@usine/executor 0.2.1 → 0.4.0

package/dist/ssh/gateway/forward.d.ts

@@ -0,0 +1,74 @@
+import type { RemoteShell } from "@usine/agents/child-host";
+import { SshDestination } from "@usine/core/worker";
+import { DateTime, Effect, Schema, Stream } from "effect";
+import { ChildProcess, type ChildProcessSpawner } from "effect/process";
+export interface OpenForward {
+    /** The SSH client number, starting at 1. `reopen` replaces only this generation. */
+    readonly generation: number;
+    readonly url: URL;
+}
+declare const GatewayForwardClosed_base: Schema.Class<GatewayForwardClosed, Schema.TaggedStruct<"GatewayForwardClosed", {
+    readonly gateway: Schema.brand<Schema.String, "SshDestination">;
+    readonly generation: Schema.Int;
+    readonly since: Schema.DateTimeUtc;
+    readonly reason: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error for a closed admin API forward, whose SSH client didn't open or exited. `since` is
+ * when the Gateway became unreachable, and `reason` is the SSH client's error.
+ */
+export declare class GatewayForwardClosed extends GatewayForwardClosed_base {
+}
+/**
+ * An SSH forward from a local port to a Gateway's admin API (ADR 0027, amendment of
+ * 2026-10-19). It opens with the first Worker behind the Gateway, reopens after a pause when
+ * its client exits, and closes with the last Worker or the executor.
+ */
+export interface GatewayForward {
+    /** The Gateway's SSH destination, used to identify it in logs and messages. */
+    readonly gateway: SshDestination;
+    /** The SSH command an operator can run to open the same forward manually. */
+    readonly command: string;
+    /** Returns the open forward, waiting while a client is opening. Fails immediately while the forward is closed. */
+    readonly current: Effect.Effect<OpenForward, GatewayForwardClosed>;
+    /**
+     * Replaces SSH client `generation`, or ends the pause after it closed, and waits for the next
+     * client. If another request already replaced it, waits for the current forward.
+     */
+    readonly reopen: (generation: number) => Effect.Effect<OpenForward, GatewayForwardClosed>;
+    /** Records an unanswered request sent at `sentAt`, and returns when the first unanswered request since the last response was sent. */
+    readonly unanswered: (sentAt: DateTime.Utc) => Effect.Effect<DateTime.Utc>;
+    /** Records a response from the admin API, so the next unanswered request starts a new outage. */
+    readonly answered: Effect.Effect<void>;
+}
+/**
+ * Opens a forward to the admin API at `adminPort` on `gateway`, using the SSH client and
+ * environment of `shell`, and keeps it open until the caller's scope closes. Each client
+ * listens on a kernel-picked port of 127.0.0.1, so it never conflicts with an operator's
+ * forward.
+ */
+export declare const gatewayForwardFor: (spawner: {
+    spawn(command: ChildProcess.Command): Effect.Effect<ChildProcessSpawner.ChildProcessHandle, import("effect/PlatformError").PlatformError, import("effect/Scope").Scope>;
+    exitCode(command: ChildProcess.Command): Effect.Effect<ChildProcessSpawner.ExitCode, import("effect/PlatformError").PlatformError>;
+    streamString(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
+    streamLines(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
+    lines(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Effect.Effect<Array<string>, import("effect/PlatformError").PlatformError>;
+    string(command: ChildProcess.Command, options?: {
+        readonly includeStderr?: boolean | undefined;
+    }): Effect.Effect<string, import("effect/PlatformError").PlatformError>;
+}, shell: Pick<RemoteShell, "ssh" | "sshEnvironment">, gateway: string & import("effect/Brand").Brand<"SshDestination">, adminPort: number & import("effect/Brand").Brand<"GatewayAdminPort">) => Effect.Effect<{
+    gateway: string & import("effect/Brand").Brand<"SshDestination">;
+    command: string;
+    current: Effect.Effect<OpenForward, GatewayForwardClosed, never>;
+    reopen: (generation: number) => Effect.Effect<OpenForward, GatewayForwardClosed, never>;
+    unanswered: (sentAt: DateTime.Utc) => Effect.Effect<DateTime.Utc, never, never>;
+    answered: Effect.Effect<void, never, never>;
+}, never, import("effect/Scope").Scope>;
+export {};
+//# sourceMappingURL=forward.d.ts.map

