@moondeck/station 0.0.0-stage → 1.0.0

package/lib/env.ts

@@ -0,0 +1,195 @@
+/**
+ * Host-agent env access. Runtime state lives in host.sqlite on the host
+ * machine; cloud metadata arrives over the host protocol.
+ */
+
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { z } from "zod";
+
+import { STATION } from "../src/station-identity";
+
+const schema = z.object({
+  // Base dir for mutable host state (.env.local + the data dir). See the
+  // resolution of `uaiHome` below. Optional — defaults are repo-aware.
+  UAI_HOME: z.string().min(1).optional(),
+  UAI_DATA_DIR: z.string().min(1).optional(),
+  UAI_AGENT_DIR: z.string().min(1).optional(),
+  UAI_HOST_TOKEN: z.string().min(32).optional(),
+  UAI_HOST_BRIDGE_PORT: z.coerce.number().int().min(1).max(65535).default(8789),
+  UAI_CLOUD_URL: z.string().min(1).optional(),
+  UAI_HOST_ID: z.string().min(1).optional(),
+  // ADR-101: container-runtime.ts validates this separately. Keeping the raw
+  // value here prevents one misspelled runtime preference from making the
+  // schema fallback discard every otherwise-valid host setting.
+  UAI_RUNTIME: z.string().optional(),
+  // Host master key file (ADR-027) — 32 bytes, AES-256-GCM for the host
+  // secret store. Defaults to $UAI_DATA_DIR/host-master.key; generated on
+  // first use.
+  UAI_HOST_KEY_FILE: z.string().min(1).optional(),
+  // Transitional single-user GitHub PAT, for the one user who has not
+  // connected GitHub. Inert without UAI_GH_PAT_FALLBACK_USER_ID: the PAT is a
+  // host-wide credential, so it may only be injected into tasks owned by the
+  // user it belongs to. See setupTaskGithub().
+  UAI_GH_PAT_FALLBACK: z.string().min(1).optional(),
+  UAI_GH_PAT_FALLBACK_USER_ID: z.string().min(1).optional(),
+  UAI_WORKSPACE_ROOT: z.string().min(1).default(`~/${STATION.homeDirName}`),
+  // Crash reporting (ADR-071, docs/observability.md). Default-ON for
+  // installed hosts via the DSN baked into lib/obs.ts; UAI_SENTRY_DSN
+  // overrides it (self-hosted Sentry), UAI_TELEMETRY_DISABLED=1 turns it
+  // off entirely — zero telemetry bytes leave the machine.
+  UAI_SENTRY_DSN: z.string().min(1).optional(),
+  UAI_TELEMETRY_DISABLED: z.string().optional(),
+  // ADR-134 credential store. ONLY Uai-operated hosts set `aws-ssm`: engine
+  // accounts are then mirrored to AWS Parameter Store (SecureString, KMS) and
+  // reconciled at start. Owned hosts keep `local` — credentials never leave
+  // the machine. See docs/credential-store.md.
+  UAI_CREDENTIAL_STORE: z.enum(["local", "aws-ssm"]).default("local"),
+  UAI_CREDENTIAL_STORE_PREFIX: z
+    .string()
+    .regex(/^\/[A-Za-z0-9_.\-]+(?:\/[A-Za-z0-9_.\-]+)*$/)
+    .default("/uai"),
+  UAI_CREDENTIAL_STORE_KMS_KEY: z.string().min(1).default("alias/uai-credentials"),
+  // Shared with the ADR-121 machine provider (read raw there); the store
+  // needs it too, so surface it here for one validated read.
+  UAI_AWS_REGION: z.string().min(1).optional(),
+  // ADR-135: the broker Lambda a Uai-operated host invokes for a reactive
+  // refresh (name or ARN). Unset = scheduled refreshes only.
+  UAI_TOKEN_BROKER_FUNCTION: z.string().min(1).optional(),
+  // Who keeps the standard image and agent CLIs current. `host` (owned hosts):
+  // this process, hourly. `external` (Uai-operated hosts): a cloud job keeps
+  // the payload AMI fresh and this host only reconciles once at start.
