tines 0.0.203 → 0.0.204

package/dist/index.js

@@ -3407,8 +3407,8 @@ var STATE_CATEGORIES = [
   "awaiting_human",
   "done"
 ];
-function runRefLabel(run) {
-  return run.issue_ref ? `run on ${run.issue_ref.project_name}/${run.issue_ref.number}` : `run ${run.run_id}`;
+function runRefLabel(run2) {
+  return run2.issue_ref ? `run on ${run2.issue_ref.project_name}/${run2.issue_ref.number}` : `run ${run2.run_id}`;
 }
 function actorLabel(actor) {
   if (actor.run) {
@@ -3530,13 +3530,13 @@ function ageLabel(at, now = Date.now()) {
 function prUrlOf(v) {
   return v.pr_repo_url && v.pr_number !== null ? `${v.pr_repo_url}/pull/${v.pr_number}` : null;
 }
-function runDurationLabel(run, now = Date.now()) {
-  if (!run.started_at) return "\u2014";
-  const seconds = Math.max(0, Math.round(((run.ended_at ?? now) - run.started_at) / 1e3));
+function runDurationLabel(run2, now = Date.now()) {
+  if (!run2.started_at) return "\u2014";
+  const seconds = Math.max(0, Math.round(((run2.ended_at ?? now) - run2.started_at) / 1e3));
   return seconds < 60 ? `${seconds}s` : `${Math.floor(seconds / 60)}m`;
 }
-function runCostLabel(run) {
-  const usage = run.usage;
+function runCostLabel(run2) {
+  const usage = run2.usage;
   if (!usage) return null;
   if (usage.cost_usd !== void 0) {
     const dollars = usage.cost_usd === 0 ? "$0" : usage.cost_usd < 0.01 ? "<$0.01" : `$${usage.cost_usd.toFixed(2)}`;
@@ -3559,13 +3559,13 @@ function utilizationLabel(quota, activeRuns, stateName = (id2) => id2) {
     return `${activeRuns.length}/${quota.limit} global slot${quota.limit === 1 ? "" : "s"} in use`;
   }
   const counts = /* @__PURE__ */ new Map();
-  for (const run of activeRuns) {
-    const entry = counts.get(run.state_id_at_start) ?? {
-      name: run.state_at_start_name ?? stateName(run.state_id_at_start),
+  for (const run2 of activeRuns) {
+    const entry = counts.get(run2.state_id_at_start) ?? {
+      name: run2.state_at_start_name ?? stateName(run2.state_id_at_start),
       n: 0
     };
     entry.n += 1;
-    counts.set(run.state_id_at_start, entry);
+    counts.set(run2.state_id_at_start, entry);
   }
   for (const stateId of Object.keys(quota.overrides)) {
     if (!counts.has(stateId)) counts.set(stateId, { name: stateName(stateId), n: 0 });
@@ -3587,8 +3587,8 @@ function str(v) {
 function isoTime(v) {
   return typeof v === "number" && Number.isFinite(v) ? new Date(v).toISOString() : "an unknown time";
 }
-function joinChanged(v, sep2) {
-  return Array.isArray(v) ? v.join(sep2) : "";
+function joinChanged(v, sep3) {
+  return Array.isArray(v) ? v.join(sep3) : "";
 }
 function action(type) {
   return type.split(".")[1] ?? type;
@@ -5623,7 +5623,7 @@ function roundLines(round, now = Date.now()) {
     if (latest.artifacts.length > 0) {
       lines2.push(`    ${latest.artifacts.map(artifactChangeLabel).join(" \xB7 ")}`);
     }
-    for (const run of earlier) lines2.push(`    ${earlierAttemptLine(run, now)}`);
+    for (const run2 of earlier) lines2.push(`    ${earlierAttemptLine(run2, now)}`);
     if (latest.summary_comment) {
       lines2.push(`    summary (${latest.summary_comment.id}):`);
       for (const line of latest.summary_comment.body.split("\n")) lines2.push(`      ${line}`);
@@ -5637,20 +5637,20 @@ function roundLines(round, now = Date.now()) {
   }
   return lines2;
 }
-function runHeadline(run, now) {
-  const cost = runCostLabel(run);
+function runHeadline(run2, now) {
+  const cost = runCostLabel(run2);
   return [
-    `${run.run_id} on ${run.runner_name}`,
-    runDurationLabel(run, now),
-    run.outcome ?? run.status,
+    `${run2.run_id} on ${run2.runner_name}`,
+    runDurationLabel(run2, now),
+    run2.outcome ?? run2.status,
     ...cost ? [cost] : [],
-    run.transition ? `"${run.transition.action ?? "moved directly"}" \u2192 ${run.transition.to_state.name}` : "no transition"
+    run2.transition ? `"${run2.transition.action ?? "moved directly"}" \u2192 ${run2.transition.to_state.name}` : "no transition"
   ].join(" \xB7 ");
 }
-function earlierAttemptLine(run, now) {
-  const back = run.returned_via;
+function earlierAttemptLine(run2, now) {
+  const back = run2.returned_via;
   const how = back ? back.action ? `sent back by ${back.from_state.name} ("${back.action}")` : "moved directly back" : "never came back";
-  return `${run.run_id} \xB7 ${runDurationLabel(run, now)} \xB7 ${run.outcome ?? run.status} \xB7 ${how}`;
+  return `${run2.run_id} \xB7 ${runDurationLabel(run2, now)} \xB7 ${run2.outcome ?? run2.status} \xB7 ${how}`;
 }
 function artifactChangeLabel(a) {
   const versions = a.from_version === null ? `v${a.to_version}` : `v${a.from_version} \u2192 v${a.to_version}`;
@@ -5669,16 +5669,16 @@ function roundSummaryLabel(summary) {
   ];
   return parts.length > 0 ? parts.join(" \xB7 ") : "\u2014";
 }
-function runRow(run) {
+function runRow(run2) {
   return [
-    run.id,
-    run.issue_ref ? issueRef(run.issue_ref) : run.issue_id,
-    run.runner_name,
-    `${run.tier}${run.model ? ` (${run.model})` : ""}`,
-    `${run.status}${run.resumed_from_run_id ? ` \xB7 resumed run ${run.resumed_from_run_id}` : ""}`,
-    runDurationLabel(run),
-    runCostLabel(run) ?? "\u2014",
-    timestamp(run.created_at)
+    run2.id,
+    run2.issue_ref ? issueRef(run2.issue_ref) : run2.issue_id,
+    run2.runner_name,
+    `${run2.tier}${run2.model ? ` (${run2.model})` : ""}`,
+    `${run2.status}${run2.resumed_from_run_id ? ` \xB7 resumed run ${run2.resumed_from_run_id}` : ""}`,
+    runDurationLabel(run2),
+    runCostLabel(run2) ?? "\u2014",
+    timestamp(run2.created_at)
   ];
 }
 function byteSize(bytes2) {
@@ -5751,11 +5751,11 @@ function assertNewStatesHavePrompts(states, prompts) {
   }
 }
 function parseScheduleRef(ref) {
-  const sep2 = ref.indexOf("/");
-  if (sep2 < 1 || sep2 === ref.length - 1) {
+  const sep3 = ref.indexOf("/");
+  if (sep3 < 1 || sep3 === ref.length - 1) {
     throw new CliError(`schedule reference must look like <project>/<name>, got "${ref}"`);
   }
-  return { project: ref.slice(0, sep2), name: ref.slice(sep2 + 1) };
+  return { project: ref.slice(0, sep3), name: ref.slice(sep3 + 1) };
 }
 function parseIssueRef(ref) {
   const match = ref.match(/^(.+)\/(\d+)$/);
@@ -5763,12 +5763,12 @@ function parseIssueRef(ref) {
   return { project: match[1], number: Number.parseInt(match[2], 10) };
 }
 function parseFileSpec(spec) {
-  const sep2 = spec.indexOf("=");
-  if (sep2 < 1 || sep2 === spec.length - 1) {
+  const sep3 = spec.indexOf("=");
+  if (sep3 < 1 || sep3 === spec.length - 1) {
     throw new CliError(`--file must look like <path>=@<local-file>, got "${spec}"`);
   }
-  const path2 = spec.slice(0, sep2);
-  const source = spec.slice(sep2 + 1);
+  const path2 = spec.slice(0, sep3);
+  const source = spec.slice(sep3 + 1);
   if (!source.startsWith("@")) {
     throw new CliError(
       `skill file content always comes from a local file: --file ${path2}=@<local-file>`
@@ -5782,10 +5782,10 @@ function parseFileSpec(spec) {
   }
 }
 function parseTargetSpec(spec) {
-  const sep2 = spec.lastIndexOf(":");
-  if (sep2 === -1) return { name: spec };
-  const name2 = spec.slice(0, sep2);
-  const tier = spec.slice(sep2 + 1);
+  const sep3 = spec.lastIndexOf(":");
+  if (sep3 === -1) return { name: spec };
+  const name2 = spec.slice(0, sep3);
+  const tier = spec.slice(sep3 + 1);
   if (!name2) throw new CliError(`target must look like <runner>[:tier], got "${spec}"`);
   if (!MODEL_TIERS.includes(tier)) {
     throw new CliError(`unknown tier "${tier}" in "${spec}" (tiers: ${MODEL_TIERS.join(", ")})`);
@@ -5997,12 +5997,12 @@ async function resolveLabelFlag(api, ref) {
   return match.id;
 }
 async function resolveStateFlag(api, ref) {
-  const sep2 = ref.indexOf("/");
-  if (sep2 < 1 || sep2 === ref.length - 1) {
+  const sep3 = ref.indexOf("/");
+  if (sep3 < 1 || sep3 === ref.length - 1) {
     die(`--state must look like <workflow>/<state>, got "${ref}"`);
   }
-  const workflow2 = await resolveWorkflow(api, ref.slice(0, sep2));
-  const stateRef2 = ref.slice(sep2 + 1);
+  const workflow2 = await resolveWorkflow(api, ref.slice(0, sep3));
+  const stateRef2 = ref.slice(sep3 + 1);
   const state = workflow2.states.find((s) => s.name === stateRef2) ?? workflow2.states.find((s) => s.id === stateRef2);
   if (!state) {
     die(
@@ -8489,9 +8489,6 @@ function register7(program3) {
   });
 }
 
-// src/commands/runners.ts
-import { hostname as hostname2 } from "node:os";
-
 // src/daemon/daemon.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
@@ -8505,7 +8502,6 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { hostname, platform, arch } from "node:os";
 import { randomUUID } from "node:crypto";
 import { dirname as dirname4, join as join5 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
@@ -9138,9 +9134,9 @@ function formatExitLine(exit) {
   return `# tines runner: exit ${parts.join(" ")} after ${formatDuration(exit.durationMs)}
 `;
 }
-function exitLineForRun(run, exit) {
-  if (run.settled) return null;
-  return formatExitLine({ ...exit, timedOut: run.timedOut });
+function exitLineForRun(run2, exit) {
+  if (run2.settled) return null;
+  return formatExitLine({ ...exit, timedOut: run2.timedOut });
 }
 var RunTable = class {
   constructor(effects, opts = {}) {
@@ -9163,8 +9159,8 @@ var RunTable = class {
   has(runId) {
     return this.runs.has(runId);
   }
-  track(run) {
-    this.runs.set(run.runId, run);
+  track(run2) {
+    this.runs.set(run2.runId, run2);
     this.effects.persist();
   }
   /** Call after setting a run's pid so the state file reflects it. */
@@ -9180,10 +9176,10 @@ var RunTable = class {
    * already-settled run, a daemon shutdown. Guessing `failed` also errs the
    * safe way — it keeps a directory rather than destroying evidence.
