safekeep 0.2.0__tar.gz → 0.3.1__tar.gz

{safekeep-0.2.0 → safekeep-0.3.1}/PKG-INFO

@@ -1,16 +1,22 @@
 Metadata-Version: 2.4
 Name: safekeep
-Version: 0.2.0
-Summary: Selective always-on backups for macOS: fswatch-driven copy of allow-listed files, never deletes
+Version: 0.3.1
+Summary: Selective always-on backups for macOS and Linux: fswatch-driven copy of allow-listed files, never deletes
 License-Expression: MIT
-Project-URL: Homepage, https://gitlab.com/foxhound87/safekeep
-Project-URL: Repository, https://gitlab.com/foxhound87/safekeep
-Keywords: backup,macos,fswatch,sync,allow-list,launchd
+Project-URL: Repository, https://github.com/foxhound87/safekeep
+Project-URL: Homepage, https://foxhound87.github.io/safekeep/
+Project-URL: Documentation, https://foxhound87.github.io/safekeep/
+Keywords: backup,macos,linux,fswatch,sync,allow-list,launchd,systemd
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: System Administrators
 Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX
+Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: System :: Archiving :: Backup
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
@@ -19,12 +25,17 @@ Dynamic: license-file
 
 # safekeep
 
-**Selective always-on backups for macOS**: watches source folders with
+[![PyPI](https://img.shields.io/pypi/v/safekeep)](https://pypi.org/project/safekeep/)
+[![Python](https://img.shields.io/pypi/pyversions/safekeep)](https://pypi.org/project/safekeep/)
+
+**Selective always-on backups for macOS and Linux**: watches source folders with
 [fswatch](https://github.com/emcrisostomo/fswatch) and copies only the files you
 chose to their destinations — an **allow-list** model that **never deletes**
 anything in the backup (a file removed or renamed at the source stays in the
 backup).
 
+Documentation: https://foxhound87.github.io/safekeep/
+
 ## Features
 
 - **Allow-list**: a file is copied only if it matches at least one `include:`;
@@ -38,7 +49,8 @@ backup).
   don't matter, the next reconcile brings everything back in sync.
 - **Unmounted volumes**: missing destination → `pending` state with exponential
   backoff (1s → 60s cap), then a reconcile once the mount is back.
-- **launchd at boot**: an agent with `RunAtLoad` + `KeepAlive` keeps the process
+- **launchd (macOS) or systemd (Linux) at boot**: an agent with `RunAtLoad` +
+  `KeepAlive` (or `WantedBy=default.target` + `Restart=always`) keeps the process
   alive and restarts it if it dies.
 - **`.sync` carries rules only, destinations live only in `~/.safekeep`**: a
   `.sync` file can neither add nor remove destinations (a `dest:` line is an
@@ -53,27 +65,31 @@ pipx install safekeep     # recommended for a CLI
 pip install safekeep
 ```
 
-**Requirements**: macOS, Python >= 3.9 and
+**Requirements**: macOS or Linux (POSIX with systemd), Python >= 3.9 and
 [fswatch](https://github.com/emcrisostomo/fswatch):
 
 ```bash
-brew install fswatch
+brew install fswatch      # macOS
+sudo pacman -S fswatch    # Arch / Omarchy
+sudo apt install fswatch  # Debian / Ubuntu
+sudo dnf install fswatch  # Fedora
 ```
 
-The **launchd agent** (daemon at boot) is installed from a checkout of this
-repository with `./install.sh` — not from the wheel — see
-[Agent (launchd)](#agent-launchd) below.
+The **agent** (daemon at boot: launchd on macOS, a systemd *user unit* on Linux)
+is installed from a checkout of this repository with `./install.sh` — not from
+the wheel — see [Agent](#agent) below.
 
-## Agent (launchd)
+## Agent
 
 ```bash
-git clone https://gitlab.com/foxhound87/safekeep.git
+git clone https://github.com/foxhound87/safekeep.git
 cd safekeep
 
-# only external dependency, if not installed yet
-brew install fswatch
+# only external dependency, if not installed yet (see the per-OS list above)
+brew install fswatch      # macOS — the script suggests the right command on Linux
 
-# copies the example into ~/.safekeep, renders the plist, runs preflight checks
+# copies the example into ~/.safekeep, renders the plist / systemd unit,
+# runs preflight checks
 bash install.sh
 ```
 
@@ -88,12 +104,21 @@ Then:
 3. load the agent:
 
 ```bash
+# macOS (launchd)
 launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.safekeep.agent.plist
 # unload with: launchctl bootout gui/$(id -u)/com.safekeep.agent
+
+# Linux (systemd user unit)
+systemctl --user enable --now safekeep
+# status with: systemctl --user status safekeep
+# logs with:   journalctl --user -u safekeep -f
+# unload with: systemctl --user disable --now safekeep
+# start at boot without a login session: loginctl enable-linger $USER
 ```
 
-Once you have granted TCC/FDA (Full Disk Access) permissions to the Python
-interpreter and to `fswatch`, run `safekeep doctor` for diagnostics.
+On macOS, once you have granted TCC/FDA (Full Disk Access) permissions to the
+Python interpreter and to `fswatch`, run `safekeep doctor` for diagnostics. On
+Linux the same command checks the `inotify` watch limit instead.
 
 ## Quickstart
 
@@ -157,7 +182,7 @@ safekeep <command> [--config PATH] [-v]
 | `run` | daemon: initial reconcile, fswatch loop, event dispatch, 24h timer |
 | `sync-once [--dry-run] [--project PATH] [--prune]` | a single pass: walks the source and copies whatever differs (`--dry-run` only prints what it would copy; `--prune` also removes dest files whose source still exists but is no longer included) |
 | `status` | read-only: config, sources, discovered projects with N rules, destination states |
-| `doctor` | diagnostics: config, fswatch, TCC, launchd plist — exits non-zero if a fatal check fails |
+| `doctor` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails |
 
 ## Tests
 
@@ -165,9 +190,12 @@ safekeep <command> [--config PATH] [-v]
 python3 -m unittest discover -s tests
 ```
 
-Stdlib (`unittest`) suite, zero dependencies: 156 tests covering the matcher,
-config, atomic copy, volumes, daemon, auto-discovery and CLI. `fswatch` is not
-needed to run the tests.
+Stdlib (`unittest`) suite, zero dependencies: 175 tests covering the matcher,
+config, atomic copy, volumes, daemon, auto-discovery, CLI and the POSIX
+portability layer (platform helper, per-OS fswatch monitor, systemd template).
+`fswatch` is not needed to run the suite — the few `doctor` checks that talk to
+the real binary are skipped when it's missing — but CI installs it so the
+Linux job exercises the real `inotify` monitor.
 
 ## Documentation
 

safekeep-0.2.0/safekeep.egg-info/PKG-INFO → safekeep-0.3.1/README.md

@@ -1,30 +1,16 @@
-Metadata-Version: 2.4
-Name: safekeep
-Version: 0.2.0
-Summary: Selective always-on backups for macOS: fswatch-driven copy of allow-listed files, never deletes
-License-Expression: MIT
-Project-URL: Homepage, https://gitlab.com/foxhound87/safekeep
-Project-URL: Repository, https://gitlab.com/foxhound87/safekeep
-Keywords: backup,macos,fswatch,sync,allow-list,launchd
-Classifier: Development Status :: 4 - Beta
-Classifier: Environment :: Console
-Classifier: Intended Audience :: System Administrators
-Classifier: Operating System :: MacOS
-Classifier: Programming Language :: Python :: 3
-Classifier: Topic :: System :: Archiving :: Backup
-Requires-Python: >=3.9
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Dynamic: license-file
-
 # safekeep
 
-**Selective always-on backups for macOS**: watches source folders with
+[![PyPI](https://img.shields.io/pypi/v/safekeep)](https://pypi.org/project/safekeep/)
+[![Python](https://img.shields.io/pypi/pyversions/safekeep)](https://pypi.org/project/safekeep/)
+
+**Selective always-on backups for macOS and Linux**: watches source folders with
 [fswatch](https://github.com/emcrisostomo/fswatch) and copies only the files you
 chose to their destinations — an **allow-list** model that **never deletes**
 anything in the backup (a file removed or renamed at the source stays in the
 backup).
 
+Documentation: https://foxhound87.github.io/safekeep/
+
 ## Features
 
 - **Allow-list**: a file is copied only if it matches at least one `include:`;
@@ -38,7 +24,8 @@ backup).
   don't matter, the next reconcile brings everything back in sync.
 - **Unmounted volumes**: missing destination → `pending` state with exponential
   backoff (1s → 60s cap), then a reconcile once the mount is back.
-- **launchd at boot**: an agent with `RunAtLoad` + `KeepAlive` keeps the process
+- **launchd (macOS) or systemd (Linux) at boot**: an agent with `RunAtLoad` +
+  `KeepAlive` (or `WantedBy=default.target` + `Restart=always`) keeps the process
   alive and restarts it if it dies.
 - **`.sync` carries rules only, destinations live only in `~/.safekeep`**: a
   `.sync` file can neither add nor remove destinations (a `dest:` line is an
@@ -53,27 +40,31 @@ pipx install safekeep     # recommended for a CLI
 pip install safekeep
 ```
 
-**Requirements**: macOS, Python >= 3.9 and
+**Requirements**: macOS or Linux (POSIX with systemd), Python >= 3.9 and
 [fswatch](https://github.com/emcrisostomo/fswatch):
 
 ```bash
-brew install fswatch
+brew install fswatch      # macOS
+sudo pacman -S fswatch    # Arch / Omarchy
+sudo apt install fswatch  # Debian / Ubuntu
+sudo dnf install fswatch  # Fedora
 ```
 
-The **launchd agent** (daemon at boot) is installed from a checkout of this
-repository with `./install.sh` — not from the wheel — see
-[Agent (launchd)](#agent-launchd) below.
+The **agent** (daemon at boot: launchd on macOS, a systemd *user unit* on Linux)
+is installed from a checkout of this repository with `./install.sh` — not from
+the wheel — see [Agent](#agent) below.
 
-## Agent (launchd)
+## Agent
 
 ```bash
-git clone https://gitlab.com/foxhound87/safekeep.git
+git clone https://github.com/foxhound87/safekeep.git
 cd safekeep
 
-# only external dependency, if not installed yet
-brew install fswatch
+# only external dependency, if not installed yet (see the per-OS list above)
+brew install fswatch      # macOS — the script suggests the right command on Linux
 
-# copies the example into ~/.safekeep, renders the plist, runs preflight checks
+# copies the example into ~/.safekeep, renders the plist / systemd unit,
+# runs preflight checks
 bash install.sh
 ```
 
@@ -88,12 +79,21 @@ Then:
 3. load the agent:
 
 ```bash
+# macOS (launchd)
 launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.safekeep.agent.plist
 # unload with: launchctl bootout gui/$(id -u)/com.safekeep.agent
+
+# Linux (systemd user unit)
+systemctl --user enable --now safekeep
+# status with: systemctl --user status safekeep
+# logs with:   journalctl --user -u safekeep -f
+# unload with: systemctl --user disable --now safekeep
+# start at boot without a login session: loginctl enable-linger $USER
 ```
 
-Once you have granted TCC/FDA (Full Disk Access) permissions to the Python
-interpreter and to `fswatch`, run `safekeep doctor` for diagnostics.
+On macOS, once you have granted TCC/FDA (Full Disk Access) permissions to the
+Python interpreter and to `fswatch`, run `safekeep doctor` for diagnostics. On
+Linux the same command checks the `inotify` watch limit instead.
 
 ## Quickstart
 
@@ -157,7 +157,7 @@ safekeep <command> [--config PATH] [-v]
 | `run` | daemon: initial reconcile, fswatch loop, event dispatch, 24h timer |
 | `sync-once [--dry-run] [--project PATH] [--prune]` | a single pass: walks the source and copies whatever differs (`--dry-run` only prints what it would copy; `--prune` also removes dest files whose source still exists but is no longer included) |
 | `status` | read-only: config, sources, discovered projects with N rules, destination states |
-| `doctor` | diagnostics: config, fswatch, TCC, launchd plist — exits non-zero if a fatal check fails |
+| `doctor` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails |
 
 ## Tests
 
@@ -165,9 +165,12 @@ safekeep <command> [--config PATH] [-v]
 python3 -m unittest discover -s tests
 ```
 
-Stdlib (`unittest`) suite, zero dependencies: 156 tests covering the matcher,
-config, atomic copy, volumes, daemon, auto-discovery and CLI. `fswatch` is not
-needed to run the tests.
+Stdlib (`unittest`) suite, zero dependencies: 175 tests covering the matcher,
+config, atomic copy, volumes, daemon, auto-discovery, CLI and the POSIX
+portability layer (platform helper, per-OS fswatch monitor, systemd template).
+`fswatch` is not needed to run the suite — the few `doctor` checks that talk to
+the real binary are skipped when it's missing — but CI installs it so the
+Linux job exercises the real `inotify` monitor.
 
 ## Documentation
 

{safekeep-0.2.0 → safekeep-0.3.1}/pyproject.toml

@@ -6,25 +6,31 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "safekeep"
 dynamic = ["version"]
-description = "Selective always-on backups for macOS: fswatch-driven copy of allow-listed files, never deletes"
+description = "Selective always-on backups for macOS and Linux: fswatch-driven copy of allow-listed files, never deletes"
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
 requires-python = ">=3.9"
-keywords = ["backup", "macos", "fswatch", "sync", "allow-list", "launchd"]
+keywords = ["backup", "macos", "linux", "fswatch", "sync", "allow-list", "launchd", "systemd"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",
     "Intended Audience :: System Administrators",
     "Operating System :: MacOS",
+    "Operating System :: POSIX",
+    "Operating System :: POSIX :: Linux",
     "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.14",
     "Topic :: System :: Archiving :: Backup",
 ]
 # zero runtime dependencies: solo stdlib (fswatch è un binario esterno)
 
 [project.urls]
-Homepage = "https://gitlab.com/foxhound87/safekeep"
-Repository = "https://gitlab.com/foxhound87/safekeep"
+Repository = "https://github.com/foxhound87/safekeep"
+Homepage = "https://foxhound87.github.io/safekeep/"
+Documentation = "https://foxhound87.github.io/safekeep/"
 
 [project.scripts]
 safekeep = "safekeep.cli:main"

safekeep-0.3.1/safekeep/__init__.py

@@ -0,0 +1,6 @@
+"""safekeep — motore di backup event-driven per macOS e Linux (vedi SPEC.md)."""
+import logging
+
+logging.getLogger('safekeep').addHandler(logging.NullHandler())
+
+__version__ = '0.3.1'

{safekeep-0.2.0 → safekeep-0.3.1}/safekeep/cli.py

@@ -1,7 +1,7 @@
 """CLI di safekeep: `run`, `sync-once`, `status` e `doctor` (SPEC.md §9).
 
 Entry point del package (`safekeep.cli:main`): `bin/safekeep.py` è solo lo
-shim che usano launchd e i test.
+shim che usano launchd/systemd e i test.
 """
 import argparse
 import os
@@ -12,13 +12,24 @@ import sys
 from safekeep.config import ConfigError, discover_projects, parse_sync
 from safekeep.copier import TMP_INFIX
 from safekeep.daemon import Daemon, setup_logging
+from safekeep.platform import (
+    INOTIFY_MIN_WATCHES,
+    LOG_PATH,
+    fswatch_monitor,
+    inotify_limit,
+    install_hint,
+    is_darwin,
+    is_linux,
+    linger_enabled,
+    recent_permission_errors,
+)
 from safekeep.volumes import dest_state
 
 # Radice del repo quando si gira da checkout; in un install pip punta altrove
 # (site-packages) e i riferimenti a file del repo degradano (vedi cmd_doctor).
 REPO = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 EXAMPLE = os.path.join(REPO, 'examples', 'safekeep.example')
-REPO_URL = 'https://gitlab.com/foxhound87/safekeep'
+REPO_URL = 'https://github.com/foxhound87/safekeep'
 
 
 def build_parser():
@@ -29,7 +40,7 @@ def build_parser():
 
     parser = argparse.ArgumentParser(
         prog='safekeep',
-        description='safekeep — backup event-driven per macOS (vedi SPEC.md)')
+        description='safekeep — backup event-driven per macOS e Linux (vedi SPEC.md)')
     sub = parser.add_subparsers(dest='comando', required=True)
     sub.add_parser('run', parents=[common],
                    help='daemon: reconcile iniziale + watch fswatch + dispatch eventi + timer 24h')
@@ -45,7 +56,10 @@ def build_parser():
     sub.add_parser('status', parents=[common],
                    help='config, progetti e stato delle dest — sola lettura')
     sub.add_parser('doctor', parents=[common],
-                   help='diagnostica: config, fswatch, TCC, plist — exit ≠ 0 se un check fatale fallisce')
+                   help='diagnostica: config, fswatch + monitor di piattaforma, python, '
+                        'errori di permesso recenti nel log, TCC/plist (macOS), '
+                        'inotify/systemd/linger (Linux) — exit ≠ 0 se un check '
+                        'fatale fallisce')
     return parser
 
 
@@ -186,7 +200,7 @@ def cmd_doctor(args):
 
     exe = shutil.which('fswatch')
     if exe is None:
-        out(False, 'fswatch non trovato — installa con: brew install fswatch',
+        out(False, f'fswatch non trovato — installa con: {install_hint()}',
             is_fatal=True)
     else:
         version = None
@@ -200,31 +214,64 @@ def cmd_doctor(args):
         out(version is not None,
             f'fswatch: {version}' if version else 'fswatch --version senza output',
             is_fatal=True)
+        # monitor atteso per piattaforma (SPEC.md §14.2/§14.4)
+        expected = fswatch_monitor()
         try:
             monitors = subprocess.run([exe, '-M'], capture_output=True,
                                       text=True, timeout=15)
-            has_fsevents = 'fsevents_monitor' in monitors.stdout
+            present = expected in monitors.stdout
         except (OSError, subprocess.SubprocessError):
-            has_fsevents = False
-        out(has_fsevents,
-            'fswatch monitor: fsevents_monitor presente' if has_fsevents else
-            'fswatch monitor: fsevents_monitor ASSENTE in `fswatch -M`',
+            present = False
+        out(present,
+            f'fswatch monitor: {expected} presente' if present else
+            f'fswatch monitor: {expected} ASSENTE in `fswatch -M`',
             is_fatal=True)
 
     out(sys.version_info >= (3, 9),
         f'python {sys.version.split()[0]} (≥ 3.9)', is_fatal=True)
 
-    docs = os.path.expanduser('~/Documents')
-    if not os.path.isdir(docs):
-        out(True, 'TCC (Transparency, Consent and Control): ~/Documents assente — probe saltato')
+    # Errori di permesso recenti nel log corrente (SPEC.md §14.4): sintomo
+    # delle ultime 24h, non stato del sistema → sempre NON fatale
+    log = os.path.expanduser(LOG_PATH)
+    recent = recent_permission_errors()
+    if recent is None:
+        out(True, f'errori di permesso recenti: log assente — check saltato ({log})')
+    elif recent[0] > 0:
+        out(False, f'errori di permesso recenti: {recent[0]} nelle ultime 24h '
+                   f'(ultimo: {recent[1]}) — log: {log} — warning non fatale: '
+                   'vedi i pending con `safekeep sync-once --dry-run`, poi '
+                   'riconcedere i permessi al volume (FDA/Full Disk Access)')
     else:
-        try:
-            os.listdir(docs)
-        except PermissionError:
-            out(False, 'TCC: PermissionError su ~/Documents — serve FDA '
-                       '(Full Disk Access) per i progetti in cartelle protette')
+        out(True, f'errori di permesso recenti: nessuno nelle ultime 24h — log: {log}')
+
+    # Linux: il limite di watch di inotify è il rischio #1 sugli alberi grandi
+    # (SPEC.md §14.4) — informativo, NON fatale
+    if is_linux():
+        limit = inotify_limit()
+        if limit is None:
+            out(True, 'inotify: limite di watch non leggibile — check saltato')
+        elif limit < INOTIFY_MIN_WATCHES:
+            out(False, f'inotify: fs.inotify.max_user_watches={limit} '
+                       f'(< {INOTIFY_MIN_WATCHES}) — su alberi grandi (~25k file) i '
+                       'watch finiscono: sudo sysctl -w fs.inotify.max_user_watches=524288 '
+                       '— warning non fatale')
+        else:
+            out(True, f'inotify: fs.inotify.max_user_watches={limit} '
+                      f'(≥ {INOTIFY_MIN_WATCHES})')
+
+    # TCC (Transparency, Consent and Control) è un meccanismo di macOS (SPEC.md §11)
+    if is_darwin():
+        docs = os.path.expanduser('~/Documents')
+        if not os.path.isdir(docs):
+            out(True, 'TCC (Transparency, Consent and Control): ~/Documents assente — probe saltato')
         else:
-            out(True, 'TCC: ~/Documents leggibile')
+            try:
+                os.listdir(docs)
+            except PermissionError:
+                out(False, 'TCC: PermissionError su ~/Documents — serve FDA '
+                           '(Full Disk Access) per i progetti in cartelle protette')
+            else:
+                out(True, 'TCC: ~/Documents leggibile')
 
     if cfg is not None:
         residui = [os.path.join(dirpath, name)
@@ -236,19 +283,48 @@ def cmd_doctor(args):
             'residui *.safekeep.tmp.*: nessuno' if not residui else
             'residui *.safekeep.tmp.*: ' + ', '.join(residui))
 
-    plist = os.path.expanduser('~/Library/LaunchAgents/com.safekeep.agent.plist')
-    if not os.path.exists(plist):
-        out(True, 'plist non installato (nessun agent da validare)')
-    elif shutil.which('plutil') is None:
-        out(True, 'plutil assente — lint del plist saltato')
+    if is_darwin():
+        plist = os.path.expanduser('~/Library/LaunchAgents/com.safekeep.agent.plist')
+        if not os.path.exists(plist):
+            out(True, 'plist non installato (nessun agent da validare)')
+        elif shutil.which('plutil') is None:
+            out(True, 'plutil assente — lint del plist saltato')
+        else:
+            try:
+                lint = subprocess.run(['plutil', '-lint', plist],
+                                      capture_output=True, text=True, timeout=15)
+                detail = (lint.stdout + lint.stderr).strip() or plist
+                out(lint.returncode == 0, f'plist lint: {detail}', is_fatal=True)
+            except (OSError, subprocess.SubprocessError) as e:
+                out(False, f'plist lint non eseguibile: {e}', is_fatal=True)
     else:
-        try:
-            lint = subprocess.run(['plutil', '-lint', plist],
-                                  capture_output=True, text=True, timeout=15)
-            detail = (lint.stdout + lint.stderr).strip() or plist
-            out(lint.returncode == 0, f'plist lint: {detail}', is_fatal=True)
-        except (OSError, subprocess.SubprocessError) as e:
-            out(False, f'plist lint non eseguibile: {e}', is_fatal=True)
+        # Linux: user unit systemd al posto del plist (SPEC.md §14.3)
+        unit = os.path.expanduser('~/.config/systemd/user/safekeep.service')
+        if not os.path.exists(unit):
+            out(True, 'unit systemd non installata (nessun agent da validare)')
+        else:
+            try:
+                with open(unit, encoding='utf-8') as fh:
+                    text = fh.read()
+            except (OSError, UnicodeError) as e:
+                out(False, f'unit systemd illeggibile: {unit}: {e}', is_fatal=True)
+            else:
+                if '__REPO__' in text or '__PYTHON__' in text:
+                    out(False, f'unit systemd: {unit} contiene ancora i placeholder '
+                               'del template — rilancia install.sh', is_fatal=True)
+                else:
+                    out(True, f'unit systemd: {unit}')
+            # linger: solo dove la unit è installata (SPEC.md §14.4) — non fatale
+            enabled = linger_enabled()
+            if enabled is None:
+                out(True, 'linger: non verificabile (/var/lib/systemd/linger '
+                          'assente) — check saltato')
+            elif enabled:
+                out(True, 'linger: abilitato (agent al boot anche senza login)')
+            else:
+                out(False, "linger: NON abilitato — l'agent non partirà al boot "
+                           'senza login → loginctl enable-linger $USER — '
+                           'warning non fatale')
 
     return 1 if fatal else 0
 

{safekeep-0.2.0 → safekeep-0.3.1}/safekeep/daemon.py

@@ -4,7 +4,8 @@
 Un solo processo, nessun thread: `step()` fa `select` su stdout di fswatch con
 timeout pari alla scadenza più vicina (reconcile giornaliero, retry dest
 absent, respawn fswatch). Le regex `-e` sono un pre-filtro grezzo: la verità
-su cosa copiare resta al matcher Python (SPEC.md §6.4).
+su cosa copiare resta al matcher Python (SPEC.md §6.4). Il monitor di fswatch
+viene da `safekeep.platform` (SPEC.md §14.1).
 """
 import logging
 import logging.handlers
@@ -26,6 +27,7 @@ from .config import (
 )
 from .copier import MOUNT_ERRNOS, copy_one, needs_copy, prune_project, reconcile_project
 from .matcher import BUILTIN_RULES, Matcher, _glob, parse_rule
+from .platform import LOG_PATH, fswatch_monitor, init_system
 from .volumes import backoff_schedule, dest_state, partition_dests
 
 log = logging.getLogger('safekeep')
@@ -34,7 +36,7 @@ FLOOD_LIMIT = 5000        # path per progetto in un batch → collapse a reconci
 DEDUP_WINDOW = 2.0        # secondi: stessa path entro la finestra → un solo evento
 RECONCILE_INTERVAL = 24 * 3600
 DEATH_WINDOW = 60         # finestra di conteggio delle morti di fswatch
-MAX_DEATHS = 5            # 5 morti in 60s → esco con codice ≠ 0 (launchd ci riprova)
+MAX_DEATHS = 5            # 5 morti in 60s → esco con codice ≠ 0 (l'init system ci riprova)
 RESPAWN_CAP = 60          # backoff respawn 1 → 60s
 
 SKIP = 'skip'
@@ -269,7 +271,7 @@ def setup_logging(level='info', logfile=None):
     logger._safekeep_handlers = True
     fmt = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
     if logfile is None:
-        logfile = os.path.expanduser('~/.local/state/safekeep/safekeep.log')
+        logfile = os.path.expanduser(LOG_PATH)
     try:
         os.makedirs(os.path.dirname(logfile), exist_ok=True)
         handler = logging.handlers.RotatingFileHandler(
@@ -409,8 +411,9 @@ class Daemon:
     # --- fswatch ---------------------------------------------------------
 
     def fswatch_argv(self):
-        """`fswatch -0 -m fsevents_monitor -r -l 1.0 -e <regex> -- <roots>` (§6.4)."""
-        argv = ['fswatch', '-0', '-m', 'fsevents_monitor', '-r', '-l', '1.0']
+        """`fswatch -0 -m <monitor> -r -l 1.0 -e <regex> -- <roots>` (§6.4, §14.2):
+        il monitor è dichiarato per piattaforma, mai il default implicito."""
+        argv = ['fswatch', '-0', '-m', fswatch_monitor(), '-r', '-l', '1.0']
         for regex in self.exclude_regexes():
             argv += ['-e', regex]
         return argv + ['--'] + self.discovery_roots()[0]
@@ -462,8 +465,8 @@ class Daemon:
         self.deaths.append(now)
         if len(self.deaths) >= MAX_DEATHS:
             log.error('fswatch morto %d volte in %ds: esco con codice != 0 '
-                      '(launchd con KeepAlive ci riproverà)',
-                      len(self.deaths), DEATH_WINDOW)
+                      '(%s ci riproverà)',
+                      len(self.deaths), DEATH_WINDOW, init_system())
             self.fatal = True
             return
         if now - self.last_spawn >= DEATH_WINDOW: