jishushell 0.6.5 → 0.7.3

package/dist/services/system/system-reconciler.js

@@ -0,0 +1,763 @@
+/**
+ * src/services/system/system-reconciler.ts
+ *
+ * Compares the system state rendered by the currently installed code against
+ * host files/services, then applies the shared setup-manager installers when
+ * privileged, domain-specific changes are needed.
+ */
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+import { existsSync, lstatSync, readFileSync, readlinkSync, symlinkSync, writeFileSync } from "fs";
+import { userInfo } from "os";
+import { dirname, join, resolve } from "path";
+import { JISHUSHELL_HOME, getCoreConfig, getCorePort, getIntegrationRuntimeEntry } from "../../config.js";
+import { ensureDirHost } from "../../utils/fs.js";
+import { createInvalidSudoPasswordError, isSudoAuthenticationError, isSudoNoNewPrivilegesError, runSudoAskpassCommand, } from "../../utils/sudo-askpass.js";
+import { buildSudoDisplayCommand, buildSudoJishushellCommand, getJishushellWrapper } from "./cli-command.js";
+import * as setupManager from "../setup/setup-manager.js";
+import { resolveIntegrationKindFromMetadata } from "../app-common/integration-refs.js";
+import { listRegisteredIntegrations } from "../integrations/index.js";
+import { chownToServiceUser, listInstances } from "../instances/manager.js";
+import { inspectRuntimeOwnership, repairCoreRuntimeOwnership, repairInstanceWorkspaceOwnership, } from "./runtime-ownership.js";
+const RECONCILE_STATE_FILE = join(JISHUSHELL_HOME, "reconcile-state.json");
+const SYSTEM_CLI_LINK = "/usr/local/bin/jishushell";
+// ── Helpers ────────────────────────────────────────────────────────────────
+function hasSudoAccess() {
+    if (typeof process.getuid === "function" && process.getuid() === 0)
+        return true;
+    try {
+        execFileSync("sudo", ["-n", "true"], { stdio: "ignore", timeout: 3000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isRoot() {
+    return typeof process.getuid === "function" && process.getuid() === 0;
+}
+function resolveCurrentCliTarget(candidate) {
+    const cliPath = candidate?.trim();
+    if (!cliPath || !existsSync(cliPath))
+        return null;
+    const args = ["system", "reload"];
+    if (cliPath.endsWith(".js")) {
+        return {
+            command: process.execPath,
+            args: [cliPath, ...args],
+            displayCommand: buildSudoDisplayCommand(process.execPath, [cliPath, ...args]),
+        };
+    }
+    return {
+        command: cliPath,
+        args,
+        displayCommand: buildSudoDisplayCommand(cliPath, args),
+    };
+}
+function resolveSystemReloadTarget() {
+    const wrapper = getJishushellWrapper();
+    if (existsSync(wrapper)) {
+        return {
+            command: wrapper,
+            args: ["system", "reload"],
+            displayCommand: buildSudoDisplayCommand(wrapper, ["system", "reload"]),
+        };
+    }
+    return resolveCurrentCliTarget(process.env.JISHUSHELL_CORE_BIN)
+        ?? resolveCurrentCliTarget(process.argv[1]);
+}
+function getSystemReloadCommand() {
+    return resolveSystemReloadTarget()?.displayCommand
+        ?? buildSudoJishushellCommand(["system", "reload"]);
+}
+export function getStoredReconcileState() {
+    if (!existsSync(RECONCILE_STATE_FILE))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(RECONCILE_STATE_FILE, "utf-8"));
+        if (!raw || !Array.isArray(raw.items))
+            return null;
+        // Rebuild the public shape instead of spreading disk JSON. Older releases
+        // stored instance restart advisories in this system-level file; those
+        // fields are intentionally ignored by the current host-only reconciler.
