@danneillouven/remote-workspace 0.0.0-stage → 0.1.0

package/runtime/server/src/modules/git/git.routes.js

@@ -0,0 +1,68 @@
+import { gitCommitDiffQuerySchema, gitCommitQuerySchema, gitCommitRequestSchema, gitDiffQuerySchema, gitDiscardHunkRequestSchema, gitLogQuerySchema, gitOperationRequestSchema, gitPathsRequestSchema, gitRepoRequestSchema, } from "../../../../src/schema/git.js";
+import { workspaceIdParamsSchema } from "../../../../src/schema/workspace.js";
+import { parseInput } from "../../lib/validation.js";
+export function registerGitRoutes(app, workspaces, commitMessages) {
+    app.get('/api/workspaces/:workspaceId/git/status', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return (await workspaces.git(workspaceId)).status();
+    });
+    app.get('/api/workspaces/:workspaceId/git/diff', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return (await workspaces.git(workspaceId)).diff(parseInput(gitDiffQuerySchema, request.query));
+    });
+    app.get('/api/workspaces/:workspaceId/git/log', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return (await workspaces.git(workspaceId)).log(parseInput(gitLogQuerySchema, request.query));
+    });
+    app.get('/api/workspaces/:workspaceId/git/commit', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return (await workspaces.git(workspaceId)).commitDetails(parseInput(gitCommitQuerySchema, request.query));
+    });
+    app.get('/api/workspaces/:workspaceId/git/commit-diff', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return (await workspaces.git(workspaceId)).commitDiff(parseInput(gitCommitDiffQuerySchema, request.query));
+    });
+    app.post('/api/workspaces/:workspaceId/git/stage', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { repo, paths } = parseInput(gitPathsRequestSchema, request.body);
+        await (await workspaces.git(workspaceId)).stage(repo, paths);
+        return reply.status(204).send();
+    });
+    app.post('/api/workspaces/:workspaceId/git/unstage', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { repo, paths } = parseInput(gitPathsRequestSchema, request.body);
+        await (await workspaces.git(workspaceId)).unstage(repo, paths);
+        return reply.status(204).send();
+    });
+    app.post('/api/workspaces/:workspaceId/git/discard', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { repo, paths } = parseInput(gitPathsRequestSchema, request.body);
+        await (await workspaces.git(workspaceId)).discard(repo, paths);
+        return reply.status(204).send();
+    });
+    app.post('/api/workspaces/:workspaceId/git/discard-hunk', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { repo, path, hunk } = parseInput(gitDiscardHunkRequestSchema, request.body);
+        await (await workspaces.git(workspaceId)).discardHunk(repo, path, hunk);
+        return reply.status(204).send();
+    });
+    app.post('/api/workspaces/:workspaceId/git/commit', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { repo, message, stageAll, all, amend, signoff } = parseInput(gitCommitRequestSchema, request.body);
+        return (await workspaces.git(workspaceId)).commit(repo, message, stageAll, { all, amend, signoff });
+    });
+    app.get('/api/workspaces/:workspaceId/git/refs', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { repo } = parseInput(gitRepoRequestSchema, request.query);
+        return (await workspaces.git(workspaceId)).refs(repo);
+    });
+    app.post('/api/workspaces/:workspaceId/git/operation', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return (await workspaces.git(workspaceId)).operation(parseInput(gitOperationRequestSchema, request.body));
+    });
+    app.post('/api/workspaces/:workspaceId/git/commit-message', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { repo } = parseInput(gitRepoRequestSchema, request.body);
+        return commitMessages.generate(await (await workspaces.git(workspaceId)).commitMessageContext(repo));
+    });
+}