    */
-  cleanup(run, outcome = "failed") {
-    this.runs.delete(run.runId);
+  cleanup(run2, outcome = "failed") {
+    this.runs.delete(run2.runId);
     this.effects.persist();
-    this.effects.release(run, { keep: this.keep(outcome, run), outcome });
+    this.effects.release(run2, { keep: this.keep(outcome, run2), outcome });
   }
   /**
    * Ends a run: flush logs, finish-report, clean up. On a run someone
@@ -9199,26 +9195,26 @@ var RunTable = class {
    * `{ judgment: 'rate_limited' }` with its reset time, while transient 5xx
    * and transport outages use `interrupted` and the normal short backoff.
    */
-  async finishAndCleanup(run, status, error, judgment) {
-    if (run.settled) return this.cleanup(run);
-    run.settled = true;
-    run.endNote ??= error;
-    run.drain?.();
-    if (this.keep(status, run)) this.effects.noteKept?.(run);
-    await run.flush?.();
-    const keptBeforeFinish = this.keep(status, run);
+  async finishAndCleanup(run2, status, error, judgment) {
+    if (run2.settled) return this.cleanup(run2);
+    run2.settled = true;
+    run2.endNote ??= error;
+    run2.drain?.();
+    if (this.keep(status, run2)) this.effects.noteKept?.(run2);
+    await run2.flush?.();
+    const keptBeforeFinish = this.keep(status, run2);
     try {
-      await this.effects.finish(run, status, error, judgment);
-      this.effects.log(`run ${run.runId} finished: ${status}${error ? ` (${error})` : ""}`);
-      if (!keptBeforeFinish && this.keep(status, run)) {
-        this.effects.log(`run ${run.runId} workspace kept for resume at ${run.workspace}`);
+      await this.effects.finish(run2, status, error, judgment);
+      this.effects.log(`run ${run2.runId} finished: ${status}${error ? ` (${error})` : ""}`);
+      if (!keptBeforeFinish && this.keep(status, run2)) {
+        this.effects.log(`run ${run2.runId} workspace kept for resume at ${run2.workspace}`);
       }
     } catch (err) {
       this.effects.log(
-        `finish report for run ${run.runId} not accepted: ${err instanceof Error ? err.message : String(err)}`
+        `finish report for run ${run2.runId} not accepted: ${err instanceof Error ? err.message : String(err)}`
       );
     }
-    this.cleanup(run, status);
+    this.cleanup(run2, status);
   }
   /**
    * Marks a supervisor-settled run (`cancels`): kill, do NOT finish-report.
@@ -9227,11 +9223,11 @@ var RunTable = class {
    * is cleaned up by the launch path's next settled check.
    */
   markCanceled(runId) {
-    const run = this.runs.get(runId);
-    if (!run || run.settled) return null;
-    run.canceled = true;
-    run.settled = true;
-    return run;
+    const run2 = this.runs.get(runId);
+    if (!run2 || run2.settled) return null;
+    run2.canceled = true;
+    run2.settled = true;
+    return run2;
   }
 };
 var LogBatcher = class {
@@ -9466,6 +9462,9 @@ function message(err) {
   return err instanceof Error ? err.message : String(err);
 }
 
+// src/daemon/register.ts
+import { arch, hostname, platform } from "node:os";
+
 // src/daemon/store.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync8, rmSync as rmSync2, statSync as statSync3 } from "node:fs";
 import { join as join4 } from "node:path";
@@ -9596,15 +9595,48 @@ function directorySizeBytes(path2) {
   return total;
 }
 
+// src/daemon/register.ts
+function missingApiKeyMessage(name2, baseUrl) {
+  return `no stored runner token for "${name2}" at ${baseUrl} \u2014 set TINES_API_KEY (a user API key) to register`;
+}
+async function ensureRunnerCredentials(opts) {
+  const stored = loadRunnerCredentials(opts.configDir, opts.baseUrl, opts.name);
+  if (stored) {
+    opts.log(
+      `reconnecting as runner "${opts.name}" (${stored.runner_id}) \u2014 token from ${opts.configDir}`
+    );
+    return { creds: stored, registered: false };
+  }
+  if (!opts.apiKey) throw new Error(missingApiKeyMessage(opts.name, opts.baseUrl));
+  const userClient = createApiClient({ baseUrl: opts.baseUrl, apiKey: opts.apiKey });
+  const registered = await userClient.registerRunner({
+    name: opts.name,
+    harness: opts.harness,
+    ...opts.command !== void 0 ? { command: opts.command } : {},
+    max_concurrent: opts.maxConcurrent,
+    hostname: hostname(),
+    platform: `${platform()} ${arch()}`
+  });
+  const creds = { runner_id: registered.runner.id, token: registered.runner_token };
+  saveRunnerCredentials(opts.configDir, opts.baseUrl, opts.name, creds);
+  opts.log(
+    `registered runner "${opts.name}" (${creds.runner_id}); token stored in ${opts.configDir}`
+  );
+  return { creds, registered: true };
+}
+function nextStepsMessage(name2, baseUrl) {
+  return `next: route work to "${name2}" \u2014 ${baseUrl}/agents (or: tines routing set ${name2}). Eligible work starts when this runner is available and routing matches. If automation is stopped, resume it in Agents or with tines supervisor enable.`;
+}
+
 // src/daemon/daemon.ts
 var CLI_REFRESH_TTL_MS = 10 * 6e4;
 var DAEMON_VERSION = cliVersion();
-async function uploadRawLog(run) {
-  const path2 = run.rawSpoolPath;
-  if (!path2 || !run.rawUpload) return;
-  run.rawSpoolPath = void 0;
+async function uploadRawLog(run2) {
+  const path2 = run2.rawSpoolPath;
+  if (!path2 || !run2.rawUpload) return;
+  run2.rawSpoolPath = void 0;
   try {
-    await new Promise((resolve) => run.rawSpool?.end(resolve) ?? resolve());
+    await new Promise((resolve) => run2.rawSpool?.end(resolve) ?? resolve());
     const size = statSync4(path2).size;
     if (size > 0) {
       let body = readFileSync9(path2);
@@ -9618,7 +9650,7 @@ async function uploadRawLog(run) {
           body.subarray(body.byteLength - RUN_LOG_RAW_MAX_BYTES + marker.byteLength)
         ]);
       }
-      await run.rawUpload(body);
+      await run2.rawUpload(body);
     }
   } catch {
   } finally {
@@ -9680,31 +9712,21 @@ async function runDaemon(opts) {
       );
     }
   };
-  let creds = loadRunnerCredentials(opts.configDir, baseUrl, opts.name);
-  if (creds) {
-    log(
-      `reconnecting as runner "${opts.name}" (${creds.runner_id}) \u2014 token from ${opts.configDir}`
-    );
-  } else {
-    if (!opts.apiKey) {
-      throw new Error(
-        `no stored runner token for "${opts.name}" at ${baseUrl} \u2014 set TINES_API_KEY (a user API key) to register`
-      );
-    }
-    const userClient = createApiClient({ baseUrl, apiKey: opts.apiKey });
-    const registered = await userClient.registerRunner({
-      name: opts.name,
