@rynx-ai/cli 0.1.11-beta.39 → 0.1.11-beta.40

package/dist/autostart.d.ts

@@ -13,6 +13,7 @@ export interface AutostartState {
 export interface AutostartRenderInput {
     cliPath: string;
     dataDir: string;
+    environment?: NodeJS.ProcessEnv;
     logDir: string;
     nodePath: string;
     pathEnv: string;

package/dist/commands/lifecycle.js

@@ -1,6 +1,6 @@
-import { startStandaloneDaemon, standaloneDaemonRestartRequired, statusStandaloneDaemon, stopStandaloneDaemon, streamStandaloneDaemonLogs, } from "../standalone.js";
+import { startStandaloneDaemon, statusStandaloneDaemon, stopStandaloneDaemon, streamStandaloneDaemonLogs, } from "../standalone.js";
 import { refreshAutostart } from "../autostart.js";
-import { assertLinuxSystemdInvocation, linuxUserSystemdAvailable, runLinuxSystemdLifecycle, } from "../systemd-service.js";
+import { assertLinuxSystemdInvocation } from "../systemd-service.js";
 import { fail } from "./errors.js";
 const SYSTEMD_SERVICE_FLAG = "--systemd-service";
 export async function runLifecycleCommand(command, args, options = {}) {
@@ -14,18 +14,6 @@ export async function runLifecycleCommand(command, args, options = {}) {
     }
     if (args.length > 0)
         fail(`${command}: unexpected argument ${args[0]}`);
-    if (linuxUserSystemdAvailable() &&
-        (command === "start" ||
-            command === "restart" ||
-            command === "stop" ||
-            command === "status")) {
-        return runLinuxSystemdLifecycle(command, {
-            restartRequired: standaloneDaemonRestartRequired,
-            start: startStandaloneDaemon,
-            status: statusStandaloneDaemon,
-            stop: stopStandaloneDaemon,
-        }, options);
-    }
     switch (command) {
         case "start": {
             refreshAutostart();

package/dist/standalone.d.ts

@@ -4,7 +4,6 @@ export declare function startStandaloneDaemon(options?: {
     restart?: boolean;
     quiet?: boolean;
 }): Promise<number>;
-export declare function standaloneDaemonRestartRequired(): Promise<boolean>;
 /** Reuse any healthy owner; otherwise explicitly start the standalone owner. */
 export declare function ensureStandaloneDaemon(): Promise<{
     origin: string;

package/dist/standalone.js

@@ -22,10 +22,6 @@ export async function startStandaloneDaemon(options = {}) {
         },
     });
 }
-export async function standaloneDaemonRestartRequired() {
-    const { isDaemonStartRequired } = await import("@rynx-ai/daemon/lifecycle");
-    return isDaemonStartRequired();
-}
 /** Reuse any healthy owner; otherwise explicitly start the standalone owner. */
 export async function ensureStandaloneDaemon() {
     const current = await resolveDaemonControlEndpoint();

package/dist/systemd-service.d.ts

@@ -1,6 +1,7 @@
 import type { AutostartRenderInput, AutostartState } from "./autostart.js";
 export declare const RYNX_SYSTEMD_SERVICE = "rynx.service";
 export declare const RYNX_SYSTEMD_SERVICE_ENV = "RYNX_SYSTEMD_SERVICE";
+export declare const RYNX_SERVICE_ENV_KEYS = "RYNX_SERVICE_ENV_KEYS";
 export interface LinuxSystemdServiceState {
     loadState: string;
     activeState: string;
@@ -38,26 +39,14 @@ export interface LinuxPm2InspectionDeps {
     statUid?: (file: string) => number;
     currentUid?: number;
 }
-export interface LinuxLifecycleActions {
-    restartRequired: () => Promise<boolean>;
-    start: (options?: {
-        restart?: boolean;
-        quiet?: boolean;
-    }) => Promise<number>;
-    status: () => Promise<number>;
-    stop: () => Promise<number>;
-}
 export declare function renderSystemdUnit(input: AutostartRenderInput): string;
 export declare function linuxUserSystemdAvailable(): boolean;
 export declare function inspectLinuxAutostart(): AutostartState;
 export declare function enableLinuxAutostart(): void;
 export declare function disableLinuxAutostart(): void;
-/** Refresh a registered or lifecycle-created unit without changing enablement. */
+/** Refresh an existing autostart unit without changing enablement. */
 export declare function refreshLinuxServiceIfPresent(): boolean;
 export declare function assertLinuxSystemdInvocation(): void;
-export declare function runLinuxSystemdLifecycle(command: "start" | "restart" | "stop" | "status", actions: LinuxLifecycleActions, options?: {
-    quiet?: boolean;
-}): Promise<number>;
 export declare function parseLinuxSystemdShow(output: string): LinuxSystemdServiceState;
 export declare function inspectLinuxPm2GodOwnership(home: string, deps?: LinuxPm2InspectionDeps): LinuxPm2GodOwnership;
 export declare function scanLinuxPm2GodPids(home: string, deps?: LinuxPm2InspectionDeps): number[];

