akm-cli 0.9.0-rc.2 → 0.9.0-rc.4

package/dist/tasks/backends/cron.js

@@ -25,60 +25,70 @@
 //
 // Tests inject a fake exec so unit tests don't touch the real crontab.
 import { spawnSync } from "node:child_process";
-import fs from "node:fs";
 import path from "node:path";
 import { ConfigError } from "../../core/errors.js";
 import { getTaskLogDir } from "../../core/paths.js";
 import { resolveAkmInvocation } from "../resolve-akm-bin.js";
 import { parseSchedule, translateToCron } from "../schedule.js";
-const BEGIN = (id) => `# akm:task ${id} BEGIN`;
-const END = (id) => `# akm:task ${id} END`;
+import { buildScheduledTaskInvocation, resolveScheduledTaskContext, } from "../scheduler-invocation.js";
+import { nodeFs } from "./exec-utils.js";
+const BEGIN = (id) => `# akm:task ${assertCronValue(id)} BEGIN`;
+const END = (id) => `# akm:task ${assertCronValue(id)} END`;
 const DISABLED_PREFIX = "# akm:disabled ";
 const BLOCK_RE = /^# akm:task ([\w.@:_-]+) BEGIN$/;
+const BLOCK_END_RE = /^# akm:task ([\w.@:_-]+) END$/;
 export function CRON_BACKEND(options = {}) {
     const exec = options.exec ?? defaultCronExec();
+    const fsLike = options.fs ?? nodeFs();
     const logDir = options.logDir ?? getTaskLogDir();
     const akmArgv = options.akmArgv ?? resolveAkmInvocation().argv;
+    const envPath = options.envPath === false ? undefined : (options.envPath ?? process.env.PATH);
+    const scheduledContext = options.scheduledContext ?? resolveScheduledTaskContext();
     return {
         name: "cron",
         install(task) {
             // Create the log directory before writing the crontab line — cron
             // appends with `>>` and the surrounding shell will fail the entire
             // entry if the parent directory doesn't exist.
-            ensureDir(logDir);
-            const cronLine = buildCronLine(task, akmArgv, logDir);
+            fsLike.ensureDir(logDir);
+            const cronLine = buildCronLine(task, akmArgv, logDir, envPath, scheduledContext);
             const existing = readCrontab(exec);
             const block = renderBlock(task.id, cronLine, task.enabled);
             const next = upsertBlock(existing, task.id, block);
-            writeCrontab(exec, next);
+            replaceCrontab(exec, existing, next);
         },
         uninstall(id) {
             const existing = readCrontab(exec);
             const next = removeBlock(existing, id);
-            writeCrontab(exec, next);
+            replaceCrontab(exec, existing, next);
         },
         setEnabled(id, enabled) {
             const existing = readCrontab(exec);
             const next = toggleBlock(existing, id, enabled);
-            writeCrontab(exec, next);
+            replaceCrontab(exec, existing, next);
         },
         list() {
             const existing = readCrontab(exec);
             return listBlocks(existing).map(({ id, body }) => ({ id, signature: normalizeSignature(body) }));
         },
         expectedSignature(task) {
-            const cronLine = buildCronLine(task, akmArgv, logDir);
+            const cronLine = buildCronLine(task, akmArgv, logDir, envPath, scheduledContext);
             return normalizeSignature(cronBlockBody(cronLine, task.enabled));
         },
     };
 }
 // ── helpers (exported for tests) ────────────────────────────────────────────
-export function buildCronLine(task, akmArgv, logDir) {
+export function buildCronLine(task, akmArgv, logDir, envPath, scheduledContext) {
     const spec = parseSchedule(task.schedule, "cron");
     const cronExpr = translateToCron(spec);
     const logPath = path.join(logDir, `${task.id}.log`);
-    const cmd = [...akmArgv, "tasks", "run", task.id].map((part) => quoteForCron(part)).join(" ");
-    return `${cronExpr} ${cmd} >> ${quoteForCron(logPath)} 2>&1`;
+    const invocation = buildScheduledTaskInvocation(akmArgv, task.id, scheduledContext);
+    const cmd = invocation.argv.map((part) => quoteForCron(part)).join(" ");
+    const contextPrefix = Object.entries(invocation.environment)
+        .map(([key, value]) => `${key}=${quoteForCron(value)}`)
+        .join(" ");
+    const pathPrefix = envPath === undefined ? "" : `PATH=${quoteForCron(envPath)} `;
+    return `${cronExpr} ${contextPrefix} ${pathPrefix}${cmd} >> ${quoteForCron(logPath)} 2>&1`;
 }
 /** The crontab line as it appears inside a block — commented when disabled. */
 export function cronBlockBody(cronLine, enabled) {
@@ -93,28 +103,44 @@ export function renderBlock(id, cronLine, enabled) {
  * drift signature, and exported for tests.
