@farazirfan/costar-server-executor 1.0.0

package/dist/infra/skills-remote.js

@@ -0,0 +1,283 @@
+import { loadWorkspaceSkillEntries } from "../agents/skills.js";
+import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
+import { listNodePairing, updatePairedNodeMetadata } from "./node-pairing.js";
+import { createSubsystemLogger } from "../logging/subsystem.js";
+import { bumpSkillsSnapshotVersion } from "../agents/skills/refresh.js";
+const log = createSubsystemLogger("gateway/skills-remote");
+const remoteNodes = new Map();
+let remoteRegistry = null;
+function describeNode(nodeId) {
+    const record = remoteNodes.get(nodeId);
+    const name = record?.displayName?.trim();
+    const base = name && name !== nodeId ? `${name} (${nodeId})` : nodeId;
+    const ip = record?.remoteIp?.trim();
+    return ip ? `${base} @ ${ip}` : base;
+}
+function extractErrorMessage(err) {
+    if (!err)
+        return undefined;
+    if (typeof err === "string")
+        return err;
+    if (err instanceof Error)
+        return err.message;
+    if (typeof err === "object" && "message" in err && typeof err.message === "string") {
+        return err.message;
+    }
+    if (typeof err === "number" || typeof err === "boolean" || typeof err === "bigint") {
+        return String(err);
+    }
+    if (typeof err === "symbol") {
+        return err.toString();
+    }
+    if (typeof err === "object") {
+        try {
+            return JSON.stringify(err);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+function logRemoteBinProbeFailure(nodeId, err) {
+    const message = extractErrorMessage(err);
+    const label = describeNode(nodeId);
+    // Node unavailable errors (not connected or disconnected mid-operation) are expected
+    // when nodes have transient connections - log at info level instead of warn
+    if (message?.includes("node not connected") || message?.includes("node disconnected")) {
+        log.info(`remote bin probe skipped: node unavailable (${label})`);
+        return;
+    }
+    if (message?.includes("invoke timed out") || message?.includes("timeout")) {
+        log.warn(`remote bin probe timed out (${label}); check node connectivity for ${label}`);
+        return;
+    }
+    log.warn(`remote bin probe error (${label}): ${message ?? "unknown"}`);
+}
+function isMacPlatform(platform, deviceFamily) {
+    const platformNorm = String(platform ?? "")
+        .trim()
+        .toLowerCase();
+    const familyNorm = String(deviceFamily ?? "")
+        .trim()
+        .toLowerCase();
+    if (platformNorm.includes("mac"))
+        return true;
+    if (platformNorm.includes("darwin"))
+        return true;
+    if (familyNorm === "mac")
+        return true;
+    return false;
+}
+function supportsSystemRun(commands) {
+    return Array.isArray(commands) && commands.includes("system.run");
+}
+function supportsSystemWhich(commands) {
+    return Array.isArray(commands) && commands.includes("system.which");
+}
+function upsertNode(record) {
+    const existing = remoteNodes.get(record.nodeId);
+    const bins = new Set(record.bins ?? existing?.bins ?? []);
+    remoteNodes.set(record.nodeId, {
+        nodeId: record.nodeId,
+        displayName: record.displayName ?? existing?.displayName,
+        platform: record.platform ?? existing?.platform,
+        deviceFamily: record.deviceFamily ?? existing?.deviceFamily,
+        commands: record.commands ?? existing?.commands,
+        remoteIp: record.remoteIp ?? existing?.remoteIp,
+        bins,
+    });
+}
+export function setSkillsRemoteRegistry(registry) {
+    remoteRegistry = registry;
+}
+export async function primeRemoteSkillsCache() {
+    try {
+        const list = await listNodePairing();
+        let sawMac = false;
+        for (const node of list.paired) {
+            upsertNode({
+                nodeId: node.nodeId,
+                displayName: node.displayName,
+                platform: node.platform,
+                deviceFamily: node.deviceFamily,
+                commands: node.commands,
+                remoteIp: node.remoteIp,
+                bins: node.bins,
+            });
+            if (isMacPlatform(node.platform, node.deviceFamily) && supportsSystemRun(node.commands)) {
+                sawMac = true;
+            }
+        }
+        if (sawMac) {
+            bumpSkillsSnapshotVersion({ reason: "remote-node" });
+        }
+    }
+    catch (err) {
+        log.warn(`failed to prime remote skills cache: ${String(err)}`);
+    }
+}
+export function recordRemoteNodeInfo(node) {
+    upsertNode(node);
+}
+export function recordRemoteNodeBins(nodeId, bins) {
+    upsertNode({ nodeId, bins });
+}
+function listWorkspaceDirs(cfg) {
+    const dirs = new Set();
+    const list = cfg.agents?.list;
+    if (Array.isArray(list)) {
+        for (const entry of list) {
+            if (entry && typeof entry === "object" && typeof entry.id === "string") {
+                dirs.add(resolveAgentWorkspaceDir(cfg, entry.id));
+            }
+        }
+    }
+    dirs.add(resolveAgentWorkspaceDir(cfg, resolveDefaultAgentId(cfg)));
+    return [...dirs];
+}
+function collectRequiredBins(entries, targetPlatform) {
