patchwork-os 0.2.0-alpha.0

package/deploy/bootstrap-new-vps.sh

@@ -0,0 +1,364 @@
+#!/usr/bin/env bash
+# deploy/bootstrap-new-vps.sh
+# Full fresh-server setup for claude-ide-bridge on a NEW VPS.
+# Handles everything from Node.js install to running HTTPS service.
+#
+# Usage (run as root on a fresh Ubuntu 22.04/24.04 VPS):
+#   curl -fsSL https://raw.githubusercontent.com/Oolab-labs/claude-ide-bridge/main/deploy/bootstrap-new-vps.sh | \
+#     DOMAIN=bridge.example.com bash
+#
+#   Or after cloning:
+#   DOMAIN=bridge.example.com bash deploy/bootstrap-new-vps.sh
+#
+# Required environment variables:
+#   DOMAIN        Subdomain for the bridge  (e.g. bridge.example.com)
+#
+# Optional environment variables:
+#   REPO_URL      Git repo URL              (default: https://github.com/Oolab-labs/claude-ide-bridge)
+#   INSTALL_DIR   Where to clone the repo   (default: /opt/claude-ide-bridge)
+#   SERVICE_USER  System user to run bridge (default: claude-bridge)
+#   PORT          Bridge port               (default: 9000)
+#   BRANCH        Git branch to clone       (default: main)
+#   SKIP_CERTBOT  Set to 1 to skip TLS cert (useful if DNS not yet set)
+
+set -euo pipefail
+
+# ── Config ────────────────────────────────────────────────────────────────────
+DOMAIN="${DOMAIN:-}"
+REPO_URL="${REPO_URL:-https://github.com/Oolab-labs/claude-ide-bridge}"
+INSTALL_DIR="${INSTALL_DIR:-/opt/claude-ide-bridge}"
+SERVICE_USER="${SERVICE_USER:-claude-bridge}"
+PORT="${PORT:-9000}"
+BRANCH="${BRANCH:-main}"
+SKIP_CERTBOT="${SKIP_CERTBOT:-0}"
+SERVICE_NAME="claude-ide-bridge"
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+info()    { echo -e "${GREEN}✓${NC} $*"; }
+warn()    { echo -e "${YELLOW}⚠${NC}  $*"; }
+err()     { echo -e "${RED}✗${NC} $*" >&2; }
+section() { echo ""; echo "── $* ──────────────────────────────────────────"; }
+
+# ── Pre-flight ────────────────────────────────────────────────────────────────
+section "Pre-flight"
+
+[[ "$(id -u)" -eq 0 ]] || { err "Run as root: sudo bash deploy/bootstrap-new-vps.sh"; exit 1; }
+
+if [[ -z "$DOMAIN" ]]; then
+  err "DOMAIN is required. Example:"
+  echo "  DOMAIN=bridge.example.com bash deploy/bootstrap-new-vps.sh"
+  exit 1
+fi
+
+info "Domain:       $DOMAIN"
+info "Install dir:  $INSTALL_DIR"
+info "Service user: $SERVICE_USER"
+info "Port:         $PORT"
+info "Branch:       $BRANCH"
+
+# ── 1. System packages ────────────────────────────────────────────────────────
+section "System packages"
+
+apt-get update -qq
+apt-get install -y -qq curl git nginx certbot python3-certbot-nginx ufw
+info "System packages installed"
+
+# ── 2. Node.js 20+ ────────────────────────────────────────────────────────────
+section "Node.js"
+
+NODE_OK=false
+if command -v node &>/dev/null; then
+  NODE_VER=$(node -e 'console.log(parseInt(process.version.slice(1)))')
+  [[ "$NODE_VER" -ge 20 ]] && NODE_OK=true
+fi
+
+if [[ "$NODE_OK" == false ]]; then
+  info "Installing Node.js 20..."
+  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+  apt-get install -y -qq nodejs
+fi
+
+NODE_VERSION=$(node --version)
+info "Node $NODE_VERSION / npm $(npm --version)"
+
+# ── 3. Service user ───────────────────────────────────────────────────────────
+section "Service user"
+
+if ! id "$SERVICE_USER" &>/dev/null; then
+  useradd --system --create-home --shell /bin/bash "$SERVICE_USER"
+  info "Created user: $SERVICE_USER"
+else
+  info "User already exists: $SERVICE_USER"
+fi
+
+# ── 4. Clone or update repo ───────────────────────────────────────────────────
+section "Repository"
+
+if [[ -d "$INSTALL_DIR/.git" ]]; then
+  info "Repo exists — pulling latest..."