+        return {
+            timestamp: typeof raw.timestamp === "string" ? raw.timestamp : new Date(0).toISOString(),
+            items: raw.items,
+            hasPendingSudoActions: raw.hasPendingSudoActions === true,
+            reloadRequired: raw.reloadRequired === true,
+            manualRequired: raw.manualRequired === true,
+            canAutoReload: raw.canAutoReload === true,
+            command: typeof raw.command === "string" ? raw.command : getSystemReloadCommand(),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function createSystemReloadSudoError(result) {
+    const message = (result.stderr || result.stdout).trim();
+    if (isSudoAuthenticationError(message)) {
+        return createInvalidSudoPasswordError();
+    }
+    if (isSudoNoNewPrivilegesError(message)) {
+        const err = new Error("当前运行环境禁止 sudo 提权（no new privileges），请在系统终端执行推荐的 reload 命令。");
+        err.code = "SUDO_NO_NEW_PRIVILEGES";
+        return err;
+    }
+    if (/systemd-run.*not found|No such file or directory/i.test(message)) {
+        const err = new Error("当前系统缺少 systemd-run，无法从网页安全启动后台 reload。请在系统终端执行推荐命令。");
+        err.code = "SYSTEM_RELOAD_UNSUPPORTED";
+        return err;
+    }
+    if (message)
+        return new Error(message);
+    return new Error("无法启动系统 reload，请在系统终端执行推荐命令。");
+}
+function buildSystemdRunReloadArgs(unit, includeCollect, target) {
+    const currentUser = userInfo();
+    const sudoEnv = typeof process.getuid === "function" && process.getuid() > 0
+        ? [
+            `--setenv=SUDO_UID=${process.getuid()}`,
+            ...(typeof process.getgid === "function" ? [`--setenv=SUDO_GID=${process.getgid()}`] : []),
+            `--setenv=SUDO_USER=${currentUser.username}`,
+        ]
+        : [];
+    const args = [
+        "systemd-run",
+        "--quiet",
+        `--unit=${unit}`,
+        `--setenv=JISHUSHELL_HOME=${JISHUSHELL_HOME}`,
+        `--setenv=HOME=${dirname(JISHUSHELL_HOME)}`,
+        ...sudoEnv,
+        target.command,
+        ...target.args,
+    ];
+    if (includeCollect)
+        args.splice(2, 0, "--collect");
+    return args;
+}
+function normalizeText(content) {
+    return content
+        .replace(/\r\n/g, "\n")
+        .replace(/\r/g, "\n")
+        .split("\n")
+        .map((line) => line.trimEnd())
+        .join("\n")
+        .replace(/\n*$/, "\n");
+}
+function hashText(content) {
+    return createHash("sha256").update(normalizeText(content)).digest("hex");
+}
+function readActualFile(path, sudoAvailable) {
+    try {
+        return { content: readFileSync(path, "utf-8") };
+    }
+    catch (e) {
+        if (e?.code === "ENOENT")
+            return { content: null };
+        if (e?.code === "EACCES" && sudoAvailable) {
+            try {
+                return { content: execFileSync("sudo", ["-n", "cat", path], { encoding: "utf-8", timeout: 3000 }) };
+            }
+            catch (sudoError) {
+                return { content: null, error: sudoError?.message || String(sudoError), errorCode: sudoError?.code };
+            }
+        }
+        return { content: null, error: e?.message || String(e), errorCode: e?.code };
+    }
+}
+function checkExpectedFile(resource, sudoAvailable) {
+    let isSymlink = false;
+    try {
+        isSymlink = lstatSync(resource.path).isSymbolicLink();
+    }
+    catch (e) {
+        if (e?.code !== "ENOENT") {
+            return {
+                resource,
+                drift: true,
+                missing: false,
+                expectedHash: hashText(resource.content),
+                error: e?.message || String(e),
+                errorCode: e?.code,
+            };
+        }
+    }
+    const actual = readActualFile(resource.path, sudoAvailable);
+    const expectedHash = hashText(resource.content);
+    if (actual.error) {
+        return {
+            resource,
+            drift: true,
+            missing: false,
+            expectedHash,
+            error: actual.error,
+            errorCode: actual.errorCode,
+        };
+    }
+    if (actual.content === null) {
+        return {
+            resource,
+            drift: true,
+            missing: true,
+            expectedHash,
+        };
+    }
+    const actualHash = hashText(actual.content);
+    return {
+        resource,
+        drift: expectedHash !== actualHash || isSymlink,
+        missing: false,
+        expectedHash,
+        actualHash,
+        isSymlink,
+    };
