@smoothbricks/nx-cache-server 0.0.0-stage → 0.1.1

package/package.json

@@ -1,6 +1,105 @@
 {
   "name": "@smoothbricks/nx-cache-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Nx-compatible task archive server with labelled principals, atomic never-replace publication, and filesystem SIEVE retention.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/smoothbricks/codebase.git",
+    "directory": "packages/nx-cache-server"
+  },
+  "main": "./dist/ts/index.js",
+  "module": "./dist/ts/index.js",
+  "types": "./dist/ts/index.d.ts",
+  "bin": {
+    "nx-cache-server": "./dist/ts/main.js"
+  },
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./dist/ts/index.d.ts",
+      "import": "./dist/ts/index.js",
+      "default": "./dist/ts/index.js"
+    }
+  },
+  "files": [
+    "dist/ts",
+    "dist/server",
+    "src",
+    "!**/*.test.ts",
+    "!**/__tests__/**",
+    "!**/*.tsbuildinfo"
+  ],
+  "dependencies": {
+    "tslib": "^2.8.1"
+  },
+  "devDependencies": {
+    "@smoothbricks/lmao": "0.5.4",
+    "typia": "14.0.6"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "nx run nx-cache-server:test --outputStyle=stream"
+  },
+  "nx": {
+    "name": "nx-cache-server",
+    "tags": [
+      "npm:public"
+    ],
+    "targets": {
+      "lint": {},
+      "test-warmup": {
+        "executor": "@smoothbricks/nx-plugin:bounded-exec",
+        "cache": false,
+        "options": {
+          "comment": "Build prerequisite for test, not a test: each TypeScript project test loads through the compiler preload compiles its own typia native plugin key, which takes minutes on a cold Go cache and would blow test's 180s idle bound before any test finishes (canonical 39038263857: build still active at idle expiry, compiler at 116.8% CPU, no test named). The 600s budget here is a build budget, not a test timeout increase. cache:false is load-bearing — the ttsc plugin cache lives outside Nx outputs, so a cached skip on a fresh runner would run the test cold again. Follows wire-warmup in packages/cowshed/package.json; uses the same compiler preload specifier as bunfig.toml. The trace preload is absent on purpose (its setup calls afterAll(), which throws outside `bun test`), so the script imports the LMAO test harness it loads instead: that module routes through LMAO's own project, a second plugin key (publish 39079862820 built it cold inside test).",
+          "command": "bun --preload @smoothbricks/lmao/bun/preload scripts/warm-ttsc-plugins.mjs",
+          "cwd": "{projectRoot}",
+          "timeoutMs": 600000,
+          "killAfterMs": 10000
+        }
+      },
+      "test": {
+        "executor": "@smoothbricks/nx-plugin:bounded-exec",
+        "dependsOn": [
+          "test-warmup"
+        ],
+        "options": {
+          "command": "bun test --timeout=0",
+          "cwd": "{projectRoot}",
+          "idleTimeoutMs": 180000,
+          "killAfterMs": 10000
+        }
+      },
+      "build": {
+        "dependsOn": [
+          "...",
+          "bundle"
+        ]
+      },
+      "bundle": {
+        "executor": "nx:run-commands",
+        "cache": true,
+        "inputs": [
+          "{projectRoot}/src/**/*.ts",
+          "!{projectRoot}/src/**/__tests__/**",
+          "{projectRoot}/package.json",
+          {
+            "runtime": "sh node_modules/@smoothbricks/nx-plugin/runtime-input.sh bun -e 'console.log(Bun.version, Bun.revision)'"
+          }
+        ],
+        "outputs": [
+          "{projectRoot}/dist/server/nx-cache-server.js"
+        ],
+        "options": {
+          "cwd": "{projectRoot}",
+          "command": "bun build --target=bun src/main.ts --outfile dist/server/nx-cache-server.js"
+        }
+      }
+    }
+  }
+}

