workoffdesk 0.0.0-stage → 1.0.0

package/dist/server/agents/codex/threads.js

@@ -0,0 +1,208 @@
+import { execFile } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+const obj = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : undefined);
+const str = (v) => (typeof v === 'string' ? v : '');
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+const LIMIT = 50;
+// How long the list is kept: it takes the app server seconds to make.
+const KEEP_MS = 5 * 60_000;
+// How much of the end of a rollout is read for how its last turn went and what the person said last.
+const TAIL = 64 * 1024;
+const RUN_MS = 5_000;
+const PROMPT_MAX = 200;
+const run = (bin, args) => new Promise((resolve, reject) => execFile(bin, args, { timeout: RUN_MS, maxBuffer: 16 * 1024 * 1024 }, (err, stdout) => 
+// lsof says 1 when some file asked about is open nowhere; what it found is still on stdout.
+err && !stdout ? reject(err) : resolve(String(stdout))));
+const real = (p) => {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+};
+// A thread people opened themselves: from the TUI or an editor, not `codex exec` or a subagent.
+function threadOf(v) {
+    const t = obj(v);
+    const source = t?.source;
+    if (!t || t.ephemeral === true || t.parentThreadId || (source !== 'cli' && source !== 'vscode'))
+        return null;
+    return anyThread(t);
+}
+function anyThread(t) {
+    const id = str(t?.id);
+    if (!t || !id)
+        return null;
+    return {
+        id,
+        cwd: str(t.cwd),
+        title: str(t.name).trim() || str(t.preview).replace(/\s+/g, ' ').trim(),
+        path: str(t.path) || null,
+        updatedAt: num(t.updatedAt) * 1000,
+    };
+}
+export class CodexThreads {
+    o;
+    kept = null;
+    listing = null;
+    asking = null;
+    locks;
+    constructor(o) {
+        this.o = o;
+        this.locks = join(o.codexHome, 'thread-writer-locks');
+    }
+    // The latest threads and every thread open somewhere now, newest first. Asked again while one runs, the one
+    // running answers.
+    list() {
+        this.asking ??= this.listNow().finally(() => {
+            this.asking = null;
+        });
+        return this.asking;
+    }
+    // One thread as list() has it, also when it is older than the list goes or not one list() shows; null when
+    // there is none.
+    async where(id) {
+        const listed = (await this.list()).find((t) => t.id === id);
+        if (listed)
+            return listed;
+        const thread = anyThread(await this.o.agent.readThread(id));
+        if (!thread)
+            return null;
+        const holders = await this.holders();
+        return this.live(thread, holders.get(id) ?? null);
+    }
+    async listNow() {
+        const [threads, holders] = await Promise.all([this.threads(), this.holders()]);
+        const known = new Set(threads.map((t) => t.id));
+        // Opened since the list was made: read on its own, which is quick.
+        const added = await Promise.all([...holders.keys()].filter((id) => !known.has(id)).map((id) => this.o.agent.readThread(id).then(threadOf, () => null)));
+        const all = [...threads, ...added.flatMap((t) => (t ? [t] : []))];
+        const shown = await Promise.all(all.map((t) => this.live(t, holders.get(t.id) ?? null)));
+        return shown.sort((a, b) => b.lastActivity - a.lastActivity);
+    }
+    // The kept list, made again in the background once old; the first ask waits for it.
+    threads() {
+        const fresh = this.kept && Date.now() - this.kept.at < KEEP_MS;
+        if (!fresh && !this.listing) {
+            this.listing = this.o.agent
+                .listThreads({ limit: LIMIT, sourceKinds: ['cli', 'vscode'] })
+                .then((data) => {
+                const threads = data.flatMap((d) => threadOf(d) ?? []);
+                this.kept = { at: Date.now(), threads };
+                return threads;
+            })
+                .finally(() => {
+                this.listing = null;
+            });
+        }
+        if (this.kept) {
+            this.listing?.catch(() => { });
+            return Promise.resolve(this.kept.threads);
+        }
+        return this.listing;
+    }
+    // The thread's state as its rollout says now.
+    async live(t, holder) {
+        const end = t.path ? await rolloutEnd(t.path).catch(() => null) : null;
+        return {
+            ...t,
+            holder,
+            // A turn left unended by a Codex that was quit is not one the Codex holding it now runs.
