@outerlayer/cli 0.24.0 → 0.25.1

package/dist/command-DKYZC7PH.js

@@ -0,0 +1,533 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { runRunnerInstall, launcherSummary, restartNote } from './chunk-QXNJWSTM.js';
+import './chunk-ATGHVEU4.js';
+import { currentLink, execStartCommand } from './chunk-QMQC6JCO.js';
+import { detectMachine } from './chunk-S6AWZKJN.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-ENFBARQP.js';
+import './chunk-5222PA6S.js';
+import './chunk-TQMI335S.js';
+import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-IGRRD7PX.js';
+import './chunk-Q435LWVN.js';
+import './chunk-DEBOL6ON.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-OGFGZQA3.js';
+import { readJobFile } from './chunk-N3VSI5ZI.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-APBTVIM4.js';
+import './chunk-HPOEVC2V.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-3FNPTQRH.js';
+import './chunk-CQRIZNE6.js';
+import './chunk-3WZ5ECSM.js';
+import './chunk-SNQR2EYI.js';
+import './chunk-BUP5N3X6.js';
+import './chunk-XSPA5ODY.js';
+import './chunk-GOSFARMS.js';
+import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-JWRX5ZTT.js';
+import './chunk-UXYLWVTQ.js';
+import './chunk-7RQ73DLO.js';
+import { realLima } from './chunk-77MM5RYD.js';
+import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
+import './chunk-FXUVXSY2.js';
+import './chunk-MQ743JX3.js';
+import './chunk-M4B6QKNZ.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-VPEGE3QZ.js';
+import './chunk-HCVLP7XA.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-QE3UQAHK.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
+import './chunk-WZBHBH3J.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-RKOTJQVG.js';
+import './chunk-QZBXLLTV.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-RA3O54FC.js';
+import './chunk-ZODVSFI4.js';
+import { runnerDir } from './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
+import './chunk-Z5GEFMRW.js';
+import { userInfo, totalmem, tmpdir } from 'os';
+import { join, dirname } from 'path';
+import { createHash } from 'crypto';
+import { rmSync, existsSync, readdirSync, mkdtempSync, writeFileSync, readFileSync, statSync, lstatSync } from 'fs';
+import { spawnSync } from 'child_process';
+
+createRequire(import.meta.url);
+var LIBEXEC = "/usr/local/libexec/outerlayer";
+var ETC = "/etc/outerlayer";
+var UID_BASE = 2e9;
+var UID_COUNT = 256;
+var UID_ATTEMPTS = 8;
+function helperUnitFor(unitName) {
+  return `${unitName}-helper`;
+}
+function helperDirFor(unitName) {
+  return `${LIBEXEC}/${helperUnitFor(unitName)}`;
+}
+function helperSocketFor(unitName) {
+  return helperSocketPath(unitName);
+}
+function helperConfigPathFor(unitName) {
+  return `${ETC}/${helperUnitFor(unitName)}.json`;
+}
+function helperUnitPathFor(unitName) {
+  return `/etc/systemd/system/${helperUnitFor(unitName)}.service`;
+}
+function sha256Of(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function helperUnitText(unitName) {
+  const unit = helperUnitFor(unitName);
+  return `${UNIT_MARKER}
+[Unit]
+Description=OuterLayer root helper: starts microVM builds under Firecracker's jailer
+After=local-fs.target
+
+[Service]
+ExecStart=${helperDirFor(unitName)}/outerlayer-host-helper --config ${helperConfigPathFor(unitName)}
+RuntimeDirectory=${unit}
+RuntimeDirectoryMode=0755
+RuntimeDirectoryPreserve=yes
+Restart=on-failure
+RestartSec=5
+KillMode=process
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function helperConfigText(input) {
+  const dir = helperDirFor(input.unitName);
+  return `${JSON.stringify(
+    {
+      runnerUid: input.uid,
+      runnerGid: input.gid,
