@openagt/servers 0.0.0-stage → 0.0.1

package/dist/logins.d.ts

@@ -0,0 +1,94 @@
+import { type Exec, type Session } from './ssh.js';
+import { type LoginKind, type Server } from './store.js';
+/**
+ * The two logins a server works with, and how each gets there: over SSH, as the install's own
+ * scripts do, never through the browser and never through the server's door.
+ *
+ * GitHub's is this computer's own, read from `gh` and copied. Claude's is made new for the
+ * server: `claude setup-token` asks the person in this computer's browser and shows a login
+ * that lasts a year; this computer's own Claude login is never read. Neither is written
+ * anywhere on this computer, and what a server said is kept without them.
+ *
+ * Taking a login off the server deletes it there. It does not end the login: GitHub's is still
+ * this computer's own, and Claude's is good until its year is over.
+ */
+export type Failed = {
+    ok: false;
+    error: string;
+};
+/** The GitHub account `gh` is logged in to on this computer: whose login a copy would be. */
+export declare function ownGithubAccount(run?: Exec): Promise<{
+    ok: true;
+    account: string;
+} | Failed>;
+/** `text` without the login it may repeat. */
+export declare function scrubbed(text: string, login: string): string;
+export type GithubGiven = {
+    ok: true;
+    account: string;
+} | (Failed & {
+    /** The server was sent the login. Its script leaves no login behind when it fails; a line that broke half-way leaves that unknown. */
+    reached: boolean;
+});
+/** Copy this computer's GitHub login to the server on a line that is already open. */
+export declare function giveGithub(session: Session, run?: Exec): Promise<GithubGiven>;
+/** Write down how a copy of the GitHub login went. */
+export declare function noteGithub(kept: Server, given: GithubGiven): void;
+/** The login among what Claude Code showed, once all of it is there. */
+export declare function mintedIn(shown: string): string | undefined;
+/** Why Claude Code ended without a login, from what it showed: its last lines, never a part of a login. */
+export declare function notMinted(shown: string): string;
+export interface MintOptions {
+    signal?: AbortSignal;
+    /** How long the person has to say yes in the browser. */
+    timeoutMs?: number;
+    /** The command that makes the login; Claude Code's own when unsaid. */
+    command?: string;
+}
+/** How a Claude login is made for a server. */
+export type Mint = (opts?: MintOptions) => Promise<{
+    ok: true;
+    login: string;
+} | Failed>;
+/**
+ * Make a Claude login that lasts a year, with Claude Code's own `claude setup-token`: it opens
+ * this computer's browser, the person says yes there, and it shows the login once. It keeps
+ * nothing, and neither does this.
+ *
+ * Claude Code draws on a terminal's screen and this process has none, so the system's `script`
+ * lends it one, wide enough that the login stays on one line. Its input is a pipe nothing ever
+ * writes to. `script` gives its program a group of its own, so that program first says which
+ * process it is: at the end both groups are ended, whether or not Claude Code heeds a terminal
+ * that went away.
+ */
+export declare const mintClaude: Mint;
+/** One change to one login of a server. */
+export interface Job {
+    kind: LoginKind;
+    /** Take the login off the server, where otherwise the server is given one. */
+    remove: boolean;
+}
+export interface LoginOptions extends Job {
+    env: NodeJS.ProcessEnv;
+    address: string;
+    exec?: Exec;
+    mint?: Mint;
+    /** Stops waiting for the person. What was already on its way to the server arrives all the same. */
+    signal?: AbortSignal;
+    /** How often the file is told the work still goes on. */
+    beatMs?: number;
+}
+/** Refused: the login is already being changed, in another process. */
+export declare class AlreadyAtWork extends Error {
+    constructor(address: string, kind: LoginKind);
+}
+/**
+ * Change one login of a server: give it one, or take it off. Run as a process of its own: a
+ * person asked in the browser takes a while, a server may too, and a command a page runs has
+ * seconds. How it ended is written to the file, for the page.
+ *
+ * Once the server is being told, it is told to the end: a line cut half-way would leave on the
+ * server what this computer does not know of.
