start":
-      requireLinux("start");
-      start(system);
+      await start(instance);
       break;
     case "stop":
-      requireLinux("stop");
-      stop(system);
+      await stop(instance);
       break;
     case "restart":
-      requireLinux("restart");
-      restart(system);
+      await restart(instance, cliEntry, CLI_VERSION);
       break;
     case "status":
-      requireLinux("status");
-      status(system);
+      await status(instance);
       break;
     case "logs":
-      requireLinux("logs");
-      logs(system, flags["no-follow"] !== true);
+      await logs(instance, flags["no-follow"] !== true);
       break;
     case "--version":
     case "-v":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tesseract-agent",
-  "version": "0.1.6",
+  "version": "0.2.1",
   "license": "UNLICENSED",
   "publishConfig": {
     "access": "public"