-      harness: opts.harness,
-      ...opts.command !== void 0 ? { command: opts.command } : {},
-      max_concurrent: opts.maxConcurrent,
-      hostname: hostname(),
-      platform: `${platform()} ${arch()}`
-    });
-    creds = { runner_id: registered.runner.id, token: registered.runner_token };
-    saveRunnerCredentials(opts.configDir, baseUrl, opts.name, creds);
-    log(`registered runner "${opts.name}" (${creds.runner_id}); token stored in ${opts.configDir}`);
+  const ensured = await ensureRunnerCredentials({
+    configDir: opts.configDir,
+    baseUrl,
+    name: opts.name,
+    harness: opts.harness,
+    ...opts.command !== void 0 ? { command: opts.command } : {},
+    maxConcurrent: opts.maxConcurrent,
+    ...opts.apiKey !== void 0 ? { apiKey: opts.apiKey } : {},
+    log
+  });
+  const creds = ensured.creds;
+  if (ensured.registered) {
+    log(nextStepsMessage(opts.name, baseUrl));
     log(
-      `next: route work to "${opts.name}" \u2014 ${baseUrl}/agents (or: tines routing set ${opts.name}). Eligible work starts when this runner is available and routing matches. If automation is stopped, resume it in Agents or with tines supervisor enable.`
+      `keep it running: \`tines runner install --name ${opts.name} --harness ${opts.harness.replaceAll("_", "-")}\` installs this runner as a launchd/systemd service that keeps itself updated (docs/runner-daemon.md)`
     );
   }
   const client2 = createApiClient({ baseUrl, apiKey: creds.token });
@@ -9719,7 +9741,7 @@ async function runDaemon(opts) {
   const selfUpdate = opts.selfUpdate && opts.cliRefresh && managedInstall;
   if (opts.selfUpdate && opts.cliRefresh) {
     log(
-      managedInstall ? `self-update: on \u2014 this daemon (tines ${DAEMON_VERSION}) runs from ${prefix} and will restart once idle after a newer release is installed there` : `self-update: off \u2014 this daemon (tines ${DAEMON_VERSION}) runs from ${selfPath ?? process.argv[1] ?? "?"}, not ${prefix}; launch it from ${join5(prefix, "node_modules", ".bin", "tines")} to have refreshes apply on restart (docs/runner-daemon.md)`
+      managedInstall ? `self-update: on \u2014 this daemon (tines ${DAEMON_VERSION}) runs from ${prefix} and will restart once idle after a newer release is installed there` : `self-update: off \u2014 this daemon (tines ${DAEMON_VERSION}) runs from ${selfPath ?? process.argv[1] ?? "?"}, not ${prefix}; launch it from ${join5(prefix, "node_modules", ".bin", "tines")} to have refreshes apply on restart \u2014 \`tines runner install --name ${opts.name} --harness ${opts.harness.replaceAll("_", "-")}\` sets that up as a service (docs/runner-daemon.md)`
     );
   }
   let pendingUpdate = null;
@@ -9739,9 +9761,9 @@ async function runDaemon(opts) {
   log(`agent CLI: ${cliLabel(await ensureCli())}`);
   const table2 = new RunTable(
     {
-      finish: async (run, status, error, judgment) => {
-        const summary = run.renderer?.summary();
-        const ended = await client2.finishRun(run.runId, {
+      finish: async (run2, status, error, judgment) => {
+        const summary = run2.renderer?.summary();
+        const ended = await client2.finishRun(run2.runId, {
           status,
           ...error ? { error } : {},
           ...judgment,
@@ -9749,8 +9771,8 @@ async function runDaemon(opts) {
           ...summary?.pricingEvidence ? {
             pricing_evidence: {
               ...summary.pricingEvidence,
-              model: run.pricingModel ?? null,
-              session_mode: run.pricingSessionMode ?? "cold",
+              model: run2.pricingModel ?? null,
+              session_mode: run2.pricingSessionMode ?? "cold",
               daemon_version: DAEMON_VERSION
             }
           } : {},
@@ -9758,33 +9780,33 @@ async function runDaemon(opts) {
           ...summary?.numTurns !== void 0 ? { turn_count: summary.numTurns } : {},
           // The whole conversation's turns, which for a resumed run is
           // more than this run's own: the size guard reads this one.
-          ...summary?.numTurns !== void 0 ? { conversation_turn_count: run.priorTurns + summary.numTurns } : {},
-          workspace_path: run.workspace
+          ...summary?.numTurns !== void 0 ? { conversation_turn_count: run2.priorTurns + summary.numTurns } : {},
+          workspace_path: run2.workspace
         });
-        if (ended?.resume_expires_at) run.keepForResume = true;
+        if (ended?.resume_expires_at) run2.keepForResume = true;
       },
-      release: (run, { keep, outcome }) => {
-        if (run.timeout) clearTimeout(run.timeout);
-        run.renderer?.finish();
-        settleWorkspace(run.workspace, keep, {
-          run_id: run.runId,
-          ...run.issueLabel ? { issue_ref: run.issueLabel } : {},
+      release: (run2, { keep, outcome }) => {
+        if (run2.timeout) clearTimeout(run2.timeout);
+        run2.renderer?.finish();
+        settleWorkspace(run2.workspace, keep, {
+          run_id: run2.runId,
+          ...run2.issueLabel ? { issue_ref: run2.issueLabel } : {},
           status: outcome,
-          ...run.endNote ? { error: run.endNote } : {}
+          ...run2.endNote ? { error: run2.endNote } : {}
         });
-        void uploadRawLog(run);
+        void uploadRawLog(run2);
         sweepKeptWorkspaces();
       },
-      noteKept: (run) => run.batcher.append(`workspace kept at ${run.workspace}
+      noteKept: (run2) => run2.batcher.append(`workspace kept at ${run2.workspace}
 `),
       persist: () => {
-        const entries = table2.values().filter((run) => run.child?.pid !== void 0).map((run) => ({
-          run_id: run.runId,
-          pid: run.child.pid,
-          workspace: run.workspace,
-          key_fingerprint: run.keyFingerprint,
-          started_at: run.spawnedAt,
-          ...run.issueLabel ? { issue_ref: run.issueLabel } : {}
+        const entries = table2.values().filter((run2) => run2.child?.pid !== void 0).map((run2) => ({
+          run_id: run2.runId,
+          pid: run2.child.pid,
+          workspace: run2.workspace,
+          key_fingerprint: run2.keyFingerprint,
+          started_at: run2.spawnedAt,
+          ...run2.issueLabel ? { issue_ref: run2.issueLabel } : {}
         }));
         saveDaemonState(statePath, entries);
       },
@@ -9793,7 +9815,7 @@ async function runDaemon(opts) {
     {
       // A workspace the server retained for a resume is kept whatever the
       // --keep-workspaces mode says; pruning still bounds it by age/count.
