@rynx-ai/cli 0.1.11-beta.4 → 0.1.11-beta.40

package/dist/systemd-service.d.ts

@@ -0,0 +1,53 @@
+import type { AutostartRenderInput, AutostartState } from "./autostart.js";
+export declare const RYNX_SYSTEMD_SERVICE = "rynx.service";
+export declare const RYNX_SYSTEMD_SERVICE_ENV = "RYNX_SYSTEMD_SERVICE";
+export declare const RYNX_SERVICE_ENV_KEYS = "RYNX_SERVICE_ENV_KEYS";
+export interface LinuxSystemdServiceState {
+    loadState: string;
+    activeState: string;
+    subState: string;
+    type: string;
+    mainPid: number;
+    killMode: string;
+    killSignal: string;
+    restartKillSignal: string;
+    finalKillSignal: string;
+    sendSigkill: string;
+    workingDirectory: string;
+    pidFile: string;
+    environment: string;
+    execStart: string;
+    execStop: string;
+}
+export interface LinuxPm2GodProcess {
+    pid: number;
+    cgroup: string;
+    startIdentity: string;
+}
+export type LinuxPm2GodOwnership = {
+    kind: "absent";
+} | {
+    kind: "owned";
+    processes: LinuxPm2GodProcess[];
+} | {
+    kind: "external";
+    processes: LinuxPm2GodProcess[];
+};
+export interface LinuxPm2InspectionDeps {
+    procEntries?: () => string[];
+    readText?: (file: string) => string;
+    statUid?: (file: string) => number;
+    currentUid?: number;
+}
+export declare function renderSystemdUnit(input: AutostartRenderInput): string;
+export declare function linuxUserSystemdAvailable(): boolean;
+export declare function inspectLinuxAutostart(): AutostartState;
+export declare function enableLinuxAutostart(): void;
+export declare function disableLinuxAutostart(): void;
+/** Refresh an existing autostart unit without changing enablement. */
+export declare function refreshLinuxServiceIfPresent(): boolean;
+export declare function assertLinuxSystemdInvocation(): void;
+export declare function parseLinuxSystemdShow(output: string): LinuxSystemdServiceState;
+export declare function inspectLinuxPm2GodOwnership(home: string, deps?: LinuxPm2InspectionDeps): LinuxPm2GodOwnership;
+export declare function scanLinuxPm2GodPids(home: string, deps?: LinuxPm2InspectionDeps): number[];
+export declare function linuxSystemdCgroupForPid(pid: number, readText?: (file: string) => string): string;

package/dist/systemd-service.js

@@ -0,0 +1,589 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { rynxHome } from "@rynx-ai/core";
+export const RYNX_SYSTEMD_SERVICE = "rynx.service";
+export const RYNX_SYSTEMD_SERVICE_ENV = "RYNX_SYSTEMD_SERVICE";
+export const RYNX_SERVICE_ENV_KEYS = "RYNX_SERVICE_ENV_KEYS";
+const COMMAND_TIMEOUT_MS = 5_000;
+const AUTOMATIC_SERVICE_ENVIRONMENT = new Set([
+    "ALL_PROXY",
+    "AWS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "HTTPS_PROXY",
+    "HTTP_PROXY",
+    "NODE_EXTRA_CA_CERTS",
+    "NO_PROXY",
+    "REQUESTS_CA_BUNDLE",
+    "SSL_CERT_DIR",
+    "SSL_CERT_FILE",
+    "all_proxy",
+    "https_proxy",
+    "http_proxy",
+    "no_proxy",
+]);
+const BLOCKED_SERVICE_ENVIRONMENT = new Set([
+    "PATH",
+    "INVOCATION_ID",
+    "JOURNAL_STREAM",
+    "LISTEN_FDS",
+    "LISTEN_FDNAMES",
+    "LISTEN_PID",
+    "MAINPID",
+    "MANAGERPID",
+    "NOTIFY_SOCKET",
+    "ELECTRON_RUN_AS_NODE",
+    "NODE_CHANNEL_FD",
+    "NODE_UNIQUE_ID",
+    "PM2_HOME",
+    "RYNX_DAEMON_LIFECYCLE",
+    "RYNX_HOME",
+    "RYNX_REFRESH_LOGIN_SHELL_PATH",
+    RYNX_SERVICE_ENV_KEYS,
+    RYNX_SYSTEMD_SERVICE_ENV,
+    "SYSTEMD_EXEC_PID",
+    "SYSTEMD_INVOCATION_ID",
+    "WATCHDOG_PID",
+    "WATCHDOG_USEC",
+]);
