@sema-agent/server 1.185.0

package/dist/plugins/remote-env-ssh.d.ts

@@ -0,0 +1,122 @@
+import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory } from "@sema-agent/core";
+type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
+export interface SshEnvConfig {
+    host: string;
+    port?: number;
+    username: string;
+    privateKey: string;
+    passphrase?: string;
+    mountPath?: string;
+    readyTimeoutMs?: number;
+    commandTimeoutMs?: number;
+    dataTimeoutMs?: number;
+    retry?: {
+        maxAttempts?: number;
+        backoffMs?: number;
+    };
+}
+type ConnectResult = {
+    ok: true;
+    value: WorkspaceHandle;
+} | {
+    ok: false;
+    error: RemoteExecutionError;
+};
+export interface SshEnvDeps {
+    connectOnce?: (signal?: AbortSignal) => Promise<ConnectResult>;
+}
+export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
+    readonly capabilities: {
+        isolation: boolean;
+        suspendable: boolean;
+    };
+    cwd: string;
+    private conn?;
+    private sftpPromise?;
+    private readonly cfg;
+    private readonly injectedConnectOnce?;
+    constructor(config: SshEnvConfig, deps?: SshEnvDeps);
+    private resolve;
+    workspaceHandle(): WorkspaceHandle;
+    connect(config?: RemoteConnectConfig): Promise<{
+        ok: true;
+        value: WorkspaceHandle;
+    } | {
+        ok: false;
+        error: RemoteExecutionError;
+    }>;
+    private connectOnce;
+    suspendVM(_options?: VmLifecycleOptions): Promise<{
+        ok: true;
+        value: SnapshotId;
+    } | {
+        ok: false;
+        error: RemoteExecutionError;
+    }>;
+    resumeVM(_snapshotId: SnapshotId, _options?: VmLifecycleOptions): Promise<{
+        ok: true;
+        value: WorkspaceHandle;
+    } | {
+        ok: false;
+        error: RemoteExecutionError;
+    }>;
+    postResumeInit(): Promise<{
+        ok: true;
+        value: void;
+    } | {
+        ok: false;
+        error: RemoteExecutionError;
+    }>;
+    reconnect(_sessionToken: SessionToken): Promise<{
+        ok: true;
+        value: WorkspaceHandle;
+    } | {
+        ok: false;
+        error: RemoteExecutionError;
+    }>;
+    destroy(): Promise<void>;
+    cleanup(): Promise<void>;
+    exec(command: string, options?: ExecOpts): Promise<Result<{
+        stdout: string;
+        stderr: string;
+        exitCode: number;
+    }, ExecutionError>>;
+    execStream(command: string, options?: ExecStreamOptions): AsyncIterable<OutputChunk>;
+    private sftp;
+    absolutePath(p: string): Promise<Result<string, FileError>>;
+    joinPath(parts: string[]): Promise<Result<string, FileError>>;
+    readTextFile(p: string, abortSignal?: AbortSignal): Promise<Result<string, FileError>>;
+    readTextLines(p: string, options?: {
+        maxLines?: number;
+        abortSignal?: AbortSignal;
+    }): Promise<Result<string[], FileError>>;
+    readBinaryFile(p: string, abortSignal?: AbortSignal): Promise<Result<Uint8Array, FileError>>;
+    writeFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+    appendFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+    fileInfo(p: string, abortSignal?: AbortSignal): Promise<Result<FileInfo, FileError>>;
+    listDir(p: string, abortSignal?: AbortSignal): Promise<Result<FileInfo[], FileError>>;
+    canonicalPath(p: string, abortSignal?: AbortSignal): Promise<Result<string, FileError>>;
+    exists(p: string, abortSignal?: AbortSignal): Promise<Result<boolean, FileError>>;
+    createDir(p: string, options?: {
+        recursive?: boolean;
+        abortSignal?: AbortSignal;
+    }): Promise<Result<void, FileError>>;
+    remove(p: string, options?: {
+        recursive?: boolean;
+        force?: boolean;
+        abortSignal?: AbortSignal;
+    }): Promise<Result<void, FileError>>;
+    createTempDir(prefix?: string, abortSignal?: AbortSignal): Promise<Result<string, FileError>>;
+    createTempFile(options?: {
+        prefix?: string;
+        suffix?: string;
+        abortSignal?: AbortSignal;
+    }): Promise<Result<string, FileError>>;
+    private withCwdEnv;
+    private tempResult;
+    private connErr;
+    private fileError;
+}
+export declare function sshExecutionEnvFactory(config: SshEnvConfig): ExecutionEnvFactory;
+export {};
+//# sourceMappingURL=remote-env-ssh.d.ts.map