+    const bins = new Set();
+    for (const entry of entries) {
+        const os = entry.metadata?.os ?? [];
+        if (os.length > 0 && !os.includes(targetPlatform))
+            continue;
+        const required = entry.metadata?.requires?.bins ?? [];
+        const anyBins = entry.metadata?.requires?.anyBins ?? [];
+        for (const bin of required) {
+            if (bin.trim())
+                bins.add(bin.trim());
+        }
+        for (const bin of anyBins) {
+            if (bin.trim())
+                bins.add(bin.trim());
+        }
+    }
+    return [...bins];
+}
+function buildBinProbeScript(bins) {
+    const escaped = bins.map((bin) => `'${bin.replace(/'/g, `'\\''`)}'`).join(" ");
+    return `for b in ${escaped}; do if command -v "$b" >/dev/null 2>&1; then echo "$b"; fi; done`;
+}
+function parseBinProbePayload(payloadJSON, payload) {
+    if (!payloadJSON && !payload)
+        return [];
+    try {
+        const parsed = payloadJSON
+            ? JSON.parse(payloadJSON)
+            : payload;
+        if (Array.isArray(parsed.bins)) {
+            return parsed.bins.map((bin) => String(bin).trim()).filter(Boolean);
+        }
+        if (typeof parsed.stdout === "string") {
+            return parsed.stdout
+                .split(/\r?\n/)
+                .map((line) => line.trim())
+                .filter(Boolean);
+        }
+    }
+    catch {
+        return [];
+    }
+    return [];
+}
+function areBinSetsEqual(a, b) {
+    if (!a)
+        return false;
+    if (a.size !== b.size)
+        return false;
+    for (const bin of b) {
+        if (!a.has(bin))
+            return false;
+    }
+    return true;
+}
+export async function refreshRemoteNodeBins(params) {
+    if (!remoteRegistry)
+        return;
+    if (!isMacPlatform(params.platform, params.deviceFamily))
+        return;
+    const canWhich = supportsSystemWhich(params.commands);
+    const canRun = supportsSystemRun(params.commands);
+    if (!canWhich && !canRun)
+        return;
+    const workspaceDirs = listWorkspaceDirs(params.cfg);
+    const requiredBins = new Set();
+    for (const workspaceDir of workspaceDirs) {
+        const entries = loadWorkspaceSkillEntries(workspaceDir, { config: params.cfg });
+        for (const bin of collectRequiredBins(entries, "darwin")) {
+            requiredBins.add(bin);
+        }
+    }
+    if (requiredBins.size === 0)
+        return;
+    try {
+        const binsList = [...requiredBins];
+        const res = await remoteRegistry.invoke(canWhich
+            ? {
+                nodeId: params.nodeId,
+                command: "system.which",
+                params: { bins: binsList },
+                timeoutMs: params.timeoutMs ?? 15_000,
+            }
+            : {
+                nodeId: params.nodeId,
+                command: "system.run",
+                params: {
+                    command: ["/bin/sh", "-lc", buildBinProbeScript(binsList)],
+                },
+                timeoutMs: params.timeoutMs ?? 15_000,
+            });
+        if (!res.ok) {
+            logRemoteBinProbeFailure(params.nodeId, res.error?.message ?? "unknown");
+            return;
+        }
+        const bins = parseBinProbePayload(res.payloadJSON, res.payload);
+        const existingBins = remoteNodes.get(params.nodeId)?.bins;
+        const nextBins = new Set(bins);
+        const hasChanged = !areBinSetsEqual(existingBins, nextBins);
+        recordRemoteNodeBins(params.nodeId, bins);
+        if (!hasChanged)
+            return;
+        await updatePairedNodeMetadata(params.nodeId, { bins });
+        bumpSkillsSnapshotVersion({ reason: "remote-node" });
+    }
+    catch (err) {
+        logRemoteBinProbeFailure(params.nodeId, err);
+    }
+}
+export function getRemoteSkillEligibility() {
+    const macNodes = [...remoteNodes.values()].filter((node) => isMacPlatform(node.platform, node.deviceFamily) && supportsSystemRun(node.commands));
+    if (macNodes.length === 0)
+        return undefined;
+    const bins = new Set();
+    for (const node of macNodes) {
+        for (const bin of node.bins)
+            bins.add(bin);
+    }
+    const labels = macNodes.map((node) => node.displayName ?? node.nodeId).filter(Boolean);
+    const note = labels.length > 0
+        ? `Remote macOS node available (${labels.join(", ")}). Run macOS-only skills via nodes.run on that node.`
+        : "Remote macOS node available. Run macOS-only skills via nodes.run on that node.";
+    return {
+        platforms: ["darwin"],
+        hasBin: (bin) => bins.has(bin),
+        hasAnyBin: (required) => required.some((bin) => bins.has(bin)),
+        note,
+    };
+}
+export async function refreshRemoteBinsForConnectedNodes(cfg) {
+    if (!remoteRegistry)
+        return;
+    const connected = remoteRegistry.listConnected();
+    for (const node of connected) {
+        await refreshRemoteNodeBins({
+            nodeId: node.nodeId,
+            platform: node.platform,
+            deviceFamily: node.deviceFamily,
+            commands: node.commands,
+            cfg,
+        });
+    }
+}
+//# sourceMappingURL=skills-remote.js.map

package/dist/infra/skills-remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-remote.js","sourceRoot":"","sources":["../../src/infra/skills-remote.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAaxE,MAAM,GAAG,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;AACxD,IAAI,cAAc,GAAwB,IAAI,CAAC;AAE/C,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,SAAS,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACnF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc,EAAE,GAAY;IAC5D,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,qFAAqF;IACrF,4EAA4E;IAC5E,IAAI,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,IAAI,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,+CAA+C,KAAK,GAAG,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,IAAI,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,kCAAkC,KAAK,EAAE,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB,EAAE,YAAqB;IAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SACxC,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;SAC1C,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAmB;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAmB;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,MAQnB;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAClE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW;QACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;QAC/C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ,EAAE,YAAY;QAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;QAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;QAC/C,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA6B;IACnE,cAAc,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,UAAU,CAAC;gBACT,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxF,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,yBAAyB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,wCAAwC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAOpC;IACC,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAc;IACjE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAmB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACvE,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAqB,EAAE,cAAsB;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/E,OAAO,YAAY,OAAO,mEAAmE,CAAC;AAChG,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAsC,EAAE,OAAiB;IACrF,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW;YACxB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAA0C;YACnE,CAAC,CAAE,OAAgD,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC,MAAM;iBACjB,KAAK,CAAC,OAAO,CAAC;iBACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B,EAAE,CAAc;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAO3C;IACC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO;IACjE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO;IAEjC,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,yBAAyB,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CACrC,QAAQ;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,cAAc;gBACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM;aACtC;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE;oBACN,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;iBAC3D;gBACD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM;aACtC,CACN,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC5D,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,yBAAyB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC9F,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvF,MAAM,IAAI,GACR,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD;QACzG,CAAC,CAAC,gFAAgF,CAAC;IACvF,OAAO;QACL,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9B,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,GAAmB;IAC1E,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,qBAAqB,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/infra/ssh-config.d.ts

