crewx-bridge 0.1.0

package/dist/service.js

@@ -0,0 +1,221 @@
+import { execFile } from "node:child_process";
+import { unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { bridgeStateDirectory, ensureSecureDirectory, writeSecureText, } from "./config.js";
+import { BridgeError } from "./errors.js";
+const execFileAsync = promisify(execFile);
+function escapeXml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&apos;");
+}
+function systemdQuote(value) {
+    if (/[\0\r\n]/.test(value)) {
+        throw new BridgeError("unsafe_service_path", "Service paths must not contain line breaks.");
+    }
+    return `"${value
+        .replaceAll("\\", "\\\\")
+        .replaceAll('"', '\\"')
+        .replaceAll("%", "%%")}"`;
+}
+function safePathEnvironment(value) {
+    if (/[\0\r\n]/.test(value)) {
+        throw new BridgeError("unsafe_service_path", "The service PATH must not contain control characters.");
+    }
+    return value;
+}
+export function bridgeServiceEntrypoint() {
+    return fileURLToPath(new URL("./index.js", import.meta.url));
+}
+export function launchdDefinition(options) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.crewx.bridge</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${escapeXml(safePathEnvironment(options.pathEnvironment ?? "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin"))}</string>
+  </dict>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(options.nodePath)}</string>
+    <string>${escapeXml(options.entrypoint)}</string>
+    <string>serve</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>ProcessType</key>
+  <string>Background</string>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(options.stdoutPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(options.stderrPath)}</string>
+  <key>Umask</key>
+  <integer>63</integer>
+</dict>
+</plist>
+`;
+}
+export function systemdDefinition(options) {
+    return `[Unit]
+Description=CrewX Bridge
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${systemdQuote(options.nodePath)} ${systemdQuote(options.entrypoint)} serve
+Environment=${systemdQuote(`PATH=${safePathEnvironment(options.pathEnvironment ?? "/usr/local/bin:/usr/bin:/bin")}`)}
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=45
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=default.target
+`;
+}
+function refuseRoot(platform = process.platform, effectiveUid = typeof process.getuid === "function" ? process.getuid() : undefined) {
+    if (["darwin", "linux"].includes(platform) &&
+        effectiveUid === 0) {
+        throw new BridgeError("root_refused", "CrewX Bridge must be installed as the OS user who owns the project folders, not root.");
+    }
+}
+export function servicePath(platform = process.platform, userHome = homedir()) {
+    if (platform === "darwin") {
+        return join(userHome, "Library", "LaunchAgents", "com.crewx.bridge.plist");
+    }
+    if (platform === "linux") {
+        return join(userHome, ".config", "systemd", "user", "crewx-bridge.service");
+    }
+    throw new BridgeError("unsupported_platform", "CrewX Bridge services currently support macOS and Linux.");
+}
+async function defaultExecutor(file, args) {
+    const result = await execFileAsync(file, [...args], {
+        encoding: "utf8",
+        timeout: 30_000,
+        maxBuffer: 1024 * 1024,
+    });
+    return { stdout: result.stdout, stderr: result.stderr };
+}
+export async function installService(options = {}) {
+    const platform = options.platform ?? process.platform;
+    refuseRoot(platform, options.effectiveUid);
+    const userHome = options.userHome ?? homedir();
+    const path = servicePath(platform, userHome);
+    const executor = options.executor ?? defaultExecutor;
+    const nodePath = options.nodePath ?? process.execPath;
+    const entrypoint = options.entrypoint ?? bridgeServiceEntrypoint();
+    const pathEnvironment = process.env.PATH ?? "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin";
+    if (platform === "darwin") {
+        const state = bridgeStateDirectory(options.environment, platform);
+        await ensureSecureDirectory(state);
+        await writeSecureText(path, launchdDefinition({
+            nodePath,
+            entrypoint,
+            stdoutPath: join(state, "bridge.log"),
+            stderrPath: join(state, "bridge.error.log"),
+            pathEnvironment,
+        }));
+        const uid = options.uid ??
+            (typeof process.getuid === "function" ? process.getuid() : undefined);
+        if (uid === undefined) {
+            throw new BridgeError("uid_unavailable", "Unable to determine the current user ID.");
+        }
+        await executor("launchctl", ["bootout", `gui/${uid}`, path]).catch(() => ({
+            stdout: "",
+            stderr: "",
+        }));
+        await executor("launchctl", ["bootstrap", `gui/${uid}`, path]);
+        return path;
+    }
+    if (platform === "linux") {
+        await writeSecureText(path, systemdDefinition({ nodePath, entrypoint, pathEnvironment }));
+        await executor("systemctl", ["--user", "daemon-reload"]);
+        await executor("systemctl", ["--user", "enable", "--now", "crewx-bridge.service"]);
+        return path;
+    }
+    throw new BridgeError("unsupported_platform", "CrewX Bridge services currently support macOS and Linux.");
+}
+export async function uninstallService(options = {}) {
+    const platform = options.platform ?? process.platform;
+    refuseRoot(platform, options.effectiveUid);
+    const userHome = options.userHome ?? homedir();
+    const path = servicePath(platform, userHome);
+    const executor = options.executor ?? defaultExecutor;
+    if (platform === "darwin") {
+        const uid = options.uid ??
+            (typeof process.getuid === "function" ? process.getuid() : undefined);
+        if (uid === undefined) {
+            throw new BridgeError("uid_unavailable", "Unable to determine the current user ID.");
+        }
+        await executor("launchctl", ["bootout", `gui/${uid}`, path]).catch(() => ({
+            stdout: "",
+            stderr: "",
+        }));
+    }
+    else if (platform === "linux") {
+        await executor("systemctl", ["--user", "disable", "--now", "crewx-bridge.service"]).catch(() => ({ stdout: "", stderr: "" }));
+    }
+    else {
+        throw new BridgeError("unsupported_platform", "CrewX Bridge services currently support macOS and Linux.");
+    }
+    await unlink(path).catch((error) => {
+        if (error.code !== "ENOENT")
+            throw error;
+    });
+    if (platform === "linux") {
+        await executor("systemctl", ["--user", "daemon-reload"]);
+    }
+    return path;
+}
+export async function serviceStatus(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const executor = options.executor ?? defaultExecutor;
+    try {
+        if (platform === "darwin") {
+            const uid = options.uid ??
+                (typeof process.getuid === "function" ? process.getuid() : undefined);
+            if (uid === undefined) {
+                throw new BridgeError("uid_unavailable", "Unable to determine the current user ID.");
+            }
+            const result = await executor("launchctl", ["print", `gui/${uid}/com.crewx.bridge`]);
+            return { running: true, detail: result.stdout.trim() };
+        }
+        if (platform === "linux") {
+            const result = await executor("systemctl", [
+                "--user",
+                "is-active",
+                "crewx-bridge.service",
+            ]);
+            return { running: result.stdout.trim() === "active", detail: result.stdout.trim() };
+        }
+    }
+    catch (error) {
+        return {
+            running: false,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    throw new BridgeError("unsupported_platform", "CrewX Bridge services currently support macOS and Linux.");
+}
+//# sourceMappingURL=service.js.map