-      keep: (outcome, run) => run.keepForResume || keepWorkspace(opts.keepWorkspaces, outcome)
+      keep: (outcome, run2) => run2.keepForResume || keepWorkspace(opts.keepWorkspaces, outcome)
     }
   );
   for (const orphan of loadDaemonState(statePath)) {
@@ -9827,12 +9849,12 @@ async function runDaemon(opts) {
   }
   saveDaemonState(statePath, []);
   const killWithoutFinish = (runId) => {
-    const run = table2.markCanceled(runId);
-    if (!run) return;
-    run.endNote ??= "canceled by supervisor";
+    const run2 = table2.markCanceled(runId);
+    if (!run2) return;
+    run2.endNote ??= "canceled by supervisor";
     log(`supervisor canceled run ${runId}; killing without finish-reporting`);
-    if (run.child?.pid) {
-      const pid = run.child.pid;
+    if (run2.child?.pid) {
+      const pid = run2.child.pid;
       killTree(pid, "SIGTERM");
       setTimeout(() => killTree(pid, "SIGKILL"), 5e3).unref?.();
     }
@@ -9848,7 +9870,7 @@ async function runDaemon(opts) {
     }
     const workspace = resume ? resume.workspace_path : join5(workspacesDir(opts.configDir), runId);
     const issueLabel = assignment.run.issue_ref ? `${assignment.run.issue_ref.project_name}/${assignment.run.issue_ref.number}` : void 0;
-    const run = {
+    const run2 = {
       runId,
       workspace,
       ...issueLabel ? { issueLabel } : {},
@@ -9864,8 +9886,8 @@ async function runDaemon(opts) {
         { onError: (err) => log(`log append for run ${runId} failed: ${message2(err)}`) }
       )
     };
-    run.flush = () => run.batcher.flush();
-    table2.track(run);
+    run2.flush = () => run2.batcher.flush();
+    table2.track(run2);
     log(
       resume ? `run ${runId} assigned (issue ${issueLabel ?? assignment.run.issue_id}); resuming run ${resume.previous_run_id} in ${workspace}` : `run ${runId} assigned (issue ${issueLabel ?? assignment.run.issue_id}); materializing workspace`
     );
@@ -9893,28 +9915,28 @@ async function runDaemon(opts) {
 `
         );
       for (const repo of resume ? [] : assignment.bundle.repos) {
-        if (run.settled) return table2.cleanup(run);
+        if (run2.settled) return table2.cleanup(run2);
         const args = [
           "clone",
           ...repo.branch ? ["--branch", repo.branch] : [],
           repo.url,
           repo.dir
         ];
-        run.batcher.append(`$ git ${args.join(" ")}
+        run2.batcher.append(`$ git ${args.join(" ")}
 `);
-        const result = await runGit(args, workspace, run.batcher);
+        const result = await runGit(args, workspace, run2.batcher);
         if (result !== 0) {
           return table2.finishAndCleanup(
-            run,
+            run2,
             "failed",
             `git clone failed for ${repo.url} (exit ${result})`
           );
         }
       }
-      if (run.settled) return table2.cleanup(run);
+      if (run2.settled) return table2.cleanup(run2);
       const cli = await ensureCli();
-      if (run.settled) return table2.cleanup(run);
-      run.batcher.append(
+      if (run2.settled) return table2.cleanup(run2);
+      run2.batcher.append(
         cli.source === "fresh" ? `tines CLI: ${cli.version ?? "unknown"} (daemon-managed)
 ` : cli.source === "stale" ? `warning: agent CLI refresh failed; using last-good tines ${cli.version ?? "unknown"} from ${opts.configDir}/cli
 ` : `warning: no daemon-managed tines CLI; using whatever \`tines\` is on this machine's PATH
@@ -9932,10 +9954,10 @@ async function runDaemon(opts) {
         harnessInput
       );
       if (opts.harness === "codex") {
-        run.pricingModel = harnessInput.model;
-        run.pricingSessionMode = resume ? "resumed" : "cold";
+        run2.pricingModel = harnessInput.model;
+        run2.pricingSessionMode = resume ? "resumed" : "cold";
       }
-      run.batcher.append(
+      run2.batcher.append(
         formatLaunchBanner(invocation, harnessInput, {
           harness: opts.harness,
           timeoutMinutes: assignment.timeout_minutes,
@@ -9953,86 +9975,86 @@ async function runDaemon(opts) {
         stdio: ["ignore", "pipe", "pipe"],
         detached: true
       });
-      run.child = child;
-      run.spawnedAt = Date.now();
+      run2.child = child;
+      run2.spawnedAt = Date.now();
       table2.persist();
       log(`run ${runId}: launched ${invocation.file} (pid ${child.pid})`);
       if (opts.harness === "claude_code") {
         const limiter = new RateLimitDetector();
-        run.limiter = limiter;
+        run2.limiter = limiter;
         const renderer = new ClaudeStreamRenderer(
-          (line) => run.batcher.append(line),
+          (line) => run2.batcher.append(line),
           (event) => limiter.noteStreamEvent(event)
         );
-        run.renderer = renderer;
+        run2.renderer = renderer;
         const spoolPath = join5(opts.configDir, "rawlogs", `${runId}.ndjson`);
         mkdirSync4(dirname4(spoolPath), { recursive: true });
-        run.rawSpoolPath = spoolPath;
-        run.rawSpool = createWriteStream(spoolPath);
-        run.rawUpload = (body) => client2.putRunLogRaw(runId, body);
+        run2.rawSpoolPath = spoolPath;
+        run2.rawSpool = createWriteStream(spoolPath);
+        run2.rawUpload = (body) => client2.putRunLogRaw(runId, body);
         const decoder = new StringDecoder("utf8");
-        run.drain = () => {
+        run2.drain = () => {
           const trailing = decoder.end();
           if (trailing) renderer.write(trailing);
           renderer.finish();
         };
         child.stdout?.on("data", (data) => {
-          run.rawSpool?.write(data);
+          run2.rawSpool?.write(data);
           renderer.write(decoder.write(data));
         });
       } else if (opts.harness === "codex") {
-        const renderer = new CodexStreamRenderer((line) => run.batcher.append(line));
+        const renderer = new CodexStreamRenderer((line) => run2.batcher.append(line));
         const decoder = new StringDecoder("utf8");
-        run.renderer = renderer;
-        run.drain = () => {
+        run2.renderer = renderer;
+        run2.drain = () => {
           const trailing = decoder.end();
           if (trailing) renderer.write(trailing);
           renderer.finish();
         };
         child.stdout?.on("data", (data) => renderer.write(decoder.write(data)));
       } else {
-        child.stdout?.on("data", (data) => run.batcher.append(data.toString("utf8")));
+        child.stdout?.on("data", (data) => run2.batcher.append(data.toString("utf8")));
       }
       child.stderr?.on("data", (data) => {
         const text4 = data.toString("utf8");
-        run.batcher.append(text4);
-        run.limiter?.noteStderr(text4);
+        run2.batcher.append(text4);
+        run2.limiter?.noteStderr(text4);
       });
-      run.timeout = setTimeout(() => {
-        if (run.settled) return;
+      run2.timeout = setTimeout(() => {
+        if (run2.settled) return;
         log(`run ${runId} hit its ${assignment.timeout_minutes}m timeout; killing`);
-        run.timedOut = true;
+        run2.timedOut = true;
         if (child.pid) killTree(child.pid, "SIGTERM");
         if (child.pid) setTimeout(() => killTree(child.pid, "SIGKILL"), 5e3).unref?.();
       }, assignment.timeout_minutes * 6e4);
       child.on("error", (err) => {
-        void table2.finishAndCleanup(run, "failed", `failed to launch harness: ${message2(err)}`);
+        void table2.finishAndCleanup(run2, "failed", `failed to launch harness: ${message2(err)}`);
       });
       child.on("close", (code, signal) => {
-        run.drain?.();
-        run.limiter?.finish();
-        const closing = exitLineForRun(run, {
+        run2.drain?.();
+        run2.limiter?.finish();
+        const closing = exitLineForRun(run2, {
           code,
           signal,
-          durationMs: Date.now() - (run.spawnedAt ?? Date.now())
+          durationMs: Date.now() - (run2.spawnedAt ?? Date.now())
         });
-        if (closing) run.batcher.append(closing);
-        if (run.timedOut) {
+        if (closing) run2.batcher.append(closing);
+        if (run2.timedOut) {
           void table2.finishAndCleanup(
-            run,
+            run2,
             "failed",
             `run exceeded the ${assignment.timeout_minutes}m timeout; harness killed`
           );
         } else if (code === 0) {
-          void table2.finishAndCleanup(run, "completed");
+          void table2.finishAndCleanup(run2, "completed");
         } else {
-          const limited = signal ? null : run.limiter?.signal() ?? null;
-          const providerError = signal ? null : run.limiter?.providerError() ?? null;
+          const limited = signal ? null : run2.limiter?.signal() ?? null;
+          const providerError = signal ? null : run2.limiter?.providerError() ?? null;
           if (limited) {
             log(
               `run ${runId}: harness rate limited (${limited.detail}); reporting without a strike`
             );
-            void table2.finishAndCleanup(run, "failed", `rate limited: ${limited.detail}`, {
+            void table2.finishAndCleanup(run2, "failed", `rate limited: ${limited.detail}`, {
               judgment: "rate_limited",
               ...limited.resumeAt !== null ? { resume_at: limited.resumeAt } : {}
             });
@@ -10040,12 +10062,12 @@ async function runDaemon(opts) {
             log(
               `run ${runId}: transient provider error (${providerError.detail}); reporting without a strike`
             );
-            void table2.finishAndCleanup(run, "failed", `provider error: ${providerError.detail}`, {
+            void table2.finishAndCleanup(run2, "failed", `provider error: ${providerError.detail}`, {
               judgment: "interrupted"
             });
           } else {
             void table2.finishAndCleanup(
-              run,
+              run2,
               "failed",
               signal ? `harness killed by ${signal}` : `harness exited with code ${code}`
             );
@@ -10053,7 +10075,7 @@ async function runDaemon(opts) {