  */
 export function listBlocks(existing) {
+    return parseBlocks(existing).map(({ id, body }) => ({ id, body }));
+}
+function parseBlocks(existing) {
     const out = [];
     const lines = existing.split(/\r?\n/);
     let currentId = null;
+    let start = -1;
     let body = [];
-    for (const line of lines) {
+    for (const [index, line] of lines.entries()) {
         const begin = line.match(BLOCK_RE);
         if (begin) {
+            if (currentId !== null)
+                throw malformedBlockError(currentId);
             currentId = begin[1];
+            start = index;
             body = [];
             continue;
         }
-        if (currentId !== null && line === END(currentId)) {
-            out.push({ id: currentId, body: body.join("\n") });
+        const end = line.match(BLOCK_END_RE);
+        if (end) {
+            if (currentId === null || end[1] !== currentId)
+                throw malformedBlockError(currentId ?? end[1]);
+            out.push({ id: currentId, body: body.join("\n"), start, end: index });
             currentId = null;
+            start = -1;
             body = [];
             continue;
         }
         if (currentId !== null)
             body.push(line);
     }
+    if (currentId !== null)
+        throw malformedBlockError(currentId);
     return out;
 }
+function malformedBlockError(id) {
+    return new ConfigError(`Crontab contains a malformed akm task block for "${id}"; refusing to modify it.`, "INVALID_CONFIG_FILE");
+}
 /** Collapse incidental whitespace so signature comparison ignores it. */
 function normalizeSignature(body) {
     return body
@@ -131,27 +157,17 @@ export function upsertBlock(existing, id, block) {
 }
 export function removeBlock(existing, id) {
     const lines = existing.split(/\r?\n/);
-    const out = [];
-    let inBlock = false;
-    for (const line of lines) {
-        if (!inBlock && line === BEGIN(id)) {
-            inBlock = true;
-            continue;
-        }
-        if (inBlock && line === END(id)) {
-            inBlock = false;
-            continue;
-        }
-        if (inBlock)
-            continue;
-        out.push(line);
-    }
+    const blocks = parseBlocks(existing).filter((block) => block.id === id);
+    if (blocks.length === 0)
+        return existing;
+    const out = lines.filter((_, index) => !blocks.some((block) => index >= block.start && index <= block.end));
     // Collapse trailing blank lines.
     while (out.length > 0 && out[out.length - 1] === "")
         out.pop();
     return out.join("\n");
 }
 export function toggleBlock(existing, id, enabled) {
+    parseBlocks(existing);
     const lines = existing.split(/\r?\n/);
     const out = [];
     let inBlock = false;
@@ -184,12 +200,23 @@ export function toggleBlock(existing, id, enabled) {
     return out.join("\n");
 }
 function quoteForCron(part) {
+    assertCronValue(part);
     // crontab passes the rest of the line to /bin/sh -c, so quote anything that
     // isn't a plain shell-safe token. Single-quote and escape embedded single
-    // quotes via the standard shell idiom: `'foo'\''bar'`.
+    // quotes via the standard shell idiom: `'foo'\''bar'`. Cron interprets `%`
+    // before the shell, even inside quotes, so close the quote around its escape.
