bs9 1.0.0 → 1.3.0

package/src/commands/start.ts

@@ -6,34 +6,101 @@ import { execSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { writeFileSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
+import { getPlatformInfo } from "../platform/detect.js";
+
+// Security: Host validation function
+function isValidHost(host: string): boolean {
+  // Allow localhost, 0.0.0.0, and valid IP addresses
+  const localhostRegex = /^(localhost|127\.0\.0\.1|::1)$/;
+  const anyIPRegex = /^(0\.0\.0\.0|::)$/;
+  const ipv4Regex = /^(\d{1,3}\.){3}\d{1,3}$/;
+  const ipv6Regex = /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
+  const hostnameRegex = /^[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*$/;
+  
+  if (localhostRegex.test(host) || anyIPRegex.test(host)) {
+    return true;
+  }
+  
+  if (ipv4Regex.test(host)) {
+    const parts = host.split('.');
+    return parts.every(part => {
+      const num = parseInt(part, 10);
+      return num >= 0 && num <= 255;
+    });
+  }
+  
+  if (ipv6Regex.test(host)) {
+    return true;
+  }
+  
+  if (hostnameRegex.test(host) && host.length <= 253) {
+    return true;
+  }
+  
+  return false;
+}
 
 interface StartOptions {
   name?: string;
   port?: string;
+  host?: string;
   env?: string[];
   otel?: boolean;
   prometheus?: boolean;
   build?: boolean;
+  https?: boolean;
 }
 
 export async function startCommand(file: string, options: StartOptions): Promise<void> {
+  const platformInfo = getPlatformInfo();
+  
+  // Security: Validate and sanitize file path
   const fullPath = resolve(file);
   if (!existsSync(fullPath)) {
     console.error(`❌ File not found: ${fullPath}`);
     process.exit(1);
   }
-
-  const serviceName = options.name || basename(fullPath, fullPath.endsWith('.ts') ? '.ts' : '.js').replace(/[^a-zA-Z0-9-_]/g, "_");
+  
+  // Security: Prevent directory traversal and ensure file is within allowed paths
+  const allowedPaths = [process.cwd(), homedir()];
+  const isAllowedPath = allowedPaths.some(allowed => fullPath.startsWith(allowed));
+  if (!isAllowedPath) {
+    console.error(`❌ Security: File path outside allowed directories: ${fullPath}`);
+    process.exit(1);
+  }
+  
+  // Security: Validate and sanitize service name
+  const rawServiceName = options.name || basename(fullPath, fullPath.endsWith('.ts') ? '.ts' : '.js');
+  const serviceName = rawServiceName.replace(/[^a-zA-Z0-9-_]/g, "_").replace(/^[^a-zA-Z]/, "_").substring(0, 64);
+  
+  // Security: Validate port number
   const port = options.port || "3000";
+  const portNum = Number(port);
+  if (isNaN(portNum) || portNum < 1 || portNum > 65535) {
+    console.error(`❌ Security: Invalid port number: ${port}. Must be 1-65535`);
+    process.exit(1);
+  }
+  
+  // Security: Validate host
+  const host = options.host || "localhost";
+  if (!isValidHost(host)) {
+    console.error(`❌ Security: Invalid host: ${host}`);
+    process.exit(1);
+  }
+  
+  const protocol = options.https ? "https" : "http";
 
   // Port warning for privileged ports
-  const portNum = Number(port);
   if (portNum < 1024) {
     console.warn(`⚠️  Port ${port} is privileged (< 1024).`);
     console.warn("   Options:");
     console.warn("   - Use port >= 1024 (recommended)");
-    console.warn("   - Run with sudo (not recommended for user services)");
-    console.warn("   - Use port forwarding: `sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3000`");
+    if (platformInfo.isWindows) {
+      console.warn("   - Run as Administrator (not recommended)");
+    } else {
+      console.warn("   - Run with sudo (not recommended for user services)");
+      console.warn("   - Use port forwarding: `sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3000`");
+    }
   }
 
   // Handle TypeScript files and build option
@@ -77,43 +144,137 @@ export async function startCommand(file: string, options: StartOptions): Promise
     auditResult.warning.forEach(issue => console.warn(`  - ${issue}`));
   }
 
