altd 0.0.3 → 0.0.5

package/dist/altd.js

@@ -1,132 +1,207 @@
-import {spawn} from 'child_process';
-import Tail from 'nodejs-tail';
+import { spawn as nodeSpawn } from "node:child_process";
+import Tail from "nodejs-tail";
+
 /**
- ** main class of AccessLogTailDispatcher
+ * Safe, modern dispatcher:
+ * - command is mapped to an absolute executable path (not user-provided)
+ * - args are validated per-command
+ * - rate limited
+ * - process is sandboxed-ish (no shell, timeout, limited output)
  */
 export default class AccessLogTailDispatcher {
-    /**
-     * @constructor
-     * @param {string} file access_log
-     * @param {Array} whitelist ['command1','command2'..]
-     */
-    constructor(file, whitelist) {
-        this.file = file;
-        this.whitelist = whitelist;
-        this.spawn = undefined;
-        this.tail = undefined;
-    }
-    /**
-     * Get the path from 'GET /path/to/dir HTTP'
-     * @param {string} line access_log
-     * @return {string} /path/to/dir
-     */
-    path(line) {
-        if (!(typeof line === 'string')) {
-            return '';
-        }
-        let match = line.match(
-            /GET\s((\/[a-z0-9-._~%!$&'()*+,;=:@?]+)+\/?)\sHTTP/i);
-        if (null !== match && match.length > 2) {
-            return match[1];
-        }
-        return '';
-    }
+  /**
+   * @param {string} file access_log
+   * @param {object} commandRegistry { [commandName]: { execPath: string, buildArgs: (rawArgs:string[])=>string[] } }
+   * @param {object} [opts]
+   */
+  constructor(file, commandRegistry, opts = {}) {
+    this.file = file;
+    this.registry = commandRegistry;
+
+    this.spawnImpl = opts.spawnImpl ?? nodeSpawn;
+    this.tail = opts.tail
+      ?? new Tail(file, {
+        alwaysStat: true,
+        ignoreInitial: true,
+        persistent: true,
+      });
+
+    // Simple rate limit: max N executions per windowMs
+    this.windowMs = opts.windowMs ?? 1000;
+    this.maxPerWindow = opts.maxPerWindow ?? 5;
+    this._windowStart = Date.now();
+    this._countInWindow = 0;
+
+    // Process limits
+    this.timeoutMs = opts.timeoutMs ?? 10_000;
+    this.maxStdoutBytes = opts.maxStdoutBytes ?? 64 * 1024;
+  }
+
+  /**
+   * Extract request path from a typical access log line.
+   * More robust: parse "METHOD <url> HTTP/..."
+   * @param {string} line
+   * @returns {string} pathname like "/a/b"
+   */
+  extractPath(line) {
+    if (typeof line !== "string" || line.length > 10_000) return "";
 
-    /**
-     * Extract command and args
-     * @param {string} path
-     * @return {Array} [command,arg1,arg2...]
-     */
-    commandWithArgs(path) {
-        if (!(typeof path === 'string')) {
-            return [];
-        }
-        let commands = path.split(/\//).map(function(element, index, array) {
-            let ret = "";
-            try{
-              ret = decodeURIComponent(element);
-            }catch(e){
-              console.error(e);
-            }
-            return ret;
-        });
-        commands.shift();
-        return commands;
+    // Find something like: GET /foo/bar HTTP/1.1
+    const m = line.match(
+      /\b(GET|POST|PUT|DELETE|HEAD|OPTIONS)\s+(\S+)\s+HTTP\/\d(?:\.\d)?\b/i,
+    );
+    if (!m) return "";
+
+    const rawTarget = m[2];
+
+    // rawTarget can be absolute URL or origin-form. Normalize via URL.
+    // If it's origin-form "/x", give it a dummy base.
+    let url;
+    try {
+      url = rawTarget.startsWith("/")
+        ? new URL(rawTarget, "http://localhost")
+        : new URL(rawTarget);
+    } catch {
+      return "";
     }
 