+            busy: holder?.at === 'terminal' && !!end?.busy && end.turnAt >= holder.since,
+            lastPrompt: end?.lastPrompt ?? null,
+            lastActivity: Math.round(Math.max(t.updatedAt, end?.mtime ?? 0)),
+        };
+    }
+    // Who holds each thread's lock, by thread id.
+    async holders() {
+        const out = await run('/usr/sbin/lsof', ['-Fpn', '+d', this.locks]).catch(() => '');
+        const held = new Map();
+        let pid = 0;
+        for (const line of out.split('\n')) {
+            if (line.startsWith('p'))
+                pid = Number(line.slice(1));
+            else if (line.startsWith('n') && line.endsWith('.lock') && pid)
+                held.set(basename(line.slice(1), '.lock'), pid);
+        }
+        if (!held.size)
+            return new Map();
+        const procs = await this.processes([...new Set(held.values())]);
+        return new Map([...held].flatMap(([id, p]) => {
+            const h = procs.get(p);
+            return h ? [[id, h]] : [];
+        }));
+    }
+    async processes(pids) {
+        const out = await run('/bin/ps', ['-E', '-ww', '-o', 'pid=,tty=,lstart=,command=', '-p', pids.join(',')]).catch(() => '');
+        const procs = new Map();
+        for (const line of out.split('\n')) {
+            const [, pid, tty, started, command] = /^\s*(\d+)\s+(\S+)\s+(\w{3}\s+\w{3}\s+\d+\s+[\d:]{8}\s+\d{4})\s(.*)$/.exec(line) ?? [];
+            if (!pid)
+                continue;
+            procs.set(Number(pid), holderOf({ pid: Number(pid), tty, since: Date.parse(started) || 0, command }, this.o.sock));
+        }
+        return procs;
+    }
+}
+// Where a process holding a thread's lock has it, by its line in ps (command with its environment after it);
+// sock is this server's app server's. since: when the process started, to the second.
+export function holderOf(p, sock) {
+    const listen = /\s--listen\s+unix:\/\/(\S+)/.exec(p.command)?.[1];
+    // Resolved when asked: the socket may not exist yet when the server starts, and /var is a link.
+    if (listen && real(listen) === real(sock))
+        return { at: 'here' };
+    if (/\sapp-server(\s|$)/.test(p.command) || /(^|\s)WORKOFFDESK_SESSION=\S/.test(p.command) || /(^|[\s/])codex\s+exec(\s|$)/.test(p.command))
+        return { at: 'elsewhere' };
+    return { at: 'terminal', pid: p.pid, tty: /^ttys?\d+$/.test(p.tty) ? p.tty : null, since: p.since };
+}
+const promptOf = (text) => [...text.replace(/\s+/g, ' ').trim()].slice(0, PROMPT_MAX).join('') || null;
+// How a rollout ends: whether its last turn is still going and when it started, and what the person said last.
+export async function rolloutEnd(path) {
+    const fh = await open(path, 'r');
+    try {
+        const { size, mtimeMs } = await fh.stat();
+        const from = Math.max(0, size - TAIL);
+        const buf = Buffer.alloc(size - from);
+        await fh.read(buf, 0, buf.length, from);
+        // A line the part read starts inside is not JSON on its own, so it is passed over below.
+        const lines = buf.toString('utf8').split('\n');
+        let busy = false;
+        let turnAt = 0;
+        let lastPrompt = null;
+        for (const line of lines) {
+            if (!line.includes('"event_msg"'))
+                continue;
+            let e;
+            let p;
+            try {
+                e = obj(JSON.parse(line));
+                p = obj(e?.payload);
+            }
+            catch {
+                continue;
+            }
+            const type = str(p?.type);
+            if (type === 'task_started') {
+                busy = true;
+                turnAt = Date.parse(str(e?.timestamp)) || 0;
+            }
+            else if (type === 'task_complete' || type === 'turn_aborted')
+                busy = false;
+            else if (type === 'item_completed' && obj(p?.item)?.type === 'UserMessage') {
+                const text = (Array.isArray(obj(p?.item)?.content) ? obj(p?.item).content : [])
+                    .map((c) => (obj(c)?.type === 'text' ? str(obj(c)?.text) : ''))
+                    .join(' ');
+                lastPrompt = promptOf(text) ?? lastPrompt;
+            }
+            // How Codex before September wrote it.
+            else if (type === 'user_message')
+                lastPrompt = promptOf(str(p?.message)) ?? lastPrompt;
+        }
+        return { busy, turnAt, lastPrompt, mtime: mtimeMs };
+    }
+    finally {
+        await fh.close();
+    }
+}

