cawdev-cli 1.0.6-beta → 1.0.8-beta

package/runner/attach.mjs

@@ -482,7 +482,7 @@ export function elapsed(ms) {
  */
 export function footerLines(state, width, ink = painter(3)) {
   const {
-    runner, runs = [], email, watching, connected = true,
+    runner, runs = [], email, expired = false, watching, connected = true,
     banner = [], overlay = [], input = null, keys = '', status = '',
     running = null, now = Date.now(), matches = [],
   } = state;
@@ -519,6 +519,16 @@ export function footerLines(state, width, ink = painter(3)) {
     ), width));
   }
 
+  // The platform refused the stored session (401). Pinned for the same reason
+  // as the row above: one line in the scrollback is gone with the next
+  // transcript line, and every action from here on would fail without it.
+  if (expired) {
+    lines.push(padVisible(clip(
+      ` ${ink.warn('!')} ${ink.muted('session expired —')} ${ink.text('/login')} ${ink.muted('to sign in again')}`,
+      width,
+    ), width));
+  }
+
   // Who and where. The runner's NAME is what the console shows and what
   // `--runner` takes, so it is the word somebody would type; the email is what
   // every action here is done as, and "watching only" is not a lesser state,
@@ -679,19 +689,19 @@ async function openSession(argv, url) {
  * too is not belt and braces: a machine over ssh has no browser to open, and
  * this is the only thing that makes it work at all.
  */
-async function runSignIn(session, ink = painter()) {
+async function runSignIn(session, ink = painter(), say = (line) => console.log(line)) {
   const outcome = await signInThroughBrowser(session, ({ url, code }) => {
-    console.log(`  ${ink.muted('If your browser did not open, go to')}`);
-    console.log(`      ${ink.accent(url)}`);
-    console.log(`  ${ink.muted('and check it is showing')}  ${ink.bold(code)}\n`);
-    console.log(`  ${ink.muted('Waiting…')}`);
+    say(`  ${ink.muted('If your browser did not open, go to')}`);
+    say(`      ${ink.accent(url)}`);
+    say(`  ${ink.muted('and check it is showing')}  ${ink.bold(code)}\n`);
+    say(`  ${ink.muted('Waiting…')}`);
   });
   if (outcome.signedIn) {
-    console.log(`  ${ink.success('Signed in')} as ${ink.bold(outcome.email)}.\n`);
+    say(`  ${ink.success('Signed in')} as ${ink.bold(outcome.email)}.\n`);
   } else if (outcome.refused) {
-    console.log(`  ${ink.danger('Refused')} in the browser.\n`);
+    say(`  ${ink.danger('Refused')} in the browser.\n`);
   } else {
-    console.log(`  ${ink.warn('The code expired.')}\n`);
+    say(`  ${ink.warn('The code expired.')}\n`);
   }
   return outcome;
 }
@@ -755,7 +765,7 @@ export function configMenu(file, runner = {}, gone = new Set()) {
     kind: 'config',
     title: `this machine — ${runner.name ?? file.name ?? 'cawdev'}`,
     rows: [
-      { id: 'add-project', label: 'Add a project', hint: `${serving}${pending}` },
+      { id: 'add-project', label: 'Add a project — or create one on cawdev', hint: `${serving}${pending}` },
       { id: 'add-workspace', label: 'Add a workspace to a project', hint: checkouts || 'no projects to add one to' },
       ...[...new Set([...KNOWN_AGENTS, ...agents])].map((command) => (agents.includes(command)
         ? { id: `agent:${command}`, label: `Disable ${command}`, hint: 'spawned here now' }
@@ -801,6 +811,9 @@ function refOf(word) {
   return word.replace(/^r/i, 'R').replace(/^i/i, 'i');
 }
 
