@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/lib/ssh-identity.js

@@ -0,0 +1,326 @@
+/**
+ * The machine's Forge SSH identity: one ed25519 key, registered to the signed-in
+ * account, and pinned for git.vibes.dev in `~/.ssh/config`.
+ *
+ * Forge Git is SSH-only (`ssh://git@git.vibes.dev/…`), so a machine with no key,
+ * an unregistered key, or an unknown host key cannot clone, and each of those
+ * used to be a manual step (`ssh-keygen`, `vibes forge ssh-key add`, answering
+ * the host-key prompt). `ensureForgeSshIdentity` does all three, idempotently:
+ *
+ * - SELECT before creating. `~/.ssh/id_ed25519.pub` first (OpenSSH's own default
+ *   identity), then any other `ssh-ed25519` public key in `~/.ssh`, sorted. A key
+ *   is generated only when the machine has none, at the default path, so plain
+ *   `ssh` and `git` use it too. The private key is never read or sent. A key
+ *   file that is absent is expected; one that exists but cannot be read stops
+ *   setup with its cause, because skipping it could hide the key the user meant
+ *   and lead to generating over it.
+ * - REGISTER by fingerprint. A key the account already holds is left alone.
+ * - PIN the host in a marked block that is the only part of `~/.ssh/config` this
+ *   module writes. `StrictHostKeyChecking accept-new` records git.vibes.dev's
+ *   key on first contact and still refuses a CHANGED key.
+ *
+ * `~/.ssh` is the runtime's path-roots user home. Reads, listing, `mkdir` and
+ * writes go through the runtime's host-disk `filesystem/adapter`
+ * (`resolveSshHome`). Two steps do not: `ssh-keygen` writes the key pair
+ * itself, and the owner-only permission bits are set with node's `chmod`,
+ * because `filesystem/adapter` has no permission operation yet. That gap is
+ * `@vibesdotdev/filesystem`'s to close.
+ */
+import { chmodChecked, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { getPathRoots, getRuntimePath } from '@vibesdotdev/paths';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { z } from 'zod';
+import { fingerprintPublicKey, runtimeExec } from "./ssh-keygen.js";
+import { sendForgeRequest } from "./transport.js";
+export const FORGE_SSH_HOST = 'git.vibes.dev';
+const BLOCK_BEGIN = '# BEGIN managed-by-vibes-forge';
+const BLOCK_END = '# END managed-by-vibes-forge';
+const DEFAULT_PUBLIC_KEY = 'id_ed25519.pub';
+const FILESYSTEM_ADAPTER_KIND = 'filesystem/adapter';
+/**
+ * The part of `filesystem/adapter` this module calls. Forge has no dependency
+ * on `@vibesdotdev/filesystem`, so it names these operations here and checks
+ * the resolved implementation against them.
+ */
+export const SshFilesSchema = z.object({
+    exists: z.custom((fn) => fn instanceof Function),
+    readFile: z.custom((fn) => fn instanceof Function),
+    list: z.custom((fn) => fn instanceof Function),
+    mkdir: z.custom((fn) => fn instanceof Function),
+    writeFile: z.custom((fn) => fn instanceof Function)
+});
+const SSH_FILE_OPERATIONS = ['exists', 'readFile', 'list', 'mkdir', 'writeFile'];
+/** What a host-disk adapter must offer to reach `~/.ssh`. */
+const HOST_DISK_CAPABILITIES = ['read', 'write', 'list'];
+const AdapterDescriptorSchema = z.object({
+    enabled: z.boolean().optional(),
+    cloudNative: z.boolean().optional(),
+    capabilities: z.array(z.string()).optional()
+});
+/** An enabled adapter on this machine's disk that can read, write and list. */
+function isHostDisk(descriptor) {
+    const parsed = AdapterDescriptorSchema.safeParse(descriptor);
+    if (!parsed.success)
+        return false;
+    const { enabled, cloudNative, capabilities = [] } = parsed.data;
+    return (enabled !== false &&
+        cloudNative !== true &&
+        HOST_DISK_CAPABILITIES.every((capability) => capabilities.includes(capability)));
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** The text of `path`, or null when it does not exist. Any other failure is reported. */
+async function readIfPresent(files, path) {
+    let content;
+    try {
+        content = await files.readFile(path, 'utf8');
+    }
+    catch (error) {
+        // SAFETY: Error object from fs operations exposes node errno codes.