+}
+function statusForDrift(check, sudoAvailable) {
+    if (!check.drift)
+        return "ok";
+    if (check.error)
+        return check.errorCode === "EACCES" && !sudoAvailable ? "skipped" : "error";
+    if (check.resource.requiresSudo && !sudoAvailable)
+        return "skipped";
+    return "skipped";
+}
+function requiresOperatorReload(resource, sudoAvailable) {
+    if (!resource.reloadRequired)
+        return false;
+    if (resource.requiresSudo && !sudoAvailable)
+        return true;
+    return !sudoAvailable && process.platform !== "darwin";
+}
+function buildFileItem(check, sudoAvailable) {
+    const resource = check.resource;
+    if (!check.drift) {
+        return {
+            component: resource.id,
+            id: resource.id,
+            path: resource.path,
+            status: "ok",
+            message: `${resource.path} matches expected ${resource.component} state`,
+            requiresSudo: false,
+            reloadRequired: false,
+            manualRequired: false,
+            fix: "none",
+            expectedHash: check.expectedHash,
+            actualHash: check.actualHash,
+            severity: "info",
+        };
+    }
+    const manualRequired = requiresOperatorReload(resource, sudoAvailable);
+    const status = statusForDrift(check, sudoAvailable);
+    const missingOrDifferent = check.missing
+        ? "is missing"
+        : check.isSymlink
+            ? "is a symlink; expected a managed file"
+            : "differs from expected state";
+    const message = check.error
+        ? `Cannot read ${resource.path}: ${check.error}`
+        : `${resource.path} ${missingOrDifferent}`;
+    return {
+        component: resource.id,
+        id: resource.id,
+        path: resource.path,
+        status,
+        message,
+        requiresSudo: resource.requiresSudo || manualRequired,
+        reloadRequired: resource.reloadRequired,
+        manualRequired,
+        fix: resource.fix,
+        command: resource.reloadRequired ? getSystemReloadCommand() : undefined,
+        expectedHash: check.expectedHash,
+        actualHash: check.actualHash,
+        details: check.error,
+        severity: status === "error" ? "error" : "warning",
+    };
+}
+function applyScope(scope, corePort) {
+    switch (scope) {
+        case "core":
+            return setupManager.installJishushellSystemd(corePort, false);
+        case "panel":
+            return setupManager.installJishushellPanelSystemd(corePort, undefined, false);
+        case "nomad":
+            return setupManager.installNomadSystemd();
+    }
+}
+function groupedByScope(checks) {
+    const groups = new Map();
+    for (const check of checks) {
+        const existing = groups.get(check.resource.installScope) ?? [];
+        existing.push(check);
+        groups.set(check.resource.installScope, existing);
+    }
+    return groups;
+}
+function scopeRequiresSudo(scope, checks) {
+    if (process.platform === "darwin") {
+        return checks.some((check) => check.resource.requiresSudo);
+    }
+    return scope === "core" || scope === "panel" || scope === "nomad";
+}
+function pushAppliedScopeResult(items, scope, checks, result) {
+    const ids = checks.map((check) => check.resource.id);
+    const reloadRequired = checks.some((check) => check.resource.reloadRequired);
+    if (!result.ok) {
+        items.push({
+            component: `${scope}.expected-state`,
+            status: "error",
+            message: result.message,
+            requiresSudo: checks.some((check) => check.resource.requiresSudo),
+            reloadRequired,
+            manualRequired: true,
+            fix: reloadRequired ? "system-reload" : "manual",
+            command: reloadRequired ? getSystemReloadCommand() : undefined,
+            details: [result.error, `Resources: ${ids.join(", ")}`].filter(Boolean).join("\n"),
+            severity: "error",
+        });
+        return;
+    }
+    const postChecks = checks.map((check) => checkExpectedFile(check.resource, true));
+    const remaining = postChecks.filter((check) => check.drift);
+    if (remaining.length > 0) {
+        items.push({
+            component: `${scope}.expected-state`,
+            status: "error",
+            message: `${scope} installer completed but ${remaining.length} resource(s) still drift`,
+            requiresSudo: checks.some((check) => check.resource.requiresSudo),
+            reloadRequired,
