vibe64 0.1.47 → 0.1.49

package/node_modules/@local/vibe64-execution/src/host/execHelper.js

@@ -2,7 +2,7 @@
 import { createRequire as __vibe64CreateRequire } from 'node:module';const require=__vibe64CreateRequire(import.meta.url);
 import{spawn as Ye,spawnSync as I}from"node:child_process";import{chmodSync as Je,chownSync as xe,closeSync as Ze,existsSync as T,
 lstatSync as fe,mkdirSync as _e,openSync as Qe,readFileSync as h,readSync as et,realpathSync as te,renameSync as Ne,rmSync as Te,
-unlinkSync as G,writeFileSync as oe}from"node:fs";import u from"node:path";import{createConnection as tt}from"node:net";
+unlinkSync as L,writeFileSync as oe}from"node:fs";import u from"node:path";import{createConnection as tt}from"node:net";
 import w from"node:process";var Ie=1024*1024,rt=64*1024,nt=10,ot=15e3,it="vibe64.exec-helper.payload",st=1,at=new Set(["\
 account-auth-terminal","account-status","codex-app-server","create-system-user","deployment-service","enable-system-user",
 "github-api-command","github-toolchain","github-workflow-command","health-status","managed-execution","managed-service",
@@ -23,7 +23,7 @@ ft=new Set(["assistant","browser","control","job","preview","service","terminal"
 F=64*1024*1024,$e=1024*1024*1024*1024,yt=256*1024*1024,we=1024*1024*1024*1024,de=8,pe=8192,gt=15e3;import.meta.main&&ht().
 catch(e=>{w.stderr.write(`${String(e?.message||e)}
 `),w.exit(2)});async function ht(){if(w.argv[2]==="run-managed"){await bt(w.argv[3]||"");return}if(w.argv[2]!=="execute")
-throw new Error("Usage: vibe64-exec-helper execute [payload-json-file]");let e=Jt(w.argv[3]||"");Lt(e);let t=String(e.operation||
+throw new Error("Usage: vibe64-exec-helper execute [payload-json-file]");let e=Jt(w.argv[3]||"");Gt(e);let t=String(e.operation||
 "").trim();if(!at.has(t))throw new Error("Vibe64 exec helper rejected an unknown operation.");if(t==="deployment-service"){
 Ht(e);return}if(t==="managed-service"){Kt(e);return}if(t==="managed-execution"){St(e,w.argv[3]||"");return}let r=N(e.username);
 if(t==="create-system-user"||t==="enable-system-user"){Wt(t,e,r);return}Se(r);let n=String(e.command||"").trim();if(!je.
@@ -35,7 +35,7 @@ error)throw p.error;w.exit(typeof p.status=="number"?p.status:1)}function Et(e,t
 e.username,"--","/usr/bin/env","--",`PATH=${n.env.PATH}`,t,...r],{...n,env:{...n.env,PATH:ie}})}function St(e={},t=""){let r=q();
 vt(t,r),ae(j);let n=String(e.action||"").trim();if(n.startsWith("workflow-")){let O=Ot(e,r);w.stdout.write(`${JSON.stringify(
 O)}
-`),O.ok!==!0&&(w.exitCode=1);return}let o=W(e.executionId),i=De(o,r);if(n==="inspect"){Pt(i,o,r);return}if(n==="stop"){Gt(
+`),O.ok!==!0&&(w.exitCode=1);return}let o=W(e.executionId),i=De(o,r);if(n==="inspect"){Pt(i,o,r);return}if(n==="stop"){Lt(
 i,o,r);return}if(n!=="start")throw new Error("Vibe64 exec helper rejected an unknown managed execution action.");let s=It(
 e.mode),a=Tt(e.kind),c=String(e.lifecycle||"").trim();if(c!==(s==="capture"?"finite":s==="pty"?"interactive":"service"))
 throw new Error("Vibe64 exec helper rejected a managed execution lifecycle mismatch.");let p=Re(e.controllerLeaseName,c),
@@ -61,25 +61,25 @@ ype=exec",`--slice=${k}`,`--property=Description=Vibe64 ${a} execution`,`--prope
 p=${j}`,"--property=SupplementaryGroups=nix-users","--property=UMask=0007",`--property=WorkingDirectory=${f}`,...y?[`--p\
 roperty=EnvironmentFile=${y}`]:[],"--property=KillMode=control-group","--property=ExitType=cgroup","--property=OOMPolicy\
 =stop","--property=MemoryAccounting=yes","--property=IOAccounting=yes","--property=TasksAccounting=yes",`--property=Memo\
-ryMax=${D}`,`--property=TasksMax=${V}`,"--property=TimeoutStopSec=10s",...s==="capture"?["--wait","--pipe"]:[],...s==="p\
-ty"?["--wait","--pty"]:[],Xe,"run-managed",Z],L=I("systemd-run",qe,{stdio:"inherit"});if((s!=="detached"||L.error||L.status!==
-0)&&Te(J,{force:!0,recursive:!0}),L.error)throw L.error;w.exit(typeof L.status=="number"?L.status:1)}function vt(e="",t={}){
-let r=String(e||"").trim();if(!r)return;let n=u.resolve(r),o=u.join(Y(t.username),"managed-execution-payloads");if(C(o,n).
