@unimatrix27/ralph-harness 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (103) hide show
  1. package/CONTRIBUTING.md +89 -0
  2. package/README.md +401 -0
  3. package/dist/bin/ralph-bootstrap-aws.d.ts +3 -0
  4. package/dist/bin/ralph-bootstrap-aws.d.ts.map +1 -0
  5. package/dist/bin/ralph-bootstrap-aws.js +43 -0
  6. package/dist/bin/ralph-bootstrap-aws.js.map +1 -0
  7. package/dist/bin/ralph-fire.d.ts +3 -0
  8. package/dist/bin/ralph-fire.d.ts.map +1 -0
  9. package/dist/bin/ralph-fire.js +59 -0
  10. package/dist/bin/ralph-fire.js.map +1 -0
  11. package/dist/bin/ralph-gsm.d.ts +3 -0
  12. package/dist/bin/ralph-gsm.d.ts.map +1 -0
  13. package/dist/bin/ralph-gsm.js +93 -0
  14. package/dist/bin/ralph-gsm.js.map +1 -0
  15. package/dist/bin/ralph-orchestrate.d.ts +3 -0
  16. package/dist/bin/ralph-orchestrate.d.ts.map +1 -0
  17. package/dist/bin/ralph-orchestrate.js +20 -0
  18. package/dist/bin/ralph-orchestrate.js.map +1 -0
  19. package/dist/bin/ralph-sync-credential.d.ts +3 -0
  20. package/dist/bin/ralph-sync-credential.d.ts.map +1 -0
  21. package/dist/bin/ralph-sync-credential.js +44 -0
  22. package/dist/bin/ralph-sync-credential.js.map +1 -0
  23. package/dist/bin/ralph-sync-github-pat.d.ts +3 -0
  24. package/dist/bin/ralph-sync-github-pat.d.ts.map +1 -0
  25. package/dist/bin/ralph-sync-github-pat.js +93 -0
  26. package/dist/bin/ralph-sync-github-pat.js.map +1 -0
  27. package/dist/bin/ralph-tail-logs.d.ts +3 -0
  28. package/dist/bin/ralph-tail-logs.d.ts.map +1 -0
  29. package/dist/bin/ralph-tail-logs.js +72 -0
  30. package/dist/bin/ralph-tail-logs.js.map +1 -0
  31. package/dist/bin/ralph-validate-config.d.ts +3 -0
  32. package/dist/bin/ralph-validate-config.d.ts.map +1 -0
  33. package/dist/bin/ralph-validate-config.js +41 -0
  34. package/dist/bin/ralph-validate-config.js.map +1 -0
  35. package/dist/lib/aws-bootstrap.d.ts +53 -0
  36. package/dist/lib/aws-bootstrap.d.ts.map +1 -0
  37. package/dist/lib/aws-bootstrap.js +438 -0
  38. package/dist/lib/aws-bootstrap.js.map +1 -0
  39. package/dist/lib/aws-clients.d.ts +17 -0
  40. package/dist/lib/aws-clients.d.ts.map +1 -0
  41. package/dist/lib/aws-clients.js +25 -0
  42. package/dist/lib/aws-clients.js.map +1 -0
  43. package/dist/lib/claude-runner.d.ts +21 -0
  44. package/dist/lib/claude-runner.d.ts.map +1 -0
  45. package/dist/lib/claude-runner.js +101 -0
  46. package/dist/lib/claude-runner.js.map +1 -0
  47. package/dist/lib/credential-syncer.d.ts +27 -0
  48. package/dist/lib/credential-syncer.d.ts.map +1 -0
  49. package/dist/lib/credential-syncer.js +116 -0
  50. package/dist/lib/credential-syncer.js.map +1 -0
  51. package/dist/lib/ec2-orchestrator.d.ts +38 -0
  52. package/dist/lib/ec2-orchestrator.d.ts.map +1 -0
  53. package/dist/lib/ec2-orchestrator.js +469 -0
  54. package/dist/lib/ec2-orchestrator.js.map +1 -0
  55. package/dist/lib/env-loader.d.ts +18 -0
  56. package/dist/lib/env-loader.d.ts.map +1 -0
  57. package/dist/lib/env-loader.js +120 -0
  58. package/dist/lib/env-loader.js.map +1 -0
  59. package/dist/lib/fire-launcher.d.ts +59 -0
  60. package/dist/lib/fire-launcher.d.ts.map +1 -0
  61. package/dist/lib/fire-launcher.js +320 -0
  62. package/dist/lib/fire-launcher.js.map +1 -0
  63. package/dist/lib/gh-runner.d.ts +13 -0
  64. package/dist/lib/gh-runner.d.ts.map +1 -0
  65. package/dist/lib/gh-runner.js +50 -0
  66. package/dist/lib/gh-runner.js.map +1 -0
  67. package/dist/lib/github-state-mutator.d.ts +11 -0
  68. package/dist/lib/github-state-mutator.d.ts.map +1 -0
  69. package/dist/lib/github-state-mutator.js +179 -0
  70. package/dist/lib/github-state-mutator.js.map +1 -0
  71. package/dist/lib/phase-result-schemas.d.ts +88 -0
  72. package/dist/lib/phase-result-schemas.d.ts.map +1 -0
  73. package/dist/lib/phase-result-schemas.js +180 -0
