[Unit]
Description=thought stream private inspector with bounded Review and course question sinks
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=%h/code/thought-stream
Environment=THOUGHTSTREAM_ROOT=%h/.local/share/thoughtstream/live
EnvironmentFile=-%h/.config/thoughtstream/credentials/inspector-review.env
EnvironmentFile=-%h/.config/thoughtstream/credentials/inspector-course-chat.env
ExecStart=%h/.nvm/versions/node/v22.19.0/bin/node --import tsx %h/code/thought-stream/src/cli.ts serve --host 127.0.0.1 --port 4317 --agent-context-root %h/.local/share/thoughtstream/telegram-agent-context
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=%h/.local/share/thoughtstream/live
ReadWritePaths=%h/.local/share/thoughtstream/telegram-agent-context
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
UMask=0077

[Install]
WantedBy=default.target