+ */
+export declare function changeLogin(opts: LoginOptions): Promise<void>;
+//# sourceMappingURL=logins.d.ts.map

package/dist/logins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logins.d.ts","sourceRoot":"","sources":["../src/logins.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,IAAI,EAAa,KAAK,OAAO,EAAE,MAAM,UAAU,CAAA;AAElH,OAAO,EAAwD,KAAK,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAA;AAE9G;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,MAAM,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAUjD,6FAA6F;AAC7F,wBAAsB,gBAAgB,CAAC,GAAG,GAAE,IAAc,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,CAI3G;AAUD,8CAA8C;AAC9C,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAWD,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7B,CAAC,MAAM,GAAG;IACR,sIAAsI;IACtI,OAAO,EAAE,OAAO,CAAA;CACjB,CAAC,CAAA;AAEN,sFAAsF;AACtF,wBAAsB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,IAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAO5F;AAKD,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAIjE;AAUD,wEAAwE;AACxE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE1D;AAED,2GAA2G;AAC3G,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,+CAA+C;AAC/C,MAAM,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,CAAA;AAQxF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,EAAE,IAyCrB,CAAA;AAEJ,2CAA2C;AAC3C,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,GAAG;IACvC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,oGAAoG;IACpG,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAID,uEAAuE;AACvE,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAE3C;CACF;AAcD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCnE"}

package/dist/logins.js

@@ -0,0 +1,205 @@
+import { spawn } from 'node:child_process';
+import { exec as ownExec, lastLines, openSession, withAdvice } from './ssh.js';
+import { LOGIN_TIMEOUT_MS, claudeLoginScript, claudeLogoutScript, githubLoginScript, githubLogoutScript } from './steps.js';
+import { BEAT_MS, atWork, changeServer, isAccount } from './store.js';
+/** How long one of this computer's own commands gets to answer. */
+const OWN_TIMEOUT_MS = 15_000;
+/** Why this computer's `gh` gave nothing, in words: never its own, which could hold what it was asked for. */
+function noGh(said, otherwise) {
+    return { ok: false, error: `There is no GitHub login to copy from this computer. ${/could not start/.test(said.err) ? '`gh` is not on this computer.' : otherwise}` };
+}
+/** The GitHub account `gh` is logged in to on this computer: whose login a copy would be. */
+export async function ownGithubAccount(run = ownExec) {
+    const said = await run('gh', ['api', '--hostname', 'github.com', 'user', '--jq', '.login'], '', { timeoutMs: OWN_TIMEOUT_MS });
+    const account = said.out.trim();
+    return said.code === 0 && isAccount(account) ? { ok: true, account } : noGh(said, '`gh` is not logged in to github.com here, or GitHub does not answer: see `gh auth status`.');
+}
+/** This computer's GitHub login, as `gh` keeps it. */
+async function ownGithubLogin(run) {
+    const said = await run('gh', ['auth', 'token', '--hostname', 'github.com'], '', { timeoutMs: OWN_TIMEOUT_MS });
+    const login = said.out.trim();
+    // What it reads as is what GitHub hands out; anything else is not sent anywhere.
+    return said.code === 0 && /^[A-Za-z0-9_]{20,255}$/.test(login) ? { ok: true, login } : noGh(said, '`gh` is not logged in to github.com here: run `gh auth login`.');
+}
+/** `text` without the login it may repeat. */
+export function scrubbed(text, login) {
+    return login ? text.replaceAll(login, '•••') : text;
+}
+/** Run a login's script on the server. What comes back never holds the login. */
+async function send(session, { as, script }, login = '') {
+    const said = await session.run(as, script, LOGIN_TIMEOUT_MS);
+    const clean = { out: scrubbed(said.out, login), err: scrubbed(said.err, login) };
+    return said.code === 0 ? { ok: true, out: clean.out } : { ok: false, error: lastLines(clean) || 'The server did not answer.' };
+}
+/** Copy this computer's GitHub login to the server on a line that is already open. */
+export async function giveGithub(session, run = ownExec) {
+    const own = await ownGithubLogin(run);
+    if (!own.ok)
+        return { ...own, reached: false };
+    const sent = await send(session, githubLoginScript(own.login), own.login);
+    if (!sent.ok)
+        return { ...sent, reached: true };
+    const account = sent.out.trim().split('\n').at(-1)?.trim();
+    return isAccount(account) ? { ok: true, account } : { ok: false, error: 'The server took the login and did not say whose it is.', reached: true };
+}
+/** What is known of a login beyond a try: since when it is there, and whose it is. */
+const known = (login) => ({ ...(login?.since ? { since: login.since } : {}), ...(login?.account ? { account: login.account } : {}) });
+/** Write down how a copy of the GitHub login went. */
+export function noteGithub(kept, given) {
+    if (given.ok)
+        kept.github = { since: new Date().toISOString(), account: given.account };
+    // One that was sent and did not arrive replaced what the server had: this computer no longer counts on a login there.
+    else
+        kept.github = { ...(given.reached ? {} : known(kept.github)), failed: given.error };
+}
+/** What Claude Code writes before and after the login it made, and what such a login reads as. */
+const MINTED = /Your OAuth token[^\n]*:\s*(sk-ant-[A-Za-z0-9_-]{40,400})\s+Store this token securely/;
+/** What a terminal is told beside words: colours, where the cursor goes, a link's address. */
+const TERMINAL = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-Z\\-_]/g;
+/** The words Claude Code showed, without what only a terminal reads. */
+const words = (shown) => shown.replace(TERMINAL, '').replaceAll('\r', '\n');
+/** The login among what Claude Code showed, once all of it is there. */
+export function mintedIn(shown) {
+    return MINTED.exec(words(shown))?.[1];
+}
+/** Why Claude Code ended without a login, from what it showed: its last lines, never a part of a login. */
+export function notMinted(shown) {
+    const text = words(shown);
+    if (/Your OAuth token/.test(text))
+        return 'Claude Code made a login, and this OpenAgent could not read it off what Claude Code showed.';
+    const lines = [...new Set(text.split('\n').map(line => line.trim()).filter(line => line && !STARTED_AS.test(line)))];
+    return ['Claude Code ended without a login.', ...lines.slice(-5)].join('\n');
+}
+const MINT_TIMEOUT_MS = 10 * 60_000;
+/** How much of what Claude Code showed is kept: its end, where the login is. */
+const SHOWN = 256 * 1024;
+/** The line the lent terminal's first program writes of itself, before it becomes Claude Code. */
+const STARTED_AS = /^started as (\d+)$/m;
+/**
+ * Make a Claude login that lasts a year, with Claude Code's own `claude setup-token`: it opens
+ * this computer's browser, the person says yes there, and it shows the login once. It keeps
+ * nothing, and neither does this.
+ *
+ * Claude Code draws on a terminal's screen and this process has none, so the system's `script`
+ * lends it one, wide enough that the login stays on one line. Its input is a pipe nothing ever
+ * writes to. `script` gives its program a group of its own, so that program first says which
+ * process it is: at the end both groups are ended, whether or not Claude Code heeds a terminal
+ * that went away.
+ */
+export const mintClaude = ({ signal, timeoutMs = MINT_TIMEOUT_MS, command = 'claude setup-token' } = {}) => new Promise(resolve => {
+    const inner = `echo "started as $$"; stty cols 250 rows 50; command -v ${command.split(' ')[0]} >/dev/null || { echo "Claude Code is not on this computer."; exit 1; }; exec ${command}`;
+    const lent = process.platform === 'darwin' ? 'script -q /dev/null sh -c "$0"' : 'script -q -e -c "$0" /dev/null';
+    // On Linux `script` starts its program with the person's own shell, and the line above is written for sh.
+    const child = spawn('sh', ['-c', `tail -f /dev/null | { ${lent}; kill 0; }`, inner], { stdio: ['ignore', 'pipe', 'pipe'], detached: true, env: { ...process.env, SHELL: '/bin/sh' } });
+    let shown = '';
+    let lentTo;
+    let ended = false;
+    const end = (answer) => {
+        if (ended)
+            return;
+        ended = true;
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', stopped);
+        for (const group of [lentTo, child.pid]) {
+            if (group === undefined || group <= 1)
+                continue;
+            try {
+                process.kill(-group, 'SIGKILL');
+            }
+            catch {
+                // Gone already.
+            }
+        }
+        child.stdout.destroy();
+        child.stderr.destroy();
+        resolve(answer);
+    };
+    const stopped = () => end({ ok: false, error: 'The login was stopped.' });
+    const timer = setTimeout(() => end({ ok: false, error: `No yes came from the browser in ${Math.round(timeoutMs / 60_000)} minutes.` }), timeoutMs);
+    signal?.addEventListener('abort', stopped, { once: true });
+    if (signal?.aborted)
+        stopped();
+    const read = (said) => {
+        shown = (shown + said).slice(-SHOWN);
+        // Read once, as it comes: it is the first thing written, and a long wait scrolls it out of what is kept.
+        lentTo ??= Number(STARTED_AS.exec(words(shown))?.[1]) || undefined;
+        const login = mintedIn(shown);
+        if (login)
+            end({ ok: true, login });
+    };
+    child.stdout.setEncoding('utf8').on('data', read);
+    child.stderr.setEncoding('utf8').on('data', read);
+    child.once('error', error => end({ ok: false, error: `Claude Code could not be started: ${error.message}` }));
+    child.once('close', () => end({ ok: false, error: notMinted(shown) }));
+});
+const NAMES = { github: 'GitHub', claude: 'Claude' };
+/** Refused: the login is already being changed, in another process. */
+export class AlreadyAtWork extends Error {
+    constructor(address, kind) {
+        super(`The ${NAMES[kind]} login of ${address} is being changed right now`);
+    }
+}
+/** Open a line to the server, meet it, and do `work` on it; a server that cannot be met is told with what to do about it. */
+async function onServer(server, run, work) {
+    const session = await openSession(server, run ? { exec: run } : {});
+    try {
+        const met = await session.meet();
+        if (!met.ok)
+            return { ok: false, error: withAdvice(server, met.said || 'The server did not answer.'), reached: false };
+        return await work(session);
+    }
+    finally {
+        await session.close();
+    }
+}
+/**
+ * Change one login of a server: give it one, or take it off. Run as a process of its own: a
+ * person asked in the browser takes a while, a server may too, and a command a page runs has
+ * seconds. How it ended is written to the file, for the page.
