@hadooppei/hwcode 0.2.4 → 1.0.1

package/.pi/lib/workflows/cloud/remote/connect.ts

@@ -0,0 +1,83 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+
+import type { CloudVendorId } from "../providers.ts";
+import { runProcess, truncateOutput } from "../process.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../../runtime/defaults.ts";
+import { mergeKnownHosts, parseSshKeyscan, type SshHostKey } from "./host-key.ts";
+import { validateRemoteTargetProfile, type RemoteIdentityType, type RemoteTargetProfile } from "./profiles.ts";
+import { runSsh } from "./ssh-transport.ts";
+
+export interface RemoteConnectionRequest {
+  id: string;
+  name: string;
+  vendor: CloudVendorId;
+  region: string;
+  host: string;
+  port: number;
+  user: string;
+  keyPath: string;
+  knownHostsPath: string;
+  remoteRoot: string;
+  identityType: RemoteIdentityType;
+  proxyJump?: { host: string; port: number; user: string };
+}
+
+export interface RemoteTrustInteraction {
+  confirm(host: string, port: number, keys: readonly SshHostKey[], role: "target" | "jump"): Promise<boolean>;
+}
+
+function storeKeys(path: string, keys: readonly SshHostKey[]): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  writeFileSync(path, mergeKnownHosts(existing, keys), { encoding: "utf8", mode: 0o600 });
+}
+
+async function scanDirect(host: string, port: number, root: string, signal?: AbortSignal): Promise<SshHostKey[]> {
+  const result = await runProcess("ssh-keyscan", ["-p", String(port), host], { cwd: root, signal, timeoutMs: CLOUD_RUNTIME_DEFAULTS.runner.hostKeyScanTimeoutMs });
+  if (result.code !== 0 || !result.stdout.trim()) throw new Error(`Unable to read SSH host keys for ${host}: ${truncateOutput(result.stderr || result.stdout)}`);
+  const keys = parseSshKeyscan(result.stdout);
+  if (keys.length === 0) throw new Error(`ssh-keyscan returned no valid OpenSSH host keys for ${host}`);
+  return keys;
+}
+
+export async function connectRemoteTarget(
+  request: RemoteConnectionRequest,
+  root: string,
+  interaction: RemoteTrustInteraction,
+  signal?: AbortSignal,
+): Promise<RemoteTargetProfile> {
+  if (!existsSync(request.keyPath)) throw new Error(`SSH private key does not exist: ${request.keyPath}`);
+  let targetKeys: SshHostKey[];
+  let jumpKeysToStore: SshHostKey[] = [];
+  if (request.proxyJump) {
+    const jumpKeys = await scanDirect(request.proxyJump.host, request.proxyJump.port, root, signal);
+    if (!await interaction.confirm(request.proxyJump.host, request.proxyJump.port, jumpKeys, "jump")) throw new Error("User declined the ProxyJump SSH host key");
+    jumpKeysToStore = jumpKeys;
+    const temporaryKnownHosts = `${request.knownHostsPath}.${process.pid}.${randomUUID()}.tmp`;
+    mkdirSync(dirname(temporaryKnownHosts), { recursive: true, mode: 0o700 });
+    const existing = existsSync(request.knownHostsPath) ? readFileSync(request.knownHostsPath, "utf8") : "";
+    writeFileSync(temporaryKnownHosts, mergeKnownHosts(existing, jumpKeys), { encoding: "utf8", mode: 0o600 });
+    const jumpProfile = validateRemoteTargetProfile({
+      ...request,
+      id: `${request.id}-jump`, name: `${request.name}-jump`, host: request.proxyJump.host,
+      port: request.proxyJump.port, user: request.proxyJump.user, hostKeyFingerprint: jumpKeys[0]!.fingerprint,
+      identityType: "ssh-only", proxyJump: undefined, knownHostsPath: temporaryKnownHosts,
+    });
+    try {
+      const scanned = await runSsh(jumpProfile, "ssh-keyscan", ["-p", String(request.port), request.host], { signal, remoteCwd: "", timeoutMs: CLOUD_RUNTIME_DEFAULTS.runner.hostKeyScanTimeoutMs });
+      if (scanned.code !== 0 || !scanned.stdout.trim()) throw new Error(`Unable to scan the private target through ProxyJump: ${truncateOutput(scanned.stderr || scanned.stdout)}`);
+      targetKeys = parseSshKeyscan(scanned.stdout);
+      if (targetKeys.length === 0) throw new Error("ProxyJump returned no valid target host keys");
+    } finally {
+      rmSync(temporaryKnownHosts, { force: true });
+    }
+  } else {
+    targetKeys = await scanDirect(request.host, request.port, root, signal);
+  }
+  if (!await interaction.confirm(request.host, request.port, targetKeys, "target")) throw new Error("User declined the target SSH host key");
+  if (jumpKeysToStore.length > 0) storeKeys(request.knownHostsPath, jumpKeysToStore);
+  storeKeys(request.knownHostsPath, targetKeys);
+  return validateRemoteTargetProfile({ ...request, hostKeyFingerprint: targetKeys[0]!.fingerprint });
+}

