patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/deploy/bootstrap-vps.sh

@@ -1,192 +0,0 @@
-#!/usr/bin/env bash
-# deploy/bootstrap-vps.sh
-# Full VPS bootstrap for a single Patchwork OS bridge.
-# Run as root on a fresh Ubuntu 24.04 VPS.
-# Usage: PATCHWORK_DOMAIN=your.tld PATCHWORK_ACME_EMAIL=you@your.tld bash bootstrap-vps.sh
-
-set -euo pipefail
-
-# Domain + ACME contact are deployment-specific — supply them via the
-# environment so no real domain/email is committed to version control.
-DOMAIN="${PATCHWORK_DOMAIN:?set PATCHWORK_DOMAIN, e.g. your.tld}"
-EMAIL="${PATCHWORK_ACME_EMAIL:?set PATCHWORK_ACME_EMAIL, e.g. you@your.tld}"
-BRIDGE_PORT=3284
-BRIDGE_USER="patchwork"
-BRIDGE_HOME="/opt/patchwork"
-NODE_VERSION="22"
-
-# ── Colours ──────────────────────────────────────────────────────────────────
-RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
-info()  { echo -e "${GREEN}[bootstrap]${NC} $*"; }
-warn()  { echo -e "${YELLOW}[bootstrap]${NC} $*"; }
-error() { echo -e "${RED}[bootstrap]${NC} $*"; exit 1; }
-
-# ── 1. System updates ─────────────────────────────────────────────────────────
-info "Updating system packages..."
-apt-get update -qq
-apt-get upgrade -y -qq
-apt-get install -y -qq curl wget gnupg2 ca-certificates lsb-release \
-  nginx certbot python3-certbot-nginx ufw git jq unzip
-
-# ── 2. Node.js ────────────────────────────────────────────────────────────────
-info "Installing Node.js ${NODE_VERSION}..."
-curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - >/dev/null
-apt-get install -y -qq nodejs
-node --version
-npm --version
-
-# ── 3. Service user ───────────────────────────────────────────────────────────
-info "Creating service user '${BRIDGE_USER}'..."
-id "${BRIDGE_USER}" &>/dev/null || useradd -r -m -d "${BRIDGE_HOME}" -s /bin/bash "${BRIDGE_USER}"
-mkdir -p "${BRIDGE_HOME}"
-chown "${BRIDGE_USER}:${BRIDGE_USER}" "${BRIDGE_HOME}"
-
-# ── 4. Install bridge globally ────────────────────────────────────────────────
-info "Installing patchwork-os from npm..."
-npm install -g patchwork-os@alpha 2>&1 | tail -5
-# `patchwork-os` ships three bin aliases: `patchwork` (preferred),
-# `patchwork-os`, and the legacy `claude-ide-bridge`. Use the canonical
-# `patchwork` name for the systemd unit + nginx config below.
-BRIDGE_BIN="$(which patchwork)"
-info "Bridge binary: ${BRIDGE_BIN}"
-
-# ── 5. Generate fixed token ───────────────────────────────────────────────────
-FIXED_TOKEN="$(uuidgen | tr '[:upper:]' '[:lower:]')"
-info "Generated bridge token (save this!): ${FIXED_TOKEN}"
-
-# Persist token to a file readable only by root + patchwork user
-TOKEN_FILE="/etc/patchwork/bridge-token"
-mkdir -p /etc/patchwork
-echo "${FIXED_TOKEN}" > "${TOKEN_FILE}"
-chown root:"${BRIDGE_USER}" "${TOKEN_FILE}"
-chmod 640 "${TOKEN_FILE}"
-
-# ── 6. Systemd service ────────────────────────────────────────────────────────
-info "Writing systemd service..."
-cat > /etc/systemd/system/patchwork-bridge.service <<EOF
-[Unit]
-Description=Patchwork OS — Claude IDE Bridge
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=${BRIDGE_USER}
-Group=${BRIDGE_USER}
-WorkingDirectory=${BRIDGE_HOME}
-Environment=NODE_ENV=production
-Environment=HOME=${BRIDGE_HOME}
-
-ExecStart=${BRIDGE_BIN} \\
-  --bind 0.0.0.0 \\
-  --port ${BRIDGE_PORT} \\
-  --vps \\
-  --issuer-url https://${DOMAIN} \\
-  --cors-origin https://claude.ai \\
-  --fixed-token ${FIXED_TOKEN}
