surf-cli 2.17.0 → 2.19.0

package/native/video-recorder.cjs

@@ -0,0 +1,444 @@
+const fs = require("fs");
+const path = require("path");
+const { spawn } = require("child_process");
+
+const DEFAULT_VIDEO_FPS = 30;
+const MAX_VIDEO_FPS = 60;
+const MIN_VIDEO_FPS = 1;
+const VIDEO_FRAME_QUEUE_LIMIT = 2;
+const VIDEO_BACKFILL_LIMIT_MS = 5000;
+const DEFAULT_STARTUP_GRACE_MS = 100;
+const DEFAULT_STOP_TIMEOUT_MS = 5000;
+
+class VideoRecorderError extends Error {
+  constructor(code, message, details = undefined) {
+    super(message);
+    this.name = "VideoRecorderError";
+    this.code = code;
+    if (details !== undefined) this.details = details;
+  }
+}
+
+function parseVideoFps(value, fallback = DEFAULT_VIDEO_FPS) {
+  if (value === undefined || value === null || value === "") return fallback;
+  if (typeof value === "boolean") {
+    throw new VideoRecorderError("video_fps_invalid", "fps must be a number");
+  }
+  const fps = Number(value);
+  if (!Number.isFinite(fps) || fps < MIN_VIDEO_FPS || fps > MAX_VIDEO_FPS) {
+    throw new VideoRecorderError("video_fps_invalid", `fps must be between ${MIN_VIDEO_FPS} and ${MAX_VIDEO_FPS}`);
+  }
+  return fps;
+}
+
+function validateVideoOutputPath(output, { createParent = true } = {}) {
+  if (typeof output !== "string" || !output.trim()) {
+    throw new VideoRecorderError("video_output_invalid", "video output path is required");
+  }
+  if (output.includes("\0")) {
+    throw new VideoRecorderError("video_output_invalid", "video output path contains an invalid null byte");
+  }
+
+  const resolved = path.resolve(output);
+  let existing;
+  try {
+    existing = fs.statSync(resolved);
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      throw new VideoRecorderError("video_output_invalid", `Cannot access video output path: ${error.message}`);
+    }
+  }
+  if (existing?.isDirectory()) {
+    throw new VideoRecorderError("video_output_invalid", `Video output path is a directory: ${resolved}`);
+  }
+
+  const parent = path.dirname(resolved);
+  if (createParent) {
+    try {
+      fs.mkdirSync(parent, { recursive: true });
+    } catch (error) {
+      throw new VideoRecorderError("video_output_unwritable", `Cannot create video output directory ${parent}: ${error.message}`);
+    }
+  }
+  try {
+    let writableParent = parent;
+    while (!fs.existsSync(writableParent)) {
+      const next = path.dirname(writableParent);
+      if (next === writableParent) break;
+      writableParent = next;
+    }
+    fs.accessSync(writableParent, fs.constants.W_OK);
+    if (existing) fs.accessSync(resolved, fs.constants.W_OK);
+  } catch (error) {
+    throw new VideoRecorderError("video_output_unwritable", `Video output path is not writable: ${resolved}`);
+  }
+
+  return resolved;
+}
+
+function buildFfmpegArgs(output, fps) {
+  return [
+    "-hide_banner",
+    "-loglevel",
+    "error",
+    "-y",
+    "-f",
+    "image2pipe",
+    "-vcodec",
+    "mjpeg",
+    "-framerate",
+    String(fps),
+    "-i",
+    "pipe:0",
+    "-an",
+    "-vf",
+    "pad=ceil(iw/2)*2:ceil(ih/2)*2",
+    "-c:v",
+    "libvpx-vp9",
+    "-pix_fmt",
+    "yuv420p",
+    "-r",
+    String(fps),
+    "-deadline",
+    "realtime",
+    "-row-mt",
+    "1",
+    "-f",
+    "webm",
+    output,
+  ];
+}
+
+function normalizeChildError(error) {
+  if (error instanceof VideoRecorderError) return error;
+  const message = error?.message || String(error || "ffmpeg failed");
+  if (error?.code === "ENOENT") {
+    return new VideoRecorderError("ffmpeg_missing", "ffmpeg was not found on PATH. Install ffmpeg and retry.");
+  }
+  return new VideoRecorderError("ffmpeg_failed", message);
+}
+
+class VideoRecorder {
+  constructor({
+    output,
