talentos 1.1.0 → 1.1.2

package/dist/agent/adapters.js

@@ -1,4 +1,5 @@
 import { execFile, spawn } from "node:child_process";
+import { existsSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline";
@@ -6,6 +7,8 @@ import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { writePrivateFile } from "../agent-config.js";
 import { redactAgentOutput, } from "../agent-link.js";
+import { gatewayLauncherPath } from "../gateway-install.js";
+import { providerPathEnv, resolveProviderBinary } from "../provider-binary.js";
 const CHILD_ENV = [
     "HOME",
     "PATH",
@@ -23,8 +26,12 @@ const CHILD_ENV = [
     "CLAUDE_CONFIG_DIR",
 ];
 const CLAUDE_VERSION = /^\d+\.\d+\.\d+/u;
+const CODEX_VERSION = /\b\d+\.\d+\.\d+\b/u;
 const DONT_ASK = /\bdontAsk\b/u;
-const CLAUDE_TOOLS = [
+// Kept package-local for the published CLI. The launch tests compare both
+// adapters against the server's exported ROOM_AGENT_TOOLS contract.
+const ROOM_TOOLS = [
+    "list_rooms",
     "read_room",
     "list_room_files",
     "read_file",
@@ -33,27 +40,31 @@ const CLAUDE_TOOLS = [
     "create_deck",
     "post_message",
     "share_link",
-]
-    .map((tool) => `mcp__talentos__${tool}`)
-    .join(",");
-export function childEnvironment(source = process.env) {
-    return Object.fromEntries(CHILD_ENV.filter((key) => source[key] !== undefined).map((key) => [
-        key,
-        source[key],
-    ]));
+    "whoami",
+];
+const CLAUDE_TOOLS = ROOM_TOOLS.map((tool) => `mcp__talentos__${tool}`).join(",");
+export function childEnvironment(source = process.env, binary) {
+    return {
+        ...Object.fromEntries(CHILD_ENV.filter((key) => source[key] !== undefined).map((key) => [
+            key,
+            source[key],
+        ])),
+        PATH: providerPathEnv(binary, source.HOME),
+    };
 }
-export async function verifyClaudeCode() {
+export async function verifyClaudeCode(configured) {
+    const binary = resolveProviderBinary("claude_code", configured);
     const execute = promisify(execFile);
     const options = {
-        env: childEnvironment(),
+        env: childEnvironment(process.env, binary),
         timeout: 5000,
         maxBuffer: 256_000,
     };
     let version = "unknown";
     try {
-        const detected = await execute("claude", ["--version"], options);
+        const detected = await execute(binary, ["--version"], options);
         version = CLAUDE_VERSION.exec(detected.stdout.trim())?.[0] ?? "unknown";
-        const help = await execute("claude", ["--help"], options);
+        const help = await execute(binary, ["--help"], options);
         if (version !== "unknown" && DONT_ASK.test(help.stdout)) {
             return;
         }
@@ -63,6 +74,78 @@ export async function verifyClaudeCode() {
     }
     throw new Error(`Update Claude Code (${version}) to a version that supports --permission-mode dontAsk.`);
 }
+export async function verifyCodex(configured) {
+    const binary = resolveProviderBinary("codex", configured);
+    const execute = promisify(execFile);
+    const options = {
+        env: childEnvironment(process.env, binary),
+        timeout: 5000,
+        maxBuffer: 256_000,
+    };
+    let version = "unknown";
+    try {
+        const detected = await execute(binary, ["--version"], options);
+        version = CODEX_VERSION.exec(detected.stdout)?.[0] ?? "unknown";
+        for (const args of [
+            ["exec", "--help"],
+            ["exec", "resume", "--help"],
+        ]) {
+            const help = await execute(binary, args, options);
+            if (![
+                "--json",
+                "--skip-git-repo-check",
+                "--ignore-user-config",
+                "--ignore-rules",
+            ].every((flag) => help.stdout.includes(flag))) {
+                throw new Error("Unsupported Codex flags");
+            }
+        }
+        if (version !== "unknown") {
+            await codexRoomCatalog(binary);
+            return;
+        }
+    }
+    catch {
+        // Provider diagnostics can contain login details.
+    }
+    throw new Error(`Update Codex (${version}) to a version supporting isolated room turns, exec/resume flags and a local model catalog.`);
+}
+async function codexRoomCatalog(binary) {
+    try {
+        const { stdout } = await promisify(execFile)(binary, ["debug", "models", "--bundled"], {
+            env: childEnvironment(process.env, binary),
+            timeout: 5000,
+            maxBuffer: 4_000_000,
+        });
+        const catalog = JSON.parse(stdout);
+        if (!Array.isArray(catalog.models) || catalog.models.length === 0) {
+            throw new Error("Missing model catalog");
+        }
+        const models = catalog.models.map((model) => {
