xaq-cli 0.0.0 → 0.1.0-nightly.72

package/dist/service-BVn3soZZ.js

@@ -0,0 +1,766 @@
+#!/usr/bin/env node
+import { n as envVar, t as LEGACY_PRODUCT } from "./brand--ZB8jTn1.js";
+import { t as Crypto } from "./crypto-fv2fj3S8.js";
+import { r as readSetupToken } from "./setup-token-CwuSzfLK.js";
+import { i as legacyDataDir, n as dataFiles } from "./config-C9XmYZWO.js";
+import { f as NPM_PACKAGE } from "./types-BhJDbSzE.js";
+import { c as runningInstance, i as cliCommand, l as serviceInstallCommand, n as assertMasterKeyUsable } from "./instance-Dj9TpJB2.js";
+import { i as loopbackUrl, t as consoleUrls } from "./urls-U_LfYV61.js";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { createServer } from "node:net";
+import { homedir, tmpdir, userInfo } from "node:os";
+import { execFileSync } from "node:child_process";
+const LAUNCHD_LABEL = "sh.xaq.daemon";
+/**
+* The service's names before the rename (agentinbox). `service install` stops and replaces a service
+* installed under them (rolling back to it on failure); `status` and `uninstall` find it too.
+*/
+const LEGACY_SERVICE_NAME = "agentinbox";
+const LEGACY_LAUNCHD_LABEL = "com.unlaboredlabs.agentinbox";
+/** The package a pre-rename service install put into `<data>/app`. */
+const LEGACY_PACKAGE = "agentinbox-cli";
+const DAEMON_UNIT = {
+	launchd: LAUNCHD_LABEL,
+	systemd: "xaq"
+};
+const LEGACY_DAEMON_UNIT = {
+	launchd: LEGACY_LAUNCHD_LABEL,
+	systemd: LEGACY_SERVICE_NAME
+};
+const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+/** Package root: one level above the running module (dist/cli.js or server/service.ts). */
+const ROOT = resolve(import.meta.dirname, "..");
+/**
+* Settings that come from the environment rather than flags. They are kept in `<data>/service.env`
+* (mode 0600) so re-running `service install` from a shell without them (the documented update
+* path) keeps them. Set one to an empty value to drop it.
+*/
+const SERVICE_ENV_KEYS = [
+	"XAQ_MASTER_KEY",
+	"TRUST_PROXY",
+	"TRUST_PROXY_HOPS",
+	"TRUST_PROXY_FROM",
+	"XAQ_LOG_LEVEL"
+];
+/** Their names before the rename: still read from the shell and from a service.env an older install wrote. */
+const LEGACY_ENV_KEYS = {
+	XAQ_MASTER_KEY: "AGENTINBOX_MASTER_KEY",
+	XAQ_LOG_LEVEL: "AGENTINBOX_LOG_LEVEL"
+};
+const serviceEnvPath = (dataDir) => join(dataDir, "service.env");
+/** Plain variables written into the unit/plist. Secrets never go into the systemd unit. */
+function plainEnv(spec) {
+	return {
+		XAQ_DATA: spec.dataDir,
+		PORT: String(spec.port),
+		HOST: spec.host,
+		XAQ_SERVICE: "1"
+	};
+}
+/** systemd word quoting for ExecStart/Environment: double quotes, escaped backslashes, quotes and specifiers. */
+const sdQuote = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/%/g, "%%")}"`;
+/**
+* The systemd unit. Everything from service.env (including XAQ_MASTER_KEY) is loaded with
+* EnvironmentFile=, so the world-readable unit holds no secrets. EnvironmentFile takes an
+* unquoted absolute path (systemd ignores quoted ones), which is why data dirs with whitespace are refused.
