@lamplitisles/dsh-nanocodex 0.1.0-beta.0

package/vendor/nanocodex-tools/dist/shell.js

@@ -0,0 +1,553 @@
+import git, {} from "isomorphic-git";
+import { downloadRepositoryArchive } from "./repository-archive.js";
+const REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const GITHUB_REPOSITORY = /^https:\/\/github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/;
+/** gh compatibility command backed by the connected GitHub account. */
+export function createGhCommand(fetch, clone) {
+    return {
+        name: "gh",
+        trusted: true,
+        async execute(args, context = {}) {
+            const request = (url, options) => {
+                context.signal?.throwIfAborted();
+                return fetch(url, { ...options, signal: context.signal });
+            };
+            try {
+                context.signal?.throwIfAborted();
+                if (args[0] === "auth" && args[1] === "status") {
+                    const user = await github(request, "/user");
+                    return ok(`Logged in to github.com as ${text(user, "login")} through the connected account.\n`);
+                }
+                if (args[0] === "api") {
+                    const fields = apiFields(args);
+                    const explicitMethod = option(args, "--method", "-X");
+                    const method = (explicitMethod ?? (Object.keys(fields).length ? "POST" : "GET")).toUpperCase();
+                    const endpoint = positional(args.slice(1), [
+                        "--method", "-X", "-f", "-F", "--field", "--raw-field",
+                    ]);
+                    if (!endpoint)
+                        throw new Error("gh api requires an endpoint");
+                    let path = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+                    const hasFields = Object.keys(fields).length > 0;
+                    if (hasFields && (method === "GET" || method === "HEAD")) {
+                        const target = new URL(path, "https://api.github.com");
+                        for (const [name, value] of Object.entries(fields))
+                            target.searchParams.set(name, value);
+                        path = `${target.pathname}${target.search}`;
+                    }
+                    return ok(`${JSON.stringify(await github(request, path, {
+                        method,
+                        ...(hasFields && method !== "GET" && method !== "HEAD"
+                            ? { body: JSON.stringify(fields) }
+                            : {}),
+                    }), null, 2)}\n`);
+                }
+                if (args[0] === "repo" && args[1] === "view") {
+                    const repository = option(args.slice(2), "--repo", "-R")
+                        ?? args.slice(2).find((value) => !value.startsWith("-"));
+                    requireRepository(repository, "gh repo view requires OWNER/REPO");
+                    const repo = requireRecord(await github(request, `/repos/${repository}`), "repository");
+                    return ok([
+                        `name:\t${optionalText(repo, "full_name") ?? repository}`,
+                        `description:\t${optionalText(repo, "description") ?? ""}`,
+                        `url:\t${optionalText(repo, "html_url") ?? `https://github.com/${repository}`}`,
+                        "",
+                    ].join("\n"));
+                }
+                if (args[0] === "repo" && args[1] === "clone") {
+                    if (!clone)
+                        throw new Error("repository cloning is unavailable in this runtime");
+                    return clone(ghRepoCloneArguments(args.slice(2)), context);
+                }
+                if (args[0] === "repo" && args[1] === "list") {
+                    const owner = positional(args.slice(2), ["--limit", "-L"]);
+                    const perPage = limit(option(args.slice(2), "--limit", "-L"));
+                    const repositories = await github(request, `/user/repos?${new URLSearchParams({
+                        affiliation: "owner,collaborator,organization_member",
+                        per_page: "100",
+                        sort: "updated",
+                    })}`);
+                    if (!Array.isArray(repositories))
+                        throw new Error("GitHub returned an invalid repository list");
+                    const selected = repositories.filter((repository) => {
+                        if (!owner)
+                            return true;
+                        const record = requireRecord(repository, "repository");
+                        const repositoryOwner = requireRecord(record.owner, "repository owner");
+                        return optionalText(repositoryOwner, "login")?.toLowerCase() === owner.toLowerCase();
+                    }).slice(0, perPage);
+                    return ok(selected.map((repository) => {
+                        const record = requireRecord(repository, "repository");
+                        return [
+                            optionalText(record, "full_name") ?? "unknown",
+                            optionalText(record, "description") ?? "",
+                            record.private === true ? "private" : "public",
+                        ].join("\t");
+                    }).join("\n") + (selected.length ? "\n" : ""));
+                }
+                if (args[0] === "pr" && args[1] === "list") {
+                    const repository = option(args.slice(2), "--repo", "-R");
+                    requireRepository(repository, "gh pr list requires --repo OWNER/REPO");
+                    const pulls = await github(request, `/repos/${repository}/pulls?${new URLSearchParams({
+                        state: "open",
+                        per_page: String(limit(option(args.slice(2), "--limit", "-L"))),
+                    })}`);
+                    if (!Array.isArray(pulls))
+                        throw new Error("GitHub returned an invalid pull request list");
+                    return ok(pulls.map((pull) => {
+                        const row = requireRecord(pull, "pull request");
+                        const head = requireRecord(row.head, "pull request head");
+                        return [row.number, text(row, "title"), text(head, "ref")].join("\t");
+                    }).join("\n") + (pulls.length ? "\n" : ""));
+                }
+                return fail([
+                    "gh (Nanocodex Just Bash compatibility command)",
+                    "",
+                    "Supported commands:",
+                    "  gh auth status",
+                    "  gh api [--method METHOD] [-f key=value] ENDPOINT",
+                    "  gh repo list [OWNER] [--limit N]",
+                    "  gh repo clone OWNER/REPO [DIRECTORY] [-- GITFLAGS...]",
+                    "  gh repo view OWNER/REPO",
+                    "  gh pr list --repo OWNER/REPO [--limit N]",
+                    "",
+                    "Connected GitHub calls use the permissions granted in Profile.",
+                    "",
+                ].join("\n"));
+            }
+            catch (error) {
+                return fail(`gh: ${error instanceof Error ? error.message : String(error)}\n`);
+            }
+        },
+    };
+}
+function ghRepoCloneArguments(args) {
+    const separator = args.indexOf("--");
+    const commandArgs = separator === -1 ? args : args.slice(0, separator);
+    const gitArgs = separator === -1 ? [] : args.slice(separator + 1);
+    if (commandArgs.some((value) => value.startsWith("-"))) {
+        throw new Error("gh repo clone supports OWNER/REPO [DIRECTORY] [-- GITFLAGS...]");
+    }
+    if (commandArgs.length < 1 || commandArgs.length > 2) {
+        throw new Error("gh repo clone requires OWNER/REPO and an optional destination");
+    }
+    const repository = commandArgs[0];
+    requireRepository(repository, "gh repo clone requires OWNER/REPO");
+    return [
+        "clone",
+        ...gitArgs,
+        `https://github.com/${repository}.git`,
+        ...(commandArgs[1] === undefined ? [] : [commandArgs[1]]),
+    ];
+}
+/** Git compatibility command backed by durable storage and host-authorized GitHub downloads. */
+export function createGitCommand(fetch, workspace) {
+    return {
+        name: "git",
+        trusted: true,
+        async execute(args, context = {}) {
+            try {
+                const mounted = commandWorkspace(workspace(), context.signal);
+                const command = args[0];
+                if (command === "clone") {
+                    return ok(await cloneRepository(fetch, workspace(), args.slice(1), context));
+                }
+                const dir = await gitDirectory(mounted, context.cwd);
+                const fs = workspaceFs(mounted);
+                if (command === "status") {
+                    const matrix = await git.statusMatrix({ fs, dir });
+                    const changed = matrix.filter(([, head, workdir, stage]) => head !== workdir || head !== stage);
+                    if (args.includes("--short") || args.includes("-s") || args.includes("--porcelain")) {
+                        const lines = changed.flatMap(([path, head, workdir, stage]) => shortStatusCodes(head, workdir, stage).map((code) => `${code} ${path}`));
+                        return ok(lines.join("\n") + (lines.length ? "\n" : ""));
+                    }
+                    const branch = await git.currentBranch({ fs, dir, fullname: false });
+                    return ok(`On branch ${branch ?? "HEAD"}\n${changed.length ? `${changed.length} changed path(s)\n` : "nothing to commit, working tree clean\n"}`);
+                }
+                if (command === "log") {
+                    const depth = logDepth(args.slice(1));
+                    const commits = await git.log({ fs, dir, depth });
+                    if (args.includes("--oneline")) {
+                        return ok(commits.map(({ oid, commit }) => `${oid.slice(0, 7)} ${commit.message.split("\n")[0]}`).join("\n") + (commits.length ? "\n" : ""));
+                    }
+                    return ok(commits.map(({ oid, commit }) => [
+                        `commit ${oid}`,
+                        `Author: ${commit.author.name} <${commit.author.email}>`,
+                        `Date:   ${new Date(commit.author.timestamp * 1_000).toISOString()}`,
+                        "",
+                        `    ${commit.message.trim().replaceAll("\n", "\n    ")}`,
+                        "",
+                    ].join("\n")).join("\n"));
+                }
+                if (command === "rev-parse" && args[1] === "HEAD") {
+                    return ok(`${await git.resolveRef({ fs, dir, ref: "HEAD" })}\n`);
+                }
+                if (command === "branch" && (args.length === 1 || args.includes("--show-current"))) {
+                    const branch = await git.currentBranch({ fs, dir, fullname: false });
+                    return ok(args.includes("--show-current") ? `${branch ?? ""}\n` : `${branch ? `* ${branch}` : "* (detached HEAD)"}\n`);
+                }
+                if (command === "remote" && (args.length === 1 || args.includes("-v"))) {
+                    const remotes = await git.listRemotes({ fs, dir });
+                    return ok(remotes.flatMap(({ remote, url }) => args.includes("-v")
+                        ? [`${remote}\t${url} (fetch)`]
+                        : [remote]).join("\n") + (remotes.length ? "\n" : ""));
+                }
+                if (command === "ls-files") {
+                    const files = await git.listFiles({ fs, dir });
+                    return ok(`${files.join("\n")}${files.length ? "\n" : ""}`);
+                }
+                return fail([
+                    `git: '${command ?? ""}' is not implemented by managed git`,
+                    "Nanocodex git supports clone, status, log, rev-parse HEAD, branch, remote, and ls-files.",
+                    "",
+                ].join("\n"));
+            }
+            catch (error) {
+                return fail(`git: ${error instanceof Error ? error.message : String(error)}\n`);
+            }
+        },
+    };
+}
+function shortStatusCodes(head, workdir, stage) {
+    if (head === 0 && stage === 0)
+        return workdir === 0 ? [] : ["??"];
+    if (head === 1 && stage === 0)
+        return workdir === 0
+            ? ["D "]
+            : ["D ", "??"];
+    const index = head === 0 ? "A" : stage === head ? " " : "M";
+    const workingTree = workdir === stage ? " " : workdir === 0 ? "D" : "M";
+    return index === " " && workingTree === " " ? [] : [`${index}${workingTree}`];
+}
+async function gitDirectory(workspace, cwd) {
+    let directory = typeof cwd === "string" ? gitWorkspacePath(workspace, cwd) : workspace.root;
+    for (;;) {
+        if (await workspaceEntry(workspace, `${directory}/.git`))
+            return directory;
+        if (directory === workspace.root)
+            throw new Error("not a git repository");
+        directory = directory.slice(0, directory.lastIndexOf("/")) || workspace.root;
+    }
+}
+function logDepth(args) {
+    const compact = args.find((value) => /^-\d+$/.test(value));
+    const explicit = option(args, "--max-count", "-n") ?? joinedOption(args, "--max-count");
+    const value = explicit ?? compact?.slice(1);
+    if (value === undefined)
+        return 20;
+    const depth = positiveInteger(value, "log depth");
+    return depth;
+}
+async function cloneRepository(fetch, workspace, args, context) {
+    const { cwd, signal } = context;
+    const depthValue = option(args, "--depth", "-") ?? joinedOption(args, "--depth");
+    const depth = depthValue === undefined ? undefined : positiveInteger(depthValue, "--depth");
+    const branch = option(args, "--branch", "-b") ?? joinedOption(args, "--branch");
+    const positionals = gitPositionals(args);
+    const remote = positionals[0];
+    const match = remote?.match(GITHUB_REPOSITORY);
+    if (!match)
+        throw new Error("clone requires an https://github.com/OWNER/REPO URL");
+    if (branch !== undefined && (!branch || branch.startsWith("-") || branch.includes(".."))) {
+        throw new Error("--branch must name one branch or tag");
+    }
+    const repository = match[1];
+    const requestedDestination = positionals[1] ?? repository.slice(repository.indexOf("/") + 1);
+    const absoluteWorkspaceDestination = requestedDestination.startsWith(`${workspace.root}/`);
+    const destination = absoluteWorkspaceDestination
+        ? requestedDestination.slice(workspace.root.length + 1)
+        : requestedDestination;
+    if (!/^[A-Za-z0-9_.-]+$/.test(destination) || destination === "." || destination === "..") {
+        throw new Error("clone destination must be one workspace directory name");
+    }
+    const root = !absoluteWorkspaceDestination
+        && typeof cwd === "string" && cwd.startsWith(`${workspace.root}/`)
+        ? cwd
+        : workspace.root;
+    const dir = `${root}/${destination}`;
+    if (await workspaceEntry(workspace, dir))
+        throw new Error(`destination path '${destination}' already exists`);
+    try {
+        if (depth === undefined) {
+            await downloadRepositoryArchive(fetch, commandWorkspace(workspace, signal), repository, branch ?? "HEAD", dir, signal);
+            return `Downloaded source files into '${destination}' (no .git or history).\n`;
+        }
+        await git.clone({
+            fs: workspaceFs(commandWorkspace(workspace, signal)),
+            http: managedGitHttp(fetch, signal),
+            dir,
+            url: `https://github.com/${repository}.git`,
+            depth,
+            singleBranch: true,
+            ...(branch === undefined ? {} : { ref: branch }),
+        });
+    }
+    catch (error) {
+        if (await workspaceEntry(workspace, dir)) {
+            await workspace.remove(dir, { recursive: true });
+        }
+        throw error;
+    }
+    return `Cloning into '${destination}'...\n`;
+}
+function managedGitHttp(fetch, signal) {
+    return {
+        async request(request) {
+            signal?.throwIfAborted();
+            const body = request.body === undefined
+                ? undefined
+                : await collectGitBody(request.body);
+            const response = await (fetch.stream ?? fetch)(request.url, {
+                method: request.method,
+                headers: request.headers,
+                body,
+                signal: signal ?? (request.signal instanceof AbortSignal ? request.signal : undefined),
+            });
+            return {
+                url: response.url,
+                statusCode: response.status,
+                statusMessage: response.statusText,
+                headers: response.headers,
+                body: (async function* () {
+                    if (response.body instanceof Uint8Array)
+                        yield response.body;
+                    else
+                        yield* response.body;
+                })(),
+            };
+        },
+    };
+}
+async function collectGitBody(body) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of body) {
+        size += chunk.byteLength;
+        chunks.push(chunk);
+    }
+    const joined = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return joined;
+}
+function workspaceFs(workspace) {
+    const resolve = (path) => gitWorkspacePath(workspace, path);
+    const promises = {
+        readFile: async (path, options) => {
+            const contents = await workspace.readFile(resolve(path));
+            const encoding = typeof options === "string" ? options : options?.encoding;
+            return encoding ? new TextDecoder(encoding).decode(contents) : contents;
+        },
+        writeFile: async (path, contents) => workspace.writeFile(resolve(path), contents),
+        unlink: async (path) => workspace.remove(resolve(path)),
+        readdir: async (path) => (await workspace.list(resolve(path)))
+            .map(({ path: child }) => child.slice(child.lastIndexOf("/") + 1)),
+        mkdir: async (path, options) => {
+            path = resolve(path);
+            if (options?.recursive) {
+                const relative = path.startsWith(workspace.root) ? path.slice(workspace.root.length) : path;
+                let current = workspace.root;
+                for (const segment of relative.split("/").filter(Boolean)) {
+                    current += `/${segment}`;
+                    if (!(await workspaceEntry(workspace, current)))
+                        await workspace.mkdir(current);
+                }
+            }
+            else {
+                await workspace.mkdir(path);
+            }
+        },
+        rmdir: async (path) => workspace.remove(resolve(path)),
+        stat: async (path) => gitStat(await requiredWorkspaceEntry(workspace, resolve(path))),
+        lstat: async (path) => gitStat(await requiredWorkspaceEntry(workspace, resolve(path))),
+        readlink: async () => { throw Object.assign(new Error("symbolic links are unavailable"), { code: "EINVAL" }); },
+        symlink: async () => { throw Object.assign(new Error("symbolic links are unavailable"), { code: "ENOSYS" }); },
+        chmod: async (path) => { await requiredWorkspaceEntry(workspace, resolve(path)); },
+    };
+    return { promises };
+}
+function commandWorkspace(workspace, signal) {
+    return {
+        root: workspace.root,
+        list: (...args) => { signal?.throwIfAborted(); return workspace.list(...args); },
+        readFile: (...args) => { signal?.throwIfAborted(); return workspace.readFile(...args); },
+        writeFile: (...args) => { signal?.throwIfAborted(); return workspace.writeFile(...args); },
+        mkdir: (...args) => { signal?.throwIfAborted(); return workspace.mkdir(...args); },
+        remove: (...args) => { signal?.throwIfAborted(); return workspace.remove(...args); },
+    };
+}
+function gitWorkspacePath(workspace, path) {
+    const source = path.startsWith("/") ? path : `${workspace.root}/${path}`;
+    const segments = [];
+    for (const segment of source.split("/")) {
+        if (!segment || segment === ".")
+            continue;
+        if (segment === "..")
+            segments.pop();
+        else
+            segments.push(segment);
+    }
+    const resolved = `/${segments.join("/")}`;
+    if (resolved !== workspace.root && !resolved.startsWith(`${workspace.root}/`)) {
+        throw Object.assign(new Error(`path escapes ${workspace.root}`), { code: "EPERM" });
+    }
+    return resolved;
+}
+async function workspaceEntry(workspace, path) {
+    if (path === workspace.root)
+        return { kind: "directory", path };
+    const separator = path.lastIndexOf("/");
+    const parent = path.slice(0, separator) || workspace.root;
+    const target = path.slice(separator + 1);
+    try {
+        return (await workspace.list(parent))
+            .find((entry) => entry.path === target || entry.path.endsWith(`/${target}`));
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+async function requiredWorkspaceEntry(workspace, path) {
+    const entry = await workspaceEntry(workspace, path);
+    if (entry)
+        return entry;
+    throw Object.assign(new Error(`${path} does not exist`), { code: "ENOENT" });
+}
+function gitStat(entry) {
+    const modified = new Date(entry.modifiedAt ?? 0);
+    return {
+        isFile: () => entry.kind === "file",
+        isDirectory: () => entry.kind === "directory",
+        isSymbolicLink: () => false,
+        mode: entry.kind === "directory" ? 0o755 : 0o644,
+        size: entry.size ?? 0,
+        mtime: modified,
+        ctime: modified,
+        birthtime: modified,
+        dev: 0,
+        ino: 0,
+        uid: 0,
+        gid: 0,
+    };
+}
+function gitPositionals(args) {
+    const positionals = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (value === "--depth" || value === "--branch" || value === "-b") {
+            index += 1;
+            continue;
+        }
+        if (value.startsWith("--depth=") || value.startsWith("--branch="))
+            continue;
+        if (value.startsWith("-"))
+            throw new Error(`unsupported clone option '${value}'`);
+        positionals.push(value);
+    }
+    if (positionals.length < 1 || positionals.length > 2)
+        throw new Error("clone requires a repository URL and optional destination");
+    return positionals;
+}
+function joinedOption(args, name) {
+    return args.find((value) => value.startsWith(`${name}=`))?.slice(name.length + 1);
+}
+function positiveInteger(value, name) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1)
+        throw new Error(`${name} must be a positive integer`);
+    return parsed;
+}
+async function github(fetch, path, options = {}) {
+    const url = new URL(path, "https://api.github.com");
+    if (url.origin !== "https://api.github.com")
+        throw new Error("endpoint is outside api.github.com");
+    const response = await fetch(url.href, {
+        method: options.method,
+        headers: {
+            accept: "application/vnd.github+json",
+            ...(options.body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        body: options.body,
+    });
+    const raw = new TextDecoder().decode(response.body);
+    let value;
+    try {
+        value = raw ? JSON.parse(raw) : null;
+    }
+    catch {
+        throw new Error(`GitHub returned invalid JSON (HTTP ${response.status})`);
+    }
+    if (response.status < 200 || response.status >= 300) {
+        const detail = value && typeof value === "object"
+            ? optionalText(value, "message")
+                ?? optionalText(value, "error")
+            : undefined;
+        throw new Error(`GitHub request failed (HTTP ${response.status}${detail ? `: ${detail}` : ""})`);
+    }
+    return value;
+}
+function apiFields(args) {
+    const fields = Object.create(null);
+    for (let index = 0; index < args.length; index += 1) {
+        if (!["-f", "-F", "--field", "--raw-field"].includes(args[index]))
+            continue;
+        const field = args[index + 1];
+        const separator = field?.indexOf("=") ?? -1;
+        if (!field || separator <= 0)
+            throw new Error(`${args[index]} requires key=value`);
+        fields[field.slice(0, separator)] = field.slice(separator + 1);
+        index += 1;
+    }
+    return fields;
+}
+function option(args, long, short) {
+    const index = args.findIndex((value) => value === long || value === short);
+    return index === -1 ? undefined : args[index + 1];
+}
+function positional(args, optionsWithValues) {
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (optionsWithValues.includes(value)) {
+            index += 1;
+            continue;
+        }
+        if (!value.startsWith("-"))
+            return value;
+    }
+    return undefined;
+}
+function limit(value) {
+    if (value === undefined)
+        return 30;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 100) {
+        throw new Error("--limit must be an integer from 1 to 100");
+    }
+    return parsed;
+}
+function requireRepository(value, message) {
+    if (!value || !REPOSITORY.test(value))
+        throw new Error(message);
+}
+function requireRecord(value, name) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`GitHub returned an invalid ${name}`);
+    }
+    return value;
+}
+function text(value, key) {
+    const field = requireRecord(value, "response")[key];
+    if (typeof field !== "string")
+        throw new Error(`GitHub response is missing ${key}`);
+    return field;
+}
+function optionalText(value, key) {