         }
       });
     } catch (err) {
-      void table2.finishAndCleanup(run, "failed", `workspace setup failed: ${message2(err)}`);
+      void table2.finishAndCleanup(run2, "failed", `workspace setup failed: ${message2(err)}`);
     }
   };
   const shutdown = async () => {
@@ -10061,9 +10083,9 @@ async function runDaemon(opts) {
     shuttingDown = true;
     log("shutting down; failing in-flight runs");
     await Promise.all(
-      table2.values().map(async (run) => {
-        if (run.child?.pid) killTree(run.child.pid, "SIGTERM");
-        await table2.finishAndCleanup(run, "failed", "daemon shut down", {
+      table2.values().map(async (run2) => {
+        if (run2.child?.pid) killTree(run2.child.pid, "SIGTERM");
+        await table2.finishAndCleanup(run2, "failed", "daemon shut down", {
           judgment: "interrupted"
         });
       })
@@ -10114,11 +10136,11 @@ async function runDaemon(opts) {
         return;
       }
       if (err instanceof ApiError && err.status === 401) {
-        for (const run of table2.values()) {
-          if (run.child?.pid) killTree(run.child.pid, "SIGKILL");
-          settleWorkspace(run.workspace, keepWorkspace(opts.keepWorkspaces, "failed"), {
-            run_id: run.runId,
-            ...run.issueLabel ? { issue_ref: run.issueLabel } : {},
+        for (const run2 of table2.values()) {
+          if (run2.child?.pid) killTree(run2.child.pid, "SIGKILL");
+          settleWorkspace(run2.workspace, keepWorkspace(opts.keepWorkspaces, "failed"), {
+            run_id: run2.runId,
+            ...run2.issueLabel ? { issue_ref: run2.issueLabel } : {},
             status: "failed",
             error: "daemon token rejected"
           });
@@ -10160,6 +10182,480 @@ function runGit(args, cwd, batcher) {
   });
 }
 
+// src/commands/daemon-flags.ts
+import { hostname as hostname2 } from "node:os";
+function withDaemonFlags(cmd) {
+  return cmd.option(
+    "--name <name>",
+    "runner name, unique per user; name it machine-plus-harness, e.g. macbook-claude (default: this hostname)"
+  ).option("--harness <harness>", "claude-code | codex | custom", "claude-code").option(
+    "--command <template>",
+    "custom harness command template ({prompt_file}, {workspace}, {model})"
+  ).option("--max-concurrent <n>", "maximum simultaneous runs", (v) => Number.parseInt(v, 10), 1).option("--poll-interval <seconds>", "seconds between polls", (v) => Number.parseInt(v, 10), 15).option(
+    "--keep-workspaces <mode>",
+    "keep settled runs' workspaces for debugging: never | failed | always",
+    "never"
+  ).option(
+    "--keep-workspaces-for <hours>",
+    "delete kept workspaces older than this",
+    (v) => Number(v),
+    72
+  ).option(
+    "--keep-workspaces-max <n>",
+    "keep at most this many workspaces (oldest removed first)",
+    (v) => Number.parseInt(v, 10),
+    20
+  );
+}
+function parseDaemonFlags(opts) {
+  const harness = opts.harness.replaceAll("-", "_");
+  if (!HARNESS_KINDS.includes(harness)) {
+    die(`--harness must be claude-code, codex, or custom, got "${opts.harness}"`);
+  }
+  if (harness === "custom" && !opts.command) {
+    die('the custom harness needs --command "<template>" ({prompt_file}, {workspace}, {model})');
+  }
+  if (harness !== "custom" && opts.command) die("--command only applies to --harness custom");
+  if (!Number.isInteger(opts.maxConcurrent) || opts.maxConcurrent < 1 || opts.maxConcurrent > 100) {
+    die("--max-concurrent must be an integer between 1 and 100");
+  }
+  if (!Number.isInteger(opts.pollInterval) || opts.pollInterval < 1) {
+    die("--poll-interval must be a positive number of seconds");
+  }
+  const keepWorkspaces = opts.keepWorkspaces;
+  if (!KEEP_WORKSPACES_MODES.includes(keepWorkspaces)) {
+    die(
+      `--keep-workspaces must be ${KEEP_WORKSPACES_MODES.join(", ")}, got "${opts.keepWorkspaces}"`
+    );
+  }
+  if (!Number.isFinite(opts.keepWorkspacesFor) || opts.keepWorkspacesFor <= 0) {
+    die("--keep-workspaces-for must be a positive number of hours");
+  }
+  if (!Number.isInteger(opts.keepWorkspacesMax) || opts.keepWorkspacesMax < 1) {
+    die("--keep-workspaces-max must be a positive integer");
+  }
+  return {
+    name: opts.name ?? hostname2(),
+    harness,
+    ...opts.command !== void 0 ? { command: opts.command } : {},
+    maxConcurrent: opts.maxConcurrent,
+    pollIntervalSeconds: opts.pollInterval,
+    keepWorkspaces,
+    keepWorkspacesForHours: opts.keepWorkspacesFor,
+    keepWorkspacesMax: opts.keepWorkspacesMax
+  };
+}
+function harnessFlag(harness) {
+  return harness.replaceAll("_", "-");
+}
+
+// src/commands/runner-service.ts
+import { execFile } from "node:child_process";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, rmSync as rmSync4, statSync as statSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir2, hostname as hostname3, userInfo } from "node:os";
+import { dirname as dirname6 } from "node:path";
+import { promisify } from "node:util";
+
+// src/daemon/service.ts
+import { existsSync as existsSync6, statSync as statSync5 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname5, join as join6, sep as sep2 } from "node:path";
+function defaultServiceManager(platform2 = process.platform) {
+  if (platform2 === "darwin") return "launchd";
+  if (platform2 === "linux") return "systemd";
+  return null;
+}
+function serviceLabel(name2, kind) {
+  return kind === "launchd" ? `dev.tines.runner.${name2}` : `tines-runner-${name2}`;
+}
+function unitPath(name2, kind, home) {
+  const label = serviceLabel(name2, kind);
+  return kind === "launchd" ? join6(home, "Library", "LaunchAgents", `${label}.plist`) : join6(home, ".config", "systemd", "user", `${label}.service`);
+}
+function serviceLogPath(configDir, name2) {
+  return join6(configDir, "logs", `runner-${name2}.log`);
+}
+function managedBinary(prefix) {
+  return join6(prefix, "node_modules", ".bin", "tines");
+}
+function daemonArgs(input2) {
+  const args = [
+    "runner",
+    "daemon",
+    "--url",
+    input2.url,
+    "--name",
+    input2.name,
+    "--harness",
+    input2.harness
+  ];
+  if (input2.command !== void 0) args.push("--command", input2.command);
+  if (input2.maxConcurrent !== 1) args.push("--max-concurrent", String(input2.maxConcurrent));
+  if (input2.pollIntervalSeconds !== void 0 && input2.pollIntervalSeconds !== 15)
+    args.push("--poll-interval", String(input2.pollIntervalSeconds));
+  if (input2.keepWorkspaces !== void 0 && input2.keepWorkspaces !== "never")
+    args.push("--keep-workspaces", input2.keepWorkspaces);
+  if (input2.keepWorkspacesForHours !== void 0 && input2.keepWorkspacesForHours !== 72)
+    args.push("--keep-workspaces-for", String(input2.keepWorkspacesForHours));
+  if (input2.keepWorkspacesMax !== void 0 && input2.keepWorkspacesMax !== 20)
+    args.push("--keep-workspaces-max", String(input2.keepWorkspacesMax));
+  return args;
+}
+function findOnPath(name2, envPath) {
+  for (const dir of (envPath ?? "").split(delimiter2)) {
+    if (!dir) continue;
+    const candidate = join6(dir, name2);
+    try {
+      if (statSync5(candidate).isFile()) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function servicePath(input2) {
+  const dirs = [dirname5(input2.execPath)];
+  const missing = [];
+  for (const name2 of input2.required) {
+    const found = findOnPath(name2, input2.envPath);
+    if (found) dirs.push(dirname5(found));
+    else missing.push(name2);
+  }
+  dirs.push(
+    ...input2.platform === "darwin" ? ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"] : ["/usr/local/bin", "/usr/bin", "/bin"]
+  );
+  return { path: [...new Set(dirs)].join(delimiter2), missing };
+}
+function xml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderLaunchdPlist(spec) {
+  const label = serviceLabel(spec.name, "launchd");
+  const env = { PATH: spec.path, ...spec.env };
+  const lines2 = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    `	<key>Label</key><string>${xml(label)}</string>`,
+    "	<key>ProgramArguments</key>",
+    "	<array>",
+    ...[spec.binary, ...spec.args].map((arg) => `		<string>${xml(arg)}</string>`),
+    "	</array>",
+    "	<key>EnvironmentVariables</key>",
+    "	<dict>",
+    ...Object.entries(env).map(
+      ([key, value]) => `		<key>${xml(key)}</key><string>${xml(value)}</string>`
+    ),
+    "	</dict>",
+    "	<key>RunAtLoad</key><true/>",
+    "	<!-- Relaunches after any exit: a crash, and the daemon's own exit for a self-update. -->",
+    "	<key>KeepAlive</key><true/>",
+    `	<key>StandardOutPath</key><string>${xml(spec.logPath)}</string>`,
+    `	<key>StandardErrorPath</key><string>${xml(spec.logPath)}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ];
+  return lines2.join("\n");
+}
+function unitQuote(value) {
+  return /^[A-Za-z0-9_./:=@%+-]+$/.test(value) ? value : `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function renderSystemdUnit(spec) {
+  const env = { PATH: spec.path, ...spec.env };
+  const lines2 = [
+    "[Unit]",
+    `Description=Tines local runner daemon (${spec.name})`,
+    "After=network-online.target",
+    "",
+    "[Service]",
+    `ExecStart=${[spec.binary, ...spec.args].map(unitQuote).join(" ")}`,
+    ...Object.entries(env).map(([key, value]) => `Environment=${unitQuote(`${key}=${value}`)}`),
+    `StandardOutput=append:${spec.logPath}`,
+    `StandardError=append:${spec.logPath}`,
+    "# always, not on-failure: the daemon exits 0 on purpose to pick up a self-update.",
+    "Restart=always",
+    "RestartSec=10",
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ];
+  return lines2.join("\n");
+}
+function renderUnit(spec) {
+  return spec.kind === "launchd" ? renderLaunchdPlist(spec) : renderSystemdUnit(spec);
+}
+function serviceCommands(target) {
+  const label = serviceLabel(target.name, target.kind);
+  if (target.kind === "launchd") {
+    const domain = `gui/${target.uid}`;
+    return {
+      // bootout first so a re-install replaces the loaded definition
+      // instead of failing with "service already loaded".