-    /**
-     * Filter by whitelist
-     * @param {Array} commandWithArgs [command,arg1,arg2...]
-     * @param {Array} whitelist ['command1','command2'...]
-     * @return {Array} filtered commandWithArgs
-     */
-    filterByWhitelist(commandWithArgs, whitelist) {
-        if (!this.isArray(commandWithArgs) ||
-            !this.isArray(whitelist) ||
-            commandWithArgs.length == 0 ||
-            whitelist.indexOf(commandWithArgs[0]) == -1
-        ) {
-            return [];
-        }
-        return commandWithArgs;
+    // Only use pathname; ignore query/hash to reduce attack surface.
+    return url.pathname || "";
+  }
+
+  /**
+   * "/cmd/a/b" -> ["cmd","a","b"] (safe decode, size limits)
+   * @param {string} pathname
+   * @returns {string[]}
+   */
+  parseCommand(pathname) {
+    if (typeof pathname !== "string" || pathname === "" || pathname.length > 2048) {
+      return [];
     }
+    if (!pathname.startsWith("/")) return [];
 
-    /**
-     * Dispatch
-     * @param {Array} commandWithArgs [command,arg1,arg2...]
-     */
-    dispatch(commandWithArgs) {
-        if (commandWithArgs.length == 0) {
-            return;
-        }
-        let command = commandWithArgs.shift();
-        let proc = this.spawn(command, commandWithArgs);
-        proc.on('error', (err) => {
-            console.error(err);
-        });
-        proc.stdout.on('data', (data) => {
-            process.stdout.write(data.toString());
-        });
+    const parts = pathname.split("/").filter(Boolean);
+    if (parts.length === 0) return [];
+
+    // Safe decode each segment; if decode fails, reject the whole request.
+    const decoded = [];
+    for (const p of parts) {
+      if (p.length > 256) return [];
+      try {
+        decoded.push(decodeURIComponent(p));
+      } catch {
+        return [];
+      }
     }
+    return decoded;
+  }
 
-    /**
-     * isArray
-     * @param {object} obj [command,arg1,arg2...]
-     * @return {boolean}
-     */
-    isArray(obj) {
-        return Object.prototype.toString.call(obj) === '[object Array]';
+  /**
+   * Basic rate limit to avoid log-triggered fork bombs.
+   * @returns {boolean} allowed
+   */
+  allowByRateLimit() {
+    const now = Date.now();
+    if (now - this._windowStart >= this.windowMs) {
+      this._windowStart = now;
+      this._countInWindow = 0;
     }
+    this._countInWindow += 1;
+    return this._countInWindow <= this.maxPerWindow;
+  }
+
+  /**
+   * Validate + build exec + args using registry
+   * @param {string[]} parsed ["cmd", ...rawArgs]
+   * @returns {{execPath:string,args:string[]}|null}
+   */
+  resolveExecution(parsed) {
+    if (!Array.isArray(parsed) || parsed.length === 0) return null;
+
+    const [cmd, ...rawArgs] = parsed;
 
-    /**
-     * run
-     * @param {string} file
-     * @param {Array} whitelist ['command1','command2'...]
-     */
-    run(file, whitelist) {
-        if ( typeof file !== 'undefined') {
-            this.file = file;
-        }
-        if ( typeof whitelist !== 'undefined') {
-            this.whitelist = whitelist;
-        }
-        if ( typeof this.spawn === 'undefined') {
-            this.spawn = spawn;
-        }
-        if ( typeof this.tail === 'undefined') {
-            this.tail = new Tail(this.file,
-                {alwaysStat: true, ignoreInitial: true, persistent: true});
-        }
-        this.tail.on('line', (line) => {
-            this.dispatch(
-                this.filterByWhitelist(
-                    this.commandWithArgs(
-                        this.path(line)),
-                    this.whitelist));
-        });
-        this.tail.on('close', () => {
-            console.log('watching stopped');
-        });
-        this.tail.watch();
+    const entry = this.registry[cmd];
+    if (!entry) return null;
+
+    // Build args via per-command validator
+    let args;
+    try {
+      args = entry.buildArgs(rawArgs);
+    } catch {
+      return null;
     }
+    if (!Array.isArray(args)) return null;
+
+    return { execPath: entry.execPath, args };
+  }
+
+  /**
+   * Spawn with limits
+   * @param {string} execPath
+   * @param {string[]} args
+   */
+  spawnLimited(execPath, args) {
+    const proc = this.spawnImpl(execPath, args, {
+      shell: false,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        // Minimal env is often safer; adjust as needed
+        PATH: process.env.PATH ?? "",
+      },
+    });
+
+    // Timeout
+    const t = setTimeout(() => {
+      proc.kill("SIGKILL");
+    }, this.timeoutMs);
+    proc.on("exit", () => clearTimeout(t));
+
+    // Output limiting
+    let outBytes = 0;
+    proc.stdout.on("data", (buf) => {
+      outBytes += buf.length;
+      if (outBytes > this.maxStdoutBytes) {
+        proc.kill("SIGKILL");
+        return;
+      }
+      process.stdout.write(buf);
+    });
+
+    proc.stderr.on("data", (buf) => {
+      process.stderr.write(buf);
+    });
+
+    proc.on("error", (err) => {
+      console.error("[spawn error]", err);
+    });
+  }
+
+  /**
+   * Start watching
+   */
+  run() {
+    this.tail.on("line", (line) => {
+      if (!this.allowByRateLimit()) return;
+
+      const pathname = this.extractPath(line);
+      const parsed = this.parseCommand(pathname);
+      const exec = this.resolveExecution(parsed);
+      if (!exec) return;
+
+      this.spawnLimited(exec.execPath, exec.args);
+    });
+
+    this.tail.on("close", () => {
+      console.log("watching stopped");
+    });
+
+    this.tail.watch();
+  }
+
+  stop() {
+    try {
+      this.tail.unwatch?.();
+    } catch {}
+  }
 }