     if (/^[A-Za-z0-9_\-./@:%=+,]+$/.test(part))
-        return part;
-    return `'${part.replace(/'/g, `'\\''`)}'`;
+        return part.replaceAll("%", "\\%");
+    return `'${part.replace(/'/g, `'\\''`).replace(/%/g, `'\\%'`)}'`;
+}
+function assertCronValue(value) {
+    for (const char of value) {
+        const code = char.codePointAt(0) ?? 0;
+        if (code < 0x20 || (code >= 0x7f && code <= 0x9f)) {
+            throw new ConfigError("Cron values must not contain control characters.", "INVALID_CONFIG_FILE");
+        }
+    }
+    return value;
 }
 function readCrontab(exec) {
     const result = exec.read();
@@ -209,13 +236,19 @@ function writeCrontab(exec, content) {
         throw new ConfigError(`crontab - failed (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`, "INVALID_CONFIG_FILE", "Ensure the `crontab` binary is on PATH and your shell can write the user crontab.");
     }
 }
-function ensureDir(dir) {
+function replaceCrontab(exec, existing, next) {
     try {
-        fs.mkdirSync(dir, { recursive: true });
+        writeCrontab(exec, next);
     }
-    catch {
-        // Best-effort: the install will surface a clearer error if the cron
-        // line later fails at runtime due to a missing redirection target.
+    catch (err) {
+        try {
+            writeCrontab(exec, existing);
+        }
+        catch (rollbackError) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new AggregateError([err, rollbackError], `${message}; restoring the prior crontab also failed.`);
+        }
+        throw err;
     }
 }
 function defaultCronExec() {

package/dist/tasks/backends/exec-utils.js

@@ -40,13 +40,65 @@ export function nodeFs() {
  */
 export function spawnCommand(args) {
     const [bin, ...rest] = args;
-    const r = spawnSync(bin, rest, { encoding: "utf8" });
+    const r = spawnSync(bin, rest);
     return {
         status: r.status ?? 1,
-        stdout: r.stdout ?? "",
-        stderr: r.stderr ?? "",
+        stdout: decodeCommandOutput(r.stdout),
+        stderr: decodeCommandOutput(r.stderr),
     };
 }
+/** Decode native command output, including the UTF-16 XML emitted by schtasks. */
+export function decodeCommandOutput(output) {
+    if (output === null || output === undefined)
+        return "";
+    if (typeof output === "string")
+        return output.replace(/^\uFEFF/, "");
+    if (output.length === 0)
+        return "";
+    if (output[0] === 0xef && output[1] === 0xbb && output[2] === 0xbf) {
+        return output.toString("utf8", 3);
+    }
+    if (output[0] === 0xff && output[1] === 0xfe) {
+        return output.subarray(2).toString("utf16le");
+    }
+    if (output[0] === 0xfe && output[1] === 0xff) {
+        return decodeUtf16Be(output.subarray(2));
+    }
+    const pairs = Math.floor(output.length / 2);
+    if (pairs > 1) {
+        let evenNuls = 0;
+        let oddNuls = 0;
+        for (let i = 0; i < pairs * 2; i += 2) {
+            if (output[i] === 0)
+                evenNuls += 1;
+            if (output[i + 1] === 0)
+                oddNuls += 1;
+        }
+        if (oddNuls / pairs > 0.6)
+            return output.toString("utf16le");
+        if (evenNuls / pairs > 0.6)
+            return decodeUtf16Be(output);
+    }
+    return output.toString("utf8");
+}
+/** Return XML with the declaration required by Task Scheduler's UTF-16 input. */
+export function normalizeXmlForUtf16File(xml) {
+    const source = xml.replace(/^\uFEFF/, "");
+    const declaration = '<?xml version="1.0" encoding="UTF-16"?>';
+    if (/^<\?xml\b[^?]*\?>/i.test(source)) {
+        return source.replace(/^<\?xml\b[^?]*\?>/i, declaration);
+    }
+    return `${declaration}\n${source}`;
+}
+function decodeUtf16Be(output) {
+    const evenLength = output.length - (output.length % 2);
+    const swapped = Buffer.allocUnsafe(evenLength);
+    for (let i = 0; i < evenLength; i += 2) {
+        swapped[i] = output[i + 1];
+        swapped[i + 1] = output[i];
+    }
+    return swapped.toString("utf16le");
+}
 /**
  * Escape a string for safe embedding in an XML attribute or text node.