+        if (error.code === 'ENOENT')
+            return null;
+        throw new CapabilityError(`cannot read ${path}: ${describeError(CaughtFailureSchema.parse(error))}`, 'UNAVAILABLE', {
+            cause: error,
+            reason: 'ssh-file-read-failed'
+        });
+    }
+    return content instanceof Uint8Array ? new TextDecoder().decode(content) : content;
+}
+/**
+ * Public key file names in `~/.ssh`, or null when the directory does not exist.
+ *
+ * A listing can fail with ENOENT while `~/.ssh` exists, when a file inside it
+ * is removed mid-listing (ssh rewrites `known_hosts` through a temp file). Only
+ * a missing directory means "no key"; reading it as one would generate a key
+ * over the user's own.
+ */
+async function listPublicKeys(home) {
+    let entries;
+    try {
+        entries = await home.files.list(home.dir);
+    }
+    catch (error) {
+        // SAFETY: Error object from fs operations exposes node errno codes.
+        if (error.code === 'ENOENT' && !(await home.files.exists(home.dir)))
+            return null;
+        throw new CapabilityError(`cannot list ${home.dir}: ${describeError(CaughtFailureSchema.parse(error))}`, 'UNAVAILABLE', {
+            cause: error,
+            reason: 'ssh-file-list-failed'
+        });
+    }
+    return entries
+        .filter((entry) => entry.kind !== 'directory' && entry.name.endsWith('.pub'))
+        .map((entry) => entry.name)
+        .sort();
+}
+/** The public key to use: the default identity first, then any ed25519 key in `~/.ssh`. */
+export async function selectEd25519PublicKey(home) {
+    const names = await listPublicKeys(home);
+    if (names === null)
+        return null;
+    const ordered = [DEFAULT_PUBLIC_KEY, ...names.filter((name) => name !== DEFAULT_PUBLIC_KEY)];
+    for (const name of ordered) {
+        const path = home.join(home.dir, name);
+        const text = await readIfPresent(home.files, path);
+        if (text?.trim().startsWith('ssh-ed25519 '))
+            return path;
+    }
+    return null;
+}
+/** The managed `Host git.vibes.dev` block for `identityFile`. */
+export function renderSshConfigBlock(identityFile) {
+    return [
+        BLOCK_BEGIN,
+        `Host ${FORGE_SSH_HOST}`,
+        '  User git',
+        `  IdentityFile ${identityFile}`,
+        '  IdentitiesOnly yes',
+        '  StrictHostKeyChecking accept-new',
+        BLOCK_END
+    ].join('\n');
+}
+/**
+ * `existing` with the managed block set to `block`, or null when it already is.
+ *
+ * The block is placed FIRST: ssh takes the first value it finds for each
+ * option, so a block appended after a `Host *` stanza would be shadowed by it.
