Deploy hosted mcp2cli as rico

[rodaddy]

Summary

• deploy hosted mcp2cli to /home/rico/.local/bin/mcp2cli and restart it as rico, without sudo, root-owned paths, systemctl, or /tmp
• keep hosted daemon state under Rico-owned XDG paths for pid, logs, staged binary, and backups
• resolve hosted Vaultwarden secret refs through the already-running daemon HTTP /call path via MCP2CLI_VAULTWARDEN_REMOTE_URL

Refs #19.

Hosted CT216 validation

• CT216 health: status=ok, version 0.3.12, PID 123164, PPID 1, user rico, exe /home/rico/.local/bin/mcp2cli
• current hosted binary hash: dcd82fbacf1b2082a8d2477e68dc9100926957b9252acb680eb05cf9e0392492
• hosted env has MCP2CLI_VAULTWARDEN_REMOTE_URL=http://127.0.0.1:9500
• open-brain get_contract returned contract 2026-06-28.memory-tools.v11
• n8n --help returned tool listing
• hosted direct /list-tools for gitingest returned ingest_repo
• hosted direct /schema for gitingest.ingest_repo returned schema fingerprint 9afdc6d458ec7698eecf4c87fcceea1c9b929b63309830b38f30e86725ac2dc9
• hosted direct /call for gitingest.ingest_repo on octocat/Hello-World returned success=true
• daemon log shows secret_refs_resolved for gitingest, Vaultwarden lookup success, stdio connection, and successful ingest_repo

Local validation

• bun test tests/secrets/refs.test.ts
• bun run typecheck
• git diff --check
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml"); puts "yaml ok"'
• bun build --compile --target=bun-linux-x64 src/cli/index.ts --outfile /Volumes/ThunderBolt/_tmp/mcp2cli/test_install/bin/mcp2cli-linux-x64-check
• ggshield secret scan repo .
• actionlint .github/workflows/ci.yml only reports the existing local config gap for custom self-hosted runner label rodaddy

[rodaddy]

Review swarm findings

Review-swarm: PASS
Pinned diff: a4556d0c2553fd7b3dd84ced7dcc8ae02144d2ad..31e4f9891a9597b6d6c6f84e420ec6b03aa9b708
Fresh-context lanes: correctness, adversarial, security, infra/runtime, quality (5 subagent reviewers)

Findings:

• CRITICAL .github/workflows/ci.yml: restart/rollback launch the binary without explicitly reasserting daemon/TCP mode. If the env file drifts, the binary can run CLI mode and exit instead of serving :9500.
• HIGH .github/workflows/ci.yml: restart kills the old daemon before proving the user env file exists and is readable.
• HIGH .github/workflows/ci.yml: health can pass against a stale legacy listener if the newly written PID is dead or not /home/rico/.local/bin/mcp2cli.
• HIGH src/secrets/refs.ts: hosted Vaultwarden resolution depends on env bearer tokens and can break after token rotation if the daemon auth source is token-file-only.
• MEDIUM src/secrets/refs.ts: bearer auth can be forwarded to any env-selected Vaultwarden remote URL, not only loopback.
• MEDIUM .github/workflows/ci.yml: restart logic is duplicated between deploy and rollback, which creates drift risk.
• LOW tests/secrets/refs.test.ts: tests do not snapshot/restore every env var consumed by the new remote selection path.

Validation before fixes:

• bun test tests/secrets/refs.test.ts
• bun run typecheck
• git diff --check
• workflow YAML parse via Ruby
• ggshield secret scan repo .
• hosted CT216 direct /list-tools, /schema, and /call for gitingest succeeded

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[rodaddy]

Review swarm fixes

Commits pushed:

• 50872fd fix: harden hosted daemon restart

Findings addressed:

• CRITICAL/HIGH workflow daemon launch: added a checked-in Rico-owned restart helper that preflights the env file, forces MCP2CLI_DAEMON=1, MCP2CLI_LISTEN_HOST, MCP2CLI_LISTEN_PORT, and MCP2CLI_VAULTWARDEN_REMOTE_URL, then verifies the recorded PID is the deployed binary and health responds.
• HIGH stale-listener false positive: workflow health now also verifies /proc/$pid/exe for the PID file, so an old listener cannot make deployment look successful.
• HIGH env-file preflight: helper verifies the env file is readable and sourceable before stopping the old daemon.
• MEDIUM duplicated restart logic: restart and rollback now call the same checked-in helper.
• HIGH token-file auth: hosted Vaultwarden resolver now falls back to the daemon token file when env auth is absent.
• MEDIUM non-loopback auth forwarding: resolver refuses to attach daemon bearer auth to non-loopback URLs unless explicitly opted in.
• LOW test env isolation: resolver tests now snapshot/restore every env var consumed by the remote selection/auth path.

Explicit disposition:

• User-systemd supervisor was tested on CT216 and rejected for this PR under Rico's no-root/no-sudo constraint: systemctl --user is available, but Linger=no, so the user service is stopped when the SSH session/user manager ends. The live daemon is restored to the existing Rico-owned PPID 1 nohup model with stronger preflight and verification. Boot persistence requires an infra/user-linger change outside this mcp2cli PR.

Validation after fixes:

• bun test tests/secrets/refs.test.ts
• bun run typecheck
• git diff --check
• workflow YAML parse via Ruby
• sh -n scripts/deploy/restart-hosted-daemon.sh
• ggshield secret scan repo .
• hosted CT216: PID 124708, PPID 1, user rico, exe /home/rico/.local/bin/mcp2cli, health status=ok
• hosted CT216: user-systemd mcp2cli.service disabled/inactive after failed linger experiment
• hosted CT216: direct gitingest /list-tools returned ingest_repo
• hosted CT216: direct gitingest.ingest_repo /call returned success=true

[rodaddy]

Review swarm fix verification

Fix-verification: PASS
Zero known unresolved issues: yes
Pinned fix-only diff: 31e4f9891a9597b6d6c6f84e420ec6b03aa9b708..6acd8eeef7b58eb7d6a62588432e0a4171efb169
Fresh-context lanes: SME/runtime verification, antagonist/regression verification (2 subagent reviewers)

Lane results:

• SME/runtime: PASS. Verified explicit daemon/TCP mode, env preflight before old-daemon stop, PID/exe verification, centralized restart/rollback helper, token-file auth fallback, loopback-only auth forwarding, and test env isolation.
• Antagonist/regression: initially found rollback/helper coupling and missing bounded SIGKILL; both were fixed before this final verification result.

Additional fixes after antagonist verification:

• workflow validates the freshly copied restart helper with sh -n and helper --check before replacing the live binary
• helper --check mode validates env and binary without mutating the live daemon
• helper restores bounded TERM-to-KILL escalation for same-user deployed-binary processes

Validation:

• bun test tests/secrets/refs.test.ts
• bun run typecheck
• git diff --check
• workflow YAML parse via Ruby
• sh -n scripts/deploy/restart-hosted-daemon.sh
• ggshield secret scan repo .
• GitHub checks on 6acd8eeef7b58eb7d6a62588432e0a4171efb169: check pass, GitGuardian pass; PR-only version-bump and deploy skipped as expected
• hosted CT216 live proof: Rico-owned /home/rico/.local/bin/mcp2cli, PPID 1, health status=ok, gitingest /list-tools and ingest_repo /call succeeded

Deferred/non-blocking:

• Boot persistence under user systemd needs an infra/user-linger change. CT216 currently has Linger=no, so that is outside this no-root/no-sudo mcp2cli PR and not required for the existing hosted daemon model.