thinkpool-pair 0.7.364 → 0.7.366

package/service.mjs

@@ -1,877 +1 @@
-/* ─────────────────────────────────────────────────────────────
-   service.mjs — install the bridge as a boot-persistent OS service
-   so a customer's bridge survives reboot/logout and auto-restarts
-   on crash, on every platform:
-     • macOS   → launchd LaunchAgent (KeepAlive)
-     • Linux   → systemd --user unit (Restart=always)
-     • Windows → Startup-folder .cmd running --supervise
-   `--supervise` (in bridge.mjs) is the cross-platform crash-restart
-   baseline that needs no install; this adds boot persistence.
-
-   Two service shapes, one builder:
-     • room    — `install-service <ROOM>` → supervises one room bridge.
-     • account — `install-service` (no room) → supervises the ACCOUNT
-                 supervisor (`npx thinkpool-pair`, bare), which serves
-                 every session you're in. Pass room=null for this.
-   Pinned services launch an immutable local runtime directly. The optional
-   auto-update tier still resolves `thinkpool-pair@latest`; its self-restart
-   lives in bridge.mjs / account.mjs.
-   ───────────────────────────────────────────────────────────── */
-
-import os from 'node:os'
-import fs from 'node:fs'
-import path from 'node:path'
-import { execSync } from 'node:child_process'
-import { hostMemoryAdmission } from './host-memory.mjs'
-import { readSupervisorReady, supervisorReadyMatches } from './supervisor-ready.mjs'
-import { pairCli } from './command-guidance.mjs'
-import { loadKeepAwakePreference } from './keep-awake.mjs'
-import { scheduledRunsEnabled } from './scheduled-runs.mjs'
-
-// Service identity. Account mode has no room → a single stable id so there's
-// exactly one account service per machine (a second install replaces it).
-// Room codes flow UNESCAPED into launchctl/systemd shell strings + plist paths, so
-// this is the security chokepoint: reject anything that isn't a plain alnum code
-// before it can inject shell (`A;rm -rf ~`) or corrupt the service label. Every
-// room-interpolating path (buildArtifact, restart/uninstall/serviceActive) calls
-// label(), so one guard here covers them all.
-const ROOM_CODE_RE = /^[A-Za-z0-9]{2,16}$/
-const label = (room) => {
-  if (room && !ROOM_CODE_RE.test(room)) throw new Error(`invalid room code: ${JSON.stringify(room)} (expected 2–16 alphanumerics)`)
-  return room ? `io.thinkpool.pair.${room.toLowerCase()}` : 'io.thinkpool.pair.account'
-}
-const slug = (room) => room || 'account'
-const xml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`
-export function sanitizeServicePath(value, platform = process.platform) {
-  const sep = platform === 'win32' ? ';' : ':'
-  return String(value || '').split(sep).filter((part) => part && !part.includes('/.npm/_npx/')).join(sep)
-}
-export function darwinServiceRunning(output) {
-  const text = String(output || '')
-  return /(^|\n)[ \t]*state = running[ \t]*($|\n)/.test(text) && /(^|\n)[ \t]*pid = \d+[ \t]*($|\n)/.test(text)
-}
-// Legacy auto-update services still use npx. They MUST use a bridge-owned cache:
-// deleting ~/.npm/_npx corrupts unrelated interactive `npx thinkpool-pair` processes
-// (0.7.274 removed account.mjs underneath a live launcher). The service cache is
-// disposable and isolated, so clearing it cannot mutate a person's npm execution tree.
-const serviceNpmCache = () => path.join(os.homedir(), '.thinkpool-pair', 'npm-cache')
-const cacheWipe = (cacheRoot) => `rm -rf ${shq(path.join(cacheRoot, '_npx'))}/* 2>/dev/null`
-
-// The version installing the service. By DEFAULT the service is pinned to this exact
-// version (not @latest) so a future bad npm publish can't auto-roll to every machine's
-// always-on bridge — that's what spread the broken 0.7.49 on 2026-06-22. Updates become
-// deliberate (re-run install-service). `--auto-update` opts back into @latest tracking.
-const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return 'latest' } })()
-
-// Connected account readiness is deliberately stronger than "the OS process is
-// running": the supervisor must receive its own Supabase presence echo first.
-// That echo has taken ~62s on a real Linux host, so the old 30s handoff window
-// killed a healthy replacement and rolled back forever. Keep the external helper
-// alive long enough for one slow Realtime generation plus five stable PID probes.
-const SERVICE_PROOF_POLLS = 180
-const SERVICE_PROOF_SLEEP_SECONDS = '0.5'
-const SERVICE_CONFIRM_TIMEOUT_MS = 200_000
-
-// Resolve the real npx next to the current node, so the service stays seamless:
-// it runs `npx -y thinkpool-pair@latest …`, always picking up the newest publish
-// with no re-install. Absolute path + injected PATH so it works under launchd /
-// systemd's bare environment (which don't search PATH for argv[0]).
-function npxPath(platform) {
-  const bin = path.dirname(process.execPath)
-  const cand = path.join(bin, platform === 'win32' ? 'npx.cmd' : 'npx')
-  try { fs.accessSync(cand); return cand } catch { return platform === 'win32' ? 'npx.cmd' : 'npx' }
-}
-
-function npmPath(platform = process.platform) {
-  const bin = path.dirname(process.execPath)
-  const cand = path.join(bin, platform === 'win32' ? 'npm.cmd' : 'npm')
-  try { fs.accessSync(cand); return cand } catch { return platform === 'win32' ? 'npm.cmd' : 'npm' }
-}
-
-// Persistent services never execute through npx. Provision an immutable, versioned
-// runtime from the tarball URL (which bypasses stale npm packument metadata), then point
-// launchd/systemd directly at its bridge.mjs with the current Node binary.
-function runtimeVersion(entry) {
-  try {
-    const pkg = JSON.parse(fs.readFileSync(path.join(path.dirname(entry), 'package.json'), 'utf8'))
-    return typeof pkg?.version === 'string' ? pkg.version : null
-  } catch { return null }
-}
-
-export function provisionRuntime(version, { exec = execSync, root = path.join(os.homedir(), '.thinkpool-pair', 'runtimes'), admit = hostMemoryAdmission } = {}) {
-  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(version))) throw new Error(`invalid runtime version: ${version}`)
-  const dir = path.join(root, String(version))
-  const entry = path.join(dir, 'node_modules', 'thinkpool-pair', 'bridge.mjs')
-  if (fs.existsSync(entry) && runtimeVersion(entry) === String(version)) return entry
-  const memory = admit('stage a bridge runtime update')
-  if (!memory?.ok) throw new Error(memory?.reason || 'host memory is critically low')
-
-  // Install beside the target and only swap it into place after BOTH the entrypoint
-  // and package version prove the payload. A killed/poisoned npm install must never
-  // leave `runtimes/0.7.237` containing 0.7.229 and then pass forever on file existence.
-  const tmp = `${dir}.install-${process.pid}-${Date.now()}`
-  fs.rmSync(tmp, { recursive: true, force: true })
-  fs.mkdirSync(tmp, { recursive: true })
-  const tarball = `https://registry.npmjs.org/thinkpool-pair/-/thinkpool-pair-${version}.tgz`
-  const tmpEntry = path.join(tmp, 'node_modules', 'thinkpool-pair', 'bridge.mjs')
-  try {
-    exec(`${shq(npmPath())} install --prefix ${shq(tmp)} ${shq(tarball)} --prefer-online --no-audit --no-fund`, { stdio: 'inherit', shell: '/bin/bash' })
-    const actual = runtimeVersion(tmpEntry)
-    if (!fs.existsSync(tmpEntry) || actual !== String(version)) {
-      throw new Error(`runtime verification failed: requested ${version}, installed ${actual || 'no valid package'}`)
-    }
-    fs.rmSync(dir, { recursive: true, force: true })
-    fs.renameSync(tmp, dir)
-  } catch (e) {
-    fs.rmSync(tmp, { recursive: true, force: true })
-    throw e
-  }
-  return entry
-}
-
-// Pure artifact builder — returned shape is testable without side effects.
-// room falsy → ACCOUNT service (bare `thinkpool-pair`, auto-serves all sessions).
-export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate = false, version = VERSION, staleProof = false, runtimeEntry = null, scheduledRuns = scheduledRunsEnabled() } = {}) {
-  const npx = npxPath(platform)
-  // Account mode discovers each room's own bound directory, so its supervisor must use
-  // a stable home cwd. Persisting the caller's managed worktree here makes the service
-  // unstartable as soon as that lane is closed and its worktree is removed.
-  const cwd = room ? process.cwd() : os.homedir()
-  const id = slug(room)
-  const logDir = path.join(os.homedir(), '.thinkpool-pair')
-  const log = path.join(logDir, `${id}.log`)
-  const servicePath = sanitizeServicePath(process.env.PATH || '', platform)
-  const npmCache = serviceNpmCache()
-  const tail = cmdArgs.length ? ['--', ...cmdArgs] : []
-  const desc = room ? `bridge (${room})` : 'account bridge'
-  // OS-supervised tiers (launchd KeepAlive / systemd Restart) don't need --supervise.
-  // PINNED by default to `@${VERSION}` so a KeepAlive restart re-runs the SAME known-good
-  // version — a bad publish can't auto-roll here. `autoUpdate` opts into `@latest` tracking
-  // (and the in-process self-updater via THINKPOOL_PAIR_AUTOUPDATE below).
-  const verSpec = autoUpdate ? 'thinkpool-pair@latest' : `thinkpool-pair@${version}`
-  // Anti-zombie (2026-06-29): cacheWipe removes the INSTALLED package, but npx still
-  // resolves `@latest` from npm's cached registry metadata (TTL'd). A restart inside
-  // that window reinstalls the OLD version even though a newer one is published — the
-  // bridge "comes back from the dead" stale (left FVIHV1DE on 0.7.86 while @latest was
-  // 0.7.87). `--prefer-online` forces npx to REVALIDATE the packument against the
-  // registry every resolve, so `@latest` always means the true latest. Only needed for
-  // the @latest (autoUpdate) tier — a pinned exact version is immutable, no staleness.
-  const onlineFlag = (autoUpdate || staleProof) ? ['--prefer-online'] : []
-  const pkgArgs = room ? ['-y', ...onlineFlag, verSpec, room] : ['-y', ...onlineFlag, verSpec]
-  // In-process self-update (account.mjs / bridge.mjs) is gated on this env — only on when
-  // the user explicitly opted into auto-update.
-  const autoUpdateEnv = autoUpdate ? { THINKPOOL_PAIR_AUTOUPDATE: '1' } : {}
-  // Persistent services rebuild a deliberately tiny environment. Preserve this
-  // activation only as the exact boolean true; arbitrary caller values are omitted.
-  const scheduledRunsEnv = scheduledRuns === true
-    ? { darwin: '<key>TP_SCHEDULED_RUNS_ENABLED</key><string>1</string>', linux: 'Environment=TP_SCHEDULED_RUNS_ENABLED=1\n', win32: 'set "TP_SCHEDULED_RUNS_ENABLED=1"\r\n' }
-    : { darwin: '', linux: '', win32: '' }
-
-  if (platform === 'darwin') {
-    // launchd KeepAlive supervises. Stable runtimes execute directly; the legacy npx
-    // shape keeps its cache-wiping wrapper for auto-update compatibility.