+ */
+export function mergeSshConfig(existing, block) {
+    const begin = existing.indexOf(BLOCK_BEGIN);
+    const end = existing.indexOf(BLOCK_END);
+    if (begin >= 0 && end > begin) {
+        const current = existing.slice(begin, end + BLOCK_END.length);
+        if (current === block)
+            return null;
+        return existing.slice(0, begin) + block + existing.slice(end + BLOCK_END.length);
+    }
+    const rest = existing.replace(/^\s+/, '');
+    return `${block}\n${rest ? `\n${rest}` : ''}`;
+}
+/** Create `~/.ssh` owner-only when it is missing; an existing directory keeps its mode. */
+async function ensureSshDir(home) {
+    if (await home.files.exists(home.dir))
+        return;
+    await home.files.mkdir(home.dir, { recursive: true });
+    await home.restrict(home.dir, 0o700);
+}
+async function generateKey(deps, home) {
+    await ensureSshDir(home);
+    const privateKey = home.join(home.dir, 'id_ed25519');
+    const result = await deps.exec('ssh-keygen', [
+        '-q',
+        '-t',
+        'ed25519',
+        '-N',
+        '',
+        '-C',
+        `vibes@${deps.hostname}`,
+        '-f',
+        privateKey
+    ]);
+    if (result.code !== 0) {
+        throw new Error(`ssh-keygen could not create ${privateKey}: ${result.stderr.trim() || `exit ${result.code}`}`);
+    }
+    return `${privateKey}.pub`;
+}
+async function registerKey(deps, home, publicKeyPath, fingerprint, check) {
+    const listed = await deps.send({ method: 'GET', path: '/api/account/ssh-keys' });
+    if (!listed.ok)
+        throw new Error(`could not list your Forge SSH keys: ${listed.message}`);
+    if (listed.data.results.some((key) => key.fingerprint === fingerprint))
+        return 'already';
+    if (check)
+        return 'missing';
+    const publicKey = (await readIfPresent(home.files, publicKeyPath))?.trim();
+    if (!publicKey)
+        throw new Error(`${publicKeyPath} disappeared before it could be registered`);
+    const created = await deps.send({
+        method: 'POST',
+        path: '/api/account/ssh-keys',
+        body: { name: deps.hostname, publicKey }
+    });
+    if (created.ok)
+        return 'now';
+    if (created.status === 409) {
+        throw new Error(`${publicKeyPath} is registered to a different Vibes account. Sign in as that account, or remove the key there.`);
+    }
+    throw new Error(`could not register ${publicKeyPath}: ${created.message}`);
+}
+/**
+ * Write the managed block into `~/.ssh/config`. The file is owner-only BEFORE
+ * the new text lands: a new config is created empty and restricted first,
+ * since the adapter cannot create a file with a mode.
+ */
+async function pinHost(home, identityFile, check) {
+    const path = home.join(home.dir, 'config');
+    const existing = await readIfPresent(home.files, path);
+    const next = mergeSshConfig(existing ?? '', renderSshConfigBlock(identityFile));
+    if (next === null)
+        return 'ready';
+    if (check)
+        return 'missing';
+    await ensureSshDir(home);
+    if (existing === null)
+        await home.files.writeFile(path, '');
+    await home.restrict(path, 0o600);
+    await home.files.writeFile(path, next);
+    return 'written';
+}
+/** Select or create, register, and pin. `check` reports without writing anything. */
+export async function ensureForgeSshIdentity(deps, options) {
+    const home = await deps.home();
+    let publicKey = await selectEd25519PublicKey(home);
+    let generated = false;
+    if (!publicKey) {
+        if (options.check) {
+            return {
+                ok: false,
+                publicKey: null,
+                fingerprint: null,
+                generated: false,
+                registered: 'missing',
+                sshConfig: 'missing',
+                problem: 'this machine has no ed25519 SSH key'
+            };
+        }
+        publicKey = await generateKey(deps, home);
+        generated = true;
+    }
+    const fingerprint = await fingerprintPublicKey(publicKey, deps.exec);
+    const registered = await registerKey(deps, home, publicKey, fingerprint, options.check);
+    const sshConfig = await pinHost(home, publicKey.replace(/\.pub$/, ''), options.check);
+    const ok = registered !== 'missing' && sshConfig !== 'missing';
+    const report = {
+        ok,
+        publicKey,
+        fingerprint,
+        generated,
+        registered,
+        sshConfig
+    };
+    if (!ok) {
+        report.problem = [
+            registered === 'missing' ? `${publicKey} is not registered with Forge` : null,
+            sshConfig === 'missing' ? `~/.ssh/config does not pin ${FORGE_SSH_HOST}` : null
+        ]
+            .filter(Boolean)
+            .join('; ');
+    }
+    return report;
+}
+/**
+ * The runtime's host-disk `filesystem/adapter`: enabled, not cloud-native, and
+ * able to read, write and list. The query goes to the adapter kind, never to a
+ * `filesystem/adapter-binding`: a workspace binding confines files to its
+ * workspace, and `~/.ssh` lies outside every workspace.