package/dist/server/agents/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/cli.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { account } from './commands/account.js';
+import { attach } from './commands/attach.js';
+import { doctor } from './commands/doctor.js';
+import { install } from './commands/install.js';
+import { openHere } from './commands/open.js';
+import { serve } from './commands/serve.js';
+import { deployCommand, restartCommand, rollbackCommand, startCommand, stopCommand } from './commands/service.js';
+import { setup } from './commands/setup.js';
+import { status } from './commands/status.js';
+import { m } from './system/messages.js';
+import { VERSION } from './system/version.js';
+// Columns a string takes in a terminal: CJK characters take two.
+const columns = (s) => [...s].reduce((n, c) => n + (/[\u1100-\u115f\u2e80-\ua4cf\uac00-\ud7a3\uf900-\ufaff\ufe30-\ufe4f\uff00-\uff60\uffe0-\uffe6]/.test(c) ? 2 : 1), 0);
+function helpText() {
+    const rows = Object.values(m.cli.help).flat();
+    const width = Math.max(...rows.map(([form]) => columns(form)));
+    return [m.cli.usage, '', ...rows.map(([form, what]) => `  ${form}${' '.repeat(width - columns(form))}  ${what}`)].join('\n');
+}
+const [cmd, ...rest] = process.argv.slice(2);
+if (cmd === '--version' || cmd === '-v') {
+    console.log(VERSION);
+    process.exit(0);
+}
+if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') {
+    console.log(helpText());
+    process.exit(0);
+}
+const commands = {
+    setup,
+    serve,
+    doctor,
+    status,
+    attach,
+    account,
+    claude: (args) => openHere('claude', args),
+    codex: (args) => openHere('codex', args),
+    install,
+    start: startCommand,
+    stop: stopCommand,
+    restart: restartCommand,
+    deploy: deployCommand,
+    rollback: rollbackCommand,
+};
+if (!Object.hasOwn(commands, cmd)) {
+    console.error(`${m.cli.unknownCommand(cmd)}\n\n${helpText()}`);
+    process.exit(1);
+}
+await commands[cmd](rest);

package/dist/server/commands/account.js

@@ -0,0 +1,61 @@
+import { askAccounts, askToMove, askToPick } from '../sessions/control.js';
+import { m } from '../system/messages.js';
+import { homeDir, socketPath } from '../system/paths.js';
+import { fail } from './common.js';
+// The account an email or folder names. An email more than one account has names none of them.
+export function findAccount(view, who, w) {
+    const byFolder = view.accounts.find((a) => a.folder === who || (a.id && a.id === who));
+    if (byFolder)
+        return byFolder.id;
+    const byEmail = view.accounts.filter((a) => a.email.toLowerCase() === who.toLowerCase());
+    if (byEmail.length > 1)
+        throw new Error(w.twoWithEmail(byEmail[0].email, byEmail.map((a) => a.folder)));
+    if (!byEmail.length)
+        throw new Error(w.noSuch(who));
+    return byEmail[0].id;
+}
+// Why an account cannot be picked, else what it used when its sessions last said; a limit past its reset is reset.
+function said(a, w, now) {
+    if (!a.signedIn)
+        return w.signedOut;
+    if (!a.ready)
+        return w.notReady;
+    if (!a.shared)
+        return w.apart;
+    const part = (l, label) => l && label(l.resetsAt !== undefined && l.resetsAt * 1000 <= now ? w.reset : `${Math.round(l.used)}%`);
+    const parts = [part(a.limits?.fiveHour, w.fiveHour), part(a.limits?.sevenDay, w.sevenDay)].filter(Boolean);
+    return parts.length ? parts.join(' · ') : w.notSeen;
+}
+// A line an account, the one in use checked; then the open sessions on another account, and those moving to it.
+export function accountLines(view, w, now = Date.now()) {
+    const emails = Math.max(...view.accounts.map((a) => a.email.length));
+    const folders = Math.max(...view.accounts.map((a) => a.folder.length));
+    const lines = view.accounts.map((a) => `${a.id === view.inUse ? '✓' : ' '} ${a.email.padEnd(emails)}  ${a.folder.padEnd(folders)}  ${said(a, w, now)}`);
+    const sessions = [view.elsewhere && w.elsewhere(view.elsewhere), view.moving && w.moving(view.moving)].filter((l) => !!l);
+    return sessions.length ? [...lines, '', ...sessions] : lines;
+}
+export async function account(args) {
+    const sock = socketPath(homeDir(), 'control.sock');
+    const w = m.account;
+    const [sub, ...rest] = args;
+    const show = (view) => console.log(accountLines(view, w).join('\n'));
+    try {
+        if (sub === undefined)
+            return show(await askAccounts(sock));
+        if (sub === '--json')
+            return console.log(JSON.stringify(await askAccounts(sock)));
+        if (sub === 'move')
+            return show(await askToMove(sock));
+        const who = rest.find((a) => !a.startsWith('--'));
+        if (sub !== 'use' || !who)
+            return fail(w.usage);
+        const view = await askToPick(sock, findAccount(await askAccounts(sock), who, w));
+        show(rest.includes('--move') ? await askToMove(sock) : view);
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === 'ENOENT' || code === 'ECONNREFUSED')
+            fail(m.cli.notRunning);
+        fail(code === 'account-none-picked' ? w.nonePicked : e.message);
+    }
+}