+ *
+ * Once the server is being told, it is told to the end: a line cut half-way would leave on the
+ * server what this computer does not know of.
+ */
+export async function changeLogin(opts) {
+    const { env, address, kind, remove } = opts;
+    const mine = (kept) => kept[kind]?.worker?.pid === process.pid;
+    const beat = () => ({ pid: process.pid, seen: new Date().toISOString() });
+    // This process's from here on; the command that started it held it under its own name until now.
+    const server = await changeServer(env, address, kept => {
+        const worker = kept[kind]?.worker;
+        if (atWork(worker) && worker.pid !== process.pid && worker.pid !== process.ppid)
+            throw new AlreadyAtWork(address, kind);
+        kept[kind] = { ...known(kept[kind]), worker: beat() };
+        return { address: kept.address, user: kept.user };
+    });
+    if (!server)
+        throw new Error(`no server at ${address}`);
+    const beating = setInterval(() => void changeServer(env, address, kept => void (mine(kept) && (kept[kind].worker = beat()))).catch(() => { }), opts.beatMs ?? BEAT_MS);
+    const failed = (error) => (kept) => void (kept[kind] = { ...known(kept[kind]), failed: error });
+    let after = failed('The work stopped before it ended.');
+    try {
+        if (remove) {
+            const gone = await onServer(server, opts.exec, session => send(session, kind === 'github' ? githubLogoutScript() : claudeLogoutScript()));
+            after = gone.ok ? kept => void delete kept[kind] : failed(gone.error);
+        }
+        else if (kind === 'github') {
+            const given = await onServer(server, opts.exec, session => giveGithub(session, opts.exec));
+            after = kept => noteGithub(kept, given);
+        }
+        else {
+            await changeServer(env, address, kept => void (mine(kept) && (kept.claude.asking = true)));
+            const minted = await (opts.mint ?? mintClaude)(opts.signal ? { signal: opts.signal } : {});
+            await changeServer(env, address, kept => void (mine(kept) && delete kept.claude.asking));
+            if (!minted.ok)
+                return void (after = failed(minted.error));
+            const given = await onServer(server, opts.exec, session => send(session, claudeLoginScript(minted.login), minted.login));
+            after = given.ok ? kept => void (kept.claude = { since: new Date().toISOString() }) : failed(given.error);
+        }
+    }
+    finally {
+        clearInterval(beating);
+        // One that was started over is another process's by now: nothing of it is this one's to write.
+        await changeServer(env, address, kept => void (mine(kept) && after(kept))).catch(() => { });
+    }
+}
+//# sourceMappingURL=logins.js.map

package/dist/logins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logins.js","sourceRoot":"","sources":["../src/logins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAsC,MAAM,UAAU,CAAA;AAClH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAC7I,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAA2C,MAAM,YAAY,CAAA;AAiB9G,mEAAmE;AACnE,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B,8GAA8G;AAC9G,SAAS,IAAI,CAAC,IAAU,EAAE,SAAiB;IACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAA;AACvK,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAG,GAAS,OAAO;IACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAA;IAC9H,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IAC/B,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,4FAA4F,CAAC,CAAA;AACjL,CAAC;AAED,sDAAsD;AACtD,KAAK,UAAU,cAAc,CAAC,GAAS;IACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAA;IAC9G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7B,iFAAiF;IACjF,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,gEAAgE,CAAC,CAAA;AACrK,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAID,iFAAiF;AACjF,KAAK,UAAU,IAAI,CAAC,OAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAe,EAAE,KAAK,GAAG,EAAE;IAC3E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAA;IAChF,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,4BAA4B,EAAE,CAAA;AAChI,CAAC;AASD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,GAAG,GAAS,OAAO;IACpE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IACzE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1D,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACnJ,CAAC;AAED,sFAAsF;AACtF,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAS,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAE/J,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAkB;IACzD,IAAI,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACvF,sHAAsH;;QACjH,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;AAC1F,CAAC;AAED,kGAAkG;AAClG,MAAM,MAAM,GAAG,sFAAsF,CAAA;AACrG,8FAA8F;AAC9F,MAAM,QAAQ,GAAG,0EAA0E,CAAA;AAE3F,wEAAwE;AACxE,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAE3F,wEAAwE;AACxE,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,6FAA6F,CAAA;IACvI,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACpH,OAAO,CAAC,oCAAoC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9E,CAAC;AAaD,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAA;AACnC,gFAAgF;AAChF,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAA;AACxB,kGAAkG;AAClG,MAAM,UAAU,GAAG,qBAAqB,CAAA;AAExC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,UAAU,GAAS,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,eAAe,EAAE,OAAO,GAAG,oBAAoB,EAAE,GAAG,EAAE,EAAE,EAAE,CAC/G,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;IACpB,MAAM,KAAK,GAAG,2DAA2D