Add cross-platform background-service install (systemd/launchd/Windows)

[hyperpolymath]

Summary

Adds a unified cross-platform service installation system so Burble can run as a background service without popping a terminal window. Detects the OS and installs:

• Linux/WSL: systemd --user units with CAP_NET_BIND_SERVICE for privileged UDP/9 binding
• macOS: launchd LaunchAgents in ~/Library/LaunchAgents/
• Windows host (WSL2 NAT): True Windows Service via sc.exe with an embedded C# service host compiled from in-box .NET Framework csc.exe

The Windows service runs under the installing user's account (prompted once via Get-Credential, password stored securely by the SCM) because WSL distros are per-user — a LocalSystem service cannot see the user's distros.

Changes

• scripts/install-service.sh (new): Cross-platform service installer that dispatches to OS-specific handlers. Supports install, uninstall, start, stop, restart, status, logs actions. Includes --no-ai-bridge flag to skip the AI bridge service.

• scripts/wsl-bolt-udp-forward.ps1 (major refactor):

  • Replaced scheduled-task-at-logon approach with a true Windows Service
  • Added Compile-ServiceHost() to generate and compile a minimal C# service host from embedded source using csc.exe
  • Added Assert-Elevated() to enforce elevated shell requirement for -Install and -Uninstall
  • Added Write-Relay() function for dual console + persistent log output (critical for windowless service)
  • Renamed Install-Task → Install-Service, Uninstall-Task → Uninstall-Service
  • Service now stores arguments in service-args.txt and logs to C:\ProgramData\BurbleBoltFwd\relay.log
  • Configured for auto-restart on crash (5s/5s/30s via sc.exe failure)
  • Grants service user Modify ACL on install directory so it can write logs
  • Updated usage docs and exit codes

• assets/services/burble.service (new): systemd user unit for Elixir/Phoenix server with AmbientCapabilities=CAP_NET_BIND_SERVICE for UDP/9

• assets/services/burble-ai-bridge.service (new): systemd user unit for Deno AI bridge

• assets/services/com.hyperpolymath.burble.plist (new): macOS launchd LaunchAgent for Elixir server

• assets/services/com.hyperpolymath.burble.ai-bridge.plist (new): macOS launchd LaunchAgent for Deno AI bridge

• docs/developer/wsl-mirrored-networking.adoc: Updated to document the new service-based approach, LSA Secrets password storage, and systemd/launchd installation paths

• Justfile: Added service-install, service-uninstall, service-start, service-stop, service-restart, service-status, service-logs recipes

• CHANGELOG.md: Documented the new feature with implementation details

RSR Quality Checklist

Required

• Tests pass (no new tests required; existing functionality preserved)
• Code is formatted (PowerShell, Bash, XML, systemd unit syntax)
• Linter is clean (no new warnings)
• No banned language patterns
• SPDX license headers present on all new files
• No secrets or credentials included (passwords handled by Windows SCM via LSA Secrets)

As Applicable

• Documentation updated (docs/developer/wsl-mirrored-networking.adoc, CHANGELOG.md)
• CHANGELOG updated with feature description

Testing

The changes are backward

https://claude.ai/code/session_016BNGnVKCbN5FBXcTXRpDXy

[github-actions]

🔍 Hypatia Security Scan

Findings: 17 issues detected

Severity	Count
🔴 Critical	4
🟠 High	5
🟡 Medium	8

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/burble/burble/server/lib/burble/media/lmdb_playout.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "SSL verify_none disables certificate validation -- MITM risk (1 occurrences, CWE-295)",
    "type": "elixir_no_ssl_verify",
    "file": "/home/runner/work/burble/burble/server/lib/burble/bridges/mumble.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "believe_me undermines formal verification (2 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/burble/burble/src/interface/abi/Foreign.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/burble/burble/configs/config.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Lock.unwrap() without poison handling (14 occurrences, CWE-754)",
    "type": "lock_unwrap",
    "file": "/home/runner/work/burble/burble/tools/selur-compose/crates/selur-compose-driver/src/mock.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "line": 24,
    "reason": "Secret found: Generic API key",
    "type": "secret_detected",
    "file": "/home/runner/work/burble/burble/.envrc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "line": 39,
    "reason": "Secret found: Password",
    "type": "secret_detected",
    "file": "/home/runner/work/burble/burble/server/lib/burble/safety/proven_bridge.ex",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence