@apralabs/apra-fleet 0.2.2

package/dist/tools/revoke-vcs-auth.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { getStrategy } from '../services/strategy.js';
+import { getOsCommands } from '../os/index.js';
+import { getAgentOS, touchAgent } from '../utils/agent-helpers.js';
+import { memberIdentifier, resolveMember } from '../utils/resolve-member.js';
+import { githubProvider } from '../services/vcs/github.js';
+import { bitbucketProvider } from '../services/vcs/bitbucket.js';
+import { azureDevOpsProvider } from '../services/vcs/azure-devops.js';
+import { PROVIDER_HOSTS } from '../services/vcs/constants.js';
+import { logLine } from '../utils/log-helpers.js';
+const providers = {
+    'github': githubProvider,
+    'bitbucket': bitbucketProvider,
+    'azure-devops': azureDevOpsProvider,
+};
+export const revokeVcsAuthSchema = z.object({
+    ...memberIdentifier,
+    provider: z.enum(['github', 'bitbucket', 'azure-devops']).describe('VCS provider whose credentials to revoke'),
+    label: z.string().regex(/^[a-zA-Z0-9_-]{1,64}$/).optional().describe('Credential label to revoke (e.g. "work-github"). If omitted, revokes the default (provider-named) credential.'),
+    scope_url: z.string().optional().describe('Git credential scope URL used when the credential was provisioned (e.g. "https://github.com/my-org"). Defaults to "https://<host>".'),
+});
+export async function revokeVcsAuth(input) {
+    const agentOrError = resolveMember(input.member_id, input.member_name);
+    if (typeof agentOrError === 'string')
+        return agentOrError;
+    const agent = agentOrError;
+    const service = providers[input.provider];
+    const strategy = getStrategy(agent);
+    const conn = await strategy.testConnection();
+    if (!conn.ok)
+        return `❌ Member "${agent.friendlyName}" is offline: ${conn.error}`;
+    const cmds = getOsCommands(getAgentOS(agent));
+    const exec = async (cmd) => {
+        const result = await strategy.execCommand(cmd, 15000);
+        if (result.code !== 0 && result.stderr)
+            throw new Error(result.stderr);
+        return result.stdout;
+    };
+    const label = input.label ?? input.provider;
+    const host = PROVIDER_HOSTS[input.provider];
+    const scopeUrl = input.scope_url ?? `https://${host}`;
+    let result;
+    try {
+        result = await service.revoke(agent, cmds, exec, label, scopeUrl);
+    }
+    catch (err) {
+        return `❌ Failed to revoke ${input.provider} credentials on "${agent.friendlyName}": ${err.message}`;
+    }
+    touchAgent(agent.id);
+    logLine('revoke_vcs_auth', `provider=${input.provider}`, agent);
+    return result.success
+        ? `✅ ${result.message} on "${agent.friendlyName}"`
+        : `❌ ${result.message}`;
+}
+//# sourceMappingURL=revoke-vcs-auth.js.map

package/dist/tools/revoke-vcs-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-vcs-auth.js","sourceRoot":"","sources":["../../src/tools/revoke-vcs-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAIlD,MAAM,SAAS,GAAuC;IACpD,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,iBAAiB;IAC9B,cAAc,EAAE,mBAAmB;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,gBAAgB;IACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC9G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+GAA+G,CAAC;IACrL,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qIAAqI,CAAC;CACjL,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,MAAM,KAAK,GAAG,YAAqB,CAAC;IAEpC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,aAAa,KAAK,CAAC,YAAY,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC;IAElF,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,IAAI,EAAE,CAAC;IAEtD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,sBAAsB,KAAK,CAAC,QAAQ,oBAAoB,KAAK,CAAC,YAAY,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACvG,CAAC;IAED,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrB,OAAO,CAAC,iBAAiB,EAAE,YAAY,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAEhE,OAAO,MAAM,CAAC,OAAO;QACnB,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,QAAQ,KAAK,CAAC,YAAY,GAAG;QAClD,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/dist/tools/send-files.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+export declare const sendFilesSchema: z.ZodObject<{
+    local_paths: z.ZodArray<z.ZodString, "many">;
+    dest_subdir: z.ZodOptional<z.ZodString>;
+    member_id: z.ZodOptional<z.ZodString>;
+    member_name: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    local_paths: string[];
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+    dest_subdir?: string | undefined;
+}, {
+    local_paths: string[];
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+    dest_subdir?: string | undefined;
+}>;
+export type SendFilesInput = z.infer<typeof sendFilesSchema>;
+export declare function sendFiles(input: SendFilesInput, extra?: any): Promise<string>;
+//# sourceMappingURL=send-files.d.ts.map

