patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/deploy/install-vps-service.sh

@@ -1,240 +0,0 @@
-#!/usr/bin/env bash
-# deploy/install-vps-service.sh
-# Idempotent updater — re-installs the systemd service and nginx config
-# on an already-bootstrapped server after a git pull.
-#
-# For FIRST-TIME setup on a new VPS, use bootstrap-new-vps.sh instead.
-#
-# Usage (run as root from repo root):
-#   bash deploy/install-vps-service.sh
-#
-# Optional environment overrides:
-#   DOMAIN        Override domain (default: read from existing nginx config or prompt)
-#   PORT          Override port   (default: read from .env.vps)
-#   SERVICE_USER  Override user   (default: auto-detect from existing service)
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-SERVICE_NAME="claude-ide-bridge"
-ENV_FILE="$REPO_ROOT/.env.vps"
-
-RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
-info()    { echo -e "${GREEN}✓${NC} $*"; }
-warn()    { echo -e "${YELLOW}⚠${NC}  $*"; }
-err()     { echo -e "${RED}✗${NC} $*" >&2; }
-
-echo "=== Claude IDE Bridge — Service Updater ==="
-echo ""
-
-# ── Pre-flight ────────────────────────────────────────────────────────────────
-[[ "$(id -u)" -eq 0 ]] || { err "Run as root: sudo bash deploy/install-vps-service.sh"; exit 1; }
-[[ -f "$ENV_FILE" ]]   || { err "$ENV_FILE not found. Run bootstrap-new-vps.sh first."; exit 1; }
-
-source "$ENV_FILE"
-[[ -n "${FIXED_TOKEN:-}" ]] || { err "FIXED_TOKEN not set in $ENV_FILE"; exit 1; }
-[[ -n "${PORT:-}" ]]        || { err "PORT not set in $ENV_FILE"; exit 1; }
-[[ -n "${WORKSPACE:-}" ]]   || { err "WORKSPACE not set in $ENV_FILE"; exit 1; }
-
-DIST="$REPO_ROOT/dist/index.js"
-[[ -f "$DIST" ]] || { err "$DIST not found. Run: npm run build"; exit 1; }
-
-command -v nginx     >/dev/null 2>&1 || { err "nginx not found. Run bootstrap-new-vps.sh first."; exit 1; }
-command -v systemctl >/dev/null 2>&1 || { err "systemd not available."; exit 1; }
-
-# Detect service user from existing unit file, fall back to env or default
-EXISTING_USER=$(grep -Po '(?<=^User=).+' /etc/systemd/system/${SERVICE_NAME}.service 2>/dev/null || echo "")
-SERVICE_USER="${SERVICE_USER:-${EXISTING_USER:-claude-bridge}}"
-
-# Detect domain from existing nginx config
-EXISTING_DOMAIN=$(grep -Po '(?<=server_name )[\w.-]+' /etc/nginx/sites-available/claude-bridge 2>/dev/null | head -1 || echo "")
-DOMAIN="${DOMAIN:-$EXISTING_DOMAIN}"
-
-if [[ -z "$DOMAIN" ]]; then
-  err "Cannot determine DOMAIN. Set it: DOMAIN=bridge.example.com bash deploy/install-vps-service.sh"
-  exit 1
-fi
-
-info "Repo:         $REPO_ROOT"
-info "Domain:       $DOMAIN"
-info "Port:         $PORT"
-info "Service user: $SERVICE_USER"
-echo ""
-
-# ── Systemd service ───────────────────────────────────────────────────────────
-echo "Updating systemd service..."