package/dist/plugins/remote-env-ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-env-ssh.d.ts","sourceRoot":"","sources":["../../src/plugins/remote-env-ssh.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,SAAS,EACT,cAAc,EACd,oBAAoB,EAIpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAEzB,MAAM,kBAAkB,CAAC;AAE1B,KAAK,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAQpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IAEjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,KAAK,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,KAAK,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAOvG,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAChE;AAED,qBAAa,qBAAsB,YAAW,kBAAkB;IAC9D,QAAQ,CAAC,YAAY;;;MAA4C;IAEjE,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAS;IACtB,OAAO,CAAC,WAAW,CAAC,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkJ;IACtK,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAmD;gBAE5E,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,UAAU;IAiBnD,OAAO,CAAC,OAAO;IAIf,eAAe,IAAI,eAAe;IAM5B,OAAO,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAUvI,OAAO,CAAC,WAAW;IAwCb,SAAS,CAAC,QAAQ,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAG/H,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAG5J,cAAc,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAKjG,SAAS,CAAC,aAAa,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAQlI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IASxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,cAAc,CAAC,CAAC;IA0E/H,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,aAAa,CAAC,WAAW,CAAC;IAsH3F,OAAO,CAAC,IAAI;IAUN,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAG3D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAI7D,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAKtF,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IAS1H,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAW5F,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAkB/G,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAchH,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAWpF,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;IAgBrF,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAavF,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAOjF,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAapH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAelI,aAAa,CAAC,MAAM,SAAS,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAI7F,cAAc,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAUnI,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,SAAS;CAUlB;AAOD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,mBAAmB,CAEhF"}

package/dist/plugins/remote-env-ssh.js

@@ -0,0 +1,511 @@
+import path from "node:path";
+import { Client } from "ssh2";
+import { shellQuote, kindFromMode } from "./remote-shell.js";
+import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
+const PROVIDER = "ssh";
+const ok = (value) => ({ ok: true, value });
+const unsupported = (op) => ({
+    ok: false,
+    error: new RemoteExecutionError("unsupported", `${op} is not supported on an SSH target (real machine — not snapshotable; capabilities.suspendable=false)`),
+});
+export class RemoteSshExecutionEnv {
+    capabilities = { isolation: false, suspendable: false };
+    cwd;
+    conn;
+    sftpPromise;
+    cfg;
+    injectedConnectOnce;
+    constructor(config, deps) {
+        this.injectedConnectOnce = deps?.connectOnce;
+        this.cfg = {
+            host: config.host,
+            port: config.port ?? 22,
+            username: config.username,
+            privateKey: config.privateKey,
+            passphrase: config.passphrase,
+            mountPath: config.mountPath ?? ".",
+            readyTimeoutMs: config.readyTimeoutMs ?? 15_000,
+            commandTimeoutMs: config.commandTimeoutMs ?? 5 * 60_000,
+            dataTimeoutMs: config.dataTimeoutMs ?? 5 * 60_000,
+            retry: { maxAttempts: config.retry?.maxAttempts ?? 3, backoffMs: config.retry?.backoffMs ?? 500 },
+        };
+        this.cwd = this.cfg.mountPath;
+    }
+    resolve(p) {
+        return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));
+    }
+    workspaceHandle() {
+        return { sandboxId: `${this.cfg.host}:${this.cfg.port}`, provider: PROVIDER, mountPath: this.cwd };
+    }
+    async connect(config) {
+        const policy = {
+            retryableCodes: ["connect_failed", "timeout"],
+            maxAttempts: this.cfg.retry.maxAttempts,
+            backoffMs: (failed) => this.cfg.retry.backoffMs * failed,
+        };
+        const once = this.injectedConnectOnce ?? ((s) => this.connectOnce(s));
+        return withRetry((_attempt) => once(config?.abortSignal), policy, { signal: config?.abortSignal });
+    }
+    connectOnce(signal) {
+        return new Promise((resolve) => {
+            if (signal?.aborted)
+                return resolve({ ok: false, error: new RemoteExecutionError("aborted", "connect aborted") });
+            const c = new Client();
+            const opts = {
+                host: this.cfg.host,
+                port: this.cfg.port,
+                username: this.cfg.username,
+                privateKey: this.cfg.privateKey,