+ */
+async function resolveHostDiskFiles(runtime) {
+    if (!runtime.hasKind(FILESYSTEM_ADAPTER_KIND)) {
+        throw new Error(`No ${FILESYSTEM_ADAPTER_KIND} is registered on this runtime, so ~/.ssh cannot be read.`);
+    }
+    const wanted = `host-disk ${FILESYSTEM_ADAPTER_KIND} (enabled, not cloud-native, with ${HOST_DISK_CAPABILITIES.join(', ')})`;
+    const hostDisk = runtime.query(FILESYSTEM_ADAPTER_KIND).descriptors().find(isHostDisk);
+    if (!hostDisk)
+        throw new Error(`No ${wanted} is registered on this runtime, so ~/.ssh cannot be read.`);
+    let resolved;
+    try {
+        resolved = await runtime.query(FILESYSTEM_ADAPTER_KIND).withId(hostDisk.id).resolve();
+    }
+    catch (error) {
+        throw new CapabilityError(`The ${wanted} '${hostDisk.id}' did not load, so ~/.ssh cannot be read: ${describeError(CaughtFailureSchema.parse(error))}`, 'UNAVAILABLE', {
+            cause: error,
+            reason: 'filesystem-adapter-load-failed'
+        });
+    }
+    const files = SshFilesSchema.safeParse(resolved);
+    if (!files.success) {
+        throw new Error(`The runtime's ${FILESYSTEM_ADAPTER_KIND} does not implement ${SSH_FILE_OPERATIONS.join(', ')}.`);
+    }
+    return files.data;
+}
+/** `~/.ssh` under the runtime's path-roots user home, joined by its path service. */
+export async function resolveSshHome(runtime) {
+    const path = await getRuntimePath(runtime);
+    return {
+        dir: path.join(getPathRoots(runtime).userHome, '.ssh'),
+        join: (...segments) => path.join(...segments),
+        files: await resolveHostDiskFiles(runtime),
+        restrict: async (target, mode) => {
+            // SAFETY: RuntimeRef in CLI execution context is a full VibesRuntime instance.
+            const adapter = await resolveFileSystemAdapter(runtime, { binding: false });
+            await chmodChecked(adapter, target, mode);
+        }
+    };
+}
+/** Production dependencies: the handed runtime's `~/.ssh`, real `ssh-keygen`, the Forge API. */
+export function defaultSshIdentityDeps(runtime) {
+    const host = runtime.localEnvironment.getHostname?.() || 'localhost';
+    return {
+        home: () => resolveSshHome(runtime),
+        hostname: host.replace(/\.local$/, ''),
+        exec: runtimeExec(runtime),
+        send: (spec) => sendForgeRequest(runtime, spec)
+    };
+}
+//# sourceMappingURL=ssh-identity.js.map

package/dist/cli/lib/ssh-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-identity.js","sourceRoot":"","sources":["../../../src/cli/lib/ssh-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAA0D,MAAM,qBAAqB,CAAC;AACnI,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAiB,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAqC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,QAAQ,CAAC;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAmE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,QAAQ,CAAC;IACpH,IAAI,EAAE,CAAC,CAAC,MAAM,CAAmE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,QAAQ,CAAC;IAChH,KAAK,EAAE,CAAC,CAAC,MAAM,CAAmE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,QAAQ,CAAC;IACjH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAgD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,QAAQ,CAAC;CAClG,CAAC,CAAC;AAmCH,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAU,CAAC;AAE1F,6DAA6D;AAC7D,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAElE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,+EAA+E;AAC/E,SAAS,UAAU,CAAC,UAAmB;IACtC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAChE,OAAO,CACN,OAAO,KAAK,KAAK;QACjB,WAAW,KAAK,IAAI;QACpB,sBAAsB,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC/E,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAoB;IAC1C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,aAAa,CAAC,KAAe,EAAE,IAAY;IACzD,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,oEAAoE;QACpE,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjE,MAAM,IAAI,eAAe,CAAC,eAAe,IAAI,KAAK,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE;YACnH,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sBAAsB;SAC9B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,OAA8C,CAAC;IACnD,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,oEAAoE;QACpE,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACzG,MAAM,IAAI,eAAe,CAAC,eAAe,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE;YACvH,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sBAAsB;SAC9B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO;SACZ,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE,CAAC;AACV,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAa;IACzD