+    fps = DEFAULT_VIDEO_FPS,
+    tabId,
+    recorderId,
+    spawnImpl = spawn,
+    now = () => Date.now(),
+    setIntervalImpl = setInterval,
+    clearIntervalImpl = clearInterval,
+    startupGraceMs = DEFAULT_STARTUP_GRACE_MS,
+    stopTimeoutMs = DEFAULT_STOP_TIMEOUT_MS,
+    onFailure = () => {},
+  } = {}) {
+    this.output = validateVideoOutputPath(output, { createParent: false });
+    this.fps = parseVideoFps(fps);
+    this.tabId = tabId;
+    this.recorderId = recorderId;
+    this.spawnImpl = spawnImpl;
+    this.now = now;
+    this.setIntervalImpl = setIntervalImpl;
+    this.clearIntervalImpl = clearIntervalImpl;
+    this.startupGraceMs = startupGraceMs;
+    this.stopTimeoutMs = stopTimeoutMs;
+    this.onFailure = onFailure;
+
+    this.state = "idle";
+    this.child = null;
+    this.ticker = null;
+    this.startedAt = null;
+    this.stoppedAt = null;
+    this.frames = 0;
+    this.capturedFrames = 0;
+    this.lastFrame = null;
+    this.frameQueue = [];
+    this.failure = null;
+    this.closeCode = null;
+    this.closeSignal = null;
+    this.stopPromise = null;
+    this._failureNotified = false;
+  }
+
+  get intervalMs() {
+    return Math.max(1, Math.round(1000 / this.fps));
+  }
+
+  status() {
+    return {
+      status: this.state === "active" || this.state === "starting" || this.state === "stopping" ? "active" : this.state,
+      recorderId: this.recorderId,
+      path: this.output,
+      fps: this.fps,
+      tabId: this.tabId,
+      startedAt: this.startedAt ? new Date(this.startedAt).toISOString() : undefined,
+      stoppedAt: this.stoppedAt ? new Date(this.stoppedAt).toISOString() : undefined,
+      durationMs: this.startedAt ? Math.max(0, (this.stoppedAt || this.now()) - this.startedAt) : 0,
+      frames: this.frames,
+      capturedFrames: this.capturedFrames,
+      ...(this.failure ? { error: this.failure.message, errorCode: this.failure.code } : {}),
+    };
+  }
+
+  async start() {
+    if (this.state !== "idle") {
+      throw new VideoRecorderError("video_recorder_state", `Cannot start video recorder in state ${this.state}`);
+    }
+    // Create the parent only after all basic path validation has completed.
+    validateVideoOutputPath(this.output, { createParent: true });
+
+    this.state = "starting";
+    this.startedAt = this.now();
+    let child;
+    try {
+      child = this.spawnImpl("ffmpeg", buildFfmpegArgs(this.output, this.fps), {
+        stdio: ["pipe", "ignore", "pipe"],
+        windowsHide: true,
+      });
+    } catch (error) {
+      this._fail(normalizeChildError(error));
+      throw this.failure;
+    }
+    this.child = child;
+    this._attachChildListeners(child);
+
+    try {
+      await this._waitForStartup();
+    } catch (error) {
+      const normalized = normalizeChildError(error);
+      this._fail(normalized);
+      await this._killChild();
+      throw normalized;
+    }
+    if (this.state === "failed") throw this.failure;
+
+    this.state = "active";
+    this.ticker = this.setIntervalImpl(() => this._tick(), this.intervalMs);
+    // A frame can arrive while the start command is settling; encode it
+    // without waiting for the first interval, then keep a wall-clock cadence.
+    this._tick();
+    return this.status();
+  }
+
+  addFrame(data, receivedAt = this.now()) {
+    if (this.state !== "starting" && this.state !== "active") return false;
+    if (typeof data !== "string" || !data) return false;
+    let frame;
+    try {
+      frame = Buffer.from(data, "base64");
+    } catch {
+      return false;
+    }
+    if (!frame.length) return false;
+
+    this.capturedFrames += 1;
+    this.lastFrame = { data: frame, receivedAt };
+    this.frameQueue.push(this.lastFrame);