package/dist/tools/send-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-files.d.ts","sourceRoot":"","sources":["../../src/tools/send-files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;EAQ1B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE7D,wBAAsB,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CA8FnF"}

package/dist/tools/send-files.js

@@ -0,0 +1,103 @@
+import path from 'node:path';
+import { z } from 'zod';
+import { getStrategy } from '../services/strategy.js';
+import { touchAgent } from '../utils/agent-helpers.js';
+import { memberIdentifier, resolveMember } from '../utils/resolve-member.js';
+import { writeStatusline } from '../services/statusline.js';
+import { ensureCloudReady } from '../services/cloud/lifecycle.js';
+import { isContainedInWorkFolder } from '../utils/platform.js';
+import { LogScope } from '../utils/log-helpers.js';
+export const sendFilesSchema = z.object({
+    ...memberIdentifier,
+    local_paths: z.array(z.string()).describe('Array of local file paths to upload'),
+    dest_subdir: z.string().optional().describe('Destination subdirectory relative to work_folder on the member. ' +
+        'Defaults to work_folder root (equivalent to "."). ' +
+        'Paths outside work_folder are rejected.'),
+});
+export async function sendFiles(input, extra) {
+    const agentOrError = resolveMember(input.member_id, input.member_name);
+    if (typeof agentOrError === 'string')
+        return agentOrError;
+    let agent;
+    try {
+        agent = await ensureCloudReady(agentOrError); // auto-start if stopped
+    }
+    catch (err) {
+        return `Failed to upload files to "${agentOrError.friendlyName}": ${err.message}`;
+    }
+    if (input.dest_subdir?.includes('\0')) {
+        return `⛔ Invalid dest_subdir: null bytes are not allowed.`;
+    }
+    // Path security: verify dest_subdir stays within work_folder
+    let resolvedPath;
+    if (input.dest_subdir) {
+        if (agent.agentType === 'local') {
+            const resolved = path.resolve(agent.workFolder, input.dest_subdir);
+            const workFolderNorm = path.resolve(agent.workFolder);
+            if (resolved !== workFolderNorm && !resolved.startsWith(workFolderNorm + path.sep)) {
+                return 'dest_subdir resolves outside member work_folder — write blocked';
+            }
+            resolvedPath = resolved;
+        }
+        else {
+            if (!isContainedInWorkFolder(agent.workFolder, input.dest_subdir)) {
+                return 'dest_subdir resolves outside member work_folder — write blocked';
+            }
+            const normWorkFolder = agent.workFolder.replace(/\\/g, '/').replace(/\/$/, '');
+            const normSubdir = input.dest_subdir.replace(/\\/g, '/');
+            const isAbsolute = /^[A-Za-z]:/.test(normSubdir) || normSubdir.startsWith('/');
+            resolvedPath = isAbsolute ? normSubdir : `${normWorkFolder}/${normSubdir}`;
+        }
+    }
+    // Pre-flight: detect basename collisions that would silently overwrite files
+    const seen = new Map();
+    const collisionLines = [];
+    for (const p of input.local_paths) {
+        const bn = path.basename(p);
+        const first = seen.get(bn);
+        if (first !== undefined) {
+            collisionLines.push(`  ${bn}: "${first}" and "${p}"`);
+        }
+        else {
+            seen.set(bn, p);
+        }
+    }
+    if (collisionLines.length > 0) {
+        return `⛔ Basename collision: these files share a name and would overwrite each other at destination:\n${collisionLines.join('\n')}`;
+    }
+    const strategy = getStrategy(agent);
+    const dest = resolvedPath ?? agent.workFolder;
+    const scope = new LogScope('send_files', `${input.local_paths.length} file(s) → ${dest}`, agent);
+    writeStatusline(new Map([[agent.id, 'busy']]));
+    try {
+        const result = await strategy.transferFiles(input.local_paths, input.dest_subdir, extra?.signal);
+        touchAgent(agent.id); // T7: idle manager resets its timer via touchAgent
+        let output = '';
+        if (result.success.length > 0) {
+            output += `✅ Successfully uploaded ${result.success.length} file(s) to ${agent.friendlyName}:\n`;
+            for (const f of result.success) {
+                output += `  - ${f}\n`;
+            }
+        }
+        if (result.failed.length > 0) {
+            output += `\n❌ Failed to upload ${result.failed.length} file(s):\n`;
+            for (const f of result.failed) {
+                output += `  - ${f.path}: ${f.error}\n`;
+            }
+        }
+        output += `\nDestination: ${resolvedPath ?? agent.workFolder}`;
+        if (result.failed.length > 0 && result.success.length > 0)
+            scope.fail(`${result.success.length} ok, ${result.failed.length} failed`);
+        else if (result.failed.length > 0)
+            scope.abort(`all ${result.failed.length} file(s) failed`);
+        else
+            scope.ok(`${result.success.length} file(s)`);
+        return output;
+    }
+    catch (err) {
+        writeStatusline(new Map([[agent.id, 'offline']]));
+        scope.abort(err.message);
+        return `Failed to upload files to "${agent.friendlyName}": ${err.message}`;
+    }
+}
+//# sourceMappingURL=send-files.js.map