+*/
+function renderSystemdUnit(spec) {
+	const vars = Object.entries(plainEnv(spec)).map(([k, v]) => `Environment=${sdQuote(`${k}=${v}`)}`).join("\n");
+	const envFile = Object.keys(spec.extraEnv).length ? `\nEnvironmentFile=${serviceEnvPath(spec.dataDir).replace(/%/g, "%%")}` : "";
+	return `[Unit]
+Description=xaq (MCP broker for AI agents)${spec.system ? "\nAfter=network-online.target\nWants=network-online.target" : ""}
+
+[Service]
+ExecStart=${sdQuote(spec.execPath)} ${sdQuote(spec.entry)} start --no-open
+${vars}${envFile}
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=20
+
+[Install]
+WantedBy=${spec.system ? "multi-user.target" : "default.target"}
+`;
+}
+/** The launchd plist. Written with mode 0600, since it may carry XAQ_MASTER_KEY. */
+/** Escapes text for a plist <string>. */
+const xmlEscape = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function renderLaunchdPlist(spec) {
+	const esc = xmlEscape;
+	const vars = Object.entries({
+		...plainEnv(spec),
+		...spec.extraEnv
+	}).map(([k, v]) => `    <key>${esc(k)}</key><string>${esc(v)}</string>`).join("\n");
+	const log = esc(dataFiles(spec.dataDir).log);
+	return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${esc(spec.execPath)}</string>
+    <string>${esc(spec.entry)}</string>
+    <string>start</string>
+    <string>--no-open</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+${vars}
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${log}</string>
+  <key>StandardErrorPath</key><string>${log}</string>
+</dict>
+</plist>
+`;
+}
+/** Parses service.env (KEY=value lines). */
+function parseEnvFile(text) {
+	const out = {};
+	for (const line of text.split("\n")) {
+		const m = /^\s*([A-Z_][A-Z0-9_]*)=(.*)$/.exec(line);
+		if (m) out[m[1]] = m[2].trim();
+	}
+	return out;
+}
+/**
+* The service's env-derived settings: the current shell wins, previous install fills the gaps,
+* an explicitly empty value removes the setting. The pre-rename names (AGENTINBOX_MASTER_KEY…) count
+* where the new one isn't given, and are written back under the new name.
+*/
+function mergeServiceEnv(previous, current) {
+	const out = {};
+	for (const key of SERVICE_ENV_KEYS) {
+		const old = LEGACY_ENV_KEYS[key];
+		const value = key in current ? current[key] : old && old in current ? current[old] : previous[key] ?? (old ? previous[old] : void 0);
+		if (value) out[key] = key === "TRUST_PROXY_FROM" ? value.split(/[\s,]+/).filter(Boolean).join(",") : value;
+	}
+	return out;
+}
+/** Fails early (before anything is touched) when the master key can't work. */
+function validateMasterKey(value) {
+	if (!value) return;
+	try {
+		if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value.trim())) throw new Error("not base64");
+		new Crypto(Buffer.from(value, "base64"));
+	} catch {
+		throw new Error("XAQ_MASTER_KEY must be 32 random bytes in base64 (e.g. `openssl rand -base64 32`).");
+	}
+}
+function readPreviousEnv(dataDir) {
+	try {
+		return parseEnvFile(readFileSync(serviceEnvPath(dataDir), "utf8"));
+	} catch {
+		return {};
+	}
+}
+function writeServiceEnv(dataDir, env) {
+	const file = serviceEnvPath(dataDir);
+	if (!Object.keys(env).length) {
+		rmSync(file, { force: true });
+		return;
+	}
+	for (const [k, v] of Object.entries(env)) if (/[\r\n]/.test(v)) throw new Error(`${k} must be a single line.`);
+	writeFileSync(file, serviceEnvText(env), { mode: 384 });
+}
+/**
+* service.env's content. For one release, XAQ_MASTER_KEY and XAQ_LOG_LEVEL are also written under their
+* pre-rename names, so going back to agentinbox-cli by hand (its `service install` reads only those)
+* still finds the key and starts.
+*/
+function serviceEnvText(env) {
+	const lines = Object.entries(env).map(([k, v]) => `${k}=${v}\n`);
+	for (const [key, old] of Object.entries(LEGACY_ENV_KEYS)) {
+		const value = env[key];
+		if (value && old) lines.push(`${old}=${value}\n`);
+	}
+	return lines.join("");
+}
+/**
+* Installs the package into `staging` (a fresh private npm prefix), so a failed npm install leaves the
+* current install untouched. From an installed package that is the latest release; from a source
+* checkout, the local build. Returns `staging`. The one install path for the daemon and the listeners.
