@termix-ssh/plugin-sdk 1.0.0

package/dist/settings.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Settings field validation, shared by core and the frontend.
+ *
+ * Both the HTTP routes and the form renderer call these, so "what counts as a
+ * valid value" is decided once. A field the manifest never declared has no
+ * entry here and is rejected rather than stored, which is what stops a PUT
+ * from writing arbitrary keys into a plugin's namespace.
+ */
+import type { PluginSettingsField } from "./manifest.js";
+/** The permission an admin-scope field requires when it names none itself. */
+export declare const ADMIN_SETTINGS_PERMISSION = "admin.plugins.manage";
+/** What a secret looks like on the wire. The value never leaves the server. */
+export interface RedactedSecret {
+    set: boolean;
+}
+export declare function isRedactedSecret(value: unknown): value is RedactedSecret;
+/**
+ * Turns whatever arrived on the wire into the type the field declares.
+ *
+ * Forms send everything as strings, so a number field that refused "30" would
+ * reject every value the UI can produce. Anything genuinely unconvertible is
+ * left alone for validateSettingValue to reject with a readable message.
+ */
+export declare function coerceSettingValue(field: PluginSettingsField, value: unknown): unknown;
+/**
+ * Returns an error message, or null when the value is acceptable.
+ *
+ * Messages are plain English rather than i18n keys: they name the offending
+ * field and the rule it broke, and the UI shows them beside the input.
+ */
+export declare function validateSettingValue(field: PluginSettingsField, value: unknown): string | null;
+/** The declared defaults for a scope, used when no row has been written. */
+export declare function defaultsFor(fields?: readonly PluginSettingsField[]): Record<string, unknown>;
+/** Looks a field up by key, for a caller holding only the declared list. */
+export declare function findSettingsField(fields: readonly PluginSettingsField[], key: string): PluginSettingsField | undefined;
+/**
+ * Whether a field should be shown or accepted, given the rest of the scope.
+ *
+ * A field declaring `requires` is inert while its named boolean is off, so the
+ * UI hides it and a write to it is pointless rather than wrong.
+ */
+export declare function isFieldActive(field: PluginSettingsField, values: Record<string, unknown>): boolean;
+export type { PluginSettingsField } from "./manifest.js";

