@chainingintention/pi-web-cn 2.0.0 → 2.202610.0

package/dist/nativeServices/serviceDoctor.js

@@ -1,5 +1,8 @@
+import { createTranslator } from "../shared/i18n.js";
 import { posix as posixPath } from "node:path";
-import { createDevelopmentNativeServicePlan, nativeServicePrerequisiteNeedsPathAdvice, resolveProductionNativeServicePlan, validateNativeServicePlan, } from "./servicePlan.js";
+import { TextDecoder, TextEncoder } from "node:util";
+import { ownEnvironmentValue } from "../environment.js";
+import { createDevelopmentNativeServicePlan, nativeServiceManagerRefs, nativeServicePrerequisiteNeedsPathAdvice, resolveProductionNativeServicePlan, validateNativeServicePlan, } from "./servicePlan.js";
 export function inferInstalledNativeServiceMode(serviceIds) {
     if (serviceIds.size === 0)
         return "none";
@@ -11,15 +14,51 @@ export function inferInstalledNativeServiceMode(serviceIds) {
         return "development";
     return "ambiguous";
 }
-export function inspectInstalledProductionServiceContext(backend, definitions) {
+/**
+ * Select the config path for a caller that is about to probe managed native
+ * services. A nonempty caller value is an explicit override and deliberately
+ * avoids interpreting installed files. Otherwise every relevant definition
+ * must parse to one consistent environment before its persisted path is used.
+ */
+export function selectManagedNativeServiceConfig(backend, definitions, callerConfigPath) {
+    if (callerConfigPath !== undefined && callerConfigPath !== "") {
+        return { ok: true, value: { source: "caller", configPath: callerConfigPath } };
+    }
+    if (definitions.length === 0)
+        return { ok: true, value: { source: "default" } };
     const parsed = parseConsistentDefinitions(backend, definitions);
+    if (!parsed.ok)
+        return parsed;
+    const firstEnvironment = parsed.value[0]?.environment;
+    const installedConfigPath = firstEnvironment === undefined
+        ? undefined
+        : ownEnvironmentValue(firstEnvironment, "PI_WEB_CONFIG");
+    if (installedConfigPath === undefined || installedConfigPath === "") {
+        return { ok: true, value: { source: "default" } };
+    }
+    if (!posixPath.isAbsolute(installedConfigPath)) {
+        return {
+            ok: false,
+            message: `Installed service definitions declare relative PI_WEB_CONFIG ${JSON.stringify(installedConfigPath)}; managed config paths must be absolute.`,
+        };
+    }
+    return { ok: true, value: { source: "installed", configPath: installedConfigPath } };
+}
+export function inspectInstalledNativeServiceDefinitionEnvironment(backend, definition) {
+    const parsed = backend.kind === "systemd"
+        ? parseSystemdDefinition(definition)
+        : parseLaunchdDefinition(definition);
+    return parsed.ok ? { ok: true, value: parsed.value.environment } : parsed;
+}
+export function inspectInstalledProductionServiceContext(backend, definitions, t = createTranslator("en", {})) {
+    const parsed = parseConsistentDefinitions(backend, definitions, t);
     if (!parsed.ok)
         return parsed;
     const withWorkingDirectory = parsed.value.find((definition) => definition.workingDirectory !== null);
     if (withWorkingDirectory !== undefined) {
         return {
             ok: false,
-            message: `Installed production service ${withWorkingDirectory.id} unexpectedly has working directory ${withWorkingDirectory.workingDirectory ?? ""}.`,
+            message: t("doctor.productionCwd", "Installed production service {arg0} unexpectedly has working directory {arg1}.", { arg0: withWorkingDirectory.id, arg1: withWorkingDirectory.workingDirectory ?? "" }),
         };
     }
     return {
@@ -30,13 +69,13 @@ export function inspectInstalledProductionServiceContext(backend, definitions) {
         },
     };
 }
-export function inspectInstalledDevelopmentServiceInput(backend, definitions) {
-    const parsed = parseConsistentDefinitions(backend, definitions);
+export function inspectInstalledDevelopmentServiceInput(backend, definitions, t = createTranslator("en", {})) {
+    const parsed = parseConsistentDefinitions(backend, definitions, t);
     if (!parsed.ok)
         return parsed;
     const first = parsed.value[0] ?? impossibleMissingDefinition();
     if (first.workingDirectory === null) {
-        return { ok: false, message: "Installed development services do not declare a working directory." };
+        return { ok: false, message: t("doctor.cwdMissing", "Installed development services do not declare a working directory.") };
     }
     const input = {
         backend,
@@ -51,7 +90,7 @@ export function inspectInstalledDevelopmentServiceInput(backend, definitions) {
         if (expected?.shellCommand !== definition.shellCommand) {
             return {
                 ok: false,
-                message: `Installed ${definition.id} service command does not match the canonical development plan.`,
+                message: t("doctor.developmentMismatch", "Installed {arg0} service command does not match the canonical development plan.", { arg0: definition.id }),
             };
         }
     }
@@ -77,14 +116,14 @@ export async function runNativeServiceDoctor(target, dependencies) {
     const validation = await validateNativeServicePlan(plan, dependencies.probe);
     return { kind: "plan-validation", scope, plan, validation };
 }
-export function formatNativeServiceDoctorResult(result) {
+export function formatNativeServiceDoctorResult(result, t = createTranslator("en", {})) {
     if (result.kind === "inspection-failure") {
         return {
             ok: false,
             failureKind: "inspection",
             lines: [
-                `✗ Installed native-service plan could not be inspected: ${result.message}`,
