vibe64 0.1.50 → 0.1.51

package/node_modules/@local/vibe64-execution/src/host/execHelper.js

@@ -2,17 +2,17 @@
 import { createRequire as __vibe64CreateRequire } from 'node:module';const require=__vibe64CreateRequire(import.meta.url);
 import{spawn as pr,spawnSync as P}from"node:child_process";import{createHash as dr}from"node:crypto";import{chmodSync as fr,
 closeSync as w,constants as $,existsSync as Y,fchmodSync as de,fchownSync as ne,fstatSync as J,lstatSync as Ee,mkdirSync as Z,
-openSync as M,readFileSync as N,readSync as ft,readdirSync as fe,realpathSync as me,renameSync as Se,rmSync as Ve,statSync as hr,
+openSync as M,readFileSync as N,readSync as ft,readdirSync as fe,realpathSync as ie,renameSync as Se,rmSync as Ve,statSync as hr,
 unlinkSync as q,writeFileSync as he}from"node:fs";import p from"node:path";import{createConnection as gr}from"node:net";
 import{constants as wr}from"node:os";import h from"node:process";var yr=4*1024*1024,Er=1024*1024,ht=4*Math.ceil(yr/3)+Er,
 B=$.O_RDONLY|$.O_DIRECTORY|$.O_NOFOLLOW,gt=$.O_WRONLY|$.O_CREAT|$.O_EXCL|$.O_NOFOLLOW,Sr=$.O_RDONLY|$.O_NOFOLLOW|$.O_NONBLOCK,
-br=/^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/u,vr=64*1024,wt=[".local","state","vibe64","users"],yt=64*1024,xr=64,kr=64*1024,Or=10,
+vr=/^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/u,br=64*1024,wt=[".local","state","vibe64","users"],yt=64*1024,xr=64,kr=64*1024,Or=10,
 Ar=15e3,Mr="vibe64.exec-helper.payload",Nr=1,_r=new Set(["account-auth-terminal","application-account","account-status",
 "codex-app-server","create-system-user","deployment-service","enable-system-user","github-api-command","github-toolchain",
 "github-workflow-command","health-status","managed-execution","managed-service","opencode-app-server","vibe64-command","\
 workspace-cache-command"]),Et=new Set(["bash","gh","git"]),St=/^[A-Za-z_][A-Za-z0-9_]*$/u,Tr=new Set(["BASH_ENV","ENV","\
 GCONV_PATH","GETCONF_DIR","GLIBC_TUNABLES","HOSTALIASES","LOCALDOMAIN","LD_AUDIT","LD_LIBRARY_PATH","LD_PRELOAD","LOCPAT\
-H","MALLOC_TRACE","NIS_PATH","NLSPATH","NODE_OPTIONS","RESOLV_HOST_CONF","RES_OPTIONS","TZDIR"]),be=["/opt/vibe64/runtim\
+H","MALLOC_TRACE","NIS_PATH","NLSPATH","NODE_OPTIONS","RESOLV_HOST_CONF","RES_OPTIONS","TZDIR"]),ve=["/opt/vibe64/runtim\
 e-packs/policy-bin","/opt/vibe64/runtime-packs/operator-clis/bin","/opt/vibe64/runtime-packs/node26/bin","/opt/vibe64/ru\
 ntime-packs/git/bin","/opt/vibe64/runtime-packs/gh/bin","/opt/vibe64/runtime-packs/ripgrep/bin","/opt/vibe64/runtime-pac\
 ks/bubblewrap/bin","/opt/vibe64/runtime-packs/bun/bin","/opt/vibe64/runtime-packs/php/bin","/opt/vibe64/runtime-packs/co\
@@ -21,8 +21,8 @@ on/bin","/opt/vibe64/runtime-packs/ruby/bin","/opt/vibe64/runtime-packs/go/bin",
 pt/vibe64/runtime-packs/kotlin/bin","/opt/vibe64/runtime-packs/csharp/bin","/opt/vibe64/runtime-packs/rust/bin","/opt/vi\
 be64/runtime-packs/mariadb/bin","/opt/vibe64/runtime-packs/postgresql/bin","/opt/vibe64/runtime-packs/sqlite/bin","/opt/\
 vibe64/runtime-packs/playwright/bin","/opt/vibe64/runtime-packs/guard-bin","/usr/local/sbin","/usr/local/bin","/usr/sbin",
-"/usr/bin","/sbin","/bin"].join(":"),bt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,G="vibe64",U="v64d_",ve="/var/lib/vibe64",Rr=new Set(
-["root"]),Ue="/etc/vibe64",Ge=p.join(Ue,"people"),vt="vibe64.person-registration",xt=4096,Pe=3,Ir="/etc/vibe64/person-su\
+"/usr/bin","/sbin","/bin"].join(":"),vt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,G="vibe64",U="v64d_",be="/var/lib/vibe64",Rr=new Set(
+["root"]),Ue="/etc/vibe64",Ge=p.join(Ue,"people"),bt="vibe64.person-registration",xt=4096,Pe=3,Ir="/etc/vibe64/person-su\
 do-commands",$r=new Set(["adm","admin","disk","docker","incus","incus-admin","kmem","libvirt","lxd","root","shadow","sta\
 ff","sudo","wheel"]),We="v64a_",kt=new RegExp(`^${We}[a-f0-9]{12}$`,"u"),xe=p.join(Ue,"applications"),Ot="vibe64.applica\
 tion-account",ke="/var/lib/vibe64-apps",ge="/etc/systemd/system",at="resource-controller.sock",Re="/run/vibe64-applicati\
@@ -34,19 +34,19 @@ d"){await Hr(h.argv[3]||"");return}if(h.argv[2]==="run-release-service"){Hn(h.ar
 "upgrade-person-registry"){if(h.argv.length!==4)throw new Error("Usage: vibe64-exec-helper upgrade-person-registry <work\
 space>");xn(h.argv[3]);return}if(h.argv[2]==="register-person"){if(h.argv.length!==5)throw new Error("Usage: vibe64-exec\
 -helper register-person <workspace> <username>");Xt(h.argv[3],h.argv[4]);return}if(h.argv[2]==="check-person"){if(h.argv.
-length!==4)throw new Error("Usage: vibe64-exec-helper check-person <username>");se(h.argv[3]),ze(F(h.argv[3]),Me(h.argv[3]));
+length!==4)throw new Error("Usage: vibe64-exec-helper check-person <username>");ce(h.argv[3]),ze(F(h.argv[3]),Me(h.argv[3]));
 return}if(h.argv[2]!=="execute"||h.argv.length>4)throw new Error("Usage: vibe64-exec-helper execute [payload-json-file]");
 let e=h.argv[3]||"",t=e?Fr(e,Q()):Yn();wn(t);let r=String(t.operation||"").trim();if(!_r.has(r))throw new Error("Vibe64 \
 exec helper rejected an unknown operation.");if(e&&r!=="managed-execution")throw new Error("Vibe64 exec helper accepts a\
  payload file only for a managed execution.");if(r==="deployment-service"){Pn(t);return}if(r==="managed-service"){Dn(t);
 return}if(r==="managed-execution"){Wr(t);return}if(r==="application-account"){On(t);return}let n=O(t.username);if(r==="c\
-reate-system-user"||r==="enable-system-user"){yn(r,t,n);return}se(n);let o=String(t.command||"").trim();if(!Et.has(o))throw new Error(
+reate-system-user"||r==="enable-system-user"){yn(r,t,n);return}ce(n);let o=String(t.command||"").trim();if(!Et.has(o))throw new Error(
 "Vibe64 exec helper rejected an unknown command.");let s=F(n);oe("uid",t.uid,s.uid),oe("gid",t.gid,s.gid);let i=Q();Ht(i,
 s);let c=ar(t.cwd||"",i.username,{operation:r,targetUser:s}),a=it(t.env||{},s,i.username,r),u=Array.isArray(t.args)?t.args.
