@usine/executor 0.2.0 → 0.3.0

package/dist/ssh/gateway/preflight.js

@@ -0,0 +1,234 @@
+import { HarnessReady, HarnessUnavailableError } from "@usine/core/agent/capability";
+import { Effect, Option, Redacted, Ref } from "effect";
+import { ExecutorOperationError, WorkerCapabilityError } from "../../executor.js";
+import { sendingShell } from "../../remote/commands.js";
+import { forwardProxyUrl, GATEWAY_SENT_VARIABLES, gatewayEnvironment } from "./environment.js";
+/** A placeholder caller token that lets preflight check the sent variables without attaching anything. */
+const PROBE_TOKEN = Redacted.make("usine-preflight");
+/** A script that takes name and value pairs and prints each name whose variable doesn't have that value on the machine. */
+const SENT_VARIABLES_SCRIPT = `
+while [ "$#" -gt 1 ]; do
+  test "$(printenv "$1")" = "$2" || echo "$1"
+  shift 2
+done
+`.trim();
+/** Matches the Gateway's refusal header for a request without a caller token. */
+const REFUSED_WITHOUT_TOKEN = /^x-usine-gateway-refusal:\s*missing-caller-token\s*$/imu;
+/** The exit code OpenSSH uses when it can't connect to the machine or run the command. */
+const SSH_FAILURE = 255;
+const gatewayGap = (worker, message, cause) => new WorkerCapabilityError({ worker, capability: "gateway", message, cause });
+/** Returns the error for an SSH transport failure, which isn't a capability gap. */
+const unreachable = (host, command, result) => new ExecutorOperationError({
+    operation: "preflight",
+    message: `Can't reach ${host} to run ${command}`,
+    cause: new Error(result.stderr.trim() || `ssh exited with code ${SSH_FAILURE}`),
+});
+/**
+ * Logs a warning, once per Worker, that the Gateway is too old to report its Anthropic
+ * credential kind (#248). Later preflights log at debug level.
+ */
+const warnOfUnreportedCredential = (worker, gateway) => Ref.getAndSet(gateway.warnedOfUnreportedCredential, true).pipe(Effect.flatMap((warned) => warned
+    ? Effect.logDebug("SSH Worker's Gateway still does not report the kind of its Anthropic credential; already warned for this Worker", { worker, gateway: gateway.forward.gateway })
+    : Effect.logWarning("SSH Worker's Gateway does not report the kind of its Anthropic credential; its Claude Code children count in the Claude plan pool until the Gateway is upgraded", { worker, gateway: gateway.forward.gateway })));
+/**
+ * Reads the Gateway's Anthropic credential kind and records it for the Worker (ADR 0013).
+ * Fails if the Worker's `llmProviders` includes Anthropic and the Gateway has no Anthropic
+ * credential. If the Gateway is too old to report credentials, keeps the Claude plan pool and
+ * logs a warning.
+ */
+const recordAnthropicCredential = Effect.fn("SshExecutor.recordAnthropicCredential")(function* (worker, gateway) {
+    yield* Effect.annotateCurrentSpan({ worker, gateway: gateway.forward.gateway });
+    const reported = yield* gateway.admin.providers.pipe(Effect.mapError((error) => gatewayGap(worker, error.message, error)));
+    const credential = yield* Option.match(reported, {
+        onNone: () => warnOfUnreportedCredential(worker, gateway).pipe(Effect.as(Option.none())),
+        onSome: ({ providers }) => {
+            const anthropic = providers.find(({ provider }) => provider === "anthropic");
+            return anthropic === undefined
+                ? Effect.fail(gatewayGap(worker, `The gateway of SSH worker "${worker}" has no Anthropic credential, but the worker's llm_providers includes anthropic. Set ANTHROPIC_API_KEY or USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN on the gateway, or remove anthropic from llm_providers.`, new Error(`the gateway reports ${providers.map(({ provider }) => provider).join(", ") || "no provider"}`)))
+                : Effect.succeed(Option.some(anthropic.credential));
+        },
+    });
+    yield* Ref.set(gateway.anthropicCredential, credential);
+    return credential;
+});
+/**
+ * Returns the credential kind the Gateway injects for `harness`, as recorded by the last
+ * preflight. Only Claude Code uses a Gateway credential; Codex and Pi use their own logins.
+ */
+export const gatewayCredentialFor = (gateway, harness) => {
+    switch (harness) {
+        case "claude":
+            return Ref.get(gateway.anthropicCredential);
+        case "codex":
+        case "pi":
+            return Effect.succeedNone;
+    }
+};
+/**
+ * Verifies the Gateway in front of an SSH Worker without attaching anything: the admin API
+ * forward opens and accepts the admin token, the machine's sshd accepts the caller-token
+ * variables, and the machine can connect to `git.<domain>`, which rejects a request without a caller
+ * token. If the Gateway has the Anthropic credential, records its kind for the Worker.
+ */
+export const verifyGateway = Effect.fn("SshExecutor.verifyGateway")(function* (commands, worker, machine, gateway) {
+    const { admin, forward, settings } = gateway;
+    const gitHost = `git.${settings.domain}`;
+    yield* Effect.annotateCurrentSpan({ worker, domain: settings.domain, gateway: forward.gateway });
+    const open = yield* forward.current.pipe(Effect.catchTag("GatewayForwardClosed", (closed) => forward.reopen(closed.generation)), Effect.mapError((closed) => gatewayGap(worker, `Can't open the forward to the gateway admin API of SSH worker "${worker}" through ${closed.gateway}: ${closed.reason}. Run ${forward.command} to see the SSH error.`, closed)));
+    const { attachments } = yield* admin.list.pipe(Effect.mapError((error) => gatewayGap(worker, error.message, error)));
+    const anthropicCredential = settings.llmProviders.includes("anthropic")
+        ? yield* recordAnthropicCredential(worker, gateway)
+        : Option.none();
+    const { sent } = gatewayEnvironment({
+        domain: settings.domain,
+        llmProviders: settings.llmProviders,
+        ghConfigDirectory: machine.workerDirectory,
+        callerToken: PROBE_TOKEN,
+    });
+    const received = yield* commands.run("preflight", sendingShell(machine.shell, sent), "sh", [
+        "-c",
+        SENT_VARIABLES_SCRIPT,
+        "sh",
+        ...Object.entries(sent).flatMap(([name, value]) => [name, Redacted.value(value)]),
+    ]);
+    const dropped = received.split("\n").filter((name) => name !== "");
+    if (dropped.length > 0)
+        return yield* gatewayGap(worker, `The sshd on SSH worker "${worker}" doesn't accept ${dropped.join(", ")}. Add AcceptEnv ${GATEWAY_SENT_VARIABLES.join(" ")} to its sshd configuration.`, new Error(`variables not received: ${dropped.join(" ")}`));