package/runtime/server/src/modules/hosts/directory-browser.js

@@ -0,0 +1,36 @@
+import os from 'node:os';
+import path from 'node:path';
+import { mapWithConcurrency } from "../../lib/concurrency.js";
+import { AppError } from "../../lib/errors.js";
+const MAX_ENTRIES = 2000;
+const collator = new Intl.Collator(undefined, { numeric: true, sensitivity: 'base' });
+/**
+ * Lists directories on a host so the user can pick a project folder. This is
+ * deliberately not confined to a workspace: it runs before one exists, and the
+ * user already has shell access to the same account. It only ever reveals
+ * directory names (no file contents).
+ */
+export async function browseDirectories(driver, requestPath, local) {
+    // SFTP resolves "." to the login directory.
+    const start = requestPath ? path.posix.normalize(requestPath) : local ? os.homedir() : '.';
+    const directory = await driver.realpath(start);
+    const stat = await driver.stat(directory);
+    if (stat.type !== 'directory')
+        throw new AppError('NOT_A_DIRECTORY', 'Not a directory.');
+    const raw = await driver.readdir(directory);
+    const candidates = raw.filter((entry) => entry.stat.type === 'directory' || entry.stat.type === 'symlink');
+    const resolved = await mapWithConcurrency(candidates, 16, async (entry) => {
+        const entryPath = path.posix.join(directory, entry.name);
+        if (entry.stat.type === 'directory')
+            return { name: entry.name, path: entryPath };
+        const target = await driver.stat(entryPath).catch(() => null);
+        return target?.type === 'directory' ? { name: entry.name, path: entryPath } : null;
+    });
+    const entries = resolved.filter((entry) => entry !== null).sort((a, b) => collator.compare(a.name, b.name));
+    return {
+        path: directory,
+        parent: directory === '/' ? null : path.posix.dirname(directory),
+        entries: entries.slice(0, MAX_ENTRIES),
+        truncated: entries.length > MAX_ENTRIES,
+    };
+}