+    while (this.frameQueue.length > VIDEO_FRAME_QUEUE_LIMIT) this.frameQueue.shift();
+    // The wall-clock ticker is the sole write path once active, so a busy
+    // screencast cannot make ffmpeg run faster than the requested FPS.
+    return true;
+  }
+
+  async stop() {
+    if (this.stopPromise) return this.stopPromise;
+    if (this.state === "idle") {
+      throw new VideoRecorderError("video_not_active", "No active video recording");
+    }
+    if (this.state === "failed") throw this.failure;
+
+    this.stopPromise = this._stopInternal();
+    return this.stopPromise;
+  }
+
+  async dispose() {
+    if (this.stopPromise) return this.stopPromise.catch(() => this.status());
+    if (this.state === "idle" || this.state === "stopped") return this.status();
+    this._clearTicker();
+    await this._killChild();
+    this.state = "stopped";
+    this.stoppedAt = this.now();
+    return this.status();
+  }
+
+  _attachChildListeners(child) {
+    child.once?.("error", (error) => {
+      if (this.state === "stopping" || this.state === "stopped") return;
+      this._fail(normalizeChildError(error));
+    });
+    child.once?.("exit", (code, signal) => {
+      this.closeCode = code;
+      this.closeSignal = signal;
+      if (this.state === "starting") {
+        this._fail(new VideoRecorderError("ffmpeg_exit_early", `ffmpeg exited before recording started${code === null ? "" : ` (code ${code})`}`));
+      } else if (this.state === "active") {
+        this._fail(new VideoRecorderError("ffmpeg_exited", `ffmpeg exited while recording${code === null ? "" : ` (code ${code})`}`));
+      }
+    });
+    child.once?.("close", (code, signal) => {
+      this.closeCode = code;
+      this.closeSignal = signal;
+      if (this.state === "starting") {
+        this._fail(new VideoRecorderError("ffmpeg_exit_early", `ffmpeg exited before recording started${code === null ? "" : ` (code ${code})`}`));
+      } else if (this.state === "active") {
+        this._fail(new VideoRecorderError("ffmpeg_exited", `ffmpeg exited while recording${code === null ? "" : ` (code ${code})`}`));
+      }
+    });
+    child.stdin?.once?.("error", (error) => {
+      if (this.state === "stopping" || this.state === "stopped") return;
+      this._fail(normalizeChildError(error));
+    });
+    child.stderr?.on?.("data", (chunk) => {
+      const text = String(chunk || "").trim();
+      if (!text) return;
+      this.stderr = `${this.stderr || ""}${text}\n`.slice(-8192);
+    });
+  }
+
+  _waitForStartup() {
+    const child = this.child;
+    if (!child) return Promise.reject(new VideoRecorderError("ffmpeg_failed", "ffmpeg process was not created"));
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      let timer;
+      const finish = (error) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        error ? reject(error) : resolve();
+      };
+      const onSpawn = () => {
+        timer = setTimeout(() => finish(), this.startupGraceMs);
+      };
+      child.once?.("spawn", onSpawn);
+      child.once?.("error", (error) => finish(normalizeChildError(error)));
+      child.once?.("exit", (code) => {
+        finish(new VideoRecorderError("ffmpeg_exit_early", `ffmpeg exited before recording started${code === null ? "" : ` (code ${code})`}`));
+      });
+      child.once?.("close", (code) => {
+        finish(new VideoRecorderError("ffmpeg_exit_early", `ffmpeg exited before recording started${code === null ? "" : ` (code ${code})`}`));
+      });
+      // Real ChildProcess instances emit spawn, but a small process wrapper may
+      // not. Do not leave a recorder hanging forever in that case.
+      timer = setTimeout(() => finish(), this.startupGraceMs);
+    });
+  }
+
+  _tick() {
