@ours.network/fleet 0.9.5 → 0.9.8

package/dist/session/types.d.ts

@@ -1,10 +1,81 @@
 import type { SessionBackendId } from '../config.js';
 export type SessionReadiness = 'starting' | 'idle' | 'running' | 'awaiting_permission' | 'failed';
+export type TurnOutcome = 'completed' | 'refused' | 'cancelled' | 'failed' | 'inconclusive';
+/**
+ * Two independent facts about one turn, deliberately kept apart:
+ *
+ * - `accepted` — the live session took responsibility for the prompt. It says
+ *   nothing about what the agent then did with it.
+ * - `outcome` / `succeeded` — how the turn TERMINATED. Only `completed` is a
+ *   terminal success. A refusal or a cancellation is a prompt that was
+ *   delivered and then not carried out; every caller that needs the work
+ *   actually done (mail delivery, role startup) must treat it as a failure.
+ *
+ * Collapsing the two is what let a refused wake commit its notification cursor
+ * and a refused startup prompt log the role as up.
+ */
 export interface TurnResult {
     accepted: boolean;
-    outcome: 'completed' | 'refused' | 'cancelled' | 'failed' | 'inconclusive';
+    outcome: TurnOutcome;
+    succeeded: boolean;
     detail?: string;
 }
+/**
+ * Why a control operation failed. The distinctions exist because collapsing
+ * them is what made a busy agent look dead: only `offline` is evidence that the
+ * session is gone, and `timeout` explicitly does NOT say the prompt was lost.
+ */
+export type ControlFailureKind = 'offline' | 'control-unavailable' | 'timeout' | 'rejected' | 'backend';
+export declare class SessionControlError extends Error {
+    readonly kind: ControlFailureKind;
+    constructor(kind: ControlFailureKind, message: string);
+}
+/**
+ * A prompt the live session has taken responsibility for. Interactive callers
+ * stop here: the session has the prompt, and waiting for the turn to finish is
+ * a different question with a different, much longer, timescale.
+ */
+export interface QueuedPrompt {
+    promptId: string;
+    /** Turns already queued ahead of this one. 0 means it starts immediately. */
+    queuedBehind: number;
+    /** The turn's terminal result. Never rejects. */
+    completion: Promise<TurnResult>;
+}
+/**
+ * How a session's process ended.
+ *
+ * `unknown` is the honest answer when no evidence was recorded — the previous
+ * code wrote the word `crash` there, asserting a failure it had not observed.
+ * `session-destroyed` (the console was torn down out from under a live process)
+ * and `program-exit` (the program decided to leave) are different events and
+ * must not collapse into one another, because they imply different next starts.
+ */
+export type ExitClass = 'clean' | 'program-exit' | 'signal' | 'session-destroyed' | 'unknown';
+export interface ExitRecord {
+    version: 1;
+    class: ExitClass;
+    /** Exit code, when the program exited of its own accord. */
+    code?: number;
+    /** Signal that killed it, when one did. */
+    signal?: string;
+    /** Raw wait status as the pane shell saw it (tmux only). */
+    status?: number;
+    at?: string;
+    /** One line an operator can read. */
+    detail: string;
+}
+/**
+ * Classify a shell `$?`. Above 128 the shell is reporting 128+signal — the only
+ * signal evidence a pane wrapper can give us.