package/dist/index.js

@@ -1,10 +1,66 @@
 #!/usr/bin/env node
+import { accessSync, constants } from 'node:fs';
+import { createRequire } from 'node:module';
+import { delimiter, isAbsolute, join } from 'node:path';
 import { Command } from 'commander';
-import pkg from './package.json' assert { type: 'json' };
 import AccessLogTailDispatcher from './altd.js';
 
+const require = createRequire(import.meta.url);
+const pkg = require('../package.json');
+
 const program = new Command();
 
+const resolveExecPath = (command) => {
+  if (!command || typeof command !== 'string') return null;
+  if (isAbsolute(command)) {
+    try {
+      accessSync(command, constants.X_OK);
+      return command;
+    } catch {
+      return null;
+    }
+  }
+
+  const searchPaths = (process.env.PATH ?? '').split(delimiter);
+  for (const dir of searchPaths) {
+    if (!dir) continue;
+    const candidate = join(dir, command);
+    try {
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+      // continue
+    }
+  }
+  return null;
+};
+
+const buildRegistry = (whitelist) => {
+  const registry = {};
+  for (const command of whitelist) {
+    const execPath = resolveExecPath(command);
+    if (!execPath) {
+      console.warn(`[altd] skip command: ${command}`);
+      continue;
+    }
+    registry[command] = {
+      execPath,
+      buildArgs: (rawArgs) => {
+        if (!Array.isArray(rawArgs) || rawArgs.length > 20) {
+          throw new Error('invalid args');
+        }
+        for (const arg of rawArgs) {
+          if (typeof arg !== 'string' || arg.length > 256) {
+            throw new Error('invalid args');
+          }
+        }
+        return rawArgs;
+      },
+    };
+  }
+  return registry;
+};
+
 program
   .name('altd')
   .version(pkg.version)
@@ -13,17 +69,23 @@ program
   .option(
     '-w, --whitelist <commands>',
     'Add commands to whitelist',
-    (commands) => commands.split(',')
+    (commands) => commands.split(',').map((command) => command.trim()).filter(Boolean)
   )
   .parse(process.argv);
 
 const fileValue = program.args[0];
 const { whitelist } = program.opts();
 
-if (!fileValue || !whitelist) {
+if (!fileValue || !whitelist || whitelist.length === 0) {
   console.log('altd <file> -w <commands...>');
   process.exit(1);
 }
 
-const altd = new AccessLogTailDispatcher(fileValue, whitelist);
+const registry = buildRegistry(whitelist);
+if (Object.keys(registry).length === 0) {
+  console.error('[altd] no valid commands to run');
+  process.exit(1);
+}
+
+const altd = new AccessLogTailDispatcher(fileValue, registry);
 altd.run();

package/index.js

@@ -1,10 +1,66 @@
 #!/usr/bin/env node
+import { accessSync, constants } from 'node:fs';
+import { createRequire } from 'node:module';
+import { delimiter, isAbsolute, join } from 'node:path';
 import { Command } from 'commander';
-import pkg from './package.json' assert { type: 'json' };
 import AccessLogTailDispatcher from './src/altd.js';
 