package/dist/server/commands/attach.js

@@ -0,0 +1,27 @@
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { idOfTmuxName, tmuxName } from '../sessions/sessionName.js';
+import { m } from '../system/messages.js';
+import { homeDir, tmuxSocketFor } from '../system/paths.js';
+import { shownTitle, Store } from '../system/store.js';
+import { Tmux } from '../system/tmux.js';
+import { ask, fail } from './common.js';
+export async function attach(args) {
+    const home = homeDir();
+    const tmux = new Tmux({ socket: tmuxSocketFor(home), conf: join(home, 'tmux.conf') });
+    const ids = (await tmux.listSessions()).flatMap((s) => idOfTmuxName(s.name) ?? []);
+    if (!ids.length)
+        fail(m.cli.noSessions);
+    let id = args[0];
+    if (!id) {
+        const meta = new Store(join(home, 'state.json')).get().sessions;
+        ids.forEach((sid, i) => {
+            const info = meta[sid];
+            console.log(`${i + 1}) ${sid}  ${info ? shownTitle(info) : ''}  ${info?.cwd ?? ''}`);
+        });
+        const pick = Number(await ask(m.cli.whichOne));
+        id = ids[pick - 1] ?? fail(m.cli.noSuchNumber);
+    }
+    const r = spawnSync(tmux.bin, tmux.attachArgs(tmuxName(id)), { stdio: 'inherit', env: tmux.env() });
+    process.exit(r.status ?? 0);
+}

