@positronic/cli 0.0.59 → 0.0.60

package/dist/src/lib/jwt-auth.js

@@ -157,13 +157,24 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
-import { SignJWT, importPKCS8 } from 'jose';
+import { SignJWT, importPKCS8, base64url } from 'jose';
 import { existsSync } from 'fs';
-import { loadPrivateKey, getPrivateKeyFingerprint, resolvePrivateKeyPath } from './ssh-key-utils.js';
+import { createPrivateKey } from 'crypto';
+import { loadPrivateKey, getPrivateKeyFingerprint, getPublicKeyFingerprint, resolvePrivateKeyPath } from './ssh-key-utils.js';
 import { ProjectConfigManager } from '../commands/project-config-manager.js';
+import { AgentSigner } from './ssh-agent-signer.js';
+/**
+ * Check if an error indicates an encrypted key
+ */ function isEncryptedKeyError(error) {
+    if (_instanceof(error, Error) && error.name === 'KeyEncryptedError') {
+        return true;
+    }
+    return false;
+}
 /**
  * JWT Auth Provider for authenticating API requests
  * Uses SSH private keys to sign short-lived JWTs
+ * Falls back to ssh-agent for encrypted keys
  */ export var JwtAuthProvider = /*#__PURE__*/ function() {
     "use strict";
     function JwtAuthProvider() {
@@ -172,6 +183,11 @@ import { ProjectConfigManager } from '../commands/project-config-manager.js';
         _define_property(this, "fingerprint", null);
         _define_property(this, "initialized", false);
         _define_property(this, "initError", null);
+        // Agent fallback support
+        _define_property(this, "encryptedKeyPath", null);
+        _define_property(this, "agentSigner", null);
+        _define_property(this, "agentKey", null);
+        _define_property(this, "useAgent", false);
         this.initialize();
     }
     _create_class(JwtAuthProvider, [
@@ -191,16 +207,42 @@ import { ProjectConfigManager } from '../commands/project-config-manager.js';
                     this.fingerprint = getPrivateKeyFingerprint(this.privateKey);
                     this.initialized = true;
                 } catch (error) {
-                    this.initError = _instanceof(error, Error) ? error : new Error('Failed to initialize JWT auth provider');
+                    if (isEncryptedKeyError(error)) {
+                        // Store the path for agent fallback - we'll try the agent in createToken()
+                        var configManager1 = new ProjectConfigManager();
+                        var configuredPath1 = configManager1.getPrivateKeyPath();
+                        this.encryptedKeyPath = resolvePrivateKeyPath(configuredPath1);
+                        this.initError = _instanceof(error, Error) ? error : new Error('Key is encrypted');
+                    } else {
+                        this.initError = _instanceof(error, Error) ? error : new Error('Failed to initialize JWT auth provider');
+                    }
                 }
             }
         },
         {
             /**
    * Check if the provider is ready to create JWTs
+   * Returns true if we have a direct key OR if we have an encrypted key
+   * that might work with agent fallback
    */ key: "isReady",
             value: function isReady() {
-                return this.initialized && this.privateKey !== null;
+                // Direct key is loaded and ready
+                if (this.initialized && this.privateKey !== null) {
+                    return true;
+                }
+                // Encrypted key might work with agent fallback
+                if (this.encryptedKeyPath !== null) {
+                    return true;
+                }
+                return false;
+            }
+        },
+        {
+            /**
+   * Check if we have an encrypted key that requires agent fallback
+   */ key: "hasEncryptedKey",
+            value: function hasEncryptedKey() {
+                return this.encryptedKeyPath !== null;
             }
         },
         {
@@ -227,12 +269,18 @@ import { ProjectConfigManager } from '../commands/project-config-manager.js';
                 if (!this.privateKey) {
                     throw new Error('Private key not loaded');
                 }
-                var keyType = this.privateKey.type;
+                return this.getAlgorithmForKeyType(this.privateKey.type, this.privateKey.curve);
+            }
+        },
+        {
+            key: "getAlgorithmForKeyType",
+            value: /**
+   * Map SSH key type string to JWT algorithm
+   */ function getAlgorithmForKeyType(keyType, curve) {
                 if (keyType === 'rsa') {
                     return 'RS256';
                 } else if (keyType === 'ecdsa') {
                     // ECDSA curve determines algorithm
-                    var curve = this.privateKey.curve;
                     if (curve === 'nistp256') {
                         return 'ES256';
                     } else if (curve === 'nistp384') {
@@ -248,22 +296,102 @@ import { ProjectConfigManager } from '../commands/project-config-manager.js';
                 throw new Error("Unsupported key type: ".concat(keyType));
             }
         },
+        {
+            key: "getPkcs8Pem",
+            value: /**
+   * Convert the SSH private key to PKCS8 PEM format
+   * Ed25519 keys need special handling because sshpk's PKCS8 output
+   * is not compatible with Node.js/OpenSSL
+   */ function getPkcs8Pem() {
+                if (!this.privateKey) {
+                    throw new Error('Private key not loaded');
+                }
+                if (this.privateKey.type === 'ed25519') {
+                    // For Ed25519, sshpk's PKCS8 output includes the public key in a format
+                    // that Node.js/OpenSSL doesn't understand. Instead, we construct a JWK