  74. package/dist/lib/phase-result-schemas.js.map +1 -0
  75. package/dist/lib/post-hoc-agent-stuck-checker.d.ts +26 -0
  76. package/dist/lib/post-hoc-agent-stuck-checker.d.ts.map +1 -0
  77. package/dist/lib/post-hoc-agent-stuck-checker.js +142 -0
  78. package/dist/lib/post-hoc-agent-stuck-checker.js.map +1 -0
  79. package/dist/lib/prompt-renderer.d.ts +4 -0
  80. package/dist/lib/prompt-renderer.d.ts.map +1 -0
  81. package/dist/lib/prompt-renderer.js +30 -0
  82. package/dist/lib/prompt-renderer.js.map +1 -0
  83. package/dist/lib/security-runner.d.ts +7 -0
  84. package/dist/lib/security-runner.d.ts.map +1 -0
  85. package/dist/lib/security-runner.js +53 -0
  86. package/dist/lib/security-runner.js.map +1 -0
  87. package/dist/lib/structured-log-emitter.d.ts +53 -0
  88. package/dist/lib/structured-log-emitter.d.ts.map +1 -0
  89. package/dist/lib/structured-log-emitter.js +122 -0
  90. package/dist/lib/structured-log-emitter.js.map +1 -0
  91. package/dist/lib/target-config-schema.d.ts +28 -0
  92. package/dist/lib/target-config-schema.d.ts.map +1 -0
  93. package/dist/lib/target-config-schema.js +157 -0
  94. package/dist/lib/target-config-schema.js.map +1 -0
  95. package/dist/lib/user-data-renderer.d.ts +20 -0
  96. package/dist/lib/user-data-renderer.d.ts.map +1 -0
  97. package/dist/lib/user-data-renderer.js +75 -0
  98. package/dist/lib/user-data-renderer.js.map +1 -0
  99. package/lib/cloud-init/system-setup.sh +338 -0
  100. package/package.json +55 -0
  101. package/prompts/discovery.md +182 -0
  102. package/prompts/implementation.md +161 -0
  103. package/prompts/review.md +135 -0
package/dist/bin/ralph-gsm.js ADDED
@@ -0,0 +1,93 @@
1
+ #!/usr/bin/env node
2
+ //
3
+ // ralph-gsm — CLI wrapper around src/lib/github-state-mutator. Drop-in
4
+ // replacement for the (deleted) bin/gsm bash script.
5
+ //
6
+ // Usage:
7
+ // ralph-gsm swap-label <repo> <issue#> <from-label> <to-label>
8
+ // ralph-gsm comment-issue <repo> <issue#> <body>
9
+ // ralph-gsm find-or-create-log <repo> <milestone>
10
+ // ralph-gsm append-caveman-log <repo> <log#> <issue#> <summary> [<gotcha>]
11
+ //
12
+ // Exit codes (matching bin/gsm):
13
+ // 0 success
14
+ // 2 usage / missing required argument
15
+ // non-zero propagated from gh via GhRunnerError
16
+ import { GhRunnerError, appendCavemanLog, commentIssue, findOrCreateMilestoneLogIssue, moduleErr, swapLabel, } from "../lib/github-state-mutator.js";
17
+ const USAGE = `usage: ralph-gsm <command> [args]
18
+
19
+ commands:
20
+ swap-label <repo> <issue#> <from-label> <to-label>
21
+ comment-issue <repo> <issue#> <body>
22
+ find-or-create-log <repo> <milestone>
23
+ append-caveman-log <repo> <log#> <issue#> <summary> [<gotcha>]
24
+ `;
25
+ function fail(message, code) {
26
+ process.stderr.write(moduleErr(message) + "\n");
27
+ process.exit(code);
28
+ }
29
+ function usage(code) {
30
+ process.stderr.write(USAGE);
31
+ process.exit(code);
32
+ }
33
+ function parseIssueNum(raw, label) {
34
+ const n = Number.parseInt(raw, 10);
35
+ if (!Number.isFinite(n) || n <= 0 || String(n) !== raw) {
36
+ fail(`${label} must be a positive integer, got '${raw}'`, 2);
37
+ }
38
+ return n;
39
+ }
40
+ function requireArgs(cmd, want, got) {
41
+ if (got < want)
42
+ fail(`${cmd}: expected ${want} args, got ${got}`, 2);
43
+ }
44
+ const args = process.argv.slice(2);
45
+ const cmd = args[0];
46
+ if (!cmd)
47
+ usage(2);
48
+ if (cmd === "-h" || cmd === "--help" || cmd === "help")
49
+ usage(0);
50
+ const rest = args.slice(1);
51
+ try {
52
+ switch (cmd) {
53
+ case "swap-label": {
54
+ requireArgs("swap-label", 4, rest.length);
55
+ const [repo, numRaw, from, to] = rest;
56
+ swapLabel(repo, parseIssueNum(numRaw, "issue#"), from, to);
57
+ break;
58
+ }
59
+ case "comment-issue": {
60
+ requireArgs("comment-issue", 3, rest.length);
61
+ const [repo, numRaw, body] = rest;
62
+ commentIssue(repo, parseIssueNum(numRaw, "issue#"), body);
63
+ break;
64
+ }
65
+ case "find-or-create-log": {
66
+ requireArgs("find-or-create-log", 2, rest.length);
67
+ const [repo, milestone] = rest;
68
+ const n = findOrCreateMilestoneLogIssue(repo, milestone);
69
+ process.stdout.write(`${n}\n`);
70
+ break;
71
+ }
72
+ case "append-caveman-log": {
73
+ requireArgs("append-caveman-log", 4, rest.length);
74
+ const [repo, logRaw, issueRaw, summary, gotcha] = rest;
75
+ appendCavemanLog(repo, parseIssueNum(logRaw, "log#"), parseIssueNum(issueRaw, "issue#"), summary, gotcha);
76
+ break;
77
+ }
78
+ default:
79
+ process.stderr.write(`ralph-gsm: unknown command: ${cmd}\n`);
80
+ usage(2);
81
+ }
82
+ }
83
+ catch (err) {
84
+ if (err instanceof GhRunnerError) {
85
+ process.stderr.write(moduleErr(err.message) + "\n");
86
+ process.exit(err.exitCode === 0 ? 1 : err.exitCode);
87
+ }
88
+ const detail = err instanceof Error ? err.message : String(err);
89
+ process.stderr.write(detail + "\n");
90
+ process.exit(1);
91
+ }
92
+ process.exit(0);
93
+ //# sourceMappingURL=ralph-gsm.js.map
package/dist/bin/ralph-gsm.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-gsm.js","sourceRoot":"","sources":["../../src/bin/ralph-gsm.ts"],"names":[],"mappings":";AACA,EAAE;AACF,uEAAuE;AACvE,qDAAqD;AACrD,EAAE;AACF,SAAS;AACT,iEAAiE;AACjE,mDAAmD;AACnD,oDAAoD;AACpD,6EAA6E;AAC7E,EAAE;AACF,iCAAiC;AACjC,eAAe;AACf,yCAAyC;AACzC,mDAAmD;AAEnD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,6BAA6B,EAC7B,SAAS,EACT,SAAS,GACV,MAAM,gCAAgC,CAAC;AAExC,MAAM,KAAK,GAAG;;;;;;;CAOb,CAAC;AAEF,SAAS,IAAI,CAAC,OAAe,EAAE,IAAY;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACvD,IAAI,CAAC,GAAG,KAAK,qCAAqC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IACzD,IAAI,GAAG,GAAG,IAAI;QAAE,IAAI,CAAC,GAAG,GAAG,cAAc,IAAI,cAAc,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEpB,IAAI,CAAC,GAAG;IAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACnB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;IAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE3B,IAAI,CAAC;IACH,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,WAAW,CAAC,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAwC,CAAC;YAC1E,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM;QACR,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,WAAW,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,IAAgC,CAAC;YAC9D,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM;QACR,CAAC;QACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,WAAW,CAAC,oBAAoB,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,IAAwB,CAAC;YACnD,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM;QACR,CAAC;QACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,WAAW,CAAC,oBAAoB,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,IAMjD,CAAC;YACF,gBAAgB,CACd,IAAI,EACJ,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACjC,OAAO,EACP,MAAM,CACP,CAAC;YACF,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;YAC7D,KAAK,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}
package/dist/bin/ralph-orchestrate.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ #!/usr/bin/env node
2
+ export {};
3
+ //# sourceMappingURL=ralph-orchestrate.d.ts.map
package/dist/bin/ralph-orchestrate.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-orchestrate.d.ts","sourceRoot":"","sources":["../../src/bin/ralph-orchestrate.ts"],"names":[],"mappings":""}
package/dist/bin/ralph-orchestrate.js ADDED
@@ -0,0 +1,20 @@
1
+ #!/usr/bin/env node
2
+ //
3
+ // ralph-orchestrate — slice 5 orchestrator (real). Replaces the iteration-1
4
+ // `lib/ec2-orchestrator.sh`. Runs the discovery → implementation → review
5
+ // state machine on a freshly bootstrapped EC2 worker.
6
+ //
7
+ // Usage:
8
+ // ralph-orchestrate
9
+ //
10
+ // Reads the env contract documented in lib/ec2-orchestrator.ts. Exit codes
11
+ // are byte-compatible with iteration 1's `orch::run`.
12
+ import { run } from "../lib/ec2-orchestrator.js";
13
+ run()
14
+ .then((rc) => process.exit(rc))
15
+ .catch((err) => {
16
+ const msg = err instanceof Error ? err.message : String(err);
17
+ process.stderr.write(`ralph-orchestrate: ${msg}\n`);
18
+ process.exit(1);
19
+ });
20
+ //# sourceMappingURL=ralph-orchestrate.js.map
package/dist/bin/ralph-orchestrate.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-orchestrate.js","sourceRoot":"","sources":["../../src/bin/ralph-orchestrate.ts"],"names":[],"mappings":";AACA,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,sDAAsD;AACtD,EAAE;AACF,SAAS;AACT,sBAAsB;AACtB,EAAE;AACF,2EAA2E;AAC3E,sDAAsD;AAEtD,OAAO,EAAE,GAAG,EAAE,MAAM,4BAA4B,CAAC;AAEjD,GAAG,EAAE;KACF,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KAC9B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
package/dist/bin/ralph-sync-credential.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ #!/usr/bin/env node
2
+ export {};
3
+ //# sourceMappingURL=ralph-sync-credential.d.ts.map
package/dist/bin/ralph-sync-credential.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-sync-credential.d.ts","sourceRoot":"","sources":["../../src/bin/ralph-sync-credential.ts"],"names":[],"mappings":""}
package/dist/bin/ralph-sync-credential.js ADDED
@@ -0,0 +1,44 @@
1
+ #!/usr/bin/env node
2
+ //
3
+ // ralph-sync-credential — extract the macOS Keychain `Claude Code-credentials`
4
+ // entry and write it into SSM as a SecureString. Drop-in replacement for the
5
+ // (deleted) bin/sync-credential.sh. Re-run after every desktop `claude /login`.
6
+ //
7
+ // Usage:
8
+ // ralph-sync-credential [<ssm-key>]
9
+ //
10
+ // Reads from env:
11
+ // RALPH_CLAUDE_OAUTH_SSM_KEY SSM parameter name
12
+ // (default /ralph/claude-oauth-credential)
13
+ //
14
+ // Region is forced to eu-central-1. The credential is never echoed, logged,
15
+ // or placed on any process's argv.
16
+ //
17
+ // Exit codes (matching bin/sync-credential.sh + lib/credential-syncer.sh):
18
+ // 0 success
19
+ // 2 usage error
20
+ // 3 Keychain entry missing, empty, or not JSON
21
+ // 4 AWS credentials not configured
22
+ // 1 any other failure
23
+ import { defaultAwsClients } from "../lib/aws-clients.js";
24
+ import { CredentialSyncerError, DEFAULTS, moduleErr, syncCredential, } from "../lib/credential-syncer.js";
25
+ async function main() {
26
+ const args = process.argv.slice(2);
27
+ if (args.length > 1) {
28
+ process.stderr.write(moduleErr("usage: ralph-sync-credential [<ssm-key>]") + "\n");
29
+ process.exit(2);
30
+ }
31
+ const ssmKey = args[0] ?? process.env.RALPH_CLAUDE_OAUTH_SSM_KEY ?? DEFAULTS.ssmKey;
32
+ const clients = defaultAwsClients();
33
+ await syncCredential({ clients, ssmKey });
34
+ }
35
+ main().catch((err) => {
36
+ if (err instanceof CredentialSyncerError) {
37
+ process.stderr.write(`${err.message}\n`);
38
+ process.exit(err.code);
39
+ }
40
+ const msg = err instanceof Error ? err.message : String(err);
41
+ process.stderr.write(`${msg}\n`);
42
+ process.exit(1);
43
+ });
44
+ //# sourceMappingURL=ralph-sync-credential.js.map
package/dist/bin/ralph-sync-credential.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-sync-credential.js","sourceRoot":"","sources":["../../src/bin/ralph-sync-credential.ts"],"names":[],"mappings":";AACA,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,SAAS;AACT,sCAAsC;AACtC,EAAE;AACF,kBAAkB;AAClB,qDAAqD;AACrD,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,mCAAmC;AACnC,EAAE;AACF,2EAA2E;AAC3E,gBAAgB;AAChB,oBAAoB;AACpB,mDAAmD;AACnD,uCAAuC;AACvC,0BAA0B;AAE1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,SAAS,EACT,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,CAAC,0CAA0C,CAAC,GAAG,IAAI,CAC7D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GACV,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,QAAQ,CAAC,MAAM,CAAC;IAEvE,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
package/dist/bin/ralph-sync-github-pat.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ #!/usr/bin/env node
2
+ export {};
3
+ //# sourceMappingURL=ralph-sync-github-pat.d.ts.map
package/dist/bin/ralph-sync-github-pat.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-sync-github-pat.d.ts","sourceRoot":"","sources":["../../src/bin/ralph-sync-github-pat.ts"],"names":[],"mappings":""}
package/dist/bin/ralph-sync-github-pat.js ADDED
@@ -0,0 +1,93 @@
1
+ #!/usr/bin/env node
2
+ //
3
+ // ralph-sync-github-pat — write a GitHub PAT into the SSM SecureString that
4
+ // the EC2 worker reads at launch. Net-new in slice 4 (the iteration-1 fire
5
+ // path bootstrapped a placeholder via aws-bootstrap and the operator
6
+ // overwrote it manually with `aws ssm put-parameter`).
7
+ //
8
+ // Usage:
9
+ // echo $TOKEN | ralph-sync-github-pat
10
+ // ralph-sync-github-pat < ./token.txt
11
+ //
12
+ // The token must be supplied on stdin. We deliberately do NOT accept the
13
+ // token on argv (it would land in shell history + ps output). We also do
14
+ // not read from a $RALPH_GITHUB_PAT env var — env vars on macOS leak into
15
+ // process listings.
16
+ //
17
+ // Reads from env:
18
+ // RALPH_GITHUB_TOKEN_SSM_KEY SSM parameter name
19
+ // (default /ralph/github-pat)
20
+ //
21
+ // Region is forced to eu-central-1.
22
+ //
23
+ // Exit codes:
24
+ // 0 success
25
+ // 2 usage error (no stdin / empty input / argv given)
26
+ // 4 AWS credentials not configured
27
+ // 1 any other failure
28
+ import { PutParameterCommand } from "@aws-sdk/client-ssm";
29
+ import { GetCallerIdentityCommand } from "@aws-sdk/client-sts";
30
+ import { AWS_REGION, defaultAwsClients } from "../lib/aws-clients.js";
31
+ const MODULE_PREFIX = "github-pat-syncer";
32
+ const DEFAULT_SSM_KEY = "/ralph/github-pat";
33
+ const DEFAULT_KMS_ALIAS = "alias/ralph";
34
+ function moduleErr(message) {
35
+ return `${MODULE_PREFIX}: error: ${message}`;
36
+ }
37
+ function moduleInfo(message) {
38
+ return `${MODULE_PREFIX}: ${message}`;
39
+ }
40
+ async function readStdin() {
41
+ const chunks = [];
42
+ for await (const chunk of process.stdin) {
43
+ chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
44
+ }
45
+ return Buffer.concat(chunks).toString("utf8");
46
+ }
47
+ async function main() {
48
+ const args = process.argv.slice(2);
49
+ if (args.length > 0) {
50
+ process.stderr.write(moduleErr("this CLI takes no arguments — pass the token on stdin (echo $TOKEN | ralph-sync-github-pat)") + "\n");
51
+ process.exit(2);
52
+ }
53
+ if (process.stdin.isTTY) {
54
+ process.stderr.write(moduleErr("no stdin attached. Pipe the token in: 'echo $TOKEN | ralph-sync-github-pat' (or redirect from a file).") + "\n");
55
+ process.exit(2);
56
+ }
57
+ const ssmKey = process.env.RALPH_GITHUB_TOKEN_SSM_KEY || DEFAULT_SSM_KEY;
58
+ const kmsAlias = DEFAULT_KMS_ALIAS;
59
+ const raw = await readStdin();
60
+ // Strip exactly one trailing newline (added by `echo`/`cat`); preserve
61
+ // whitespace inside the token. If the operator typed multiple lines we
62
+ // keep them — the SDK will reject anything that isn't a valid GitHub PAT
63
+ // when it's actually used downstream.
64
+ const token = raw.endsWith("\n") ? raw.slice(0, -1) : raw;
65
+ if (token.length === 0) {
66
+ process.stderr.write(moduleErr("stdin was empty.") + "\n");
67
+ process.exit(2);
68
+ }
69
+ const clients = defaultAwsClients();
70
+ try {
71
+ await clients.sts.send(new GetCallerIdentityCommand({}));
72
+ }
73
+ catch (err) {
74
+ const detail = err instanceof Error ? err.message : String(err);
75
+ process.stderr.write(moduleErr(`AWS credentials not configured. Run 'aws configure' or set AWS_PROFILE. (${detail})`) + "\n");
76
+ process.exit(4);
77
+ }
78
+ process.stdout.write(moduleInfo(`uploading PAT to ${ssmKey} (region=${AWS_REGION}, kms=${kmsAlias})`) + "\n");
79
+ await clients.ssm.send(new PutParameterCommand({
80
+ Name: ssmKey,
81
+ Type: "SecureString",
82
+ KeyId: kmsAlias,
83
+ Value: token,
84
+ Overwrite: true,
85
+ }));
86
+ process.stdout.write(moduleInfo(`uploaded PAT to ${ssmKey}`) + "\n");
87
+ }
88
+ main().catch((err) => {
89
+ const msg = err instanceof Error ? err.message : String(err);
90
+ process.stderr.write(`${msg}\n`);
91
+ process.exit(1);
92
+ });
93
+ //# sourceMappingURL=ralph-sync-github-pat.js.map
package/dist/bin/ralph-sync-github-pat.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-sync-github-pat.js","sourceRoot":"","sources":["../../src/bin/ralph-sync-github-pat.ts"],"names":[],"mappings":";AACA,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,uDAAuD;AACvD,EAAE;AACF,SAAS;AACT,wCAAwC;AACxC,wCAAwC;AACxC,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,oBAAoB;AACpB,EAAE;AACF,kBAAkB;AAClB,qDAAqD;AACrD,8DAA8D;AAC9D,EAAE;AACF,oCAAoC;AACpC,EAAE;AACF,cAAc;AACd,gBAAgB;AAChB,0DAA0D;AAC1D,uCAAuC;AACvC,0BAA0B;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAExC,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,GAAG,aAAa,YAAY,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,GAAG,aAAa,KAAK,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,CACP,6FAA6F,CAC9F,GAAG,IAAI,CACT,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,CACP,wGAAwG,CACzG,GAAG,IAAI,CACT,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,eAAe,CAAC;IAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IAEnC,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,CACP,4EAA4E,MAAM,GAAG,CACtF,GAAG,IAAI,CACT,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,CACR,oBAAoB,MAAM,YAAY,UAAU,SAAS,QAAQ,GAAG,CACrE,GAAG,IAAI,CACT,CAAC;IAEF,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACpB,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,IAAI;KAChB,CAAC,CACH,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
package/dist/bin/ralph-tail-logs.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ #!/usr/bin/env node
2
+ export {};
3
+ //# sourceMappingURL=ralph-tail-logs.d.ts.map
package/dist/bin/ralph-tail-logs.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-tail-logs.d.ts","sourceRoot":"","sources":["../../src/bin/ralph-tail-logs.ts"],"names":[],"mappings":""}
package/dist/bin/ralph-tail-logs.js ADDED
@@ -0,0 +1,72 @@
1
+ #!/usr/bin/env node
2
+ //
3
+ // ralph-tail-logs — tail the per-instance CloudWatch streams for one (or
4
+ // all) running ralph-harness EC2 worker(s). Net-new in slice 4 (iteration 1
5
+ // documented `aws logs tail …` as a one-liner).
6
+ //
7
+ // Usage:
8
+ // ralph-tail-logs # tail every stream in /ralph/main
9
+ // ralph-tail-logs <instance-id> # tail just one stream (i-...)
10
+ // ralph-tail-logs --since 30m # forwarded to `aws logs tail`
11
+ // ralph-tail-logs --no-follow ... # forwarded to `aws logs tail`
12
+ //
13
+ // Implementation: this is a thin pass-through to `aws logs tail` (CLI v2).
14
+ // The CLI is the only AWS tool that ships a usable interactive tailer; the
15
+ // SDK's StartLiveTail API requires extra IAM perms most operators don't
16
+ // have. Forwarding keeps the operator UX identical.
17
+ //
18
+ // Reads from env:
19
+ // RALPH_LOG_GROUP log group to tail (default /ralph/main)
20
+ //
21
+ // Region is forced to eu-central-1 via the --region flag passed to aws.
22
+ //
23
+ // Exit codes:
24
+ // 0 aws exited 0
25
+ // 2 usage error
26
+ // propagated any non-zero exit from the underlying `aws` CLI
27
+ import { spawnSync } from "node:child_process";
28
+ import { AWS_REGION } from "../lib/aws-clients.js";
29
+ const MODULE_PREFIX = "ralph-tail-logs";
30
+ const DEFAULT_LOG_GROUP = "/ralph/main";
31
+ function moduleErr(message) {
32
+ return `${MODULE_PREFIX}: error: ${message}`;
33
+ }
34
+ function main() {
35
+ const argv = process.argv.slice(2);
36
+ if (argv[0] === "-h" || argv[0] === "--help") {
37
+ process.stdout.write(`usage: ralph-tail-logs [<instance-id>] [extra args forwarded to 'aws logs tail']\n` +
38
+ `\n` +
39
+ `Tails the per-instance CloudWatch stream(s) for ralph-harness EC2 workers.\n` +
40
+ `Without an instance id, tails every stream in the log group.\n` +
41
+ `\n` +
42
+ `env:\n` +
43
+ ` RALPH_LOG_GROUP log group to tail (default ${DEFAULT_LOG_GROUP})\n`);
44
+ process.exit(0);
45
+ }
46
+ const logGroup = process.env.RALPH_LOG_GROUP || DEFAULT_LOG_GROUP;
47
+ // First positional argument that looks like an EC2 instance id is treated
48
+ // as the stream filter; everything else is forwarded to `aws logs tail`.
49
+ // (aws logs tail accepts `--log-stream-names <name>` for stream selection.)
50
+ const passthrough = [];
51
+ let instanceId;
52
+ for (const a of argv) {
53
+ if (!instanceId && /^i-[0-9a-f]+$/i.test(a)) {
54
+ instanceId = a;
55
+ continue;
56
+ }
57
+ passthrough.push(a);
58
+ }
59
+ const args = ["--region", AWS_REGION, "logs", "tail", logGroup, "--follow"];
60
+ if (instanceId) {
61
+ args.push("--log-stream-names", instanceId);
62
+ }
63
+ args.push(...passthrough);
64
+ const r = spawnSync("aws", args, { stdio: "inherit" });
65
+ if (r.error) {
66
+ process.stderr.write(moduleErr(`failed to spawn aws: ${r.error.message}`) + "\n");
67
+ process.exit(1);
68
+ }
69
+ process.exit(r.status ?? 1);
70
+ }
71
+ main();
72
+ //# sourceMappingURL=ralph-tail-logs.js.map
package/dist/bin/ralph-tail-logs.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-tail-logs.js","sourceRoot":"","sources":["../../src/bin/ralph-tail-logs.ts"],"names":[],"mappings":";AACA,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,gDAAgD;AAChD,EAAE;AACF,SAAS;AACT,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,oDAAoD;AACpD,EAAE;AACF,kBAAkB;AAClB,+DAA+D;AAC/D,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,cAAc;AACd,qBAAqB;AACrB,oBAAoB;AACpB,iEAAiE;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAExC,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,GAAG,aAAa,YAAY,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oFAAoF;YAClF,IAAI;YACJ,8EAA8E;YAC9E,gEAAgE;YAChE,IAAI;YACJ,QAAQ;YACR,mDAAmD,iBAAiB,KAAK,CAC5E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAElE,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,UAAU,GAAG,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAE1B,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAC5D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,IAAI,EAAE,CAAC"}
package/dist/bin/ralph-validate-config.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ #!/usr/bin/env node
2
+ export {};
3
+ //# sourceMappingURL=ralph-validate-config.d.ts.map
package/dist/bin/ralph-validate-config.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-validate-config.d.ts","sourceRoot":"","sources":["../../src/bin/ralph-validate-config.ts"],"names":[],"mappings":""}
package/dist/bin/ralph-validate-config.js ADDED
@@ -0,0 +1,41 @@
1
+ #!/usr/bin/env node
2
+ import { readFileSync } from "node:fs";
3
+ import { ValidateError, moduleErr, validate, } from "../lib/target-config-schema.js";
4
+ const args = process.argv.slice(2);
5
+ if (args.length === 0) {
6
+ process.stderr.write(moduleErr("usage: ralph-validate-config <path-to-config.yaml>") + "\n");
7
+ process.exit(2);
8
+ }
9
+ const path = args[0];
10
+ let yamlString;
11
+ try {
12
+ yamlString = readFileSync(path, "utf8");
13
+ }
14
+ catch (err) {
15
+ const code = err.code;
16
+ if (code === "ENOENT") {
17
+ process.stderr.write(moduleErr(`config file not found: ${path}`) + "\n");
18
+ process.exit(2);
19
+ }
20
+ const detail = err instanceof Error ? err.message : String(err);
21
+ process.stderr.write(moduleErr(`could not read ${path}: ${detail}`) + "\n");
22
+ process.exit(2);
23
+ }
24
+ try {
25
+ validate(yamlString);
26
+ }
27
+ catch (err) {
28
+ if (err instanceof ValidateError) {
29
+ const msg = err.code === 3
30
+ ? err.message.replace(/^malformed yaml/, `malformed yaml in ${path}`)
31
+ : err.message;
32
+ process.stderr.write(moduleErr(msg) + "\n");
33
+ process.exit(err.code);
34
+ }
35
+ const detail = err instanceof Error ? err.message : String(err);
36
+ process.stderr.write(moduleErr(`unexpected error: ${detail}`) + "\n");
37
+ process.exit(6);
38
+ }
39
+ process.stdout.write(`ok: ${path} is a valid .ralph/config.yaml\n`);
40
+ process.exit(0);
41
+ //# sourceMappingURL=ralph-validate-config.js.map
package/dist/bin/ralph-validate-config.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ralph-validate-config.js","sourceRoot":"","sources":["../../src/bin/ralph-validate-config.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,aAAa,EACb,SAAS,EACT,QAAQ,GACT,MAAM,gCAAgC,CAAC;AAExC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,CAAC,oDAAoD,CAAC,GAAG,IAAI,CACvE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;AAEtB,IAAI,UAAkB,CAAC;AACvB,IAAI,CAAC;IACH,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,0BAA0B,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,CAAC;IACH,QAAQ,CAAC,UAAU,CAAC,CAAC;AACvB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GACP,GAAG,CAAC,IAAI,KAAK,CAAC;YACZ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CACjB,iBAAiB,EACjB,qBAAqB,IAAI,EAAE,CAC5B;YACH,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,kCAAkC,CAAC,CAAC;AACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}
package/dist/lib/aws-bootstrap.d.ts ADDED
@@ -0,0 +1,53 @@
1
+ import { type AwsClients } from "./aws-clients.js";
2
+ export declare const MODULE_PREFIX = "aws-bootstrap";
3
+ export declare const DEFAULTS: {
4
+ readonly region: "eu-central-1";
5
+ readonly kmsAlias: "alias/ralph";
6
+ readonly iamRole: "ralph-ec2-role";
7
+ readonly iamProfile: "ralph-ec2-profile";
8
+ readonly sgName: "ralph-sg";
9
+ readonly agentStuckLabel: "agent-stuck";
10
+ readonly agentStuckColor: "d73a4a";
11
+ readonly githubKey: "/ralph/github-pat";
12
+ readonly oauthKey: "/ralph/claude-oauth-credential";
13
+ readonly logGroup: "/ralph/main";
14
+ };
15
+ export declare function moduleErr(message: string): string;
16
+ export declare function moduleInfo(message: string): string;
17
+ export type Logger = (line: string) => void;
18
+ export declare function ensureKmsAlias(clients: AwsClients, alias: string, info?: Logger): Promise<void>;
19
+ export declare function ensureSsmSecureString(clients: AwsClients, name: string, description: string, kmsAlias: string, info?: Logger): Promise<void>;
20
+ interface PolicyDoc {
21
+ Version: string;
22
+ Statement: PolicyStatement[];
23
+ }
24
+ interface PolicyStatement {
25
+ Sid: string;
26
+ Effect: "Allow" | "Deny";
27
+ Action: string[];
28
+ Resource: string[] | string;
29
+ Condition?: unknown;
30
+ }
31
+ export declare function buildInlinePolicy(account: string, githubKey: string, oauthKey: string, logGroup: string, kmsAlias: string, region?: string): PolicyDoc;
32
+ export declare function canonicalJson(value: unknown): string;
33
+ export declare function ensureIamRoleAndProfile(clients: AwsClients, role: string, profile: string, githubKey: string, oauthKey: string, logGroup: string, kmsAlias: string, info?: Logger, region?: string): Promise<void>;
34
+ export declare function ensureSecurityGroup(clients: AwsClients, name: string, description: string, info?: Logger, region?: string): Promise<void>;
35
+ export declare function ensureLogGroup(clients: AwsClients, name: string, info?: Logger): Promise<void>;
36
+ export declare function ensureAgentStuckLabel(repo: string, label: string, info?: Logger, color?: string): void;
37
+ export interface RunAllOptions {
38
+ clients: AwsClients;
39
+ repo: string;
40
+ githubKey?: string;
41
+ oauthKey?: string;
42
+ logGroup?: string;
43
+ kmsAlias?: string;
44
+ iamRole?: string;
45
+ iamProfile?: string;
46
+ sgName?: string;
47
+ agentStuckLabel?: string;
48
+ region?: string;
49
+ info?: Logger;
50
+ }
51
+ export declare function runAll(opts: RunAllOptions): Promise<void>;
52
+ export {};
53
+ //# sourceMappingURL=aws-bootstrap.d.ts.map
package/dist/lib/aws-bootstrap.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"aws-bootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/aws-bootstrap.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG/D,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,eAAO,MAAM,QAAQ;;;;;;;;;;;CAWX,CAAC;AAEX,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAS5C,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAwBf;AASD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAID,UAAU,SAAS;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,eAAe,EAAE,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA+BD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAwB,GAC/B,SAAS,CAkCX;AAID,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAsBD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAoB,EAC1B,MAAM,GAAE,MAAwB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA4If;AAOD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,MAAoB,EAC1B,MAAM,GAAE,MAAwB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyCf;AAKD,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAWf;AAMD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAoB,EAC1B,KAAK,GAAE,MAAiC,GACvC,IAAI,CAwCN;AAID,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAGD,wBAAsB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0D/D"}