 map(d=>String(d)):[],l=t.inputBase64?Buffer.from(String(t.inputBase64),"base64"):void 0;h.umask(7);let m=Gr(s,o,u,{cwd:c,
 env:a,...l===void 0?{stdio:"inherit"}:{input:l,stdio:["pipe","inherit","inherit"]}});if(m.error)throw m.error;h.exit(typeof m.
 status=="number"?m.status:1)}function Gr(e,t,r,n){return P("/usr/bin/setpriv",["--no-new-privs","--","/usr/sbin/runuser",
-"-u",e.username,"--","/usr/bin/env","--",`PATH=${n.env.PATH}`,t,...r],{...n,env:{...n.env,PATH:be}})}function Wr(e={}){let t=Q(),
+"-u",e.username,"--","/usr/bin/env","--",`PATH=${n.env.PATH}`,t,...r],{...n,env:{...n.env,PATH:ve}})}function Wr(e={}){let t=Q(),
 r=Ne(G),n=String(e.action||"").trim();if(n.startsWith("workflow-")){let D=Zr(e,t);h.stdout.write(`${JSON.stringify(D)}
 `),D.ok!==!0&&(h.exitCode=1);return}if(n==="release-ended"){h.stdout.write(`${JSON.stringify(gn(t,e.keepExecutionIds))}
 `);return}let o=z(e.executionId),s=ye(o,t);if(n==="inspect"){mn(s,o,t);return}if(n==="stop"){let D=hn(s,o,t,{termTimeoutMs:fn(
@@ -62,24 +62,24 @@ helper rejected an unsupported real-user managed command.");let S=Array.isArray(
 e.env||{},m,t.username,f);if(e.usageRecordingPreload){if(d)throw new Error("An application account does not run the usag\
 e recorder.");R.NODE_OPTIONS=io(e.usageRecordingPreload)}let C="";if(e.releaseEnvironmentFile){if(!d)throw new Error("Re\
 lease environment requires an application's own execution.");C=Jt(e.releaseEnvironmentFile,d,{cwd:g,daemonUid:t.uid,gid:m.
-gid})}let I=K(e.memoryMaxBytes,pe,_t,"memory limit"),v=K(e.tasksMax,Ce,De,"task limit"),b=K(e.workMemoryMaxBytes,Br,Fe,"\
-work-slice memory limit"),_=K(e.workTasksMax,Ce,De,"work-slice task limit");if(I>b||v>_)throw new Error("Vibe64 exec hel\
-per rejected an execution limit above its work-slice limit.");let st=Ye(t);if(e.workflow){let D=Rt(e.workflow,t),ae=X(D);
-if(ae.activeState!=="active"||!ae.controlGroup||ae.finishedAt)throw new Error("Vibe64 exec helper rejected an execution \
-without its active workflow group.");if(I>ae.memoryMaxBytes||v>ae.tasksMax)throw new Error("Vibe64 exec helper rejected \
-an execution limit above its workflow limit.");st=D.unitName}else Yr(t,{memoryMaxBytes:b,tasksMax:_});let Te=d?$t(t,{create:!0}):
+gid})}let I=K(e.memoryMaxBytes,pe,_t,"memory limit"),b=K(e.tasksMax,Ce,De,"task limit"),v=K(e.workMemoryMaxBytes,Br,Fe,"\
+work-slice memory limit"),_=K(e.workTasksMax,Ce,De,"work-slice task limit");if(I>v||b>_)throw new Error("Vibe64 exec hel\
+per rejected an execution limit above its work-slice limit.");let st=Ye(t);if(e.workflow){let D=Rt(e.workflow,t),ue=X(D);
+if(ue.activeState!=="active"||!ue.controlGroup||ue.finishedAt)throw new Error("Vibe64 exec helper rejected an execution \
+without its active workflow group.");if(I>ue.memoryMaxBytes||b>ue.tasksMax)throw new Error("Vibe64 exec helper rejected \
+an execution limit above its workflow limit.");st=D.unitName}else Yr(t,{memoryMaxBytes:v,tasksMax:_});let Te=d?$t(t,{create:!0}):
 jt(t,{create:!0,gid:r}),ct=Te.create(o,m,{...d?{application:!0}:{},args:S,command:y,controllerLeaseName:l,cwd:g,env:R,inputBase64:String(
 e.inputBase64||""),inputPresent:e.inputPresent===!0,...C?{releaseEnvironmentFile:C}:{},executionId:o},{privateDirectory:i===
 "detached"}),ur=p.join(ct,"command.json"),lr=p.resolve(h.argv[1]),mr=["--quiet",`--unit=${s}`,"--service-type=exec",`--s\
 lice=${st}`,`--property=Description=Vibe64 ${c} execution`,...It(m,{receiptRoot:ct}).map(D=>`--property=${D}`),`--proper\
 ty=WorkingDirectory=${g}`,"--property=KillMode=control-group","--property=ExitType=cgroup","--property=OOMPolicy=stop","\
 --property=MemoryAccounting=yes","--property=IOAccounting=yes","--property=TasksAccounting=yes",`--property=MemoryMax=${I}`,
-`--property=TasksMax=${v}`,"--property=TimeoutStopSec=10s",...i==="capture"?["--property=LogLevelMax=notice","--wait","-\
+`--property=TasksMax=${b}`,"--property=TimeoutStopSec=10s",...i==="capture"?["--property=LogLevelMax=notice","--wait","-\
 -pipe"]:[],...i==="pty"?["--wait","--pty"]:[],...m.username!==t.username?["/usr/bin/setpriv","--no-new-privs","--"]:[],lr,
 "run-managed",ur],re=P("systemd-run",mr,{stdio:"inherit"});if((i!=="detached"||re.error||re.status!==0)&&Te.remove(o),Te.
-close(),re.error)throw re.error;h.exit(typeof re.status=="number"?re.status:1)}function Fr(e="",t={},{managedRoot:r=ve}={}){
+close(),re.error)throw re.error;h.exit(typeof re.status=="number"?re.status:1)}function Fr(e="",t={},{managedRoot:r=be}={}){
 let n=p.join(r,T(O(t.username))),o=["tmp","managed-execution-payloads"],s=p.basename(String(e));if(e!==p.join(n,...o,s)||
-!br.test(s))throw new Error("Vibe64 exec helper rejected an unsafe managed execution payload path.");let i=ce(n,o);try{if(J(
+!vr.test(s))throw new Error("Vibe64 exec helper rejected an unsafe managed execution payload path.");let i=ae(n,o);try{if(J(
 i).uid!==t.uid)throw new Error("Vibe64 exec helper refused a managed execution payload directory owned by another user.");
 let c=H(i,s,{maxBytes:ht,uid:t.uid});return q(E(i,s)),tr(c)}finally{w(i)}}async function Hr(e=""){let t=p.resolve(String(
 e||"")),r=N(t,"utf8");q(t);let n=JSON.parse(r);if(n?.schema!=="vibe64.managed-execution.command"||n?.schemaVersion!==1)throw new Error(
@@ -213,7 +213,7 @@ LOOP","ENOTDIR","ENXIO","EVIBE64UNSAFEFILE"]);function Pt(e="",{create:t=!1,gid:
 t&&we(e,o);let i;try{i=M(e,B)}catch(c){if(!t&&c?.code==="ENOENT")return on;throw c}try{let c=J(i).uid;if(c!==s&&c!==n)throw new Error(
 "Vibe64 exec helper refused an execution receipt directory owned by another user.");t&&(ne(i,s,r),de(i,o))}catch(c){throw w(
 i),c}return{close:()=>w(i),entries:()=>fe(E(i)),remove:c=>Ve(E(i,z(c)),{force:!0,recursive:!0}),result(c=""){let a=z(c),
-u=-1;try{u=M(E(i,a),B);let l=JSON.parse(H(u,"result.json",{maxBytes:vr,uid:J(u).uid}));return l?.schema==="vibe64.manage\
+u=-1;try{u=M(E(i,a),B);let l=JSON.parse(H(u,"result.json",{maxBytes:br,uid:J(u).uid}));return l?.schema==="vibe64.manage\
 d-execution.result"&&l.schemaVersion===1&&l.executionId===a?l:{}}catch(l){if(l instanceof SyntaxError||sn.has(l?.code))return{};
 throw l}finally{u>=0&&w(u)}},create(c="",a={},u={},{privateDirectory:l=!1}={}){let m=z(c),d=E(i,m);Z(d,{mode:448});let f=M(
 d,B);try{let g={...u.env};if(l){Z(E(f,"private"),{mode:448});let S=M(E(f,"private"),B);try{ne(S,a.uid,a.gid)}finally{w(S)}
@@ -225,10 +225,10 @@ he(n,`${JSON.stringify({...t,schema:"vibe64.managed-execution.result",schemaVers
 `,{flag:"wx",mode:384}),Se(n,r)}function un(){let e=String(N("/proc/self/cgroup","utf8")||"").split(`
 `).find(i=>i.startsWith("0::")),t=String(e||"").slice(3).replace(/^\/+/,""),r=t?p.join("/sys/fs/cgroup",t):"";if(!r||!Y(
 r))return{};let n=mt(p.join(r,"cpu.stat")),o=mt(p.join(r,"memory.events")),s=ln(p.join(r,"io.stat"));return{resourceCounters:Xe(
-r),cpuUsageNSec:String(Number(n.usage_usec||0)*1e3),ioReadBytes:String(s.readBytes),ioWriteBytes:String(s.writeBytes),memoryCurrent:ue(
-p.join(r,"memory.current")),memoryPeak:ue(p.join(r,"memory.peak")),memorySwapCurrent:ue(p.join(r,"memory.swap.current")),
-oomKillCount:String(Number(o.oom_kill||0)),taskLimit:Ct(r),tasksCurrent:ue(p.join(r,"pids.current")),tasksPeak:ue(p.join(
-r,"pids.peak"))}}function ue(e=""){try{let t=String(N(e,"utf8")||"0").trim();return/^[0-9]+$/u.test(t)?t:"0"}catch(t){if(t?.
+r),cpuUsageNSec:String(Number(n.usage_usec||0)*1e3),ioReadBytes:String(s.readBytes),ioWriteBytes:String(s.writeBytes),memoryCurrent:le(
+p.join(r,"memory.current")),memoryPeak:le(p.join(r,"memory.peak")),memorySwapCurrent:le(p.join(r,"memory.swap.current")),
+oomKillCount:String(Number(o.oom_kill||0)),taskLimit:Ct(r),tasksCurrent:le(p.join(r,"pids.current")),tasksPeak:le(p.join(
+r,"pids.peak"))}}function le(e=""){try{let t=String(N(e,"utf8")||"0").trim();return/^[0-9]+$/u.test(t)?t:"0"}catch(t){if(t?.
 code==="ENOENT")return"0";throw t}}function Ct(e,t=N){if(!e)return null;try{let r=c=>{try{return A(/^max\s+(\d+)$/mu.exec(
 t(p.join(e,c),"utf8"))?.[1])}catch{return null}},n=r("pids.events.local"),o=r("pids.events"),s=n>0?n:o;if(!(s>0))return null;
 let i=t("/proc/self/mountinfo","utf8").split(`
@@ -275,19 +275,19 @@ recordedAt:new Date(a).toISOString()}}return null}function dn(e,{unitName:t,work
 "string"||Buffer.byteLength(e)>128*1024)return null;let s=e.trim().split(/\r?\n/u);if(s.length>64)return null;let i=s.flatMap(
 a=>{try{return[JSON.parse(a)]}catch{return[]}}),c=null;for(let a of i){let u=Number(a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
 isFinite(u)||u<n||u>o)continue;let l=a.MESSAGE;if(typeof l=="string"&&l.startsWith("oom-kill:")&&l.endsWith(",task_memcg\
-=")){let b=i.find(_=>/^[a-f0-9]{32}$/u.test(a.__SEQNUM_ID||"")&&_?.__SEQNUM_ID===a.__SEQNUM_ID&&_?._BOOT_ID===a._BOOT_ID&&
+=")){let v=i.find(_=>/^[a-f0-9]{32}$/u.test(a.__SEQNUM_ID||"")&&_?.__SEQNUM_ID===a.__SEQNUM_ID&&_?._BOOT_ID===a._BOOT_ID&&
 /^[a-f0-9]{32}$/u.test(a._BOOT_ID||"")&&Number.isSafeInteger(Number(a.__SEQNUM))&&Number(_.__SEQNUM)===Number(a.__SEQNUM)+
 1&&Number(_._SOURCE_MONOTONIC_TIMESTAMP)>=Number(a._SOURCE_MONOTONIC_TIMESTAMP)&&Number(_._SOURCE_MONOTONIC_TIMESTAMP)-Number(
-a._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(_.MESSAGE||""));b&&(l+=b.MESSAGE)}
+a._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(_.MESSAGE||""));v&&(l+=v.MESSAGE)}
 let m=typeof l=="string"&&l.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
 if(!m)continue;let[,d,f,g,y]=m,S=y.split("/"),R=S.indexOf(`vibe64-${r}-work.slice`),C=S.indexOf(t);if(S[1]!=="vibe64.sli\
-ce"||R<2||C<=R||S.some((b,_)=>_>0&&(b==="."||b===".."||!/^[a-zA-Z0-9_.-]+$/u.test(b))))continue;let I;if(d==="CONSTRAINT\
-_NONE"&&g)I="host";else if(d==="CONSTRAINT_MEMCG"&&f&&(y===f||y.startsWith(`${f}/`))){let b=f.split("/").at(-1),_=S.slice(
-0,C+1).join("/");I=f===_||f.startsWith(`${_}/`)?"execution":b===`vibe64-${r}-work.slice`?"workspace_work":b===`vibe64-${r}\
-.slice`?"workspace":b==="vibe64.slice"?"platform":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}-w[a-f0-9]{32}\.slice$/u.test(b)?"wo\
-rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(b)?"session":/-work-p[a-f0-9]{64}\.slice$/u.test(b)?"project":
-"ancestor"}else return null;let v=f||"";if(c&&c.cgroup!==v)return null;(!c||u>Date.parse(c.recordedAt))&&(c={source:"ker\
-nel-journal",scope:I,cgroup:v,recordedAt:new Date(u).toISOString()})}return c}function fn(e){if(e==null)return Le;if(!Number.
+ce"||R<2||C<=R||S.some((v,_)=>_>0&&(v==="."||v===".."||!/^[a-zA-Z0-9_.-]+$/u.test(v))))continue;let I;if(d==="CONSTRAINT\
+_NONE"&&g)I="host";else if(d==="CONSTRAINT_MEMCG"&&f&&(y===f||y.startsWith(`${f}/`))){let v=f.split("/").at(-1),_=S.slice(
+0,C+1).join("/");I=f===_||f.startsWith(`${_}/`)?"execution":v===`vibe64-${r}-work.slice`?"workspace_work":v===`vibe64-${r}\
+.slice`?"workspace":v==="vibe64.slice"?"platform":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}-w[a-f0-9]{32}\.slice$/u.test(v)?"wo\
+rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(v)?"session":/-work-p[a-f0-9]{64}\.slice$/u.test(v)?"project":
+"ancestor"}else return null;let b=f||"";if(c&&c.cgroup!==b)return null;(!c||u>Date.parse(c.recordedAt))&&(c={source:"ker\
+nel-journal",scope:I,cgroup:b,recordedAt:new Date(u).toISOString()})}return c}function fn(e){if(e==null)return Le;if(!Number.
 isSafeInteger(e)||e<0)throw new Error("Vibe64 exec helper rejected an invalid managed execution stop timeout.");return Math.