+    const probed = yield* commands.inspect("preflight", machine.shell, "curl", [
+        "-sS",
+        "--noproxy",
+        "*",
+        "--max-time",
+        "15",
+        "-o",
+        "/dev/null",
+        "-D",
+        "-",
+        `http://${gitHost}/`,
+    ]);
+    if (probed.exitCode === SSH_FAILURE)
+        return yield* unreachable(machine.shell.destination, "curl", probed);
+    if (probed.exitCode !== 0 || !REFUSED_WITHOUT_TOKEN.test(probed.stdout))
+        return yield* gatewayGap(worker, `SSH worker "${worker}" can't reach its gateway at ${gitHost}`, new Error(probed.stderr.trim() ||
+            probed.stdout.split("\n")[0]?.trim() ||
+            `curl exited with code ${String(probed.exitCode)}`));
+    yield* Effect.logInfo("SSH Worker Gateway verified", {
+        worker,
+        domain: settings.domain,
+        gateway: forward.gateway,
+        adminPort: settings.adminPort,
+        forwardPort: open.url.port,
+        llmProviders: settings.llmProviders.join(","),
+        anthropicCredential: Option.getOrElse(anthropicCredential, () => "none"),
+        attachments: attachments.filter((attachment) => attachment.worker === worker).length,
+    });
+});
+/**
+ * The harnesses that can use the operator's login on the machine, with the hosts each login
+ * calls through the forward proxy. `infra/hetzner/gateway/egress-allowlist` lists the same
+ * hosts.
+ */
+const LOGINS = {
+    claude: { label: "Claude Code", hosts: ["api.anthropic.com", "platform.claude.com"] },
+    codex: { label: "Codex", hosts: ["chatgpt.com", "auth.openai.com"] },
+};
+/**
+ * A script that takes the forward proxy URL and host names, and prints one line per host: the
+ * host, curl's exit code, the proxy's CONNECT status, and the host's HTTP status (`000` if the
+ * host didn't respond).
+ */
+const LOGIN_HOSTS_SCRIPT = `
+proxy=$1
+shift
+for host in "$@"; do
+  codes=$(curl -s -o /dev/null --max-time 10 --proxy "$proxy" -w '%{http_connect} %{http_code}' "https://$host/")
+  echo "$host $? $codes"
+done
+`.trim();
+const LOGIN_HOST_ANSWER = /^(\S+) (\d+) (\d{3}) (\d{3})$/u;
+/** The CONNECT status the forward proxy returns for a host that isn't in its allowlist. */
+const PROXY_REFUSED = "403";
+/**
+ * Probes a brain on a Worker behind a Gateway (ADR 0027). If the Gateway has the Anthropic
+ * credential, checks only the Claude Code binary. Otherwise, Claude Code and Codex use the
+ * operator's login (ADR 0026): `probe` checks the login, then the machine must connect to the
+ * login's hosts through the forward proxy. Pi goes to `probe`, which rejects it on any remote
+ * machine.
+ */
+export const gatewayHarnessProbe = (commands, machine, gateway, probe) => {
+    const worker = machine.address.name;
+    const host = machine.shell.destination;
+    const { domain } = gateway.settings;
+    const proxy = forwardProxyUrl(domain);
+    const claudeBinary = Effect.fn("SshExecutor.probeClaudeBehindGateway")(function* () {
+        yield* Effect.annotateCurrentSpan({ host, domain });
+        const result = yield* commands.inspect("preflight", machine.shell, "claude", ["--version"]);
+        if (result.exitCode === SSH_FAILURE)
+            return yield* unreachable(host, "claude", result);
+        if (result.exitCode !== 0)
+            return new HarnessUnavailableError({
+                harness: "claude",
+                capability: "binary",
+                message: "claude --version failed. Check the Claude Code installation on the worker.",
+            });
+        yield* Effect.logInfo("Claude Code uses the Gateway's Anthropic credential; checked its binary only", { host, version: result.stdout.trim() });
+        return new HarnessReady({ harness: "claude" });
+    });
+    const loginHostsReachable = Effect.fn("SshExecutor.probeLoginHostsBehindGateway")(function* (harness) {
+        const { label, hosts } = LOGINS[harness];
+        yield* Effect.annotateCurrentSpan({ worker, host, domain, harness });
+        const result = yield* commands.inspect("preflight", machine.shell, "sh", [
+            "-c",
+            LOGIN_HOSTS_SCRIPT,
+            "sh",
+            proxy,
+            ...hosts,
+        ]);
+        if (result.exitCode === SSH_FAILURE)
+            return yield* unreachable(host, "curl", result);
+        const answers = new Map(result.stdout.split("\n").flatMap((line) => {
+            const match = LOGIN_HOST_ANSWER.exec(line.trim());
+            return match === null
+                ? []
+                : [[match[1], { exitCode: match[2], connect: match[3], status: match[4] }]];
+        }));
+        for (const loginHost of hosts) {
+            const answer = answers.get(loginHost);
+            if (answer !== undefined && answer.status !== "000")
+                continue;
+            const cause = new Error(answer === undefined
+                ? `no response from ${loginHost}: ${result.stderr.trim() || `sh exited with code ${String(result.exitCode)}`}`
+                : `curl exited with code ${answer.exitCode}; the proxy returned ${answer.connect} for CONNECT`);
+            return yield* gatewayGap(worker, answer?.connect === PROXY_REFUSED
+                ? `${label} uses its login on SSH worker "${worker}", and the gateway's forward proxy blocks ${loginHost}. Add ${loginHost} to the gateway's egress allowlist.`
+                : `${label} uses its login on SSH worker "${worker}", which can't reach ${loginHost} through the gateway's forward proxy at ${proxy}`, cause);
+        }
+        yield* Effect.logInfo("SSH Worker reaches its harness login's hosts through the Gateway", {
+            worker,
+            harness,
+            domain,
+            hosts: hosts.join(","),
+        });
+    });
+    const loginOnMachine = Effect.fn("SshExecutor.probeLoginBehindGateway")(function* (brain, harness) {
+        yield* Effect.annotateCurrentSpan({ worker, host, domain, harness });
+        const readiness = yield* probe(brain);
+        if (readiness._tag === "HarnessUnavailableError")
+            return readiness;
+        yield* loginHostsReachable(harness);
+        return readiness;
+    });
+    return (brain) => {
+        switch (brain.harness) {
+            case "claude":
+                return gateway.settings.llmProviders.includes("anthropic")
+                    ? claudeBinary()
+                    : loginOnMachine(brain, "claude");
+            case "codex":
+                return loginOnMachine(brain, "codex");
+            case "pi":
+                return probe(brain);
+        }
+    };
+};
+//# sourceMappingURL=preflight.js.map

