@monster-orange/den 0.4.20 → 0.4.22

package/src/shared/github-device.ts

@@ -56,11 +56,27 @@ export interface GithubIdentity {
   login: string;
 }
 
-/** The three calls, swappable in a unit test. */
+/**
+ * Whether a login is a member of an org (D17), as far as its own token can
+ * tell: `member`, `not_member`, or `unreadable` (the membership is private
+ * and this token may not read it: the app lacks the org's Members
+ * permission, or isn't installed there).
+ */
+export type OrgMembership = "member" | "not_member" | "unreadable";
+
+/** The calls, swappable in a unit test. */
 export interface GithubDeviceClient {
   start(clientId: string): Promise<DeviceCode>;
   poll(clientId: string, deviceCode: string): Promise<PollResult>;
   user(token: string): Promise<GithubIdentity>;
+  /**
+   * D17: is `login` (the token's own account) a member of `org`? First its
+   * own membership (`GET /user/memberships/orgs/<org>`, which a GitHub App
+   * reads with the org's Members permission), then the public list (`GET
+   * /orgs/<org>/members/<login>`: 204 for a public member). A network
+   * failure throws.
+   */
+  orgMember(token: string, org: string, login: string): Promise<OrgMembership>;
 }
 
 const TIMEOUT_MS = 15_000;
@@ -218,6 +234,27 @@ export function githubDeviceClient(
         throw new Error(`GitHub's /user answered ${r.status}`);
       return { id: j.id, login: j.login };
     },
+    async orgMember(token, org, login) {
+      const headers = {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "x-github-api-version": "2022-11-28",
+      };
+      const own = await request(
+        `${ep.api}/user/memberships/orgs/${encodeURIComponent(org)}`,
+        { method: "GET", headers },
+      );
+      if (own.status === 200)
+        return parse(own.body).state === "active" ? "member" : "not_member";
+      const pub = await request(
+        `${ep.api}/orgs/${encodeURIComponent(org)}/members/${encodeURIComponent(login)}`,
+        { method: "GET", headers },
+      );
+      if (pub.status === 204) return "member";
+      // A 404 for its own membership means none; a 403 means this token
+      // may not read it, so a private membership can't be told apart.
+      return own.status === 404 ? "not_member" : "unreadable";
+    },
   };
 }
 

package/src/shared/launchd-session.ts

@@ -0,0 +1,92 @@
+/**
+ * D20: the launchd session a process runs in, as `launchctl managername`
+ * names it. It decides what survives a logout:
+ *
+ *   Aqua, LoginWindow  the desktop login session (gui/<uid>): ends when the
+ *                      person logs out, with every process in it.
+ *   Background         outside it (an ssh shell, user/<uid>): keeps running
+ *                      after logout, but has no login keychain and no GUI
+ *                      (headed apps, WebKit on macOS).
+ *   System             a LaunchDaemon: as Background.
+ *
+ * A child inherits its parent's session, so a session host started from
+ * the desktop dies at logout with every agent in it. Off macOS there is no
+ * such thing (null).
+ */
+import { spawnSync } from "child_process";
+
+/**
+ * `service install --mode always` is opt-in: it is meant to keep the
+ * server, the host and every agent running across a logout, but no logout
+ * has proven it yet. Every place that offers it says so.
+ */
+export const ALWAYS_UNPROVEN = "not yet proven across a logout";
+
+export type LaunchctlRunner = () => { status: number | null; stdout: string };
+
+const defaultRunner: LaunchctlRunner = () => {
+  const r = spawnSync("launchctl", ["managername"], {
+    encoding: "utf-8",
+    timeout: 2000,
+  });
+  return { status: r.status, stdout: r.stdout ?? "" };
+};
+
+/** `launchctl managername`, or "unknown"; null off macOS. */
+export function readLaunchdSession(
+  run: LaunchctlRunner = defaultRunner,
+  platform: NodeJS.Platform = process.platform,
+): string | null {
+  if (platform !== "darwin") return null;
+  try {
+    const r = run();
+    const name = r.status === 0 ? r.stdout.trim() : "";
+    // Only a plain word: it is shown and stored as-is.
+    return /^[A-Za-z]{1,32}$/.test(name) ? name : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+let cached: string | null | undefined;
+
+/** This process's launchd session (it never changes, so asked once). */
+export function launchdSession(): string | null {
+  if (cached === undefined) cached = readLaunchdSession();
+  return cached;
+}
+
+/**
+ * D20: `web up` from a shell outside the desktop session (an ssh shell:
+ * Background) starts a server there; say what that means and the right
+ * way. null in the desktop session or off macOS.
+ */
+export function webUpWarning(
+  session: string | null | undefined,
+  cli: string,
+): string | null {
+  if (session !== "Background" && session !== "System") return null;
+  return `this shell runs outside the desktop session (${session}, e.g. ssh): a server started here keeps running after logout but has no login keychain and no GUI, and its agents run here too. To run it as a service: ${cli} service install --mode always (opt-in, ${ALWAYS_UNPROVEN}) or --mode login`;
+}
+
+/** Whether a process in this session ends when the person logs out. */
+export function endsAtLogout(session: string | null | undefined): boolean {
+  return session === "Aqua" || session === "LoginWindow";
+}
+
+/**
+ * The line doctor and the agent page show for `what` (the server, the
+ * session host, an agent) running in `session`: the fix when it ends at
+ * logout, what it lacks when it doesn't. null when there is nothing to say.
+ */
+export function sessionWarning(
+  session: string | null | undefined,
+  cli: string,
+  what: string,
+): string | null {
+  if (endsAtLogout(session))
+    return `the ${what} runs in the desktop login session (${session}): it stops when you log out. To keep it running: ${cli} service install --mode always (opt-in, ${ALWAYS_UNPROVEN})`;
+  if (session === "Background" || session === "System")
+    return `the ${what} keeps running after logout (${session}); it has no login keychain and no GUI, so it uses the 1Password service-account token, headless browsers and Full Disk Access instead`;
+  return null;
+}