package/dist/settings.js

@@ -0,0 +1,168 @@
+/**
+ * Settings field validation, shared by core and the frontend.
+ *
+ * Both the HTTP routes and the form renderer call these, so "what counts as a
+ * valid value" is decided once. A field the manifest never declared has no
+ * entry here and is rejected rather than stored, which is what stops a PUT
+ * from writing arbitrary keys into a plugin's namespace.
+ */
+/** The permission an admin-scope field requires when it names none itself. */
+export const ADMIN_SETTINGS_PERMISSION = "admin.plugins.manage";
+export function isRedactedSecret(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.keys(value).length === 1 &&
+        typeof value.set === "boolean");
+}
+/**
+ * Turns whatever arrived on the wire into the type the field declares.
+ *
+ * Forms send everything as strings, so a number field that refused "30" would
+ * reject every value the UI can produce. Anything genuinely unconvertible is
+ * left alone for validateSettingValue to reject with a readable message.
+ */
+export function coerceSettingValue(field, value) {
+    if (value === null || value === undefined)
+        return value;
+    switch (field.type) {
+        case "boolean":
+            if (typeof value === "boolean")
+                return value;
+            if (value === "true")
+                return true;
+            if (value === "false")
+                return false;
+            return value;
+        case "number": {
+            if (typeof value === "number")
+                return value;
+            if (typeof value === "string" && value.trim() !== "") {
+                const parsed = Number(value);
+                return Number.isNaN(parsed) ? value : parsed;
+            }
+            return value;
+        }
+        case "multiselect":
+            return Array.isArray(value) ? value : value === "" ? [] : value;
+        case "string":
+        case "secret":
+        case "textarea":
+        case "select":
+            return typeof value === "number" || typeof value === "boolean"
+                ? String(value)
+                : value;
+        default:
+            return value;
+    }
+}
+/**
+ * Returns an error message, or null when the value is acceptable.
+ *
+ * Messages are plain English rather than i18n keys: they name the offending
+ * field and the rule it broke, and the UI shows them beside the input.
+ */
+export function validateSettingValue(field, value) {
+    // Clearing a field is always allowed; the default takes over on read.
+    if (value === null || value === undefined)
+        return null;
+    switch (field.type) {
+        case "boolean":
+            return typeof value === "boolean"
+                ? null
+                : `"${field.key}" must be true or false`;
+        case "number": {
+            if (typeof value !== "number" || !Number.isFinite(value)) {
+                return `"${field.key}" must be a number`;
+            }
+            if (field.min !== undefined && value < field.min) {
+                return `"${field.key}" must be at least ${field.min}`;
+            }
+            if (field.max !== undefined && value > field.max) {
+                return `"${field.key}" must be at most ${field.max}`;
+            }
+            return null;
+        }
+        case "select": {
+            if (typeof value !== "string") {
+                return `"${field.key}" must be a string`;
+            }
+            const allowed = (field.options ?? []).map((option) => option.value);
+            return allowed.includes(value)
+                ? null
+                : `"${field.key}" must be one of: ${allowed.join(", ")}`;
+        }
+        case "multiselect": {
+            if (!Array.isArray(value)) {
+                return `"${field.key}" must be an array`;
+            }
+            const allowed = (field.options ?? []).map((option) => option.value);
+            for (const entry of value) {
+                if (typeof entry !== "string" || !allowed.includes(entry)) {
+                    return `"${field.key}" may only contain: ${allowed.join(", ")}`;
+                }
+            }
+            return null;
+        }
+        case "json": {
+            if (typeof value === "string") {
+                try {
+                    JSON.parse(value);
+                    return null;
+                }
+                catch {
+                    return `"${field.key}" must be valid JSON`;
+                }
+            }
+            // Already-parsed JSON is fine as long as it survives a round trip.
+            try {
+                JSON.stringify(value);
+                return null;
+            }
+            catch {
+                return `"${field.key}" must be valid JSON`;
+            }
+        }
+        case "secret":
+            // A redacted echo is a no-op rather than a value, handled by the caller.
+            if (isRedactedSecret(value))
+                return null;
+            return typeof value === "string"
+                ? null
+                : `"${field.key}" must be a string`;
+        case "string":
+        case "textarea":
+            return typeof value === "string"
+                ? null
+                : `"${field.key}" must be a string`;
+        case "custom":
+            // The component owns its own shape; core only stores what it sends.
+            return null;
+        default:
+            return `"${field.key}" has an unknown type`;
+    }
+}
+/** The declared defaults for a scope, used when no row has been written. */
+export function defaultsFor(fields = []) {
+    const defaults = {};
+    for (const field of fields) {
+        if (field.default !== undefined)
+            defaults[field.key] = field.default;
+    }
+    return defaults;
+}
+/** Looks a field up by key, for a caller holding only the declared list. */
+export function findSettingsField(fields = [], key) {
+    return fields.find((field) => field.key === key);
+}
+/**
+ * Whether a field should be shown or accepted, given the rest of the scope.
+ *
+ * A field declaring `requires` is inert while its named boolean is off, so the
+ * UI hides it and a write to it is pointless rather than wrong.
+ */
+export function isFieldActive(field, values) {
+    if (!field.requires)
+        return true;
+    return values[field.requires] === true;
+}