-length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execution payload path.");G(n)}async function bt(e=""){
-let t=u.resolve(String(e||"")),r=h(t,"utf8");G(t);let n=JSON.parse(r);if(n?.schema!=="vibe64.managed-execution.command"||
-n?.schemaVersion!==1)throw new Error("Vibe64 managed execution runner rejected an invalid payload.");let o=String(n.command||
-"").trim();if(!o||/[\r\n]/u.test(o))throw new Error("Vibe64 managed execution runner rejected an invalid command.");let i=Re(
-n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,l=!1,p=()=>{
-l=!0,a&&c===null&&(c=Me(a))};s?.once("close",p);let m=new Date().toISOString();try{a=Ye(o,Array.isArray(n.args)?n.args.map(
-String):[],{cwd:String(n.cwd||"/"),detached:!!s,env:n.releaseEnvironment===!0?be({...w.env,...n.env},{username:n.env.USER,
-home:n.env.HOME},n.env.USER):n.env&&typeof n.env=="object"&&!Array.isArray(n.env)?n.env:{},stdio:n.inputPresent===!0?["p\
-ipe","inherit","inherit"]:"inherit"}),n.inputPresent===!0&&a.stdin.end(Buffer.from(String(n.inputBase64||""),"base64")),
-l&&(c=Me(a));let d=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().toISOString()}),a.once("error",x),
-a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof d.status=="number"?d.status:1;Ct(u.dirname(t),
-{...Dt(),executionId:W(n.executionId),startedAt:m,exitObservedAt:d.exitObservedAt,execMainCode:d.signal?"killed":"exited",
-execMainStatus:d.signal||String(f),result:d.signal?"signal":f===0?"success":"exit-code",signal:String(d.signal||"")}),w.
-exitCode=f}finally{c!==null&&clearTimeout(c),s?.off("close",p),s?.destroy()}}function Re(e="",t=""){let r=String(e||"");
-if(t!=="service"){if(r)throw new Error("Vibe64 exec helper rejected a controller lease on a finite execution.");return""}
+ryMax=${D}`,`--property=TasksMax=${V}`,"--property=TimeoutStopSec=10s",...s==="capture"?["--property=LogLevelMax=notice",
+"--wait","--pipe"]:[],...s==="pty"?["--wait","--pty"]:[],Xe,"run-managed",Z],G=I("systemd-run",qe,{stdio:"inherit"});if((s!==
+"detached"||G.error||G.status!==0)&&Te(J,{force:!0,recursive:!0}),G.error)throw G.error;w.exit(typeof G.status=="number"?
+G.status:1)}function vt(e="",t={}){let r=String(e||"").trim();if(!r)return;let n=u.resolve(r),o=u.join(Y(t.username),"ma\
+naged-execution-payloads");if(C(o,n).length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execution\
+ payload path.");L(n)}async function bt(e=""){let t=u.resolve(String(e||"")),r=h(t,"utf8");L(t);let n=JSON.parse(r);if(n?.