+*/
+function stagePackage(staging, opts) {
+	const fromSource = basename(dirname(ROOT)) !== "node_modules";
+	let spec = `${NPM_PACKAGE}@latest`;
+	let tmp;
+	if (fromSource) {
+		if (!existsSync(join(ROOT, "dist/cli.js")) || opts.requireWeb && !existsSync(join(ROOT, "dist/web/index.html"))) throw new Error("Run `pnpm build` before installing the service from a source checkout.");
+		tmp = mkdtempSync(join(tmpdir(), "xaq-pack-"));
+		const out = execFileSync(npm, [
+			"pack",
+			"--ignore-scripts",
+			"--pack-destination",
+			tmp,
+			"--loglevel=error"
+		], {
+			cwd: ROOT,
+			encoding: "utf8"
+		});
+		spec = join(tmp, out.trim().split("\n").pop());
+	}
+	console.log(fromSource ? `  Installing this build into ${opts.where}…` : `  Installing the latest release into ${opts.where}…`);
+	rmSync(staging, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(staging, { recursive: true });
+	writeFileSync(join(staging, "package.json"), "{ \"private\": true }\n");
+	try {
+		execFileSync(npm, [
+			"install",
+			spec,
+			"--omit=dev",
+			"--prefer-online",
+			"--no-audit",
+			"--no-fund",
+			"--loglevel=error"
+		], {
+			cwd: staging,
+			stdio: "inherit"
+		});
+		if (!existsSync(installedEntry(staging))) throw new Error("the installed package has no dist/cli.js");
+	} catch (err) {
+		rmSync(staging, {
+			recursive: true,
+			force: true
+		});
+		throw new Error(`Installing xaq failed, so the existing service was left as it was. ${err instanceof Error ? err.message : ""}`.trim());
+	} finally {
+		if (tmp) rmSync(tmp, {
+			recursive: true,
+			force: true
+		});
+	}
+	return staging;
+}
+/** The CLI entry inside an install made by stagePackage. */
+const installedEntry = (app) => join(app, "node_modules", NPM_PACKAGE, "dist/cli.js");
+/** Installs into `<dir>/app.new` (see stagePackage). Returns the staging directory. */
+const stageApp = (dir) => stagePackage(join(dir, "app.new"), {
+	where: "the data directory",
+	requireWeb: true
+});
+/**
+* Moves a staged install into place as `app` (the current one becomes `app.old`). `restore()` puts
+* the previous install back; `commit()` deletes it. If the move itself fails, nothing changes.
+*/
+function swapIn(staging, app) {
+	const old = `${app}.old`;
+	rmSync(old, {
+		recursive: true,
+		force: true
+	});
+	if (existsSync(app)) renameSync(app, old);
+	try {
+		renameSync(staging, app);
+	} catch (err) {
+		if (existsSync(old)) renameSync(old, app);
+		throw err;
+	}
+	return {
+		restore() {
+			rmSync(app, {
+				recursive: true,
+				force: true
+			});
+			if (existsSync(old)) renameSync(old, app);
+		},
+		commit() {
+			rmSync(old, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+}
+/** Deletes `<dir>/app`, `app.new` and `app.old`, but only where they really are our own installs (xaq-cli, or agentinbox-cli from before the rename). */
+function removeOwnInstall(dir) {
+	for (const name of [
+		"app",
+		"app.new",
+		"app.old"
+	]) {
+		const path = join(dir, name);
+		if (["xaq-cli", "agentinbox-cli"].some((p) => existsSync(join(path, "node_modules", p)))) rmSync(path, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+const systemOps = () => {
+	const root = process.getuid?.() === 0;
+	const ops = {
+		platform: process.platform,
+		root,
+		exec: (cmd, args, opts) => void execFileSync(cmd, args, { stdio: opts?.quiet ? "ignore" : "inherit" }),
+		capture: (cmd, args) => execFileSync(cmd, args, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		}),
+		stage: stageApp,
+		unitDir: () => {
+			if (process.platform === "darwin") return join(homedir(), "Library/LaunchAgents");
+			if (root) return "/etc/systemd/system";
+			unitDirCache ??= join(userManagerConfigHome(ops) ?? join(homedir(), ".config"), "systemd/user");
+			return unitDirCache;
+		},
+		waitReady: waitForHealth,
+		instance: runningInstance,
+		portInUse,
+		uid: process.getuid?.() ?? 0,
+		user: userInfo().username
+	};
+	let unitDirCache;
+	return ops;
+};
+/**
+* XDG_CONFIG_HOME as the systemd user manager sees it (where `systemctl --user` looks for units),
+* which can differ from this shell's. Null when unset there or the manager can't be asked.
+*/
+function userManagerConfigHome(ops) {
+	try {
+		const env = ops.capture("systemctl", ["--user", "show-environment"]);
+		return /^XDG_CONFIG_HOME=(.+)$/m.exec(env)?.[1]?.trim() || null;
+	} catch {
+		return null;
+	}
+}
+/** The unit file (systemd) or plist (launchd) for a service's names. */
+const unitPath = (ops, id) => join(ops.unitDir(), ops.platform === "darwin" ? `${id.launchd}.plist` : `${id.systemd}.service`);
+const unitFile = (ops) => unitPath(ops, DAEMON_UNIT);
+const unitLabel = (ops, id) => ops.platform === "darwin" ? id.launchd : id.systemd;
+const systemctl = (ops, ...args) => ops.exec("systemctl", ops.root ? args : ["--user", ...args]);
+const launchdTarget = (ops) => `gui/${ops.uid}`;
+function assertSupported(ops) {
+	if (ops.platform !== "linux" && ops.platform !== "darwin") throw new Error(`Service install supports Linux (systemd) and macOS (launchd). Elsewhere, install the command (\`npm i -g ${NPM_PACKAGE}\`) and run \`xaq start\` under your own supervisor.`);
+}
+const readText = (file) => {
+	try {
+		return readFileSync(file, "utf8");
+	} catch {
+		return null;
+	}
+};
+/** Where to look when the service doesn't start. */
+function serviceHints(ops, env = process.env, id = DAEMON_UNIT) {
+	if (ops.platform === "darwin") return [`launchctl print ${launchdTarget(ops)}/${id.launchd}`, "and the log file xaq.log (agentinbox.log from before the rename) in the data directory"];
+	const scope = ops.root ? "" : " --user";
+	const hints = [`systemctl${scope} status ${id.systemd}`, `journalctl${scope} -u ${id.systemd} -e`];
+	if (!ops.root && !env.XDG_RUNTIME_DIR) hints.push(`XDG_RUNTIME_DIR is not set, so there may be no systemd user session (common over \`su\` or \`sudo -u\`). Log in as ${ops.user} directly (e.g. over ssh), or run \`sudo loginctl enable-linger ${ops.user}\` and then \`export XDG_RUNTIME_DIR=/run/user/${ops.uid}\` before installing.`);
+	return hints;
+}
+const firstLine = (err) => (err instanceof Error ? err.message : String(err)).split("\n")[0];
+/** First line of a failed command's stderr (what launchctl / systemctl said), else of the error. */
+const commandFailure = (err) => {
+	return (String(err?.stderr ?? "").trim() || (err instanceof Error ? err.message : String(err))).split("\n")[0];
+};
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Whether launchd has a job with this label loaded (any `launchctl print` failure counts as not loaded). */
+function launchdLoaded(ops, label) {
+	try {
+		ops.capture("launchctl", ["print", `${launchdTarget(ops)}/${label}`]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Loads the launchd job in `file`, replacing a loaded job with the same label. `launchctl bootout` returns
+* before the old job is torn down (launchd gives it up to 20 s to exit), and `bootstrap` of that label fails
+* with "5: Input/output error" until it is. So: boot it out, wait until `launchctl print` no longer finds it,
+* then bootstrap; on failure, retry with growing delays. Throws launchd's reason when every attempt failed.
+*/
+async function bootstrapLaunchd(ops, label, file, opts = {}) {
+	const { attempts = 5, pollMs = 250, unloadTimeoutMs = 3e4 } = opts;
+	let last = null;
+	const deadline = Date.now() + unloadTimeoutMs;
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		try {
+			ops.exec("launchctl", ["bootout", `${launchdTarget(ops)}/${label}`], { quiet: true });
+		} catch {}
+		await waitUnloaded(ops, label, deadline, pollMs);
+		try {
+			ops.capture("launchctl", [
+				"bootstrap",
+				launchdTarget(ops),
+				file
+			]);
+			return;
+		} catch (err) {
+			last = err;
+			if (attempt < attempts) await sleep(pollMs * 4 * Math.min(2 ** (attempt - 1), 4));
+		}
+	}
+	const stillLoaded = launchdLoaded(ops, label);
+	throw new Error(`launchctl bootstrap failed: ${commandFailure(last)}${stillLoaded ? ` (a job labelled ${label} is still loaded and wouldn't unload)` : ""}`);
+}
+/** Polls `launchctl print` until launchd no longer lists the label, or the deadline passes. */
+async function waitUnloaded(ops, label, deadline, pollMs) {
+	while (launchdLoaded(ops, label) && Date.now() < deadline) await sleep(pollMs);
+}
+function unitState(ops, id) {
+	if (ops.platform === "darwin") return {
+		running: launchdLoaded(ops, id.launchd),
+		enabled: false
+	};
+	const ask = (verb) => {
+		try {
+			return ops.capture("systemctl", [
+				...ops.root ? [] : ["--user"],
+				verb,
+				id.systemd
+			]).trim();
+		} catch (err) {
+			return String(err?.stdout ?? "").trim();
+		}
+	};
+	const active = ask("is-active");
+	return {
+		running: active === "active" || active === "activating" || active === "reloading",
+		enabled: ask("is-enabled") === "enabled"
+	};
+}
+/**
+* Stops a service and waits until it is really gone, so a replacement never runs next to it (they would
+* fight over the port and the data directory). systemd's stop waits by itself; launchd's bootout returns
+* at once and tears the job down asynchronously. Throws when it is still running afterwards.
