@ozyman42/ozy-cli 0.4.6-linux-x64.0 → 0.4.6

package/src/commands/npm/setup/setup.test.ts

@@ -0,0 +1,117 @@
+import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { validatePackageJson } from './package-json-validate';
+import { parseGithubOwnerRepo } from './git-remote';
+import { workflowExists, createWorkflow } from './workflow';
+import { Option } from "effect";
+
+// ── validatePackageJson ──────────────────────────────────────────────────────
+
+describe('validatePackageJson', () => {
+  const base = {
+    name: '@scope/pkg',
+    version: '1.0.0',
+    repository: { type: 'git', url: 'git+https://github.com/owner/repo.git' },
+    publishConfig: { access: 'public' as const, provenance: true },
+    scripts: { build: 'bun run build' },
+    files: ['dist'],
+  };
+
+  test('returns no issues for a valid package', () => {
+    expect(validatePackageJson(base)).toEqual([]);
+  });
+
+  test('fatal: missing version', () => {
+    const issues = validatePackageJson({ ...base, version: '' });
+    expect(issues.some(i => i.field === 'version' && i.fatal)).toBe(true);
+  });
+
+  test('fatal: missing build script', () => {
+    const issues = validatePackageJson({ ...base, scripts: {} });
+    expect(issues.some(i => i.field === 'scripts.build' && i.fatal)).toBe(true);
+  });
+
+  test('non-fatal: missing repository', () => {
+    const issues = validatePackageJson({ ...base, repository: undefined as any });
+    expect(issues.some(i => i.field === 'repository' && !i.fatal)).toBe(true);
+  });
+
+  test('non-fatal: invalid repository url', () => {
+    const issues = validatePackageJson({ ...base, repository: { type: 'git', url: 'git+.git' } });
+    expect(issues.some(i => i.field === 'repository.url' && !i.fatal)).toBe(true);
+  });
+
+  test('non-fatal: publishConfig.access not public', () => {
+    const issues = validatePackageJson({ ...base, publishConfig: { access: 'restricted', provenance: true } });
+    expect(issues.some(i => i.field === 'publishConfig.access')).toBe(true);
+  });
+
+  test('non-fatal: publishConfig.provenance not true', () => {
+    const issues = validatePackageJson({ ...base, publishConfig: { access: 'public', provenance: false } });
+    expect(issues.some(i => i.field === 'publishConfig.provenance')).toBe(true);
+  });
+
+  test('non-fatal: dist not in files', () => {
+    const issues = validatePackageJson({ ...base, files: ['src'] });
+    expect(issues.some(i => i.field === 'files')).toBe(true);
+  });
+});
+
+// ── parseGithubOwnerRepo ─────────────────────────────────────────────────────
+
+describe('parseGithubOwnerRepo', () => {
+  test('parses https url', () => {
+    expect(parseGithubOwnerRepo('https://github.com/owner/repo.git')).toEqual(Option.some({ owner: 'owner', repo: 'repo' }));
+  });
+
+  test('parses https url without .git', () => {
+    expect(parseGithubOwnerRepo('https://github.com/owner/repo')).toEqual(Option.some({ owner: 'owner', repo: 'repo' }));
+  });
+
+  test('parses standard ssh url', () => {
+    expect(parseGithubOwnerRepo('git@github.com:owner/repo.git')).toEqual(Option.some({ owner: 'owner', repo: 'repo' }));
+  });
+
+  test('parses ssh alias url', () => {
+    expect(parseGithubOwnerRepo('git@github-ozyman42:ozyman42/test.git')).toEqual(Option.some({ owner: 'ozyman42', repo: 'test' }));
+  });
+
+  test('returns null for unrecognised url', () => {
+    expect(parseGithubOwnerRepo('not-a-url')).toBeNull();
+  });
+});
+
+// ── workflow helpers ─────────────────────────────────────────────────────────
+
+describe('workflow', () => {
+  let tmpDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'ozy-test-'));
+  });
+
+  afterEach(async () => {
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  test('workflowExists returns false when missing', async () => {
+    expect(await workflowExists(tmpDir)).toBe(false);
+  });
+
+  test('createWorkflow creates a valid yaml file', async () => {
+    await createWorkflow(tmpDir);
+    expect(await workflowExists(tmpDir)).toBe(true);
+    const content = await fs.readFile(path.join(tmpDir, '.github/workflows/publish.yml'), 'utf8');
+    expect(content).toContain('npm publish dist/');
+    expect(content).toContain('id-token: write');
+    expect(content).toContain('bun run build');
+  });
+
+  test('createWorkflow is idempotent', async () => {
+    await createWorkflow(tmpDir);
+    await createWorkflow(tmpDir);
+    expect(await workflowExists(tmpDir)).toBe(true);
+  });
+});