  */

package/dist/tasks/backends/launchd.js

@@ -29,6 +29,7 @@ import { ConfigError } from "../../core/errors.js";
 import { getTaskLogDir } from "../../core/paths.js";
 import { resolveAkmInvocation } from "../resolve-akm-bin.js";
 import { parseSchedule, translateToLaunchd } from "../schedule.js";
+import { buildScheduledTaskInvocation, resolveScheduledTaskContext, } from "../scheduler-invocation.js";
 import { escapeXml, nodeExec, nodeFs } from "./exec-utils.js";
 export const LAUNCHD_LABEL_PREFIX = "com.akm.task.";
 export function LAUNCHD_BACKEND(options = {}) {
@@ -37,57 +38,157 @@ export function LAUNCHD_BACKEND(options = {}) {
     const agentsDir = options.agentsDir ?? defaultAgentsDir();
     const logDir = options.logDir ?? getTaskLogDir();
     const akmArgv = options.akmArgv ?? resolveAkmInvocation().argv;
+    const scheduledContext = options.scheduledContext ?? resolveScheduledTaskContext();
     const plistPath = (id) => path.join(agentsDir, `${LAUNCHD_LABEL_PREFIX}${id}.plist`);
     const label = (id) => `${LAUNCHD_LABEL_PREFIX}${id}`;
     const target = (id) => `gui/${exec.uid()}/${label(id)}`;
+    const pathEnv = () => {
+        if (options.envPath === false)
+            return undefined;
+        if (typeof options.envPath === "string")
+            return options.envPath;
+        return process.env.PATH ?? "";
+    };
+    const setEnableState = (id, enabled) => {
+        const verb = enabled ? "enable" : "disable";
+        const result = exec.run(["launchctl", verb, target(id)]);
+        if (result.status !== 0) {
+            throw new ConfigError(`launchctl ${verb} failed: ${result.stderr || result.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
+        }
+    };
     return {
         name: "launchd",
         install(task) {
             // Capture PATH at install time so launchd (which strips the environment
             // aggressively) can find the same binaries the user sees interactively.
-            let pathEnv;
-            if (options.envPath === false) {
-                pathEnv = undefined;
-            }
-            else if (typeof options.envPath === "string") {
-                pathEnv = options.envPath;
-            }
-            else {
-                pathEnv = process.env.PATH ?? "";
+            const xml = buildPlistXml(task, akmArgv, logDir, pathEnv(), scheduledContext);
+            const file = plistPath(task.id);
+            const previousPlist = fsLike.exists(file) ? fsLike.readFile(file) : undefined;
+            let previousEnabled = true;
+            if (previousPlist !== undefined) {
+                const disabledLabels = readDisabledLabels(exec);
+                if (disabledLabels === undefined) {
+                    throw new ConfigError(`launchctl print-disabled failed; cannot safely replace existing task "${task.id}".`, "INVALID_CONFIG_FILE");
+                }
+                previousEnabled = !disabledLabels.has(label(task.id));
             }
-            const xml = buildPlistXml(task, akmArgv, logDir, pathEnv);
             fsLike.ensureDir(agentsDir);
             // launchd refuses to start a job when StandardOutPath/StandardErrorPath
             // points at a non-existent directory; create it before bootstrap.
             fsLike.ensureDir(logDir);
-            fsLike.writeFile(plistPath(task.id), xml);
-            const bootout = exec.run(["launchctl", "bootout", target(task.id)]);
-            // bootout returning non-zero is fine — agent might not be loaded.
-            void bootout;
-            const bootstrap = exec.run(["launchctl", "bootstrap", `gui/${exec.uid()}`, plistPath(task.id)]);
-            if (bootstrap.status !== 0) {
-                throw new ConfigError(`launchctl bootstrap failed (exit ${bootstrap.status}): ${bootstrap.stderr || bootstrap.stdout || "no output"}.`, "INVALID_CONFIG_FILE", "Ensure `launchctl` is available; on macOS it is part of the base system.");
+            const tempFile = path.join(agentsDir, `.${task.id}.${Date.now()}.tmp`);
+            fsLike.writeFile(tempFile, xml);
+            let bootoutCompleted = false;
+            let previousWasLoaded = false;
+            let fileReplaced = false;
+            let enableStateTouched = false;
+            try {
+                const bootout = exec.run(["launchctl", "bootout", target(task.id)]);
+                if (bootout.status !== 0 && !isServiceNotFoundResult(bootout)) {
+                    throw new ConfigError(`launchctl bootout failed (exit ${bootout.status}): ${bootout.stderr || bootout.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
+                }
+                bootoutCompleted = true;
+                previousWasLoaded = previousPlist !== undefined && bootout.status === 0;
+                fsLike.replaceFile(tempFile, file);
+                fileReplaced = true;
+                // A disable override survives bootout and plist replacement. Clear it
+                // before bootstrap, then apply the desired state after registration.