-    const args = runtimeEntry
-      ? [process.execPath, runtimeEntry, ...(room ? [room] : []), ...tail]
-      : staleProof
-      ? ['/bin/bash', '-lc', `${cacheWipe(npmCache)}; export NPM_CONFIG_CACHE=${shq(npmCache)}; exec ${[npx, ...pkgArgs, ...tail].map(shq).join(' ')}`]
-      : [npx, ...pkgArgs, ...tail]
-    const file = path.join(os.homedir(), 'Library', 'LaunchAgents', `${label(room)}.plist`)
-    const content = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>
-  <key>Label</key><string>${label(room)}</string>
-  <key>ProgramArguments</key><array>${args.map((a) => `<string>${xml(a)}</string>`).join('')}</array>
-  <key>RunAtLoad</key><true/>
-  <!-- KeepAlive only on UNSUCCESSFUL exit. A bridge that exits 0 has intentionally
-       stood down — told to stop, or another bridge already owns this machine's
-       singleton lock — and must NOT be relaunched, or launchd thrashes it every
-       few seconds forever (the 2026-06-28 account-bridge restart loop). A crash
-       or an update-restart exits non-zero and IS relaunched. Mirrors the bridge's
-       own exit-code contract (stop()=0, restart-requested=non-zero). -->
-  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
-  <key>WorkingDirectory</key><string>${xml(cwd)}</string>
-  <key>StandardOutPath</key><string>${xml(log)}</string>
-  <key>StandardErrorPath</key><string>${xml(log)}</string>
-  <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(servicePath)}</string>${runtimeEntry ? '' : `<key>NPM_CONFIG_CACHE</key><string>${xml(npmCache)}</string>`}${autoUpdate ? '<key>THINKPOOL_PAIR_AUTOUPDATE</key><string>1</string>' : ''}${scheduledRunsEnv.darwin}</dict>
-</dict></plist>\n`
-    // The destructive reload is intentionally NOT represented as an inline `post`
-    // command. installService stages this plist and hands the transaction to an
-    // independent one-shot launchd job (buildDarwinReloadHandoff below).
-    return { file, content, logDir, post: [], expectedRuntime: runtimeEntry || verSpec, note: 'Loaded as a LaunchAgent — starts at login, restarts on crash.' }
-  }
-
-  if (platform === 'linux') {
-    const args = runtimeEntry
-      ? [process.execPath, runtimeEntry, ...(room ? [room] : []), ...tail]
-      : [npx, ...pkgArgs, ...tail]   // systemd Restart=always supervises
-    const file = path.join(os.homedir(), '.config', 'systemd', 'user', `${label(room)}.service`)
-    // staleProof → cache-wiping /bin/bash launch (same intent as darwin). `$$HOME` so systemd
-    // emits a literal $HOME to bash rather than expanding it itself (empty + warning).
-    const execStart = runtimeEntry
-      ? args.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(' ')
-      : staleProof
-      ? `/bin/bash -lc "${cacheWipe(npmCache)}; export NPM_CONFIG_CACHE=${shq(npmCache)}; exec ${[npx, ...pkgArgs, ...tail].join(' ')}"`
-      : args.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(' ')
-    const content = `[Unit]
-Description=ThinkPool Code ${desc}
-After=network-online.target
-
-[Service]
-ExecStart=${execStart}
-Restart=always
-RestartSec=2
-# Don't relaunch a clean stand-down. exit 0 = the bridge intentionally stopped —
-# told to stop, or another bridge already holds this machine's singleton lock —
-# so restarting it just thrashes every RestartSec forever (the 2026-06-28
-# account-bridge restart loop). Crashes + update-restarts exit non-zero and are
-# still restarted. Matches the bridge's exit-code contract (stop()=0, restart=non-zero).
-RestartPreventExitStatus=0
-WorkingDirectory=${cwd}
-Environment=PATH=${servicePath}
-${runtimeEntry ? '' : `Environment=NPM_CONFIG_CACHE=${npmCache}\n`}${autoUpdate ? 'Environment=THINKPOOL_PAIR_AUTOUPDATE=1\n' : ''}${scheduledRunsEnv.linux}StandardOutput=append:${log}
-StandardError=append:${log}
-
-[Install]
-WantedBy=default.target
-`
-    return { file, content, logDir, post: ['systemctl --user daemon-reload', `systemctl --user enable ${label(room)}.service`, `systemctl --user restart ${label(room)}.service`], expectedRuntime: runtimeEntry || verSpec, note: 'Enabled as a systemd --user service. Run `loginctl enable-linger $USER` once to keep it running after logout.' }
-  }
-
-  if (platform === 'win32') {
-    // No native per-user daemon without extra tooling — a Startup-folder script
-    // running --supervise gives login-persistence + crash-restart, dependency-free.
-    // Account mode ignores --supervise (the account supervisor takes over argv),
-    // so it gets login-persistence only — no in-process crash-restart on Windows.
-    const startup = path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup')
-    const file = path.join(startup, `thinkpool-pair-${id}.cmd`)
-    const inner = runtimeEntry
-      ? [process.execPath, runtimeEntry, ...(room ? [room, '--supervise'] : []), ...tail].map((s) => `"${s}"`).join(' ')
-      : room
-      ? ['npx', '-y', ...onlineFlag, verSpec, room, '--supervise', ...tail].join(' ')
-      : ['npx', '-y', ...onlineFlag, verSpec].join(' ')
-    const content = `@echo off\r\ntitle thinkpool-pair ${id}\r\n${runtimeEntry ? '' : `set "NPM_CONFIG_CACHE=${npmCache}"\r\n`}${scheduledRunsEnv.win32}${inner}\r\n`
-    return { file, content, logDir, post: [], note: 'Installed to the Startup folder — runs at login' + (room ? ' with --supervise (auto-restart on crash).' : ' (account mode).') + ' Start it now without rebooting by double-clicking the .cmd, or run it from a terminal.' }
-  }
-
-  throw new Error(`unsupported platform: ${platform}`)
-}
-
-// Parse both legacy npx commands (`thinkpool-pair@<ver>`) and stable runtime commands
-// (`.../runtimes/<ver>/...`).
-export function parseRunningPairVersions(out) {
-  const versions = String(out).match(/(?:thinkpool-pair@|runtimes[\\/])(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/g) || []
-  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0]).filter(Boolean))
-}
-
-// Return a version only when the OS service manager proves that THIS service is
-// both live and configured to execute one unambiguous pair runtime. This is
-// deliberately stricter than isServiceInstalled(): a plist/unit on disk, or a
-// process list that happens to contain thinkpool-pair, is not update evidence.
-// Windows' Startup-folder tier has no service-manager identity to query, so an
-// exact running version cannot be attributed safely and is therefore unproven.
-export function serviceRuntimeSnapshot(room, { platform = process.platform, exec = execSync } = {}) {
-  const exactVersion = (output) => {
-    const versions = parseRunningPairVersions(output)
-    return versions.size === 1 ? [...versions][0] : null
-  }
-  const id = label(room)
-  try {
-    if (platform === 'darwin') {
-      const out = exec(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], shell: '/bin/bash' })
-      const pid = String(out).match(/(^|\n)[ \t]*pid = (\d+)[ \t]*($|\n)/)?.[2]
-      return darwinServiceRunning(out) ? { version: exactVersion(out), pid: pid || null } : null
-    }
-    if (platform === 'linux') {
-      const out = exec(`systemctl --user show ${id}.service --property=ActiveState --property=MainPID --property=ExecStart`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
-      const pid = String(out).match(/^MainPID=([1-9]\d*)$/m)?.[1]
-      if (!/^ActiveState=active$/m.test(String(out)) || !pid) return null
-      return { version: exactVersion(out), pid }
-    }
-  } catch { /* service manager could not prove a live runtime */ }
-  return null
-}
-
-export function serviceRuntimeVersion(room, options) {
-  return serviceRuntimeSnapshot(room, options)?.version || null
-}
-
-// A macOS update can be invoked FROM a ThinkPool Code room hosted by the very account
-// service being replaced. Running `bootout; bootstrap` in that caller is unsafe: bootout
-// tears down the room process tree and can kill the updater before bootstrap. Hand the
-// whole destructive transaction to a separate one-shot launchd job first. It survives
-// the target service's teardown, reloads it, verifies the exact expected runtime in
-// launchd's live definition, and records an atomic result for diagnosis.
-export function buildDarwinReloadHandoff({ targetLabel, targetFile, stagedFile, expectedRuntime, version, nonce = `${process.pid}-${Date.now()}` }) {
-  if (!/^io\.thinkpool\.pair\.[A-Za-z0-9_.-]+$/.test(String(targetLabel))) throw new Error(`invalid service label: ${targetLabel}`)
-  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(version))) throw new Error(`invalid runtime version: ${version}`)
-  const safeNonce = String(nonce).replace(/[^A-Za-z0-9-]/g, '') || String(process.pid)
-  const helperLabel = `io.thinkpool.pair.update.${safeNonce}`
-  const helperFile = path.join(os.homedir(), 'Library', 'LaunchAgents', `${helperLabel}.plist`)
-  const backupFile = `${stagedFile}.previous`
-  const statusFile = path.join(os.homedir(), '.thinkpool-pair', 'update-status.json')
-  const logFile = path.join(os.homedir(), '.thinkpool-pair', 'update.log')
-  const readyFile = path.join(os.homedir(), '.thinkpool-pair', 'account-ready.json')
-  const requiresReady = targetLabel === label(null)
-  const script = [
-    'set -u',
-    'dom="gui/$(id -u)"',
-    `target=${shq(targetLabel)}`,
-    `helper=${shq(helperLabel)}`,
-    `target_file=${shq(targetFile)}`,
-    `staged_file=${shq(stagedFile)}`,
-    `backup_file=${shq(backupFile)}`,
-    `helper_file=${shq(helperFile)}`,
-    `expected=${shq(expectedRuntime)}`,
-    `version=${shq(version)}`,
-    `status=${shq(statusFile)}`,
-    `ready=${shq(readyFile)}`,
-    `requires_ready=${requiresReady ? '1' : '0'}`,
-    'tmp="$status.tmp.$$"',
-    'ok=0',
-    'live_pid=""',
-    'stable=0',
-    'had_previous=0',
-    'if [ -f "$target_file" ]; then cp "$target_file" "$backup_file" && had_previous=1; fi',
-    'launchctl bootout "$dom/$target" 2>/dev/null || true',
-    'for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done',
-    'if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi',
-    'cp "$staged_file" "$target_file"',
-    'launchctl enable "$dom/$target" 2>/dev/null || true',
-    'for i in $(seq 1 30); do launchctl bootstrap "$dom" "$target_file" 2>/dev/null && break; sleep 0.3; done',
-    'printf "update_handoff_start target=%s version=%s timeout_s=90\\n" "$target" "$version"',
-    'for i in $(seq 1 ' + SERVICE_PROOF_POLLS + '); do snapshot="$(launchctl print "$dom/$target" 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^[[:space:]]*pid = \\([0-9][0-9]*\\)[[:space:]]*$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && grep -F "\\"version\\":\\"$version\\"" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F -- "$expected" >/dev/null && printf "%s\\n" "$snapshot" | grep -F "state = running" >/dev/null; then if [ "$pid" = "$live_pid" ]; then stable=$((stable+1)); else live_pid="$pid"; stable=1; fi; if [ "$stable" -ge 5 ]; then ok=1; break; fi; else live_pid=""; stable=0; fi; sleep ' + SERVICE_PROOF_SLEEP_SECONDS + '; done',
-    'if [ "$ok" != 1 ]; then ready_state=missing; [ -f "$ready" ] && ready_state=present; printf "update_handoff_verify_timeout target=%s version=%s last_pid=%s ready=%s\\n" "$target" "$version" "$live_pid" "$ready_state"; fi',
-    `if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: true, version: String(version), target: String(targetLabel) })}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then launchctl bootout "$dom/$target" 2>/dev/null || true; for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done; if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi; cp "$backup_file" "$target_file"; launchctl enable "$dom/$target" 2>/dev/null || true; bootstrapped=0; for i in $(seq 1 30); do if launchctl bootstrap "$dom" "$target_file" 2>/dev/null; then bootstrapped=1; break; fi; sleep 0.3; done; if [ "$bootstrapped" = 1 ]; then rollback_pid=""; rollback_stable=0; for i in $(seq 1 ${SERVICE_PROOF_POLLS}); do snapshot="$(launchctl print "$dom/$target" 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^[[:space:]]*pid = \\([0-9][0-9]*\\)[[:space:]]*$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F "state = running" >/dev/null; then if [ "$pid" = "$rollback_pid" ]; then rollback_stable=$((rollback_stable+1)); else rollback_pid="$pid"; rollback_stable=1; fi; if [ "$rollback_stable" -ge 5 ]; then rollback=1; break; fi; else rollback_pid=""; rollback_stable=0; fi; sleep ${SERVICE_PROOF_SLEEP_SECONDS}; done; fi; else launchctl bootout "$dom/$target" 2>/dev/null || true; rm -f "$target_file"; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed within 90s; previous service restored and ready', rolledBack: true })}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed within 90s and ready rollback failed', rolledBack: false })}' > "$tmp"; fi; fi`,
-    'printf "update_handoff_complete target=%s version=%s ok=%s\\n" "$target" "$version" "$ok"',
-    'mv "$tmp" "$status"',
-    'rm -f "$staged_file" "$backup_file" "$helper_file"',
-    'launchctl bootout "$dom/$helper" >/dev/null 2>&1 || true',
-    'exit "$((1-ok))"',
-  ].join('; ')
-  const content = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>
-  <key>Label</key><string>${xml(helperLabel)}</string>
-  <key>ProgramArguments</key><array><string>/bin/bash</string><string>-lc</string><string>${xml(script)}</string></array>
-  <key>RunAtLoad</key><true/>
-  <key>StandardOutPath</key><string>${xml(logFile)}</string>
-  <key>StandardErrorPath</key><string>${xml(logFile)}</string>
-</dict></plist>\n`
-  return { helperLabel, helperFile, backupFile, statusFile, logFile, script, content }
-}
-
-// Linux has the same self-replacement hazard as launchd: `systemctl restart` issued
-// from inside the account service can terminate the caller before it observes the new
-// process. Run the destructive transaction in a separate transient user unit, and use
-// the same process-bound account readiness receipt as macOS before committing success.