package/dist/ssh/gateway/forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/forward.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAyB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAY,MAAM,EAA8B,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAcxE,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CACnB;;;;;;;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,yBAOxC;CAAG;AAEL;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kHAAkH;IAClH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACnE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC1F,sIAAsI;IACtI,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3E,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACxC;AA6DD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;yBAyQA,QAAQ,CAAC,GAAG;;uCAWxC,CAAC"}

package/dist/ssh/gateway/forward.js

@@ -0,0 +1,247 @@
+import { createServer } from "node:net";
+import { SshDestination } from "@usine/core/worker";
+import { DateTime, Deferred, Effect, Fiber, Option, Ref, Result, Schema, Stream } from "effect";
+import { ChildProcess } from "effect/process";
+/** The line the SSH client prints through `LocalCommand` when its local port is listening. */
+const OPEN_LINE = "usine-gateway-forward-open";
+/** The time an SSH client has to connect and listen before it's replaced. */
+const OPEN_TIMEOUT = "30 seconds";
+/** The time a request waits for the forward to open. */
+const OPEN_WAIT = "1 minute";
+/** The maximum pause between SSH clients, in milliseconds. The pause doubles from one second after each failure. */
+const MAX_PAUSE_MILLIS = 60_000;
+/**
+ * The error for a closed admin API forward, whose SSH client didn't open or exited. `since` is
+ * when the Gateway became unreachable, and `reason` is the SSH client's error.
+ */
+export class GatewayForwardClosed extends Schema.TaggedError("@usine/executor/GatewayForwardClosed")("GatewayForwardClosed", {
+    gateway: SshDestination,
+    generation: Schema.Int,
+    since: Schema.DateTimeUtc,
+    reason: Schema.NonEmptyString,
+}) {
+}
+const notOpened = (reason) => ({ _tag: "NotOpened", reason });
+const exited = (reason) => ({ _tag: "Exited", reason });
+const REPLACED = { _tag: "Replaced" };
+const ListenerAddress = Schema.Struct({ port: Schema.Int });
+/** Returns a free port on 127.0.0.1 picked by the kernel, released for the SSH client to listen on. */
+const freeLocalPort = Effect.callback((resume) => {
+    const server = createServer();
+    server.once("error", (cause) => resume(Effect.fail(cause)));
+    server.listen(0, "127.0.0.1", () => {
+        const address = Schema.decodeUnknownOption(ListenerAddress)(server.address());
+        server.close(() => resume(Option.match(address, {
+            onNone: () => Effect.fail(new Error("the listener reported no port")),
+            onSome: ({ port }) => Effect.succeed(port),
+        })));
+    });
+});
+/** Returns the SSH client's stderr on one line, or its exit code if stderr is empty. */
+const complaint = (stderr, exitCode) => {
+    const lines = stderr
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line !== "");
+    return lines.length > 0 ? lines.join("; ") : `ssh exited with code ${String(exitCode)}`;
+};
+const pauseAfter = (failures) => Math.min(1000 * 2 ** Math.max(failures - 1, 0), MAX_PAUSE_MILLIS);
+/**
+ * Opens a forward to the admin API at `adminPort` on `gateway`, using the SSH client and
+ * environment of `shell`, and keeps it open until the caller's scope closes. Each client
+ * listens on a kernel-picked port of 127.0.0.1, so it never conflicts with an operator's
+ * forward.
+ */
+export const gatewayForwardFor = Effect.fn("SshExecutor.gatewayForwardFor")(function* (spawner, shell, gateway, adminPort) {
+    const fields = { gateway, adminPort };
+    yield* Effect.annotateCurrentSpan(fields);
+    const forwardSpec = (port) => `127.0.0.1:${String(port)}:127.0.0.1:${String(adminPort)}`;
+    const command = [
+        shell.ssh.command,
+        ...shell.ssh.args,
+        "-N",
+        "-o",
+        "ExitOnForwardFailure=yes",
+        "-L",
+        forwardSpec(adminPort),
+        gateway,
+    ].join(" ");
+    const argumentsFor = (port) => [
+        ...shell.ssh.args,
+        "-N",
+        // LocalCommand runs when all listeners are up, ExitOnForwardFailure exits if a listener fails, and ControlPath=none avoids the operator's shared connections.
+        "-o",
+        "ExitOnForwardFailure=yes",
+        "-o",
+        "ControlPath=none",
+        "-o",
+        "PermitLocalCommand=yes",
+        "-o",
+        `LocalCommand=echo ${OPEN_LINE}`,
+        "-L",
+        forwardSpec(port),
+        gateway,
+    ];
+    const generationNumbered = (number) => Effect.all({
+        opened: Deferred.make(),
+        replace: Deferred.make(),
+        next: Deferred.make(),
+    }).pipe(Effect.map((signals) => ({ number, ...signals })));
+    const first = yield* generationNumbered(1);
+    const state = yield* Ref.make({ _tag: "Opening", generation: first });
+    const runClient = Effect.fn("SshExecutor.runGatewayForward")(function* (generation, closedSince) {
+        yield* Effect.annotateCurrentSpan({ ...fields, generation: generation.number });
+        const picked = yield* Effect.result(freeLocalPort);
+        if (Result.isFailure(picked))
+            return notOpened(`no free port on 127.0.0.1: ${picked.failure.message}`);
+        const port = picked.success;
+        yield* Effect.annotateCurrentSpan({ port });
+        yield* Effect.logDebug("Starting an SSH client for the forward to the Gateway's admin API", {
+            ...fields,
+            generation: generation.number,
+            port,
+        });
+        return yield* Effect.scoped(Effect.gen(function* () {
+            const handle = yield* spawner.spawn(ChildProcess.make(shell.ssh.command, argumentsFor(port), {
+                env: { ...shell.sshEnvironment },
+                extendEnv: false,
+                detached: false,
+                forceKillAfter: "5 seconds",
+                stdin: "ignore",
+            }));
+            const stderr = yield* handle.stderr.pipe(Stream.decodeText(), Stream.mkString, Effect.forkScoped);
+            const reported = (exitCode) => Fiber.join(stderr).pipe(Effect.map((text) => complaint(text, exitCode)));
+            const listening = yield* handle.stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.filter((line) => line.trim() === OPEN_LINE), Stream.runHead, Effect.timeoutOption(OPEN_TIMEOUT));
+            if (Option.isNone(listening))
+                return notOpened(`ssh didn't open the forward within ${OPEN_TIMEOUT}`);
+            if (Option.isNone(listening.value))
+                return notOpened(yield* reported(Number(yield* handle.exitCode)));
+            const open = {
+                generation: generation.number,
+                url: new URL(`http://127.0.0.1:${String(port)}`),
+            };
+            yield* Ref.set(state, { _tag: "Open", generation, open });
+            yield* Deferred.succeed(generation.opened, open);
+            yield* Option.match(closedSince, {
+                onNone: () => Effect.logInfo("Opened the forward to the Gateway's admin API", {
+                    ...fields,
+                    generation: generation.number,
+                    port,
+                }),
+                onSome: (since) => Effect.logInfo("Reopened the forward to the Gateway's admin API", {
+                    ...fields,
+                    generation: generation.number,
+                    port,
+                    closedSince: DateTime.formatIso(since),
+                }),
+            });
+            // Sets the state to closed first, so no request uses a port the client no longer listens on.
+            const closedNow = (reason) => DateTime.now.pipe(Effect.flatMap((since) => Ref.set(state, {
+                _tag: "Closed",
+                generation,
+                closed: new GatewayForwardClosed({
+                    gateway,
+                    generation: generation.number,
+                    since,
+                    reason,
+                }),
+            })));
+            return yield* Effect.raceFirst(handle.exitCode.pipe(Effect.flatMap((code) => reported(Number(code))), Effect.catch((error) => Effect.succeed(`can't read the SSH client's exit code: ${error.message}`)), Effect.tap(closedNow), Effect.map(exited)), Deferred.await(generation.replace).pipe(Effect.andThen(closedNow("replaced after a request got no response")), Effect.as(REPLACED)));
+        })).pipe(Effect.catch((error) => Effect.succeed(notOpened(`can't run ${shell.ssh.command}: ${error.message}`))));
+    });
+    // Runs until the caller's scope closes, with one span per SSH client.