package/src/commands/npm/setup/trusted-publishing.ts

@@ -0,0 +1,106 @@
+import { $ } from 'bun';
+import { createInterface } from 'node:readline';
+import { Effect } from 'effect';
+import { log } from '@/common/log';
+
+function encodePackageName(name: string): string {
+  if (!name.startsWith('@')) return encodeURIComponent(name);
+  const slash = name.indexOf('/');
+  return `@${name.slice(1, slash)}%2F${name.slice(slash + 1)}`;
+}
+
+function promptPasscode(): Promise<string> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => {
+    rl.question('  enter the passcode from the browser: ', answer => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+async function registryPost(
+  url: string,
+  body: string,
+  authToken: string,
+  { existingOtp, alreadyExistsStatus }: { existingOtp?: string; alreadyExistsStatus?: number } = {},
+): Promise<{ otp?: string; alreadyExists: boolean }> {
+  const headers: Record<string, string> = {
+    Authorization: `Bearer ${authToken}`,
+    'Content-Type': 'application/json',
+  };
+
+  const post = (otp?: string) => fetch(url, {
+    method: 'POST',
+    headers: otp ? { ...headers, 'npm-otp': otp } : headers,
+    body,
+  });
+
+  const check = (res: Response) => {
+    if (res.ok) return true;
+    if (alreadyExistsStatus && res.status === alreadyExistsStatus) return true;
+    return false;
+  };
+
+  if (existingOtp) {
+    const res = await post(existingOtp);
+    if (check(res)) return { otp: existingOtp, alreadyExists: !res.ok };
+  }
+
+  let res = await post();
+  if (check(res)) return { otp: undefined, alreadyExists: !res.ok };
+
+  if (res.status === 401) {
+    const notice = res.headers.get('npm-notice') ?? '';
+    const loginUrl = notice.match(/https:\/\/www\.npmjs\.com\/login\/[a-f0-9-]+/)?.[0];
+    if (!loginUrl) throw new Error('2FA required but could not parse login URL');
+    await $`open ${loginUrl}`.quiet().nothrow();
+    const otp = await promptPasscode();
+    res = await post(otp);
+    if (check(res)) return { otp, alreadyExists: !res.ok };
+  }
+
+  throw new Error(`${res.status} ${await res.text()}`);
+}
+
+export function addTrustedPublisher(
+  name: string,
+  ownerRepo: string,
+  token: string,
+): Effect.Effect<{ alreadyConfigured: boolean; otp?: string }, string> {
+  const encoded = encodePackageName(name);
+  log('  setting up (may require 2FA)...');
+  const body = JSON.stringify([{
+    type: 'github',
+    claims: { repository: ownerRepo, workflow_ref: { file: 'pipeline.yml' } },
+    permissions: ['createPackage'],
+  }]);
+  return Effect.tryPromise({
+    try: async () => {
+      const { otp, alreadyExists } = await registryPost(
+        `https://registry.npmjs.org/-/package/${encoded}/trust`, body, token,
+        { alreadyExistsStatus: 409 },
+      );
+      return { alreadyConfigured: alreadyExists, otp };
+    },
+    catch: (e) => `trust setup failed: ${e instanceof Error ? e.message : String(e)}`,
+  });
+}
+
+export function setPackageAccessPolicy(
+  name: string,
+  token: string,
+  existingOtp?: string,
+): Effect.Effect<void, string> {
+  const encoded = encodePackageName(name);
+  const body = JSON.stringify({ publish_requires_tfa: true, automation_token_overrides_tfa: false });
+  return Effect.tryPromise({
+    try: async () => {
+      await registryPost(
+        `https://registry.npmjs.org/-/package/${encoded}/access`, body, token,
+        { existingOtp },
+      );
+    },
+    catch: (e) => `access policy setup failed: ${e instanceof Error ? e.message : String(e)}`,
+  });
+}