+const TRANSIENT_SERVICE_ENVIRONMENT = new Set([
+    "_",
+    "CI",
+    "CLICOLOR",
+    "CLICOLOR_FORCE",
+    "CODEX_CI",
+    "COLORTERM",
+    "FORCE_COLOR",
+    "GH_PAGER",
+    "GIT_PAGER",
+    "NO_COLOR",
+    "OLDPWD",
+    "PAGER",
+    "PWD",
+    "SHLVL",
+    "SSH_CLIENT",
+    "SSH_CONNECTION",
+    "SSH_TTY",
+    "TERM",
+    "TERM_PROGRAM",
+    "TERM_PROGRAM_VERSION",
+    "TERM_SESSION_ID",
+    "TERMINFO",
+    "TMUX",
+    "TMUX_PANE",
+]);
+export function renderSystemdUnit(input) {
+    const pidFile = path.join(input.dataDir, "pm2", "pm2.pid");
+    const inheritedEnvironment = renderInheritedEnvironment(input.environment);
+    return `[Unit]
+Description=Rynx local control plane
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+PIDFile=${systemdPath(pidFile)}
+KillMode=process
+KillSignal=SIGCONT
+RestartKillSignal=SIGCONT
+FinalKillSignal=SIGCONT
+SendSIGKILL=no
+TimeoutStartSec=60
+TimeoutStopSec=45
+WorkingDirectory=${systemdPath(input.dataDir)}
+${inheritedEnvironment}
+Environment=${systemdQuote(`PATH=${input.pathEnv}`)}
+Environment=${systemdQuote(`RYNX_HOME=${input.dataDir}`)}
+Environment=${systemdQuote(`${RYNX_SYSTEMD_SERVICE_ENV}=${RYNX_SYSTEMD_SERVICE}`)}
+ExecStart=${systemdQuote(input.nodePath)} ${systemdQuote(input.cliPath)} start --systemd-service
+ExecStop=${systemdQuote(input.nodePath)} ${systemdQuote(input.cliPath)} stop --systemd-service
+
+[Install]
+WantedBy=default.target
+`;
+}
+export function linuxUserSystemdAvailable() {
+    return process.platform === "linux" &&
+        run("systemctl", ["--user", "show-environment"]).status === 0;
+}
+export function inspectLinuxAutostart() {
+    const context = currentContext();
+    if (!linuxUserSystemdAvailable()) {
+        return {
+            supported: false,
+            registered: existsSync(context.unitPath),
+            manager: "systemd-user",
+            registrationPath: context.unitPath,
+            detail: "user systemd is unavailable in this login session",
+        };
+    }
+    const lingerEnabled = inspectLinuxLinger();
+    const active = run("systemctl", ["--user", "is-active", RYNX_SYSTEMD_SERVICE]).status === 0;
+    let detail;
+    if (active) {
+        try {
+            assertRunningServiceOwnership(context);
+        }
+        catch (error) {
+            detail = errorMessage(error);
+        }
+    }
+    return {
+        supported: true,
+        registered: run("systemctl", ["--user", "is-enabled", RYNX_SYSTEMD_SERVICE]).status === 0,
+        active,
+        ...(lingerEnabled === undefined
+            ? {}
+            : {
+                lingerEnabled,
+                ...(!lingerEnabled
+                    ? { lingerEnableCommand: `sudo loginctl enable-linger ${userInfo().username}` }
+                    : {}),
+            }),
+        manager: "systemd-user",
+        registrationPath: context.unitPath,
+        ...(detail ? { detail } : {}),
+    };
+}
+export function enableLinuxAutostart() {
+    assertUserSystemdAvailable();
+    const context = currentContext();
+    syncLinuxService(context);
+    requireSuccess(run("systemctl", ["--user", "enable", RYNX_SYSTEMD_SERVICE]), "systemctl --user enable");
+}
+export function disableLinuxAutostart() {
+    assertUserSystemdAvailable();
+    const context = currentContext();
+    const disabled = run("systemctl", ["--user", "disable", RYNX_SYSTEMD_SERVICE]);
+    if (disabled.status !== 0 && existsSync(context.unitPath)) {
+        requireSuccess(disabled, "systemctl --user disable");
