patchwork-os 0.2.0-beta.12.canary.240 → 0.2.0-beta.12.canary.242

package/dist/fp/commandDescription.js

@@ -56,6 +56,9 @@ export const DANGEROUS_FLAGS_FOR_COMMAND = {
     npm: new Set(["--node-options"]),
     yarn: new Set(["--node-options"]),
     pnpm: new Set(["--node-options"]),
+    // npx runs an arbitrary package binary, so --node-options is the same
+    // interpreter-bypass vector as npm/yarn/pnpm (H10 sibling — was missed).
+    npx: new Set(["--node-options"]),
 };
 export const PATH_FLAG_EXEMPTIONS = {
     psql: new Set(["--config"]),

package/dist/fp/commandDescription.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandDescription.js","sourceRoot":"","sources":["../../src/fp/commandDescription.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IACjD,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,cAAc;IACd,UAAU;IACV,UAAU;IACV,uBAAuB;IACvB,IAAI;IACJ,WAAW;IACX,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,wBAAwB;IACxB,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAgC;IACtE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACpB,6EAA6E;IAC7E,0EAA0E;IAC1E,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAChC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAgC;IAC/D,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3B,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;CAClC,CAAC;AAgBF,SAAS,mBAAmB,CAAC,OAAe,EAAE,SAAmB;IAC/D,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,2DAA2D,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,kDAAkD,OAAO,8DAA8D,CAC3I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAa,EACb,OAAe,EACf,SAAiB;IAEjB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,+BAA+B,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,IAAI,aAAa,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,yCAAyC,OAAO,wCAAwC,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,wEAAwE,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,6BAA6B,OAAO,6DAA6D,CAC/G,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,4EAA4E;QAC5E,uEAAuE;QACvE,0BAA0B;QAC1B,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAC9C,CAAC;YACD,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,QAAQ,CAAC,MAAM,GAAG,6CAA6C,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgC,EAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"commandDescription.js","sourceRoot":"","sources":["../../src/fp/commandDescription.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IACjD,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,cAAc;IACd,UAAU;IACV,UAAU;IACV,uBAAuB;IACvB,IAAI;IACJ,WAAW;IACX,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,wBAAwB;IACxB,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAgC;IACtE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACpB,6EAA6E;IAC7E,0EAA0E;IAC1E,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAChC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACjC,sEAAsE;IACtE,yEAAyE;IACzE,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAgC;IAC/D,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3B,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;CAClC,CAAC;AAgBF,SAAS,mBAAmB,CAAC,OAAe,EAAE,SAAmB;IAC/D,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,2DAA2D,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,kDAAkD,OAAO,8DAA8D,CAC3I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAa,EACb,OAAe,EACf,SAAiB;IAEjB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,+BAA+B,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,IAAI,aAAa,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,yCAAyC,OAAO,wCAAwC,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,wEAAwE,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,6BAA6B,OAAO,6DAA6D,CAC/G,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,4EAA4E;QAC5E,uEAAuE;QACvE,0BAA0B;QAC1B,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAC9C,CAAC;YACD,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,QAAQ,CAAC,MAAM,GAAG,6CAA6C,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgC,EAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC"}

package/dist/recipes/tools/meetingNotes.js

@@ -154,10 +154,10 @@ function bulletLines(lines) {
 /**
  * Extract display names / emails from a line of inline chips. Handles three
  * formats Drive emits across export modes:
- *   1. Markdown link form: `[Stephanie M](mailto:sm@wamae.com)`
+ *   1. Markdown link form: `[Jane Doe](mailto:jane@example.com)`
  *   2. Tab / 2+ space separated tokens (markdown export of bare chips)
  *   3. Single-space separated tokens with emails as boundaries
- *      (`text/plain` export form): `kwkarago@gmail.com Stephanie M sm@x.com`
+ *      (`text/plain` export form): `alice@example.com Jane Doe jane@example.com`
  *      where multi-word names are several capitalised tokens in a row.