+ */
+export declare function classifyShellStatus(status: number): ExitRecord;
+/** Classify a child process exit reported directly by node. */
+export declare function classifyChildExit(code: number | null, signal: string | null): ExitRecord;
+/** The single definition of terminal success. Nothing else may re-derive it. */
+export declare const isTerminalSuccess: (outcome: TurnOutcome) => boolean;
+/** Build a TurnResult with `succeeded` always consistent with `outcome`. */
+export declare function turnResult(accepted: boolean, outcome: TurnOutcome, detail?: string): TurnResult;
 export interface SessionSnapshot {
     backend: SessionBackendId;
     alive: boolean;
@@ -14,6 +85,8 @@ export interface SessionSnapshot {
     pendingPermissionId?: string;
 }
 export type SessionEventKind = 'state' | 'agent_text' | 'thought' | 'tool_call' | 'tool_update' | 'permission' | 'turn_stop' | 'error';
+/** What a settled permission request resolved to. */
+export type PermissionDecision = 'allowed' | 'denied' | 'cancelled';
 export interface SessionEvent {
     version: 1;
     seq: number;
@@ -31,17 +104,35 @@ export interface SessionEvent {
         name: string;
         kind: string;
     }>;
+    /** What was decided. */
+    decision?: PermissionDecision;
+    /** Whether policy decided it, or a human answered the prompt. */
+    decisionSource?: 'automatic' | 'manual';
+    /** The configured policy that produced an automatic decision. */
+    policy?: string;
+    /** Why, in one human-readable line. */
+    reason?: string;
+    /** The option actually selected, when one was. */
+    optionId?: string;
 }
 export interface SessionHandle {
     readonly backend: SessionBackendId;
     readonly pid: number;
     isAlive(): boolean;
     snapshot(): SessionSnapshot;
+    /**
+     * Hand the session a prompt and return as soon as it has accepted
+     * responsibility for it. Throws `SessionControlError` if it cannot.
+     */
+    queuePrompt(text: string): Promise<QueuedPrompt>;
+    /** Queue a prompt and wait for its terminal result. */
     submitPrompt(text: string): Promise<TurnResult>;
     interrupt(): Promise<void>;
     respondPermission(permissionId: string, optionId: string): boolean;
     eventsSince(seq: number): SessionEvent[];
     subscribe(listener: (event: SessionEvent) => void): () => void;
     setControllerAttached(attached: boolean): void;
+    /** How the backing process ended, or null while it is still running. */
+    exitResult(): ExitRecord | null;
     close(): Promise<void>;
 }

package/dist/session/types.js

@@ -1 +1,42 @@
-export {};
+export class SessionControlError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = 'SessionControlError';
+    }
+}
+/**
+ * Classify a shell `$?`. Above 128 the shell is reporting 128+signal — the only
+ * signal evidence a pane wrapper can give us.
+ */
+export function classifyShellStatus(status) {
+    if (!Number.isFinite(status))
+        return { version: 1, class: 'unknown', detail: 'pane wrote an unreadable exit status' };
+    if (status === 0)
+        return { version: 1, class: 'clean', code: 0, status, detail: 'exited cleanly (code 0)' };
+    if (status > 128) {
+        const signal = status - 128;
+        return {
+            version: 1, class: 'signal', signal: `SIG${signal}`, status,
+            detail: `killed by signal ${signal} (shell status ${status})`,
+        };
+    }
+    return { version: 1, class: 'program-exit', code: status, status, detail: `exited with code ${status}` };
+}
+/** Classify a child process exit reported directly by node. */
+export function classifyChildExit(code, signal) {
+    if (signal)
+        return { version: 1, class: 'signal', signal, detail: `killed by ${signal}` };
+    if (code === 0)
+        return { version: 1, class: 'clean', code: 0, detail: 'exited cleanly (code 0)' };
+    if (code === null)
+        return { version: 1, class: 'unknown', detail: 'the process ended with neither a code nor a signal' };
+    return { version: 1, class: 'program-exit', code, detail: `exited with code ${code}` };
+}
+/** The single definition of terminal success. Nothing else may re-derive it. */
+export const isTerminalSuccess = (outcome) => outcome === 'completed';
+/** Build a TurnResult with `succeeded` always consistent with `outcome`. */
+export function turnResult(accepted, outcome, detail) {
+    return { accepted, outcome, succeeded: isTerminalSuccess(outcome), detail };
+}

package/dist/spawn.d.ts

@@ -1,5 +1,12 @@
+import type { IsolationConfig } from './isolation/types.js';
 import { type ApprovalMode, type FilesystemMode, type SessionBackendId, type UnattendedMode } from './config.js';
 import { type OpsDeps } from './ops.js';
+import { type CreationDeps, type CreationProvenance } from './creation.js';
+/**
+ * The provenance record written by the most recent spawn in this process, so
+ * the CLI can print the same summary it persisted rather than rebuilding it.
+ */
+export declare let lastProvenance: CreationProvenance | undefined;
 export interface SpawnOpts {
     name: string;
     temp?: boolean;
@@ -23,12 +30,30 @@ export interface SpawnOpts {
     monitor?: boolean;
     bioFile?: string;
     personaFile?: string;
+    /**
+     * Path to a file holding exactly the existing `isolation:` mapping — the same
+     * schema fleet.yaml uses, not a second policy language. The ONE new operator
+     * input in this release (6.3).