package/dist/server/commands/common.js

@@ -0,0 +1,114 @@
+import { execFile, spawn } from 'node:child_process';
+import { closeSync, existsSync, openSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+import { endOp } from '../ops/lastOp.js';
+import { ACTIVATED } from '../ops/release.js';
+import { ConfigError, loadConfig, parseConfig } from '../system/config.js';
+import { m } from '../system/messages.js';
+import { originQr } from './qr.js';
+// The package's parts, from this file: src/commands/ in the source, dist/server/commands/ in a build.
+const fromHere = (path) => fileURLToPath(new URL(path, import.meta.url));
+// The package folder: dist/server/commands/common.js is three below it in a build.
+export const PACKAGE_ROOT = fromHere('../../../');
+export const WEB_DIR = fromHere('../../web');
+export const APP_UPDATE_DIR = fromHere('../../app-update/ios');
+export const ACTIVATED_FILE = fromHere(`../../../${ACTIVATED}`);
+// The CLI's entry; running from source (tsx), the built one.
+export const CLI_ENTRY = fromHere(import.meta.url.endsWith('.ts') ? '../../dist/server/cli.js' : '../cli.js');
+export const HEALTH_WAIT_MS = 30_000;
+export function flag(args, name) {
+    const i = args.indexOf(`--${name}`);
+    return i >= 0 ? args[i + 1] : undefined;
+}
+export function fail(message, code = 1) {
+    process.stderr.write(`${message}\n`);
+    process.exit(code);
+}
+const ORIGIN_EXAMPLE = 'https://workoffdesk.example.com';
+// The config setup will write: the one there is, with the origin replaced when one is given.
+// With neither, a person at a terminal is asked for it until it is one that works.
+export async function configForSetup(home, origin) {
+    const there = existsSync(join(home, 'config.json')) ? loadConfigOrFail(home) : null;
+    if (!origin && there)
+        return there;
+    if (!origin && !process.stdin.isTTY)
+        fail(m.cli.notConfigured(ORIGIN_EXAMPLE));
+    for (;;) {
+        const given = origin ?? (await ask(m.cli.askOrigin(ORIGIN_EXAMPLE))).trim();
+        try {
+            // Passkeys belong to the rpId, so it is kept unless the site moves to another address.
+            return parseConfig({ ...there, origin: given, rpId: there?.origin === given ? there.rpId : undefined });
+        }
+        catch (e) {
+            if (!(e instanceof ConfigError))
+                throw e;
+            if (origin)
+                fail(e.message);
+            console.log(e.message);
+        }
+    }
+}
+export function loadConfigOrFail(home, code = 1) {
+    try {
+        return loadConfig(home);
+    }
+    catch (e) {
+        if (e instanceof ConfigError)
+            fail(e.message, code);
+        throw e;
+    }
+}
+export async function readStdinLine() {
+    let data = '';
+    for await (const chunk of process.stdin)
+        data += chunk;
+    return data.split('\n')[0] ?? '';
+}
+export function ask(question, hidden = false) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    if (hidden) {
+        // Echo nothing after the prompt itself.
+        rl._writeToOutput = (s) => {
+            if (s.startsWith(question))
+                process.stdout.write(question);
+        };
+    }
+    return new Promise((resolve) => rl.question(question, (answer) => {
+        rl.close();
+        if (hidden)
+            process.stdout.write('\n');
+        resolve(answer);
+    }));
+}
+export function which(name) {
+    const dirs = [...(process.env.PATH ?? '').split(delimiter), '/opt/homebrew/bin', '/usr/local/bin'];
+    return dirs.map((d) => join(d, name)).find(existsSync);
+}
+export const exec = (cmd, args, o) => new Promise((done) => execFile(cmd, args, { env: o?.env }, (err, stdout, stderr) => done({ code: err ? Number(err.code) || 1 : 0, out: `${stdout}${stderr}` })));
+// The CLI this server was started by, run apart from it: it outlives the server's restart, in a process
+// group of its own, which launchd leaves alone when it stops the service.
+export function spawnOp(home, op) {
+    const out = openSync(join(home, 'logs/ops.log'), 'a', 0o600);
+    try {
+        const child = spawn(process.execPath, [process.argv[1], op, '--record'], { detached: true, stdio: ['ignore', out, out] });
+        child.unref();
+        if (!child.pid)
+            throw new Error(`could not start the ${op}`);
+        return child.pid;
+    }
+    finally {
+        closeSync(out);
+    }
+}
+// A restart or rollback a screen asked for (routes/mac.ts) says how it ended in ops.json.
+export const record = (args, home, outcome) => {
+    if (args.includes('--record'))
+        endOp(home, outcome);
+};
+export function showQr(origin) {
+    const qr = originQr(origin);
+    if (qr)
+        console.log(`\n${m.cli.scan(origin)}\n${qr}`);
+}

package/dist/server/commands/doctor.js

@@ -0,0 +1,43 @@
+import { execFile } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { resolveClaude, resolveCodex } from '../http/serve.js';
+import { formatChecks, runDoctor } from '../ops/doctor.js';
+import { loadConfig } from '../system/config.js';
+import { m } from '../system/messages.js';
+import { homeDir } from '../system/paths.js';
+import { VERSION } from '../system/version.js';
+import { showQr } from './common.js';
+export function doctorDeps(home) {
+    return {
+        platform: process.platform,
+        nodeVersion: process.versions.node,
+        home,
+        claudeBin: resolveClaude(),
+        codexBin: resolveCodex(),
+        version: VERSION,
+        launchAgents: join(homedir(), 'Library/LaunchAgents'),
+        run: (cmd, args) => new Promise((done) => execFile(cmd, args, { timeout: 10_000 }, (err, stdout) => done({ ok: !err, out: stdout }))),
+        fetch: async (url) => {
+            try {
+                const res = await fetch(url, { signal: AbortSignal.timeout(3_000) });
+                const body = res.ok ? (await res.json().catch(() => null)) : null;
+                return { ok: res.ok, version: body?.version };
+            }
+            catch {
+                return { ok: false };
+            }
+        },
+    };
+}
+export async function doctor() {
+    const home = homeDir();
+    const checks = await runDoctor(doctorDeps(home));
+    console.log(formatChecks(checks));
+    if (checks.find((c) => c.id === 'origin')?.ok)
+        showQr(loadConfig(home).origin);
+    if (checks.some((c) => !c.ok)) {
+        console.log(`\n${m.doctor.failed}`);
+        process.exit(1);
+    }
+}