+*/
+async function stopAndWait(ops, id, opts = {}) {
+	const { pollMs = 250, unloadTimeoutMs = 3e4 } = opts;
+	if (ops.platform === "darwin") {
+		try {
+			ops.exec("launchctl", ["bootout", `${launchdTarget(ops)}/${id.launchd}`], { quiet: true });
+		} catch {}
+		await waitUnloaded(ops, id.launchd, Date.now() + unloadTimeoutMs, pollMs);
+		if (launchdLoaded(ops, id.launchd)) throw new Error(`launchd still has ${id.launchd} loaded after booting it out`);
+		return;
+	}
+	try {
+		systemctl(ops, "disable", "--now", id.systemd);
+	} catch {}
+	if (unitState(ops, id).running) throw new Error(`systemd still reports ${id.systemd} running after stopping it`);
+}
+/** Puts a stopped service's unit file back and returns it to the state it was in (see unitState). */
+async function restoreUnit(ops, id, file, text, state, pollMs) {
+	writeFileSync(file, text, { mode: ops.platform === "darwin" ? 384 : 420 });
+	if (ops.platform === "linux") {
+		systemctl(ops, "daemon-reload");
+		if (state.enabled) systemctl(ops, "enable", id.systemd);
+		if (state.running) systemctl(ops, "start", id.systemd);
+	} else if (state.running) await bootstrapLaunchd(ops, id.launchd, file, { pollMs });
+}
+/** Fails before anything is touched when systemd can't be reached (e.g. no user bus over su). */
+function preflight(ops) {
+	if (ops.platform !== "linux") return;
+	try {
+		systemctl(ops, "daemon-reload");
+	} catch (err) {
+		const hints = serviceHints(ops).map((h) => `    ${h}`).join("\n");
+		throw new Error(`Can't talk to systemd${ops.root ? "" : " (user session)"}: ${firstLine(err)}. Nothing was changed.\n${hints}`);
+	}
+}
+/** Whether host:port can't be bound because something already listens there. */
+function portInUse(host, port) {
+	if (!port) return Promise.resolve(false);
+	return new Promise((done) => {
+		const probe = createServer();
+		probe.once("error", (err) => done(err.code === "EADDRINUSE"));
+		probe.listen({
+			host,
+			port,
+			exclusive: true
+		}, () => probe.close(() => done(false)));
+	});
+}
+/**
+* The service manager's main pid for a service (default: the xaq daemon; the listener passes its
+* own label and unit); null when it isn't running or can't be asked.
+*/
+function serviceMainPid(ops, id = DAEMON_UNIT) {
+	try {
+		const out = ops.platform === "darwin" ? /^\s*pid = (\d+)/m.exec(ops.capture("launchctl", ["print", `${launchdTarget(ops)}/${id.launchd}`]))?.[1] ?? "" : ops.capture("systemctl", [
+			...ops.root ? [] : ["--user"],
+			"show",
+			"-p",
+			"MainPID",
+			"--value",
+			id.systemd
+		]).trim();
+		const pid = Number(out);
+		return Number.isInteger(pid) && pid > 0 ? pid : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Refuses (before anything is touched) while xaq already runs outside the service: in a
+* terminal on this data directory (its instance lock), or anything on the port while the service
+* isn't running. The service could only fail to start, and the health check would hear the other one.
+* A lock holder is the service when its lock says so, or (early nightlies didn't write that flag)
+* when, with a unit installed, it is the service manager's main process. `units` are the installed
+* services (the new one and/or one from before the rename).
+*/
+async function assertNothingElseRunning(config, ops, unitInstalled, units = [DAEMON_UNIT]) {
+	const other = ops.instance(config.dataDir);
+	const pids = unitInstalled ? units.map((id) => serviceMainPid(ops, id)).filter((p) => p !== null) : [];
+	if (other && !other.service && !pids.includes(other.pid)) throw new Error(`xaq is already running in a terminal (pid ${other.pid}${other.port ? `, port ${other.port}` : ""}): stop it with Ctrl-C, then run this again. The service uses the same data directory (${config.dataDir}), and only one xaq can use it at a time. Nothing was changed.`);
+	if (!other && !pids.length && await ops.portInUse(config.host, config.port)) throw new Error(`Port ${config.port} is already in use: by xaq (or agentinbox) running in a terminal with another --data directory, or by another program. Stop it (Ctrl-C in its terminal), or choose another port with --port. Nothing was changed.`);
+}
+/**
+* After the health check answered: whether the data directory's lock holder is the new service's own
+* process. It must be the service manager's main process (or, when that pid is unknown, say in its lock
+* that it is the service), and not the process that held the lock before the install. This checks the
+* lock holder, not who answered: xaq binds its port before taking the lock and exits when the
+* port is taken, so a service that holds the lock is the one listening. Null when it is; else why not.
+*/
+function notTheService(owner, before, mainPid) {
+	if (!owner) return "no xaq holds the data directory";
+	const same = before && owner.pid === before.pid && owner.startedAt === before.startedAt;
+	const isService = mainPid !== null ? owner.pid === mainPid : !!owner.service;
+	if (same || !isService) return `the xaq holding the data directory (pid ${owner.pid}) is not the service${mainPid ? ` (pid ${mainPid})` : ""}`;
+	return null;
+}
+/**
+* A daemon service installed under the names from before the rename (agentinbox), if any: its unit file,
+* the file's content, and the data directory it runs on.
