@rynx-ai/cli 0.1.11-beta.4 → 0.1.11-beta.41

package/dist/systemd-service.d.ts

@@ -0,0 +1,58 @@
+import type { AutostartRenderInput, AutostartState } from "./autostart.js";
+export declare const RYNX_SYSTEMD_SERVICE = "rynx.service";
+export declare const RYNX_SYSTEMD_SERVICE_ENV = "RYNX_SYSTEMD_SERVICE";
+export declare const RYNX_SERVICE_ENV_KEYS = "RYNX_SERVICE_ENV_KEYS";
+export interface LinuxSystemdServiceState {
+    loadState: string;
+    activeState: string;
+    subState: string;
+    type: string;
+    remainAfterExit: string;
+    killMode: string;
+    killSignal: string;
+    restartKillSignal: string;
+    finalKillSignal: string;
+    sendSigkill: string;
+    workingDirectory: string;
+    environment: string;
+    execStart: string;
+    execStop: string;
+}
+export interface LinuxPm2GodProcess {
+    pid: number;
+    cgroup: string;
+    startIdentity: string;
+}
+export type LinuxPm2GodInspection = {
+    kind: "absent";
+} | {
+    kind: "service-cgroup";
+    processes: LinuxPm2GodProcess[];
+} | {
+    kind: "external";
+    processes: LinuxPm2GodProcess[];
+};
+export interface LinuxPm2InspectionDeps {
+    procEntries?: () => string[];
+    readText?: (file: string) => string;
+    statUid?: (file: string) => number;
+    currentUid?: number;
+}
+export declare function renderSystemdUnit(input: AutostartRenderInput): string;
+export declare function linuxUserSystemdAvailable(): boolean;
+export declare function inspectLinuxAutostart(): AutostartState;
+export declare function enableLinuxAutostart(): void;
+export declare function disableLinuxAutostart(): void;
+/** Refresh an existing autostart unit without changing enablement. */
+export declare function refreshLinuxServiceIfPresent(): boolean;
+export declare function assertLinuxSystemdInvocation(): void;
+/**
+ * Stop through systemd while the oneshot unit owns the lifecycle state. PM2
+ * owns its own process tree; systemd only records whether its start hook has
+ * completed and provides the matching synchronous ExecStop boundary.
+ */
+export declare function stopLinuxServiceIfActive(): boolean;
+export declare function parseLinuxSystemdShow(output: string): LinuxSystemdServiceState;
+export declare function inspectLinuxPm2GodProcesses(home: string, deps?: LinuxPm2InspectionDeps): LinuxPm2GodInspection;
+export declare function scanLinuxPm2GodPids(home: string, deps?: LinuxPm2InspectionDeps): number[];
+export declare function linuxSystemdCgroupForPid(pid: number, readText?: (file: string) => string): string;

package/dist/systemd-service.js

@@ -0,0 +1,636 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { rynxHome } from "@rynx-ai/core";
+export const RYNX_SYSTEMD_SERVICE = "rynx.service";
+export const RYNX_SYSTEMD_SERVICE_ENV = "RYNX_SYSTEMD_SERVICE";
+export const RYNX_SERVICE_ENV_KEYS = "RYNX_SERVICE_ENV_KEYS";
+const COMMAND_TIMEOUT_MS = 5_000;
+const STOP_COMMAND_TIMEOUT_MS = 50_000;
+const AUTOMATIC_SERVICE_ENVIRONMENT = new Set([
+    "ALL_PROXY",
+    "AWS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "HTTPS_PROXY",
+    "HTTP_PROXY",
+    "NODE_EXTRA_CA_CERTS",
+    "NO_PROXY",
+    "REQUESTS_CA_BUNDLE",
+    "SSL_CERT_DIR",
+    "SSL_CERT_FILE",
+    "all_proxy",
+    "https_proxy",
+    "http_proxy",
+    "no_proxy",
+]);
+const BLOCKED_SERVICE_ENVIRONMENT = new Set([
+    "PATH",
+    "INVOCATION_ID",
+    "JOURNAL_STREAM",
+    "LISTEN_FDS",
+    "LISTEN_FDNAMES",
+    "LISTEN_PID",
+    "MAINPID",
+    "MANAGERPID",
+    "NOTIFY_SOCKET",
+    "ELECTRON_RUN_AS_NODE",
+    "NODE_CHANNEL_FD",
+    "NODE_UNIQUE_ID",
+    "PM2_HOME",
+    "RYNX_DAEMON_LIFECYCLE",
+    "RYNX_HOME",
+    "RYNX_REFRESH_LOGIN_SHELL_PATH",