-                "  Run `pi-web install` or `pi-web install --dev` to replace mixed, partial, or outdated service definitions.",
+                t("doctor.inspectionFailed", "✗ Installed native-service plan could not be inspected: {arg0}", { arg0: result.message }),
+                t("doctor.replaceDefinitions", "  Run `pi-web install` or `pi-web install --dev` to replace mixed, partial, or outdated service definitions."),
             ],
             plan: null,
             adviceShell: null,
@@ -92,26 +131,26 @@ export function formatNativeServiceDoctorResult(result) {
             failedPrerequisites: [],
         };
     }
-    const lines = [scopeHeading(result.scope)];
+    const lines = [scopeHeading(result.scope, t)];
     if (result.kind === "plan-resolution-failure") {
         let infrastructure = false;
         for (const failure of result.failures) {
             if (failure.kind === "probe-infrastructure") {
                 infrastructure = true;
-                lines.push(`✗ Native service probe infrastructure failure (${failure.reason}): ${failure.message}`);
+                lines.push(t("doctor.infrastructureFailure", "✗ Native service probe infrastructure failure ({arg0}): {arg1}", { arg0: failure.reason, arg1: failure.message }));
             }
             else if (failure.kind === "entrypoint-inspection-failure") {
                 infrastructure = true;
-                lines.push(`✗ Could not inspect bundled ${failure.serviceId} entrypoint ${failure.entrypointPath}: ${failure.message}`);
+                lines.push(t("doctor.entrypointFailed", "✗ Could not inspect bundled {arg0} entrypoint {arg1}: {arg2}", { arg0: failure.serviceId, arg1: failure.entrypointPath, arg2: failure.message }));
             }
             else {
-                lines.push(`✗ ${failure.namedCommand} is unavailable to the native service manager, and bundled entrypoint ${failure.bundledEntrypointPath} is missing.`);
+                lines.push(t("doctor.commandMissing", "✗ {arg0} is unavailable to the native service manager, and bundled entrypoint {arg1} is missing.", { arg0: failure.namedCommand, arg1: failure.bundledEntrypointPath }));
                 if (failure.namedCommandFailure !== null)
                     lines.push(`  ${failure.namedCommandFailure}`);
             }
         }
         if (infrastructure)
-            lines.push("  This infrastructure failure is not proof of a PATH mismatch.");
+            lines.push(t("doctor.notPathProof", "  This infrastructure failure is not proof of a PATH mismatch."));
         return {
             ok: false,
             failureKind: infrastructure ? "infrastructure" : "requirements",
@@ -125,10 +164,10 @@ export function formatNativeServiceDoctorResult(result) {
     }
     const configuredOverrides = result.plan.services.filter((service) => service.strategy.kind === "configured-override");
     for (const service of configuredOverrides) {
-        lines.push(`! ${service.description} uses a configured command override; doctor does not execute arbitrary configured commands.`);
+        lines.push(t("doctor.overrideSkipped", "! {arg0} uses a configured command override; doctor does not execute arbitrary configured commands.", { arg0: service.description }));
     }
     if (result.validation.ok) {
-        lines.push("✓ All verifiable native-service plan requirements are satisfied in the service-manager context.");
+        lines.push(t("doctor.requirementsSatisfied", "✓ All verifiable native-service plan requirements are satisfied in the service-manager context."));
         return {
             ok: true,
             failureKind: "none",
@@ -144,17 +183,17 @@ export function formatNativeServiceDoctorResult(result) {
     for (const failure of result.validation.failures) {
         if (failure.kind === "probe-infrastructure") {
             infrastructure = true;
-            lines.push(`✗ Native service probe infrastructure failure (${failure.reason}): ${failure.message}`);
+            lines.push(t("doctor.infrastructureFailure", "✗ Native service probe infrastructure failure ({arg0}): {arg1}", { arg0: failure.reason, arg1: failure.message }));
         }
         else {
             failedPrerequisites.push(failure.prerequisite);
-            lines.push(`✗ Native service requirement failed: ${failure.prerequisite.description}`);
+            lines.push(t("doctor.requirementFailed", "✗ Native service requirement failed: {arg0}", { arg0: failure.prerequisite.description }));
             if (failure.detail !== null && failure.detail !== failure.prerequisite.description)
                 lines.push(`  ${failure.detail}`);
         }
     }
     if (infrastructure)
-        lines.push("  This infrastructure failure is not proof of a PATH mismatch.");
+        lines.push(t("doctor.notPathProof", "  This infrastructure failure is not proof of a PATH mismatch."));
     return {
         ok: false,
         failureKind: infrastructure ? "infrastructure" : "requirements",
@@ -166,19 +205,19 @@ export function formatNativeServiceDoctorResult(result) {
         failedPrerequisites,
     };
 }
-function scopeHeading(scope) {
+function scopeHeading(scope, t = createTranslator("en", {})) {
     if (scope.kind === "installed-development")
-        return "Installed development native-service plan:";
-    return `Prospective production native-service plan (${scope.reason ?? "installed strategy is unknown"}):`;
+        return t("doctor.installedDev", "Installed development native-service plan:");
+    return t("doctor.prospectiveProduction", "Prospective production native-service plan ({arg0}):", { arg0: scope.reason ?? t("doctor.strategyUnknown", "installed strategy is unknown") });
 }