-
-cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<SERVICE
-[Unit]
-Description=Claude IDE Bridge MCP Server
-Documentation=https://github.com/Oolab-labs/claude-ide-bridge
-After=network.target
-StartLimitIntervalSec=120
-StartLimitBurst=5
-
-[Service]
-Type=simple
-User=$SERVICE_USER
-WorkingDirectory=$REPO_ROOT
-
-# Load config — FIXED_TOKEN, PORT, WORKSPACE
-EnvironmentFile=$ENV_FILE
-
-# Bridge process
-ExecStart=/usr/bin/node $REPO_ROOT/dist/index.js \\
-    --port \${PORT} \\
-    --workspace \${WORKSPACE} \\
-    --fixed-token \${FIXED_TOKEN} \\
-    --grace-period 120000 \\
-    --vps
-
-KillMode=mixed
-KillSignal=SIGTERM
-TimeoutStopSec=15
-Restart=always
-RestartSec=5
-
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=claude-ide-bridge
-
-NoNewPrivileges=true
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
-SERVICE
-
-systemctl daemon-reload
-systemctl enable "$SERVICE_NAME"
-info "Systemd service updated"
-
-# ── nginx ─────────────────────────────────────────────────────────────────────
-echo "Updating nginx config..."
-
-# Add connection_upgrade map if missing
-if ! grep -q "connection_upgrade" /etc/nginx/nginx.conf 2>/dev/null; then
-  perl -i -0pe 's/(http \{)/$1\n    map \$http_upgrade \$connection_upgrade {\n        default upgrade;\n        '"''"'     close;\n    }/' /etc/nginx/nginx.conf
-  info "Added connection_upgrade map to nginx.conf"
-fi
-
-# Write site config with domain and port injected
-cat > "/etc/nginx/sites-available/claude-bridge" <<NGINX
-# Claude IDE Bridge — nginx reverse proxy
-# Domain: $DOMAIN  Port: ${PORT}
-# Updated by install-vps-service.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-server {
-    listen 80;
-    listen [::]:80;
-    server_name $DOMAIN;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/html;
-    }
-
-    location / {
-        return 301 https://\$host\$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-    server_name $DOMAIN;
-
-    # TLS — managed by Certbot
-    # ssl_certificate     /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    add_header X-Content-Type-Options nosniff always;
-    add_header X-Frame-Options DENY always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
-    location /mcp {
-        proxy_pass http://127.0.0.1:${PORT};
-        proxy_http_version 1.1;
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_read_timeout 86400s;
-        proxy_send_timeout 86400s;
-        proxy_connect_timeout 10s;
-        proxy_set_header Authorization \$http_authorization;
-        proxy_pass_header Authorization;
-        proxy_set_header Mcp-Session-Id \$http_mcp_session_id;
-        proxy_pass_header Mcp-Session-Id;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection \$connection_upgrade;
-    }
-
-    location /health {
-        proxy_pass http://127.0.0.1:${PORT};
-        proxy_http_version 1.1;
-        proxy_connect_timeout 5s;
-        proxy_read_timeout 10s;
-    }
-
-    location /.well-known/ {
-        proxy_pass http://127.0.0.1:${PORT};
-        proxy_http_version 1.1;
-        proxy_connect_timeout 5s;
-        proxy_read_timeout 10s;
-    }
-
-    location / {
-        return 404;
-    }
-}
-NGINX
-
-[[ -L "/etc/nginx/sites-enabled/claude-bridge" ]] || \
-  ln -s /etc/nginx/sites-available/claude-bridge /etc/nginx/sites-enabled/claude-bridge
-
-[[ -L "/etc/nginx/sites-enabled/default" ]] && \
-  rm -f /etc/nginx/sites-enabled/default
-
-nginx -t
-systemctl reload nginx
-info "nginx config updated"
-
-# ── Stop tmux session if still running (superseded by systemd) ────────────────
-if command -v tmux >/dev/null 2>&1 && tmux has-session -t "bridge" 2>/dev/null; then
-  tmux kill-session -t "bridge" 2>/dev/null || true
-  info "Stopped legacy tmux bridge session"
-fi
-
-# ── Restart service ───────────────────────────────────────────────────────────
-echo "Restarting service..."
-systemctl restart "$SERVICE_NAME"
-
-echo -n "Waiting for bridge..."
-for i in $(seq 1 20); do
-  if curl -sf --max-time 3 "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
-    echo " ready."
-    break
-  fi
-  sleep 1; echo -n "."
-  if [[ $i -eq 20 ]]; then
-    echo " timed out."