+    RYNX_SERVICE_ENV_KEYS,
+    RYNX_SYSTEMD_SERVICE_ENV,
+    "SYSTEMD_EXEC_PID",
+    "SYSTEMD_INVOCATION_ID",
+    "WATCHDOG_PID",
+    "WATCHDOG_USEC",
+]);
+const TRANSIENT_SERVICE_ENVIRONMENT = new Set([
+    "_",
+    "CI",
+    "CLICOLOR",
+    "CLICOLOR_FORCE",
+    "CODEX_CI",
+    "COLORTERM",
+    "FORCE_COLOR",
+    "GH_PAGER",
+    "GIT_PAGER",
+    "NO_COLOR",
+    "OLDPWD",
+    "PAGER",
+    "PWD",
+    "SHLVL",
+    "SSH_CLIENT",
+    "SSH_CONNECTION",
+    "SSH_TTY",
+    "TERM",
+    "TERM_PROGRAM",
+    "TERM_PROGRAM_VERSION",
+    "TERM_SESSION_ID",
+    "TERMINFO",
+    "TMUX",
+    "TMUX_PANE",
+]);
+export function renderSystemdUnit(input) {
+    const inheritedEnvironment = renderInheritedEnvironment(input.environment);
+    return `[Unit]
+Description=Rynx local control plane
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+KillMode=process
+KillSignal=SIGCONT
+RestartKillSignal=SIGCONT
+FinalKillSignal=SIGCONT
+SendSIGKILL=no
+TimeoutStartSec=60
+TimeoutStopSec=45
+WorkingDirectory=${systemdPath(input.dataDir)}
+${inheritedEnvironment}
+Environment=${systemdQuote(`PATH=${input.pathEnv}`)}
+Environment=${systemdQuote(`RYNX_HOME=${input.dataDir}`)}
+Environment=${systemdQuote(`${RYNX_SYSTEMD_SERVICE_ENV}=${RYNX_SYSTEMD_SERVICE}`)}
+ExecStart=${systemdQuote(input.nodePath)} ${systemdQuote(input.cliPath)} start --systemd-service
+ExecStop=${systemdQuote(input.nodePath)} ${systemdQuote(input.cliPath)} stop --systemd-service
+
+[Install]
+WantedBy=default.target
+`;
+}
+export function linuxUserSystemdAvailable() {
+    return process.platform === "linux" &&
+        run("systemctl", ["--user", "show-environment"]).status === 0;
+}
+export function inspectLinuxAutostart() {
+    const context = currentContext();
+    if (!linuxUserSystemdAvailable()) {
+        return {
+            supported: false,
+            registered: existsSync(context.unitPath),
+            manager: "systemd-user",
+            registrationPath: context.unitPath,
+            detail: "user systemd is unavailable in this login session",
+        };
+    }
+    const lingerEnabled = inspectLinuxLinger();
+    const active = run("systemctl", ["--user", "is-active", RYNX_SYSTEMD_SERVICE]).status === 0;
+    let detail;
+    if (active) {
+        try {
+            assertActiveServiceLifecycle(context);
+        }
+        catch (error) {
+            detail = errorMessage(error);
+        }
+    }
+    return {
+        supported: true,
+        registered: run("systemctl", ["--user", "is-enabled", RYNX_SYSTEMD_SERVICE]).status === 0,
+        active,
+        ...(lingerEnabled === undefined
+            ? {}
+            : {
+                lingerEnabled,
+                ...(!lingerEnabled
+                    ? { lingerEnableCommand: `sudo loginctl enable-linger ${userInfo().username}` }
+                    : {}),
+            }),
+        manager: "systemd-user",
+        registrationPath: context.unitPath,
+        ...(detail ? { detail } : {}),
+    };
+}
+export function enableLinuxAutostart() {
+    assertUserSystemdAvailable();
+    const context = currentContext();
+    syncLinuxService(context);
+    requireSuccess(run("systemctl", ["--user", "enable", RYNX_SYSTEMD_SERVICE]), "systemctl --user enable");
+}
+export function disableLinuxAutostart() {
+    assertUserSystemdAvailable();
+    const context = currentContext();
+    const disabled = run("systemctl", ["--user", "disable", RYNX_SYSTEMD_SERVICE]);
+    if (disabled.status !== 0 && existsSync(context.unitPath)) {
+        requireSuccess(disabled, "systemctl --user disable");
+    }
+    rmSync(context.unitPath, { force: true });