@@ -0,0 +1,13 @@
+import type { SshParsedTarget } from "./ssh-tunnel.js";
+export type SshResolvedConfig = {
+    user?: string;
+    host?: string;
+    port?: number;
+    identityFiles: string[];
+};
+export declare function parseSshConfigOutput(output: string): SshResolvedConfig;
+export declare function resolveSshConfig(target: SshParsedTarget, opts?: {
+    identity?: string;
+    timeoutMs?: number;
+}): Promise<SshResolvedConfig | null>;
+//# sourceMappingURL=ssh-config.d.ts.map

package/dist/infra/ssh-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-config.d.ts","sourceRoot":"","sources":["../../src/infra/ssh-config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AASF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CA2BtE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA6CnC"}

package/dist/infra/ssh-config.js

@@ -0,0 +1,85 @@
+import { spawn } from "node:child_process";
+function parsePort(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return undefined;
+    return parsed;
+}
+export function parseSshConfigOutput(output) {
+    const result = { identityFiles: [] };
+    const lines = output.split("\n");
+    for (const raw of lines) {
+        const line = raw.trim();
+        if (!line)
+            continue;
+        const [key, ...rest] = line.split(/\s+/);
+        const value = rest.join(" ").trim();
+        if (!key || !value)
+            continue;
+        switch (key) {
+            case "user":
+                result.user = value;
+                break;
+            case "hostname":
+                result.host = value;
+                break;
+            case "port":
+                result.port = parsePort(value);
+                break;
+            case "identityfile":
+                if (value !== "none")
+                    result.identityFiles.push(value);
+                break;
+            default:
+                break;
+        }
+    }
+    return result;
+}
+export async function resolveSshConfig(target, opts = {}) {
+    const sshPath = "/usr/bin/ssh";
+    const args = ["-G"];
+    if (target.port > 0 && target.port !== 22) {
+        args.push("-p", String(target.port));
+    }
+    if (opts.identity?.trim()) {
+        args.push("-i", opts.identity.trim());
+    }
+    const userHost = target.user ? `${target.user}@${target.host}` : target.host;
+    // Use "--" so userHost can't be parsed as an ssh option.
+    args.push("--", userHost);
+    return await new Promise((resolve) => {
+        const child = spawn(sshPath, args, {
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        let stdout = "";
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            stdout += String(chunk);
+        });
+        const timeoutMs = Math.max(200, opts.timeoutMs ?? 800);
+        const timer = setTimeout(() => {
+            try {
+                child.kill("SIGKILL");
+            }
+            finally {
+                resolve(null);
+            }
+        }, timeoutMs);
+        child.once("error", () => {
+            clearTimeout(timer);
+            resolve(null);
+        });
+        child.once("exit", (code) => {
+            clearTimeout(timer);
+            if (code !== 0 || !stdout.trim()) {
+                resolve(null);
+                return;
+            }
+            resolve(parseSshConfigOutput(stdout));
+        });
+    });
+}
+//# sourceMappingURL=ssh-config.js.map

package/dist/infra/ssh-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-config.js","sourceRoot":"","sources":["../../src/infra/ssh-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAW3C,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,MAAM,GAAsB,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;YAAE,SAAS;QAC7B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM;gBACT,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;gBACpB,MAAM;YACR,KAAK,UAAU;gBACb,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;gBACpB,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,cAAc;gBACjB,IAAI,KAAK,KAAK,MAAM;oBAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM;YACR;gBACE,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAuB,EACvB,OAAkD,EAAE;IAEpD,MAAM,OAAO,GAAG,cAAc,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC7E,yDAAyD;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1B,OAAO,MAAM,IAAI,OAAO,CAA2B,CAAC,OAAO,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/infra/ssh-tunnel.d.ts