+                enableStateTouched = true;
+                setEnableState(task.id, true);
+                const bootstrap = exec.run(["launchctl", "bootstrap", `gui/${exec.uid()}`, file]);
+                if (bootstrap.status !== 0) {
+                    throw new ConfigError(`launchctl bootstrap failed (exit ${bootstrap.status}): ${bootstrap.stderr || bootstrap.stdout || "no output"}.`, "INVALID_CONFIG_FILE", "Ensure `launchctl` is available; on macOS it is part of the base system.");
+                }
+                if (!task.enabled) {
+                    setEnableState(task.id, false);
+                }
             }
-            if (!task.enabled) {
-                const disable = exec.run(["launchctl", "disable", target(task.id)]);
-                if (disable.status !== 0) {
-                    throw new ConfigError(`launchctl disable failed: ${disable.stderr || disable.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
+            catch (err) {
+                if (!bootoutCompleted)
+                    throw err;
+                const rollbackErrors = [];
+                let priorFileRestored = !fileReplaced;
+                if (fileReplaced) {
+                    let replacementUnloaded = false;
+                    try {
+                        const rollbackBootout = exec.run(["launchctl", "bootout", target(task.id)]);
+                        replacementUnloaded = rollbackBootout.status === 0 || isServiceNotFoundResult(rollbackBootout);
+                        if (!replacementUnloaded) {
+                            rollbackErrors.push(new ConfigError(`launchctl bootout during rollback failed: ${rollbackBootout.stderr || rollbackBootout.stdout || "no output"}.`, "INVALID_CONFIG_FILE"));
+                        }
+                    }
+                    catch (rollbackError) {
+                        rollbackErrors.push(rollbackError);
+                    }
+                    if (replacementUnloaded) {
+                        try {
+                            if (previousPlist === undefined) {
+                                if (fsLike.exists(file))
+                                    fsLike.removeFile(file);
+                            }
+                            else {
+                                fsLike.writeFile(tempFile, previousPlist);
+                                fsLike.replaceFile(tempFile, file);
+                            }
+                            priorFileRestored = true;
+                        }
+                        catch (rollbackError) {
+                            rollbackErrors.push(rollbackError);
+                        }
+                    }
                 }
+                if (previousPlist !== undefined && previousWasLoaded && priorFileRestored) {
+                    try {
+                        setEnableState(task.id, true);
+                        const restore = exec.run(["launchctl", "bootstrap", `gui/${exec.uid()}`, file]);
+                        if (restore.status !== 0) {
+                            rollbackErrors.push(new ConfigError(`launchctl bootstrap during rollback failed: ${restore.stderr || restore.stdout || "no output"}.`, "INVALID_CONFIG_FILE"));
+                        }
+                    }
+                    catch (rollbackError) {
+                        rollbackErrors.push(rollbackError);
+                    }
+                    if (!previousEnabled) {
+                        try {
+                            setEnableState(task.id, false);
+                        }
+                        catch (rollbackError) {
+                            rollbackErrors.push(rollbackError);
+                        }
+                    }
+                }
+                else if (enableStateTouched) {
+                    try {
+                        setEnableState(task.id, previousPlist === undefined || previousEnabled);
+                    }
+                    catch (rollbackError) {
+                        rollbackErrors.push(rollbackError);
+                    }
+                }
+                if (rollbackErrors.length > 0) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    throw new AggregateError([err, ...rollbackErrors], `${message}; rollback for launchd task "${task.id}" was incomplete.`);
+                }
+                throw err;
+            }
+            finally {
+                if (fsLike.exists(tempFile))
+                    fsLike.removeFile(tempFile);
             }
         },
         uninstall(id) {
-            // Bootout first (may fail if agent never loaded — that's fine).
-            exec.run(["launchctl", "bootout", target(id)]);
+            const bootout = exec.run(["launchctl", "bootout", target(id)]);
+            if (bootout.status !== 0 && !isServiceNotFoundResult(bootout)) {
+                throw new ConfigError(`launchctl bootout failed (exit ${bootout.status}): ${bootout.stderr || bootout.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
+            }
+            // launchctl disable overrides persist after the plist is removed.