package/dist/systemd-service.js

@@ -6,10 +6,78 @@ import { fileURLToPath } from "node:url";
 import { rynxHome } from "@rynx-ai/core";
 export const RYNX_SYSTEMD_SERVICE = "rynx.service";
 export const RYNX_SYSTEMD_SERVICE_ENV = "RYNX_SYSTEMD_SERVICE";
+export const RYNX_SERVICE_ENV_KEYS = "RYNX_SERVICE_ENV_KEYS";
 const COMMAND_TIMEOUT_MS = 5_000;
-const LIFECYCLE_TIMEOUT_MS = 60_000;
+const AUTOMATIC_SERVICE_ENVIRONMENT = new Set([
+    "ALL_PROXY",
+    "AWS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "HTTPS_PROXY",
+    "HTTP_PROXY",
+    "NODE_EXTRA_CA_CERTS",
+    "NO_PROXY",
+    "REQUESTS_CA_BUNDLE",
+    "SSL_CERT_DIR",
+    "SSL_CERT_FILE",
+    "all_proxy",
+    "https_proxy",
+    "http_proxy",
+    "no_proxy",
+]);
+const BLOCKED_SERVICE_ENVIRONMENT = new Set([
+    "PATH",
+    "INVOCATION_ID",
+    "JOURNAL_STREAM",
+    "LISTEN_FDS",
+    "LISTEN_FDNAMES",
+    "LISTEN_PID",
+    "MAINPID",
+    "MANAGERPID",
+    "NOTIFY_SOCKET",
+    "ELECTRON_RUN_AS_NODE",
+    "NODE_CHANNEL_FD",
+    "NODE_UNIQUE_ID",
+    "PM2_HOME",
+    "RYNX_DAEMON_LIFECYCLE",
+    "RYNX_HOME",
+    "RYNX_REFRESH_LOGIN_SHELL_PATH",
+    RYNX_SERVICE_ENV_KEYS,
+    RYNX_SYSTEMD_SERVICE_ENV,
+    "SYSTEMD_EXEC_PID",
+    "SYSTEMD_INVOCATION_ID",
+    "WATCHDOG_PID",
+    "WATCHDOG_USEC",
+]);
+const TRANSIENT_SERVICE_ENVIRONMENT = new Set([
+    "_",
+    "CI",
+    "CLICOLOR",
+    "CLICOLOR_FORCE",
+    "CODEX_CI",
+    "COLORTERM",
+    "FORCE_COLOR",
+    "GH_PAGER",
+    "GIT_PAGER",
+    "NO_COLOR",
+    "OLDPWD",
+    "PAGER",
+    "PWD",
+    "SHLVL",
+    "SSH_CLIENT",
+    "SSH_CONNECTION",
+    "SSH_TTY",
+    "TERM",
+    "TERM_PROGRAM",
+    "TERM_PROGRAM_VERSION",
+    "TERM_SESSION_ID",
+    "TERMINFO",
+    "TMUX",
+    "TMUX_PANE",
+]);
 export function renderSystemdUnit(input) {
     const pidFile = path.join(input.dataDir, "pm2", "pm2.pid");
+    const inheritedEnvironment = renderInheritedEnvironment(input.environment);
     return `[Unit]
 Description=Rynx local control plane
 After=network-online.target
@@ -26,6 +94,7 @@ SendSIGKILL=no
 TimeoutStartSec=60
 TimeoutStopSec=45
 WorkingDirectory=${systemdPath(input.dataDir)}
+${inheritedEnvironment}
 Environment=${systemdQuote(`PATH=${input.pathEnv}`)}
 Environment=${systemdQuote(`RYNX_HOME=${input.dataDir}`)}
 Environment=${systemdQuote(`${RYNX_SYSTEMD_SERVICE_ENV}=${RYNX_SYSTEMD_SERVICE}`)}
@@ -95,7 +164,7 @@ export function disableLinuxAutostart() {
     rmSync(context.unitPath, { force: true });
     requireSuccess(run("systemctl", ["--user", "daemon-reload"]), "systemctl --user daemon-reload");
 }
-/** Refresh a registered or lifecycle-created unit without changing enablement. */
+/** Refresh an existing autostart unit without changing enablement. */
 export function refreshLinuxServiceIfPresent() {
     if (process.platform !== "linux" || !linuxUserSystemdAvailable())
         return false;
@@ -116,59 +185,6 @@ export function assertLinuxSystemdInvocation() {
         throw new Error(`--systemd-service requires the ${RYNX_SYSTEMD_SERVICE} cgroup`);
     }
 }
-export async function runLinuxSystemdLifecycle(command, actions, options = {}) {
-    assertUserSystemdAvailable();
-    const context = currentContext();
-    if (command === "status") {
-        return statusLinuxLifecycle(context, actions);
-    }
-    if (command === "stop") {
-        return stopLinuxLifecycle(context, actions);
-    }
-    const unitChanged = syncLinuxService(context);
-    const before = inspectLinuxPm2GodOwnership(context.pm2Home);
-    assertSingleGod(before);
-    const serviceBefore = inspectLinuxSystemdService();
-    if (before.kind === "owned" && serviceOwnsGod(serviceBefore, before.processes[0])) {
-        if (command === "start") {