package/src/commands/npm/setup/workflow.ts

@@ -0,0 +1,20 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import WORKFLOW_TEMPLATE from './publish-workflow.yml' with { type: 'text' };
+
+const WORKFLOW_PATH = '.github/workflows/publish.yml';
+
+export async function workflowExists(repoRoot: string): Promise<boolean> {
+  try {
+    await fs.access(path.join(repoRoot, WORKFLOW_PATH));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function createWorkflow(repoRoot: string): Promise<void> {
+  const fullPath = path.join(repoRoot, WORKFLOW_PATH);
+  await fs.mkdir(path.dirname(fullPath), { recursive: true });
+  await fs.writeFile(fullPath, WORKFLOW_TEMPLATE, 'utf8');
+}

package/src/commands/ssh/get-sk-credential.ts

@@ -0,0 +1,110 @@
+import { Effect } from "effect";
+import { makeCommand } from "@/common/command";
+import * as path from 'path';
+import * as fs from 'fs';
+import { log } from "@/common/log";
+import { selectFromList } from "@ozyman42/interactive-cli-select";
+import type { EffectGen } from "effective-modules";
+
+const OPENSSH_MAGIC = Buffer.from('openssh-key-v1\0', 'utf8');
+
+function isSkPublicKey(pubKeyPath: string): boolean {
+  try {
+    const keyType = fs.readFileSync(pubKeyPath, 'utf8').trim().split(/\s+/)[0] ?? '';
+    return keyType.startsWith('sk-');
+  } catch {
+    return false;
+  }
+}
+
+function parseCredentialId(privateKeyPath: string): string {
+  const base64 = fs.readFileSync(privateKeyPath, 'utf8')
+    .split('\n')
+    .filter(line => !line.startsWith('-----'))
+    .join('');
+  const buf = Buffer.from(base64, 'base64');
+
+  if (!buf.subarray(0, OPENSSH_MAGIC.length).equals(OPENSSH_MAGIC)) {
+    throw new Error('Not an OpenSSH private key file.');
+  }
+
+  let off = OPENSSH_MAGIC.length;
+
+  function readString(): Buffer {
+    if (off + 4 > buf.length) throw new Error('Unexpected end of buffer.');
+    const len = buf.readUInt32BE(off); off += 4;
+    if (off + len > buf.length) throw new Error('Buffer underflow.');
+    const chunk = buf.subarray(off, off + len); off += len;
+    return chunk;
+  }
+
+  function readUint32(): number {
+    if (off + 4 > buf.length) throw new Error('Unexpected end of buffer.');
+    const val = buf.readUInt32BE(off); off += 4;