+/** How many matching commands advanced mode's prompt shows at once. */
+const SPLIT_COMPLETIONS = 6;
+
 /** The slash commands, and the one place they are described. */
 const COMMANDS = [
   ['/help', 'this list'],
@@ -887,6 +900,11 @@ export class Attached {
   constructor(socketPath, session, options = {}) {
     this.socketPath = socketPath;
     this.session = session;
+    if (session) {
+      session.onExpired = () => this.sessionExpired();
+    }
+    /** True from a 401 on a session that was signed in until `/login` works. */
+    this.expired = false;
     this.options = options;
     this.ink = painter();
     this.screen = new Scrollback(options.out ?? process.stdout);
@@ -1864,8 +1882,16 @@ export class Attached {
       }
       if (rows.length) {
         // As far as they agree, which is what every shell does and nobody has
-        // to be taught. One match completes it whole.
-        line.set(commonPrefix(rows.map(([name]) => name)));
+        // to be taught. One match completes it whole. Once the line is already
+        // that far, Tab moves down the list instead — `/log` is a command AND
+        // the prefix of `/login` and `/logout`, and Tab stopping there for
+        // good left those two reachable only by the arrows.
+        const prefix = commonPrefix(rows.map(([name]) => name));
+        if (rows.length > 1 && line.text.toLowerCase() === prefix.toLowerCase() && this.input.showing !== false) {
+          this.input.at = (at + 1) % rows.length;
+        } else {
+          line.set(prefix);
+        }
         this.input.showing = true;
         this.dirty = true;
       }
@@ -2606,7 +2632,7 @@ export class Attached {
    * comes back absolute; configure.mjs inspects it again before acting.
    */
   async askPath({ question, suggestions, slug, gitUrl, inspect = inspectPath }) {
-    this.say(`  ${this.ink.text(question)}`);
+    // The question is the picker's title; printing it as well put it on screen twice.
     const rows = [];
     for (const each of suggestions) {
       const seen = await inspect(each.path, { gitUrl });
@@ -2829,21 +2855,31 @@ export class Attached {
    * the moment it is decided.
    */
   async signIn() {
+    let say;
     if (this.split) {
-      this.leaveSplit();
+      // Advanced mode stays: the URL and the code go to the prompt window,
+      // where everything said there is read, and the browser opens anyway.
+      say = (line) => this.say(line);
+    } else {
+      // Everything queued goes out first and the footer comes down, so what
+      // `runSignIn` prints with `console.log` lands under the transcript rather
+      // than through the middle of a live region nothing is going to erase.
+      this.say('');
+      this.screen.update(this.pending, []);
+      this.pending = [];
     }
-    // Everything queued goes out first and the footer comes down, so what
-    // `runSignIn` prints with `console.log` lands under the transcript rather
-    // than through the middle of a live region nothing is going to erase.
-    this.say('');
-    this.screen.update(this.pending, []);
-    this.pending = [];
-    const outcome = await runSignIn(this.session, this.ink)
+    const outcome = await runSignIn(this.session, this.ink, say)
       .catch((failure) => ({ signedIn: false, message: failure.message }));
     if (outcome.message) {
       this.say(this.ink.danger(`  could not sign in: ${outcome.message}`));
     }
-    if (this.session.signedIn) {
+    if (this.session.signedIn && this.expired) {
+      // After an expiry the watchers never stopped — they have been failing
+      // quietly and pick up on their own — so a second set would poll twice.
+      this.expired = false;
+      this.note('signed in again');
+      void this.findStopped();
+    } else if (this.session.signedIn) {
       void this.watchInbox();
       void this.watchQuestions();
       void this.findStopped();
@@ -2852,6 +2888,20 @@ export class Attached {
     return undefined;
   }
 
+  /**
+   * The platform answered 401 to a session that was signed in: it expired, was
+   * signed out from the console, or the account went. Said once, where it is
+   * read — the prompt window in advanced mode, the scrollback otherwise — and
+   * the footer keeps a row until `/login` succeeds. The watchers keep polling
+   * and fail quietly; they pick up again on their own after the sign-in.
+   */
+  sessionExpired() {
+    if (this.expired) return;
+    this.expired = true;
+    this.say(this.ink.warn('  your cawdev session has expired or is no longer valid — type /login to sign in again'));
+    this.note('session expired — /login to sign in again');
+  }
+
   // --- advanced mode — split.mjs ----------------------------------------------
 
