@murmurv2/cli 2.11.0

package/runtime/packages/setup/dist/src/platform/darwin.js

@@ -0,0 +1,270 @@
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import * as fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+const marker = "<!-- Managed by Murmur setup: darwin-v1 -->";
+const launchctl = "/bin/launchctl";
+const xml = (s) => s.replace(/[&<>"']/g, c => ({
+    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;",
+}[c]));
+function absolute(value, name) {
+    if (!path.isAbsolute(value) || /[\x00-\x1f\x7f]/.test(value) || path.normalize(value) !== value) {
+        throw new Error(`darwin-invalid-absolute-path:${name}`);
+    }
+    return value;
+}
+function validate(ctx) {
+    for (const key of ["dataDir", "configPath", "storePath", "repoRoot", "nodePath", "logDir"]) {
+        absolute(ctx[key], key);
+    }
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(ctx.serviceName)) {
+        throw new Error("darwin-invalid-service-name");
+    }
+    // The current daemon resolves both paths from DATA_DIR, ignoring STORE_PATH.
+    // Refuse an inconsistent context instead of starting against the wrong DB.
+    if (ctx.configPath !== path.join(ctx.dataDir, "agent-config.json") ||
+        ctx.storePath !== path.join(ctx.dataDir, "murmur.db") ||
+        ctx.logDir !== path.join(ctx.dataDir, "logs")) {
+        throw new Error("darwin-daemon-path-contract-mismatch");
+    }
+}
+const defaultRun = (file, args) => new Promise(resolve => {
+    execFile(file, args, {
+        encoding: "utf8", timeout: 8_000, maxBuffer: 512 * 1024,
+        env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
+    }, (error, stdout, stderr) => resolve({
+        code: error ? (typeof error.code === "number" ? error.code : -1) : 0,
+        stdout: String(stdout), stderr: String(stderr),
+    }));
+});
+const absent = (r) => r.code !== 0 &&
+    /Could not find service|Could not find specified service/.test(r.stderr + r.stdout);
+const baseSnapshot = () => ({
+    state: "unknown", manager: "launchd", since: null, pid: null,
+    lastExitCode: null, observedStorePath: null,
+    restartCount: null, restartWindowMs: null,
+});
+async function accessible(file, mode = constants.F_OK) {
+    try {
+        await fs.access(file, mode);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function createDarwinAdapter(options = {}) {
+    const home = absolute(options.homeDir ?? os.homedir(), "homeDir");
+    const uid = options.uid ?? process.getuid?.();
+    if (!Number.isSafeInteger(uid) || uid < 0)
+        throw new Error("darwin-invalid-user-id");
+    const env = options.env ?? process.env;
+    const run = options.run ?? defaultRun;
+    const domain = `gui/${uid}`;
+    const plistPath = (ctx) => path.join(home, "Library", "LaunchAgents", `${ctx.serviceName}.plist`);
+    const target = (ctx) => `${domain}/${ctx.serviceName}`;
+    const servicePath = (output) => /^\s*path = (.+)$/m.exec(output)?.[1]?.trim();
+    function plist(ctx) {
+        const args = [ctx.nodePath, path.join(ctx.repoRoot, "scripts", "murmur-daemon.mjs")];
+        const environment = {
+            DATA_DIR: ctx.dataDir,
+            MURMUR_STORE_PATH: ctx.storePath,
+            PATH: [path.dirname(ctx.nodePath), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(":"),
+        };
+        return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n${marker}\n<plist version="1.0"><dict>
+<key>Label</key><string>${xml(ctx.serviceName)}</string>
+<key>ProgramArguments</key><array>${args.map(x => `<string>${xml(x)}</string>`).join("")}</array>
+<key>WorkingDirectory</key><string>${xml(ctx.repoRoot)}</string>
+<key>EnvironmentVariables</key><dict>${Object.entries(environment).map(([k, v]) => `<key>${k}</key><string>${xml(v)}</string>`).join("")}</dict>
+<key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>10</integer>
+<key>StandardOutPath</key><string>${xml(path.join(ctx.logDir, `${ctx.serviceName}.out.log`))}</string>
+<key>StandardErrorPath</key><string>${xml(path.join(ctx.logDir, `${ctx.serviceName}.err.log`))}</string>
+</dict></plist>\n`;
+    }
+    async function readOwned(ctx) {
+        const file = plistPath(ctx);
+        try {
+            const stat = await fs.lstat(file);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error("darwin-refuse-nonregular-plist");
+            const content = await fs.readFile(file, "utf8");
+            if (!content.includes(marker))
+                throw new Error("darwin-refuse-unmanaged-plist");
+            return content;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async function inspect(ctx) {
+        return run(launchctl, ["print", target(ctx)]);
+    }
+    function requireSameLoadedPath(ctx, result) {
+        if (servicePath(result.stdout) !== plistPath(ctx))
+            throw new Error("darwin-refuse-other-loaded-service");
+    }