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iFAAiF,OAAO,EAAE,CAAA;IACxL,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,gCAAgC,CAAA;IAChH,0GAA0G;IAC1G,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,yBAAyB,IAAI,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IACtL,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,IAAI,MAA0B,CAAA;IAC9B,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,GAAG,GAAG,CAAC,MAA4C,EAAQ,EAAE;QACjE,IAAI,KAAK;YAAE,OAAM;QACjB,KAAK,GAAG,IAAI,CAAA;QACZ,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC7C,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC;gBAAE,SAAQ;YAC/C,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACtB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACtB,OAAO,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC/E,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAClJ,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,KAAK,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;QACpC,yGAAyG;QACzG,MAAM,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;QAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7B,IAAI,KAAK;YAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrC,CAAC,CAAA;IACD,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACjD,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACjD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IAC7G,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AACxE,CAAC,CAAC,CAAA;AAoBJ,MAAM,KAAK,GAA8B,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAE/E,uEAAuE;AACvE,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe,EAAE,IAAe;QAC1C,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,6BAA6B,CAAC,CAAA;IAC5E,CAAC;CACF;AAED,6HAA6H;AAC7H,KAAK,UAAU,QAAQ,CAAI,MAAwC,EAAE,GAAqB,EAAE,IAAsC;IAChI,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,4BAA4B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QACtH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB;IAClD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC3C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAA;IAC/E,MAAM,IAAI,GAAG,GAAkC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IACxG,iGAAiG;IACjG,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACjC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,MAAO,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACzH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAA;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAA;IACtK,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,IAAY,EAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACrH,IAAI,KAAK,GAA2B,MAAM,CAAC,mCAAmC,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;YACzI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvE,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC1F,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC1F,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,CAAA;YACzF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YACxH,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3G,CAAC;IACH,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,OAAO,CAAC,CAAA;QACtB,+FAA+F;QAC/F,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5F,CAAC;AACH,CAAC"}

package/dist/ssh.d.ts

@@ -0,0 +1,63 @@
+import { SERVER_USER } from './steps.js';
+/**
+ * A script run on the server, over SSH, with this computer's own `ssh`: its keys, its agent and
+ * its settings are the person's, and OpenAgent keeps none of its own. Nothing is ever asked: a
+ * key that needs a password typed, or a server that wants one, is a failure told in words.
+ *
+ * The first time this computer meets a server its key is taken as it is and remembered, as when
+ * a person answers "yes" in a terminal. A server that later shows another key is refused by
+ * `ssh` itself, before anything is sent.
+ */
+/** How a command ended, and what it said. */
+export interface Said {
+    /** The exit code; `null` for a command that was stopped, or could not start. */
+    code: number | null;
+    out: string;
+    err: string;
+}
+/** How one command is run and fed a text: the real one when unsaid. */
+export type Exec = (bin: string, args: readonly string[], stdin: string, opts: {
+    timeoutMs: number;
+    signal?: AbortSignal;
+}) => Promise<Said>;
+export declare const exec: Exec;
+/** The end of what a command said, its errors last: where the reason of a failure is. */
+export declare function lastLines(said: Pick<Said, 'out' | 'err'>): string;
+/**
+ * What to do about a failure to log in to the server, which `ssh` and `sudo` word their own way,
+ * after those words. Only for the first thing asked of a server: later a server's own words
+ * could read like one of these.
+ */
+export declare function withAdvice(server: {
+    address: string;
+    user: string;
+}, said: string): string;
+export interface Session {
+    /**
+     * Meet the server: log in, and answer what its key is known by. `undefined` when `ssh` did not
+     * say, which changes nothing: the key is the one `ssh` remembers either way.
+     */
+    meet(): Promise<{
+        ok: true;
+        fingerprint?: string;
+    } | {
+        ok: false;
+        said: string;
+    }>;
+    /** Run `script` on the server as root or as the server's own user. */
+    run(as: 'root' | typeof SERVER_USER, script: string, timeoutMs: number): Promise<Said>;
+    /** Hang up. */
+    close(): Promise<void>;
+}
+/**
+ * A line to one server, kept open between the scripts, so the keys are asked for once (a key
+ * that wants a touch or a confirmation each time it is used would otherwise ask at every step).