+      load: [
+        { argv: ["launchctl", "bootout", `${domain}/${label}`], optional: true },
+        { argv: ["launchctl", "bootstrap", domain, target.unitPath] }
+      ],
+      restart: [{ argv: ["launchctl", "kickstart", "-k", `${domain}/${label}`] }],
+      unload: [{ argv: ["launchctl", "bootout", `${domain}/${label}`], optional: true }]
+    };
+  }
+  return {
+    load: [
+      { argv: ["systemctl", "--user", "daemon-reload"] },
+      { argv: ["systemctl", "--user", "enable", "--now", label] },
+      // So the runner keeps working while nobody is logged in.
+      { argv: ["loginctl", "enable-linger"], optional: true }
+    ],
+    restart: [{ argv: ["systemctl", "--user", "restart", label] }],
+    unload: [
+      { argv: ["systemctl", "--user", "disable", "--now", label], optional: true },
+      { argv: ["systemctl", "--user", "daemon-reload"], optional: true }
+    ]
+  };
+}
+function matchDaemonProcesses(psOutput, query2) {
+  const matches = [];
+  for (const raw of psOutput.split("\n")) {
+    const line = raw.trim();
+    const m = /^(\d+)\s+(.*)$/.exec(line);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    const args = m[2];
+    if (pid === query2.selfPid) continue;
+    const words = args.split(/\s+/);
+    const daemonAt = words.findIndex((w, i) => w === "runner" && words[i + 1] === "daemon");
+    if (daemonAt < 0) continue;
+    const binary = words[daemonAt - 1] ?? "";
+    if (!/(^|\/)tines(\.js|\.cjs|\.mjs)?$/.test(binary) && !/(^|\/)tines$/.test(binary)) continue;
+    let name2 = null;
+    for (let i = daemonAt + 2; i < words.length; i++) {
+      const w = words[i];
+      if (w === "--name") name2 = words[i + 1] ?? null;
+      else if (w.startsWith("--name=")) name2 = w.slice("--name=".length);
+    }
+    if ((name2 ?? query2.hostname) !== query2.name) continue;
+    const root = query2.prefix.endsWith(sep2) ? query2.prefix : query2.prefix + sep2;
+    matches.push({ pid, args, managed: args.includes(root) });
+  }
+  return matches;
+}
+function daemonStartedLine(name2) {
+  const escaped = name2.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(reconnecting as runner|registered runner) "${escaped}"`);
+}
+function managedBinaryPresent(prefix) {
+  return existsSync6(managedBinary(prefix));
+}
+
+// src/commands/runner-service.ts
+var run = promisify(execFile);
+var STARTUP_TIMEOUT_MS = 3e4;
+var log2 = (message3) => console.log(message3);
+function resolveServiceManager(flag) {
+  if (flag !== void 0) {
+    if (flag !== "launchd" && flag !== "systemd")
+      die(`--service-manager must be launchd or systemd, got "${flag}"`);
+    return flag;
+  }
+  const kind = defaultServiceManager();
+  if (!kind) {
+    die(
+      `no service manager is known for ${process.platform}; run \`tines runner daemon\` under your own supervisor instead`
+    );
+  }
+  return kind;
+}
+async function runServiceCommands(steps) {
+  for (const step of steps) {
+    try {
+      await run(step.argv[0], step.argv.slice(1), { timeout: 3e4 });
+    } catch (err) {
+      if (step.optional) continue;
+      const detail = err && typeof err === "object" && "stderr" in err && String(err.stderr).trim() ? `: ${String(err.stderr).trim()}` : err instanceof Error ? `: ${err.message}` : "";
+      die(`\`${step.argv.join(" ")}\` failed${detail}`);
+    }
+  }
+}
+async function listProcesses() {
+  try {
+    const { stdout } = await run("ps", ["-axo", "pid=,args="], { maxBuffer: 16 * 1024 * 1024 });
+    return stdout;
+  } catch {
+    return null;
+  }
+}
+function fileSize(path2) {
+  try {
+    return statSync6(path2).size;
+  } catch {
+    return 0;
+  }
+}
+async function waitForStart(logPath, offset, name2) {
+  const pattern = daemonStartedLine(name2);
+  const deadline = Date.now() + STARTUP_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    if (existsSync7(logPath)) {
+      const content = readFileSync10(logPath, "utf8").slice(offset);
+      if (pattern.test(content)) return true;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+  return false;
+}
+function serviceTarget(name2, kind) {
+  return { kind, name: name2, unitPath: unitPath(name2, kind, homedir2()), uid: userInfo().uid };
+}
+function registerServiceCommands(runnerCmd) {
+  withCommon(
+    withDaemonFlags(
+      runnerCmd.command("install").description(
+        "Register this machine as a runner and install the daemon as a launchd/systemd service that keeps itself updated"
+      )
+    ).option("--service-manager <kind>", "launchd | systemd (default: the one this OS ships)")
+  ).action(async (opts) => {
+    const settings = parseDaemonFlags(opts);
+    const kind = resolveServiceManager(opts.serviceManager);
+    const baseUrl = resolveUrl(opts).replace(/\/+$/, "");
+    const configDir = defaultConfigDir();
+    mkdirSync5(configDir, { recursive: true });
+    const prefix = agentCliPrefix(configDir);
+    const ps = await listProcesses();
+    const running = ps ? matchDaemonProcesses(ps, {
+      name: settings.name,
+      hostname: hostname3(),
+      prefix,
+      selfPid: process.pid
+    }) : [];
+    if (running.length > 0) {
+      const label = serviceLabel(settings.name, kind);
+      const lines2 = running.map((p) => `  pid ${p.pid}: ${p.args}`);
+      die(
+        running.every((p) => p.managed) ? `"${settings.name}" is already running under its service (${label}):
+${lines2.join("\n")}
+to change its flags: \`tines runners pause ${settings.name}\`, wait for 0 active runs, \`tines runner uninstall ${settings.name}\`, then install again \u2014 or \`tines runner restart ${settings.name}\` to relaunch it as is` : `a daemon for "${settings.name}" is already running outside the service:
+${lines2.join("\n")}
+stop it first \u2014 \`tines runners pause ${settings.name}\`, wait for 0 active runs, kill that process \u2014 then run install again; it reconnects with the stored token, so no key is needed`
+      );
+    }
+    if (!managedBinaryPresent(prefix)) {
+      log2(`installing the daemon-managed tines into ${prefix} \u2026`);
+      await installAgentCli({ configDir, log: log2 });
+      if (!managedBinaryPresent(prefix)) {
+        die(
+          `could not install tines into ${prefix}; the service needs that copy (npm and network access required)`
+        );
+      }
+    }
+    let ensured;
+    try {
+      ensured = await ensureRunnerCredentials({
+        configDir,
+        baseUrl,
+        name: settings.name,
+        harness: settings.harness,
+        ...settings.command !== void 0 ? { command: settings.command } : {},
+        maxConcurrent: settings.maxConcurrent,
+        ...resolveApiKey(opts) !== void 0 ? { apiKey: resolveApiKey(opts) } : {},
+        log: log2
+      });
+    } catch (err) {
+      die(err instanceof Error ? err.message : String(err));
+    }
+    const harnessBinary = settings.harness === "claude_code" ? "claude" : settings.harness === "codex" ? "codex" : null;
+    const { path: path2, missing } = servicePath({
+      execPath: process.execPath,
+      required: [...harnessBinary ? [harnessBinary] : [], "git"],
+      envPath: process.env.PATH,
+      platform: process.platform
+    });
+    for (const name2 of missing) {
+      log2(
+        `warning: \`${name2}\` is not on this shell's PATH, so it is not on the service's either \u2014 install it, then \`tines runner install\` again`
+      );
+    }
+    const target = serviceTarget(settings.name, kind);
+    const logPath = serviceLogPath(configDir, settings.name);
+    const spec = {
+      name: settings.name,
+      kind,
+      binary: managedBinary(prefix),
+      args: daemonArgs({
+        url: baseUrl,
+        name: settings.name,
+        harness: harnessFlag(settings.harness),
+        ...settings.command !== void 0 ? { command: settings.command } : {},
+        maxConcurrent: settings.maxConcurrent,
+        pollIntervalSeconds: settings.pollIntervalSeconds,
+        keepWorkspaces: settings.keepWorkspaces,
+        keepWorkspacesForHours: settings.keepWorkspacesForHours,
+        keepWorkspacesMax: settings.keepWorkspacesMax
+      }),
+      path: path2,
+      logPath,
+      env: process.env.TINES_CONFIG_DIR ? { TINES_CONFIG_DIR: process.env.TINES_CONFIG_DIR } : {}
+    };
+    mkdirSync5(dirname6(target.unitPath), { recursive: true });
