1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
// ─── Supported platforms (macOS, Linux, Windows) ──────────────────────────
#[cfg(any(target_os = "macos", target_os = "linux", windows))]
mod imp {
use crate::{Result, env};
#[cfg(target_os = "linux")]
use auto_launcher::LinuxLaunchMode;
#[cfg(target_os = "macos")]
use auto_launcher::MacOSLaunchMode;
use auto_launcher::{AutoLaunch, AutoLaunchBuilder};
use miette::IntoDiagnostic;
#[cfg(any(target_os = "macos", target_os = "linux"))]
fn build_launcher(
app_path: &str,
#[cfg(target_os = "macos")] macos_mode: MacOSLaunchMode,
#[cfg(target_os = "linux")] linux_mode: LinuxLaunchMode,
) -> Result<AutoLaunch> {
let mut builder = AutoLaunchBuilder::new();
builder
.set_app_name("pitchfork")
.set_app_path(app_path)
.set_args(&["supervisor", "run", "--boot"]);
#[cfg(target_os = "macos")]
builder.set_macos_launch_mode(macos_mode);
#[cfg(target_os = "linux")]
builder.set_linux_launch_mode(linux_mode);
builder.build().into_diagnostic()
}
pub struct BootManager {
/// The launcher matching the current privilege level (used for enable).
current: AutoLaunch,
/// The other level's launcher (used to detect cross-level registrations).
other: AutoLaunch,
/// Legacy macOS LaunchAgentSystem entry (pre-1.0.3 used /Library/LaunchAgents/
/// instead of /Library/LaunchDaemons/ for root). Kept only for migration/cleanup.
#[cfg(target_os = "macos")]
legacy: AutoLaunch,
}
impl BootManager {
pub fn new() -> Result<Self> {
let app_path = env::PITCHFORK_BIN.to_string_lossy().to_string();
#[cfg(target_os = "macos")]
let (current, other, legacy) = {
let is_root = nix::unistd::Uid::effective().is_root();
let (current_mode, other_mode) = if is_root {
(
MacOSLaunchMode::LaunchDaemonSystem,
MacOSLaunchMode::LaunchAgentUser,
)
} else {
(
MacOSLaunchMode::LaunchAgentUser,
MacOSLaunchMode::LaunchDaemonSystem,
)
};
(
build_launcher(&app_path, current_mode)?,
build_launcher(&app_path, other_mode)?,
build_launcher(&app_path, MacOSLaunchMode::LaunchAgentSystem)?,
)
};
#[cfg(target_os = "linux")]
let (current, other) = {
let is_root = nix::unistd::Uid::effective().is_root();
let (current_mode, other_mode) = if is_root {
(LinuxLaunchMode::SystemdSystem, LinuxLaunchMode::SystemdUser)
} else {
(LinuxLaunchMode::SystemdUser, LinuxLaunchMode::SystemdSystem)
};
(
build_launcher(&app_path, current_mode)?,
build_launcher(&app_path, other_mode)?,
)
};
// On Windows there is no root/user distinction; build two identical
// launchers (AutoLaunch does not implement Clone).
#[cfg(windows)]
let (current, other) = (
AutoLaunchBuilder::new()
.set_app_name("pitchfork")
.set_app_path(&app_path)
.set_args(&["supervisor", "run", "--boot"])
.build()
.into_diagnostic()?,
AutoLaunchBuilder::new()
.set_app_name("pitchfork")
.set_app_path(&app_path)
.set_args(&["supervisor", "run", "--boot"])
.build()
.into_diagnostic()?,
);
#[cfg(target_os = "macos")]
return Ok(Self {
current,
other,
legacy,
});
#[cfg(not(target_os = "macos"))]
Ok(Self { current, other })
}
/// Whether any registration (user- or system-level) exists.
pub fn is_enabled(&self) -> Result<bool> {
#[cfg(target_os = "macos")]
return Ok(self.current.is_enabled().into_diagnostic()?
|| self.other.is_enabled().into_diagnostic()?
|| self.legacy.is_enabled().into_diagnostic()?);
#[cfg(not(target_os = "macos"))]
Ok(self.current.is_enabled().into_diagnostic()?
|| self.other.is_enabled().into_diagnostic()?)
}
/// Whether a registration at the *current* privilege level exists.
pub fn is_current_level_enabled(&self) -> Result<bool> {
self.current.is_enabled().into_diagnostic()
}
/// Whether a registration at the *other* privilege level exists.
/// Used to warn the user about cross-level mismatches.
/// On macOS, includes legacy entries for non-root callers (they are at a
/// different privilege level) but not for root callers (legacy is same level).
pub fn is_other_level_enabled(&self) -> Result<bool> {
#[cfg(target_os = "macos")]
return Ok(self.other.is_enabled().into_diagnostic()?
|| (!nix::unistd::Uid::effective().is_root()
&& self.legacy.is_enabled().into_diagnostic()?));
#[cfg(not(target_os = "macos"))]
self.other.is_enabled().into_diagnostic()
}
/// Remove legacy macOS LaunchAgentSystem entry if present and caller is root.
/// Idempotent — safe to call on every enable path, including retries after
/// partial migration (new entry written but legacy removal failed).
///
/// `migrated`: true when called after writing a new LaunchDaemonSystem entry
/// (full migration); false when just removing a stale leftover.
#[cfg(target_os = "macos")]
pub fn cleanup_legacy(&self, migrated: bool) -> Result<()> {
if nix::unistd::Uid::effective().is_root()
&& self.legacy.is_enabled().into_diagnostic()?
{
self.legacy.disable().into_diagnostic()?;
if migrated {
info!(
"migrated legacy system-level launch entry from /Library/LaunchAgents/ to /Library/LaunchDaemons/"
);
} else {
info!("removed legacy system-level launch entry from /Library/LaunchAgents/");
}
}
Ok(())
}
/// Register at the current privilege level.
///
/// Returns an error if a registration at the other privilege level already
/// exists, preventing user-level and system-level entries from coexisting.
///
/// On macOS, migrates any legacy LaunchAgentSystem entry (from pre-1.0.3)
/// to the correct LaunchDaemonSystem entry.
pub fn enable(&self) -> Result<()> {
// For root, legacy will be migrated so only check non-legacy other level.
// For non-root, legacy cannot be migrated and is also a conflict.
#[cfg(target_os = "macos")]
let other_conflict = if nix::unistd::Uid::effective().is_root() {
self.other.is_enabled().into_diagnostic()?
} else {
self.is_other_level_enabled()?
};
#[cfg(not(target_os = "macos"))]
let other_conflict = self.other.is_enabled().into_diagnostic()?;
if other_conflict {
miette::bail!(
"boot start is already registered at the other privilege level; \
run `pitchfork boot disable` (with appropriate privileges) to remove \
it first"
);
}
self.current.enable().into_diagnostic()?;
#[cfg(target_os = "macos")]
self.cleanup_legacy(true)?;
Ok(())
}
/// Remove registrations at *both* levels so cross-level leftovers are also
/// cleaned up. Also removes legacy macOS LaunchAgentSystem entries when
/// running as root. Returns Ok even if some entries could not be removed
/// due to insufficient privileges — callers should check is_enabled()
/// afterwards to detect incomplete cleanup.
pub fn disable(&self) -> Result<()> {
if self.current.is_enabled().into_diagnostic()? {
self.current.disable().into_diagnostic()?;
}
if self.other.is_enabled().into_diagnostic()? {
self.other.disable().into_diagnostic()?;
}
#[cfg(target_os = "macos")]
if nix::unistd::Uid::effective().is_root()
&& self.legacy.is_enabled().into_diagnostic()?
{
self.legacy.disable().into_diagnostic()?;
}
Ok(())
}
}
}
// ─── Unsupported platforms ────────────────────────────────────────────────
#[cfg(not(any(target_os = "macos", target_os = "linux", windows)))]
mod imp {
use crate::Result;
pub struct BootManager;
impl BootManager {
pub fn new() -> Result<Self> {
miette::bail!(
"boot management is not supported on this platform; \
only macOS, Linux, and Windows are supported"
)
}
pub fn is_enabled(&self) -> Result<bool> {
miette::bail!(
"boot management is not supported on this platform; \
only macOS, Linux, and Windows are supported"
)
}
pub fn is_current_level_enabled(&self) -> Result<bool> {
miette::bail!(
"boot management is not supported on this platform; \
only macOS, Linux, and Windows are supported"
)
}
pub fn is_other_level_enabled(&self) -> Result<bool> {
miette::bail!(
"boot management is not supported on this platform; \
only macOS, Linux, and Windows are supported"
)
}
pub fn enable(&self) -> Result<()> {
miette::bail!(
"boot management is not supported on this platform; \
only macOS, Linux, and Windows are supported"
)
}
pub fn disable(&self) -> Result<()> {
miette::bail!(
"boot management is not supported on this platform; \
only macOS, Linux, and Windows are supported"
)
}
}
}
pub use imp::BootManager;