+ */
+export declare function openSession(server: {
+    address: string;
+    user: string;
+}, opts?: {
+    exec?: Exec;
+    signal?: AbortSignal;
+}): Promise<Session>;
+//# sourceMappingURL=ssh.d.ts.map

package/dist/ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.d.ts","sourceRoot":"","sources":["../src/ssh.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC;;;;;;;;GAQG;AAEH,6CAA6C;AAC7C,MAAM,WAAW,IAAI;IACnB,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,uEAAuE;AACvE,MAAM,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAK5I,eAAO,MAAM,IAAI,EAAE,IAoCf,CAAA;AAKJ,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,MAAM,CAGjE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS1F;AAED,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjF,sEAAsE;IACtE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtF,eAAe;IACf,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAKD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAqC/I"}

package/dist/ssh.js

@@ -0,0 +1,113 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { SERVER_USER } from './steps.js';
+/** How much of what a command says is kept: its end, where a failure tells its reason. */
+const KEPT = 64 * 1024;
+export const exec = (bin, args, stdin, { timeoutMs, signal }) => new Promise(resolve => {
+    const child = spawn(bin, [...args], { stdio: ['pipe', 'pipe', 'pipe'] });
+    let out = '';
+    let err = '';
+    let stopped;
+    const stop = (why) => {
+        stopped ??= why;
+        child.kill('SIGKILL');
+    };
+    const timer = setTimeout(() => stop(`No answer for ${Math.round(timeoutMs / 60_000)} minutes.`), timeoutMs);
+    const aborted = () => stop('The install was stopped.');
+    signal?.addEventListener('abort', aborted, { once: true });
+    if (signal?.aborted)
+        aborted();
+    child.stdout.setEncoding('utf8').on('data', (said) => (out = (out + said).slice(-KEPT)));
+    child.stderr.setEncoding('utf8').on('data', (said) => (err = (err + said).slice(-KEPT)));
+    let ended = false;
+    const done = (code, more = '') => {
+        if (ended)
+            return;
+        ended = true;
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', aborted);
+        // Whatever still holds the command's output open is not listened to any longer.
+        child.stdout.destroy();
+        child.stderr.destroy();
+        resolve({ code: stopped === undefined ? code : null, out, err: [err.trimEnd(), stopped, more].filter(Boolean).join('\n') });
+    };
+    child.once('error', error => done(null, `${bin} could not start: ${error.message}`));
+    child.once('close', code => done(code));
+    // `ssh` leaves a process behind that keeps the line open for the next script, and that one
+    // may hold this command's output open long after the command ended: its end is the exit,
+    // a moment later so what it said last has arrived.
+    child.once('exit', code => void setTimeout(() => done(code), 250));
+    // A command that ended before it read its text is told by its exit, not by a broken pipe here.
+    child.stdin.on('error', () => { });
+    child.stdin.end(stdin);
+});
+/** How many of a command's last lines are kept for the page. */
+const SAID_LINES = 15;
+/** The end of what a command said, its errors last: where the reason of a failure is. */
+export function lastLines(said) {
+    const lines = [said.out, said.err].flatMap(text => text.split('\n').map(line => line.trimEnd()).filter(Boolean));
+    return lines.slice(-SAID_LINES).join('\n');
+}
+/**
+ * What to do about a failure to log in to the server, which `ssh` and `sudo` word their own way,
+ * after those words. Only for the first thing asked of a server: later a server's own words
+ * could read like one of these.
+ */
+export function withAdvice(server, said) {
+    const advice = /REMOTE HOST IDENTIFICATION HAS CHANGED|Host key verification failed/.test(said)
+        ? 'This server shows another key than the one this computer remembers for it. Nothing was sent to it.'
+        : /Permission denied/.test(said)
+            ? `OpenAgent logs in with this computer's own SSH keys. Check that "ssh ${server.user}@${server.address}" works in a terminal without asking for anything.`
+            : /sudo: a password is required|sudo: a terminal is required|sudo: command not found|sudo: not found/.test(said)
+                ? `The user ${server.user} cannot become root without a password. Use root, or a user whose sudo asks for none.`
+                : undefined;
+    return [said, advice].filter(Boolean).join('\n');
+}
+/** What `ssh -v` prints about itself, which is nothing the server said. */
+const NOISE = /^(debug\d:|OpenSSH_|Authenticated to |Transferred: |Bytes per second: )/;
+/**
+ * A line to one server, kept open between the scripts, so the keys are asked for once (a key
+ * that wants a touch or a confirmation each time it is used would otherwise ask at every step).
+ */
+export async function openSession(server, opts = {}) {
+    const run = opts.exec ?? exec;
+    // The line's own socket, in a folder only this user reads; a short path, which a socket needs.
+    const dir = await mkdtemp(join(tmpdir(), 'oas-'));
+    const options = [
+        ['BatchMode', 'yes'],
+        ['StrictHostKeyChecking', 'accept-new'],
+        ['ConnectTimeout', '20'],
+        ['ServerAliveInterval', '15'],
+        ['ServerAliveCountMax', '4'],
+        ['ControlMaster', 'auto'],
+        ['ControlPath', join(dir, 's')],
+        ['ControlPersist', '120'],
+        // Whatever this computer's own settings say for every server: a server met a moment ago gets no way back into this computer.