+    }
+    rmSync(context.unitPath, { force: true });
+    requireSuccess(run("systemctl", ["--user", "daemon-reload"]), "systemctl --user daemon-reload");
+}
+/** Refresh an existing autostart unit without changing enablement. */
+export function refreshLinuxServiceIfPresent() {
+    if (process.platform !== "linux" || !linuxUserSystemdAvailable())
+        return false;
+    const context = currentContext();
+    if (!existsSync(context.unitPath))
+        return false;
+    return syncLinuxService(context);
+}
+export function assertLinuxSystemdInvocation() {
+    if (process.platform !== "linux") {
+        throw new Error("--systemd-service is only valid on Linux");
+    }
+    if (process.env[RYNX_SYSTEMD_SERVICE_ENV] !== RYNX_SYSTEMD_SERVICE) {
+        throw new Error("--systemd-service requires the Rynx systemd environment");
+    }
+    const cgroup = linuxSystemdCgroupForPid(process.pid);
+    if (!cgroupHasService(cgroup)) {
+        throw new Error(`--systemd-service requires the ${RYNX_SYSTEMD_SERVICE} cgroup`);
+    }
+}
+export function parseLinuxSystemdShow(output) {
+    const values = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const separator = line.indexOf("=");
+        if (separator <= 0)
+            continue;
+        values.set(line.slice(0, separator), line.slice(separator + 1));
+    }
+    const parsedMainPid = Number.parseInt(values.get("MainPID") ?? "0", 10);
+    return {
+        loadState: values.get("LoadState") ?? "",
+        activeState: values.get("ActiveState") ?? "",
+        subState: values.get("SubState") ?? "",
+        type: values.get("Type") ?? "",
+        mainPid: Number.isSafeInteger(parsedMainPid) && parsedMainPid > 1
+            ? parsedMainPid
+            : 0,
+        killMode: values.get("KillMode") ?? "",
+        killSignal: values.get("KillSignal") ?? "",
+        restartKillSignal: values.get("RestartKillSignal") ?? "",
+        finalKillSignal: values.get("FinalKillSignal") ?? "",
+        sendSigkill: values.get("SendSIGKILL") ?? "",
+        workingDirectory: values.get("WorkingDirectory") ?? "",
+        pidFile: values.get("PIDFile") ?? "",
+        environment: values.get("Environment") ?? "",
+        execStart: values.get("ExecStart") ?? "",
+        execStop: values.get("ExecStop") ?? "",
+    };
+}
+export function inspectLinuxPm2GodOwnership(home, deps = {}) {
+    const readText = deps.readText ?? ((file) => readFileSync(file, "utf8"));
+    const entries = scanLinuxPm2GodPids(home, deps);
+    const processes = [];
+    for (const pid of entries) {
+        try {
+            const startBefore = linuxProcStartIdentity(readText(`/proc/${pid}/stat`));
+            const cmdline = readText(`/proc/${pid}/cmdline`).replaceAll("\u0000", " ").trim();
+            const cgroup = linuxSystemdCgroupForPid(pid, readText);
+            const startAfter = linuxProcStartIdentity(readText(`/proc/${pid}/stat`));
+            if (!startBefore || startBefore !== startAfter) {
+                throw new Error(`PM2 supervisor pid ${pid} changed during inspection`);
+            }
+            if (!isDedicatedPm2God(cmdline, home))
+                continue;
+            processes.push({ pid, cgroup, startIdentity: startBefore });
+        }
+        catch (error) {
+            if (!processDisappeared(error))
+                throw procReadError(`/proc/${pid}`, error);
+        }
+    }
+    if (processes.length === 0)
+        return { kind: "absent" };
+    const external = processes.filter((entry) => !cgroupHasService(entry.cgroup));