+    mkdirSync5(dirname6(logPath), { recursive: true });
+    writeFileSync4(target.unitPath, renderUnit(spec), { mode: 420 });
+    log2(`wrote ${target.unitPath}`);
+    const offset = fileSize(logPath);
+    await runServiceCommands(serviceCommands(target).load);
+    log2(`loaded ${serviceLabel(settings.name, kind)}; waiting for the daemon to report in \u2026`);
+    const started = await waitForStart(logPath, offset, settings.name);
+    const summary = {
+      name: settings.name,
+      runner_id: ensured.creds.runner_id,
+      registered: ensured.registered,
+      service_manager: kind,
+      unit_path: target.unitPath,
+      log_path: logPath,
+      started
+    };
+    if (!started) {
+      if (opts.json) printJson(summary);
+      die(
+        `the service is loaded but the daemon has not reported in after ${STARTUP_TIMEOUT_MS / 1e3}s \u2014 read ${logPath} (a missing \`node\` on the service PATH, or a rejected token, shows there)`
+      );
+    }
+    if (opts.json) return printJson(summary);
+    log2(
+      `runner "${settings.name}" is up under ${kind} and updates itself: log at ${logPath}; \`tines runner restart ${settings.name}\` relaunches it, \`tines runner uninstall ${settings.name}\` removes the service`
+    );
+    if (ensured.registered) log2(nextStepsMessage(settings.name, baseUrl));
+  });
+  runnerCmd.command("restart [name]").description(
+    "Relaunch an installed runner service (interrupts runs in flight: pause the runner and wait for 0 active runs first if that matters)"
+  ).option("--service-manager <kind>", "launchd | systemd (default: the one this OS ships)").option("--json", "print JSON instead of a message").action(async (name2, opts) => {
+    const kind = resolveServiceManager(opts.serviceManager);
+    const target = serviceTarget(name2 ?? hostname3(), kind);
+    if (!existsSync7(target.unitPath)) {
+      die(
+        `"${target.name}" is not installed as a service (no ${target.unitPath}); run \`tines runner install --name ${target.name} \u2026\` first`
+      );
+    }
+    await runServiceCommands(serviceCommands(target).restart);
+    if (opts.json)
+      return printJson({ name: target.name, service_manager: kind, restarted: true });
+    log2(`restarted ${serviceLabel(target.name, kind)}`);
+  });
+  runnerCmd.command("uninstall [name]").description(
+    "Stop and remove a runner's service unit (the stored runner token is kept, so a later install reconnects)"
+  ).option("--service-manager <kind>", "launchd | systemd (default: the one this OS ships)").option("--json", "print JSON instead of a message").action(async (name2, opts) => {
+    const kind = resolveServiceManager(opts.serviceManager);
+    const target = serviceTarget(name2 ?? hostname3(), kind);
+    const existed = existsSync7(target.unitPath);
+    await runServiceCommands(serviceCommands(target).unload);
+    rmSync4(target.unitPath, { force: true });
+    if (opts.json)
+      return printJson({ name: target.name, service_manager: kind, removed: existed });
+    log2(
+      existed ? `removed ${serviceLabel(target.name, kind)} (${target.unitPath}); the runner token is still stored, so \`tines runner install\` reconnects without a key` : `no service unit for "${target.name}" at ${target.unitPath}; nothing to remove`
+    );
+  });
+}
+
 // src/commands/runners.ts
 function parseBoolean(value) {
   if (value === "true") return true;
@@ -10455,87 +10951,38 @@ function register8(program3) {
   });
   const runnerCmd = program3.command("runner").description("The local runner daemon");
   withCommon(
-    runnerCmd.command("daemon").description(
-      "Run the local runner daemon: register/reconnect, poll for assigned runs, execute them"
-    ).option(
-      "--name <name>",
-      "runner name, unique per user; name it machine-plus-harness, e.g. macbook-claude (default: this hostname)"
-    ).option("--harness <harness>", "claude-code | codex | custom", "claude-code").option(
-      "--command <template>",
-      "custom harness command template ({prompt_file}, {workspace}, {model})"
-    ).option("--max-concurrent <n>", "maximum simultaneous runs", (v) => Number.parseInt(v, 10), 1).option(
-      "--poll-interval <seconds>",
-      "seconds between polls",
-      (v) => Number.parseInt(v, 10),
-      15
+    withDaemonFlags(
+      runnerCmd.command("daemon").description(
+        "Run the local runner daemon in the foreground: register/reconnect, poll for assigned runs, execute them (`tines runner install` runs it as a service instead)"
+      )
     ).option(
       "--no-cli-refresh",
       "do not install/refresh the agent-facing tines CLI from npm (harnesses use the ambient PATH)"
     ).option(
       "--no-self-update",
       "do not exit for the service manager to relaunch a newer daemon (only applies when launched from the daemon-managed prefix)"
-    ).option(
-      "--keep-workspaces <mode>",
-      "keep settled runs' workspaces for debugging: never | failed | always",
-      "never"
-    ).option(
-      "--keep-workspaces-for <hours>",
-      "delete kept workspaces older than this",
-      (v) => Number(v),
-      72
-    ).option(
-      "--keep-workspaces-max <n>",
-      "keep at most this many workspaces (oldest removed first)",
-      (v) => Number.parseInt(v, 10),
-      20
     )
   ).action(
     async (opts) => {
-      const harness = opts.harness.replaceAll("-", "_");
-      if (!HARNESS_KINDS.includes(harness)) {
-        die(`--harness must be claude-code, codex, or custom, got "${opts.harness}"`);
-      }
-      if (harness === "custom" && !opts.command) {
-        die(
-          'the custom harness needs --command "<template>" ({prompt_file}, {workspace}, {model})'
-        );
-      }
-      if (harness !== "custom" && opts.command) die("--command only applies to --harness custom");
-      if (!Number.isInteger(opts.maxConcurrent) || opts.maxConcurrent < 1 || opts.maxConcurrent > 100) {
-        die("--max-concurrent must be an integer between 1 and 100");
-      }
-      if (!Number.isInteger(opts.pollInterval) || opts.pollInterval < 1) {
-        die("--poll-interval must be a positive number of seconds");
-      }
-      const keepWorkspaces = opts.keepWorkspaces;
-      if (!KEEP_WORKSPACES_MODES.includes(keepWorkspaces)) {
-        die(
-          `--keep-workspaces must be ${KEEP_WORKSPACES_MODES.join(", ")}, got "${opts.keepWorkspaces}"`
-        );
-      }
-      if (!Number.isFinite(opts.keepWorkspacesFor) || opts.keepWorkspacesFor <= 0) {
-        die("--keep-workspaces-for must be a positive number of hours");
-      }
-      if (!Number.isInteger(opts.keepWorkspacesMax) || opts.keepWorkspacesMax < 1) {
-        die("--keep-workspaces-max must be a positive integer");
-      }
+      const settings = parseDaemonFlags(opts);
       await runDaemon({
         url: resolveUrl(opts).replace(/\/+$/, ""),
         apiKey: resolveApiKey(opts),
-        name: opts.name ?? hostname2(),
-        harness,
-        command: opts.command,
-        maxConcurrent: opts.maxConcurrent,
-        pollIntervalMs: opts.pollInterval * 1e3,
+        name: settings.name,
+        harness: settings.harness,
+        command: settings.command,
+        maxConcurrent: settings.maxConcurrent,
+        pollIntervalMs: settings.pollIntervalSeconds * 1e3,
         configDir: defaultConfigDir(),
         cliRefresh: opts.cliRefresh,
         selfUpdate: opts.selfUpdate,
-        keepWorkspaces,
-        keepWorkspacesForHours: opts.keepWorkspacesFor,
-        keepWorkspacesMax: opts.keepWorkspacesMax
+        keepWorkspaces: settings.keepWorkspaces,
+        keepWorkspacesForHours: settings.keepWorkspacesForHours,
+        keepWorkspacesMax: settings.keepWorkspacesMax
       });
     }
   );
+  registerServiceCommands(runnerCmd);
   const workspacesCmd = runnerCmd.command("workspaces").description("List run workspaces the daemon kept for debugging (--keep-workspaces)").option("--json", "print JSON instead of a table").action((opts) => {
     const configDir = defaultConfigDir();
     const kept = listKeptWorkspaces(configDir);
@@ -10622,14 +11069,14 @@ function register8(program3) {
       if (evidence.population === "pending") {
         table([
           ["ID", "ISSUE", "RUNNER", "TIER", "STATUS", "COST", "CREATED"],
-          ...items.map((run) => [