+  // Platform-specific service creation
+  if (platformInfo.isLinux) {
+    await createLinuxService(serviceName, execPath, host, port, protocol, options);
+  } else if (platformInfo.isMacOS) {
+    await createMacOSService(serviceName, execPath, host, port, protocol, options);
+  } else if (platformInfo.isWindows) {
+    await createWindowsService(serviceName, execPath, host, port, protocol, options);
+  } else {
+    console.error(`❌ Platform ${platformInfo.platform} is not supported`);
+    process.exit(1);
+  }
+}
+
+async function createLinuxService(serviceName: string, execPath: string, host: string, port: string, protocol: string, options: StartOptions): Promise<void> {
   // Phase 1: Generate hardened systemd unit
   const unitContent = generateSystemdUnit({
     serviceName,
     fullPath: execPath,
+    host,
     port,
+    protocol,
     env: options.env || [],
     otel: options.otel ?? true,
     prometheus: options.prometheus ?? true,
   });
 
-  const unitPath = join(homedir(), ".config/systemd/user", `${serviceName}.service`);
+  const platformInfo = getPlatformInfo();
+  const unitPath = join(platformInfo.serviceDir, `${serviceName}.service`);
   
   // Create user systemd directory if it doesn't exist
-  const userSystemdDir = join(homedir(), ".config/systemd/user");
-  if (!existsSync(userSystemdDir)) {
-    mkdirSync(userSystemdDir, { recursive: true });
-    console.log(`📁 Created user systemd directory: ${userSystemdDir}`);
+  if (!existsSync(platformInfo.serviceDir)) {
+    mkdirSync(platformInfo.serviceDir, { recursive: true });
+    console.log(`📁 Created user systemd directory: ${platformInfo.serviceDir}`);
   }
   
   try {
-    writeFileSync(unitPath, unitContent, { encoding: "utf-8" });
+    writeFileSync(unitPath, unitContent);
     console.log(`✅ Systemd user unit written to: ${unitPath}`);
-  } catch (err) {
-    console.error(`❌ Failed to write systemd user unit: ${err}`);
+    
+    execSync("systemctl --user daemon-reload");
+    execSync(`systemctl --user enable ${serviceName}`);
+    execSync(`systemctl --user start ${serviceName}`);
+    
+    console.log(`🚀 Service '${serviceName}' started successfully`);
+    console.log(`   Health: ${protocol}://${host}:${port}/healthz`);
+    console.log(`   Metrics: ${protocol}://${host}:${port}/metrics`);
+  } catch (error) {
+    console.error(`❌ Failed to start service: ${error}`);
     process.exit(1);
   }
+}
 