+    return external.length === 0
+        ? { kind: "owned", processes }
+        : { kind: "external", processes };
+}
+export function scanLinuxPm2GodPids(home, deps = {}) {
+    const procEntries = deps.procEntries ?? (() => readdirSync("/proc"));
+    const readText = deps.readText ?? ((file) => readFileSync(file, "utf8"));
+    const statUid = deps.statUid ?? ((file) => statSync(file).uid);
+    const currentUid = deps.currentUid ?? process.getuid?.();
+    let entries;
+    try {
+        entries = procEntries();
+    }
+    catch (error) {
+        throw new Error(`cannot inspect /proc: ${errorMessage(error)}`);
+    }
+    const pids = [];
+    for (const entry of entries) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        const pid = Number(entry);
+        if (!Number.isSafeInteger(pid) || pid <= 1)
+            continue;
+        if (currentUid !== undefined) {
+            try {
+                if (statUid(`/proc/${pid}`) !== currentUid)
+                    continue;
+            }
+            catch (error) {
+                if (processDisappeared(error))
+                    continue;
+                throw procReadError(`/proc/${pid}`, error);
+            }
+        }
+        try {
+            const cmdline = readText(`/proc/${pid}/cmdline`).replaceAll("\u0000", " ").trim();
+            if (isDedicatedPm2God(cmdline, home))
+                pids.push(pid);
+        }
+        catch (error) {
+            if (!processDisappeared(error)) {
+                throw procReadError(`/proc/${pid}/cmdline`, error);
+            }
+        }
+    }
+    return [...new Set(pids)].sort((left, right) => left - right);
+}
+export function linuxSystemdCgroupForPid(pid, readText = (file) => readFileSync(file, "utf8")) {
+    return normalizedCgroupPath(readText(`/proc/${pid}/cgroup`)) ?? "(unreadable)";
+}
+function currentContext() {
+    const dataDir = rynxHome();
+    const homeDir = homedir();
+    const pm2Home = path.join(dataDir, "pm2");
+    return {
+        homeDir,
+        dataDir,
+        logDir: path.join(dataDir, "logs"),
+        cliPath: fileURLToPath(new URL("./cli.js", import.meta.url)),
+        environment: process.env,
+        nodePath: process.execPath,
+        pathEnv: process.env.PATH || defaultLinuxPath(),
+        pm2Home,
+        pidFile: path.join(pm2Home, "pm2.pid"),
+        unitPath: path.join(homeDir, ".config", "systemd", "user", RYNX_SYSTEMD_SERVICE),
+    };
+}
+function syncLinuxService(context) {
+    mkdirSync(context.dataDir, { recursive: true, mode: 0o700 });
+    mkdirSync(context.logDir, { recursive: true, mode: 0o700 });
+    const content = renderSystemdUnit(context);
+    const previous = existsSync(context.unitPath)
+        ? readFileSync(context.unitPath, "utf8")
+        : undefined;
+    const changed = previous !== content;
+    if (changed)
+        replaceFileAtomically(context.unitPath, content);
+    try {
+        requireSuccess(run("systemctl", ["--user", "daemon-reload"]), "systemctl --user daemon-reload");
+        assertStaticServiceDefinition(context, inspectLinuxSystemdService());
+        return changed;
+    }
+    catch (error) {
+        if (changed) {
+            if (previous === undefined)
+                rmSync(context.unitPath, { force: true });
+            else
+                replaceFileAtomically(context.unitPath, previous);
+            const rollback = run("systemctl", ["--user", "daemon-reload"]);
+            if (rollback.status !== 0) {