+                    // from the raw key parts and let Node's crypto handle the conversion.
+                    // sshpk stores Ed25519 key data in 'k' (seed) and 'A' (public) parts
+                    var parts = this.privateKey.part;
+                    var seed = parts.k.data;
+                    var publicKey = parts.A.data;
+                    // Construct JWK and let Node's crypto convert to PKCS8
+                    var jwk = {
+                        kty: 'OKP',
+                        crv: 'Ed25519',
+                        d: seed.toString('base64url'),
+                        x: publicKey.toString('base64url')
+                    };
+                    var keyObj = createPrivateKey({
+                        key: jwk,
+                        format: 'jwk'
+                    });
+                    return keyObj.export({
+                        type: 'pkcs8',
+                        format: 'pem'
+                    });
+                }
+                // For RSA and ECDSA, sshpk's PKCS8 output works fine
+                return this.privateKey.toString('pkcs8');
+            }
+        },
         {
             key: "createToken",
             value: /**
    * Create a short-lived JWT for authentication
    */ function createToken() {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                // If we have a direct private key, use the standard jose signing path
+                                if (this.privateKey && this.fingerprint) {
+                                    return [
+                                        2,
+                                        this.createTokenDirect()
+                                    ];
+                                }
+                                if (!this.encryptedKeyPath) return [
+                                    3,
+                                    2
+                                ];
+                                return [
+                                    4,
+                                    this.tryAgentFallback()
+                                ];
+                            case 1:
+                                _state.sent();
+                                _state.label = 2;
+                            case 2:
+                                // If agent fallback succeeded, use agent signing
+                                if (this.useAgent && this.agentSigner && this.agentKey && this.fingerprint) {
+                                    return [
+                                        2,
+                                        this.createTokenWithAgent()
+                                    ];
+                                }
+                                // No authentication method available
+                                throw this.initError || new Error('JWT auth provider not initialized');
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "createTokenDirect",
+            value: /**
+   * Create JWT using direct private key (jose library)
+   */ function createTokenDirect() {
                 return _async_to_generator(function() {
                     var algorithm, pkcs8Pem, joseKey, jwt;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 if (!this.privateKey || !this.fingerprint) {
-                                    throw new Error('JWT auth provider not initialized');
+                                    throw new Error('Private key not loaded');
                                 }
                                 algorithm = this.getAlgorithm();
                                 // Convert SSH private key to PKCS8 PEM format
-                                pkcs8Pem = this.privateKey.toString('pkcs8');
+                                pkcs8Pem = this.getPkcs8Pem();
                                 return [
                                     4,
                                     importPKCS8(pkcs8Pem, algorithm)
@@ -286,6 +414,106 @@ import { ProjectConfigManager } from '../commands/project-config-manager.js';
                     });
                 }).call(this);
             }
+        },
+        {
+            key: "tryAgentFallback",
+            value: /**
+   * Try to use ssh-agent for signing when private key is encrypted
+   */ function tryAgentFallback() {
+                return _async_to_generator(function() {
+                    var pubKeyPath, fingerprint, agent, agentKey;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (!this.encryptedKeyPath) {
+                                    return [
+                                        2
+                                    ];
+                                }
+                                // Get fingerprint from public key file
+                                pubKeyPath = this.encryptedKeyPath + '.pub';
+                                if (!existsSync(pubKeyPath)) {
+                                    throw new Error("Key is encrypted and public key file not found at ".concat(pubKeyPath, ".\n") + "Cannot determine key fingerprint for ssh-agent lookup.");
+                                }
+                                fingerprint = getPublicKeyFingerprint(pubKeyPath);
+                                agent = new AgentSigner();
+                                if (!agent.isAvailable()) {
+                                    throw new Error("Key is encrypted and ssh-agent is not running.\n" + "Start ssh-agent or use an unencrypted key.");
+                                }
+                                return [
+                                    4,
+                                    agent.hasKey(fingerprint)