+            if (!model ||
+                typeof model !== "object" ||
+                !("slug" in model) ||
+                !("apply_patch_tool_type" in model)) {
+                throw new Error("Unsupported model catalog");
+            }
+            return {
+                ...model,
+                // apply_patch has no feature toggle: its exposure comes from model
+                // metadata. A local catalog removes it before tool registration.
+                apply_patch_tool_type: null,
+                shell_type: "disabled",
+                experimental_supported_tools: [],
+                // Code-mode-only models route MCP through native execution. Expose
+                // allowed MCP functions directly while native execution stays off.
+                tool_mode: "direct",
+            };
+        });
+        return JSON.stringify({ ...catalog, models });
+    }
+    catch {
+        throw new Error("Update Codex to a version supporting a local room-only model catalog.");
+    }
+}
 export function readProviderEvent(provider, value) {
     if (!value || typeof value !== "object") {
         return {};
@@ -110,6 +193,8 @@ export function readProviderEvent(provider, value) {
 export async function runProvider(input) {
     const { config, job, workDir, sessionId, signal } = input;
     const prompt = JSON.stringify(job.packet), mcpPath = join(dirname(workDir), ".talentos-mcp.json");
+    const catalogPath = join(dirname(workDir), ".talentos-codex-models.json");
+    const binary = resolveProviderBinary(config.provider, config.providerPath);
     let command, args;
     if (config.provider === "claude_code") {
         await writePrivateFile(mcpPath, JSON.stringify({
@@ -121,7 +206,7 @@ export async function runProvider(input) {
                 },
             },
         }));
-        command = "claude";
+        command = binary;
         args = [
             "-p",
             prompt,
@@ -147,13 +232,15 @@ export async function runProvider(input) {
         }
     }
     else {
-        command = "codex";
-        const entry = fileURLToPath(new URL("./mcp-entry.js", import.meta.url));
+        command = binary;
+        const launcher = gatewayLauncherPath();
+        const useLauncher = process.platform !== "win32" && existsSync(launcher);
+        await writePrivateFile(catalogPath, await codexRoomCatalog(binary));
         // Resume has a different flag surface. Root overrides are inherited by
         // both exec paths; shell_tool=false enforces ADR 0093's default no-Bash.
         args = [
             "-c",
-            'sandbox_mode="workspace-write"',
+            'sandbox_mode="read-only"',
             "-c",
             'approval_policy="never"',
             "-c",
@@ -161,9 +248,31 @@ export async function runProvider(input) {
             "-c",
             "features.unified_exec=false",
             "-c",
-            `mcp_servers.talentos.command=${JSON.stringify(process.execPath)}`,
+            'web_search="disabled"',
+            "-c",
+            "features.view_image=false",
+            "-c",
+            "features.image_generation=false",
+            "-c",
+            "features.apps=false",
+            "-c",
+            "features.plugins=false",
+            "-c",
+            "features.multi_agent=false",
+            "-c",
+            "features.skip_host_skill_discovery=true",
+            "-c",
+            "memories.use_memories=false",
+            "-c",
+            "memories.generate_memories=false",
+            "-c",
+            `model_catalog_json=${JSON.stringify(catalogPath)}`,
+            "-c",
+            `mcp_servers.talentos.enabled_tools=${JSON.stringify(ROOM_TOOLS)}`,
+            "-c",
+            `mcp_servers.talentos.command=${JSON.stringify(useLauncher ? launcher : process.execPath)}`,
             "-c",
-            `mcp_servers.talentos.args=${JSON.stringify([entry, config.agentId])}`,
+            `mcp_servers.talentos.args=${JSON.stringify([...(useLauncher ? [] : [fileURLToPath(new URL("../index.js", import.meta.url))]), "agent", "mcp", "--agent", config.agentId])}`,
             "exec",
         ];
         if (sessionId) {
@@ -173,7 +282,7 @@ export async function runProvider(input) {
     }
     const child = spawn(command, args, {
         cwd: workDir,
-        env: childEnvironment(),
+        env: childEnvironment(process.env, binary),
         stdio: ["ignore", "pipe", "ignore"],
         detached: process.platform !== "win32",
     });
@@ -256,5 +365,6 @@ export async function runProvider(input) {
             clearTimeout(killTimer);
         }
         await rm(mcpPath, { force: true });
+        await rm(catalogPath, { force: true });
     }
 }