+    const supervise = Effect.gen(function* () {
+        let generation = first;
+        let failures = 0;
+        let closedSince = Option.none();
+        while (true) {
+            const end = yield* runClient(generation, closedSince);
+            const now = yield* DateTime.now;
+            if (end._tag === "Replaced") {
+                failures = 0;
+                closedSince = Option.some(now);
+                yield* Effect.logInfo("Replacing the forward to the Gateway's admin API, which a request found unanswered", { ...fields, generation: generation.number });
+            }
+            else {
+                failures = end._tag === "Exited" ? 1 : failures + 1;
+                const since = end._tag === "Exited" ? now : Option.getOrElse(closedSince, () => now);
+                closedSince = Option.some(since);
+                const pause = pauseAfter(failures);
+                const closed = new GatewayForwardClosed({
+                    gateway,
+                    generation: generation.number,
+                    since,
+                    reason: end.reason,
+                });
+                yield* Ref.set(state, { _tag: "Closed", generation, closed });
+                yield* Deferred.fail(generation.opened, closed);
+                yield* Effect.logWarning(end._tag === "Exited"
+                    ? "The forward to the Gateway's admin API exited; reopening it after a pause"
+                    : "Could not open the forward to the Gateway's admin API; trying again after a pause", {
+                    ...fields,
+                    generation: generation.number,
+                    closedSince: DateTime.formatIso(since),
+                    failures,
+                    pauseSeconds: pause / 1000,
+                    reason: end.reason,
+                });
+                const trigger = yield* Effect.raceFirst(Effect.sleep(pause).pipe(Effect.as("pause elapsed")), Deferred.await(generation.replace).pipe(Effect.as("request")));
+                yield* Effect.logInfo("Reopening the forward to the Gateway's admin API", {
+                    ...fields,
+                    generation: generation.number + 1,
+                    closedSince: DateTime.formatIso(since),
+                    trigger,
+                });
+            }
+            const next = yield* generationNumbered(generation.number + 1);
+            yield* Ref.set(state, { _tag: "Opening", generation: next });
+            yield* Deferred.succeed(generation.next, next);
+            generation = next;
+        }
+    });
+    yield* supervise.pipe(Effect.onInterrupt(() => Effect.logInfo("Closed the forward to the Gateway's admin API", fields)), Effect.forkScoped);
+    const notOpenedWithin = (generation) => DateTime.now.pipe(Effect.flatMap((since) => new GatewayForwardClosed({
+        gateway,
+        generation,
+        since,
+        reason: `the forward didn't open within ${OPEN_WAIT}`,
+    })));
+    const current = Effect.gen(function* () {
+        const now = yield* Ref.get(state);
+        switch (now._tag) {
+            case "Open":
+                return now.open;
+            case "Closed":
+                return yield* now.closed;
+            case "Opening":
+                return yield* Deferred.await(now.generation.opened).pipe(Effect.timeoutOrElse({
+                    duration: OPEN_WAIT,
+                    orElse: () => notOpenedWithin(now.generation.number),
+                }));
+        }
+    });
+    const reopen = Effect.fn("SshExecutor.reopenGatewayForward")(function* (generation) {
+        yield* Effect.annotateCurrentSpan({ ...fields, generation });
+        const now = yield* Ref.get(state);
+        if (now.generation.number !== generation) {
+            yield* Effect.logDebug("Another request replaced the forward to the Gateway's admin API already", { ...fields, generation, current: now.generation.number });
+            return yield* current;
+        }
+        yield* Deferred.succeed(now.generation.replace, undefined);
+        return yield* Deferred.await(now.generation.next).pipe(Effect.flatMap((next) => Deferred.await(next.opened)), Effect.timeoutOrElse({
+            duration: OPEN_WAIT,
+            orElse: () => notOpenedWithin(generation + 1),
+        }));
+    });
+    const silentSince = yield* Ref.make(Option.none());
+    const unanswered = (sentAt) => Ref.modify(silentSince, (since) => {
+        const first = Option.match(since, {
+            onNone: () => sentAt,
+            onSome: (earlier) => DateTime.min(earlier, sentAt),
+        });
+        return [first, Option.some(first)];
+    });
+    const answered = Ref.set(silentSince, Option.none());
+    return { gateway, command, current, reopen, unanswered, answered };
+});
+//# sourceMappingURL=forward.js.map

package/dist/ssh/gateway/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../../src/ssh/gateway/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,EAAyB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EAAE,YAAY,EAA4B,MAAM,gBAAgB,CAAC;AAExE,8FAA8F;AAC9F,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,wDAAwD;AACxD,MAAM,SAAS,GAAG,UAAU,CAAC;AAE7B,oHAAoH;AACpH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAQhC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,CAC1D,sCAAsC,CACvC,CAAC,sBAAsB,EAAE;IACxB,OAAO,EAAE,cAAc;IACvB,UAAU,EAAE,MAAM,CAAC,GAAG;IACtB,KAAK,EAAE,MAAM,CAAC,WAAW;IACzB,MAAM,EAAE,MAAM,CAAC,cAAc;CAC9B,CAAC;CAAG;AAiDL,MAAM,SAAS,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AACjF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3E,MAAM,QAAQ,GAAc,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAEjD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAE5D,uGAAuG;AACvG,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAgB,CAAC,MAAM,EAAE,EAAE;IAC9D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CACJ,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;YACpB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACrE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3C,CAAC,CACH,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAU,EAAE;IAC7D,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EACnF,OAA2D,EAC3D,KAAkD,EAClD,OAAuB,EACvB,SAA2B;IAE3B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACtC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,GAAG,CAAC,OAAO;QACjB,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI;QACjB,IAAI;QACJ,IAAI;QACJ,0BAA0B;QAC1B,IAAI;QACJ,WAAW,CAAC,SAAS,CAAC;QACtB,OAAO;KACR,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC;QACrC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI;QACjB,IAAI;QACJ,8JAA8J;QAC9J,IAAI;QACJ,0BAA0B;QAC1B,IAAI;QACJ,kBAAkB;QAClB,IAAI;QACJ,wBAAwB;QACxB,IAAI;QACJ,qBAAqB,SAAS,EAAE;QAChC,IAAI;QACJ,WAAW,CAAC,IAAI,CAAC;QACjB,OAAO;KACR,CAAC;IAEF,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC;QACT,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAqC;QAC1D,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAQ;QAC9B,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAc;KAClC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAe,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EACpE,UAAsB,EACtB,WAAwC;QAExC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAC1B,OAAO,SAAS,CAAC,8BAA8B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mEAAmE,EAAE;YAC1F,GAAG,MAAM;YACT,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,IAAI;SACL,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CACjC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;gBACvD,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE;gBAChC,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,WAAW;gBAC3B,KAAK,EAAE,QAAQ;aAChB,CAAC,CACH,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACtC,MAAM,CAAC,UAAU,EAAE,EACnB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,UAAU,CAClB,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CACpC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACzC,MAAM,CAAC,UAAU,EAAE,EACnB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,EAClD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CACnC,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1B,OAAO,SAAS,CAAC,sCAAsC,YAAY,EAAE,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAChC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAEpE,MAAM,IAAI,GAAgB;gBACxB,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,GAAG,EAAE,IAAI,GAAG,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;aACjD,CAAC;YACF,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC/B,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,OAAO,CAAC,+CAA+C,EAAE;oBAC9D,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,IAAI;iBACL,CAAC;gBACJ,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,OAAO,CAAC,iDAAiD,EAAE;oBAChE,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,IAAI;oBACJ,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;iBACvC,CAAC;aACL,CAAC,CAAC;YACH,6FAA6F;YAC7F,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CACnC,QAAQ,CAAC,GAAG,CAAC,IAAI,CACf,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,UAAU;gBACV,MAAM,EAAE,IAAI,oBAAoB,CAAC;oBAC/B,OAAO;oBACP,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,KAAK;oBACL,MAAM;iBACP,CAAC;aACH,CAAC,CACH,CACF,CAAC;YACJ,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAChD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,0CAA0C,KAAK,CAAC,OAAO,EAAE,CAAC,CAC1E,EACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,EACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC,EACrE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