+     */
+    isolationFile?: string;
     overseeInterval?: string;
     configPath?: string;
 }
+/**
+ * Read and validate an `--isolation-file`. The file is the existing
+ * `isolation:` mapping and nothing else — the same schema, the same validator
+ * (`validateIsolationConfig`), so a policy written here cannot mean something
+ * different from the identical block in fleet.yaml.
+ *
+ * Called BEFORE the creation transaction reserves anything: an invalid file
+ * must fail before any artifact exists.
+ */
+export declare function readIsolationFile(path: string): IsolationConfig;
+/** The ours identity a spawn will bind: explicit, else the role name. */
+export declare const effectiveIdentity: (o: SpawnOpts) => string;
 /** Permanent spawn: persist to ~/fleet.d/<Name>.yaml, then bring it up. */
-export declare function spawnPermanent(o: SpawnOpts, deps: OpsDeps): Promise<string>;
+export declare function spawnPermanent(o: SpawnOpts, deps: OpsDeps, creation?: CreationDeps): Promise<string>;
 /** Launches the detached temp supervisor (`_run-temp <name>`). Injectable for tests. */
 export type SupervisorLauncher = (binPath: string, args: string[], dir: string) => void;
 /** Temp spawn: state under ~/.ours-fleet/tmp, plain tmux, auto-clean on exit. */
-export declare function spawnTemp(o: SpawnOpts, binPath: string, launch?: SupervisorLauncher): Promise<string>;
+export declare function spawnTemp(o: SpawnOpts, binPath: string, launch?: SupervisorLauncher, creation?: CreationDeps): Promise<string>;

package/dist/spawn.js

@@ -1,11 +1,19 @@
 import { spawn as spawnChild } from 'node:child_process';
-import { existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { stringify } from 'yaml';
+import { parse, stringify } from 'yaml';
 import { agentDir, fleetDDir } from './paths.js';
+import { validateIsolationConfig } from './isolation/policy.js';
 import { loadConfig, resolveMonitorConfig, resolvePermissions, } from './config.js';
 import { applyRole, up } from './ops.js';
 import { START_STAGGER_FILE } from './runner.js';
+import { buildProvenance, daemonIdentityProvisioner, ensureIdentity, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
+import { VERSION } from './version.js';
+/**
+ * The provenance record written by the most recent spawn in this process, so
+ * the CLI can print the same summary it persisted rather than rebuilding it.
+ */
+export let lastProvenance;
 function roleFromOpts(o, defaultHarness) {
     const r = {};
     if (o.harness)
@@ -53,8 +61,35 @@ function roleFromOpts(o, defaultHarness) {
         r.bio = readFileSync(o.bioFile, 'utf8').trim();
     if (o.personaFile)
         r.persona = readFileSync(o.personaFile, 'utf8').trim();
+    if (o.isolationFile)
+        r.isolation = readIsolationFile(o.isolationFile);
     return r;
 }
+/**
+ * Read and validate an `--isolation-file`. The file is the existing
+ * `isolation:` mapping and nothing else — the same schema, the same validator
+ * (`validateIsolationConfig`), so a policy written here cannot mean something
+ * different from the identical block in fleet.yaml.
+ *
+ * Called BEFORE the creation transaction reserves anything: an invalid file
+ * must fail before any artifact exists.
+ */
+export function readIsolationFile(path) {
+    let raw;
+    try {
+        raw = parse(readFileSync(path, 'utf8'));
+    }
+    catch (e) {
+        throw new Error(`--isolation-file ${path}: ${e.message}`);
+    }
+    // A file holding only comments parses to null; treat it as an empty policy,
+    // which is a meaningful request ("sandbox me with defaults").