+*/
+function legacyDaemonUnit(ops) {
+	if (ops.platform !== "linux" && ops.platform !== "darwin") return null;
+	const file = unitPath(ops, LEGACY_DAEMON_UNIT);
+	const text = readText(file);
+	if (text === null) return null;
+	const rawPort = unitEnv(text, "PORT");
+	const port = rawPort && /^\d+$/.test(rawPort) && Number(rawPort) <= 65535 ? Number(rawPort) : null;
+	return {
+		file,
+		text,
+		dataDir: unitDataDir(text),
+		port,
+		host: unitEnv(text, "HOST") || null
+	};
+}
+/**
+* Where `service install` puts the service when the command line and environment don't say: replacing a
+* service from before the rename keeps its data directory, port and host (a bind to 127.0.0.1 must not
+* widen to 0.0.0.0 on upgrade). A service already moved keeps ~/.agentinbox too, even if a ~/.xaq has
+* appeared since. `given` is what the flags (and PORT / HOST / XAQ_DATA) said.
+*/
+function serviceInstallInput(given, ops, env = process.env) {
+	const legacy = legacyDaemonUnit(ops);
+	const installed = installedDaemonDataDir(ops);
+	return {
+		dataDir: given.dataDir ?? (envVar("DATA", env) || void 0) ?? legacy?.dataDir ?? (installed && installed === legacyDataDir() ? installed : void 0) ?? void 0,
+		port: given.port ?? (env.PORT?.trim() ? void 0 : legacy?.port ?? void 0),
+		host: given.host ?? (env.HOST ? void 0 : legacy?.host ?? void 0)
+	};
+}
+/** The data directory the installed (xaq) daemon service runs on, if one is installed and says. */
+function installedDaemonDataDir(ops) {
+	if (ops.platform !== "linux" && ops.platform !== "darwin") return null;
+	const text = readText(unitPath(ops, DAEMON_UNIT));
+	return text === null ? null : unitDataDir(text);
+}
+async function installService(config, ops = systemOps(), opts = {}) {
+	assertSupported(ops);
+	if (ops.platform === "linux" && /\s/.test(config.dataDir)) throw new Error(`The data directory "${config.dataDir}" contains whitespace, which systemd can't load settings from. Choose another one with --data.`);
+	const extraEnv = mergeServiceEnv(readPreviousEnv(config.dataDir), process.env);
+	validateMasterKey(extraEnv.XAQ_MASTER_KEY);
+	assertMasterKeyUsable(config, extraEnv.XAQ_MASTER_KEY ?? "");
+	preflight(ops);
+	const file = unitFile(ops);
+	const previousUnit = readText(file);
+	const legacy = legacyDaemonUnit(ops);
+	const legacyState = legacy ? unitState(ops, LEGACY_DAEMON_UNIT) : null;
+	await assertNothingElseRunning(config, ops, previousUnit !== null || legacy !== null, [DAEMON_UNIT, ...legacy ? [LEGACY_DAEMON_UNIT] : []]);
+	const before = ops.instance(config.dataDir);
+	mkdirSync(config.dataDir, {
+		recursive: true,
+		mode: 448
+	});
+	const staging = ops.stage(config.dataDir);
+	const previousEnv = readText(serviceEnvPath(config.dataDir));
+	const app = join(config.dataDir, "app");
+	const entry = installedEntry(app);
+	const spec = {
+		execPath: process.execPath,
+		entry,
+		dataDir: config.dataDir,
+		port: config.port,
+		host: config.host,
+		extraEnv,
+		system: ops.root
+	};
+	let swap = null;
+	try {
+		if (legacy) {
+			console.log(`  Replacing the ${LEGACY_PRODUCT} service (${unitLabel(ops, LEGACY_DAEMON_UNIT)}) with ${unitLabel(ops, DAEMON_UNIT)}…`);
+			await stopAndWait(ops, LEGACY_DAEMON_UNIT, { pollMs: opts.launchdPollMs });
+			rmSync(legacy.file, { force: true });
+			if (ops.platform === "linux") systemctl(ops, "daemon-reload");
+		}
+		uninstallService(config, ops, {
+			quiet: true,
+			keepApp: true
+		});
+		swap = swapIn(staging, app);
+		writeServiceEnv(config.dataDir, extraEnv);
+		mkdirSync(ops.unitDir(), { recursive: true });
+		if (ops.platform === "linux") {
+			writeFileSync(file, renderSystemdUnit(spec));
+			systemctl(ops, "daemon-reload");
+			systemctl(ops, "enable", "--now", "xaq");
+		} else {
+			writeFileSync(file, renderLaunchdPlist(spec), { mode: 384 });
+			await bootstrapLaunchd(ops, LAUNCHD_LABEL, file, { pollMs: opts.launchdPollMs });
+		}
+		if (!await ops.waitReady(config)) throw new Error(`it did not answer on port ${config.port}`);