package/dist/agent/gateway.js

@@ -4,7 +4,7 @@ import { isSecureUrl } from "../agent-link.js";
 export class GatewayError extends Error {
     status;
     constructor(status) {
-        super(status === 401 || status === 409
+        super(status === 401 || status === 410
             ? "Agent is no longer available. Re-link it from TalentOS."
             : "Agent gateway request failed; retrying.");
         this.status = status;

package/dist/agent/mcp-entry.js

@@ -1,9 +1,10 @@
 import { localAgents } from "../agent-config.js";
+import { parseArgv } from "../args.js";
 import { AgentClient } from "../client.js";
 import { startMcpProxy } from "../mcp-proxy.js";
 // A local stdio entry avoids putting the bearer key in Codex's argv or child
 // environment. Only the MCP proxy reads the linked-agent credential file.
-const config = (await localAgents()).find((agent) => agent.agentId === process.argv[2]);
+const config = (await localAgents()).find((agent) => agent.agentId === parseArgv(process.argv.slice(2)).options.agent);
 if (!config) {
     throw new Error("Linked agent configuration is unavailable.");
 }

package/dist/agent/serve.js

@@ -1,29 +1,20 @@
-import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rm } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
-import { childEnvironment, runProvider } from "./adapters.js";
+import { installSharedGateway } from "../gateway-install.js";
+import { compareGatewayVersions } from "../gateway-version.js";
+import { runProvider } from "./adapters.js";
 import { AgentGateway, GatewayError } from "./gateway.js";
 import { SessionMap } from "./sessions.js";
 const HEARTBEAT_MS = 20_000;
 const LEASE_SAFETY_MS = 55_000;
 const IDLE_MS = 30 * 60_000;
-const VERSION = /^(\d+)\.(\d+)\.(\d+)$/;
 export function needsUpdate(current, minimum) {
-    const a = VERSION.exec(current), b = VERSION.exec(minimum);
-    if (!b) {
+    if (compareGatewayVersions(minimum, minimum) === undefined) {
         return false;
     }
-    if (!a) {
-        return true;
-    }
-    for (let i = 1; i <= 3; i++) {
-        if (Number(a[i]) !== Number(b[i])) {
-            return Number(a[i]) < Number(b[i]);
-        }
-    }
-    return false;
+    return (compareGatewayVersions(current, minimum) ?? -1) < 0;
 }
 export function claimPollInterval(lastJobAt, now = Date.now()) {
     return now - lastJobAt >= IDLE_MS ? 10_000 : 2000;
@@ -58,29 +49,13 @@ async function acquireLock(directory) {
     };
 }
 export async function installGatewayUpdate(directory, minimum, signal) {
-    if (!VERSION.test(minimum)) {
-        throw new Error("Unsupported gateway minimum version.");
-    }
-    const destination = join(directory, "gateway-cli");
-    await new Promise((resolve, reject) => {
-        const child = spawn("npm", [
-            "install",
-            "--prefix",
-            destination,
-            "--omit=dev",
-            "--ignore-scripts",
-            "--no-audit",
-            "--no-fund",
-            `talentos@${minimum}`,
-        ], { env: childEnvironment(), stdio: "ignore", signal });
-        child.once("error", () => reject(new Error("Gateway update could not start.")));
-        child.once("close", (code) => code === 0
-            ? resolve()
-            : reject(new Error("Gateway update failed. Retry when the network is available.")));
+    return await installSharedGateway({
+        home: dirname(dirname(dirname(directory))),
+        version: minimum,
+        signal,
     });
-    return join(destination, "node_modules", "talentos", "dist", "index.js");
 }
-export async function serveAgent(config, directory, version, stop) {
+export async function serveAgent(config, directory, version, stop, verify) {
     const release = await acquireLock(directory);
     try {
         const workDir = join(directory, "work"), sessions = new SessionMap(directory), gateway = new AgentGateway(config);
@@ -97,7 +72,8 @@ export async function serveAgent(config, directory, version, stop) {
         let minimum = version, lastJobAt = Date.now(), push = false, dispose;
         let terminalError;
         const failService = (error) => {
-            if (error instanceof GatewayError && error.status === 401) {
+            if (error instanceof GatewayError &&
+                (error.status === 401 || error.status === 410)) {
                 terminalError = error;
                 service.abort();
                 active?.cancel.abort();
@@ -144,12 +120,14 @@ export async function serveAgent(config, directory, version, stop) {
             }
         };
         let heartbeats;
+        let updateAfter = 0;
         const watchdog = setInterval(() => {
             if (active && Date.now() >= active.deadline) {
                 active.cancel.abort();
             }
         }, 1000);
         try {
+            await verify?.();
             await heartbeat();
             try {
                 push = true;
@@ -164,8 +142,17 @@ export async function serveAgent(config, directory, version, stop) {
             }
             heartbeats = heartbeatLoop();
             while (!signal.aborted) {
-                if (needsUpdate(version, minimum)) {
-                    return await installGatewayUpdate(directory, minimum, signal);
+                if (needsUpdate(version, minimum) && Date.now() >= updateAfter) {
+                    if (process.platform === "win32") {
+                        throw new Error(`Gateway update required; re-run npx talentos@${minimum} agent serve --agent ${config.agentId}. Windows gateways update in the foreground.`);
+                    }
+                    try {
+                        return await installGatewayUpdate(directory, minimum, signal);
+                    }
+                    catch {
+                        updateAfter = Date.now() + 60_000;
+                        console.error("Gateway update unavailable. Serving the current version; retrying in one minute.");
+                    }
                 }
                 wakePending = false;
                 let job;

package/dist/agent-config.js

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { chmod, mkdir, readdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
 import { redactAgentOutput } from "./agent-link.js";
 import { warn } from "./format.js";
 import { homeDir } from "./install.js";
@@ -22,11 +22,11 @@ export function agentLogPath(agentId, home = homeDir()) {
     agentConfigPath(agentId, home);
     return join(agentsDir(home), agentId, "gateway.log");
 }
-export async function writePrivateFile(path, content) {
+export async function writePrivateFile(path, content, mode = 0o600) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     try {
         if ((await readFile(path, "utf8")) === content) {
-            await chmod(path, 0o600);
+            await chmod(path, mode);
             return false;
         }
     }
@@ -37,7 +37,7 @@ export async function writePrivateFile(path, content) {
     }
     const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(temporary, content, { mode: 0o600, flag: "wx" });
+        await writeFile(temporary, content, { mode, flag: "wx" });
         await rename(temporary, path);
     }
     finally {
@@ -95,6 +95,9 @@ function isLinkedAgent(value) {
         typeof config.name === "string" &&
         typeof config.linkHash === "string" &&
         typeof config.linkedAt === "number" &&
+        (config.providerPath === undefined ||
+            (typeof config.providerPath === "string" &&
+                isAbsolute(config.providerPath))) &&
         (config.provider === "claude_code" || config.provider === "codex"));
 }
 export function isMissing(error) {