package/src/shared/owner-github.ts

@@ -0,0 +1,100 @@
+/**
+ * `web.owner_github` (D17): the GitHub login of the person who runs this
+ * instance, recorded in config/local/user.yml at `web up` or `service
+ * install` from `gh` when it is signed in here and no owner is linked yet.
+ * With it, that person connects their GitHub account from any browser, on
+ * any machine (a devbox they reach from a laptop), and nobody else can
+ * claim the instance from another machine (github-routes.ts decideFlow).
+ *
+ * Only the login is kept: never a token. `gh api user` runs with a short
+ * timeout; gh missing or signed out records nothing.
+ */
+import { execFileSync } from "child_process";
+import { readUserConfig, writeUserConfig } from "./den-config.js";
+import { parseGithubName } from "./web-session.js";
+import { readWebOwner } from "./web-owner.js";
+
+export interface OwnerGithubDeps {
+  /** The login `gh` is signed in as here, or null. */
+  ghLogin?: () => string | null;
+  /** Whether an owner is linked already. */
+  ownerLinked?: () => boolean;
+  read?: typeof readUserConfig;
+  write?: typeof writeUserConfig;
+}
+
+/** `gh api user`'s login, or null (gh missing, signed out, slow, odd output). */
+export function ghLogin(env: NodeJS.ProcessEnv = process.env): string | null {
+  try {
+    const out = execFileSync("gh", ["api", "user", "--jq", ".login"], {
+      env,
+      timeout: 8_000,
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8",
+    }).trim();
+    return parseGithubName(out, "gh api user", "gh") ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export type OwnerGithubResult =
+  | { state: "linked" }
+  | { state: "set"; login: string }
+  | { state: "recorded"; login: string }
+  | { state: "none" };
+
+/**
+ * Record `web.owner_github` from gh when no owner is linked and it isn't
+ * set: `recorded`. Already set: `set`. An owner linked: `linked` (nothing
+ * to do). gh can't say: `none`. Never throws.
+ */
+export function recordOwnerGithub(
+  deps: OwnerGithubDeps = {},
+): OwnerGithubResult {
+  try {
+    if ((deps.ownerLinked ?? (() => readWebOwner() !== null))())
+      return { state: "linked" };
+    const read = deps.read ?? readUserConfig;
+    const cfg = read();
+    const web = { ...((cfg as { web?: Record<string, unknown> }).web ?? {}) };
+    let set: string | undefined;
+    try {
+      set = parseGithubName(
+        web.owner_github,
+        "web.owner_github",
+        "config/local/user.yml",
+      );
+    } catch {
+      return { state: "none" }; // a value someone typed: leave it alone
+    }
+    if (set) return { state: "set", login: set };
+    const login = (deps.ghLogin ?? ghLogin)();
+    if (!login) return { state: "none" };
+    web.owner_github = login;
+    (deps.write ?? writeUserConfig)({ ...cfg, web } as typeof cfg);
+    return { state: "recorded", login };
+  } catch {
+    return { state: "none" };
+  }
+}
+
+/** The line `web up` and `service install` print, or null. */
+export function ownerGithubLine(
+  r: OwnerGithubResult,
+  cli = "den",
+): string | null {
+  if (r.state === "recorded")
+    return `GitHub owner: @${r.login} (from gh; web.owner_github in config/local/user.yml). Connect your GitHub account from any browser to sign in.`;
+  if (r.state === "none") return ghNotSignedInHint(cli);
+  return null;
+}
+
+/** No owner, no web.owner_github, and gh can't say who you are: the fix. */
+export function ghNotSignedInHint(cli = "den"): string {
+  return (
+    "GitHub owner: not known, because gh isn't signed in here. " +
+    `Run \`gh auth login\`, then \`${cli} web restart\`; or set web.owner_github: <your GitHub login> in config/local/user.yml. ` +
+    "Then you can connect your GitHub account from any browser."
+  );
+}

package/src/shared/product.ts

@@ -8,6 +8,9 @@
  * distribution root can be found (e.g. help text printed outside a checkout).
  */
 
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse as parseYaml } from "yaml";
 import { getDistRoot } from "./paths.js";
 import {
   loadProfile,
@@ -17,7 +20,11 @@ import {
 } from "./profile.js";
 
 export interface Product extends ProductProfile {
-  /** Display name: the name with its first letter upper-cased ("Den"). */
+  /**
+   * Display name (D11): the org config's brand.name ("Acme Den") when it is
+   * safe to show anywhere (TITLE_SAFE), else the name with its first letter
+   * upper-cased ("Acme-den").
+   */
   title: string;
   /** The YAML manifest file name (".den.yml"). */
   manifestYml: string;
@@ -25,11 +32,43 @@ export interface Product extends ProductProfile {
   manifestJson: string;
 }
 
-function withDerived(p: ProductProfile): Product {
+/**
+ * What a brand.name may hold to be the display title: letters, digits,
+ * spaces, ".", "_" and "-", up to 40. The title is filled into page scripts
+ * (inside "…" and '…' strings) and HTML attributes, so no quote, backslash,
+ * "<" or "&" may reach it (the 0.4.20 hyphen bug's kin).
+ */
+export const TITLE_SAFE = /^[\p{L}\p{N}][\p{L}\p{N} ._-]{0,39}$/u;
+
+/** The name, first letter upper-cased: "acme-den" → "Acme-den". */
+export function nameTitle(name: string): string {
+  return name.charAt(0).toUpperCase() + name.slice(1);
+}
+
+/** The org config's brand.name, trimmed, or undefined. Never throws. */
+export function brandNameAt(root: string | null, configFile: string) {
+  if (!root) return undefined;
+  try {
+    const raw = parseYaml(
+      fs.readFileSync(path.join(root, configFile), "utf-8"),
+    ) as { brand?: { name?: unknown } } | null;
+    const n = raw?.brand?.name;
+    return typeof n === "string" && n.trim() ? n.trim() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** The display title: a safe brand.name, else nameTitle. */
+export function titleOf(name: string, brandName?: string): string {
+  return brandName && TITLE_SAFE.test(brandName) ? brandName : nameTitle(name);
+}
+
+function withDerived(p: ProductProfile, root: string | null = null): Product {
   const yml = p.manifestFiles[0];
   return {
     ...p,
-    title: p.name.charAt(0).toUpperCase() + p.name.slice(1),
+    title: titleOf(p.name, brandNameAt(root, p.configFile)),
     manifestYml: yml,
     manifestJson: p.manifestFiles[1] ?? yml.replace(/\.ya?ml$/, "") + ".json",
   };
@@ -40,10 +79,11 @@ let derived: { profile: ProductProfile; product: Product } | null = null;
 /** The running product. Never throws. */
 export function product(): Product {
   try {
-    const profile = loadProfile(getDistRoot());
+    const root = getDistRoot();
+    const profile = loadProfile(root);
     // Same profile object (loadProfile caches it): same derived names.
     if (derived?.profile !== profile)
-      derived = { profile, product: withDerived(profile) };
+      derived = { profile, product: withDerived(profile, root) };
     return derived.product;
   } catch {
     const pinned = process.env.DEN_PROFILE?.trim();