+        ['ForwardAgent', 'no'],
+        ['ForwardX11', 'no'],
+        ['ClearAllForwardings', 'yes'],
+        ['PermitLocalCommand', 'no'],
+        ['RequestTTY', 'no'],
+    ].flatMap(([name, value]) => ['-o', `${name}=${value}`]);
+    // `--` ends the options: an address is never read as one.
+    const args = (remote, more = []) => [...options, ...more, '-l', server.user, '--', server.address, remote];
+    const root = server.user === 'root' ? '' : 'sudo -n ';
+    const signal = opts.signal ? { signal: opts.signal } : {};
+    return {
+        async meet() {
+            const said = await run('ssh', args('true', ['-v']), '', { timeoutMs: 60_000, ...signal });
+            if (said.code !== 0)
+                return { ok: false, said: said.err.split('\n').filter(line => !NOISE.test(line)).join('\n').trim() };
+            const fingerprint = /^debug1: Server host key: \S+ (SHA256:\S+)/m.exec(said.err)?.[1];
+            return { ok: true, ...(fingerprint ? { fingerprint } : {}) };
+        },
+        run: (as, script, timeoutMs) => run('ssh', args(as === 'root' ? `${root}bash -s` : `${root}runuser -l ${SERVER_USER} -c 'bash -s'`), script, { timeoutMs, ...signal }),
+        async close() {
+            await run('ssh', ['-o', `ControlPath=${join(dir, 's')}`, '-O', 'exit', '--', server.address], '', { timeoutMs: 5_000 }).catch(() => { });
+            await rm(dir, { recursive: true, force: true });
+        },
+    };
+}
+//# sourceMappingURL=ssh.js.map

package/dist/ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../src/ssh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAuBxC,0FAA0F;AAC1F,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAA;AAEtB,MAAM,CAAC,MAAM,IAAI,GAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CACpE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;IACpB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACxE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,OAA2B,CAAA;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,OAAO,KAAK,GAAG,CAAA;QACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvB,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3G,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC5D,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,CAAA;IAC9B,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChG,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,IAAI,GAAG,EAAE,EAAQ,EAAE;QACpD,IAAI,KAAK;YAAE,OAAM;QACjB,KAAK,GAAG,IAAI,CAAA;QACZ,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC7C,gFAAgF;QAChF,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACtB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACtB,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7H,CAAC,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,qBAAqB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACpF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,2FAA2F;IAC3F,yFAAyF;IACzF,mDAAmD;IACnD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAClE,+FAA+F;IAC/F,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACjC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC,CAAC,CAAA;AAEJ,gEAAgE;AAChE,MAAM,UAAU,GAAG,EAAE,CAAA;AAErB,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,IAA+B;IACvD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAChH,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAyC,EAAE,IAAY;IAChF,MAAM,MAAM,GAAG,qEAAqE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7F,CAAC,CAAC,oGAAoG;QACtG,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,wEAAwE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,oDAAoD;YAC3J,CAAC,CAAC,mGAAmG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9G,CAAC,CAAC,YAAY,MAAM,CAAC,IAAI,uFAAuF;gBAChH,CAAC,CAAC,SAAS,CAAA;IACjB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClD,CAAC;AAcD,2EAA2E;AAC3E,MAAM,KAAK,GAAG,yEAAyE,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyC,EAAE,IAAI,GAA0C,EAAE;IAC3H,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAA;IAC7B,+FAA+F;IAC/F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG;QACd,CAAC,WAAW,EAAE,KAAK,CAAC;QACpB,CAAC,uBAAuB,EAAE,YAAY,CAAC;QACvC,CAAC,gBAAgB,EAAE,IAAI,CAAC;QACxB,CAAC,qBAAqB,EAAE,IAAI,CAAC;QAC7B,CAAC,qBAAqB,EAAE,GAAG,CAAC;QAC5B,CAAC,eAAe,EAAE,MAAM,CAAC;QACzB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC,gBAAgB,EAAE,KAAK,CAAC;QACzB,6HAA6H;QAC7H,CAAC,cAAc,EAAE,IAAI,CAAC;QACtB,CAAC,YAAY,EAAE,IAAI,CAAC;QACpB,CAAC,qBAAqB,EAAE,KAAK,CAAC;QAC9B,CAAC,oBAAoB,EAAE,IAAI,CAAC;QAC5B,CAAC,YAAY,EAAE,IAAI,CAAC;KACrB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAA;IACxD,0DAA0D;IAC1D,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAI,GAAa,EAAE,EAAY,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACtI,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzD,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;YACzF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;YACzH,MAAM,WAAW,GAAG,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC9D,CAAC;QACD,GAAG,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,WAAW,eAAe,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;QACtK,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACvI,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/steps.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The steps of an install, in order: what each is called on the page, who runs it on the server,
+ * and the script itself. A step first looks whether its work is already done and then does
+ * nothing, so the same list is the first install, a second try after a failure, and an update.