+                ...(this.cfg.passphrase ? { passphrase: this.cfg.passphrase } : {}),
+                readyTimeout: this.cfg.readyTimeoutMs,
+            };
+            c.on("ready", () => {
+                this.conn = c;
+                this.sftpPromise = undefined;
+                c.on("close", () => {
+                    if (this.conn === c) {
+                        this.conn = undefined;
+                        this.sftpPromise = undefined;
+                    }
+                });
+                resolve({ ok: true, value: this.workspaceHandle() });
+            }).on("error", (e) => {
+                try {
+                    c.end();
+                }
+                catch {
+                }
+                resolve({ ok: false, error: this.connErr(e) });
+            });
+            try {
+                c.connect(opts);
+            }
+            catch (e) {
+                resolve({ ok: false, error: this.connErr(e) });
+            }
+        });
+    }
+    async suspendVM(_options) {
+        return unsupported("suspendVM");
+    }
+    async resumeVM(_snapshotId, _options) {
+        return unsupported("resumeVM");
+    }
+    async postResumeInit() {
+        return unsupported("postResumeInit");
+    }
+    async reconnect(_sessionToken) {
+        this.conn?.end();
+        this.conn = undefined;
+        this.sftpPromise = undefined;
+        return this.connect();
+    }
+    async destroy() {
+        try {
+            this.conn?.end();
+        }
+        catch {
+        }
+        this.conn = undefined;
+        this.sftpPromise = undefined;
+    }
+    async cleanup() {
+        return this.destroy();
+    }
+    async exec(command, options) {
+        const conn = this.conn;
+        if (!conn)
+            return { ok: false, error: new ExecutionError("shell_unavailable", "SSH not connected — call connect() first") };
+        const timeoutMs = options?.timeout != null ? options.timeout * 1000 : this.cfg.commandTimeoutMs;
+        return new Promise((resolve) => {
+            const outBuf = new RollingTailBuffer();
+            const errBuf = new RollingTailBuffer();
+            let settled = false;
+            let streamRef;
+            const finish = (r) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                options?.abortSignal?.removeEventListener("abort", onAbort);
+                conn.removeListener("close", onConnClose);
+                try {
+                    streamRef?.close();
+                }
+                catch {
+                }
+                resolve(r);
+            };
+            const timer = setTimeout(() => finish({ ok: false, error: new ExecutionError("timeout", `ssh exec exceeded ${timeoutMs}ms (provider/command hang)`) }), timeoutMs);
+            const onAbort = () => finish({ ok: false, error: new ExecutionError("aborted", "ssh exec aborted") });
+            const onConnClose = () => finish({ ok: false, error: new ExecutionError("transport_lost", "ssh transport lost mid-command (connection closed before exit status) — reconnect + retry per idempotency") });
+            conn.once("close", onConnClose);
+            if (options?.abortSignal) {
+                if (options.abortSignal.aborted)
+                    return onAbort();
+                options.abortSignal.addEventListener("abort", onAbort, { once: true });
+            }
+            const full = this.withCwdEnv(command, options?.cwd, options?.env);
+            conn.exec(full, (err, stream) => {
+                if (err)
+                    return finish({ ok: false, error: new ExecutionError("spawn_error", `ssh exec failed: ${err.message}`, err) });
+                streamRef = stream;
+                if (settled) {
+                    try {
+                        stream.close();
+                    }
+                    catch {
+                    }
+                    return;
+                }
+                stream
+                    .on("data", (d) => {
+                    outBuf.push(d);
+                    options?.onStdout?.(d.toString());
+                })
+                    .on("close", (code, signal) => {
+                    if (code == null && !signal) {
+                        return finish({ ok: false, error: new ExecutionError("transport_lost", "ssh channel closed without exit status (transport lost / connection dropped)") });
+                    }
+                    const out = outBuf.result();
+                    const err = errBuf.result();
+                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode: code ?? 0 }));
+                })
+                    .stderr.on("data", (d) => {
+                    errBuf.push(d);
+                    options?.onStderr?.(d.toString());
+                });
+            });
+        });
