1#!/bin/bash2# macOS TCC workaround (M3U96a): processes started by PM2/launchd have no "Full Disk Access" and block on the3# external SSD (/Volumes/ssd). sshd-keygen-wrapper does have Full Disk Access, so PM2 runs this wrapper, which4# executes the real command on localhost through sshd. PM2 supervises this wrapper; on stop/restart the wrapper5# sends SIGTERM to the *remote* process (graceful: the worker finishes its current job) and waits for it, so no6# orphan workers are left behind. A leftover remote process from a previous incarnation (same PM2 name) is7# terminated first.8# Usage: run-under-sshd.sh <workdir> <command...>9set -u10WORKDIR="$1"; shift11KEY="$HOME/.ssh/id_ed25519_maclustr"12REMOTE_PATH="/opt/homebrew/opt/postgresql@17/bin:/opt/homebrew/bin:$HOME/.local/bin:/usr/bin:/bin:/usr/sbin:/sbin"13NAME="${name:-findata-$$}" # PM2 exports the process name as $name14PIDFILE="$WORKDIR/logs/sshd-$NAME.pid"15GRACE="${FINDATA_STOP_GRACE:-3600}" # seconds to wait after SIGTERM before SIGKILL (workers finish their job)16case "$NAME" in *api*) GRACE="${FINDATA_STOP_GRACE:-30}";; esac17mkdir -p "$WORKDIR/logs"18SSH=(ssh -T -q -o BatchMode=yes -o IdentitiesOnly=yes -i "$KEY" -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=30 -o ServerAliveCountMax=3 localhost)19if [ -f "$PIDFILE" ]; then20 OLD=$(cat "$PIDFILE" 2>/dev/null)21 if [ -n "$OLD" ] && kill -0 "$OLD" 2>/dev/null; then22 echo "run-under-sshd: terminating leftover remote process $OLD for $NAME" >&223 kill -TERM "$OLD" 2>/dev/null24 for _ in $(seq 1 "$GRACE"); do kill -0 "$OLD" 2>/dev/null || break; sleep 1; done25 kill -0 "$OLD" 2>/dev/null && { echo "run-under-sshd: SIGKILL leftover $OLD" >&2; kill -KILL "$OLD" 2>/dev/null; sleep 1; }26 fi27fi28CMD=$(printf '%q ' "$@")29"${SSH[@]}" "cd $(printf '%q' "$WORKDIR") && export PATH=$REMOTE_PATH FINDATA_ROOT=$(printf '%q' "$WORKDIR") PYTHONUNBUFFERED=1 && echo \$\$ > $(printf '%q' "$PIDFILE") && exec $CMD" &30SSHPID=$!31stop() {32 REMOTE=$(cat "$PIDFILE" 2>/dev/null)33 if [ -n "$REMOTE" ]; then34 kill -TERM "$REMOTE" 2>/dev/null35 for _ in $(seq 1 "$GRACE"); do kill -0 "$REMOTE" 2>/dev/null || break; sleep 1; done36 kill -0 "$REMOTE" 2>/dev/null && kill -KILL "$REMOTE" 2>/dev/null37 fi38 wait "$SSHPID" 2>/dev/null39 rm -f "$PIDFILE"40 exit 041}42trap stop TERM INT HUP43wait "$SSHPID"44RC=$?45rm -f "$PIDFILE"46exit $RC47