+schema!=="vibe64.managed-execution.command"||n?.schemaVersion!==1)throw new Error("Vibe64 managed execution runner rejec\
+ted an invalid payload.");let o=String(n.command||"").trim();if(!o||/[\r\n]/u.test(o))throw new Error("Vibe64 managed ex\
+ecution runner rejected an invalid command.");let i=Re(n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(
+i):null;w.umask(7);let a=null,c=null,l=!1,p=()=>{l=!0,a&&c===null&&(c=Me(a))};s?.once("close",p);let m=new Date().toISOString();
+try{a=Ye(o,Array.isArray(n.args)?n.args.map(String):[],{cwd:String(n.cwd||"/"),detached:!!s,env:n.releaseEnvironment===!0?
+be({...w.env,...n.env},{username:n.env.USER,home:n.env.HOME},n.env.USER):n.env&&typeof n.env=="object"&&!Array.isArray(n.
+env)?n.env:{},stdio:n.inputPresent===!0?["pipe","inherit","inherit"]:"inherit"}),n.inputPresent===!0&&a.stdin.end(Buffer.
+from(String(n.inputBase64||""),"base64")),l&&(c=Me(a));let d=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().
+toISOString()}),a.once("error",x),a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof d.status=="n\
+umber"?d.status:1;Ct(u.dirname(t),{...Dt(),executionId:W(n.executionId),startedAt:m,exitObservedAt:d.exitObservedAt,execMainCode:d.
+signal?"killed":"exited",execMainStatus:d.signal||String(f),result:d.signal?"signal":f===0?"success":"exit-code",signal:String(
+d.signal||"")}),w.exitCode=f}finally{c!==null&&clearTimeout(c),s?.off("close",p),s?.destroy()}}function Re(e="",t=""){let r=String(
+e||"");if(t!=="service"){if(r)throw new Error("Vibe64 exec helper rejected a controller lease on a finite execution.");return""}
 if(!/^\0vibe64-resource-controller-[a-z][a-z0-9-]{0,62}$/u.test(r))throw new Error("Vibe64 exec helper rejected an inval\
 id managed service controller lease.");return r}function xt(e=""){return new Promise((t,r)=>{let n=tt({path:e}),o=setTimeout(
 ()=>{n.destroy(),r(new Error("Vibe64 managed service could not attach to its controller lease."))},3e3);o.unref?.(),n.once(
@@ -88,21 +88,22 @@ clearTimeout(o),n.destroy(),r(new Error(`Vibe64 managed service controller lease
 ke(e,"SIGTERM");let t=setTimeout(()=>ke(e,"SIGKILL"),5e3);return t.unref?.(),t}function ke(e=null,t="SIGTERM"){let r=Number(
 e?.pid);if(!(!Number.isSafeInteger(r)||r<=1))try{w.kill(-r,t)}catch(n){if(n?.code==="ESRCH")return;try{e.kill(t)}catch(o){
 o?.code!=="ESRCH"&&w.stderr.write(`Vibe64 managed service process tree could not be stopped.
-`)}}}function Mt(e={},{memoryMaxBytes:t=0,tasksMax:r=0}={}){let n=he(e);S("systemctl",["start",n]),S("systemctl",["set-p\
-roperty","--runtime",n,`MemoryMax=${t}`,`TasksMax=${r}`,"MemoryAccounting=yes","IOAccounting=yes","TasksAccounting=yes"])}
-function Ce(e={},t={}){let r=W(e.id);for(let a of[e.projectKey,e.sessionKey])if(typeof a!="string"||!/^[a-f0-9]{64}$/u.test(
-a))throw new Error("Vibe64 exec helper rejected an invalid workflow accounting identity.");let n=N(t.username);if(!n.startsWith(
-re))throw new Error("Managed workflow accounting requires a workspace daemon owner.");let o=$(n);if(!/^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.