+    requireSuccess(run("systemctl", ["--user", "daemon-reload"]), "systemctl --user daemon-reload");
+}
+/** Refresh an existing autostart unit without changing enablement. */
+export function refreshLinuxServiceIfPresent() {
+    if (process.platform !== "linux" || !linuxUserSystemdAvailable())
+        return false;
+    const context = currentContext();
+    if (!existsSync(context.unitPath))
+        return false;
+    return syncLinuxService(context);
+}
+export function assertLinuxSystemdInvocation() {
+    if (process.platform !== "linux") {
+        throw new Error("--systemd-service is only valid on Linux");
+    }
+    if (process.env[RYNX_SYSTEMD_SERVICE_ENV] !== RYNX_SYSTEMD_SERVICE) {
+        throw new Error("--systemd-service requires the Rynx systemd environment");
+    }
+    const cgroup = linuxSystemdCgroupForPid(process.pid);
+    if (!cgroupHasService(cgroup)) {
+        throw new Error(`--systemd-service requires the ${RYNX_SYSTEMD_SERVICE} cgroup`);
+    }
+}
+/**
+ * Stop through systemd while the oneshot unit owns the lifecycle state. PM2
+ * owns its own process tree; systemd only records whether its start hook has
+ * completed and provides the matching synchronous ExecStop boundary.
+ */
+export function stopLinuxServiceIfActive() {
+    if (process.platform !== "linux")
+        return false;
+    const context = currentContext();
+    const inspection = inspectLinuxPm2GodProcesses(context.pm2Home);
+    assertSingleGod(inspection);
+    if (!linuxUserSystemdAvailable()) {
+        const unitMode = installedLinuxUnitMode(context);
+        if (unitMode === "legacy-or-unknown" ||
+            (unitMode === "absent" && (inspection.kind === "service-cgroup" ||
+                currentProcessHasLinuxServiceEvidence()))) {
+            throw new Error(`cannot safely stop a legacy or still-loaded ${RYNX_SYSTEMD_SERVICE} without user systemd; ` +
+                "retry from a login session where systemctl --user is available");
+        }
+        return false;
+    }
+    const state = inspectLinuxSystemdService();
+    if (linuxSystemdServiceIsSettledInactive(state))
+        return false;
+    stopLinuxSystemdServiceAndVerify(context);
+    return true;
+}
+function stopLinuxSystemdServiceAndVerify(context) {
+    requireSuccess(run("systemctl", ["--user", "stop", RYNX_SYSTEMD_SERVICE], STOP_COMMAND_TIMEOUT_MS), `systemctl --user stop ${RYNX_SYSTEMD_SERVICE}`);
+    const remaining = inspectLinuxPm2GodProcesses(context.pm2Home);
+    if (remaining.kind !== "absent") {
+        throw new Error(`${RYNX_SYSTEMD_SERVICE} stop completed but the PM2 supervisor is still running: ` +
+            describeInspection(remaining));
+    }
+}
+function linuxSystemdServiceIsSettledInactive(state) {
+    return state.activeState === "inactive" || state.activeState === "failed";
+}
+function installedLinuxUnitMode(context) {
+    if (!existsSync(context.unitPath))
+        return "absent";
+    const content = readFileSync(context.unitPath, "utf8");
+    const type = /^\s*Type\s*=\s*([^\s#]+)\s*$/mi.exec(content)?.[1]?.toLowerCase();
+    const remains = /^\s*RemainAfterExit\s*=\s*yes\s*$/mi.test(content);
+    return type === "oneshot" && remains ? "oneshot" : "legacy-or-unknown";
+}
+function currentProcessHasLinuxServiceEvidence() {
+    if (process.env[RYNX_SYSTEMD_SERVICE_ENV] === RYNX_SYSTEMD_SERVICE)
+        return true;
+    try {
+        return cgroupHasService(linuxSystemdCgroupForPid(process.pid));
+    }
+    catch {
+        return false;
+    }
+}
+export function parseLinuxSystemdShow(output) {
+    const values = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const separator = line.indexOf("=");
+        if (separator <= 0)