   /**
@@ -3219,7 +3269,16 @@ export class Attached {
         + ' · / commands · tab next window');
     // A question or a request on screen says which window it came from.
     const from = banner.length ? [ink.bold(ink.warn(` from ${this.tagOf(current)}`))] : [];
-    const fixed = [...from, ...banner, ...overlay, input];
+    // The commands matching what is typed, above the line as in the footer —
+    // advanced mode drew none, so enter took a highlighted command nobody saw.
+    const matches = this.mode === 'typing' && this.input?.showing !== false ? this.matching() : { rows: [], at: 0 };
+    // Six rows at most, scrolled to the highlighted one: a bare `/` matches
+    // every command, and the prompt grows with what it holds.
+    const first = Math.max(0, Math.min(matches.at - 2, matches.rows.length - SPLIT_COMPLETIONS));
+    const completing = completionLines(
+      matches.rows.slice(first, first + SPLIT_COMPLETIONS), matches.at - first, inner, ink,
+    );
+    const fixed = [...from, ...banner, ...overlay, ...completing, input];
     const promptRows = Math.max(PROMPT_ROWS, fixed.length + 5);
     // The roadmap across the top: as tall as its fullest column needs, never
     // more than a third of the screen, and never so tall that no window fits
@@ -4561,6 +4620,7 @@ export class Attached {
       runner: this.runner,
       runs: this.runs,
       email: this.session.email,
+      expired: this.expired,
       watching: run,
       connected: this.connected,
       // R83's status line is about what this machine is DRIVING, which is not

package/runner/cawdev.mjs

@@ -60,7 +60,7 @@ const USAGE = `
 
   cawdev config                          a menu: add a project, add a
                                           workspace, agents, console rules
-  cawdev config add-project              serve one more project you can write to
+  cawdev config add-project              serve one more project you can write to, or create one
   cawdev config add-workspace            another checkout for a project you
                                           already serve — R47's concurrency
   cawdev config remove-project <slug>    stop serving a project (its checkouts
@@ -464,7 +464,7 @@ export async function pickAction(ask, say, pick = askOne) {
   const picked = await pick(ask, say, new Select({
     title: 'What do you want to change on this machine?',
     rows: [
-      { id: 'add-project', label: 'Add a project' },
+      { id: 'add-project', label: 'Add a project — or create one on cawdev' },
       { id: 'add-workspace', label: 'Add a workspace to a project' },
       { id: 'remove-project', label: 'Stop serving a project' },
       { id: 'agent-enable', label: `Enable an agent (${KNOWN_AGENTS.join(' / ')})` },

package/runner/configure.mjs

@@ -181,13 +181,22 @@ async function settleCheckout({ path, slug, gitUrl, ask, say, ink, clone, inspec
   await cloneAside(ask, clone, gitUrl, path);
 }
 
+/** The row of Add a project that makes a new project rather than picking one. */
+export const CREATE_A_PROJECT = 'create:new';
+
 /**
- * Add one project this session can serve to an already-configured machine.
+ * Add one project this session can serve to an already-configured machine —
+ * or CREATE one on cawdev and serve it, from the same list.
  *
  * Clones it, then widens the existing token's grants to cover it — via
  * {@link resolveTokenId}, or by minting a fresh token when that comes back
  * empty (an older machine's first run through this command, which is also
  * what teaches it the id for next time).
+ *
+ * The list is ALWAYS shown, one project or six: going straight to "where
+ * should cawdev live?" when one was left answered a question nobody had been
+ * asked, about a project the screen never named. Its last row is "Create a
+ * new project on cawdev", see {@link askForANewProject}.
  */
 export async function addProject({
   configPath, file, url, session: given = null,
@@ -206,30 +215,37 @@ export async function addProject({
   const already = new Set(slugsOf(file));
   const projects = servable(await session.request('/api/projects'))
     .filter((project) => !already.has(project.slug));
-  if (!projects.length) {
-    throw new Error('Every project you can serve is already configured on this machine.');
-  }
 
-  let project = projects[0];
-  if (projects.length > 1) {
-    const picked = await pick(ask, say, new Select({
-      title: 'Which project should this machine also serve?',
-      rows: projects.map((candidate) => ({
+  const picked = await pick(ask, say, new Select({
+    title: projects.length
+      ? 'Which project should this machine also serve?'
+      : 'Every project you can serve is already here — create a new one?',
+    rows: [
+      ...projects.map((candidate) => ({
         id: candidate.slug, label: candidate.name, hint: candidate.slug,
       })),
+      { id: CREATE_A_PROJECT, label: 'Create a new project on cawdev', hint: `on ${url} — a name and its git repository` },
+    ],
+  }));
+
+  let project;
+  let path;
+  if (picked.row.id === CREATE_A_PROJECT) {
+    ({ project, path } = await askForANewProject({
+      file, url, session, ask, say, ink, pick, askPath, inspect, clone,
     }));
+  } else {
     project = projects.find((candidate) => candidate.slug === picked.row.id);
+    path = await askPath({
+      ask, say, pick, inspect,
+      question: `Where should ${project.slug} live on this machine?`,
+      suggestions: suggestProjectPaths(file, project.slug),
+      slug: project.slug,
+      gitUrl: project.gitUrl ?? null,
+    });
+    await settleCheckout({ path, slug: project.slug, gitUrl: project.gitUrl ?? null, ask, say, ink, clone, inspect });
   }
 