+const require = createRequire(import.meta.url);
+const pkg = require('./package.json');
+
 const program = new Command();
 
+const resolveExecPath = (command) => {
+  if (!command || typeof command !== 'string') return null;
+  if (isAbsolute(command)) {
+    try {
+      accessSync(command, constants.X_OK);
+      return command;
+    } catch {
+      return null;
+    }
+  }
+
+  const searchPaths = (process.env.PATH ?? '').split(delimiter);
+  for (const dir of searchPaths) {
+    if (!dir) continue;
+    const candidate = join(dir, command);
+    try {
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+      // continue
+    }
+  }
+  return null;
+};
+
+const buildRegistry = (whitelist) => {
+  const registry = {};
+  for (const command of whitelist) {
+    const execPath = resolveExecPath(command);
+    if (!execPath) {
+      console.warn(`[altd] skip command: ${command}`);
+      continue;
+    }
+    registry[command] = {
+      execPath,
+      buildArgs: (rawArgs) => {
+        if (!Array.isArray(rawArgs) || rawArgs.length > 20) {
+          throw new Error('invalid args');
+        }
+        for (const arg of rawArgs) {
+          if (typeof arg !== 'string' || arg.length > 256) {
+            throw new Error('invalid args');
+          }
+        }
+        return rawArgs;
+      },
+    };
+  }
+  return registry;
+};
+
 program
   .name('altd')
   .version(pkg.version)
@@ -13,17 +69,23 @@ program
   .option(
     '-w, --whitelist <commands>',
     'Add commands to whitelist',
-    (commands) => commands.split(',')
+    (commands) => commands.split(',').map((command) => command.trim()).filter(Boolean)
   )
   .parse(process.argv);
 
 const fileValue = program.args[0];
 const { whitelist } = program.opts();
 
-if (!fileValue || !whitelist) {
+if (!fileValue || !whitelist || whitelist.length === 0) {
   console.log('altd <file> -w <commands...>');
   process.exit(1);
 }
 
-const altd = new AccessLogTailDispatcher(fileValue, whitelist);
+const registry = buildRegistry(whitelist);
+if (Object.keys(registry).length === 0) {
+  console.error('[altd] no valid commands to run');
+  process.exit(1);
+}
+
+const altd = new AccessLogTailDispatcher(fileValue, registry);
 altd.run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "altd",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Access log tail dispatcher",
   "type": "module",
   "bin": {

package/scripts/build.js

@@ -9,7 +9,9 @@ const distDir = join(projectRoot, 'dist');
 await mkdir(distDir, { recursive: true });
 
 const indexSource = await readFile(join(projectRoot, 'index.js'), 'utf8');
-const indexOutput = indexSource.replace('./src/altd.js', './altd.js');
+const indexOutput = indexSource
+  .replace('./src/altd.js', './altd.js')
+  .replace('./package.json', '../package.json');
 
 await writeFile(join(distDir, 'index.js'), indexOutput);
 await copyFile(join(projectRoot, 'src', 'altd.js'), join(distDir, 'altd.js'));

package/src/altd.js

@@ -1,132 +1,207 @@
-import {spawn} from 'child_process';
-import Tail from 'nodejs-tail';
+import { spawn as nodeSpawn } from "node:child_process";
+import Tail from "nodejs-tail";
+
 /**
- ** main class of AccessLogTailDispatcher
+ * Safe, modern dispatcher:
+ * - command is mapped to an absolute executable path (not user-provided)
+ * - args are validated per-command
+ * - rate limited
+ * - process is sandboxed-ish (no shell, timeout, limited output)
  */
 export default class AccessLogTailDispatcher {
-    /**
-     * @constructor
-     * @param {string} file access_log
-     * @param {Array} whitelist ['command1','command2'..]
-     */
-    constructor(file, whitelist) {
-        this.file = file;
-        this.whitelist = whitelist;
-        this.spawn = undefined;
-        this.tail = undefined;
-    }
-    /**
-     * Get the path from 'GET /path/to/dir HTTP'
-     * @param {string} line access_log
-     * @return {string} /path/to/dir
-     */
-    path(line) {
-        if (!(typeof line === 'string')) {
-            return '';
-        }
-        let match = line.match(
-            /GET\s((\/[a-z0-9-._~%!$&'()*+,;=:@?]+)+\/?)\sHTTP/i);
-        if (null !== match && match.length > 2) {
-            return match[1];
-        }
-        return '';
-    }
+  /**
+   * @param {string} file access_log
+   * @param {object} commandRegistry { [commandName]: { execPath: string, buildArgs: (rawArgs:string[])=>string[] } }
+   * @param {object} [opts]
+   */
+  constructor(file, commandRegistry, opts = {}) {
+    this.file = file;
+    this.registry = commandRegistry;
+
+    this.spawnImpl = opts.spawnImpl ?? nodeSpawn;
+    this.tail = opts.tail
+      ?? new Tail(file, {
+        alwaysStat: true,
+        ignoreInitial: true,
+        persistent: true,
+      });
+
+    // Simple rate limit: max N executions per windowMs
+    this.windowMs = opts.windowMs ?? 1000;
+    this.maxPerWindow = opts.maxPerWindow ?? 5;
+    this._windowStart = Date.now();
+    this._countInWindow = 0;
+
+    // Process limits
+    this.timeoutMs = opts.timeoutMs ?? 10_000;
+    this.maxStdoutBytes = opts.maxStdoutBytes ?? 64 * 1024;
+  }
+
+  /**
+   * Extract request path from a typical access log line.
+   * More robust: parse "METHOD <url> HTTP/..."
+   * @param {string} line
+   * @returns {string} pathname like "/a/b"
+   */
+  extractPath(line) {
+    if (typeof line !== "string" || line.length > 10_000) return "";
 
-    /**
-     * Extract command and args
-     * @param {string} path
-     * @return {Array} [command,arg1,arg2...]
-     */
-    commandWithArgs(path) {
-        if (!(typeof path === 'string')) {
-            return [];
-        }
-        let commands = path.split(/\//).map(function(element, index, array) {
-            let ret = "";
-            try{
-              ret = decodeURIComponent(element);
-            }catch(e){
-              console.error(e);
-            }
-            return ret;
-        });
-        commands.shift();
-        return commands;
+    // Find something like: GET /foo/bar HTTP/1.1
+    const m = line.match(
+      /\b(GET|POST|PUT|DELETE|HEAD|OPTIONS)\s+(\S+)\s+HTTP\/\d(?:\.\d)?\b/i,
+    );
+    if (!m) return "";
+
+    const rawTarget = m[2];
+
+    // rawTarget can be absolute URL or origin-form. Normalize via URL.
+    // If it's origin-form "/x", give it a dummy base.
+    let url;
+    try {
+      url = rawTarget.startsWith("/")
+        ? new URL(rawTarget, "http://localhost")
+        : new URL(rawTarget);
+    } catch {
+      return "";
     }
 
-    /**
-     * Filter by whitelist
-     * @param {Array} commandWithArgs [command,arg1,arg2...]
-     * @param {Array} whitelist ['command1','command2'...]
-     * @return {Array} filtered commandWithArgs
-     */
-    filterByWhitelist(commandWithArgs, whitelist) {
-        if (!this.isArray(commandWithArgs) ||
-            !this.isArray(whitelist) ||
-            commandWithArgs.length == 0 ||
-            whitelist.indexOf(commandWithArgs[0]) == -1
-        ) {
-            return [];
-        }
-        return commandWithArgs;
+    // Only use pathname; ignore query/hash to reduce attack surface.
+    return url.pathname || "";
+  }
+
+  /**
+   * "/cmd/a/b" -> ["cmd","a","b"] (safe decode, size limits)
+   * @param {string} pathname
+   * @returns {string[]}
+   */
+  parseCommand(pathname) {
+    if (typeof pathname !== "string" || pathname === "" || pathname.length > 2048) {
+      return [];
     }
+    if (!pathname.startsWith("/")) return [];
 
-    /**
-     * Dispatch
-     * @param {Array} commandWithArgs [command,arg1,arg2...]
-     */
-    dispatch(commandWithArgs) {
-        if (commandWithArgs.length == 0) {
-            return;
-        }
-        let command = commandWithArgs.shift();
-        let proc = this.spawn(command, commandWithArgs);
-        proc.on('error', (err) => {
-            console.error(err);
-        });
-        proc.stdout.on('data', (data) => {
-            process.stdout.write(data.toString());
-        });
+    const parts = pathname.split("/").filter(Boolean);
+    if (parts.length === 0) return [];
+
+    // Safe decode each segment; if decode fails, reject the whole request.
+    const decoded = [];
+    for (const p of parts) {
+      if (p.length > 256) return [];
+      try {
+        decoded.push(decodeURIComponent(p));
+      } catch {
+        return [];
+      }
     }
+    return decoded;
+  }
 