+  git -C "$INSTALL_DIR" fetch origin
+  git -C "$INSTALL_DIR" checkout "$BRANCH"
+  git -C "$INSTALL_DIR" pull origin "$BRANCH"
+else
+  info "Cloning $REPO_URL..."
+  git clone --branch "$BRANCH" --depth 1 "$REPO_URL" "$INSTALL_DIR"
+fi
+
+chown -R "$SERVICE_USER:$SERVICE_USER" "$INSTALL_DIR"
+info "Repo ready at $INSTALL_DIR"
+
+# ── 5. Build ──────────────────────────────────────────────────────────────────
+section "Build"
+
+# Run npm install + build as SERVICE_USER
+sudo -u "$SERVICE_USER" bash -c "cd $INSTALL_DIR && npm ci --prefer-offline 2>&1"
+sudo -u "$SERVICE_USER" bash -c "cd $INSTALL_DIR && npm run build 2>&1"
+info "Build complete"
+
+# ── 6. Generate .env.vps ──────────────────────────────────────────────────────
+section ".env.vps"
+
+ENV_FILE="$INSTALL_DIR/.env.vps"
+if [[ -f "$ENV_FILE" ]]; then
+  warn ".env.vps already exists — leaving unchanged"
+  source "$ENV_FILE"
+  info "  PORT=$PORT  WORKSPACE=$WORKSPACE  TOKEN=***"
+else
+  FIXED_TOKEN=$(node -e "console.log(require('crypto').randomUUID())")
+  WORKSPACE="$INSTALL_DIR"
+  cat > "$ENV_FILE" <<EOF
+# Claude IDE Bridge — VPS config
+# Generated by bootstrap-new-vps.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)
+# Gitignored — never commit this file.
+
+PORT=$PORT
+WORKSPACE=$WORKSPACE
+FIXED_TOKEN=$FIXED_TOKEN
+BRIDGE_SESSION=bridge
+NGROK_SESSION=ngrok
+EOF
+  chmod 600 "$ENV_FILE"
+  chown "$SERVICE_USER:$SERVICE_USER" "$ENV_FILE"
+  info ".env.vps created"
+  info "  PORT=$PORT"
+  info "  WORKSPACE=$WORKSPACE"
+  info "  TOKEN=$FIXED_TOKEN"
+fi
+
+# Reload in case it already existed
+source "$ENV_FILE"
+
+# ── 7. Firewall ───────────────────────────────────────────────────────────────
+section "Firewall (ufw)"
+
+ufw --force enable >/dev/null 2>&1 || true
+ufw allow ssh   >/dev/null 2>&1
+ufw allow 80    >/dev/null 2>&1
+ufw allow 443   >/dev/null 2>&1
+info "ufw: ssh, 80, 443 open"
+
+# ── 8. Systemd service ────────────────────────────────────────────────────────
+section "Systemd service"
+
+# Generate service file from template (parameterised for this install)
+cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<SERVICE
+[Unit]
+Description=Claude IDE Bridge MCP Server
+Documentation=https://github.com/Oolab-labs/claude-ide-bridge
+After=network.target
+StartLimitIntervalSec=120
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=$SERVICE_USER
+WorkingDirectory=$INSTALL_DIR
+
+# Load config — FIXED_TOKEN, PORT, WORKSPACE
+EnvironmentFile=$ENV_FILE
+
+# Bridge process
+ExecStart=/usr/bin/node $INSTALL_DIR/dist/index.js \\
+    --port \${PORT} \\
+    --workspace \${WORKSPACE} \\
+    --fixed-token \${FIXED_TOKEN} \\
+    --grace-period 120000 \\
+    --vps
+
+KillMode=mixed
+KillSignal=SIGTERM
+TimeoutStopSec=15
+Restart=always
+RestartSec=5
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=claude-ide-bridge
+
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+SERVICE
+
+systemctl daemon-reload
+systemctl enable "$SERVICE_NAME"
+info "Systemd service installed and enabled"
+
+# ── 9. nginx ──────────────────────────────────────────────────────────────────
+section "nginx"
+
+# Add connection_upgrade map to nginx.conf if missing
+if ! grep -q "connection_upgrade" /etc/nginx/nginx.conf 2>/dev/null; then
+  # Insert after the `http {` line
+  perl -i -0pe 's/(http \{)/$1\n    map \$http_upgrade \$connection_upgrade {\n        default upgrade;\n        '"''"'     close;\n    }/' /etc/nginx/nginx.conf
+  info "Added connection_upgrade map to nginx.conf"
+fi
+
+# Write nginx site config (domain injected here, not hardcoded in repo)
+cat > "/etc/nginx/sites-available/claude-bridge" <<NGINX
+# Claude IDE Bridge — nginx reverse proxy
+# Domain: $DOMAIN  Port: ${PORT}
+# Generated by bootstrap-new-vps.sh
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $DOMAIN;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    location / {
+        return 301 https://\$host\$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name $DOMAIN;
+
+    # TLS — populated by Certbot
+    # ssl_certificate     /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
+    # include /etc/letsencrypt/options-ssl-nginx.conf;
+    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # /mcp — Streamable HTTP MCP endpoint (SSE-safe)
+    location /mcp {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+        proxy_connect_timeout 10s;
+        proxy_set_header Authorization \$http_authorization;
+        proxy_pass_header Authorization;
+        proxy_set_header Mcp-Session-Id \$http_mcp_session_id;
+        proxy_pass_header Mcp-Session-Id;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection \$connection_upgrade;
+    }
+
+    location /health {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 10s;
+    }
+
+    location /.well-known/ {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 10s;
+    }
+
+    location / {
+        return 404;
+    }
+}
+NGINX
+
+# Enable site
+[[ -L "/etc/nginx/sites-enabled/claude-bridge" ]] || \
+  ln -s /etc/nginx/sites-available/claude-bridge /etc/nginx/sites-enabled/claude-bridge
+
+# Remove default site (conflicts on port 80)
+[[ -L "/etc/nginx/sites-enabled/default" ]] && \
+  rm -f /etc/nginx/sites-enabled/default && info "Removed nginx default site"
+
+nginx -t
+systemctl reload nginx
+info "nginx configured for $DOMAIN"
+
+# ── 10. TLS certificate ───────────────────────────────────────────────────────
+section "TLS certificate"
+
+if [[ "$SKIP_CERTBOT" == "1" ]]; then
+  warn "SKIP_CERTBOT=1 — skipping cert. Run manually later:"
+  echo "  certbot --nginx -d $DOMAIN"
+else
+  if certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
+      --register-unsafely-without-email --redirect 2>&1; then
+    info "TLS certificate obtained for $DOMAIN"
+  else
+    warn "Certbot failed. Common causes:"
+    echo "   - DNS not yet pointing to this IP (check: dig $DOMAIN)"
+    echo "   - Port 80 blocked"
+    echo "  Re-run manually: certbot --nginx -d $DOMAIN"
+  fi
+fi
+
+# ── 11. Start service ─────────────────────────────────────────────────────────
+section "Starting service"
+
+systemctl restart "$SERVICE_NAME"
+
+echo -n "Waiting for bridge..."
+for i in $(seq 1 30); do
+  if curl -sf --max-time 3 "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
+    echo " ready."
+    break
+  fi
+  sleep 1; echo -n "."
+  if [[ $i -eq 30 ]]; then
+    echo " timed out."
+    warn "Check logs: journalctl -u $SERVICE_NAME -n 50"
+  fi
+done
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  Claude IDE Bridge — bootstrap complete"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+echo "  MCP endpoint:  https://$DOMAIN/mcp"
+echo "  Health check:  https://$DOMAIN/health"
+echo "  Local:         http://127.0.0.1:${PORT}/mcp"
+echo "  Token:         ${FIXED_TOKEN}"
+echo "  Install dir:   $INSTALL_DIR"
+echo "  Service user:  $SERVICE_USER"
+echo ""
+echo "  Service management:"
+echo "    systemctl status $SERVICE_NAME"
+echo "    journalctl -u $SERVICE_NAME -f"
+echo "    systemctl restart $SERVICE_NAME"
+echo ""
+echo "  To update:"
+echo "    cd $INSTALL_DIR && git pull && npm ci && npm run build"
+echo "    systemctl restart $SERVICE_NAME"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

package/deploy/claude-ide-bridge.service.template

@@ -0,0 +1,67 @@
+# deploy/claude-ide-bridge.service.template
+# Reference template — paths and user are injected by the install scripts.
+# Do NOT copy this file to /etc/systemd/system/ directly.
+# Use bootstrap-new-vps.sh or install-vps-service.sh which generate
+# the final unit file with all variables substituted.
+
+[Unit]
+Description=Claude IDE Bridge MCP Server
+Documentation=https://github.com/Oolab-labs/claude-ide-bridge
+After=network.target
+StartLimitIntervalSec=120
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=${SERVICE_USER}
+WorkingDirectory=${INSTALL_DIR}
+
+# Load personal config — FIXED_TOKEN, PORT, WORKSPACE must be set here
+EnvironmentFile=${ENV_FILE}
+
+# Bridge process — reads PORT, WORKSPACE, FIXED_TOKEN from EnvironmentFile
+ExecStart=/usr/bin/node ${INSTALL_DIR}/dist/index.js \
+    --port ${PORT} \
+    --workspace ${WORKSPACE} \
+    --fixed-token ${FIXED_TOKEN} \
+    --grace-period 120000 \
+    --vps
+
+# Graceful shutdown: SIGTERM → wait 15s → SIGKILL
+KillMode=mixed
+KillSignal=SIGTERM
+TimeoutStopSec=15
+
+# Restart policy: always restart unless manually stopped
+Restart=always
+RestartSec=5
+
+# Logging — view with: journalctl -u claude-ide-bridge -f
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=claude-ide-bridge
+
+# Hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=${INSTALL_DIR} /tmp /root/.claude
+CapabilityBoundingSet=
+AmbientCapabilities=
+LockPersonality=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=${INSTALL_DIR} /tmp /root/.claude
+CapabilityBoundingSet=
+AmbientCapabilities=
+LockPersonality=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=multi-user.target

package/deploy/claude-ide-bridge@.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=Claude IDE Bridge MCP Server (for user %i)
+After=network.target
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=%i
+WorkingDirectory=%h
+ExecStart=/usr/local/bin/node /opt/claude-ide-bridge/dist/index.js --workspace %h --jsonl
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=10
+KillMode=mixed
+KillSignal=SIGTERM
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=claude-ide-bridge
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=%h/.claude %h
+PrivateTmp=true
+ProtectHome=read-only
+CapabilityBoundingSet=
+LockPersonality=true
+RestrictNamespaces=true
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=default.target

package/deploy/ecosystem.config.js.example

@@ -0,0 +1,36 @@
+// PM2 ecosystem config for claude-ide-bridge.
+// Copy to the repo root and edit before use:
+//   cp deploy/ecosystem.config.js.example ecosystem.config.js
+//
+// Usage:
+//   pm2 start ecosystem.config.js
+//   pm2 save
+//
+// IMPORTANT: The --port value below must match the port in your nginx proxy_pass.
+// The bridge defaults to a random port if --port is not set, which breaks nginx.
+
+module.exports = {
+  apps: [
+    {
+      name: "claude-bridge",
+      script: "dist/index.js",
+      cwd: "/root/claude-ide-bridge", // adjust to your INSTALL_DIR
+
+      // All bridge flags go here — NOT in env (PORT env var is not read by the bridge)
+      args: [
+        "--port", "4748",             // must match nginx proxy_pass port
+        "--bind", "0.0.0.0",          // expose to all interfaces (nginx handles TLS)
+        "--vps",                       // expands command allowlist for server use
+        "--fixed-token", "YOUR_TOKEN_HERE", // stable token; prevents rotation on restart
+      ].join(" "),
+
+      restart_delay: 5000,  // wait 5s before restart on crash
+      max_restarts: 20,     // give up after 20 consecutive crashes
+      min_uptime: "10s",    // don't count a restart as a crash if up for <10s
+
+      env: {
+        NODE_ENV: "production",
+      },
+    },
+  ],
+};