-test(o))throw new Error("Invalid managed workflow workspace identity.");let i=`vibe64-${o}-work-p${e.projectKey}.slice`,
-s=`${i.slice(0,-6)}-s${e.sessionKey}.slice`;return{id:r,workspace:o,projectKey:e.projectKey,sessionKey:e.sessionKey,projectUnit:i,
-sessionUnit:s,unitName:`${s.slice(0,-6)}-w${r.replaceAll("-","")}.slice`}}function ye(e){return u.join("/run/vibe64-work\
-flows",e.workspace,`${e.id}.json`)}function kt(e){try{let t=JSON.parse(h(ye(e),"utf8"));if(t.schema!=="vibe64.managed-wo\
-rkflow.result.v1"||t.unitName!==e.unitName||t.id!==e.id)throw new Error("Invalid managed workflow result identity.");return t}catch(t){
-if(t.code==="ENOENT")return null;throw t}}function At(e,t){let r=ye(e);for(let i of["/run/vibe64-workflows",u.dirname(r)]){
-try{_e(i,{mode:448})}catch(a){if(a.code!=="EEXIST")throw a}let s=fe(i);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==
-0||(s.mode&63)!==0)throw new Error("Unsafe managed workflow result directory.")}let n=`${r}.tmp-${w.pid}`,o=Qe(n,"wx",384);
-try{try{oe(o,`${JSON.stringify({...t,schema:"vibe64.managed-workflow.result.v1"})}
-`)}finally{Ze(o)}Ne(n,r)}catch(i){try{G(n)}catch(s){if(s.code!=="ENOENT")throw new AggregateError([i,s],"Workflow receip\
+`)}}}function Mt(e={},{memoryMaxBytes:t=0,tasksMax:r=0}={}){let n=he(e);A("systemctl",["is-active","--quiet",n]).status!==
+0&&S("systemctl",["start",n]),S("systemctl",["set-property","--runtime",n,`MemoryMax=${t}`,`TasksMax=${r}`,"MemoryAccoun\
+ting=yes","IOAccounting=yes","TasksAccounting=yes"])}function Ce(e={},t={}){let r=W(e.id);for(let a of[e.projectKey,e.sessionKey])
+if(typeof a!="string"||!/^[a-f0-9]{64}$/u.test(a))throw new Error("Vibe64 exec helper rejected an invalid workflow accou\
+nting identity.");let n=N(t.username);if(!n.startsWith(re))throw new Error("Managed workflow accounting requires a works\
+pace daemon owner.");let o=$(n);if(!/^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(o))throw new Error("Invalid managed work\
+flow workspace identity.");let i=`vibe64-${o}-work-p${e.projectKey}.slice`,s=`${i.slice(0,-6)}-s${e.sessionKey}.slice`;return{
+id:r,workspace:o,projectKey:e.projectKey,sessionKey:e.sessionKey,projectUnit:i,sessionUnit:s,unitName:`${s.slice(0,-6)}-\
+w${r.replaceAll("-","")}.slice`}}function ye(e){return u.join("/run/vibe64-workflows",e.workspace,`${e.id}.json`)}function kt(e){
+try{let t=JSON.parse(h(ye(e),"utf8"));if(t.schema!=="vibe64.managed-workflow.result.v1"||t.unitName!==e.unitName||t.id!==
+e.id)throw new Error("Invalid managed workflow result identity.");return t}catch(t){if(t.code==="ENOENT")return null;throw t}}
+function At(e,t){let r=ye(e);for(let i of["/run/vibe64-workflows",u.dirname(r)]){try{_e(i,{mode:448})}catch(a){if(a.code!==
+"EEXIST")throw a}let s=fe(i);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==0||(s.mode&63)!==0)throw new Error("Unsafe\
+ managed workflow result directory.")}let n=`${r}.tmp-${w.pid}`,o=Qe(n,"wx",384);try{try{oe(o,`${JSON.stringify({...t,schema:"\
+vibe64.managed-workflow.result.v1"})}
+`)}finally{Ze(o)}Ne(n,r)}catch(i){try{L(n)}catch(s){if(s.code!=="ENOENT")throw new AggregateError([i,s],"Workflow receip\
 t write and cleanup failed.")}throw i}}function P(e){let t=A("systemctl",["show",e.unitName,"--no-pager","--property=Loa\
 dState,ActiveState,ControlGroup,MemoryMax,TasksMax"]),r=Object.fromEntries(String(t.stdout||"").trim().split(`