package/dist/ssh/gateway/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../src/ssh/gateway/preflight.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAErF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAElF,OAAO,EAAuB,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,0GAA0G;AAC1G,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAErD,2HAA2H;AAC3H,MAAM,qBAAqB,GAAG;;;;;CAK7B,CAAC,IAAI,EAAE,CAAC;AAET,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,yDAAyD,CAAC;AAExF,0FAA0F;AAC1F,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,UAAU,GAAG,CAAC,MAAkB,EAAE,OAAe,EAAE,KAAc,EAAE,EAAE,CACzE,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAE/E,oFAAoF;AACpF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,MAAqB,EAAE,EAAE,CAC3E,IAAI,sBAAsB,CAAC;IACzB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,eAAe,IAAI,WAAW,OAAO,EAAE;IAChD,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,wBAAwB,WAAW,EAAE,CAAC;CAChF,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAAC,MAAkB,EAAE,OAAuB,EAAE,EAAE,CACjF,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM;IACJ,CAAC,CAAC,MAAM,CAAC,QAAQ,CACb,iHAAiH,EACjH,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAC7C;IACH,CAAC,CAAC,MAAM,CAAC,UAAU,CACf,iKAAiK,EACjK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAC7C,CACN,CACF,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CAAC,QAAQ,CAAC,EAC5F,MAAkB,EAClB,OAAuB;IAEvB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAClD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CACrE,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC/C,MAAM,EAAE,GAAG,EAAE,CACX,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAyB,CAAC,CAChD;QACH,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;YACxB,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;YAC7E,OAAO,SAAS,KAAK,SAAS;gBAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,UAAU,CACR,MAAM,EACN,8BAA8B,MAAM,+MAA+M,EACnP,IAAI,KAAK,CACP,uBAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,EAAE,CAC/F,CACF,CACF;gBACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,CAAC;KACF,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAuB,EACvB,OAAgB,EACqC,EAAE;IACvD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC9C,KAAK,OAAO,CAAC;QACb,KAAK,IAAI;YACP,OAAO,MAAM,CAAC,WAAW,CAAC;IAC9B,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAC3E,QAAwB,EACxB,MAAkB,EAClB,OAAmB,EACnB,OAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EACtF,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,UAAU,CACR,MAAM,EACN,kEAAkE,MAAM,aAAa,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,CAAC,OAAO,wBAAwB,EACrK,MAAM,CACP,CACF,CACF,CAAC;IACF,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAC5C,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CACrE,CAAC;IACF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrE,CAAC,CAAC,KAAK,CAAC,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAyB,CAAC;IAEzC,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,iBAAiB,EAAE,OAAO,CAAC,eAAe;QAC1C,WAAW,EAAE,WAAW;KACzB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;QACzF,IAAI;QACJ,qBAAqB;QACrB,IAAI;QACJ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;KAClF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,OAAO,KAAK,CAAC,CAAC,UAAU,CACtB,MAAM,EACN,2BAA2B,MAAM,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,6BAA6B,EACvJ,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAC1D,CAAC;IAEJ,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE;QACzE,KAAK;QACL,WAAW;QACX,GAAG;QACH,YAAY;QACZ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,GAAG;QACH,UAAU,OAAO,GAAG;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;QACjC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACrE,OAAO,KAAK,CAAC,CAAC,UAAU,CACtB,MAAM,EACN,eAAe,MAAM,gCAAgC,OAAO,EAAE,EAC9D,IAAI,KAAK,CACP,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAClB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YACpC,yBAAyB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CACrD,CACF,CAAC;IACJ,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE;QACnD,MAAM;QACN,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAC1B,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7C,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;QACxE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;KACrF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,GAAG;IACb,MAAM,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,EAAE;IACrF,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE;CAGrE,CAAC;AAIF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG;;;;;;;CAO1B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D,2FAA2F;AAC3F,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,QAAwB,EACxB,OAAmB,EACnB,OAAuB,EACvB,KAAmB,EACL,EAAE;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IACpC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAAC,QAAQ,CAAC;QAC9E,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YACvB,OAAO,IAAI,uBAAuB,CAAC;gBACjC,OAAO,EAAE,QAAQ;gBACjB,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,4EAA4E;aACtF,CAAC,CAAC;QACL,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,8EAA8E,EAC9E,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACxC,CAAC;QACF,OAAO,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,0CAA0C,CAAC,CAAC,QAAQ,CAAC,EACzF,OAAqB;QAErB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YACvE,IAAI;YACJ,kBAAkB;YAClB,IAAI;YACJ,KAAK;YACL,GAAG,KAAK;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,KAAK,KAAK,IAAI;gBACnB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAU,CAAC,CAAC;QACzF,CAAC,CAAC,CACH,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;gBAAE,SAAS;YAC9D,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,oBAAoB,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,uBAAuB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9G,CAAC,CAAC,yBAAyB,MAAM,CAAC,QAAQ,wBAAwB,MAAM,CAAC,OAAO,cAAc,CACjG,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,UAAU,CACtB,MAAM,EACN,MAAM,EAAE,OAAO,KAAK,aAAa;gBAC/B,CAAC,CAAC,GAAG,KAAK,kCAAkC,MAAM,6CAA6C,SAAS,SAAS,SAAS,qCAAqC;gBAC/J,CAAC,CAAC,GAAG,KAAK,kCAAkC,MAAM,wBAAwB,SAAS,2CAA2C,KAAK,EAAE,EACvI,KAAK,CACN,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kEAAkE,EAAE;YACxF,MAAM;YACN,OAAO;YACP,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC,QAAQ,CAAC,EAC/E,KAAgB,EAChB,OAAqB;QAErB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,SAAS,CAAC,IAAI,KAAK,yBAAyB;YAAE,OAAO,SAAS,CAAC;QACnE,KAAK,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,KAAK,QAAQ;gBACX,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACxD,CAAC,CAAC,YAAY,EAAE;oBAChB,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACtC,KAAK,OAAO;gBACV,OAAO,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,KAAK,IAAI;gBACP,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/ssh/model.d.ts

@@ -0,0 +1,65 @@
+import type { SshCommand } from "@usine/agents/child-host";
+import type { GatewayAdminPort, GatewayCredentialKind, GatewayDomain, GatewayLlmProvider, SshDestination, SshIdentityFile, SshPort, WorkerName, WorkerRoot } from "@usine/core/worker";
+import type { Effect, Option, Redacted, Ref } from "effect";
+import type { HarnessProbe } from "../harness-preflight.ts";
+import type { RemoteMachine } from "../remote/machine.ts";
+import type { GatewayAdmin } from "./gateway/admin.ts";
+import type { GatewayForward } from "./gateway/forward.ts";
+/** The Gateway in front of an SSH Worker's machine on a private network (ADR 0027). */
+export interface SshWorkerGateway {
+    /** The Gateway's private DNS domain. GitHub is at `git.<domain>`, LLM providers at `llm.<domain>`, and the forward proxy at `<domain>:3128`. */
+    readonly domain: GatewayDomain;
+    /** The `ssh` destination for the Gateway: `user@host` or a Host alias. The admin API forward connects through it. */
+    readonly destination: SshDestination;
+    /** The admin API port on the Gateway's loopback interface. */
+    readonly adminPort: GatewayAdminPort;
+    /** The admin API bearer token. */
+    readonly adminToken: Redacted.Redacted<string>;
+    /** The LLM providers the Gateway has credentials for. A harness whose provider isn't listed uses its own login through the forward proxy. */
+    readonly llmProviders: ReadonlyArray<GatewayLlmProvider>;
+}
+export interface SshWorkerAddress {
+    /**
+     * The Worker's name in `usine.yaml`; its state is in `workers/<name>` under `root`. A request
+     * for a Worker without an address fails with a `machine` capability error.
+     */
+    readonly name: WorkerName;
+    /** The `ssh` destination: `user@host` or a Host alias. */
+    readonly destination: SshDestination;
+    /** The private key for authentication. If `None`, the SSH agent and configuration are used. */
+    readonly identityFile: Option.Option<SshIdentityFile>;
+    /** The SSH server port. If `None`, the SSH configuration's port is used. */
+    readonly port: Option.Option<SshPort>;
+    /** The machine directory that contains `workers/<name>`. */
+    readonly root: WorkerRoot;
+    /** The Gateway in front of the machine. If `None`, each Attempt's token is written on the machine (ADR 0026). */
+    readonly gateway: Option.Option<SshWorkerGateway>;
+}
+export interface SshExecutorOptions {
+    readonly workers: ReadonlyArray<SshWorkerAddress>;
+    /** The local SSH command and the options placed before each Worker's port and identity file. Defaults to `ssh` in batch mode with keepalives. */
+    readonly ssh?: SshCommand;
+    /** The timeout for the parent task's cancellation, then separately for the Attempt to finish. Defaults to 10 seconds. */
+    readonly interruptGrace?: Parameters<typeof Effect.timeoutOption>[1];
+    /** Probes a brain's binary and login on a Worker's machine. Defaults to the `@usine/agents/preflight` checks over SSH, which send no prompt. Behind a Gateway, the Gateway checks also apply. */
+    readonly harnessReadiness?: (machine: SshMachine) => HarnessProbe;
+}
+export interface MachineGateway {
+    readonly settings: SshWorkerGateway;
+    readonly forward: GatewayForward;
+    readonly admin: GatewayAdmin;
+    /**
+     * The Anthropic credential kind the Gateway uses for Claude Code, from the last preflight.
+     * `None` before the first preflight, if `llmProviders` doesn't include `anthropic`, or if the
+     * Gateway is too old to report it.
+     */
+    readonly anthropicCredential: Ref.Ref<Option.Option<GatewayCredentialKind>>;
+    /** Whether a preflight already warned that the Gateway is too old to report its Anthropic credential kind. */
+    readonly warnedOfUnreportedCredential: Ref.Ref<boolean>;
+}
+export interface SshMachine extends RemoteMachine {
+    /** The Worker's address from `usine.yaml`; preflight checks its root. */
+    readonly address: SshWorkerAddress;
+    readonly gateway: Option.Option<MachineGateway>;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/ssh/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/ssh/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,OAAO,EACP,UAAU,EACV,UAAU,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,gJAAgJ;IAChJ,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,qHAAqH;IACrH,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,kCAAkC;IAClC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,6IAA6I;IAC7I,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,+FAA+F;IAC/F,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,iHAAiH;IACjH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,iJAAiJ;IACjJ,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,yHAAyH;IACzH,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,iMAAiM;IACjM,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,YAAY,CAAC;CACnE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5E,8GAA8G;IAC9G,QAAQ,CAAC,4BAA4B,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;CACjD"}