package/.pi/lib/workflows/cloud/remote/host-key.ts

@@ -0,0 +1,35 @@
+import { createHash } from "node:crypto";
+
+export interface SshHostKey {
+  line: string;
+  algorithm: string;
+  fingerprint: string;
+}
+
+export function parseSshKeyscan(output: string): SshHostKey[] {
+  const keys: SshHostKey[] = [];
+  const seen = new Set<string>();
+  for (const rawLine of output.split(/\r?\n/u)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const fields = line.split(/\s+/u);
+    if (fields.length < 3 || !/^ssh-|^ecdsa-/u.test(fields[1]!)) continue;
+    let decoded: Buffer;
+    try { decoded = Buffer.from(fields[2]!, "base64"); } catch { continue; }
+    if (decoded.length === 0 || decoded.toString("base64").replace(/=+$/u, "") !== fields[2]!.replace(/=+$/u, "")) continue;
+    const fingerprint = `SHA256:${createHash("sha256").update(decoded).digest("base64").replace(/=+$/u, "")}`;
+    if (seen.has(fingerprint)) continue;
+    seen.add(fingerprint);
+    keys.push({ line, algorithm: fields[1]!, fingerprint });
+  }
+  return keys.sort((left, right) => {
+    const rank = (algorithm: string) => algorithm === "ssh-ed25519" ? 0 : algorithm.startsWith("ecdsa-") ? 1 : 2;
+    return rank(left.algorithm) - rank(right.algorithm);
+  });
+}
+
+export function mergeKnownHosts(existing: string, scanned: readonly SshHostKey[]): string {
+  const lines = new Set(existing.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean));
+  for (const key of scanned) lines.add(key.line);
+  return `${[...lines].join("\n")}\n`;
+}

package/.pi/lib/workflows/cloud/remote/profiles.ts

@@ -0,0 +1,100 @@
+import { isAbsolute } from "node:path";
+
+import type { CloudVendorId } from "../providers.ts";
+
+export type RemoteIdentityType = "instance-role" | "agency" | "ssh-only";
+
+export interface RemoteTargetProfile {
+  id: string;
+  name: string;
+  vendor: CloudVendorId;
+  region: string;
+  host: string;
+  port: number;
+  user: string;
+  keyPath: string;
+  hostKeyFingerprint: string;
+  knownHostsPath: string;
+  remoteRoot: string;
+  identityType: RemoteIdentityType;
+  terraformPath?: string;
+  proxyJump?: {
+    host: string;
+    port: number;
+    user: string;
+  };
+}
+
+export interface RemoteTargetSummary {
+  id: string;
+  name: string;
+  vendor: CloudVendorId;
+  region: string;
+  host: string;
+  port: number;
+  user: string;
+  remoteRoot: string;
+  identityType: RemoteIdentityType;
+  hostKeyFingerprint: string;
+}
+
+function nonEmpty(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function validHost(value: unknown): value is string {
+  return nonEmpty(value) && !/[\s\0]/u.test(value);
+}
+
+export function validateRemoteTargetProfile(value: unknown): RemoteTargetProfile {
+  if (!value || typeof value !== "object") throw new Error("invalid remote target profile");
+  const data = value as Record<string, unknown>;
+  if (!nonEmpty(data.id) || !nonEmpty(data.name) || !nonEmpty(data.vendor)
+    || !nonEmpty(data.region) || !validHost(data.host) || !nonEmpty(data.user)
+    || !nonEmpty(data.keyPath) || !nonEmpty(data.hostKeyFingerprint)
+    || !nonEmpty(data.knownHostsPath) || !nonEmpty(data.remoteRoot)
+    || !isAbsolute(data.keyPath as string) || !isAbsolute(data.knownHostsPath as string)
+    || !isAbsolute(data.remoteRoot as string)
+    || !Number.isInteger(data.port) || (data.port as number) < 1 || (data.port as number) > 65_535
+    || !(["aws", "azure", "gcp", "huawei", "alibaba", "tencent"] as unknown[]).includes(data.vendor)
+    || !(["instance-role", "agency", "ssh-only"] as unknown[]).includes(data.identityType)) {
+    throw new Error("invalid remote target profile");
+  }
+  if ((data.remoteRoot as string) === "/") throw new Error("remote root cannot be filesystem root");
+  if (data.terraformPath !== undefined && !nonEmpty(data.terraformPath)) {
+    throw new Error("invalid terraform path");
+  }
+  let proxyJump: RemoteTargetProfile["proxyJump"];
+  if (data.proxyJump !== undefined) {
+    if (!data.proxyJump || typeof data.proxyJump !== "object") throw new Error("invalid SSH ProxyJump");
+    const jump = data.proxyJump as Record<string, unknown>;
+    if (!validHost(jump.host) || !nonEmpty(jump.user) || !Number.isInteger(jump.port)
+      || (jump.port as number) < 1 || (jump.port as number) > 65_535) throw new Error("invalid SSH ProxyJump");
+    proxyJump = { host: jump.host, port: jump.port as number, user: jump.user };
+  }
+  return {
+    id: data.id as string,
+    name: data.name as string,
+    vendor: data.vendor as CloudVendorId,
+    region: data.region as string,
+    host: data.host as string,
+    port: data.port as number,
+    user: data.user as string,
+    keyPath: data.keyPath as string,
+    hostKeyFingerprint: data.hostKeyFingerprint as string,
+    knownHostsPath: data.knownHostsPath as string,
+    remoteRoot: data.remoteRoot as string,
+    identityType: data.identityType as RemoteIdentityType,
+    terraformPath: data.terraformPath as string | undefined,
+    proxyJump,
+  };
+}
+
+export function remoteTargetSummary(profile: RemoteTargetProfile): RemoteTargetSummary {
+  const { keyPath: _keyPath, knownHostsPath: _knownHostsPath, terraformPath: _terraformPath, proxyJump: _proxyJump, ...summary } = profile;
+  return summary;
+}
+
+export function remoteTargetLabel(profile: RemoteTargetProfile): string {
+  return `${profile.name} · ${profile.vendor}/${profile.region} · ${profile.user}@${profile.host}:${profile.port}`;
+}

package/.pi/lib/workflows/cloud/remote/ssh-transport.ts

@@ -0,0 +1,104 @@
+import { spawn } from "node:child_process";
+
+import { shellQuote } from "../../../working-directory.ts";
+import { isolatedCloudEnvironment } from "../process.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../../runtime/defaults.ts";
+import type { RemoteTargetProfile } from "./profiles.ts";
+
+export interface SshRunResult {
+  stdout: string;
+  stderr: string;
+  code: number;
+  killed: boolean;
+  timedOut: boolean;
+}
+
+export interface SshRunOptions {
+  cwd?: string;
+  remoteCwd?: string;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  input?: string | Uint8Array;
+  onOutput?: (chunk: string, stream: "stdout" | "stderr") => void;
+}
+
+function remoteTarget(profile: RemoteTargetProfile): string {
+  return `${profile.user}@${profile.host}`;
+}
+
+export function buildSshArgs(profile: RemoteTargetProfile, command: string, args: readonly string[] = [], remoteCwd = profile.remoteRoot): string[] {
+  const remoteCommand = [
+    ...(remoteCwd ? [`cd ${shellQuote(remoteCwd)}`] : []),
+    [command, ...args].map(shellQuote).join(" "),
+  ].join(" && ");
+  const connection = [
+    "-T",
+    "-o", "BatchMode=yes",
+    "-o", "StrictHostKeyChecking=yes",
+    "-o", `UserKnownHostsFile=${profile.knownHostsPath}`,
+    "-o", `ConnectTimeout=${CLOUD_RUNTIME_DEFAULTS.runner.connectTimeoutSeconds}`,
+    ...(profile.proxyJump ? ["-J", `${profile.proxyJump.user}@${profile.proxyJump.host}:${profile.proxyJump.port}`] : []),
+    "-p", String(profile.port),
+    "-i", profile.keyPath,
+    remoteTarget(profile),
+    remoteCommand,
+  ];
+  return connection;
+}
+
+export function runSsh(
+  profile: RemoteTargetProfile,
+  command: string,
+  args: readonly string[] = [],
+  options: SshRunOptions = {},
+): Promise<SshRunResult> {
+  return new Promise((resolve) => {
+    const child = spawn("ssh", buildSshArgs(profile, command, args, options.remoteCwd), {
+      cwd: options.cwd,
+      env: isolatedCloudEnvironment(),
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: false,
+    });
+    let stdout = "";
+    let stderr = "";
+    let killed = false;
+    let timedOut = false;
+    let settled = false;
+    let forceKillTimer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      killed = true;
+      child.kill("SIGTERM");
+      forceKillTimer ??= setTimeout(() => child.kill("SIGKILL"), CLOUD_RUNTIME_DEFAULTS.process.forceKillGraceMs);
+    }, options.timeoutMs ?? CLOUD_RUNTIME_DEFAULTS.runner.commandTimeoutMs);
+    const abort = () => {
+      killed = true;
+      child.kill("SIGTERM");
+      forceKillTimer ??= setTimeout(() => child.kill("SIGKILL"), CLOUD_RUNTIME_DEFAULTS.process.forceKillGraceMs);
+    };
+    const finish = (code: number) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      if (forceKillTimer) clearTimeout(forceKillTimer);
+      options.signal?.removeEventListener("abort", abort);
+      resolve({ stdout, stderr, code, killed, timedOut });
+    };
+    if (options.signal?.aborted) abort();
+    else options.signal?.addEventListener("abort", abort, { once: true });
+    child.stdout.on("data", (chunk: Buffer) => {
+      const text = chunk.toString("utf8");
+      stdout += text;
+      options.onOutput?.(text, "stdout");
+    });
+    child.stderr.on("data", (chunk: Buffer) => {
+      const text = chunk.toString("utf8");
+      stderr += text;
+      options.onOutput?.(text, "stderr");
+    });
+    child.on("error", (error) => { stderr += error.message; finish(127); });
+    child.on("close", (code) => finish(code ?? 1));
+    if (options.input !== undefined) child.stdin.end(options.input);
+    else child.stdin.end();
+  });
+}

package/.pi/lib/workflows/cloud/remote/workspace.ts

@@ -0,0 +1,109 @@
+import { createHash, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
+import type { RemoteTargetProfile } from "./profiles.ts";
+import { runSsh, type SshRunResult } from "./ssh-transport.ts";
+
+const EXCLUDED_NAMES = new Set([".terraform", "terraform.tfstate", "terraform.tfstate.backup"]);
+const EXCLUDED_SUFFIXES = [".tfplan", ".tfstate", ".tfstate.backup", ".tfvars", ".tfvars.json"];
+
+export interface SyncFile {
+  relativePath: string;
+  bytes: number;
+  sha256: string;
+}
+
+export interface RemoteRunWorkspace {
+  runId: string;
+  remotePath: string;
+  sourceDigest: string;
+  files: SyncFile[];
+}
+
+function isExcluded(name: string): boolean {
+  return EXCLUDED_NAMES.has(name) || EXCLUDED_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+
+function collectFiles(root: string, directory: string, output: SyncFile[]): void {
+  for (const entry of readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+    if (isExcluded(entry.name)) continue;
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) collectFiles(root, path, output);
+    else if (entry.isSymbolicLink()) throw new Error(`Terraform source cannot contain symbolic links: ${relative(root, path)}`);
+    else if (entry.isFile()) {
+      const content = readFileSync(path);
+      const relativePath = relative(root, path).split(sep).join("/");
+      if (/[\r\n\0]/u.test(relativePath)) throw new Error(`Terraform source contains an unsupported file name: ${relativePath}`);
+      output.push({
+        relativePath,
+        bytes: content.byteLength,
+        sha256: createHash("sha256").update(content).digest("hex"),
+      });
+    }
+  }
+}
+
+export function createRemoteRunWorkspace(root: string, remoteRoot: string, runId = randomUUID()): RemoteRunWorkspace {
+  if (!isAbsolute(root) || !isAbsolute(remoteRoot) || remoteRoot === "/") throw new Error("absolute workspace roots are required");
+  const files: SyncFile[] = [];
+  collectFiles(root, root, files);
+  const sourceDigest = createHash("sha256")
+    .update(files.map((file) => `${file.relativePath}\0${file.sha256}`).join("\n"))
+    .digest("hex");
+  return { runId, remotePath: join(remoteRoot, "runs", runId), sourceDigest, files };
+}
+
+export function assertRemoteWorkspacePath(remoteRoot: string, remotePath: string): void {
+  const root = remoteRoot.endsWith(sep) ? remoteRoot : `${remoteRoot}${sep}`;
+  if (!isAbsolute(remotePath) || !(remotePath === remoteRoot || remotePath.startsWith(root))) {
+    throw new Error("remote workspace path is outside the configured runner root");
+  }
+}
+
+export function isTerraformSourceFile(path: string): boolean {
+  return path.endsWith(".tf") || path.endsWith(".tf.json") || path.endsWith(".hcl");
+}
+
+function createTarArchive(root: string, files: readonly SyncFile[], signal?: AbortSignal): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    const child = spawn("tar", [
+      "-czf", "-",
+      "-C", root, "--",
+      ...files.map((file) => file.relativePath),
+    ], { stdio: ["ignore", "pipe", "pipe"], shell: false });
+    const chunks: Buffer[] = [];
+    const errors: Buffer[] = [];
+    const abort = () => child.kill("SIGTERM");
+    signal?.addEventListener("abort", abort, { once: true });
+    child.stdout.on("data", (chunk: Buffer) => chunks.push(chunk));
+    child.stderr.on("data", (chunk: Buffer) => errors.push(chunk));
+    child.on("error", reject);
+    child.on("close", (code) => {
+      signal?.removeEventListener("abort", abort);
+      if (signal?.aborted) reject(new Error("Terraform source sync aborted"));
+      else if (code !== 0) reject(new Error(`cannot archive Terraform source: ${Buffer.concat(errors).toString("utf8")}`));
+      else resolve(Buffer.concat(chunks));
+    });
+  });
+}
+
+export async function syncRemoteWorkspace(
+  profile: RemoteTargetProfile,
+  sourceRoot: string,
+  workspace: RemoteRunWorkspace,
+  signal?: AbortSignal,
+): Promise<SshRunResult> {
+  assertRemoteWorkspacePath(profile.remoteRoot, workspace.remotePath);
+  const mkdir = await runSsh(profile, "mkdir", ["-p", workspace.remotePath], { signal, remoteCwd: "" });
+  if (mkdir.code !== 0) throw new Error(`cannot create remote Terraform workspace: ${mkdir.stderr.trim() || mkdir.code}`);
+  const archive = await createTarArchive(sourceRoot, workspace.files, signal);
+  const unpack = await runSsh(profile, "tar", ["-xzf", "-"], { signal, remoteCwd: workspace.remotePath, input: archive });
+  if (unpack.code !== 0) throw new Error(`cannot sync Terraform source: ${unpack.stderr.trim() || unpack.code}`);
+  const verified = await runSsh(profile, "sha256sum", workspace.files.map((file) => file.relativePath), { signal, remoteCwd: workspace.remotePath });
+  if (verified.code !== 0) throw new Error(`cannot verify remote Terraform source: ${verified.stderr.trim() || verified.code}`);
+  const actual = new Map(verified.stdout.split(/\r?\n/u).map((line) => line.match(/^([a-f0-9]{64})\s+\*?(.+)$/u)).filter((match): match is RegExpMatchArray => Boolean(match)).map((match) => [match[2]!, match[1]!]));
+  const mismatch = workspace.files.find((file) => actual.get(file.relativePath) !== file.sha256);
+  if (mismatch) throw new Error(`remote Terraform source digest mismatch: ${mismatch.relativePath}`);
+  return unpack;
+}

