@usine/executor 0.2.0 → 0.3.0

package/dist/ssh/gateway/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../../../src/ssh/gateway/attachments.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAqB,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAI3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAuB,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEvE;;;GAGG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;CAOxC,CAAC,IAAI,EAAE,CAAC;AAET,gHAAgH;AAChH,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAOrC,0GAA0G;AAC1G,MAAM,iBAAiB,GAAG,CAAC,OAAmB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,eAAe,KAAK,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EAC3F,QAAwB,EACxB,UAA4E;IAE5E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE3C,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CAAC,QAAQ,CAAC,EAClF,MAAkB;QAElB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,EAAE;gBAClF,MAAM;aACP,CAAC,CAAC;QACL,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAClD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6DAA6D,EAAE;gBAC3F,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,4EAA4E;QAC5E,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,SAAS,EACT,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CACrB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,uDAAuD,EAAE;YACtE,MAAM;YACN,UAAU;YACV,UAAU,EAAE,EAAE;YACd,QAAQ;SACT,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,0FAA0F,EAC1F,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC/D,CACF,EACD,MAAM,CAAC,MAAM,CACd,EACH,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,6FAA6F;IAC7F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,MAAM,EAAE,CAAC,MAAkB,EAAE,EAAE,CAC7B,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,+FAA+F,EAC/F,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CACnC,CACF,EACD,MAAM,CAAC,MAAM,CACd;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAChE,SAAoB,EACpB,MAAkB,EAClB,UAA0B,EAC1B,WAA4B,EAC5B,OAAmB,EACnB,OAAuB,EACvB,SAA4B;QAE5B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YAClD,IAAI;YACJ,sBAAsB;YACtB,IAAI;YACJ,iBAAiB,CAAC,OAAO,CAAC;YAC1B,MAAM,CAAC,YAAY,CAAC;YACpB,MAAM,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAqB,CAAC,CAAC;QACnE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,KAAK,CAAC;YACX,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,QAAQ,CAAC,iDAAiD,EAAE,MAAM,CAAC;YAC5E,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,+CAA+C,EAAE;gBAC9D,GAAG,MAAM;gBACT,UAAU,EAAE,EAAE;gBACd,QAAQ;aACT,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,8FAA8F,EAC9F,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CACtD,CACF,EACD,MAAM,CAAC,MAAM,CACd;SACJ,CAAC,CACH,CACF,CACF,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,UAA4B,EAAE,EAAE,CAClD,IAAI,aAAa,CAAC;YAChB,MAAM;YACN,UAAU;YACV,UAAU,EAAE,IAAI,sBAAsB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACnE,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;QAEL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CACxD,QAAQ,CAAC,EAAE,UAA4B;YACrC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBAClD,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;aAC5D,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,0BAA0B,CAAC;gBAC7B,UAAU;gBACV,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK;aACN,CAAC,CACL,CACF,CAAC;YACF,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAChF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACxE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACpB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,iDAAiD,EACrD;gBACE,GAAG,MAAM;gBACT,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;gBAChC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;aAC3D,CACF,CAAC;YACF,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QACD,oFAAoF;QACpF,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EACnB,MAAM,CAAC,eAAe,CACvB,CAAC;QAEF,4FAA4F;QAC5F,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CACxD,QAAQ,CAAC;YACP,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO;YACnC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;YACzC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mDAAmD,EAAE;gBAC1E,GAAG,MAAM;gBACT,UAAU,EAAE,EAAE;aACf,CAAC,CAAC;QACL,CAAC,EACD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EACnB,MAAM,CAAC,eAAe,CACvB,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC3C,QAAQ,CAAC,KAAK,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,OAAO,CACR,CAAC;QACF,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC;QACzC,yFAAyF;QACzF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,uEAAuE,EACvE;YACE,GAAG,MAAM;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CACF,CACF,EACD,MAAM,CAAC,MAAM,CACd,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC;YAC5C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC;YAC7C,WAAW;SACZ,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;YACxC,WAAW,EAAE,QAAQ;YACrB,cAAc,EAAE,QAAQ;YACxB,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;YAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;SACvE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/environment.d.ts

@@ -0,0 +1,52 @@
+import type { RepositoryName } from "@usine/core/repository";
+import type { GatewayDomain, GatewayLlmProvider } from "@usine/core/worker";
+import { type CallerToken } from "@usine/gateway/admin";
+import { Redacted } from "effect";
+/** The variables sent through the SSH connection because they contain the caller token. The Worker's sshd must accept each in `AcceptEnv`. */
+export declare const GATEWAY_SENT_VARIABLES: readonly ["GIT_CONFIG_VALUE_0", "GH_ENTERPRISE_TOKEN", "GH_TOKEN", "ANTHROPIC_AUTH_TOKEN"];
+/** Returns the Gateway's forward proxy URL from a Worker; children receive it as `HTTPS_PROXY`. */
+export declare const forwardProxyUrl: (domain: GatewayDomain) => string;
+/** Returns the URL a Worker behind the Gateway clones and fetches `repository` from. */
+export declare const gatewayRepositoryUrl: (domain: GatewayDomain, repository: RepositoryName) => string;
+/**
+ * Returns gh's configuration files for the Gateway at `domain`. Neither file contains a token;
+ * gh reads the caller token from `GH_ENTERPRISE_TOKEN` and `GH_TOKEN`.