+      buildsRoot: input.buildsRoot,
+      jailBase: input.jailBase,
+      stateDir: `/run/${helperUnitFor(input.unitName)}/state`,
+      socket: helperSocketFor(input.unitName),
+      uidBase: input.uidBase,
+      uidCount: UID_COUNT,
+      jailer: { path: `${dir}/jailer`, sha256: input.pins.jailer },
+      firecracker: { path: `${dir}/firecracker`, sha256: input.pins.firecracker },
+      firecrackerVersion: input.pins.firecrackerVersion
+    },
+    null,
+    2
+  )}
+`;
+}
+function notInstalled(ok, lines) {
+  return { ok, installed: false, lines };
+}
+async function installHelper(request, deps) {
+  const { helper } = deps;
+  const lines = [];
+  const say = deps.say ?? ((line) => void lines.push(line));
+  const unit = helperUnitFor(request.unitName);
+  const dir = helperDirFor(request.unitName);
+  const configFile = helperConfigPathFor(request.unitName);
+  const without = "microVM builds run Firecracker as the runner's account, as they did before";
+  if (!deps.systemd.running()) return notInstalled(true, [`systemd is not running, so the root helper is not installed: ${without}`]);
+  if (helper.pins.helper === void 0) {
+    return notInstalled(true, [`this release of the CLI pins no root helper, so none is installed: ${without}`]);
+  }
+  const identity = helper.identity(request.user);
+  if (identity === void 0) return notInstalled(false, [`the account ${request.user} was not found, so the root helper was not installed`]);
+  const runner = runnerDir(request.configPath);
+  const buildsRoot = join(runner, "builds");
+  const jailBase = helper.jailBase(buildsRoot, request.unitName);
+  if (jailBase === void 0) {
+    return notInstalled(true, [
+      `no directory that only root can write, below only such directories, is on the same file system as ${buildsRoot}, so the root helper was not installed: it links each build's files into its jail, and a link cannot cross file systems. ${without}`
+    ]);
+  }
+  let uidBase = UID_BASE;
+  for (let attempt = 0; attempt < UID_ATTEMPTS && !helper.uidRangeFree(uidBase, UID_COUNT); attempt++) uidBase += 65536;
+  if (!helper.uidRangeFree(uidBase, UID_COUNT)) return notInstalled(true, [`every range of ${UID_COUNT} user ids that was tried is used by an account or a group, so the root helper was not installed: ${without}`]);
+  let assets;
+  let helperBytes;
+  try {
+    assets = await helper.assets(runner);
+    helperBytes = await helper.fetchHelper();
+  } catch (err) {
+    return notInstalled(false, [`the files for the root helper could not be had: ${err instanceof Error ? err.message : String(err)}`]);
+  }
+  if (sha256Of(helperBytes) !== helper.pins.helper) {
+    return notInstalled(false, [`the root helper that was downloaded has sha256 ${sha256Of(helperBytes)}, not the ${helper.pins.helper} this release pins, so it was not installed`]);
+  }
+  const config = helperConfigText({ unitName: request.unitName, uid: identity.uid, gid: identity.gid, buildsRoot, jailBase, uidBase, pins: helper.pins });
+  const unitPath = helperUnitPathFor(request.unitName);
+  const existed = deps.systemd.read(unitPath) !== void 0;
+  const staged = helper.stage({ "outerlayer-host-helper": helperBytes, "helper.json": config });
+  const root = (argv) => {
+    say(`sudo ${argv.join(" ")}`);
+    const result = helper.root(argv);
+    if (result.status !== 0) lines.push(`sudo ${argv.join(" ")} failed with exit status ${result.status}`);
+    return result.status === 0;
+  };
+  const systemctl = (args) => {
+    say(`sudo systemctl ${args.join(" ")}`);
+    return deps.systemd.systemctl(args, { sudo: true }).status === 0;
+  };