+    const cfg = (raw ?? {});
+    const problems = validateIsolationConfig(cfg);
+    if (problems.length)
+        throw new Error(`--isolation-file ${path}: ${problems.join('; ')}`);
+    return cfg;
+}
 function validateSpawnOpts(o) {
     if (o.session && !['tmux', 'acp'].includes(o.session))
         throw new Error(`invalid --session '${o.session}'; allowed: tmux, acp`);
@@ -65,6 +100,12 @@ function validateSpawnOpts(o) {
     if (o.unattended && !['deny', 'wait'].includes(o.unattended))
         throw new Error(`invalid --unattended '${o.unattended}'; allowed: deny, wait`);
 }
+/**
+ * Reject names that are already USED. This is a precondition, not a claim: it
+ * runs INSIDE the creation transaction, after both names are reserved, so the
+ * gap between checking and creating that let two spawns both succeed is closed
+ * by the reservation rather than by this function.
+ */
 function assertNameFree(o) {
     const cfg = loadConfig(o.configPath);
     if (cfg.roles.some(r => r.name === o.name))
@@ -72,18 +113,96 @@ function assertNameFree(o) {
     if (existsSync(agentDir(o.name)) || existsSync(agentDir(o.name, true)))
         throw new Error(`agent dir for '${o.name}' already exists — pick another name or 'ours-fleet rm ${o.name}'`);
 }
+/** The ours identity a spawn will bind: explicit, else the role name. */
+export const effectiveIdentity = (o) => o.identity ?? o.name;
+/**
+ * Which settings came from the operator, from fleet defaults, or from a
+ * built-in (6.6). Built while the options are still separable — once they are
+ * merged into a ResolvedRole the distinction is gone.
+ *
+ * `env`, `bio`, `persona` and `harness_options` are deliberately absent: the
+ * record exists to be read, and must not become a place credentials collect.
+ */
+function provenanceSettings(o, defaults) {
+    const perms = (defaults.permissions ?? {});
+    return {
+        harness: provenanceOf(o.harness, defaults.harness, 'claude-code'),
+        session: provenanceOf(o.session, defaults.session, 'tmux'),
+        identity: o.identity
+            ? { value: o.identity, source: 'cli' }
+            : { value: o.name, source: 'built-in' }, // defaults to the role name
+        cwd: provenanceOf(o.cwd, undefined, undefined),
+        model: provenanceOf(o.model?.trim(), defaults.model, undefined),
+        coordinator: provenanceOf(o.coordinator, undefined, undefined),
+        approval: provenanceOf(o.approval, perms.approval, 'ask'),
+        filesystem: provenanceOf(o.filesystem, perms.filesystem, 'workspace'),
+        unattended: provenanceOf(o.unattended, perms.unattended, 'deny'),
+        isolation: o.isolationFile
+            ? { value: 'declared via --isolation-file', source: 'cli' }
+            : { value: defaults.isolation ? 'from fleet defaults' : undefined, source: defaults.isolation ? 'fleet-default' : 'built-in' },
+    };
+}
 /** Permanent spawn: persist to ~/fleet.d/<Name>.yaml, then bring it up. */
-export async function spawnPermanent(o, deps) {
+export async function spawnPermanent(o, deps, creation = {}) {
     validateSpawnOpts(o);
-    assertNameFree(o);
-    const cfg = loadConfig(o.configPath);
-    mkdirSync(fleetDDir(), { recursive: true });
-    const file = join(fleetDDir(), `${o.name}.yaml`);
-    writeFileSync(file, stringify({
-        roles: { [o.name]: roleFromOpts(o, cfg.defaults.harness) },
-    }));
-    await up(loadConfig(o.configPath), [o.name], deps, o.configPath);
-    return file;
+    if (o.isolationFile)
+        readIsolationFile(o.isolationFile); // fail before reserving
+    // Name AND identity reserved together, before anything is written or started
+    // (6.4). A loser of the race creates no config, no state, no service.
+    return withCreationTransaction({ role: o.name, identity: effectiveIdentity(o) }, async (tx) => {
+        assertNameFree(o);
+        const cfg = loadConfig(o.configPath);
+        // Establish the identity BEFORE the service is enabled (7.3), and record
+        // what was actually guaranteed so the briefing can say something true.
+        const guarantee = await ensureIdentity(effectiveIdentity(o), { bio: o.bioFile ? readFileSync(o.bioFile, 'utf8').trim() : undefined,
+            persona: o.personaFile ? readFileSync(o.personaFile, 'utf8').trim() : undefined }, creation.identityProvisioner ?? daemonIdentityProvisioner(), deps.log);
+        if (guarantee.state === 'created')
+            // We minted it; a failed creation must not leave an orphan identity
+            // behind. Only ever removes an identity THIS transaction created.