+                                ];
+                            case 1:
+                                agentKey = _state.sent();
+                                if (!agentKey) {
+                                    throw new Error("Key is encrypted and not loaded in ssh-agent.\n" + "Run: ssh-add ".concat(this.encryptedKeyPath));
+                                }
+                                this.agentSigner = agent;
+                                this.agentKey = agentKey;
+                                this.fingerprint = fingerprint;
+                                this.useAgent = true;
+                                this.initError = null;
+                                this.initialized = true;
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "createTokenWithAgent",
+            value: /**
+   * Create JWT using ssh-agent for signing
+   * Manually constructs the JWT since jose expects to do signing itself
+   */ function createTokenWithAgent() {
+                return _async_to_generator(function() {
+                    var keyType, curve, algorithm, header, encodedHeader, now, payload, encodedPayload, signingInput, signature, signatureBytes, encodedSignature;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (!this.agentSigner || !this.agentKey || !this.fingerprint) {
+                                    throw new Error('Agent signing not configured');
+                                }
+                                // Get algorithm from agent key type
+                                keyType = this.agentKey.type;
+                                curve = this.agentKey.curve;
+                                algorithm = this.getAlgorithmForKeyType(keyType, curve);
+                                // Build JWT header
+                                header = {
+                                    alg: algorithm
+                                };
+                                encodedHeader = base64url.encode(JSON.stringify(header));
+                                // Build JWT payload
+                                now = Math.floor(Date.now() / 1000);
+                                payload = {
+                                    sub: this.fingerprint,
+                                    iat: now,
+                                    exp: now + 30
+                                };
+                                encodedPayload = base64url.encode(JSON.stringify(payload));
+                                // Create signing input
+                                signingInput = "".concat(encodedHeader, ".").concat(encodedPayload);
+                                return [
+                                    4,
+                                    this.agentSigner.sign(this.agentKey, Buffer.from(signingInput))
+                                ];
+                            case 1:
+                                signature = _state.sent();
+                                // Convert sshpk.Signature to raw bytes for JWT
+                                // sshpk's toBuffer() gives us the raw signature bytes
+                                signatureBytes = signature.toBuffer('raw');
+                                encodedSignature = base64url.encode(signatureBytes);
+                                return [
+                                    2,
+                                    "".concat(signingInput, ".").concat(encodedSignature)
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
         }
     ]);
     return JwtAuthProvider;
@@ -313,33 +541,31 @@ var providerInstance = null;
 }
 /**
  * Get the Authorization header if auth is available
- * Returns { Authorization: 'Bearer <token>' } or empty object
+ * Throws if there's an auth configuration error
+ * Returns empty object with warning if no key is configured
  */ export function getAuthHeader() {
     return _async_to_generator(function() {
-        var provider, token, error;
+        var provider, error, token;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
                     provider = getJwtAuthProvider();
                     if (!provider.isReady()) {
+                        error = provider.getError();
+                        if (error) {
+                            throw error;
+                        }
+                        console.warn('Warning: No SSH key configured for authentication. Run "px auth login" to configure.');
                         return [
                             2,
                             {}
                         ];
                     }
-                    _state.label = 1;
-                case 1:
-                    _state.trys.push([
-                        1,
-                        3,
-                        ,
-                        4
-                    ]);
                     return [
                         4,
                         provider.createToken()
                     ];
-                case 2:
+                case 1:
                     token = _state.sent();
                     return [
                         2,
@@ -347,17 +573,6 @@ var providerInstance = null;
                             Authorization: "Bearer ".concat(token)
                         }
                     ];
-                case 3:
-                    error = _state.sent();
-                    console.error('Warning: Failed to create auth token:', error);
-                    return [
-                        2,
-                        {}
-                    ];
-                case 4:
-                    return [
-                        2
-                    ];
             }
         });
     })();

package/dist/src/lib/ssh-agent-signer.js

@@ -0,0 +1,296 @@
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import { Client as AgentClient } from 'sshpk-agent';
+/**
+ * Wrapper for ssh-agent operations using sshpk-agent
+ */ export var AgentSigner = /*#__PURE__*/ function() {
+    "use strict";
+    function AgentSigner() {
+        _class_call_check(this, AgentSigner);
+        _define_property(this, "client", null);
+        _define_property(this, "keys", null);
+    }
+    _create_class(AgentSigner, [
+        {
+            /**
+   * Check if ssh-agent is available (SSH_AUTH_SOCK environment variable exists)
+   */ key: "isAvailable",
+            value: function isAvailable() {
+                return !!process.env.SSH_AUTH_SOCK;
+            }
+        },
+        {
+            key: "getClient",
+            value: /**
+   * Get the agent client, creating it lazily
+   */ function getClient() {
+                if (!this.client) {
+                    this.client = new AgentClient();
+                }
+                return this.client;
+            }
+        },
+        {
+            key: "getKeys",
+            value: /**
+   * List all keys available in the ssh-agent
+   */ function getKeys() {
+                return _async_to_generator(function() {
+                    var _this, client;
+                    return _ts_generator(this, function(_state) {
+                        _this = this;
+                        if (this.keys) {
+                            return [
+                                2,
+                                this.keys
+                            ];
+                        }
+                        client = this.getClient();
+                        return [
+                            2,
+                            new Promise(function(resolve, reject) {
+                                client.listKeys(function(err, keys) {
+                                    if (err) {
+                                        reject(err);
+                                        return;
+                                    }
+                                    _this.keys = keys;
+                                    resolve(keys);
+                                });
+                            })
+                        ];
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "hasKey",
+            value: /**
+   * Check if the agent has a key with the given fingerprint
+   * Returns the key if found, null otherwise
+   */ function hasKey(fingerprint) {
+                return _async_to_generator(function() {
+                    var keys, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, key, keyFingerprint;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.getKeys()
+                                ];
+                            case 1:
+                                keys = _state.sent();
+                                _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                                try {
+                                    for(_iterator = keys[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                                        key = _step.value;
+                                        keyFingerprint = key.fingerprint('sha256').toString();
+                                        if (keyFingerprint === fingerprint) {
+                                            return [
+                                                2,
+                                                key
+                                            ];
+                                        }
+                                    }
+                                } catch (err) {
+                                    _didIteratorError = true;
+                                    _iteratorError = err;
+                                } finally{
+                                    try {
+                                        if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                            _iterator.return();
+                                        }
+                                    } finally{
+                                        if (_didIteratorError) {
+                                            throw _iteratorError;
+                                        }
+                                    }
+                                }
+                                return [
+                                    2,
+                                    null
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "sign",
+            value: /**
+   * Sign data with a key from the agent
+   * Returns the sshpk.Signature object
+   */ function sign(key, data) {
+                return _async_to_generator(function() {
+                    var client;
+                    return _ts_generator(this, function(_state) {
+                        client = this.getClient();
+                        return [
+                            2,
+                            new Promise(function(resolve, reject) {
+                                client.sign(key, data, function(err, signature) {
+                                    if (err) {
+                                        reject(err);
+                                        return;
+                                    }
+                                    resolve(signature);
+                                });
+                            })
+                        ];
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return AgentSigner;
+}();

package/dist/src/lib/ssh-key-utils.js

@@ -171,6 +171,15 @@ import { createPublicKey } from 'crypto';
     var publicKey = privateKey.toPublic();
     return publicKey.fingerprint('sha256').toString();
 }
+/**
+ * Get the fingerprint from a public key file (.pub file)
+ * This is useful when the private key is encrypted but we need the fingerprint
+ * to look up the key in ssh-agent
+ */ export function getPublicKeyFingerprint(pubKeyPath) {
+    var content = readFileSync(pubKeyPath, 'utf-8').trim();
+    var sshKey = sshpk.parseKey(content, 'auto');
+    return sshKey.fingerprint('sha256').toString();
+}
 /**
  * Resolve the private key path from environment, config, or default
  * @param configuredPath - Optional configured path from ProjectConfigManager

package/dist/types/lib/jwt-auth.d.ts

@@ -1,18 +1,29 @@
 /**
  * JWT Auth Provider for authenticating API requests
  * Uses SSH private keys to sign short-lived JWTs
+ * Falls back to ssh-agent for encrypted keys
  */
 export declare class JwtAuthProvider {
     private privateKey;
     private fingerprint;
     private initialized;
     private initError;
+    private encryptedKeyPath;
+    private agentSigner;
+    private agentKey;
+    private useAgent;
     constructor();
     private initialize;
     /**
      * Check if the provider is ready to create JWTs
+     * Returns true if we have a direct key OR if we have an encrypted key
+     * that might work with agent fallback
      */
     isReady(): boolean;
+    /**
+     * Check if we have an encrypted key that requires agent fallback
+     */
+    hasEncryptedKey(): boolean;
     /**
      * Get the error that occurred during initialization, if any
      */
@@ -25,10 +36,33 @@ export declare class JwtAuthProvider {
      * Map SSH key type to JWT algorithm
      */
     private getAlgorithm;
+    /**
+     * Map SSH key type string to JWT algorithm
+     */
+    private getAlgorithmForKeyType;
+    /**
+     * Convert the SSH private key to PKCS8 PEM format
+     * Ed25519 keys need special handling because sshpk's PKCS8 output
+     * is not compatible with Node.js/OpenSSL
+     */
+    private getPkcs8Pem;
     /**
      * Create a short-lived JWT for authentication
      */
     createToken(): Promise<string>;
+    /**
+     * Create JWT using direct private key (jose library)
+     */
+    private createTokenDirect;
+    /**
+     * Try to use ssh-agent for signing when private key is encrypted
+     */
+    private tryAgentFallback;
+    /**
+     * Create JWT using ssh-agent for signing
+     * Manually constructs the JWT since jose expects to do signing itself
+     */
+    private createTokenWithAgent;
 }
 /**
  * Get the singleton JWT auth provider instance
@@ -45,7 +79,8 @@ export declare function resetJwtAuthProvider(): void;
 export declare function isAuthAvailable(): boolean;
 /**
  * Get the Authorization header if auth is available
- * Returns { Authorization: 'Bearer <token>' } or empty object
+ * Throws if there's an auth configuration error
+ * Returns empty object with warning if no key is configured
  */
 export declare function getAuthHeader(): Promise<Record<string, string>>;
 //# sourceMappingURL=jwt-auth.d.ts.map

package/dist/types/lib/jwt-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/lib/jwt-auth.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,SAAS,CAAsB;;IAMvC,OAAO,CAAC,UAAU;IA0BlB;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,QAAQ,IAAI,KAAK,GAAG,IAAI;IAIxB;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B;;OAEG;IACH,OAAO,CAAC,YAAY;IA4BpB;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAuBrC;AAKD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAarE"}
+{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/lib/jwt-auth.ts"],"names":[],"mappings":"AAuBA;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,SAAS,CAAsB;IAGvC,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,QAAQ,CAAS;;IAMzB,OAAO,CAAC,UAAU;IAqClB;;;;OAIG;IACH,OAAO,IAAI,OAAO;IAYlB;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACH,QAAQ,IAAI,KAAK,GAAG,IAAI;IAIxB;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqB9B;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAiCnB;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAoBpC;;OAEG;YACW,iBAAiB;IAwB/B;;OAEG;YACW,gBAAgB;IAwC9B;;;OAGG;YACW,oBAAoB;CAuCnC;AAKD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBrE"}

package/dist/types/lib/ssh-agent-signer.d.ts

@@ -0,0 +1,31 @@
+import sshpk from 'sshpk';
+/**
+ * Wrapper for ssh-agent operations using sshpk-agent
+ */
+export declare class AgentSigner {
+    private client;
+    private keys;
+    /**
+     * Check if ssh-agent is available (SSH_AUTH_SOCK environment variable exists)
+     */
+    isAvailable(): boolean;
+    /**
+     * Get the agent client, creating it lazily
+     */
+    private getClient;
+    /**
+     * List all keys available in the ssh-agent
+     */
+    getKeys(): Promise<sshpk.Key[]>;
+    /**
+     * Check if the agent has a key with the given fingerprint
+     * Returns the key if found, null otherwise
+     */
+    hasKey(fingerprint: string): Promise<sshpk.Key | null>;
+    /**
+     * Sign data with a key from the agent
+     * Returns the sshpk.Signature object
+     */
+    sign(key: sshpk.Key, data: Buffer): Promise<sshpk.Signature>;
+}
+//# sourceMappingURL=ssh-agent-signer.d.ts.map

package/dist/types/lib/ssh-agent-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-agent-signer.d.ts","sourceRoot":"","sources":["../../../src/lib/ssh-agent-signer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,IAAI,CAA4B;IAExC;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,OAAO,CAAC,SAAS;IAOjB;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAmBrC;;;OAGG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;IAa5D;;;OAGG;IACG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;CAanE"}

package/dist/types/lib/ssh-key-utils.d.ts

@@ -29,6 +29,12 @@ export declare function loadPrivateKey(pathOrEnv?: string): sshpk.PrivateKey;
  * Get the fingerprint of a private key (from its public component)
  */
 export declare function getPrivateKeyFingerprint(privateKey: sshpk.PrivateKey): string;
+/**
+ * Get the fingerprint from a public key file (.pub file)
+ * This is useful when the private key is encrypted but we need the fingerprint
+ * to look up the key in ssh-agent
+ */
+export declare function getPublicKeyFingerprint(pubKeyPath: string): string;
 /**
  * Resolve the private key path from environment, config, or default
  * @param configuredPath - Optional configured path from ProjectConfigManager

package/dist/types/lib/ssh-key-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-key-utils.d.ts","sourceRoot":"","sources":["../../../src/lib/ssh-key-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAmB,UAAU,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,aAAa,EAAE,CAkDjD;AA0CD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAiBpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,UAAU,CAyBnE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAG7E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAoB5E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKlD"}
+{"version":3,"file":"ssh-key-utils.d.ts","sourceRoot":"","sources":["../../../src/lib/ssh-key-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAmB,UAAU,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,aAAa,EAAE,CAkDjD;AA0CD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAiBpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,UAAU,CAyBnE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAG7E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAIlE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAoB5E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKlD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@positronic/cli",
-  "version": "0.0.59",
+  "version": "0.0.60",
   "publishConfig": {
     "access": "public"
   },
@@ -23,9 +23,9 @@
     "clean": "rm -rf tsconfig.tsbuildinfo dist node_modules"
   },
   "dependencies": {
-    "@positronic/core": "^0.0.59",
-    "@positronic/spec": "^0.0.59",
-    "@positronic/template-new-project": "^0.0.59",
+    "@positronic/core": "^0.0.60",
+    "@positronic/spec": "^0.0.60",
+    "@positronic/template-new-project": "^0.0.60",
     "caz": "^2.0.0",
     "chokidar": "^3.6.0",
     "dotenv": "^16.4.7",
@@ -38,6 +38,7 @@
     "react": "^18.3.1",
     "react-robot": "^1.2.1",
     "sshpk": "^1.18.0",
+    "sshpk-agent": "^1.8.1",
     "yargs": "^17.7.2"
   },
   "devDependencies": {