-export function buildLinuxReloadHandoff({ targetLabel, targetFile, stagedFile, expectedRuntime, version, nonce = `${process.pid}-${Date.now()}` }) {
-  if (!/^io\.thinkpool\.pair\.[A-Za-z0-9_.-]+$/.test(String(targetLabel))) throw new Error(`invalid service label: ${targetLabel}`)
-  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(version))) throw new Error(`invalid runtime version: ${version}`)
-  const safeNonce = String(nonce).replace(/[^A-Za-z0-9-]/g, '') || String(process.pid)
-  const helperLabel = `io.thinkpool.pair.update.${safeNonce}`
-  const backupFile = `${stagedFile}.previous`
-  const statusFile = path.join(os.homedir(), '.thinkpool-pair', 'update-status.json')
-  const logFile = path.join(os.homedir(), '.thinkpool-pair', 'update.log')
-  const readyFile = path.join(os.homedir(), '.thinkpool-pair', 'account-ready.json')
-  const requiresReady = targetLabel === label(null)
-  const script = [
-    'set -u',
-    `target=${shq(targetLabel)}`,
-    'unit="$target.service"',
-    `target_file=${shq(targetFile)}`,
-    `staged_file=${shq(stagedFile)}`,
-    `backup_file=${shq(backupFile)}`,
-    `expected=${shq(expectedRuntime)}`,
-    `version=${shq(version)}`,
-    `status=${shq(statusFile)}`,
-    `ready=${shq(readyFile)}`,
-    `requires_ready=${requiresReady ? '1' : '0'}`,
-    'tmp="$status.tmp.$$"',
-    'ok=0',
-    'had_previous=0',
-    'if [ -f "$target_file" ]; then cp "$target_file" "$backup_file" && had_previous=1; fi',
-    'systemctl --user stop "$unit" 2>/dev/null || true',
-    'if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi',
-    'cp "$staged_file" "$target_file"',
-    'systemctl --user daemon-reload',
-    'systemctl --user enable "$unit" >/dev/null 2>&1 || true',
-    'systemctl --user restart "$unit" >/dev/null 2>&1 || true',
-    'live_pid=""',
-    'stable=0',
-    'printf "update_handoff_start target=%s version=%s timeout_s=90\\n" "$target" "$version"',
-    'for i in $(seq 1 ' + SERVICE_PROOF_POLLS + '); do snapshot="$(systemctl --user show "$unit" --property=ActiveState --property=MainPID --property=ExecStart 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^MainPID=\\([1-9][0-9]*\\)$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && grep -F "\\"version\\":\\"$version\\"" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F "ActiveState=active" >/dev/null && printf "%s\\n" "$snapshot" | grep -F -- "$expected" >/dev/null; then if [ "$pid" = "$live_pid" ]; then stable=$((stable+1)); else live_pid="$pid"; stable=1; fi; if [ "$stable" -ge 5 ]; then ok=1; break; fi; else live_pid=""; stable=0; fi; sleep ' + SERVICE_PROOF_SLEEP_SECONDS + '; done',
-    'if [ "$ok" != 1 ]; then ready_state=missing; [ -f "$ready" ] && ready_state=present; printf "update_handoff_verify_timeout target=%s version=%s last_pid=%s ready=%s\\n" "$target" "$version" "$live_pid" "$ready_state"; fi',
-    `if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: true, version: String(version), target: String(targetLabel) })}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then systemctl --user stop "$unit" 2>/dev/null || true; if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi; cp "$backup_file" "$target_file"; systemctl --user daemon-reload; systemctl --user enable "$unit" >/dev/null 2>&1 || true; systemctl --user restart "$unit" >/dev/null 2>&1 || true; rollback_pid=""; rollback_stable=0; for i in $(seq 1 ${SERVICE_PROOF_POLLS}); do snapshot="$(systemctl --user show "$unit" --property=ActiveState --property=MainPID 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^MainPID=\\([1-9][0-9]*\\)$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F "ActiveState=active" >/dev/null; then if [ "$pid" = "$rollback_pid" ]; then rollback_stable=$((rollback_stable+1)); else rollback_pid="$pid"; rollback_stable=1; fi; if [ "$rollback_stable" -ge 5 ]; then rollback=1; break; fi; else rollback_pid=""; rollback_stable=0; fi; sleep ${SERVICE_PROOF_SLEEP_SECONDS}; done; else systemctl --user stop "$unit" 2>/dev/null || true; rm -f "$target_file"; systemctl --user daemon-reload; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed within 90s; previous service restored and ready', rolledBack: true })}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed within 90s and ready rollback failed', rolledBack: false })}' > "$tmp"; fi; fi`,
-    'printf "update_handoff_complete target=%s version=%s ok=%s\\n" "$target" "$version" "$ok"',
-    'mv "$tmp" "$status"',
-    'rm -f "$staged_file" "$backup_file"',
-    'exit "$((1-ok))"',
-  ].join('; ')
-  return { helperLabel, backupFile, statusFile, logFile, script }
-}
-
-const accountLockFile = () => path.join(os.homedir(), '.thinkpool-pair', 'account.lock')
-const processAlive = (pid) => {
-  try { process.kill(pid, 0); return true } catch (error) { return error?.code === 'EPERM' }
-}
-
-// A first background install can race a foreground/orphaned ThinkPool bridge that
-// still owns account.lock. The launchd child then exits 0, satisfying a momentary
-// `state = running` probe while KeepAlive correctly declines to restart it. Retire
-// only a PID whose command is demonstrably a packaged ThinkPool bridge; fail closed
-// on PID reuse or an unrelated process.
-export async function retireUnmanagedBridgeLock({
-  lockFile = accountLockFile(),
-  readLock = () => fs.readFileSync(lockFile, 'utf8'),
-  removeLock = () => fs.rmSync(lockFile, { force: true }),
-  commandForPid = (pid) => String(execSync(`ps -p ${pid} -o command=`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })),
-  alive = processAlive,
-  signal = (pid, sig) => process.kill(pid, sig),
-  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-  waitMs = 2500,
-  pollMs = 100,
-  stderr = process.stderr,
-} = {}) {
-  let pid = 0
-  try { pid = parseInt(String(readLock()).trim(), 10) || 0 } catch { return true }
-  const removeIfSameAndDead = () => {
-    if (alive(pid)) return false
-    try { if ((parseInt(String(readLock()).trim(), 10) || 0) === pid) removeLock() } catch { /* already gone */ }
-    return true
-  }
-  if (!pid || pid === process.pid || removeIfSameAndDead()) return true
-  let command = ''
-  try { command = commandForPid(pid) } catch { return removeIfSameAndDead() }
-  const packagedBridge = /(?:node_modules[\\/]thinkpool-pair|\.npm[\\/]_npx|\.thinkpool-pair[\\/]runtimes)[\\/][^\n]*bridge\.mjs(?:\s|$)/.test(command)
-  if (!packagedBridge) {
-    stderr.write(`  ⚠ account.lock belongs to PID ${pid}, but it is not a verified thinkpool-pair bridge; refusing to signal an unrelated process.\n`)
-    return false
-  }
-  stderr.write(`  ◆ stopping previous thinkpool-pair bridge (PID ${pid}) before installing the background service…\n`)
-  try { signal(pid, 'SIGTERM') } catch { if (removeIfSameAndDead()) return true }
-  const polls = Math.max(1, Math.ceil(Math.max(0, Number(waitMs) || 0) / Math.max(1, Number(pollMs) || 1)))
-  for (let i = 0; i < polls; i++) { if (removeIfSameAndDead()) return true; await sleep(Math.max(1, Number(pollMs) || 1)) }
-  try { signal(pid, 'SIGKILL') } catch { /* checked below */ }
-  for (let i = 0; i < 5; i++) { if (removeIfSameAndDead()) return true; await sleep(Math.max(1, Number(pollMs) || 1)) }
-  stderr.write(`  ⚠ previous thinkpool-pair bridge PID ${pid} did not stop; background install aborted to avoid two competing bridges.\n`)
-  return false
-}
-
-function startDarwinReloadHandoff(a, version) {
-  const stagedFile = path.join(a.logDir, `service-update-${process.pid}-${Date.now()}.plist`)
-  const h = buildDarwinReloadHandoff({ targetLabel: labelFromFile(a.file), targetFile: a.file, stagedFile, expectedRuntime: a.expectedRuntime, version })
-  fs.mkdirSync(path.dirname(h.helperFile), { recursive: true })
-  fs.mkdirSync(path.dirname(h.statusFile), { recursive: true })
-  fs.rmSync(h.statusFile, { force: true })
-  fs.writeFileSync(stagedFile, a.content)
-  fs.writeFileSync(h.helperFile, h.content)
-  try {
-    execSync(`launchctl bootstrap gui/$(id -u) ${shq(h.helperFile)}`, { stdio: 'inherit', shell: '/bin/bash' })
-    process.stderr.write(`  ◆ update handoff armed outside the bridge process tree — completion is recorded in ${h.statusFile}.\n`)
-    return true
-  } catch (e) {
-    fs.rmSync(stagedFile, { force: true })
-    fs.rmSync(h.helperFile, { force: true })
-    process.stderr.write(`  ⚠ could not arm the launchd update handoff; existing service left running: ${e.message}\n`)
-    return false
-  }
-}
-
-function startLinuxReloadHandoff(a, version) {
-  const stagedFile = path.join(a.logDir, `service-update-${process.pid}-${Date.now()}.service`)
-  const h = buildLinuxReloadHandoff({ targetLabel: labelFromFile(a.file), targetFile: a.file, stagedFile, expectedRuntime: a.expectedRuntime, version })
-  fs.mkdirSync(path.dirname(h.statusFile), { recursive: true })
-  fs.rmSync(h.statusFile, { force: true })
-  fs.writeFileSync(stagedFile, a.content)
-  try {
-    execSync(`systemd-run --user --unit=${shq(h.helperLabel)} --collect --property=StandardOutput=append:${shq(h.logFile)} --property=StandardError=append:${shq(h.logFile)} /bin/bash -lc ${shq(h.script)}`, { stdio: 'inherit', shell: '/bin/bash' })
-    process.stderr.write(`  ◆ update handoff armed outside the bridge service cgroup — completion is recorded in ${h.statusFile}.\n`)
-    return true
-  } catch (e) {
-    fs.rmSync(stagedFile, { force: true })
-    process.stderr.write(`  ⚠ could not arm the systemd update handoff; existing service left running: ${e.message}\n`)
-    return false
-  }
-}
-
-function labelFromFile(file) {
-  const match = path.basename(file).match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_.-]+)\.(?:plist|service)$/)
-  if (!match) throw new Error(`cannot derive service label from ${file}`)
-  return match[1]
-}
-
-// F4 — every io.thinkpool.pair.* label currently LOADED in the launchd/systemd domain,
-// plus any label with a plist/unit still on disk (loaded or not). Pure enumeration so the
-// sweep below is testable in isolation. `keepLabel` is the label we're about to (re)install
-// — its own bootout+bootstrap is the caller's job, so the sweep leaves it alone.