package/dist/tools/send-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-files.js","sourceRoot":"","sources":["../../src/tools/send-files.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,gBAAgB;IACnB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACzC,kEAAkE;QAClE,oDAAoD;QACpD,yCAAyC,CAC1C;CACF,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAqB,EAAE,KAAW;IAChE,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,IAAI,KAAY,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,gBAAgB,CAAC,YAAqB,CAAC,CAAC,CAAC,wBAAwB;IACjF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,8BAA+B,YAAsB,CAAC,YAAY,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IAC/F,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,oDAAoD,CAAC;IAC9D,CAAC;IAED,6DAA6D;IAC7D,IAAI,YAAgC,CAAC;IACrC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YACnE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnF,OAAO,iEAAiE,CAAC;YAC3E,CAAC;YACD,YAAY,GAAG,QAAQ,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClE,OAAO,iEAAiE,CAAC;YAC3E,CAAC;YACD,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC/E,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,UAAU,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,kGAAkG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvI,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,IAAI,GAAG,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,cAAc,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAEjG,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAEjG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,mDAAmD;QAEzE,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,2BAA2B,MAAM,CAAC,OAAO,CAAC,MAAM,eAAe,KAAK,CAAC,YAAY,KAAK,CAAC;YACjG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC;YACpE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,kBAAkB,YAAY,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAE/D,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,QAAQ,MAAM,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;aACvE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC/B,KAAK,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;;YAE1D,KAAK,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,8BAA8B,KAAK,CAAC,YAAY,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/tools/setup-git-app.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export declare const setupGitAppSchema: z.ZodObject<{
+    app_id: z.ZodString;
+    private_key_path: z.ZodString;
+    installation_id: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    app_id: string;
+    private_key_path: string;
+    installation_id: number;
+}, {
+    app_id: string;
+    private_key_path: string;
+    installation_id: number;
+}>;
+export type SetupGitAppInput = z.infer<typeof setupGitAppSchema>;
+export declare function setupGitApp(input: SetupGitAppInput): Promise<string>;
+//# sourceMappingURL=setup-git-app.d.ts.map

package/dist/tools/setup-git-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-git-app.d.ts","sourceRoot":"","sources":["../../src/tools/setup-git-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAI5B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEjE,wBAAsB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkE1E"}

package/dist/tools/setup-git-app.js

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import { loadPrivateKey, verifyAppConnectivity } from '../services/github-app.js';
+import { setGitHubApp } from '../services/git-config.js';
+import { enforceOwnerOnly } from '../utils/file-permissions.js';
+import { credentialResolve } from '../services/credential-store.js';
+import { FLEET_DIR } from '../paths.js';
+const STORED_KEY_PATH = path.join(FLEET_DIR, 'github-app.pem');
+const TOKEN_RE = /\{\{secure\.([a-zA-Z0-9_-]{1,64})\}\}/;
+export const setupGitAppSchema = z.object({
+    app_id: z.string().regex(/^\d+$/, 'App ID must be numeric').describe('The GitHub App ID (numeric string)'),
+    private_key_path: z.string().describe('Path to the GitHub App private key (.pem) file. Supports {{secure.NAME}} token — if the resolved value starts with -----BEGIN it is treated as PEM key content directly (no file needed).'),
+    installation_id: z.number().describe('The GitHub App installation ID for your organization'),
+});
+export async function setupGitApp(input) {
+    // Resolve {{secure.NAME}} token in private_key_path if present
+    let keyPath = input.private_key_path;
+    let tempKeyPath;
+    const tokenMatch = TOKEN_RE.exec(input.private_key_path);
+    if (tokenMatch) {
+        const entry = credentialResolve(tokenMatch[1], '*');
+        if (!entry)
+            return `❌ Credential "${tokenMatch[1]}" not found. Run credential_store_set first.`;
+        if ('denied' in entry)
+            return `❌ ${entry.denied}`;
+        if ('expired' in entry)
+            return `❌ ${entry.expired}`;
+        const resolved = entry.plaintext;
+        if (resolved.startsWith('-----BEGIN')) {
+            tempKeyPath = path.join(os.tmpdir(), `apra-fleet-gitapp-${crypto.randomBytes(8).toString('hex')}.pem`);
+            fs.writeFileSync(tempKeyPath, resolved, { mode: 0o600 });
+            keyPath = tempKeyPath;
+        }
+        else {
+            keyPath = resolved;
+        }
+    }
+    try {
+        // Validate and read private key
+        let privateKey;
+        try {
+            privateKey = loadPrivateKey(keyPath);
+        }
+        catch (err) {
+            return `❌ ${err.message}`;
+        }
+        // Verify connectivity before storing anything
+        let result;
+        try {
+            result = await verifyAppConnectivity(input.app_id, privateKey, input.installation_id);
+        }
+        catch (err) {
+            return `❌ GitHub API verification failed: ${err.message}`;
+        }
+        if (!result.ok) {
+            return `❌ GitHub App verification failed: ${result.error}`;
+        }
+        // Copy PEM to fleet dir
+        if (!fs.existsSync(FLEET_DIR)) {
+            fs.mkdirSync(FLEET_DIR, { recursive: true, mode: 0o700 });
+        }
+        fs.writeFileSync(STORED_KEY_PATH, privateKey + '\n', { mode: 0o600 });
+        enforceOwnerOnly(STORED_KEY_PATH);
+        // Store config
+        setGitHubApp({
+            appId: input.app_id,
+            privateKeyPath: STORED_KEY_PATH,
+            installationId: input.installation_id,
+            createdAt: new Date().toISOString(),
+        });
+        return `✅ GitHub App configured successfully\n`
+            + `  App: ${result.appName} (ID: ${input.app_id})\n`
+            + `  Org: ${result.orgName}\n`
+            + `  Installation: ${input.installation_id}\n`
+            + `  Private key stored: ${STORED_KEY_PATH}`;
+    }
+    finally {
+        if (tempKeyPath) {
+            try {
+                fs.unlinkSync(tempKeyPath);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+//# sourceMappingURL=setup-git-app.js.map