-function parseConsistentDefinitions(backend, definitions) {
+function parseConsistentDefinitions(backend, definitions, t = createTranslator("en", {})) {
     if (definitions.length === 0)
-        return { ok: false, message: "No installed service definitions were provided." };
+        return { ok: false, message: t("doctor.definitionsMissing", "No installed service definitions were provided.") };
     const parsed = [];
     for (const definition of definitions) {
         const result = backend.kind === "systemd"
-            ? parseSystemdDefinition(definition)
-            : parseLaunchdDefinition(definition);
+            ? parseSystemdDefinition(definition, t)
+            : parseLaunchdDefinition(definition, t);
         if (!result.ok)
             return result;
         parsed.push(result.value);
@@ -186,13 +225,13 @@ function parseConsistentDefinitions(backend, definitions) {
     const first = parsed[0] ?? impossibleMissingDefinition();
     for (const definition of parsed.slice(1)) {
         if (definition.shell.executable !== first.shell.executable) {
-            return { ok: false, message: "Installed service definitions use different login shells." };
+            return { ok: false, message: t("doctor.shellMismatch", "Installed service definitions use different login shells.") };
         }
         if (!recordsEqual(definition.environment, first.environment)) {
-            return { ok: false, message: "Installed service definitions use different environments." };
+            return { ok: false, message: t("doctor.environmentMismatch", "Installed service definitions use different environments.") };
         }
         if (definition.workingDirectory !== first.workingDirectory) {
-            return { ok: false, message: "Installed service definitions use different working directories." };
+            return { ok: false, message: t("doctor.cwdMismatch", "Installed service definitions use different working directories.") };
         }
     }
     return { ok: true, value: parsed };
@@ -203,7 +242,9 @@ function systemdServiceDirectives(contents) {
     let inServiceSection = false;
     let foundServiceSection = false;
     for (const line of contents.split(/\r?\n/u)) {
-        const trimmed = line.trim();
+        // systemd syntax trims ASCII spaces and tabs here; JavaScript's trim/\s
+        // would also consume Unicode whitespace that systemd treats as key text.
+        const trimmed = line.replace(/^[ \t]+|[ \t]+$/gu, "");
         if (/^\[[^\]]+\]$/u.test(trimmed)) {
             inServiceSection = trimmed === "[Service]";
             foundServiceSection ||= inServiceSection;
@@ -211,105 +252,180 @@ function systemdServiceDirectives(contents) {
         }
         if (!inServiceSection || trimmed === "" || trimmed.startsWith("#") || trimmed.startsWith(";"))
             continue;
-        const match = /^\s*([A-Za-z][A-Za-z0-9]*)=(.*)$/u.exec(line);
+        // Slice after the recognized prefix so JavaScript-only line separators remain directive data.
+        const match = /^[ \t]*([A-Za-z][A-Za-z0-9]*)=/u.exec(line);
         const name = match?.[1];
-        const value = match?.[2];
-        if (name === undefined || value === undefined || !allowed.has(name))
+        if (match === null || name === undefined || !allowed.has(name))
             return undefined;
-        directives.push({ name, value });
+        directives.push({ name, value: line.slice(match[0].length) });
     }
     return foundServiceSection ? directives : undefined;
 }
-function parseSystemdDefinition(definition) {
+function hasSystemdPhysicalLineContinuation(line) {
+    let trailingBackslashes = 0;
+    for (let index = line.length - 1; index >= 0 && line[index] === "\\"; index -= 1)
+        trailingBackslashes += 1;
+    return trailingBackslashes % 2 === 1;
+}
+/** Parse PI WEB's bounded ExecStart argument structure, including persisted legacy encodings. */
+function parseSystemdExecStart(value) {
+    const environmentPrefix = "/usr/bin/env ";
+    const shellOffset = value.startsWith(environmentPrefix) ? environmentPrefix.length : 0;
+    const shell = parseSystemdExecStartArgument(value, shellOffset);
+    if (shell === undefined)
+        return undefined;
+    const loginShellSeparator = " -lc ";
+    if (!value.startsWith(loginShellSeparator, shell.endOffset))
+        return undefined;
+    const shellCommandOffset = shell.endOffset + loginShellSeparator.length;
+    if (shellCommandOffset >= value.length)
+        return undefined;
+    return {
+        shellArgument: shell.value,
+        shellCommandArgument: value.slice(shellCommandOffset),
+    };
+}
+/** Scan one systemd argument linearly so delimiters inside quoted values remain data. */
+function parseSystemdExecStartArgument(value, offset) {
+    if (offset >= value.length || value[offset] === " " || value[offset] === "\t")
+        return undefined;
+    let quote = null;
+    for (let index = offset; index < value.length; index += 1) {
+        const character = value[index];
+        if (character === "\\") {
+            index += 1;
+            if (index >= value.length)
+                return undefined;
+            continue;
+        }
+        if (quote === null && (character === " " || character === "\t")) {
+            return { value: value.slice(offset, index), endOffset: index };
+        }
+        if (character !== "\"" && character !== "'")
+            continue;
+        if (quote === null)
+            quote = character;
+        else if (character === quote)
+            quote = null;
+    }
+    return quote === null ? { value: value.slice(offset), endOffset: value.length } : undefined;
+}
+// Keep malformed installed input linear; overlapping escaped/raw regex alternatives can backtrack exponentially.