+		const wrong = notTheService(ops.instance(config.dataDir), before, serviceMainPid(ops));
+		if (wrong) throw new Error(wrong);
+	} catch (err) {
+		await rollback();
+		const hints = serviceHints(ops, process.env, legacy && previousUnit === null ? LEGACY_DAEMON_UNIT : DAEMON_UNIT).map((h) => `    ${h}`).join("\n");
+		const restored = legacy ? `the ${LEGACY_PRODUCT} service as it was` : previousUnit ? "the previous install" : "no service";
+		throw new Error(`Starting the service failed (${firstLine(err)}). Rolled back to ${restored}.\n  To find out why:\n${hints}`);
+	}
+	swap.commit();
+	async function rollback() {
+		const quietly = async (fn) => {
+			try {
+				await fn();
+			} catch {}
+		};
+		if (legacy) await quietly(() => stopAndWait(ops, DAEMON_UNIT, { pollMs: opts.launchdPollMs }));
+		await quietly(() => uninstallService(config, ops, {
+			quiet: true,
+			keepApp: true
+		}));
+		await quietly(() => rmSync(file, { force: true }));
+		if (ops.platform === "linux") await quietly(() => systemctl(ops, "daemon-reload"));
+		await quietly(() => rmSync(staging, {
+			recursive: true,
+			force: true
+		}));
+		if (swap) await quietly(() => swap.restore());
+		await quietly(() => previousEnv === null ? rmSync(serviceEnvPath(config.dataDir), { force: true }) : writeFileSync(serviceEnvPath(config.dataDir), previousEnv, { mode: 384 }));
+		if (previousUnit !== null) await quietly(async () => {
+			writeFileSync(file, previousUnit, { mode: ops.platform === "darwin" ? 384 : 420 });
+			if (ops.platform === "linux") {
+				systemctl(ops, "daemon-reload");
+				systemctl(ops, "enable", "--now", "xaq");
+			} else await bootstrapLaunchd(ops, LAUNCHD_LABEL, file, { pollMs: opts.launchdPollMs });
+		});
+		if (legacy) await quietly(() => restoreUnit(ops, LEGACY_DAEMON_UNIT, legacy.file, legacy.text, legacyState, opts.launchdPollMs));
+	}
+	enableLinger(ops);
+	const fromShell = (k) => k in process.env || (LEGACY_ENV_KEYS[k] ?? k) in process.env;
+	const kept = Object.keys(extraEnv).filter((k) => !fromShell(k));
+	console.log(`\n  Installed xaq as a ${ops.platform === "linux" ? "systemd" : "launchd"} service (${unitLabel(ops, DAEMON_UNIT)}).`);
+	if (legacy) console.log(`  It replaces the ${LEGACY_PRODUCT} service (${unitLabel(ops, LEGACY_DAEMON_UNIT)}), which was removed. Your data stays in ${config.dataDir}.`);
+	console.log(`  It runs the Node.js at ${process.execPath} (v${process.versions.node}). If you remove or replace that Node, run \`${serviceInstallCommand(config)}\` again.`);
+	if (kept.length) console.log(`  Kept ${kept.join(", ")} from the previous install.`);
+	printLinks(config);
+}
+/** Keeps user services running after logout and starts them at boot (systemd user units only). */
+function enableLinger(ops) {
+	if (ops.platform !== "linux" || ops.root) return;
+	try {
+		ops.exec("loginctl", ["enable-linger", ops.user], { quiet: true });
+	} catch {
+		console.warn(`  Could not enable lingering. Run \`sudo loginctl enable-linger ${ops.user}\` so the service starts at boot.`);
+	}
+}
+/** XAQ_DATA (AGENTINBOX_DATA in a unit from before the rename) from an installed unit or plist. */
+function unitDataDir(text) {
+	return unitEnv(text, "XAQ_DATA") ?? unitEnv(text, "AGENTINBOX_DATA");
+}
+/** An environment variable a unit (`Environment="K=v"`) or plist (`<key>K</key><string>v</string>`) sets. */
+function unitEnv(text, name) {
+	const systemd = new RegExp(`^Environment="${name}=((?:[^"\\\\]|\\\\.)*)"`, "m").exec(text);
+	if (systemd) return systemd[1].replace(/\\(.)/g, "$1").replace(/%%/g, "%");
+	const plist = new RegExp(`<key>${name}</key><string>([^<]*)</string>`).exec(text);
+	if (plist) return plist[1].replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+	return null;
+}
+/**
+* Stops and removes the service, under its own name or the one from before the rename. The data
+* directory is the one the installed unit uses (falling back to `config.dataDir`), and only directories
+* that really are the service's own install are deleted; nothing is created.