+            setEnableState(id, true);
             const file = plistPath(id);
             if (fsLike.exists(file))
                 fsLike.removeFile(file);
         },
         setEnabled(id, enabled) {
-            const verb = enabled ? "enable" : "disable";
-            const r = exec.run(["launchctl", verb, target(id)]);
-            if (r.status !== 0) {
-                throw new ConfigError(`launchctl ${verb} failed: ${r.stderr || r.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
-            }
+            setEnableState(id, enabled);
         },
         list() {
             if (!fsLike.exists(agentsDir))
@@ -98,48 +199,132 @@ export function LAUNCHD_BACKEND(options = {}) {
                     ids.push(file.slice(LAUNCHD_LABEL_PREFIX.length, -".plist".length));
                 }
             }
-            return ids.map((id) => ({ id }));
+            if (ids.length === 0)
+                return [];
+            const disabledLabels = readDisabledLabels(exec);
+            return ids.map((id) => {
+                if (!disabledLabels)
+                    return { id };
+                try {
+                    const loaded = exec.run(["launchctl", "print", target(id)]);
+                    if (loaded.status !== 0)
+                        return { id };
+                }
+                catch {
+                    return { id };
+                }
+                try {
+                    const xml = fsLike
+                        .readFile(plistPath(id))
+                        .replace(/<!-- akm-enabled:(?:true|false) -->/, `<!-- akm-enabled:${!disabledLabels.has(label(id))} -->`);
+                    return { id, signature: normalizeSignature(xml) };
+                }
+                catch {
+                    return { id };
+                }
+            });
+        },
+        expectedSignature(task) {
+            return normalizeSignature(buildPlistXml(task, akmArgv, logDir, pathEnv(), scheduledContext));
         },
     };
 }
 // ── XML builder (exported for tests) ────────────────────────────────────────
-export function buildPlistXml(task, akmArgv, logDir, pathEnv) {
+export function buildPlistXml(task, akmArgv, logDir, pathEnv, scheduledContext) {
     const spec = parseSchedule(task.schedule, "launchd");
     const trigger = translateToLaunchd(spec);
-    const argv = [...akmArgv, "tasks", "run", task.id];
+    const invocation = buildScheduledTaskInvocation(akmArgv, task.id, scheduledContext);
+    const argv = invocation.argv;
     const programArgs = argv.map((a) => `      <string>${escapeXml(a)}</string>`).join("\n");
     const logPath = path.join(logDir, `${task.id}.log`);
     const triggerXml = renderLaunchdTrigger(trigger);
-    const envVarsXml = pathEnv !== undefined
-        ? `  <key>EnvironmentVariables</key>\n  <dict>\n    <key>PATH</key>\n    <string>${escapeXml(pathEnv)}</string>\n  </dict>\n`
-        : "";
-    return launchdTemplate
+    const environment = { ...invocation.environment };
+    if (pathEnv !== undefined)
+        environment.PATH = pathEnv;
+    const envEntries = Object.entries(environment)
+        .map(([key, value]) => `    <key>${key}</key>\n    <string>${escapeXml(value)}</string>`)
+        .join("\n");
+    const envVarsXml = `  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n`;
+    const xml = launchdTemplate
+        .replace("<dict>\n", `<dict>\n  <!-- akm-enabled:${task.enabled} -->\n`)
         .replace("{{LABEL}}", LAUNCHD_LABEL_PREFIX + escapeXml(task.id))
         .replace("{{PROGRAM_ARGS}}", programArgs)
         .replaceAll("{{LOG_PATH}}", escapeXml(logPath))
         .replace("{{ENV_VARS}}", envVarsXml)
         .replace("{{TRIGGER_XML}}", triggerXml);
+    for (const char of xml) {
+        const code = char.codePointAt(0) ?? 0;
+        if (code <= 0x08 || code === 0x0b || code === 0x0c || (code >= 0x0e && code <= 0x1f)) {
+            throw new ConfigError("Launchd plist values must not contain XML-forbidden control characters.", "INVALID_CONFIG_FILE");
+        }