+    if (this.state !== "active") return;
+    const stdin = this.child?.stdin;
+    if (!stdin || stdin.destroyed || stdin.writableEnded || stdin.writableNeedDrain) return;
+
+    const now = this.now();
+    let frame = this.frameQueue.shift() || this.lastFrame;
+    if (!frame) return;
+
+    // Never replay a queued frame after an arbitrarily long event-loop stall.
+    // The live ticker continues from the latest frame, but stale backfill is
+    // intentionally limited to a few seconds.
+    if (now - frame.receivedAt > VIDEO_BACKFILL_LIMIT_MS) {
+      frame = this.lastFrame;
+    }
+    try {
+      stdin.write(frame.data);
+      this.frames += 1;
+    } catch (error) {
+      this._fail(normalizeChildError(error));
+    }
+  }
+
+  async _stopInternal() {
+    this._clearTicker();
+    // Flush only a pending frame before closing stdin. Replaying the latest
+    // already-written frame here would add an unnecessary duplicate at stop.
+    if (this.frameQueue.length > 0) this._tick();
+    this.state = "stopping";
+    this.stoppedAt = this.now();
+    const child = this.child;
+    if (!child) {
+      this.state = "stopped";
+      return this.status();
+    }
+
+    const closeResult = await new Promise((resolve) => {
+      let settled = false;
+      let timer;
+      const finish = (code, signal, timedOut = false) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        resolve({ code, signal, timedOut });
+      };
+      child.once?.("close", finish);
+      child.once?.("exit", finish);
+      try {
+        if (child.stdin && !child.stdin.destroyed && !child.stdin.writableEnded) child.stdin.end();
+        else if (child.stdin?.destroy) child.stdin.destroy();
+      } catch (error) {
+        this._fail(normalizeChildError(error));
+        finish(null, null);
+      }
+      timer = setTimeout(() => {
+        try { child.kill?.("SIGTERM"); } catch {}
+        finish(this.closeCode, this.closeSignal, true);
+      }, this.stopTimeoutMs);
+    });
+    if (closeResult.timedOut) {
+      this.failure = new VideoRecorderError("ffmpeg_stop_timeout", `ffmpeg did not exit within ${this.stopTimeoutMs}ms while finalizing the recording`);
+      this.state = "failed";
+      throw this.failure;
+    }
+    this.closeCode = closeResult.code;
+    this.closeSignal = closeResult.signal;
+    if (this.failure) {
+      this.state = "failed";
+      throw this.failure;
+    }
+    if (closeResult.code !== null && closeResult.code !== undefined && closeResult.code !== 0) {
+      const detail = this.stderr ? `: ${this.stderr.trim()}` : "";
+      this.failure = new VideoRecorderError("ffmpeg_failed", `ffmpeg failed while finalizing the recording (code ${closeResult.code})${detail}`);
+      this.state = "failed";
+      throw this.failure;
+    }
+    this.state = "stopped";
+    return this.status();
+  }
+
+  _clearTicker() {
+    if (this.ticker !== null) {
+      this.clearIntervalImpl(this.ticker);
+      this.ticker = null;
+    }
+  }
+
+  _fail(error) {
+    if (this.failure) return;
+    this.failure = normalizeChildError(error);
+    this.state = "failed";
+    this._clearTicker();
+    if (!this._failureNotified) {
+      this._failureNotified = true;
+      try { this.onFailure(this.failure, this); } catch {}
+    }
+  }
+
+  async _killChild() {
+    const child = this.child;
+    if (!child || child.killed) return;
+    try { child.kill("SIGTERM"); } catch {}
+  }
+}
+
+module.exports = {
+  DEFAULT_STARTUP_GRACE_MS,
+  DEFAULT_STOP_TIMEOUT_MS,
+  DEFAULT_VIDEO_FPS,
+  MAX_VIDEO_FPS,
+  MIN_VIDEO_FPS,
+  VIDEO_BACKFILL_LIMIT_MS,
+  VIDEO_FRAME_QUEUE_LIMIT,
+  VideoRecorder,
+  VideoRecorderError,
+  parseVideoFps,
+  validateVideoOutputPath,
+};