package/src/__tests__/supervisor.fixture.ts

@@ -0,0 +1,15 @@
+import { fileURLToPath } from 'node:url';
+
+const main = fileURLToPath(new URL('../main.ts', import.meta.url));
+const flags = process.argv.includes('--exit-on-stdin-eof') ? ['--exit-on-stdin-eof'] : [];
+
+const child = Bun.spawn([process.execPath, main, ...flags], {
+  env: process.env,
+  stdin: 'pipe',
+  stdout: 'pipe',
+  stderr: 'inherit',
+});
+
+await Bun.write(Bun.stdout, `${JSON.stringify({ backendPid: child.pid })}\n`);
+await Bun.write(Bun.stdout, new Response(child.stdout));
+process.exit(await child.exited);

package/src/config.ts

@@ -0,0 +1,201 @@
+/// <reference types="node" />
+
+/**
+ * Startup configuration, read once from the environment and refused loudly when it cannot describe a
+ * server that is safe to run.
+ *
+ * A token is a `label:secret` pair, not a bare secret, because every audit line names the principal
+ * that read or published an artifact and no line may ever carry the secret itself. Capability rides
+ * with the token: `NX_CACHE_SERVER_WRITE_TOKENS` may publish, `NX_CACHE_SERVER_READ_TOKENS` may only
+ * read. That split is the CREEP mitigation (see the module header of `server.ts`): an untrusted
+ * context gets a read token and cannot reach the write path at all.
+ *
+ * Every refusal below names one wrong thing and the fix, and the problems are collected rather than
+ * thrown one at a time so a fresh operator sees the whole list in one start attempt.
+ */
+
+export type CacheCapability = 'read' | 'write';
+
+export interface CachePrincipal {
+  /** Audit name for this token. Appears in every log line the token produces; the secret never does. */
+  readonly label: string;
+  /** The exact `Authorization` header value this principal must present, precomputed at startup. */
+  readonly bearer: string;
+  readonly capability: CacheCapability;
+}
+
+export interface CacheServerConfig {
+  /** Absolute directory holding one file per cache key. */
+  readonly directory: string;
+  readonly host: string;
+  /** `0` asks the OS for a free port; the bound port is reported by `startCacheServer`. */
+  readonly port: number;
+  /** Largest artifact this server accepts, in bytes. */
+  readonly maxBytes: number;
+  /** Published archive retention cap, independent of the per-upload limit. */
+  readonly capBytes: number;
+  readonly principals: readonly CachePrincipal[];
+}
+
+export type CacheServerConfigResult =
+  | { readonly ok: true; readonly config: CacheServerConfig }
+  | { readonly ok: false; readonly problems: readonly string[] };
+
+/**
+ * Loopback by default: this server authenticates with a shared bearer token, so the address it binds
+ * is the difference between "the sheds on this host" and "the network". Widening it is an explicit
+ * act (`NX_CACHE_SERVER_HOST=0.0.0.0` or an interface address), never an accident of the default.
+ */
+export const DEFAULT_HOST = '127.0.0.1';
+export const DEFAULT_PORT = 8765;
+/**
+ * 1 GiB. The nx client builds the whole gzipped tarball in memory before it sends
+ * (`packages/nx/src/native/cache/http_remote_cache.rs`, `store`), so artifacts are already bounded by
+ * client RAM; this bound protects the server's disk from a client that is not nx.
+ */
+export const DEFAULT_MAX_BYTES = 1024 * 1024 * 1024;
+export const DEFAULT_CAP_BYTES = 10 * 1024 * 1024 * 1024;
+
+const MAX_PORT = 65_535;
+/** Lowercase, digits and dashes: a label is read by humans in logs and typed into a systemd unit. */
+const LABEL = /^[a-z0-9][a-z0-9-]{0,31}$/;
+
+const TOKEN_SOURCES: readonly (readonly [envName: string, capability: CacheCapability])[] = [
+  ['NX_CACHE_SERVER_WRITE_TOKENS', 'write'],
+  ['NX_CACHE_SERVER_READ_TOKENS', 'read'],
+];
+
+type Env = Readonly<Record<string, string | undefined>>;
+
+export function cacheServerConfigFromEnv(env: Env): CacheServerConfigResult {
+  const problems: string[] = [];
+  const directory = readDirectory(env, problems);
+  const port = readInteger(env, 'NX_CACHE_SERVER_PORT', DEFAULT_PORT, 0, MAX_PORT, problems);
+  const maxBytes = readInteger(
+    env,
+    'NX_CACHE_SERVER_MAX_BYTES',
+    DEFAULT_MAX_BYTES,
+    1,
+    Number.MAX_SAFE_INTEGER,
+    problems,
+  );
+  const capBytes = readInteger(