package/runtime/server/src/modules/hosts/host-service.js

@@ -0,0 +1,260 @@
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import ssh2 from 'ssh2';
+import { expandHome } from "../../config/config.js";
+import { AppError } from "../../lib/errors.js";
+import { fingerprintSha256, keyTypeOf } from "../ssh/host-key-verifier.js";
+import { probeHostKey } from "../ssh/host-key-probe.js";
+import { SshConnectionManager } from "../ssh/ssh-connection-manager.js";
+import { installPublicKey } from "./key-installer.js";
+// ssh2 is CommonJS; Node's ESM loader only exposes its named exports reliably via the default export.
+const { utils } = ssh2;
+const KEY_COMMENT = `remote-workspace@${os.hostname()}`;
+function errnoCode(error) {
+    return error.code ?? 'unknown error';
+}
+/** Validate a private key and derive its public key line. Key material never appears in errors. */
+function publicKeyLine(data) {
+    const parsed = utils.parseKey(data);
+    if (parsed instanceof Error) {
+        if (/encrypted|passphrase/i.test(parsed.message)) {
+            throw new AppError('BAD_REQUEST', 'This key is protected by a passphrase. Use an unencrypted key dedicated to Remote Workspace, generate one here, or use ssh-agent.');
+        }
+        throw new AppError('BAD_REQUEST', 'Could not read the private key. Use an OpenSSH or PEM private key.');
+    }
+    if (!parsed.isPrivateKey())
+        throw new AppError('BAD_REQUEST', 'That is a public key. Provide the private key instead.');
+    return `${parsed.type} ${parsed.getPublicSSH().toString('base64')} ${parsed.comment || KEY_COMMENT}`;
+}
+function decodeHostKey(input) {
+    const blob = Buffer.from(input.key, 'base64');
+    if (keyTypeOf(blob) !== input.keyType)
+        throw new AppError('BAD_REQUEST', 'The host key is malformed.');
+    return { keyType: input.keyType, key: blob.toString('base64') };
+}
+export function hostLabel(host) {
+    return `${host.username}@${host.host}${host.port === 22 ? '' : `:${host.port}`}`;
+}
+/**
+ * SSH hosts configured in the UI: credentials, the trusted host key, and one
+ * shared control connection per host (SFTP + Git). Private keys stay in
+ * DATA_DIR; summaries expose only public keys and fingerprints.
+ */
+export class HostService {
+    #store;
+    #options;
+    #logger;
+    #connections = new Map();
+    #listeners = new Set();
+    constructor(store, options, logger) {
+        this.#store = store;
+        this.#options = options;
+        this.#logger = logger;
+    }
+    get agentAvailable() {
+        return this.#options.agentSocket !== null;
+    }
+    /** Called when a host's connection settings change or it is removed. */
+    onChange(listener) {
+        this.#listeners.add(listener);
+    }
+    list() {
+        return this.#store.state.hosts.map((host) => this.summary(host));
+    }
+    find(id) {
+        return this.#store.state.hosts.find((host) => host.id === id);
+    }
+    get(id) {
+        const host = this.find(id);
+        if (!host)
+            throw new AppError('NOT_FOUND', 'Host not found.');
+        return host;
+    }
+    summary(host) {
+        return {
+            id: host.id,
+            name: host.name,
+            host: host.host,
+            port: host.port,
+            username: host.username,
+            auth: host.auth,
+            hostKey: { keyType: host.hostKey.keyType, fingerprint: fingerprintSha256(Buffer.from(host.hostKey.key, 'base64')) },
+            connection: this.#connections.get(host.id)?.getStatus() ?? { status: 'idle', error: null },
+            createdAt: host.createdAt,
+        };
+    }
+    probe(host, port) {
+        return probeHostKey(host, port, { readyTimeoutMs: this.#options.readyTimeoutMs, knownHostsPath: this.#options.knownHostsPath }, this.#logger);
+    }
+    /**
+     * Resolve credentials. For "password", sign in once with the password (host key
+     * pinned) and install a freshly generated key, so only the key is ever kept.
+     */
+    async #credentials(input, target) {
+        switch (input.type) {
+            case 'password': {
+                const pair = utils.generateKeyPairSync('ed25519', { comment: KEY_COMMENT });
+                const publicKey = pair.public.trim();
+                await installPublicKey({ ...this.#connectionSettings(target), password: input.password }, publicKey, this.#logger);
+                this.#logger.info({ host: target.host, port: target.port }, 'installed key on host using a one-time password sign-in');
+                return { auth: { type: 'managed-key', source: 'password', publicKey }, privateKey: pair.private };
+            }
+            case 'generate': {
+                const pair = utils.generateKeyPairSync('ed25519', { comment: KEY_COMMENT });
+                return { auth: { type: 'managed-key', source: 'generated', publicKey: pair.public.trim() }, privateKey: pair.private };
+            }
+            case 'import': {
+                const pem = input.privateKey.replace(/\r\n/g, '\n').trim();
+                return { auth: { type: 'managed-key', source: 'imported', publicKey: publicKeyLine(pem) }, privateKey: pem };
+            }
+            case 'key-file': {
+                const keyPath = path.resolve(expandHome(input.path));
+                let data;
+                try {
+                    data = readFileSync(keyPath);
+                }
+                catch (error) {
+                    throw new AppError('BAD_REQUEST', `Cannot read ${keyPath} on the server (${errnoCode(error)}).`);
+                }
+                publicKeyLine(data);
+                return { auth: { type: 'key-file', path: keyPath }, privateKey: null };
+            }