 min(e,Le)}function hn(e="",t="",r={},{termTimeoutMs:n=Le,run:o=j,readState:s=()=>Dt(e,t,r),removeRuntime:i=()=>{let u=Ke(
 r);try{u.remove(t)}finally{u.close()}},now:c=Date.now,wait:a=u=>Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,
@@ -303,50 +303,51 @@ split(/\r?\n/u)){let[d="",,f=""]=m.trim().split(/\s+/u);!d||s.has(d)||(f==="fail
 let u=0,l=n();try{for(let m of l.entries()){if(!Nt.test(m)||m!==m.toLowerCase())continue;let d=ye(m,e);s.has(d)||c.has(d)||
 (l.remove(m),u+=1)}}finally{l.close()}for(let m=0;m<a.length;m+=256)o(a.slice(m,m+256));return{ok:!0,released:u,reset:a.
 length}}function wn(e={}){if(e?.schema!==Mr||e?.schemaVersion!==Nr)throw new Error("Vibe64 exec helper rejected a non-no\
-rmalized execution payload.")}function yn(e="",t={},r=""){se(r);let n=Lt(Q());if(Ne(G),e==="create-system-user"){qn(r,String(
+rmalized execution payload.")}function yn(e="",t={},r=""){ce(r);let n=Lt(Q());if(Ne(G),e==="create-system-user"){qn(r,String(
 t.password||"")),Xt(n,r);return}En(n,r)}function En(e="",t="",{addToGroup:r=s=>rr(s,G),resolveUser:n=F,...o}={}){Ft(e,n(
 t),o),r(t)}function Lt(e={}){let t=String(e.username||"");if(!t.startsWith(U))throw new Error("Only a workspace daemon a\
 cts as its people.");return Ae(t.slice(U.length))}function Ae(e=""){if(!/^[a-z][a-z0-9]{0,62}$/u.test(String(e)))throw new Error(
-"Vibe64 exec helper rejected an invalid workspace name.");return e}function ie(e="",t=0){let r=M(e,B);try{let n=J(r);if(!n.
+"Vibe64 exec helper rejected an invalid workspace name.");return e}function se(e="",t=0){let r=M(e,B);try{let n=J(r);if(!n.
 isDirectory()||n.uid!==t||(n.mode&18)!==0)throw new Error("A Vibe64 registry is not a directory only root can change.")}catch(n){
 throw w(r),n}return r}function ee(e="",{create:t=!1,registryRoot:r="",registryUid:n=0}={}){t&&Z(r,{mode:493,recursive:!0});
-let o=ie(r,n);try{let s=te(e);return t&&we(E(o,s),493),ie(E(o,s),n)}finally{w(o)}}function Sn(e="",t="",r={}){let n=r.registryUid??
+let o=se(r,n);try{let s=te(e);return t&&we(E(o,s),493),se(E(o,s),n)}finally{w(o)}}function Sn(e="",t="",r={}){let n=r.registryUid??
 0,o;try{o=ee(e,{registryRoot:Ge,...r})}catch{return null}try{let s=JSON.parse(H(o,`${t}.json`,{maxBytes:xt,othersMayWrite:!1,
-uid:n}));return s?.schema===vt&&s.schemaVersion===1&&s.username===t&&Number.isSafeInteger(s.uid)?{uid:s.uid,username:t}:
+uid:n}));return s?.schema===bt&&s.schemaVersion===1&&s.username===t&&Number.isSafeInteger(s.uid)?{uid:s.uid,username:t}:
 null}catch{return null}finally{w(o)}}function Bt(e,t={}){let r=`${te(t.username)}.json`,n=`.${r}.${h.pid}.tmp`,o=M(E(e,n),
 gt,420);try{de(o,420),he(o,`${JSON.stringify(t)}
-`)}finally{w(o)}Se(E(e,n),E(e,r))}function Vt(e,t={}){Bt(e,{schema:vt,schemaVersion:1,uid:t.uid,username:t.username})}function Ut(e=""){
+`)}finally{w(o)}Se(E(e,n),E(e,r))}function Vt(e,t={}){Bt(e,{schema:bt,schemaVersion:1,uid:t.uid,username:t.username})}function Ut(e=""){
 return Object.assign(new Error(e),{exitCode:Pe})}function Be(e=""){let t=(r,n)=>{let o=new RegExp(`^[\\t ]*${r}[\\t ]+(\\d\
 +)[\\t ]*$`,"mu").exec(String(e));return o?Number(o[1]):n};return{max:t("UID_MAX",6e4),min:t("UID_MIN",1e3)}}function Gt(e={},{
-groups:t=[],loginUids:r=Be(),sudoCommands:n=[],sudoListing:o=""}={}){let{uid:s,username:i}=e;if(!Number.isSafeInteger(s)||
-s<r.min||s>r.max)return`${i} is a system account (uid ${s}), not a person's login.`;let c=t.find(a=>$r.has(a));return c?
-`${i} is in the administrators' group ${c}.`:bn(i,o,n)}function bn(e="",t="",r=[]){if(t.includes(`User ${e} is not allow\
-ed to run sudo on `))return"";let n=t.split(`
-`),o=n.findIndex(a=>a.startsWith(`User ${e} may run the following commands on `)),s=o<0?[]:n.slice(o+1).filter(a=>a.trim()),
-i=new Set(r);return s.length>0&&s.every(a=>{let u=/^ {4}\(root\) NOPASSWD: (.+)$/u.exec(a);return!!u&&u[1].split(", ").every(
-l=>i.has(l))})?"":`${e} has sudo rules.`}function vn(e=Ir,t=0){let r;try{r=M(p.dirname(e),B)}catch(n){if(n.code==="ENOEN\
-T")return[];throw n}try{let n=J(r);if(n.uid!==t||(n.mode&18)!==0)throw new Error("The Vibe64 person sudo commands are no\
-t in a directory only root can change.");return H(r,p.basename(e),{maxBytes:4096,othersMayWrite:!1,uid:t}).split(`
+groups:t=[],loginUids:r=Be(),resolveProgram:n=i=>i,sudoCommands:o=[],sudoListing:s=""}={}){let{uid:i,username:c}=e;if(!Number.
+isSafeInteger(i)||i<r.min||i>r.max)return`${c} is a system account (uid ${i}), not a person's login.`;let a=t.find(u=>$r.
+has(u));return a?`${c} is in the administrators' group ${a}.`:vn(c,s,o,n)}function vn(e="",t="",r=[],n=o=>o){if(t.includes(
+`User ${e} is not allowed to run sudo on `))return"";let o=t.split(`
+`),s=o.findIndex(l=>l.startsWith(`User ${e} may run the following commands on `)),i=s<0?[]:o.slice(s+1).filter(l=>l.trim()),
+c=l=>{let[m,...d]=l.split(" ");try{return[n(m),...d].join(" ")}catch{return l}},a=new Set(r.map(c));return i.length>0&&i.
+every(l=>{let m=/^ {4}\(root\) NOPASSWD: (.+)$/u.exec(l);return!!m&&m[1].split(", ").every(d=>a.has(c(d)))})?"":`${e} ha\
+s sudo rules.`}function bn(e=Ir,t=0){let r;try{r=M(p.dirname(e),B)}catch(n){if(n.code==="ENOENT")return[];throw n}try{let n=J(
+r);if(n.uid!==t||(n.mode&18)!==0)throw new Error("The Vibe64 person sudo commands are not in a directory only root can c\
+hange.");return H(r,p.basename(e),{maxBytes:4096,othersMayWrite:!1,uid:t}).split(`
 `).map(o=>o.trim()).filter(Boolean)}catch(n){if(n.code==="ENOENT")return[];throw n}finally{w(r)}}function Wt(){try{return Be(
 N("/etc/login.defs","utf8"))}catch{return Be()}}function Me(e=""){let t=Wt(),r=P("/usr/bin/sudo",["-n","-l","-U",e],{encoding:"\
 utf8",env:{COLUMNS:"100000",LANG:"C",LC_ALL:"C",PATH:"/usr/sbin:/usr/bin:/sbin:/bin"}});return{groups:tt(e),loginUids:t,
-sudoCommands:vn(),sudoListing:r.error?"":String(r.stdout||"")}}function ze(e={},t={}){let r=Gt(e,t);if(r)throw Ut(`Vibe6\
-4 never runs commands as an administrator or system account: ${r}`)}function Ft(e="",t={},{facts:r=Me,...n}={}){if(se(t.