+    env,
+    'NX_CACHE_SERVER_CAP_BYTES',
+    DEFAULT_CAP_BYTES,
+    1,
+    Number.MAX_SAFE_INTEGER,
+    problems,
+  );
+  if (maxBytes !== undefined && capBytes !== undefined && maxBytes > capBytes) {
+    problems.push('NX_CACHE_SERVER_MAX_BYTES must not exceed NX_CACHE_SERVER_CAP_BYTES.');
+  }
+  const principals = readPrincipals(env, problems);
+  const configuredHost = env.NX_CACHE_SERVER_HOST?.trim();
+  const host = configuredHost === undefined || configuredHost === '' ? DEFAULT_HOST : configuredHost;
+
+  if (
+    problems.length > 0 ||
+    directory === undefined ||
+    port === undefined ||
+    maxBytes === undefined ||
+    capBytes === undefined ||
+    principals === undefined
+  ) {
+    return { ok: false, problems };
+  }
+  return { ok: true, config: { directory, host, port, maxBytes, capBytes, principals } };
+}
+
+function readDirectory(env: Env, problems: string[]): string | undefined {
+  const raw = env.NX_CACHE_SERVER_DIR?.trim();
+  if (raw === undefined || raw === '') {
+    problems.push(
+      'NX_CACHE_SERVER_DIR is not set. Name the directory that holds cache entries; there is no default because a wrong guess would start an empty cache that looks healthy.',
+    );
+    return undefined;
+  }
+  if (!raw.startsWith('/')) {
+    problems.push(
+      `NX_CACHE_SERVER_DIR=${JSON.stringify(raw)} must be an absolute path: a supervisor starts this process, and its working directory is not the operator's.`,
+    );
+    return undefined;
+  }
+  return raw;
+}
+
+function readInteger(
+  env: Env,
+  name: string,
+  fallback: number,
+  min: number,
+  max: number,
+  problems: string[],
+): number | undefined {
+  const raw = env[name]?.trim();
+  if (raw === undefined || raw === '') return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < min || value > max) {
+    problems.push(`${name}=${JSON.stringify(raw)} must be an integer between ${min} and ${max}.`);
+    return undefined;
+  }
+  return value;
+}
+
+function readPrincipals(env: Env, problems: string[]): readonly CachePrincipal[] | undefined {
+  const principals: CachePrincipal[] = [];
+  const labels = new Set<string>();
+  const secrets = new Set<string>();
+
+  for (const [envName, capability] of TOKEN_SOURCES) {
+    const raw = env[envName];
+    if (raw === undefined) continue;
+    const entries = raw.split(',');
+    entries.forEach((rawEntry, index) => {
+      const entry = rawEntry.trim();
+      if (entry === '') return;
+      // The position, never the entry: an entry without a colon is entirely secret.
+      const at = `${envName} entry ${index + 1}`;
+      const colon = entry.indexOf(':');
+      if (colon < 1) {
+        problems.push(
+          `${at} is not "label:secret". Every token carries a label so an audit line can name the principal that published an artifact without printing the token.`,
+        );
+        return;
+      }
+      const label = entry.slice(0, colon);
+      const secret = entry.slice(colon + 1);
+      if (!LABEL.test(label)) {
+        problems.push(
+          `${at} label ${JSON.stringify(label)} must match ${LABEL.source} — lowercase, digits and dashes.`,
+        );
+        return;
+      }
+      if (secret === '') {
+        problems.push(`${at} (label ${label}) has an empty secret.`);
+        return;
+      }
+      if (labels.has(label)) {
+        problems.push(`${at} reuses label ${label}. One label names one principal, or the audit log lies.`);
+        return;
+      }
+      if (secrets.has(secret)) {
+        problems.push(
+          `${at} (label ${label}) repeats a secret already configured for another principal. One secret maps to exactly one label and one capability.`,
+        );
+        return;
+      }
+      labels.add(label);
+      secrets.add(secret);
+      principals.push({ label, bearer: `Bearer ${secret}`, capability });
+    });
+  }
+
+  if (principals.length === 0) {
+    problems.push(
+      'No tokens configured. Set NX_CACHE_SERVER_WRITE_TOKENS and/or NX_CACHE_SERVER_READ_TOKENS to comma-separated "label:secret" entries; the write list may publish artifacts, the read list may only fetch them.',
+    );
+    return undefined;
+  }
+  return principals;
+}