package/dist/agent-http.js

@@ -1,12 +1,16 @@
 import { spawnSync } from "node:child_process";
+import { childEnvironment } from "./agent/adapters.js";
 import { isSecureUrl, } from "./agent-link.js";
+import { resolveProviderBinary } from "./provider-binary.js";
 const REQUEST_TIMEOUT_MS = 10_000;
 const HEARTBEAT_WINDOW_MS = 60_000;
 export class AgentHttpError extends Error {
     status;
     retryAfterMs;
     constructor(operation, response) {
-        super(`${operation} (HTTP ${response.status}). Ask for a fresh setup prompt if this link expired.`);
+        super(response.status === 426
+            ? "Update TalentOS CLI: run npx --yes --prefer-online talentos@latest agent link again with your setup URL."
+            : `${operation} (HTTP ${response.status}). Ask for a fresh setup prompt if this link expired.`);
         this.status = response.status;
         const seconds = Number(response.headers.get("Retry-After"));
         this.retryAfterMs = Number.isFinite(seconds)
@@ -37,11 +41,12 @@ export async function setupApiOrigin(link, override) {
     }
     return apiOrigin(apiUrl);
 }
-export function inspectProvider(provider) {
-    const binary = provider === "claude_code" ? "claude" : "codex";
+export function inspectProvider(provider, configured) {
+    const binary = resolveProviderBinary(provider, configured);
     const version = spawnSync(binary, ["--version"], {
         encoding: "utf8",
         timeout: REQUEST_TIMEOUT_MS,
+        env: childEnvironment(process.env, binary),
     });
     if (version.status !== 0 || !version.stdout?.trim()) {
         throw new Error(`Install the official ${binary} CLI and sign in before linking.`);
@@ -52,6 +57,7 @@ export function inspectProvider(provider) {
     const login = spawnSync(binary, args, {
         encoding: "utf8",
         timeout: REQUEST_TIMEOUT_MS,
+        env: childEnvironment(process.env, binary),
     });
     if (login.status !== 0) {
         throw new Error(`Sign in through the official ${binary} CLI before linking.`);
@@ -92,7 +98,13 @@ export async function redeemAgent(apiUrl, body) {
         typeof value.name !== "string") {
         throw new Error("TalentOS returned an invalid agent link. Ask for a fresh prompt.");
     }
-    return { agentId: value.agentId, name: value.name };
+    const retiredAgentIds = "retiredAgentIds" in value ? value.retiredAgentIds : undefined;
+    if (retiredAgentIds !== undefined &&
+        (!Array.isArray(retiredAgentIds) ||
+            retiredAgentIds.some((id) => typeof id !== "string"))) {
+        throw new Error("TalentOS returned an invalid agent link. Ask for a fresh prompt.");
+    }
+    return { agentId: value.agentId, name: value.name, retiredAgentIds };
 }
 export async function fetchAgentStatus(agent) {
     const response = await safeFetch(`${apiOrigin(agent.apiUrl)}/agent-link/status`, { headers: { Authorization: `Bearer ${agent.apiKey}` } });