package/dist/ssh/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/ssh/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/ssh/model.ts"],"names":[],"mappings":""}

package/dist/ssh/preflight.d.ts

@@ -0,0 +1,16 @@
+import type { ClaudeLoginLock } from "@usine/agents/runtime";
+import type { BrainSpec } from "@usine/core/agent/brain";
+import type { WorkerName } from "@usine/core/worker";
+import { Effect } from "effect";
+import { type ExecutorError, WorkerCapabilityError } from "../executor.ts";
+import { type HarnessProbe } from "../harness-preflight.ts";
+import type { RemoteCommands } from "../remote/commands.ts";
+import type { SshMachine } from "./model.ts";
+/**
+ * Verifies an SSH Worker without changing its machine: SSH connects, the root is a writable
+ * directory, Git runs, memory is enough for the concurrent Attempts, the Gateway (if any)
+ * responds and is reachable, and each brain is ready. Claude brains are checked under the
+ * Worker's lock in `logins`.
+ */
+export declare const sshPreflightFor: (commands: RemoteCommands, machineFor: (worker: WorkerName) => Effect.Effect<SshMachine, ExecutorError>, harnessProbe: (machine: SshMachine) => HarnessProbe, logins: ClaudeLoginLock["Service"]) => (worker: string & import("effect/Brand").Brand<"WorkerName">, brains: readonly BrainSpec[], maxConcurrentAttempts: number) => Effect.Effect<undefined, import("../executor.ts").CredentialUnavailableError | import("../executor.ts").ExecutorOperationError | WorkerCapabilityError, never>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/ssh/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/ssh/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,KAAK,aAAa,EAElB,qBAAqB,EAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,YAAY,EAA0B,MAAM,yBAAyB,CAAC;AAEpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAY7C;;;;;GAKG;AACH,eAAO,MAAM,eAAe,aAChB,cAAc,cACZ,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,gBAC9D,CAAC,OAAO,EAAE,UAAU,KAAK,YAAY,UAC3C,eAAe,CAAC,SAAS,CAAC,iSA0EX,CAAC"}