+            continue;
+        values.set(line.slice(0, separator), line.slice(separator + 1));
+    }
+    return {
+        loadState: values.get("LoadState") ?? "",
+        activeState: values.get("ActiveState") ?? "",
+        subState: values.get("SubState") ?? "",
+        type: values.get("Type") ?? "",
+        remainAfterExit: values.get("RemainAfterExit") ?? "",
+        killMode: values.get("KillMode") ?? "",
+        killSignal: values.get("KillSignal") ?? "",
+        restartKillSignal: values.get("RestartKillSignal") ?? "",
+        finalKillSignal: values.get("FinalKillSignal") ?? "",
+        sendSigkill: values.get("SendSIGKILL") ?? "",
+        workingDirectory: values.get("WorkingDirectory") ?? "",
+        environment: values.get("Environment") ?? "",
+        execStart: values.get("ExecStart") ?? "",
+        execStop: values.get("ExecStop") ?? "",
+    };
+}
+export function inspectLinuxPm2GodProcesses(home, deps = {}) {
+    const readText = deps.readText ?? ((file) => readFileSync(file, "utf8"));
+    const entries = scanLinuxPm2GodPids(home, deps);
+    const processes = [];
+    for (const pid of entries) {
+        try {
+            const startBefore = linuxProcStartIdentity(readText(`/proc/${pid}/stat`));
+            const cmdline = readText(`/proc/${pid}/cmdline`).replaceAll("\u0000", " ").trim();
+            const cgroup = linuxSystemdCgroupForPid(pid, readText);
+            const startAfter = linuxProcStartIdentity(readText(`/proc/${pid}/stat`));
+            if (!startBefore || startBefore !== startAfter) {
+                throw new Error(`PM2 supervisor pid ${pid} changed during inspection`);
+            }
+            if (!isDedicatedPm2God(cmdline, home))
+                continue;
+            processes.push({ pid, cgroup, startIdentity: startBefore });
+        }
+        catch (error) {
+            if (!processDisappeared(error))
+                throw procReadError(`/proc/${pid}`, error);
+        }
+    }
+    if (processes.length === 0)
+        return { kind: "absent" };
+    const external = processes.filter((entry) => !cgroupHasService(entry.cgroup));
+    return external.length === 0
+        ? { kind: "service-cgroup", processes }
+        : { kind: "external", processes };
+}
+export function scanLinuxPm2GodPids(home, deps = {}) {
+    const procEntries = deps.procEntries ?? (() => readdirSync("/proc"));
+    const readText = deps.readText ?? ((file) => readFileSync(file, "utf8"));
+    const statUid = deps.statUid ?? ((file) => statSync(file).uid);
+    const currentUid = deps.currentUid ?? process.getuid?.();
+    let entries;
+    try {
+        entries = procEntries();
+    }
+    catch (error) {
+        throw new Error(`cannot inspect /proc: ${errorMessage(error)}`);
+    }
+    const pids = [];
+    for (const entry of entries) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        const pid = Number(entry);
+        if (!Number.isSafeInteger(pid) || pid <= 1)
+            continue;
+        if (currentUid !== undefined) {
+            try {
+                if (statUid(`/proc/${pid}`) !== currentUid)
+                    continue;
+            }
+            catch (error) {
+                if (processDisappeared(error))
+                    continue;
+                throw procReadError(`/proc/${pid}`, error);
+            }
+        }
+        try {
+            const cmdline = readText(`/proc/${pid}/cmdline`).replaceAll("\u0000", " ").trim();
+            if (isDedicatedPm2God(cmdline, home))
+                pids.push(pid);
+        }
+        catch (error) {
+            if (!processDisappeared(error)) {
+                throw procReadError(`/proc/${pid}/cmdline`, error);
