feat: agent service improvements, Docker publishing, platform-aware CLI

Service fixes:
- Fix macOS status detection: use launchctl print instead of launchctl list
  which can't see system daemons without root
- Fix empty server URL in plist during launchd throttle recovery
- Service data lives in /var/lib/plow-agent/ instead of user home dir
- Credentials copied from user config to service dir during install
- Always re-register on startup (idempotent) to handle server rebuilds
- Log to stderr so daemon logs appear in /var/log/plow-agent.err.log

CLI improvements:
- --service logs: tails the right log source per platform
- --service status: shows platform, data dir, status, and all commands
- Wizard and help messages are platform-aware (macOS/Linux/Windows)
- sudo auto-elevation for service install/uninstall/start/stop

Docker:
- CI workflow now builds and pushes to ghcr.io/jackharrhy/plow-agent
- Added compose.yml for easy volunteer setup
- Dockerfile accepts VERSION build arg for proper version stamping
- README rewritten with Docker Compose as primary container path

Author: jackharrhy

.github/workflows/release-agent.yml

@@ -9,6 +9,7 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 jobs:
   release:
@@ -51,3 +52,23 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ steps.version.outputs.version }}
           GORELEASER_CURRENT_TAG: ${{ steps.version.outputs.tag }}
+
+      - name: Log in to ghcr.io
+        if: steps.version.outputs.skip != 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        if: steps.version.outputs.skip != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: agent
+          push: true
+          tags: |
+            ghcr.io/jackharrhy/plow-agent:latest
+            ghcr.io/jackharrhy/plow-agent:${{ steps.version.outputs.version }}
+          build-args: |
+            VERSION=${{ steps.version.outputs.version }}

agent/Dockerfile

@@ -1,9 +1,10 @@
 FROM golang:1.25-alpine AS builder
+ARG VERSION=dev
 WORKDIR /build
 COPY go.mod go.sum ./
 RUN go mod download
 COPY *.go ./
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /plow-agent .
+RUN CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION}" -o /plow-agent .
 
 FROM scratch
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

agent/README.md

@@ -33,7 +33,9 @@ This launches an interactive setup wizard that:
 
 After setup, the agent runs in the background and survives reboots. You don't need to keep a terminal open.
 
-**Note:** Installing a system service usually requires administrator/root privileges. On Linux, run with `sudo`. On macOS, you may get a permissions prompt. On Windows, run as Administrator.
+**Note:** Installing a system service requires administrator/root privileges. The wizard will prompt for your sudo password automatically. On Windows, run as Administrator.
+
+**Once you see "Registered" in the output, let Jack know** (message him or open an issue) so he can approve your agent. It won't start fetching data until approved.
 
 ## Running interactively
 
@@ -50,35 +52,86 @@ This runs the agent in the foreground. Press Ctrl+C to stop.
 Once installed, you can control the service with:
 
 ```
-plow-agent --service status      # Check if running
+plow-agent --service status      # Check if running + platform info
+plow-agent --service logs        # View live logs (auto-detects platform)
 plow-agent --service stop        # Stop the service
 plow-agent --service start       # Start the service
 plow-agent --service restart     # Restart the service
 plow-agent --service uninstall   # Remove the service
 ```
 
-### Viewing logs
+The `status` and `logs` commands automatically detect your platform and show the right information -- no need to remember platform-specific log commands.
+
+### Complete removal
+
+To fully uninstall the agent and clean up all its data:
+
+```bash
+# 1. Stop and remove the system service
+plow-agent --service uninstall
+
+# 2. Remove service data (credentials used by the daemon)
+sudo rm -rf /var/lib/plow-agent
+
+# 3. Remove your local config (keypair and name)
+rm -rf ~/.config/plow-agent
+
+# 4. Remove the binary itself
+rm plow-agent
+```
+
+On macOS, if the service is stuck, you can force-remove it:
+
+```bash
+sudo launchctl bootout system/plow-agent
+sudo rm /Library/LaunchDaemons/plow-agent.plist
+```
+
+## Docker / Docker Compose
+
+The agent Docker image is published to `ghcr.io/jackharrhy/plow-agent` automatically on every release.
+
+The easiest way to run it is with the included [`compose.yml`](compose.yml):
+
+1. Download it: `curl -O https://raw.githubusercontent.com/jackharrhy/where-the-plow/main/agent/compose.yml`
+2. Edit `PLOW_NAME` to something that identifies you (e.g. "alice-homelab")
+3. Run it:
+
+```bash
+docker compose up -d
+```
+
+That's it. The volume keeps your keypair across restarts. Let Jack know once it's running so he can approve your agent.
+
+To view logs:
 
-- **Linux (systemd):** `journalctl -u plow-agent -f`
-- **macOS (launchd):** `log show --predicate 'process == "plow-agent"' --last 1h`
-- **Windows:** Event Viewer > Application logs
+```bash
+docker compose logs -f
+```
 
-## Docker
+To stop and remove:
 
+```bash
+docker compose down
+docker volume rm plow-agent_plow-agent-data  # removes credentials
 ```
+
+### Docker run (without Compose)
+
+```bash
 docker run -d \
   --name plow-agent \
+  --restart unless-stopped \
   -e PLOW_SERVER=https://plow.jackharrhy.dev \
   -e PLOW_NAME=your-name-here \
+  -e PLOW_DATA_DIR=/data \
   -v plow-agent-data:/data \
   ghcr.io/jackharrhy/plow-agent:latest
 ```
 