package/.pi/lib/{cloud → workflows/cloud}/template-save.ts

@@ -1,6 +1,7 @@
 import type { CloudPromptTemplate } from "./templates.ts";
 import { cloudPromptTemplateSource } from "./templates.ts";
-import type { CloudWorkflowDetails, WorkflowState } from "../workflows/state.ts";
+import type { CloudWorkflowDetails, WorkflowState } from "../state.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../runtime/defaults.ts";
 
 export type CloudTemplateSourceAction = "update" | "create" | "cancel";
 export type CloudTemplateSaveStage = "source-action" | "name" | "notes";
@@ -72,7 +73,7 @@ export async function saveCloudWorkflowTemplate(
     } else {
       const defaultName = details.sourceTemplate
         ? `${details.sourceTemplate.name} 副本`
-        : details.request.slice(0, 48);
+        : details.request.slice(0, CLOUD_RUNTIME_DEFAULTS.templates.slugMaxLength);
       name = (await interaction.inputName(defaultName))?.trim();
     }
     if (!name) return { status: "cancelled", stage: "name" };

package/.pi/lib/{cloud → workflows/cloud}/templates.ts

@@ -2,8 +2,10 @@ import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 
-import { getCloudProvider, isCloudVendorId, type CloudVendorId } from "../cloud-providers.ts";
-import type { CloudTemplateSource, WorkflowState } from "../workflows/state.ts";
+import { getCloudProvider, isCloudVendorId, type CloudVendorId } from "./providers.ts";
+import type { CloudTemplateSource, WorkflowState } from "../state.ts";
+import { legacyUserCloudTemplatePaths, userRuntimePaths } from "../../runtime/paths.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../runtime/defaults.ts";
 
 export interface CloudPromptTemplate {
   id: string;
@@ -25,11 +27,12 @@ export function cloudPromptTemplateSource(template: CloudPromptTemplate): CloudT
     name: template.name,
     createdAt: template.createdAt,
     updatedAt: template.updatedAt,
+    kind: "prompt",
   };
 }
 
 export function defaultCloudPromptDirectory(home = homedir()): string {
-  return join(home, ".hwcode", "cloud", "prompts");
+  return userRuntimePaths(home).cloudPromptTemplates;
 }
 
 function slugify(value: string): string {
@@ -38,7 +41,7 @@ function slugify(value: string): string {
     .toLowerCase()
     .replace(/[^a-z0-9]+/gu, "-")
     .replace(/^-+|-+$/gu, "")
-    .slice(0, 48);
+    .slice(0, CLOUD_RUNTIME_DEFAULTS.templates.slugMaxLength);
   return slug || `task-${new Date().toISOString().slice(0, 10)}`;
 }
 
@@ -66,7 +69,7 @@ function legacyTemplateName(id: string): string {
 }
 
 function cleanTemplateName(value: string): string {
-  return value.replace(/[\r\n]+/gu, " ").replace(/\s+/gu, " ").trim().slice(0, 80);
+  return value.replace(/[\r\n]+/gu, " ").replace(/\s+/gu, " ").trim().slice(0, CLOUD_RUNTIME_DEFAULTS.templates.nameMaxLength);
 }
 
 export function parseCloudPromptTemplate(path: string): CloudPromptTemplate | undefined {
@@ -97,12 +100,17 @@ export function parseCloudPromptTemplate(path: string): CloudPromptTemplate | un
 }
 
 export function listCloudPromptTemplates(
-  directory = defaultCloudPromptDirectory(),
+  directory?: string,
+  home = homedir(),
 ): CloudPromptTemplate[] {
-  if (!existsSync(directory)) return [];
-  return readdirSync(directory, { withFileTypes: true })
-    .filter((entry) => entry.isFile() && entry.name.endsWith(".md"))
-    .map((entry) => parseCloudPromptTemplate(join(directory, entry.name)))
+  const directories = directory
+    ? [directory]
+    : [...new Set([defaultCloudPromptDirectory(home), legacyUserCloudTemplatePaths(home).prompts])];
+  return directories
+    .filter(existsSync)
+    .flatMap((path) => readdirSync(path, { withFileTypes: true })
+      .filter((entry) => entry.isFile() && entry.name.endsWith(".md"))
+      .map((entry) => parseCloudPromptTemplate(join(path, entry.name))))
     .filter((template): template is CloudPromptTemplate => Boolean(template))
     .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt) || left.name.localeCompare(right.name));
 }