package/native/workflow-definition.cjs

@@ -40,6 +40,7 @@ const COMMANDS = {
   "session.ensure": { primaryArg: "name", effect: "navigation", recordable: false, argKinds: { name: "name", url: "url" } },
   "session.list": { effect: "read", recordable: false },
   "session.info": { primaryArg: "name", effect: "read", recordable: false, argKinds: { name: "name" } },
+  "session.cleanup": { effect: "page-write", recordable: false, argKinds: { "idle-after": "duration" } },
   "session.close": { primaryArg: "name", effect: "page-write", recordable: false, argKinds: { name: "name" } },
   "session.rebind": { primaryArg: "name", effect: "page-write", recordable: false, argKinds: { name: "name", tabId: "tab-id" } },
   "session.reopen": { primaryArg: "name", effect: "navigation", recordable: false, argKinds: { name: "name", url: "url" } },
@@ -64,6 +65,10 @@ const COMMANDS = {
   "page.text": { effect: "read" },
   "page.state": { effect: "read" },
   screenshot: { effect: "read" },
+  "video.start": { primaryArg: "output", effect: "read", recordable: false },
+  "video.stop": { effect: "read", recordable: false },
+  "video.status": { effect: "read", recordable: false },
+  "video.restart": { primaryArg: "output", effect: "read", recordable: false },
   "window.new": { primaryArg: "url", effect: "navigation", argKinds: { url: "url" } },
   "window.focus": { primaryArg: "id", effect: "navigation", argKinds: { id: "window-id" } },
   "window.close": { primaryArg: "id", effect: "page-write", argKinds: { id: "window-id" } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "surf-cli",
-  "version": "2.17.0",
+  "version": "2.19.0",
   "description": "CLI for AI agents to control Chrome. Zero config, agent-agnostic, battle-tested.",
   "keywords": [
     "chrome",
@@ -68,14 +68,14 @@
     "@biomejs/biome": "^2.5.4",
     "@types/chrome": "^0.2.2",
     "@types/node": "^26.1.2",
-    "@vitest/coverage-v8": "^4.1.9",
-    "@vitest/ui": "^4.1.9",
-    "pi-subagents": "^0.52.0",
-    "puppeteer": "25.8.0",
+    "@vitest/coverage-v8": "^5.0.0",
+    "@vitest/ui": "^5.0.0",
+    "pi-subagents": "^0.66.0",
+    "puppeteer": "25.10.0",
     "typebox": "^1.3.11",
     "typescript": "^7.0.2",
     "vite": "^8.1.4",
-    "vitest": "^4.1.9"
+    "vitest": "^5.0.0"
   },
   "pi": {
     "extensions": [

package/scripts/install-native-host.cjs

@@ -4,6 +4,7 @@ const path = require("path");
 const os = require("os");
 const { execFileSync, execSync } = require("child_process");
 const { parseListenEndpoint } = require("../native/listener.cjs");
+const { normalizeSocketConfig } = require("../native/socket-permissions.cjs");
 const { getStateDir, loadHostIdentity, loadRegistry } = require("../native/remote-auth.cjs");
 
 const HOST_NAME = "surf.browser.host";
@@ -166,7 +167,9 @@ function wslPathToWindowsPath(wslPath) {
   }
 }
 
-function createWrapper(wrapperDir, nodePath, hostPath, target = process.platform, listen) {
+function createWrapper(wrapperDir, nodePath, hostPath, target = process.platform, listen, socketMode, socketGroup) {
+  const socketConfig = normalizeSocketConfig(socketMode, socketGroup);
+  assertSocketAccessTargetSupported(socketConfig.mode, socketConfig.group, target);
   fs.mkdirSync(wrapperDir, { recursive: true });
 
   if (target === "wsl-windows") {
@@ -186,9 +189,13 @@ function createWrapper(wrapperDir, nodePath, hostPath, target = process.platform
 
   const shPath = path.join(wrapperDir, "host-wrapper.sh");
   const hostDir = path.dirname(hostPath);
+  const socketEnvironment = [
+    socketConfig.mode === undefined ? "" : `: "\${SURF_SOCKET_MODE:=${socketConfig.mode.toString(8)}}"\nexport SURF_SOCKET_MODE\n`,
+    socketConfig.group === undefined ? "" : `: "\${SURF_SOCKET_GROUP:=${socketConfig.group}}"\nexport SURF_SOCKET_GROUP\n`,
+  ].join("");
   const content = `#!/usr/bin/env bash
 cd "${hostDir}"
-${listen ? `: "\${SURF_LISTEN:=${listen}}"\nexport SURF_LISTEN\n` : ""}exec "${nodePath}" "${hostPath}" "$@"
+${listen ? `: "\${SURF_LISTEN:=${listen}}"\nexport SURF_LISTEN\n` : ""}${socketEnvironment}exec "${nodePath}" "${hostPath}" "$@"
 `;
   fs.writeFileSync(shPath, content);
   fs.chmodSync(shPath, "755");
@@ -201,6 +208,12 @@ function assertListenTargetSupported(listen, target) {
   }
 }
 