-export function existingServiceLabels(platform = process.platform, { fsMod = fs } = {}) {
-  const labels = new Set()
-  try {
-    if (platform === 'darwin') {
-      try {
-        const out = execSync(`launchctl print gui/$(id -u) 2>/dev/null | grep -oE 'io\\.thinkpool\\.pair\\.[A-Za-z0-9_]+' | sort -u`, { encoding: 'utf8', shell: '/bin/bash' })
-        for (const l of out.split('\n')) { const t = l.trim(); if (t) labels.add(t) }
-      } catch { /* nothing loaded */ }
-      try {
-        const dir = path.join(os.homedir(), 'Library', 'LaunchAgents')
-        for (const f of fsMod.readdirSync(dir)) { const m = f.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.plist$/); if (m) labels.add(m[1]) }
-      } catch { /* no dir */ }
-    } else if (platform === 'linux') {
-      try {
-        const out = execSync(`systemctl --user list-unit-files 'io.thinkpool.pair.*' --no-legend 2>/dev/null | awk '{print $1}'`, { encoding: 'utf8', shell: '/bin/bash' })
-        for (const l of out.split('\n')) { const t = l.trim().replace(/\.service$/, ''); if (t) labels.add(t) }
-      } catch { /* none */ }
-      try {
-        const dir = path.join(os.homedir(), '.config', 'systemd', 'user')
-        for (const f of fsMod.readdirSync(dir)) { const m = f.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.service$/); if (m) labels.add(m[1]) }
-      } catch { /* no dir */ }
-    }
-  } catch { /* best-effort */ }
-  return [...labels]
-}
-
-// F4 — before (re)installing, sweep EVERY pre-existing thinkpool-pair service EXCEPT the one
-// we're about to install (which the install path bootout+bootstraps itself). Today's outage
-// trigger was an uninstall/reinstall leaving TWO account services live, both heart-beating,
-// racing the saved login. Idempotent + best-effort; never throws. Also reaps orphaned ROOM
-// CHILD bridges (the proven verifyDarwinReload pattern — the uppercase-room guard never
-// matches the no-arg menu or the supervisor, so the live account bridge is never touched).
-export function sweepExistingServices(keepLabel, platform = process.platform) {
-  for (const lbl of existingServiceLabels(platform)) {
-    if (lbl === keepLabel) continue
-    try {
-      if (platform === 'darwin') {
-        execSync(`launchctl bootout gui/$(id -u)/${lbl} 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' })
-        try { fs.rmSync(path.join(os.homedir(), 'Library', 'LaunchAgents', `${lbl}.plist`), { force: true }) } catch { /* noop */ }
-      } else if (platform === 'linux') {
-        execSync(`systemctl --user disable --now ${lbl}.service 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' })
-      }
-      process.stderr.write(`  ◆ swept stale service ${lbl}\n`)
-    } catch { /* best-effort */ }
-  }
-  // Reap orphaned ROOM child bridges only — safe (never the supervisor / interactive menu).
-  if (platform !== 'win32') {
-    try { execSync(`pkill -9 -f 'thinkpool-pair/bridge.mjs [A-Z0-9]' 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' }) } catch { /* noop */ }
-  }
-}
-
-// staleProof remains for the legacy npx artifact shape. Pinned services normally bypass
-// npx entirely through the verified immutable runtime provisioned below.
-export function installService(room, cmdArgs = [], { autoUpdate = false, version = VERSION, staleProof = true } = {}) {
-  // Pinned services get a stable local runtime. The legacy @latest opt-in keeps its
-  // existing npx behavior until it resolves a concrete version through updateService.
-  let runtimeEntry = null
-  if (!autoUpdate) {
-    try { runtimeEntry = provisionRuntime(version) }
-    catch (e) { process.stderr.write(`  ⚠ runtime install failed; service left unchanged: ${e.message}\n`); return false }
-  }
-  const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate, version, staleProof, runtimeEntry })
-  // F4: clear every OTHER pre-existing pair service first, so only the one we install remains
-  // (the "two account services live" storm trigger). Our own label is handled by the
-  // launchd handoff (macOS) or the platform post command, so keep it.
-  try { sweepExistingServices(label(room), process.platform) } catch { /* best-effort */ }
-  fs.mkdirSync(a.logDir, { recursive: true })
-  fs.mkdirSync(path.dirname(a.file), { recursive: true })
-  if (process.platform === 'darwin') {
-    process.stderr.write(`\n  ◆ staged replacement for ${a.file}\n`)
-    if (!startDarwinReloadHandoff(a, version)) return false
-  } else if (process.platform === 'linux') {
-    process.stderr.write(`\n  ◆ staged replacement for ${a.file}\n`)
-    if (!startLinuxReloadHandoff(a, version)) return false
-  } else {
-    fs.writeFileSync(a.file, a.content)
-    process.stderr.write(`\n  ◆ wrote ${a.file}\n`)
-    for (const cmd of a.post) {
-      try { execSync(cmd, { stdio: 'inherit' }) }
-      catch (e) { process.stderr.write(`  ⚠ "${cmd}" failed; service update NOT confirmed: ${e.message}\n`); return false }
-    }
-  }
-  // Be honest about the cadence — it is NOT instant. The supervisor polls npm
-  // roughly every 30 min (THINKPOOL_PAIR_UPDATE_INTERVAL) and only restarts once
-  // every served session is idle, so a just-published version can take a while.
-  const idleSecs = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90)
-  const updateNote = autoUpdate
-    ? (process.platform === 'win32'
-        ? 'auto-update ON: a new thinkpool-pair@latest applies on the next login/restart (Windows has no in-process self-update).'
-        : `auto-update ON: checks npm ~every 30 min and restarts to apply a new @latest once sessions are idle (≥${idleSecs}s quiet; they resume in place).`)
-    : `PINNED to ${version} (stable local runtime; restarts do not depend on npx or the network). To update: use "Restart & update the bridge" (or run ${pairCli('install-service', room || undefined)}). Pass --auto-update to track @latest instead.`
-  const removeArg = room ? ` ${room}` : ''
-  const what = room ? `room ${room}` : 'your account (auto-serves every session)'
-  const awakeNote = loadKeepAwakePreference()
-    ? '  ◆ Keep-awake on: system sleep is inhibited while the bridge runs (higher battery use); the display may still dim, lock, and turn off.\n'
-    : ''
-  const runtimeNote = '  ◆ Prerequisite: Claude Code, Codex, or Hermes must be installed on this machine. BYOK supplies model credentials; it does not install an agent.\n'
-  process.stderr.write(`  ◆ ${what}\n  ◆ ${process.platform === 'darwin' ? 'Launchd is completing and verifying the reload independently.' : a.note}\n${runtimeNote}${awakeNote}  ◆ ${updateNote}\n  ◆ logs: ${path.join(a.logDir, `${slug(room)}.log`)}\n  ◆ remove with: ${pairCli('uninstall-service')}${removeArg}\n\n`)
-  return true
-}
-
-// Interactive installs must not present an armed launchd helper as a completed
-// background service. installService() intentionally returns after staging because
-// an in-service update may tear down its caller; this menu/CLI primitive waits for the
-// helper receipt AND the exact live runtime before returning success.
-export async function installAndConfirmService(room, cmdArgs = [], {
-  platform = process.platform,
-  version = VERSION,
-  staleProof = true,
-  install = installService,
-  exec = execSync,
-  snapshot = serviceRuntimeSnapshot,
-  prepareAccountHandoff = retireUnmanagedBridgeLock,
-  readReady = () => readSupervisorReady(),
-  readStatus = () => {
-    try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
-  },
-  now = Date.now,
-  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-  timeoutMs = SERVICE_CONFIRM_TIMEOUT_MS,
-  pollMs = 250,
-  stderr = process.stderr,
-} = {}) {
-  const before = snapshot(room, { platform, exec })
-  if (!room && platform !== 'win32' && !before) {
-    if (!(await prepareAccountHandoff())) {
-      stderr.write('  ⚠ background install aborted: the previous bridge could not be handed off safely.\n')
-      return false
-    }
-  }
-  const confirmationStartedAt = now()
-  if (install(room, cmdArgs, { version, staleProof }) === false) return false
-
-  const confirmation = () => {
-    const live = snapshot(room, { platform, exec })
-    const ready = !!room || platform === 'win32' || supervisorReadyMatches(readReady(), live, version, { notBefore: confirmationStartedAt })
-    if (live?.version === version && ready) {
-      stderr.write(`  ✓ bridge install confirmed — running v${version}.\n`)
-      return true
-    }
-    return false
-  }
-
-  // Windows has no service-manager process identity. macOS and Linux both cross an
-  // asynchronous external-helper boundary and must wait for its receipt plus account
-  // readiness; a live PID alone is not a connected bridge.
-  if (platform === 'win32') return true
-
-  const deadline = now() + Math.max(0, Number(timeoutMs) || 0)
-  const expectedTarget = label(room)
-  for (;;) {
-    const status = readStatus()
-    if (status && typeof status === 'object' && status.target === expectedTarget && status.version === version) {
-      if (status.ok === false) {
-        stderr.write(`  ⚠ install v${version} was not confirmed: ${status.error || 'the launchd handoff failed'}.\n`)
-        return false
-      }
-      if (status.ok === true && confirmation()) return true
-    }
-    if (now() >= deadline) {
-      stderr.write(`  ⚠ install v${version} timed out waiting for supervisor readiness; no connected account bridge was proven.\n`)
-      return false
-    }
-    await sleep(Math.max(1, Number(pollMs) || 1))
-  }
-}
-
-// Restart an already-installed boot-persistent service. launchd/systemd relaunch
-// the stable runtime (or legacy auto-update npx command), so active sessions resume
-// from disk. Use it to recover a wedged bridge or re-read provider.json.