-    warn "Check: journalctl -u $SERVICE_NAME -n 50"
-  fi
-done
-
-# ── Summary ───────────────────────────────────────────────────────────────────
-echo ""
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "  Claude IDE Bridge — service updated"
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo ""
-echo "  MCP endpoint:  https://$DOMAIN/mcp"
-echo "  Local:         http://127.0.0.1:${PORT}/mcp"
-echo "  Token:         ${FIXED_TOKEN}"
-echo ""
-echo "  journalctl -u $SERVICE_NAME -f"
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

package/deploy/macos/README.md

@@ -1,153 +0,0 @@
-# macOS launchd setup for the bridge
-
-Make the local `claude-ide-bridge` and the SSH reverse tunnel to your
-self-hosted dashboard persistent on your Mac:
-
-- Auto-start at login
-- Auto-restart on crash (bridge has its own `--watch` supervisor; launchd
-  is the supervisor of the supervisor)
-- Auto-reconnect on network change / sleep / wake (autossh)
-- No tmux session to keep alive, no terminal to leave open
-
-## One-time setup
-
-1. **Install the patchwork CLI globally** (not via `npm link`). LaunchAgents
-   run in a tighter sandbox; symlinked installs into `~/Documents` /
-   `~/Desktop` / `~/Downloads` fail with `EPERM`:
-   ```bash
-   npm install -g patchwork-os
-   # or, from a local repo:
-   #   npm pack && npm install -g patchwork-os-*.tgz
-   ```
-
-2. **Make sure you can SSH to the VPS without a password prompt.** The
-   tunnel runs unattended; if SSH would prompt for a key passphrase,
-   add the key to your agent (`ssh-add ~/.ssh/id_ed25519`) or use a
-   passphrase-less key.
-
-3. **(Recommended) Pin the SSH target in `~/.ssh/config` first.** Using
-   the public domain as the SSH target is fragile — DNS drifts during
-   redeploys (CDN edges, transient IPs), so SSH lands on a different
-   machine and the host key changes. Add an alias once and use it
-   everywhere:
-
-   ```ssh-config
-   # ~/.ssh/config
-   Host pw-bridge
-       HostName 185.167.97.141       # your VPS IP — stable across DNS shifts
-       User wesh                      # or root, whatever your VPS allows
-       IdentityFile ~/.ssh/id_ed25519
-       ServerAliveInterval 30
-       ServerAliveCountMax 3
-       UserKnownHostsFile ~/.ssh/known_hosts.patchwork
-   ```
-
-   Verify it works once: `ssh pw-bridge "echo ok"`. The host key is
-   accepted into the dedicated `known_hosts.patchwork` file and stays
-   there even if you `ssh-keygen -R` your global known_hosts later.
-
-4. **Run the installer** with the alias (cleanest):
-   ```bash
-   VPS_HOST=pw-bridge bash deploy/macos/install-mac-bridge.sh
-   ```
-   The installer detects the alias via `ssh -G` and lets ssh_config
-   own user + identity + hostname resolution. On a VPS rebuild, you
-   only update `~/.ssh/config` — the LaunchAgents pick it up.
-
-   Without an alias (interactive, prompts for VPS host):
-   ```bash
-   bash deploy/macos/install-mac-bridge.sh
-   # → prompts; recommend the IP (185.167.97.141) over the domain
-   ```
-   Or fully env-driven:
-   ```bash
-   VPS_HOST=185.167.97.141 VPS_USER=root \
-   BRIDGE_PORT=63906 VPS_PORT=3285 \
-   bash deploy/macos/install-mac-bridge.sh
-   ```
-
-5. **Sync the bridge token to the VPS** (the installer prints the exact
-   `ssh … sed … pm2 restart` command — copy-paste).
-
-## What runs after install
-
-```
-~/Library/LaunchAgents/com.patchwork.bridge.plist
-~/Library/LaunchAgents/com.patchwork.tunnel.plist
-```
-
-Both are loaded into the per-user `gui/$UID` launchd domain at install
-time and at every login.
-
-```
-[claude-ide-bridge --port 63906 --fixed-token <…> --watch]
-        │
-        │  127.0.0.1:63906
-        ▼
-[autossh -R 127.0.0.1:3285:localhost:63906]
-        │
-        │  encrypted SSH reverse tunnel
-        ▼
-VPS:3285 ──── nginx ──── dashboard `/api/bridge/*`
-```
-
-## Logs
-
-```bash
-tail -f ~/Library/Logs/patchwork-bridge.log
-tail -f ~/Library/Logs/patchwork-tunnel.log
-```
-
-## Status
-
-```bash
-launchctl print gui/$UID/com.patchwork.bridge
-launchctl print gui/$UID/com.patchwork.tunnel
-```
-
-## Restart manually
-
-```bash
-launchctl kickstart -k gui/$UID/com.patchwork.bridge
-launchctl kickstart -k gui/$UID/com.patchwork.tunnel
-```
-
-## Uninstall
-
-```bash
-bash deploy/macos/uninstall-mac-bridge.sh
-```
-
-## Troubleshooting
-
-- **`com.patchwork.bridge` exits with status 78 / `EPERM`** — the bridge
-  CLI is installed via `npm link` and points into `~/Documents`. The
-  macOS sandbox blocks LaunchAgents from reading that tree. Reinstall
-  globally as a real package (see step 1).
-- **`com.patchwork.tunnel` keeps respawning** — check the SSH key is
-  added to `ssh-agent` (`ssh-add -l`). LaunchAgents run before the
-  user's shell rc, so an interactive `ssh-add` from `.zshrc` doesn't
-  apply. Use a passphrase-less key, or store the key in macOS Keychain
-  with `ssh-add --apple-use-keychain`.
-- **Tunnel succeeds but dashboard says offline** — VPS port already in
-  use by an old leftover bridge. SSH to the VPS and `pkill -f "autossh\|sshd: .*\@notty"`,
-  or pick a different `VPS_PORT`.
-- **Dashboard 401s on every bridge call** — `PATCHWORK_BRIDGE_TOKEN`
-  on the VPS doesn't match the `--fixed-token` value the bridge is
-  using. Re-run the install script's printed `sed … pm2 restart`
-  command.
-- **`Host key for X has changed and you have requested strict
-  checking`** every now and then — the SSH target is moving. Two
-  causes:
-  1. **DNS drift.** The public domain resolves to a different IP than
-     it did last time (CDN edge, redeploy churn). `dig +short
-     bridge.your.tld` vs your known VPS IP — if those differ, switch
-     the `VPS_HOST` to the IP or a `~/.ssh/config` alias and re-run
-     the installer.
-  2. **VPS rebuild.** A reimage regenerates `/etc/ssh/ssh_host_*_key`
-     files. Either back them up before the rebuild and restore after,
-     or accept the new key once with `ssh-keygen -R <host> && ssh
-     <host>`. The launchd tunnel uses `StrictHostKeyChecking=accept-new`
-     (only auto-trusts on first connect, not after change), so you'll
-     see the warning, accept the new key interactively once, and the
-     tunnel resumes.