+            manualRequired: true,
+            fix: reloadRequired ? "system-reload" : "manual",
+            command: reloadRequired ? getSystemReloadCommand() : undefined,
+            details: remaining.map((check) => `${check.resource.id}: ${check.resource.path}`).join("\n"),
+            severity: "error",
+        });
+        return;
+    }
+    items.push({
+        component: `${scope}.expected-state`,
+        status: "updated",
+        message: result.message,
+        requiresSudo: false,
+        reloadRequired,
+        manualRequired: false,
+        fix: reloadRequired ? "system-reload" : "none",
+        command: reloadRequired ? getSystemReloadCommand() : undefined,
+        details: `Resources: ${ids.join(", ")}`,
+        severity: "info",
+    });
+}
+function reconcileExpectedFiles(items, options, sudoAvailable) {
+    const corePort = getCorePort();
+    let files;
+    try {
+        files = setupManager.getExpectedSystemFiles({ corePort });
+    }
+    catch (e) {
+        items.push({
+            component: "expected-state",
+            status: "error",
+            message: "Failed to render expected system state",
+            manualRequired: true,
+            fix: "manual",
+            details: e?.message || String(e),
+            severity: "error",
+        });
+        return;
+    }
+    const checks = files.map((file) => checkExpectedFile(file, sudoAvailable));
+    const clean = checks.filter((check) => !check.drift);
+    for (const check of clean) {
+        items.push(buildFileItem(check, sudoAvailable));
+    }
+    const drifted = checks.filter((check) => check.drift);
+    if (drifted.length === 0)
+        return;
+    if (!options.apply) {
+        for (const check of drifted) {
+            items.push(buildFileItem(check, sudoAvailable));
+        }
+        return;
+    }
+    const groups = groupedByScope(drifted);
+    for (const [scope, scopedChecks] of groups) {
+        const requiresSudo = scopeRequiresSudo(scope, scopedChecks);
+        if (requiresSudo && !sudoAvailable) {
+            for (const check of scopedChecks) {
+                items.push(buildFileItem(check, sudoAvailable));
+            }
+            continue;
+        }
+        const result = applyScope(scope, corePort);
+        pushAppliedScopeResult(items, scope, scopedChecks, result);
+    }
+}
+// ── Reconcile: system CLI path ─────────────────────────────────────────────
+function normalizeSymlinkTarget(linkPath, target) {
+    return target.startsWith("/") ? target : resolve(dirname(linkPath), target);
+}
+function createSystemCliSymlink(expected) {
+    if (isRoot()) {
+        symlinkSync(expected, SYSTEM_CLI_LINK);
+        return;
+    }
+    execFileSync("sudo", ["-n", "ln", "-s", expected, SYSTEM_CLI_LINK], { stdio: "ignore", timeout: 5000 });
+}
+function reconcileSystemCliLink(items, apply, sudoAvailable) {
+    if (process.platform === "win32")
+        return;
+    const expected = getJishushellWrapper();
+    const command = getSystemReloadCommand();
+    let exists = false;
+    let isSymlink = false;
+    let target = "";
+    let targetMatches = false;
+    try {
+        const stat = lstatSync(SYSTEM_CLI_LINK);
+        exists = true;
+        isSymlink = stat.isSymbolicLink();
+        if (isSymlink) {
+            target = readlinkSync(SYSTEM_CLI_LINK);
+            targetMatches = normalizeSymlinkTarget(SYSTEM_CLI_LINK, target) === expected;
+        }
+    }
+    catch (e) {
+        if (e?.code !== "ENOENT") {
+            items.push({
+                component: "core.system-cli-link",
+                id: "core.system-cli-link",
+                path: SYSTEM_CLI_LINK,
+                status: "skipped",
+                message: `Cannot inspect ${SYSTEM_CLI_LINK}: ${e?.message || String(e)}`,
+                requiresSudo: false,
+                reloadRequired: false,
+                manualRequired: false,
+                fix: "none",
+                command,
+                severity: "warning",
+            });
+            return;
+        }
+    }
+    if (exists && isSymlink && targetMatches) {
+        items.push({
+            component: "core.system-cli-link",
+            id: "core.system-cli-link",
+            path: SYSTEM_CLI_LINK,
+            status: "ok",
+            message: `${SYSTEM_CLI_LINK} points to ${expected}`,
+            requiresSudo: false,
+            reloadRequired: false,
+            manualRequired: false,