package/dist/ssh/preflight.js

@@ -0,0 +1,47 @@
+import { Effect, Option } from "effect";
+import { logPreflightFailure, WorkerCapabilityError, } from "../executor.js";
+import { verifyHarnessReadiness } from "../harness-preflight.js";
+import { verifyLinuxMemory } from "../memory-preflight.js";
+import { verifyGateway } from "./gateway/preflight.js";
+/** A script that succeeds if `$1` is a directory the SSH user can write to. */
+const WRITABLE_DIRECTORY_SCRIPT = 'test -d "$1" && test -w "$1"';
+const capabilityError = (worker, capability, message, cause) => new WorkerCapabilityError({ worker, capability, message, cause });
+/**
+ * Verifies an SSH Worker without changing its machine: SSH connects, the root is a writable
+ * directory, Git runs, memory is enough for the concurrent Attempts, the Gateway (if any)
+ * responds and is reachable, and each brain is ready. Claude brains are checked under the
+ * Worker's lock in `logins`.
+ */
+export const sshPreflightFor = (commands, machineFor, harnessProbe, logins) => Effect.fn("SshExecutor.preflight")(function* (worker, brains, maxConcurrentAttempts) {
+    const machine = yield* machineFor(worker);
+    const host = machine.shell.destination;
+    const root = machine.address.root;
+    yield* Effect.annotateCurrentSpan({ worker, host, maxConcurrentAttempts });
+    const connected = yield* commands
+        .inspect("preflight", machine.shell, "true", [])
+        .pipe(Effect.mapError((cause) => capabilityError(worker, "machine", `Can't connect to SSH worker "${worker}" at ${host}`, cause)));
+    if (connected.exitCode !== 0)
+        return yield* capabilityError(worker, "machine", `Can't connect to SSH worker "${worker}" at ${host}`, new Error(connected.stderr.trim() || `ssh exited with code ${String(connected.exitCode)}`));
+    const rootChecked = yield* commands
+        .inspect("preflight", machine.shell, "sh", ["-c", WRITABLE_DIRECTORY_SCRIPT, "sh", root])
+        .pipe(Effect.mapError((cause) => capabilityError(worker, "machine", `Can't inspect ${root} on ${host}`, cause)));
+    if (rootChecked.exitCode !== 0)
+        return yield* capabilityError(worker, "machine", `The root ${root} of SSH worker "${worker}" isn't a writable directory on ${host}`, new Error(rootChecked.stderr.trim() || `exit code ${String(rootChecked.exitCode)}`));
+    const gitVersion = (yield* commands
+        .run("preflight", machine.shell, "git", ["--version"])
+        .pipe(Effect.mapError((cause) => capabilityError(worker, "toolchain", `Worker "${worker}" can't run Git`, cause)))).trim();
+    if (!gitVersion.startsWith("git version "))
+        return yield* capabilityError(worker, "toolchain", `Worker "${worker}" returned an unrecognized Git version`, new Error(gitVersion));
+    yield* verifyLinuxMemory(worker, maxConcurrentAttempts, commands.run("preflight", machine.shell, "cat", ["/proc/meminfo"]));
+    if (Option.isSome(machine.gateway))
+        yield* verifyGateway(commands, worker, machine, machine.gateway.value);
+    yield* verifyHarnessReadiness(worker, brains, harnessProbe(machine), logins);
+    yield* Effect.logInfo("SSH Worker preflight verified", {
+        worker,
+        host,
+        root,
+        gitVersion,
+        harnesses: [...new Set(brains.map(({ harness }) => harness))].join(","),
+    });
+}, logPreflightFailure);
+//# sourceMappingURL=preflight.js.map

package/dist/ssh/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/ssh/preflight.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAqB,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAEjE,MAAM,eAAe,GAAG,CACtB,MAAkB,EAClB,UAA4B,EAC5B,OAAe,EACf,KAAc,EACS,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAwB,EACxB,UAA4E,EAC5E,YAAmD,EACnD,MAAkC,EAClC,EAAE,CACF,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAC1C,MAAkB,EAClB,MAAgC,EAChC,qBAA6B;IAE7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,QAAQ;SAC9B,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;SAC/C,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CACb,MAAM,EACN,SAAS,EACT,gCAAgC,MAAM,QAAQ,IAAI,EAAE,EACpD,KAAK,CACN,CACF,CACF,CAAC;IACJ,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,SAAS,EACT,gCAAgC,MAAM,QAAQ,IAAI,EAAE,EACpD,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,wBAAwB,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC3F,CAAC;IACJ,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ;SAChC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;SACxF,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,iBAAiB,IAAI,OAAO,IAAI,EAAE,EAAE,KAAK,CAAC,CAC9E,CACF,CAAC;IACJ,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,SAAS,EACT,YAAY,IAAI,mBAAmB,MAAM,mCAAmC,IAAI,EAAE,EAClF,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CACpF,CAAC;IACJ,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ;SAChC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC;SACrD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,MAAM,iBAAiB,EAAE,KAAK,CAAC,CAChF,CACF,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,WAAW,EACX,WAAW,MAAM,wCAAwC,EACzD,IAAI,KAAK,CAAC,UAAU,CAAC,CACtB,CAAC;IACJ,KAAK,CAAC,CAAC,iBAAiB,CACtB,MAAM,EACN,qBAAqB,EACrB,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,CAAC,CACnE,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,KAAK,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzE,KAAK,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;QACrD,MAAM;QACN,IAAI;QACJ,IAAI;QACJ,UAAU;QACV,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KACxE,CAAC,CAAC;AACL,CAAC,EAAE,mBAAmB,CAAC,CAAC"}