+    return val;
+  }
+
+  const cipherName = readString().toString('utf8');
+  if (cipherName !== 'none') throw new Error('Encrypted private keys are not supported.');
+  readString(); // kdf name
+  readString(); // kdf options
+
+  if (readUint32() !== 1) throw new Error('Expected exactly 1 key.');
+  readString(); // public key blob
+
+  const pb = readString(); // private key block
+  let p = 0;
+
+  function pbString(): Buffer {
+    if (p + 4 > pb.length) throw new Error('Unexpected end of private block.');
+    const len = pb.readUInt32BE(p); p += 4;
+    if (p + len > pb.length) throw new Error('Private block underflow.');
+    const chunk = pb.subarray(p, p + len); p += len;
+    return chunk;
+  }
+
+  const check1 = pb.readUInt32BE(p); p += 4;
+  const check2 = pb.readUInt32BE(p); p += 4;
+  if (check1 !== check2) throw new Error('Private key integrity check failed — key may be encrypted or corrupt.');
+
+  const keyType = pbString().toString('utf8');
+  if (keyType.includes('ecdsa')) {
+    pbString(); // curve identifier
+    pbString(); // ec_point
+  } else if (keyType.includes('ed25519')) {
+    pbString(); // public key (32 bytes)
+  } else {
+    throw new Error(`Unsupported security key type: ${keyType}`);
+  }
+
+  pbString(); // application string (e.g. 'ssh:')
+  p += 1;     // flags byte
+
+  return pbString().toString('hex');
+}
+
+export const skCredential = makeCommand('sk-credential', 'get credential id of a given ssh security key pointer', () =>
+  Effect.gen(function* (): EffectGen<void, never> {
+    // Effect v3 → v4 shim: Effect.async was renamed to Effect.callback
+    (Effect as any).async = (Effect as any).callback;
+
+    const cwd = process.cwd();
+    const skKeys = fs.readdirSync(cwd).filter(name =>
+      !name.endsWith('.pub') && isSkPublicKey(path.join(cwd, `${name}.pub`))
+    );
+
+    if (skKeys.length === 0) {
+      log('No SSH security keys found.');
+      return;
+    }
+
+    const choice = yield* selectFromList({
+      options: skKeys,
+      getKey: o => o,
+      renderOption: o => o,
+    }).pipe(Effect.orDie);
+
+    const credentialId = parseCredentialId(path.join(cwd, choice));
+    log(`Credential ID: ${credentialId}`);
+  })
+);

package/src/commands/ssh/index.ts

@@ -0,0 +1,8 @@
+import { Command } from 'commander';
+import { skCredential } from './get-sk-credential';
+
+export const ssh = new Command('ssh')
+  .summary('ssh related utility commands');
+
+[skCredential]
+  .forEach(cmd => { ssh.addCommand(cmd) });

package/src/commands/upgrade.ts

@@ -0,0 +1,90 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { Effect, Option } from "effect";
+import { makeCommand } from "@/common/command";
+import { CLI_CMD_NAME, PACKAGE_NAME } from "@/common/constants";
+
+type PackageManager = "bun" | "pnpm" | "npm";
+type InstallScope = "global" | "local";
+
+interface InstallInfo {
+  pm: PackageManager;
+  scope: InstallScope;
+  cwd?: string;
+}
+
+function findLockFile(dir: string): Option.Option<PackageManager> {
+  let current = dir;
+  while (true) {
+    if (existsSync(join(current, "bun.lock")) || existsSync(join(current, "bun.lockb"))) return Option.some("bun" as PackageManager);
+    if (existsSync(join(current, "pnpm-lock.yaml"))) return Option.some("pnpm" as PackageManager);
+    if (existsSync(join(current, "package-lock.json"))) return Option.some("npm" as PackageManager);
+    const parent = dirname(current);
+    if (parent === current) return Option.none();
+    current = parent;
+  }
+}
+
+function detectInstall(binaryPath: string): Option.Option<InstallInfo> {
+  if (binaryPath.includes("/.bun/bin/")) {
+    return Option.some({ pm: "bun", scope: "global" } as InstallInfo);
+  }
+  if (binaryPath.includes("/pnpm/")) {
+    return Option.some({ pm: "pnpm", scope: "global" } as InstallInfo);
+  }
+  const localMatch = binaryPath.match(/^(.+\/node_modules)\/.bin\//);
+  if (localMatch) {
+    const projectRoot = dirname(localMatch[1]!);
+    const pm = Option.getOrElse(findLockFile(projectRoot), () => "npm" as PackageManager);
+    return Option.some({ pm, scope: "local", cwd: projectRoot } as InstallInfo);
+  }
+  return Option.none();
+}
+
+function buildUpgradeCommand(info: InstallInfo): string[] {
+  const pkg = `${PACKAGE_NAME}@latest`;
+  if (info.scope === "global") {
+    if (info.pm === "bun") return ["bun", "add", "--no-cache", "-g", pkg];
+    if (info.pm === "pnpm") return ["pnpm", "add", "-g", pkg];
+    return ["npm", "install", "-g", pkg];
+  }
+  if (info.pm === "bun") return ["bun", "add", "--no-cache", pkg];
+  if (info.pm === "pnpm") return ["pnpm", "add", pkg];
+  return ["npm", "install", pkg];
+}
+
+function whichOzy(): Effect.Effect<string, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const proc = Bun.spawn(["which", CLI_CMD_NAME], { stdout: "pipe", stderr: "pipe" });
+      const code = await proc.exited;
+      if (code !== 0) throw new Error(`${CLI_CMD_NAME} binary not found — install with: bun add --no-cache -g ${PACKAGE_NAME}@latest`);
+      return (await new Response(proc.stdout).text()).trim();
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}
+
+export const upgrade = makeCommand("upgrade", `upgrade ${CLI_CMD_NAME} to the latest version`, () =>
+  Effect.gen(function* () {
+    const binaryPath = yield* whichOzy();
+
+    const infoOption = detectInstall(binaryPath);
+    if (Option.isNone(infoOption))
+      return yield* Effect.fail(`unknown-install: could not detect package manager from binary path: ${binaryPath}\nUpgrade manually with your package manager.`);
+    const info = infoOption.value;
+
+    const cmd = buildUpgradeCommand(info);
+    console.log(`Detected: ${info.pm} (${info.scope})`);
+    console.log(`Running: ${cmd.join(" ")}`);
+
+    const proc = Bun.spawn(cmd, {
+      cwd: info.cwd ?? process.cwd(),
+      stdout: "inherit",
+      stderr: "inherit",
+    });
+    const code = yield* Effect.promise(() => proc.exited);
+    if (code !== 0)
+      yield* Effect.fail(`install-failed: ${cmd[0]} exited with code ${code}`);
+  })
+);

package/src/common/command.ts

@@ -0,0 +1,16 @@
+import { Command } from 'commander';
+import { Effect, Result } from 'effect';
+import { log } from './log';
+
+export function makeCommand(name: string, description: string,
+  action: () => Effect.Effect<void, string>): Command {
+  return new Command(name)
+    .description(description)
+    .action(async () => {
+      const result = await Effect.runPromise(action().pipe(Effect.result));
+      if (Result.isFailure(result)) {
+        log(`✗ ${result.failure}`);
+      }
+      process.exit();
+    });
+}