-  const path = await askPath({
-    ask, say, pick, inspect,
-    question: `Where should ${project.slug} live on this machine?`,
-    suggestions: suggestProjectPaths(file, project.slug),
-    slug: project.slug,
-    gitUrl: project.gitUrl ?? null,
-  });
-  await settleCheckout({ path, slug: project.slug, gitUrl: project.gitUrl ?? null, ask, say, ink, clone, inspect });
-
   const grants = {};
   for (const slug of [...already, project.slug]) {
     grants[slug] = ['runner:operate'];
@@ -250,9 +266,71 @@ export async function addProject({
 
   await write(configPath, next);
   say(`  ${ink.success('✓')} ${ink.muted('Now serving')} ${ink.text(project.slug)} ${ink.muted('at')} ${ink.accent(path)}`);
+  if (project.created) {
+    // The rest of the console's setup walk — rules, members, the brief — is
+    // decisions about the project, not about this machine, and lives there.
+    say(`  ${ink.muted('The rest of its setup (rules, members, the CTO Interview):')} ${ink.accent(`${url}/projects/${project.slug}/setup`)}`);
+  }
   return next;
 }
 
+/**
+ * "Create a new project on cawdev": a name, the repository, the checkout —
+ * and only then the project, so a clone that fails leaves nothing on the
+ * platform. The slug is the SERVER's (R290, `<username>-<name>`); it is shown
+ * before anything is made and the answer to the POST is what is used.
+ *
+ * An empty git URL is allowed when the path is already a checkout: its
+ * `origin` is the repository, which is the commonest case — somebody with the
+ * code on their disk who wants cawdev to know about it.
+ */
+async function askForANewProject({ file, url, session, ask, say, ink, pick, askPath, inspect, clone }) {
+  const name = String(await ask.line('  Name of the new project ')).trim();
+  if (!name) {
+    throw new Error('A project needs a name. Nothing changed.');
+  }
+  const suggested = await session.request(`/api/projects/slug-suggestion?name=${encodeURIComponent(name)}`)
+    .then((answer) => answer?.slug)
+    .catch(() => null);
+  const slug = suggested || name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'project';
+  say(`  ${ink.muted('It will be')} ${ink.text(slug)} ${ink.muted('on')} ${ink.accent(url)}`);
+
+  const typedUrl = String(await ask.line(
+    '  Its git repository URL — blank if the checkout is already on this machine ',
+  )).trim();
+  const path = await askPath({
+    ask, say, pick, inspect,
+    question: `Where should ${slug} live on this machine?`,
+    suggestions: suggestProjectPaths(file, slug),
+    slug,
+    gitUrl: typedUrl || null,
+  });
+
+  let gitUrl = typedUrl || null;
+  if (!gitUrl) {
+    const seen = await inspect(path, { gitUrl: null });
+    if (seen.kind !== 'checkout' || !seen.remote) {
+      throw new Error(`${path} is ${describe(seen, slug)} — with no git URL, the path must be a checkout `
+        + 'with an origin. Nothing changed.');
+    }
+    gitUrl = seen.remote;
+    say(`  ${ink.muted('Its repository, from that checkout\'s origin:')} ${ink.accent(gitUrl)}`);
+  }
+  await settleCheckout({ path, slug, gitUrl, ask, say, ink, clone, inspect });
+
+  if (!await confirm(ask, `Create ${name} on ${url}`)) {
+    throw new Error(`Nothing created on cawdev; the checkout at ${path} stays.`);
+  }
+  let created;
+  try {
+    created = await session.request('/api/projects', { method: 'POST', body: { name, gitUrl } });
+  } catch (failure) {
+    throw new Error(`cawdev refused to create ${name}: ${failure.message}. The checkout at ${path} stays.`);
+  }
+  say(`  ${ink.success('✓')} ${ink.muted('Created')} ${ink.text(created.name ?? name)} ${ink.muted('as')} ${ink.text(created.slug)}`);
+  return { project: { ...created, created: true }, path };
+}
+
 /** Add another checkout for a project this machine already serves — R47. */
 export async function addWorkspace({
   configPath, file,

package/runner/input.mjs

@@ -192,7 +192,11 @@ export function completions(text, commands) {
     return [];
   }
   const word = typed.slice(1).toLowerCase();
-  return commands.filter(([name]) => name.slice(1).toLowerCase().startsWith(word));
+  const found = commands.filter(([name]) => name.slice(1).toLowerCase().startsWith(word));
+  // A name typed in full comes first, so enter runs `/log` and not `/login`,
+  // the first longer one in the list.
+  const exact = found.filter(([name]) => name.slice(1).toLowerCase() === word);
+  return [...exact, ...found.filter((row) => !exact.includes(row))];
 }
 
 /**

package/runner/restart.mjs

@@ -0,0 +1,191 @@
+// What a daemon that restarted under its sessions does about them — R339.
+//
+// A daemon killed mid-run (most often for memory, by the kernel, while the
+// session ran a test suite) comes back healthy with an empty `running` map.
+// The platform could only infer what happened: five minutes later
+// StaleRunSweeper failed the run as "its runner is alive but stopped driving
+// it", a sentence that names no cause and arrives after somebody has already
+// gone looking. The one process that KNOWS is the new daemon, so the old one
+// leaves a note: the runs it is driving, written beside the socket every time
+// that set changes. On boot the new one reads it and reports each run it no
+// longer holds as DAEMON_RESTARTED, at once.
+//
+// And so it happens less: `sessionMemoryMax` spawns each agent in a systemd
+// scope with a memory ceiling, so a runaway test suite takes down its own
+// session — the ordinary "agent was terminated" path — and not the daemon.
+//
+// Pure where it can be. The file, the scope probe and the kill are the only
+// side effects, and each takes what it touches as an argument.
+
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+
+/**
+ * Where a runner's note lives — one per runner id, because one machine may
+ * run two configs. NOT in the run directory, which holds sockets and nothing
+ * else (the terminal lists it to find daemons): beside it, so a test that
+ * points CAWDEV_RUN_DIR at a temporary directory keeps its notes there too.
+ */
+export function drivingPath(runnerId, env = process.env) {
+  const dir = env.CAWDEV_DRIVING_DIR
+    ?? (env.CAWDEV_RUN_DIR ? `${env.CAWDEV_RUN_DIR}-driving` : join(homedir(), '.cawdev', 'driving'));
+  return join(dir, `${runnerId}.json`);
+}
+
+/**
+ * The note: who wrote it and what it was driving. `command` is the child's
+ * command's base name, so the next daemon can tell its own orphan from an
+ * unrelated process that was handed the same pid after a reboot.
+ */
+export function snapshotOf(pid, running) {
+  const runs = [];
+  for (const [id, child] of running) {
+    runs.push({
+      id,
+      projectSlug: child?.cawdevProjectSlug ?? null,
+      childPid: Number.isInteger(child?.pid) ? child.pid : null,
+      command: child?.cawdevCommand ? basename(child.cawdevCommand) : null,
+    });
+  }
+  return { pid, runs };
+}
+
+/** Atomic: a daemon killed mid-write must not leave half a note for the next one. */
+export async function writeDriving(path, snapshot) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile(temporary, JSON.stringify(snapshot), { mode: 0o600 });
+  await rename(temporary, path);
+}
+
+/** The previous note, or null — a missing or unreadable one is "nothing was being driven". */
+export async function readDriving(path) {
+  try {
+    const parsed = JSON.parse(await readFile(path, 'utf8'));
+    return parsed && Number.isInteger(parsed.pid) && Array.isArray(parsed.runs) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The runs a previous daemon left behind, or none.
+ *
+ * None when the note is this process's own, and none when its writer is
+ * still alive: that is a second daemon on the same runner id, and its runs
+ * are its own business.
+ */
+export function leftBehind(previous, myPid, isAlive) {
+  if (!previous || previous.pid === myPid || isAlive(previous.pid)) {
+    return [];
+  }
+  return previous.runs.filter((run) => typeof run.id === 'string' && run.projectSlug);
+}
+
+/** Whether a pid is a live process. Signal 0 tests without sending. */