+function isSingleSystemdQuotedValue(value) {
+    if (value.length < 2 || !value.startsWith('"') || !value.endsWith('"'))
+        return false;
+    const closingQuoteIndex = value.length - 1;
+    for (let index = 1; index < closingQuoteIndex; index += 1) {
+        const character = value[index];
+        if (character === '"')
+            return false;
+        if (character !== "\\")
+            continue;
+        index += 1;
+        if (index >= closingQuoteIndex)
+            return false;
+    }
+    return true;
+}
+function parseSystemdDefinition(definition, t = createTranslator("en", {})) {
+    if (definition.contents.split(/\r?\n/u).some(hasSystemdPhysicalLineContinuation)) {
+        return {
+            ok: false,
+            message: `Installed ${definition.id} systemd unit uses physical-line continuation, which cannot be inspected safely.`,
+        };
+    }
     const directives = systemdServiceDirectives(definition.contents);
     if (directives === undefined) {
-        return { ok: false, message: `Installed ${definition.id} systemd unit has unrecognized service directives.` };
+        return { ok: false, message: t("doctor.systemd.unrecognized_service_directives", "Installed {arg0} systemd unit has unrecognized service directives.", { arg0: definition.id }) };
     }
     const execStarts = directives.filter((directive) => directive.name === "ExecStart");
     const execStart = execStarts.length === 1
-        ? /^(?:\/usr\/bin\/env )?(.+?) -lc (.+)$/u.exec(execStarts[0]?.value ?? "")
-        : null;
-    if (execStart?.[1] === undefined || execStart[2] === undefined) {
+        ? parseSystemdExecStart(execStarts[0]?.value ?? "")
+        : undefined;
+    if (execStart === undefined) {
         return { ok: false, message: `Installed ${definition.id} systemd unit must have exactly one recognized ExecStart.` };
     }
-    const shellExecutable = parseSystemdExecArgument(execStart[1]);
+    const shellExecutable = parseSystemdExecArgument(execStart.shellArgument);
     if (shellExecutable === undefined) {
-        return { ok: false, message: `Installed ${definition.id} systemd unit has an unrecognized login shell argument.` };
+        return { ok: false, message: t("doctor.systemd.an_unrecognized_login_shell_argument", "Installed {arg0} systemd unit has an unrecognized login shell argument.", { arg0: definition.id }) };
     }
-    const shell = installedShell(shellExecutable);
+    const shell = installedShell(shellExecutable, t);
     if (!shell.ok)
         return shell;
-    const shellCommand = parseSystemdShellCommand(shell.value.name, execStart[2]);
+    const shellCommand = parseSystemdShellCommand(shell.value.name, execStart.shellCommandArgument);
     if (shellCommand === undefined) {
-        return { ok: false, message: `Installed ${definition.id} systemd unit has an unrecognized shell command.` };
+        return { ok: false, message: t("doctor.systemd.an_unrecognized_shell_command", "Installed {arg0} systemd unit has an unrecognized shell command.", { arg0: definition.id }) };
     }
-    const environment = {};
+    const environment = new Map();
     for (const directive of directives.filter((item) => item.name === "Environment")) {
         const rawValue = directive.value;
-        if (!/^"(?:\\.|[^"])*"$/u.test(rawValue)) {
+        if (!isSingleSystemdQuotedValue(rawValue)) {
             return { ok: false, message: `Installed ${definition.id} systemd unit has an unrecognized environment entry.` };
         }
         const assignment = parseSystemdDirectiveValue(rawValue);
         const separator = assignment?.indexOf("=") ?? -1;
         const key = assignment?.slice(0, separator) ?? "";
-        if (separator <= 0 || Object.hasOwn(environment, key)) {
+        if (separator <= 0 || !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key) || environment.has(key)) {
             return { ok: false, message: `Installed ${definition.id} systemd unit has a malformed environment entry.` };
         }
-        environment[key] = assignment?.slice(separator + 1) ?? "";
+        environment.set(key, assignment?.slice(separator + 1) ?? "");
     }
     const workingDirectories = directives.filter((directive) => directive.name === "WorkingDirectory");
     if (workingDirectories.length > 1) {
-        return { ok: false, message: `Installed ${definition.id} systemd unit has duplicate working directories.` };
+        return { ok: false, message: t("doctor.systemd.duplicate_working_directories", "Installed {arg0} systemd unit has duplicate working directories.", { arg0: definition.id }) };
     }
     const rawWorkingDirectory = workingDirectories[0]?.value;
     if (rawWorkingDirectory?.startsWith('"') === true || rawWorkingDirectory?.startsWith("'") === true) {