+            case 'agent':
+                if (!this.agentAvailable) {
+                    throw new AppError('BAD_REQUEST', 'No ssh-agent is available to the server (SSH_AUTH_SOCK is not set where it runs).');
+                }
+                return { auth: { type: 'agent' }, privateKey: null };
+        }
+    }
+    async create(input) {
+        const id = randomUUID();
+        const hostKey = decodeHostKey(input.hostKey);
+        const { auth, privateKey } = await this.#credentials(input.auth, { ...input, hostKey });
+        if (privateKey)
+            this.#store.writePrivateKey(id, privateKey);
+        const host = {
+            id,
+            name: input.name,
+            host: input.host,
+            port: input.port,
+            username: input.username,
+            auth,
+            hostKey,
+            createdAt: new Date().toISOString(),
+        };
+        try {
+            this.#store.update((draft) => {
+                draft.hosts.push(host);
+            });
+        }
+        catch (error) {
+            this.#store.deletePrivateKey(id);
+            throw error;
+        }
+        this.#logger.info({ hostId: id, host: input.host, port: input.port, auth: auth.type }, 'host added');
+        return this.summary(host);
+    }
+    async update(id, input) {
+        const current = this.get(id);
+        const address = { host: input.host ?? current.host, port: input.port ?? current.port };
+        if ((address.host !== current.host || address.port !== current.port) && !input.hostKey) {
+            throw new AppError('BAD_REQUEST', 'Verify the host key of the new address before saving.');
+        }
+        const hostKey = input.hostKey ? decodeHostKey(input.hostKey) : current.hostKey;
+        const username = input.username ?? current.username;
+        const credentials = input.auth ? await this.#credentials(input.auth, { ...address, username, hostKey }) : null;
+        if (credentials?.privateKey)
+            this.#store.writePrivateKey(id, credentials.privateKey);
+        const next = {
+            ...current,
+            ...address,
+            name: input.name ?? current.name,
+            username,
+            hostKey,
+            auth: credentials?.auth ?? current.auth,
+        };
+        this.#store.update((draft) => {
+            draft.hosts = draft.hosts.map((host) => (host.id === id ? next : host));
+        });
+        if (current.auth.type === 'managed-key' && next.auth.type !== 'managed-key')
+            this.#store.deletePrivateKey(id);
+        this.#invalidate(id);
+        this.#logger.info({ hostId: id }, 'host updated');
+        return this.summary(next);
+    }
+    /** Remove the host, its projects, and its stored key. Callers terminate terminals first. */
+    remove(id) {
+        this.get(id);
+        this.#store.update((draft) => {
+            draft.hosts = draft.hosts.filter((host) => host.id !== id);
+            draft.workspaces = draft.workspaces.filter((workspace) => workspace.hostId !== id);
+        });
+        this.#store.deletePrivateKey(id);
+        this.#invalidate(id);
+        this.#logger.info({ hostId: id }, 'host removed');
+    }
+    /** Open a fresh control connection, surfacing host-key and authentication problems. */
+    async test(id) {
+        await this.connection(id).reconnect();
+        return this.summary(this.get(id));
+    }
+    /** Connection settings without credentials, pinned to the host's trusted key. */
+    #connectionSettings(target) {
+        return {
+            host: target.host,
+            port: target.port,
+            username: target.username,
+            privateKey: null,
+            passphrase: null,
+            password: null,
+            agentSocket: null,
+            hostVerification: { mode: 'pinned', keyType: target.hostKey.keyType, key: Buffer.from(target.hostKey.key, 'base64') },
+            readyTimeoutMs: this.#options.readyTimeoutMs,
+            keepaliveIntervalMs: this.#options.keepaliveIntervalMs,
+        };
+    }
+    /** Connection settings for a host, with its private key loaded from disk. */
+    sshConfig(id) {
+        const host = this.get(id);
+        let privateKey = null;
+        let agentSocket = null;
+        const auth = host.auth;
+        try {
+            if (auth.type === 'managed-key')
+                privateKey = this.#store.readPrivateKey(id);
+            if (auth.type === 'key-file')
+                privateKey = readFileSync(auth.path);
+        }
+        catch (error) {
+            throw new AppError('REMOTE_UNAVAILABLE', `Cannot read the private key for ${host.name} (${errnoCode(error)}).`);
+        }
+        if (auth.type === 'agent') {
+            agentSocket = this.#options.agentSocket;
+            if (!agentSocket)
+                throw new AppError('REMOTE_UNAVAILABLE', 'No ssh-agent is available to the server (SSH_AUTH_SOCK is not set).');
+        }
+        return { ...this.#connectionSettings(host), privateKey, agentSocket };
+    }
+    /** The shared control connection for a host, created on first use. */
+    connection(id) {
+        let manager = this.#connections.get(id);
+        if (!manager) {
+            manager = new SshConnectionManager(this.sshConfig(id), this.#logger);
+            this.#connections.set(id, manager);
+        }
+        return manager;
+    }
+    #invalidate(id) {
+        this.#connections.get(id)?.dispose();
+        this.#connections.delete(id);
+        for (const listener of this.#listeners)
+            listener(id);
+    }
+    dispose() {
+        for (const manager of this.#connections.values())
+            manager.dispose();
+        this.#connections.clear();
+    }
+}