+  UAI_IMAGE_MAINTENANCE: z.enum(["host", "external"]).default("host"),
+  NODE_ENV: z
+    .enum(["development", "production", "test"])
+    .default("development"),
+});
+
+const parsed = schema.safeParse(process.env);
+
+if (!parsed.success) {
+  console.error(
+    "uai host-agent: invalid environment",
+    parsed.error.flatten().fieldErrors,
+  );
+}
+
+const raw = parsed.success ? parsed.data : schema.parse({});
+// The PAT is validated above but kept nowhere here: its one reader takes it
+// from process.env when it injects it (github-tokens.ts), and the cutover
+// purge removes it from there (ADR-154 §13). A long-lived copy in this
+// module would outlive that purge for the life of the process.
+delete raw.UAI_GH_PAT_FALLBACK;
+const here = dirname(fileURLToPath(import.meta.url)); // <pkg>/lib
+
+function expandHome(path: string): string {
+  if (path === "~") return homedir();
+  if (path.startsWith("~/")) return resolve(homedir(), path.slice(2));
+  return path;
+}
+
+/** Walk up from `start` until `pred` holds; null at the filesystem root. */
+function findUp(start: string, pred: (dir: string) => boolean): string | null {
+  let dir = start;
+  for (;;) {
+    if (pred(dir)) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+// Monorepo root iff we're running from a checkout: a dir holding BOTH
+// pnpm-workspace.yaml and a host-agent/ child. The node_modules guard makes
+// the "null when installed" comment TRUE (review finding: a tarball beneath
+// a foreign pnpm workspace with a sibling host-agent/ resolved uaiHome — and
+// the telemetry disclosure marker — into that workspace instead of ~/.uai).
+// Real path first: pnpm reaches this file through symlinks. Keep in sync
+// with src/load-env.ts, which applies the same rule.
+const realHere = (() => {
+  try {
+    return realpathSync(here);
+  } catch {
+    return here;
+  }
+})();
+const repoRoot = realHere.split(sep).includes("node_modules")
+  ? null
+  : findUp(
+      realHere,
+      (d) =>
+        existsSync(resolve(d, "pnpm-workspace.yaml")) &&
+        existsSync(resolve(d, "host-agent")),
+    );
+
+// UAI_HOME: where .env.local + the data dir live. Explicit UAI_HOME wins; then
+// the parent of an explicit UAI_DATA_DIR; then the repo root (dev checkout);
+// then ~/.moondeck (installed; a station never uses the old host's ~/.uai). Keep this in sync with src/load-env.ts,
+// which resolves the same base independently (it runs before this module).
+const uaiHome = raw.UAI_HOME
+  ? resolve(expandHome(raw.UAI_HOME))
+  : raw.UAI_DATA_DIR
+    ? dirname(resolve(expandHome(raw.UAI_DATA_DIR)))
+    : (repoRoot ?? resolve(homedir(), STATION.homeDirName));
+
+// Data dir: explicit UAI_DATA_DIR wins, kept verbatim (e.g. the live host's
+// pinned <repo>/.data); else <repo>/.data in a checkout, or ~/.moondeck/data when
+// installed.
+const dataDir = raw.UAI_DATA_DIR
+  ? resolve(expandHome(raw.UAI_DATA_DIR))
+  : resolve(uaiHome, repoRoot ? ".data" : "data");
+
+const workspaceRoot = resolve(expandHome(raw.UAI_WORKSPACE_ROOT));
+
+export const env = {
+  ...raw,
+  uaiHome,
+  dataDir,
+  hostDbPath: resolve(dataDir, "host.sqlite"),
+  hostKeyPath: raw.UAI_HOST_KEY_FILE
+    ? resolve(uaiHome, expandHome(raw.UAI_HOST_KEY_FILE))
+    : resolve(dataDir, "host-master.key"),
+  commandDbDir: resolve(dataDir, "host-command-dbs"),
+  // Agent scripts ship inside the package; lib/agent.ts resolves them off the
+  // package root by default. Only an explicit UAI_AGENT_DIR override surfaces
+  // here (undefined → use the shipped scripts).
+  agentDir: raw.UAI_AGENT_DIR
+    ? resolve(uaiHome, expandHome(raw.UAI_AGENT_DIR))
+    : undefined,
+  workspaceRoot,
+} as const;
+
+export type Env = typeof env;
+
+/** Absolute path to a project's uai-owned directory (holds its bare mirror). */
+export function projectDir(projectId: string): string {
+  return resolve(env.workspaceRoot, "projects", projectId);
+}
+
+/** Absolute path to a project's single bare mirror (ADR-022: one repo/project). */
+export function projectRepoMirror(projectId: string): string {
+  return resolve(projectDir(projectId), "repo.git");
+}
+
+/** Absolute path to a task's directory (top-level; a task spans 0..N projects). */
+export function taskDir(taskId: string): string {
+  return resolve(env.workspaceRoot, "tasks", taskId);
+}
+
+/** Absolute path to a task's workspace root (parent of per-project worktrees). */
+export function taskWorkspaceDir(taskId: string): string {
+  return resolve(taskDir(taskId), "workspace");
+}
+
+/** Absolute path to one selected project's worktree within a task. */
+export function taskProjectWorktree(taskId: string, projectSlug: string): string {
+  return resolve(taskWorkspaceDir(taskId), projectSlug);
+}
+
+/** Absolute path to a task's ephemeral `.uai/` render dir (generated compose). */
+export function taskUaiDir(taskId: string): string {
+  return resolve(taskDir(taskId), ".uai");
+}

package/lib/fs-aliases.ts

@@ -0,0 +1,49 @@
+/**
+ * ADR-154 §13: removing a credential by one name must not leave it under
+ * another. Shared by the cutover purge and the credential store's cleanup of
+ * staged writes.
+ */
+
+import { lstatSync, readdirSync, readlinkSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+/**
+ * Throws, naming each, while removing `path` would leave another name of
+ * what is in it: a link in it that leads out of it (what it leads to stays,
+ * and the runner's own writes, which follow links, may have filled it), and
+ * a file in it with a second name (a hard link: the other name keeps its
+ * bytes). A link that leads somewhere inside it goes with it. Walked with
+ * lstat, following nothing; a link's target is taken from its own
+ * directory, by name, which is how the kernel follows it: one that leads
+ * out through another link on the way is caught at that link. `path` itself
+ * is no link (the callers checked).
+ */
+export function assertNoAliases(path: string): void {
+  const found: string[] = [];
+  const visit = (at: string): void => {
+    const stats = lstatSync(at, { bigint: true });
+    if (stats.isSymbolicLink()) {
+      const to = resolve(dirname(at), readlinkSync(at));
+      if (!isWithin(path, to)) found.push(`${at} (a symbolic link to ${to})`);
+      return;
+    }
+    if (stats.isDirectory()) {
+      for (const name of readdirSync(at)) visit(join(at, name));
+      return;
+    }
+    if (stats.nlink > 1n) found.push(`${at} (a file with ${stats.nlink} names)`);
+  };
+  visit(path);
+  if (found.length > 0) {
+    throw new Error(
+      `${found.join(", ")}: removing it would leave what the station wrote through ` +
+        `${found.length === 1 ? "that" : "those"}; nothing here is removed until ` +
+        `${found.length === 1 ? "it is" : "they are"} gone`,
+    );
+  }
+}
+
+function isWithin(dir: string, path: string): boolean {
+  const rel = relative(dir, path);
+  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}

package/lib/git-clone-credentials.ts

@@ -0,0 +1,334 @@
+/**
+ * ADR-154 §6, §12: what task-up's host-side clone and fetches authenticate
+ * with, served by this process from memory for exactly as long as the
+ * operation holds the task owner's credentials (`holdTaskGitCredentials`).
+ *
+ * - GitHub over HTTPS: git's credential helper is a small script that asks
+ *   this process for github.com's token over a private socket, each time git
+ *   needs it. Nothing caches it: no `git credential-cache` daemon outlives
+ *   the clone.
+ * - SSH: an ssh-agent this process speaks itself, holding only the task
+ *   owner's ed25519 key (what the sign-in box mints), in memory. Only the
+ *   public key is written, so ssh can name the identity it wants.
+ *
+ * Everything lives in a 0700 directory under /tmp, whose path has no
+ * whitespace (git runs the helper through a shell). The service closes when
+ * the hold's signal aborts or the caller closes it: the sockets stop
+ * answering and the directory is removed. A process that dies takes its
+ * sockets with it, and what it leaves on disk holds no secret.
+ */
+
+import { createPrivateKey, createPublicKey, sign, type KeyObject } from "node:crypto";
+import { chmodSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { createServer, type Server, type Socket } from "node:net";
+import { join } from "node:path";
+
+import type { TaskGitCredentialHold } from "./credential-consumers/github";
+
+/** What task-up is told, all non-secret paths. */
+export interface CloneCredentialEnv {
+  /** The executable git runs as its credential helper (github.com only). */
+  UAI_GITHUB_CREDENTIAL_HELPER?: string;
+  /** The agent socket holding the owner's SSH key. */
+  UAI_TASK_SSH_AUTH_SOCK?: string;
+  /** The owner's public key: the identity ssh asks the agent for. */
+  UAI_TASK_SSH_PUBLIC_KEY?: string;
+}
+
+export interface CloneCredentialService {
+  env: CloneCredentialEnv;
+  /** Stop answering and remove the directory. Idempotent. */
+  close(): Promise<void>;
+}
+
+/** An SSH key the agent cannot hold: not an unencrypted ed25519 key, or one
+ *  whose public half does not match. */
+export class UnsupportedSshKey extends Error {
+  constructor(reason: string) {
+    super(`the SSH key cannot be used for the clone: ${reason}`);
+    this.name = "UnsupportedSshKey";
+  }
+}
+
+/**
+ * Serve `hold`'s credentials to task-up until the hold's signal aborts or
+ * `close()` is called. Rejects (serving nothing) when the hold is already
+ * aborted or its SSH key cannot be held.
+ */
+export async function serveCloneCredentials(
+  hold: Pick<TaskGitCredentialHold, "github" | "ssh" | "signal">,
+): Promise<CloneCredentialService> {
+  if (hold.signal.aborted) throw new Error("the task's credentials were taken before the clone");
+  const key = hold.ssh ? ed25519Identity(hold.ssh.privateKey, hold.ssh.publicKey) : null;
+  const directory = mkdtempSync(join("/tmp", "uai-clone-credentials-"));
+  chmodSync(directory, 0o700);
+  const servers: Server[] = [];
+  const sockets = new Set<Socket>();
+  /** Listens not yet settled: closing fails them, so a start can never wait
+   *  on a server closed under it. */
+  const starting = new Set<(error: Error) => void>();
+  let closing: Promise<void> | null = null;
+  const close = (): Promise<void> => {
+    closing ??= (async () => {
+      hold.signal.removeEventListener("abort", onAbort);
+      for (const fail of [...starting]) fail(new Error("the task's credentials were taken before the clone"));
+      for (const socket of sockets) socket.destroy();
+      await Promise.all(servers.map((server) => new Promise<void>((resolve) => server.close(() => resolve()))));
+      rmSync(directory, { recursive: true, force: true });
+    })();
+    return closing;
+  };
+  const onAbort = (): void => void close();
+  hold.signal.addEventListener("abort", onAbort);
+
+  const listen = async (path: string, handle: (socket: Socket) => void): Promise<void> => {
+    const server = createServer((socket) => {
+      if (closing) {
+        socket.destroy();
+        return;
+      }
+      sockets.add(socket);
+      socket.on("close", () => sockets.delete(socket));
+      socket.on("error", () => socket.destroy());
+      handle(socket);
+    });
+    servers.push(server);
+    await new Promise<void>((resolve, reject) => {
+      const fail = (error: Error): void => {
+        starting.delete(fail);
+        reject(error);
+      };
+      starting.add(fail);
+      server.once("error", fail);
+      server.listen(path, () => {
+        starting.delete(fail);
+        resolve();
+      });
+    });
+    if (closing) throw new Error("the task's credentials were taken before the clone");
+    chmodSync(path, 0o600);
+  };
+
+  const env: CloneCredentialEnv = {};
+  try {
+    if (hold.github) {
+      const token = hold.github.token;
+      const socketPath = join(directory, "github.sock");
+      await listen(socketPath, (socket) => answerGithub(socket, token));
+      const node = join(directory, "node");
+      symlinkSync(process.execPath, node);
+      const helper = join(directory, "git-credential-uai");
+      writeFileSync(helper, helperScript(node, socketPath), { mode: 0o700 });
+      env.UAI_GITHUB_CREDENTIAL_HELPER = helper;
+    }
+    if (key) {
+      const socketPath = join(directory, "ssh-agent.sock");
+      await listen(socketPath, (socket) => answerAgent(socket, key));
+      const publicKey = join(directory, "id_ed25519.pub");
+      writeFileSync(publicKey, `${key.publicLine}\n`, { mode: 0o600 });
+      env.UAI_TASK_SSH_AUTH_SOCK = socketPath;
+      env.UAI_TASK_SSH_PUBLIC_KEY = publicKey;
+    }
+  } catch (error) {
+    await close();
+    throw error;
+  }
+  if (hold.signal.aborted) {
+    await close();
+    throw new Error("the task's credentials were taken before the clone");
+  }
+  return { env, close };
+}
+
+// ---------------------------------------------------------------------------
+// GitHub: the credential helper and what it asks
+// ---------------------------------------------------------------------------
+
+/** The helper git runs: only `get`, only https://github.com; it asks this
+ *  process and prints what it answers (nothing once the service closed). */
+function helperScript(node: string, socketPath: string): string {
+  return `#!${node}
+"use strict";
+if (process.argv[2] !== "get") process.exit(0);
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { input += chunk; });
+process.stdin.on("end", () => {
+  const fields = {};
+  for (const line of input.split("\\n")) {
+    const at = line.indexOf("=");
+    if (at > 0) fields[line.slice(0, at)] = line.slice(at + 1);
+  }
+  if (fields.protocol !== "https" || fields.host !== "github.com") process.exit(0);
+  const socket = require("node:net").connect(${JSON.stringify(socketPath)});
+  let answer = "";
+  socket.setEncoding("utf8");
+  socket.on("data", (chunk) => { answer += chunk; });
+  socket.on("end", () => { process.stdout.write(answer); });
+  socket.on("error", () => process.exit(0));
+  socket.end("protocol=https\\nhost=github.com\\n");
+});
+`;
+}
+
+function answerGithub(socket: Socket, token: string): void {
+  let request = "";
+  socket.setEncoding("utf8");
+  socket.on("data", (chunk: string) => {
+    request += chunk;
+    if (request.length > 1024) socket.destroy();
+  });
+  socket.on("end", () => {
+    const fields = new Set(request.split("\n"));
+    if (fields.has("protocol=https") && fields.has("host=github.com")) {
+      socket.end(`username=x-access-token\npassword=${token}\n`);
+    } else {
+      socket.end();
+    }
+  });
+}
+
+// ---------------------------------------------------------------------------
+// SSH: an agent holding one ed25519 key (draft-miller-ssh-agent)
+// ---------------------------------------------------------------------------
+
+const SSH_AGENT_FAILURE = 5;
+const SSH_AGENTC_REQUEST_IDENTITIES = 11;
+const SSH_AGENT_IDENTITIES_ANSWER = 12;
+const SSH_AGENTC_SIGN_REQUEST = 13;
+const SSH_AGENT_SIGN_RESPONSE = 14;
+/** A message larger than any request this agent answers. */
+const MAX_AGENT_MESSAGE = 256 * 1024;
+/** PKCS#8 for an ed25519 private key, up to its 32-byte seed (RFC 8410). */
+const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+
+interface Ed25519Identity {
+  blob: Buffer;
+  comment: string;
+  publicLine: string;
+  privateKey: KeyObject;
+}
+
+function sshString(bytes: Buffer): Buffer {
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(bytes.length);
+  return Buffer.concat([length, bytes]);
+}
+
+/** Reads SSH wire fields in order; throws on anything short or malformed. */
+class Reader {
+  #offset = 0;
+  constructor(private readonly bytes: Buffer) {}
+  uint32(): number {
+    if (this.#offset + 4 > this.bytes.length) throw new UnsupportedSshKey("a truncated field");
+    const value = this.bytes.readUInt32BE(this.#offset);
+    this.#offset += 4;
+    return value;
+  }
+  string(): Buffer {
+    const length = this.uint32();
+    if (this.#offset + length > this.bytes.length) throw new UnsupportedSshKey("a truncated field");
+    const value = this.bytes.subarray(this.#offset, this.#offset + length);
+    this.#offset += length;
+    return value;
+  }
+}
+
+/** The one ed25519 identity in an unencrypted openssh-key-v1 private key,
+ *  checked against its public line. */
+export function ed25519Identity(privateKeyPem: string, publicLine: string): Ed25519Identity {
+  const pem = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]+?)-----END OPENSSH PRIVATE KEY-----/.exec(privateKeyPem);
+  if (!pem) throw new UnsupportedSshKey("not an OpenSSH private key");
+  const body = Buffer.from(pem[1]!.replace(/\s+/g, ""), "base64");
+  const magic = Buffer.from("openssh-key-v1\0");
+  if (!body.subarray(0, magic.length).equals(magic)) throw new UnsupportedSshKey("not an OpenSSH private key");
+  const outer = new Reader(body.subarray(magic.length));
+  const cipher = outer.string().toString();
+  const kdf = outer.string().toString();
+  outer.string();
+  if (cipher !== "none" || kdf !== "none") throw new UnsupportedSshKey("an encrypted key");
+  if (outer.uint32() !== 1) throw new UnsupportedSshKey("more than one key");
+  const blob = Buffer.from(outer.string());
+  const secret = new Reader(outer.string());
+  if (secret.uint32() !== secret.uint32()) throw new UnsupportedSshKey("a corrupt key");
+  if (secret.string().toString() !== "ssh-ed25519") throw new UnsupportedSshKey("not an ed25519 key");
+  const pub = secret.string();
+  const pair = secret.string();
+  const comment = secret.string().toString();
+  if (pub.length !== 32 || pair.length !== 64 || !pair.subarray(32).equals(pub)) {
+    throw new UnsupportedSshKey("a corrupt ed25519 key");
+  }
+  if (!blob.equals(Buffer.concat([sshString(Buffer.from("ssh-ed25519")), sshString(pub)]))) {
+    throw new UnsupportedSshKey("a corrupt ed25519 key");
+  }
+  const [type, encoded] = publicLine.trim().split(/\s+/);
+  if (type !== "ssh-ed25519" || !encoded || !Buffer.from(encoded, "base64").equals(blob)) {
+    throw new UnsupportedSshKey("its public key does not match");
+  }
+  const privateKey = createPrivateKey({
+    key: Buffer.concat([PKCS8_ED25519_PREFIX, pair.subarray(0, 32)]),
+    format: "der",
+    type: "pkcs8",
+  });
+  // The seed's own public key: the one the agent advertises must be the one
+  // it signs with.
+  const derived = Buffer.from(createPublicKey(privateKey).export({ format: "jwk" }).x ?? "", "base64url");
+  if (!derived.equals(pub)) throw new UnsupportedSshKey("a corrupt ed25519 key");
+  return { blob, comment, publicLine: `ssh-ed25519 ${encoded}`, privateKey };
+}
+
+function agentMessage(type: number, payload: Buffer = Buffer.alloc(0)): Buffer {
+  const header = Buffer.alloc(5);
+  header.writeUInt32BE(payload.length + 1);
+  header.writeUInt8(type, 4);
+  return Buffer.concat([header, payload]);
+}
+
+/** The agent's answer to one request: its identity, a signature by it, or
+ *  failure for everything else (adding, removing, locking, extensions). */
+export function agentAnswer(request: Buffer, key: Ed25519Identity): Buffer {
+  const type = request.readUInt8(0);
+  if (type === SSH_AGENTC_REQUEST_IDENTITIES) {
+    const count = Buffer.alloc(4);
+    count.writeUInt32BE(1);
+    return agentMessage(
+      SSH_AGENT_IDENTITIES_ANSWER,
+      Buffer.concat([count, sshString(key.blob), sshString(Buffer.from(key.comment))]),
+    );
+  }
+  if (type === SSH_AGENTC_SIGN_REQUEST) {
+    try {
+      const reader = new Reader(request.subarray(1));
+      const blob = reader.string();
+      const data = reader.string();
+      reader.uint32();
+      if (!blob.equals(key.blob)) return agentMessage(SSH_AGENT_FAILURE);
+      const signature = sign(null, data, key.privateKey);
+      return agentMessage(
+        SSH_AGENT_SIGN_RESPONSE,
+        sshString(Buffer.concat([sshString(Buffer.from("ssh-ed25519")), sshString(signature)])),
+      );
+    } catch {
+      return agentMessage(SSH_AGENT_FAILURE);
+    }
+  }
+  return agentMessage(SSH_AGENT_FAILURE);
+}
+
+function answerAgent(socket: Socket, key: Ed25519Identity): void {
+  let pending = Buffer.alloc(0);
+  socket.on("data", (chunk: Buffer) => {
+    pending = Buffer.concat([pending, chunk]);
+    while (pending.length >= 4) {
+      const length = pending.readUInt32BE(0);
+      if (length === 0 || length > MAX_AGENT_MESSAGE) {
+        socket.destroy();
+        return;
+      }
+      if (pending.length < 4 + length) return;
+      const request = pending.subarray(4, 4 + length);
+      pending = pending.subarray(4 + length);
+      socket.write(agentAnswer(request, key));
+    }
+  });
+}