+    }
+    return xml;
 }
 function renderLaunchdTrigger(trigger) {
-    if (trigger.intervalSeconds !== undefined) {
-        return `  <key>StartInterval</key>
-  <integer>${trigger.intervalSeconds}</integer>`;
+    if (trigger.calendars !== undefined) {
+        const lines = ["  <key>StartCalendarInterval</key>", "  <array>"];
+        for (const calendar of trigger.calendars) {
+            lines.push(...renderCalendar(calendar, "    "));
+        }
+        lines.push("  </array>");
+        return lines.join("\n");
     }
     const cal = trigger.calendar ?? {};
-    const lines = ["  <key>StartCalendarInterval</key>", "  <dict>"];
-    if (cal.Minute !== undefined)
-        lines.push(`    <key>Minute</key><integer>${cal.Minute}</integer>`);
-    if (cal.Hour !== undefined)
-        lines.push(`    <key>Hour</key><integer>${cal.Hour}</integer>`);
-    if (cal.Day !== undefined)
-        lines.push(`    <key>Day</key><integer>${cal.Day}</integer>`);
-    if (cal.Month !== undefined)
-        lines.push(`    <key>Month</key><integer>${cal.Month}</integer>`);
-    if (cal.Weekday !== undefined)
-        lines.push(`    <key>Weekday</key><integer>${cal.Weekday}</integer>`);
-    lines.push("  </dict>");
+    const lines = ["  <key>StartCalendarInterval</key>", ...renderCalendar(cal, "  ")];
     return lines.join("\n");
 }
+function renderCalendar(calendar, indent) {
+    const valueIndent = `${indent}  `;
+    const lines = [`${indent}<dict>`];
+    if (calendar.Minute !== undefined) {
+        lines.push(`${valueIndent}<key>Minute</key><integer>${calendar.Minute}</integer>`);
+    }
+    if (calendar.Hour !== undefined)
+        lines.push(`${valueIndent}<key>Hour</key><integer>${calendar.Hour}</integer>`);
+    if (calendar.Day !== undefined)
+        lines.push(`${valueIndent}<key>Day</key><integer>${calendar.Day}</integer>`);
+    if (calendar.Month !== undefined)
+        lines.push(`${valueIndent}<key>Month</key><integer>${calendar.Month}</integer>`);
+    if (calendar.Weekday !== undefined) {
+        lines.push(`${valueIndent}<key>Weekday</key><integer>${calendar.Weekday}</integer>`);
+    }
+    lines.push(`${indent}</dict>`);
+    return lines;
+}
+function normalizeSignature(xml) {
+    return xml.replace(/\r\n/g, "\n").trim();
+}
+function readDisabledLabels(exec) {
+    try {
+        const result = exec.run(["launchctl", "print-disabled", `gui/${exec.uid()}`]);
+        if (result.status !== 0)
+            return undefined;
+        return parseDisabledLabels(result.stdout);
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseDisabledLabels(output) {
+    const envelope = /^\s*disabled services\s*=\s*\{([\s\S]*)\}\s*$/.exec(output);
+    if (!envelope)
+        return undefined;
+    const disabled = new Set();
+    let body = envelope[1];
+    while (body.trim()) {
+        const entry = /^\s*"([^"\r\n]+)"\s*=>\s*(true|false|enabled|disabled)\s*/.exec(body);
+        if (!entry)
+            return undefined;
+        if (entry[2] === "true" || entry[2] === "disabled")
+            disabled.add(entry[1]);
+        body = body.slice(entry[0].length);
+    }
+    return disabled;
+}
+function isServiceNotFoundResult(result) {
+    const output = `${result.stderr ?? ""}\n${result.stdout ?? ""}`;
+    return /could not find service\b|service\b.*\bnot found\b|\bno such process\b/i.test(output);
+}
 function defaultAgentsDir() {
     // launchd's per-user LaunchAgents live under the user's home directory.
     // If we can't determine HOME, refuse rather than silently producing a
@@ -162,9 +347,15 @@ function defaultLaunchdExec() {
 function defaultLaunchdFs() {
     return {
         ...nodeFs(),
+        readFile(file) {
+            return fs.readFileSync(file, "utf8");
+        },
         removeFile(file) {
             fs.rmSync(file, { force: true });
         },
+        replaceFile(source, destination) {
+            fs.renameSync(source, destination);
+        },
         list(dir) {
             try {
                 return fs.readdirSync(dir);