 `).map(s=>{let a=s.indexOf("=");return[s.slice(0,a),s.slice(a+1)]})),n=String(r.ControlGroup||"");if(n&&(u.posix.basename(
@@ -122,7 +123,7 @@ exec(s)?.[1]),oomCount:n.oom??null,oomKillCount:n.oom_kill??null,limitHitCount:n
 t("pids.current")),peakScope:"workflow-lifetime"}}function Ot(e,t){let r=Ce(e.workflow,t),n=String(e.action||"");if(n===
 "workflow-inspect")return{ok:!0,...P(r)};if(n==="workflow-grow"||n==="workflow-limits")return _t(e,r,t);if(n==="workflow\
 -forget"){let o=P(r);if(o.scopeEmpty!==!0||o.activeState!=="inactive")throw new Error("Only a completed workflow receipt\
- can be acknowledged.");try{G(ye(r))}catch(i){if(i.code!=="ENOENT")throw i}return{ok:!0,id:r.id}}if(n==="workflow-create"){
+ can be acknowledged.");try{L(ye(r))}catch(i){if(i.code!=="ENOENT")throw i}return{ok:!0,id:r.id}}if(n==="workflow-create"){
 let o=U(e.memoryMaxBytes,F,we,"workflow memory limit"),i=U(e.tasksMax,de,pe,"workflow task limit"),s=E(S("systemctl",["s\
 how",he(t),"--property=MemoryMax","--value"]));if(s===null||o>s)throw new Error("Vibe64 exec helper rejected a workflow \
 above its proven work-slice memory limit.");let a=P(r);if(a.finishedAt)throw new Error("A completed workflow identity ca\
@@ -245,13 +246,13 @@ _NONE"&&g)V="host";else if(d==="CONSTRAINT_MEMCG"&&f&&(x===f||x.startsWith(`${f}
 .slice`?"workspace":v==="vibe64.slice"?"platform":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}-w[a-f0-9]{32}\.slice$/u.test(v)?"wo\
 rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(v)?"session":/-work-p[a-f0-9]{64}\.slice$/u.test(v)?"project":
 "ancestor"}else return null;let H=f||"";if(a&&a.cgroup!==H)return null;(!a||l>Date.parse(a.recordedAt))&&(a={source:"ker\
-nel-journal",scope:V,cgroup:H,recordedAt:new Date(l).toISOString()})}return a}function Gt(e="",t="",r={}){let n=K(e,t,r);
+nel-journal",scope:V,cgroup:H,recordedAt:new Date(l).toISOString()})}return a}function Lt(e="",t="",r={}){let n=K(e,t,r);
 n.scopeEmpty||A("systemctl",["stop",e]);let o=Date.now()+gt,i=K(e,t,r),s=new Int32Array(new SharedArrayBuffer(4));for(;!i.
 scopeEmpty&&Date.now()<o;)Atomics.wait(s,0,0,25),i=K(e,t,r);i.scopeEmpty||(A("systemctl",["kill","--kill-who=all","--sig\
 nal=SIGKILL",e]),A("systemctl",["stop",e]),i=K(e,t,r)),i.scopeEmpty&&(Te(Ee(r,t),{force:!0,recursive:!0}),A("systemctl",
 ["reset-failed",e])),w.stdout.write(`${JSON.stringify({executionId:t,ok:i.scopeEmpty,scopeEmpty:i.scopeEmpty,stopped:n.scopeEmpty===
 !1,...i})}
-`),i.scopeEmpty||w.exit(1)}function Lt(e={}){if(e?.schema!==it||e?.schemaVersion!==st)throw new Error("Vibe64 exec helpe\
+`),i.scopeEmpty||w.exit(1)}function Gt(e={}){if(e?.schema!==it||e?.schemaVersion!==st)throw new Error("Vibe64 exec helpe\
 r rejected a non-normalized execution payload.")}function Wt(e="",t={},r=""){Se(r),q(),ae(j),e==="create-system-user"?tr(
 r,String(t.password||"")):X(r),rr(r,j)}function Ht(e={}){let t=q();ae(j);let r=String(e.action||"").trim(),n=ce(e.unitName);
 if(r==="inspect"){zt(n);return}if(r==="remove"){Yt(n);return}if(r!=="install-start")throw new Error("Vibe64 exec helper \
@@ -265,7 +266,7 @@ ager","--output=cat","--lines=80"]),n=String(r.stdout||r.stderr||"").trim();w.st
 `)+`
 `)}function Kt(e={}){let t=q();ae(j);let r=String(e.action||"").trim(),n=ve(e.unitName,t);if(r!=="install-start")throw new Error(