-username),Sn(e,t.username,n)?.uid!==t.uid)throw Ut(`OS user ${t.username} is not registered as a Vibe64 person of worksp\
-ace ${e}. A server administrator registers an existing account with: sudo ${p.resolve(h.argv[1])} register-person ${e} ${t.
-username}`);let s=r(t.username);return ze(t,s),s}function Ht(e={},t={},r={}){if(!Ft(Lt(e),t,r).groups.includes(G))throw new Error(
-`OS user is not enabled for the shared Vibe64 group: ${t.username}`);ro(e,t.username)}function Xt(e="",t="",{addToGroup:r=i=>rr(
-i,G),facts:n=Me,resolveUser:o=F,...s}={}){Ae(e),se(t),o(`${U}${e}`);let i=o(t);ze(i,n(t));let c=ee(e,{registryRoot:Ge,...s,
-create:!0});try{Vt(c,i)}finally{w(c)}return r(t),i}function xn(e="",{facts:t=Me,registryRoot:r=Ge,registryUid:n=0,report:o=i=>h.
-stdout.write(`${i}
-`),resolveUser:s=F}={}){Ae(e);let i=s(`${U}${e}`);Z(r,{mode:493,recursive:!0});let c=ie(r,n);try{try{return w(ee(e,{registryRoot:r,
+resolveProgram:ie,sudoCommands:bn(),sudoListing:r.error?"":String(r.stdout||"")}}function ze(e={},t={}){let r=Gt(e,t);if(r)
+throw Ut(`Vibe64 never runs commands as an administrator or system account: ${r}`)}function Ft(e="",t={},{facts:r=Me,...n}={}){
+if(ce(t.username),Sn(e,t.username,n)?.uid!==t.uid)throw Ut(`OS user ${t.username} is not registered as a Vibe64 person o\
+f workspace ${e}. A server administrator registers an existing account with: sudo ${p.resolve(h.argv[1])} register-perso\
+n ${e} ${t.username}`);let s=r(t.username);return ze(t,s),s}function Ht(e={},t={},r={}){if(!Ft(Lt(e),t,r).groups.includes(
+G))throw new Error(`OS user is not enabled for the shared Vibe64 group: ${t.username}`);ro(e,t.username)}function Xt(e="",t="",{
+addToGroup:r=i=>rr(i,G),facts:n=Me,resolveUser:o=F,...s}={}){Ae(e),ce(t),o(`${U}${e}`);let i=o(t);ze(i,n(t));let c=ee(e,
+{registryRoot:Ge,...s,create:!0});try{Vt(c,i)}finally{w(c)}return r(t),i}function xn(e="",{facts:t=Me,registryRoot:r=Ge,
+registryUid:n=0,report:o=i=>h.stdout.write(`${i}
+`),resolveUser:s=F}={}){Ae(e);let i=s(`${U}${e}`);Z(r,{mode:493,recursive:!0});let c=se(r,n);try{try{return w(ee(e,{registryRoot:r,
 registryUid:n})),{imported:[],refused:[]}}catch(d){if(d.code!=="ENOENT")throw d}let a=`.${e}.upgrading`;Ve(E(c,a),{force:!0,
-recursive:!0}),Z(E(c,a),{mode:493});let u=ie(E(c,a),n),l=[],m=[];try{for(let d of kn(i)){let f;try{se(d),f=s(d)}catch{continue}
+recursive:!0}),Z(E(c,a),{mode:493});let u=se(E(c,a),n),l=[],m=[];try{for(let d of kn(i)){let f;try{ce(d),f=s(d)}catch{continue}
 let g=t(d);if(!g.groups.includes(G))continue;let y=Gt(f,g);if(y){m.push(d),o(`[vibe64-exec-helper] Not registering ${d} \
 as a Vibe64 person of ${e}: ${y}`);continue}Vt(u,f),l.push(d),o(`[vibe64-exec-helper] Registered ${d} as a Vibe64 person\
- of ${e}.`)}}finally{w(u)}return Se(E(c,a),E(c,e)),{imported:l,refused:m}}finally{w(c)}}function kn(e={}){let t;try{t=ce(
+ of ${e}.`)}}finally{w(u)}return Se(E(c,a),E(c,e)),{imported:l,refused:m}}finally{w(c)}}function kn(e={}){let t;try{t=ae(
 e.home,wt)}catch(r){if(r.code==="ENOENT")return[];throw r}try{let r=[];for(let n of fe(E(t)).sort()){let o=n.endsWith(".\
-json")?n.slice(0,-5):"";if(bt.test(o))try{JSON.parse(H(t,n,{maxBytes:yt,uid:e.uid}))?.username===o&&r.push(o)}catch{}}return r}finally{
+json")?n.slice(0,-5):"";if(vt.test(o))try{JSON.parse(H(t,n,{maxBytes:yt,uid:e.uid}))?.username===o&&r.push(o)}catch{}}return r}finally{
 w(t)}}function On(e={}){let t=Q(),r=String(e.action||"").trim();if(r!=="ensure"&&r!=="retire")throw new Error("Vibe64 ex\
 ec helper rejected an unknown application account action.");let n=r==="ensure"?{account:Nn(t,e.project)}:Tn(t,e.project);
 h.stdout.write(`${JSON.stringify({ok:!0,...n})}
@@ -366,23 +367,23 @@ return null}try{let s=JSON.parse(H(o,`${te(t)}.json`,{maxBytes:xt,othersMayWrite
 1&&s.username===t&&Number.isSafeInteger(s.uid)&&Number.isSafeInteger(s.gid)&&Mt.test(String(s.project))?{gid:s.gid,project:s.
 project,uid:s.uid,username:t}:null}catch{return null}finally{w(o)}}function Kt(e={},t={},{registryRoot:r=xe,registryUid:n=0}={}){
 let o=ee(e.workspace,{create:!0,registryRoot:r,registryUid:n});try{Bt(o,{gid:t.gid,project:e.project,schema:Ot,schemaVersion:1,
-uid:t.uid,username:e.username})}finally{w(o)}}function le(e,t="",{gid:r,mode:n,uid:o},{verify:s=!0}={}){let i=E(e,te(t)),
+uid:t.uid,username:e.username})}finally{w(o)}}function me(e,t="",{gid:r,mode:n,uid:o},{verify:s=!0}={}){let i=E(e,te(t)),
 c=we(i,448);if(!c&&!s)return{created:c,descriptor:-1};let a=M(i,B);try{if(c)ne(a,o,r),de(a,n);else if(s){let u=J(a);if(u.
