safekeep 0.6.0__tar.gz → 0.7.0__tar.gz

{safekeep-0.6.0/safekeep.egg-info → safekeep-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: safekeep
-Version: 0.6.0
+Version: 0.7.0
 Summary: Selective always-on backups for macOS and Linux: fswatch-driven copy of allow-listed files, never deletes
 License-Expression: MIT
 Project-URL: Repository, https://github.com/foxhound87/safekeep
@@ -84,21 +84,22 @@ sudo dnf install fswatch  # Fedora
 ```
 
 The **agent** (daemon at boot: launchd on macOS, a systemd *user unit* on Linux)
-is installed from a checkout of this repository with `./install.sh` — not from
-the wheel — see [Agent](#agent) below.
+is installed from the installed package with `safekeep daemon install` — the
+unit templates ship inside the wheel, no checkout needed — see
+[Agent](#agent) below. The old `./install.sh` wrapper is deprecated.
 
 ## Agent
 
 ```bash
-git clone https://github.com/foxhound87/safekeep.git
-cd safekeep
+pipx install safekeep        # or: pip install --user safekeep
 
 # only external dependency, if not installed yet (see the per-OS list above)
-brew install fswatch      # macOS — the script suggests the right command on Linux
+brew install fswatch      # macOS — the preflight suggests the right command on Linux
 
-# copies the example into ~/.safekeep, renders the plist / systemd unit,
-# runs preflight checks
-bash install.sh
+# preflight (fswatch / shim on PATH / python / WSL systemd-on), then renders
+# the plist or systemd user unit from the embedded template into place —
+# idempotent, does NOT start anything yet
+safekeep daemon install        # --dry-run to preview, nothing is written
 ```
 
 Then:
@@ -112,16 +113,18 @@ Then:
 3. load the agent:
 
 ```bash
-# macOS (launchd)
-launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.safekeep.agent.plist
-# unload with: launchctl bootout gui/$(id -u)/com.safekeep.agent
-
-# Linux (systemd user unit)
-systemctl --user enable --now safekeep
-# status with: systemctl --user status safekeep
-# logs with:   journalctl --user -u safekeep -f
-# unload with: systemctl --user disable --now safekeep
-# start at boot without a login session: loginctl enable-linger $USER
+safekeep daemon start        # launchctl bootstrap (macOS) / systemctl --user enable --now (Linux)
+safekeep daemon status       # exit 0 while running, 1 otherwise
+safekeep daemon stop         # unload
+
+# logs (Linux): journalctl --user -u safekeep -f
+# remove the unit (config and logs stay): safekeep daemon uninstall
+# remove everything, incl. ~/.safekeep:    safekeep daemon uninstall --purge
+
+# Linux - start at boot without a login session (linger = user units active
+# without a login), either pass
+safekeep daemon install --enable-linger
+# or run once: loginctl enable-linger $USER
 ```
 
 On macOS, once you have granted TCC/FDA (Full Disk Access) permissions to the
@@ -152,7 +155,8 @@ exactly those entries, as always. Without it safekeep switches to
 **auto-discovery**: it scans `$HOME` for `.sync` files (skipping hidden
 directories, `Library`, `.Trash`, `.cache`, `node_modules`, `.git`, `.venv`,
 `__pycache__`, `venv`), watches `$HOME`, and picks up any `.sync` created after
-startup. `dest:` stays mandatory in both modes.
+startup. `dest:` stays mandatory in both modes — unless `s3_bucket:` is set
+(at least one of the two must be present).
 
 `~/Code/myapp/.sync` (rules only, no destinations):
 
@@ -187,9 +191,12 @@ destinations. The client is [botocore](https://botocore.amazonaws.com/),
 installed via the optional extra — the core package stays stdlib-only:
 
 ```bash
-pipx install "safekeep[s3]"
+pipx install "safekeep[s3]"      # or: pip install "safekeep[s3]"
 ```
 
+Without the extra the config still parses, but any `s3_*` key fails fast with
+an install hint (`doctor` reports it as a **non-fatal** warning).
+
 `~/.safekeep` (the `s3_*` keys are valid **only** in this file — a `.sync`
 can't add them; keep the file at `chmod 600`):
 
@@ -205,6 +212,10 @@ s3_addressing: path                       # path (default) | virtual
 s3_tls_check: true                        # false = self-signed certificates
 ```
 
+With `s3_secret_key_env:` the variable must be in the **agent's** environment
+(launchd `EnvironmentVariables`, systemd `Environment=`) — a shell `export`
+alone doesn't reach a daemon started at boot.
+
 Semantics (see [SPEC.md](SPEC.md) §18): upload-only with `needs_copy` based on
 object metadata (`x-amz-meta-mtime` in nanoseconds, `x-amz-meta-mode`,
 symlinks = zero-byte objects with `x-amz-meta-symlink`), same 1s mtime
@@ -215,14 +226,18 @@ that's an accepted v1 limitation.
 
 Compatible services:
 
-| Service | Example `s3_endpoint` | `s3_addressing` | Notes |
-|---|---|---|---|
-| MinIO (self-hosted) | `https://minio.example.com:9000` | `path` | SigV4 (Signature Version 4), any region |
-| Silo | `https://s3.example.com:443` | `path` | fork of MinIO — same settings |
-| Ceph RGW | `https://rgw.example.com` | `path` | S3-compatible API |
-| Wasabi | `https://s3.wasabisys.com` | `path` | region required, must match the bucket |
-| Backblaze B2 | `https://s3.<region>.backblazeb2.com` | `virtual` | use an Application Key as access/secret |
-| AWS S3 | *(omit `s3_endpoint`)* | `virtual` | default endpoint, region must match |
+| Service | Example `s3_endpoint` | `s3_addressing` | `s3_region` | TLS |
+|---|---|---|---|---|
+| MinIO (self-hosted) | `https://minio.example.com:9000` | `path` | any (`us-east-1` default) | `https` + `s3_tls_check: false` if self-signed |
+| Silo (fork of MinIO) | `https://s3.example.com:443` | `path` | any (`us-east-1` default) | as the endpoint's own certificate |
+| Ceph RGW | `https://rgw.example.com` | `path` | any, must match the RGW zone (`us-east-1` default) | as configured on the RGW |
+| Wasabi | `https://s3.wasabisys.com` | `path` | **required**, must match the bucket (`us-east-1` on that endpoint) | `https` |
+| Backblaze B2 | `https://s3.<region>.backblazeb2.com` | `virtual` or `path` | **required**, must match the bucket region | `https` only — cleartext rejected |
+| AWS S3 | *(omit `s3_endpoint`)* | `virtual` | must match the bucket (`us-east-1` default) | `https` |
+
+All of them speak SigV4 (Signature Version 4) with the same client — no
+service-specific code path. B2 wants an **Application Key** (not the Master
+Key) as `s3_access_key`/`s3_secret_key`.
 
 `safekeep status` shows the bucket as `[ok]`/`[offline]` (cached HeadBucket),
 and `safekeep doctor` reports credentials, file permissions and bucket
@@ -240,6 +255,7 @@ safekeep <command> [--config PATH] [-v]
 | `sync-once [--dry-run] [--project PATH] [--prune]` | a single pass: walks the source and copies whatever differs (`--dry-run` only prints what it would copy; `--prune` also removes dest files whose source still exists but is no longer included) |
 | `status` | read-only: config, sources, discovered projects with N rules, destination states |
 | `doctor [--json]` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails; `--json` prints the same checks as one JSON document on stdout with the same exit code, including a structured `permission_errors` count of the last 24h |
+| `daemon {install,start,stop,status,uninstall}` | manage the boot agent: `install` runs preflight (fswatch, shim on PATH, WSL systemd-on) and renders the launchd plist / systemd user unit from the embedded templates (idempotent, `--dry-run`, `--enable-linger`); `start`/`stop`/`status` load, unload and probe it; `uninstall` removes the unit (`--purge` also drops `~/.safekeep` and state) |
 
 ## Tests
 
@@ -247,7 +263,7 @@ safekeep <command> [--config PATH] [-v]
 python3 -m unittest discover -s tests
 ```
 
-Stdlib (`unittest`) suite, zero dependencies: 221 tests covering the matcher,
+Stdlib (`unittest`) suite, zero dependencies: 287 tests covering the matcher,
 config, atomic copy, volumes, daemon, auto-discovery, CLI, the permission-trend
 wrapper and the POSIX portability layer (platform helper, per-OS fswatch
 monitor, systemd template).
@@ -255,6 +271,20 @@ monitor, systemd template).
 the real binary are skipped when it's missing — but CI installs it so the
 Linux job exercises the real `inotify` monitor.
 
+The S3 integration test talks to a real bucket and is **skipped** unless every
+`SAFEKEEP_S3_TEST_*` variable is set (no credential is hard-coded; it uploads
+under a throwaway timestamped prefix and performs **no** DeleteObject):
+
+```bash
+export SAFEKEEP_S3_TEST_ENDPOINT=https://s3.example.com:443 \
+       SAFEKEEP_S3_TEST_BUCKET=my-backup-bucket \
+       SAFEKEEP_S3_TEST_ACCESS_KEY=REPLACEME_ACCESS_KEY \
+       SAFEKEEP_S3_TEST_SECRET_KEY=REPLACEME_SECRET_KEY \
+       SAFEKEEP_S3_TEST_REGION=us-east-1        # optional, default us-east-1
+       # SAFEKEEP_S3_TEST_PREFIX=safekeep       # optional, default safekeep-itest
+python3 -m unittest tests.test_s3_itest -v
+```
+
 ## Documentation
 
 Everything in detail (config format, pattern semantics, event → sync flow,

{safekeep-0.6.0 → safekeep-0.7.0}/README.md

@@ -57,21 +57,22 @@ sudo dnf install fswatch  # Fedora
 ```
 
 The **agent** (daemon at boot: launchd on macOS, a systemd *user unit* on Linux)
-is installed from a checkout of this repository with `./install.sh` — not from
-the wheel — see [Agent](#agent) below.
+is installed from the installed package with `safekeep daemon install` — the
+unit templates ship inside the wheel, no checkout needed — see
+[Agent](#agent) below. The old `./install.sh` wrapper is deprecated.
 
 ## Agent
 
 ```bash
-git clone https://github.com/foxhound87/safekeep.git
-cd safekeep
+pipx install safekeep        # or: pip install --user safekeep
 
 # only external dependency, if not installed yet (see the per-OS list above)
-brew install fswatch      # macOS — the script suggests the right command on Linux
+brew install fswatch      # macOS — the preflight suggests the right command on Linux
 
-# copies the example into ~/.safekeep, renders the plist / systemd unit,
-# runs preflight checks
-bash install.sh
+# preflight (fswatch / shim on PATH / python / WSL systemd-on), then renders
+# the plist or systemd user unit from the embedded template into place —
+# idempotent, does NOT start anything yet
+safekeep daemon install        # --dry-run to preview, nothing is written
 ```
 
 Then:
@@ -85,16 +86,18 @@ Then:
 3. load the agent:
 
 ```bash
-# macOS (launchd)
-launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.safekeep.agent.plist
-# unload with: launchctl bootout gui/$(id -u)/com.safekeep.agent
-
-# Linux (systemd user unit)
-systemctl --user enable --now safekeep
-# status with: systemctl --user status safekeep
-# logs with:   journalctl --user -u safekeep -f
-# unload with: systemctl --user disable --now safekeep
-# start at boot without a login session: loginctl enable-linger $USER
+safekeep daemon start        # launchctl bootstrap (macOS) / systemctl --user enable --now (Linux)
+safekeep daemon status       # exit 0 while running, 1 otherwise
+safekeep daemon stop         # unload
+
+# logs (Linux): journalctl --user -u safekeep -f
+# remove the unit (config and logs stay): safekeep daemon uninstall
+# remove everything, incl. ~/.safekeep:    safekeep daemon uninstall --purge
+
+# Linux - start at boot without a login session (linger = user units active
+# without a login), either pass
+safekeep daemon install --enable-linger
+# or run once: loginctl enable-linger $USER
 ```
 
 On macOS, once you have granted TCC/FDA (Full Disk Access) permissions to the
@@ -125,7 +128,8 @@ exactly those entries, as always. Without it safekeep switches to
 **auto-discovery**: it scans `$HOME` for `.sync` files (skipping hidden
 directories, `Library`, `.Trash`, `.cache`, `node_modules`, `.git`, `.venv`,
 `__pycache__`, `venv`), watches `$HOME`, and picks up any `.sync` created after
-startup. `dest:` stays mandatory in both modes.
+startup. `dest:` stays mandatory in both modes — unless `s3_bucket:` is set
+(at least one of the two must be present).
 
 `~/Code/myapp/.sync` (rules only, no destinations):
 
@@ -160,9 +164,12 @@ destinations. The client is [botocore](https://botocore.amazonaws.com/),
 installed via the optional extra — the core package stays stdlib-only:
 
 ```bash
-pipx install "safekeep[s3]"
+pipx install "safekeep[s3]"      # or: pip install "safekeep[s3]"
 ```
 
+Without the extra the config still parses, but any `s3_*` key fails fast with
+an install hint (`doctor` reports it as a **non-fatal** warning).
+
 `~/.safekeep` (the `s3_*` keys are valid **only** in this file — a `.sync`
 can't add them; keep the file at `chmod 600`):
 
@@ -178,6 +185,10 @@ s3_addressing: path                       # path (default) | virtual
 s3_tls_check: true                        # false = self-signed certificates
 ```
 
+With `s3_secret_key_env:` the variable must be in the **agent's** environment
+(launchd `EnvironmentVariables`, systemd `Environment=`) — a shell `export`
+alone doesn't reach a daemon started at boot.
+
 Semantics (see [SPEC.md](SPEC.md) §18): upload-only with `needs_copy` based on
 object metadata (`x-amz-meta-mtime` in nanoseconds, `x-amz-meta-mode`,
 symlinks = zero-byte objects with `x-amz-meta-symlink`), same 1s mtime
@@ -188,14 +199,18 @@ that's an accepted v1 limitation.
 
 Compatible services:
 
-| Service | Example `s3_endpoint` | `s3_addressing` | Notes |
-|---|---|---|---|
-| MinIO (self-hosted) | `https://minio.example.com:9000` | `path` | SigV4 (Signature Version 4), any region |
-| Silo | `https://s3.example.com:443` | `path` | fork of MinIO — same settings |
-| Ceph RGW | `https://rgw.example.com` | `path` | S3-compatible API |
-| Wasabi | `https://s3.wasabisys.com` | `path` | region required, must match the bucket |
-| Backblaze B2 | `https://s3.<region>.backblazeb2.com` | `virtual` | use an Application Key as access/secret |
-| AWS S3 | *(omit `s3_endpoint`)* | `virtual` | default endpoint, region must match |
+| Service | Example `s3_endpoint` | `s3_addressing` | `s3_region` | TLS |
+|---|---|---|---|---|
+| MinIO (self-hosted) | `https://minio.example.com:9000` | `path` | any (`us-east-1` default) | `https` + `s3_tls_check: false` if self-signed |
+| Silo (fork of MinIO) | `https://s3.example.com:443` | `path` | any (`us-east-1` default) | as the endpoint's own certificate |
+| Ceph RGW | `https://rgw.example.com` | `path` | any, must match the RGW zone (`us-east-1` default) | as configured on the RGW |
+| Wasabi | `https://s3.wasabisys.com` | `path` | **required**, must match the bucket (`us-east-1` on that endpoint) | `https` |
+| Backblaze B2 | `https://s3.<region>.backblazeb2.com` | `virtual` or `path` | **required**, must match the bucket region | `https` only — cleartext rejected |
+| AWS S3 | *(omit `s3_endpoint`)* | `virtual` | must match the bucket (`us-east-1` default) | `https` |
+
+All of them speak SigV4 (Signature Version 4) with the same client — no
+service-specific code path. B2 wants an **Application Key** (not the Master
+Key) as `s3_access_key`/`s3_secret_key`.
 
 `safekeep status` shows the bucket as `[ok]`/`[offline]` (cached HeadBucket),
 and `safekeep doctor` reports credentials, file permissions and bucket
@@ -213,6 +228,7 @@ safekeep <command> [--config PATH] [-v]
 | `sync-once [--dry-run] [--project PATH] [--prune]` | a single pass: walks the source and copies whatever differs (`--dry-run` only prints what it would copy; `--prune` also removes dest files whose source still exists but is no longer included) |
 | `status` | read-only: config, sources, discovered projects with N rules, destination states |
 | `doctor [--json]` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails; `--json` prints the same checks as one JSON document on stdout with the same exit code, including a structured `permission_errors` count of the last 24h |
+| `daemon {install,start,stop,status,uninstall}` | manage the boot agent: `install` runs preflight (fswatch, shim on PATH, WSL systemd-on) and renders the launchd plist / systemd user unit from the embedded templates (idempotent, `--dry-run`, `--enable-linger`); `start`/`stop`/`status` load, unload and probe it; `uninstall` removes the unit (`--purge` also drops `~/.safekeep` and state) |
 
 ## Tests
 
@@ -220,7 +236,7 @@ safekeep <command> [--config PATH] [-v]
 python3 -m unittest discover -s tests
 ```
 
-Stdlib (`unittest`) suite, zero dependencies: 221 tests covering the matcher,
+Stdlib (`unittest`) suite, zero dependencies: 287 tests covering the matcher,
 config, atomic copy, volumes, daemon, auto-discovery, CLI, the permission-trend
 wrapper and the POSIX portability layer (platform helper, per-OS fswatch
 monitor, systemd template).
@@ -228,6 +244,20 @@ monitor, systemd template).
 the real binary are skipped when it's missing — but CI installs it so the
 Linux job exercises the real `inotify` monitor.
 
+The S3 integration test talks to a real bucket and is **skipped** unless every
+`SAFEKEEP_S3_TEST_*` variable is set (no credential is hard-coded; it uploads
+under a throwaway timestamped prefix and performs **no** DeleteObject):
+
+```bash
+export SAFEKEEP_S3_TEST_ENDPOINT=https://s3.example.com:443 \
+       SAFEKEEP_S3_TEST_BUCKET=my-backup-bucket \
+       SAFEKEEP_S3_TEST_ACCESS_KEY=REPLACEME_ACCESS_KEY \
+       SAFEKEEP_S3_TEST_SECRET_KEY=REPLACEME_SECRET_KEY \
+       SAFEKEEP_S3_TEST_REGION=us-east-1        # optional, default us-east-1
+       # SAFEKEEP_S3_TEST_PREFIX=safekeep       # optional, default safekeep-itest
+python3 -m unittest tests.test_s3_itest -v
+```
+
 ## Documentation
 
 Everything in detail (config format, pattern semantics, event → sync flow,

{safekeep-0.6.0 → safekeep-0.7.0}/pyproject.toml

@@ -43,5 +43,10 @@ safekeep = "safekeep.cli:main"
 # NO auto-discovery: bin/ e tests/ farebbero errore di build
 packages = ["safekeep"]
 
+[tool.setuptools.package-data]
+# 0.7.0: template unit + example config embedded — `safekeep daemon install`
+# funziona da PyPI senza git clone (sorgente unica: safekeep/data/)
+safekeep = ["data/*"]
+
 [tool.setuptools.dynamic]
 version = {attr = "safekeep.__version__"}

{safekeep-0.6.0 → safekeep-0.7.0}/safekeep/__init__.py

@@ -3,4 +3,4 @@ import logging
 
 logging.getLogger('safekeep').addHandler(logging.NullHandler())
 
-__version__ = '0.6.0'
+__version__ = '0.7.0'

{safekeep-0.6.0 → safekeep-0.7.0}/safekeep/cli.py

@@ -1,4 +1,4 @@
-"""CLI di safekeep: `run`, `sync-once`, `status` e `doctor` (SPEC.md §9).
+"""CLI di safekeep: `run`, `sync-once`, `status`, `doctor` e `daemon` (SPEC.md §9).
 
 Entry point del package (`safekeep.cli:main`): `bin/safekeep.py` è solo lo
 shim che usano launchd/systemd e i test.
@@ -13,6 +13,7 @@ import sys
 from datetime import datetime
 
 from safekeep import __version__
+from safekeep import daemonctl
 from safekeep.config import ConfigError, discover_projects, parse_sync
 from safekeep.copier import TMP_INFIX
 from safekeep.daemon import Daemon, setup_logging
@@ -34,10 +35,8 @@ from safekeep.platform import (
 from safekeep.s3dest import S3ExtraMissing, secret_perms_insecure
 from safekeep.volumes import dest_state
 
-# Radice del repo quando si gira da checkout; in un install pip punta altrove
-# (site-packages) e i riferimenti a file del repo degradano (vedi cmd_doctor).
-REPO = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-EXAMPLE = os.path.join(REPO, 'examples', 'safekeep.example')
+# Repo upstream: solo nell'hint degradato di `cmd_doctor` quando l'esempio
+# embedded non fosse leggibile (install pip rotto — package data mancante).
 REPO_URL = 'https://github.com/foxhound87/safekeep'
 
 
@@ -73,6 +72,38 @@ def build_parser():
     doc.add_argument('--json', action='store_true',
                      help='stessi check, stesso exit code, ma un documento JSON su '
                           'stdout (SPEC.md §9.1)')
+    daem = sub.add_parser(
+        'daemon',
+        description="installa e gestisce l'agent di boot (launchd su macOS, "
+                    'systemd user su Linux/WSL2 con systemd-on) — ExecStart = '
+                    'shim `safekeep` sul PATH → `safekeep run`',
+        help="installa e gestisce l'agent di boot (launchd su macOS, systemd "
+             "user su Linux/WSL2) — ExecStart: safekeep run")
+    dsub = daem.add_subparsers(dest='daemon_cmd', required=True)
+    dinst = dsub.add_parser(
+        'install',
+        help='preflight (fswatch/shim/python/WSL-systemd) + render della unit da '
+             'template embedded + scrittura — idempotente, NON avvia')
+    dinst.add_argument('--enable-linger', action='store_true',
+                       help='Linux: esegue `loginctl enable-linger $USER` '
+                            '(default: solo hint — linger = unit user attive '
+                            'anche senza login)')
+    dinst.add_argument('--dry-run', action='store_true',
+                       help='mostra cosa installerebbe, senza scrivere nulla')
+    dsub.add_parser('start',
+                    help="carica e avvia l'agent (launchctl bootstrap / "
+                         'systemctl --user enable --now)')
+    dsub.add_parser('stop',
+                    help="ferma l'agent (launchctl bootout / "
+                         'systemctl --user disable --now)')
+    dsub.add_parser('status',
+                    help="stato dell'agent — sola lettura, exit 0 se in "
+                         'esecuzione, 1 altrimenti')
+    dun = dsub.add_parser('uninstall',
+                          help='rimuove la unit — ~/.safekeep e i log restano '
+                               'intatti')
+    dun.add_argument('--purge', action='store_true',
+                     help='rimuove anche ~/.safekeep e ~/.local/state/safekeep/')
     return parser
 
 
@@ -190,10 +221,13 @@ def cmd_doctor(args):
     daemon = None
     s3_missing = None
     if not os.path.exists(cfg_path):
-        if os.path.exists(EXAMPLE):
-            hint = f'creala: cp {EXAMPLE} {cfg_path}'
+        # Hint dall'example EMBEDDED (package data, task 4): un install pip non
+        # ha il repo → niente più "clone the repo"
+        embedded = daemonctl.example_path()
+        if os.path.exists(embedded):
+            hint = f'creala: cp {embedded} {cfg_path}'
         else:
-            # install pip: niente repo, niente esempi → hint degradato
+            # install rotto (niente package data): fallback minimo
             hint = (f'clone {REPO_URL} and copy examples/safekeep.example to '
                     f'{cfg_path}')
         out(False, f'config assente: {cfg_path} ({hint})',
@@ -377,7 +411,7 @@ def cmd_doctor(args):
             'residui *.safekeep.tmp.*: ' + ', '.join(residui))
 
     if is_darwin():
-        plist = os.path.expanduser('~/Library/LaunchAgents/com.safekeep.agent.plist')
+        plist = os.path.expanduser(daemonctl.PLIST_PATH)
         if not os.path.exists(plist):
             out(True, 'plist non installato (nessun agent da validare)')
         elif shutil.which('plutil') is None:
@@ -391,8 +425,9 @@ def cmd_doctor(args):
             except (OSError, subprocess.SubprocessError) as e:
                 out(False, f'plist lint non eseguibile: {e}', is_fatal=True)
     else:
-        # Linux: user unit systemd al posto del plist (SPEC.md §14.3)
-        unit = os.path.expanduser('~/.config/systemd/user/safekeep.service')
+        # Linux: user unit systemd al posto del plist (SPEC.md §14.3) — stesso
+        # path scritto da daemonctl (costanti condivise, task 4)
+        unit = os.path.expanduser(daemonctl.UNIT_PATH)
         if not os.path.exists(unit):
             out(True, 'unit systemd non installata (nessun agent da validare)')
         else:
@@ -402,9 +437,12 @@ def cmd_doctor(args):
             except (OSError, UnicodeError) as e:
                 out(False, f'unit systemd illeggibile: {unit}: {e}', is_fatal=True)
             else:
-                if '__REPO__' in text or '__PYTHON__' in text:
-                    out(False, f'unit systemd: {unit} contiene ancora i placeholder '
-                               'del template — rilancia install.sh', is_fatal=True)
+                residui = [p for p in daemonctl.PLACEHOLDERS if p in text]
+                if residui:
+                    out(False, f'unit systemd: {unit} contiene ancora i '
+                               f'placeholder del template '
+                               f'({", ".join(residui)}) — rilancia '
+                               f'safekeep daemon install', is_fatal=True)
                 else:
                     out(True, f'unit systemd: {unit}')
             # linger: solo dove la unit è installata (SPEC.md §14.4) — non fatale
@@ -453,9 +491,25 @@ def cmd_doctor(args):
     return code
 
 
+def cmd_daemon(args):
+    """Dispatch dei sottocomandi `safekeep daemon` (daemonctl, SPEC §14.3)."""
+    if args.daemon_cmd == 'install':
+        return daemonctl.install(enable_linger=args.enable_linger,
+                                 dry_run=args.dry_run)
+    if args.daemon_cmd == 'uninstall':
+        return daemonctl.uninstall(purge=args.purge)
+    if args.daemon_cmd == 'start':
+        return daemonctl.start()
+    if args.daemon_cmd == 'stop':
+        return daemonctl.stop()
+    return daemonctl.status()
+
+
 def main(argv=None):
     args = build_parser().parse_args(argv)
     try:
+        if args.comando == 'daemon':
+            return cmd_daemon(args)
         if args.comando == 'run':
             return Daemon(args.config).run(verbose=args.v)
         if args.comando == 'status':