+export function isAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (failure) {
+    return failure.code === 'EPERM';
+  }
+}
+
+/** Live states a restart does not concern: they hold no process. */
+const NOT_DRIVEN = new Set(['QUEUED', 'PAUSED', 'USAGE_LIMITED']);
+
+/**
+ * Whether the platform's view of a run means a restart killed it: live,
+ * holding a process, and still this runner's. A run carried on elsewhere in
+ * the meantime is not ours to fail.
+ */
+export function killedByRestart(run, runnerId) {
+  return Boolean(run?.live)
+    && !NOT_DRIVEN.has(run.state)
+    && (!run.runnerId || run.runnerId === runnerId);
+}
+
+/**
+ * What the run says — the cause, the evidence to look for, and the way out.
+ * `stopped` is the signal a daemon that stopped ON PURPOSE wrote into its
+ * note; without one it was killed, and memory is the usual reason.
+ */
+export function restartSummary({ name, previousPid, pid, orphanStopped, stopped = null }) {
+  const why = stopped
+    ? `It was stopped (${stopped}) — by somebody, or by the service manager restarting it.`
+    : 'Most often the machine ran out of memory — `journalctl -k | grep -i "killed process"` '
+      + 'says so on Linux; `sessionMemoryMax` in the runner config keeps a session from taking '
+      + 'the daemon with it.';
+  return `The cawdev daemon on ${name} restarted while driving this run (it was pid `
+    + `${previousPid}; it is pid ${pid} now), and the agent session went with it. ${why}`
+    + (orphanStopped ? ' The session it left running unattended has been stopped.' : '')
+    + ' The workspace is kept with whatever the session had written: carry it on there, or '
+    + 'discard it.';
+}
+
+// --- the memory ceiling ----------------------------------------------------
+
+/**
+ * `sessionMemoryMax` as systemd reads it — `6G`, `512M`, `75%` — or null.
+ * Anything else is null, and the daemon says so rather than guessing.
+ */
+export function memoryMaxOf(value) {
+  if (value === undefined || value === null || value === '') return null;
+  const text = String(value).trim();
+  return /^\d+(\.\d+)?[KMGT]?$|^\d+(\.\d+)?%$/i.test(text) ? text.toUpperCase() : null;
+}
+
+/**
+ * The command line that runs `command args` under the ceiling — or the same
+ * command line, when there is no ceiling to apply. `systemd-run --scope` execs
+ * the command in place, so the pid, the process group and the pipes are the
+ * agent's own: cancelling (`kill(-pid)`) and the stream readers do not change.
+ */
+export function scoped(command, args, scope) {
+  if (!scope?.memoryMax) {
+    return { command, args };
+  }
+  return {
+    command: 'systemd-run',
+    args: [`--${scope.manager}`, '--scope', '--quiet', '--collect', '--no-ask-password',
+      '-p', `MemoryMax=${scope.memoryMax}`, '--', command, ...args],
+  };
+}
+
+/**
+ * Whether this machine can apply the ceiling: Linux, and a systemd that will
+ * make a scope for this user. Tried with `true` once at boot, because a
+ * daemon run as a system service has no user manager and every spawn would
+ * otherwise fail on a command that cannot work here.
+ */
+export async function probeScope(memoryMax, { platform = process.platform, run = runQuietly } = {}) {
+  if (!memoryMax) return { scope: null, why: null };
+  if (platform !== 'linux') {
+    return { scope: null, why: `sessionMemoryMax needs Linux and systemd; this is ${platform}` };
+  }
+  for (const manager of ['user', 'system']) {
+    const code = await run('systemd-run',
+      [`--${manager}`, '--scope', '--quiet', '--collect', '--no-ask-password',
+        '-p', `MemoryMax=${memoryMax}`, 'true']);
+    if (code === 0) {
+      return { scope: { manager, memoryMax }, why: null };
+    }
+  }
+  return {
+    scope: null,
+    why: 'systemd-run could not make a scope here (no user manager — `loginctl enable-linger` '
+      + 'for this user, or run the daemon as root)',
+  };
+}
+
+function runQuietly(command, args) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { stdio: 'ignore' });
+    child.on('error', () => resolve(-1));
+    child.on('close', (code) => resolve(code));
+  });
+}