 "Vibe64 exec helper rejected an unknown managed service action.");let o=Oe(e.workingDirectory,t,"workingDirectory"),i=Oe(
-e.startScript,t,"startScript"),s=Le(e.processModel),a=s==="forking"?Ge(e.pidFile,t):"",c=ir(n,t),l=ar({owner:t,pidFile:a,
+e.startScript,t,"startScript"),s=Ge(e.processModel),a=s==="forking"?Le(e.pidFile,t):"",c=ir(n,t),l=ar({owner:t,pidFile:a,
 processModel:s,startScript:i,unitName:n,workingDirectory:o});Ft({owner:t,pidFile:a,unitName:n}),Pe({activation:"start",unit:l,
 unitName:n,unitPath:c})}function Ft({owner:e={},pidFile:t="",unitName:r=""}={}){if(!t||!T(t))return;let n=String(h(t,"ut\
 f8")||"").trim();if(!/^[1-9][0-9]*$/u.test(n))throw new Error("Vibe64 managed service PID file is invalid.");let o=Number(
@@ -274,16 +275,16 @@ let i=Xt(o);if(i===null){Q(t,n);return}if(i!==e.uid)throw new Error("Vibe64 mana
 er.");if(qt(o,r))return;try{w.kill(o,"SIGTERM")}catch(c){if(c?.code==="ESRCH"){Q(t,n);return}throw c}let s=Date.now()+3e4,
 a=new Int32Array(new SharedArrayBuffer(4));for(;me(o)&&Date.now()<s;)Atomics.wait(a,0,0,100);if(me(o))throw new Error("V\
 ibe64 managed service process did not stop cleanly during ownership transfer.");Q(t,n)}function Q(e="",t=""){T(e)&&String(
-h(e,"utf8")||"").trim()===t&&G(e)}function me(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
+h(e,"utf8")||"").trim()===t&&L(e)}function me(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
 function Xt(e=0){let t="";try{t=h(`/proc/${e}/status`,"utf8")}catch(o){if(o?.code==="ENOENT")return null;throw o}let r=String(
 t||"").match(/^Uid:\s+([0-9]+)/mu),n=Number(r?.[1]);if(!Number.isSafeInteger(n))throw new Error("Vibe64 managed service \
 process UID is unavailable.");return n}function qt(e=0,t=""){let r=`/${t}`,n="";try{n=h(`/proc/${e}/cgroup`,"utf8")}catch(o){
 if(o?.code==="ENOENT")return!1;throw o}return String(n||"").split(`
 `).some(o=>o.trim().endsWith(r))}function Pe({activation:e="start",unit:t="",unitName:r="",unitPath:n=""}={}){if(e!=="st\
 art"&&e!=="restart")throw new Error("Vibe64 exec helper rejected an unsupported systemd activation.");let o=`${n}.tmp-${w.
-pid}`;oe(o,t,{mode:420});try{S("mv",[o,n])}catch(i){try{G(o)}catch{}throw i}S("systemctl",["daemon-reload"]),S("systemct\
+pid}`;oe(o,t,{mode:420});try{S("mv",[o,n])}catch(i){try{L(o)}catch{}throw i}S("systemctl",["daemon-reload"]),S("systemct\
 l",["enable",r]),A("systemctl",["reset-failed",r]);try{S("systemctl",[e,r])}catch(i){throw A("systemctl",["stop",r]),i}}
-function Yt(e=""){ce(e),A("systemctl",["stop",e]),A("systemctl",["disable",e]),A("systemctl",["reset-failed",e]);try{G(We(
+function Yt(e=""){ce(e),A("systemctl",["stop",e]),A("systemctl",["disable",e]),A("systemctl",["reset-failed",e]);try{L(We(
 e))}catch(t){if(t?.code!=="ENOENT")throw t}S("systemctl",["daemon-reload"])}function Jt(e=""){let t=e?h(u.resolve(e),"ut\
 f8"):Zt();if(Buffer.byteLength(t,"utf8")>Ie)throw new Error("Vibe64 exec helper payload is too large.");let r=JSON.parse(
 t);if(!r||typeof r!="object"||Array.isArray(r))throw new Error("Vibe64 exec helper payload must be a JSON object.");return r}
@@ -310,9 +311,9 @@ hpasswd",{encoding:"utf8",input:`${e}:${t}
 S("usermod",["-a","-G",t,e])}function S(e="",t=[]){let r=I(e,t,{encoding:"utf8"});if(r.status!==0)throw new Error(String(