package/dist/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAErB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAO1C,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,6CAA6C,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,KAAK;SACb,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;SACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAMjC;IACC,OAAO;;;;;;;;;cASK,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,eAAe,IAAI,gDAAgD,CAAC,CAAC;;;;cAI3G,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;cAC3B,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;;;;;;;;;;;;YAY/B,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;;YAE7B,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;;;;;CAKxC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAIjC;IACC,OAAO;;;;;;;YAOG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC;cAChE,YAAY,CAAC,QAAQ,mBAAmB,CAAC,OAAO,CAAC,eAAe,IAAI,8BAA8B,CAAC,EAAE,CAAC;;;;;;;;;;;;;;CAcnH,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CACjB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,YAAY,GACV,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;IAErE,IACE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtC,YAAY,KAAK,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,cAAc,EACd,uFAAuF,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,QAAQ,GAAG,OAAO,EAAE;IAEpB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,WAAW,CACnB,sBAAsB,EACtB,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,IAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QAClD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,IAAI,GAAG,IAAI;KACvB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UASjC,EAAE;IACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,uBAAuB,EAAE,CAAC;IACnE,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,gDAAgD,CAAC;IAEvE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,eAAe,CACnB,IAAI,EACJ,iBAAiB,CAAC;YAChB,QAAQ;YACR,UAAU;YACV,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC;YAC3C,eAAe;SAChB,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GACP,OAAO,CAAC,GAAG;YACX,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACxE,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;SACX,CAAC,CAAC,CAAC;QACJ,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,eAAe,CACnB,IAAI,EACJ,iBAAiB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,WAAW,CACnB,sBAAsB,EACtB,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAMnC,EAAE;IACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GACP,OAAO,CAAC,GAAG;YACX,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACxE,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;SACX,CAAC,CAAC,CAAC;IACN,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAAK,CACvF,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,WAAW,CACnB,sBAAsB,EACtB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAIhC,EAAE;IACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,GACP,OAAO,CAAC,GAAG;gBACX,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;gBACzC,QAAQ;gBACR,WAAW;gBACX,sBAAsB;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,WAAW,CACnB,sBAAsB,EACtB,0DAA0D,CAC3D,CAAC;AACJ,CAAC"}