  */
 function extractChips(line) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "0.2.0-beta.12.canary.240",
+  "version": "0.2.0-beta.12.canary.242",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",
@@ -64,6 +64,11 @@
     "dist",
     "!dist/__tests__",
     "!dist/**/__tests__",
+    "!dist/recipes/tools/altscan.*",
+    "!dist/recipes/tools/market.*",
+    "!dist/recipes/tools/ta.*",
+    "!dist/recipes/tools/taLedger.*",
+    "!dist/recipes/tools/watchlist.*",
     "scripts/start-all.sh",
     "scripts/start-all.mjs",
     "scripts/start-all.ps1",
@@ -79,7 +84,6 @@
     "scripts/gen-claude-desktop-config.sh",
     "scripts/smoke/run-all.mjs",
     "templates",
-    "deploy",
     "LICENSE",
     "README.md"
   ],

package/deploy/README.md

@@ -1,172 +0,0 @@
-# Deploy
-
-Production VPS deployment files for claude-ide-bridge.
-
-> **Deployment targets:** The **systemd + nginx** path (this directory) is the
-> production-supported deployment for VPS/remote use. A `Dockerfile` and
-> `docker-compose.yml` exist in the repo root as an alternative for
-> containerised environments, but are not actively tested against the systemd
-> config — if you use Docker, treat it as a community-supported path and keep
-> it in sync with any service config changes.
-
-## Files
-
-| File | Purpose |
-|------|---------|
-| `bootstrap-new-vps.sh` | **Full fresh-server setup** — Node.js, clone, build, user, firewall, systemd, nginx, Certbot |
-| `install-vps-service.sh` | **Idempotent updater** — re-installs service + nginx after `git pull` on an existing server |
-| `nginx-claude-bridge.conf.template` | nginx config reference (domain + port injected by scripts) |
-| `claude-ide-bridge.service.template` | systemd unit reference (paths + user injected by scripts) |
-| `claude-ide-bridge@.service` | Template unit for multi-user demo instances (alternate pattern) |
-| `ecosystem.config.js.example` | PM2 ecosystem config template (alternative to systemd) |
-
-## First-time setup (new VPS)
-
-```bash
-# Option A: run remotely on fresh server
-DOMAIN=bridge.example.com bash <(curl -fsSL https://raw.githubusercontent.com/Oolab-labs/claude-ide-bridge/main/deploy/bootstrap-new-vps.sh)
-
-# Option B: after cloning the repo
-DOMAIN=bridge.example.com bash deploy/bootstrap-new-vps.sh
-```
-
-The bootstrap script handles everything end-to-end:
-1. Installs Node.js 22, nginx, certbot
-2. Creates a dedicated `claude-bridge` system user (non-root)
-3. Clones the repo to `/opt/claude-ide-bridge`
-4. Runs `npm ci && npm run build`
-5. Generates `.env.vps` with a random auth token
-6. Opens ports 80/443 in ufw
-7. Installs and enables the systemd service
-8. Writes the nginx config with your domain injected
-9. Runs Certbot for HTTPS
-10. Starts the bridge and confirms it's healthy
-
-**Required:** `DOMAIN` env var pointing to a subdomain that resolves to your VPS IP.
-
-**Optional overrides:**
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `REPO_URL` | GitHub upstream | Git repo to clone |
-| `INSTALL_DIR` | `/opt/claude-ide-bridge` | Where to install |
-| `SERVICE_USER` | `claude-bridge` | System user to run as |
-| `PORT` | `9000` | Bridge listen port |
-| `BRANCH` | `main` | Git branch |
-| `SKIP_CERTBOT` | `0` | Set to `1` to skip TLS (DNS not ready) |
-
-## Updating an existing server
-
-```bash
-cd /opt/claude-ide-bridge   # or wherever INSTALL_DIR is
-git pull
-npm ci
-npm run build
-bash deploy/install-vps-service.sh
-```
-
-`install-vps-service.sh` re-generates the systemd unit and nginx config from the current state of `.env.vps`, then restarts the service automatically. It auto-detects the domain and service user from the existing installation — no config needed.
