machine-bridge-mcp 0.1.0

package/src/local/service.mjs

@@ -0,0 +1,224 @@
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { run } from "./shell.mjs";
+import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";
+
+const LABEL = "dev.machine-bridge-mcp.daemon";
+const WINDOWS_TASK = "MachineBridgeMCP";
+
+export async function installAutostart({ workspace, stateRoot, entryScript, policy, logger = console }) {
+  const spec = serviceSpec({ workspace, stateRoot, entryScript, policy });
+  if (process.platform === "darwin") return installLaunchd(spec, logger);
+  if (process.platform === "win32") return installWindowsTask(spec, logger);
+  return installSystemd(spec, logger);
+}
+
+export async function uninstallAutostart({ stateRoot, logger = console } = {}) {
+  if (process.platform === "darwin") return uninstallLaunchd(logger);
+  if (process.platform === "win32") return uninstallWindowsTask(logger);
+  return uninstallSystemd(logger);
+}
+
+export async function autostartStatus({ logger = console } = {}) {
+  if (process.platform === "darwin") return statusLaunchd(logger);
+  if (process.platform === "win32") return statusWindowsTask(logger);
+  return statusSystemd(logger);
+}
+
+export async function startAutostart({ logger = console } = {}) {
+  if (process.platform === "darwin") return startLaunchd(logger);
+  if (process.platform === "win32") return run("schtasks", ["/Run", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true });
+  return run("systemctl", ["--user", "start", "machine-bridge-mcp.service"], { capture: true, allowFailure: true });
+}
+
+export async function stopAutostart({ logger = console } = {}) {
+  if (process.platform === "darwin") return stopLaunchd(logger);
+  if (process.platform === "win32") return run("schtasks", ["/End", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true });
+  return run("systemctl", ["--user", "stop", "machine-bridge-mcp.service"], { capture: true, allowFailure: true });
+}
+
+function serviceSpec({ workspace, stateRoot, entryScript, policy = {} }) {
+  const root = expandHome(stateRoot);
+  const logs = path.join(root, "logs");
+  ensureOwnerOnlyDir(root);
+  ensureOwnerOnlyDir(logs);
+  return {
+    workspace,
+    stateRoot: root,
+    entryScript: path.resolve(entryScript),
+    node: process.execPath,
+    stdout: path.join(logs, "daemon.out.log"),
+    stderr: path.join(logs, "daemon.err.log"),
+    policy: {
+      allowWrite: policy.allowWrite !== false,
+      allowExec: policy.allowExec !== false,
+      minimalEnv: policy.minimalEnv !== false,
+    },
+  };
+}
+
+function daemonArgs(spec) {
+  const args = [
+    spec.entryScript,
+    "start",
+    "--daemon-only",
+    "--workspace", spec.workspace,
+    "--state-dir", spec.stateRoot,
+    "--no-print-credentials",
+    "--quiet",
+  ];
+  if (spec.policy.allowWrite === false) args.push("--no-write");
+  if (spec.policy.allowExec === false) args.push("--no-exec");
+  if (spec.policy.minimalEnv === false) args.push("--full-env");
+  return args;
+}
+
+function launchdPlistPath() {
+  return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
+}
+
+async function installLaunchd(spec, logger) {
+  const plistPath = launchdPlistPath();
+  mkdirSync(path.dirname(plistPath), { recursive: true });
+  const args = [spec.node, ...daemonArgs(spec)];
+  writeFileSync(plistPath, launchdPlist({ args, stdout: spec.stdout, stderr: spec.stderr }), { mode: 0o644 });
+  logger.info?.(`Autostart installed for next login: ${plistPath}`);
+  return { ok: true, provider: "launchd", path: plistPath };
+}
+
+async function startLaunchd(logger) {
+  const plistPath = launchdPlistPath();
+  const target = `gui/${process.getuid?.() ?? ""}`;
+  if (!existsSync(plistPath)) return { ok: false, error: "launchd plist not installed" };
+  await run("launchctl", ["bootout", target, plistPath], { capture: true, allowFailure: true });
+  const boot = await run("launchctl", ["bootstrap", target, plistPath], { capture: true, allowFailure: true });
+  const kick = await run("launchctl", ["kickstart", "-k", `${target}/${LABEL}`], { capture: true, allowFailure: true });
+  logger.info?.("launchd service started");
+  return { ok: boot.code === 0 || kick.code === 0, bootstrap: boot, kickstart: kick };
+}
+
+async function stopLaunchd(logger) {
+  const plistPath = launchdPlistPath();
+  const target = `gui/${process.getuid?.() ?? ""}`;
+  const result = await run("launchctl", ["bootout", target, plistPath], { capture: true, allowFailure: true });
+  logger.info?.("launchd service stopped");
+  return result;
+}
+