package/deploy/macos/com.patchwork.bridge.plist.template

@@ -1,54 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>com.patchwork.bridge</string>
-
-  <key>ProgramArguments</key>
-  <array>
-    <string>{{BRIDGE_BIN}}</string>
-    <string>--port</string>
-    <string>{{BRIDGE_PORT}}</string>
-    <string>--fixed-token</string>
-    <string>{{BRIDGE_TOKEN}}</string>
-    <string>--watch</string>
-    <string>--workspace</string>
-    <string>{{WORKSPACE}}</string>
-  </array>
-
-  <key>RunAtLoad</key>
-  <true/>
-  <!-- KeepAlive is redundant with `--watch` (which has its own
-       exponential-backoff supervisor and recovers from crashes faster
-       than launchd's per-second relaunch). Leave it true as belt-and-
-       suspenders in case `--watch` itself dies (its supervisor process
-       is a single Node, and that's the one launchd is keeping alive). -->
-  <key>KeepAlive</key>
-  <true/>
-
-  <key>StandardOutPath</key>
-  <string>{{HOME}}/Library/Logs/patchwork-bridge.log</string>
-  <key>StandardErrorPath</key>
-  <string>{{HOME}}/Library/Logs/patchwork-bridge.log</string>
-
-  <key>WorkingDirectory</key>
-  <string>{{WORKSPACE}}</string>
-
-  <key>EnvironmentVariables</key>
-  <dict>
-    <!-- launchd's default PATH doesn't include Homebrew. Bridge spawns
-         child processes (claude CLI, git, npm) via PATH lookup, so
-         missing /opt/homebrew/bin breaks half the tools. -->
-    <key>PATH</key>
-    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
-    <key>HOME</key>
-    <string>{{HOME}}</string>
-  </dict>
-
-  <!-- Throttle: don't relaunch faster than every 10 s on rapid crash
-       loops, prevents spinning up if the binary is broken. -->
-  <key>ThrottleInterval</key>
-  <integer>10</integer>
-</dict>
-</plist>

package/deploy/macos/com.patchwork.tunnel.plist.template

@@ -1,76 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>com.patchwork.tunnel</string>
-
-  <key>ProgramArguments</key>
-  <array>
-    <string>{{AUTOSSH_BIN}}</string>
-    <!-- AUTOSSH_PORT=0 disables the legacy monitoring-port heartbeat in
-         favor of SSH's own ServerAliveInterval/CountMax. Modern autossh
-         docs recommend this; the monitoring port is unreliable behind
-         NAT and consumes another tunnel slot. -->
-    <string>-M</string>
-    <string>0</string>
-    <!-- -N: no remote command   -T: no pseudo-tty                 -->
-    <string>-N</string>
-    <string>-T</string>
-    <string>-R</string>
-    <string>127.0.0.1:{{VPS_PORT}}:localhost:{{BRIDGE_PORT}}</string>
-    <!-- ServerAliveInterval=30 + CountMax=3 = ssh kills the link if
-         the server doesn't respond for 90 s, autossh restarts. Critical
-         for laptop sleep/wake and Wi-Fi switches. -->
-    <string>-o</string>
-    <string>ServerAliveInterval=30</string>
-    <string>-o</string>
-    <string>ServerAliveCountMax=3</string>
-    <!-- ExitOnForwardFailure=yes makes autossh exit + retry if the
-         remote port is already bound. Otherwise the tunnel "succeeds"
-         but no traffic flows. -->
-    <string>-o</string>
-    <string>ExitOnForwardFailure=yes</string>
-    <!-- Don't auto-add new host keys (security: surface key changes
-         instead of silently trusting). Initial setup expects the user
-         to have already SSH'd at least once and accepted the key. -->
-    <string>-o</string>
-    <string>StrictHostKeyChecking=accept-new</string>
-    <string>-i</string>
-    <string>{{SSH_KEY}}</string>
-    <!-- SSH_TARGET is rendered by install-mac-bridge.sh:
-           - "user@host" form when host is an IP or hostname
-           - bare alias when host matches a `~/.ssh/config` Host entry
-             (so ssh_config's User + HostName + IdentityFile resolution
-             works as designed; passing user@alias would override the
-             config's User directive and confuse the alias case). -->
-    <string>{{SSH_TARGET}}</string>
-  </array>
-
-  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <true/>
-
-  <key>StandardOutPath</key>
-  <string>{{HOME}}/Library/Logs/patchwork-tunnel.log</string>
-  <key>StandardErrorPath</key>
-  <string>{{HOME}}/Library/Logs/patchwork-tunnel.log</string>
-
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PATH</key>
-    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
-    <key>HOME</key>
-    <string>{{HOME}}</string>
-    <!-- AUTOSSH_GATETIME=0: don't require a "stable" connection time
-         before counting reconnect attempts. Default 30 s makes startup
-         after a long sleep slower than necessary. -->
-    <key>AUTOSSH_GATETIME</key>
-    <string>0</string>
-  </dict>
-
-  <key>ThrottleInterval</key>
-  <integer>10</integer>
-</dict>
-</plist>