+ */
+export declare const ghGatewayConfig: (domain: GatewayDomain) => {
+    readonly "config.yml": "version: \"1\"\nhttp_unix_socket: /run/usine-gateway/http.sock\n";
+    readonly "hosts.yml": `git.${string & import("effect/Brand").Brand<"GatewayDomain">}:
+    git_protocol: https
+`;
+};
+export interface GatewayEnvironmentOptions {
+    readonly domain: GatewayDomain;
+    readonly llmProviders: ReadonlyArray<GatewayLlmProvider>;
+    /** The machine directory that contains the `ghGatewayConfig` files. */
+    readonly ghConfigDirectory: string;
+    readonly callerToken: CallerToken;
+}
+/**
+ * An Attempt's environment behind a Gateway. `exported` has no secrets and goes in each command
+ * line; `sent` contains the caller token and goes only through the SSH connection.
+ */
+export interface GatewayEnvironment {
+    readonly exported: Readonly<Record<string, string>>;
+    readonly sent: Readonly<Record<string, Redacted.Redacted<string>>>;
+}
+/**
+ * Returns the environment that points git, gh, package managers, and Claude Code at the
+ * Gateway at `domain`.
+ *
+ * - git sends the caller token in `x-usine-gateway-token` to `git.<domain>` only, and rewrites
+ *   `https://github.com/` and `https://git.<domain>/` to the Gateway. The header value is
+ *   config entry 0 (`GIT_CONFIG_VALUE_0`).
+ * - gh uses `git.<domain>` through the Gateway socket, with the caller token as both its
+ *   enterprise and GitHub token, so absolute pagination links also authenticate.
+ * - Package managers use the forward proxy at `<domain>:3128`; local addresses and the
+ *   Gateway's own names bypass it.
+ * - Claude Code calls `llm.<domain>/anthropic` with the caller token if the Gateway has the
+ *   Anthropic credential. Otherwise, and for Codex, the harness uses its own login through the
+ *   forward proxy, whose allowlist must include the login's hosts.
+ */
+export declare const gatewayEnvironment: (options: GatewayEnvironmentOptions) => GatewayEnvironment;
+//# sourceMappingURL=environment.d.ts.map

package/dist/ssh/gateway/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,KAAK,WAAW,EAAwB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAWlC,8IAA8I;AAC9I,eAAO,MAAM,sBAAsB,YACjC,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,sBAAsB,CACd,CAAC;AAEX,mGAAmG;AACnG,eAAO,MAAM,eAAe,WAAY,aAAa,KAAG,MACd,CAAC;AAE3C,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,WAAY,aAAa,cAAc,cAAc,KAAG,MAC/C,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAY,aAAa;aAEjD,YAAY;aACZ,WAAW;;;CACF,CAAC;AAEd,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,uEAAuE;IACvE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACpE;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB,YAAa,yBAAyB,KAAG,kBAgCvE,CAAC"}

package/dist/ssh/gateway/environment.js

@@ -0,0 +1,78 @@
+import { GATEWAY_TOKEN_HEADER } from "@usine/gateway/admin";
+import { Redacted } from "effect";
+/**
+ * The Unix socket that systemd forwards to the Gateway's port 80
+ * (`infra/hetzner/gateway/worker-cloud-init.yaml`). gh sends plain HTTP over it, and only HTTPS
+ * to `GH_HOST` directly.
+ */
+const GH_GATEWAY_SOCKET = "/run/usine-gateway/http.sock";
+const FORWARD_PROXY_PORT = 3128;
+/** The variables sent through the SSH connection because they contain the caller token. The Worker's sshd must accept each in `AcceptEnv`. */
+export const GATEWAY_SENT_VARIABLES = [
+    "GIT_CONFIG_VALUE_0",
+    "GH_ENTERPRISE_TOKEN",
+    "GH_TOKEN",
+    "ANTHROPIC_AUTH_TOKEN",
+];
+/** Returns the Gateway's forward proxy URL from a Worker; children receive it as `HTTPS_PROXY`. */
+export const forwardProxyUrl = (domain) => `http://${domain}:${FORWARD_PROXY_PORT}`;
+/** Returns the URL a Worker behind the Gateway clones and fetches `repository` from. */
+export const gatewayRepositoryUrl = (domain, repository) => `http://git.${domain}/${repository}.git`;
+/**
+ * Returns gh's configuration files for the Gateway at `domain`. Neither file contains a token;
+ * gh reads the caller token from `GH_ENTERPRISE_TOKEN` and `GH_TOKEN`.