+            fix: "none",
+            severity: "info",
+        });
+        return;
+    }
+    if (exists) {
+        const details = isSymlink
+            ? `${SYSTEM_CLI_LINK} points to ${target}; expected ${expected}`
+            : `${SYSTEM_CLI_LINK} exists and is not a symlink`;
+        items.push({
+            component: "core.system-cli-link",
+            id: "core.system-cli-link",
+            path: SYSTEM_CLI_LINK,
+            status: "skipped",
+            message: `${SYSTEM_CLI_LINK} is reserved by another command`,
+            requiresSudo: false,
+            reloadRequired: false,
+            manualRequired: false,
+            fix: "none",
+            command,
+            details,
+            severity: "warning",
+        });
+        return;
+    }
+    if (!apply || !sudoAvailable) {
+        items.push({
+            component: "core.system-cli-link",
+            id: "core.system-cli-link",
+            path: SYSTEM_CLI_LINK,
+            status: "skipped",
+            message: `${SYSTEM_CLI_LINK} is missing; repair will create it when privileged access is available`,
+            requiresSudo: false,
+            reloadRequired: false,
+            manualRequired: false,
+            fix: "none",
+            command,
+            details: `Create symlink: ${SYSTEM_CLI_LINK} -> ${expected}`,
+            severity: "info",
+        });
+        return;
+    }
+    try {
+        createSystemCliSymlink(expected);
+        items.push({
+            component: "core.system-cli-link",
+            id: "core.system-cli-link",
+            path: SYSTEM_CLI_LINK,
+            status: "updated",
+            message: `Created ${SYSTEM_CLI_LINK} -> ${expected}`,
+            requiresSudo: false,
+            reloadRequired: false,
+            manualRequired: false,
+            fix: "none",
+            severity: "info",
+        });
+    }
+    catch (e) {
+        items.push({
+            component: "core.system-cli-link",
+            id: "core.system-cli-link",
+            path: SYSTEM_CLI_LINK,
+            status: "skipped",
+            message: `Failed to create ${SYSTEM_CLI_LINK}: ${e?.message || String(e)}`,
+            requiresSudo: false,
+            reloadRequired: false,
+            manualRequired: false,
+            fix: "none",
+            command,
+            details: `Expected symlink target: ${expected}`,
+            severity: "warning",
+        });
+    }
+}
+// ── Reconcile: Docker images ───────────────────────────────────────────────
+function integrationKindsUsedByInstances() {
+    const kinds = new Set();
+    for (const instance of listInstances()) {
+        try {
+            const kind = resolveIntegrationKindFromMetadata(instance);
+            if (kind)
+                kinds.add(kind);
+        }
+        catch {
+            // Invalid/legacy instance identity is owned by migration or repair. The
+            // system reconciler must not guess an Integration from old fields.
+        }
+    }
+    return kinds;
+}
+async function reconcileDockerImages(results, apply) {
+    const config = getCoreConfig();
+    if (config.service_manager !== "nomad") {
+        results.push({
+            component: "docker-images",
+            status: "skipped",
+            message: "Not using Nomad/Docker runtime",
+            reloadRequired: false,
+            manualRequired: false,
+            fix: "none",
+            severity: "info",
+        });
+        return;
+    }
+    try {
+        execFileSync("docker", ["info"], { stdio: "ignore", timeout: 8000 });
+    }
+    catch (e) {
+        results.push({
+            component: "docker-images",
+            status: "skipped",
+            message: "Docker not available",
+            reloadRequired: false,
+            manualRequired: true,
+            fix: "manual",
+            severity: "warning",
+            details: e?.message || "Cannot connect to Docker daemon. Ensure Docker is installed and running.",
+        });
+        return;
+    }
+    const usedIntegrationKinds = integrationKindsUsedByInstances();
+    for (const integration of listRegisteredIntegrations()) {
+        // Registration means Core knows how to integrate with an App; it does not
+        // mean the user chose to install that optional App. Always maintain the
+        // required baseline image, and maintain optional images only when a
+        // canonical instance actually uses that Integration.
+        const shouldMaintainImage = integration.manifest?.requiredForSetupReady === true
+            || usedIntegrationKinds.has(integration.kind);
+        if (!shouldMaintainImage)
+            continue;
+        const catalogEntry = getIntegrationRuntimeEntry(integration.kind);
+        const expectedImage = catalogEntry?.image || catalogEntry?.defaultImage;
+        if (!expectedImage)
+            continue;
+        try {
+            execFileSync("docker", ["image", "inspect", expectedImage], { timeout: 10000, stdio: "ignore" });
+            results.push({
+                component: `docker.${integration.kind}`,
+                id: expectedImage,
+                status: "ok",
+                message: `Image ${expectedImage} present`,
+                reloadRequired: false,
+                manualRequired: false,
+                fix: "none",
+                severity: "info",
+            });
+        }
+        catch {
+            if (!apply) {
+                results.push({
+                    component: `docker.${integration.kind}`,
+                    id: expectedImage,
+                    status: "skipped",
+                    message: `Image ${expectedImage} missing`,
+                    reloadRequired: false,
+                    manualRequired: false,
+                    fix: "docker-pull",
+                    details: `Run: docker pull ${expectedImage}`,
+                    severity: "warning",
+                });
+                continue;
+            }
+            try {
+                execFileSync("docker", ["pull", expectedImage], { timeout: 120000, stdio: "ignore" });
+                results.push({
+                    component: `docker.${integration.kind}`,
+                    id: expectedImage,
+                    status: "updated",
+                    message: `Pulled image ${expectedImage}`,
+                    reloadRequired: false,
+                    manualRequired: false,
+                    fix: "none",
+                    severity: "info",
+                });
+            }
+            catch (e) {
+                results.push({
+                    component: `docker.${integration.kind}`,
+                    id: expectedImage,
+                    status: "error",
+                    message: `Failed to pull ${expectedImage}: ${e?.message || "timeout"}`,
+                    reloadRequired: false,
+                    manualRequired: true,
+                    fix: "docker-pull",
+                    details: "Check network connectivity and Docker permissions.",
+                    severity: "error",
+                });
+            }
+        }
+    }
+}
+function reconcileRuntimeOwnership(results, apply) {
+    const drifts = inspectRuntimeOwnership({ includeApps: true });
+    if (!apply) {
+        results.push({
+            component: "runtime-ownership",
+            id: "runtime-ownership",
+            status: drifts.length === 0 ? "ok" : "skipped",
+            message: drifts.length === 0
+                ? "Core runtime ownership matches the service user"
+                : `${drifts.length} Core runtime path(s) need service-user ownership repair`,
+            reloadRequired: false,
+            manualRequired: drifts.length > 0,
+            requiresSudo: drifts.length > 0,
+            fix: drifts.length > 0 ? "manual" : "none",
+            details: drifts.map((drift) => {
+                const actual = drift.actualUid == null ? "unknown" : `${drift.actualUid}:${drift.actualGid}`;
+                return `${drift.path}: actual=${actual} expected=${drift.expectedUid}:${drift.expectedGid}`;
+            }).join("\n") || undefined,
+            severity: drifts.length === 0 ? "info" : "warning",
+        });
+        return;
+    }
+    const core = repairCoreRuntimeOwnership({ includeApps: true });
+    const instanceErrors = [];
+    const instanceRepairs = [];
+    for (const instance of listInstances()) {
+        if (!instance?.id)
+            continue;
+        const repaired = repairInstanceWorkspaceOwnership(instance.id);