+*/
+function uninstallService(config, ops = systemOps(), opts = {}) {
+	assertSupported(ops);
+	const units = [DAEMON_UNIT, LEGACY_DAEMON_UNIT].map((id) => ({
+		id,
+		file: unitPath(ops, id),
+		text: readText(unitPath(ops, id))
+	})).filter((u) => u.text !== null);
+	const dataDir = units.map((u) => unitDataDir(u.text)).find(Boolean) || config.dataDir;
+	if (!units.length && !opts.quiet) console.log("The xaq service is not installed.");
+	for (const u of units) {
+		if (ops.platform === "linux") {
+			try {
+				systemctl(ops, "disable", "--now", u.id.systemd);
+			} catch {}
+			rmSync(u.file);
+			systemctl(ops, "daemon-reload");
+		} else {
+			try {
+				ops.exec("launchctl", ["bootout", `${launchdTarget(ops)}/${u.id.launchd}`], { quiet: true });
+			} catch {}
+			rmSync(u.file);
+		}
+		if (!opts.quiet) console.log(`Removed the ${unitLabel(ops, u.id)} service. Your data in ${dataDir} was kept.`);
+	}
+	if (!opts.keepApp) removeOwnInstall(dataDir);
+}
+function serviceStatus(ops = systemOps()) {
+	assertSupported(ops);
+	const id = existsSync(unitFile(ops)) ? DAEMON_UNIT : existsSync(unitPath(ops, LEGACY_DAEMON_UNIT)) ? LEGACY_DAEMON_UNIT : null;
+	if (!id) {
+		console.log(`The xaq service is not installed. Install it with \`${cliCommand("service install")}\`.`);
+		process.exitCode = 1;
+		return;
+	}
+	if (id === LEGACY_DAEMON_UNIT) console.log(`This is the service from before the rename to xaq (${unitLabel(ops, id)}). \`${cliCommand("service install")}\` moves it to ${unitLabel(ops, DAEMON_UNIT)}, keeping your data.\n`);
+	try {
+		if (ops.platform === "linux") systemctl(ops, "status", id.systemd, "--no-pager");
+		else ops.exec("launchctl", ["print", `${launchdTarget(ops)}/${id.launchd}`]);
+	} catch {
+		process.exitCode = 1;
+	}
+}
+/** A real HealthResponse (not the "starting" placeholder or something else on the port). */
+function isHealthResponse(body) {
+	const b = body;
+	return !!b && (b.status === "ok" || b.status === "degraded") && typeof b.version === "string";
+}
+/** Polls /api/health for up to ~45 s. 503 with a HealthResponse means "up but degraded", which is up. */
+async function waitForHealth(config) {
+	const base = loopbackUrl(config.host, config.port);
+	for (let i = 0; i < 90; i++) {
+		try {
+			const res = await fetch(`${base}/api/health`, { signal: AbortSignal.timeout(1e3) });
+			if ((res.status === 200 || res.status === 503) && isHealthResponse(await res.json().catch(() => null))) return true;
+		} catch {}
+		await new Promise((r) => setTimeout(r, 500));
+	}
+	return false;
+}
+function printLinks(config) {
+	const token = readSetupToken(config.dataDir);
+	console.log(`  Running at:\n`);
+	for (const url of consoleUrls(config.host, config.port)) console.log(`    ${url}${token ? `/setup?token=${token}` : ""}`);
+	if (token) console.log(`\n  Open the link above to claim the instance and finish setup.`);
+	console.log();
+}
+//#endregion
+export { serviceEnvPath as A, systemOps as B, preflight as C, renderSystemdUnit as D, renderLaunchdPlist as E, serviceStatus as F, unitPath as G, uninstallService as H, stageApp as I, validateMasterKey as J, unitState as K, stagePackage as L, serviceHints as M, serviceInstallInput as N, restoreUnit as O, serviceMainPid as P, stopAndWait as R, parseEnvFile as S, removeOwnInstall as T, unitDataDir as U, systemctl as V, unitEnv as W, xmlEscape as Y, launchdLoaded as _, LEGACY_PACKAGE as a, mergeServiceEnv as b, assertNothingElseRunning as c, commandFailure as d, enableLinger as f, isHealthResponse as g, installedEntry as h, LEGACY_LAUNCHD_LABEL as i, serviceEnvText as j, sdQuote as k, assertSupported as l, installedDaemonDataDir as m, LAUNCHD_LABEL as n, LEGACY_SERVICE_NAME as o, installService as p, userManagerConfigHome as q, LEGACY_DAEMON_UNIT as r, SERVICE_ENV_KEYS as s, DAEMON_UNIT as t, bootstrapLaunchd as u, launchdTarget as v, readText as w, notTheService as x, legacyDaemonUnit as y, swapIn as z };
+
+//# sourceMappingURL=service-BVn3soZZ.js.map