@sentropic/h2a-runtime 0.81.0

package/dist/skills-sync.js

@@ -0,0 +1,255 @@
+/**
+ * `remote plugin sync-skills` — propagate the LOCAL user's Claude Code skills
+ * and plugin state into each live session Pod's `$HOME/.claude/`, so delegated /
+ * remote claude sessions get the same capabilities (superpowers, track, h2a,
+ * graphify, sent-tech-design, …) the operator has locally.
+ *
+ * APPROACH — "copy the resolved cache" (the chosen DEFAULT). We tar a short,
+ * explicit WHITELIST of skill+plugin paths and untar it into the Pod. This is
+ * deterministic: the Pod gets byte-for-byte the same resolved plugin cache the
+ * operator already vetted locally, with no network/marketplace fetch in-Pod.
+ *   Reversible fork (NOT implemented — documented for the conductor): instead of
+ *   shipping the cache, re-install marketplaces in-Pod (`claude plugin
+ *   marketplace add … && claude plugin install …`). That re-resolves remotely
+ *   (non-deterministic, needs network + auth in the Pod) and is therefore the
+ *   non-default. If we ever want it, it slots in as an alternate plan builder
+ *   here; the CLI surface stays the same.
+ *
+ * CRITICAL SAFETY — we NEVER tar the whole `~/.claude` (it holds settings.json,
+ * .credentials.json, OAuth tokens, project transcripts under projects/, and
+ * ~/.claude.json). Only the four paths in SKILLS_SYNC_WHITELIST are archived,
+ * each a leaf path so no broader directory can sweep a secret in with it. The
+ * SAFETY tests assert no credential/transcript path is ever a tar member.
+ *
+ * Payloads are argv ARRAYS (tar argv, kubectl argv) — never a `bash -lc` string
+ * with interpolated paths — so a $HOME (or any path) with shell metacharacters
+ * is just a single argument, never a parsed shell word. The archive itself
+ * rides stdin (`kubectl exec -i … -- tar -x`), so no file content is ever
+ * interpolated either.
+ *
+ * Idempotent: re-running untars over the existing tree (`--overwrite`), so the
+ * Pod's skills/plugins converge to the local state on every run.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { listRemoteSessions } from "./attach.js";
+import { getTunnel } from "./config.js";
+// ---------------------------------------------------------------------------
+// Pure helpers (exported for tests)
+// ---------------------------------------------------------------------------
+/**
+ * The ONLY paths synced to Pods, relative to `$HOME`. Skills dir + the three
+ * plugin-state pieces that make the resolved plugin cache deterministic. Each
+ * is a leaf path: no entry is a parent of a secret file (so tarring it can
+ * never drag settings.json / .credentials.json / transcripts along). Anything
+ * outside this list — including the rest of ~/.claude/plugins (blocklist.json,
+ * known_marketplaces.json, plugin-catalog-cache.json, data/) — is excluded.
+ */
+export const SKILLS_SYNC_WHITELIST = [
+    ".claude/skills",
+    ".claude/plugins/installed_plugins.json",
+    ".claude/plugins/marketplaces",
+    ".claude/plugins/cache",
+];
+/** The explicit whitelist as a fresh array (callers cannot mutate the source). */
+export function skillsSyncWhitelist() {
+    return [...SKILLS_SYNC_WHITELIST];
+}
+/**
+ * `tar` argv that archives ONLY the whitelisted paths, relative to `$HOME`, as
+ * a gzip stream on stdout (`-f -`). `-C <home>` keeps members relative so they
+ * untar cleanly into the Pod's `$HOME`. `--ignore-failed-read` lets a partial
+ * local install still sync (a missing member is skipped, not fatal). Members
+ * follow `--` so a leading-dash path can never be mistaken for a flag.
+ */
+export function buildSkillsTarArgs(home) {
+    return [
+        "-c",
+        "-z",
+        "--ignore-failed-read",
+        "-C",
+        home,
+        "-f",
+        "-",
+        "--",
+        ...skillsSyncWhitelist(),
+    ];
+}
+/**
+ * In-Pod `tar` argv: extract the gzip stream from stdin (`-f -`) into the Pod's
+ * `$HOME` (`-C <podHome>`), `--overwrite` so a re-run replaces the existing
+ * skills/plugins in place (idempotent). No member is named — extraction takes
+ * whatever the archive carries, and the archive only ever carries the
+ * whitelist (constrained on the tar side).
+ */
+export function buildPodUntarArgs(podHome) {
+    return ["-x", "-z", "--overwrite", "-C", podHome, "-f", "-"];
+}
+/** Default Pod `$HOME` — the session-agent container runs as root. */
+const DEFAULT_POD_HOME = "/root";
+/**
+ * Compose the local-tar | pod-untar plan for one Pod. Pure: it builds the two
+ * argv arrays and a dry-run line, but spawns nothing — the actual transfer is
+ * behind the `runSkillsSync` seam so tests never shell out.
+ */
+export function buildSkillsSyncPlan(input) {
+    const { home, pod } = input;
+    const podHome = pod.podHome ?? DEFAULT_POD_HOME;
+    const tarArgs = buildSkillsTarArgs(home);
+    const untarArgs = buildPodUntarArgs(podHome);
+    const podName = `session-${pod.sessionId}`;
+    const dryRun = `${podName} (${pod.profile}): tar ${tarArgs.join(" ")} ` +
+        `| kubectl exec -i ${podName} -- tar ${untarArgs.join(" ")} ` +
+        `[whitelist: ${skillsSyncWhitelist().join(", ")}]`;
+    return {
+        pod: podName,
+        sessionId: pod.sessionId,
+        profile: pod.profile,
+        tar: { cmd: "tar", args: tarArgs },
+        untar: { cmd: "tar", args: untarArgs },
+        whitelist: skillsSyncWhitelist(),
+        dryRun,
+    };
+}
+/**
+ * Resolve which live sessions to sync. `--all` => every session; `--pod <ref>`
+ * => the single session whose id (or `session-<id>` Pod name) matches. Throws
+ * when neither is given, or when `--pod` matches nothing live.
+ */
+export function selectSyncPods(sessions, opts) {
+    if (opts.all) {
+        return sessions.map((s) => ({ sessionId: s.id, profile: s.profile }));
+    }
+    if (opts.pod) {
+        const id = opts.pod.startsWith("session-")
+            ? opts.pod.slice("session-".length)
+            : opts.pod;
+        const match = sessions.find((s) => s.id === id);
+        if (!match) {
+            throw new Error(`no live session matches --pod "${opts.pod}"`);
+        }
+        return [{ sessionId: match.id, profile: match.profile }];
+    }
+    throw new Error("select sessions with --pod <name> or --all");
+}
+// ---------------------------------------------------------------------------
+// Spawn seam (thin — tests stub this, never shell out)
+// ---------------------------------------------------------------------------
+function expandHome(p) {
+    return p.startsWith("~") ? join(homedir(), p.slice(1)) : p;
+}
+function kubeEnv(tunnel) {
+    const env = { ...process.env };
+    if (tunnel.kubeconfig)
+        env.KUBECONFIG = expandHome(tunnel.kubeconfig);
+    return env;
+}
+const spawnSkillsSync = (plan, tunnel) => new Promise((resolve, reject) => {
+    const kubectlArgs = [
+        "-n",
+        tunnel.namespace,
+        "exec",
+        "-i",
+        plan.pod,
+        "-c",
+        "session-agent",
+        "--",
+        plan.untar.cmd,
+        ...plan.untar.args,
+    ];
+    const env = kubeEnv(tunnel);
+    const tar = spawn(plan.tar.cmd, plan.tar.args, {
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const kube = spawn("kubectl", kubectlArgs, {
+        stdio: ["pipe", "inherit", "pipe"],
+        env,
+    });
+    let tarErr = "";
+    let kubeErr = "";
+    tar.stderr.on("data", (d) => {
+        tarErr += d.toString();
+    });
+    kube.stderr.on("data", (d) => {
+        kubeErr += d.toString();
+    });
+    tar.on("error", reject);
+    kube.on("error", reject);
+    tar.stdout.pipe(kube.stdin);
+    let tarDone = false;
+    let kubeDone = false;
+    let failed = false;
+    const settle = () => {
+        if (tarDone && kubeDone && !failed)
+            resolve();
+    };
+    tar.on("close", (code) => {
+        tarDone = true;
+        if (code !== 0 && !failed) {
+            failed = true;
+            reject(new Error(`tar exited ${code}: ${tarErr.trim().slice(0, 200)}`));
+            return;
+        }
+        settle();
+    });
+    kube.on("close", (code) => {
+        kubeDone = true;
+        if (code !== 0 && !failed) {
+            failed = true;
+            reject(new Error(`kubectl exec ${plan.pod} exited ${code}: ${kubeErr.trim().slice(0, 200)}`));
+            return;
+        }
+        settle();
+    });
+});
+// ---------------------------------------------------------------------------
+// Command
+// ---------------------------------------------------------------------------
+/**
+ * `remote plugin sync-skills [--pod <name>|--all] [--dry-run]` — copy the local
+ * Claude Code skills + plugin cache (whitelist only) into the selected live
+ * session Pod(s). `--dry-run` prints the tar/exec plan and transfers nothing.
+ */
+export async function syncSkills(url, opts, stderr = process.stderr, run = spawnSkillsSync) {
+    const tunnel = getTunnel();
+    if (!tunnel) {
+        throw new Error("plugin sync-skills needs a tunnel configured (remote config tunnel …)");
+    }
+    const sessions = await listRemoteSessions(url);
+    if (sessions.length === 0) {
+        stderr.write("[remote] no live remote sessions to sync\n");
+        return;
+    }
+    const pods = selectSyncPods(sessions, opts);
+    const home = homedir();
+    if (opts.dryRun) {
+        stderr.write(`[remote] sync-skills DRY-RUN — whitelist (relative to $HOME): ${skillsSyncWhitelist().join(", ")}\n`);
+        for (const pod of pods) {
+            stderr.write(`    ${buildSkillsSyncPlan({ home, pod }).dryRun}\n`);
+        }
+        stderr.write("[remote] dry-run: nothing transferred\n");
+        return;
+    }
+    // Fail fast if local tar is missing (clearer than a spawn ENOENT mid-loop).
+    if (spawnSync("tar", ["--version"], { stdio: "ignore" }).status !== 0) {
+        throw new Error("local `tar` not found — required to archive the skills cache");
+    }
+    let failures = 0;
+    for (const pod of pods) {
+        const plan = buildSkillsSyncPlan({ home, pod });
+        stderr.write(`[remote] ${plan.sessionId} (${plan.profile}): sync-skills…\n`);
+        try {
+            await run(plan, tunnel);
+            stderr.write(`    skills/plugins synced (${plan.whitelist.length} whitelist path(s)) -> ${plan.pod}:$HOME\n`);
+        }
+        catch (error) {
+            failures++;
+            stderr.write(`    sync-skills FAILED: ${String(error).slice(0, 200)}\n`);
+        }
+    }
+    stderr.write(`[remote] sync-skills done: ${pods.length} pod(s)${failures > 0 ? `, ${failures} failure(s)` : ""}\n`);
+    if (failures > 0)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=skills-sync.js.map

package/dist/skills-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-sync.js","sourceRoot":"","sources":["../src/skills-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAC;AAE3D,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,gBAAgB;IAChB,wCAAwC;IACxC,8BAA8B;IAC9B,uBAAuB;CACxB,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,sBAAsB;QACtB,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,GAAG;QACH,IAAI;QACJ,GAAG,mBAAmB,EAAE;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAUD,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAiBjC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,GAAG,CAAC,SAAS,EAAE,CAAC;IAC3C,MAAM,MAAM,GACV,GAAG,OAAO,KAAK,GAAG,CAAC,OAAO,UAAU,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QACxD,qBAAqB,OAAO,WAAW,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC7D,eAAe,mBAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrD,OAAO;QACL,GAAG,EAAE,OAAO;QACZ,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;QAClC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,SAAS,EAAE,mBAAmB,EAAE;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAwD,EACxD,IAAqC;IAErC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,OAAO,CAAC,MAAoB;IACnC,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAaD,MAAM,eAAe,GAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACzD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACpC,MAAM,WAAW,GAAG;QAClB,IAAI;QACJ,MAAM,CAAC,SAAS;QAChB,MAAM;QACN,IAAI;QACJ,IAAI,CAAC,GAAG;QACR,IAAI;QACJ,eAAe;QACf,IAAI;QACJ,IAAI,CAAC,KAAK,CAAC,GAAG;QACd,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI;KACnB,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAC7C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE;QACzC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;QAClC,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;QAClC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;QACnC,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,OAAO,IAAI,QAAQ,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;IAChD,CAAC,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,CACJ,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,WAAW,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CACtF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,IAAuD,EACvD,SAA6B,OAAO,CAAC,MAAM,EAC3C,MAAwB,eAAe;IAEvC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACV,iEAAiE,mBAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACtG,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,mBAAmB,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxB,MAAM,CAAC,KAAK,CACV,8BAA8B,IAAI,CAAC,SAAS,CAAC,MAAM,0BAA0B,IAAI,CAAC,GAAG,UAAU,CAChG,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAK,CACV,8BAA8B,IAAI,CAAC,MAAM,UAAU,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CACtG,CAAC;IACF,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACzC,CAAC"}

package/dist/smoke.d.ts

@@ -0,0 +1,23 @@
+import type { CliProfile, SessionTarget } from "./protocol-local.js";
+import { type AuthBundle } from "./auth-bundle.js";
+import { type AuthRefreshResult } from "./auth-refresh.js";
+export type SmokeRemoteProfileOptions = {
+    readonly profile: CliProfile;
+    readonly baseUrl: string;
+    readonly target?: SessionTarget;
+    readonly displayName?: string;
+    readonly timeoutMs?: number;
+    readonly auth?: boolean;
+    readonly authRefresh?: boolean;
+    readonly fetchImpl?: typeof fetch;
+    readonly collectAuth?: (profile: CliProfile) => Promise<AuthBundle>;
+    readonly ensureAuthFresh?: (profile: CliProfile) => Promise<AuthRefreshResult>;
+};
+export type SmokeRemoteProfileResult = {
+    readonly profile: CliProfile;
+    readonly sessionId: string;
+    readonly terminalId: string;
+    readonly shell: string;
+};
+export declare function smokeRemoteProfile(options: SmokeRemoteProfileOptions): Promise<SmokeRemoteProfileResult>;
+//# sourceMappingURL=smoke.d.ts.map

package/dist/smoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke.d.ts","sourceRoot":"","sources":["../src/smoke.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EAEV,aAAa,EAEd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,OAAO,EAAE,UAAU,KAChB,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AA2GF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAgEnC"}

package/dist/smoke.js

@@ -0,0 +1,138 @@
+import { createRemoteSession, stopRemoteSession } from "./attach.js";
+import { assertRequiredAuthBundle, collectProfileAuth, } from "./auth-bundle.js";
+import { ensureProfileAuthFresh, } from "./auth-refresh.js";
+function joinUrl(base, path) {
+    return `${base.replace(/\/$/, "")}${path}`;
+}
+function parseSseEvents(buffer) {
+    const events = [];
+    const chunks = buffer.split("\n\n");
+    const rest = chunks.pop() ?? "";
+    for (const chunk of chunks) {
+        if (!chunk.trim())
+            continue;
+        let eventName;
+        const dataLines = [];
+        for (const line of chunk.split("\n")) {
+            if (line.startsWith("event:"))
+                eventName = line.slice(6).trim();
+            else if (line.startsWith("data:"))
+                dataLines.push(line.slice(5).trim());
+        }
+        if (dataLines.length === 0)
+            continue;
+        events.push({
+            ...(eventName !== undefined ? { event: eventName } : {}),
+            data: dataLines.join("\n"),
+        });
+    }
+    return { events, rest };
+}
+async function waitForTerminalOpened(options) {
+    const controller = new AbortController();
+    let reader;
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, options.timeoutMs);
+    try {
+        const response = await options.fetchImpl(joinUrl(options.baseUrl, `/sessions/${options.sessionId}/events`), {
+            headers: { accept: "text/event-stream" },
+            signal: controller.signal,
+        });
+        if (!response.ok || !response.body) {
+            throw new Error(`[remote] smoke event stream returned ${response.status} ${response.statusText}`);
+        }
+        reader = response.body.getReader();
+        const decoder = new TextDecoder("utf-8");
+        let buffer = "";
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            const { events, rest } = parseSseEvents(buffer);
+            buffer = rest;
+            for (const ev of events) {
+                if (ev.event &&
+                    ev.event !== "terminal.opened" &&
+                    ev.event !== "terminal.exited") {
+                    continue;
+                }
+                const envelope = JSON.parse(ev.data);
+                if (envelope.type === "terminal.opened") {
+                    return envelope.payload;
+                }
+                if (envelope.type === "terminal.exited") {
+                    const payload = envelope.payload;
+                    throw new Error(`[remote] smoke session ${options.sessionId} exited before terminal.opened (exitCode=${payload.exitCode ?? "unknown"})`);
+                }
+            }
+        }
+        throw new Error(`[remote] smoke event stream ended before terminal.opened for ${options.sessionId}`);
+    }
+    catch (error) {
+        if (timedOut) {
+            throw new Error(`[remote] smoke timed out waiting for terminal.opened for ${options.sessionId}`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        controller.abort();
+        await reader?.cancel().catch(() => { });
+    }
+}
+export async function smokeRemoteProfile(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    let credentials;
+    if (options.auth !== false) {
+        if (options.authRefresh !== false) {
+            await (options.ensureAuthFresh ?? ensureProfileAuthFresh)(options.profile);
+        }
+        const bundle = await (options.collectAuth ?? collectProfileAuth)(options.profile);
+        assertRequiredAuthBundle(options.profile, bundle);
+        if (Object.keys(bundle).length > 0)
+            credentials = bundle;
+    }
+    let sessionId;
+    let result;
+    let failure;
+    try {
+        sessionId = (await createRemoteSession(options.baseUrl, {
+            profile: options.profile,
+            target: options.target ?? "k3s",
+            displayName: options.displayName ?? `smoke-${options.profile}-${Date.now()}`,
+            ...(credentials ? { credentials } : {}),
+        }, fetchImpl)).id;
+        const opened = await waitForTerminalOpened({
+            baseUrl: options.baseUrl,
+            sessionId,
+            timeoutMs: options.timeoutMs ?? 120_000,
+            fetchImpl,
+        });
+        result = {
+            profile: options.profile,
+            sessionId,
+            terminalId: opened.terminalId,
+            shell: opened.shell,
+        };
+    }
+    catch (error) {
+        failure = error;
+    }
+    if (sessionId) {
+        try {
+            await stopRemoteSession(options.baseUrl, sessionId, "remote-profile-smoke", fetchImpl);
+        }
+        catch (error) {
+            if (!failure)
+                failure = error;
+        }
+    }
+    if (failure)
+        throw failure;
+    return result;
+}
+//# sourceMappingURL=smoke.js.map

package/dist/smoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke.js","sourceRoot":"","sources":["../src/smoke.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAwB3B,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IAIpC,MAAM,MAAM,GAA4C,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,SAAS;QAC5B,IAAI,SAA6B,CAAC;QAClC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAKpC;IACC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,MAA2D,CAAC;IAChE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CACtC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,OAAO,CAAC,SAAS,SAAS,CAAC,EACjE;YACE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;YACxC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;gBACxB,IACE,EAAE,CAAC,KAAK;oBACR,EAAE,CAAC,KAAK,KAAK,iBAAiB;oBAC9B,EAAE,CAAC,KAAK,KAAK,iBAAiB,EAC9B,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAwB,CAAC;gBAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACxC,OAAO,QAAQ,CAAC,OAAyB,CAAC;gBAC5C,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAgC,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,SAAS,4CAA4C,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,CACxH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,CAAC,SAAS,EAAE,CACpF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,SAAS,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,IAAI,WAAyD,CAAC;IAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC,CACvD,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAC9D,OAAO,CAAC,OAAO,CAChB,CAAC;QACF,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,GAAG,MAAM,CAAC;IAC3D,CAAC;IAED,IAAI,SAA6B,CAAC;IAClC,IAAI,MAA4C,CAAC;IACjD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,CACV,MAAM,mBAAmB,CACvB,OAAO,CAAC,OAAO,EACf;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,WAAW,EACT,OAAO,CAAC,WAAW,IAAI,SAAS,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YACjE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,EACD,SAAS,CACV,CACF,CAAC,EAAE,CAAC;QACL,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;YACzC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;YACvC,SAAS;SACV,CAAC,CAAC;QACH,MAAM,GAAG;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,iBAAiB,CACrB,OAAO,CAAC,OAAO,EACf,SAAS,EACT,sBAAsB,EACtB,SAAS,CACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;IAC3B,OAAO,MAAO,CAAC;AACjB,CAAC"}

package/dist/soft-refresh.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Soft credential refresh: push fresh local creds INTO a running session Pod and
+ * relaunch the CLI in place — WITHOUT recreating the Pod (keeps HOME parity, the
+ * conversation, the node, no image pull). Fixes the recurring ~8h token logout
+ * (the CLI can't self-refresh OAuth in a headless Pod). Also patches the auth
+ * Secret so the fresh token survives a future Pod restart.
+ *
+ * Steps (all via kubectl against the configured tunnel):
+ *  1. materialize each bundled cred file into $HOME/<rel> in the Pod,
+ *  2. patch session-<id>-auth Secret keys (durability),
+ *  3. respawn the Pod's tmux `main` pane: `<cli> --resume <newestConv>` with a
+ *     UTF-8 locale, dropping to a shell on exit (never kills the session).
+ *
+ * Unchanged-creds gating (`skipIfUnchanged`, used by `refresh --all/--watch`):
+ * the respawn INTERRUPTS the Pod's CLI, so it must only happen when the pushed
+ * creds actually differ. We sha256 the bundle and compare it with the previous
+ * pass (`previousHash`, in-memory --watch state) and with the hash recorded in
+ * the Pod ($HOME/.remote-creds.sha256, written after every push). Identical
+ * creds = silent no-op: nothing pushed, no Secret patch, NO respawn.
+ */
+import { type HealthResult, type ProbeableTool } from "./cred-health.js";
+/** HOME-relative file in the Pod recording the sha256 of the last pushed bundle. */
+export declare const CREDS_HASH_FILE = ".remote-creds.sha256";
+/**
+ * Deterministic sha256 of an auth bundle (profile + sorted rel -> base64 value),
+ * SKIPPING config-only rels (see CONFIG_ONLY_RELS). Values stay opaque: the
+ * hash never leaks any secret material.
+ */
+export declare function hashAuthBundle(profile: string, bundle: Readonly<Record<string, string>>): string;
+export type SoftRefreshResult = {
+    /** false = creds identical to the Pod's last push — nothing pushed, NO respawn. */
+    changed: boolean;
+    /** sha256 of the local bundle — feed back as `previousHash` on the next pass. */
+    hash: string;
+    filesPushed: string[];
+    secretKeysPatched: string[];
+    convId: string | undefined;
+    respawned: boolean;
+};
+export type SoftRefreshOptions = {
+    /**
+     * Compare the bundle hash with `previousHash` and/or the hash recorded in the
+     * Pod, and no-op (no push, no Secret patch, NO respawn) when identical.
+     */
+    skipIfUnchanged?: boolean;
+    /** Bundle hash from the previous pass (in-memory --watch state): when it matches, skip without even reading the Pod. */
+    previousHash?: string;
+    stderr?: NodeJS.WriteStream;
+};
+/**
+ * Push the profile's fresh creds into the Pod, patch the Secret, and relaunch
+ * the CLI in place. `bundle` is the already-collected creds (rel -> content).
+ */
+export declare function softRefreshSession(sessionId: string, profile: string, options?: SoftRefreshOptions): Promise<SoftRefreshResult>;
+/** Result of a per-pod, per-tool probe→push pass. */
+export type ToolHealthAction = {
+    readonly tool: ProbeableTool;
+    readonly health: HealthResult;
+    /** true when ok:false drove a re-bundle+push of this tool's creds. */
+    readonly pushed: boolean;
+    /** HOME-relative files materialized into the Pod (empty when not pushed / none local). */
+    readonly filesPushed: ReadonlyArray<string>;
+    readonly secretKeysPatched: ReadonlyArray<string>;
+};
+/**
+ * Injectable seams so the executor is unit-testable WITHOUT shelling out to
+ * kubectl or reading ~/. Production defaults wire the real plumbing.
+ */
+export type ToolHealthDeps = {
+    /** Run the argv-safe probe in the Pod (default: execPodArgv against the tunnel). */
+    exec: (argv: ReadonlyArray<string>) => {
+        status: number;
+        stdout: string;
+    };
+    /** Re-bundle the LOCAL creds for the tools (default: collectToolAuth). */
+    collect: (tools: ReadonlyArray<string>) => Promise<{
+        bundle: Record<string, string>;
+        bundled: string[];
+    }>;
+    /** Materialize one base64 file into the Pod's $HOME (default: execPod base64 -d). */
+    materialize: (rel: string, base64: string) => void;
+    /** Patch one Secret data key with a base64 value (default: kubectl patch). */
+    patchSecretKey: (key: string, base64: string) => void;
+    stderr?: {
+        write: (s: string) => unknown;
+    };
+};
+/**
+ * Probe ONE covered tool in a live Pod and, if it's unauthenticated, push the
+ * tool's LOCAL creds (re-bundle + materialize + Secret patch — the same
+ * mechanism as today, an extra trigger). Pure-ish: all IO is injected via
+ * `deps`. Returns what happened (probe result + whether/what was pushed).
+ * Exported for tests.
+ */
+export declare function probeAndPushToolHealth(tool: ProbeableTool, deps: ToolHealthDeps): Promise<ToolHealthAction>;
+/**
+ * Production wiring for `probeAndPushToolHealth` against a configured tunnel +
+ * live pod. Builds the default `ToolHealthDeps` (real kubectl exec / patch /
+ * collectToolAuth) and probes EACH covered tool, pushing on a 401. Best-effort:
+ * a probe/push error for one tool is logged and the others continue. Returns the
+ * per-tool actions. NOT pure (does IO); the pure decision lives in
+ * `probeAndPushToolHealth` + cred-health. Used by the watch loop.
+ */
+export declare function probePodCredHealth(sessionId: string, tools?: ReadonlyArray<string>, options?: {
+    stderr?: NodeJS.WriteStream;
+}): Promise<ToolHealthAction[]>;
+//# sourceMappingURL=soft-refresh.d.ts.map

package/dist/soft-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soft-refresh.d.ts","sourceRoot":"","sources":["../src/soft-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAwF1B,oFAAoF;AACpF,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAgBtD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACvC,MAAM,CAYR;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,mFAAmF;IACnF,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wHAAwH;IACxH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA6L5B;AAuED,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,oFAAoF;IACpF,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,0EAA0E;IAC1E,OAAO,EAAE,CACP,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,KACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACpE,qFAAqF;IACrF,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,8EAA8E;IAC9E,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACtD,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAyC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,aAAa,CAAC,MAAM,CAA2B,EACtD,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,CAAA;CAAO,GAC5C,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoE7B"}