+    async function observedStore(pid, expected) {
+        const result = await run("/usr/sbin/lsof", ["-a", "-p", String(pid), "-Fn"]);
+        if (result.code !== 0)
+            return null;
+        let canonical;
+        try {
+            canonical = await fs.realpath(expected);
+        }
+        catch {
+            return null;
+        }
+        for (const line of result.stdout.split("\n")) {
+            if (!line.startsWith("n/"))
+                continue;
+            try {
+                if (await fs.realpath(line.slice(1)) === canonical)
+                    return canonical;
+            }
+            catch { /* closed file */ }
+        }
+        return null;
+    }
+    async function status(ctx) {
+        validate(ctx);
+        const value = baseSnapshot();
+        const result = await inspect(ctx);
+        if (absent(result))
+            return { ...value, state: "stopped", detail: "launchd service is not loaded" };
+        if (result.code !== 0)
+            return { ...value, detail: "launchctl could not inspect this user service" };
+        if (servicePath(result.stdout) !== plistPath(ctx))
+            return { ...value, detail: "loaded service path differs from the selected profile" };
+        const state = /^\s*state = (.+)$/m.exec(result.stdout)?.[1]?.trim();
+        const pid = Number(/^\s*pid = (\d+)$/m.exec(result.stdout)?.[1]);
+        const exitMatch = /^\s*last exit code = (-?\d+)$/m.exec(result.stdout);
+        value.lastExitCode = exitMatch ? Number(exitMatch[1]) : null;
+        if (state === "running" && Number.isSafeInteger(pid) && pid > 0) {
+            value.state = "running";
+            value.pid = pid;
+            const start = await run("/bin/ps", ["-p", String(pid), "-o", "lstart="]);
+            if (start.code === 0 && start.stdout.trim()) {
+                const parsed = Date.parse(start.stdout.trim() + " UTC");
+                if (Number.isFinite(parsed))
+                    value.since = new Date(parsed).toISOString();
+            }
+            value.observedStorePath = await observedStore(pid, ctx.storePath);
+        }
+        else if (value.lastExitCode !== null && value.lastExitCode !== 0) {
+            value.state = "failed";
+        }
+        else if (["waiting", "not running", "exited"].includes(state ?? "")) {
+            value.state = "stopped";
+        }
+        return value;
+    }
+    async function install(ctx) {
+        validate(ctx);
+        if (!await accessible(ctx.nodePath, constants.X_OK) ||
+            !await accessible(path.join(ctx.repoRoot, "scripts", "murmur-daemon.mjs"))) {
+            throw new Error("darwin-daemon-executable-missing");
+        }
+        const content = plist(ctx);
+        const previous = await readOwned(ctx);
+        if (previous === content)
+            return;
+        const loaded = await inspect(ctx);
+        if (!absent(loaded)) {
+            if (loaded.code === 0)
+                throw new Error("darwin-stop-service-before-install-update");
+            throw new Error("darwin-cannot-confirm-service-unloaded");
+        }
+        const file = plistPath(ctx);
+        await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o755 });
+        await fs.mkdir(ctx.logDir, { recursive: true, mode: 0o700 });
+        if (previous !== null)
+            await fs.writeFile(`${file}.backup-${randomUUID()}`, previous, { flag: "wx", mode: 0o600 });
+        const temporary = `${file}.tmp-${randomUUID()}`;
+        try {
+            await fs.writeFile(temporary, content, { flag: "wx", mode: 0o600 });
+            await fs.rename(temporary, file);
+        }
+        finally {
+            await fs.rm(temporary, { force: true });
+        }
+    }
+    async function start(ctx) {
+        validate(ctx);
+        if (await readOwned(ctx) !== plist(ctx))
+            throw new Error("darwin-install-required-for-current-profile");
+        const loaded = await inspect(ctx);
+        if (absent(loaded)) {
+            const result = await run(launchctl, ["bootstrap", domain, plistPath(ctx)]);
+            if (result.code !== 0)
+                throw new Error(`darwin-bootstrap-failed:${result.code}`);
+        }
+        else {
+            if (loaded.code !== 0)
+                throw new Error("darwin-cannot-inspect-service-before-start");
+            requireSameLoadedPath(ctx, loaded);
+        }
+        const result = await run(launchctl, ["kickstart", target(ctx)]);
+        if (result.code !== 0)
+            throw new Error(`darwin-kickstart-failed:${result.code}`);
+    }
+    async function stop(ctx) {
+        validate(ctx);
+        const loaded = await inspect(ctx);
+        if (absent(loaded))
+            return;
+        if (loaded.code !== 0)
+            throw new Error("darwin-cannot-inspect-service-before-stop");
+        requireSameLoadedPath(ctx, loaded);
+        if (await readOwned(ctx) !== plist(ctx))
+            throw new Error("darwin-stop-profile-mismatch");
+        const result = await run(launchctl, ["bootout", target(ctx)]);
+        if (result.code !== 0 && !absent(result))
+            throw new Error(`darwin-bootout-failed:${result.code}`);
+    }
+    async function detectClients(ctx) {
+        validate(ctx);
+        const appDirs = options.applicationDirs ?? ["/Applications", path.join(home, "Applications")];
+        async function hasApp(names, bundleId) {
+            for (const dir of appDirs)
+                for (const name of names) {
+                    const info = path.join(absolute(dir, "applicationDir"), name, "Contents", "Info.plist");
+                    if (!await accessible(info))
+                        continue;
+                    const result = await run("/usr/bin/plutil", ["-extract", "CFBundleIdentifier", "raw", info]);
+                    if (result.code === 0 && result.stdout.trim() === bundleId)
+                        return true;
+                }
+            return false;
+        }
+        const executableDirs = options.executableDirs?.map(p => absolute(p, "executableDir")) ?? [...new Set([
+                ...(env.PATH ?? "").split(":"), path.join(home, ".local", "bin"),
+                "/opt/homebrew/bin", "/usr/local/bin",
+            ].filter(p => path.isAbsolute(p) && !/[\x00-\x1f\x7f]/.test(p)))];
+        async function hasExecutable(name) {
+            for (const dir of executableDirs) {
+                const candidate = path.join(dir, name);
+                if (await accessible(candidate, constants.X_OK) && await fs.stat(candidate).then(s => s.isFile(), () => false))
+                    return true;
+            }
+            return false;
+        }
+        const codexHome = env.CODEX_HOME || path.join(home, ".codex");
+        const codexConfig = path.isAbsolute(codexHome) && !/[\x00-\x1f\x7f]/.test(codexHome)
+            ? path.join(codexHome, "config.toml") : null;
+        // Do not guess a writable MCP target for non-default Claude profiles.
+        // Shared setup may resolve it by a client-supported configuration query.
+        const claudeConfig = env.CLAUDE_CONFIG_DIR ? null : path.join(home, ".claude.json");
+        return [
+            { id: "claude-code", installed: await hasExecutable("claude"), configPath: claudeConfig, format: "json",
+                ...(claudeConfig === null ? { detail: "Custom CLAUDE_CONFIG_DIR detected; MCP config target requires client verification" } : {}) },
+            { id: "claude-desktop", installed: await hasApp(["Claude.app"], "com.anthropic.claudefordesktop"), configPath: path.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json"), format: "json" },
+            { id: "codex-cli", installed: await hasExecutable("codex"), configPath: codexConfig, format: "toml" },
+            { id: "codex-desktop", installed: await hasApp(["Codex.app", "ChatGPT.app"], "com.openai.codex"), configPath: codexConfig, format: "toml" },
+        ];
+    }
+    return { manager: "launchd", status, install, start, stop, detectClients };
+}

package/runtime/packages/setup/dist/src/platform/linux.d.ts

@@ -0,0 +1,9 @@
+import type { PlatformAdapter, ServiceContext } from "../types.js";
+export interface LinuxOptions {
+    homeDir?: string;
+    env?: NodeJS.ProcessEnv;
+    run?: (args: string[]) => Promise<string>;
+    procDir?: string;
+}
+export declare function renderLinuxUnit(c: ServiceContext): string;
+export declare function createLinuxAdapter(options?: LinuxOptions): PlatformAdapter;

package/runtime/packages/setup/dist/src/platform/linux.js

@@ -0,0 +1,176 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { constants } from "node:fs";
+import { access, mkdir, open, readdir, readlink, realpath, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+const exec = promisify(execFile);
+const marker = "# Managed by Murmur setup: systemd-v1\n";
+const unit = (c) => `${c.serviceName}.service`;
+const q = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
+const check = (c) => {
+    for (const value of [c.dataDir, c.configPath, c.storePath, c.repoRoot, c.nodePath, c.logDir]) {
+        if (!path.isAbsolute(value) || /[\x00-\x1f\x7f]/.test(value) || path.normalize(value) !== value)
+            throw new Error("service.invalid-path");
+    }
+    if (c.configPath !== path.join(c.dataDir, "agent-config.json") || c.storePath !== path.join(c.dataDir, "murmur.db")
+        || c.logDir !== path.join(c.dataDir, "logs"))
+        throw new Error("service.conflicting-store-path");
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,100}$/.test(c.serviceName))
+        throw new Error("service.invalid-name");
+};
+export function renderLinuxUnit(c) {
+    check(c);
+    // ExecStart expands $ independently from specifiers; Environment values do not.
+    const arg = (v) => q(v.replaceAll("$", () => "$$"));
+    return `${marker}[Unit]\nDescription=Murmur agent daemon\nStartLimitIntervalSec=60\nStartLimitBurst=5\n\n[Service]\nType=simple\nWorkingDirectory=${c.repoRoot.replaceAll("%", "%%")}\nEnvironment=${q(`DATA_DIR=${c.dataDir}`)}\nExecStart=${arg(c.nodePath)} ${arg(path.join(c.repoRoot, "scripts", "murmur-daemon.mjs"))}\nStandardOutput=append:${path.join(c.logDir, `${c.serviceName}.out.log`).replaceAll("%", "%%")}\nStandardError=append:${path.join(c.logDir, `${c.serviceName}.err.log`).replaceAll("%", "%%")}\nRestart=on-failure\nRestartSec=5\nUMask=0077\n\n[Install]\nWantedBy=default.target\n`;
+}
+export function createLinuxAdapter(options = {}) {
+    const env = options.env ?? process.env, home = options.homeDir ?? homedir();
+    const run = options.run ?? (async (args) => {
+        try {
+            return (await exec("systemctl", ["--user", ...args], { timeout: 5000, maxBuffer: 256 * 1024 })).stdout;
+        }
+        catch (e) {
+            const result = e;
+            if (args[0] === "show" && /^LoadState=not-found$/m.test(result.stdout ?? ""))
+                return result.stdout;
+            throw e;
+        }
+    });
+    const dir = path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "systemd", "user");
+    if (!path.isAbsolute(dir))
+        throw new Error("service.invalid-config-directory");
+    const target = (c) => path.join(dir, unit(c));
+    const inspect = async (c) => Object.fromEntries((await run(["show", unit(c), "--property=LoadState,ActiveState,SubState,MainPID,ExecMainStatus,ActiveEnterTimestamp,FragmentPath"]))
+        .trim().split("\n").filter(line => line.includes("=")).map(line => { const i = line.indexOf("="); return [line.slice(0, i), line.slice(i + 1)]; }));
+    const sameLoadedPath = (c, values) => {
+        if (values.LoadState !== "not-found" && values.FragmentPath !== target(c))
+            throw new Error("service.foreign-loaded-unit");
+    };
+    async function readOwned(c) {
+        let handle;
+        try {
+            handle = await open(target(c), constants.O_RDONLY | constants.O_NOFOLLOW);
+            const info = await handle.stat();
+            if (!info.isFile() || info.size > 65536 || info.uid !== process.getuid?.())
+                throw new Error("service.foreign-unit-file");
+            const text = await handle.readFile("utf8");
+            if (!text.startsWith(marker))
+                throw new Error("service.unmanaged-unit");
+            return text;
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return null;
+            throw e;
+        }
+        finally {
+            await handle?.close();
+        }
+    }
+    async function requireProfile(c) {
+        check(c);
+        sameLoadedPath(c, await inspect(c));
+        if (await readOwned(c) !== renderLinuxUnit(c))
+            throw new Error("service.profile-mismatch");
+    }
+    return {
+        manager: "systemd",
+        async status(c) {
+            check(c);
+            const result = { state: "unknown", manager: "systemd", since: null, pid: null,
+                lastExitCode: null, observedStorePath: null, restartCount: null, restartWindowMs: null };
+            let values;
+            try {
+                values = await inspect(c);
+                sameLoadedPath(c, values);
+            }
+            catch {
+                return { ...result, detail: "service.manager-or-profile-unavailable" };
+            }
+            if (values.LoadState === "not-found")
+                return { ...result, state: "stopped", detail: "service.not-installed" };
+            result.state = values.ActiveState === "failed" ? "failed" : values.ActiveState === "active" && values.SubState === "running" ? "running"
+                : values.ActiveState === "inactive" ? "stopped" : "unknown";
+            result.pid = Number(values.MainPID) > 0 ? Number(values.MainPID) : null;
+            result.lastExitCode = /^\d+$/.test(values.ExecMainStatus ?? "") ? Number(values.ExecMainStatus) : null;
+            const started = Date.parse(values.ActiveEnterTimestamp ?? "");
+            result.since = Number.isFinite(started) ? new Date(started).toISOString() : null;
+            if (result.pid) {
+                try {
+                    const expected = await realpath(c.storePath), fdDir = path.join(options.procDir ?? "/proc", String(result.pid), "fd");
+                    for (const fd of await readdir(fdDir)) {
+                        try {
+                            if (await readlink(path.join(fdDir, fd)) === expected) {
+                                result.observedStorePath = expected;
+                                break;
+                            }
+                        }
+                        catch { }
+                    }
+                }
+                catch { /* Inaccessible descriptors mean unverified, not guessed from config. */ }
+            }
+            return result;
+        },
+        async install(c) {
+            check(c);
+            const values = await inspect(c);
+            sameLoadedPath(c, values);
+            const previous = await readOwned(c), content = renderLinuxUnit(c);
+            if (previous !== content && !["inactive", "failed", undefined].includes(values.ActiveState))
+                throw new Error("service.stop-before-update");
+            await mkdir(dir, { recursive: true, mode: 0o700 });
+            await mkdir(c.logDir, { recursive: true, mode: 0o700 });
+            if (previous !== content) {
+                if (previous !== null)
+                    await writeFile(`${target(c)}.backup-${randomUUID()}`, previous, { flag: "wx", mode: 0o600 });
+                const temporary = `${target(c)}.${randomUUID()}.tmp`;
+                try {
+                    await writeFile(temporary, content, { flag: "wx", mode: 0o600 });
+                    await rename(temporary, target(c));
+                }
+                finally {
+                    await unlink(temporary).catch(() => { });
+                }
+            }
+            await run(["daemon-reload"]);
+            await run(["enable", unit(c)]);
+        },
+        async start(c) { await requireProfile(c); await run(["start", unit(c)]); },
+        async stop(c) {
+            check(c);
+            const values = await inspect(c);
+            if (values.LoadState === "not-found")
+                return;
+            await requireProfile(c);
+            await run(["stop", unit(c)]);
+        },
+        async detectClients() {
+            const rows = [];
+            for (const [id, command, configPath, format] of [
+                ["claude-code", "claude", env.CLAUDE_CONFIG_DIR ? null : path.join(home, ".claude.json"), "json"],
+                ["codex-cli", "codex", path.join(env.CODEX_HOME || path.join(home, ".codex"), "config.toml"), "toml"],
+            ]) {
+                let installed = false;
+                for (const candidate of (env.PATH ?? "").split(path.delimiter)) {
+                    if (!path.isAbsolute(candidate))
+                        continue;
+                    try {
+                        const file = path.join(candidate, command);
+                        await access(file, constants.X_OK);
+                        if ((await stat(file)).isFile()) {
+                            installed = true;
+                            break;
+                        }
+                    }
+                    catch { }
+                }
+                rows.push({ id, installed, configPath, format, ...(configPath === null ? { detail: "Custom Claude profile requires client verification" } : {}) });
+            }
+            return rows;
+        },
+    };
+}

package/runtime/packages/setup/dist/src/platform/windows.d.ts

@@ -0,0 +1,25 @@
+import type { PlatformAdapter } from '../types.js';
+export interface WindowsOptions {
+    helperPath?: string;
+    env?: NodeJS.ProcessEnv;
+    homeDir?: string;
+    canonicalize?: (value: string) => Promise<string>;
+    run?: (file: string, args: string[], options: {
+        env: NodeJS.ProcessEnv;
+        timeout: number;
+    }) => Promise<{
+        code: number;
+        stdout: string;
+        stderr: string;
+    }>;
+    /** true/false when the token's integrity level was measured, null when it could not be. */
+    elevated?: () => Promise<boolean | null>;
+}
+/**
+ * murmur-svc ends a failure with exactly one footer line `murmur-svc: reason=<key>` (LF). Only that
+ * strict last line is trusted and only its key is kept, case preserved; the rest of stderr may carry
+ * paths or OS text and is never read. Anything else keeps the old generic code.
+ */
+export declare function helperReason(stderr: string): string;
+/** Native SCM helper is the only service observer and mutator. No shell, PID guessing or registry fallback. */
+export declare function createWindowsAdapter(options?: WindowsOptions): PlatformAdapter;