+  const removeFiles = () => {
+    helper.root(["rm", "-rf", dir]);
+    helper.root(["rm", "-f", configFile]);
+  };
+  const discard = () => {
+    if (existed) systemctl(["disable", "--now", unit]);
+    if (deps.systemd.read(unitPath) !== void 0) {
+      deps.systemd.remove(unitPath);
+      systemctl(["daemon-reload"]);
+    }
+    removeFiles();
+  };
+  try {
+    const copies = [
+      { from: join(staged.dir, "outerlayer-host-helper"), to: `${dir}/outerlayer-host-helper`, pin: helper.pins.helper, what: "helper" },
+      { from: assets.jailer, to: `${dir}/jailer`, pin: helper.pins.jailer, what: "jailer" },
+      { from: assets.firecracker, to: `${dir}/firecracker`, pin: helper.pins.firecracker, what: "Firecracker" }
+    ];
+    const ok = root(["install", "-d", "-o", "root", "-g", "root", "-m", "0755", dir]) && root(["install", "-d", "-o", "root", "-g", "root", "-m", "0755", ETC]) && root(["install", "-d", "-o", "root", "-g", "root", "-m", "0755", jailBase]) && copies.every((copy) => root(["install", "-o", "root", "-g", "root", "-m", "0755", copy.from, copy.to])) && root(["install", "-o", "root", "-g", "root", "-m", "0644", join(staged.dir, "helper.json"), configFile]);
+    if (!ok) {
+      if (existed) lines.push(`the root helper ${unit} is installed, so its files were left in place`);
+      else removeFiles();
+      return notInstalled(false, lines);
+    }
+    for (const copy of copies) {
+      const bytes = helper.readFile(copy.to);
+      if (bytes === void 0 || sha256Of(bytes) !== copy.pin) {
+        discard();
+        return notInstalled(false, [...lines, `the ${copy.what} copied to ${copy.to} is not the file this release pins, so the root helper was not installed`]);
+      }
+    }
+    if (helper.readFile(configFile)?.toString("utf8") !== config) {
+      discard();
+      return notInstalled(false, [...lines, `the config copied to ${configFile} is not the one the installer wrote, so the root helper was not installed`]);
+    }
+    const writable = deps.accountCan === void 0 ? void 0 : [dir, ...copies.map((copy) => copy.to), configFile, ETC].find((path) => deps.accountCan(request.user, "-w", path));
+    if (writable !== void 0) {
+      discard();
+      return notInstalled(false, [...lines, `the account ${request.user} can write ${writable}, which root runs or reads, so the root helper was not installed`]);
+    }
+  } finally {
+    staged.remove();
+  }
+  say(`sudo tee ${unitPath}`);
+  try {
+    deps.systemd.write(unitPath, helperUnitText(request.unitName));
+  } catch (err) {
+    if (!existed) removeFiles();
+    return notInstalled(false, [...lines, err instanceof Error ? err.message : String(err)]);
+  }
+  if (!systemctl(["daemon-reload"]) || !systemctl(["enable", "--now", unit]) || existed && !systemctl(["restart", unit])) {
+    if (!existed) discard();
+    lines.push(`the unit ${unit} did not start, so the root helper is not running: ${without}`);
+    return notInstalled(false, lines);
+  }
+  lines.push(`installed and started the root helper ${unit}: it runs as root, starts each microVM build under Firecracker's jailer and does nothing else`);
+  return { ok: true, installed: true, lines };
+}
+function uninstallHelper(request, deps) {
+  const lines = [];
+  const say = deps.say ?? ((line) => void lines.push(line));
+  const unit = helperUnitFor(request.unitName);
+  const unitPath = helperUnitPathFor(request.unitName);
+  const configFile = helperConfigPathFor(request.unitName);
+  const dir = helperDirFor(request.unitName);
+  const config = deps.helper.readFile(configFile);
+  let jailBase;
+  if (config !== void 0) {
+    try {