+                throw new AggregateError([error, new Error(`systemd rollback failed: ${commandDetail(rollback)}`)], "could not update or restore the Rynx systemd service");
+            }
+        }
+        throw error;
+    }
+}
+function inspectLinuxSystemdService() {
+    const output = systemctlUser([
+        "show",
+        RYNX_SYSTEMD_SERVICE,
+        "--property=LoadState",
+        "--property=ActiveState",
+        "--property=SubState",
+        "--property=Type",
+        "--property=MainPID",
+        "--property=KillMode",
+        "--property=KillSignal",
+        "--property=RestartKillSignal",
+        "--property=FinalKillSignal",
+        "--property=SendSIGKILL",
+        "--property=WorkingDirectory",
+        "--property=PIDFile",
+        "--property=Environment",
+        "--property=ExecStart",
+        "--property=ExecStop",
+    ]);
+    return parseLinuxSystemdShow(output);
+}
+function assertStaticServiceDefinition(context, state) {
+    const errors = [];
+    if (state.loadState !== "loaded")
+        errors.push(`LoadState=${state.loadState || "(empty)"}`);
+    if (state.type !== "forking")
+        errors.push(`Type=${state.type || "(empty)"}`);
+    if (state.pidFile !== context.pidFile)
+        errors.push(`PIDFile=${state.pidFile || "(empty)"}`);
+    if (state.workingDirectory !== context.dataDir) {
+        errors.push(`WorkingDirectory=${state.workingDirectory || "(empty)"}`);
+    }
+    if (state.killMode !== "process")
+        errors.push(`KillMode=${state.killMode || "(empty)"}`);
+    if (!signalMatches(state.killSignal, "18", "SIGCONT")) {
+        errors.push(`KillSignal=${state.killSignal || "(empty)"}`);
+    }
+    if (!signalMatches(state.restartKillSignal, "18", "SIGCONT")) {
+        errors.push(`RestartKillSignal=${state.restartKillSignal || "(empty)"}`);
+    }
+    if (!signalMatches(state.finalKillSignal, "18", "SIGCONT")) {
+        errors.push(`FinalKillSignal=${state.finalKillSignal || "(empty)"}`);
+    }
+    if (state.sendSigkill !== "no")
+        errors.push(`SendSIGKILL=${state.sendSigkill || "(empty)"}`);
+    for (const expected of [
+        `RYNX_HOME=${context.dataDir}`,
+        `${RYNX_SYSTEMD_SERVICE_ENV}=${RYNX_SYSTEMD_SERVICE}`,
+        `PATH=${context.pathEnv}`,
+    ]) {
+        if (!state.environment.includes(expected))
+            errors.push(`Environment missing ${expected}`);
+    }
+    for (const [name, value, action] of [
+        ["ExecStart", state.execStart, "start"],
+        ["ExecStop", state.execStop, "stop"],
+    ]) {
+        if (!value.includes(context.nodePath) ||
+            !value.includes(context.cliPath) ||
+            !value.includes(action) ||
+            !value.includes("--systemd-service")) {
+            errors.push(`${name}=${value || "(empty)"}`);
+        }
+    }
+    if (errors.length > 0) {
+        throw new Error(`${RYNX_SYSTEMD_SERVICE} effective configuration is invalid: ${errors.join("; ")}`);
+    }
+}
+function assertRunningServiceOwnership(context) {
+    const ownership = inspectLinuxPm2GodOwnership(context.pm2Home);
+    assertSingleGod(ownership);
+    if (ownership.kind !== "owned") {
+        throw new Error(ownership.kind === "absent"
+            ? "systemd started without a PM2 supervisor"
+            : `PM2 supervisor is outside ${RYNX_SYSTEMD_SERVICE}: ${describeOwnership(ownership)}`);
+    }
+    const process = ownership.processes[0];
+    const state = inspectLinuxSystemdService();