+ *
+ * `root` is only who installs. What runs afterwards runs as the server's own user `openagent`:
+ * the programs are root's, so an agent that works there cannot change OpenAgent itself.
+ */
+export declare const STEP_IDS: readonly ['login', 'user', 'tools', 'openagent', 'agent', 'service', 'door'];
+export type StepId = (typeof STEP_IDS)[number];
+/** What a script is written for. */
+export interface Facts {
+    /** The server's number or name: what its certificate is for. */
+    address: string;
+    /** The OpenAgent the server gets: the one that runs on this computer. */
+    version: string;
+}
+export interface StepDef {
+    id: StepId;
+    /** The step's line on the page. */
+    label: string;
+    as: 'root' | 'openagent';
+    /** How long the step may take: a server that stopped answering is not waited for longer. */
+    timeoutMs: number;
+    script(facts: Facts): string;
+}
+/** The server's user everything runs as once it is installed. */
+export declare const SERVER_USER = "openagent";
+/** Where the server keeps the Claude login: root's file, which the service reads as it starts. An agent on the server works with the login, and so can read it; it cannot change the file. */
+export declare const CLAUDE_FILE = "/etc/openagent/claude.env";
+/** `value` as one word of a shell script, whatever it holds. */
+export declare function quoted(value: string): string;
+/** What the service file holds. `KillMode=process`: a run is a process of its own and goes on when OpenAgent starts again, as on a laptop. */
+export declare const SERVICE_UNIT = "[Unit]\nDescription=OpenAgent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nUser=openagent\nWorkingDirectory=/home/openagent\nEnvironment=PATH=/home/openagent/.local/bin:/opt/openagent/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nEnvironmentFile=-/etc/openagent/claude.env\nExecStart=/opt/openagent/node/bin/openagent\nRestart=always\nRestartSec=5\nKillMode=process\nAmbientCapabilities=CAP_NET_BIND_SERVICE\n\n[Install]\nWantedBy=multi-user.target";
+export declare const STEPS: readonly StepDef[];
+/** The script that asks the server's door for a link a new machine gets in with. Run as the server's own user. */
+export declare function linkScript(): string;
+/** A script that puts a login on the server or takes it off, and who runs it there. */
+export interface LoginScript {
+    as: StepDef['as'];
+    script: string;
+}
+/** How long a login's script may take: a server that stopped answering is not waited for longer. */
+export declare const LOGIN_TIMEOUT_MS: number;
+/**
+ * Give the server a GitHub login: `gh` keeps it in its own file, and git asks `gh` for it. The
+ * server then holds this one login, and answers whose it is; when any of that fails, it holds none.
+ *
+ * The login is a word of the script, which the server's shell reads where a program would read:
+ * it is on no command line, and no program the script starts finds it among what it was given.
+ */
+export declare function githubLoginScript(login: string): LoginScript;
+/** Take the GitHub login off the server. */
+export declare function githubLogoutScript(): LoginScript;
+/**
+ * Give the server a Claude login: Claude Code is first asked, as the server's own user, whether
+ * it reads the login; then the login is written to root's file and OpenAgent is started again
+ * with it. A run that is at work goes on with the login it started with. When OpenAgent does not
+ * start with it, the file is put back as it was.
+ *
+ * Claude Code is the server user's own program: root asks it as that user, for half a minute at
+ * most, and without the lock root holds, which a program that never ended would hold with it.
+ */
+export declare function claudeLoginScript(login: string): LoginScript;
+/** Take the Claude login off the server, and start OpenAgent again without it. */
+export declare function claudeLogoutScript(): LoginScript;
+//# sourceMappingURL=steps.d.ts.map

package/dist/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../src/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,QAAQ,YAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AACpG,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9C,oCAAoC;AACpC,MAAM,WAAW,KAAK;IACpB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,GAAG,WAAW,CAAA;IACxB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;CAC7B;AAED,iEAAiE;AACjE,eAAO,MAAM,WAAW,cAAc,CAAA;AAOtC,8LAA8L;AAC9L,eAAO,MAAM,WAAW,8BAA8B,CAAA;AAOtD,gEAAgE;AAChE,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AAgDD,8IAA8I;AAC9I,eAAO,MAAM,YAAY,yfAiBE,CAAA;AAE3B,eAAO,MAAM,KAAK,EAAE,SAAS,OAAO,EAqMnC,CAAA;AAED,kHAAkH;AAClH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,QAAa,CAAA;AAM1C;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAmB5D;AAED,4CAA4C;AAC5C,wBAAgB,kBAAkB,IAAI,WAAW,CAYhD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CA8B5D;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,IAAI,WAAW,CAchD"}