-        return { ok: false, message: `Installed ${definition.id} systemd unit has an invalid quoted working directory.` };
+        return { ok: false, message: t("doctor.systemd.an_invalid_quoted_working_directory", "Installed {arg0} systemd unit has an invalid quoted working directory.", { arg0: definition.id }) };
     }
     const workingDirectory = rawWorkingDirectory === undefined
         ? null
         : parseSystemdDirectiveValue(rawWorkingDirectory);
     if (workingDirectories.length === 1 && workingDirectory === undefined) {
-        return { ok: false, message: `Installed ${definition.id} systemd unit has a malformed working directory.` };
+        return { ok: false, message: t("doctor.systemd.a_malformed_working_directory", "Installed {arg0} systemd unit has a malformed working directory.", { arg0: definition.id }) };
     }
     return {
         ok: true,
-        value: { id: definition.id, shell: shell.value, environment, workingDirectory: workingDirectory ?? null, shellCommand },
+        value: {
+            id: definition.id,
+            shell: shell.value,
+            environment: Object.fromEntries(environment),
+            workingDirectory: workingDirectory ?? null,
+            shellCommand,
+        },
     };
 }
-function parseLaunchdDefinition(definition) {
-    const argumentsMatches = [...definition.contents.matchAll(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/gu)];
-    const arguments_ = argumentsMatches.length === 1
-        ? parseXmlStringSequence(argumentsMatches[0]?.[1] ?? "")
-        : undefined;
+function parseLaunchdDefinition(definition, t = createTranslator("en", {})) {
+    const plist = parseLaunchdPlistDocument(definition.contents);
+    if (plist === undefined) {
+        return { ok: false, message: `Installed ${definition.id} LaunchAgent is not a structurally valid property list.` };
+    }
+    const label = plistStringValue(plist.get("Label"));
+    if (label === undefined) {
+        return { ok: false, message: `Installed ${definition.id} LaunchAgent has an unrecognized Label.` };
+    }
+    const expectedLabel = nativeServiceManagerRefs[definition.id].launchdLabel;
+    if (label !== expectedLabel) {
+        return {
+            ok: false,
+            message: `Installed ${definition.id} LaunchAgent declares Label ${JSON.stringify(label)} instead of ${JSON.stringify(expectedLabel)}.`,
+        };
+    }
+    const arguments_ = plistStringArray(plist.get("ProgramArguments"));
     if (arguments_?.length !== 4 || arguments_[0] !== "/usr/bin/env" || arguments_[2] !== "-lc") {
-        return { ok: false, message: `Installed ${definition.id} LaunchAgent has unrecognized ProgramArguments.` };
+        return { ok: false, message: t("doctor.launchd.unrecognized_ProgramArguments", "Installed {arg0} LaunchAgent has unrecognized ProgramArguments.", { arg0: definition.id }) };
     }
-    const shell = installedShell(arguments_[1] ?? "");
+    const shell = installedShell(arguments_[1] ?? "", t);
     if (!shell.ok)
         return shell;
-    const environmentMatches = [...definition.contents.matchAll(/<key>EnvironmentVariables<\/key>\s*<dict>([\s\S]*?)<\/dict>/gu)];
-    const environmentKeyCount = [...definition.contents.matchAll(/<key>EnvironmentVariables<\/key>/gu)].length;
-    if (environmentMatches.length > 1 || environmentKeyCount !== environmentMatches.length) {
-        return { ok: false, message: `Installed ${definition.id} LaunchAgent has a malformed environment dictionary.` };
-    }
-    const environment = environmentMatches.length === 0
-        ? {}
-        : parseXmlStringDictionary(environmentMatches[0]?.[1] ?? "");
+    const rawEnvironment = plist.get("EnvironmentVariables");
+    const environment = rawEnvironment === undefined ? {} : plistStringDictionary(rawEnvironment);
     if (environment === undefined) {
-        return { ok: false, message: `Installed ${definition.id} LaunchAgent has a malformed environment dictionary.` };
-    }
-    const contentsWithoutEnvironment = environmentMatches[0]?.[0] === undefined
-        ? definition.contents
-        : definition.contents.replace(environmentMatches[0][0], "");
-    const workingDirectoryMatches = [...contentsWithoutEnvironment.matchAll(/<key>WorkingDirectory<\/key>\s*<string>([\s\S]*?)<\/string>/gu)];
-    const workingDirectoryKeyCount = [...contentsWithoutEnvironment.matchAll(/<key>WorkingDirectory<\/key>/gu)].length;
-    if (workingDirectoryMatches.length > 1 || workingDirectoryKeyCount !== workingDirectoryMatches.length) {
-        return { ok: false, message: `Installed ${definition.id} LaunchAgent has a malformed working directory.` };
+        return { ok: false, message: t("doctor.launchd.a_malformed_environment_dictionary", "Installed {arg0} LaunchAgent has a malformed environment dictionary.", { arg0: definition.id }) };
     }