-The volume keeps your keypair across container restarts. Set `PLOW_NAME` to something that identifies you -- the server operator sees this when approving agents.
-
-To build the image yourself:
+### Building locally
 
-```
+```bash
 docker build -t plow-agent agent/
 ```
 
@@ -98,31 +151,34 @@ This creates a small PVC for key persistence and a Deployment running the agent.
 |---|---|---|
 | `--server` / `PLOW_SERVER` | Yes (for `--run`) | Plow server URL |
 | `--run` | No | Run in foreground instead of installing as service |
-| `--service <action>` | No | Control installed service: install, uninstall, start, stop, restart, status |
+| `--service <action>` | No | Control installed service: install, uninstall, start, stop, restart, status, logs |
 | `PLOW_NAME` | Docker/K8s only | Agent name (binary prompts interactively) |
 | `PLOW_DATA_DIR` | No | Override config directory (default: `~/.config/plow-agent/`, or `/data` when set) |
 
-## What gets stored locally
+## What gets stored
 
-The agent saves two files in its config directory:
+The agent stores two files:
 
 - `key.pem` -- your ECDSA private key (never sent to the server, only used to sign requests)
 - `name` -- the name you chose for this agent
 
-On a binary install these live in `~/.config/plow-agent/`. In Docker/K8s they live in the `/data` volume.
+**Interactive / `--run` mode:** stored in `~/.config/plow-agent/`
+
+**System service:** stored in `/var/lib/plow-agent/` (copied there during install so the daemon can access them as root)
+
+**Docker/K8s:** stored in the `/data` volume
 
 ## Checking your status
 
 The agent logs its current status on startup and during operation:
 
 ```
 2026/02/25 14:30:00 Agent ID: a1b2c3d4e5f67890
-2026/02/25 14:30:00 Server: https://plow.jackharrhy.dev
-2026/02/25 14:30:01 Registered! Waiting for approval...
+2026/02/25 14:30:01 Registered: agent_id=a1b2c3d4e5f67890 status=pending
 2026/02/25 14:30:01 Status: pending — waiting for approval (checking every 30s)
 ```
 
-Once approved:
+Once Jack approves your agent:
 
 ```
 2026/02/25 14:35:01 Approved! Fetching every 18s (offset 6s)

agent/client.go

@@ -19,8 +19,10 @@ type Schedule struct {
 	Headers         map[string]string `json:"headers"`
 }
 
-// register sends a POST /agents/register request to the server.
-func register(cfg *Config) {
+// tryRegister sends a POST /agents/register request to the server.
+// Registration is idempotent — if the agent is already known the server
+// returns the current status. Returns nil on success.
+func tryRegister(cfg *Config) error {
 	hostname, _ := os.Hostname()
 	systemInfo := fmt.Sprintf("%s/%s %s", runtime.GOOS, runtime.GOARCH, hostname)
 
@@ -31,32 +33,38 @@ func register(cfg *Config) {
 	}
 	body, err := json.Marshal(payload)
 	if err != nil {
-		log.Fatalf("Failed to marshal register payload: %v", err)
+		return fmt.Errorf("marshal register payload: %w", err)
 	}
 
 	url := cfg.server + "/agents/register"
 	resp, err := http.Post(url, "application/json", bytes.NewReader(body))
 	if err != nil {
-		log.Fatalf("Registration failed: %v", err)
+		return fmt.Errorf("register request: %w", err)
 	}
 	defer resp.Body.Close()
 
 	respBody, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode != 200 {
-		log.Fatalf("Registration failed (HTTP %d): %s", resp.StatusCode, respBody)
+		return fmt.Errorf("register HTTP %d: %s", resp.StatusCode, respBody)
 	}
 
 	var result struct {
 		AgentID string `json:"agent_id"`
 		Status  string `json:"status"`
 	}
 	if err := json.Unmarshal(respBody, &result); err != nil {
-		log.Fatalf("Failed to parse register response: %v", err)
+		return fmt.Errorf("parse register response: %w", err)
 	}
 
-	log.Printf("Registered! Agent ID: %s, Status: %s", result.AgentID, result.Status)
-	if result.Status == "pending" {
-		log.Printf("Waiting for approval...")
+	log.Printf("Registered: agent_id=%s status=%s", result.AgentID, result.Status)
+	return nil
+}
+
+// register calls tryRegister and fatals on error. Used by the interactive
+// wizard where failure should be immediately visible.
+func register(cfg *Config) {
+	if err := tryRegister(cfg); err != nil {
+		log.Fatalf("Registration failed: %v", err)
 	}
 }
 

agent/compose.yml

@@ -0,0 +1,13 @@
+services:
+  plow-agent:
+    image: ghcr.io/jackharrhy/plow-agent:latest
+    restart: unless-stopped
+    environment:
+      - PLOW_SERVER=https://plow.jackharrhy.dev
+      - PLOW_NAME=your-name-here  # Change this to identify yourself
+      - PLOW_DATA_DIR=/data
+    volumes:
+      - plow-agent-data:/data
+
+volumes:
+  plow-agent-data: