@lifeaitools/clauth 1.30.26 → 2.0.0

package/cli/commands/login.js

@@ -0,0 +1,135 @@
+// cli/commands/login.js
+// clauth login <target> — the GLOBAL LOGIN DIRECTIVE.
+//
+// WHY THIS EXISTS
+// Before this command, "log into Vultr" meant an agent or human fetching a
+// raw private key from the vault (curl .../v/vultr-dev-ssh) and hand-rolling
+// an ssh-agent + ssh invocation per caller. That is exactly the failure mode
+// this closes: one canonical, zero-friction verb for every clauth-managed box
+// login, so nobody re-derives (or gets wrong) the key-handling dance. It does
+// NOT reimplement that dance — services/ssh-clauth.sh and .ps1 already carry
+// hard-won fixes (CRLF stripping, Windows-OpenSSH-vs-Git-ssh binary
+// resolution, ephemeral key cleanup) documented in lifeai-env's lessons.
+// This command only resolves a friendly target name and delegates to them.
+//
+// Add a new box by adding an entry to LOGIN_TARGETS — never by hand-fetching
+// its key elsewhere.
+
+import { spawn, spawnSync } from "node:child_process";
+import path from "node:path";
+
+export const LOGIN_TARGETS = {
+  vultr: {
+    service: "vultr-dev-ssh",
+    host: "root@64.237.54.189",
+    label: "Vultr dev box (PM2 apps, port 64.237.54.189)",
+  },
+};
+
+export function resolveEnvRoot(env = process.env) {
+  return env.LIFEAI_ENV || "C:/Dev/lifeai-env";
+}
+
+function bashCandidates(platform) {
+  return platform === "win32"
+    ? ["C:\\Program Files\\Git\\bin\\bash.exe", "bash"]
+    : ["bash"];
+}
+
+export function findBash(platform = process.platform, probe = spawnSync) {
+  for (const candidate of bashCandidates(platform)) {
+    try {
+      const result = probe(candidate, ["--version"], { stdio: "ignore" });
+      if (result && result.status === 0) return candidate;
+    } catch {
+      // try next candidate
+    }
+  }
+  return "bash";
+}
+
+export function listTargets() {
+  return Object.entries(LOGIN_TARGETS).map(([name, target]) => ({ name, ...target }));
+}
+
+/**
+ * Pure resolver: target name + options -> {bin, args, env}. Kept separate
+ * from process spawning so the routing logic is testable without touching a
+ * real shell, ssh-agent, or the network.
+ */
+export function resolveInvocation(targetName, opts = {}, ctx = {}) {
+  const target = LOGIN_TARGETS[targetName];
+  if (!target) {
+    const known = Object.keys(LOGIN_TARGETS).join(", ");
+    throw new Error(`Unknown login target "${targetName}". Known targets: ${known}`);
+  }
+
+  const platform = ctx.platform || process.platform;
+  const envRoot = resolveEnvRoot(ctx.env || process.env);
+  const host = opts.host || target.host;
+
+  const useNativeWindows = Boolean(opts.nativeWindows) && platform === "win32";
+  // The bash engine always gets a forward-slash path — it is fed to bash
+  // (Git Bash on Windows, or real bash elsewhere), never a native Windows API,
+  // so path.join's backslash normalization on a Windows host would be wrong.
+  const engine = useNativeWindows
+    ? path.join(envRoot, "services", "ssh-clauth.ps1")
+    : `${envRoot.replace(/[\\/]+$/, "")}/services/ssh-clauth.sh`;
+
+  const bin = useNativeWindows ? "pwsh" : (ctx.findBash || findBash)(platform);
+  const args = useNativeWindows
+    ? [
+        "-NoProfile", "-File", engine,
+        "-Service", target.service,
+        "-Target", host,
+        ...(opts.command ? ["-Command", opts.command] : []),
+      ]
+    : [engine, opts.command || "", host];
+
+  return {
+    bin,
+    args,
+    env: { ...(ctx.env || process.env), SSH_CLAUTH_SERVICE: target.service },
+  };
+}
+
+export function printTargetList(log = console.log) {
+  log("\nKnown login targets (clauth login <target>):\n");
+  for (const t of listTargets()) {
+    log(`  ${t.name.padEnd(12)} ${t.host.padEnd(22)} ${t.label}`);
+  }
+  log("\nUsage:");
+  log("  clauth login vultr                    interactive shell");
+  log("  clauth login vultr -c \"pm2 list\"      run one command");
+  log("  clauth login vultr --host user@1.2.3.4  override the target host\n");
+}
+
+export async function runLogin(targetName, opts = {}) {
+  if (!targetName) {
+    printTargetList();
+    return;
+  }
+
+  let invocation;
+  try {
+    invocation = resolveInvocation(targetName, opts);
+  } catch (err) {
+    console.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+
+  const child = spawn(invocation.bin, invocation.args, {
+    stdio: "inherit",
+    env: invocation.env,
+  });
+
+  const code = await new Promise((resolve) => {
+    child.on("exit", (c) => resolve(c ?? 1));
+    child.on("error", (err) => {
+      console.error(`clauth login: failed to launch ${invocation.bin}: ${err.message}`);
+      resolve(1);
+    });
+  });
+  process.exitCode = code;
+}

package/cli/commands/login.test.js

@@ -0,0 +1,73 @@
+// node --test cli/commands/login.test.js
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { LOGIN_TARGETS, listTargets, resolveEnvRoot, resolveInvocation } from "./login.js";
+
+test("listTargets exposes vultr with its clauth service + default host", () => {
+  const targets = listTargets();
+  const vultr = targets.find((t) => t.name === "vultr");
+  assert.ok(vultr, "vultr target must be registered");
+  assert.equal(vultr.service, "vultr-dev-ssh");
+  assert.equal(vultr.host, "root@64.237.54.189");
+});
+
+test("resolveEnvRoot honors LIFEAI_ENV and falls back to the documented default", () => {
+  assert.equal(resolveEnvRoot({ LIFEAI_ENV: "D:/custom-env" }), "D:/custom-env");
+  assert.equal(resolveEnvRoot({}), "C:/Dev/lifeai-env");
+});
+
+test("resolveInvocation rejects an unknown target instead of guessing", () => {
+  assert.throws(() => resolveInvocation("not-a-real-box"), /Unknown login target/);
+});
+
+test("resolveInvocation on posix delegates to the bash ssh-clauth engine, never fetches a key itself", () => {
+  const inv = resolveInvocation("vultr", {}, {
+    platform: "linux",
+    env: { LIFEAI_ENV: "/opt/lifeai-env" },
+    findBash: () => "bash",
+  });
+  assert.equal(inv.bin, "bash");
+  assert.equal(inv.args[0], "/opt/lifeai-env/services/ssh-clauth.sh");
+  assert.equal(inv.args[2], "root@64.237.54.189");
+  assert.equal(inv.env.SSH_CLAUTH_SERVICE, "vultr-dev-ssh");
+});
+
+test("resolveInvocation passes a one-shot command through as $1 to ssh-clauth.sh", () => {
+  const inv = resolveInvocation("vultr", { command: "pm2 list --no-color" }, {
+    platform: "linux",
+    env: {},
+    findBash: () => "bash",
+  });
+  assert.equal(inv.args[1], "pm2 list --no-color");
+});
+
+test("resolveInvocation honors --host override without touching the target registry", () => {
+  const inv = resolveInvocation("vultr", { host: "root@10.0.0.9" }, {
+    platform: "linux",
+    env: {},
+    findBash: () => "bash",
+  });
+  assert.equal(inv.args[2], "root@10.0.0.9");
+  assert.equal(LOGIN_TARGETS.vultr.host, "root@64.237.54.189", "registry default must stay untouched");
+});
+
+test("resolveInvocation defaults to the Bash engine on Windows too (the ps1 engine self-blocks agent sessions)", () => {
+  const inv = resolveInvocation("vultr", {}, {
+    platform: "win32",
+    env: {},
+    findBash: () => "C:\\Program Files\\Git\\bin\\bash.exe",
+  });
+  assert.equal(inv.bin, "C:\\Program Files\\Git\\bin\\bash.exe");
+  assert.match(inv.args[0], /ssh-clauth\.sh$/);
+});
+
+test("resolveInvocation only switches to the native Windows engine when explicitly requested", () => {
+  const inv = resolveInvocation("vultr", { nativeWindows: true }, {
+    platform: "win32",
+    env: { LIFEAI_ENV: "C:/Dev/lifeai-env" },
+  });
+  assert.equal(inv.bin, "pwsh");
+  assert.match(inv.args[2], /ssh-clauth\.ps1$/);
+  assert.deepEqual(inv.args.slice(3, 5), ["-Service", "vultr-dev-ssh"]);
+});