CACpB,CACF,CAAC;QACJ,CAAC,CAAC,CACH,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAC9E,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,WAAW,GAAG,MAAM,CAAC,IAAI,EAAgB,CAAC;QAC9C,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC5B,QAAQ,GAAG,CAAC,CAAC;gBACb,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,oFAAoF,EACpF,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAC7C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;gBACrF,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC;oBACtC,OAAO;oBACP,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,KAAK;oBACL,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;gBACH,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9D,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAChD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,GAAG,CAAC,IAAI,KAAK,QAAQ;oBACnB,CAAC,CAAC,2EAA2E;oBAC7E,CAAC,CAAC,mFAAmF,EACvF;oBACE,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;oBACtC,QAAQ;oBACR,YAAY,EAAE,KAAK,GAAG,IAAI;oBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CACF,CAAC;gBACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CACrC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,EACpD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAC9D,CAAC;gBACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kDAAkD,EAAE;oBACxE,GAAG,MAAM;oBACT,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;oBACjC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC9D,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/C,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CACnB,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,OAAO,CAAC,+CAA+C,EAAE,MAAM,CAAC,CACxE,EACD,MAAM,CAAC,UAAU,CAClB,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAE,EAAE,CAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,CACf,MAAM,CAAC,OAAO,CACZ,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;QACvB,OAAO;QACP,UAAU;QACV,KAAK;QACL,MAAM,EAAE,kCAAkC,SAAS,EAAE;KACtD,CAAC,CACL,CACF,CAAC;IAEJ,MAAM,OAAO,GAA8B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,MAAM;gBACT,OAAO,GAAG,CAAC,IAAI,CAAC;YAClB,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3B,KAAK,SAAS;gBACZ,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,aAAa,CAAC;oBACnB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;iBACrD,CAAC,CACH,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAkB;QACxF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpB,yEAAyE,EACzE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAC1D,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EACrD,MAAM,CAAC,aAAa,CAAC;YACnB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,GAAG,CAAC,CAAC;SAC9C,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAgB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAE,EAAE,CAC1C,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;YAChC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;YACpB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAU,CAAC;IAC9C,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAErD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAA2B,CAAC;AAC9F,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/preflight.d.ts

@@ -0,0 +1,67 @@
+import { type RemoteShell } from "@usine/agents/child-host";
+import type { Harness } from "@usine/core/agent/brain";
+import { HarnessReady, HarnessUnavailableError } from "@usine/core/agent/capability";
+import type { GatewayCredentialKind, WorkerName } from "@usine/core/worker";
+import { Effect, Option } from "effect";
+import { ExecutorOperationError, WorkerCapabilityError } from "../../executor.ts";
+import type { HarnessProbe } from "../../harness-preflight.ts";
+import { type RemoteCommands } from "../../remote/commands.ts";
+import type { MachineGateway, SshMachine } from "../model.ts";
+/**
+ * Returns the credential kind the Gateway injects for `harness`, as recorded by the last
+ * preflight: Anthropic's for Claude Code, OpenAI's for Codex. Pi uses its own login.
+ */
+export declare const gatewayCredentialFor: (gateway: MachineGateway, harness: Harness) => Effect.Effect<Option.Option<GatewayCredentialKind>>;
+/**
+ * Verifies the Gateway's admin API for an SSH Worker without attaching anything: the forward
+ * opens and the admin API accepts the admin token. Records the Gateway's credential kind for
+ * each provider in the Worker's `llmProviders`. Needs no Worker machine.
+ */
+export declare const verifyGatewayAdmin: (worker: string & import("effect/Brand").Brand<"WorkerName">, gateway: MachineGateway) => Effect.Effect<void, WorkerCapabilityError, never>;
+/**
+ * Verifies the Gateway in front of an SSH Worker without attaching anything: the admin API
+ * checks of `verifyGatewayAdmin`, then the machine checks of `verifyGatewayFromMachine`.