+async function uninstallLaunchd(logger) {
+  await stopLaunchd(logger).catch(() => {});
+  const plistPath = launchdPlistPath();
+  if (existsSync(plistPath)) rmSync(plistPath, { force: true });
+  logger.info?.(`Autostart removed: ${plistPath}`);
+  return { ok: true, provider: "launchd", path: plistPath };
+}
+
+async function statusLaunchd() {
+  const plistPath = launchdPlistPath();
+  const target = `gui/${process.getuid?.() ?? ""}/${LABEL}`;
+  const result = await run("launchctl", ["print", target], { capture: true, allowFailure: true });
+  return { ok: existsSync(plistPath), provider: "launchd", installed: existsSync(plistPath), path: plistPath, active: result.code === 0, detail: result.stdout || result.stderr };
+}
+
+function launchdPlist({ args, stdout, stderr }) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${escapeXml(LABEL)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args.map(arg => `    <string>${escapeXml(arg)}</string>`).join("\n")}
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${escapeXml(stdout)}</string>
+  <key>StandardErrorPath</key><string>${escapeXml(stderr)}</string>
+</dict>
+</plist>
+`;
+}
+
+function systemdPath() {
+  return path.join(os.homedir(), ".config", "systemd", "user", "machine-bridge-mcp.service");
+}
+
+async function installSystemd(spec, logger) {
+  const servicePath = systemdPath();
+  mkdirSync(path.dirname(servicePath), { recursive: true });
+  writeFileSync(servicePath, systemdUnit(spec), { mode: 0o644 });
+  const reload = await run("systemctl", ["--user", "daemon-reload"], { capture: true, allowFailure: true });
+  const enable = await run("systemctl", ["--user", "enable", "machine-bridge-mcp.service"], { capture: true, allowFailure: true });
+  const linger = await run("loginctl", ["enable-linger", os.userInfo().username], { capture: true, allowFailure: true });
+  logger.info?.(`Autostart installed: ${servicePath}`);
+  return { ok: reload.code === 0 && enable.code === 0, provider: "systemd", path: servicePath, reload, enable, linger };
+}
+
+async function uninstallSystemd(logger) {
+  await run("systemctl", ["--user", "disable", "--now", "machine-bridge-mcp.service"], { capture: true, allowFailure: true });
+  const servicePath = systemdPath();
+  if (existsSync(servicePath)) rmSync(servicePath, { force: true });
+  await run("systemctl", ["--user", "daemon-reload"], { capture: true, allowFailure: true });
+  logger.info?.(`Autostart removed: ${servicePath}`);
+  return { ok: true, provider: "systemd", path: servicePath };
+}
+
+async function statusSystemd() {
+  const servicePath = systemdPath();
+  const result = await run("systemctl", ["--user", "status", "machine-bridge-mcp.service", "--no-pager"], { capture: true, allowFailure: true });
+  return { ok: existsSync(servicePath), provider: "systemd", installed: existsSync(servicePath), path: servicePath, active: result.code === 0, detail: result.stdout || result.stderr };
+}
+
+function systemdUnit(spec) {
+  const execArgs = [spec.node, ...daemonArgs(spec)].map(systemdQuote).join(" ");
+  return `[Unit]
+Description=Machine Bridge MCP daemon
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${execArgs}
+Restart=always
+RestartSec=5
+StandardOutput=append:${spec.stdout}
+StandardError=append:${spec.stderr}
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+async function installWindowsTask(spec, logger) {
+  const command = windowsCommand(spec);
+  const result = await run("schtasks", ["/Create", "/TN", WINDOWS_TASK, "/SC", "ONLOGON", "/TR", command, "/F"], { capture: true, allowFailure: true });
+  logger.info?.("Windows Scheduled Task installed for logon");
+  return { ok: result.code === 0, provider: "schtasks", task: WINDOWS_TASK, result };
+}
+
+async function uninstallWindowsTask(logger) {
+  const result = await run("schtasks", ["/Delete", "/TN", WINDOWS_TASK, "/F"], { capture: true, allowFailure: true });
+  logger.info?.("Windows Scheduled Task removed");
+  return { ok: result.code === 0 || /cannot find/i.test(result.stderr), provider: "schtasks", task: WINDOWS_TASK, result };
+}
+
+async function statusWindowsTask() {
+  const result = await run("schtasks", ["/Query", "/TN", WINDOWS_TASK, "/FO", "LIST"], { capture: true, allowFailure: true });
+  return { ok: result.code === 0, provider: "schtasks", installed: result.code === 0, task: WINDOWS_TASK, active: result.code === 0, detail: result.stdout || result.stderr };
+}
+
+function windowsCommand(spec) {
+  return [spec.node, ...daemonArgs(spec)].map(winQuote).join(" ");
+}
+
+function winQuote(value) {
+  return `"${String(value).replaceAll('"', '\\"')}"`;