package/dist/server/commands/install.js

@@ -0,0 +1,169 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { dirname, join } from 'node:path';
+import { launchEntry } from '../ops/release.js';
+import { m } from '../system/messages.js';
+import { MIN_NODE, nodeTooOld } from '../system/node.js';
+import { homeDir, writeFileAtomic } from '../system/paths.js';
+import { CLI_ENTRY, fail, flag, loadConfigOrFail, which } from './common.js';
+const xml = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+function plist(label, args, log, env = {}) {
+    const envXml = Object.entries(env)
+        .map(([k, v]) => `      <key>${xml(k)}</key>\n      <string>${xml(v)}</string>`)
+        .join('\n');
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>${xml(label)}</string>
+    <key>ProgramArguments</key>
+    <array>
+${args.map((a) => `      <string>${xml(a)}</string>`).join('\n')}
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>ThrottleInterval</key>
+    <integer>10</integer>
+    <key>ProcessType</key>
+    <string>Interactive</string>
+    <key>StandardOutPath</key>
+    <string>${xml(log)}</string>
+    <key>StandardErrorPath</key>
+    <string>${xml(log)}</string>${envXml
+        ? `
+    <key>EnvironmentVariables</key>
+    <dict>
+${envXml}
+    </dict>`
+        : ''}
+  </dict>
+</plist>
+`;
+}
+// launchd starts agents with PATH=/usr/bin:/bin:/usr/sbin:/sbin and no locale.
+export function renderServicePlist(o) {
+    const path = [dirname(o.nodePath), join(o.userHome, '.local/bin'), '/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin', '/usr/sbin', '/sbin'];
+    return plist(o.label, [o.nodePath, o.cliPath, 'serve'], join(o.home, 'logs/server.log'), {
+        PATH: path.join(':'),
+        WORKOFFDESK_HOME: o.home,
+        SHELL: o.shell,
+        LANG: 'en_US.UTF-8',
+    });
+}
+const shellQuote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+export function renderWrapper(o) {
+    return `#!/bin/sh\n# Managed by workoffdesk install.\nexport WORKOFFDESK_HOME=${shellQuote(o.home)}\nexec ${shellQuote(o.nodePath)} ${shellQuote(o.cliPath)} "$@"\n`;
+}
+export function checkNode(node) {
+    let version;
+    try {
+        version = execFileSync(node, ['-p', 'process.versions.node'], { encoding: 'utf8' }).trim();
+    }
+    catch {
+        throw new Error(m.node.doesNotRun(node));
+    }
+    if (nodeTooOld(version))
+        throw new Error(m.node.tooOld(node, version, MIN_NODE.join('.')));
+    return node;
+}
+export function renderTunnelPlist(o) {
+    return plist(o.label, [o.cloudflaredPath, 'tunnel', '--config', join(o.home, 'cloudflared.yml'), 'run'], join(o.home, 'logs/tunnel.log'));
+}
+export function renderCloudflaredYml(o) {
+    return `# Managed by workoffdesk install. The default ~/.cloudflared/config.yml is left alone.
+tunnel: ${o.tunnelId}
+credentials-file: ${o.credentialsFile}
+protocol: http2
+
+ingress:
+  - hostname: ${o.hostname}
+    service: http://127.0.0.1:${o.port}
+  - service: http_status:404
+`;
+}
+export function servicePath(userHome, label) {
+    return join(userHome, 'Library/LaunchAgents', `${label}.plist`);
+}
+// What install writes, for the CLI to print and the setup wizard to start: the service's agent, the workoffdesk
+// command, and with a tunnel its agent and config. Starts nothing.
+export function installService(o) {
+    const label = o.config.serviceLabel;
+    mkdirSync(o.agents, { recursive: true });
+    mkdirSync(o.binDir, { recursive: true });
+    mkdirSync(join(o.home, 'logs'), { recursive: true });
+    const servicePlist = join(o.agents, `${label}.plist`);