+function assertSocketAccessTargetSupported(socketMode, socketGroup, target) {
+  if ((socketMode !== undefined || socketGroup !== undefined) && (target === "win32" || target === "wsl-windows")) {
+    throw new Error("--socket-mode and --socket-group are only supported for POSIX native-host wrappers");
+  }
+}
+
 function readExistingManifest(manifestPath) {
   if (!fs.existsSync(manifestPath)) return {};
   return JSON.parse(fs.readFileSync(manifestPath, "utf8"));
@@ -276,7 +289,14 @@ function installWindowsRegistry(browser, extensionId, wrapperPath) {
 
 function parseArgs() {
   const args = process.argv.slice(2);
-  const result = { extensionId: null, browsers: ["chrome"], target: "auto", listen: undefined };
+  const result = {
+    extensionId: null,
+    browsers: ["chrome"],
+    target: "auto",
+    listen: undefined,
+    socketMode: undefined,
+    socketGroup: undefined,
+  };
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -292,6 +312,12 @@ function parseArgs() {
     } else if (arg === "--listen") {
       result.listen = args[++i];
       if (!result.listen || result.listen.startsWith("--")) throw new Error("--listen requires a Tailnet IP and port");
+    } else if (arg === "--socket-mode") {
+      result.socketMode = args[++i];
+      if (!result.socketMode || result.socketMode.startsWith("--")) throw new Error("--socket-mode requires 600 or 660");
+    } else if (arg === "--socket-group") {
+      result.socketGroup = args[++i];
+      if (!result.socketGroup || result.socketGroup.startsWith("--")) throw new Error("--socket-group requires a group name or gid");
     } else if (arg === "--help" || arg === "-h") {
       printHelp();
       process.exit(0);
@@ -322,6 +348,12 @@ Options:
                   Persist an authenticated Tailnet-only listener endpoint.
                   Requires at least one surf remote authorize client first.
                   Supports Tailscale IPv4 or IPv6 addresses; POSIX wrappers only.
+  --socket-mode <600|660>
+                  Persist the local Unix socket mode (default: 600).
+                  Mode 660 requires --socket-group; POSIX wrappers only.
+  --socket-group <group-or-gid>
+                  Persist the local Unix socket group for mode 660.
+                  Use a dedicated group; this grants full Surf authority.
 
 Examples:
   node install-native-host.cjs abcdefghijklmnopabcdefghijklmnop
@@ -329,13 +361,14 @@ Examples:
   node install-native-host.cjs abcdefghijklmnop --browser all
   node install-native-host.cjs abcdefghijklmnop --target linux
   node install-native-host.cjs abcdefghijklmnop --listen 100.64.1.2:4321
+  node install-native-host.cjs abcdefghijklmnop --socket-mode 660 --socket-group surf
 `);
 }
 
 function main() {
   let parsed;
   try { parsed = parseArgs(); } catch (error) { console.error(`Error: ${error.message}`); process.exit(1); }
-  const { extensionId, browsers, target, listen } = parsed;
+  const { extensionId, browsers, target, listen, socketMode, socketGroup } = parsed;
 
   if (!extensionId) {
     console.error("Error: Extension ID required");
@@ -378,7 +411,12 @@ function main() {
   }
 
   const effectiveTarget = runningInWsl && target !== "linux" ? "wsl-windows" : process.platform;
-  try { assertListenTargetSupported(listen, effectiveTarget); } catch (error) { console.error(`Error: ${error.message}`); process.exit(1); }
+  let socketConfig;
+  try {
+    socketConfig = normalizeSocketConfig(socketMode, socketGroup);
+    assertListenTargetSupported(listen, effectiveTarget);
+    assertSocketAccessTargetSupported(socketMode, socketGroup, effectiveTarget);
+  } catch (error) { console.error(`Error: ${error.message}`); process.exit(1); }
 
   const nodePath = findNode();
   if (!nodePath) {
@@ -407,7 +445,15 @@ function main() {
   console.log(`Wrapper dir: ${wrapperDir}`);
   console.log("");
 
-  const wrapperPath = createWrapper(wrapperDir, nodePath, hostPath, effectiveTarget, listener);
+  const wrapperPath = createWrapper(
+    wrapperDir,
+    nodePath,
+    hostPath,
+    effectiveTarget,
+    listener,
+    socketConfig.mode,
+    socketConfig.group,
+  );
   console.log(`Created wrapper: ${wrapperPath}`);
   console.log("");
 
@@ -450,4 +496,5 @@ module.exports = {
   createWrapper,
   writeManifest,
   assertListenTargetSupported,
+  assertSocketAccessTargetSupported,
 };