-// room falsy → the ACCOUNT service. Returns true on success.
-export function restartService(room) {
-  const plat = process.platform
-  if (!isServiceInstalled(room)) {
-    process.stderr.write('  ⚠ no background service installed to restart — install one first.\n')
-    return false
-  }
-  const id = label(room)
-  try {
-    if (plat === 'darwin') execSync(`launchctl kickstart -k gui/$(id -u)/${id}`, { stdio: 'inherit' })
-    else if (plat === 'linux') execSync(`systemctl --user restart ${id}.service`, { stdio: 'inherit' })
-    else {
-      // Windows Startup .cmd has no managed daemon to kick — guide the manual path.
-      process.stderr.write('  ⚠ Windows has no managed daemon — close the running thinkpool-pair window and re-launch the Startup .cmd (or reboot) to restart.\n')
-      return false
-    }
-    process.stderr.write(`  ◆ restarted ${id} — any active session resumes in place.\n`)
-    return true
-  } catch (e) {
-    process.stderr.write(`  ⚠ restart failed: ${e.message}\n`)
-    return false
-  }
-}
-
-// One authoritative update path for both the interactive menu and `restart-service`.
-// Resolve the registry version first, then rewrite + reload the service pinned to that
-// exact build. If npm is unavailable, fail without pretending an old-version restart
-// was an update.
-function publishedServiceVersion(exec = execSync) {
-  let target = ''
-  try {
-    target = String(exec('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })).trim()
-  } catch { /* reported by caller */ }
-  return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(target) ? target : null
-}
-
-// Download and verify the immutable runtime WITHOUT replacing the live service.
-// The account supervisor can do this while rooms are busy, then re-check its
-// between-turn contract immediately before the now-fast service-manager reload.
-export function stageServiceUpdate(room, { exec = execSync, active = isServiceInstalled, provision = provisionRuntime } = {}) {
-  if (!active(room)) {
-    process.stderr.write('  ⚠ no background service installed to update — install one first.\n')
-    return null
-  }
-  const target = publishedServiceVersion(exec)
-  if (!target) {
-    process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n")
-    return null
-  }
-  process.stderr.write(`\n  ◆ preparing bridge v${target} in the background; active sessions keep running…\n`)
-  try { provision(target); return target } catch (error) {
-    process.stderr.write(`  ⚠ couldn't stage bridge v${target}: ${error?.message || error}\n`)
-    return null
-  }
-}
-
-export function applyStagedServiceUpdate(room, target, { install = installService, active = isServiceInstalled } = {}) {
-  if (!active(room) || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(target || ''))) return false
-  process.stderr.write(`\n  ◆ updating the background service to v${target} and restarting…\n`)
-  return install(room, [], { version: target, staleProof: true }) !== false
-}
-
-export function updateService(room, { exec = execSync, install = installService, active = isServiceInstalled } = {}) {
-  if (!active(room)) {
-    process.stderr.write('  ⚠ no background service installed to update — install one first.\n')
-    return false
-  }
-  const target = publishedServiceVersion(exec)
-  if (!target) {
-    process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n")
-    return false
-  }
-  process.stderr.write(`\n  ◆ updating the background service to v${target} and restarting…\n`)
-  return install(room, [], { version: target, staleProof: true }) !== false
-}
-
-// Menu/CLI-only update path. updateService intentionally returns as soon as it has
-// safely staged an update: on macOS it must do that so an independent launchd helper
-// can replace the service without killing its caller mid-transaction. Consumers that
-// need to say "updated" rather than "staged" must use this primitive instead.
-//
-// All dependencies are injectable so this contract can be tested without a service,
-// a clock, or npm. The default timeout exceeds the launchd handoff's bounded reload
-// and verification loops, but is still finite.
-export async function updateAndConfirmService(room, {
-  platform = process.platform,
-  exec = execSync,
-  update = updateService,
-  install = installService,
-  active = isServiceInstalled,
-  snapshot = serviceRuntimeSnapshot,
-  readReady = () => readSupervisorReady(),
-  readStatus = () => {
-    try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
-  },
-  now = Date.now,
-  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-  timeoutMs = SERVICE_CONFIRM_TIMEOUT_MS,
-  pollMs = 250,
-  stderr = process.stderr,
-} = {}) {
-  const before = snapshot(room, { platform, exec })
-  const confirmationStartedAt = now()
-  let target = null
-  const captureTarget = (...args) => {
-    const result = exec(...args)
-    const resolved = String(result).trim()
-    if (/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(resolved)) target = resolved
-    return result
-  }
-  const staged = update(room, { exec: captureTarget, install, active }) !== false
-  if (!staged || !target) {
-    stderr.write('  ⚠ update was not confirmed: staging the published runtime failed; the existing service was left unchanged.\n')
-    return false
-  }
-
-  const confirmation = () => {
-    const live = snapshot(room, { platform, exec })
-    const versionChanged = !!before && before.version !== target
-    const processChanged = !!before?.pid && !!live?.pid && before.pid !== live.pid
-    const ready = !!room || platform === 'win32' || supervisorReadyMatches(readReady(), live, target, { notBefore: confirmationStartedAt })
-    if (live?.version === target && (versionChanged || processChanged) && ready) {
-      stderr.write(`  ✓ bridge restart confirmed — running v${target}.\n`)
-      return { ok: true, live }
-    }
-    return { ok: false, live }
-  }
-  const printUnconfirmed = ({ live } = {}) => {
-    if (live?.version && live.version !== target) stderr.write(`  ⚠ update v${target} was not confirmed: live service is still v${live.version}.\n`)
-    else if (live?.version === target) stderr.write(`  ⚠ update v${target} was not confirmed: the service process did not restart.\n`)
-    else stderr.write(`  ⚠ update v${target} was not confirmed: the service manager cannot prove the new runtime is running.\n`)
-  }
-
-  // The Windows Startup-folder tier has no authoritative live-service identity, so
-  // callers use updateService directly and label it as a next-launch update. Both
-  // managed Unix tiers are asynchronous external handoffs and share the receipt loop.
-  if (platform === 'win32') return true
-
-  const deadline = now() + Math.max(0, Number(timeoutMs) || 0)
-  const expectedTarget = label(room)
-  let lastProof = null
-  for (;;) {
-    const status = readStatus()
-    if (status && typeof status === 'object' && status.target === expectedTarget) {
-      if (status.ok === false && status.version === target) {
-        stderr.write(`  ⚠ update v${target} was not confirmed: ${status.error || 'the launchd handoff failed'}.\n`)
-        return false
-      }
-      if (status.ok === true && status.version === target) {
-        lastProof = confirmation()
-        if (lastProof.ok) return true
-      }
-    }
-    if (now() >= deadline) {
-      if (lastProof) printUnconfirmed(lastProof)
-      else stderr.write(`  ⚠ update v${target} timed out waiting for launchd confirmation; the service may have rolled back.\n`)
-      return false
-    }
-    await sleep(Math.max(1, Number(pollMs) || 1))
-  }
-}
-
-// Ground truth: is the OS service manager ACTUALLY running our service right now?
-// A leftover plist/unit on disk does NOT mean it's loaded — `launchctl load` can
-// silently no-op (the 2026-06-26 "says installed but it's off" bug), and a unit can
-// be left disabled. Ask the manager, don't trust file presence. room falsy → account.
-export function serviceActive(room, { platform = process.platform, exec = execSync } = {}) {
-  const plat = platform
-  const id = label(room)
-  try {
-    if (plat === 'darwin') {
-      const out = exec(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
-      return darwinServiceRunning(out)
-    }
-    if (plat === 'linux')  { exec(`systemctl --user is-active --quiet ${id}.service`); return true }
-    // A Startup entry is install evidence, never proof that its console process
-    // is alive. Windows has no per-user manager we can query authoritatively.
-    return false
-  } catch { return false }
-}
-
-// Is a boot-persistent service installed AND loaded? room falsy → the ACCOUNT service.
-// Lets the main run skip the offer + avoid starting a second bridge that races the
-// service. Reflects launchd/systemd reality, not just file existence (so a plist that
-// failed to load reads as not-installed → the menu re-offers install, which self-heals).