+    return typeof value[key] === "string" ? value[key] : undefined;
+}
+function ok(stdout) { return { stdout, stderr: "", exitCode: 0 }; }
+function fail(stderr) { return { stdout: "", stderr, exitCode: 1 }; }

package/vendor/nanocodex-tools/dist/ssh.d.ts

@@ -0,0 +1,29 @@
+import { type SshCommandResult, type SshIdentityReferenceRequest } from "../tools/ssh.mjs";
+import type { Workspace } from "../tools/types.mjs";
+export type SshSocket = Readonly<{
+    readable: ReadableStream<Uint8Array>;
+    writable: WritableStream<Uint8Array>;
+    opened: Promise<unknown>;
+    closed: Promise<void>;
+    close(): Promise<void>;
+}>;
+export type SshConnect = (address: Readonly<{
+    hostname: string;
+    port: number;
+}>, options: Readonly<{
+    allowHalfOpen: boolean;
+    secureTransport: "off";
+}>) => SshSocket;
+/** Creates a workspace-backed SSH command over an injected Web Streams socket transport. */
+export declare function createWorkspaceSshCommand(options: Readonly<{
+    connect: SshConnect;
+    filesystem(): Workspace;
+    resolvePassword?(reference: string): Promise<string>;
+    executeWithIdentityReference?(request: SshIdentityReferenceRequest, context: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<SshCommandResult>;
+}>): Readonly<{
+    name: "ssh";
+    trusted?: boolean;
+    execute(args: string[], context: unknown): Promise<SshCommandResult>;
+}>;

package/vendor/nanocodex-tools/dist/ssh.js

@@ -0,0 +1,66 @@
+import { createSshCommand, createWebStreamSshStream, } from "../tools/ssh.mjs";
+/** Creates a workspace-backed SSH command over an injected Web Streams socket transport. */
+export function createWorkspaceSshCommand(options) {
+    return createSshCommand({
+        transport: "tcp",
+        maxOutputBytes: 4 * 1024 * 1024,
+        readIdentity: async (path, context) => new TextDecoder().decode(await options.filesystem().readFile(resolveWorkspacePath(options.filesystem().root, context.cwd, path))),
+        ...(options.resolvePassword === undefined
+            ? {}
+            : { resolvePassword: options.resolvePassword }),
+        ...(options.executeWithIdentityReference === undefined
+            ? {}
+            : { executeWithIdentityReference: options.executeWithIdentityReference }),
+        async openStream(endpoint, signal) {
+            if (endpoint instanceof URL)
+                throw new Error("TCP SSH requires a host and port");
+            const socket = options.connect(endpoint, { allowHalfOpen: true, secureTransport: "off" });
+            try {
+                await abortable(socket.opened, signal);
+                return createWebStreamSshStream(socket, signal);
+            }
+            catch (error) {
+                await socket.close();
+                throw error;
+            }
+        },
+    });
+}
+function resolveWorkspacePath(root, cwd, path) {
+    const absolute = path.startsWith("/");
+    if (absolute && path !== root && !path.startsWith(`${root}/`)) {
+        throw new Error(`SSH identity path must stay within ${root}`);
+    }
+    const parts = absolute ? [] : relativeParts(root, cwd);
+    const input = absolute ? path.slice(root.length) : path;
+    for (const part of input.split("/")) {
+        if (!part || part === ".")
+            continue;
+        if (part === "..") {
+            if (parts.length === 0)
+                throw new Error(`SSH identity path escapes ${root}`);
+            parts.pop();
+        }
+        else
+            parts.push(part);
+    }
+    return parts.length === 0 ? root : `${root}/${parts.join("/")}`;
+}
+function relativeParts(root, path) {
+    if (path === root)
+        return [];
+    if (!path.startsWith(`${root}/`))
+        throw new Error(`SSH cwd must stay within ${root}`);
+    return path.slice(root.length + 1).split("/").filter(Boolean);
+}
+function abortable(promise, signal) {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(signal.reason ?? new Error("SSH command cancelled"));
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason ?? new Error("SSH command cancelled"));
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then((value) => { signal.removeEventListener("abort", abort); resolve(value); }, (error) => { signal.removeEventListener("abort", abort); reject(error); });
+    });
+}