+ */
+export const ghGatewayConfig = (domain) => ({
+    "config.yml": `version: "1"\nhttp_unix_socket: ${GH_GATEWAY_SOCKET}\n`,
+    "hosts.yml": `git.${domain}:\n    git_protocol: https\n`,
+});
+/**
+ * Returns the environment that points git, gh, package managers, and Claude Code at the
+ * Gateway at `domain`.
+ *
+ * - git sends the caller token in `x-usine-gateway-token` to `git.<domain>` only, and rewrites
+ *   `https://github.com/` and `https://git.<domain>/` to the Gateway. The header value is
+ *   config entry 0 (`GIT_CONFIG_VALUE_0`).
+ * - gh uses `git.<domain>` through the Gateway socket, with the caller token as both its
+ *   enterprise and GitHub token, so absolute pagination links also authenticate.
+ * - Package managers use the forward proxy at `<domain>:3128`; local addresses and the
+ *   Gateway's own names bypass it.
+ * - Claude Code calls `llm.<domain>/anthropic` with the caller token if the Gateway has the
+ *   Anthropic credential. Otherwise, and for Codex, the harness uses its own login through the
+ *   forward proxy, whose allowlist must include the login's hosts.
+ */
+export const gatewayEnvironment = (options) => {
+    const { domain, callerToken } = options;
+    const gitBase = `http://git.${domain}/`;
+    const proxy = forwardProxyUrl(domain);
+    const direct = `localhost,127.0.0.1,::1,${domain}`;
+    const exported = {
+        GIT_CONFIG_COUNT: "3",
+        GIT_CONFIG_KEY_0: `http.${gitBase}.extraHeader`,
+        GIT_CONFIG_KEY_1: `url.${gitBase}.insteadOf`,
+        GIT_CONFIG_VALUE_1: "https://github.com/",
+        GIT_CONFIG_KEY_2: `url.${gitBase}.insteadOf`,
+        GIT_CONFIG_VALUE_2: `https://git.${domain}/`,
+        GH_HOST: `git.${domain}`,
+        GH_CONFIG_DIR: options.ghConfigDirectory,
+        GH_PROMPT_DISABLED: "1",
+        HTTPS_PROXY: proxy,
+        HTTP_PROXY: proxy,
+        https_proxy: proxy,
+        http_proxy: proxy,
+        NO_PROXY: direct,
+        no_proxy: direct,
+    };
+    const sent = {
+        GIT_CONFIG_VALUE_0: Redacted.make(`${GATEWAY_TOKEN_HEADER}: ${Redacted.value(callerToken)}`),
+        GH_ENTERPRISE_TOKEN: callerToken,
+        GH_TOKEN: callerToken,
+    };
+    if (!options.llmProviders.includes("anthropic"))
+        return { exported, sent };
+    return {
+        exported: { ...exported, ANTHROPIC_BASE_URL: `http://llm.${domain}/anthropic` },
+        sent: { ...sent, ANTHROPIC_AUTH_TOKEN: callerToken },
+    };
+};
+//# sourceMappingURL=environment.js.map

package/dist/ssh/gateway/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/ssh/gateway/environment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAEzD,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,8IAA8I;AAC9I,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,oBAAoB;IACpB,qBAAqB;IACrB,UAAU;IACV,sBAAsB;CACd,CAAC;AAEX,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAqB,EAAU,EAAE,CAC/D,UAAU,MAAM,IAAI,kBAAkB,EAAE,CAAC;AAE3C,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAqB,EAAE,UAA0B,EAAU,EAAE,CAChG,cAAc,MAAM,IAAI,UAAU,MAAM,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAqB,EAAE,EAAE,CACvD,CAAC;IACC,YAAY,EAAE,mCAAmC,iBAAiB,IAAI;IACtE,WAAW,EAAE,OAAO,MAAM,8BAA8B;CACzD,CAAU,CAAC;AAmBd;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAsB,EAAE;IAC3F,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,MAAM,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,2BAA2B,MAAM,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG;QACf,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,QAAQ,OAAO,cAAc;QAC/C,gBAAgB,EAAE,OAAO,OAAO,YAAY;QAC5C,kBAAkB,EAAE,qBAAqB;QACzC,gBAAgB,EAAE,OAAO,OAAO,YAAY;QAC5C,kBAAkB,EAAE,eAAe,MAAM,GAAG;QAC5C,OAAO,EAAE,OAAO,MAAM,EAAE;QACxB,aAAa,EAAE,OAAO,CAAC,iBAAiB;QACxC,kBAAkB,EAAE,GAAG;QACvB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,MAAM;KACjB,CAAC;IACF,MAAM,IAAI,GAAG;QACX,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,KAAK,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5F,mBAAmB,EAAE,WAAW;QAChC,QAAQ,EAAE,WAAW;KACtB,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3E,OAAO;QACL,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,cAAc,MAAM,YAAY,EAAE;QAC/E,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC,CAAC"}

package/dist/ssh/gateway/forward.d.ts

@@ -0,0 +1,74 @@
+import type { RemoteShell } from "@usine/agents/child-host";
+import { SshDestination } from "@usine/core/worker";
+import { DateTime, Effect, Schema, Stream } from "effect";
+import { ChildProcess, type ChildProcessSpawner } from "effect/unstable/process";
+export interface OpenForward {
+    /** The SSH client number, starting at 1. `reopen` replaces only this generation. */
+    readonly generation: number;
+    readonly url: URL;
+}
+declare const GatewayForwardClosed_base: Schema.Class<GatewayForwardClosed, Schema.TaggedStruct<"GatewayForwardClosed", {
+    readonly gateway: Schema.brand<Schema.String, "SshDestination">;
+    readonly generation: Schema.Int;
+    readonly since: Schema.DateTimeUtc;
+    readonly reason: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error for a closed admin API forward, whose SSH client didn't open or exited. `since` is
+ * when the Gateway became unreachable, and `reason` is the SSH client's error.
+ */
+export declare class GatewayForwardClosed extends GatewayForwardClosed_base {
+}
+/**
+ * An SSH forward from a local port to a Gateway's admin API (ADR 0027, amendment of
+ * 2026-10-19). It opens with the first Worker behind the Gateway, reopens after a pause when
+ * its client exits, and closes with the last Worker or the executor.
+ */
+export interface GatewayForward {
+    /** The Gateway's SSH destination, used to identify it in logs and messages. */
+    readonly gateway: SshDestination;
+    /** The SSH command an operator can run to open the same forward manually. */
+    readonly command: string;
+    /** Returns the open forward, waiting while a client is opening. Fails immediately while the forward is closed. */
+    readonly current: Effect.Effect<OpenForward, GatewayForwardClosed>;
+    /**
+     * Replaces SSH client `generation`, or ends the pause after it closed, and waits for the next
+     * client. If another request already replaced it, waits for the current forward.
+     */
+    readonly reopen: (generation: number) => Effect.Effect<OpenForward, GatewayForwardClosed>;
+    /** Records an unanswered request sent at `sentAt`, and returns when the first unanswered request since the last response was sent. */
+    readonly unanswered: (sentAt: DateTime.Utc) => Effect.Effect<DateTime.Utc>;
+    /** Records a response from the admin API, so the next unanswered request starts a new outage. */
+    readonly answered: Effect.Effect<void>;
+}
+/**
+ * Opens a forward to the admin API at `adminPort` on `gateway`, using the SSH client and
+ * environment of `shell`, and keeps it open until the caller's scope closes. Each client
+ * listens on a kernel-picked port of 127.0.0.1, so it never conflicts with an operator's
+ * forward.
+ */
+export declare const gatewayForwardFor: (spawner: {
+    spawn(command: ChildProcess.Command): Effect.Effect<ChildProcessSpawner.ChildProcessHandle, import("effect/PlatformError").PlatformError, import("effect/Scope").Scope>;
+    exitCode(command: ChildProcess.Command): Effect.Effect<ChildProcessSpawner.ExitCode, import("effect/PlatformError").PlatformError>;
+    streamString(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
+    streamLines(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
+    lines(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Effect.Effect<Array<string>, import("effect/PlatformError").PlatformError>;
+    string(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Effect.Effect<string, import("effect/PlatformError").PlatformError>;
+}, shell: Pick<RemoteShell, "ssh" | "sshEnvironment">, gateway: string & import("effect/Brand").Brand<"SshDestination">, adminPort: number & import("effect/Brand").Brand<"GatewayAdminPort">) => Effect.Effect<{
+    gateway: string & import("effect/Brand").Brand<"SshDestination">;
+    command: string;
+    current: Effect.Effect<OpenForward, GatewayForwardClosed, never>;
+    reopen: (generation: number) => Effect.Effect<OpenForward, GatewayForwardClosed, never>;
+    unanswered: (sentAt: DateTime.Utc) => Effect.Effect<DateTime.Utc, never, never>;
+    answered: Effect.Effect<void, never, never>;
+}, never, import("effect/Scope").Scope>;
+export {};
+//# sourceMappingURL=forward.d.ts.map

package/dist/ssh/gateway/forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/forward.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAyB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAY,MAAM,EAA8B,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAcjF,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CACnB;;;;;;;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,yBAOxC;CAAG;AAEL;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kHAAkH;IAClH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACnE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC1F,sIAAsI;IACtI,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3E,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACxC;AA6DD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;yBAyQA,QAAQ,CAAC,GAAG;;uCAWxC,CAAC"}

package/dist/ssh/gateway/forward.js

@@ -0,0 +1,247 @@
+import { createServer } from "node:net";
+import { SshDestination } from "@usine/core/worker";
+import { DateTime, Deferred, Effect, Fiber, Option, Ref, Result, Schema, Stream } from "effect";
+import { ChildProcess } from "effect/unstable/process";
+/** The line the SSH client prints through `LocalCommand` when its local port is listening. */
+const OPEN_LINE = "usine-gateway-forward-open";
+/** The time an SSH client has to connect and listen before it's replaced. */
+const OPEN_TIMEOUT = "30 seconds";
+/** The time a request waits for the forward to open. */
+const OPEN_WAIT = "1 minute";
+/** The maximum pause between SSH clients, in milliseconds. The pause doubles from one second after each failure. */
+const MAX_PAUSE_MILLIS = 60_000;
+/**
+ * The error for a closed admin API forward, whose SSH client didn't open or exited. `since` is
+ * when the Gateway became unreachable, and `reason` is the SSH client's error.
+ */
+export class GatewayForwardClosed extends Schema.TaggedError("@usine/executor/GatewayForwardClosed")("GatewayForwardClosed", {
+    gateway: SshDestination,
+    generation: Schema.Int,
+    since: Schema.DateTimeUtc,
+    reason: Schema.NonEmptyString,
+}) {
+}
+const notOpened = (reason) => ({ _tag: "NotOpened", reason });
+const exited = (reason) => ({ _tag: "Exited", reason });
+const REPLACED = { _tag: "Replaced" };
+const ListenerAddress = Schema.Struct({ port: Schema.Int });
+/** Returns a free port on 127.0.0.1 picked by the kernel, released for the SSH client to listen on. */
+const freeLocalPort = Effect.callback((resume) => {
+    const server = createServer();
+    server.once("error", (cause) => resume(Effect.fail(cause)));
+    server.listen(0, "127.0.0.1", () => {
+        const address = Schema.decodeUnknownOption(ListenerAddress)(server.address());
+        server.close(() => resume(Option.match(address, {
+            onNone: () => Effect.fail(new Error("the listener reported no port")),
+            onSome: ({ port }) => Effect.succeed(port),
+        })));
+    });
+});
+/** Returns the SSH client's stderr on one line, or its exit code if stderr is empty. */
+const complaint = (stderr, exitCode) => {
+    const lines = stderr
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line !== "");
+    return lines.length > 0 ? lines.join("; ") : `ssh exited with code ${String(exitCode)}`;
+};
+const pauseAfter = (failures) => Math.min(1000 * 2 ** Math.max(failures - 1, 0), MAX_PAUSE_MILLIS);
+/**
+ * Opens a forward to the admin API at `adminPort` on `gateway`, using the SSH client and
+ * environment of `shell`, and keeps it open until the caller's scope closes. Each client
+ * listens on a kernel-picked port of 127.0.0.1, so it never conflicts with an operator's
+ * forward.
+ */
+export const gatewayForwardFor = Effect.fn("SshExecutor.gatewayForwardFor")(function* (spawner, shell, gateway, adminPort) {
+    const fields = { gateway, adminPort };
+    yield* Effect.annotateCurrentSpan(fields);
+    const forwardSpec = (port) => `127.0.0.1:${String(port)}:127.0.0.1:${String(adminPort)}`;
+    const command = [
+        shell.ssh.command,
+        ...shell.ssh.args,
+        "-N",
+        "-o",
+        "ExitOnForwardFailure=yes",
+        "-L",
+        forwardSpec(adminPort),
+        gateway,
+    ].join(" ");
+    const argumentsFor = (port) => [
+        ...shell.ssh.args,
+        "-N",
+        // LocalCommand runs when all listeners are up, ExitOnForwardFailure exits if a listener fails, and ControlPath=none avoids the operator's shared connections.
+        "-o",
+        "ExitOnForwardFailure=yes",
+        "-o",
+        "ControlPath=none",
+        "-o",
+        "PermitLocalCommand=yes",
+        "-o",
+        `LocalCommand=echo ${OPEN_LINE}`,
+        "-L",
+        forwardSpec(port),
+        gateway,
+    ];
+    const generationNumbered = (number) => Effect.all({
+        opened: Deferred.make(),
+        replace: Deferred.make(),
+        next: Deferred.make(),
+    }).pipe(Effect.map((signals) => ({ number, ...signals })));
+    const first = yield* generationNumbered(1);
+    const state = yield* Ref.make({ _tag: "Opening", generation: first });
+    const runClient = Effect.fn("SshExecutor.runGatewayForward")(function* (generation, closedSince) {
+        yield* Effect.annotateCurrentSpan({ ...fields, generation: generation.number });
+        const picked = yield* Effect.result(freeLocalPort);
+        if (Result.isFailure(picked))
+            return notOpened(`no free port on 127.0.0.1: ${picked.failure.message}`);
+        const port = picked.success;
+        yield* Effect.annotateCurrentSpan({ port });
+        yield* Effect.logDebug("Starting an SSH client for the forward to the Gateway's admin API", {
+            ...fields,
+            generation: generation.number,
+            port,
+        });
+        return yield* Effect.scoped(Effect.gen(function* () {
+            const handle = yield* spawner.spawn(ChildProcess.make(shell.ssh.command, argumentsFor(port), {
+                env: { ...shell.sshEnvironment },
+                extendEnv: false,
+                detached: false,
+                forceKillAfter: "5 seconds",
+                stdin: "ignore",
+            }));
+            const stderr = yield* handle.stderr.pipe(Stream.decodeText(), Stream.mkString, Effect.forkScoped);
+            const reported = (exitCode) => Fiber.join(stderr).pipe(Effect.map((text) => complaint(text, exitCode)));
+            const listening = yield* handle.stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.filter((line) => line.trim() === OPEN_LINE), Stream.runHead, Effect.timeoutOption(OPEN_TIMEOUT));
+            if (Option.isNone(listening))
+                return notOpened(`ssh didn't open the forward within ${OPEN_TIMEOUT}`);
+            if (Option.isNone(listening.value))
+                return notOpened(yield* reported(Number(yield* handle.exitCode)));
+            const open = {
+                generation: generation.number,
+                url: new URL(`http://127.0.0.1:${String(port)}`),
+            };
+            yield* Ref.set(state, { _tag: "Open", generation, open });
+            yield* Deferred.succeed(generation.opened, open);
+            yield* Option.match(closedSince, {
+                onNone: () => Effect.logInfo("Opened the forward to the Gateway's admin API", {
+                    ...fields,
+                    generation: generation.number,
+                    port,
+                }),
+                onSome: (since) => Effect.logInfo("Reopened the forward to the Gateway's admin API", {
+                    ...fields,
+                    generation: generation.number,
+                    port,
+                    closedSince: DateTime.formatIso(since),
+                }),
+            });
+            // Sets the state to closed first, so no request uses a port the client no longer listens on.
+            const closedNow = (reason) => DateTime.now.pipe(Effect.flatMap((since) => Ref.set(state, {
+                _tag: "Closed",
+                generation,
+                closed: new GatewayForwardClosed({
+                    gateway,
+                    generation: generation.number,
+                    since,
+                    reason,
+                }),
+            })));
+            return yield* Effect.raceFirst(handle.exitCode.pipe(Effect.flatMap((code) => reported(Number(code))), Effect.catch((error) => Effect.succeed(`can't read the SSH client's exit code: ${error.message}`)), Effect.tap(closedNow), Effect.map(exited)), Deferred.await(generation.replace).pipe(Effect.andThen(closedNow("replaced after a request got no response")), Effect.as(REPLACED)));
+        })).pipe(Effect.catch((error) => Effect.succeed(notOpened(`can't run ${shell.ssh.command}: ${error.message}`))));
+    });
+    // Runs until the caller's scope closes, with one span per SSH client.
+    const supervise = Effect.gen(function* () {
+        let generation = first;
+        let failures = 0;
+        let closedSince = Option.none();
+        while (true) {
+            const end = yield* runClient(generation, closedSince);
+            const now = yield* DateTime.now;
+            if (end._tag === "Replaced") {
+                failures = 0;
+                closedSince = Option.some(now);
+                yield* Effect.logInfo("Replacing the forward to the Gateway's admin API, which a request found unanswered", { ...fields, generation: generation.number });
+            }
+            else {
+                failures = end._tag === "Exited" ? 1 : failures + 1;
+                const since = end._tag === "Exited" ? now : Option.getOrElse(closedSince, () => now);
+                closedSince = Option.some(since);
+                const pause = pauseAfter(failures);
+                const closed = new GatewayForwardClosed({
+                    gateway,
+                    generation: generation.number,
+                    since,
+                    reason: end.reason,
+                });
+                yield* Ref.set(state, { _tag: "Closed", generation, closed });
+                yield* Deferred.fail(generation.opened, closed);
+                yield* Effect.logWarning(end._tag === "Exited"
+                    ? "The forward to the Gateway's admin API exited; reopening it after a pause"
+                    : "Could not open the forward to the Gateway's admin API; trying again after a pause", {
+                    ...fields,
+                    generation: generation.number,
+                    closedSince: DateTime.formatIso(since),
+                    failures,
+                    pauseSeconds: pause / 1000,
+                    reason: end.reason,
+                });
+                const trigger = yield* Effect.raceFirst(Effect.sleep(pause).pipe(Effect.as("pause elapsed")), Deferred.await(generation.replace).pipe(Effect.as("request")));
+                yield* Effect.logInfo("Reopening the forward to the Gateway's admin API", {
+                    ...fields,
+                    generation: generation.number + 1,
+                    closedSince: DateTime.formatIso(since),
+                    trigger,
+                });
+            }
+            const next = yield* generationNumbered(generation.number + 1);
+            yield* Ref.set(state, { _tag: "Opening", generation: next });
+            yield* Deferred.succeed(generation.next, next);
+            generation = next;
+        }
+    });
+    yield* supervise.pipe(Effect.onInterrupt(() => Effect.logInfo("Closed the forward to the Gateway's admin API", fields)), Effect.forkScoped);
+    const notOpenedWithin = (generation) => DateTime.now.pipe(Effect.flatMap((since) => new GatewayForwardClosed({
+        gateway,
+        generation,
+        since,
+        reason: `the forward didn't open within ${OPEN_WAIT}`,
+    })));
+    const current = Effect.gen(function* () {
+        const now = yield* Ref.get(state);
+        switch (now._tag) {
+            case "Open":
+                return now.open;
+            case "Closed":
+                return yield* now.closed;
+            case "Opening":
+                return yield* Deferred.await(now.generation.opened).pipe(Effect.timeoutOrElse({
+                    duration: OPEN_WAIT,
+                    orElse: () => notOpenedWithin(now.generation.number),
+                }));
+        }
+    });
+    const reopen = Effect.fn("SshExecutor.reopenGatewayForward")(function* (generation) {
+        yield* Effect.annotateCurrentSpan({ ...fields, generation });
+        const now = yield* Ref.get(state);
+        if (now.generation.number !== generation) {
+            yield* Effect.logDebug("Another request replaced the forward to the Gateway's admin API already", { ...fields, generation, current: now.generation.number });
+            return yield* current;
+        }
+        yield* Deferred.succeed(now.generation.replace, undefined);
+        return yield* Deferred.await(now.generation.next).pipe(Effect.flatMap((next) => Deferred.await(next.opened)), Effect.timeoutOrElse({
+            duration: OPEN_WAIT,
+            orElse: () => notOpenedWithin(generation + 1),
+        }));
+    });
+    const silentSince = yield* Ref.make(Option.none());
+    const unanswered = (sentAt) => Ref.modify(silentSince, (since) => {
+        const first = Option.match(since, {
+            onNone: () => sentAt,
+            onSome: (earlier) => DateTime.min(earlier, sentAt),
+        });
+        return [first, Option.some(first)];
+    });
+    const answered = Ref.set(silentSince, Option.none());
+    return { gateway, command, current, reopen, unanswered, answered };
+});
+//# sourceMappingURL=forward.js.map

package/dist/ssh/gateway/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../../src/ssh/gateway/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,EAAyB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EAAE,YAAY,EAA4B,MAAM,yBAAyB,CAAC;AAEjF,8FAA8F;AAC9F,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,wDAAwD;AACxD,MAAM,SAAS,GAAG,UAAU,CAAC;AAE7B,oHAAoH;AACpH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAQhC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,CAC1D,sCAAsC,CACvC,CAAC,sBAAsB,EAAE;IACxB,OAAO,EAAE,cAAc;IACvB,UAAU,EAAE,MAAM,CAAC,GAAG;IACtB,KAAK,EAAE,MAAM,CAAC,WAAW;IACzB,MAAM,EAAE,MAAM,CAAC,cAAc;CAC9B,CAAC;CAAG;AAiDL,MAAM,SAAS,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AACjF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3E,MAAM,QAAQ,GAAc,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAEjD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAE5D,uGAAuG;AACvG,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAgB,CAAC,MAAM,EAAE,EAAE;IAC9D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CACJ,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;YACpB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACrE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3C,CAAC,CACH,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAU,EAAE;IAC7D,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EACnF,OAA2D,EAC3D,KAAkD,EAClD,OAAuB,EACvB,SAA2B;IAE3B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACtC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,GAAG,CAAC,OAAO;QACjB,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI;QACjB,IAAI;QACJ,IAAI;QACJ,0BAA0B;QAC1B,IAAI;QACJ,WAAW,CAAC,SAAS,CAAC;QACtB,OAAO;KACR,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC;QACrC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI;QACjB,IAAI;QACJ,8JAA8J;QAC9J,IAAI;QACJ,0BAA0B;QAC1B,IAAI;QACJ,kBAAkB;QAClB,IAAI;QACJ,wBAAwB;QACxB,IAAI;QACJ,qBAAqB,SAAS,EAAE;QAChC,IAAI;QACJ,WAAW,CAAC,IAAI,CAAC;QACjB,OAAO;KACR,CAAC;IAEF,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC;QACT,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAqC;QAC1D,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAQ;QAC9B,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAc;KAClC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAe,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EACpE,UAAsB,EACtB,WAAwC;QAExC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAC1B,OAAO,SAAS,CAAC,8BAA8B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mEAAmE,EAAE;YAC1F,GAAG,MAAM;YACT,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,IAAI;SACL,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CACjC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;gBACvD,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE;gBAChC,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,WAAW;gBAC3B,KAAK,EAAE,QAAQ;aAChB,CAAC,CACH,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACtC,MAAM,CAAC,UAAU,EAAE,EACnB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,UAAU,CAClB,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CACpC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACzC,MAAM,CAAC,UAAU,EAAE,EACnB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,EAClD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CACnC,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1B,OAAO,SAAS,CAAC,sCAAsC,YAAY,EAAE,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAChC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAEpE,MAAM,IAAI,GAAgB;gBACxB,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,GAAG,EAAE,IAAI,GAAG,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;aACjD,CAAC;YACF,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC/B,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,OAAO,CAAC,+CAA+C,EAAE;oBAC9D,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,IAAI;iBACL,CAAC;gBACJ,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,OAAO,CAAC,iDAAiD,EAAE;oBAChE,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,IAAI;oBACJ,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;iBACvC,CAAC;aACL,CAAC,CAAC;YACH,6FAA6F;YAC7F,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CACnC,QAAQ,CAAC,GAAG,CAAC,IAAI,CACf,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,UAAU;gBACV,MAAM,EAAE,IAAI,oBAAoB,CAAC;oBAC/B,OAAO;oBACP,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,KAAK;oBACL,MAAM;iBACP,CAAC;aACH,CAAC,CACH,CACF,CAAC;YACJ,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAChD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,0CAA0C,KAAK,CAAC,OAAO,EAAE,CAAC,CAC1E,EACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,EACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC,EACrE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CACpB,CACF,CAAC;QACJ,CAAC,CAAC,CACH,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAC9E,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,WAAW,GAAG,MAAM,CAAC,IAAI,EAAgB,CAAC;QAC9C,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC5B,QAAQ,GAAG,CAAC,CAAC;gBACb,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,oFAAoF,EACpF,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAC7C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;gBACrF,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC;oBACtC,OAAO;oBACP,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,KAAK;oBACL,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;gBACH,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9D,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAChD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,GAAG,CAAC,IAAI,KAAK,QAAQ;oBACnB,CAAC,CAAC,2EAA2E;oBAC7E,CAAC,CAAC,mFAAmF,EACvF;oBACE,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;oBACtC,QAAQ;oBACR,YAAY,EAAE,KAAK,GAAG,IAAI;oBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CACF,CAAC;gBACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CACrC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,EACpD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAC9D,CAAC;gBACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kDAAkD,EAAE;oBACxE,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;oBACjC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC9D,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/C,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CACnB,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,OAAO,CAAC,+CAA+C,EAAE,MAAM,CAAC,CACxE,EACD,MAAM,CAAC,UAAU,CAClB,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAE,EAAE,CAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,CACf,MAAM,CAAC,OAAO,CACZ,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;QACvB,OAAO;QACP,UAAU;QACV,KAAK;QACL,MAAM,EAAE,kCAAkC,SAAS,EAAE;KACtD,CAAC,CACL,CACF,CAAC;IAEJ,MAAM,OAAO,GAA8B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,MAAM;gBACT,OAAO,GAAG,CAAC,IAAI,CAAC;YAClB,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3B,KAAK,SAAS;gBACZ,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,aAAa,CAAC;oBACnB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;iBACrD,CAAC,CACH,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAkB;QACxF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpB,yEAAyE,EACzE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAC1D,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EACrD,MAAM,CAAC,aAAa,CAAC;YACnB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,GAAG,CAAC,CAAC;SAC9C,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAgB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAE,EAAE,CAC1C,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;YAChC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;YACpB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAU,CAAC;IAC9C,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAErD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAA2B,CAAC;AAC9F,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/preflight.d.ts

@@ -0,0 +1,28 @@
+import type { Harness } from "@usine/core/agent/brain";
+import type { GatewayCredentialKind } from "@usine/core/worker";
+import { Effect, Option } from "effect";
+import { ExecutorOperationError, WorkerCapabilityError } from "../../executor.ts";
+import type { HarnessProbe } from "../../harness-preflight.ts";
+import { type RemoteCommands } from "../../remote/commands.ts";
+import type { MachineGateway, SshMachine } from "../model.ts";
+/**
+ * Returns the credential kind the Gateway injects for `harness`, as recorded by the last
+ * preflight. Only Claude Code uses a Gateway credential; Codex and Pi use their own logins.
+ */
+export declare const gatewayCredentialFor: (gateway: MachineGateway, harness: Harness) => Effect.Effect<Option.Option<GatewayCredentialKind>>;
+/**
+ * Verifies the Gateway in front of an SSH Worker without attaching anything: the admin API
+ * forward opens and accepts the admin token, the machine's sshd accepts the caller-token
+ * variables, and the machine can connect to `git.<domain>`, which rejects a request without a caller
+ * token. If the Gateway has the Anthropic credential, records its kind for the Worker.
+ */
+export declare const verifyGateway: (commands: RemoteCommands, worker: string & import("effect/Brand").Brand<"WorkerName">, machine: SshMachine, gateway: MachineGateway) => Effect.Effect<undefined, ExecutorOperationError | WorkerCapabilityError, never>;
+/**
+ * Probes a brain on a Worker behind a Gateway (ADR 0027). If the Gateway has the Anthropic
+ * credential, checks only the Claude Code binary. Otherwise, Claude Code and Codex use the
+ * operator's login (ADR 0026): `probe` checks the login, then the machine must connect to the
+ * login's hosts through the forward proxy. Pi goes to `probe`, which rejects it on any remote
+ * machine.
+ */
+export declare const gatewayHarnessProbe: (commands: RemoteCommands, machine: SshMachine, gateway: MachineGateway, probe: HarnessProbe) => HarnessProbe;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/ssh/gateway/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAa,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,KAAK,EAAE,qBAAqB,EAAc,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAwF9D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,YACtB,cAAc,WACd,OAAO,KACf,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAQpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,0NAgFxB,CAAC;AAmCH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aACpB,cAAc,WACf,UAAU,WACV,cAAc,SAChB,YAAY,KAClB,YA2FF,CAAC"}