package/.pi/lib/workflows/cloud/terraform/plan.ts

@@ -0,0 +1,109 @@
+export type TerraformPlanAction = "no-op" | "read" | "create" | "update" | "delete" | "replace";
+
+export interface TerraformResourceChange {
+  address: string;
+  providerName?: string;
+  actions: TerraformPlanAction[];
+  sensitive: boolean;
+}
+
+export interface TerraformPlanSummary {
+  create: number;
+  update: number;
+  delete: number;
+  replace: number;
+  read: number;
+  noOp: number;
+  sensitiveChangesHidden: number;
+  resources: TerraformResourceChange[];
+}
+
+function classifyActions(actions: readonly string[]): TerraformPlanAction {
+  if (actions.includes("delete") && actions.includes("create")) return "replace";
+  if (actions.includes("create")) return "create";
+  if (actions.includes("update")) return "update";
+  if (actions.includes("delete")) return "delete";
+  if (actions.includes("read")) return "read";
+  return "no-op";
+}
+
+export function classifyTerraformPlan(value: unknown): TerraformPlanSummary {
+  if (!value || typeof value !== "object") throw new Error("invalid Terraform plan JSON");
+  const data = value as Record<string, unknown>;
+  if (!Array.isArray(data.resource_changes)) throw new Error("Terraform plan JSON has no resource_changes");
+  const resources: TerraformResourceChange[] = [];
+  for (const entry of data.resource_changes) {
+    if (!entry || typeof entry !== "object") continue;
+    const resource = entry as Record<string, unknown>;
+    if (typeof resource.address !== "string" || !resource.change || typeof resource.change !== "object") continue;
+    const change = resource.change as Record<string, unknown>;
+    if (!Array.isArray(change.actions) || change.actions.some((action) => typeof action !== "string")) continue;
+    const action = classifyActions(change.actions as string[]);
+    const sensitive = Boolean(change.after_sensitive) || Boolean(change.before_sensitive);
+    resources.push({
+      address: resource.address,
+      providerName: typeof resource.provider_name === "string" ? resource.provider_name : undefined,
+      actions: [action],
+      sensitive,
+    });
+  }
+  const summary: TerraformPlanSummary = {
+    create: resources.filter((resource) => resource.actions.includes("create") && !resource.actions.includes("replace")).length,
+    update: resources.filter((resource) => resource.actions.includes("update")).length,
+    delete: resources.filter((resource) => resource.actions.includes("delete")).length,
+    replace: resources.filter((resource) => resource.actions.includes("replace")).length,
+    read: resources.filter((resource) => resource.actions.includes("read")).length,
+    noOp: resources.filter((resource) => resource.actions.includes("no-op")).length,
+    sensitiveChangesHidden: resources.filter((resource) => resource.sensitive && !resource.actions.includes("no-op")).length,
+    resources,
+  };
+  return summary;
+}
+
+export function terraformPlanRequiresApproval(summary: TerraformPlanSummary): boolean {
+  return summary.create > 0 || summary.update > 0 || summary.delete > 0 || summary.replace > 0;
+}
+
+export function terraformPlanHasDeletion(summary: TerraformPlanSummary): boolean {
+  return summary.delete > 0 || summary.replace > 0;
+}
+
+export function terraformPlanSummaryText(summary: TerraformPlanSummary): string {
+  return [
+    `create=${summary.create}`,
+    `update=${summary.update}`,
+    `delete=${summary.delete}`,
+    `replace=${summary.replace}`,
+    `read=${summary.read}`,
+    `sensitive-hidden=${summary.sensitiveChangesHidden}`,
+  ].join(", ");
+}
+
+export interface TerraformStateSummary {
+  resourceCount: number;
+  resourceTypes: Record<string, number>;
+}
+
+export function summarizeTerraformState(value: unknown): TerraformStateSummary {
+  if (!value || typeof value !== "object") throw new Error("invalid Terraform state JSON");
+  const root = (value as Record<string, unknown>).values;
+  const rootModule = root && typeof root === "object" ? (root as Record<string, unknown>).root_module : undefined;
+  const resourceTypes: Record<string, number> = {};
+  let resourceCount = 0;
+  const visit = (module: unknown): void => {
+    if (!module || typeof module !== "object") return;
+    const data = module as Record<string, unknown>;
+    if (Array.isArray(data.resources)) {
+      for (const resource of data.resources) {
+        if (!resource || typeof resource !== "object") continue;
+        const type = (resource as Record<string, unknown>).type;
+        if (typeof type !== "string") continue;
+        resourceCount += 1;
+        resourceTypes[type] = (resourceTypes[type] ?? 0) + 1;
+      }
+    }
+    if (Array.isArray(data.child_modules)) for (const child of data.child_modules) visit(child);
+  };
+  visit(rootModule);
+  return { resourceCount, resourceTypes };
+}