package/src/common/constants.ts

@@ -0,0 +1,26 @@
+import * as path from "node:path";
+import { version, name } from "../../package.json";
+
+export const PACKAGE_NAME = name;
+export const FUTURE_TOOL_NAME = "jive";
+const CLI_DIR = path.dirname(process.execPath);
+const commandPath = (commandName: string) =>
+  path.resolve(CLI_DIR, process.platform === "win32" ? `${commandName}.exe` : commandName);
+export const CLI_CMD_NAME = "ozy";
+export const AGENT_CMD_NAME = "ozy-signing-agent";
+export const AGENT_CMD_PATH = commandPath(AGENT_CMD_NAME);
+export const CLI_CMD_PATH = commandPath(CLI_CMD_NAME);
+export const AGENT_SOCK_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.sock`);
+export const AGENT_LOG_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.log`);
+export const AGENT_PID_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.pid`);
+export const AGENT_PORT_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.port`);
+export const CRED_ID_COMMENT_PREFIX = 'credentialId:';
+export const CURRENT_VERSION = version;
+export const VIRTUAL_KEY_CMD_NAME = "ozy-virtual-security-key";
+export const SSH_KEYGEN_CMD_NAME = "ozy-ssh-keygen";
+export const SSH_KEYGEN_CMD_PATH = commandPath(SSH_KEYGEN_CMD_NAME);
+export const VIRTUAL_KEY_LOG_FILE_PATH = path.resolve(CLI_DIR, `${VIRTUAL_KEY_CMD_NAME}.log`);
+export const DEFAULT_SESSION_TIMEOUT_SECONDS = 120;
+export const STANDARD_REMOTE_USER = "git";
+export const STANDARD_REMOTE_HOST = "github.com";
+export const STANDARD_REMOTE_PREFIX = `${STANDARD_REMOTE_USER}@${STANDARD_REMOTE_HOST}:`;

package/src/common/effective-modules-extensions.ts

@@ -0,0 +1,24 @@
+import { type EffectGen } from "effective-modules";
+import { type Context, Effect } from "effect";
+
+type MethodsRequireSelf<S extends Context.Service<any, any>> = {
+  [k in keyof S["Service"]]: 
+    S["Service"][k] extends Function ?
+      ReturnType<S["Service"][k]> extends EffectGen<infer A, infer E, infer R> ?
+        (...args: Parameters<S["Service"][k]>) => Effect.Effect<A, E, R | S["Identifier"]>
+        : ReturnType<S["Service"][k]> extends Effect.Effect<infer A, infer E, infer R> ?
+          (...args: Parameters<S["Service"][k]>) => Effect.Effect<A, E, R | S["Identifier"]>
+          : never
+      : never;
+}
+
+export function using<S extends Context.Service<any, any>>(service: S): MethodsRequireSelf<S> {
+  return new Proxy({}, {
+    get(_target, prop, _receiver) {
+      return Effect.fn(function*(...args: any[]) {
+        const instance = yield* service;
+        return yield* instance[prop](...args);
+      })
+    }
+  }) as any;
+}

package/src/common/log.ts

@@ -0,0 +1,3 @@
+export function log(...stuff: any[]) {
+  console.log(...stuff);
+}

package/src/common/render-caller-tree.ts

@@ -0,0 +1,22 @@
+import type { CallerProcess } from "@/modules/common/os-platform/interface";
+import { Option } from "effect";
+
+const CYAN = '\x1b[36m';
+const DIM = '\x1b[2m';
+const RESET = '\x1b[0m';
+
+function fmtNode(node: CallerProcess): string {
+  const dir = Option.getOrElse(() => '?')(node.directory);
+  return `${CYAN}${node.command}${RESET}  ${DIM}${dir}${RESET}`;
+}
+
+export function renderCallerTree(chain: CallerProcess[]): string {
+  if (chain.length === 0) return '(empty)';
+  const lines: string[] = [fmtNode(chain[0]!)];
+  let indent = '';
+  for (let i = 1; i < chain.length; i++) {
+    lines.push(`${indent}└── ${fmtNode(chain[i]!)}`);
+    indent += '    ';
+  }
+  return lines.join('\n');
+}