+    assertStaticServiceDefinition(context, state);
+    if (state.activeState !== "active" ||
+        state.subState !== "running" ||
+        state.mainPid !== process.pid) {
+        throw new Error(`${RYNX_SYSTEMD_SERVICE} does not own the PM2 supervisor: ` +
+            `ActiveState=${state.activeState}, SubState=${state.subState}, ` +
+            `MainPID=${state.mainPid}, PM2=${process.pid}`);
+    }
+    return process;
+}
+function assertSingleGod(ownership) {
+    if (ownership.kind !== "absent" && ownership.processes.length !== 1) {
+        throw new Error(`multiple PM2 supervisors use this RYNX_HOME: ${describeOwnership(ownership)}`);
+    }
+}
+function describeOwnership(ownership) {
+    if (ownership.kind === "absent")
+        return "absent";
+    return ownership.processes
+        .map((entry) => `${entry.pid}@${entry.cgroup}`)
+        .join(", ");
+}
+function inspectLinuxLinger() {
+    const result = run("loginctl", [
+        "show-user",
+        userInfo().username,
+        "--property=Linger",
+    ]);
+    if (result.status !== 0)
+        return undefined;
+    const value = result.stdout?.trim();
+    if (value === "Linger=yes")
+        return true;
+    if (value === "Linger=no")
+        return false;
+    return undefined;
+}
+function normalizedCgroupPath(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    if (trimmed.startsWith("/"))
+        return trimmed;
+    let unified;
+    for (const line of trimmed.split(/\r?\n/)) {
+        const first = line.indexOf(":");
+        const second = first < 0 ? -1 : line.indexOf(":", first + 1);
+        if (second < 0)
+            continue;
+        const hierarchy = line.slice(0, first);
+        const controllers = line.slice(first + 1, second);
+        const cgroup = line.slice(second + 1).trim();
+        if (!cgroup)
+            continue;
+        if (controllers.split(",").includes("name=systemd"))
+            return cgroup;
+        if (hierarchy === "0" && controllers === "")
+            unified = cgroup;
+    }
+    return unified;
+}
+function cgroupHasService(cgroup) {
+    return cgroup?.split("/").includes(RYNX_SYSTEMD_SERVICE) === true;
+}
+function linuxProcStartIdentity(raw) {
+    const closeParen = raw.lastIndexOf(")");
+    if (closeParen < 0)
+        return undefined;
+    return raw.slice(closeParen + 2).trim().split(/\s+/)[19];
+}
+function isDedicatedPm2God(cmdline, home) {
+    return cmdline.includes("PM2 v") && cmdline.includes(`God Daemon (${home})`);
+}
+function processDisappeared(error) {
+    const code = error?.code;
+    return code === "ENOENT" || code === "ESRCH" || code === "ENOTDIR";
+}
+function procReadError(file, error) {
+    return new Error(`cannot inspect ${file}: ${errorMessage(error)}`);
+}
+function assertUserSystemdAvailable() {
+    if (!linuxUserSystemdAvailable()) {
+        throw new Error("user systemd is unavailable in this login session");
+    }
+}
+function systemctlUser(args, timeout = COMMAND_TIMEOUT_MS) {
+    const result = run("systemctl", ["--user", ...args], timeout);
+    requireSuccess(result, `systemctl --user ${args.join(" ")}`);
+    return result.stdout ?? "";
+}
+function replaceFileAtomically(file, content) {
+    mkdirSync(path.dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(temporary, content, {
+            encoding: "utf8",
+            flag: "wx",
+            // The generated unit contains the caller's environment and may include
+            // runtime credentials. Keep the snapshot private to the owning user.
+            mode: 0o600,
+        });
+        renameSync(temporary, file);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+function run(command, args, timeout = COMMAND_TIMEOUT_MS) {
+    return spawnSync(command, [...args], {
+        encoding: "utf8",
+        stdio: "pipe",
+        timeout,
+        killSignal: "SIGTERM",
+    });
+}
+function requireSuccess(result, description) {
+    if (result.status === 0)
+        return;
+    throw new Error(`${description} failed: ${commandDetail(result)}`);
+}
+function commandDetail(result) {
+    return result.error?.message
+        || result.stderr?.trim()
+        || result.stdout?.trim()
+        || `exit ${result.status ?? "unknown"}`;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function signalMatches(value, number, name) {
+    return value === number || value === name;
+}
+function defaultLinuxPath() {
+    return "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+}
+function renderInheritedEnvironment(env) {
+    if (!env)
+        return "";
+    const requested = new Set((env[RYNX_SERVICE_ENV_KEYS] ?? "")
+        .split(/[\s,]+/)
+        .filter((name) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name)));
+    return Object.entries(env)
+        .filter(([name, value]) => value !== undefined &&
+        /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+        (AUTOMATIC_SERVICE_ENVIRONMENT.has(name) || requested.has(name)) &&
+        !name.startsWith("npm_") &&
+        !name.startsWith("RYNX_RUNNER_") &&
+        !BLOCKED_SERVICE_ENVIRONMENT.has(name) &&
+        !TRANSIENT_SERVICE_ENVIRONMENT.has(name))
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, value]) => `Environment=${systemdQuote(`${name}=${value}`)}`)
+        .join("\n");
+}
+function systemdQuote(value) {
+    return `"${value
+        .replaceAll("\\", "\\\\")
+        .replaceAll("\"", "\\\"")
+        .replaceAll("%", "%%")
+        .replaceAll("\t", "\\t")
+        .replaceAll("\n", "\\n")
+        .replaceAll("\r", "\\r")}"`;
+}
+function systemdPath(value) {
+    return value
+        .replaceAll("%", "%%")
+        .replaceAll("\\", "\\x5c")
+        .replaceAll(" ", "\\x20")
+        .replaceAll("\t", "\\t")
+        .replaceAll("\n", "\\n")
+        .replaceAll("\r", "\\r")
+        .replaceAll('"', "\\x22")
+        .replaceAll("'", "\\x27");
+}

package/dist/usage.d.ts

@@ -1 +1 @@
-export declare const USAGE = "Usage: rynx <command>\n\nGeneral:\n  version [--json] | --version\n                     print the installed Rynx version\n\nSetup:\n  setup [--non-interactive] [--default-runtime <codex|traex|claude>]\n        [--host <host>] [--port <port>] [--log-level <level>]\n        [--install-browser|--skip-browser] [--json]\n                     initialize configuration and local dependencies\n  doctor             read-only health check\n\nLifecycle:\n  start | restart | stop | status | logs\n  update [version] [--check] [--json]\n\nPlugins:\n  market list\n  market add <git-or-local-source> [--alias <id>]\n  market refresh [market-id]\n  market remove <market-id>\n  plugin list\n  plugin install <source|plugin@market> [--force] [--expect-digest <sha256-...>]\n  plugin update <plugin@market> [--expect-digest <sha256-...>]\n  plugin enable|disable|uninstall <plugin@market>\n  plugin <plugin@market> <command>  invoke a plugin-owned command\n\nAgents:\n  agent list\n  agent show <id>\n  agent add <id>\n  agent rm <id>\n\nBuiltin Skills:\n  skills list [--json]\n  skills get <browser|emulator> [--full] [--json]\n\nMaintenance:\n  cleanup sessions [--dry-run]\n\nEmulator:\n  emulator <args...>\n\nRemote Runtime:\n  runtime share --address <host|ws-url> [--label <label>] [--json]\n  runtime add --pairing-code <rynx://...