+            tx.record({
+                stage: `ours identity ${effectiveIdentity(o)}`,
+                undo: async () => {
+                    await creation.identityProvisioner?.remove?.(effectiveIdentity(o));
+                },
+            });
+        mkdirSync(fleetDDir(), { recursive: true });
+        const file = join(fleetDDir(), `${o.name}.yaml`);
+        writeRoleFile(tx, file, stringify({
+            roles: { [o.name]: roleFromOpts(o, cfg.defaults.harness) },
+        }));
+        // `up` materialises the state dir and registers the service. Journal the
+        // dir before it exists so a failure leaves the name genuinely reusable
+        // rather than blocked by a half-built directory.
+        const stateDir = agentDir(o.name);
+        const stateExisted = existsSync(stateDir);
+        tx.record({
+            stage: `state dir ${stateDir}`,
+            undo: () => { if (!stateExisted)
+                rmSync(stateDir, { recursive: true, force: true }); },
+        });
+        // Journal the service registration BEFORE it happens, and undo only the
+        // registrations this transaction actually created (6.2). `registered` is
+        // filled by `up`'s onInstalled hook at the moment each registration is
+        // made — not from its return value, which never arrives when `up` throws
+        // after registering.
+        const registered = [];
+        tx.record({
+            stage: `service registration for ${o.name}`,
+            undo: async () => { for (const n of registered)
+                await deps.backend.uninstall(n); },
+        });
+        // Provenance is written BEFORE the role starts, so a role that fails to
+        // launch still records how it was asked for (6.6).
+        const provenance = buildProvenance({
+            role: o.name, lifetime: 'permanent', fleetVersion: VERSION,
+            settings: provenanceSettings(o, cfg.defaults),
+        });
+        mkdirSync(agentDir(o.name), { recursive: true });
+        writeProvenance(agentDir(o.name), provenance);
+        await up(loadConfig(o.configPath), [o.name], { ...deps, onInstalled: outcome => registered.push(outcome.role) }, o.configPath, guarantee.state);
+        lastProvenance = provenance;
+        return file;
+    }, creation);
 }
 const detachedSupervisor = (binPath, args, dir) => {
     // Log to the temp dir; the fd stays valid even after runTemp removes the dir.
@@ -95,8 +214,19 @@ const detachedSupervisor = (binPath, args, dir) => {
     child.unref();
 };
 /** Temp spawn: state under ~/.ours-fleet/tmp, plain tmux, auto-clean on exit. */
-export async function spawnTemp(o, binPath, launch = detachedSupervisor) {
+export async function spawnTemp(o, binPath, launch = detachedSupervisor, creation = {}) {
     validateSpawnOpts(o);
+    if (o.isolationFile)
+        readIsolationFile(o.isolationFile); // fail before reserving
+    // Temporary roles go through the SAME reservation boundary as permanent ones
+    // (6.4): a temp agent competes for the same names.
+    return withCreationTransaction({ role: o.name, identity: effectiveIdentity(o) }, async (tx) => {
+        const guarantee = await ensureIdentity(effectiveIdentity(o), { bio: o.bioFile ? readFileSync(o.bioFile, 'utf8').trim() : undefined,
+            persona: o.personaFile ? readFileSync(o.personaFile, 'utf8').trim() : undefined }, creation.identityProvisioner ?? daemonIdentityProvisioner(), creation.log);
+        return spawnTempInner(o, binPath, launch, tx, guarantee);
+    }, creation);
+}
+async function spawnTempInner(o, binPath, launch, tx, guarantee) {
     assertNameFree(o);
     const cfg = loadConfig(o.configPath);
     const defaultHarness = cfg.defaults.harness;
@@ -106,7 +236,7 @@ export async function spawnTemp(o, binPath, launch = detachedSupervisor) {
         ...(fromOpts.harness_options ?? {}),
     };
     const role = {
-        ...fromOpts,
+        ...fromOpts, // includes `isolation` when --isolation-file was given
         name: o.name,
         harness: o.harness ?? defaultHarness ?? 'claude-code',
         session: o.session ?? cfg.defaults.session ?? 'tmux',
@@ -114,11 +244,19 @@ export async function spawnTemp(o, binPath, launch = detachedSupervisor) {
         model: o.model?.trim() || cfg.defaults.model,
         harness_options: Object.keys(mergedHarnessOptions).length ? mergedHarnessOptions : undefined,
         permissions: resolvePermissions(cfg.defaults.permissions, fromOpts.permissions),
+        permissionsDeclared: fromOpts.permissions !== undefined || cfg.defaults.permissions !== undefined,
         // Temp agents inherit the fleet-wide monitor defaults via the snapshot (design §2).