package/runtime/server/src/modules/hosts/host.routes.js

@@ -0,0 +1,31 @@
+import { browseQuerySchema, createHostRequestSchema, hostIdParamsSchema, hostProbeRequestSchema, updateHostRequestSchema, } from "../../../../src/schema/hosts.js";
+import { parseInput } from "../../lib/validation.js";
+export function registerHostRoutes(app, hosts, workspaces) {
+    app.get('/api/hosts', async () => ({ hosts: hosts.list(), agentAvailable: hosts.agentAvailable }));
+    // Fetch the key a server presents so the user can verify it before trusting it.
+    app.post('/api/hosts/probe', async (request) => {
+        const { host, port } = parseInput(hostProbeRequestSchema, request.body);
+        return hosts.probe(host, port);
+    });
+    app.post('/api/hosts', async (request, reply) => {
+        const created = await hosts.create(parseInput(createHostRequestSchema, request.body));
+        return reply.status(201).send(created);
+    });
+    app.patch('/api/hosts/:hostId', async (request) => {
+        const { hostId } = parseInput(hostIdParamsSchema, request.params);
+        return hosts.update(hostId, parseInput(updateHostRequestSchema, request.body));
+    });
+    app.delete('/api/hosts/:hostId', async (request, reply) => {
+        const { hostId } = parseInput(hostIdParamsSchema, request.params);
+        workspaces.removeHost(hostId);
+        return reply.status(204).send();
+    });
+    app.post('/api/hosts/:hostId/test', async (request) => {
+        const { hostId } = parseInput(hostIdParamsSchema, request.params);
+        return hosts.test(hostId);
+    });
+    app.get('/api/browse', async (request) => {
+        const { host, path } = parseInput(browseQuerySchema, request.query);
+        return workspaces.browse(host, path);
+    });
+}

package/runtime/server/src/modules/hosts/key-installer.js

@@ -0,0 +1,58 @@
+import { AppError } from "../../lib/errors.js";
+import { quoteShellArg } from "../../lib/shell-quote.js";
+import { connectSsh } from "../ssh/ssh-connection.js";
+const INSTALL_TIMEOUT_MS = 20_000;
+/**
+ * The remote command that authorizes `publicKey` for the logged-in user, like
+ * ssh-copy-id: creates ~/.ssh (0700) and authorized_keys (0600) if needed and
+ * appends the key only if it is not there yet. Runs in the login shell (POSIX).
+ */
+export function authorizeKeyCommand(publicKey) {
+    const key = quoteShellArg(publicKey);
+    return [
+        'umask 077',
+        'mkdir -p ~/.ssh',
+        'touch ~/.ssh/authorized_keys',
+        'chmod 700 ~/.ssh',
+        'chmod 600 ~/.ssh/authorized_keys',
+        `{ grep -qxF ${key} ~/.ssh/authorized_keys || printf '%s\\n' ${key} >> ~/.ssh/authorized_keys; }`,
+    ].join(' && ');
+}
+/**
+ * Sign in once with the user's SSH password (host key already pinned) and add
+ * our public key to authorized_keys. The password lives only in this call: it
+ * is never stored, logged, or returned.
+ */
+export async function installPublicKey(config, publicKey, logger) {
+    const client = await connectSsh(config, logger);
+    try {
+        const exitCode = await new Promise((resolve, reject) => {
+            client.exec(authorizeKeyCommand(publicKey), (error, stream) => {
+                if (error) {
+                    reject(new AppError('REMOTE_UNAVAILABLE', 'The SSH server refused to run a command.', { cause: error }));
+                    return;
+                }
+                let code = null;
+                const timer = setTimeout(() => {
+                    stream.close();
+                    reject(new AppError('TIMEOUT', 'Timed out while setting up the key.'));
+                }, INSTALL_TIMEOUT_MS);
+                stream.on('exit', (status) => {
+                    code = typeof status === 'number' ? status : null;
+                });
+                stream.on('close', () => {
+                    clearTimeout(timer);
+                    resolve(code);
+                });
+                stream.resume();
+                stream.stderr.resume();
+            });
+        });
+        if (exitCode !== 0) {
+            throw new AppError('REMOTE_UNAVAILABLE', 'Signed in, but could not add the key to ~/.ssh/authorized_keys on the host.');
+        }
+    }
+    finally {
+        client.end();
+    }
+}