-
-## Day-to-day management
-
-```bash
-# View live logs
-journalctl -u claude-ide-bridge -f
-
-# Check status
-systemctl status claude-ide-bridge
-
-# Restart after code change
-npm run build && systemctl restart claude-ide-bridge
-
-# Stop (won't restart until manually started)
-systemctl stop claude-ide-bridge
-```
-
-## Using PM2 instead of systemd
-
-PM2 is a simpler alternative when you're running as root, already have PM2 installed, or prefer not to configure systemd manually.
-
-> **Important:** The bridge picks a **random port** by default. The port in your PM2 start command **must match** the port in your nginx `proxy_pass` directive, or every restart will cause a 502 Bad Gateway.
-
-### Quick start with PM2
-
-```bash
-# Replace 4748 and YOUR_TOKEN_HERE with your nginx proxy_pass port and auth token
-pm2 delete claude-bridge 2>/dev/null || true
-pm2 start /root/claude-ide-bridge/dist/index.js \
-  --name claude-bridge \
-  -- --port 4748 --bind 0.0.0.0 --vps --fixed-token YOUR_TOKEN_HERE
-pm2 save
-```
-
-Retrieve your token anytime:
-```bash
-cat ~/.claude/ide/*.lock | node -e "const d=require('fs').readFileSync('/dev/stdin','utf8').trim(); console.log(JSON.parse(d).authToken)"
-# or if you have a .env.vps:
-grep FIXED_TOKEN /root/claude-ide-bridge/.env.vps
-```
-
-### Persist across reboots
-
-```bash
-# Generate and run the startup command PM2 prints
-pm2 startup
-# (run the command it outputs, then:)
-pm2 save
-```
-
-### Using an ecosystem file
-
-For repeatable deployments, use the included example:
-
-```bash
-cp deploy/ecosystem.config.js.example ecosystem.config.js
-# Edit ecosystem.config.js: set cwd, port, and fixed-token
-pm2 start ecosystem.config.js
-pm2 save
-```
-
-### Day-to-day management with PM2
-
-```bash
-# View live logs
-pm2 logs claude-bridge
-
-# Check status
-pm2 status
-
-# Restart after code change
-npm run build && pm2 restart claude-bridge
-
-# Stop
-pm2 stop claude-bridge
-```
-
-## MCP endpoint
-
-```
-https://<your-domain>/mcp
-```
-
-Use in `.mcp.json` for Claude Desktop, claude.ai Custom Connectors, or any remote MCP client:
-
-```json
-{
-  "mcpServers": {
-    "claude-ide-bridge": {
-      "type": "http",
-      "url": "https://your-domain/mcp",
-      "headers": {
-        "Authorization": "Bearer ${BRIDGE_TOKEN}"
-      }
-    }
-  }
-}
-```
-
-Set `BRIDGE_TOKEN` in your shell profile. Retrieve the token anytime:
-
-```bash
-grep FIXED_TOKEN /opt/claude-ide-bridge/.env.vps
-```

package/deploy/bootstrap-new-vps.sh

@@ -1,364 +0,0 @@
-#!/usr/bin/env bash
-# deploy/bootstrap-new-vps.sh
-# Full fresh-server setup for patchwork-os on a NEW VPS.
-# Handles everything from Node.js install to running HTTPS service.