package/dist/supervisor.d.ts

@@ -0,0 +1,23 @@
+import { type ChildProcess, type SpawnOptions } from "node:child_process";
+import { type BridgeStartAgentPayload, type BridgeCommandSecret } from "crewx-agent-protocol";
+import { type BridgeConfig, type BridgeFolderConfig } from "./config.js";
+export type SpawnProcess = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
+export declare function minimalChildEnvironment(additions: Record<string, string>, source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function resolveAgentCliEntrypoint(): string;
+export declare class ProcessSupervisor {
+    private readonly config;
+    private readonly spawnProcess;
+    private readonly cliEntrypoint;
+    private readonly runs;
+    constructor(config: BridgeConfig, spawnProcess?: SpawnProcess, cliEntrypoint?: string);
+    activeCount(): number;
+    activeRuns(): Array<{
+        id: string;
+        pid: number;
+    }>;
+    isRunning(runId: string, _journalPid?: number | null): boolean;
+    start(payload: BridgeStartAgentPayload, secret: BridgeCommandSecret, folder: BridgeFolderConfig): number;
+    stop(runId: string, _journalPid?: number | null): Promise<void>;
+    stopAll(): Promise<void>;
+}
+//# sourceMappingURL=supervisor.d.ts.map

package/dist/supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGjF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGzE,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AA0BlB,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAOnB;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAgCD,qBAAa,iBAAiB;IAI1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;gBAGnC,MAAM,EAAE,YAAY,EACpB,YAAY,GAAE,YAAoB,EAClC,aAAa,SAA8B;IAG9D,WAAW,IAAI,MAAM;IAIrB,UAAU,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAMhD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAK9D,KAAK,CACH,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,kBAAkB,GACzB,MAAM;IA4CH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB/D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAK/B"}

package/dist/supervisor.js

@@ -0,0 +1,149 @@
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { BridgeError } from "./errors.js";
+const PASSTHROUGH_ENVIRONMENT = [
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "TMPDIR",
+    "LANG",
+    "LC_ALL",
+    "XDG_CONFIG_HOME",
+    "XDG_CACHE_HOME",
+    "XDG_DATA_HOME",
+    "XDG_STATE_HOME",
+    "OPENAI_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "CODEX_HOME",
+    "CLAUDE_CONFIG_DIR",
+];
+export function minimalChildEnvironment(additions, source = process.env) {
+    const environment = {};
+    for (const key of PASSTHROUGH_ENVIRONMENT) {
+        const value = source[key];
+        if (value !== undefined)
+            environment[key] = value;
+    }
+    return { ...environment, ...additions };
+}
+export function resolveAgentCliEntrypoint() {
+    return fileURLToPath(import.meta.resolve("crewx-agent-cli"));
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function signalProcessGroup(pid, signal) {
+    try {
+        process.kill(-pid, signal);
+    }
+    catch {
+        try {
+            process.kill(pid, signal);
+        }
+        catch {
+            // It may have exited between the liveness check and signal.
+        }
+    }
+}
+async function waitForExit(pid, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (!processAlive(pid))
+            return true;
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    return !processAlive(pid);
+}
+export class ProcessSupervisor {
+    config;
+    spawnProcess;
+    cliEntrypoint;
+    runs = new Map();
+    constructor(config, spawnProcess = spawn, cliEntrypoint = resolveAgentCliEntrypoint()) {
+        this.config = config;
+        this.spawnProcess = spawnProcess;
+        this.cliEntrypoint = cliEntrypoint;
+    }
+    activeCount() {
+        return [...this.runs.values()].filter(({ pid }) => processAlive(pid)).length;
+    }
+    activeRuns() {
+        return [...this.runs.entries()]
+            .filter(([, { pid }]) => processAlive(pid))
+            .map(([id, { pid }]) => ({ id, pid }));
+    }
+    isRunning(runId, _journalPid) {
+        const pid = this.runs.get(runId)?.pid;
+        return typeof pid === "number" && processAlive(pid);
+    }
+    start(payload, secret, folder) {
+        if (this.isRunning(payload.run_id)) {
+            const existing = this.runs.get(payload.run_id);
+            if (existing)
+                return existing.pid;
+        }
+        if (this.activeCount() >= this.config.policy.maxConcurrentRuns) {
+            throw new BridgeError("policy_concurrency_exceeded", "The local concurrent-run limit has been reached.");
+        }
+        const args = [
+            this.cliEntrypoint,
+            "daemon",
+            "--adapter",
+            payload.adapter,
+            "--cwd",
+            folder.path,
+        ];
+        const child = this.spawnProcess(process.execPath, args, {
+            cwd: folder.path,
+            env: minimalChildEnvironment({
+                CREWX_URL: secret.api_url,
+                CREWX_TOKEN: secret.agent_token,
+                CREWX_ADAPTER: payload.adapter,
+                CREWX_BRIDGE_ROOT: folder.path,
+            }),
+            detached: true,
+            shell: false,
+            stdio: "ignore",
+        });
+        if (!child.pid) {
+            child.kill();
+            throw new BridgeError("spawn_failed", "The agent runner did not return a process ID.");
+        }
+        this.runs.set(payload.run_id, { pid: child.pid, child });
+        child.once("exit", () => {
+            const current = this.runs.get(payload.run_id);
+            if (current?.child === child)
+                this.runs.delete(payload.run_id);
+        });
+        return child.pid;
+    }
+    async stop(runId, _journalPid) {
+        // A PID restored from disk is not a process identity: after a restart it
+        // may belong to an unrelated process. Only signal children this
+        // supervisor spawned and still tracks in memory.
+        const pid = this.runs.get(runId)?.pid;
+        if (!pid || !processAlive(pid)) {
+            this.runs.delete(runId);
+            return;
+        }
+        signalProcessGroup(pid, "SIGTERM");
+        const exited = await waitForExit(pid, this.config.policy.shutdownGraceMs);
+        if (!exited) {
+            signalProcessGroup(pid, "SIGKILL");
+            await waitForExit(pid, 1_000);
+        }
+        this.runs.delete(runId);
+    }
+    async stopAll() {
+        await Promise.all([...this.runs.entries()].map(([runId, { pid }]) => this.stop(runId, pid)));
+    }
+}
+//# sourceMappingURL=supervisor.js.map