> [--name <name>]\n  runtime list [--json]\n  runtime test <local|daemon-id> [--json]\n  runtime forget <daemon-id>\n  runtime clients list [--json]\n  runtime clients revoke <grant-id>\n\nSessions:\n  session fork <session-id> [--title <title>] [--json]\n\nBrowser:\n  browser install|update|version|clean [...]\n  browser open [url] [--session <id>] [--runtime <local|daemon-id>] [--json]\n  browser status|pages|close [--session <id>] [--runtime <local|daemon-id>] [--json]\n  browser endpoint [--ensure] [--session <local-id>] [--json]\n  browser snapshot [--session <local-id>] [--json]\n  browser navigate <url> [--session <local-id>] [--json]\n  browser click (--ref <ref>|--selector <css>|--x <n> --y <n>) [--session <local-id>] [--json]\n  browser type (--ref <ref>|--selector <css>) --text <text> [--session <local-id>] [--json]\n  browser screenshot --output <absolute-path> [--session <local-id>] [--json]\n";
+export declare const USAGE = "Usage: rynx <command>\n\nGeneral:\n  version [--json] | --version\n                     print the installed Rynx version\n\nSetup:\n  setup [--non-interactive] [--default-runtime <codex|traex|claude>]\n        [--host <host>] [--port <port>] [--log-level <level>]\n        [--install-browser|--skip-browser] [--json|--result-file <path>]\n                     initialize configuration and local dependencies\n  doctor             read-only health check\n\nLifecycle:\n  start | restart | stop | status | logs\n  autostart enable|disable|status\n  update [version] [--check] [--json]\n\nPlugins:\n  market list\n  market add <git-or-local-source> [--alias <id>]\n  market refresh [market-id]\n  market remove <market-id>\n  plugin list\n  plugin install <source|plugin@market> [--force] [--expect-digest <sha256-...>]\n  plugin update <plugin@market> [--expect-digest <sha256-...>]\n  plugin enable|disable|uninstall <plugin@market>\n  plugin <plugin@market> <command>  invoke a plugin-owned command\n\nAgents:\n  agent list\n  agent show <id>\n  agent add <id>\n  agent rm <id>\n\nBuiltin Skills:\n  skills list [--json]\n  skills get <browser|emulator> [--full] [--json]\n\nMaintenance:\n  cleanup sessions [--dry-run]\n\nEmulator:\n  emulator <args...>\n\nRemote Runtime:\n  runtime share --address <host|ws-url> [--label <label>] [--json]\n  runtime add --pairing-code <rynx://...> [--name <name>]\n  runtime list [--json]\n  runtime test <local|daemon-id> [--json]\n  runtime forget <daemon-id>\n  runtime clients list [--json]\n  runtime clients revoke <grant-id>\n\nSessions:\n  session fork <session-id> [--title <title>] [--json]\n\nBrowser:\n  browser install|update|version|clean [...]\n  browser open [url] [--session <id>] [--runtime <local|daemon-id>] [--json]\n  browser status|pages|close [--session <id>] [--runtime <local|daemon-id>] [--json]\n  browser endpoint [--ensure] [--session <local-id>] [--json]\n  browser snapshot [--session <local-id>] [--json]\n  browser navigate <url> [--session <local-id>] [--json]\n  browser click (--ref <ref>|--selector <css>|--x <n> --y <n>) [--session <local-id>] [--json]\n  browser type (--ref <ref>|--selector <css>) --text <text> [--session <local-id>] [--json]\n  browser screenshot --output <absolute-path> [--session <local-id>] [--json]\n";

package/dist/usage.js

@@ -7,12 +7,13 @@ General:
 Setup:
   setup [--non-interactive] [--default-runtime <codex|traex|claude>]
         [--host <host>] [--port <port>] [--log-level <level>]
-        [--install-browser|--skip-browser] [--json]
+        [--install-browser|--skip-browser] [--json|--result-file <path>]
                      initialize configuration and local dependencies
   doctor             read-only health check
 
 Lifecycle:
   start | restart | stop | status | logs
+  autostart enable|disable|status
   update [version] [--check] [--json]
 
 Plugins: