patchwork-os 0.2.0-alpha.0

package/deploy/install-vps-service.sh

@@ -0,0 +1,240 @@
+#!/usr/bin/env bash
+# deploy/install-vps-service.sh
+# Idempotent updater — re-installs the systemd service and nginx config
+# on an already-bootstrapped server after a git pull.
+#
+# For FIRST-TIME setup on a new VPS, use bootstrap-new-vps.sh instead.
+#
+# Usage (run as root from repo root):
+#   bash deploy/install-vps-service.sh
+#
+# Optional environment overrides:
+#   DOMAIN        Override domain (default: read from existing nginx config or prompt)
+#   PORT          Override port   (default: read from .env.vps)
+#   SERVICE_USER  Override user   (default: auto-detect from existing service)
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+SERVICE_NAME="claude-ide-bridge"
+ENV_FILE="$REPO_ROOT/.env.vps"
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+info()    { echo -e "${GREEN}✓${NC} $*"; }
+warn()    { echo -e "${YELLOW}⚠${NC}  $*"; }
+err()     { echo -e "${RED}✗${NC} $*" >&2; }
+
+echo "=== Claude IDE Bridge — Service Updater ==="
+echo ""
+
+# ── Pre-flight ────────────────────────────────────────────────────────────────
+[[ "$(id -u)" -eq 0 ]] || { err "Run as root: sudo bash deploy/install-vps-service.sh"; exit 1; }
+[[ -f "$ENV_FILE" ]]   || { err "$ENV_FILE not found. Run bootstrap-new-vps.sh first."; exit 1; }
+
+source "$ENV_FILE"
+[[ -n "${FIXED_TOKEN:-}" ]] || { err "FIXED_TOKEN not set in $ENV_FILE"; exit 1; }
+[[ -n "${PORT:-}" ]]        || { err "PORT not set in $ENV_FILE"; exit 1; }
+[[ -n "${WORKSPACE:-}" ]]   || { err "WORKSPACE not set in $ENV_FILE"; exit 1; }
+
+DIST="$REPO_ROOT/dist/index.js"
+[[ -f "$DIST" ]] || { err "$DIST not found. Run: npm run build"; exit 1; }
+
+command -v nginx     >/dev/null 2>&1 || { err "nginx not found. Run bootstrap-new-vps.sh first."; exit 1; }
+command -v systemctl >/dev/null 2>&1 || { err "systemd not available."; exit 1; }
+
+# Detect service user from existing unit file, fall back to env or default
+EXISTING_USER=$(grep -Po '(?<=^User=).+' /etc/systemd/system/${SERVICE_NAME}.service 2>/dev/null || echo "")
+SERVICE_USER="${SERVICE_USER:-${EXISTING_USER:-claude-bridge}}"
+
+# Detect domain from existing nginx config
+EXISTING_DOMAIN=$(grep -Po '(?<=server_name )[\w.-]+' /etc/nginx/sites-available/claude-bridge 2>/dev/null | head -1 || echo "")
+DOMAIN="${DOMAIN:-$EXISTING_DOMAIN}"
+
+if [[ -z "$DOMAIN" ]]; then
+  err "Cannot determine DOMAIN. Set it: DOMAIN=bridge.example.com bash deploy/install-vps-service.sh"
+  exit 1
+fi
+
+info "Repo:         $REPO_ROOT"
+info "Domain:       $DOMAIN"
+info "Port:         $PORT"
+info "Service user: $SERVICE_USER"
+echo ""
+
+# ── Systemd service ───────────────────────────────────────────────────────────
+echo "Updating systemd service..."
+
+cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<SERVICE
+[Unit]
+Description=Claude IDE Bridge MCP Server
+Documentation=https://github.com/Oolab-labs/claude-ide-bridge
+After=network.target
+StartLimitIntervalSec=120
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=$SERVICE_USER
+WorkingDirectory=$REPO_ROOT
+
+# Load config — FIXED_TOKEN, PORT, WORKSPACE
+EnvironmentFile=$ENV_FILE
+
+# Bridge process
+ExecStart=/usr/bin/node $REPO_ROOT/dist/index.js \\
+    --port \${PORT} \\
+    --workspace \${WORKSPACE} \\
+    --fixed-token \${FIXED_TOKEN} \\
+    --grace-period 120000 \\
+    --vps
+
+KillMode=mixed
+KillSignal=SIGTERM
+TimeoutStopSec=15
+Restart=always
+RestartSec=5
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=claude-ide-bridge
+
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+SERVICE
+
+systemctl daemon-reload
+systemctl enable "$SERVICE_NAME"
+info "Systemd service updated"
+
+# ── nginx ─────────────────────────────────────────────────────────────────────
+echo "Updating nginx config..."
+
+# Add connection_upgrade map if missing
+if ! grep -q "connection_upgrade" /etc/nginx/nginx.conf 2>/dev/null; then
+  perl -i -0pe 's/(http \{)/$1\n    map \$http_upgrade \$connection_upgrade {\n        default upgrade;\n        '"''"'     close;\n    }/' /etc/nginx/nginx.conf
+  info "Added connection_upgrade map to nginx.conf"
+fi
+
+# Write site config with domain and port injected
+cat > "/etc/nginx/sites-available/claude-bridge" <<NGINX
+# Claude IDE Bridge — nginx reverse proxy
+# Domain: $DOMAIN  Port: ${PORT}
+# Updated by install-vps-service.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $DOMAIN;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    location / {
+        return 301 https://\$host\$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name $DOMAIN;
+
+    # TLS — managed by Certbot
+    # ssl_certificate     /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
+    # include /etc/letsencrypt/options-ssl-nginx.conf;
+    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    location /mcp {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        proxy_connect_timeout 10s;
+        proxy_set_header Authorization \$http_authorization;
+        proxy_pass_header Authorization;
+        proxy_set_header Mcp-Session-Id \$http_mcp_session_id;
+        proxy_pass_header Mcp-Session-Id;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection \$connection_upgrade;
+    }
+
+    location /health {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 10s;
+    }
+
+    location /.well-known/ {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 10s;
+    }
+
+    location / {
+        return 404;
+    }
+}
+NGINX
+
+[[ -L "/etc/nginx/sites-enabled/claude-bridge" ]] || \
+  ln -s /etc/nginx/sites-available/claude-bridge /etc/nginx/sites-enabled/claude-bridge
+
+[[ -L "/etc/nginx/sites-enabled/default" ]] && \
+  rm -f /etc/nginx/sites-enabled/default
+
+nginx -t
+systemctl reload nginx
+info "nginx config updated"
+
+# ── Stop tmux session if still running (superseded by systemd) ────────────────
+if command -v tmux >/dev/null 2>&1 && tmux has-session -t "bridge" 2>/dev/null; then
+  tmux kill-session -t "bridge" 2>/dev/null || true
+  info "Stopped legacy tmux bridge session"
+fi
+
+# ── Restart service ───────────────────────────────────────────────────────────
+echo "Restarting service..."
+systemctl restart "$SERVICE_NAME"
+
+echo -n "Waiting for bridge..."
+for i in $(seq 1 20); do
+  if curl -sf --max-time 3 "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
+    echo " ready."
+    break
+  fi
+  sleep 1; echo -n "."
+  if [[ $i -eq 20 ]]; then
+    echo " timed out."
+    warn "Check: journalctl -u $SERVICE_NAME -n 50"
+  fi
+done
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  Claude IDE Bridge — service updated"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+echo "  MCP endpoint:  https://$DOMAIN/mcp"
+echo "  Local:         http://127.0.0.1:${PORT}/mcp"
+echo "  Token:         ${FIXED_TOKEN}"
+echo ""
+echo "  journalctl -u $SERVICE_NAME -f"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

package/deploy/nginx-claude-bridge.conf.template

@@ -0,0 +1,129 @@
+# deploy/nginx-claude-bridge.conf.template
+# Reference template — domain and port are injected by the install scripts.
+# Do NOT use this file directly. Use bootstrap-new-vps.sh or install-vps-service.sh
+# which write the final nginx config to /etc/nginx/sites-available/claude-bridge
+# with $DOMAIN and $PORT substituted.
+#
+# To manually generate from this template:
+#   DOMAIN=bridge.example.com PORT=9000 \
+#   envsubst '$DOMAIN $PORT' < deploy/nginx-claude-bridge.conf.template \
+#   > /etc/nginx/sites-available/claude-bridge
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name ${DOMAIN};
+
+    # Let Certbot complete ACME HTTP-01 challenges
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    # Redirect all other HTTP to HTTPS
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name ${DOMAIN};
+
+    # TLS — Certbot populates these after: certbot --nginx -d ${DOMAIN}
+    # ssl_certificate     /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
+    # include /etc/letsencrypt/options-ssl-nginx.conf;
+    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    # Security headers
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header Content-Security-Policy "default-src 'none'" always;
+
+    # /mcp — Streamable HTTP MCP endpoint (SSE-safe, never buffer)
+    location /mcp {
+        # Rate limit: 30 req/min per IP, burst of 10 (requires limit_req_zone in http{} block)
+        limit_req zone=mcp_zone burst=10 nodelay;
+        limit_req_status 429;
+
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+
+        # SSE requires no buffering
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        proxy_connect_timeout 10s;
+
+        # Forward auth and MCP session headers
+        proxy_set_header Authorization $http_authorization;
+        proxy_pass_header Authorization;
+        proxy_set_header Mcp-Session-Id $http_mcp_session_id;
+        proxy_pass_header Mcp-Session-Id;
+
+        # Standard proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket upgrade passthrough
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+
+    # /health — unauthenticated health check
+    location /health {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 10s;
+    }
+
+    # /.well-known — MCP server card + OAuth discovery (RFC 8414, RFC 9396)
+    location /.well-known/ {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 10s;
+    }
+
+    # /oauth — OAuth 2.0 endpoints (authorize, token, register, revoke)
+    location /oauth/ {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 30s;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # /ping — unauthenticated health probe
+    location /ping {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_http_version 1.1;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 10s;
+    }
+
+    # Block everything else
+    location / {
+        return 404;
+    }
+}
+
+# Note: add this to the `http {}` block in /etc/nginx/nginx.conf if not present
+# (bootstrap-new-vps.sh and install-vps-service.sh do this automatically):
+#
+# map $http_upgrade $connection_upgrade {
+#     default upgrade;
+#     ''      close;
+# }
+#
+# Rate limiting zone — add to http {} block:
+# limit_req_zone $binary_remote_addr zone=mcp_zone:10m rate=30r/m;

package/dist/activityLog.d.ts

@@ -0,0 +1,112 @@
+export type { ActivityEntry, ActivityListener, LifecycleEntry, TimelineEntry, } from "./activityTypes.js";
+import type { ActivityEntry, ActivityListener, LifecycleEntry, TimelineEntry } from "./activityTypes.js";
+/** Default sliding window for co-occurrence (5 minutes). */
+export declare const DEFAULT_CO_OCCURRENCE_WINDOW_MS: number;
+export declare class ActivityLog {
+    private entries;
+    private lifecycleEntries;
+    private nextId;
+    private maxEntries;
+    private persistPath;
+    private readonly listeners;
+    private rateLimitRejections;
+    /**
+     * Per-tool bounded ring of duration samples used for percentile computation.
+     * Capped at MAX_DURATION_SAMPLES per tool to bound memory.
+     */
+    private readonly durationSamples;
+    constructor(maxEntries?: number);
+    /**
+     * Subscribe to real-time activity events.
+     * @returns An unsubscribe function — call it to stop receiving events.
+     */
+    subscribe(listener: ActivityListener): () => void;
+    setPersistPath(p: string): void;
+    private _loadFromDisk;
+    private _appendToDisk;
+    private _rotateDisk;
+    record(tool: string, durationMs: number, status: "success" | "error", errorMessage?: string, sessionId?: string): void;
+    recordEvent(event: string, metadata?: Record<string, unknown>): void;
+    /**
+     * Return the highest ID assigned so far, or 0 if nothing has been recorded.
+     * Used by watchActivityLog to return an accurate lastId on long-poll timeout
+     * so clients don't re-poll from the same position indefinitely.
+     */
+    getHighestId(): number;
+    /**
+     * Look up a single approval_decision lifecycle entry by callId. Returns
+     * the decision entry plus tool entries + lifecycle events for the same
+     * session in the ±60s window around the decision (for context).
+     *
+     * The dashboard approval detail view is the only caller; keep the window
+     * tight so we don't walk unbounded history for each lookup.
+     */
+    findApprovalByCallId(callId: string): {
+        decision: LifecycleEntry | null;
+        nearby: TimelineEntry[];
+    };
+    /**
+     * Return all lifecycle entries whose metadata.sessionId matches. Sorted
+     * by id ascending (oldest first). Used by the dashboard session detail
+     * view to render a per-session event stream.
+     */
+    querySessionLifecycle(sessionId: string, limit?: number): LifecycleEntry[];
+    /**
+     * Return tool entries recorded under a given sessionId, sorted by id
+     * ascending. Entries persisted before sessionId-on-tool-calls landed
+     * will have `sessionId === undefined` and are excluded — callers who
+     * need historical correlation should cross-reference by time bounds.
+     */
+    querySessionTools(sessionId: string, limit?: number): ActivityEntry[];
+    queryTimeline(opts?: {
+        last?: number;
+    }): TimelineEntry[];
+    query(opts?: {
+        tool?: string;
+        status?: string;
+        last?: number;
+    }): ActivityEntry[];
+    toPrometheus(extras?: {
+        activeToolCalls?: number;
+        rateLimitRejected?: number;
+        extensionDisconnects?: number;
+    }): string;
+    stats(): Record<string, {
+        count: number;
+        avgDurationMs: number;
+        errors: number;
+    }>;
+    /**
+     * Per-tool percentiles (p50/p95/p99) computed from the bounded duration
+     * sample buffer. Returns null for any tool with fewer than 2 samples.
+     */
+    percentiles(): Record<string, {
+        p50: number;
+        p95: number;
+        p99: number;
+        sampleCount: number;
+    }>;
+    /** Increment the rate-limit rejection counter. */
+    recordRateLimitRejection(): void;
+    /** Return total rate-limit rejections recorded since startup. */
+    getRateLimitRejections(): number;
+    /**
+     * Per-tool stats within a sliding time window (reverse scan stops outside cutoff).
+     * Returns Record<tool, {count, errors, avgDurationMs}>.
+     */
+    windowedStats(windowMs: number): Record<string, {
+        count: number;
+        errors: number;
+        avgDurationMs: number;
+    }>;
+    /**
+     * Tool-pair co-occurrence within a sliding time window.
+     * Counts how many times tool B was called within `windowMs` after tool A,
+     * across all entries in the in-memory buffer. Pairs are ordered (A < B
+     * alphabetically) to avoid double-counting. Returns sorted by count desc.
+     */
+    coOccurrence(windowMs?: number): {
+        pair: string;
+        count: number;
+    }[];
+}