+}
+
+function systemdQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+function escapeXml(value) {
+  return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}

package/src/local/shell.mjs

@@ -0,0 +1,68 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { packageRoot } from "./state.mjs";
+
+export function run(command, args = [], options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd || process.cwd(),
+      env: options.env || process.env,
+      stdio: options.capture ? ["ignore", "pipe", "pipe"] : "inherit",
+      shell: false,
+    });
+    let stdout = "";
+    let stderr = "";
+    if (options.capture) {
+      child.stdout?.on("data", chunk => { stdout += String(chunk); });
+      child.stderr?.on("data", chunk => { stderr += String(chunk); });
+    }
+    child.on("error", error => {
+      if (options.allowFailure) resolve({ code: 127, stdout, stderr: error.message });
+      else reject(error);
+    });
+    child.on("close", code => {
+      const result = { code, stdout, stderr };
+      if (code === 0 || options.allowFailure) resolve(result);
+      else {
+        const error = new Error((stderr || stdout || `${command} exited ${code}`).trim());
+        error.result = result;
+        reject(error);
+      }
+    });
+  });
+}
+
+export function findWranglerCommand() {
+  const suffix = process.platform === "win32" ? ".cmd" : "";
+  const local = path.join(packageRoot, "node_modules", ".bin", `wrangler${suffix}`);
+  if (existsSync(local)) return { cmd: local, argsPrefix: [] };
+  return { cmd: "npx", argsPrefix: ["wrangler"] };
+}
+
+export async function runWrangler(args, options = {}) {
+  const wrangler = findWranglerCommand();
+  return run(wrangler.cmd, [...wrangler.argsPrefix, ...args], { cwd: packageRoot, ...options });
+}
+
+export function workspaceShellCommand(command) {
+  if (process.platform === "win32") {
+    return { cmd: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-Command", command] };
+  }
+  const shell = process.env.MBM_EXEC_SHELL || (existsSync("/bin/zsh") ? "/bin/zsh" : existsSync("/bin/bash") ? "/bin/bash" : "/bin/sh");
+  const base = path.basename(shell);
+  if (base === "zsh") return { cmd: shell, args: ["-f", "-c", command] };
+  if (base === "bash") return { cmd: shell, args: ["--noprofile", "--norc", "-c", command] };
+  return { cmd: shell, args: ["-c", command] };
+}
+
+export function executionEnv(workspace, options = {}) {
+  // Keep environment small to avoid accidental dependence on the launching shell,
+  // but do not hide filesystem contents. Operators can opt into full env when desired.
+  if (options.fullEnv || process.env.MBM_PASS_ENV === "true") return { ...process.env, MBM_WORKSPACE: workspace };
+  const allowed = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "TMP", "TEMP", "SystemRoot", "WINDIR"];
+  const env = { MBM_WORKSPACE: workspace };
+  for (const key of allowed) if (process.env[key]) env[key] = process.env[key];
+  if (!env.PATH) env.PATH = process.env.PATH || "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+  return env;
+}

package/src/local/state.mjs

@@ -0,0 +1,170 @@
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, realpathSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+export const appName = "machine-bridge-mcp";
+
+export function expandHome(input = "") {
+  if (!input || input === "~") return os.homedir();
+  if (input.startsWith("~/")) return path.join(os.homedir(), input.slice(2));
+  return input;
+}
+
+export function resolveWorkspace(input = process.cwd()) {
+  const resolved = path.resolve(expandHome(input));
+  return realpathSync(resolved);
+}
+
+export function defaultStateRoot() {
+  if (process.platform === "win32") {
+    const base = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+    return path.join(base, appName);
+  }
+  if (process.env.XDG_STATE_HOME) return path.join(expandHome(process.env.XDG_STATE_HOME), appName);
+  return path.join(os.homedir(), ".local", "state", appName);
+}
+
+
+export function configPath(stateRoot = defaultStateRoot()) {
+  return path.join(expandHome(stateRoot), "config.json");
+}
+
+export function loadGlobalConfig(stateRoot = defaultStateRoot()) {
+  const file = configPath(stateRoot);
+  if (!existsSync(file)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+export function saveGlobalConfig(config, stateRoot = defaultStateRoot()) {
+  const root = expandHome(stateRoot);
+  ensureOwnerOnlyDir(root);
+  const file = configPath(root);
+  writeFileSync(file, `${JSON.stringify({ ...config, updatedAt: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