-            run.id,
-            run.issue_ref ? `${run.issue_ref.project_name}/${run.issue_ref.number}` : run.issue_id,
-            run.runner_name,
-            run.tier,
+          ...items.map((run2) => [
+            run2.id,
+            run2.issue_ref ? `${run2.issue_ref.project_name}/${run2.issue_ref.number}` : run2.issue_id,
+            run2.runner_name,
+            run2.tier,
             "Pending at cutoff",
             "\u2014",
-            timestamp(run.created_at)
+            timestamp(run2.created_at)
           ])
         ]);
         return;
@@ -10645,29 +11092,29 @@ function register8(program3) {
   ).action(
     async (id2, opts) => {
       const api = client(opts);
-      const run = await api.getRun(id2);
-      if (opts.json) return printJson(run);
+      const run2 = await api.getRun(id2);
+      if (opts.json) return printJson(run2);
       console.log(
-        `${run.id}  ${run.status}  on ${run.runner_name}${run.resumed_from_run_id ? `  \xB7 resumed run ${run.resumed_from_run_id}` : ""}`
+        `${run2.id}  ${run2.status}  on ${run2.runner_name}${run2.resumed_from_run_id ? `  \xB7 resumed run ${run2.resumed_from_run_id}` : ""}`
       );
-      if (run.issue_ref) console.log(`issue: ${issueRef(run.issue_ref)} \u2014 ${run.issue_ref.title}`);
-      console.log(`tier: ${run.tier}  model: ${run.model ?? "(n/a)"}`);
+      if (run2.issue_ref) console.log(`issue: ${issueRef(run2.issue_ref)} \u2014 ${run2.issue_ref.title}`);
+      console.log(`tier: ${run2.tier}  model: ${run2.model ?? "(n/a)"}`);
       console.log(
-        `states: ${run.state_at_start_name ?? run.state_id_at_start} \u2192 ${run.state_at_end_name ?? run.state_id_at_end ?? "\u2026"}`
+        `states: ${run2.state_at_start_name ?? run2.state_id_at_start} \u2192 ${run2.state_at_end_name ?? run2.state_id_at_end ?? "\u2026"}`
       );
       console.log(
-        `created: ${timestamp(run.created_at)}  started: ${run.started_at ? timestamp(run.started_at) : "\u2014"}  ended: ${run.ended_at ? timestamp(run.ended_at) : "\u2014"}  duration: ${runDurationLabel(run)}`
+        `created: ${timestamp(run2.created_at)}  started: ${run2.started_at ? timestamp(run2.started_at) : "\u2014"}  ended: ${run2.ended_at ? timestamp(run2.ended_at) : "\u2014"}  duration: ${runDurationLabel(run2)}`
       );
-      if (run.usage) {
-        const u = run.usage;
-        const costLabel = runCostLabel(run);
+      if (run2.usage) {
+        const u = run2.usage;
+        const costLabel = runCostLabel(run2);
         const metric = (value) => value === void 0 ? "unknown" : value.toLocaleString();
         console.log(
           `usage: input ${metric(u.input_tokens)}  cache-read ${metric(u.cache_read_tokens)}  cache-write ${metric(u.cache_write_tokens)}  output ${metric(u.output_tokens)}`
         );
         if (u.cost_usd !== void 0)
           console.log(
-            `cost: ${runCostLabel(run)}${u.cost_source === void 0 ? " \xB7 source unavailable" : ""}`
+            `cost: ${runCostLabel(run2)}${u.cost_source === void 0 ? " \xB7 source unavailable" : ""}`
           );
         const pricing = u.pricing;
         if (pricing?.status === "provider_authoritative")
@@ -10692,9 +11139,9 @@ function register8(program3) {
           console.log("  Standard API list-price estimate; not an invoice or subscription usage.");
         }
       }
-      if (run.provider_session_id) console.log(`provider session: ${run.provider_session_id}`);
-      if (run.provider_url) console.log(`provider console: ${run.provider_url}`);
-      if (run.error) console.log(`error: ${run.error}`);
+      if (run2.provider_session_id) console.log(`provider session: ${run2.provider_session_id}`);
+      if (run2.provider_url) console.log(`provider console: ${run2.provider_url}`);
+      if (run2.error) console.log(`error: ${run2.error}`);
       if (opts.logs) {
         console.log("");
         if (opts.full || opts.raw) {
@@ -10711,12 +11158,12 @@ function register8(program3) {
           process.stdout.write(decoder.decode());
           return;
         }
-        if (run.log_bytes_dropped > 0) {
+        if (run2.log_bytes_dropped > 0) {
           console.log(
-            `[${Math.round(run.log_bytes_dropped / 1024)} KB truncated from the head \u2014 ` + (run.log_expired ? "past its retention window; only this tail remains]" : `run \`tines runs show ${run.id} --logs --full\` for the complete ${Math.round(run.log_full_bytes / 1024)} KB log]`)
+            `[${Math.round(run2.log_bytes_dropped / 1024)} KB truncated from the head \u2014 ` + (run2.log_expired ? "past its retention window; only this tail remains]" : `run \`tines runs show ${run2.id} --logs --full\` for the complete ${Math.round(run2.log_full_bytes / 1024)} KB log]`)
           );
         }
-        console.log(run.log || "(no log output captured)");
+        console.log(run2.log || "(no log output captured)");
       }
     }
   );
@@ -10724,10 +11171,10 @@ function register8(program3) {
     runsCmd.command("cancel <id>").description("Cancel a run (judged like any other end: usually a strike)")
   ).action(async (id2, opts) => {
     const api = client(opts);
-    const run = await api.cancelRun(id2);
-    if (opts.json) return printJson(run);
+    const run2 = await api.cancelRun(id2);
+    if (opts.json) return printJson(run2);
     console.log(
-      `canceled ${run.id}${run.issue_ref ? ` on ${issueRef(run.issue_ref)}` : ""} (was on ${run.runner_name})`
+      `canceled ${run2.id}${run2.issue_ref ? ` on ${issueRef(run2.issue_ref)}` : ""} (was on ${run2.runner_name})`
     );
   });
 }
@@ -11104,12 +11551,12 @@ function register10(program3) {
     const api = client(opts);
     const overrides = {};
     for (const spec of opts.state) {
-      const sep2 = spec.lastIndexOf("=");
-      if (sep2 < 1 || sep2 === spec.length - 1) {
+      const sep3 = spec.lastIndexOf("=");
+      if (sep3 < 1 || sep3 === spec.length - 1) {
         die(`--state must look like <workflow>/<state>=<n>, got "${spec}"`);
       }
-      const limit = Number.parseInt(spec.slice(sep2 + 1), 10);
-      const { state } = await resolveStateFlag(api, spec.slice(0, sep2));
+      const limit = Number.parseInt(spec.slice(sep3 + 1), 10);
+      const { state } = await resolveStateFlag(api, spec.slice(0, sep3));
       overrides[state.id] = limit;
     }
     const settings = await api.updateSupervisorSettings({
@@ -11126,17 +11573,17 @@ function register10(program3) {
 }
 
 // src/commands/workflows.ts
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 
 // src/workflow-packages.ts
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { createHash } from "node:crypto";
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 var PACKAGE_STDIN = "-";
 var MAX_LOCAL_JSON_BYTES = 32 * 1024 * 1024;
 function readPackageSource(path2) {
   try {
-    const bytes2 = readFileSync10(path2 === PACKAGE_STDIN ? 0 : path2);
+    const bytes2 = readFileSync11(path2 === PACKAGE_STDIN ? 0 : path2);
     if (bytes2.byteLength > MAX_LOCAL_JSON_BYTES)
       throw new Error(`input exceeds ${MAX_LOCAL_JSON_BYTES} bytes`);
     return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes2);
@@ -11480,14 +11927,14 @@ function readJsonBody(inline, file) {
   if (file !== void 0 && file !== "-") {
     let raw;
     try {
-      raw = readFileSync11(file, "utf8");
+      raw = readFileSync12(file, "utf8");
     } catch (err) {
       die(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
     return parseJsonObject(raw, file);
   }
   if (file === "-" || !process.stdin.isTTY) {
-    const raw = readFileSync11(0, "utf8");
+    const raw = readFileSync12(0, "utf8");
     if (raw.trim() === "") {
       if (file === "-") die("no JSON on stdin");
       return void 0;
@@ -11596,9 +12043,9 @@ async function resolveStateBases(states, library) {
   }
 }
 function resolveBasePair(lib, pair, stateName) {
-  const sep2 = pair.indexOf("/");
-  const workflowRef = pair.slice(0, sep2).trim();
-  const stateRef2 = pair.slice(sep2 + 1).trim();
+  const sep3 = pair.indexOf("/");
+  const workflowRef = pair.slice(0, sep3).trim();
+  const stateRef2 = pair.slice(sep3 + 1).trim();
   const where = `state "${stateName}" inherits from "${pair}"`;
   if (!workflowRef || !stateRef2) {
     die(`${where}, which is not a <workflow>/<state> pair`);