@songsid/agend 2.1.1-beta.7 → 2.1.1-beta.8

package/dist/sd-notify.d.ts

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 /**
  * Keep systemd's notification socket private to the fleet process. The socket
  * path is a capability: any child that inherits it can send READY/WATCHDOG/
@@ -9,4 +10,10 @@
  */
 export declare function consumeNotifySocket(environment: NodeJS.ProcessEnv): string | undefined;
 export declare function buildNotifyEnvironment(environment: NodeJS.ProcessEnv, socket: string): NodeJS.ProcessEnv;
+/** Only the process recorded as the fleet owner may exercise the capability. */
+export declare function isFleetOwner(dataDir?: string, pid?: number): boolean;
+type NotifyExecutor = (file: string, args: readonly string[], options: Parameters<typeof execFileSync>[2]) => unknown;
+/** Exported for a focused test of the exact helper environment. */
+export declare function sendSystemdNotification(state: string, socket: string, environment: NodeJS.ProcessEnv, execute?: NotifyExecutor): void;
 export declare function sdNotify(state: string): void;
+export {};

package/dist/sd-notify.js

@@ -1,4 +1,7 @@
 import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getAgendHome } from "./paths.js";
 /**
  * Keep systemd's notification socket private to the fleet process. The socket
  * path is a capability: any child that inherits it can send READY/WATCHDOG/
@@ -10,23 +13,36 @@ import { execFileSync } from "node:child_process";
  */
 export function consumeNotifySocket(environment) {
     const socket = environment.NOTIFY_SOCKET;
-    if (socket)
-        delete environment.NOTIFY_SOCKET;
+    delete environment.NOTIFY_SOCKET;
     return socket || undefined;
 }
 export function buildNotifyEnvironment(environment, socket) {
     return { ...environment, NOTIFY_SOCKET: socket };
 }
 const notifySocket = consumeNotifySocket(process.env);
+/** Only the process recorded as the fleet owner may exercise the capability. */
+export function isFleetOwner(dataDir = getAgendHome(), pid = process.pid) {
+    try {
+        const fleetPid = Number.parseInt(readFileSync(join(dataDir, "fleet.pid"), "utf8").trim(), 10);
+        return Number.isSafeInteger(fleetPid) && fleetPid === pid;
+    }
+    catch {
+        return false;
+    }
+}
+/** Exported for a focused test of the exact helper environment. */
+export function sendSystemdNotification(state, socket, environment, execute = execFileSync) {
+    execute("systemd-notify", [state], {
+        env: buildNotifyEnvironment(environment, socket),
+        stdio: "ignore",
+        timeout: 5000,
+    });
+}
 export function sdNotify(state) {
-    if (!notifySocket)
+    if (!notifySocket || !isFleetOwner())
         return;
     try {
-        execFileSync("systemd-notify", [state], {
-            env: buildNotifyEnvironment(process.env, notifySocket),
-            stdio: "ignore",
-            timeout: 5000,
-        });
+        sendSystemdNotification(state, notifySocket, process.env);
     }
     catch { /* best effort */ }
 }

package/dist/sd-notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"sd-notify.js","sourceRoot":"","sources":["../src/sd-notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA8B;IAChE,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,WAAW,CAAC,aAAa,CAAC;IAC7C,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,WAA8B,EAC9B,MAAc;IAEd,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAEtD,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,IAAI,CAAC;QACH,YAAY,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE;YACtC,GAAG,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC;YACtD,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"sd-notify.js","sourceRoot":"","sources":["../src/sd-notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA8B;IAChE,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC;IACzC,OAAO,WAAW,CAAC,aAAa,CAAC;IACjC,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,WAA8B,EAC9B,MAAc;IAEd,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAEtD,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAC1B,OAAO,GAAG,YAAY,EAAE,EACxB,GAAG,GAAG,OAAO,CAAC,GAAG;IAEjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAC9B,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EACvD,EAAE,CACH,CAAC;QACF,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,GAAG,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,MAAc,EACd,WAA8B,EAC9B,UAA0B,YAAY;IAEtC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE;QACjC,GAAG,EAAE,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC;QAChD,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC7C,IAAI,CAAC;QACH,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@songsid/agend",
-  "version": "2.1.1-beta.7",
+  "version": "2.1.1-beta.8",
   "description": "Multi-agent fleet daemon — run any coding CLI (Claude, Gemini, Codex, OpenCode) from Telegram",
   "type": "module",
   "bin": {

package/templates/systemd.service.ejs

@@ -4,8 +4,12 @@ After=network.target
 
 [Service]
 Type=notify
-# Node delegates AF_UNIX datagram sends to systemd-notify, so the helper must
-# be accepted. src/sd-notify.ts keeps NOTIFY_SOCKET out of all other children.
+# NotifyAccess must stay "all": sdNotify() delivers via a short-lived
+# systemd-notify child, so "main"/"exec" reject it with
+# "Got notification message from PID <helper>, but reception only permitted
+# for main PID <service>" (Result=protocol), breaking READY/WATCHDOG.
+# The capability is instead contained in src/sd-notify.ts, which removes
+# NOTIFY_SOCKET from the environment so no other child process inherits it.
 NotifyAccess=all
 TimeoutStartSec=0
 WatchdogSec=60