#!/bin/bash
# macOS TCC workaround (M3U96a): processes started by PM2/launchd have no "Full Disk Access" and block on the
# external SSD (/Volumes/ssd). sshd-keygen-wrapper does have Full Disk Access, so PM2 runs this wrapper, which
# re-executes the real command on localhost through sshd. The ssh client is what PM2 supervises; when it stops,
# the pty hangs up and the worker receives SIGHUP (handled as a graceful stop).
# Usage: run-under-sshd.sh <workdir> <command...>
set -u
WORKDIR="$1"; shift
KEY="$HOME/.ssh/id_ed25519_maclustr"
REMOTE_PATH="/opt/homebrew/opt/postgresql@17/bin:/opt/homebrew/bin:$HOME/.local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
CMD=$(printf '%q ' "$@")
exec env -u SSH_AUTH_SOCK ssh -tt -q -o BatchMode=yes -o IdentitiesOnly=yes -i "$KEY" -o StrictHostKeyChecking=accept-new \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3 localhost \
  "cd $(printf '%q' "$WORKDIR") && export PATH=$REMOTE_PATH FINDATA_ROOT=$(printf '%q' "$WORKDIR") PYTHONUNBUFFERED=1 && exec $CMD"