-export function isServiceInstalled(room) {
-  if (process.platform === 'win32') {
-    try { return fs.existsSync(buildArtifact('win32', { room }).file) } catch { return false }
-  }
-  return serviceActive(room)
-}
-
-export function uninstallService(room) {
-  const plat = process.platform
-  let a
-  try { a = buildArtifact(plat, { room }) } catch (e) { process.stderr.write(`  ⚠ ${e.message}\n`); return }
-  if (plat === 'darwin') { try { execSync(`launchctl bootout gui/$(id -u)/${label(room)} 2>/dev/null`) } catch { /* noop */ } }
-  if (plat === 'linux') { try { execSync(`systemctl --user disable --now ${label(room)}.service 2>/dev/null`) } catch { /* noop */ } }
-  try { fs.rmSync(a.file, { force: true }); process.stderr.write(`  ◆ removed ${a.file}\n`) } catch (e) { process.stderr.write(`  ⚠ ${e.message}\n`) }
-}
+import e from"node:os";import t from"node:fs";import r from"node:path";import{execSync as n}from"node:child_process";import{hostMemoryAdmission as i}from"./host-memory.mjs";import{readSupervisorReady as o,supervisorReadyMatches as s}from"./supervisor-ready.mjs";import{pairCli as a}from"./command-guidance.mjs";import{loadKeepAwakePreference as l}from"./keep-awake.mjs";import{scheduledRunsEnabled as c}from"./scheduled-runs.mjs";const d=/^[A-Za-z0-9]{2,16}$/,p=e=>{if(e&&!d.test(e))throw new Error(`invalid room code: ${JSON.stringify(e)} (expected 2–16 alphanumerics)`);return e?`io.thinkpool.pair.${e.toLowerCase()}`:"io.thinkpool.pair.account"},u=e=>e||"account",f=e=>String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;"),$=e=>`'${String(e).replace(/'/g,"'\\''")}'`;export function sanitizeServicePath(e,t=process.platform){const r="win32"===t?";":":";return String(e||"").split(r).filter(e=>e&&!e.includes("/.npm/_npx/")).join(r)}export function darwinServiceRunning(e){const t=String(e||"");return/(^|\n)[ \t]*state = running[ \t]*($|\n)/.test(t)&&/(^|\n)[ \t]*pid = \d+[ \t]*($|\n)/.test(t)}const h=e=>`rm -rf ${$(r.join(e,"_npx"))}/* 2>/dev/null`,m=(()=>{try{return JSON.parse(t.readFileSync(new URL("./package.json",import.meta.url),"utf8")).version}catch{return"latest"}})();function g(e){try{const n=JSON.parse(t.readFileSync(r.join(r.dirname(e),"package.json"),"utf8"));return"string"==typeof n?.version?n.version:null}catch{return null}}export function provisionRuntime(o,{exec:s=n,root:a=r.join(e.homedir(),".thinkpool-pair","runtimes"),admit:l=i}={}){if(!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(o)))throw new Error(`invalid runtime version: ${o}`);const c=r.join(a,String(o)),d=r.join(c,"node_modules","thinkpool-pair","bridge.mjs");if(t.existsSync(d)&&g(d)===String(o))return d;const p=l("stage a bridge runtime update");if(!p?.ok)throw new Error(p?.reason||"host memory is critically low");const u=`${c}.install-${process.pid}-${Date.now()}`;t.rmSync(u,{recursive:!0,force:!0}),t.mkdirSync(u,{recursive:!0});const f=`https://registry.npmjs.org/thinkpool-pair/-/thinkpool-pair-${o}.tgz`,h=r.join(u,"node_modules","thinkpool-pair","bridge.mjs");try{s(`${$(function(e=process.platform){const n=r.dirname(process.execPath),i=r.join(n,"win32"===e?"npm.cmd":"npm");try{return t.accessSync(i),i}catch{return"win32"===e?"npm.cmd":"npm"}}())} install --prefix ${$(u)} ${$(f)} --prefer-online --no-audit --no-fund`,{stdio:"inherit",shell:"/bin/bash"});const e=g(h);if(!t.existsSync(h)||e!==String(o))throw new Error(`runtime verification failed: requested ${o}, installed ${e||"no valid package"}`);t.rmSync(c,{recursive:!0,force:!0}),t.renameSync(u,c)}catch(e){throw t.rmSync(u,{recursive:!0,force:!0}),e}return d}export function buildArtifact(n,{room:i=null,cmdArgs:o=[],autoUpdate:s=!1,version:a=m,staleProof:l=!1,runtimeEntry:d=null,scheduledRuns:g=c()}={}){const v=function(e){const n=r.dirname(process.execPath),i=r.join(n,"win32"===e?"npx.cmd":"npx");try{return t.accessSync(i),i}catch{return"win32"===e?"npx.cmd":"npx"}}(n),y=i?process.cwd():e.homedir(),k=u(i),b=r.join(e.homedir(),".thinkpool-pair"),w=r.join(b,`${k}.log`),S=sanitizeServicePath(process.env.PATH||"",n),_=r.join(e.homedir(),".thinkpool-pair","npm-cache"),x=o.length?["--",...o]:[],A=i?`bridge (${i})`:"account bridge",P=s?"thinkpool-pair@latest":`thinkpool-pair@${a}`,j=s||l?["--prefer-online"]:[],E=i?["-y",...j,P,i]:["-y",...j,P],F=!0===g?{darwin:"<key>TP_SCHEDULED_RUNS_ENABLED</key><string>1</string>",linux:"Environment=TP_SCHEDULED_RUNS_ENABLED=1\n",win32:'set "TP_SCHEDULED_RUNS_ENABLED=1"\r\n'}:{darwin:"",linux:"",win32:""};if("darwin"===n){const t=d?[process.execPath,d,...i?[i]:[],...x]:l?["/bin/bash","-lc",`${h(_)}; export NPM_CONFIG_CACHE=${$(_)}; exec ${[v,...E,...x].map($).join(" ")}`]:[v,...E,...x];return{file:r.join(e.homedir(),"Library","LaunchAgents",`${p(i)}.plist`),content:`<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>\n  <key>Label</key><string>${p(i)}</string>\n  <key>ProgramArguments</key><array>${t.map(e=>`<string>${f(e)}</string>`).join("")}</array>\n  <key>RunAtLoad</key><true/>\n  \x3c!-- KeepAlive only on UNSUCCESSFUL exit. A bridge that exits 0 has intentionally\n       stood down — told to stop, or another bridge already owns this machine's\n       singleton lock — and must NOT be relaunched, or launchd thrashes it every\n       few seconds forever (the 2026-06-28 account-bridge restart loop). A crash\n       or an update-restart exits non-zero and IS relaunched. Mirrors the bridge's\n       own exit-code contract (stop()=0, restart-requested=non-zero). --\x3e\n  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>\n  <key>WorkingDirectory</key><string>${f(y)}</string>\n  <key>StandardOutPath</key><string>${f(w)}</string>\n  <key>StandardErrorPath</key><string>${f(w)}</string>\n  <key>EnvironmentVariables</key><dict><key>PATH</key><string>${f(S)}</string>${d?"":`<key>NPM_CONFIG_CACHE</key><string>${f(_)}</string>`}${s?"<key>THINKPOOL_PAIR_AUTOUPDATE</key><string>1</string>":""}${F.darwin}</dict>\n</dict></plist>\n`,logDir:b,post:[],expectedRuntime:d||P,note:"Loaded as a LaunchAgent — starts at login, restarts on crash."}}if("linux"===n){const t=d?[process.execPath,d,...i?[i]:[],...x]:[v,...E,...x];return{file:r.join(e.homedir(),".config","systemd","user",`${p(i)}.service`),content:`[Unit]\nDescription=ThinkPool Code ${A}\nAfter=network-online.target\n\n[Service]\nExecStart=${d?t.map(e=>`'${e.replace(/'/g,"'\\''")}'`).join(" "):l?`/bin/bash -lc "${h(_)}; export NPM_CONFIG_CACHE=${$(_)}; exec ${[v,...E,...x].join(" ")}"`:t.map(e=>`'${e.replace(/'/g,"'\\''")}'`).join(" ")}\nRestart=always\nRestartSec=2\n# Don't relaunch a clean stand-down. exit 0 = the bridge intentionally stopped —\n# told to stop, or another bridge already holds this machine's singleton lock —\n# so restarting it just thrashes every RestartSec forever (the 2026-06-28\n# account-bridge restart loop). Crashes + update-restarts exit non-zero and are\n# still restarted. Matches the bridge's exit-code contract (stop()=0, restart=non-zero).\nRestartPreventExitStatus=0\nWorkingDirectory=${y}\nEnvironment=PATH=${S}\n${d?"":`Environment=NPM_CONFIG_CACHE=${_}\n`}${s?"Environment=THINKPOOL_PAIR_AUTOUPDATE=1\n":""}${F.linux}StandardOutput=append:${w}\nStandardError=append:${w}\n\n[Install]\nWantedBy=default.target\n`,logDir:b,post:["systemctl --user daemon-reload",`systemctl --user enable ${p(i)}.service`,`systemctl --user restart ${p(i)}.service`],expectedRuntime:d||P,note:"Enabled as a systemd --user service. Run `loginctl enable-linger $USER` once to keep it running after logout."}}if("win32"===n){const t=r.join(process.env.APPDATA||r.join(e.homedir(),"AppData","Roaming"),"Microsoft","Windows","Start Menu","Programs","Startup"),n=r.join(t,`thinkpool-pair-${k}.cmd`),o=d?[process.execPath,d,...i?[i,"--supervise"]:[],...x].map(e=>`"${e}"`).join(" "):i?["npx","-y",...j,P,i,"--supervise",...x].join(" "):["npx","-y",...j,P].join(" ");return{file:n,content:`@echo off\r\ntitle thinkpool-pair ${k}\r\n${d?"":`set "NPM_CONFIG_CACHE=${_}"\r\n`}${F.win32}${o}\r\n`,logDir:b,post:[],note:"Installed to the Startup folder — runs at login"+(i?" with --supervise (auto-restart on crash).":" (account mode).")+" Start it now without rebooting by double-clicking the .cmd, or run it from a terminal."}}throw new Error(`unsupported platform: ${n}`)}export function parseRunningPairVersions(e){const t=String(e).match(/(?:thinkpool-pair@|runtimes[\\/])(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/g)||[];return new Set(t.map(e=>e.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0]).filter(Boolean))}export function serviceRuntimeSnapshot(e,{platform:t=process.platform,exec:r=n}={}){const i=e=>{const t=parseRunningPairVersions(e);return 1===t.size?[...t][0]:null},o=p(e);try{if("darwin"===t){const e=r(`launchctl print gui/$(id -u)/${o}`,{encoding:"utf8",stdio:["ignore","pipe","ignore"],shell:"/bin/bash"}),t=String(e).match(/(^|\n)[ \t]*pid = (\d+)[ \t]*($|\n)/)?.[2];return darwinServiceRunning(e)?{version:i(e),pid:t||null}:null}if("linux"===t){const e=r(`systemctl --user show ${o}.service --property=ActiveState --property=MainPID --property=ExecStart`,{encoding:"utf8",stdio:["ignore","pipe","ignore"]}),t=String(e).match(/^MainPID=([1-9]\d*)$/m)?.[1];return/^ActiveState=active$/m.test(String(e))&&t?{version:i(e),pid:t}:null}}catch{}return null}export function serviceRuntimeVersion(e,t){return serviceRuntimeSnapshot(e,t)?.version||null}export function buildDarwinReloadHandoff({targetLabel:t,targetFile:n,stagedFile:i,expectedRuntime:o,version:s,nonce:a=`${process.pid}-${Date.now()}`}){if(!/^io\.thinkpool\.pair\.[A-Za-z0-9_.-]+$/.test(String(t)))throw new Error(`invalid service label: ${t}`);if(!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(s)))throw new Error(`invalid runtime version: ${s}`);const l=`io.thinkpool.pair.update.${String(a).replace(/[^A-Za-z0-9-]/g,"")||String(process.pid)}`,c=r.join(e.homedir(),"Library","LaunchAgents",`${l}.plist`),d=`${i}.previous`,u=r.join(e.homedir(),".thinkpool-pair","update-status.json"),h=r.join(e.homedir(),".thinkpool-pair","update.log"),m=r.join(e.homedir(),".thinkpool-pair","account-ready.json"),g=t===p(null),v=["set -u",'dom="gui/$(id -u)"',`target=${$(t)}`,`helper=${$(l)}`,`target_file=${$(n)}`,`staged_file=${$(i)}`,`backup_file=${$(d)}`,`helper_file=${$(c)}`,`expected=${$(o)}`,`version=${$(s)}`,`status=${$(u)}`,`ready=${$(m)}`,"requires_ready="+(g?"1":"0"),'tmp="$status.tmp.