-  // Reload and start using user systemd
+async function createMacOSService(serviceName: string, execPath: string, host: string, port: string, protocol: string, options: StartOptions): Promise<void> {
+  const { launchdCommand } = await import("../macos/launchd.js");
+  
+  const envVars: Record<string, string> = {
+    PORT: port,
+    HOST: host,
+    PROTOCOL: protocol,
+    NODE_ENV: "production",
+    SERVICE_NAME: serviceName,
+    ...(options.env || []).reduce((acc, env) => {
+      const [key, value] = env.split('=');
+      if (key && value) acc[key] = value;
+      return acc;
+    }, {} as Record<string, string>)
+  };
+  
+  if (options.otel) {
+    envVars.OTEL_SERVICE_NAME = serviceName;
+    envVars.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT = "http://localhost:4318/v1/traces";
+  }
+  
   try {
-    execSync("systemctl --user daemon-reload", { stdio: "inherit" });
-    execSync(`systemctl --user enable ${serviceName}`, { stdio: "inherit" });
-    execSync(`systemctl --user start ${serviceName}`, { stdio: "inherit" });
+    await launchdCommand('create', {
+      name: `bs9.${serviceName}`,
+      file: execPath,
+      workingDir: dirname(execPath),
+      env: JSON.stringify(envVars),
+      autoStart: true,
+      keepAlive: true,
+      logOut: `${getPlatformInfo().logDir}/${serviceName}.out.log`,
+      logErr: `${getPlatformInfo().logDir}/${serviceName}.err.log`
+    });
+    
     console.log(`🚀 Service '${serviceName}' started successfully`);
-    console.log(`   Health: http://localhost:${port}/healthz`);
-    console.log(`   Metrics: http://localhost:${port}/metrics`);
-  } catch (err) {
-    console.error(`❌ Failed to start user service: ${err}`);
+    console.log(`   Health: ${protocol}://${host}:${port}/healthz`);
+    console.log(`   Metrics: ${protocol}://${host}:${port}/metrics`);
+  } catch (error) {
+    console.error(`❌ Failed to start macOS service: ${error}`);
+    process.exit(1);
+  }
+}
+
+async function createWindowsService(serviceName: string, execPath: string, host: string, port: string, protocol: string, options: StartOptions): Promise<void> {
+  const { windowsCommand } = await import("../windows/service.js");
+  
+  const envVars: Record<string, string> = {
+    PORT: port,
+    HOST: host,
+    PROTOCOL: protocol,
+    NODE_ENV: "production",
+    SERVICE_NAME: serviceName,
+    ...(options.env || []).reduce((acc, env) => {
+      const [key, value] = env.split('=');
+      if (key && value) acc[key] = value;
+      return acc;
+    }, {} as Record<string, string>)
+  };
+  
+  if (options.otel) {
+    envVars.OTEL_SERVICE_NAME = serviceName;
+    envVars.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT = "http://localhost:4318/v1/traces";
+  }
+  
+  try {
+    await windowsCommand('create', {
+      name: `BS9_${serviceName}`,
+      file: execPath,
+      displayName: `BS9 Service: ${serviceName}`,
+      description: `BS9 managed service: ${serviceName}`,
+      workingDir: dirname(execPath),
+      args: ['run', execPath],
+      env: JSON.stringify(envVars)
+    });
+    
+    console.log(`🚀 Service '${serviceName}' started successfully`);
+    console.log(`   Health: ${protocol}://${host}:${port}/healthz`);
+    console.log(`   Metrics: ${protocol}://${host}:${port}/metrics`);
+  } catch (error) {
+    console.error(`❌ Failed to start Windows service: ${error}`);
     process.exit(1);
   }
 }
@@ -140,6 +301,9 @@ async function securityAudit(filePath: string): Promise<SecurityAuditResult> {
     { pattern: /child_process\.exec\s*\(/, msg: "Unsafe child_process.exec() detected" },
     { pattern: /require\s*\(\s*["']fs["']\s*\)/, msg: "Direct fs module usage (potential file system access)" },
     { pattern: /process\.env\.\w+\s*\+\s*["']/, msg: "Potential command injection via env concatenation" },
+    { pattern: /require\s*\(\s*["']child_process["']\s*\)/, msg: "Child process module usage detected" },
+    { pattern: /spawn\s*\(/, msg: "Process spawning detected" },
+    { pattern: /execSync\s*\(/, msg: "Synchronous execution detected" },
   ];
 
   for (const { pattern, msg } of dangerousPatterns) {
@@ -164,7 +328,9 @@ async function securityAudit(filePath: string): Promise<SecurityAuditResult> {
 interface SystemdUnitOptions {
   serviceName: string;
   fullPath: string;
+  host: string;
   port: string;
+  protocol: string;
   env: string[];
   otel: boolean;
   prometheus: boolean;
@@ -173,6 +339,8 @@ interface SystemdUnitOptions {
 function generateSystemdUnit(opts: SystemdUnitOptions): string {
   const envVars = [
     `PORT=${opts.port}`,
+    `HOST=${opts.host}`,
+    `PROTOCOL=${opts.protocol}`,
     `NODE_ENV=production`,
     `SERVICE_NAME=${opts.serviceName}`,
     ...opts.env,
@@ -190,6 +358,7 @@ function generateSystemdUnit(opts: SystemdUnitOptions): string {
   return `[Unit]
 Description=BS9 Service: ${opts.serviceName}
 After=network.target
+Documentation=https://github.com/bs9/bs9
 
 [Service]
 Type=simple
@@ -201,6 +370,17 @@ WorkingDirectory=${workingDir}
 ExecStart=${bunPath} run ${opts.fullPath}
 ${envSection}
 
+# Security hardening (user systemd compatible)
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=${workingDir}
+UMask=0022
+
+# Resource limits
+LimitNOFILE=65536
+LimitNPROC=4096
+
 [Install]
 WantedBy=default.target
 `;

package/src/commands/status.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
 
 import { execSync } from "node:child_process";
+import { getPlatformInfo } from "../platform/detect.js";
 import { readFileSync } from "node:fs";
 