-#
-# Usage (run as root on a fresh Ubuntu 22.04/24.04 VPS):
-#   curl -fsSL https://raw.githubusercontent.com/Oolab-labs/patchwork-os/main/deploy/bootstrap-new-vps.sh | \
-#     DOMAIN=bridge.example.com bash
-#
-#   Or after cloning:
-#   DOMAIN=bridge.example.com bash deploy/bootstrap-new-vps.sh
-#
-# Required environment variables:
-#   DOMAIN        Subdomain for the bridge  (e.g. bridge.example.com)
-#
-# Optional environment variables:
-#   REPO_URL      Git repo URL              (default: https://github.com/Oolab-labs/patchwork-os)
-#   INSTALL_DIR   Where to clone the repo   (default: /opt/patchwork-os)
-#   SERVICE_USER  System user to run bridge (default: patchwork)
-#   PORT          Bridge port               (default: 9000)
-#   BRANCH        Git branch to clone       (default: main)
-#   SKIP_CERTBOT  Set to 1 to skip TLS cert (useful if DNS not yet set)
-
-set -euo pipefail
-
-# ── Config ────────────────────────────────────────────────────────────────────
-DOMAIN="${DOMAIN:-}"
-REPO_URL="${REPO_URL:-https://github.com/Oolab-labs/patchwork-os}"
-INSTALL_DIR="${INSTALL_DIR:-/opt/patchwork-os}"
-SERVICE_USER="${SERVICE_USER:-patchwork}"
-PORT="${PORT:-9000}"
-BRANCH="${BRANCH:-main}"
-SKIP_CERTBOT="${SKIP_CERTBOT:-0}"
-SERVICE_NAME="patchwork-os"
-
-RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
-info()    { echo -e "${GREEN}✓${NC} $*"; }
-warn()    { echo -e "${YELLOW}⚠${NC}  $*"; }
-err()     { echo -e "${RED}✗${NC} $*" >&2; }
-section() { echo ""; echo "── $* ──────────────────────────────────────────"; }
-
-# ── Pre-flight ────────────────────────────────────────────────────────────────
-section "Pre-flight"
-
-[[ "$(id -u)" -eq 0 ]] || { err "Run as root: sudo bash deploy/bootstrap-new-vps.sh"; exit 1; }
-
-if [[ -z "$DOMAIN" ]]; then
-  err "DOMAIN is required. Example:"
-  echo "  DOMAIN=bridge.example.com bash deploy/bootstrap-new-vps.sh"
-  exit 1
-fi
-
-info "Domain:       $DOMAIN"
-info "Install dir:  $INSTALL_DIR"
-info "Service user: $SERVICE_USER"
-info "Port:         $PORT"
-info "Branch:       $BRANCH"
-
-# ── 1. System packages ────────────────────────────────────────────────────────
-section "System packages"
-
-apt-get update -qq
-apt-get install -y -qq curl git nginx certbot python3-certbot-nginx ufw
-info "System packages installed"
-
-# ── 2. Node.js 20+ ────────────────────────────────────────────────────────────
-section "Node.js"
-
-NODE_OK=false
-if command -v node &>/dev/null; then
-  NODE_VER=$(node -e 'console.log(parseInt(process.version.slice(1)))')
-  [[ "$NODE_VER" -ge 20 ]] && NODE_OK=true
-fi
-
-if [[ "$NODE_OK" == false ]]; then
-  info "Installing Node.js 20..."
-  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
-  apt-get install -y -qq nodejs
-fi
-
-NODE_VERSION=$(node --version)
-info "Node $NODE_VERSION / npm $(npm --version)"
-
-# ── 3. Service user ───────────────────────────────────────────────────────────
-section "Service user"
-
-if ! id "$SERVICE_USER" &>/dev/null; then
-  useradd --system --create-home --shell /bin/bash "$SERVICE_USER"
-  info "Created user: $SERVICE_USER"
-else
-  info "User already exists: $SERVICE_USER"
-fi
-
-# ── 4. Clone or update repo ───────────────────────────────────────────────────
-section "Repository"
-
-if [[ -d "$INSTALL_DIR/.git" ]]; then
-  info "Repo exists — pulling latest..."
-  git -C "$INSTALL_DIR" fetch origin
-  git -C "$INSTALL_DIR" checkout "$BRANCH"
-  git -C "$INSTALL_DIR" pull origin "$BRANCH"
-else
-  info "Cloning $REPO_URL..."