@@ -0,0 +1,22 @@
+export type SshParsedTarget = {
+    user?: string;
+    host: string;
+    port: number;
+};
+export type SshTunnel = {
+    parsedTarget: SshParsedTarget;
+    localPort: number;
+    remotePort: number;
+    pid: number | null;
+    stderr: string[];
+    stop: () => Promise<void>;
+};
+export declare function parseSshTarget(raw: string): SshParsedTarget | null;
+export declare function startSshPortForward(opts: {
+    target: string;
+    identity?: string;
+    localPortPreferred: number;
+    remotePort: number;
+    timeoutMs: number;
+}): Promise<SshTunnel>;
+//# sourceMappingURL=ssh-tunnel.d.ts.map

package/dist/infra/ssh-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-tunnel.d.ts","sourceRoot":"","sources":["../../src/infra/ssh-tunnel.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,YAAY,EAAE,eAAe,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B,CAAC;AAMF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CA4BlE;AA0CD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,SAAS,CAAC,CAiGrB"}

package/dist/infra/ssh-tunnel.js

@@ -0,0 +1,174 @@
+import { spawn } from "node:child_process";
+import net from "node:net";
+import { ensurePortAvailable } from "./ports.js";
+function isErrno(err) {
+    return Boolean(err && typeof err === "object" && "code" in err);
+}
+export function parseSshTarget(raw) {
+    const trimmed = raw.trim().replace(/^ssh\s+/, "");
+    if (!trimmed)
+        return null;
+    const [userPart, hostPart] = trimmed.includes("@")
+        ? (() => {
+            const idx = trimmed.indexOf("@");
+            const user = trimmed.slice(0, idx).trim();
+            const host = trimmed.slice(idx + 1).trim();
+            return [user || undefined, host];
+        })()
+        : [undefined, trimmed];
+    const colonIdx = hostPart.lastIndexOf(":");
+    if (colonIdx > 0 && colonIdx < hostPart.length - 1) {
+        const host = hostPart.slice(0, colonIdx).trim();
+        const portRaw = hostPart.slice(colonIdx + 1).trim();
+        const port = Number.parseInt(portRaw, 10);
+        if (!host || !Number.isFinite(port) || port <= 0)
+            return null;
+        // Security: Reject hostnames starting with '-' to prevent argument injection
+        if (host.startsWith("-"))
+            return null;
+        return { user: userPart, host, port };
+    }
+    if (!hostPart)
+        return null;
+    // Security: Reject hostnames starting with '-' to prevent argument injection
+    if (hostPart.startsWith("-"))
+        return null;
+    return { user: userPart, host: hostPart, port: 22 };
+}
+async function pickEphemeralPort() {
+    return await new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            server.close(() => {
+                if (!addr || typeof addr === "string") {
+                    reject(new Error("failed to allocate a local port"));
+                    return;
+                }
+                resolve(addr.port);
+            });
+        });
+    });
+}
+async function canConnectLocal(port) {
+    return await new Promise((resolve) => {
+        const socket = net.connect({ host: "127.0.0.1", port });
+        const done = (ok) => {
+            socket.removeAllListeners();
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.once("connect", () => done(true));
+        socket.once("error", () => done(false));
+        socket.setTimeout(250, () => done(false));
+    });
+}
+async function waitForLocalListener(port, timeoutMs) {
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < timeoutMs) {
+        if (await canConnectLocal(port))
+            return;
+        await new Promise((r) => setTimeout(r, 50));
+    }
+    throw new Error(`ssh tunnel did not start listening on localhost:${port}`);
+}
+export async function startSshPortForward(opts) {
+    const parsed = parseSshTarget(opts.target);
+    if (!parsed)
+        throw new Error(`invalid SSH target: ${opts.target}`);
+    let localPort = opts.localPortPreferred;
+    try {
+        await ensurePortAvailable(localPort);
+    }
+    catch (err) {
+        if (isErrno(err) && err.code === "EADDRINUSE") {
+            localPort = await pickEphemeralPort();
+        }
+        else {
+            throw err;
+        }
+    }
+    const userHost = parsed.user ? `${parsed.user}@${parsed.host}` : parsed.host;