-
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=patchwork-bridge
-
-# Hardening
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=${BRIDGE_HOME}
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl daemon-reload
-systemctl enable patchwork-bridge
-
-# ── 7. UFW firewall ───────────────────────────────────────────────────────────
-info "Configuring firewall..."
-ufw --force reset >/dev/null
-ufw default deny incoming >/dev/null
-ufw default allow outgoing >/dev/null
-ufw allow ssh >/dev/null
-ufw allow http >/dev/null
-ufw allow https >/dev/null
-ufw --force enable >/dev/null
-ufw status
-
-# ── 8. Nginx config — HTTP only first (certbot needs nginx up to issue cert) ──
-info "Writing nginx config (HTTP only)..."
-cat > /etc/nginx/sites-available/patchwork <<'NGINX'
-server {
-    listen 80;
-    listen [::]:80;
-    server_name __DOMAIN__ www.__DOMAIN__;
-
-    location /.well-known/acme-challenge/ { root /var/www/html; }
-
-    location / {
-        proxy_pass         http://127.0.0.1:3284;
-        proxy_http_version 1.1;
-        proxy_set_header   Upgrade $http_upgrade;
-        proxy_set_header   Connection "upgrade";
-        proxy_set_header   Host $host;
-        proxy_set_header   X-Real-IP $remote_addr;
-        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header   X-Forwarded-Proto $scheme;
-        proxy_read_timeout 3600s;
-        proxy_send_timeout 3600s;
-    }
-}
-NGINX
-
-# Substitute the deployment domain into the just-written config (the heredoc
-# is quoted so nginx's own $variables survive un-expanded).
-sed -i "s/__DOMAIN__/${DOMAIN}/g" /etc/nginx/sites-available/patchwork
-
-ln -sf /etc/nginx/sites-available/patchwork /etc/nginx/sites-enabled/patchwork
-rm -f /etc/nginx/sites-enabled/default
-
-nginx -t
-systemctl reload nginx
-
-# ── 9. TLS certificate ────────────────────────────────────────────────────────
-info "Issuing Let's Encrypt certificate for ${DOMAIN}..."
-certbot --nginx \
-  -d "${DOMAIN}" \
-  -d "www.${DOMAIN}" \
-  --non-interactive \
-  --agree-tos \
-  --email "${EMAIL}" \
-  --redirect
-
-# Certbot rewrites the nginx config with SSL — reload to apply
-systemctl reload nginx
-
-# ── 10. Start bridge ──────────────────────────────────────────────────────────
-info "Starting bridge service..."
-systemctl start patchwork-bridge
-sleep 3
-systemctl is-active patchwork-bridge && info "Bridge is running." || warn "Bridge may have failed — check: journalctl -u patchwork-bridge -n 50"
-
-# ── 11. Print summary ─────────────────────────────────────────────────────────
-echo ""
-echo -e "${GREEN}═══════════════════════════════════════════════════${NC}"
-echo -e "${GREEN}  Patchwork OS — VPS bootstrap complete${NC}"
-echo -e "${GREEN}═══════════════════════════════════════════════════${NC}"
-echo ""
-echo "  Domain:       https://${DOMAIN}"
-echo "  Bridge port:  ${BRIDGE_PORT} (internal, nginx proxied)"
-echo "  Token file:   ${TOKEN_FILE}"
-echo "  Token:        ${FIXED_TOKEN}"
-echo ""
-echo "  Service:      systemctl status patchwork-bridge"
-echo "  Logs:         journalctl -u patchwork-bridge -f"
-echo "  Nginx logs:   tail -f /var/log/nginx/access.log"
-echo ""
-echo -e "${YELLOW}  Save the token above — you'll need it to connect Claude Code.${NC}"
-echo ""
-echo "  To connect Claude Code remotely:"
-echo "    claude mcp add patchwork https://${DOMAIN}/mcp --token ${FIXED_TOKEN}"
-echo ""

package/deploy/claude-ide-bridge.service.template

@@ -1,67 +0,0 @@
-# deploy/claude-ide-bridge.service.template
-# Reference template — paths and user are injected by the install scripts.
-# Do NOT copy this file to /etc/systemd/system/ directly.
-# Use bootstrap-new-vps.sh or install-vps-service.sh which generate
-# the final unit file with all variables substituted.
-
-[Unit]
-Description=Claude IDE Bridge MCP Server
-Documentation=https://github.com/Oolab-labs/claude-ide-bridge
-After=network.target
-StartLimitIntervalSec=120
-StartLimitBurst=5
-
-[Service]
-Type=simple
-User=${SERVICE_USER}
-WorkingDirectory=${INSTALL_DIR}
-
-# Load personal config — FIXED_TOKEN, PORT, WORKSPACE must be set here
-EnvironmentFile=${ENV_FILE}
-
-# Bridge process — reads PORT, WORKSPACE, FIXED_TOKEN from EnvironmentFile
-ExecStart=/usr/bin/node ${INSTALL_DIR}/dist/index.js \
-    --port ${PORT} \
-    --workspace ${WORKSPACE} \
-    --fixed-token ${FIXED_TOKEN} \
-    --grace-period 120000 \
-    --vps
-
-# Graceful shutdown: SIGTERM → wait 15s → SIGKILL
-KillMode=mixed
-KillSignal=SIGTERM
-TimeoutStopSec=15
-
-# Restart policy: always restart unless manually stopped
-Restart=always
-RestartSec=5
-
-# Logging — view with: journalctl -u claude-ide-bridge -f
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=claude-ide-bridge
-
-# Hardening
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=${INSTALL_DIR} /tmp /root/.claude
-CapabilityBoundingSet=
-AmbientCapabilities=
-LockPersonality=true
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=${INSTALL_DIR} /tmp /root/.claude
-CapabilityBoundingSet=
-AmbientCapabilities=
-LockPersonality=true
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-
-[Install]
-WantedBy=multi-user.target

package/deploy/claude-ide-bridge@.service

@@ -1,31 +0,0 @@
-[Unit]
-Description=Claude IDE Bridge MCP Server (for user %i)
-After=network.target
-StartLimitIntervalSec=60
-StartLimitBurst=5
-
-[Service]
-Type=simple
-User=%i
-WorkingDirectory=%h
-ExecStart=/usr/local/bin/node /opt/claude-ide-bridge/dist/index.js --workspace %h --jsonl
-Restart=on-failure
-RestartSec=3
-TimeoutStopSec=10
-KillMode=mixed
-KillSignal=SIGTERM
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=claude-ide-bridge
-NoNewPrivileges=true
-ProtectSystem=strict
-ReadWritePaths=%h/.claude %h
-PrivateTmp=true
-ProtectHome=read-only
-CapabilityBoundingSet=
-LockPersonality=true
-RestrictNamespaces=true
-RestrictSUIDSGID=true
-
-[Install]
-WantedBy=default.target

package/deploy/deploy-dashboard.sh

@@ -1,198 +0,0 @@
-#!/usr/bin/env bash
-# deploy-dashboard.sh — Build dashboard locally and deploy to VPS
-# Run from Mac: bash deploy/deploy-dashboard.sh
-set -euo pipefail
-
-VPS="root@185.167.97.141"
-REMOTE_DIR="/opt/patchwork-dashboard"
-PM2_NAME="patchwork-dashboard"
-PORT=3200
-NGINX_CONF="/etc/nginx/sites-available/patchworkos"
-DASHBOARD_URL="https://patchworkos.com/dashboard"
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-DASHBOARD_DIR="$REPO_ROOT/dashboard"
-
-echo "==> Building dashboard..."
-cd "$DASHBOARD_DIR"
-npm run build
-
-echo "==> Packaging standalone build..."
-TARBALL="/tmp/patchwork-dashboard.tar.gz"
-STAGE="/tmp/patchwork-dashboard-stage"
-rm -rf "$STAGE" && mkdir -p "$STAGE"
-
-# Copy standalone output
-cp -r "$DASHBOARD_DIR/.next/standalone/." "$STAGE/"
-# Standalone needs static assets in .next/static
-mkdir -p "$STAGE/.next/static"
-cp -r "$DASHBOARD_DIR/.next/static/." "$STAGE/.next/static/"
-# Copy public dir if it exists
-if [ -d "$DASHBOARD_DIR/public" ]; then
-  cp -r "$DASHBOARD_DIR/public/." "$STAGE/public/"
-fi
-
-tar -czf "$TARBALL" --no-xattrs -C "$STAGE" .
-
-echo "==> Copying tarball to VPS..."
-scp "$TARBALL" "$VPS:/tmp/patchwork-dashboard.tar.gz"
-
-echo "==> Deploying on VPS..."
-# Pass secrets as positional args (NOT inside the heredoc body) so the
-# single-quoted heredoc still preserves remote-shell `$X` references but
-# the operator's local env reaches the VPS. Without this, the previous
-# `${PATCHWORK_BRIDGE_TOKEN:-REPLACE_ME}` inside the heredoc evaluated on
-# the remote, where the var doesn't exist, and always wrote REPLACE_ME.
-# shellcheck disable=SC2087
-ssh "$VPS" bash -s -- "${PATCHWORK_BRIDGE_TOKEN:-REPLACE_ME}" "${DASHBOARD_PASSWORD:-}" <<'REMOTE'
-set -euo pipefail
-# `${N:-}` so an empty/missing positional arg doesn't trip `set -u`.
-PATCHWORK_BRIDGE_TOKEN="${1:-REPLACE_ME}"
-DASHBOARD_PASSWORD="${2:-}"
-REMOTE_DIR="/opt/patchwork-dashboard"
-PM2_NAME="patchwork-dashboard"
-PORT=3200
-
-# Stop existing PM2 process if running
-if pm2 list | grep -q "$PM2_NAME"; then
-  pm2 stop "$PM2_NAME" || true
-  pm2 delete "$PM2_NAME" || true
-fi
-
-# Preserve .env.local across the deploy. Without this stash/restore, the
-# `rm -rf "$REMOTE_DIR"` below blows away every secret the operator pasted
-# (VAPID, PATCHWORK_PUSH_TOKEN, custom DASHBOARD_PASSWORD), and the "if
-# already exists, preserve" branch later in this script never fires —
-# the file no longer exists by then.
-ENV_BACKUP=""
-if [ -f "$REMOTE_DIR/.env.local" ]; then
-  ENV_BACKUP="$(mktemp /tmp/patchwork-env.XXXXXX)"
-  cp -p "$REMOTE_DIR/.env.local" "$ENV_BACKUP"
-fi
-
-# Wipe and recreate deploy dir
-rm -rf "$REMOTE_DIR"
-mkdir -p "$REMOTE_DIR"
-
-if [ -n "$ENV_BACKUP" ] && [ -f "$ENV_BACKUP" ]; then
-  cp -p "$ENV_BACKUP" "$REMOTE_DIR/.env.local"
-  rm -f "$ENV_BACKUP"
-fi
-
-# Extract
-tar -xzf /tmp/patchwork-dashboard.tar.gz -C "$REMOTE_DIR"
-rm /tmp/patchwork-dashboard.tar.gz
-
-# Copy static assets into standalone's expected location
-mkdir -p "$REMOTE_DIR/.next"
-if [ -d "$REMOTE_DIR/.next/static" ]; then
-  echo "static dir already in place"
-else
-  # tar may have extracted flat; handle both layouts
-  if [ -d /tmp/dashboard-static ]; then
-    cp -r /tmp/dashboard-static "$REMOTE_DIR/.next/static"
-  fi
-fi
-
-# Also copy public dir if present
-if [ -d "$REMOTE_DIR/public" ]; then
-  echo "public dir in place"
-fi
-
-# Write .env.local — secrets must be set via environment before running this script:
-#   PATCHWORK_BRIDGE_TOKEN, DASHBOARD_PASSWORD
-# PATCHWORK_BRIDGE_TOKEN is the bridge auth token (from: patchwork print-token)
-# DASHBOARD_PASSWORD protects the dashboard UI (leave blank to disable auth)
-if [ -f "$REMOTE_DIR/.env.local" ]; then
-  echo ".env.local already exists on VPS — preserving (delete manually to reset)"
-else
-  cat > "$REMOTE_DIR/.env.local" <<ENV
-NEXT_PUBLIC_BASE_PATH=/dashboard
-PATCHWORK_BRIDGE_URL=https://patchworkos.com
-PATCHWORK_BRIDGE_TOKEN=${PATCHWORK_BRIDGE_TOKEN:-REPLACE_ME}
-VAPID_SUBJECT=mailto:support@gigsecure.co.ke
-DASHBOARD_PASSWORD=${DASHBOARD_PASSWORD:-}
-ENV
-  chmod 600 "$REMOTE_DIR/.env.local"
-  echo "Wrote .env.local — review and update secrets if placeholders remain"
-fi
-
-# Install PM2 if missing
-which pm2 || npm install -g pm2
-
-# Start with PM2
-cd "$REMOTE_DIR"
-PORT=3200 pm2 start server.js --name "$PM2_NAME"
-
-pm2 save
-echo "PM2 started: $PM2_NAME on port $PORT"
-REMOTE
-
-echo "==> Configuring nginx..."
-ssh "$VPS" bash <<'NGINX'
-set -euo pipefail
-NGINX_CONF="/etc/nginx/sites-available/patchworkos"
-
-# Add SSE location block if missing
-if ! grep -q "location /dashboard/api/bridge/stream" "$NGINX_CONF"; then
-  # Insert before the closing brace of the SSL server block
-  # We insert just before the last `}` that closes the server block listening on 443
-  python3 - "$NGINX_CONF" <<'PYEOF'
-import sys, re
-
-path = sys.argv[1]
-with open(path) as f:
-    content = f.read()
-
-sse_block = """
-    # SSE passthrough — no buffering
-    location /dashboard/api/bridge/stream {
-        proxy_pass http://127.0.0.1:3200;
-        proxy_http_version 1.1;
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_read_timeout 86400s;
-        proxy_send_timeout 86400s;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        add_header X-Accel-Buffering no;
-    }
-
-    # Dashboard app
-    location /dashboard {
-        proxy_pass http://127.0.0.1:3200;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 60s;
-    }
-"""
-
-# Find the ssl/443 server block and insert before its closing brace
-# Strategy: find last `}` in file and insert before it
-idx = content.rfind('\n}')
-if idx == -1:
-    print("ERROR: could not find closing brace in nginx config", file=sys.stderr)
-    sys.exit(1)
-
-new_content = content[:idx] + sse_block + content[idx:]
-with open(path, 'w') as f:
-    f.write(new_content)
-print("nginx: location blocks inserted")
-PYEOF
-else
-  echo "nginx: location blocks already present, skipping"
-fi
-
-nginx -t && systemctl reload nginx
-echo "nginx reloaded"
-NGINX
-
-echo ""
-echo "==> Deploy complete!"
-echo "    Dashboard: https://patchworkos.com/dashboard"

package/deploy/deploy-landing.sh

@@ -1,136 +0,0 @@
-#!/usr/bin/env bash
-# deploy-landing.sh — Deploy static landing page to VPS
-# Run from Mac: bash deploy/deploy-landing.sh
-set -euo pipefail
-
-VPS="root@185.167.97.141"
-LANDING_DIR="/var/www/patchwork-landing"
-NGINX_CONF="/etc/nginx/sites-available/patchworkos"
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-echo "==> Copying landing page + assets to VPS..."
-ssh "$VPS" "mkdir -p $LANDING_DIR"
-# index.html plus the favicon + manifest browsers probe at apex. Without
-# these the browser console fills with /favicon.svg and /manifest.json
-# 401s on every page load (nginx falls through to the dashboard middleware
-# for paths that don't have an explicit `location`).
-scp "$REPO_ROOT/landing/index.html"   "$VPS:$LANDING_DIR/index.html"
-scp "$REPO_ROOT/landing/favicon.ico"  "$VPS:$LANDING_DIR/favicon.ico"
-scp "$REPO_ROOT/landing/favicon.svg"  "$VPS:$LANDING_DIR/favicon.svg"
-scp "$REPO_ROOT/landing/manifest.json" "$VPS:$LANDING_DIR/manifest.json"
-
-echo "==> Updating nginx to serve landing page at root..."
-ssh "$VPS" bash <<'REMOTE'
-set -euo pipefail
-NGINX_CONF="/etc/nginx/sites-available/patchworkos"
-
-# Insert landing page root location if not already present
-if ! grep -q "location = /" "$NGINX_CONF"; then
-  python3 - "$NGINX_CONF" <<'PYEOF'
-import sys, re
-
-path = sys.argv[1]
-with open(path) as f:
-    content = f.read()
-
-landing_blocks = """
-    # Static landing page at root
-    location = / {
-        root /var/www/patchwork-landing;
-        try_files /index.html =404;
-    }
-
-    # Bridge API paths — proxy to bridge
-    location ~ ^/(mcp|oauth|notify|\.well-known|metrics|health|approvals|activity|sessions|traces|recipes|connectors|settings|schemas|push) {
-        proxy_pass http://127.0.0.1:3284;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 3600s;
-        proxy_send_timeout 3600s;
-    }
-"""
-
-# Insert before the SSE/dashboard blocks (before first "location /dashboard")
-# or before the last closing brace if those don't exist
-if 'location /dashboard' in content:
-    idx = content.find('    # SSE passthrough')
-    if idx == -1:
-        idx = content.find('    location /dashboard')
-else:
-    idx = content.rfind('\n}')
-
-if idx == -1:
-    idx = content.rfind('\n}')
-
-new_content = content[:idx] + landing_blocks + content[idx:]
-with open(path, 'w') as f:
-    f.write(new_content)
-print("nginx: landing + bridge location blocks inserted")
-PYEOF
-else
-  echo "nginx: landing location already present, skipping"
-fi
-
-# Independent idempotency block for the apex asset locations — these were
-# added after the original landing block, so existing installs miss them.
-if ! grep -q "location = /favicon.ico" "$NGINX_CONF"; then
-  python3 - "$NGINX_CONF" <<'PYEOF'
-import sys
-
-path = sys.argv[1]
-with open(path) as f:
-    content = f.read()
-
-asset_blocks = """
-    # Apex assets — favicon + PWA manifest browsers probe at root
-    location = /favicon.ico {
-        root /var/www/patchwork-landing;
-        try_files /favicon.ico =404;
-        access_log off;
-    }
-    location = /favicon.svg {
-        root /var/www/patchwork-landing;
-        try_files /favicon.svg =404;
-        access_log off;
-    }
-    location = /manifest.json {
-        root /var/www/patchwork-landing;
-        try_files /manifest.json =404;
-        access_log off;
-    }
-"""
-
-# Insert immediately after the existing `location = /` block
-marker = '    location = / {'
-idx = content.find(marker)
-if idx == -1:
-    print("WARN: could not find `location = /` to anchor; appending to end", flush=True)
-    idx = content.rfind('\n}')
-    new_content = content[:idx] + asset_blocks + content[idx:]
-else:
-    # find end of the location = / block
-    end = content.find('    }', idx)
-    end = content.find('\n', end) + 1 if end != -1 else idx
-    new_content = content[:end] + asset_blocks + content[end:]
-
-with open(path, 'w') as f:
-    f.write(new_content)
-print("nginx: apex asset location blocks inserted")
-PYEOF
-else
-  echo "nginx: apex asset locations already present, skipping"
-fi
-
-nginx -t && systemctl reload nginx
-echo "nginx reloaded"
-REMOTE
-
-echo ""
-echo "==> Deploy complete!"
-echo "    Landing page: https://patchworkos.com"

package/deploy/ecosystem.config.js.example

@@ -1,36 +0,0 @@
-// PM2 ecosystem config for claude-ide-bridge.
-// Copy to the repo root and edit before use:
-//   cp deploy/ecosystem.config.js.example ecosystem.config.js
-//
-// Usage:
-//   pm2 start ecosystem.config.js
-//   pm2 save
-//
-// IMPORTANT: The --port value below must match the port in your nginx proxy_pass.
-// The bridge defaults to a random port if --port is not set, which breaks nginx.
-
-module.exports = {
-  apps: [
-    {
-      name: "claude-bridge",
-      script: "dist/index.js",
-      cwd: "/root/claude-ide-bridge", // adjust to your INSTALL_DIR
-
-      // All bridge flags go here — NOT in env (PORT env var is not read by the bridge)
-      args: [
-        "--port", "4748",             // must match nginx proxy_pass port
-        "--bind", "0.0.0.0",          // expose to all interfaces (nginx handles TLS)
-        "--vps",                       // expands command allowlist for server use
-        "--fixed-token", "YOUR_TOKEN_HERE", // stable token; prevents rotation on restart
-      ].join(" "),
-
-      restart_delay: 5000,  // wait 5s before restart on crash
-      max_restarts: 20,     // give up after 20 consecutive crashes
-      min_uptime: "10s",    // don't count a restart as a crash if up for <10s
-
-      env: {
-        NODE_ENV: "production",
-      },
-    },
-  ],
-};