+      jailBase = JSON.parse(config.toString("utf8")).jailBase;
+    } catch {
+    }
+  }
+  const systemctl = (args) => {
+    say(`sudo systemctl ${args.join(" ")}`);
+    deps.systemd.systemctl(args, { sudo: true });
+  };
+  const root = (argv) => {
+    say(`sudo ${argv.join(" ")}`);
+    deps.helper.root(argv);
+  };
+  const installed = deps.systemd.read(unitPath) !== void 0 || config !== void 0;
+  if (!installed) return { ok: true, installed: false, lines };
+  systemctl(["disable", "--now", unit]);
+  if (deps.systemd.read(unitPath) !== void 0) {
+    say(`sudo rm ${unitPath}`);
+    deps.systemd.remove(unitPath);
+    systemctl(["daemon-reload"]);
+  }
+  root(["rm", "-rf", dir]);
+  root(["rm", "-f", configFile]);
+  if (jailBase !== void 0) root(["rmdir", `${jailBase}/firecracker`, jailBase]);
+  lines.push(`removed the root helper ${unit}`);
+  return { ok: true, installed: false, lines };
+}
+async function serviceInVm(lima, instance, action, options) {
+  const limactl = lima.locate();
+  if (limactl === void 0) {
+    return { ok: false, lines: ["limactl is not installed, and the runner's service lives in the Linux VM it manages. Install Lima with `brew install lima`."] };
+  }
+  const ran = await lima.shell(instance, ["outerlayer", "runner", action, "--service", ...options.extraArgs ?? []]);
+  const lines = [...ran.stdout.split("\n"), ...ran.stderr.split("\n")].map((line) => line.trim()).filter((line) => line !== "");
+  if (ran.status !== 0) return { ok: false, lines: lines.length > 0 ? lines : [`outerlayer runner ${action} --service failed in the VM ${instance} with exit status ${ran.status}`] };
+  if (action === "install") {
+    const path = writeLaunchAgent(options.home, limactl, instance);
+    lines.push(`the VM ${instance} starts at login through ${path}`);
+  } else {
+    rmSync(launchAgentPath(options.home), { force: true });
+    lines.push("removed the launch agent that started the VM at login");
+  }
+  return { ok: true, lines };
+}
+var WSL_CONF = "/etc/wsl.conf";
+function readText(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function sudoWrite(path, text) {
+  const result = spawnSync("sudo", ["tee", path], { input: text, stdio: ["pipe", "ignore", "inherit"] });
+  if (result.status !== 0) throw new Error(`sudo tee ${path} failed with exit status ${result.status}`);
+}
+function realSystemd() {
+  return {
+    running: () => existsSync("/run/systemd/system"),
+    read: readText,
+    write: sudoWrite,
+    remove: (path) => {
+      spawnSync("sudo", ["rm", "-f", path], { stdio: ["inherit", "ignore", "inherit"] });
+    },
+    systemctl: (args, options) => {
+      const result = options?.sudo === true ? spawnSync("sudo", ["systemctl", ...args], { encoding: "utf8", stdio: ["inherit", "pipe", "inherit"] }) : spawnSync("systemctl", args, { encoding: "utf8" });
+      return { status: result.status ?? -1, stdout: result.stdout ?? "" };
+    }
+  };
+}
+function realWslConf() {
+  return { read: () => readText(WSL_CONF), write: (text) => sudoWrite(WSL_CONF, text) };
+}
+function buildsRunningIn(runnerDirPath) {
+  const jobs = join(runnerDirPath, "jobs");
+  if (!existsSync(jobs)) return false;
+  try {
+    return readdirSync(jobs, { withFileTypes: true }).some((entry) => {
+      if (!entry.isDirectory()) return false;
+      const job = readJobFile(join(jobs, entry.name, "job.json"));
+      return job === null || job.outcome === void 0 && job.endedAt === void 0;
+    });
+  } catch {
+    return true;
+  }
+}
+function rootOnlyChain(path) {
+  let current = "/";
+  const parts = path.split("/").filter(Boolean);
+  for (const part of ["", ...parts]) {