package/dist/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAQzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa1C,MAAM,uBAAuB,GAAG;IAC9B,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,mBAAmB;CACX,CAAC;AAEX,MAAM,UAAU,uBAAuB,CACrC,SAAiC,EACjC,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,MAAsB;IAC7D,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,SAAiB;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEtD,YACmB,MAAoB,EACpB,eAA6B,KAAK,EAClC,gBAAgB,yBAAyB,EAAE;QAF3C,WAAM,GAAN,MAAM,CAAc;QACpB,iBAAY,GAAZ,YAAY,CAAsB;QAClC,kBAAa,GAAb,aAAa,CAA8B;IAC3D,CAAC;IAEJ,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/E,CAAC;IAED,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,WAA2B;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;QACtC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CACH,OAAgC,EAChC,MAA2B,EAC3B,MAA0B;QAE1B,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/D,MAAM,IAAI,WAAW,CACnB,6BAA6B,EAC7B,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG;YACX,IAAI,CAAC,aAAa;YAClB,QAAQ;YACR,WAAW;YACX,OAAO,CAAC,OAAO;YACf,OAAO;YACP,MAAM,CAAC,IAAI;SACZ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;YACtD,GAAG,EAAE,MAAM,CAAC,IAAI;YAChB,GAAG,EAAE,uBAAuB,CAAC;gBAC3B,SAAS,EAAE,MAAM,CAAC,OAAO;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,OAAO,CAAC,OAAO;gBAC9B,iBAAiB,EAAE,MAAM,CAAC,IAAI;aAC/B,CAAC;YACF,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,+CAA+C,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,WAA2B;QACnD,yEAAyE;QACzE,gEAAgE;QAChE,iDAAiD;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACnC,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "crewx-bridge",
+  "version": "0.1.0",
+  "description": "Secure macOS and Linux machine bridge for CrewX agent runtimes.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "crewx-bridge": "./dist/index.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "keywords": [
+    "crewx",
+    "daemon",
+    "bridge",
+    "codex",
+    "claude-code",
+    "agent-runner"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "commander": "^14.0.2",
+    "zod": "^4.1.12",
+    "crewx-agent-cli": "0.2.1",
+    "crewx-agent-protocol": "0.2.1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "typescript": "^5.9.3"
+  },
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node --input-type=module -e \"import { chmodSync } from 'node:fs'; chmodSync('dist/index.js', 0o755)\"",
+    "test": "pnpm --filter crewx-agent-protocol build && pnpm --filter crewx-agent-cli build && pnpm run build && node --test test/*.test.mjs",
+    "types:check": "tsc -p tsconfig.json --noEmit"
+  }
+}