From 11d2a3d784070ea183e94e0b2fcc5c4fc5d0bd63 Mon Sep 17 00:00:00 2001
From: sssnake <sssnake@seteclabs.io>
Date: Sun, 12 Jul 2026 11:34:49 -0700
Subject: [PATCH] Add supervisor to keep enforcement + detection daemons alive

cgwatch.sh respawns ratlock/cgdetect within ~30s if either dies (crash,
OOM, accidental kill), so the guard self-heals instead of staying down
until the next reboot. service.sh now launches the supervisor after the
RIL-up wait rather than starting the two daemons directly.
---
 cgwatch.sh | 28 ++++++++++++++++++++++++++++
 service.sh | 30 ++++++++++++------------------
 2 files changed, 40 insertions(+), 18 deletions(-)
 create mode 100644 cgwatch.sh

diff --git a/cgwatch.sh b/cgwatch.sh
new file mode 100644
index 0000000..c73d5b6
--- /dev/null
+++ b/cgwatch.sh
@@ -0,0 +1,28 @@
+#!/system/bin/sh
+# CellGuard supervisor — keeps the enforcement (ratlock) and detection
+# (cgdetect) daemons alive and respawns either one if it dies, so a crash,
+# a one-off OOM, or an accidental kill self-heals within ~30s instead of
+# leaving the guard down until the next reboot.
+#
+# Started once by service.sh at boot. Respawned daemons are launched with
+# setsid so they reparent to init (ppid=1) and survive this supervisor and
+# any adb/su session. pgrep uses short script-name patterns — this script's
+# own cmdline is "sh .../cgwatch.sh", so it never self-matches ratlock/cgdetect.
+
+MODDIR=${0%/*}
+CG=/data/adb/cellguard
+mkdir -p "$CG"
+log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$CG/cgwatch.log"; }
+
+log "cgwatch start (pid $$)"
+while true; do
+  if ! pgrep -f ratlock.sh >/dev/null 2>&1; then
+    setsid sh "$MODDIR/ratlock.sh" 5 </dev/null >/dev/null 2>&1 &
+    log "respawned ratlock"
+  fi
+  if ! pgrep -f cgdetect.sh >/dev/null 2>&1; then
+    setsid sh "$MODDIR/cgdetect.sh" 4 </dev/null >/dev/null 2>&1 &
+    log "respawned cgdetect"
+  fi
+  sleep 30
+done
diff --git a/service.sh b/service.sh
index 2a04020..5fd18dc 100755
--- a/service.sh
+++ b/service.sh
@@ -32,26 +32,20 @@ else
   log "cgcap.ko missing at $KMOD — build it first"
 fi
 
-# --- 2. enforcement: hold every active SIM to LTE + 5G(NR) only ---
-# ratlock runs its own watchdog loop; launch once, in background.
-if ! pgrep -f "$MODDIR/ratlock.sh" >/dev/null 2>&1; then
-  # wait briefly for RIL/subscriptions to come up after boot
-  for i in $(seq 1 30); do
-    [ -n "$(cmd phone get-allowed-network-types-for-users -s 0 2>/dev/null)$(cmd phone get-allowed-network-types-for-users -s 1 2>/dev/null)" ] && break
-    sleep 1
-  done
-  nohup sh "$MODDIR/ratlock.sh" 5 >/dev/null 2>&1 &
-  log "ratlock started (LTE+NR/5G enforcement watchdog)"
-else
-  log "ratlock already running"
-fi
+# --- 2. wait briefly for RIL/subscriptions to come up after boot ---
+# (enforcement needs the telephony API to be live before it can set RAT).
+for i in $(seq 1 30); do
+  [ -n "$(cmd phone get-allowed-network-types-for-users -s 0 2>/dev/null)$(cmd phone get-allowed-network-types-for-users -s 1 2>/dev/null)" ] && break
+  sleep 1
+done
 
-# --- 3. detection: always-on IMSI-catcher detector (independent of WebUI) ---
-if ! pgrep -f "$MODDIR/cgdetect.sh" >/dev/null 2>&1; then
-  nohup sh "$MODDIR/cgdetect.sh" 4 >/dev/null 2>&1 &
-  log "cgdetect started (always-on IMSI-catcher detector)"
+# --- 3. supervisor: starts + keeps alive both enforcement (ratlock) and
+#         detection (cgdetect) daemons, respawning either if it dies. ---
+if ! pgrep -f cgwatch.sh >/dev/null 2>&1; then
+  setsid sh "$MODDIR/cgwatch.sh" </dev/null >/dev/null 2>&1 &
+  log "cgwatch supervisor started (respawns ratlock + cgdetect)"
 else
-  log "cgdetect already running"
+  log "cgwatch already running"
 fi
 
 log "CellGuard service done"