package/dist/ssh-certs.d.ts

@@ -0,0 +1,25 @@
+/**
+ * OpenSSH certificate auth for ssh2, which has no native support for it.
+ *
+ * Grafts the certificate onto the parsed key, converts ECDSA signatures from
+ * DER to SSH wire format, and patches Protocol.authPK so the signature
+ * wrapper carries the base algorithm (OpenSSH's sshkey_check_sigtype wants
+ * that). Pure: no core state, it only touches the config and client it gets.
+ *
+ * Used by core key auth with a CA-signed certificate and by every plugin that
+ * issues short-lived certificates (opkssh, step-ca, vault).
+ */
+import type { Client, ConnectConfig } from "ssh2";
+export interface CertificateCredentials {
+    /** OpenSSH or PEM private key. */
+    privateKey: Buffer | string;
+    /** The certificate line, e.g. "ssh-ed25519-cert-v01@openssh.com AAAA...". */
+    certificate: string;
+    passphrase?: string;
+}
+/**
+ * Sets up certificate publickey auth on an ssh2 client. Call before
+ * `client.connect(config)`; it sets `config.authHandler` and
+ * `config.username`.
+ */
+export declare function applyCertificateAuth(config: ConnectConfig, client: Client, credentials: CertificateCredentials, username: string): Promise<void>;

package/dist/ssh-certs.js

@@ -0,0 +1,234 @@
+/**
+ * OpenSSH certificate auth for ssh2, which has no native support for it.
+ *
+ * Grafts the certificate onto the parsed key, converts ECDSA signatures from
+ * DER to SSH wire format, and patches Protocol.authPK so the signature
+ * wrapper carries the base algorithm (OpenSSH's sshkey_check_sigtype wants
+ * that). Pure: no core state, it only touches the config and client it gets.
+ *
+ * Used by core key auth with a CA-signed certificate and by every plugin that
+ * issues short-lived certificates (opkssh, step-ca, vault).
+ */
+// Grafts an OpenSSH certificate onto an already-parsed private key object and
+// patches the ssh2 client so that certificate-based publickey auth succeeds.
+async function applyCertToConnection(config, client, privKey, certStr) {
+    // Extract cert type and blob from the stored certificate
+    const certParts = certStr.trim().split(/\s+/);
+    if (certParts.length < 2) {
+        throw new Error("Invalid certificate format: expected '<type> <base64>' string");
+    }
+    const certType = certParts[0];
+    const certBlob = Buffer.from(certParts[1], "base64");
+    // Graft cert type and blob onto the parsed private key
+    privKey.type = certType;
+    const pubSSHSym = Object.getOwnPropertySymbols(privKey).find((s) => String(s) === "Symbol(Public key SSH)");
+    if (!pubSSHSym) {
+        throw new Error("Cannot find public SSH symbol on parsed key; ssh2 internals may have changed");
+    }
+    privKey[pubSSHSym] = certBlob;
+    // Wrap sign() for ECDSA cert keys (DER → SSH wire format)
+    if (privKey.type.startsWith("ecdsa-")) {
+        const origSign = privKey.sign.bind(privKey);
+        privKey.sign = (data, algo) => {
+            const sigAlgo = algo?.includes("-cert-")
+                ? algo.replace(/-cert-v\d+@openssh\.com$/, "")
+                : algo;
+            const sig = origSign(data, sigAlgo);
+            if (sig instanceof Error || sig[0] !== 0x30)
+                return sig;
+            // Convert DER-encoded ECDSA signature to SSH wire format
+            try {
+                let pos = 2;
+                if (sig[1] & 0x80)
+                    pos += sig[1] & 0x7f;
+                pos++;
+                const rLen = sig[pos++];
+                const r = sig.subarray(pos, pos + rLen);
+                pos += rLen + 1;
+                const sLen = sig[pos++];
+                const s = sig.subarray(pos, pos + sLen);
+                const out = Buffer.allocUnsafe(4 + r.length + 4 + s.length);
+                out.writeUInt32BE(r.length, 0);
+                r.copy(out, 4);
+                out.writeUInt32BE(s.length, 4 + r.length);
+                s.copy(out, 4 + r.length + 4);
+                return out;
+            }
+            catch {
+                return sig;
+            }
+        };
+    }
+    // Set up authHandler to bypass ssh2's cert type rejection
+    let certAuthAttempted = false;
+    const authHandler = (methodsLeft, _partialSuccess, callback) => {
+        const next = callback;
+        if (!certAuthAttempted &&
+            (!methodsLeft || methodsLeft.includes("publickey"))) {
+            certAuthAttempted = true;
+            next({
+                type: "publickey",
+                username: config.username,
+                key: privKey,
+            });
+        }
+        else {
+            next(false);
+        }
+    };
+    config.authHandler = authHandler;
+    // Monkey-patch Protocol.authPK after connect() to fix the signature
+    // wrapper algorithm for cert types.
+    const baseAlgo = certType.replace(/-cert-v\d+@openssh\.com$/, "");
+    const origConnect = client.connect.bind(client);
+    const patchedClient = client;
+    patchedClient.connect = (cfg) => {
+        const connectedClient = origConnect(cfg);
+        const proto = patchedClient._protocol;
+        if (!proto)
+            return connectedClient;
+        const origAuthPK = proto.authPK.bind(proto);
+        proto.authPK = (user, pubKey, keyAlgo, cbSign) => {
+            const isCertAuth = !!cbSign && pubKey?.type?.includes("-cert-");
+            if (!isCertAuth) {
+                return origAuthPK(user, pubKey, keyAlgo, cbSign);
+            }
+            // Signed auth with cert type: rebuild packet with base algo in
+            // the signature wrapper. keyAlgo may be undefined for ECDSA.
+            const certAlgo = keyAlgo || pubKey.type;
+            const pubSSH = pubKey.getPublicSSH();
+            const sessionID = proto._kex.sessionID;
+            const sesLen = sessionID.length;
+            const userLen = Buffer.byteLength(user);
+            const certAlgoLen = Buffer.byteLength(certAlgo);
+            const baseAlgoLen = Buffer.byteLength(baseAlgo);
+            const pubKeyLen = pubSSH.length;
+            // Build data to sign (uses the cert algo, which the server verifies against)
+            const sigDataLen = 4 +
+                sesLen +
+                1 +
+                4 +
+                userLen +
+                4 +
+                14 +
+                4 +
+                9 +
+                1 +
+                4 +
+                certAlgoLen +
+                4 +
+                pubKeyLen;
+            const sigData = Buffer.allocUnsafe(sigDataLen);
+            let sp = 0;
+            sigData.writeUInt32BE(sesLen, sp);
+            sp += 4;
+            sessionID.copy(sigData, sp);
+            sp += sesLen;
+            sigData[sp++] = 50; // SSH_MSG_USERAUTH_REQUEST
+            sigData.writeUInt32BE(userLen, sp);
+            sp += 4;
+            sigData.write(user, sp, userLen, "utf8");
+            sp += userLen;
+            sigData.writeUInt32BE(14, sp);
+            sp += 4;
+            sigData.write("ssh-connection", sp, 14, "utf8");
+            sp += 14;
+            sigData.writeUInt32BE(9, sp);
+            sp += 4;
+            sigData.write("publickey", sp, 9, "utf8");
+            sp += 9;
+            sigData[sp++] = 1; // TRUE
+            sigData.writeUInt32BE(certAlgoLen, sp);
+            sp += 4;
+            sigData.write(certAlgo, sp, certAlgoLen, "utf8");
+            sp += certAlgoLen;
+            sigData.writeUInt32BE(pubKeyLen, sp);
+            sp += 4;
+            pubSSH.copy(sigData, sp);
+            cbSign(sigData, (signature) => {
+                const sigLen = signature.length;
+                const payloadLen = 1 +
+                    4 +
+                    userLen +
+                    4 +
+                    14 +
+                    4 +
+                    9 +
+                    1 +
+                    4 +
+                    certAlgoLen +
+                    4 +
+                    pubKeyLen +
+                    4 +
+                    4 +
+                    baseAlgoLen +
+                    4 +
+                    sigLen;
+                const packet = proto._packetRW.write.alloc(payloadLen);
+                let pp = proto._packetRW.write.allocStart;
+                packet[pp] = 50; // SSH_MSG_USERAUTH_REQUEST
+                packet.writeUInt32BE(userLen, ++pp);
+                pp += 4;
+                packet.write(user, pp, userLen, "utf8");
+                pp += userLen;
+                packet.writeUInt32BE(14, pp);
+                pp += 4;
+                packet.write("ssh-connection", pp, 14, "utf8");
+                pp += 14;
+                packet.writeUInt32BE(9, pp);
+                pp += 4;
+                packet.write("publickey", pp, 9, "utf8");
+                pp += 9;
+                packet[pp++] = 1; // TRUE
+                // Header: cert type
+                packet.writeUInt32BE(certAlgoLen, pp);
+                pp += 4;
+                packet.write(certAlgo, pp, certAlgoLen, "utf8");
+                pp += certAlgoLen;
+                // Public key blob
+                packet.writeUInt32BE(pubKeyLen, pp);
+                pp += 4;
+                pubSSH.copy(packet, pp);
+                pp += pubKeyLen;
+                // Signature wrapper: base algo (NOT cert type)
+                packet.writeUInt32BE(4 + baseAlgoLen + 4 + sigLen, pp);
+                pp += 4;
+                packet.writeUInt32BE(baseAlgoLen, pp);
+                pp += 4;
+                packet.write(baseAlgo, pp, baseAlgoLen, "utf8");
+                pp += baseAlgoLen;
+                packet.writeUInt32BE(sigLen, pp);
+                pp += 4;
+                signature.copy(packet, pp);
+                proto._authsQueue.push("publickey");
+                proto._debug?.("Outbound: Sending USERAUTH_REQUEST (publickey)");
+                const finalized = proto._packetRW.write.finalize(packet);
+                proto._cipher.encrypt(finalized);
+            });
+        };
+        return connectedClient;
+    };
+}
+/**
+ * Sets up certificate publickey auth on an ssh2 client. Call before
+ * `client.connect(config)`; it sets `config.authHandler` and
+ * `config.username`.
+ */
+export async function applyCertificateAuth(config, client, credentials, username) {
+    const { createRequire } = await import("node:module");
+    const esmRequire = createRequire(import.meta.url);
+    const { utils: { parseKey }, } = esmRequire("ssh2");
+    config.username = username;
+    const keyBuf = Buffer.isBuffer(credentials.privateKey)
+        ? credentials.privateKey
+        : Buffer.from(credentials.privateKey, "utf8");
+    const parsed = credentials.passphrase
+        ? parseKey(keyBuf, credentials.passphrase)
+        : parseKey(keyBuf);
+    if (parsed instanceof Error || !parsed) {
+        const reason = parsed instanceof Error ? parsed.message : "unknown error";
+        throw new Error(`Failed to parse private key for certificate auth: ${reason}`);
+    }
+    const privKey = (Array.isArray(parsed) ? parsed[0] : parsed);
+    await applyCertToConnection(config, client, privKey, credentials.certificate);
+}

package/dist/ssh-options.d.ts

@@ -0,0 +1,23 @@
+/**
+ * A host's SSH connection options, as core's connect pipeline reads them
+ * (`ssh_data.ssh_options`). Shared by the backend and frontend host records.
+ */
+export interface HostSshOptions {
+    /** Seconds between keepalive packets. */
+    keepaliveInterval?: number;
+    /** Missed keepalives before the connection is dropped. */
+    keepaliveCountMax?: number;
+    /** Offer older key exchange, cipher and MAC algorithms. On unless false. */
+    allowLegacyAlgorithms?: boolean;
+    /** Agent auth: the agent socket to use instead of the default. */
+    agentSocketPath?: string | null;
+    /** Agent auth: the key comment or fingerprint to offer first. */
+    agentIdentity?: string | null;
+    /** Forward the agent (or the host's key) into the session. */
+    agentForwarding?: boolean;
+    /** Variables exported into an interactive session. */
+    environmentVariables?: Array<{
+        key: string;
+        value: string;
+    }>;
+}

package/dist/ssh-options.js

@@ -0,0 +1 @@
+export {};

package/dist/table-builder.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Turns a plugin's table definition into the Drizzle table it is queried
+ * through.
+ *
+ * One table object for every dialect. The sqlite-core definitions already
+ * encode correctly on each engine at query time, so the repositories use them
+ * everywhere; only DDL genuinely differs, and that lives in the SDK's ddl
+ * entry so the CLI and the server share one mapping.
+ */
+import type { PluginTableDefinition } from "./db.js";
+/**
+ * Builds the queryable table object.
+ *
+ * Always sqlite-core, on every dialect. drizzle's three table classes share no
+ * base class, and the query-builder surface a plugin uses is identical across
+ * them.
+ */
+export declare function buildTable(pluginId: string, definition: PluginTableDefinition): unknown;
+/**
+ * A minimal stand-in for a core table, for tests that join against users,
+ * ssh_data, roles or user_roles without core's schema. Only what
+ * createTestDb's stubs declare. The property name is camelCased and mapped
+ * to its snake_case column the same way buildTable does, so e.g. a stub's
+ * "displayName" property reads the real "display_name" SQL column.
+ */
+export declare function buildRefTable(name: string, columns: Record<string, "text" | "integer" | "boolean">): unknown;

package/dist/table-builder.js

@@ -0,0 +1,87 @@
+/**
+ * Turns a plugin's table definition into the Drizzle table it is queried
+ * through.
+ *
+ * One table object for every dialect. The sqlite-core definitions already
+ * encode correctly on each engine at query time, so the repositories use them
+ * everywhere; only DDL genuinely differs, and that lives in the SDK's ddl
+ * entry so the CLI and the server share one mapping.
+ */
+import { sqliteTable, text as sqliteText, integer as sqliteInteger, real as sqliteReal, index as sqliteIndex, uniqueIndex as sqliteUniqueIndex, } from "drizzle-orm/sqlite-core";
+import { sql } from "drizzle-orm";
+import { prefixedTableName } from "./db.js";
+import { columnName } from "./ddl.js";
+/**
+ * Builds the queryable table object.
+ *
+ * Always sqlite-core, on every dialect. drizzle's three table classes share no
+ * base class, and the query-builder surface a plugin uses is identical across
+ * them.
+ */
+export function buildTable(pluginId, definition) {
+    const physical = prefixedTableName(pluginId, definition.name);
+    const columns = {};
+    for (const [property, column] of Object.entries(definition.columns)) {
+        const name = columnName(property, column);
+        let built;
+        switch (column.type) {
+            case "id":
+                built = sqliteInteger(name).primaryKey({ autoIncrement: true });
+                break;
+            case "integer":
+            case "bigint":
+            case "refHost":
+                built = sqliteInteger(name);
+                break;
+            case "real":
+                built = sqliteReal(name);
+                break;
+            case "boolean":
+                built = sqliteInteger(name, { mode: "boolean" });
+                break;
+            default:
+                built = sqliteText(name);
+                break;
+        }
+        if (column.type !== "id") {
+            if (column.primaryKey)
+                built = built.primaryKey();
+            if (column.notNull)
+                built = built.notNull();
+            if (column.unique)
+                built = built.unique();
+            if (column.defaultNow) {
+                built = built.default(sql `CURRENT_TIMESTAMP`);
+            }
+            else if (column.defaultValue !== undefined) {
+                built = built.default(column.defaultValue);
+            }
+        }
+        columns[property] = built;
+    }
+    return sqliteTable(physical, columns, (table) => definition.indexes.map((entry) => {
+        const make = entry.unique ? sqliteUniqueIndex : sqliteIndex;
+        const target = table;
+        return make(entry.name).on(...entry.columns.map((c) => target[c]));
+    }));
+}
+/**
+ * A minimal stand-in for a core table, for tests that join against users,
+ * ssh_data, roles or user_roles without core's schema. Only what
+ * createTestDb's stubs declare. The property name is camelCased and mapped
+ * to its snake_case column the same way buildTable does, so e.g. a stub's
+ * "displayName" property reads the real "display_name" SQL column.
+ */
+export function buildRefTable(name, columns) {
+    const built = {};
+    for (const [property, type] of Object.entries(columns)) {
+        const columnSqlName = columnName(property);
+        built[property] =
+            type === "boolean"
+                ? sqliteInteger(columnSqlName, { mode: "boolean" })
+                : type === "integer"
+                    ? sqliteInteger(columnSqlName)
+                    : sqliteText(columnSqlName);
+    }
+    return sqliteTable(name, built);
+}

package/dist/testing/safe-ports.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Keeps a test server's random port off the fetch spec's blocked list.
+ *
+ * Tests start servers on port 0 and call them with fetch, which refuses
+ * ports like 6000 or 6667 with "bad port". Linux never hands those out as
+ * ephemeral ports, but Windows can (its dynamic range may start at 1024), so
+ * a server that lands on one closes and listens again.
+ */
+export declare const FETCH_BLOCKED_PORTS: Set<number>;
+export declare function installSafePorts(): void;

package/dist/testing/safe-ports.js

@@ -0,0 +1,59 @@
+/**
+ * Keeps a test server's random port off the fetch spec's blocked list.
+ *
+ * Tests start servers on port 0 and call them with fetch, which refuses
+ * ports like 6000 or 6667 with "bad port". Linux never hands those out as
+ * ephemeral ports, but Windows can (its dynamic range may start at 1024), so
+ * a server that lands on one closes and listens again.
+ */
+import net from "node:net";
+export const FETCH_BLOCKED_PORTS = new Set([
+    1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79,
+    87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137,
+    139, 143, 161, 179, 389, 427, 465, 512, 513, 514, 515, 526, 530, 531, 532,
+    540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720, 1723,
+    2049, 3659, 4045, 4190, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668, 6669,
+    6679, 6697, 10080,
+]);
+function wantsRandomPort(args) {
+    const first = args[0];
+    if (first === 0 || first === "0")
+        return true;
+    if (first && typeof first === "object" && !Array.isArray(first)) {
+        const port = first.port;
+        return port === 0 || port === "0";
+    }
+    return false;
+}
+const PATCHED = Symbol.for("termix.safePorts");
+export function installSafePorts() {
+    const proto = net.Server.prototype;
+    if (proto[PATCHED])
+        return;
+    proto[PATCHED] = true;
+    const listen = proto.listen;
+    proto.listen = function (...args) {
+        if (wantsRandomPort(args))
+            retryOnBlockedPort(this, args);
+        return listen.apply(this, args);
+    };
+}
+function retryOnBlockedPort(server, args) {
+    const emit = server.emit;
+    // The caller's callback is already a pending "listening" listener, so a
+    // retry leaves it out and it fires once, on the good port.
+    const retryArgs = args.filter((arg) => typeof arg !== "function");
+    server.emit = ((event, ...rest) => {
+        if (event === "listening") {
+            const address = server.address();
+            if (address &&
+                typeof address === "object" &&
+                FETCH_BLOCKED_PORTS.has(address.port)) {
+                server.close(() => server.listen(...retryArgs));
+                return true;
+            }
+            server.emit = emit;
+        }
+        return emit.call(server, event, ...rest);
+    });
+}