 uid!==o||u.gid!==r||n===457&&(u.mode&18)!==0)throw new Error(`The application area's ${t} directory is not the one the h\
 elper made.`)}return{created:c,descriptor:a}}catch(u){throw w(a),u}}function et(e={},{areaGid:t=0,areaUid:r=0,create:n=!0}={}){
 let o=M(p.dirname(e.areaRoot),$.O_RDONLY|$.O_DIRECTORY);try{for(let s of[p.basename(e.areaRoot),e.workspace,e.project]){
-let i;n?i=le(o,s,{gid:t,mode:457,uid:r}).descriptor:i=ie(E(o,te(s)),r),w(o),o=i}return o}catch(s){throw w(o),s}}function An(e={},t={},r={},{
+let i;n?i=me(o,s,{gid:t,mode:457,uid:r}).descriptor:i=se(E(o,te(s)),r),w(o),o=i}return o}catch(s){throw w(o),s}}function An(e={},t={},r={},{
 areaGid:n=0,areaUid:o=0,grantDaemonSearch:s=i=>k("setfacl",["-m",`u:${O(t.username)}:x`,`/proc/${h.pid}/fd/${i}`])}={}){
-let i=et(e,{areaGid:n,areaUid:o}),c=[i];try{let a={gid:r.gid,mode:448,uid:r.uid};c.push(le(i,"handover",{gid:r.gid,mode:1512,
-uid:t.uid}).descriptor);let u=le(i,"app",a).descriptor;c.push(u),c.push(le(u,"home",a,{verify:!1}).descriptor);let l=le(
+let i=et(e,{areaGid:n,areaUid:o}),c=[i];try{let a={gid:r.gid,mode:448,uid:r.uid};c.push(me(i,"handover",{gid:r.gid,mode:1512,
+uid:t.uid}).descriptor);let u=me(i,"app",a).descriptor;c.push(u),c.push(me(u,"home",a,{verify:!1}).descriptor);let l=me(
 i,"database",a);c.push(l.descriptor),l.created&&s(l.descriptor)}finally{for(let a of c)a>=0&&w(a)}}function Mn(e={},{applicationLimit:t,
-managedRoot:r,registryRoot:n,registryUid:o}){try{w(ce(p.join(r,e.workspace),["projects",...e.folder]))}catch(i){throw["E\
+managedRoot:r,registryRoot:n,registryUid:o}){try{w(ae(p.join(r,e.workspace),["projects",...e.folder]))}catch(i){throw["E\
 LOOP","ENOENT","ENOTDIR"].includes(i.code)?new Error(`Vibe64 exec helper refused an application account: ${e.workspace} \
 has no project ${e.folder.join("/")}.`):i}let s=0;try{let i=ee(e.workspace,{registryRoot:n,registryUid:o});try{s=fe(E(i)).
 filter(c=>c.endsWith(".json")&&kt.test(c.slice(0,-5))).length}finally{w(i)}}catch(i){if(i.code!=="ENOENT")throw i}if(s>=
 t)throw new Error(`Vibe64 exec helper refused an application account: ${e.workspace} already has ${t}, its limit. Retire\
  unused ones first.`)}function Nn(e={},t="",{applicationLimit:r=Cr,areaRoot:n=ke,createUser:o=m=>k("useradd",["--system",
-"--user-group","--no-create-home","--home-dir",m.home,"--shell",At,m.username]),facts:s=qe,managedRoot:i=ve,registryRoot:c=xe,
+"--user-group","--no-create-home","--home-dir",m.home,"--shell",At,m.username]),facts:s=qe,managedRoot:i=be,registryRoot:c=xe,
 registryUid:a=0,resolveUser:u=rt,...l}={}){let m=Je(e,t,{areaRoot:n}),d={registryRoot:c,registryUid:a},f=Qe(m.workspace,
 m.username,d),g=u(m.username);if(f){if(!g||g.uid!==f.uid||g.gid!==f.gid||f.project!==m.project)throw new Error(`The regi\
 stered application account ${m.username} is not the account on this host.`)}else Mn(m,{applicationLimit:r,managedRoot:i,
@@ -393,16 +394,16 @@ et(e,{areaUid:t,create:!1})}catch(n){if(n.code==="ENOENT")return[];throw n}try{l
 if(o.code==="ENOENT")return[];throw o}try{return fe(E(n)).sort()}finally{w(n)}}finally{w(r)}}function Tn(e={},t="",{areaRoot:r=ke,
 areaUid:n=0,deleteUser:o=d=>k("userdel",[d]),facts:s=qe,registryRoot:i=xe,registryUid:c=0,resolveUser:a=rt,running:u=d=>P(
 "pgrep",["-U",String(d)]).status!==1,unitRoot:l=ge,unitUid:m=0}={}){let d=Je(e,t,{areaRoot:r}),f={registryRoot:i,registryUid:c},
-g=Qe(d.workspace,d.username,f),y=a(d.username);if(y){let v=g&&g.uid!==y.uid?"it is not the registered account.":Ze(y,d,s(
-d.username));if(v)throw new Error(`Vibe64 exec helper refused to retire application account ${d.username}: ${v}`);let b=qt(
-{unitRoot:l,unitUid:m,workspace:d.workspace}).find(({lines:_})=>_.includes(`User=${d.username}`));if(b)throw new Error(`\
-The application's release service ${b.name} is still installed. Remove it before retiring the application.`)}let S=_n(d,
+g=Qe(d.workspace,d.username,f),y=a(d.username);if(y){let b=g&&g.uid!==y.uid?"it is not the registered account.":Ze(y,d,s(
+d.username));if(b)throw new Error(`Vibe64 exec helper refused to retire application account ${d.username}: ${b}`);let v=qt(
+{unitRoot:l,unitUid:m,workspace:d.workspace}).find(({lines:_})=>_.includes(`User=${d.username}`));if(v)throw new Error(`\
+The application's release service ${v.name} is still installed. Remove it before retiring the application.`)}let S=_n(d,
 {areaUid:n});if(S.length>0)throw new Error(`The application's database directory still holds ${S.slice(0,5).join(", ")}${S.
 length>5?` and ${S.length-5} more`:""}. Give its production database back to the editor before retiring the application.`);
-let R=()=>{let v=ee(d.workspace,f);try{q(E(v,`${d.username}.json`))}finally{w(v)}},C=!!(g&&y);if(C&&R(),y&&u(y.uid))throw C&&
+let R=()=>{let b=ee(d.workspace,f);try{q(E(b,`${d.username}.json`))}finally{w(b)}},C=!!(g&&y);if(C&&R(),y&&u(y.uid))throw C&&
 Kt(d,y,f),new Error("The application still runs. Stop its release service before retiring it.");let I=-1;try{I=et(d,{areaUid:n,
-create:!1})}catch(v){if(v.code!=="ENOENT")throw v}if(I>=0){w(I);let v=ie(p.join(r,d.workspace),n);try{Ve(E(v,d.project),
-{force:!0,recursive:!0})}finally{w(v)}}return g&&!C&&R(),y&&o(d.username),{retired:!!(y||g||I>=0)}}function zt(e={},t="",{
+create:!1})}catch(b){if(b.code!=="ENOENT")throw b}if(I>=0){w(I);let b=se(p.join(r,d.workspace),n);try{Ve(E(b,d.project),
+{force:!0,recursive:!0})}finally{w(b)}}return g&&!C&&R(),y&&o(d.username),{retired:!!(y||g||I>=0)}}function zt(e={},t="",{
 areaRoot:r=ke,facts:n=qe,resolveUser:o=F,...s}={}){let i=O(t),c=Qe(Yt(e),i,s);if(!c)throw new Error(`${i} is not an appl\
 ication account of this workspace.`);let a=Je(e,c.project,{areaRoot:r}),u=o(i),l=a.username!==i||c.uid!==u.uid||c.gid!==
 u.gid?"it is not the registered account.":Ze(u,a,n(i));if(l)throw new Error(`Vibe64 exec helper refused application acco\
@@ -415,7 +416,7 @@ m||V(m,r).length>0))throw new Error("Release environment must belong to the appl
 daemonUid:r=-1,gid:n=-1}={}){let o=String(e.workingDirectory||""),s=Jt(e.environmentFile,t,{cwd:o,daemonUid:r,gid:n}),i=p.
 basename(p.dirname(s)),c=p.join(t.appRoot,"releases",i,"workspace"),a=V(c,o),u=String(e.startScript||""),l=Ee(u);if(p.resolve(
 o)!==o||o!==c&&a.length===0||u!==p.join(p.dirname(s),"start.sh")||!l.isFile()||l.uid!==r||l.gid!==n||(l.mode&18)!==0||(l.
-mode&8)===0)throw new Error("A release service must run its own release's workspace and start script.");try{w(ce(t.appRoot,
+mode&8)===0)throw new Error("A release service must run its own release's workspace and start script.");try{w(ae(t.appRoot,
 ["releases",i,"workspace",...a]))}catch(m){throw new Error(`A release service's working directory must be a real folder \
 of its release's workspace: ${m.code||m.message}`)}return{environmentFile:s,startScript:u,workingDirectory:o}}function qt({
 unitRoot:e=ge,unitUid:t=0,workspace:r=""}={}){let n=`vibe64-release-${r}-`,o=M(e,B);try{let s=[];for(let i of fe(E(o)))if(!(!i.