-    const workingDirectory = workingDirectoryMatches[0]?.[1] === undefined
-        ? null
-        : xmlUnescapeStrict(workingDirectoryMatches[0][1]);
-    if (workingDirectoryMatches.length === 1 && workingDirectory === undefined) {
+    const rawWorkingDirectory = plist.get("WorkingDirectory");
+    const workingDirectory = rawWorkingDirectory === undefined ? null : plistStringValue(rawWorkingDirectory);
+    if (rawWorkingDirectory !== undefined && workingDirectory === undefined) {
         return { ok: false, message: `Installed ${definition.id} LaunchAgent has a malformed working directory.` };
     }
     return {
@@ -323,10 +439,10 @@ function parseLaunchdDefinition(definition) {
         },
     };
 }
-function installedShell(executable) {
+function installedShell(executable, t = createTranslator("en", {})) {
     const name = posixPath.basename(executable).replace(/^-/, "");
     if (name !== "bash" && name !== "zsh" && name !== "fish") {
-        return { ok: false, message: `Installed service definition uses unsupported login shell ${executable}.` };
+        return { ok: false, message: t("doctor.shellUnsupported", "Installed service definition uses unsupported login shell {arg0}.", { arg0: executable }) };
     }
     return {
         ok: true,
@@ -334,7 +450,10 @@ function installedShell(executable) {
     };
 }
 function parseSystemdExecArgument(value) {
-    const decoded = parseSystemdEscapedValue(value);
+    const quoted = value.startsWith('"') || value.endsWith('"');
+    if (quoted ? !isSingleSystemdQuotedValue(value) : /["']/u.test(value))
+        return undefined;
+    const decoded = decodeSystemdEscapes(quoted ? value.slice(1, -1) : value);
     return decoded === undefined ? undefined : decodeSystemdSubstitutions(decoded, true);
 }
 function parseSystemdDirectiveValue(value) {
@@ -345,14 +464,20 @@ function parseSystemdEscapedValue(value) {
     const quoted = value.startsWith('"') || value.endsWith('"');
     if (quoted && (!value.startsWith('"') || !value.endsWith('"')))
         return undefined;
-    return systemdUnescape(quoted ? value.slice(1, -1) : value);
+    return decodeSystemdEscapes(quoted ? value.slice(1, -1) : value);
 }
-function systemdUnescape(value) {
-    let result = "";
+export function decodeSystemdEscapes(value) {
+    const bytes = [];
+    const encoder = new TextEncoder();
     for (let index = 0; index < value.length; index += 1) {
         const character = value[index];
         if (character !== "\\") {
-            result += character ?? "";
+            const codePoint = value.codePointAt(index);
+            if (codePoint === undefined || codePoint === 0 || (codePoint >= 0xd800 && codePoint <= 0xdfff))
+                return undefined;
+            bytes.push(...encoder.encode(String.fromCodePoint(codePoint)));
+            if (codePoint > 0xffff)
+                index += 1;
             continue;
         }
         const escape = value[index + 1];
@@ -374,23 +499,45 @@ function systemdUnescape(value) {
         };
         const simple = simpleEscapes[escape];
         if (simple !== undefined) {
-            result += simple;
+            bytes.push(...encoder.encode(simple));
             index += 1;
             continue;
         }
+        if (/^[0-7]$/u.test(escape)) {
+            const encoded = value.slice(index + 1, index + 4);
+            if (!/^[0-7]{3}$/u.test(encoded))
+                return undefined;
+            const decoded = Number.parseInt(encoded, 8);
+            if (decoded === 0 || decoded > 0xff)
+                return undefined;
+            bytes.push(decoded);
+            index += 3;
+            continue;
+        }
         const length = escape === "x" ? 2 : escape === "u" ? 4 : escape === "U" ? 8 : 0;
         if (length === 0)
             return undefined;
         const encoded = value.slice(index + 2, index + 2 + length);
         if (encoded.length !== length || !new RegExp(`^[0-9a-fA-F]{${String(length)}}$`, "u").test(encoded))
             return undefined;
-        const codePoint = Number.parseInt(encoded, 16);
-        if (codePoint === 0 || codePoint > 0x10ffff)
+        const decoded = Number.parseInt(encoded, 16);
+        if (decoded === 0 || decoded > 0x10ffff || (decoded >= 0xd800 && decoded <= 0xdfff))
             return undefined;
-        result += String.fromCodePoint(codePoint);
+        if (escape === "x")
+            bytes.push(decoded);
+        else
+            bytes.push(...encoder.encode(String.fromCodePoint(decoded)));
         index += length + 1;
     }
-    return result;
+    try {
+        // Keep a BOM produced by an escape sequence as U+FEFF. The default
+        // decoder behavior strips leading UTF-8 BOM bytes, which could turn an
+        // invalid BOM-prefixed environment key into PI_WEB_CONFIG.
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(Uint8Array.from(bytes));
+    }
+    catch {
+        return undefined;
+    }
 }
 function decodeSystemdSubstitutions(value, decodeDollars) {
     let result = "";
@@ -414,7 +561,17 @@ function parseSystemdShellCommand(shell, value) {
         return undefined;
     const inner = value.slice(1, -1);
     const unquoted = shell === "fish" ? fishSingleQuoteUnescape(inner) : inner.replaceAll("'\\''", "'");
-    return decodeSystemdSubstitutions(unquoted, true);
+    if (legacySystemdShellQuote(shell, unquoted) !== value)
+        return undefined;
+    // The pre-hardening renderer doubled percent specifiers, but its
+    // replacement-string "$$" left dollar characters unchanged.
+    return decodeSystemdSubstitutions(unquoted, false);
+}
+function legacySystemdShellQuote(shell, value) {
+    const escaped = shell === "fish"
+        ? value.replaceAll("\\", "\\\\").replaceAll("'", "\\'")
+        : value.replaceAll("'", "'\\''");
+    return `'${escaped}'`;
 }
 function fishSingleQuoteUnescape(value) {
     let result = "";
@@ -430,34 +587,181 @@ function fishSingleQuoteUnescape(value) {
     }
     return result;
 }
-function parseXmlStringSequence(contents) {
+const plistXmlDeclaration = '<?xml version="1.0" encoding="UTF-8"?>';
+const plistDoctype = '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">';
+const maximumPlistDepth = 32;
+/** Parse the complete XML plist subset emitted by PI WEB, rejecting fragments and duplicate dictionary keys. */
+function parseLaunchdPlistDocument(contents) {
+    const normalizedContents = normalizePlistXml(contents);
+    if (normalizedContents === undefined)
+        return undefined;
+    const cursor = {
+        contents: normalizedContents,
+        offset: normalizedContents.startsWith("\uFEFF") ? 1 : 0,
+    };
+    skipPlistWhitespace(cursor);
+    if (consumePlistToken(cursor, plistXmlDeclaration))
+        skipPlistWhitespace(cursor);
+    else if (cursor.contents.startsWith("<?xml", cursor.offset))
+        return undefined;
+    if (consumePlistToken(cursor, plistDoctype))
+        skipPlistWhitespace(cursor);
+    else if (cursor.contents.startsWith("<!DOCTYPE", cursor.offset))
+        return undefined;
+    if (!consumePlistToken(cursor, '<plist version="1.0">'))
+        return undefined;
+    const root = parsePlistValue(cursor, 0);
+    if (root?.kind !== "dictionary")
+        return undefined;
+    skipPlistWhitespace(cursor);
+    if (!consumePlistToken(cursor, "</plist>"))
+        return undefined;
+    skipPlistWhitespace(cursor);
+    return cursor.offset === cursor.contents.length ? root.value : undefined;
+}
+function parsePlistValue(cursor, depth) {
+    if (depth > maximumPlistDepth)
+        return undefined;
+    skipPlistWhitespace(cursor);
+    if (cursor.contents.startsWith("<string>", cursor.offset)) {
+        const value = parsePlistTextElement(cursor, "string");
+        return value === undefined ? undefined : { kind: "string", value };
+    }
+    for (const tag of ["data", "date", "integer", "real"]) {
+        if (!cursor.contents.startsWith(`<${tag}>`, cursor.offset))
+            continue;
+        const value = parsePlistTextElement(cursor, tag);
+        return value === undefined || !isValidPlistScalarValue(tag, value)
+            ? undefined
+            : { kind: "scalar", value };
+    }
+    if (cursor.contents.startsWith("<array", cursor.offset))
+        return parsePlistArray(cursor, depth);
+    if (cursor.contents.startsWith("<dict", cursor.offset))
+        return parsePlistDictionary(cursor, depth);
+    if (consumePlistToken(cursor, "<true/>"))
+        return { kind: "boolean", value: true };
+    if (consumePlistToken(cursor, "<false/>"))
+        return { kind: "boolean", value: false };
+    return undefined;
+}
+function parsePlistArray(cursor, depth) {
+    if (consumePlistToken(cursor, "<array/>"))
+        return { kind: "array", value: [] };
+    if (!consumePlistToken(cursor, "<array>"))
+        return undefined;
     const values = [];
-    let cursor = 0;
-    for (const match of contents.matchAll(/<string>([\s\S]*?)<\/string>/gu)) {
-        if (contents.slice(cursor, match.index).trim() !== "")
-            return undefined;
-        const value = xmlUnescapeStrict(match[1] ?? "");
+    for (;;) {
+        skipPlistWhitespace(cursor);
+        if (consumePlistToken(cursor, "</array>"))
+            return { kind: "array", value: values };
+        const value = parsePlistValue(cursor, depth + 1);
         if (value === undefined)
             return undefined;
         values.push(value);
-        cursor = match.index + match[0].length;
     }
-    return contents.slice(cursor).trim() === "" ? values : undefined;
 }
-function parseXmlStringDictionary(contents) {
-    const values = {};
-    let cursor = 0;