package/runtime/server/src/modules/ssh/host-key-probe.js

@@ -0,0 +1,64 @@
+import { Client } from 'ssh2';
+import { AppError } from "../../lib/errors.js";
+import { createKnownHostsVerifier, fingerprintSha256, keyTypeOf, readKnownHosts } from "./host-key-verifier.js";
+import { networkErrorMessage } from "./ssh-connection.js";
+const statusForRejection = {
+    'unknown-host': 'unknown',
+    'key-mismatch': 'mismatch',
+    revoked: 'revoked',
+};
+/**
+ * Fetch the host key a server presents, without trusting or authenticating.
+ * The handshake is aborted inside the host-key callback, so no credentials are
+ * ever offered to an unverified server. The result is shown to the user, who
+ * decides whether to trust it; known_hosts is consulted so keys the server's
+ * user already trusts are recognized (and conflicting keys are flagged).
+ */
+export async function probeHostKey(host, port, options, logger) {
+    const entries = await readKnownHosts(options.knownHostsPath).catch((error) => {
+        logger.warn({ err: error }, 'cannot read known_hosts; treating every host as unknown');
+        return [];
+    });
+    const knownHosts = createKnownHostsVerifier(entries, host, port);
+    const presented = await new Promise((resolve, reject) => {
+        const client = new Client();
+        let captured = null;
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            client.end();
+            if (captured)
+                resolve(captured);
+            else {
+                const message = (error && networkErrorMessage(error, host, port)) ?? `Could not complete an SSH handshake with ${host}:${port}.`;
+                reject(new AppError('REMOTE_UNAVAILABLE', message, { cause: error }));
+            }
+        };
+        client.on('error', (error) => finish(error));
+        client.once('close', () => finish());
+        client.once('ready', () => finish());
+        client.connect({
+            host,
+            port,
+            username: 'remote-workspace-probe',
+            readyTimeout: options.readyTimeoutMs,
+            // Like OpenSSH: when known_hosts already has keys for this host, ask for those types.
+            algorithms: knownHosts.acceptedAlgorithms.length > 0
+                ? { serverHostKey: knownHosts.acceptedAlgorithms }
+                : undefined,
+            hostVerifier: (key) => {
+                captured = Buffer.from(key);
+                return false;
+            },
+        });
+    });
+    const verdict = knownHosts.verify(presented);
+    return {
+        keyType: keyTypeOf(presented) ?? 'unknown',
+        key: presented.toString('base64'),
+        fingerprint: fingerprintSha256(presented),
+        knownHosts: verdict.ok ? 'trusted' : (statusForRejection[verdict.reason] ?? 'unknown'),
+    };
+}

