exec.zig

1// exec.zig — all process execution and SSH routing2// Commands call these functions; output is streamed or captured here.3const std = @import("std");4const builtin = @import("builtin");5const types = @import("types.zig");6const errors = @import("errors.zig");7const output = @import("output.zig");89// nixos-rebuild manages this profile; generation commands must target it10// explicitly. Bare nix-env defaults to the per-user profile, which is empty.11const SYSTEM_PROFILE = "/nix/var/nix/profiles/system";1213pub const RunResult = struct {14    stdout: []u8,15    stderr: []u8,16    exit_code: u8,17};1819// Run a process and capture stdout+stderr (not streaming).20pub fn capture(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine, cmd: []const []const u8) !RunResult {21    const argv = try buildArgv(gpa, machine, cmd);22    defer if (!machine.local) gpa.free(argv);2324    const result = std.process.run(gpa, io, .{ .argv = argv }) catch |e| {25        errors.error_info.setMessage("process failed: {s}", .{cmd[0]});26        return e;27    };2829    return .{30        .stdout = result.stdout,31        .stderr = result.stderr,32        .exit_code = switch (result.term) {33            .exited => |c| c,34            else => 1,35        },36    };37}3839// Run a process and stream its output to the terminal (inherit stdio).40pub fn stream(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, cmd: []const []const u8) !u8 {41    // The child inherits stdout and writes directly to the fd; flush any buffered42    // nina header first so it isn't reordered after the child's output.43    output.flush();44    const argv = try buildArgv(gpa, machine, cmd);45    defer if (!machine.local) gpa.free(argv);4647    var child = std.process.spawn(io, .{48        .argv = argv,49        .stdin = .inherit,50        .stdout = .inherit,51        .stderr = .inherit,52    }) catch |e| {53        errors.error_info.setMessage("failed to spawn: {s}", .{cmd[0]});54        return e;55    };5657    const term = child.wait(io) catch |e| {58        errors.error_info.setMessage("process wait failed", .{});59        return e;60    };6162    return switch (term) {63        .exited => |c| c,64        else => 1,65    };66}6768// Stream a local process with inherited stdio (no SSH routing — for nix commands).69pub fn streamLocal(io: std.Io, cmd: []const []const u8) !u8 {70    output.flush();71    var child = std.process.spawn(io, .{72        .argv = cmd,73        .stdin = .inherit,74        .stdout = .inherit,75        .stderr = .inherit,76    }) catch |e| {77        errors.error_info.setMessage("failed to spawn: {s}", .{cmd[0]});78        return e;79    };80    const term = child.wait(io) catch {81        errors.error_info.setMessage("process wait failed", .{});82        return error.ProcessFailed;83    };84    return switch (term) {85        .exited => |c| c,86        else => 1,87    };88}8990// Run a process and capture output as a single string (no SSH routing — for local nix commands).91pub fn captureLocal(gpa: std.mem.Allocator, io: std.Io, cmd: []const []const u8) ![]u8 {92    const result = std.process.run(gpa, io, .{ .argv = cmd }) catch return error.ProcessFailed;93    defer gpa.free(result.stderr);94    switch (result.term) {95        .exited => |c| if (c != 0) {96            gpa.free(result.stdout);97            return error.ProcessFailed;98        },99        else => {100            gpa.free(result.stdout);101            return error.ProcessFailed;102        },103    }104    return result.stdout;105}106107fn buildArgv(gpa: std.mem.Allocator, machine: *const types.Machine, cmd: []const []const u8) ![]const []const u8 {108    if (machine.local) return cmd;109110    const host = machine.host orelse {111        errors.error_info.setMessage("machine '{s}' has no host configured", .{machine.name});112        return error.SshFailed;113    };114115    var ssh: std.ArrayList([]const u8) = .empty;116    try ssh.append(gpa, "ssh");117    try ssh.append(gpa, "-o");118    try ssh.append(gpa, "BatchMode=yes");119    try ssh.append(gpa, "-o");120    try ssh.append(gpa, "StrictHostKeyChecking=accept-new");121    if (machine.ssh_key) |key| {122        try ssh.append(gpa, "-i");123        try ssh.append(gpa, key);124    }125    const addr = if (machine.user) |u|126        try std.fmt.allocPrint(gpa, "{s}@{s}", .{ u, host })127    else128        try gpa.dupe(u8, host);129    try ssh.append(gpa, addr);130    for (cmd) |arg| try ssh.append(gpa, arg);131    return ssh.toOwnedSlice(gpa);132}133134// --- NixOS rebuild ---135136pub fn nixosRebuildSwitch(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {137    const cmd = &.