+            }
+        }
+    }
+    return [...new Set(pids)].sort((left, right) => left - right);
+}
+export function linuxSystemdCgroupForPid(pid, readText = (file) => readFileSync(file, "utf8")) {
+    return normalizedCgroupPath(readText(`/proc/${pid}/cgroup`)) ?? "(unreadable)";
+}
+function currentContext() {
+    const dataDir = rynxHome();
+    const homeDir = homedir();
+    const pm2Home = path.join(dataDir, "pm2");
+    return {
+        homeDir,
+        dataDir,
+        logDir: path.join(dataDir, "logs"),
+        cliPath: fileURLToPath(new URL("./cli.js", import.meta.url)),
+        environment: process.env,
+        nodePath: process.execPath,
+        pathEnv: process.env.PATH || defaultLinuxPath(),
+        pm2Home,
+        unitPath: path.join(homeDir, ".config", "systemd", "user", RYNX_SYSTEMD_SERVICE),
+    };
+}
+function syncLinuxService(context) {
+    mkdirSync(context.dataDir, { recursive: true, mode: 0o700 });
+    mkdirSync(context.logDir, { recursive: true, mode: 0o700 });
+    const content = renderSystemdUnit(context);
+    const previous = existsSync(context.unitPath)
+        ? readFileSync(context.unitPath, "utf8")
+        : undefined;
+    const changed = previous !== content;
+    if (changed)
+        replaceFileAtomically(context.unitPath, content);
+    try {
+        requireSuccess(run("systemctl", ["--user", "daemon-reload"]), "systemctl --user daemon-reload");
+        assertStaticServiceDefinition(context, inspectLinuxSystemdService());
+        return changed;
+    }
+    catch (error) {
+        if (changed) {
+            if (previous === undefined)
+                rmSync(context.unitPath, { force: true });
+            else
+                replaceFileAtomically(context.unitPath, previous);
+            const rollback = run("systemctl", ["--user", "daemon-reload"]);
+            if (rollback.status !== 0) {
+                throw new AggregateError([error, new Error(`systemd rollback failed: ${commandDetail(rollback)}`)], "could not update or restore the Rynx systemd service");
+            }
+        }
+        throw error;
+    }
+}
+function inspectLinuxSystemdService() {
+    const output = systemctlUser([
+        "show",
+        RYNX_SYSTEMD_SERVICE,
+        "--property=LoadState",
+        "--property=ActiveState",
+        "--property=SubState",
+        "--property=Type",
+        "--property=RemainAfterExit",
+        "--property=KillMode",
+        "--property=KillSignal",
+        "--property=RestartKillSignal",
+        "--property=FinalKillSignal",
+        "--property=SendSIGKILL",
+        "--property=WorkingDirectory",
+        "--property=Environment",
+        "--property=ExecStart",
+        "--property=ExecStop",
+    ]);
+    return parseLinuxSystemdShow(output);
+}
+function assertStaticServiceDefinition(context, state) {
+    const errors = [];
+    if (state.loadState !== "loaded")
+        errors.push(`LoadState=${state.loadState || "(empty)"}`);
+    if (state.type !== "oneshot")
+        errors.push(`Type=${state.type || "(empty)"}`);
+    if (state.remainAfterExit !== "yes") {
+        errors.push(`RemainAfterExit=${state.remainAfterExit || "(empty)"}`);
+    }
+    if (state.workingDirectory !== context.dataDir) {
+        errors.push(`WorkingDirectory=${state.workingDirectory || "(empty)"}`);
+    }
+    if (state.killMode !== "process")
+        errors.push(`KillMode=${state.killMode || "(empty)"}`);
+    if (!signalMatches(state.killSignal, "18", "SIGCONT")) {
+        errors.push(`KillSignal=${state.killSignal || "(empty)"}`);
+    }
+    if (!signalMatches(state.restartKillSignal, "18", "SIGCONT")) {