+ */
+export declare const verifyGateway: (commands: RemoteCommands, worker: WorkerName, machine: SshMachine, gateway: MachineGateway) => Effect.Effect<undefined, ExecutorOperationError | WorkerCapabilityError, never>;
+/**
+ * Checks only the binary of a harness whose credential the machine doesn't keep, the Gateway's
+ * or an API key in the Attempt's environment, named by `credential` in the log. Codex's version
+ * must also be supported.
+ */
+export declare const harnessBinaryProbe: (commands: RemoteCommands, host: string, shell: RemoteShell, harness: "claude" | "codex", credential: string) => Effect.Effect<HarnessReady | HarnessUnavailableError, ExecutorOperationError, never>;
+/**
+ * The harnesses that can use the operator's login on the machine or the Gateway's credential
+ * for their provider, with the hosts each login calls through the forward proxy, which
+ * `infra/hetzner/gateway/egress-allowlist` lists, and the API host that an API key in the
+ * Attempt's environment calls.
+ */
+declare const LOGINS: {
+    readonly claude: {
+        readonly label: "Claude Code";
+        readonly provider: "Anthropic";
+        readonly gatewayProvider: "anthropic";
+        readonly hosts: readonly ["api.anthropic.com", "platform.claude.com"];
+        readonly apiHost: "api.anthropic.com";
+    };
+    readonly codex: {
+        readonly label: "Codex";
+        readonly provider: "OpenAI";
+        readonly gatewayProvider: "openai";
+        readonly hosts: readonly ["chatgpt.com", "auth.openai.com"];
+        readonly apiHost: "api.openai.com";
+    };
+};
+/** A harness that can use a login, the Gateway's credential, or an API key. */
+export type LoginHarness = keyof typeof LOGINS;
+/**
+ * Probes a brain on a Worker behind a Gateway (ADR 0027). If the Gateway has the credential of
+ * the harness's provider, checks only the harness binary. Otherwise, Claude Code and Codex use
+ * the operator's login (ADR 0026), or an API key in the Attempt's environment if `apiKeyed`
+ * returns `true` for the harness: `probe` checks the login or the binary, then the machine must
+ * connect to the login's hosts, or the provider's API host, through the forward proxy. Pi goes
+ * to `probe`, which rejects it on any remote machine. The checks run through `shell`, on the
+ * machine or in a container on it.
+ */
+export declare const gatewayHarnessProbe: (commands: RemoteCommands, machine: SshMachine, gateway: MachineGateway, probe: HarnessProbe, shell: RemoteShell, apiKeyed: (harness: LoginHarness) => boolean) => HarnessProbe;
+export {};
+//# sourceMappingURL=preflight.d.ts.map

package/dist/ssh/gateway/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAa,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,qBAAqB,EAAsB,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,KAAK,EAAsB,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0HlF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,YACtB,cAAc,WACd,OAAO,KACf,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CASpD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,6IA+B7B,CAAC;AAqEH;;;GAGG;AACH,eAAO,MAAM,aAAa,aACd,cAAc,UAChB,UAAU,WACT,UAAU,WACV,cAAc,oFAItB,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,uMA0B7B,CAAC;AAEH;;;;;GAKG;AACH,QAAA,MAAM,MAAM;;iBAER,KAAK,EAAE,aAAa;iBACpB,QAAQ,EAAE,WAAW;iBACrB,eAAe,EAAE,WAAW;iBAC5B,KAAK;iBACL,OAAO,EAAE,mBAAmB;;;iBAG5B,KAAK,EAAE,OAAO;iBACd,QAAQ,EAAE,QAAQ;iBAClB,eAAe,EAAE,QAAQ;iBACzB,KAAK;iBACL,OAAO,EAAE,gBAAgB;;CAa5B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,MAAM,CAAC;AAqB/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,aACpB,cAAc,WACf,UAAU,WACV,cAAc,SAChB,YAAY,SACZ,WAAW,YACR,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,KAC3C,YAyFF,CAAC"}