@indykish/oracle 0.9.0

package/dist/src/browser/utils.js

@@ -0,0 +1,122 @@
+export function parseDuration(input, fallback) {
+    if (!input) {
+        return fallback;
+    }
+    const trimmed = input.trim();
+    if (!trimmed) {
+        return fallback;
+    }
+    const lowercase = trimmed.toLowerCase();
+    if (/^[0-9]+$/.test(lowercase)) {
+        return Number(lowercase);
+    }
+    const normalized = lowercase.replace(/\s+/g, '');
+    const singleMatch = /^([0-9]+)(ms|s|m|h)$/i.exec(normalized);
+    if (singleMatch && singleMatch[0].length === normalized.length) {
+        const value = Number(singleMatch[1]);
+        return convertUnit(value, singleMatch[2]);
+    }
+    const multiDuration = /([0-9]+)(ms|h|m|s)/g;
+    let total = 0;
+    let lastIndex = 0;
+    let match = multiDuration.exec(normalized);
+    while (match !== null) {
+        total += convertUnit(Number(match[1]), match[2]);
+        lastIndex = multiDuration.lastIndex;
+        match = multiDuration.exec(normalized);
+    }
+    if (total > 0 && lastIndex === normalized.length) {
+        return total;
+    }
+    return fallback;
+}
+function convertUnit(value, unitRaw) {
+    const unit = unitRaw?.toLowerCase();
+    switch (unit) {
+        case 'ms':
+            return value;
+        case 's':
+            return value * 1000;
+        case 'm':
+            return value * 60_000;
+        case 'h':
+            return value * 3_600_000;
+        default:
+            return value;
+    }
+}
+export function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export function estimateTokenCount(text) {
+    if (!text) {
+        return 0;
+    }
+    const words = text.trim().split(/\s+/).filter(Boolean);
+    const estimate = Math.max(words.length * 0.75, text.length / 4);
+    return Math.max(1, Math.round(estimate));
+}
+export async function withRetries(task, options = {}) {
+    const { retries = 2, delayMs = 250, onRetry } = options;
+    let attempt = 0;
+    while (attempt <= retries) {
+        try {
+            return await task();
+        }
+        catch (error) {
+            if (attempt === retries) {
+                throw error;
+            }
+            attempt += 1;
+            onRetry?.(attempt, error);
+            await delay(delayMs * attempt);
+        }
+    }
+    throw new Error('withRetries exhausted without result');
+}
+export function formatBytes(size) {
+    if (!Number.isFinite(size) || size < 0) {
+        return 'n/a';
+    }
+    if (size < 1024) {
+        return `${size} B`;
+    }
+    if (size < 1024 * 1024) {
+        return `${(size / 1024).toFixed(1)} KB`;
+    }
+    return `${(size / (1024 * 1024)).toFixed(1)} MB`;
+}
+/**
+ * Normalizes a ChatGPT URL, ensuring it is absolute, uses http/https, and trims whitespace.
+ * Falls back to the provided default when input is empty/undefined.
+ */
+export function normalizeChatgptUrl(raw, fallback) {
+    const candidate = raw?.trim();
+    if (!candidate) {
+        return fallback;
+    }
+    const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(candidate);
+    const withScheme = hasScheme ? candidate : `https://${candidate}`;
+    let parsed;
+    try {
+        parsed = new URL(withScheme);
+    }
+    catch {
+        throw new Error(`Invalid ChatGPT URL: "${raw}". Provide an absolute http(s) URL.`);
+    }
+    if (!/^https?:$/i.test(parsed.protocol)) {
+        throw new Error(`Invalid ChatGPT URL protocol: "${parsed.protocol}". Use http or https.`);
+    }
+    // Preserve user-provided path/query; URL#toString will normalize trailing slashes appropriately.
+    return parsed.toString();
+}
+export function isTemporaryChatUrl(url) {
+    try {
+        const parsed = new URL(url);
+        const value = (parsed.searchParams.get('temporary-chat') ?? '').trim().toLowerCase();
+        return value === 'true' || value === '1' || value === 'yes';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/browserMode.js

@@ -0,0 +1 @@
+export { runBrowserMode, CHATGPT_URL, DEFAULT_MODEL_STRATEGY, DEFAULT_MODEL_TARGET, parseDuration, normalizeChatgptUrl, isTemporaryChatUrl, } from './browser/index.js';

package/dist/src/cli/bridge/claudeConfig.js

@@ -0,0 +1,54 @@
+import chalk from 'chalk';
+import os from 'node:os';
+import path from 'node:path';
+import { loadUserConfig } from '../../config.js';
+import { resolveRemoteServiceConfig } from '../../remote/remoteServiceConfig.js';
+export async function runBridgeClaudeConfig(options) {
+    const { config: userConfig } = await loadUserConfig();
+    const resolved = resolveRemoteServiceConfig({
+        cliHost: undefined,
+        cliToken: undefined,
+        userConfig,
+        env: process.env,
+    });
+    const snippet = formatClaudeMcpConfig({
+        oracleHomeDir: process.env.ORACLE_HOME_DIR ?? path.join(os.homedir(), '.oracle-local'),
+        browserProfileDir: process.env.ORACLE_BROWSER_PROFILE_DIR ??
+            path.join(os.homedir(), '.oracle-local', 'browser-profile'),
+        remoteHost: resolved.host,
+        remoteToken: resolved.token,
+        includeToken: Boolean(options.printToken),
+    });
+    console.log(snippet);
+    if (!options.printToken) {
+        console.log('');
+        console.log(chalk.dim('Tip: rerun with --print-token to include ORACLE_REMOTE_TOKEN in the snippet.'));
+    }
+}
+export function formatClaudeMcpConfig({ oracleHomeDir, browserProfileDir, remoteHost, remoteToken, includeToken, }) {
+    const env = {};
+    // biome-ignore lint/complexity/useLiteralKeys: env vars are uppercase and include underscores.
+    env['ORACLE_ENGINE'] = 'browser';
+    // biome-ignore lint/complexity/useLiteralKeys: env vars are uppercase and include underscores.
+    env['ORACLE_HOME_DIR'] = oracleHomeDir;
+    // biome-ignore lint/complexity/useLiteralKeys: env vars are uppercase and include underscores.
+    env['ORACLE_BROWSER_PROFILE_DIR'] = browserProfileDir;
+    if (remoteHost) {
+        // biome-ignore lint/complexity/useLiteralKeys: env vars are uppercase and include underscores.
+        env['ORACLE_REMOTE_HOST'] = remoteHost;
+        // biome-ignore lint/complexity/useLiteralKeys: env vars are uppercase and include underscores.
+        env['ORACLE_REMOTE_TOKEN'] = includeToken ? remoteToken ?? '<YOUR_TOKEN>' : '<YOUR_TOKEN>';
+    }
+    // Claude Code supports project-scoped `.mcp.json` config files:
+    // https://docs.anthropic.com/en/docs/claude-code/mcp
+    return JSON.stringify({
+        mcpServers: {
+            oracle: {
+                type: 'stdio',
+                command: 'oracle-mcp',
+                args: [],
+                env,
+            },
+        },
+    }, null, 2);
+}

package/dist/src/cli/bridge/client.js

@@ -0,0 +1,73 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import chalk from 'chalk';
+import { configPath as defaultConfigPath } from '../../config.js';
+import { parseBridgeConnectionString, readBridgeConnectionArtifact, looksLikePath, } from '../../bridge/connection.js';
+import { readUserConfigFile, writeUserConfigFile } from '../../bridge/userConfigFile.js';
+import { checkRemoteHealth } from '../../remote/health.js';
+export async function runBridgeClient(options) {
+    const connectRaw = options.connect?.trim();
+    if (!connectRaw) {
+        throw new Error('Missing --connect. Provide a connection string or a bridge-connection.json path.');
+    }
+    const { remoteHost, remoteToken, tunnel } = await resolveConnection(connectRaw);
+    if (options.test !== false) {
+        const health = await checkRemoteHealth({ host: remoteHost, token: remoteToken, timeoutMs: 5000 });
+        if (!health.ok) {
+            const suffix = health.statusCode ? ` (HTTP ${health.statusCode})` : '';
+            throw new Error(`Remote service health check failed: ${health.error ?? 'unknown error'}${suffix}`);
+        }
+        console.log(chalk.green(`Remote service OK (${remoteHost})${health.version ? ` — oracle ${health.version}` : ''}`));
+    }
+    const configFilePath = options.config?.trim() || defaultConfigPath();
+    if (options.writeConfig !== false) {
+        const { config } = await readUserConfigFile(configFilePath);
+        const next = { ...config, browser: { ...(config.browser ?? {}) } };
+        next.browser = { ...(next.browser ?? {}) };
+        next.browser.remoteHost = remoteHost;
+        next.browser.remoteToken = remoteToken;
+        if (tunnel) {
+            next.browser.remoteViaSshReverseTunnel = {
+                ssh: tunnel.ssh,
+                remotePort: tunnel.remotePort,
+                localPort: tunnel.localPort,
+                identity: tunnel.identity,
+                extraArgs: tunnel.extraArgs,
+            };
+        }
+        await writeUserConfigFile(configFilePath, next);
+        console.log(chalk.green(`Wrote remote config to ${configFilePath}`));
+    }
+    console.log('');
+    console.log('Next:');
+    console.log(chalk.dim(`- oracle --engine browser -p "hello" --file README.md`));
+    if (options.printEnv) {
+        console.log('');
+        console.log('# Optional env overrides (paste into your shell):');
+        console.log(`export ORACLE_ENGINE=browser`);
+        console.log(`export ORACLE_REMOTE_HOST=${shellQuote(remoteHost)}`);
+        console.log(`export ORACLE_REMOTE_TOKEN=${shellQuote(remoteToken)}`);
+    }
+}
+async function resolveConnection(input) {
+    if (input.includes('://')) {
+        return { ...parseBridgeConnectionString(input) };
+    }
+    const resolvedPath = looksLikePath(input) ? path.resolve(process.cwd(), input) : null;
+    if (resolvedPath) {
+        const stat = await fs.stat(resolvedPath).catch(() => null);
+        if (stat?.isFile()) {
+            const artifact = await readBridgeConnectionArtifact(resolvedPath);
+            return { remoteHost: artifact.remoteHost, remoteToken: artifact.remoteToken, tunnel: artifact.tunnel };
+        }
+        if (stat) {
+            throw new Error(`--connect points to ${resolvedPath}, but it is not a file.`);
+        }
+        throw new Error(`Connection artifact not found at ${resolvedPath}`);
+    }
+    return { ...parseBridgeConnectionString(input) };
+}
+function shellQuote(value) {
+    // Single-quote for POSIX shells; safe for tokens/host strings.
+    return `'${value.replace(/'/g, `'"'"'`)}'`;
+}

package/dist/src/cli/bridge/codexConfig.js

@@ -0,0 +1,43 @@
+import chalk from 'chalk';
+import { loadUserConfig } from '../../config.js';
+import { resolveRemoteServiceConfig } from '../../remote/remoteServiceConfig.js';
+export async function runBridgeCodexConfig(options) {
+    const { config: userConfig } = await loadUserConfig();
+    const resolved = resolveRemoteServiceConfig({
+        cliHost: undefined,
+        cliToken: undefined,
+        userConfig,
+        env: process.env,
+    });
+    const snippet = formatCodexMcpSnippet({
+        remoteHost: resolved.host,
+        remoteToken: resolved.token,
+        includeToken: Boolean(options.printToken),
+    });
+    console.log(snippet);
+    if (!options.printToken) {
+        console.log('');
+        console.log(chalk.dim('Tip: rerun with --print-token to include ORACLE_REMOTE_TOKEN in the snippet.'));
+    }
+}
+export function formatCodexMcpSnippet({ remoteHost, remoteToken, includeToken, }) {
+    const hostValue = remoteHost ?? '127.0.0.1:9473';
+    const tokenValue = includeToken ? remoteToken ?? '<YOUR_TOKEN>' : '<YOUR_TOKEN>';
+    return [
+        '# ~/.codex/config.toml',
+        '',
+        '[mcp.servers.oracle]',
+        'command = "oracle-mcp"',
+        'args = []',
+        `env = { ORACLE_ENGINE = "browser", ORACLE_REMOTE_HOST = "${escapeTomlString(hostValue)}", ORACLE_REMOTE_TOKEN = "${escapeTomlString(tokenValue)}" }`,
+        '',
+        '# If you prefer npx:',
+        '# [mcp.servers.oracle]',
+        '# command = "npx"',
+        '# args = ["-y", "@steipete/oracle", "oracle-mcp"]',
+        `# env = { ORACLE_ENGINE = "browser", ORACLE_REMOTE_HOST = "${escapeTomlString(hostValue)}", ORACLE_REMOTE_TOKEN = "${escapeTomlString(tokenValue)}" }`,
+    ].join('\n');
+}
+function escapeTomlString(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}

package/dist/src/cli/bridge/doctor.js

@@ -0,0 +1,107 @@
+import os from 'node:os';
+import chalk from 'chalk';
+import { getCliVersion } from '../../version.js';
+import { loadUserConfig } from '../../config.js';
+import { resolveRemoteServiceConfig } from '../../remote/remoteServiceConfig.js';
+import { checkTcpConnection, checkRemoteHealth } from '../../remote/health.js';
+import { detectChromeBinary, detectChromeCookieDb } from '../../browser/detect.js';
+import { formatCodexMcpSnippet } from './codexConfig.js';
+export async function runBridgeDoctor(_options) {
+    const { config: userConfig, path: configPath, loaded } = await loadUserConfig();
+    const version = getCliVersion();
+    const resolvedRemote = resolveRemoteServiceConfig({
+        cliHost: undefined,
+        cliToken: undefined,
+        userConfig,
+        env: process.env,
+    });
+    const lines = [];
+    const fail = [];
+    const warn = [];
+    lines.push(chalk.bold('Bridge doctor'));
+    lines.push(chalk.dim(`OS: ${process.platform} ${os.release()} (${process.arch})`));
+    lines.push(chalk.dim(`Node: ${process.version}`));
+    lines.push(chalk.dim(`Oracle: ${version}`));
+    lines.push(chalk.dim(`Config: ${loaded ? configPath : '(missing)'}`));
+    if (userConfig.engine) {
+        lines.push(chalk.dim(`Default engine: ${userConfig.engine}`));
+    }
+    if (userConfig.model) {
+        lines.push(chalk.dim(`Default model: ${userConfig.model}`));
+    }
+    lines.push('');
+    lines.push(chalk.bold('Browser mode'));
+    if (resolvedRemote.host) {
+        lines.push(`Remote service: ${chalk.green('configured')}`);
+        lines.push(chalk.dim(`remoteHost: ${resolvedRemote.host} (${resolvedRemote.sources.host})`));
+        lines.push(chalk.dim(`remoteToken: ${resolvedRemote.token ? 'set' : 'missing'} (${resolvedRemote.sources.token})`));
+        const tcp = await checkTcpConnection(resolvedRemote.host, 2000);
+        if (tcp.ok) {
+            lines.push(chalk.dim(`TCP connect: ${chalk.green('ok')}`));
+        }
+        else {
+            fail.push(`Cannot reach ${resolvedRemote.host} (${tcp.error ?? 'unknown error'}).`);
+            lines.push(chalk.dim(`TCP connect: ${chalk.red(`failed (${tcp.error ?? 'unknown error'})`)}`));
+        }
+        if (!resolvedRemote.token) {
+            fail.push('Remote token is missing. Run `oracle bridge client --connect <...> --write-config` or set ORACLE_REMOTE_TOKEN.');
+        }
+        else if (tcp.ok) {
+            const health = await checkRemoteHealth({ host: resolvedRemote.host, token: resolvedRemote.token, timeoutMs: 5000 });
+            if (health.ok) {
+                const meta = health.version ? `oracle ${health.version}` : 'ok';
+                lines.push(chalk.dim(`Auth (/health): ${chalk.green(meta)}`));
+            }
+            else {
+                const detail = health.error ?? 'unknown error';
+                fail.push(`Remote auth failed: ${detail}`);
+                const suffix = health.statusCode ? `HTTP ${health.statusCode}` : 'network';
+                lines.push(chalk.dim(`Auth (/health): ${chalk.red(`${suffix} (${detail})`)}`));
+            }
+        }
+    }
+    else {
+        lines.push(`Remote service: ${chalk.yellow('not configured')}`);
+        const chrome = await detectChromeBinary();
+        if (chrome.path) {
+            lines.push(chalk.dim(`Chrome: ${chalk.green(chrome.path)}`));
+        }
+        else {
+            fail.push('No Chrome installation detected. Install Chrome/Chromium or set --browser-chrome-path.');
+            lines.push(chalk.dim(`Chrome: ${chalk.red('not found')}`));
+        }
+        if (process.platform === 'win32') {
+            warn.push('Cookie sync is disabled on Windows; use --browser-manual-login or run browser automation on another host.');
+            lines.push(chalk.dim('Cookies: (cookie sync disabled on Windows)'));
+        }
+        else {
+            const cookieDb = await detectChromeCookieDb({ profile: 'Default' });
+            if (cookieDb) {
+                lines.push(chalk.dim(`Cookies DB: ${chalk.green(cookieDb)}`));
+            }
+            else {
+                warn.push('Chrome cookies DB not detected. You may need --browser-cookie-path or --browser-manual-login.');
+                lines.push(chalk.dim(`Cookies DB: ${chalk.yellow('not found')}`));
+            }
+        }
+    }
+    lines.push('');
+    lines.push(chalk.bold('Codex MCP'));
+    lines.push(formatCodexMcpSnippet({ remoteHost: resolvedRemote.host, remoteToken: resolvedRemote.token, includeToken: false }));
+    if (warn.length) {
+        lines.push('');
+        lines.push(chalk.yellowBright('Warnings:'));
+        for (const message of warn) {
+            lines.push(chalk.yellow(`- ${message}`));
+        }
+    }
+    if (fail.length) {
+        lines.push('');
+        lines.push(chalk.redBright('Problems:'));
+        for (const message of fail) {
+            lines.push(chalk.red(`- ${message}`));
+        }
+    }
+    console.log(lines.join('\n'));
+    process.exitCode = fail.length ? 1 : 0;
+}

package/dist/src/cli/bridge/host.js

@@ -0,0 +1,259 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import chalk from 'chalk';
+import { getOracleHomeDir } from '../../oracleHome.js';
+import { parseHostPort, normalizeHostPort, formatBridgeConnectionString } from '../../bridge/connection.js';
+import { serveRemote } from '../../remote/server.js';
+export async function runBridgeHost(options) {
+    const bindRaw = options.bind?.trim() || '127.0.0.1:9473';
+    const { hostname: bindHost, port: bindPort } = parseHostPort(bindRaw);
+    const tokenRaw = options.token?.trim() || 'auto';
+    const token = tokenRaw === 'auto' ? randomBytes(16).toString('hex') : tokenRaw;
+    if (!token.trim()) {
+        throw new Error('Token is required (use --token auto to generate one).');
+    }
+    const writeConnectionPath = options.writeConnection?.trim() || path.join(getOracleHomeDir(), 'bridge-connection.json');
+    const sshTarget = options.ssh?.trim();
+    const sshRemotePort = typeof options.sshRemotePort === 'number' ? options.sshRemotePort : bindPort;
+    if (sshRemotePort <= 0 || sshRemotePort > 65_535) {
+        throw new Error(`Invalid --ssh-remote-port: ${sshRemotePort}. Expected 1-65535.`);
+    }
+    const connectionHostForClient = sshTarget ? normalizeHostPort('127.0.0.1', sshRemotePort) : normalizeHostPort(bindHost === '0.0.0.0' || bindHost === '::' ? '127.0.0.1' : bindHost, bindPort);
+    const artifact = await upsertConnectionArtifact(writeConnectionPath, {
+        remoteHost: connectionHostForClient,
+        remoteToken: token,
+        tunnel: sshTarget
+            ? {
+                ssh: sshTarget,
+                remotePort: sshRemotePort,
+                localPort: bindPort,
+                identity: options.sshIdentity?.trim() || undefined,
+                extraArgs: options.sshExtraArgs?.trim() || undefined,
+            }
+            : undefined,
+    });
+    if (options.printToken) {
+        console.log(token);
+    }
+    if (options.print) {
+        console.log(formatBridgeConnectionString({ remoteHost: artifact.remoteHost, remoteToken: token }, { includeToken: true }));
+    }
+    if (options.background) {
+        await spawnBridgeHostInBackground({
+            bind: bindRaw,
+            token,
+            writeConnectionPath,
+            sshTarget,
+            sshRemotePort,
+            sshIdentity: options.sshIdentity?.trim(),
+            sshExtraArgs: options.sshExtraArgs?.trim(),
+        });
+        return;
+    }
+    console.log(chalk.cyanBright('Bridge host starting...'));
+    console.log(chalk.dim(`- Local bind: ${normalizeHostPort(bindHost, bindPort)}`));
+    console.log(chalk.dim(`- Connection artifact: ${writeConnectionPath}`));
+    console.log(chalk.dim(`- Client remoteHost: ${artifact.remoteHost}`));
+    console.log(chalk.dim('Token stored in connection artifact (not printed). Use --print or --print-token if needed.'));
+    let tunnel = null;
+    if (sshTarget) {
+        tunnel = startReverseTunnel({
+            sshTarget,
+            remotePort: sshRemotePort,
+            localPort: bindPort,
+            identity: options.sshIdentity?.trim() || undefined,
+            extraArgs: options.sshExtraArgs?.trim() || undefined,
+            log: (msg) => console.log(chalk.dim(msg)),
+        });
+        console.log(chalk.dim(`Reverse SSH tunnel active (remote 127.0.0.1:${sshRemotePort} -> local 127.0.0.1:${bindPort})`));
+    }
+    const filteredServeLogger = (message) => {
+        if (message.includes('Access token:')) {
+            return;
+        }
+        console.log(message);
+    };
+    try {
+        await serveRemote({
+            host: bindHost,
+            port: bindPort,
+            token,
+            logger: filteredServeLogger,
+        });
+    }
+    finally {
+        tunnel?.stop();
+    }
+}
+async function upsertConnectionArtifact(filePath, input) {
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    const now = new Date().toISOString();
+    const existing = await fs.readFile(filePath, 'utf8').catch(() => null);
+    let createdAt = now;
+    if (existing) {
+        try {
+            const parsed = JSON.parse(existing);
+            if (typeof parsed.createdAt === 'string' && parsed.createdAt.trim().length > 0) {
+                createdAt = parsed.createdAt;
+            }
+        }
+        catch {
+            // ignore invalid previous content
+        }
+    }
+    const artifact = {
+        remoteHost: input.remoteHost,
+        remoteToken: input.remoteToken,
+        createdAt,
+        updatedAt: now,
+        tunnel: input.tunnel,
+    };
+    const contents = `${JSON.stringify(artifact, null, 2)}\n`;
+    const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+    await fs.writeFile(tempPath, contents, { encoding: 'utf8', mode: 0o600 });
+    await fs.rename(tempPath, filePath);
+    if (process.platform !== 'win32') {
+        await fs.chmod(filePath, 0o600).catch(() => undefined);
+    }
+    return artifact;
+}
+function startReverseTunnel({ sshTarget, remotePort, localPort, identity, extraArgs, log, }) {
+    let stopped = false;
+    let child = null;
+    let attempt = 0;
+    let timer = null;
+    const spawnOnce = () => {
+        if (stopped)
+            return;
+        const args = [
+            '-N',
+            '-R',
+            `${remotePort}:127.0.0.1:${localPort}`,
+            '-o',
+            'ExitOnForwardFailure=yes',
+            '-o',
+            'ServerAliveInterval=30',
+            '-o',
+            'ServerAliveCountMax=3',
+        ];
+        if (identity) {
+            args.push('-i', identity);
+        }
+        if (extraArgs) {
+            args.push(...splitArgs(extraArgs));
+        }
+        args.push(sshTarget);
+        child = spawn('ssh', args, { stdio: 'ignore' });
+        const pid = child.pid;
+        log(`[bridge host] ssh tunnel started${pid ? ` (pid ${pid})` : ''}: ${sshTarget}`);
+        child.once('exit', (code, signal) => {
+            child = null;
+            if (stopped)
+                return;
+            const label = signal ? `signal ${signal}` : `code ${code ?? 0}`;
+            const delayMs = Math.min(30_000, 1_000 * 2 ** attempt);
+            attempt += 1;
+            log(`[bridge host] ssh tunnel exited (${label}); restarting in ${delayMs}ms`);
+            timer = setTimeout(spawnOnce, delayMs);
+            timer.unref?.();
+        });
+    };
+    spawnOnce();
+    return {
+        stop: () => {
+            stopped = true;
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            if (child) {
+                child.removeAllListeners();
+                child.kill();
+                child = null;
+            }
+        },
+    };
+}
+function splitArgs(input) {
+    const args = [];
+    let current = '';
+    let quote = null;
+    const push = () => {
+        const trimmed = current.trim();
+        if (trimmed.length)
+            args.push(trimmed);
+        current = '';
+    };
+    for (let i = 0; i < input.length; i += 1) {
+        const ch = input[i] ?? '';
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            push();
+            continue;
+        }
+        current += ch;
+    }
+    push();
+    return args;
+}
+async function spawnBridgeHostInBackground({ bind, token, writeConnectionPath, sshTarget, sshRemotePort, sshIdentity, sshExtraArgs, }) {
+    const oracleHome = getOracleHomeDir();
+    await fs.mkdir(oracleHome, { recursive: true, mode: 0o700 });
+    const logPath = path.join(oracleHome, 'bridge-host.log');
+    const pidPath = path.join(oracleHome, 'bridge-host.pid');
+    const logHandle = await fs.open(logPath, 'a');
+    const stdio = ['ignore', logHandle.fd, logHandle.fd];
+    const scriptPath = process.argv[1];
+    if (!scriptPath) {
+        throw new Error('Unable to determine CLI entrypoint for background mode.');
+    }
+    const args = [
+        scriptPath,
+        'bridge',
+        'host',
+        '--foreground',
+        '--bind',
+        bind,
+        '--token',
+        token,
+        '--write-connection',
+        writeConnectionPath,
+    ];
+    if (sshTarget) {
+        args.push('--ssh', sshTarget);
+    }
+    if (typeof sshRemotePort === 'number') {
+        args.push('--ssh-remote-port', String(sshRemotePort));
+    }
+    if (sshIdentity) {
+        args.push('--ssh-identity', sshIdentity);
+    }
+    if (sshExtraArgs) {
+        args.push('--ssh-extra-args', sshExtraArgs);
+    }
+    const child = spawn(process.execPath, args, { detached: true, stdio });
+    child.unref();
+    await fs.writeFile(pidPath, `${child.pid ?? ''}\n`, { encoding: 'utf8', mode: 0o600 });
+    if (process.platform !== 'win32') {
+        await fs.chmod(pidPath, 0o600).catch(() => undefined);
+    }
+    await logHandle.close();
+    console.log(chalk.green(`Bridge host running in background (pid ${child.pid ?? '?'})`));
+    console.log(chalk.dim(`- Log: ${logPath}`));
+    console.log(chalk.dim(`- PID: ${pidPath}`));
+}