+        errors.push(`RestartKillSignal=${state.restartKillSignal || "(empty)"}`);
+    }
+    if (!signalMatches(state.finalKillSignal, "18", "SIGCONT")) {
+        errors.push(`FinalKillSignal=${state.finalKillSignal || "(empty)"}`);
+    }
+    if (state.sendSigkill !== "no")
+        errors.push(`SendSIGKILL=${state.sendSigkill || "(empty)"}`);
+    for (const expected of [
+        `RYNX_HOME=${context.dataDir}`,
+        `${RYNX_SYSTEMD_SERVICE_ENV}=${RYNX_SYSTEMD_SERVICE}`,
+        `PATH=${context.pathEnv}`,
+    ]) {
+        if (!state.environment.includes(expected))
+            errors.push(`Environment missing ${expected}`);
+    }
+    for (const [name, value, action] of [
+        ["ExecStart", state.execStart, "start"],
+        ["ExecStop", state.execStop, "stop"],
+    ]) {
+        if (!value.includes(context.nodePath) ||
+            !value.includes(context.cliPath) ||
+            !value.includes(action) ||
+            !value.includes("--systemd-service")) {
+            errors.push(`${name}=${value || "(empty)"}`);
+        }
+    }
+    if (errors.length > 0) {
+        throw new Error(`${RYNX_SYSTEMD_SERVICE} effective configuration is invalid: ${errors.join("; ")}`);
+    }
+}
+function assertActiveServiceLifecycle(context) {
+    const inspection = inspectLinuxPm2GodProcesses(context.pm2Home);
+    assertSingleGod(inspection);
+    if (inspection.kind === "absent") {
+        throw new Error("systemd started without a PM2 supervisor");
+    }
+    const process = inspection.processes[0];
+    const state = inspectLinuxSystemdService();
+    assertStaticServiceDefinition(context, state);
+    if (state.activeState !== "active" ||
+        state.subState !== "exited") {
+        throw new Error(`${RYNX_SYSTEMD_SERVICE} lifecycle is not active: ` +
+            `ActiveState=${state.activeState}, SubState=${state.subState}`);
+    }
+    return process;
+}
+function assertSingleGod(inspection) {
+    if (inspection.kind !== "absent" && inspection.processes.length !== 1) {
+        throw new Error(`multiple PM2 supervisors use this RYNX_HOME: ${describeInspection(inspection)}`);
+    }
+}
+function describeInspection(inspection) {
+    if (inspection.kind === "absent")
+        return "absent";
+    return inspection.processes
+        .map((entry) => `${entry.pid}@${entry.cgroup}`)
+        .join(", ");
+}
+function inspectLinuxLinger() {
+    const result = run("loginctl", [
+        "show-user",
+        userInfo().username,
+        "--property=Linger",
+    ]);
+    if (result.status !== 0)
+        return undefined;
+    const value = result.stdout?.trim();
+    if (value === "Linger=yes")
+        return true;
+    if (value === "Linger=no")
+        return false;
+    return undefined;
+}
+function normalizedCgroupPath(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    if (trimmed.startsWith("/"))
+        return trimmed;
+    let unified;
+    for (const line of trimmed.split(/\r?\n/)) {
+        const first = line.indexOf(":");
+        const second = first < 0 ? -1 : line.indexOf(":", first + 1);
+        if (second < 0)
+            continue;
+        const hierarchy = line.slice(0, first);
+        const controllers = line.slice(first + 1, second);
+        const cgroup = line.slice(second + 1).trim();
+        if (!cgroup)
+            continue;
+        if (controllers.split(",").includes("name=systemd"))
+            return cgroup;
+        if (hierarchy === "0" && controllers === "")
+            unified = cgroup;
+    }
+    return unified;
+}
+function cgroupHasService(cgroup) {
+    return cgroup?.split("/").includes(RYNX_SYSTEMD_SERVICE) === true;
+}
+function linuxProcStartIdentity(raw) {
