1#!/bin/bash2# macOS TCC workaround (M3U96a): processes started by PM2/launchd have no "Full Disk Access" and block on the3# external SSD (/Volumes/ssd). sshd-keygen-wrapper does have Full Disk Access, so PM2 runs this wrapper, which4# executes the real command on localhost through sshd. PM2 supervises this wrapper; on stop/restart the wrapper5# sends SIGTERM to the *remote* process (graceful: the worker finishes its current job) and waits for it, so no6# orphan workers are left behind. A leftover remote process from a previous incarnation (same PM2 name) is7# terminated first.8# Usage: run-under-sshd.sh <workdir> <command...>9set -u10WORKDIR="$1"; shift11KEY="$HOME/.ssh/id_ed25519_maclustr"12REMOTE_PATH="/opt/homebrew/opt/postgresql@17/bin:/opt/homebrew/bin:$HOME/.local/bin:/usr/bin:/bin:/usr/sbin:/sbin"13NAME="${name:-findata-$$}" # PM2 exports the process name as $name14PIDFILE="$WORKDIR/logs/sshd-$NAME.pid"15mkdir -p "$WORKDIR/logs"16SSH=(ssh -T -q -o BatchMode=yes -o IdentitiesOnly=yes -i "$KEY" -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=30 -o ServerAliveCountMax=3 localhost)17if [ -f "$PIDFILE" ]; then18 OLD=$(cat "$PIDFILE" 2>/dev/null)19 if [ -n "$OLD" ] && kill -0 "$OLD" 2>/dev/null; then20 echo "run-under-sshd: terminating leftover remote process $OLD for $NAME" >&221 kill -TERM "$OLD" 2>/dev/null22 for _ in $(seq 1 3600); do kill -0 "$OLD" 2>/dev/null || break; sleep 1; done23 fi24fi25CMD=$(printf '%q ' "$@")26"${SSH[@]}" "cd $(printf '%q' "$WORKDIR") && export PATH=$REMOTE_PATH FINDATA_ROOT=$(printf '%q' "$WORKDIR") PYTHONUNBUFFERED=1 && echo \$\$ > $(printf '%q' "$PIDFILE") && exec $CMD" &27SSHPID=$!28stop() {29 REMOTE=$(cat "$PIDFILE" 2>/dev/null)30 [ -n "$REMOTE" ] && kill -TERM "$REMOTE" 2>/dev/null31 wait "$SSHPID" 2>/dev/null32 rm -f "$PIDFILE"33 exit 034}35trap stop TERM INT HUP36wait "$SSHPID"37RC=$?38rm -f "$PIDFILE"39exit $RC40