+    current = join(current, part);
+    try {
+      const info = lstatSync(current);
+      if (!info.isDirectory() || info.uid !== 0 || (info.mode & 18) !== 0) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+function deviceOf(path) {
+  for (let current = path; ; current = dirname(current)) {
+    try {
+      return statSync(current).dev;
+    } catch {
+      if (dirname(current) === current) return void 0;
+    }
+  }
+}
+function findJailBase(buildsDir, unitName) {
+  const dev = deviceOf(buildsDir);
+  if (dev === void 0) return void 0;
+  const name = `${unitName}-jail`;
+  const candidates = [`/var/lib/outerlayer/${name}`];
+  for (let ancestor = dirname(buildsDir); dirname(ancestor) !== ancestor; ancestor = dirname(ancestor)) candidates.push(join(ancestor, `.${name}`));
+  return candidates.find((candidate) => {
+    const parent = candidate.startsWith("/var/lib/outerlayer/") ? "/var/lib" : dirname(candidate);
+    if (!rootOnlyChain(parent) || deviceOf(parent) !== dev) return false;
+    return !existsSync(candidate) || rootOnlyChain(candidate) && deviceOf(candidate) === dev;
+  });
+}
+function overlaps(start, length, base, count) {
+  return length > 0 && start < base + count && start + length > base;
+}
+function idRangeFree(base, count) {
+  for (const file of ["/etc/passwd", "/etc/group"]) {
+    const text = readText(file);
+    if (text === void 0) return false;
+    for (const line of text.split("\n")) {
+      const fields = line.split(":");
+      if (overlaps(Number(fields[2]), 1, base, count)) return false;
+      if (file === "/etc/passwd" && overlaps(Number(fields[3]), 1, base, count)) return false;
+    }
+  }
+  for (const file of ["/etc/subuid", "/etc/subgid"]) {
+    for (const line of (readText(file) ?? "").split("\n")) {
+      const fields = line.split(":");
+      if (overlaps(Number(fields[1]), Number(fields[2]), base, count)) return false;
+    }
+  }
+  return true;
+}
+function idOf(flag, account) {
+  const result = spawnSync("id", [flag, account], { encoding: "utf8" });
+  const id = Number(result.stdout);
+  return result.status === 0 && Number.isInteger(id) ? id : void 0;
+}
+function realHelperDeps() {
+  const arch = firecrackerArch(process.arch);
+  const pinnedArch = MICROVM_ARCHES.includes(arch) ? arch : void 0;
+  return {
+    pins: {
+      helper: pinnedArch !== void 0 && hostHelperPinned(pinnedArch) ? HOST_HELPER_SHA256[pinnedArch] : void 0,
+      jailer: JAILER_BINARY_SHA256[pinnedArch ?? "x86_64"],
+      firecracker: FIRECRACKER_BINARY_SHA256[pinnedArch ?? "x86_64"],
+      firecrackerVersion: FIRECRACKER_VERSION
+    },
+    assets: (runner) => ensureFirecrackerAndJailer({ runnerDir: runner }),
+    fetchHelper: async () => {
+      const url = `${HOST_HELPER_BASE_URL}/outerlayer-host-helper-${arch}`;
+      const response = await fetch(url, { signal: AbortSignal.timeout(10 * 6e4) });
+      if (!response.ok) throw new Error(`the root helper could not be downloaded from ${url}: the server answered ${response.status}; the root helper is published in the release guest-${HOST_HELPER_ASSETS_VERSION}`);
+      return Buffer.from(await response.arrayBuffer());
+    },
+    root: (argv) => {
+      const result = spawnSync("sudo", argv, { stdio: ["inherit", "ignore", "inherit"] });
+      return { status: result.status ?? -1 };
+    },
+    readFile: (path) => {
+      try {
+        return readFileSync(path);
+      } catch {
+        return void 0;
+      }
+    },
+    identity: (account) => {
+      const uid = account === userInfo().username ? userInfo().uid : idOf("-u", account);