@@ -456,7 +457,7 @@ property=RequiredBy","--value"]).stdout||"").split(/\s+/u).filter(Boolean).filte
 requiredBy:o,state:"required"};let s=!n(r(e));return s&&pt(t,["stop",e]),String(t("systemctl",["is-enabled",e]).stdout||
 "").trim()==="enabled"&&pt(t,["disable",e]),{ok:!0,requiredBy:[],state:s?"stopped":"inactive"}}function pt(e,t=[]){let r=e(
 "systemctl",t);if(r.status!==0)throw new Error(String(r.stderr||r.stdout||`systemctl ${t[0]} failed.`).trim())}function Bn({
-owner:e={},pidFile:t="",unitName:r="",workspaceRoot:n=p.join(ve,T(O(e.username)))}={}){let o=t?Un(t,e,n):null;if(o)try{Vn(
+owner:e={},pidFile:t="",unitName:r="",workspaceRoot:n=p.join(be,T(O(e.username)))}={}){let o=t?Un(t,e,n):null;if(o)try{Vn(
 o,e,r)}finally{o.close()}}function Vn(e,t={},r=""){let n=e.read();if(n===null)return;if(!/^[1-9][0-9]*$/u.test(n))throw new Error(
 "Vibe64 managed service PID file is invalid.");let o=Number(n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64\
  managed service PID is invalid.");if(!je(o)){e.remove(n);return}let s=Gn(o);if(s===null){e.remove(n);return}if(s!==t.uid)
@@ -464,7 +465,7 @@ throw new Error("Vibe64 managed service PID belongs to another OS user.");if(Wn(
 if(a?.code==="ESRCH"){e.remove(n);return}throw a}let i=Date.now()+3e4,c=new Int32Array(new SharedArrayBuffer(4));for(;je(
 o)&&Date.now()<i;)Atomics.wait(c,0,0,100);if(je(o))throw new Error("Vibe64 managed service process did not stop cleanly \
 during ownership transfer.");e.remove(n)}function Un(e="",t={},r=""){let n=V(x(r),p.dirname(e));if(n.length===0)throw new Error(
-"Vibe64 exec helper rejected a managed service PID file outside its workspace.");let o;try{o=ce(r,n)}catch(c){if(c?.code===
+"Vibe64 exec helper rejected a managed service PID file outside its workspace.");let o;try{o=ae(r,n)}catch(c){if(c?.code===
 "ENOENT")return null;throw c}let s=p.basename(e),i=()=>{try{return H(o,s,{maxBytes:xr,uid:t.uid}).trim()}catch(c){if(c?.
 code==="ENOENT")return null;throw c}};return{close:()=>w(o),read:i,remove(c=""){i()===c&&q(E(o,s))}}}function je(e=0){try{
 return h.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}function Gn(e=0){let t="";try{t=N(`/proc/${e}/stat\
@@ -493,7 +494,7 @@ t}function Yn(){return tr(Kn())}function tr(e=""){let t;try{t=JSON.parse(e)}catc
 yload is not valid JSON.")}if(!t||typeof t!="object"||Array.isArray(t))throw new Error("Vibe64 exec helper payload must \
 be a JSON object.");return t}function E(e,t=""){return p.join(`/proc/self/fd/${e}`,t)}function we(e="",t=511){try{return Z(
 e,{mode:t}),!0}catch(r){if(r?.code!=="EEXIST")throw r;return!1}}function te(e=""){let t=String(e);if(!t||t==="."||t===".\
-."||/[/\0]/u.test(t))throw new Error("Vibe64 exec helper rejected an unsafe file name.");return t}function ce(e="",t=[]){
+."||/[/\0]/u.test(t))throw new Error("Vibe64 exec helper rejected an unsafe file name.");return t}function ae(e="",t=[]){
 let r=M(e,$.O_RDONLY|$.O_DIRECTORY);try{for(let n of t){let o=M(E(r,te(n)),B);w(r),r=o}}catch(n){throw w(r),n}return r}function H(e,t="",{
 maxBytes:r=0,othersMayWrite:n=!0,uid:o=-1}={}){let s=M(E(e,te(t)),Sr);try{let i=J(s);if(!i.isFile()||i.uid!==o||!n&&(i.mode&
 18)!==0)throw Object.assign(new Error("Vibe64 exec helper refused a file that is not its owner's regular file."),{code:"\
@@ -505,8 +506,8 @@ c helper payload is too large.");e.push(Buffer.from(t.subarray(0,s)))}catch(s){i
 "EAGAIN"||s?.code==="EWOULDBLOCK")&&Date.now()<n){Atomics.wait(r,0,0,Or);continue}throw s?.code==="EAGAIN"||s?.code==="E\
 WOULDBLOCK"?new Error("Vibe64 exec helper timed out waiting for its payload."):s}return Buffer.concat(e,o).toString("utf\
 8")}function O(e=""){let t=String(e||"").trim();if(!t||/[/:\\\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejecte\
-d an unsafe username.");return t}function zn(e=""){if(!bt.test(e))throw new Error("Vibe64 exec helper rejected an unsupp\
-orted username.")}function se(e=""){if(zn(e),e.startsWith(U))throw new Error("Vibe64 daemon Unix accounts cannot be mana\
+d an unsafe username.");return t}function zn(e=""){if(!vt.test(e))throw new Error("Vibe64 exec helper rejected an unsupp\
+orted username.")}function ce(e=""){if(zn(e),e.startsWith(U))throw new Error("Vibe64 daemon Unix accounts cannot be mana\
 ged as app users.");if(e.startsWith(We))throw new Error("Vibe64 application accounts are never people.");if(Rr.has(e))throw new Error(
 "Privileged Unix accounts cannot be managed as Vibe64 app users.")}function F(e=""){let t=P("getent",["passwd",e],{encoding:"\
 utf8"});if(t.status!==0)throw new Error(`OS user was not found: ${e}`);let n=String(t.stdout||"").split(/\r?\n/u)[0].split(
@@ -532,7 +533,7 @@ if(V(x(nr(t)),n).length>0)return n;throw new Error("Vibe64 exec helper rejected
 pace service root.")}function V(e="",t=""){let r=String(e||"").trim(),n=String(t||"").trim();if(!r||!n)return[];let o=p.
 relative(p.resolve(r),p.resolve(n));return!o||o===".."||o.startsWith(`..${p.sep}`)||p.isAbsolute(o)?[]:o.split(p.sep).filter(
 Boolean)}function x(e,{allowMissingLeaf:t=!1}={}){let r=p.resolve(e);if(t)try{Ee(r)}catch(n){if(n.code!=="ENOENT")throw n;
-return p.join(me(p.dirname(r)),p.basename(r))}return me(r)}function _e(e="",t={}){let r=String(e||"").trim(),n=T(O(t.username));
+return p.join(ie(p.dirname(r)),p.basename(r))}return ie(r)}function _e(e="",t={}){let r=String(e||"").trim(),n=T(O(t.username));
 if(!t.username?.startsWith(U)||!r.startsWith(`vibe64-release-${n}-`)||!r.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.test(
 r)||r.includes("/")||r.includes(".."))throw new Error("Vibe64 exec helper rejected an unsafe deployment service unit nam\
 e.");return r}function nt(e="",t={}){let r=String(e||"").trim(),n=p.basename(p.dirname(nr(t)));if(!r.startsWith(`vibe64-\
@@ -547,18 +548,18 @@ startScript:s="",unitName:i="",user:c={},workingDirectory:a=""}={}){let u=Array.
 tion=Vibe64 release service ${i}`,`After=${["network-online.target",...u].join(" ")}`,"Wants=network-online.target",...u.