$$"',"ok=0",'live_pid=""',"stable=0","had_previous=0",'if [ -f "$target_file" ]; then cp "$target_file" "$backup_file" && had_previous=1; fi','launchctl bootout "$dom/$target" 2>/dev/null || true','for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done','if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi','cp "$staged_file" "$target_file"','launchctl enable "$dom/$target" 2>/dev/null || true','for i in $(seq 1 30); do launchctl bootstrap "$dom" "$target_file" 2>/dev/null && break; sleep 0.3; done','printf "update_handoff_start target=%s version=%s timeout_s=90\\n" "$target" "$version"','for i in $(seq 1 180); do snapshot="$(launchctl print "$dom/$target" 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^[[:space:]]*pid = \\([0-9][0-9]*\\)[[:space:]]*$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && grep -F "\\"version\\":\\"$version\\"" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F -- "$expected" >/dev/null && printf "%s\\n" "$snapshot" | grep -F "state = running" >/dev/null; then if [ "$pid" = "$live_pid" ]; then stable=$((stable+1)); else live_pid="$pid"; stable=1; fi; if [ "$stable" -ge 5 ]; then ok=1; break; fi; else live_pid=""; stable=0; fi; sleep 0.5; done','if [ "$ok" != 1 ]; then ready_state=missing; [ -f "$ready" ] && ready_state=present; printf "update_handoff_verify_timeout target=%s version=%s last_pid=%s ready=%s\\n" "$target" "$version" "$live_pid" "$ready_state"; fi',`if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ok:!0,version:String(s),target:String(t)})}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then launchctl bootout "$dom/$target" 2>/dev/null || true; for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done; if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi; cp "$backup_file" "$target_file"; launchctl enable "$dom/$target" 2>/dev/null || true; bootstrapped=0; for i in $(seq 1 30); do if launchctl bootstrap "$dom" "$target_file" 2>/dev/null; then bootstrapped=1; break; fi; sleep 0.3; done; if [ "$bootstrapped" = 1 ]; then rollback_pid=""; rollback_stable=0; for i in $(seq 1 180); do snapshot="$(launchctl print "$dom/$target" 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^[[:space:]]*pid = \\([0-9][0-9]*\\)[[:space:]]*$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F "state = running" >/dev/null; then if [ "$pid" = "$rollback_pid" ]; then rollback_stable=$((rollback_stable+1)); else rollback_pid="$pid"; rollback_stable=1; fi; if [ "$rollback_stable" -ge 5 ]; then rollback=1; break; fi; else rollback_pid=""; rollback_stable=0; fi; sleep 0.5; done; fi; else launchctl bootout "$dom/$target" 2>/dev/null || true; rm -f "$target_file"; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ok:!1,version:String(s),target:String(t),error:"new runtime not confirmed within 90s; previous service restored and ready",rolledBack:!0})}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ok:!1,version:String(s),target:String(t),error:"new runtime not confirmed within 90s and ready rollback failed",rolledBack:!1})}' > "$tmp"; fi; fi`,'printf "update_handoff_complete target=%s version=%s ok=%s\\n" "$target" "$version" "$ok"','mv "$tmp" "$status"','rm -f "$staged_file" "$backup_file" "$helper_file"','launchctl bootout "$dom/$helper" >/dev/null 2>&1 || true','exit "$((1-ok))"'].join("; ");return{helperLabel:l,helperFile:c,backupFile:d,statusFile:u,logFile:h,script:v,content:`<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>\n  <key>Label</key><string>${f(l)}</string>\n  <key>ProgramArguments</key><array><string>/bin/bash</string><string>-lc</string><string>${f(v)}</string></array>\n  <key>RunAtLoad</key><true/>\n  <key>StandardOutPath</key><string>${f(h)}</string>\n  <key>StandardErrorPath</key><string>${f(h)}</string>\n</dict></plist>\n`}}export function buildLinuxReloadHandoff({targetLabel:t,targetFile:n,stagedFile:i,expectedRuntime:o,version:s,nonce:a=`${process.pid}-${Date.now()}`}){if(!/^io\.thinkpool\.pair\.[A-Za-z0-9_.-]+$/.test(String(t)))throw new Error(`invalid service label: ${t}`);if(!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(s)))throw new Error(`invalid runtime version: ${s}`);const l=`io.thinkpool.pair.update.${String(a).replace(/[^A-Za-z0-9-]/g,"")||String(process.pid)}`,c=`${i}.previous`,d=r.join(e.homedir(),".thinkpool-pair","update-status.json"),u=r.join(e.homedir(),".thinkpool-pair","update.log"),f=r.join(e.homedir(),".thinkpool-pair","account-ready.json"),h=t===p(null);return{helperLabel:l,backupFile:c,statusFile:d,logFile:u,script:["set -u",`target=${$(t)}`,'unit="$target.service"',`target_file=${$(n)}`,`staged_file=${$(i)}`,`backup_file=${$(c)}`,`expected=${$(o)}`,`version=${$(s)}`,`status=${$(d)}`,`ready=${$(f)}`,"requires_ready="+(h?"1":"0"),'tmp="$status.tmp.$$"',"ok=0","had_previous=0",'if [ -f "$target_file" ]; then cp "$target_file" "$backup_file" && had_previous=1; fi','systemctl --user stop "$unit" 2>/dev/null || true','if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi','cp "$staged_file" "$target_file"',"systemctl --user daemon-reload",'systemctl --user enable "$unit" >/dev/null 2>&1 || true','systemctl --user restart "$unit" >/dev/null 2>&1 || true','live_pid=""',"stable=0",'printf "update_handoff_start target=%s version=%s timeout_s=90\\n" "$target" "$version"','for i in $(seq 1 180); do snapshot="$(systemctl --user show "$unit" --property=ActiveState --property=MainPID --property=ExecStart 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^MainPID=\\([1-9][0-9]*\\)$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && grep -F "\\"version\\":\\"$version\\"" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F "ActiveState=active" >/dev/null && printf "%s\\n" "$snapshot" | grep -F -- "$expected" >/dev/null; then if [ "$pid" = "$live_pid" ]; then stable=$((stable+1)); else live_pid="$pid"; stable=1; fi; if [ "$stable" -ge 5 ]; then ok=1; break; fi; else live_pid=""; stable=0; fi; sleep 0.5; done','if [ "$ok" != 1 ]; then ready_state=missing; [ -f "$ready" ] && ready_state=present; printf "update_handoff_verify_timeout target=%s version=%s last_pid=%s ready=%s\\n" "$target" "$version" "$live_pid" "$ready_state"; fi',`if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ok:!0,version:String(s),target:String(t)})}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then systemctl --user stop "$unit" 2>/dev/null || true; if [ "$requires_ready" = 1 ]; then rm -f "$ready"; fi; cp "$backup_file" "$target_file"; systemctl --user daemon-reload; systemctl --user enable "$unit" >/dev/null 2>&1 || true; systemctl --user restart "$unit" >/dev/null 2>&1 || true; rollback_pid=""; rollback_stable=0; for i in $(seq 1 180); do snapshot="$(systemctl --user show "$unit" --property=ActiveState --property=MainPID 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^MainPID=\\([1-9][0-9]*\\)$/\\1/p" | head -1)"; ready_ok=1; if [ "$requires_ready" = 1 ]; then ready_ok=0; [ -f "$ready" ] && grep -F "\\"pid\\":$pid" "$ready" >/dev/null 2>&1 && ready_ok=1; fi; if [ -n "$pid" ] && [ "$ready_ok" = 1 ] && printf "%s\\n" "$snapshot" | grep -F "ActiveState=active" >/dev/null; then if [ "$pid" = "$rollback_pid" ]; then rollback_stable=$((rollback_stable+1)); else rollback_pid="$pid"; rollback_stable=1; fi; if [ "$rollback_stable" -ge 5 ]; then rollback=1; break; fi; else rollback_pid=""; rollback_stable=0; fi; sleep 0.5; done; else systemctl --user stop "$unit" 2>/dev/null || true; rm -f "$target_file"; systemctl --user daemon-reload; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ok:!1,version:String(s),target:String(t),error:"new runtime not confirmed within 90s; previous service restored and ready",rolledBack:!0})}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ok:!1,version:String(s),target:String(t),error:"new runtime not confirmed within 90s and ready rollback failed",rolledBack:!1})}' > "$tmp"; fi; fi`,'printf "update_handoff_complete target=%s version=%s ok=%s\\n" "$target" "$version" "$ok"','mv "$tmp" "$status"','rm -f "$staged_file" "$backup_file"','exit "$((1-ok))"'].join("; ")}}const v=()=>r.join(e.homedir(),".thinkpool-pair","account.lock"),y=e=>{try{return process.kill(e,0),!0}catch(e){return"EPERM"===e?.code}};export async function retireUnmanagedBridgeLock({lockFile:e=v(),readLock:r=()=>t.readFileSync(e,"utf8"),removeLock:i=()=>t.rmSync(e,{force:!0}),commandForPid:o=e=>String(n(`ps -p ${e} -o command=`,{encoding:"utf8",stdio:["ignore","pipe","ignore"]})),alive:s=y,signal:a=(e,t)=>process.kill(e,t),sleep:l=e=>new Promise(t=>setTimeout(t,e)),waitMs:c=2500,pollMs:d=100,stderr:p=process.stderr}={}){let u=0;try{u=parseInt(String(r()).trim(),10)||0}catch{return!0}const f=()=>{if(s(u))return!1;try{(parseInt(String(r()).trim(),10)||0)===u&&i()}catch{}return!0};if(!u||u===process.pid||f())return!0;let $="";try{$=o(u)}catch{return f()}if(!/(?:node_modules[\\/]thinkpool-pair|\.npm[\\/]_npx|\.thinkpool-pair[\\/]runtimes)[\\/][^\n]*bridge\.mjs(?:\s|$)/.test($))return p.write(`  ⚠ account.lock belongs to PID ${u}, but it is not a verified thinkpool-pair bridge; refusing to signal an unrelated process.\n`),!1;p.write(`  ◆ stopping previous thinkpool-pair bridge (PID ${u}) before installing the background service…\n`);try{a(u,"SIGTERM")}catch{if(f())return!0}const h=Math.max(1,Math.ceil(Math.max(0,Number(c)||0)/Math.max(1,Number(d)||1)));for(let e=0;e<h;e++){if(f())return!0;await l(Math.max(1,Number(d)||1))}try{a(u,"SIGKILL")}catch{}for(let e=0;e<5;e++){if(f())return!0;await l(Math.max(1,Number(d)||1))}return p.write(`  ⚠ previous thinkpool-pair bridge PID ${u} did not stop; background install aborted to avoid two competing bridges.\n`),!1}function k(e){const t=r.basename(e).match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_.-]+)\.(?:plist|service)$/);if(!t)throw new Error(`cannot derive service label from ${e}`);return t[1]}export function existingServiceLabels(i=process.platform,{fsMod:o=t}={}){const s=new Set;try{if("darwin"===i){try{const e=n("launchctl print gui/$(id -u) 2>/dev/null | grep -oE 'io\\.thinkpool\\.pair\\.[A-Za-z0-9_]+' | sort -u",{encoding:"utf8",shell:"/bin/bash"});for(const t of e.split("\n")){const e=t.trim();e&&s.add(e)}}catch{}try{const t=r.join(e.homedir(),"Library","LaunchAgents");for(const e of o.readdirSync(t)){const t=e.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.plist$/);t&&s.add(t[1])}}catch{}}else if("linux"===i){try{const e=n("systemctl --user list-unit-files 'io.thinkpool.pair.*' --no-legend 2>/dev/null | awk '{print $1}'",{encoding:"utf8",shell:"/bin/bash"});for(const t of e.split("\n")){const e=t.trim().replace(/\.service$/,"");e&&s.add(e)}}catch{}try{const t=r.join(e.homedir(),".config","systemd","user");for(const e of o.readdirSync(t)){const t=e.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.service$/);t&&s.add(t[1])}}catch{}}}catch{}return[...s]}export function sweepExistingServices(i,o=process.platform){for(const s of existingServiceLabels(o))if(s!