package/src/entrypoints/ozy-signing-agent.ts

@@ -0,0 +1,48 @@
+import { appendFileSync } from "node:fs";
+import { Effect, Layer, pipe } from "effect";
+import { OSPlatformImpl } from "@/modules/common/os-platform/impl";
+import { CryptoImpl } from "@/modules/common/crypto/impl";
+import { KeyMapStoreImpl } from "@/modules/common/kep-map-store/impl";
+import { SSHConfigImpl } from "@/modules/common/ssh-config/impl";
+import { SSHAgentImpl } from "@/modules/ssh-agent/ssh-agent/impl";
+import { SessionImpl } from "@/modules/ssh-agent/session/impl";
+import { AGENT_LOG_FILE_PATH, AGENT_PID_FILE_PATH, AGENT_PORT_FILE_PATH, AGENT_SOCK_FILE_PATH } from "@/common/constants";
+import { rmSync } from "node:fs";
+
+const origLog = console.log.bind(console);
+const origError = console.error.bind(console);
+const origWarn = console.warn.bind(console);
+
+function logToFile(...args: any[]) {
+  try { 
+    appendFileSync(AGENT_LOG_FILE_PATH, args.map(arg => {
+      try { return JSON.stringify(arg) }
+      catch(e) { return String(e); }
+    }).join(' ') + '\n'); 
+  } catch {}
+}
+
+console.log = (...args: any[]) => { logToFile(...args); origLog(...args); };
+console.error = (...args: any[]) => { logToFile(...args); origError(...args); };
+console.warn = (...args: any[]) => { logToFile(...args); origWarn(...args); };
+
+function cleanup() {
+  try { rmSync(AGENT_PID_FILE_PATH); } catch {}
+  try { rmSync(AGENT_PORT_FILE_PATH); } catch {}
+  try { rmSync(AGENT_SOCK_FILE_PATH); } catch {}
+}
+
+process.on("exit", cleanup);
+process.on("SIGTERM", () => { cleanup(); process.exit(0); });
+process.on("SIGINT", () => { cleanup(); process.exit(0); });
+
+pipe(
+  SSHAgentImpl.ServiceLayer,
+  Layer.provideMerge(SessionImpl.makeRpcLayer()),
+  Layer.provideMerge(KeyMapStoreImpl.Layer),
+  Layer.provideMerge(SSHConfigImpl.Layer),
+  Layer.provideMerge(CryptoImpl.Layer),
+  Layer.provideMerge(OSPlatformImpl.Layer),
+  Layer.launch,
+  Effect.runPromise
+);

package/src/entrypoints/ozy-ssh-keygen.ts

@@ -0,0 +1,10 @@
+import { AGENT_SOCK_FILE_PATH } from "@/common/constants";
+
+const result = Bun.spawnSync(["ssh-keygen", ...Bun.argv.slice(2)], {
+  stdin: "inherit",
+  stdout: "inherit",
+  stderr: "inherit",
+  env: { ...process.env, SSH_AUTH_SOCK: AGENT_SOCK_FILE_PATH },
+});
+
+process.exit(result.exitCode ?? 1);

package/src/entrypoints/ozy-virtual-security-key.ts

@@ -0,0 +1,21 @@
+import { Effect } from "effect";
+import { appendFileSync } from "node:fs";
+import { commonModules } from "@/modules/common";
+import { OSPlatformImpl } from "@/modules/common/os-platform/impl";
+import { VIRTUAL_KEY_LOG_FILE_PATH } from "@/common/constants";
+
+const program = Effect.gen(function* () {
+  const platform = yield* commonModules.OSPlatform;
+  yield* platform.registerVirtualHID((data) =>
+    Effect.sync(() => {
+      appendFileSync(VIRTUAL_KEY_LOG_FILE_PATH, `[vhid] received ${data.length} bytes: ${data.toString('hex')}\n`);
+      return Buffer.alloc(64);
+    })
+  );
+  yield* Effect.never;
+}).pipe(Effect.provide(OSPlatformImpl.Layer));
+
+Effect.runPromise(program).catch(e => {
+  console.error('Virtual security key failed:', e);
+  process.exit(1);
+});

package/src/entrypoints/ozy.ts

@@ -0,0 +1,2 @@
+// TODO: we should move commands to its own layer
+import '@/commands';

package/src/index.ts

@@ -0,0 +1 @@
+export {};

package/src/internal/thing.ts

@@ -0,0 +1,3 @@
+export function time() {
+  console.log("is with us all");
+}