package/src/shared/profile.ts

@@ -58,6 +58,13 @@ interface RawProduct {
 }
 
 const SLUG = /^[a-z][a-z0-9-]*$/;
+/**
+ * A path the pages show (config, manifest, services and workspaces dirs):
+ * letters, digits, ".", "_", "-" and "/". The web pages carry these
+ * names as placeholders filled when served (product.ts productTokens), so
+ * a quote, backslash, "$" or "<" in one would break a page's script.
+ */
+const SAFE_PATH = /^[A-Za-z0-9._/-]+$/;
 const PREFIX = /^[A-Z][A-Z0-9_]*$/;
 
 const str = (v: unknown): string | undefined =>
@@ -83,7 +90,7 @@ export function profileFrom(
   const name = str(raw.name) ?? "den";
   if (!SLUG.test(name))
     throw new Error(
-      `den.yml: product.name "${name}" must be lower-case letters, digits and "-"`,
+      `den.yml: product.name "${name}" must be lower-case letters, digits and "-", starting with a letter`,
     );
   const envPrefix =
     str(raw.env_prefix) ?? name.toUpperCase().replace(/-/g, "_");
@@ -91,11 +98,28 @@ export function profileFrom(
     throw new Error(
       `den.yml: product.env_prefix "${envPrefix}" must be upper-case letters, digits and "_"`,
     );
+  const cli = str(raw.cli) ?? name;
+  if (!SLUG.test(cli))
+    throw new Error(
+      `den.yml: product.cli "${cli}" must be lower-case letters, digits and "-", starting with a letter`,
+    );
+  for (const key of [
+    "config",
+    "manifest",
+    "services_dir",
+    "workspaces_dir",
+  ] as const) {
+    const v = str(raw[key]);
+    if (v !== undefined && !SAFE_PATH.test(v))
+      throw new Error(
+        `den.yml: product.${key} "${v}" may use only letters, digits, ".", "_", "-" and "/"`,
+      );
+  }
   const manifest = str(raw.manifest) ?? `.${name}.yml`;
   const json = manifest.replace(/\.ya?ml$/, ".json");
   return {
     name,
-    cli: str(raw.cli) ?? name,
+    cli,
     envPrefix,
     configFile: str(raw.config) ?? `config/${name}.yml`,
     manifestFiles: json === manifest ? [manifest] : [manifest, json],

package/src/shared/sessions/client.ts

@@ -45,6 +45,8 @@ export class HostClient extends EventEmitter {
   private readonly attachments = new Map<string, AttachHandlers>();
   hostPid = 0;
   hostStartedAt = "";
+  /** D20: the host's launchd session (null off macOS or an older host). */
+  hostLaunchd: string | null = null;
 
   constructor(private readonly socket: net.Socket) {
     super();
@@ -117,10 +119,32 @@ export class HostClient extends EventEmitter {
     this.request(op, body).catch(() => undefined);
   }
 
+  /**
+   * D18: the host's executable and whether it has Full Disk Access (null:
+   * cannot tell). null from a host older than 0.4.22.
+   */
+  async access(): Promise<{
+    exe: string;
+    fullDiskAccess: boolean | null;
+  } | null> {
+    try {
+      const r = await this.request("access");
+      return {
+        exe: String(r.exe ?? ""),
+        fullDiskAccess:
+          typeof r.fullDiskAccess === "boolean" ? r.fullDiskAccess : null,
+      };
+    } catch (e) {
+      if (e instanceof HostError && e.code === "bad-request") return null;
+      throw e;
+    }
+  }
+
   async hello(): Promise<void> {
     const r = await this.request("hello");
     this.hostPid = Number(r.pid);
     this.hostStartedAt = String(r.startedAt ?? "");
+    this.hostLaunchd = typeof r.launchd === "string" ? r.launchd : null;
   }
 