package/dist/ssh/ssh.d.ts

@@ -0,0 +1,20 @@
+import { ClaudeLoginLock } from "@usine/agents/runtime";
+import type { AttemptRuntime } from "@usine/durable/attempt-runtime";
+import { Layer } from "effect";
+import type { HttpClient } from "effect/unstable/http";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { type CredentialProvider, Executor } from "../executor.ts";
+import type { SshExecutorOptions } from "./model.ts";
+import { SshWorkers } from "./workers.ts";
+/**
+ * The executor for Linux machines accessed over SSH. Each Attempt's Pi parent is a durable task
+ * in this process (`AttemptRuntime`), and each child runs on the machine as one SSH command.
+ * Without a Gateway, the Attempt's GitHub token is written next to its checkout (ADR 0026).
+ * Behind a Gateway, the machine gets only a caller token for an attachment made through the
+ * Gateway's admin API (ADR 0027). `SshWorkers` adds and removes Workers at runtime. Requires
+ * Node.
+ */
+export declare const layer: (options: SshExecutorOptions) => Layer.Layer<Executor | SshWorkers, never, AttemptRuntime | ClaudeLoginLock | CredentialProvider | ChildProcessSpawner.ChildProcessSpawner | HttpClient.HttpClient>;
+export type { SshExecutorOptions, SshMachine, SshWorkerAddress, SshWorkerGateway, } from "./model.ts";
+export { SshWorkers } from "./workers.ts";
+//# sourceMappingURL=ssh.d.ts.map

package/dist/ssh/ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.d.ts","sourceRoot":"","sources":["../../src/ssh/ssh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAmB,KAAK,EAAU,MAAM,QAAQ,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,KAAK,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AASnE,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAkB,UAAU,EAAE,MAAM,cAAc,CAAC;AAmF1D;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,YACP,kBAAkB,KAC1B,KAAK,CAAC,KAAK,CACZ,QAAQ,GAAG,UAAU,EACrB,KAAK,EACH,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,mBAAmB,CAAC,mBAAmB,GACvC,UAAU,CAAC,UAAU,CACyB,CAAC;AAEnD,YAAY,EACV,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/ssh/ssh.js

@@ -0,0 +1,78 @@
+import { ClaudeLoginLock } from "@usine/agents/runtime";
+import { Context, Effect, Layer, Option } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { Executor } from "../executor.js";
+import { agentsHarnessProbe } from "../harness-preflight.js";
+import { DEFAULT_SSH, remoteCommandsFor } from "../remote/commands.js";
+import { remoteExecutorFor } from "../remote/remote.js";
+import { sshCredentialsFor } from "./credentials.js";
+import { gatewayAttachmentsFor } from "./gateway/attachments.js";
+import { gatewayRepositoryUrl } from "./gateway/environment.js";
+import { gatewayCredentialFor, gatewayHarnessProbe } from "./gateway/preflight.js";
+import { sshPreflightFor } from "./preflight.js";
+import { sshMachinesFor, SshWorkers } from "./workers.js";
+const makeSshExecutor = (options) => Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const logins = yield* ClaudeLoginLock;
+    const commands = yield* remoteCommandsFor;
+    const base = options.ssh ?? DEFAULT_SSH;
+    if (new Set(options.workers.map(({ name }) => name)).size !== options.workers.length)
+        return yield* Effect.die(new Error("SshExecutorOptions.workers contains duplicate names"));
+    const { machineFor, workers } = yield* sshMachinesFor(base, commands);
+    // Worker names are distinct, so adding them can't fail.
+    yield* Effect.forEach(options.workers, workers.addWorker, { discard: true }).pipe(Effect.orDie);
+    // Probes with no extra environment; the harness login is on the machine or at its Gateway.
+    const harnessProbe = (machine) => {
+        const probe = options.harnessReadiness?.(machine) ?? agentsHarnessProbe(spawner, machine.shell, {});
+        return Option.match(machine.gateway, {
+            onNone: () => probe,
+            onSome: (gateway) => gatewayHarnessProbe(commands, machine, gateway, probe),
+        });
+    };
+    const credentials = yield* sshCredentialsFor(commands, machineFor);
+    const attachments = yield* gatewayAttachmentsFor(commands, machineFor);
+    // Runs for every Worker, because one that moved behind a Gateway can still have tokens from
+    // an earlier process.
+    const reclaim = (worker) => credentials.reclaim(worker).pipe(Effect.andThen(attachments.reclaim(worker)));
+    const grantFor = (repository) => Effect.succeed({
+        acquire: (attemptId, worker, permissions, machine, operation) => Effect.gen(function* () {
+            yield* reclaim(worker);
+            if (Option.isNone(machine.gateway))
+                return yield* credentials.acquire(attemptId, worker, repository, permissions, machine, operation);
+            return yield* attachments.acquire(attemptId, worker, repository, permissions, machine, machine.gateway.value, operation);
+        }),
+    });
+    const executor = yield* remoteExecutorFor({
+        kind: "ssh",
+        spanPrefix: "SshExecutor",
+        label: "SSH",
+        commands,
+        machineFor,
+        preflight: sshPreflightFor(commands, machineFor, harnessProbe, logins),
+        harnessProbe,
+        repositoryUrl: (machine, repository) => Option.match(machine.gateway, {
+            onNone: () => `https://github.com/${repository}.git`,
+            onSome: ({ settings }) => gatewayRepositoryUrl(settings.domain, repository),
+        }),
+        gatewayCredential: (machine, harness) => Option.match(machine.gateway, {
+            onNone: () => Effect.succeedNone,
+            onSome: (gateway) => gatewayCredentialFor(gateway, harness),
+        }),
+        grantFor,
+        readOnlyAccessGap: Option.none(),
+        reclaim,
+        interruptGrace: options.interruptGrace ?? "10 seconds",
+    });
+    return Context.make(Executor, executor).pipe(Context.add(SshWorkers, workers));
+});
+/**
+ * The executor for Linux machines accessed over SSH. Each Attempt's Pi parent is a durable task
+ * in this process (`AttemptRuntime`), and each child runs on the machine as one SSH command.
+ * Without a Gateway, the Attempt's GitHub token is written next to its checkout (ADR 0026).
+ * Behind a Gateway, the machine gets only a caller token for an attachment made through the
+ * Gateway's admin API (ADR 0027). `SshWorkers` adds and removes Workers at runtime. Requires
+ * Node.
+ */
+export const layer = (options) => Layer.effectContext(makeSshExecutor(options));
+export { SshWorkers } from "./workers.js";
+//# sourceMappingURL=ssh.js.map