+      const gid = account === userInfo().username ? userInfo().gid : idOf("-g", account);
+      return uid === void 0 || gid === void 0 || uid < 0 || gid < 0 ? void 0 : { uid, gid };
+    },
+    jailBase: findJailBase,
+    uidRangeFree: idRangeFree,
+    stage: (files) => {
+      const dir = mkdtempSync(join(tmpdir(), "outerlayer-helper-"));
+      for (const [name, content] of Object.entries(files)) writeFileSync(join(dir, name), content, { mode: 493 });
+      return { dir, remove: () => rmSync(dir, { recursive: true, force: true }) };
+    }
+  };
+}
+function realServiceDeps() {
+  const platform = detectMachine().platform;
+  return {
+    platform,
+    say: (line) => process.stdout.write(`running: ${line}
+`),
+    systemd: realSystemd(),
+    ...platform === "wsl2" ? { tasks: realTaskScheduler(), wslConf: realWslConf(), distro: process.env.WSL_DISTRO_NAME } : {},
+    usableMemoryBytes: totalmem(),
+    buildsRunning: buildsRunningIn,
+    ...platform === "linux" || platform === "wsl2" ? { helper: realHelperDeps() } : {},
+    // Asked as the account, through sudo, which the unit's own install needs anyway.
+    accountCan: (account, flag, path) => spawnSync("sudo", ["-n", "-u", account, "test", flag, path], { stdio: "ignore" }).status === 0
+  };
+}
+
+// src/runner/service/command.ts
+function accountCannotStart(account, nodePath, entry, can) {
+  if (!can(account, "-x", nodePath)) {
+    return `\u2717 the service would run as ${account}, which cannot execute ${nodePath}, the Node this install runs on. Nothing is set up: run the install as ${account} with a Node it can execute, or install Node where ${account} can reach it`;
+  }
+  if (!can(account, "-r", entry)) {
+    return `\u2717 the service would run as ${account}, which cannot read ${entry}. Nothing is set up: put the runner's config where ${account} can read it, or run the install as ${account}`;
+  }
+  return void 0;
+}
+function vmArgs(input) {
+  return [...input.print === true ? ["--print"] : [], ...input.replace === true ? ["--replace"] : [], ...input.allowDowngrade === true ? ["--allow-downgrade"] : [], ...input.user === void 0 ? [] : ["--user", input.user], ...input.unitName === void 0 ? [] : ["--unit-name", input.unitName]];
+}
+async function installServiceCommand(input, deps = {}) {
+  const vm = runnerVmOf(input.configPath);
+  if (vm !== void 0) {
+    const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "install", { home: input.home, extraArgs: vmArgs(input) });
+    return { ok: result.ok, state: "vm", lines: result.lines };
+  }
+  const config = loadRunnerConfig(input.configPath);
+  let launcherLines = [];
+  let launcherNotes = [];
+  let restartLine;
+  if (input.print !== true && input.layoutInstalled !== true) {
+    const installed = runRunnerInstall({
+      configPath: input.configPath,
+      entryPath: input.entryPath,
+      nodePath: input.nodePath,
+      home: input.home,
+      PATH: process.env.PATH,
+      replace: input.replace,
+      allowDowngrade: input.allowDowngrade,
+      command: "runner install --service"
+    });
+    launcherLines = [launcherSummary(installed.launcher)].filter((line) => line !== void 0);
+    launcherNotes = installed.launcher.notes;
+    restartLine = restartNote(installed);
+  }
+  const account = input.user ?? userInfo().username;
+  const serviceDeps = (deps.service ?? realServiceDeps)();
+  if (input.print !== true && account !== userInfo().username && serviceDeps.accountCan !== void 0) {
+    const entry = join(currentLink(input.configPath), "node_modules", "@outerlayer", "cli", "dist", "index.js");
+    const problem = accountCannotStart(account, input.nodePath, entry, serviceDeps.accountCan);