==i)try{if("darwin"===o){n(`launchctl bootout gui/$(id -u)/${s} 2>/dev/null || true`,{stdio:"ignore",shell:"/bin/bash"});try{t.rmSync(r.join(e.homedir(),"Library","LaunchAgents",`${s}.plist`),{force:!0})}catch{}}else"linux"===o&&n(`systemctl --user disable --now ${s}.service 2>/dev/null || true`,{stdio:"ignore",shell:"/bin/bash"});process.stderr.write(`  ◆ swept stale service ${s}\n`)}catch{}if("win32"!==o)try{n("pkill -9 -f 'thinkpool-pair/bridge.mjs [A-Z0-9]' 2>/dev/null || true",{stdio:"ignore",shell:"/bin/bash"})}catch{}}export function installService(e,i=[],{autoUpdate:o=!1,version:s=m,staleProof:c=!0}={}){let d=null;if(!o)try{d=provisionRuntime(s)}catch(e){return process.stderr.write(`  ⚠ runtime install failed; service left unchanged: ${e.message}\n`),!1}const f=buildArtifact(process.platform,{room:e,cmdArgs:i,autoUpdate:o,version:s,staleProof:c,runtimeEntry:d});try{sweepExistingServices(p(e),process.platform)}catch{}if(t.mkdirSync(f.logDir,{recursive:!0}),t.mkdirSync(r.dirname(f.file),{recursive:!0}),"darwin"===process.platform){if(process.stderr.write(`\n  ◆ staged replacement for ${f.file}\n`),!function(e,i){const o=r.join(e.logDir,`service-update-${process.pid}-${Date.now()}.plist`),s=buildDarwinReloadHandoff({targetLabel:k(e.file),targetFile:e.file,stagedFile:o,expectedRuntime:e.expectedRuntime,version:i});t.mkdirSync(r.dirname(s.helperFile),{recursive:!0}),t.mkdirSync(r.dirname(s.statusFile),{recursive:!0}),t.rmSync(s.statusFile,{force:!0}),t.writeFileSync(o,e.content),t.writeFileSync(s.helperFile,s.content);try{return n(`launchctl bootstrap gui/$(id -u) ${$(s.helperFile)}`,{stdio:"inherit",shell:"/bin/bash"}),process.stderr.write(`  ◆ update handoff armed outside the bridge process tree — completion is recorded in ${s.statusFile}.\n`),!0}catch(e){return t.rmSync(o,{force:!0}),t.rmSync(s.helperFile,{force:!0}),process.stderr.write(`  ⚠ could not arm the launchd update handoff; existing service left running: ${e.message}\n`),!1}}(f,s))return!1}else if("linux"===process.platform){if(process.stderr.write(`\n  ◆ staged replacement for ${f.file}\n`),!function(e,i){const o=r.join(e.logDir,`service-update-${process.pid}-${Date.now()}.service`),s=buildLinuxReloadHandoff({targetLabel:k(e.file),targetFile:e.file,stagedFile:o,expectedRuntime:e.expectedRuntime,version:i});t.mkdirSync(r.dirname(s.statusFile),{recursive:!0}),t.rmSync(s.statusFile,{force:!0}),t.writeFileSync(o,e.content);try{return n(`systemd-run --user --unit=${$(s.helperLabel)} --collect --property=StandardOutput=append:${$(s.logFile)} --property=StandardError=append:${$(s.logFile)} /bin/bash -lc ${$(s.script)}`,{stdio:"inherit",shell:"/bin/bash"}),process.stderr.write(`  ◆ update handoff armed outside the bridge service cgroup — completion is recorded in ${s.statusFile}.\n`),!0}catch(e){return t.rmSync(o,{force:!0}),process.stderr.write(`  ⚠ could not arm the systemd update handoff; existing service left running: ${e.message}\n`),!1}}(f,s))return!1}else{t.writeFileSync(f.file,f.content),process.stderr.write(`\n  ◆ wrote ${f.file}\n`);for(const e of f.post)try{n(e,{stdio:"inherit"})}catch(t){return process.stderr.write(`  ⚠ "${e}" failed; service update NOT confirmed: ${t.message}\n`),!1}}const h=Math.max(10,parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE,10)||90),g=o?"win32"===process.platform?"auto-update ON: a new thinkpool-pair@latest applies on the next login/restart (Windows has no in-process self-update).":`auto-update ON: checks npm ~every 30 min and restarts to apply a new @latest once sessions are idle (≥${h}s quiet; they resume in place).`:`PINNED to ${s} (stable local runtime; restarts do not depend on npx or the network). To update: use "Restart & update the bridge" (or run ${a("install-service",e||void 0)}). Pass --auto-update to track @latest instead.`,v=e?` ${e}`:"",y=e?`room ${e}`:"your account (auto-serves every session)",b=l()?"  ◆ Keep-awake on: system sleep is inhibited while the bridge runs (higher battery use); the display may still dim, lock, and turn off.\n":"";return process.stderr.write(`  ◆ ${y}\n  ◆ ${"darwin"===process.platform?"Launchd is completing and verifying the reload independently.":f.note}\n  ◆ Prerequisite: Claude Code, Codex, or Hermes must be installed on this machine. BYOK supplies model credentials; it does not install an agent.\n${b}  ◆ ${g}\n  ◆ logs: ${r.join(f.logDir,`${u(e)}.log`)}\n  ◆ remove with: ${a("uninstall-service")}${v}\n\n`),!0}export async function installAndConfirmService(i,a=[],{platform:l=process.platform,version:c=m,staleProof:d=!0,install:u=installService,exec:f=n,snapshot:$=serviceRuntimeSnapshot,prepareAccountHandoff:h=retireUnmanagedBridgeLock,readReady:g=()=>o(),readStatus:v=()=>{try{return JSON.parse(t.readFileSync(r.join(e.homedir(),".thinkpool-pair","update-status.json"),"utf8"))}catch{return null}},now:y=Date.now,sleep:k=e=>new Promise(t=>setTimeout(t,e)),timeoutMs:b=2e5,pollMs:w=250,stderr:S=process.stderr}={}){const _=$(i,{platform:l,exec:f});if(!i&&"win32"!==l&&!_&&!await h())return S.write("  ⚠ background install aborted: the previous bridge could not be handed off safely.\n"),!1;const x=y();if(!1===u(i,a,{version:c,staleProof:d}))return!1;const A=()=>{const e=$(i,{platform:l,exec:f}),t=!!i||"win32"===l||s(g(),e,c,{notBefore:x});return!(e?.version!==c||!t||(S.write(`  ✓ bridge install confirmed — running v${c}.\n`),0))};if("win32"===l)return!0;const P=y()+Math.max(0,Number(b)||0),j=p(i);for(;;){const e=v();if(e&&"object"==typeof e&&e.target===j&&e.version===c){if(!1===e.ok)return S.write(`  ⚠ install v${c} was not confirmed: ${e.error||"the launchd handoff failed"}.\n`),!1;if(!0===e.ok&&A())return!0}if(y()>=P)return S.write(`  ⚠ install v${c} timed out waiting for supervisor readiness; no connected account bridge was proven.\n`),!1;await k(Math.max(1,Number(w)||1))}}export function restartService(e){const t=process.platform;if(!isServiceInstalled(e))return process.stderr.write("  ⚠ no background service installed to restart — install one first.\n"),!1;const r=p(e);try{if("darwin"===t)n(`launchctl kickstart -k gui/$(id -u)/${r}`,{stdio:"inherit"});else{if("linux"!==t)return process.stderr.write("  ⚠ Windows has no managed daemon — close the running thinkpool-pair window and re-launch the Startup .cmd (or reboot) to restart.\n"),!1;n(`systemctl --user restart ${r}.service`,{stdio:"inherit"})}return process.stderr.write(`  ◆ restarted ${r} — any active session resumes in place.\n`),!0}catch(e){return process.stderr.write(`  ⚠ restart failed: ${e.message}\n`),!1}}function b(e=n){let t="";try{t=String(e("npm view thinkpool-pair version",{encoding:"utf8",stdio:["ignore","pipe","ignore"]})).trim()}catch{}return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(t)?t:null}export function stageServiceUpdate(e,{exec:t=n,active:r=isServiceInstalled,provision:i=provisionRuntime}={}){if(!r(e))return process.stderr.write("  ⚠ no background service installed to update — install one first.\n"),null;const o=b(t);if(!o)return process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n"),null;process.stderr.write(`\n  ◆ preparing bridge v${o} in the background; active sessions keep running…\n`);try{return i(o),o}catch(e){return process.stderr.write(`  ⚠ couldn't stage bridge v${o}: ${e?.message||e}\n`),null}}export function applyStagedServiceUpdate(e,t,{install:r=installService,active:n=isServiceInstalled}={}){return!(!n(e)||!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(t||"")))&&(process.stderr.write(`\n  ◆ updating the background service to v${t} and restarting…\n`),!1!==r(e,[],{version:t,staleProof:!0}))}export function updateService(e,{exec:t=n,install:r=installService,active:i=isServiceInstalled}={}){if(!i(e))return process.stderr.write("  ⚠ no background service installed to update — install one first.\n"),!1;const o=b(t);return o?(process.stderr.write(`\n  ◆ updating the background service to v${o} and restarting…\n`),!1!==r(e,[],{version:o,staleProof:!0})):(process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n"),!1)}export async function updateAndConfirmService(i,{platform:a=process.platform,exec:l=n,update:c=updateService,install:d=installService,active:u=isServiceInstalled,snapshot:f=serviceRuntimeSnapshot,readReady:$=()=>o(),readStatus:h=()=>{try{return JSON.parse(t.readFileSync(r.join(e.homedir(),".thinkpool-pair","update-status.json"),"utf8"))}catch{return null}},now:m=Date.now,sleep:g=e=>new Promise(t=>setTimeout(t,e)),timeoutMs:v=2e5,pollMs:y=250,stderr:k=process.stderr}={}){const b=f(i,{platform:a,exec:l}),w=m();let S=null;if(!1===c(i,{exec:(...e)=>{const t=l(...e),r=String(t).trim();return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(r)&&(S=r),t},install:d,active:u})||!S)return k.write("  ⚠ update was not confirmed: staging the published runtime failed; the existing service was left unchanged.\n"),!1;const _=()=>{const e=f(i,{platform:a,exec:l}),t=!!b&&b.version!==S,r=!!b?.pid&&!!e?.pid&&b.pid!==e.pid,n=!!i||"win32"===a||s($(),e,S,{notBefore:w});return e?.version===S&&(t||r)&&n?(k.write(`  ✓ bridge restart confirmed — running v${S}.\n`),{ok:!0,live:e}):{ok:!1,live:e}},x=({live:e}={})=>{e?.version&&e.version!==S?k.write(`  ⚠ update v${S} was not confirmed: live service is still v${e.version}.\n`):e?.version===S?k.write(`  ⚠ update v${S} was not confirmed: the service process did not restart.\n`):k.write(`  ⚠ update v${S} was not confirmed: the service manager cannot prove the new runtime is running.\n`)};if("win32"===a)return!0;const A=m()+Math.max(0,Number(v)||0),P=p(i);let j=null;for(;;){const e=h();if(e&&"object"==typeof e&&e.target===P){if(!1===e.ok&&e.version===S)return k.write(`  ⚠ update v${S} was not confirmed: ${e.error||"the launchd handoff failed"}.\n`),!1;if(!0===e.ok&&e.version===S&&(j=_(),j.ok))return!0}if(m()>=A)return j?x(j):k.write(`  ⚠ update v${S} timed out waiting for launchd confirmation; the service may have rolled back.\n`),!1;await g(Math.max(1,Number(y)||1))}}export function serviceActive(e,{platform:t=process.platform,exec:r=n}={}){const i=t,o=p(e);try{return"darwin"===i?darwinServiceRunning(r(`launchctl print gui/$(id -u)/${o}`,{encoding:"utf8",stdio:["ignore","pipe","ignore"]})):"linux"===i&&(r(`systemctl --user is-active --quiet ${o}.service`),!0)}catch{return!1}}export function isServiceInstalled(e){if("win32"===process.platform)try{return t.existsSync(buildArtifact("win32",{room:e}).file)}catch{return!1}return serviceActive(e)}export function uninstallService(e){const r=process.platform;let i;try{i=buildArtifact(r,{room:e})}catch(e){return void process.stderr.write(`  ⚠ ${e.message}\n`)}if("darwin"===r)try{n(`launchctl bootout gui/$(id -u)/${p(e)} 2>/dev/null`)}catch{}if("linux"===r)try{n(`systemctl --user disable --now ${p(e)}.service 2>/dev/null`)}catch{}try{t.rmSync(i.file,{force:!0}),process.stderr.write(`  ◆ removed ${i.file}\n`)}catch(e){process.stderr.write(`  ⚠ ${e.message}\n`)}}