+    const closeParen = raw.lastIndexOf(")");
+    if (closeParen < 0)
+        return undefined;
+    return raw.slice(closeParen + 2).trim().split(/\s+/)[19];
+}
+function isDedicatedPm2God(cmdline, home) {
+    return cmdline.includes("PM2 v") && cmdline.includes(`God Daemon (${home})`);
+}
+function processDisappeared(error) {
+    const code = error?.code;
+    return code === "ENOENT" || code === "ESRCH" || code === "ENOTDIR";
+}
+function procReadError(file, error) {
+    return new Error(`cannot inspect ${file}: ${errorMessage(error)}`);
+}
+function assertUserSystemdAvailable() {
+    if (!linuxUserSystemdAvailable()) {
+        throw new Error("user systemd is unavailable in this login session");
+    }
+}
+function systemctlUser(args, timeout = COMMAND_TIMEOUT_MS) {
+    const result = run("systemctl", ["--user", ...args], timeout);
+    requireSuccess(result, `systemctl --user ${args.join(" ")}`);
+    return result.stdout ?? "";
+}
+function replaceFileAtomically(file, content) {
+    mkdirSync(path.dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(temporary, content, {
+            encoding: "utf8",
+            flag: "wx",
+            // The generated unit contains the caller's environment and may include
+            // runtime credentials. Keep the snapshot private to the owning user.
+            mode: 0o600,
+        });
+        renameSync(temporary, file);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+function run(command, args, timeout = COMMAND_TIMEOUT_MS) {
+    return spawnSync(command, [...args], {
+        encoding: "utf8",
+        stdio: "pipe",
+        timeout,
+        killSignal: "SIGTERM",
+    });
+}
+function requireSuccess(result, description) {
+    if (result.status === 0)
+        return;
+    throw new Error(`${description} failed: ${commandDetail(result)}`);
+}
+function commandDetail(result) {
+    return result.error?.message
+        || result.stderr?.trim()
+        || result.stdout?.trim()
+        || `exit ${result.status ?? "unknown"}`;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function signalMatches(value, number, name) {
+    return value === number || value === name;
+}
+function defaultLinuxPath() {
+    return "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+}
+function renderInheritedEnvironment(env) {
+    if (!env)
+        return "";
+    const requested = new Set((env[RYNX_SERVICE_ENV_KEYS] ?? "")
+        .split(/[\s,]+/)
+        .filter((name) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name)));
+    return Object.entries(env)
+        .filter(([name, value]) => value !== undefined &&
+        /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+        (AUTOMATIC_SERVICE_ENVIRONMENT.has(name) || requested.has(name)) &&
+        !name.startsWith("npm_") &&
+        !name.startsWith("RYNX_RUNNER_") &&
+        !BLOCKED_SERVICE_ENVIRONMENT.has(name) &&
+        !TRANSIENT_SERVICE_ENVIRONMENT.has(name))
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, value]) => `Environment=${systemdQuote(`${name}=${value}`)}`)
+        .join("\n");
+}
+function systemdQuote(value) {
+    return `"${value
+        .replaceAll("\\", "\\\\")
+        .replaceAll("\"", "\\\"")
+        .replaceAll("%", "%%")
+        .replaceAll("\t", "\\t")
+        .replaceAll("\n", "\\n")
+        .replaceAll("\r", "\\r")}"`;
+}
+function systemdPath(value) {
+    return value
+        .replaceAll("%", "%%")
+        .replaceAll("\\", "\\x5c")
+        .replaceAll(" ", "\\x20")
+        .replaceAll("\t", "\\t")
+        .replaceAll("\n", "\\n")
+        .replaceAll("\r", "\\r")
+        .replaceAll('"', "\\x22")
+        .replaceAll("'", "\\x27");
+}