         monitor: resolveMonitorConfig(cfg.defaults.monitor, fromOpts.monitor),
         sourceFile: '(temp)',
     };
-    const dir = applyRole(role, { temp: true });
+    const dir = applyRole(role, { temp: true, identityGuarantee: guarantee.state });
+    const provenance = buildProvenance({
+        role: o.name, lifetime: 'temporary', fleetVersion: VERSION,
+        settings: provenanceSettings(o, cfg.defaults),
+    });
+    writeProvenance(dir, provenance);
+    lastProvenance = provenance;
+    tx.record({ stage: `temp state dir ${dir}`, undo: () => rmSync(dir, { recursive: true, force: true }) });
     writeFileSync(join(dir, 'role.yaml'), stringify(role));
     // Snapshot the fleet start-stagger so the detached temp supervisor (no config path
     // threaded through it) honors the same launch gate — a burst of temp spawns spaces

package/dist/supervisor/launchd.d.ts

@@ -1,4 +1,54 @@
 import { type Exec } from '../exec.js';
 import type { SupervisorBackend } from './types.js';
 export declare const labelFor: (name: string) => string;
+/**
+ * What `launchctl print` said about a job, parsed ONCE so that the two questions
+ * asked of it cannot drift apart. They are not the same question:
+ *
+ * - `liveness` asks "does this role's context still exist" — a loaded job counts,
+ *   including one waiting between KeepAlive restarts (1.1);
+ * - `install` asks "did the job I just bootstrapped actually START" — for which a
+ *   job that is loaded, not running, and has already exited once is a failure.
+ *
+ * On systemd one `ActiveState` answers both. Here the answers differ, so what is
+ * shared is the READING of launchd's output, not its classification.
+ */
+export interface LaunchdJob {
+    /** `launchctl print` exited 0 — the job is loaded in the domain. */
+    loaded: boolean;
+    /** launchd's own `state = …`, e.g. `running`, `waiting`, `not running`. */
+    state?: string;
+    /**
+     * `last exit code|status|reason = …`. Present only once the program has RUN
+     * and exited — which is what separates "died" from "has not started yet".
+     */
+    lastExit?: string;
+    /** The domain has no such service: a definite negative, not a failed probe. */
+    notFound: boolean;
+    /** Why the probe itself could not be read, when it could not. */
+    failure?: string;
+}
+/**
+ * Did the job we just bootstrapped actually start?
+ *
+ * `launchctl bootstrap` exits 0 once the job is LOADED. With `RunAtLoad` the
+ * program then starts asynchronously, so a zero exit is a statement about the
+ * load, not about the program — the same shape of lie that `systemctl enable
+ * --now` tells on systemd 255, where the exit code is 0 and the unit is dead.
+ *
+ * Only a DEFINITE stop counts as a failed start, exactly as on systemd:
+ *
+ * - not loaded at all, though bootstrap said it worked → definite;
+ * - loaded, `state` is not running, AND launchd already has an exit status for
+ *   it → it ran and died → definite;
+ * - loaded and running, or waiting for a KeepAlive restart, or not running with
+ *   nothing exited yet (it simply has not been spawned yet — the asynchrony
+ *   RunAtLoad introduces) → NOT a failure;
+ * - an unreadable probe → `unknown`, never a failure (1.1). launchd may be fine
+ *   and the tool merely unable to answer.
+ */
+export declare function classifyStart(job: LaunchdJob): {
+    started: 'yes' | 'no' | 'unknown';
+    detail: string;
+};
 export declare function makeLaunchdBackend(exec?: Exec, uid?: number): SupervisorBackend;