package/src/gc.ts

@@ -0,0 +1,164 @@
+/// <reference types="bun" />
+// SIEVE eviction over the entry store, with the filesystem as the only state.
+//
+// An entry is written once (its mtime). readEntry explicitly marks atime past
+// mtime even on noatime mounts: `atime > mtime` is the visited bit. Clearing it is
+// setting atime back to mtime. Insertion order is mtime, and the hand is one
+// mtime cursor persisted beside the store. A sweep walks the ring from the hand:
+// a visited entry is cleared and skipped, an unvisited one is evicted, until the
+// store is under its cap. Scan resistance is the point — a burst of archives no
+// gate ever reads again cannot flush the entries every gate reads, which LRU
+// would let it do.
+import { lstat, readdir, readFile, rename, rm, utimes } from 'node:fs/promises';
+import { join } from 'node:path';
+import { logLine, logValue } from './log.js';
+import { type CacheStore, describe, entryPath, errnoOf, isCacheKey, openCacheStore } from './store.js';
+
+export interface Entry {
+  readonly path: string;
+  readonly mtimeMs: number;
+  readonly atimeMs: number;
+  readonly size: number;
+}
+
+export interface SweepOutcome {
+  readonly usedBefore: number;
+  readonly usedAfter: number;
+  readonly deleted: number;
+  readonly cleared: number;
+  readonly hand: number;
+}
+
+export interface Store {
+  list(): Promise<Entry[]>;
+  clearVisited(entry: Entry): Promise<void>;
+  evict(entry: Entry): Promise<void>;
+}
+
+export function insertionOrder(entries: readonly Entry[]): Entry[] {
+  return [...entries].sort((a, b) => a.mtimeMs - b.mtimeMs || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+
+/** One SIEVE sweep; `hand` is the mtime cursor from the previous sweep (0 = start). */
+export async function sweep(
+  store: Store,
+  capBytes: number,
+  hand: number,
+  protectedPath?: string,
+): Promise<SweepOutcome> {
+  const ring = insertionOrder(await store.list());
+  const usedBefore = ring.reduce((sum, e) => sum + e.size, 0);
+  let used = usedBefore;
+  let deleted = 0;
+  let cleared = 0;
+  let cursor = hand;
+  if (used > capBytes && ring.length > 0) {
+    // Walk from the hand, wrapping once; a full circuit clears every visited bit.
+    const start = ring.findIndex((e) => e.mtimeMs >= hand);
+    const order = start < 0 ? ring : [...ring.slice(start), ...ring.slice(0, start)];
+    for (let round = 0; round < 2 && used > capBytes; round++) {
+      for (const entry of order) {
+        if (used <= capBytes) break;
+        if (entry.path === protectedPath) continue;
+        const visited = entry.atimeMs > entry.mtimeMs;
+        // The second circuit visits only entries spared by the first, never already-deleted entries.
+        if (round === 1 && !visited) continue;
+        if (round === 0 && visited) {
+          await store.clearVisited(entry);
+          cleared++;
+        } else {
+          await store.evict(entry);
+          used -= entry.size;
+          deleted++;
+          cursor = entry.mtimeMs;
+        }
+      }
+    }
+  }
+  return { usedBefore, usedAfter: used, deleted, cleared, hand: cursor };
+}
+
+export function directoryStore(entries: string): Store {
+  return {
+    async list() {
+      const names = await readdir(entries);
+      const out: Entry[] = [];
+      for (const name of names) {
+        if (!isCacheKey(name)) continue;
+        const path = join(entries, name);
+        const s = await lstat(path);
+        if (s.isFile())
+          out.push({
+            path,
+            mtimeMs: s.mtimeMs,
+            atimeMs: s.atimeMs,
+            size: s.size,
+          });
+      }
+      return out;
+    },
+    async clearVisited(entry) {
+      await utimes(entry.path, entry.mtimeMs / 1000, entry.mtimeMs / 1000);
+    },
+    async evict(entry) {
+      await rm(entry.path, { force: true });
+    },
+  };
+}
+
+export type SweepResult =
+  | { readonly ok: true; readonly outcome: SweepOutcome }
+  | { readonly ok: false; readonly reason: string };
+
+/**
+ * Caller holds the store lease and serializes sweeps; only ENOENT means an absent hand, not
+ * unreadable/corrupt state. `protectedKey` names an archive that must survive this sweep.
+ */
+export async function sweepDirectory(store: CacheStore, capBytes: number, protectedKey?: string): Promise<SweepResult> {
+  const entries = store.directory;
+  const handFile = join(entries, '..', 'sieve.hand');
+  const temporary = `${handFile}.tmp`;
+  try {
+    let hand = 0;
+    try {
+      const text = (await readFile(handFile, 'utf8')).trim();
+      hand = Number(text);
+      if (text === '' || !Number.isFinite(hand) || hand < 0) {
+        return { ok: false, reason: `Invalid SIEVE cursor in ${handFile}.` };
+      }
+    } catch (cause) {
+      if (errnoOf(cause) !== 'ENOENT') return { ok: false, reason: describe(cause) };
+    }
+    const protectedPath = protectedKey === undefined ? undefined : entryPath(store, protectedKey);
+    const outcome = await sweep(directoryStore(entries), capBytes, hand, protectedPath);
+    await Bun.write(temporary, `${outcome.hand}\n`);
+    await rename(temporary, handFile);
+    logLine(
+      `ev=gc used_before=${outcome.usedBefore} used_after=${outcome.usedAfter} cap=${capBytes} deleted=${outcome.deleted} cleared=${outcome.cleared} hand=${outcome.hand}`,
+    );
+    return { ok: true, outcome };
+  } catch (cause) {
+    const reason = describe(cause);
+    logLine(`ev=gc.failed reason=${logValue(reason)}`);
+    return { ok: false, reason };
+  }
+}
+
+if (import.meta.main) {
+  const [entries, rawCap] = Bun.argv.slice(2);
+  const cap = Number(rawCap);
+  if (entries === undefined || !Number.isSafeInteger(cap) || cap < 1) {
+    console.error('usage: gc.ts <entries-dir> <positive-cap-bytes>');
+    process.exit(2);
+  }
+  const opened = await openCacheStore(entries);
+  if (!opened.ok) {
+    console.error(`nx-cache-gc refused: ${opened.path} is held by a running cache server (EWOULDBLOCK)`);
+    process.exit(1);
+  }
+  const result = await sweepDirectory(opened.store, cap).finally(() => opened.store.close());
+  if (!result.ok) {
+    console.error(`nx-cache-gc failed: ${result.reason}`);
+    process.exit(1);
+  }
+}