package/dist/tools/setup-git-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-git-app.js","sourceRoot":"","sources":["../../src/tools/setup-git-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAC/D,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC1G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2LAA2L,CAAC;IAClO,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;CAC7F,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB;IACvD,+DAA+D;IAC/D,IAAI,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACrC,IAAI,WAA+B,CAAC;IACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,OAAO,iBAAiB,UAAU,CAAC,CAAC,CAAC,8CAA8C,CAAC;QAChG,IAAI,QAAQ,IAAI,KAAK;YAAE,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAClD,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvG,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,GAAG,WAAW,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,gCAAgC;QAChC,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;QAED,8CAA8C;QAC9C,IAAI,MAAyD,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,qCAAqC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,qCAAqC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7D,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,UAAU,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAElC,eAAe;QACf,YAAY,CAAC;YACX,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,cAAc,EAAE,eAAe;YAC/B,cAAc,EAAE,KAAK,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QAEH,OAAO,wCAAwC;cAC3C,UAAU,MAAM,CAAC,OAAO,SAAS,KAAK,CAAC,MAAM,KAAK;cAClD,UAAU,MAAM,CAAC,OAAO,IAAI;cAC5B,mBAAmB,KAAK,CAAC,eAAe,IAAI;cAC5C,yBAAyB,eAAe,EAAE,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/tools/setup-ssh-key.d.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+export declare const setupSSHKeySchema: z.ZodObject<{
+    member_id: z.ZodOptional<z.ZodString>;
+    member_name: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+}, {
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+}>;
+export type SetupSSHKeyInput = z.infer<typeof setupSSHKeySchema>;
+export declare function setupSSHKey(input: SetupSSHKeyInput): Promise<string>;
+//# sourceMappingURL=setup-ssh-key.d.ts.map

package/dist/tools/setup-ssh-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ssh-key.d.ts","sourceRoot":"","sources":["../../src/tools/setup-ssh-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,iBAAiB;;;;;;;;;EAE5B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAoCjE,wBAAsB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiF1E"}

