@hyperfixation/cli 0.1.1 → 0.1.3

package/dist/runner.d.ts

@@ -22,8 +22,13 @@ export interface Tunnel {
  */
 export interface Runner {
     exec(command: readonly string[], options?: ExecOptions): Promise<ExecResult>;
-    /** Forwards a local port to `127.0.0.1:<remotePort>` on the far side. */
-    tunnel(remotePort: number): Promise<Tunnel>;
+    /**
+     * Forwards a local port to `<remoteHost>:<remotePort>` as the far side sees it.
+     *
+     * `remoteHost` defaults to the far side's own loopback; it is an address on a network the far
+     * side can route to, which is how a container that publishes nothing is still reachable.
+     */
+    tunnel(remotePort: number, remoteHost?: string): Promise<Tunnel>;
 }
 export declare class RunnerError extends Error {
     constructor(message: string, options?: {
@@ -32,7 +37,9 @@ export declare class RunnerError extends Error {
 }
 /** The argv `exec` runs, `ssh` excluded — the array the test asserts against. */
 export declare function sshExecArgv(host: string, command: readonly string[]): string[];
-export declare function sshTunnelArgv(host: string, localPort: number, remotePort: number): string[];
+export declare function sshTunnelArgv(host: string, localPort: number, remotePort: number, remoteHost?: string): string[];
+/** Where a forward lands when the caller names no host: the far side's own loopback. */
+export declare const TUNNEL_LOOPBACK = "127.0.0.1";
 /** Single-quotes one word for a POSIX remote shell. */
 export declare function shellQuote(command: readonly string[]): string;
 export interface SshRunnerOptions {

package/dist/runner.js

@@ -37,17 +37,20 @@ export function sshExecArgv(host, command) {
     // re-quoted for that shell; nothing else in this file ever builds a shell word.
     return ["-T", ...SSH_OPTIONS, host, shellQuote(command)];
 }
-export function sshTunnelArgv(host, localPort, remotePort) {
+export function sshTunnelArgv(host, localPort, remotePort, remoteHost = TUNNEL_LOOPBACK) {
     assertHost(host);
+    assertTunnelHost(remoteHost);
     return [
         "-N",
         "-T",
         ...SSH_OPTIONS,
         "-L",
-        `${String(localPort)}:127.0.0.1:${String(remotePort)}`,
+        `${String(localPort)}:${remoteHost}:${String(remotePort)}`,
         host,
     ];
 }
+/** Where a forward lands when the caller names no host: the far side's own loopback. */
+export const TUNNEL_LOOPBACK = "127.0.0.1";
 /** Single-quotes one word for a POSIX remote shell. */
 export function shellQuote(command) {
     return command.map((word) => `'${word.replaceAll("'", `'\\''`)}'`).join(" ");
@@ -59,9 +62,9 @@ export function createSshRunner(options) {
     assertHost(options.host);
     return {
         exec: async (command, execOptions) => await spawnCollecting(ssh, sshExecArgv(options.host, command), execOptions),
-        tunnel: async (remotePort) => {
+        tunnel: async (remotePort, remoteHost = TUNNEL_LOOPBACK) => {
             const localPort = await freeLocalPort();
-            const child = spawn(ssh, sshTunnelArgv(options.host, localPort, remotePort), {
+            const child = spawn(ssh, sshTunnelArgv(options.host, localPort, remotePort, remoteHost), {
                 stdio: ["ignore", "ignore", "pipe"],
             });
             let stderr = "";
@@ -75,7 +78,7 @@ export function createSshRunner(options) {
             catch (cause) {
                 child.kill("SIGTERM");
                 await exited;
-                throw new RunnerError(`ssh -L ${String(localPort)}:127.0.0.1:${String(remotePort)} never became ready` +
+                throw new RunnerError(`ssh -L ${String(localPort)}:${remoteHost}:${String(remotePort)} never became ready` +
                     (stderr === "" ? "" : `: ${stderr.trim()}`), { cause });
             }
             return {
@@ -131,14 +134,20 @@ async function spawnCollecting(bin, args, options = {}) {
     child.stderr?.on("data", (chunk) => {
         stderr += chunk.toString("utf8");
     });
-    // A child that exits before reading its stdin (`true`, a refused ssh) makes the write fail with
-    // EPIPE; the exit code already says what happened, so it must not surface as an unhandled error.
-    child.stdin?.on("error", () => { });
-    child.stdin?.end(options.input ?? "");
-    const code = await new Promise((resolve, reject) => {
+    const closed = new Promise((resolve, reject) => {
+        // A child that exits before reading its stdin (`true`, a refused ssh) makes the write fail with
+        // EPIPE; the exit code already says what happened. Any other stdin error is a real failure.
+        child.stdin?.on("error", (error) => {
+            if (error.code === "EPIPE")
+                return;
+            child.kill();
+            reject(error);
+        });
         child.once("error", reject);
         child.once("close", (exitCode) => resolve(exitCode));
     });
+    child.stdin?.end(options.input ?? "");
+    const code = await closed;
     return { code, stdout, stderr };
 }
 /**
@@ -192,6 +201,19 @@ async function canConnect(port) {
         socket.once("timeout", () => done(false));
     });
 }
+/**
+ * The far-side end of a `-L` forward, which is a bare address or hostname and nothing else.
+ *
+ * It arrives from `docker inspect` on the box rather than from the operator, and `-L` takes its
+ * three fields colon-separated, so a value carrying a colon or a space would silently become a
+ * different forward than the one asked for.
+ */
+function assertTunnelHost(remoteHost) {
+    if (!TUNNEL_HOST.test(remoteHost)) {
+        throw new RunnerError(`a tunnel's remote host must match ${TUNNEL_HOST.source}, got ${JSON.stringify(remoteHost)}`);
+    }
+}
+const TUNNEL_HOST = /^[A-Za-z0-9._-]+$/;
 function assertHost(host) {
     if (!SSH_HOST.test(host)) {
         throw new RunnerError(`HF_SSH_HOST must match ${SSH_HOST.source}, got ${JSON.stringify(host)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperfixation/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "license": "MIT",
   "description": "The hf binary and its Turborepo generator templates",
   "repository": {
@@ -29,15 +29,15 @@
     "!dist/test-support/**"
   ],
   "dependencies": {
-    "@hyperfixation/auth": "0.1.1",
-    "@hyperfixation/core": "0.1.1",
-    "@hyperfixation/db": "0.1.1",
+    "@hyperfixation/auth": "0.1.3",
+    "@hyperfixation/core": "0.1.3",
+    "@hyperfixation/db": "0.1.3",
     "giget": "3.3.1",
     "pg": "^8.23.0"
   },
   "devDependencies": {
-    "@hyperfixation/eslint-config": "0.1.1",
-    "@hyperfixation/testing": "0.1.1",
+    "@hyperfixation/eslint-config": "0.1.3",
+    "@hyperfixation/testing": "0.1.3",
     "@microsoft/api-extractor": "^7.59.1",
     "@types/pg": "^8.23.1",
     "eslint": "^10.10.0",