-            if (unitChanged || await actions.restartRequired()) {
-                systemctlUser(["restart", RYNX_SYSTEMD_SERVICE], LIFECYCLE_TIMEOUT_MS);
-                assertRunningServiceOwnership(context);
-                return options.quiet ? 0 : actions.status();
-            }
-            const result = await actions.start(options.quiet ? { quiet: true } : undefined);
-            if (result !== 0)
-                return result;
-            assertRunningServiceOwnership(context);
-            return 0;
-        }
-        const previous = before.processes[0];
-        systemctlUser(["restart", RYNX_SYSTEMD_SERVICE], LIFECYCLE_TIMEOUT_MS);
-        const current = assertRunningServiceOwnership(context);
-        if (current.pid === previous.pid &&
-            current.startIdentity === previous.startIdentity) {
-            throw new Error("systemd restart did not replace the PM2 supervisor generation");
-        }
-        return options.quiet ? 0 : actions.status();
-    }
-    if (before.kind !== "absent") {
-        assertMigratableOwnership(before);
-        const stopped = await actions.stop();
-        if (stopped !== 0)
-            return stopped;
-        const afterStop = inspectLinuxPm2GodOwnership(context.pm2Home);
-        if (afterStop.kind !== "absent") {
-            throw new Error("the previous PM2 supervisor is still running after shutdown");
-        }
-    }
-    if (serviceBefore.activeState !== "inactive") {
-        systemctlUser(["stop", RYNX_SYSTEMD_SERVICE], LIFECYCLE_TIMEOUT_MS);
-    }
-    run("systemctl", ["--user", "reset-failed", RYNX_SYSTEMD_SERVICE]);
-    systemctlUser(["start", RYNX_SYSTEMD_SERVICE], LIFECYCLE_TIMEOUT_MS);
-    assertRunningServiceOwnership(context);
-    return options.quiet ? 0 : actions.status();
-}
 export function parseLinuxSystemdShow(output) {
     const values = new Map();
     for (const line of output.split(/\r?\n/)) {
@@ -282,6 +298,7 @@ function currentContext() {
         dataDir,
         logDir: path.join(dataDir, "logs"),
         cliPath: fileURLToPath(new URL("./cli.js", import.meta.url)),
+        environment: process.env,
         nodePath: process.execPath,
         pathEnv: process.env.PATH || defaultLinuxPath(),
         pm2Home,
@@ -407,64 +424,11 @@ function assertRunningServiceOwnership(context) {
     }
     return process;
 }
-async function statusLinuxLifecycle(context, actions) {
-    const ownership = inspectLinuxPm2GodOwnership(context.pm2Home);
-    if (ownership.kind === "absent") {
-        console.log("rynx: stopped (PM2 supervisor is absent)");
-        return 1;
-    }
-    assertSingleGod(ownership);
-    const directStatus = await actions.status();
-    if (ownership.kind !== "owned") {
-        console.error(`rynx: PM2 supervisor is not owned by ${RYNX_SYSTEMD_SERVICE}: ${describeOwnership(ownership)}`);
-        return 2;
-    }
-    try {
-        assertRunningServiceOwnership(context);
-    }
-    catch (error) {
-        console.error(`rynx: ${errorMessage(error)}`);
-        return 1;
-    }
-    return directStatus;
-}
-async function stopLinuxLifecycle(context, actions) {
-    const ownership = inspectLinuxPm2GodOwnership(context.pm2Home);
-    assertSingleGod(ownership);
-    if (ownership.kind === "owned") {
-        const state = inspectLinuxSystemdService();
-        if (serviceOwnsGod(state, ownership.processes[0])) {
-            systemctlUser(["stop", RYNX_SYSTEMD_SERVICE], LIFECYCLE_TIMEOUT_MS);
-            if (inspectLinuxPm2GodOwnership(context.pm2Home).kind !== "absent") {
-                throw new Error("PM2 supervisor survived systemd stop");
-            }
-            console.log("rynx stopped.");
-            return 0;
-        }
-    }
-    if (ownership.kind === "external")