+    const args = [
+        "-N",
+        "-L",
+        `${localPort}:127.0.0.1:${opts.remotePort}`,
+        "-p",
+        String(parsed.port),
+        "-o",
+        "ExitOnForwardFailure=yes",
+        "-o",
+        "BatchMode=yes",
+        "-o",
+        "StrictHostKeyChecking=accept-new",
+        "-o",
+        "UpdateHostKeys=yes",
+        "-o",
+        "ConnectTimeout=5",
+        "-o",
+        "ServerAliveInterval=15",
+        "-o",
+        "ServerAliveCountMax=3",
+    ];
+    if (opts.identity?.trim()) {
+        args.push("-i", opts.identity.trim());
+    }
+    // Security: Use '--' to prevent userHost from being interpreted as an option
+    args.push("--", userHost);
+    const stderr = [];
+    const child = spawn("/usr/bin/ssh", args, {
+        stdio: ["ignore", "ignore", "pipe"],
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+        const lines = String(chunk)
+            .split("\n")
+            .map((l) => l.trim())
+            .filter(Boolean);
+        stderr.push(...lines);
+    });
+    const stop = async () => {
+        if (child.killed)
+            return;
+        child.kill("SIGTERM");
+        await new Promise((resolve) => {
+            const t = setTimeout(() => {
+                try {
+                    child.kill("SIGKILL");
+                }
+                finally {
+                    resolve();
+                }
+            }, 1500);
+            child.once("exit", () => {
+                clearTimeout(t);
+                resolve();
+            });
+        });
+    };
+    try {
+        await Promise.race([
+            waitForLocalListener(localPort, Math.max(250, opts.timeoutMs)),
+            new Promise((_, reject) => {
+                child.once("exit", (code, signal) => {
+                    reject(new Error(`ssh exited (${code ?? "null"}${signal ? `/${signal}` : ""})`));
+                });
+            }),
+        ]);
+    }
+    catch (err) {
+        await stop();
+        const suffix = stderr.length > 0 ? `\n${stderr.join("\n")}` : "";
+        throw new Error(`${err instanceof Error ? err.message : String(err)}${suffix}`);
+    }
+    return {
+        parsedTarget: parsed,
+        localPort,
+        remotePort: opts.remotePort,
+        pid: typeof child.pid === "number" ? child.pid : null,
+        stderr,
+        stop,
+    };
+}
+//# sourceMappingURL=ssh-tunnel.js.map

package/dist/infra/ssh-tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-tunnel.js","sourceRoot":"","sources":["../../src/infra/ssh-tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiBjD,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,OAAO,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,CAAC,GAAiC,EAAE;YAClC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,6EAA6E;QAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,OAAO,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,EAAE;YAC3B,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAiB;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;QAC1C,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO;QACxC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAMzC;IACC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAEnE,IAAI,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9C,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,IAAI;QACJ,GAAG,SAAS,cAAc,IAAI,CAAC,UAAU,EAAE;QAC3C,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACnB,IAAI;QACJ,0BAA0B;QAC1B,IAAI;QACJ,eAAe;QACf,IAAI;QACJ,kCAAkC;QAClC,IAAI;QACJ,oBAAoB;QACpB,IAAI;QACJ,kBAAkB;QAClB,IAAI;QACJ,wBAAwB;QACxB,IAAI;QACJ,uBAAuB;KACxB,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,6EAA6E;IAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE;QACxC,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;aACxB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO;QACzB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxB,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;wBAAS,CAAC;oBACT,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,YAAY,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;oBAClC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,IAAI,IAAI,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACnF,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;QACrD,MAAM;QACN,IAAI;KACL,CAAC;AACJ,CAAC"}