-    /**
-     * isArray
-     * @param {object} obj [command,arg1,arg2...]
-     * @return {boolean}
-     */
-    isArray(obj) {
-        return Object.prototype.toString.call(obj) === '[object Array]';
+  /**
+   * Basic rate limit to avoid log-triggered fork bombs.
+   * @returns {boolean} allowed
+   */
+  allowByRateLimit() {
+    const now = Date.now();
+    if (now - this._windowStart >= this.windowMs) {
+      this._windowStart = now;
+      this._countInWindow = 0;
     }
+    this._countInWindow += 1;
+    return this._countInWindow <= this.maxPerWindow;
+  }
+
+  /**
+   * Validate + build exec + args using registry
+   * @param {string[]} parsed ["cmd", ...rawArgs]
+   * @returns {{execPath:string,args:string[]}|null}
+   */
+  resolveExecution(parsed) {
+    if (!Array.isArray(parsed) || parsed.length === 0) return null;
+
+    const [cmd, ...rawArgs] = parsed;
 
-    /**
-     * run
-     * @param {string} file
-     * @param {Array} whitelist ['command1','command2'...]
-     */
-    run(file, whitelist) {
-        if ( typeof file !== 'undefined') {
-            this.file = file;
-        }
-        if ( typeof whitelist !== 'undefined') {
-            this.whitelist = whitelist;
-        }
-        if ( typeof this.spawn === 'undefined') {
-            this.spawn = spawn;
-        }
-        if ( typeof this.tail === 'undefined') {
-            this.tail = new Tail(this.file,
-                {alwaysStat: true, ignoreInitial: true, persistent: true});
-        }
-        this.tail.on('line', (line) => {
-            this.dispatch(
-                this.filterByWhitelist(
-                    this.commandWithArgs(
-                        this.path(line)),
-                    this.whitelist));
-        });
-        this.tail.on('close', () => {
-            console.log('watching stopped');
-        });
-        this.tail.watch();
+    const entry = this.registry[cmd];
+    if (!entry) return null;
+
+    // Build args via per-command validator
+    let args;
+    try {
+      args = entry.buildArgs(rawArgs);
+    } catch {
+      return null;
     }
+    if (!Array.isArray(args)) return null;
+
+    return { execPath: entry.execPath, args };
+  }
+
+  /**
+   * Spawn with limits
+   * @param {string} execPath
+   * @param {string[]} args
+   */
+  spawnLimited(execPath, args) {
+    const proc = this.spawnImpl(execPath, args, {
+      shell: false,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        // Minimal env is often safer; adjust as needed
+        PATH: process.env.PATH ?? "",
+      },
+    });
+
+    // Timeout
+    const t = setTimeout(() => {
+      proc.kill("SIGKILL");
+    }, this.timeoutMs);
+    proc.on("exit", () => clearTimeout(t));
+
+    // Output limiting
+    let outBytes = 0;
+    proc.stdout.on("data", (buf) => {
+      outBytes += buf.length;
+      if (outBytes > this.maxStdoutBytes) {
+        proc.kill("SIGKILL");
+        return;
+      }
+      process.stdout.write(buf);
+    });
+
+    proc.stderr.on("data", (buf) => {
+      process.stderr.write(buf);
+    });
+
+    proc.on("error", (err) => {
+      console.error("[spawn error]", err);
+    });
+  }
+
+  /**
+   * Start watching
+   */
+  run() {
+    this.tail.on("line", (line) => {
+      if (!this.allowByRateLimit()) return;
+
+      const pathname = this.extractPath(line);
+      const parsed = this.parseCommand(pathname);
+      const exec = this.resolveExecution(parsed);
+      if (!exec) return;
+
+      this.spawnLimited(exec.execPath, exec.args);
+    });
+
+    this.tail.on("close", () => {
+      console.log("watching stopped");
+    });
+
+    this.tail.watch();
+  }
+
+  stop() {
+    try {
+      this.tail.unwatch?.();
+    } catch {}
+  }
 }