+    writeFileSync(servicePlist, renderServicePlist({ label, nodePath: o.nodePath, cliPath: o.cliPath, home: o.home, userHome: o.userHome, shell: o.shell }));
+    const wrapper = join(o.binDir, 'workoffdesk');
+    writeFileAtomic(wrapper, renderWrapper({ nodePath: o.nodePath, cliPath: o.cliPath, home: o.home }));
+    chmodSync(wrapper, 0o755);
+    const written = [wrapper, servicePlist];
+    const warnings = [!existsSync(o.cliPath) && m.cli.notBuilt(o.cliPath)];
+    let tunnelPlist;
+    if (o.tunnel) {
+        const tunnelLabel = `${label}-tunnel`;
+        const credentialsFile = join(o.userHome, '.cloudflared', `${o.tunnel.id}.json`);
+        tunnelPlist = join(o.agents, `${tunnelLabel}.plist`);
+        writeFileSync(tunnelPlist, renderTunnelPlist({ label: tunnelLabel, cloudflaredPath: o.tunnel.cloudflared, home: o.home }));
+        const yml = join(o.home, 'cloudflared.yml');
+        writeFileAtomic(yml, renderCloudflaredYml({ tunnelId: o.tunnel.id, credentialsFile, hostname: new URL(o.config.origin).hostname, port: o.config.port }));
+        written.push(tunnelPlist, yml);
+        warnings.push(!existsSync(credentialsFile) && m.cli.noCredentials(credentialsFile));
+    }
+    return { written, warnings: warnings.filter((w) => !!w), servicePlist, tunnelPlist };
+}
+function tunnelSetup(cloudflared, name) {
+    const tunnels = JSON.parse(execFileSync(cloudflared, ['tunnel', 'list', '--output', 'json'], { encoding: 'utf8' }) || '[]');
+    const tunnel = tunnels.find((t) => t.name === name);
+    if (!tunnel)
+        throw new Error(m.cli.noTunnel(name));
+    return tunnel;
+}
+// What install needs to know beyond the config: where node and the cli are, and the tunnel's id. Throws what
+// is missing.
+export function installPlan(args, home, config) {
+    const userHome = homedir();
+    const tunnelName = flag(args, 'tunnel');
+    const cloudflared = tunnelName ? (flag(args, 'cloudflared') ?? which('cloudflared')) : undefined;
+    if (tunnelName && !cloudflared)
+        throw new Error(m.cli.noCloudflared);
+    const tunnel = cloudflared && tunnelName ? tunnelSetup(cloudflared, tunnelName) : undefined;
+    const cliPath = launchEntry(CLI_ENTRY, home);
+    const nodePath = checkNode(flag(args, 'node') ?? process.execPath);
+    return {
+        home,
+        config,
+        userHome,
+        agents: flag(args, 'launch-agents-dir') ?? join(userHome, 'Library/LaunchAgents'),
+        binDir: flag(args, 'bin-dir') ?? join(userHome, '.local/bin'),
+        nodePath,
+        cliPath,
+        shell: process.env.SHELL || userInfo().shell || '/bin/zsh',
+        tunnel: tunnel && cloudflared ? { id: tunnel.id, cloudflared } : undefined,
+        tunnelName,
+    };
+}
+export function install(args) {
+    const home = homeDir();
+    const config = loadConfigOrFail(home);
+    let plan;
+    try {
+        plan = installPlan(args, home, config);
+    }
+    catch (e) {
+        fail(e.message);
+    }
+    const { written, warnings, servicePlist, tunnelPlist } = installService(plan);
+    const hostname = new URL(config.origin).hostname;
+    const frontDoor = tunnelPlist
+        ? `  cloudflared tunnel --config ${join(home, 'cloudflared.yml')} route dns ${plan.tunnelName} ${hostname}
+  launchctl bootstrap gui/$(id -u) ${servicePlist}
+  launchctl bootstrap gui/$(id -u) ${tunnelPlist}`
+        : `  launchctl bootstrap gui/$(id -u) ${servicePlist}
+
+${m.cli.frontDoor(config.port, config.origin)}`;
+    console.log(m.cli.installed({ nodePath: plan.nodePath, written, warnings, frontDoor, label: config.serviceLabel }));
+}