package/.pi/lib/workflows/cloud/terraform/policy.ts

@@ -0,0 +1,36 @@
+export interface TerraformPolicyViolation {
+  code: "provisioner" | "external-data" | "unlocked-module" | "plain-secret" | "unsafe-backend";
+  file: string;
+  detail: string;
+}
+
+export interface TerraformPolicyOptions { requireRemoteBackend?: boolean }
+
+const PROVISIONER_PATTERN = /\bprovisioner\s+"(?:local-exec|remote-exec|file)"/u;
+const EXTERNAL_DATA_PATTERN = /data\s+"external"/u;
+const PLAIN_SECRET_PATTERN = /(?:access[_-]?key|secret[_-]?key|password|token)\s*=\s*"[^"$]+"/iu;
+const UNLOCKED_MODULE_PATTERN = /module\s+"[^"]+"\s*\{[\s\S]*?source\s*=\s*"(?![^"?]+\?ref=|[^"/]+\/[^"/]+\/[^"/]+\/v?\d)[^"}]+"/u;
+
+export function scanTerraformSource(files: readonly { relativePath: string; content: string }[], options: TerraformPolicyOptions = {}): TerraformPolicyViolation[] {
+  const violations: TerraformPolicyViolation[] = [];
+  for (const file of files) {
+    if (!file.relativePath.endsWith(".tf") && !file.relativePath.endsWith(".tf.json")) continue;
+    if (PROVISIONER_PATTERN.test(file.content)) violations.push({ code: "provisioner", file: file.relativePath, detail: "Terraform provisioners are disabled; use cloud-init or provider resources." });
+    if (EXTERNAL_DATA_PATTERN.test(file.content)) violations.push({ code: "external-data", file: file.relativePath, detail: "external data sources can execute arbitrary programs." });
+    if (PLAIN_SECRET_PATTERN.test(file.content)) violations.push({ code: "plain-secret", file: file.relativePath, detail: "credential-like literal detected in Terraform source." });
+    if (UNLOCKED_MODULE_PATTERN.test(file.content)) violations.push({ code: "unlocked-module", file: file.relativePath, detail: "module source must be version or commit pinned." });
+  }
+  if (options.requireRemoteBackend) {
+    const terraform = files.filter((file) => file.relativePath.endsWith(".tf") || file.relativePath.endsWith(".tf.json"));
+    const source = terraform.map((file) => file.content).join("\n");
+    const hasRemoteBackend = /backend\s+"(?!local")[^"]+"\s*\{/u.test(source)
+      || /"backend"\s*:\s*\{\s*"(?!local")[^"]+"\s*:/u.test(source);
+    if (!hasRemoteBackend) violations.push({ code: "unsafe-backend", file: "<terraform>", detail: "remote Runner execution requires an explicit non-local Terraform backend." });
+  }
+  return violations;
+}
+
+export function assertSafeTerraformSource(files: readonly { relativePath: string; content: string }[], options: TerraformPolicyOptions = {}): void {
+  const violations = scanTerraformSource(files, options);
+  if (violations.length > 0) throw new Error(violations.map((violation) => `${violation.file}: ${violation.detail}`).join("\n"));
+}