onWatch v2.13.5

macOS: onWatch now comes back after a reboot

onWatch never restarted after a reboot or logout on macOS - setup_launchd() in the installer was a stub that created no LaunchAgent, so nothing was responsible for starting it at login. Linux had a systemd unit; macOS had nothing.

macOS now gets a per-user LaunchAgent, dev.onllm.onwatch:

onwatch service install     # start automatically at login
onwatch service status      # is the agent installed and loaded?
onwatch service uninstall   # remove it

It uses RunAtLoad plus KeepAlive: {SuccessfulExit: false}, so a crash is relaunched but a deliberate onwatch stop stays stopped until your next login.

Opt-in, asked once. install.sh, onwatch setup, and onwatch update offer it when the agent is missing; declining is remembered in ~/.onwatch/.autostart-declined. Set ONWATCH_AUTOSTART=yes|no for unattended installs. A piped install with no terminal prints the command and installs nothing. onwatch status now shows whether anything will bring onWatch back after a reboot.

Updates always leave onWatch running

onwatch update applied the new binary and exited without starting anything if onWatch was not already running - exactly the case after a reboot. It now ends with onWatch running: launchctl kickstart under launchd, systemctl restart under systemd, a fresh daemon standalone (carrying your --port and --db), and no spawn inside a container.

Antigravity: Gemini Pro and Flash are one quota pool

Antigravity treats all Gemini variants as a single shared pool, so onWatch's separate "Pro" and "Flash" cards always showed the same number and looked broken. They are now one Gemini Quota pool alongside Claude + GPT, and legacy group keys normalize to it.

Thanks to @yesme (#103).

Fixes

• macOS: auto-start at login via launchd, opt-in through onwatch service install
• onwatch update no longer exits silently leaving onWatch stopped
• Dashboard-triggered updates hand the restart to launchd or systemd instead of orphaning the supervised job; the spawned replacement no longer inherits _ONWATCH_DAEMON=1, which made it skip backgrounding and lose the port bind to the old binary
• service install creates the working and log directories - a missing WorkingDirectory fails the spawn with EX_CONFIG and retries forever
• Homebrew installs no longer write a versioned Cellar path into the plist that brew upgrade deletes
• install.sh upgrades with auto-start enabled no longer leave onWatch stopped; service uninstall no longer claims the running instance survived, because bootout stops it
• A takeover no longer deletes the new instance's PID file
• onwatch update < /dev/null no longer reads /dev/null as a terminal and installs a login item on the prompt's default
• Antigravity: Gemini Pro and Flash merged into one shared quota pool (#103)
• perf-monitor --restart <port> <duration> honours the port instead of falling back to 9211
• go test can no longer replace a developer's running onWatch with a test binary on the real port and database

---

Upgrade: nothing changes until you opt in - existing installs behave exactly as before on every platform until you answer the auto-start prompt or run onwatch service install. Linux is unaffected.