-        assertMigratableOwnership(ownership);
-    return actions.stop();
-}
 function assertSingleGod(ownership) {
     if (ownership.kind !== "absent" && ownership.processes.length !== 1) {
         throw new Error(`multiple PM2 supervisors use this RYNX_HOME: ${describeOwnership(ownership)}`);
     }
 }
-function assertMigratableOwnership(ownership) {
-    if (ownership.kind !== "external")
-        return;
-    const externalService = ownership.processes.find((entry) => serviceOwner(entry.cgroup)?.endsWith(".service"));
-    if (externalService) {
-        throw new Error(`refusing to replace a PM2 supervisor owned by ${serviceOwner(externalService.cgroup)}`);
-    }
-}
-function serviceOwnsGod(state, process) {
-    return state.activeState === "active" &&
-        state.subState === "running" &&
-        state.mainPid === process.pid &&
-        cgroupHasService(process.cgroup);
-}
 function describeOwnership(ownership) {
     if (ownership.kind === "absent")
         return "absent";
@@ -472,9 +436,6 @@ function describeOwnership(ownership) {
         .map((entry) => `${entry.pid}@${entry.cgroup}`)
         .join(", ");
 }
-function serviceOwner(cgroup) {
-    return cgroup.split("/").reverse().find((part) => part.endsWith(".service") || part.endsWith(".scope"));
-}
 function inspectLinuxLinger() {
     const result = run("loginctl", [
         "show-user",
@@ -550,7 +511,9 @@ function replaceFileAtomically(file, content) {
         writeFileSync(temporary, content, {
             encoding: "utf8",
             flag: "wx",
-            mode: 0o644,
+            // The generated unit contains the caller's environment and may include
+            // runtime credentials. Keep the snapshot private to the owning user.
+            mode: 0o600,
         });
         renameSync(temporary, file);
     }
@@ -586,6 +549,24 @@ function signalMatches(value, number, name) {
 function defaultLinuxPath() {
     return "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 }
+function renderInheritedEnvironment(env) {
+    if (!env)
+        return "";
+    const requested = new Set((env[RYNX_SERVICE_ENV_KEYS] ?? "")
+        .split(/[\s,]+/)
+        .filter((name) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name)));
+    return Object.entries(env)
+        .filter(([name, value]) => value !== undefined &&
+        /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+        (AUTOMATIC_SERVICE_ENVIRONMENT.has(name) || requested.has(name)) &&
+        !name.startsWith("npm_") &&
+        !name.startsWith("RYNX_RUNNER_") &&
+        !BLOCKED_SERVICE_ENVIRONMENT.has(name) &&
+        !TRANSIENT_SERVICE_ENVIRONMENT.has(name))
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, value]) => `Environment=${systemdQuote(`${name}=${value}`)}`)
+        .join("\n");
+}
 function systemdQuote(value) {
     return `"${value
         .replaceAll("\\", "\\\\")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rynx-ai/cli",
-  "version": "0.1.11-beta.39",
+  "version": "0.1.11-beta.40",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/rynx-ai/rynx.git",
@@ -51,12 +51,12 @@
   "dependencies": {
     "@clack/prompts": "^1.6.0",
     "ws": "^8.21.0",
-    "@rynx-ai/core": "0.1.11-beta.39",
-    "@rynx-ai/daemon": "0.1.11-beta.39",
-    "@rynx-ai/browser-cdp": "0.1.11-beta.39",
-    "@rynx-ai/emulator": "0.1.11-beta.39",
-    "@rynx-ai/tmux": "0.1.11-beta.39",
-    "@rynx-ai/protocol": "0.1.11-beta.39"
+    "@rynx-ai/browser-cdp": "0.1.11-beta.40",
+    "@rynx-ai/core": "0.1.11-beta.40",
+    "@rynx-ai/emulator": "0.1.11-beta.40",
+    "@rynx-ai/protocol": "0.1.11-beta.40",
+    "@rynx-ai/tmux": "0.1.11-beta.40",
+    "@rynx-ai/daemon": "0.1.11-beta.40"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1"