+    }
+    async *execStream(command, options) {
+        const conn = this.conn;
+        if (!conn)
+            throw new RemoteExecutionError("connect_failed", "SSH not connected — call connect() first");
+        const queue = [];
+        let finished = false;
+        let failure;
+        let exitCode = 0;
+        let wake;
+        const signalReady = () => {
+            const w = wake;
+            wake = undefined;
+            w?.();
+        };
+        let lastChunk = Date.now();
+        const idleMs = options?.readTimeoutMs;
+        let streamRef;
+        let onAbort;
+        let paused = false;
+        let done = false;
+        const onConnClose = () => {
+            if (!finished) {
+                failure = failure ?? new RemoteExecutionError("transport_lost", "ssh transport lost mid-stream (connection closed) — reconnect + retry per idempotency");
+                finished = true;
+                signalReady();
+            }
+        };
+        conn.once("close", onConnClose);
+        const teardown = () => {
+            done = true;
+            conn.removeListener("close", onConnClose);
+            if (onAbort) {
+                options?.signal?.removeEventListener("abort", onAbort);
+                onAbort = undefined;
+            }
+            try {
+                streamRef?.close();
+            }
+            catch {
+            }
+        };
+        const full = this.withCwdEnv(command, options?.cwd, options?.env);
+        conn.exec(full, (err, stream) => {
+            if (err) {
+                failure = new RemoteExecutionError("unknown", `ssh exec failed: ${err.message}`, err);
+                finished = true;
+                signalReady();
+                return;
+            }
+            streamRef = stream;
+            if (done) {
+                try {
+                    stream.close();
+                }
+                catch {
+                }
+                return;
+            }
+            if (options?.signal) {
+                onAbort = () => {
+                    failure = new RemoteExecutionError("aborted", "execStream aborted");
+                    finished = true;
+                    signalReady();
+                };
+                if (options.signal.aborted)
+                    onAbort();
+                else
+                    options.signal.addEventListener("abort", onAbort, { once: true });
+            }
+            const enqueue = (chunk) => {
+                lastChunk = Date.now();
+                queue.push(chunk);
+                if (queue.length >= 512 && !paused) {
+                    paused = true;
+                    stream.pause();
+                }
+                signalReady();
+            };
+            stream
+                .on("data", (d) => enqueue({ type: "stdout", data: d.toString() }))
+                .on("close", (code, signal) => {
+                if (code == null && !signal && !failure) {
+                    failure = new RemoteExecutionError("transport_lost", "ssh channel closed without exit status (transport lost)");
+                }
+                exitCode = code ?? 0;
+                finished = true;
+                signalReady();
+            })
+                .stderr.on("data", (d) => enqueue({ type: "stderr", data: d.toString() }));
+        });
+        try {
+            for (;;) {
+                while (queue.length)
+                    yield queue.shift();
+                if (paused) {
+                    paused = false;
+                    streamRef?.resume();
+                }
+                if (failure)
+                    throw failure;
+                if (finished)
+                    break;
+                const waitMs = idleMs ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                await new Promise((r) => {
+                    wake = r;
+                    setTimeout(r, waitMs);
+                });
+                if (idleMs && !finished && Date.now() - lastChunk >= idleMs)
+                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (provider hang / unreachable host)`);
+            }
+            while (queue.length)
+                yield queue.shift();
+            yield { type: "exit", exitCode };
+        }
+        finally {
+            teardown();
+        }
+    }
+    sftp() {
+        if (!this.conn)
+            return Promise.reject(new Error("SSH not connected"));
+        if (!this.sftpPromise) {
+            this.sftpPromise = new Promise((resolve, reject) => {
+                this.conn.sftp((err, sftp) => (err ? reject(err) : resolve(sftp)));
+            });
+        }
+        return this.sftpPromise;
+    }
+    async absolutePath(p) {
+        return ok(this.resolve(p));
+    }
+    async joinPath(parts) {
+        return ok(path.posix.join(...parts));
+    }
+    async readTextFile(p, abortSignal) {
+        const r = await this.readBinaryFile(p, abortSignal);
+        return r.ok ? ok(Buffer.from(r.value).toString("utf8")) : r;
+    }
+    async readTextLines(p, options) {
+        const r = await this.readTextFile(p, options?.abortSignal);
+        if (!r.ok)
+            return r;
+        let lines = r.value.split(/\r?\n/);
+        if (lines.length > 0 && lines[lines.length - 1] === "")
+            lines.pop();
+        if (options?.maxLines != null)
+            lines = lines.slice(0, options.maxLines);
+        return ok(lines);
+    }
+    async readBinaryFile(p, abortSignal) {
+        const abs = this.resolve(p);
+        try {
+            const sftp = await this.sftp();
+            const buf = await new Promise((resolve, reject) => sftp.readFile(abs, (err, b) => (err ? reject(err) : resolve(b))));
+            return ok(new Uint8Array(buf));
+        }
+        catch (e) {
+            return { ok: false, error: this.fileError(e, abs) };
+        }
+    }
+    async writeFile(p, content, abortSignal) {
+        const abs = this.resolve(p);
+        const dir = path.posix.dirname(abs);
+        if (dir && dir !== "." && dir !== "/") {
+            const mk = await this.exec(`mkdir -p -- ${shellQuote(dir)}`, { abortSignal });
+            if (mk.ok && mk.value.exitCode !== 0)
+                return { ok: false, error: new FileError("unknown", mk.value.stderr.trim() || `mkdir -p failed for ${dir}`, dir) };
+        }
+        try {
+            const sftp = await this.sftp();
+            const data = typeof content === "string" ? Buffer.from(content, "utf8") : Buffer.from(content);
+            await new Promise((resolve, reject) => sftp.writeFile(abs, data, (err) => (err ? reject(err) : resolve())));
+            return ok(undefined);
+        }
+        catch (e) {
+            return { ok: false, error: this.fileError(e, abs) };
+        }
+    }
+    async appendFile(p, content, abortSignal) {
+        const abs = this.resolve(p);
+        const existing = await this.readBinaryFile(abs, abortSignal);
+        let base;
+        if (existing.ok)
+            base = existing.value;
+        else if (existing.error.code === "not_found")
+            base = new Uint8Array(0);
+        else
+            return existing;
+        const add = typeof content === "string" ? new TextEncoder().encode(content) : content;
+        const merged = new Uint8Array(base.length + add.length);
+        merged.set(base, 0);
+        merged.set(add, base.length);
+        return this.writeFile(abs, merged, abortSignal);
+    }
+    async fileInfo(p, abortSignal) {
+        const abs = this.resolve(p);
+        try {
+            const sftp = await this.sftp();
+            const st = await new Promise((resolve, reject) => sftp.lstat(abs, (err, s) => (err ? reject(err) : resolve(s))));
+            return ok({ name: path.posix.basename(abs), path: abs, kind: st.isDirectory() ? "directory" : st.isSymbolicLink() ? "symlink" : "file", size: st.size ?? 0, mtimeMs: (st.mtime ?? 0) * 1000 });
+        }
+        catch (e) {
+            return { ok: false, error: this.fileError(e, abs) };
+        }
+    }
+    async listDir(p, abortSignal) {
+        const abs = this.resolve(p);
+        try {
+            const sftp = await this.sftp();
+            const entries = await new Promise((resolve, reject) => sftp.readdir(abs, (err, list) => (err ? reject(err) : resolve(list))));
+            return ok(entries.map((e) => {
+                const a = e.attrs;
+                return { name: e.filename, path: path.posix.join(abs, e.filename), kind: kindFromMode(a.mode), size: a.size ?? 0, mtimeMs: (a.mtime ?? 0) * 1000 };
+            }));
+        }
+        catch (e) {
+            return { ok: false, error: this.fileError(e, abs) };
+        }
+    }
+    async canonicalPath(p, abortSignal) {
+        const abs = this.resolve(p);
+        const r = await this.exec(`realpath -- ${shellQuote(abs)}`, { abortSignal });
+        if (!r.ok)
+            return { ok: false, error: new FileError("unknown", r.error.message, abs, r.error) };
+        if (r.value.exitCode !== 0) {
+            const msg = r.value.stderr.trim();
+            if (/permission denied|access denied/i.test(msg))
+                return { ok: false, error: new FileError("permission_denied", msg, abs) };
+            if (/not a directory/i.test(msg))
+                return { ok: false, error: new FileError("not_directory", msg, abs) };
+            return { ok: false, error: new FileError("not_found", msg || `realpath failed for ${abs}`, abs) };
+        }
+        return ok(r.value.stdout.trim());
+    }
+    async exists(p, abortSignal) {
+        const info = await this.fileInfo(p, abortSignal);
+        if (info.ok)
+            return ok(true);
+        if (info.error.code === "not_found")
+            return ok(false);
+        return { ok: false, error: info.error };
+    }
+    async createDir(p, options) {
+        const abs = this.resolve(p);
+        const r = await this.exec(`mkdir -p -- ${shellQuote(abs)}`, { abortSignal: options?.abortSignal });
+        if (!r.ok)
+            return { ok: false, error: new FileError("unknown", r.error.message, abs, r.error) };
+        if (r.value.exitCode !== 0) {
+            const msg = r.value.stderr.trim();
+            if (/permission denied/i.test(msg))
+                return { ok: false, error: new FileError("permission_denied", msg, abs) };
+            return { ok: false, error: new FileError("unknown", msg || `mkdir failed for ${abs}`, abs) };
+        }
+        return ok(undefined);
+    }
+    async remove(p, options) {
+        const abs = this.resolve(p);
+        const flags = `${options?.recursive ? "r" : ""}${options?.force ? "f" : ""}`;
+        const r = await this.exec(`rm ${flags ? `-${flags}` : ""} -- ${shellQuote(abs)}`, { abortSignal: options?.abortSignal });
+        if (!r.ok)
+            return { ok: false, error: new FileError("unknown", r.error.message, abs, r.error) };
+        if (r.value.exitCode !== 0) {
+            const msg = r.value.stderr.trim();
+            if (options?.force && /no such file/i.test(msg))
+                return ok(undefined);
+            if (/no such file/i.test(msg))
+                return { ok: false, error: new FileError("not_found", msg, abs) };
+            if (/permission denied/i.test(msg))
+                return { ok: false, error: new FileError("permission_denied", msg, abs) };
+            return { ok: false, error: new FileError("unknown", msg || `rm failed for ${abs}`, abs) };
+        }
+        return ok(undefined);
+    }
+    async createTempDir(prefix = "tmp-", abortSignal) {
+        const r = await this.exec(`mktemp -d -t ${shellQuote(`${prefix}XXXXXX`)}`, { abortSignal });
+        return this.tempResult(r, "mktemp -d");
+    }
+    async createTempFile(options) {
+        const prefix = options?.prefix ?? "";
+        const suffix = options?.suffix ?? "";
+        const suffixArg = suffix ? `--suffix=${shellQuote(suffix)} -t` : "-t";
+        const r = await this.exec(`mktemp ${suffixArg} ${shellQuote(`${prefix}XXXXXX`)}`, { abortSignal: options?.abortSignal });
+        return this.tempResult(r, "mktemp");
+    }
+    withCwdEnv(command, cwd, env) {
+        const parts = [];
+        const dir = cwd ?? (this.cwd !== "." ? this.cwd : undefined);
+        if (dir)
+            parts.push(`cd ${shellQuote(this.resolve(dir))} &&`);
+        if (env)
+            for (const [k, v] of Object.entries(env))
+                parts.push(`export ${k}=${shellQuote(v)};`);
+        parts.push(command);
+        return parts.join(" ");
+    }
+    tempResult(r, label) {
+        if (!r.ok)
+            return { ok: false, error: new FileError("unknown", r.error.message, undefined, r.error) };
+        if (r.value.exitCode !== 0)
+            return { ok: false, error: new FileError("unknown", r.value.stderr.trim() || `${label} failed`) };
+        return ok(r.value.stdout.trim());
+    }
+    connErr(e) {
+        const msg = e.message || String(e);
+        if (e.level === "client-authentication" || /authentication|all configured authentication methods failed/i.test(msg)) {
+            return new RemoteExecutionError("auth_failed", `ssh auth failed: ${msg}`, e);
+        }
+        if (e.level === "client-timeout" || /timed out|timeout/i.test(msg))
+            return new RemoteExecutionError("timeout", `ssh connect timed out: ${msg}`, e);
+        return new RemoteExecutionError("connect_failed", `ssh connect failed: ${msg}`, e);
+    }
+    fileError(e, p) {
+        if (e instanceof FileError)
+            return e;
+        const msg = e instanceof Error ? e.message : String(e);
+        const code = e?.code;
+        if (code === "ENOENT" || code === 2 || /no such file/i.test(msg))
+            return new FileError("not_found", msg, p);
+        if (code === "EACCES" || code === 3 || /permission denied/i.test(msg))
+            return new FileError("permission_denied", msg, p);
+        if (code === "EISDIR" || /is a directory/i.test(msg))
+            return new FileError("is_directory", msg, p);
+        if (code === "ENOTDIR" || /not a directory/i.test(msg))
+            return new FileError("not_directory", msg, p);
+        return new FileError("unknown", msg, p);
+    }
+}
+export function sshExecutionEnvFactory(config) {
+    return (_ctx) => new RemoteSshExecutionEnv(config);
+}
+//# sourceMappingURL=remote-env-ssh.js.map