package/dist/tools/setup-ssh-key.js

@@ -0,0 +1,119 @@
+import { z } from 'zod';
+import path from 'node:path';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import { updateAgent, getKeysDir } from '../services/registry.js';
+import { getStrategy } from '../services/strategy.js';
+import { testAuthConnection } from '../services/ssh.js';
+import { memberIdentifier, resolveMember } from '../utils/resolve-member.js';
+import { getOsCommands } from '../os/index.js';
+import { logLine } from '../utils/log-helpers.js';
+export const setupSSHKeySchema = z.object({
+    ...memberIdentifier,
+});
+/**
+ * Convert an RSA public key (PEM) to OpenSSH authorized_keys format.
+ * Uses JWK export to extract modulus (n) and exponent (e), then builds
+ * the ssh-rsa wire format per RFC 4253.
+ */
+function rsaPublicKeyToOpenSSH(publicKeyPem, comment) {
+    const keyObj = crypto.createPublicKey(publicKeyPem);
+    const jwk = keyObj.export({ format: 'jwk' });
+    const e = Buffer.from(jwk.e, 'base64url');
+    const n = Buffer.from(jwk.n, 'base64url');
+    const typeStr = 'ssh-rsa';
+    const typeLen = Buffer.alloc(4);
+    typeLen.writeUInt32BE(typeStr.length);
+    // Leading zero byte needed if high bit is set (to avoid being interpreted as negative)
+    const ePadded = (e[0] & 0x80) ? Buffer.concat([Buffer.from([0]), e]) : e;
+    const eLen = Buffer.alloc(4);
+    eLen.writeUInt32BE(ePadded.length);
+    const nPadded = (n[0] & 0x80) ? Buffer.concat([Buffer.from([0]), n]) : n;
+    const nLen = Buffer.alloc(4);
+    nLen.writeUInt32BE(nPadded.length);
+    const blob = Buffer.concat([typeLen, Buffer.from(typeStr), eLen, ePadded, nLen, nPadded]);
+    return `ssh-rsa ${blob.toString('base64')} ${comment}`;
+}
+function cleanupLocalKeys(privateKeyPath, publicKeyPath) {
+    try {
+        fs.unlinkSync(privateKeyPath);
+    }
+    catch { }
+    try {
+        fs.unlinkSync(publicKeyPath);
+    }
+    catch { }
+}
+export async function setupSSHKey(input) {
+    const agentOrError = resolveMember(input.member_id, input.member_name);
+    if (typeof agentOrError === 'string')
+        return agentOrError;
+    const agent = agentOrError;
+    if (agent.agentType === 'local') {
+        return `❌ SSH key setup is not applicable for local members. Member "${agent.friendlyName}" runs on the same machine — no SSH authentication is needed.`;
+    }
+    if (agent.authType === 'key') {
+        return `Member "${agent.friendlyName}" is already using key-based authentication.`;
+    }
+    const keysDir = getKeysDir();
+    const keyName = `${agent.id}_rsa`;
+    const privateKeyPath = path.join(keysDir, keyName);
+    const publicKeyPath = `${privateKeyPath}.pub`;
+    const strategy = getStrategy(agent);
+    // Step 1: Generate RSA-4096 key pair using Node crypto (no external tools needed)
+    try {
+        const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
+            modulusLength: 4096,
+            publicKeyEncoding: { type: 'spki', format: 'pem' },
+            privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
+        });
+        // Convert to OpenSSH authorized_keys format
+        const comment = `apra-fleet-${agent.friendlyName}`;
+        const opensshPubKey = rsaPublicKeyToOpenSSH(publicKey, comment);
+        fs.writeFileSync(privateKeyPath, privateKey, { mode: 0o600 });
+        fs.writeFileSync(publicKeyPath, opensshPubKey, { mode: 0o644 });
+        // Step 2: Deploy public key to remote using OS-specific commands
+        const cmds = getOsCommands(agent.os ?? 'linux');
+        const deployCommands = cmds.deploySSHPublicKey(opensshPubKey);
+        for (const cmd of deployCommands) {
+            const result = await strategy.execCommand(cmd, 10000);
+            if (result.code !== 0) {
+                cleanupLocalKeys(privateKeyPath, publicKeyPath);
+                return `❌ Failed to deploy key to "${agent.friendlyName}": ${result.stderr}`;
+            }
+        }
+        // Step 3: Test key-based login with a dedicated non-pooled connection.
+        // This avoids reusing the cached password-based session from the pool
+        // and avoids TOCTOU races with other agents sharing the same host.
+        const testAgent = { ...agent, authType: 'key', keyPath: privateKeyPath, encryptedPassword: undefined };
+        try {
+            const testResult = await testAuthConnection(testAgent, 'echo "key-auth-ok"', 10000);
+            if (!testResult.stdout.includes('key-auth-ok')) {
+                cleanupLocalKeys(privateKeyPath, publicKeyPath);
+                return `❌ Key-based authentication test failed for "${agent.friendlyName}". Password auth is still active.`;
+            }
+        }
+        catch (err) {
+            cleanupLocalKeys(privateKeyPath, publicKeyPath);
+            return `❌ Key-based authentication test failed: ${err.message}. Password auth is still active.`;
+        }
+        // Step 4: Update agent registration (only after successful verification)
+        updateAgent(agent.id, {
+            authType: 'key',
+            keyPath: privateKeyPath,
+            encryptedPassword: undefined,
+        });
+        logLine('setup_ssh_key', `id=${agent.id} name=${agent.friendlyName}`, agent);
+        let result = `✅ SSH key authentication set up for "${agent.friendlyName}"\n\n`;
+        result += `  Private key: ${privateKeyPath}\n`;
+        result += `  Public key:  ${publicKeyPath}\n`;
+        result += `  Auth type:   key (updated from password)\n`;
+        result += `  Verification: Key-based login successful\n`;
+        return result;
+    }
+    catch (err) {
+        cleanupLocalKeys(privateKeyPath, publicKeyPath);
+        return `❌ Failed to set up SSH key: ${err.message}`;
+    }
+}
+//# sourceMappingURL=setup-ssh-key.js.map