-  git clone --branch "$BRANCH" --depth 1 "$REPO_URL" "$INSTALL_DIR"
-fi
-
-chown -R "$SERVICE_USER:$SERVICE_USER" "$INSTALL_DIR"
-info "Repo ready at $INSTALL_DIR"
-
-# ── 5. Build ──────────────────────────────────────────────────────────────────
-section "Build"
-
-# Run npm install + build as SERVICE_USER
-sudo -u "$SERVICE_USER" bash -c "cd $INSTALL_DIR && npm ci --prefer-offline 2>&1"
-sudo -u "$SERVICE_USER" bash -c "cd $INSTALL_DIR && npm run build 2>&1"
-info "Build complete"
-
-# ── 6. Generate .env.vps ──────────────────────────────────────────────────────
-section ".env.vps"
-
-ENV_FILE="$INSTALL_DIR/.env.vps"
-if [[ -f "$ENV_FILE" ]]; then
-  warn ".env.vps already exists — leaving unchanged"
-  source "$ENV_FILE"
-  info "  PORT=$PORT  WORKSPACE=$WORKSPACE  TOKEN=***"
-else
-  FIXED_TOKEN=$(node -e "console.log(require('crypto').randomUUID())")
-  WORKSPACE="$INSTALL_DIR"
-  cat > "$ENV_FILE" <<EOF
-# Claude IDE Bridge — VPS config
-# Generated by bootstrap-new-vps.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)
-# Gitignored — never commit this file.
-
-PORT=$PORT
-WORKSPACE=$WORKSPACE
-FIXED_TOKEN=$FIXED_TOKEN
-BRIDGE_SESSION=bridge
-NGROK_SESSION=ngrok
-EOF
-  chmod 600 "$ENV_FILE"
-  chown "$SERVICE_USER:$SERVICE_USER" "$ENV_FILE"
-  info ".env.vps created"
-  info "  PORT=$PORT"
-  info "  WORKSPACE=$WORKSPACE"
-  info "  TOKEN=$FIXED_TOKEN"
-fi
-
-# Reload in case it already existed
-source "$ENV_FILE"
-
-# ── 7. Firewall ───────────────────────────────────────────────────────────────
-section "Firewall (ufw)"
-
-ufw --force enable >/dev/null 2>&1 || true
-ufw allow ssh   >/dev/null 2>&1
-ufw allow 80    >/dev/null 2>&1
-ufw allow 443   >/dev/null 2>&1
-info "ufw: ssh, 80, 443 open"
-
-# ── 8. Systemd service ────────────────────────────────────────────────────────
-section "Systemd service"
-
-# Generate service file from template (parameterised for this install)
-cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<SERVICE
-[Unit]
-Description=Patchwork OS bridge
-Documentation=https://github.com/Oolab-labs/patchwork-os
-After=network.target
-StartLimitIntervalSec=120
-StartLimitBurst=5
-
-[Service]
-Type=simple
-User=$SERVICE_USER
-WorkingDirectory=$INSTALL_DIR
-
-# Load config — FIXED_TOKEN, PORT, WORKSPACE
-EnvironmentFile=$ENV_FILE
-
-# Bridge process
-ExecStart=/usr/bin/node $INSTALL_DIR/dist/index.js \\
-    --port \${PORT} \\
-    --workspace \${WORKSPACE} \\
-    --fixed-token \${FIXED_TOKEN} \\
-    --grace-period 120000 \\
-    --vps
-
-KillMode=mixed
-KillSignal=SIGTERM
-TimeoutStopSec=15
-Restart=always
-RestartSec=5
-
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=patchwork-os
-
-NoNewPrivileges=true
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
-SERVICE
-
-systemctl daemon-reload
-systemctl enable "$SERVICE_NAME"
-info "Systemd service installed and enabled"
-
-# ── 9. nginx ──────────────────────────────────────────────────────────────────
-section "nginx"
-
-# Add connection_upgrade map to nginx.conf if missing
-if ! grep -q "connection_upgrade" /etc/nginx/nginx.conf 2>/dev/null; then
-  # Insert after the `http {` line
-  perl -i -0pe 's/(http \{)/$1\n    map \$http_upgrade \$connection_upgrade {\n        default upgrade;\n        '"''"'     close;\n    }/' /etc/nginx/nginx.conf
-  info "Added connection_upgrade map to nginx.conf"
-fi
-
-# Write nginx site config (domain injected here, not hardcoded in repo)
-cat > "/etc/nginx/sites-available/claude-bridge" <<NGINX
-# Claude IDE Bridge — nginx reverse proxy
-# Domain: $DOMAIN  Port: ${PORT}
-# Generated by bootstrap-new-vps.sh
-
-server {
-    listen 80;
-    listen [::]:80;
-    server_name $DOMAIN;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/html;
-    }
-
-    location / {
-        return 301 https://\$host\$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-    server_name $DOMAIN;
-
-    # TLS — populated by Certbot
-    # ssl_certificate     /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    add_header X-Content-Type-Options nosniff always;
-    add_header X-Frame-Options DENY always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
-    # /mcp — Streamable HTTP MCP endpoint (SSE-safe)
-    location /mcp {
-        proxy_pass http://127.0.0.1:${PORT};
-        proxy_http_version 1.1;
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_read_timeout 3600s;
-        proxy_send_timeout 3600s;
-        proxy_connect_timeout 10s;
-        proxy_set_header Authorization \$http_authorization;
-        proxy_pass_header Authorization;
-        proxy_set_header Mcp-Session-Id \$http_mcp_session_id;
-        proxy_pass_header Mcp-Session-Id;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection \$connection_upgrade;
-    }
-
-    location /health {
-        proxy_pass http://127.0.0.1:${PORT};
-        proxy_http_version 1.1;
-        proxy_connect_timeout 5s;
-        proxy_read_timeout 10s;
-    }
-
-    location /.well-known/ {
-        proxy_pass http://127.0.0.1:${PORT};
-        proxy_http_version 1.1;
-        proxy_connect_timeout 5s;
-        proxy_read_timeout 10s;
-    }
-
-    location / {
-        return 404;
-    }
-}
-NGINX
-
-# Enable site
-[[ -L "/etc/nginx/sites-enabled/claude-bridge" ]] || \
-  ln -s /etc/nginx/sites-available/claude-bridge /etc/nginx/sites-enabled/claude-bridge
-
-# Remove default site (conflicts on port 80)
-[[ -L "/etc/nginx/sites-enabled/default" ]] && \
-  rm -f /etc/nginx/sites-enabled/default && info "Removed nginx default site"
-
-nginx -t
-systemctl reload nginx
-info "nginx configured for $DOMAIN"
-
-# ── 10. TLS certificate ───────────────────────────────────────────────────────
-section "TLS certificate"
-
-if [[ "$SKIP_CERTBOT" == "1" ]]; then
-  warn "SKIP_CERTBOT=1 — skipping cert. Run manually later:"
-  echo "  certbot --nginx -d $DOMAIN"
-else
-  if certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-      --register-unsafely-without-email --redirect 2>&1; then
-    info "TLS certificate obtained for $DOMAIN"
-  else
-    warn "Certbot failed. Common causes:"
-    echo "   - DNS not yet pointing to this IP (check: dig $DOMAIN)"
-    echo "   - Port 80 blocked"
-    echo "  Re-run manually: certbot --nginx -d $DOMAIN"
-  fi
-fi
-
-# ── 11. Start service ─────────────────────────────────────────────────────────
-section "Starting service"
-
-systemctl restart "$SERVICE_NAME"
-
-echo -n "Waiting for bridge..."
-for i in $(seq 1 30); do
-  if curl -sf --max-time 3 "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
-    echo " ready."
-    break
-  fi
-  sleep 1; echo -n "."
-  if [[ $i -eq 30 ]]; then
-    echo " timed out."
-    warn "Check logs: journalctl -u $SERVICE_NAME -n 50"
-  fi
-done
-
-# ── Summary ───────────────────────────────────────────────────────────────────
-echo ""
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "  Claude IDE Bridge — bootstrap complete"
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo ""
-echo "  MCP endpoint:  https://$DOMAIN/mcp"
-echo "  Health check:  https://$DOMAIN/health"
-echo "  Local:         http://127.0.0.1:${PORT}/mcp"
-echo "  Token:         ${FIXED_TOKEN}"
-echo "  Install dir:   $INSTALL_DIR"
-echo "  Service user:  $SERVICE_USER"
-echo ""
-echo "  Service management:"
-echo "    systemctl status $SERVICE_NAME"
-echo "    journalctl -u $SERVICE_NAME -f"
-echo "    systemctl restart $SERVICE_NAME"
-echo ""
-echo "  To update:"
-echo "    cd $INSTALL_DIR && git pull && npm ci && npm run build"
-echo "    systemctl restart $SERVICE_NAME"
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"