{ "sudo", "nixos-rebuild", "switch" };138    output.printSubstep("nixos-rebuild switch", .{});139    return stream(io, machine, gpa, cmd);140}141142pub fn nixosRebuildDryActivate(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {143    return stream(io, machine, gpa, &.{ "sudo", "nixos-rebuild", "dry-activate" });144}145146pub fn nixosRebuildBuild(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {147    return stream(io, machine, gpa, &.{ "sudo", "nixos-rebuild", "build" });148}149150// --- Generations ---151152// Read system-profile generations WITHOUT root. `nix-env --list-generations -p153// /nix/var/nix/profiles/system` takes a profile lock and fails as a normal user154// ("system.lock: Permission denied"). The generation symlinks themselves are155// world-readable, so list them directly: parse `system-N-link` names, take each156// link's own mtime for the date/time, and mark the one the `system` symlink157// points at as current. Output matches the `nix-env --list-generations` columns158// (num date time [current]) so parseGenerations is unchanged.159const GEN_LIST_SCRIPT =160    \\cur=$(readlink /nix/var/nix/profiles/system 2>/dev/null | sed 's/.*system-\([0-9]*\)-link/\1/'); find /nix/var/nix/profiles -maxdepth 1 -name 'system-*-link' -printf '%f %TY-%Tm-%Td %TH:%TM\n' 2>/dev/null | sed 's/system-\([0-9]*\)-link/\1/' | sort -n | awk -v c="$cur" '{ if ($1==c) print $0" current"; else print $0 }'161;162163pub fn getGenerations(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]types.GenerationInfo {164    const r = try capture(gpa, io, machine, &.{ "sh", "-c", GEN_LIST_SCRIPT });165    defer gpa.free(r.stderr);166    defer gpa.free(r.stdout);167    if (r.exit_code != 0) return error.ProcessFailed;168    return parseGenerations(gpa, r.stdout);169}170171fn parseGenerations(gpa: std.mem.Allocator, output_str: []const u8) ![]types.GenerationInfo {172    var gens: std.ArrayList(types.GenerationInfo) = .empty;173    var lines = std.mem.splitScalar(u8, output_str, '\n');174    while (lines.next()) |line| {175        const trimmed = std.mem.trim(u8, line, " \t");176        if (trimmed.len == 0) continue;177        var parts = std.mem.tokenizeAny(u8, trimmed, " \t");178        const num_str = parts.next() orelse continue;179        const date_str = parts.next() orelse continue;180        const time_str = parts.next() orelse continue;181        const rest = parts.rest();182        const current = std.mem.indexOf(u8, rest, "current") != null;183        const num = std.fmt.parseInt(u32, num_str, 10) catch continue;184        try gens.append(gpa, .{185            .number = num,186            .date = try gpa.dupe(u8, date_str),187            .time = try gpa.dupe(u8, time_str),188            .current = current,189        });190    }191    return gens.toOwnedSlice(gpa);192}193194pub fn getCurrentGeneration(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) !u32 {195    const gens = try getGenerations(gpa, io, machine);196    defer gpa.free(gens);197    for (gens) |g| {198        if (g.current) return g.number;199    }200    return 0;201}202203pub fn switchGeneration(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, n: u32) !u8 {204    // Switch the system profile to generation n, then activate it (bootloader +205    // services). Without switch-to-configuration the change isn't applied.206    const cmd = try std.fmt.allocPrint(gpa, "nix-env -p {s} --switch-generation {d} && {s}/bin/switch-to-configuration switch", .{ SYSTEM_PROFILE, n, SYSTEM_PROFILE });207    defer gpa.free(cmd);208    return stream(io, machine, gpa, &.{ "sudo", "sh", "-c", cmd });209}210211pub fn rollback(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {212    return stream(io, machine, gpa, &.{ "sudo", "nixos-rebuild", "switch", "--rollback" });213}214215pub fn deleteGeneration(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, n: u32) !u8 {216    const n_str = try std.fmt.allocPrint(gpa, "{d}", .{n});217    defer gpa.free(n_str);218    return stream(io, machine, gpa, &.{ "sudo", "nix-env", "-p", SYSTEM_PROFILE, "--delete-generations", n_str });219}220221pub fn deleteOldGenerations(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {222    return stream(io, machine, gpa, &.{ "sudo", "nix-env", "-p", SYSTEM_PROFILE, "--delete-generations", "old" });223}224225// --- Garbage collection ---226227pub fn collectGarbage(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, delete_old: bool, keep: u32) !u8 {228    if (delete_old) {229        return stream(io, machine, gpa, &.{ "sudo", "nix-collect-garbage", "-d" });230    }231    // Keep the `keep` most recent system generations (+N deletes all but N),232    // then collect now-unreferenced store paths. `--delete-older-than` wants a233    // duration (e.g. 14d), not a generation count.234    const cmd = try std.fmt.allocPrint(gpa, "nix-env -p {s} --delete-generations +{d} && nix-collect-garbage", .{ SYSTEM_PROFILE, keep });235    defer gpa.free(cmd);236    return stream(io, machine, gpa, &.{ "sudo", "sh", "-c", cmd });237}238239// --- Channels ---240241pub fn channelList(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]types.ChannelInfo {242    const r = try capture(gpa, io, machine, &.{ "nix-channel", "--list" });243    defer gpa.free(r.stderr);244    defer gpa.free(r.stdout);245    if (r.exit_code != 0) return error.ProcessFailed;246    return parseChannels(gpa, r.stdout);247}248249fn parseChannels(gpa: std.mem.Allocator, output_str: []const u8) ![]types.ChannelInfo {250    var channels: std.ArrayList(types.ChannelInfo) = .empty;251    var lines = std.mem.splitScalar(u8, output_str, '\n');252    while (lines.next()) |line| {253        const trimmed = std.mem.trim(u8, line, " \t\r");254        if (trimmed.len == 0) continue;255        const space = std.mem.indexOfScalar(u8, trimmed, ' ') orelse continue;256        try channels.append(gpa, .{257            .name = try gpa.dupe(u8, trimmed[0..space]),258            .url = try gpa.dupe(u8, std.mem.trim(u8, trimmed[space + 1 ..], " \t")),259        });260    }261    return channels.toOwnedSlice(gpa);262}263264pub fn channelUpdate(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {265    return stream(io, machine, gpa, &.{ "sudo", "nix-channel", "--update" });266}267268pub fn channelAdd(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, url: []const u8, name: []const u8) !u8 {269    return stream(io, machine, gpa, &.{ "sudo", "nix-channel", "--add", url, name });270}271272pub fn channelRemove(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, name: []const u8) !u8 {273    return stream(io, machine, gpa, &.{ "sudo", "nix-channel", "--remove", name });274}275276// --- Services ---277278pub fn serviceList(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]types.ServiceInfo {279    const r = try capture(gpa, io, machine, &.{ "systemctl", "list-units", "--type=service", "--no-legend", "--no-pager" });280    defer gpa.free(r.stderr);281    defer gpa.free(r.stdout);282    if (r.exit_code != 0) return error.ProcessFailed;283    return parseServices(gpa, r.stdout);284}285286fn parseServices(gpa: std.mem.Allocator, output_str: []const u8) ![]types.ServiceInfo {287    var svcs: std.ArrayList(types.ServiceInfo) = .empty;288    var lines = std.mem.splitScalar(u8, output_str, '\n');289    while (lines.next()) |line| {290        const trimmed = std.mem.trim(u8, line, " \t\r");291        if (trimmed.len == 0 or trimmed[0] == 0xE2) continue; // skip UTF-8 bullet lines292        var parts = std.mem.tokenizeAny(u8, trimmed, " \t");293        const name = parts.next() orelse continue;294        _ = parts.next(); // load295        const active_str = parts.next() orelse continue;296        const sub_str = parts.next() orelse "unknown";297298        const state: types.ServiceState = if (std.mem.eql(u8, active_str, "active"))299            (if (std.mem.eql(u8, sub_str, "running") or std.mem.eql(u8, sub_str, "exited")) .active else .active)300        else if (std.mem.eql(u8, active_str, "failed"))301            .failed302        else303            .inactive;304305        try svcs.append(gpa, .{306            .name = try gpa.dupe(u8, name),307            .state = state,308            .uptime = null,309        });310    }311    return svcs.toOwnedSlice(gpa);312}313314pub fn serviceCtl(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, verb: []const u8, name: []const u8) !u8 {315    // --no-pager: `systemctl status` pipes to a pager on a tty and would block.316    return stream(io, machine, gpa, &.{ "sudo", "systemctl", "--no-pager", verb, name });317}318319pub fn serviceLogs(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, name: []const u8, last: u32, follow: bool) !u8 {320    const n_str = try std.fmt.allocPrint(gpa, "{d}", .{last});321    defer gpa.free(n_str);322    if (follow) {323        return stream(io, machine, gpa, &.{ "journalctl", "-u", name, "-f" });324    }325    return stream(io, machine, gpa, &.{ "journalctl", "-u", name, "-n", n_str, "--no-pager" });326}327328// --- Profile ---329330pub fn profileInstall(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, attr: []const u8) !u8 {331    const pkg_ref = try std.fmt.allocPrint(gpa, "nixpkgs#{s}", .{attr});332    defer gpa.free(pkg_ref);333    return stream(io, machine, gpa, &.{ "nix", "profile", "install", pkg_ref });334}335336pub fn profileRemove(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, attr: []const u8) !u8 {337    // `nix profile remove` matches by profile element name (e.g. "ripgrep"), not338    // by flake ref — passing nixpkgs#ripgrep matches nothing.339    return stream(io, machine, gpa, &.{ "nix", "profile", "remove", attr });340}341342pub fn profileList(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]u8 {343    const r = try capture(gpa, io, machine, &.{ "nix", "profile", "list" });344    defer gpa.free(r.stderr);345    if (r.exit_code != 0) return error.ProcessFailed;346    return r.stdout;347}348349pub fn profileUpgrade(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {350    return stream(io, machine, gpa, &.{ "nix", "profile", "upgrade", ".*" });351}352353// --- Store ---354355pub fn storeGc(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {356    return stream(io, machine, gpa, &.{ "sudo", "nix-collect-garbage" });357}358359pub fn storeVerify(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {360    return stream(io, machine, gpa, &.{ "nix", "store", "verify", "--all" });361}362363pub fn storeRepair(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {364    return stream(io, machine, gpa, &.{ "sudo", "nix", "store", "repair", "--all" });365}366367pub fn storeInfo(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) !types.StoreInfo {368    // `nix path-info -S --all` computes the CLOSURE size of every path — O(paths^2)369    // graph work that takes minutes on a real store (59k+ paths) and hangs the370    // command. We don't need closures: `--all --json` (no -S) carries each path's371    // own narSize, so one fast pass gives the path count and the summed store size.372    // `du -sh /nix/store` is just as slow on a big store, so it's gone too.373    // timeout-wrapped so a pathological store degrades to "?" instead of hanging.374    const pi = try capture(gpa, io, machine, &.{ "sh", "-c", "timeout 90 nix path-info --all --json 2>/dev/null" });375    defer gpa.free(pi.stdout);376    defer gpa.free(pi.stderr);377378    const scan = scanStoreJson(pi.stdout);379    const total_owned = try humanSize(gpa, scan.total_bytes);380381    return .{382        .total_size = total_owned,383        .live_paths = scan.count,384        .reclaimable_paths = 0,385    };386}387388const StoreScan = struct { count: u64, total_bytes: u64 };389390// One linear pass over `nix path-info --json`: each path object has exactly one391// "narSize": field, so counting them gives the true path count and summing the392// values gives the total store size — no per-path closure walk.393fn scanStoreJson(json_str: []const u8) StoreScan {394    const needle = "\"narSize\":";395    var count: u64 = 0;396    var total: u64 = 0;397    var i: usize = 0;398    while (std.mem.indexOfPos(u8, json_str, i, needle)) |pos| {399        var j = pos + needle.len;400        while (j < json_str.len and json_str[j] == ' ') : (j += 1) {}401        var val: u64 = 0;402        var any = false;403        while (j < json_str.len and json_str[j] >= '0' and json_str[j] <= '9') : (j += 1) {404            val = val * 10 + (json_str[j] - '0');405            any = true;406        }407        if (any) {408            count += 1;409            total += val;410        }411        i = j;412    }413    return .{ .count = count, .total_bytes = total };414}415416fn humanSize(gpa: std.mem.Allocator, bytes: u64) ![]u8 {417    const units = [_][]const u8{ "B", "KB", "MB", "GB", "TB" };418    var val: f64 = @floatFromInt(bytes);419    var unit: usize = 0;420    while (val >= 1024.0 and unit + 1 < units.len) : (unit += 1) val /= 1024.0;421    if (unit == 0) return std.fmt.allocPrint(gpa, "{d} {s}", .{ bytes, units[0] });422    return std.fmt.allocPrint(gpa, "{d:.1} {s}", .{ val, units[unit] });423}424425pub fn storePath(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine, attr: []const u8) ![]u8 {426    // nixpkgs#<attr>, not .#<attr>: the package lives in nixpkgs (resolved via the427    // flake registry), not a flake in the current directory.428    const expr = try std.fmt.allocPrint(gpa, "nixpkgs#{s}.outPath", .{attr});429    defer gpa.free(expr);430    const r = try capture(gpa, io, machine, &.{ "nix", "eval", "--raw", expr });431    defer gpa.free(r.stderr);432    if (r.exit_code != 0) {433        gpa.free(r.stdout);434        return error.ProcessFailed;435    }436    return r.stdout;437}438439// --- Flake ---440441pub fn flakeUpdate(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, input: ?[]const u8) !u8 {442    if (input) |inp| {443        return stream(io, machine, gpa, &.{ "nix", "flake", "update", inp });444    }445    return stream(io, machine, gpa, &.{ "nix", "flake", "update" });446}447448pub fn flakeCheck(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {449    return stream(io, machine, gpa, &.{ "nix", "flake", "check" });450}451452pub fn flakeInit(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {453    return stream(io, machine, gpa, &.{ "nix", "flake", "init" });454}455456pub fn flakeLock(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {457    return stream(io, machine, gpa, &.{ "nix", "flake", "lock" });458}459460pub fn flakeClone(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, url: []const u8) !u8 {461    return stream(io, machine, gpa, &.{ "nix", "flake", "clone", url });462}463464pub fn flakeShow(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]u8 {465    const r = try capture(gpa, io, machine, &.{ "nix", "flake", "show", "--json" });466    defer gpa.free(r.stderr);467    if (r.exit_code != 0) {468        gpa.free(r.stdout);469        return error.ProcessFailed;470    }471    return r.stdout;472}473474// --- Build / Run / Develop ---475476pub fn nixBuild(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, attr: ?[]const u8) !u8 {477    if (attr) |a| {478        const ref = try std.fmt.allocPrint(gpa, ".#{s}", .{a});479        defer gpa.free(ref);480        return stream(io, machine, gpa, &.{ "nix", "build", ref });481    }482    return stream(io, machine, gpa, &.{ "nix", "build" });483}484485pub fn nixRun(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, pkg: []const u8) !u8 {486    // nix run always gets --no-write-lock-file for remote URLs487    const is_url = std.mem.startsWith(u8, pkg, "http://") or std.mem.startsWith(u8, pkg, "https://") or std.mem.startsWith(u8, pkg, "github:");488    if (is_url) {489        return stream(io, machine, gpa, &.{ "nix", "run", pkg, "--no-write-lock-file" });490    }491    // Already a flake ref (contains '#') → use as-is; bare name → default to nixpkgs#.492    if (std.mem.indexOfScalar(u8, pkg, '#') != null) {493        return stream(io, machine, gpa, &.{ "nix", "run", pkg });494    }495    const ref = try std.fmt.allocPrint(gpa, "nixpkgs#{s}", .{pkg});496    defer gpa.free(ref);497    return stream(io, machine, gpa, &.{ "nix", "run", ref });498}499500pub fn nixShell(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, pkg: []const u8) !u8 {501    const ref = try std.fmt.allocPrint(gpa, "nixpkgs#{s}", .{pkg});502    defer gpa.free(ref);503    return stream(io, machine, gpa, &.{ "nix", "shell", ref });504}505506pub fn nixDevelop(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, run_cmd: ?[]const u8) !u8 {507    if (run_cmd) |cmd| {508        // sh -c so a multi-word command isn't treated as a single executable name.509        return stream(io, machine, gpa, &.{ "nix", "develop", "--command", "sh", "-c", cmd });510    }511    return stream(io, machine, gpa, &.{ "nix", "develop" });512}513514pub fn nixRepl(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator) !u8 {515    return stream(io, machine, gpa, &.{ "nix", "repl", "--expr", "import <nixpkgs> {}" });516}517518// --- Format ---519520pub fn nixpkgsFmt(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, path: []const u8, check: bool) !u8 {521    if (check) {522        return stream(io, machine, gpa, &.{ "nixpkgs-fmt", "--check", path });523    }524    return stream(io, machine, gpa, &.{ "nixpkgs-fmt", path });525}526527// --- Info ---528529pub fn systemInfo(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]u8 {530    const r = try capture(gpa, io, machine, &.{"nixos-version"});531    defer gpa.free(r.stderr);532    if (r.exit_code != 0) {533        gpa.free(r.stdout);534        return error.ProcessFailed;535    }536    return r.stdout;537}538539pub fn kernelInfo(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]u8 {540    const r = try capture(gpa, io, machine, &.{ "uname", "-r" });541    defer gpa.free(r.stderr);542    if (r.exit_code != 0) {543        gpa.free(r.stdout);544        return error.ProcessFailed;545    }546    return r.stdout;547}548549pub fn uptimeInfo(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]u8 {550    const r = try capture(gpa, io, machine, &.{"uptime"});551    defer gpa.free(r.stderr);552    if (r.exit_code != 0) {553        gpa.free(r.stdout);554        return error.ProcessFailed;555    }556    return r.stdout;557}558559// --- Boot ---560561pub fn bootEntries(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]types.BootEntry {562    const r = try capture(gpa, io, machine, &.{ "bootctl", "list" });563    defer gpa.free(r.stderr);564    defer gpa.free(r.stdout);565    if (r.exit_code != 0) return error.ProcessFailed;566    return parseBootEntries(gpa, r.stdout);567}568569fn parseBootEntries(gpa: std.mem.Allocator, output_str: []const u8) ![]types.BootEntry {570    var entries: std.ArrayList(types.BootEntry) = .empty;571    var lines = std.mem.splitScalar(u8, output_str, '\n');572    while (lines.next()) |line| {573        const trimmed = std.mem.trim(u8, line, " \t\r");574        if (std.mem.startsWith(u8, trimmed, "title:")) {575            const title = std.mem.trim(u8, trimmed[6..], " \t");576            const current = std.mem.indexOf(u8, title, "(current)") != null;577            try entries.append(gpa, .{578                .title = try gpa.dupe(u8, title),579                .current = current,580            });581        }582    }583    return entries.toOwnedSlice(gpa);584}585586// --- Pkg info ---587588pub fn pkgWhy(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, pkg: []const u8) !u8 {589    return stream(io, machine, gpa, &.{ "nix", "why-depends", ".#", pkg });590}591592pub fn pkgDeps(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, pkg: []const u8) !u8 {593    return stream(io, machine, gpa, &.{ "nix-store", "--query", "--requisites", pkg });594}595596pub fn pkgSize(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine, pkg: []const u8) ![]u8 {597    const r = try capture(gpa, io, machine, &.{ "nix", "path-info", "-s", pkg });598    defer gpa.free(r.stderr);599    if (r.exit_code != 0) {600        gpa.free(r.stdout);601        return error.ProcessFailed;602    }603    return r.stdout;604}605606pub fn pkgClosure(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, pkg: []const u8) !u8 {607    return stream(io, machine, gpa, &.{ "nix", "path-info", "-rS", pkg });608}609610// --- Hash / Fetch ---611612pub fn nixHash(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine, path: []const u8) ![]u8 {613    const r = try capture(gpa, io, machine, &.{ "nix", "hash", "path", path });614    defer gpa.free(r.stderr);615    if (r.exit_code != 0) {616        gpa.free(r.stdout);617        return error.ProcessFailed;618    }619    return r.stdout;620}621622pub fn nixFetch(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine, url: []const u8) ![]u8 {623    const r = try capture(gpa, io, machine, &.{ "nix-prefetch-url", url });624    defer gpa.free(r.stderr);625    if (r.exit_code != 0) {626        gpa.free(r.stdout);627        return error.ProcessFailed;628    }629    return r.stdout;630}631632// --- Pin ---633634pub fn editFlakeLock(_: std.mem.Allocator, _: []const u8, _: []const u8) !void {635    // Stub: full implementation would parse and edit flake.lock JSON636    // The pin/unpin flow works via nix flake update which regenerates flake.lock637}638639pub fn openEditor(io: std.Io, gpa: std.mem.Allocator, editor: []const u8, path: []const u8, line: ?u32) !u8 {640    if (line) |l| {641        const line_arg = try std.fmt.allocPrint(gpa, "+{d}", .{l});642        defer gpa.free(line_arg);643        return stream(io, &types.Machine{}, gpa, &.{ editor, path, line_arg });644    }645    return stream(io, &types.Machine{}, gpa, &.{ editor, path });646}647648pub fn diffClosures(io: std.Io, machine: *const types.Machine, gpa: std.mem.Allocator, a: u32, b: u32) !u8 {649    const a_str = try std.fmt.allocPrint(gpa, "/nix/var/nix/profiles/system-{d}-link", .{a});650    defer gpa.free(a_str);651    const b_str = try std.fmt.allocPrint(gpa, "/nix/var/nix/profiles/system-{d}-link", .{b});652    defer gpa.free(b_str);653    return stream(io, machine, gpa, &.{ "nix", "store", "diff-closures", a_str, b_str });654}655656// --- Doctor checks ---657658pub fn runDoctorChecks(gpa: std.mem.Allocator, io: std.Io, machine: *const types.Machine) ![]types.DoctorCheck {659    var checks: std.ArrayList(types.DoctorCheck) = .empty;660661    // Check nix daemon662    {663        const r = try capture(gpa, io, machine, &.{ "systemctl", "is-active", "nix-daemon" });664        defer gpa.free(r.stdout);665        defer gpa.free(r.stderr);666        const active = std.mem.indexOf(u8, r.stdout, "active") != null;667        try checks.append(gpa, .{ .name = "nix daemon", .status = if (active) .ok else .fail });668    }669670    // Check config syntax671    {672        const r = try capture(gpa, io, machine, &.{ "sudo", "nixos-rebuild", "dry-build" });673        defer gpa.free(r.stdout);674        defer gpa.free(r.stderr);675        try checks.append(gpa, .{ .name = "config syntax", .status = if (r.exit_code == 0) .ok else .fail });676    }677678    // Check channel679    {680        const r = try capture(gpa, io, machine, &.{ "nix-channel", "--list" });681        defer gpa.free(r.stdout);682        defer gpa.free(r.stderr);683        const has_channel = r.exit_code == 0 and r.stdout.len > 0;684        try checks.append(gpa, .{ .name = "channel", .status = if (has_channel) .ok else .warn });685    }686687    return checks.toOwnedSlice(gpa);688}689690// --- Log ---691692pub fn readNinaLog(gpa: std.mem.Allocator, io: std.Io, environ: *const std.process.Environ.Map, last: u32) ![]u8 {693    const home = environ.get("HOME") orelse return error.FileNotFound;694    const path = try std.fmt.allocPrint(gpa, "{s}/.nina.log", .{home});695    defer gpa.free(path);696    _ = last;697    return std.Io.Dir.readFileAlloc(.cwd(), io, path, gpa, .unlimited) catch return error.FileNotFound;698}699700pub fn appendNinaLog(io: std.Io, environ: *const std.process.Environ.Map, entry: []const u8) void {701    const home = environ.get("HOME") orelse return;702    var path_buf: [512]u8 = undefined;703    const path = std.fmt.bufPrint(&path_buf, "{s}/.nina.log", .{home}) catch return;704    const file = std.Io.Dir.openFile(.cwd(), io, path, .{ .mode = .read_write }) catch705        (std.Io.Dir.createFile(.cwd(), io, path, .{}) catch return);706    defer file.close(io);707    const size = file.length(io) catch 0;708    file.writePositionalAll(io, entry, size) catch {};709}710711// --- Update helpers ---712713// Fetch a URL with curl and return the response body. Caller must free.714// error.NetworkError = DNS/connect failure; error.HttpError = non-2xx response.715pub fn fetchUrl(gpa: std.mem.Allocator, io: std.Io, url: []const u8) ![]u8 {716    const argv = [_][]const u8{717        "curl", "-s", "-L", "-w", "\nHTTP_STATUS:%{http_code}", "-m", "30", "--", url,718    };719    const result = std.process.run(gpa, io, .{ .argv = &argv }) catch return error.NetworkError;720    defer gpa.free(result.stderr);721722    const marker = "\nHTTP_STATUS:";723    const mark_idx = std.mem.lastIndexOf(u8, result.stdout, marker) orelse {724        gpa.free(result.stdout);725        return error.NetworkError;726    };727    const status_str = std.mem.trim(u8, result.stdout[mark_idx + marker.len ..], " \r\n");728    const status = std.fmt.parseInt(u16, status_str, 10) catch {729        gpa.free(result.stdout);730        return error.NetworkError;731    };732    if (status == 0) { gpa.free(result.stdout); return error.NetworkError; }733    if (status < 200 or status >= 300) { gpa.free(result.stdout); return error.HttpError; }734    const body = gpa.dupe(u8, result.stdout[0..mark_idx]) catch |e| {735        gpa.free(result.stdout);736        return e;737    };738    gpa.free(result.stdout);739    return body;740}741742// Download a URL to a temp file. Returns the temp path (caller must gpa.free).743// The file is written to /tmp/nina-update-<pid> and left for the caller to use.744pub fn downloadToTemp(gpa: std.mem.Allocator, io: std.Io, url: []const u8) ![]u8 {745    const tmp_path = try gpa.dupe(u8, "/tmp/nina-update.bin");746    errdefer gpa.free(tmp_path);747748    var child = std.process.spawn(io, .{749        .argv = &.{ "curl", "-fsSL", "-m", "300", "-o", tmp_path, "--", url },750        .stdin = .close,751        .stdout = .close,752        .stderr = .inherit,753    }) catch return error.NetworkError;754    const term = child.wait(io) catch return error.NetworkError;755    switch (term) {756        .exited => |c| if (c != 0) return error.NetworkError,757        else => return error.NetworkError,758    }759    return tmp_path;760}761762// Get the current executable path into buf. Returns slice of buf.763pub fn selfExePath(io: std.Io, buf: *[std.Io.Dir.max_path_bytes]u8) ![]const u8 {764    const len = try std.process.executablePath(io, buf);765    return buf[0..len];766}767768// Verify blake3 of tmp_path against expected_hex (raw hex, no prefix), then769// atomically install the binary to install_path. Errors: ChecksumMismatch,770// AccessDenied (with error_info set), or underlying I/O errors.771pub fn verifyAndInstall(gpa: std.mem.Allocator, io: std.Io, tmp_path: []const u8, expected_hex: []const u8, install_path: []const u8) !void {772    const bytes = std.Io.Dir.readFileAlloc(.cwd(), io, tmp_path, gpa, .unlimited) catch {773        errors.error_info.setMessage("downloaded file not found: {s}", .{tmp_path});774        return error.FileNotFound;775    };776    defer gpa.free(bytes);777778    var hasher = std.crypto.hash.Blake3.init(.{});779    hasher.update(bytes);780    var raw: [32]u8 = undefined;781    hasher.final(&raw);782    const hex = std.fmt.bytesToHex(raw, .lower);783    if (!std.mem.eql(u8, &hex, expected_hex)) return error.ChecksumMismatch;784785    var inst_tmp_buf: [std.Io.Dir.max_path_bytes + 8]u8 = undefined;786    const inst_tmp = std.fmt.bufPrint(&inst_tmp_buf, "{s}.new", .{install_path}) catch787        return error.NameTooLong;788789    {790        const f = std.Io.Dir.createFileAbsolute(io, inst_tmp, .{}) catch {791            errors.error_info.setMessage("cannot write to {s}", .{install_path});792            errors.error_info.setSuggestion("try: sudo nina update", .{});793            return error.AccessDenied;794        };795        defer f.close(io);796        f.writePositionalAll(io, bytes, 0) catch {797            errors.error_info.setMessage("cannot write to {s}", .{install_path});798            return error.AccessDenied;799        };800        try f.setPermissions(io, .fromMode(0o755));801    }802    errdefer std.Io.Dir.deleteFileAbsolute(io, inst_tmp) catch {};803804    if (comptime builtin.os.tag == .macos) {805        _ = captureLocal(gpa, io, &.{ "codesign", "-f", "-s", "-", inst_tmp }) catch {};806    }807808    std.Io.Dir.renameAbsolute(inst_tmp, install_path, io) catch |e| switch (e) {809        error.AccessDenied => {810            errors.error_info.setMessage("cannot replace {s}", .{install_path});811            errors.error_info.setSuggestion("try: sudo nina update", .{});812            return error.AccessDenied;813        },814        else => return e,815    };816}817818// --- Nix feature setup ---819820pub const NixFeatureStatus = struct {821    nix_command: bool = false,822    flakes: bool = false,823824    pub fn allEnabled(self: NixFeatureStatus) bool {825        return self.nix_command and self.flakes;826    }827};828829fn scanConfFeatures(conf: []const u8, status: *NixFeatureStatus) void {830    var lines = std.mem.splitScalar(u8, conf, '\n');831    while (lines.next()) |line| {832        const trimmed = std.mem.trim(u8, line, " \t");833        if (!std.mem.startsWith(u8, trimmed, "experimental-features")) continue;834        if (std.mem.indexOf(u8, trimmed, "nix-command") != null) status.nix_command = true;835        if (std.mem.indexOf(u8, trimmed, "flakes") != null) status.flakes = true;836    }837}838839pub fn checkNixFeatures(gpa: std.mem.Allocator, io: std.Io, environ: *const std.process.Environ.Map) NixFeatureStatus {840    var status = NixFeatureStatus{};841842    if (std.Io.Dir.readFileAlloc(.cwd(), io, "/etc/nix/nix.conf", gpa, .unlimited) catch null) |conf| {843        defer gpa.free(conf);844        scanConfFeatures(conf, &status);845    }846847    if (environ.get("HOME")) |home| {848        var buf: [512]u8 = undefined;849        const path = std.fmt.bufPrint(&buf, "{s}/.config/nix/nix.conf", .{home}) catch return status;850        if (std.Io.Dir.readFileAlloc(.cwd(), io, path, gpa, .unlimited) catch null) |conf| {851            defer gpa.free(conf);852            scanConfFeatures(conf, &status);853        }854    }855856    return status;857}858859pub fn isNixOS(io: std.Io) bool {860    const file = std.Io.Dir.openFile(.cwd(), io, "/etc/NIXOS", .{}) catch return false;861    file.close(io);862    return true;863}864865// Appends `experimental-features = nix-command flakes` to ~/.config/nix/nix.conf.866// Returns the path written (caller must free).867pub fn enableNixFeatures(gpa: std.mem.Allocator, io: std.Io, environ: *const std.process.Environ.Map) ![]const u8 {868    const home = environ.get("HOME") orelse {869        errors.error_info.setMessage("HOME not set", .{});870        return error.ConfigNotFound;871    };872873    const dir_path = try std.fmt.allocPrint(gpa, "{s}/.config/nix", .{home});874    defer gpa.free(dir_path);875    const file_path = try std.fmt.allocPrint(gpa, "{s}/.config/nix/nix.conf", .{home});876    errdefer gpa.free(file_path);877878    _ = captureLocal(gpa, io, &.{ "mkdir", "-p", dir_path }) catch {};879880    const line = "experimental-features = nix-command flakes\n";881    const file = std.Io.Dir.openFile(.cwd(), io, file_path, .{ .mode = .read_write }) catch882        (std.Io.Dir.createFile(.cwd(), io, file_path, .{}) catch {883        errors.error_info.setMessage("could not write {s}", .{file_path});884        return error.FileNotFound;885    });886    defer file.close(io);887888    const size = file.length(io) catch 0;889    file.writePositionalAll(io, line, size) catch {890        errors.error_info.setMessage("could not write {s}", .{file_path});891        return error.FileNotFound;892    };893894    return file_path;895}