package/runtime/server/src/modules/ssh/host-key-verifier.js

@@ -0,0 +1,153 @@
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+export function parseKnownHosts(content) {
+    const entries = [];
+    for (const rawLine of content.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const fields = line.split(/\s+/);
+        let marker = null;
+        if (fields[0] === '@revoked' || fields[0] === '@cert-authority') {
+            marker = fields.shift();
+        }
+        const [hostPatterns, keyType, keyBase64] = fields;
+        if (!hostPatterns || !keyType || !keyBase64)
+            continue;
+        const key = Buffer.from(keyBase64, 'base64');
+        if (key.length === 0)
+            continue;
+        entries.push({ marker, hostPatterns, keyType, key });
+    }
+    return entries;
+}
+/** The name OpenSSH looks up: `host` on port 22, otherwise `[host]:port`. */
+export function knownHostsName(host, port) {
+    return port === 22 ? host : `[${host}]:${port}`;
+}
+function globToRegExp(pattern) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replaceAll('*', '.*').replaceAll('?', '.');
+    return new RegExp(`^${escaped}$`, 'i');
+}
+function matchesHashedPattern(pattern, name) {
+    // |1|<base64 salt>|<base64 HMAC-SHA1(salt, name)>
+    const [, magic, salt, hash] = pattern.split('|');
+    if (magic !== '1' || !salt || !hash)
+        return false;
+    const expected = Buffer.from(hash, 'base64');
+    const actual = createHmac('sha1', Buffer.from(salt, 'base64')).update(name).digest();
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+export function hostPatternsMatch(patterns, host, port) {
+    const name = knownHostsName(host, port);
+    if (patterns.startsWith('|'))
+        return matchesHashedPattern(patterns, name);
+    let matched = false;
+    for (const pattern of patterns.split(',')) {
+        const negated = pattern.startsWith('!');
+        const body = negated ? pattern.slice(1) : pattern;
+        if (!globToRegExp(body).test(name))
+            continue;
+        if (negated)
+            return false;
+        matched = true;
+    }
+    return matched;
+}
+/** OpenSSH-style fingerprint: `SHA256:` + unpadded base64 of the SHA-256 of the key blob. */
+export function fingerprintSha256(key) {
+    return `SHA256:${createHash('sha256').update(key).digest('base64').replace(/=+$/, '')}`;
+}
+const algorithmsForKeyType = {
+    'ssh-ed25519': ['ssh-ed25519'],
+    'ecdsa-sha2-nistp256': ['ecdsa-sha2-nistp256'],
+    'ecdsa-sha2-nistp384': ['ecdsa-sha2-nistp384'],
+    'ecdsa-sha2-nistp521': ['ecdsa-sha2-nistp521'],
+    'ssh-rsa': ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-rsa'],
+};
+export function createKnownHostsVerifier(entries, host, port) {
+    const relevant = entries.filter((entry) => entry.marker !== '@cert-authority' && hostPatternsMatch(entry.hostPatterns, host, port));
+    const revoked = relevant.filter((entry) => entry.marker === '@revoked');
+    const trusted = relevant.filter((entry) => entry.marker === null);
+    const acceptedAlgorithms = [...new Set(trusted.flatMap((entry) => algorithmsForKeyType[entry.keyType] ?? []))];
+    return {
+        acceptedAlgorithms,
+        verify(key) {
+            if (revoked.some((entry) => entry.key.equals(key)))
+                return { ok: false, reason: 'revoked' };
+            if (trusted.some((entry) => entry.key.equals(key)))
+                return { ok: true };
+            return { ok: false, reason: trusted.length > 0 ? 'key-mismatch' : 'unknown-host' };
+        },
+    };
+}
+/** Trust exactly one stored host key (chosen by the user when the host was added). */
+export function createPinnedVerifier(keyType, key) {
+    return {
+        acceptedAlgorithms: algorithmsForKeyType[keyType] ?? [],
+        verify(presented) {
+            const ok = presented.length === key.length && timingSafeEqual(presented, key);
+            return ok ? { ok: true } : { ok: false, reason: 'key-mismatch' };
+        },
+    };
+}
+export function createFingerprintVerifier(fingerprint) {
+    const expected = Buffer.from(fingerprint);
+    return {
+        acceptedAlgorithms: [],
+        verify(key) {
+            const actual = Buffer.from(fingerprintSha256(key));
+            const ok = actual.length === expected.length && timingSafeEqual(actual, expected);
+            return ok ? { ok: true } : { ok: false, reason: 'key-mismatch' };
+        },
+    };
+}
+/** Read known_hosts, treating a missing file as empty. */
+export async function readKnownHosts(knownHostsPath) {
+    try {
+        return parseKnownHosts(await readFile(knownHostsPath, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+/** Build a verifier from config. known_hosts is re-read on every connect so edits apply without a restart. */
+export async function loadHostKeyVerifier(config) {
+    switch (config.hostVerification.mode) {
+        case 'pinned':
+            return createPinnedVerifier(config.hostVerification.keyType, config.hostVerification.key);
+        case 'fingerprint':
+            return createFingerprintVerifier(config.hostVerification.fingerprint);
+        case 'known-hosts': {
+            const content = await readFile(config.hostVerification.knownHostsPath, 'utf8');
+            return createKnownHostsVerifier(parseKnownHosts(content), config.host, config.port);
+        }
+    }
+}
+/** The key type embedded at the start of an SSH public key blob (uint32 length + name). */
+export function keyTypeOf(key) {
+    if (key.length < 4)
+        return null;
+    const length = key.readUInt32BE(0);
+    if (length === 0 || length > 64 || key.length < 4 + length)
+        return null;
+    const name = key.subarray(4, 4 + length).toString('latin1');
+    return /^[a-z0-9@.-]+$/.test(name) ? name : null;
+}
+export function describeHostKeyRejection(reason, config) {
+    const name = knownHostsName(config.host, config.port);
+    if (config.hostVerification.mode === 'pinned') {
+        return (`Host key verification failed: ${name} presented a different key than the one you trusted. ` +
+            'Refusing to connect. If the machine was reinstalled, verify the new fingerprint and re-trust it in the host settings.');
+    }
+    switch (reason) {
+        case 'unknown-host':
+            return `Host key verification failed: ${name} is not in known_hosts. Add it with ssh-keyscan after verifying its fingerprint.`;
+        case 'key-mismatch':
+            return `Host key verification failed: the key presented by ${name} does not match the trusted key. Refusing to connect.`;
+        case 'revoked':
+            return `Host key verification failed: the key presented by ${name} is marked @revoked.`;
+    }
+}