   async start(

package/src/shared/sessions/host.ts

@@ -29,6 +29,7 @@ import {
   type Request,
 } from "./protocol.js";
 import type { PtyLoad, PtyProcess } from "./pty.js";
+import { launchdSession } from "../launchd-session.js";
 import {
   SESSION_POOLS,
   SESSION_SIGNALS,
@@ -54,6 +55,14 @@ export interface SessionHostOptions {
   log?: (line: string) => void;
   /** Called after a `shutdown` request has closed the host. */
   onShutdown?: () => void;
+  /** D20: the launchd session it runs in (default: asked; null off macOS). */
+  launchdSession?: string | null;
+  /**
+   * D18: whether this process has Full Disk Access (default: it can list
+   * macOS's TCC folder, which only such a process can; null off macOS).
+   * What it starts inherits it, so the agents have it too.
+   */
+  fullDiskAccess?: () => boolean | null;
 }
 
 interface Session {
@@ -169,6 +178,27 @@ function printableActor(v: unknown): string {
 
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
 
+/**
+ * D18: Full Disk Access, as macOS grants it to this executable: only such
+ * a process may list ~/Library/Application Support/com.apple.TCC. null off
+ * macOS, or when the folder is not there to ask.
+ */
+export function hasFullDiskAccess(
+  home: string = process.env.HOME ?? "",
+  platform: NodeJS.Platform = process.platform,
+): boolean | null {
+  if (platform !== "darwin" || !home) return null;
+  try {
+    fs.readdirSync(
+      path.join(home, "Library", "Application Support", "com.apple.TCC"),
+    );
+    return true;
+  } catch (e) {
+    const code = (e as NodeJS.ErrnoException).code;
+    return code === "EPERM" || code === "EACCES" ? false : null;
+  }
+}
+
 export class SessionHost {
   readonly paths: SessionPaths;
   private readonly sessions = new Map<string, Session>();
@@ -176,9 +206,17 @@ export class SessionHost {
   private server: net.Server | null = null;
   private readonly startedAt = new Date().toISOString();
   private closed = false;
+  /** D20: where it runs; stamped on every session it starts. */
+  private readonly launchd: string | null;
 
   constructor(private readonly opts: SessionHostOptions) {
     this.paths = sessionPaths(opts.stateDir);
+    const where =
+      opts.launchdSession !== undefined
+        ? opts.launchdSession
+        : launchdSession();
+    // "unknown" (launchctl said nothing) is no stamp at all.
+    this.launchd = where === "unknown" ? null : where;
   }
 
   private log(line: string): void {
@@ -189,6 +227,34 @@ export class SessionHost {
     return this.opts.scrollbackBytes ?? DEFAULT_SCROLLBACK_BYTES;
   }
 