package/dist/tools/setup-ssh-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ssh-key.js","sourceRoot":"","sources":["../../src/tools/setup-ssh-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGlD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,gBAAgB;CACpB,CAAC,CAAC;AAIH;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,YAAoB,EAAE,OAAe;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA+B,CAAC;IAE3E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,SAAS,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtC,uFAAuF;IACvF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,OAAO,WAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,cAAsB,EAAE,aAAqB;IACrE,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAC/C,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB;IACvD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,MAAM,KAAK,GAAG,YAAqB,CAAC;IAEpC,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,gEAAgE,KAAK,CAAC,YAAY,+DAA+D,CAAC;IAC3J,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,WAAW,KAAK,CAAC,YAAY,8CAA8C,CAAC;IACrF,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,EAAE,MAAM,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,GAAG,cAAc,MAAM,CAAC;IAE9C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpC,kFAAkF;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;YAClE,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QAEH,4CAA4C;QAC5C,MAAM,OAAO,GAAG,cAAc,KAAK,CAAC,YAAY,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEhE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhE,iEAAiE;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAE9D,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,gBAAgB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;gBAChD,OAAO,8BAA8B,KAAK,CAAC,YAAY,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAc,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;QAChH,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;YACpF,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC/C,gBAAgB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;gBAChD,OAAO,+CAA+C,KAAK,CAAC,YAAY,mCAAmC,CAAC;YAC9G,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,gBAAgB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;YAChD,OAAO,2CAA2C,GAAG,CAAC,OAAO,kCAAkC,CAAC;QAClG,CAAC;QAED,yEAAyE;QACzE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE;YACpB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,cAAc;YACvB,iBAAiB,EAAE,SAAS;SAC7B,CAAC,CAAC;QACH,OAAO,CAAC,eAAe,EAAE,MAAM,KAAK,CAAC,EAAE,SAAS,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,CAAC,CAAC;QAE7E,IAAI,MAAM,GAAG,wCAAwC,KAAK,CAAC,YAAY,OAAO,CAAC;QAC/E,MAAM,IAAI,kBAAkB,cAAc,IAAI,CAAC;QAC/C,MAAM,IAAI,kBAAkB,aAAa,IAAI,CAAC;QAC9C,MAAM,IAAI,8CAA8C,CAAC;QACzD,MAAM,IAAI,8CAA8C,CAAC;QAEzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,gBAAgB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAChD,OAAO,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/tools/shutdown-server.d.ts

@@ -0,0 +1,4 @@
+import { z } from 'zod';
+export declare const shutdownServerSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+export declare function shutdownServer(): Promise<string>;
+//# sourceMappingURL=shutdown-server.d.ts.map

package/dist/tools/shutdown-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown-server.d.ts","sourceRoot":"","sources":["../../src/tools/shutdown-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,oBAAoB,gDAAe,CAAC;AAEjD,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAItD"}

package/dist/tools/shutdown-server.js

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+import { closeAllConnections } from '../services/ssh.js';
+export const shutdownServerSchema = z.object({});
+export async function shutdownServer() {
+    closeAllConnections();
+    setTimeout(() => process.exit(0), 100);
+    return 'Server shutting down. Run /mcp to start a fresh instance.';
+}
+//# sourceMappingURL=shutdown-server.js.map

package/dist/tools/shutdown-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown-server.js","sourceRoot":"","sources":["../../src/tools/shutdown-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,mBAAmB,EAAE,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,2DAA2D,CAAC;AACrE,CAAC"}

package/dist/tools/stop-prompt.d.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+export declare const stopPromptSchema: z.ZodObject<{
+    member_id: z.ZodOptional<z.ZodString>;
+    member_name: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+}, {
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+}>;
+export type StopPromptInput = z.infer<typeof stopPromptSchema>;
+export declare function stopPrompt(input: StopPromptInput): Promise<string>;
+//# sourceMappingURL=stop-prompt.d.ts.map