-    for (const match of contents.matchAll(/<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/gu)) {
-        if (contents.slice(cursor, match.index).trim() !== "")
+function parsePlistDictionary(cursor, depth) {
+    if (consumePlistToken(cursor, "<dict/>"))
+        return { kind: "dictionary", value: new Map() };
+    if (!consumePlistToken(cursor, "<dict>"))
+        return undefined;
+    const values = new Map();
+    for (;;) {
+        skipPlistWhitespace(cursor);
+        if (consumePlistToken(cursor, "</dict>"))
+            return { kind: "dictionary", value: values };
+        const key = parsePlistTextElement(cursor, "key");
+        if (key === undefined || values.has(key))
+            return undefined;
+        const value = parsePlistValue(cursor, depth + 1);
+        if (value === undefined)
+            return undefined;
+        values.set(key, value);
+    }
+}
+function parsePlistTextElement(cursor, tag) {
+    const openingTag = `<${tag}>`;
+    const closingTag = `</${tag}>`;
+    if (!consumePlistToken(cursor, openingTag))
+        return undefined;
+    const closingOffset = cursor.contents.indexOf(closingTag, cursor.offset);
+    if (closingOffset < 0)
+        return undefined;
+    const encoded = cursor.contents.slice(cursor.offset, closingOffset);
+    cursor.offset = closingOffset + closingTag.length;
+    return xmlUnescapeStrict(encoded);
+}
+function normalizePlistXml(contents) {
+    for (const character of contents) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        const isXmlCharacter = codePoint === 0x09
+            || codePoint === 0x0a
+            || codePoint === 0x0d
+            || (codePoint >= 0x20 && codePoint <= 0xd7ff)
+            || (codePoint >= 0xe000 && codePoint <= 0xfffd)
+            || (codePoint >= 0x10000 && codePoint <= 0x10ffff);
+        if (!isXmlCharacter)
+            return undefined;
+    }
+    return contents.replace(/\r\n?/gu, "\n");
+}
+function isValidPlistScalarValue(tag, value) {
+    if (tag === "data") {
+        const compact = value.replace(/[\t\n\r ]/gu, "");
+        return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(compact);
+    }
+    if (tag === "date") {
+        const match = /^(\d{4})-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/u.exec(value);
+        if (match?.[1] === undefined || Number(match[1]) === 0)
+            return false;
+        const timestamp = Date.parse(value);
+        return Number.isFinite(timestamp)
+            && new Date(timestamp).toISOString() === `${value.slice(0, -1)}.000Z`;
+    }
+    if (tag === "integer") {
+        if (!/^[+-]?(?:0|[1-9][0-9]*)$/u.test(value))
+            return false;
+        const parsed = BigInt(value);
+        return parsed >= -(2n ** 63n) && parsed <= (2n ** 63n) - 1n;
+    }
+    return /^[+-]?(?:[0-9]+(?:\.[0-9]*)?|\.[0-9]+)(?:[eE][+-]?[0-9]+)?$/u.test(value)
+        && Number.isFinite(Number(value));
+}
+function skipPlistWhitespace(cursor) {
+    while (/[\t\n\r ]/u.test(cursor.contents[cursor.offset] ?? ""))
+        cursor.offset += 1;
+}
+function consumePlistToken(cursor, token) {
+    if (!cursor.contents.startsWith(token, cursor.offset))
+        return false;
+    cursor.offset += token.length;
+    return true;
+}
+function plistStringValue(value) {
+    return value?.kind === "string" ? value.value : undefined;
+}
+function plistStringArray(value) {
+    if (value?.kind !== "array")
+        return undefined;
+    const strings = [];
+    for (const item of value.value) {
+        if (item.kind !== "string")
             return undefined;
-        const key = xmlUnescapeStrict(match[1] ?? "");
-        const value = xmlUnescapeStrict(match[2] ?? "");
-        if (key === undefined || value === undefined || Object.hasOwn(values, key))
+        strings.push(item.value);
+    }
+    return strings;
+}
+function plistStringDictionary(value) {
+    if (value.kind !== "dictionary")
+        return undefined;
+    const entries = [];
+    for (const [key, item] of value.value) {
+        if (item.kind !== "string")
             return undefined;
-        values[key] = value;
-        cursor = match.index + match[0].length;
+        entries.push([key, item.value]);
     }
-    return contents.slice(cursor).trim() === "" ? values : undefined;
+    return Object.fromEntries(entries);
 }
 function xmlUnescapeStrict(value) {
     if (/[<>]/u.test(value) || /&(?!(?:apos|quot|gt|lt|amp);)/u.test(value))
@@ -472,7 +776,7 @@ function xmlUnescapeStrict(value) {
 function recordsEqual(left, right) {
     const leftEntries = Object.entries(left);
     return leftEntries.length === Object.keys(right).length
-        && leftEntries.every(([key, value]) => right[key] === value);
+        && leftEntries.every(([key, value]) => Object.hasOwn(right, key) && right[key] === value);
 }
 function impossibleMissingDefinition() {
     throw new Error("Expected at least one installed native service definition");