package/dist/agent-service.js

@@ -1,9 +1,10 @@
 import { spawnSync } from "node:child_process";
 import { chmod, mkdir, open, rm } from "node:fs/promises";
 import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import { agentLogPath, agentWorkDir, writePrivateFile, } from "./agent-config.js";
+import { gatewayLauncherPath } from "./gateway-install.js";
 import { homeDir } from "./install.js";
+import { providerPathEnv } from "./provider-binary.js";
 export function runCommand(command, args) {
     return (spawnSync(command, args, { stdio: "ignore", timeout: 15_000 }).status ?? 1);
 }
@@ -25,18 +26,24 @@ export async function installAgentService(agent, options = {}) {
         return { path: "", started: false };
     }
     const args = [
-        options.nodePath ?? process.execPath,
-        options.cliPath ?? fileURLToPath(new URL("./index.js", import.meta.url)),
+        gatewayLauncherPath(home),
         "agent",
         "serve",
         "--agent",
         agent.agentId,
     ];
     const workDir = agentWorkDir(agent.agentId, home);
+    const pathEnv = providerPathEnv(undefined, home, false);
     const content = platform === "darwin"
-        ? launchdUnit(name, args, workDir, logPath)
-        : systemdUnit(args, workDir, logPath);
+        ? launchdUnit(name, args, workDir, logPath, pathEnv)
+        : systemdUnit(args, workDir, logPath, pathEnv);
     const changed = await writePrivateFile(path, content);
+    if (options.reload === false) {
+        if (platform === "linux" && changed) {
+            run("systemctl", ["--user", "daemon-reload"]);
+        }
+        return { path, started: true };
+    }
     if (platform === "darwin") {
         const domain = `gui/${options.uid ?? process.getuid?.() ?? 0}`;
         const loaded = run("launchctl", ["print", `${domain}/${name}`]) === 0;
@@ -71,26 +78,34 @@ export async function uninstallAgentService(agent, options = {}) {
         return;
     }
     const run = options.run ?? runCommand;
-    if (platform === "darwin") {
-        run("launchctl", [
-            "bootout",
-            `gui/${options.uid ?? process.getuid?.() ?? 0}`,
-            path,
-        ]);
-    }
-    else {
+    if (platform === "linux") {
         run("systemctl", [
             "--user",
             "disable",
-            "--now",
             `talentos-agent@${agent.agentId}.service`,
         ]);
     }
+    // Delete before asking the supervisor to stop us: it can send SIGTERM immediately.
     await rm(path, { force: true });
-    if (platform === "linux") {
+    if (platform === "darwin") {
+        unloadLaunchAgent(agent, options);
+    }
+    else {
         run("systemctl", ["--user", "daemon-reload"]);
+        run("systemctl", [
+            "--user",
+            "--no-block",
+            "stop",
+            `talentos-agent@${agent.agentId}.service`,
+        ]);
     }
 }
+export function unloadLaunchAgent(agent, options = {}) {
+    (options.run ?? runCommand)("launchctl", [
+        "bootout",
+        `gui/${options.uid ?? process.getuid?.() ?? 0}/${serviceName(agent.agentId)}`,
+    ]);
+}
 function serviceName(agentId) {
     return `so.talentos.agent.${agentId}`;
 }
@@ -103,7 +118,7 @@ function servicePath(agentId, platform, home) {
         ? join(home, ".config", "systemd", "user", `talentos-agent@${agentId}.service`)
         : "";
 }
-function launchdUnit(name, args, workDir, logPath) {
+function launchdUnit(name, args, workDir, logPath, pathEnv) {
     const xml = (value) => value
         .replaceAll("&", "&")
         .replaceAll("<", "&lt;")
@@ -116,14 +131,15 @@ function launchdUnit(name, args, workDir, logPath) {
 <key>Label</key><string>${xml(name)}</string>
 <key>ProgramArguments</key><array>${args.map((arg) => `<string>${xml(arg)}</string>`).join("")}</array>
 <key>WorkingDirectory</key><string>${xml(workDir)}</string>
-<key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin")}</string></dict>
+<key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(pathEnv)}</string></dict>
+<key>ThrottleInterval</key><integer>60</integer>
 <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
 <key>StandardOutPath</key><string>${xml(logPath)}</string>
 <key>StandardErrorPath</key><string>${xml(logPath)}</string>
 </dict></plist>
 `;
 }
-function systemdUnit(args, workDir, logPath) {
+function systemdUnit(args, workDir, logPath, pathEnv) {
     const quote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%").replaceAll("\n", "\\n").replaceAll("\r", "\\r")}"`;
     return `[Unit]
 Description=TalentOS agent gateway
@@ -133,9 +149,10 @@ After=network-online.target
 Type=simple
 ExecStart=${args.map(quote).join(" ")}
 WorkingDirectory=${quote(workDir)}
-Environment=${quote(`PATH=${process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin"}`)}
+Environment=${quote(`PATH=${pathEnv}`)}
 Restart=always
-RestartSec=5
+RestartSec=60
+RestartPreventExitStatus=78
 StandardOutput=${quote(`append:${logPath}`)}
 StandardError=${quote(`append:${logPath}`)}