+    if (problem !== void 0) return { ok: false, state: "refused", lines: [problem] };
+  }
+  const unitName = input.unitName ?? DEFAULT_UNIT_NAME;
+  const usesVm = builtinKind(config.hooks.provision) === "vm";
+  const helper = input.print !== true && usesVm && serviceDeps.helper !== void 0 && serviceDeps.systemd.running() ? await installHelper({ configPath: input.configPath, unitName, user: account }, { ...serviceDeps, helper: serviceDeps.helper }) : void 0;
+  if (helper !== void 0 && !helper.ok) return { ok: false, state: "refused", lines: helper.lines };
+  const outcome = installService(
+    {
+      configPath: input.configPath,
+      hooks: config.hooks,
+      concurrency: config.concurrency,
+      buildMemory: config.build?.memory ?? "8g",
+      timeLimitMinutes: config.timeLimitMinutes,
+      execStart: execStartCommand(input.configPath, input.nodePath),
+      user: account,
+      unitName: input.unitName,
+      print: input.print,
+      replace: input.replace,
+      restart: input.restart,
+      ...helper?.installed === true ? { helperSocket: helperSocketFor(unitName), helperUnit: helperUnitFor(unitName) } : {}
+    },
+    serviceDeps
+  );
+  const restartLines = restartLine !== void 0 && (outcome.state === "current" || outcome.state === "pending-restart") ? [restartLine] : [];
+  return { ok: outcome.ok, state: outcome.state, lines: [...helper?.lines ?? [], ...outcome.lines, ...outcome.ok ? [...restartLines, ...launcherLines] : []], unit: outcome.unit, ...launcherNotes.length > 0 ? { notes: launcherNotes } : {} };
+}
+async function uninstallServiceCommand(input, deps = {}) {
+  const vm = runnerVmOf(input.configPath);
+  if (vm !== void 0) {
+    const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "uninstall", { home: input.home, extraArgs: input.unitName === void 0 ? [] : ["--unit-name", input.unitName] });
+    return { ok: result.ok, state: "vm", lines: result.lines };
+  }
+  const serviceDeps = (deps.service ?? realServiceDeps)();
+  const outcome = uninstallService({ configPath: input.configPath, unitName: input.unitName }, serviceDeps);
+  const helper = outcome.ok && serviceDeps.helper !== void 0 && serviceDeps.systemd.running() ? uninstallHelper({ configPath: input.configPath, unitName: input.unitName ?? DEFAULT_UNIT_NAME }, { ...serviceDeps, helper: serviceDeps.helper }) : void 0;
+  return { ok: outcome.ok, state: outcome.state, lines: [...outcome.lines, ...helper?.lines ?? []] };
+}
+
+export { installServiceCommand, uninstallServiceCommand };

package/dist/{config-7Z5DHSGY.js → config-JJ3EO7SB.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-D7X5ITVT.js';
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-JWRX5ZTT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{connect-cmd-NY5LIKVC.js → connect-cmd-F7T4LNKX.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitLineFor, listText as factoryListText, slug as factorySlug, fetchFactories, hasUncommittedPolicy, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory } from './chunk-V5Q3S4NM.js';
+export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitLineFor, listText as factoryListText, slug as factorySlug, fetchFactories, hasUncommittedPolicy, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory } from './chunk-SNQR2EYI.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import './chunk-FKXGQOF5.js';
+import './chunk-M4B6QKNZ.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-D4AMAEZ7.js';
+import './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-JKNYTNYD.js';
@@ -16,10 +16,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);