package/src/index.ts

@@ -0,0 +1,5 @@
+/** Nx-compatible opaque task archives, atomic publication, and filesystem SIEVE retention. */
+export * from './config.js';
+export * from './gc.js';
+export * from './server.js';
+export * from './store.js';

package/src/log.ts

@@ -0,0 +1,26 @@
+/**
+ * One line per event, logfmt, on stderr. stdout is reserved for the machine-readable readiness
+ * record consumed by the host supervisor. Every event names its key, principal label and outcome.
+ * The supervisor stamps and collects these events; the server owns no permanent text log.
+ *
+ * No secret ever appears here. A principal is named by its configured label (`config.ts`), never by
+ * its token, and every value that came from a request goes through `logValue` so a crafted cache key
+ * cannot forge a field or split one event across two lines.
+ */
+
+const PROGRAM = 'nx-cache-server';
+
+/** Values that need no quoting in logfmt: the cache-key charset plus the punctuation paths use. */
+const BARE_VALUE = /^[\w.:@/+-]+$/;
+
+export function logLine(fields: string): void {
+  console.error(`${PROGRAM} ${fields}`);
+}
+
+/**
+ * Render an untrusted string as one logfmt value. `JSON.stringify` is the escaping: it quotes,
+ * escapes inner quotes, and turns newlines into `\n` so an event stays on one line.
+ */
+export function logValue(value: string): string {
+  return BARE_VALUE.test(value) ? value : JSON.stringify(value);
+}

package/src/main.ts

@@ -0,0 +1,97 @@
+#!/usr/bin/env bun
+/// <reference types="bun" />
+
+/**
+ * The daemon entry point: read the environment, refuse to start on anything it cannot describe, serve
+ * until a signal arrives.
+ *
+ * stderr carries event logs and guidance; stdout carries one JSON startup record for the supervisor.
+ * Exit 2 is configuration refusal; exit 1 is operational startup failure.
+ *
+ *   NX_CACHE_SERVER_DIR=/srv/nx-cache \
+ *   NX_CACHE_SERVER_WRITE_TOKENS=ci:$SECRET \
+ *   NX_CACHE_SERVER_READ_TOKENS=shed:$OTHER \
+ *   bun src/main.ts
+ */
+
+import { cacheServerConfigFromEnv } from './config.js';
+import { logLine, logValue } from './log.js';
+import { type CacheServerReadyRecord, startCacheServer } from './server.js';
+import { describe } from './store.js';
+
+let exitOnStdinEof = false;
+const argumentProblems: string[] = [];
+for (let position = 2; position < Bun.argv.length; position++) {
+  if (Bun.argv[position] === '--exit-on-stdin-eof') {
+    exitOnStdinEof = true;
+  } else {
+    argumentProblems.push(
+      `argument ${position - 1} is unsupported; the only supported argument is --exit-on-stdin-eof`,
+    );
+  }
+}
+if (argumentProblems.length > 0) {
+  console.log(JSON.stringify({ kind: 'failed', stage: 'config', problems: argumentProblems }));
+  console.error('nx-cache-server refuses to start:');
+  for (const problem of argumentProblems) {
+    console.error(`  - ${problem}`);
+  }
+  process.exit(2);
+}
+
+const configured = cacheServerConfigFromEnv(Bun.env);
+if (!configured.ok) {
+  console.log(JSON.stringify({ kind: 'failed', stage: 'config', problems: configured.problems }));
+  console.error('nx-cache-server refuses to start:');
+  for (const problem of configured.problems) {
+    console.error(`  - ${problem}`);
+  }
+  process.exit(2);
+}
+
+const started = await startCacheServer(configured.config);
+if (!started.ok) {
+  console.log(JSON.stringify({ kind: 'failed', ...started }));
+  console.error(`nx-cache-server ${started.stage} failed in ${started.directory}: ${started.reason}`);
+  process.exit(1);
+}
+const running = started.server;
+console.log(
+  JSON.stringify({
+    kind: 'ready',
+    origin: running.origin,
+    port: running.port,
+    reclaimedStagingFiles: running.reclaimedStagingFiles,
+  } satisfies CacheServerReadyRecord),
+);
+
+/**
+ * Standard mode stops on SIGINT or SIGTERM. With `--exit-on-stdin-eof`, the parent that holds stdin
+ * stops the daemon by closing it; signals still stop it in both modes. A stop lets in-flight requests
+ * finish. An upload killed mid-body leaves only a staged file, which the next start reclaims — the
+ * published entry is never partial, because it only ever comes into existence by `link(2)`.
+ */
+let stopping = false;
+function stop(fields: string, exitCode = 0): void {
+  if (stopping) return;
+  stopping = true;
+  logLine(`ev=stopping ${fields}`);
+  void running.stop().then(
+    () => process.exit(exitCode),
+    (failure: unknown) => {
+      logLine(`ev=stop.failed reason=${logValue(describe(failure))}`);
+      process.exit(1);
+    },
+  );
+}
+for (const signal of ['SIGINT', 'SIGTERM'] as const) {
+  process.on(signal, () => stop(`signal=${signal}`));
+}
+if (exitOnStdinEof) {
+  process.stdin.once('end', () => stop('reason=supervisor-eof'));
+  process.stdin.once('error', (failure) => {
+    logLine(`ev=supervisor.error reason=${logValue(describe(failure))}`);
+    stop('reason=supervisor-error', 1);
+  });
+  process.stdin.resume();
+}