+  ownerOnlyFile(file);
+}
+
+export function setSelectedWorkspace(workspace, stateRoot = defaultStateRoot()) {
+  const root = expandHome(stateRoot);
+  const config = loadGlobalConfig(root);
+  config.selectedWorkspace = workspace;
+  config.selectedWorkspaceHash = workspaceHash(workspace);
+  saveGlobalConfig(config, root);
+  return config;
+}
+
+export function selectedWorkspace(stateRoot = defaultStateRoot()) {
+  const value = loadGlobalConfig(stateRoot).selectedWorkspace;
+  return typeof value === "string" && value.trim() ? value : "";
+}
+
+export function removeStateRoot(stateRoot = defaultStateRoot()) {
+  const root = expandHome(stateRoot);
+  if (existsSync(root)) rmSync(root, { recursive: true, force: true });
+}
+
+export function workspaceHash(workspace) {
+  return createHash("sha256").update(String(workspace)).digest("hex").slice(0, 24);
+}
+
+export function profileDirForWorkspace(workspace, stateRoot = defaultStateRoot()) {
+  return path.join(expandHome(stateRoot), "profiles", workspaceHash(workspace));
+}
+
+export function statePathForWorkspace(workspace, stateRoot = defaultStateRoot()) {
+  return path.join(profileDirForWorkspace(workspace, stateRoot), "state.json");
+}
+
+export function loadState(workspace, options = {}) {
+  const stateRoot = options.stateDir ? expandHome(options.stateDir) : defaultStateRoot();
+  const profileDir = profileDirForWorkspace(workspace, stateRoot);
+  const statePath = path.join(profileDir, "state.json");
+  ensureOwnerOnlyDir(profileDir);
+  let state = {};
+  if (existsSync(statePath)) {
+    state = JSON.parse(readFileSync(statePath, "utf8"));
+  }
+  state.schemaVersion = 1;
+  state.workspace = {
+    path: workspace,
+    hash: workspaceHash(workspace),
+    updatedAt: new Date().toISOString(),
+  };
+  state.paths = { stateRoot, profileDir, statePath };
+  state.worker ||= {};
+  state.policy ||= {};
+  return state;
+}
+
+export function saveState(state) {
+  const statePath = state?.paths?.statePath;
+  if (!statePath) throw new Error("state path is missing");
+  ensureOwnerOnlyDir(path.dirname(statePath));
+  const serializable = { ...state };
+  writeFileSync(statePath, `${JSON.stringify(serializable, null, 2)}\n`, { mode: 0o600 });
+  ownerOnlyFile(statePath);
+}
+
+export function ensureWorkerSecrets(state, options = {}) {
+  state.worker ||= {};
+  if (!state.worker.oauthPassword || options.rotateSecrets) state.worker.oauthPassword = randomToken("mcp_password");
+  if (!state.worker.daemonSecret || options.rotateSecrets) state.worker.daemonSecret = randomToken("daemon_secret");
+  if (!state.worker.oauthTokenVersion || options.rotateSecrets) state.worker.oauthTokenVersion = randomToken("token_version");
+  if (!state.worker.name || options.workerName) state.worker.name = options.workerName || defaultWorkerName(state.workspace.hash);
+}
+
+export function defaultWorkerName(hash) {
+  return `mbm-${String(hash || "default").slice(0, 12)}`;
+}
+
+export function randomToken(prefix) {
+  return `${prefix}_${randomBytes(32).toString("base64url")}`;
+}
+
+export function sha256(value) {
+  return createHash("sha256").update(String(value)).digest("hex");
+}
+
+export function fileSha256(filePath) {
+  return createHash("sha256").update(readFileSync(filePath)).digest("hex");
+}
+
+export function ensureOwnerOnlyDir(dir) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { chmodSync(dir, 0o700); } catch {}
+}
+
+export function ownerOnlyFile(filePath) {
+  try { chmodSync(filePath, 0o600); } catch {}
+}
+
+export function redactState(state) {
+  const clone = redactHomeInValue(JSON.parse(JSON.stringify(state)));
+  if (clone.worker?.oauthPassword) clone.worker.oauthPassword = previewSecret(clone.worker.oauthPassword);
+  if (clone.worker?.daemonSecret) clone.worker.daemonSecret = previewSecret(clone.worker.daemonSecret);
+  if (clone.worker?.oauthTokenVersion) clone.worker.oauthTokenVersion = previewSecret(clone.worker.oauthTokenVersion);
+  return clone;
+}
+
+function redactHomeInValue(value) {
+  const home = os.homedir();
+  if (typeof value === "string") return home && value.startsWith(home) ? `~${value.slice(home.length)}` : value;
+  if (Array.isArray(value)) return value.map(redactHomeInValue);
+  if (value && typeof value === "object") {
+    for (const key of Object.keys(value)) value[key] = redactHomeInValue(value[key]);
+  }
+  return value;
+}
+
+export function previewSecret(value) {
+  const text = String(value || "");
+  if (text.length <= 12) return "<redacted>";
+  return `${text.slice(0, 10)}...${text.slice(-6)}`;
+}