 interface StatusOptions {
@@ -20,108 +21,140 @@ interface ServiceStatus {
 }
 
 export async function statusCommand(options: StatusOptions): Promise<void> {
-  const doStatus = () => {
-    try {
-      // Get all bsn-managed user services
-      const listOutput = execSync("systemctl --user list-units --type=service --no-pager --no-legend", { encoding: "utf-8" });
-      const lines = listOutput.split("\n").filter(line => line.includes(".service"));
-      
-      // Debug: show all lines
-      // console.error("All service lines:", lines);
-      
-      const services: ServiceStatus[] = [];
-      
-      for (const line of lines) {
-        // Skip empty lines
-        if (!line.trim()) continue;
-        
-        // Try to match the line format - handle both ● and regular spaces
-        const match = line.match(/^(?:\s*([●\s○]))?\s*([^\s]+)\.service\s+([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+(.+)$/);
-        if (!match) {
-          continue;
-        }
-        
-        const [, statusIndicator, name, loaded, active, sub, description] = match;
-        
-        // Only include services that look like BSN-managed (check for "Bun Service:" pattern)
-        if (!description.includes("Bun Service:") && !description.includes("BS9 Service:")) {
-          continue;
-        }
-        
-        const status: ServiceStatus = {
-          name,
-          loaded,
-          active,
-          sub,
-          description,
-        };
+  const platformInfo = getPlatformInfo();
+  
+  try {
+    let services: ServiceStatus[] = [];
+    
+    if (platformInfo.isLinux) {
+      services = await getLinuxServices();
+    } else if (platformInfo.isMacOS) {
+      services = await getMacOSServices();
+    } else if (platformInfo.isWindows) {
+      services = await getWindowsServices();
+    }
+    
+    displayServices(services);
+    
+    if (options.watch) {
+      console.log("\n🔄 Watching for changes (Ctrl+C to stop)...");
+      setInterval(async () => {
+        console.clear();
+        console.log("🔍 BS9 Service Status");
+        console.log("=".repeat(80));
         
-        // Get additional metrics
-        try {
-          const showOutput = execSync(`systemctl --user show ${name} -p CPUUsageNSec MemoryCurrent ActiveEnterTimestamp TasksCurrent`, { encoding: "utf-8" });
-          const cpuMatch = showOutput.match(/CPUUsageNSec=(\d+)/);
-          const memMatch = showOutput.match(/MemoryCurrent=(\d+)/);
-          const timeMatch = showOutput.match(/ActiveEnterTimestamp=(.+)/);
-          const tasksMatch = showOutput.match(/TasksCurrent=(\d+)/);
-          
-          if (cpuMatch) status.cpu = formatCPU(Number(cpuMatch[1]));
-          if (memMatch) status.memory = formatMemory(Number(memMatch[1]));
-          if (timeMatch) status.uptime = formatUptime(timeMatch[1]);
-          if (tasksMatch) status.tasks = tasksMatch[1];
-        } catch {
-          // Ignore metrics errors
+        let updatedServices: ServiceStatus[] = [];
+        if (platformInfo.isLinux) {
+          updatedServices = await getLinuxServices();
+        } else if (platformInfo.isMacOS) {
+          updatedServices = await getMacOSServices();
+        } else if (platformInfo.isWindows) {
+          updatedServices = await getWindowsServices();
         }
         
-        services.push(status);
-      }
+        displayServices(updatedServices);
+      }, 2000);
+    }
+  } catch (err) {
+    console.error("❌ Failed to get service status:", err);
+    process.exit(1);
+  }
+}
+
+async function getLinuxServices(): Promise<ServiceStatus[]> {
+  const services: ServiceStatus[] = [];
+  
+  try {
+    const listOutput = execSync("systemctl --user list-units --type=service --no-pager --no-legend", { encoding: "utf-8" });
+    const lines = listOutput.split("\n").filter(line => line.includes(".service"));
+    
+    for (const line of lines) {
+      const match = line.match(/^(?:\s*([●\s○]))?\s*([^\s]+)\.service\s+([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+(.+)$/);
+      if (!match) continue;
       
-      // Display table
-      console.clear();
-      console.log("🔍 BSN Service Status\n");
+      const [, statusIndicator, name, loaded, active, sub, description] = match;
       
-      if (services.length === 0) {
-        console.log("No BSN-managed services running.");
-        return;
-      }
+      if (!description.includes("Bun Service:") && !description.includes("BS9 Service:")) continue;
       
-      // Header
-      console.log(`${"SERVICE".padEnd(20)} ${"STATE".padEnd(12)} ${"CPU".padEnd(8)} ${"MEMORY".padEnd(10)} ${"UPTIME".padEnd(12)} ${"TASKS".padEnd(6)} DESCRIPTION`);
-      console.log("-".repeat(90));
+      const status: ServiceStatus = {
+        name,
+        loaded,
+        active,
+        sub,
+        description,
+      };
       
-      for (const svc of services) {
-        const state = `${svc.active}/${svc.sub}`;
-        console.log(
-          `${svc.name.padEnd(20)} ${state.padEnd(12)} ${(svc.cpu || "-").padEnd(8)} ${(svc.memory || "-").padEnd(10)} ${(svc.uptime || "-").padEnd(12)} ${(svc.tasks || "-").padEnd(6)} ${svc.description}`
-        );
+      // Get additional metrics
+      try {
+        const showOutput = execSync(`systemctl --user show ${name} -p CPUUsageNSec MemoryCurrent ActiveEnterTimestamp TasksCurrent`, { encoding: "utf-8" });
+        const cpuMatch = showOutput.match(/CPUUsageNSec=(\d+)/);
+        const memMatch = showOutput.match(/MemoryCurrent=(\d+)/);
+        const timeMatch = showOutput.match(/ActiveEnterTimestamp=(.+)/);
+        const tasksMatch = showOutput.match(/TasksCurrent=(\d+)/);
+        
+        if (cpuMatch) status.cpu = formatCPU(Number(cpuMatch[1]));
+        if (memMatch) status.memory = formatMemory(Number(memMatch[1]));
+        if (timeMatch) status.uptime = formatUptime(timeMatch[1]);
+        if (tasksMatch) status.tasks = tasksMatch[1];
+      } catch {
+        // Metrics might not be available
       }
       
-      console.log("\n📊 SRE Metrics Summary:");
-      const totalServices = services.length;
-      const runningServices = services.filter(s => s.active === "active").length;
-      const totalMemory = services.reduce((sum, s) => sum + (s.memory ? parseMemory(s.memory) : 0), 0);
-      
-      console.log(`  Services: ${runningServices}/${totalServices} running`);
-      console.log(`  Memory: ${formatMemory(totalMemory)}`);
-      console.log(`  Last updated: ${new Date().toISOString()}`);
-      
-    } catch (err) {
-      console.error(`❌ Failed to get status: ${err}`);
-      process.exit(1);
+      services.push(status);
     }
-  };
-  
-  if (options.watch) {
-    console.log("🔄 Watch mode (Ctrl+C to exit)\n");
-    const interval = setInterval(doStatus, 2000);
-    process.on("SIGINT", () => {
-      clearInterval(interval);
-      console.log("\n👋 Exiting watch mode");
-      process.exit(0);
-    });
-    doStatus();
-  } else {
-    doStatus();
+  } catch (error) {
+    console.warn("Failed to get Linux services:", error);
   }
+  
+  return services;
+}
+
+async function getMacOSServices(): Promise<ServiceStatus[]> {
+  const services: ServiceStatus[] = [];
+  
+  try {
+    const { launchdCommand } = await import("../macos/launchd.js");
+    // For now, return empty array - would need to implement status in launchd.ts
+  } catch (error) {
+    console.warn("Failed to get macOS services:", error);
+  }
+  
+  return services;
+}
+
+async function getWindowsServices(): Promise<ServiceStatus[]> {
+  const services: ServiceStatus[] = [];
+  
+  try {
+    const { windowsCommand } = await import("../windows/service.js");
+    // For now, return empty array - would need to implement status in windows/service.ts
+  } catch (error) {
+    console.warn("Failed to get Windows services:", error);
+  }
+  
+  return services;
+}
+
+function displayServices(services: ServiceStatus[]): void {
+  // Header
+  console.log(`${"SERVICE".padEnd(20)} ${"STATE".padEnd(12)} ${"CPU".padEnd(8)} ${"MEMORY".padEnd(10)} ${"UPTIME".padEnd(12)} ${"TASKS".padEnd(6)} DESCRIPTION`);
+  console.log("-".repeat(90));
+  
+  for (const svc of services) {
+    const state = `${svc.active}/${svc.sub}`;
+    console.log(
+      `${svc.name.padEnd(20)} ${state.padEnd(12)} ${(svc.cpu || "-").padEnd(8)} ${(svc.memory || "-").padEnd(10)} ${(svc.uptime || "-").padEnd(12)} ${(svc.tasks || "-").padEnd(6)} ${svc.description}`
+    );
+  }
+  
+  console.log("\n📊 SRE Metrics Summary:");
+  const totalServices = services.length;
+  const runningServices = services.filter(s => s.active === "active").length;
+  const totalMemory = services.reduce((sum, s) => sum + (s.memory ? parseMemory(s.memory) : 0), 0);
+  
+  console.log(`  Services: ${runningServices}/${totalServices} running`);
+  console.log(`  Memory: ${formatMemory(totalMemory)}`);
+  console.log(`  Last updated: ${new Date().toISOString()}`);
 }
 
 function formatCPU(nsec: number): string {
@@ -132,31 +165,43 @@ function formatCPU(nsec: number): string {
 function formatMemory(bytes: number): string {
   const units = ["B", "KB", "MB", "GB"];
   let size = bytes;
-  let unit = 0;
-  while (size >= 1024 && unit < units.length - 1) {
+  let unitIndex = 0;
+  
+  while (size >= 1024 && unitIndex < units.length - 1) {
     size /= 1024;
-    unit++;
+    unitIndex++;
   }
-  return `${size.toFixed(1)}${units[unit]}`;
+  
+  return `${size.toFixed(1)}${units[unitIndex]}`;
 }
 
-function parseMemory(str: string): number {
-  const match = str.match(/^([\d.]+)(B|KB|MB|GB)$/);
+function parseMemory(memStr: string): number {
+  const match = memStr.match(/^([\d.]+)(B|KB|MB|GB)$/);
   if (!match) return 0;
+  
   const [, value, unit] = match;
-  const mult = { B: 1, KB: 1024, MB: 1024 ** 2, GB: 1024 ** 3 }[unit] || 1;
-  return Number(value) * mult;
+  const num = parseFloat(value);
+  
+  switch (unit) {
+    case "KB": return num * 1024;
+    case "MB": return num * 1024 * 1024;
+    case "GB": return num * 1024 * 1024 * 1024;
+    default: return num;
+  }
 }
 
 function formatUptime(timestamp: string): string {
-  try {
-    const date = new Date(timestamp);
-    const now = new Date();
-    const diff = now.getTime() - date.getTime();
-    const hours = Math.floor(diff / (1000 * 60 * 60));
-    const minutes = Math.floor((diff % (1000 * 60 * 60)) / (1000 * 60));
-    return `${hours}h ${minutes}m`;
-  } catch {
-    return "-";
-  }
+  const date = new Date(timestamp);
+  const now = new Date();
+  const diff = now.getTime() - date.getTime();
+  
+  const seconds = Math.floor(diff / 1000);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  const days = Math.floor(hours / 24);
+  
+  if (days > 0) return `${days}d ${hours % 24}h`;
+  if (hours > 0) return `${hours}h ${minutes % 60}m`;
+  if (minutes > 0) return `${minutes}m ${seconds % 60}s`;
+  return `${seconds}s`;
 }

package/src/commands/stop.ts

@@ -1,13 +1,41 @@
 #!/usr/bin/env bun
 
 import { execSync } from "node:child_process";
+import { join } from "node:path";
+import { getPlatformInfo } from "../platform/detect.js";
+
+// Security: Service name validation
+function isValidServiceName(name: string): boolean {
+  // Only allow alphanumeric, hyphens, underscores, and dots
+  // Prevent command injection and path traversal
+  const validPattern = /^[a-zA-Z0-9._-]+$/;
+  return validPattern.test(name) && name.length <= 64 && !name.includes('..') && !name.includes('/');
+}
 
 export async function stopCommand(name: string): Promise<void> {
+  // Security: Validate service name
+  if (!isValidServiceName(name)) {
+    console.error(`❌ Security: Invalid service name: ${name}`);
+    process.exit(1);
+  }
+  
+  const platformInfo = getPlatformInfo();
+  
   try {
-    execSync(`systemctl --user stop ${name}`, { stdio: "inherit" });
-    console.log(`🛑 User service '${name}' stopped`);
+    if (platformInfo.isLinux) {
+      // Security: Use shell escaping to prevent injection
+      const escapedName = name.replace(/[^a-zA-Z0-9._-]/g, '');
+      execSync(`systemctl --user stop "${escapedName}"`, { stdio: "inherit" });
+      console.log(`🛑 User service '${name}' stopped`);
+    } else if (platformInfo.isMacOS) {
+      const { launchdCommand } = await import("../macos/launchd.js");
+      await launchdCommand('stop', { name: `bs9.${name}` });
+    } else if (platformInfo.isWindows) {
+      const { windowsCommand } = await import("../windows/service.js");
+      await windowsCommand('stop', { name: `BS9_${name}` });
+    }
   } catch (err) {
-    console.error(`❌ Failed to stop user service '${name}': ${err}`);
+    console.error(`❌ Failed to stop service '${name}': ${err}`);
     process.exit(1);
   }
 }