package/dist/tools/stop-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stop-prompt.d.ts","sourceRoot":"","sources":["../../src/tools/stop-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,gBAAgB;;;;;;;;;EAE3B,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE/D,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxE"}

package/dist/tools/stop-prompt.js

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { memberIdentifier, resolveMember } from '../utils/resolve-member.js';
+import { getStoredPid, getAgentOS } from '../utils/agent-helpers.js';
+import { getStrategy } from '../services/strategy.js';
+import { getOsCommands } from '../os/index.js';
+import { tryKillPid } from '../utils/pid-helpers.js';
+import { logLine } from '../utils/log-helpers.js';
+import { inFlightAgents } from './execute-prompt.js';
+import { writeStatusline } from '../services/statusline.js';
+import { getStallDetector } from '../services/stall/index.js';
+import { cancelPendingAuth } from '../services/auth-socket.js';
+export const stopPromptSchema = z.object({
+    ...memberIdentifier,
+});
+export async function stopPrompt(input) {
+    const agentOrError = resolveMember(input.member_id, input.member_name);
+    if (typeof agentOrError === 'string')
+        return agentOrError;
+    const agent = agentOrError;
+    const strategy = getStrategy(agent);
+    const cmds = getOsCommands(getAgentOS(agent));
+    const pid = getStoredPid(agent.id);
+    cancelPendingAuth(agent.friendlyName);
+    await tryKillPid(agent, strategy, cmds);
+    getStallDetector().remove(agent.id);
+    if (pid !== undefined) {
+        // Poll until execute_prompt's finally block clears inFlightAgents so a
+        // re-dispatch immediately after stop_prompt doesn't race against cleanup.
+        const deadline = Date.now() + 2000;
+        while (inFlightAgents.has(agent.id) && Date.now() < deadline) {
+            await new Promise(r => setTimeout(r, 50));
+        }
+    }
+    // Unconditionally clear busy state — handles pid=none case where inFlightAgents
+    // still holds the agent but the process never recorded a PID.
+    inFlightAgents.delete(agent.id);
+    writeStatusline();
+    logLine('stop_prompt', `pid=${pid ?? 'none'}`, agent);
+    if (pid !== undefined) {
+        return `🛑 Agent "${agent.friendlyName}" stopped (killed PID ${pid}).`;
+    }
+    return `🛑 Agent "${agent.friendlyName}" stopped (no active session was running).`;
+}
+//# sourceMappingURL=stop-prompt.js.map

package/dist/tools/stop-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stop-prompt.js","sourceRoot":"","sources":["../../src/tools/stop-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,gBAAgB;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB;IACrD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,MAAM,KAAK,GAAG,YAAY,CAAC;IAE3B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEnC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,gBAAgB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACnC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,8DAA8D;IAC9D,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,eAAe,EAAE,CAAC;IAElB,OAAO,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IAEtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,aAAa,KAAK,CAAC,YAAY,yBAAyB,GAAG,IAAI,CAAC;IACzE,CAAC;IACD,OAAO,aAAa,KAAK,CAAC,YAAY,4CAA4C,CAAC;AACrF,CAAC"}

package/dist/tools/update-agent-cli.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export declare const updateAgentCliSchema: z.ZodObject<{
+    install_if_missing: z.ZodDefault<z.ZodBoolean>;
+    member_id: z.ZodOptional<z.ZodString>;
+    member_name: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    install_if_missing: boolean;
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+}, {
+    member_id?: string | undefined;
+    member_name?: string | undefined;
+    install_if_missing?: boolean | undefined;
+}>;
+export type UpdateAgentCliInput = z.infer<typeof updateAgentCliSchema>;
+export declare function updateAgentCli(input: UpdateAgentCliInput): Promise<string>;
+//# sourceMappingURL=update-agent-cli.d.ts.map

package/dist/tools/update-agent-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-agent-cli.d.ts","sourceRoot":"","sources":["../../src/tools/update-agent-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAG/B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AA8DvE,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDhF"}