 length>0?[`Requires=${u.join(" ")}`]:[],"StartLimitIntervalSec=60","StartLimitBurst=5","","[Service]","Type=simple",...It(
 c),...cr(n),`SocketBindAllow=tcp:${Zt(r)}`,"SocketBindAllow=udp","SocketBindDeny=any",`WorkingDirectory=${L(a)}`,`Enviro\
-nment=PATH=${L(be)}`,"Environment=TMPDIR=/tmp",`ExecStart=/usr/bin/setpriv --no-new-privs -- ${L(t)} run-release-service\
+nment=PATH=${L(ve)}`,"Environment=TMPDIR=/tmp",`ExecStart=/usr/bin/setpriv --no-new-privs -- ${L(t)} run-release-service\
  "${L(e)}" "${L(s)}"`,"Restart=always","RestartSec=3","KillSignal=SIGTERM","TimeoutStopSec=30","","[Install]","WantedBy=\
 multi-user.target",""].join(`
 `)}function to({owner:e={},pidFile:t="",processModel:r="simple",startScript:n="",unitName:o="",workingDirectory:s=""}={}){
 let i=ir(r);return["[Unit]",`Description=Vibe64 managed service ${o}`,"After=network-online.target","Wants=network-onlin\
-e.target","","[Service]",`Type=${i}`,...Qn(e),...cr(e),`WorkingDirectory=${L(s)}`,`Environment=PATH=${L(be)}`,`Environme\
+e.target","","[Service]",`Type=${i}`,...Qn(e),...cr(e),`WorkingDirectory=${L(s)}`,`Environment=PATH=${L(ve)}`,`Environme\
 nt=TMPDIR=${L(ot(e.username))}`,`ExecStart=${L(n)}`,...i==="forking"?[`PIDFile=${L(t)}`]:[],"Restart=on-failure","Restar\
 tSec=3","TimeoutStartSec=90","TimeoutStopSec=30",""].join(`
 `)}function L(e=""){let t=String(e||"").trim();if(!t||/[\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an \
 unsafe systemd value.");return t.replaceAll("\\","\\\\").replaceAll('"','\\"')}function oe(e="uid",t=null,r=null){if(!Number.
 isSafeInteger(t)||t<0||t!==r)throw new Error(`Vibe64 exec helper ${e} mismatch.`)}function ro(e={},t=""){let r=null;try{
-let n=ce(e.home,wt);try{r=JSON.parse(H(n,`${t}.json`,{maxBytes:yt,uid:e.uid}))}finally{w(n)}}catch{r=null}if(r?.username!==
+let n=ae(e.home,wt);try{r=JSON.parse(H(n,`${t}.json`,{maxBytes:yt,uid:e.uid}))}finally{w(n)}}catch{r=null}if(r?.username!==
 t||r?.status!=="active")throw new Error("OS user is not enabled for Vibe64.")}function ar(e="",t="",{operation:r="",targetUser:n={}}={}){
 if(r==="health-status")return ot(t);if(r==="workspace-cache-command"){let s=p.join(n.home,".local/state/vibe64/cache-mai\
 ntenance"),i=x(e),c=V(s,i);if(n.username!==t||x(s)!==s||i!==e||c.length!==1||!/^[a-z][a-z0-9-]*-[A-Za-z0-9]{6}$/u.test(c[0]))
@@ -579,12 +580,12 @@ per rejected an empty managed project path.");let n=x(r),o=x(p.join("/var/lib/vi
 let r=String(e||"").trim(),n=String(t.home||"").trim();if(!r||!n)throw new Error("Vibe64 exec helper rejected an empty u\
 ser command path.");let o=x(r),s=x(n);if(o===s||o.startsWith(`${s}${p.sep}`))return o;throw new Error("Vibe64 exec helpe\
 r rejected a command path outside the target user home.")}function T(e=""){return e.startsWith(U)?e.slice(U.length):e}function ot(e=""){
-return p.join(ve,T(O(e)),"tmp")}function io(e="",t=h.argv[1]){let r=String(e);try{let n=me(t),o=[p.resolve(p.dirname(n),
+return p.join(be,T(O(e)),"tmp")}function io(e="",t=h.argv[1]){let r=String(e);try{let n=ie(t),o=[p.resolve(p.dirname(n),
 "../../../vibe64-usage-recording/runtime/node")];for(let i=p.dirname(n);o.push(p.join(i,"node_modules/@local/vibe64-usag\
-e-recording/runtime/node")),p.dirname(i)!==i;i=p.dirname(i));let s=o.filter(i=>Y(i)).map(i=>me(i));if(p.isAbsolute(r)&&!/[\s"'\\]/u.
-test(r)&&p.resolve(r)===r&&me(r)===r&&hr(r).isFile()&&s.some(i=>r.startsWith(`${i}${p.sep}`)))return`--import=${r}`}catch{}
+e-recording/runtime/node")),p.dirname(i)!==i;i=p.dirname(i));let s=o.filter(i=>Y(i)).map(i=>ie(i));if(p.isAbsolute(r)&&!/[\s"'\\]/u.
+test(r)&&p.resolve(r)===r&&ie(r)===r&&hr(r).isFile()&&s.some(i=>r.startsWith(`${i}${p.sep}`)))return`--import=${r}`}catch{}
 throw new Error("Vibe64 exec helper rejected a usage recording preload outside its runtime.")}function it(e={},t={},r="",n=""){
-let o={PATH:be,TERM:h.env.TERM||"xterm-256color"};for(let[s,i]of Object.entries(e))!St.test(s)||Tr.has(s)||s.startsWith(
+let o={PATH:ve,TERM:h.env.TERM||"xterm-256color"};for(let[s,i]of Object.entries(e))!St.test(s)||Tr.has(s)||s.startsWith(
 "LD_")||s.startsWith("DYLD_")||(o[s]=String(i));if(n==="opencode-app-server"){let s=p.join(Oe({username:r}),"vibe64","ag\
 ent-providers","opencode");for(let i of["HOME","XDG_CACHE_HOME","XDG_CONFIG_HOME","XDG_DATA_HOME","XDG_STATE_HOME"]){let c=String(
 e[i]||"").trim();if(!p.isAbsolute(c)||V(s,c).length===0)throw new Error(`Vibe64 exec helper rejected OpenCode ${i} outsi\
@@ -599,7 +600,7 @@ eo as deploymentServiceUnit,En as enablePerson,Nn as ensureApplicationAccount,Bn
 nn as ensureWorkspaceRuntimeBase,it as helperChildEnv,Be as loginUidRange,Tt as managedExecutionControllerLeaseName,dn as managedExecutionOomBoundary,
 Oe as managedExecutionRuntimeBase,Kr as managedExecutionSliceCgroup,Dt as managedExecutionState,fn as managedExecutionStopTimeoutMs,
 en as managedExecutionTargetUser,Ct as managedExecutionTaskLimitCounters,pn as managedExecutionTaskLimitJournal,Xe as managedWorkflowCounters,
-Rt as managedWorkflowIdentity,Pt as openManagedExecutionReceipts,Xn as parseEnvironmentFile,Gt as personAccountProblem,vn as personSudoCommands,
+Rt as managedWorkflowIdentity,Pt as openManagedExecutionReceipts,Xn as parseEnvironmentFile,Gt as personAccountProblem,bn as personSudoCommands,
 Qe as readApplicationRegistration,Sn as readPersonRegistration,Xt as registerPerson,zt as registeredApplicationUser,gn as releaseEndedManagedExecutions,
 ar as resolveAllowedCwd,oo as resolveAllowedUserHomePath,Rn as resolveApplicationCwd,Tn as retireApplicationAccount,Gr as runUserCommand,
 hn as stopManagedExecution,Ln as stopManagedServiceUnit,xn as upgradePersonRegistry,io as usageRecordingNodeOptions};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe64",
-  "version": "0.1.50",
+  "version": "0.1.51",
   "private": false,
   "description": "Run Vibe64 against the current project.",
   "type": "module",