 r.stderr||r.stdout||`${e} failed.`).trim());return String(r.stdout||"").trim()}function A(e="",t=[]){return I(e,t,{encoding:"\
 utf8"})}function ee(e="",t={},r="path"){let n=nr(e,t);if(!T(n))throw new Error(`Vibe64 deployment service ${r} does not \
-exist.`);return n}function Oe(e="",t={},r="path"){let n=Ge(e,t);if(!T(n))throw new Error(`Vibe64 managed service ${r} do\
+exist.`);return n}function Oe(e="",t={},r="path"){let n=Le(e,t);if(!T(n))throw new Error(`Vibe64 managed service ${r} do\
 es not exist.`);return n}function Ve(e={}){let t=N(e.username),r=$(t);if(!r)throw new Error("Vibe64 exec helper could no\
-t resolve the managed service workspace.");return u.join("/var/lib/vibe64",r,"services")}function Ge(e="",t={}){let r=String(
+t resolve the managed service workspace.");return u.join("/var/lib/vibe64",r,"services")}function Le(e="",t={}){let r=String(
 e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejected an empty managed service path.");let n=b(r,{allowMissingLeaf:!0});
 if(C(b(Ve(t)),n).length>0)return n;throw new Error("Vibe64 exec helper rejected a managed service path outside the works\
 pace service root.")}function nr(e="",t={}){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejecte\
@@ -327,7 +328,7 @@ release-")||!t.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.test(t)||t.includes
 "Vibe64 exec helper rejected an unsafe deployment service unit name.");return t}function ve(e="",t={}){let r=String(e||"").
 trim(),n=u.basename(u.dirname(Ve(t)));if(!r.startsWith(`vibe64-managed-${n}-`)||!r.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.
 test(r)||r.includes("/")||r.includes(".."))throw new Error("Vibe64 exec helper rejected an unsafe managed service unit n\
-ame.");return r}function Le(e=""){let t=String(e||"").trim();if(t!=="forking"&&t!=="simple")throw new Error("Vibe64 exec\
+ame.");return r}function Ge(e=""){let t=String(e||"").trim();if(t!=="forking"&&t!=="simple")throw new Error("Vibe64 exec\
  helper rejected an unsupported managed service process model.");return t}function We(e=""){return u.join("/etc/systemd/\
 system",ce(e))}function ir(e="",t={}){return u.join("/etc/systemd/system",ve(e,t))}function He(e={}){return[`User=${_(e.
 username)}`,`Group=${j}`,"SupplementaryGroups=nix-users","UMask=0007"]}function ze(e={}){return[`Slice=vibe64-${$(N(e.username))}\
@@ -339,7 +340,7 @@ let s=Array.isArray(r)?r:[];return["[Unit]",`Description=Vibe64 release service
 `Environment=PATH=${_(ie)}`,`Environment=TMPDIR=${_(Y(t.username))}`,`ExecStart=${_(n)}`,"Restart=always","RestartSec=3",
 "KillSignal=SIGTERM","TimeoutStopSec=30","","[Install]","WantedBy=multi-user.target",""].join(`
 `)}function ar({owner:e={},pidFile:t="",processModel:r="simple",startScript:n="",unitName:o="",workingDirectory:i=""}={}){
-let s=Le(r);return["[Unit]",`Description=Vibe64 managed service ${o}`,"After=network-online.target","Wants=network-onlin\
+let s=Ge(r);return["[Unit]",`Description=Vibe64 managed service ${o}`,"After=network-online.target","Wants=network-onlin\
 e.target","","[Service]",`Type=${s}`,...He(e),...ze(e),`WorkingDirectory=${_(i)}`,`Environment=PATH=${_(ie)}`,`Environme\
 nt=TMPDIR=${_(Y(e.username))}`,`ExecStart=${_(n)}`,...s==="forking"?[`PIDFile=${_(t)}`]:[],"Restart=on-failure","Restart\
 Sec=3","TimeoutStartSec=90","TimeoutStopSec=30","","[Install]","WantedBy=multi-user.target",""].join(`