package/dist/ssh/ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../src/ssh/ssh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAIxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAA2B,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,eAAe,GAAG,CAAC,OAA2B,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;QAClF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC7F,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtE,wDAAwD;IACxD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhG,2FAA2F;IAC3F,MAAM,YAAY,GAAG,CAAC,OAAmB,EAAE,EAAE;QAC3C,MAAM,KAAK,GACT,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE;YACnC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEvE,4FAA4F;IAC5F,sBAAsB;IACtB,MAAM,OAAO,GAAG,CAAC,MAAkB,EAAE,EAAE,CACrC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAG,CAAC,UAA0B,EAAE,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC;QACb,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gBAChC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAC/B,SAAS,EACT,MAAM,EACN,UAAU,EACV,WAAW,EACX,OAAO,EACP,SAAS,CACV,CAAC;YACJ,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAC/B,SAAS,EACT,MAAM,EACN,UAAU,EACV,WAAW,EACX,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,KAAK,EACrB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;KAC6B,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAa;QACpD,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,KAAK;QACZ,QAAQ;QACR,UAAU;QACV,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC;QACtE,YAAY;QACZ,aAAa,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CACrC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,sBAAsB,UAAU,MAAM;YACpD,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;SAC5E,CAAC;QACJ,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW;YAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC;SAC5D,CAAC;QACJ,QAAQ;QACR,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE;QAChC,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,YAAY;KACvD,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,OAA2B,EAS3B,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAQnD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/ssh/workers.d.ts

@@ -0,0 +1,53 @@
+import type { WorkerName } from "@usine/core/worker";
+import { Context, Effect, Scope } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { WorkerCapabilityError } from "../executor.ts";
+import type { RemoteCommands } from "../remote/commands.ts";
+import type { SshMachine, SshWorkerAddress } from "./model.ts";
+declare const SshWorkers_base: Context.ServiceClass<SshWorkers, "@usine/executor/SshWorkers", {
+    /**
+     * Adds the machine at `address` for preflight and Attempts. Behind a Gateway, shares the admin
+     * API forward with other Workers that have the same `destination` and `adminPort`, or opens it.
+     * Adding a Worker again with the same address does nothing; with a different address, fails
+     * with a `machine` capability error.
+     */
+    readonly addWorker: (address: SshWorkerAddress) => Effect.Effect<void, WorkerCapabilityError>;
+    /**
+     * Removes `worker`'s machine, so later requests for it fail with a `machine` capability error.
+     * Call only when no Attempt runs on the Worker. If it was the last Worker behind its Gateway,
+     * closes the admin API forward. Removing an unknown Worker does nothing.
+     */
+    readonly removeWorker: (worker: WorkerName) => Effect.Effect<void>;
+}>;
+/** The Workers of the SSH executor, starting with `SshExecutorOptions.workers`. A reload adds and removes Workers at runtime. */
+export declare class SshWorkers extends SshWorkers_base {
+}
+/**
+ * Returns the SSH Workers' machines, which `addWorker` and `removeWorker` change at runtime and
+ * `machineFor` reads on each call. Each admin API forward runs in its own child scope and
+ * closes with its last Worker or the caller's scope.
+ */
+export declare const sshMachinesFor: (base: {
+    readonly command: string;
+    readonly args: readonly string[];
+}, commands: RemoteCommands) => Effect.Effect<{
+    machineFor: (worker: string & import("effect/Brand").Brand<"WorkerName">) => Effect.Effect<SshMachine, WorkerCapabilityError, never>;
+    workers: {
+        /**
+         * Adds the machine at `address` for preflight and Attempts. Behind a Gateway, shares the admin
+         * API forward with other Workers that have the same `destination` and `adminPort`, or opens it.
+         * Adding a Worker again with the same address does nothing; with a different address, fails
+         * with a `machine` capability error.
+         */
+        readonly addWorker: (address: SshWorkerAddress) => Effect.Effect<void, WorkerCapabilityError>;
+        /**
+         * Removes `worker`'s machine, so later requests for it fail with a `machine` capability error.
+         * Call only when no Attempt runs on the Worker. If it was the last Worker behind its Gateway,
+         * closes the admin API forward. Removing an unknown Worker does nothing.
+         */
+        readonly removeWorker: (worker: WorkerName) => Effect.Effect<void>;
+    };
+}, never, ChildProcessSpawner.ChildProcessSpawner | HttpClient.HttpClient | Scope.Scope>;
+export {};
+//# sourceMappingURL=workers.d.ts.map

package/dist/ssh/workers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../../src/ssh/workers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,KAAK,EAAmB,MAAM,QAAQ,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,KAAK,EAAkB,UAAU,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;;IAM7F;;;;;OAKG;wBACiB,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAC7F;;;;OAIG;2BACoB,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AAhBtE,iIAAiI;AACjI,qBAAa,UAAW,SAAQ,eAiBC;CAAG;AA8BpC;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;QAjDvB;;;;;WAKG;4BACiB,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC;QAC7F;;;;WAIG;+BACoB,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;wFAoNpE,CAAC"}