+        instanceRepairs.push(...repaired.repaired);
+        instanceErrors.push(...repaired.errors);
+    }
+    const errors = [...core.errors, ...instanceErrors];
+    const repairedCount = core.repaired.length + instanceRepairs.length;
+    results.push({
+        component: "runtime-ownership",
+        id: "runtime-ownership",
+        status: errors.length > 0 ? "error" : repairedCount > 0 ? "updated" : "ok",
+        message: errors.length > 0
+            ? "Runtime ownership repair failed"
+            : repairedCount > 0
+                ? `Repaired ownership for ${repairedCount} runtime path(s)`
+                : "Core runtime ownership matches the service user",
+        reloadRequired: false,
+        manualRequired: errors.length > 0,
+        requiresSudo: errors.length > 0,
+        fix: errors.length > 0 ? "manual" : "none",
+        details: errors.length > 0 ? errors.join("\n") : undefined,
+        severity: errors.length > 0 ? "error" : "info",
+    });
+}
+// ── Main entry points ──────────────────────────────────────────────────────
+function persistResult(result) {
+    try {
+        ensureDirHost(JISHUSHELL_HOME);
+        writeFileSync(RECONCILE_STATE_FILE, `${JSON.stringify(result, null, 2)}\n`, "utf-8");
+        chownToServiceUser(RECONCILE_STATE_FILE);
+    }
+    catch { }
+}
+function finalizeResult(items, sudoAvailable) {
+    const hasPendingSudoActions = items.some((item) => item.requiresSudo && item.status !== "ok" && item.status !== "updated");
+    const reloadRequired = items.some((item) => item.reloadRequired && item.status !== "ok");
+    const manualRequired = hasPendingSudoActions || items.some((item) => item.manualRequired && item.status !== "ok" && item.status !== "updated");
+    return {
+        timestamp: new Date().toISOString(),
+        items,
+        hasPendingSudoActions,
+        reloadRequired,
+        manualRequired,
+        canAutoReload: reloadRequired && !manualRequired && sudoAvailable,
+        command: getSystemReloadCommand(),
+    };
+}
+async function runSystemReconciliation(options) {
+    const items = [];
+    const sudoAvailable = hasSudoAccess();
+    reconcileExpectedFiles(items, options, sudoAvailable);
+    reconcileSystemCliLink(items, options.apply, sudoAvailable);
+    reconcileRuntimeOwnership(items, options.apply);
+    await reconcileDockerImages(items, options.apply);
+    const result = finalizeResult(items, sudoAvailable);
+    persistResult(result);
+    return result;
+}
+export async function inspectSystemDrift() {
+    return runSystemReconciliation({ apply: false });
+}
+export async function reconcileSystem() {
+    return runSystemReconciliation({ apply: true });
+}
+export async function startSystemReloadWithSudo(sudoPassword) {
+    if (!sudoPassword) {
+        throw new Error("请输入 sudo 密码");
+    }
+    if (process.platform === "darwin") {
+        const err = new Error("macOS 暂不支持从网页执行系统 reload，请在终端执行推荐命令。");
+        err.code = "SYSTEM_RELOAD_UNSUPPORTED";
+        throw err;
+    }
+    const target = resolveSystemReloadTarget();
+    if (!target) {
+        throw new Error(`找不到可执行的 JishuShell reload 命令：${getJishushellWrapper()}`);
+    }
+    const unit = `jishushell-web-reload-${process.pid}-${Date.now()}`;
+    let result = await runSudoAskpassCommand(sudoPassword, buildSystemdRunReloadArgs(unit, true, target), { timeoutMs: 20_000 });
+    if (result.code !== 0 && /(?:unrecognized|unknown|invalid) option.*collect|collect.*(?:unrecognized|unknown|invalid)/i.test(result.stderr)) {
+        result = await runSudoAskpassCommand(sudoPassword, buildSystemdRunReloadArgs(unit, false, target), { timeoutMs: 20_000 });
+    }
+    if (result.code !== 0) {
+        throw createSystemReloadSudoError(result);
+    }
+    return {
+        accepted: true,
+        command: target.displayCommand,
+        message: "系统 reload 已在后台启动，服务会短暂重启。",
+        state: getStoredReconcileState(),
+        unit,
+    };
+}
+//# sourceMappingURL=system-reconciler.js.map