+  /**
+   * Calls `onGone` once its state dir no longer exists (checked every
+   * `everyMs`): nothing it owns can be kept any more, so the host should
+   * end. A test that deletes its temp state dir no longer leaves a host
+   * running; a real install never deletes its state dir under a running
+   * host. Returns a stop function.
+   */
+  watchStateDir(everyMs: number, onGone: () => void): () => void {
+    const t = setInterval(() => {
+      if (fs.existsSync(this.opts.stateDir)) return;
+      clearInterval(t);
+      onGone();
+    }, everyMs);
+    t.unref();
+    return () => clearInterval(t);
+  }
+
+  /**
+   * D18: serve once no other host answers on the socket, checking every
+   * `everyMs`; resolves once it listens.
+   */
+  async listenWhenFree(everyMs: number): Promise<"listening"> {
+    for (;;) {
+      if ((await this.listen()) === "listening") return "listening";
+      await sleep(everyMs);
+    }
+  }
+
   /** Serve on the socket, or stand down when a host already answers there. */
   async listen(): Promise<"listening" | "already-running"> {
     const { socket } = this.paths;
@@ -293,6 +359,7 @@ export class SessionHost {
           exited?: boolean;
           exitCode?: number;
           prompted?: boolean;
+          launchd?: unknown;
         };
         if (typeof rec.id !== "string" || typeof rec.name !== "string")
           continue;
@@ -308,6 +375,10 @@ export class SessionHost {
               ? { exitCode: rec.exitCode }
               : {}),
             ...(rec.prompted === true ? { prompted: true } : {}),
+            ...(typeof rec.launchd === "string" &&
+            /^[A-Za-z]{1,32}$/.test(rec.launchd)
+              ? { launchd: rec.launchd }
+              : {}),
           },
           cwd: rec.cwd,
           pty: null,
@@ -338,6 +409,7 @@ export class SessionHost {
       ...(s.info.exited ? { exited: true } : {}),
       ...(s.info.exitCode !== undefined ? { exitCode: s.info.exitCode } : {}),
       ...(s.info.prompted ? { prompted: true } : {}),
+      ...(s.info.launchd ? { launchd: s.info.launchd } : {}),
     };
     try {
       fs.writeFileSync(
@@ -419,6 +491,7 @@ export class SessionHost {
           v: PROTOCOL_VERSION,
           pid: process.pid,
           startedAt: this.startedAt,
+          launchd: this.launchd,
         };
       case "list":
         return {
@@ -498,6 +571,12 @@ export class SessionHost {
         this.forget(s);
         return {};
       }
+      case "access":
+        // D18: what this host (and every agent in it) may reach.
+        return {
+          exe: process.execPath,
+          fullDiskAccess: (this.opts.fullDiskAccess ?? hasFullDiskAccess)(),
+        };
       default:
         throw new Refusal("bad-request", `unknown op "${String(req.op)}"`);
     }
@@ -607,6 +686,7 @@ export class SessionHost {
         name,
         pid: pty.pid,
         startedAt: new Date().toISOString(),
+        ...(this.launchd ? { launchd: this.launchd } : {}),
       },
       cwd,
       pty,
@@ -712,7 +792,19 @@ export class SessionHost {
  * already running; 1 when it cannot listen.
  */
 export async function runSessionHost(
-  opts: Omit<SessionHostOptions, "onShutdown">,
+  opts: Omit<SessionHostOptions, "onShutdown"> & {
+    /**
+     * D18: the launchd job's host. While another host answers on the
+     * socket (one started before the job, from a terminal or the web
+     * server), wait for it to end, then serve, instead of exiting at once
+     * (launchd would restart it every few seconds). Checks every
+     * standByMs (default 5 s).
+     */
+    standBy?: boolean;
+    standByMs?: number;
+    /** How often it checks its state dir still exists (default 10 s). */
+    stateDirCheckMs?: number;
+  },
 ): Promise<number> {
   const log =
     opts.log ??
@@ -729,15 +821,32 @@ export async function runSessionHost(
     log(`session host could not start: ${(e as Error).message}`);
     return 1;
   }
-  if (state === "already-running") {
+  const stop = () => void host.close().then(() => process.exit(0));
+  if (state === "already-running" && opts.standBy) {
+    process.on("SIGTERM", stop);
+    process.on("SIGINT", stop);
+    log(
+      `a session host is already running on ${host.paths.socket}: standing by until it ends (its sessions keep running there)`,
+    );
+    try {
+      state = await host.listenWhenFree(opts.standByMs ?? 5000);
+    } catch (e) {
+      log(`session host could not start: ${(e as Error).message}`);
+      return 1;
+    }
+  } else if (state === "already-running") {
     log(`a session host is already running on ${host.paths.socket}`);
     return 0;
+  } else {
+    process.on("SIGTERM", stop);
+    process.on("SIGINT", stop);
   }
-  const stop = () => void host.close().then(() => process.exit(0));
-  process.on("SIGTERM", stop);
-  process.on("SIGINT", stop);
   // No terminal to hang up on: it was started detached.
   process.on("SIGHUP", () => undefined);
   log(`session host ${process.pid} listening on ${host.paths.socket}`);
+  host.watchStateDir(opts.stateDirCheckMs ?? 10_000, () => {
+    log(`its state dir ${opts.stateDir} is gone: stopping`);
+    stop();
+  });
   return 0;
 }

package/src/shared/sessions/types.ts

@@ -30,6 +30,11 @@ export interface SessionInfo {
    * starts afresh instead. Never what was typed.
    */
   prompted?: boolean;
+  /**
+   * D20: the launchd session its host ran in (`launchctl managername`):
+   * Aqua ends at logout, Background survives it. Absent off macOS.
+   */
+  launchd?: string;
 }
 
 /**