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC;IAC7F,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACxD,OAAO;QACN,WAAW;QACX,QAAQ,cAAc,EAAE;QACxB,YAAY;QACZ,kBAAkB,YAAY,EAAE;QAChC,sBAAsB;QACtB,oCAAoC;QACpC,SAAS;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,YAAY,CAAC,IAAa;IACxC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAqB,EAAE,IAAa;IAC9D,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;QAC5C,IAAI;QACJ,IAAI;QACJ,SAAS;QACT,IAAI;QACJ,EAAE;QACF,IAAI;QACJ,SAAS,IAAI,CAAC,QAAQ,EAAE;QACxB,IAAI;QACJ,UAAU;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,GAAG,UAAU,MAAM,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,IAAqB,EACrB,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,KAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,4CAA4C,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAuB;QACrD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE;KACxC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACd,GAAG,aAAa,gGAAgG,CAChH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,aAAa,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,IAAa,EAAE,YAAoB,EAAE,KAAc;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,IAAI,EAAE,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,QAAQ,KAAK,IAAI;QAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,IAAqB,EACrB,OAA2B;IAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,SAAS;gBACpB,OAAO,EAAE,qCAAqC;aAC9C,CAAC;QACH,CAAC;QACD,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,SAAS,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,CAAC;IAC/D,MAAM,MAAM,GAAsB;QACjC,EAAE;QACF,SAAS;QACT,WAAW;QACX,SAAS;QACT,UAAU;QACV,SAAS;KACT,CAAC;IACF,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,CAAC,OAAO,GAAG;YAChB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,+BAA+B,CAAC,CAAC,CAAC,IAAI;YAC7E,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI;SAC/E;aACC,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAmB;IACtD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,MAAM,uBAAuB,2DAA2D,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,uBAAuB,qCAAqC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC7H,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,MAAM,2DAA2D,CAAC,CAAC;IACxG,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAE,6CAA6C,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE;YACrK,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gCAAgC;SACxC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,iBAAiB,uBAAuB,uBAAuB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAmB;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO;QACN,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC;QACtD,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;QAC7C,KAAK,EAAE,MAAM,oBAAoB,CAAC,OAAO,CAAC;QAC1C,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAChC,+EAA+E;YAC/E,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAuB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;KACD,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,OAAqB;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,IAAI,WAAW,CAAC;IACrE,OAAO;QACN,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;QACnC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QACtC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC;KAC/C,CAAC;AACH,CAAC"}

package/dist/cli/lib/ssh-key-source.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Local SSH key resolution for forge-cli (key add + credential-helper signing).
+ *
+ * The PRIVATE key never leaves the machine. `add` reads the PUBLIC key file and
+ * uploads it; the credential-helper shells out to `ssh-keygen -Y sign` against a
+ * signing-key selector to produce an SSHSIG over the server nonce — only that
+ * signature crosses the wire. A PUBLIC key selector lets OpenSSH use the matching
+ * key already loaded in ssh-agent without reading or prompting for the private key.
+ *
+ * Default key path mirrors OpenSSH's own default public identity,
+ * `~/.ssh/id_ed25519.pub`, under the runtime's path-roots user home. Override
+ * with `--key <path>`.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+/**
+ * Where `~` and a relative `--key` resolve: the runtime's path-roots user home
+ * and the invocation's working directory. Nothing reads `homedir()` or
+ * `process.cwd()`.
+ */
+export interface KeyPathBase {
+    readonly userHome: string;
+    readonly cwd: string;
+}
+/** The key path base of `runtime`: `getPathRoots(runtime).userHome` and the host cwd. */
+export declare function keyPathBase(runtime: VibesRuntime): KeyPathBase;
+/** The default OpenSSH Ed25519 identity (private key path; `.pub` = public). */
+export declare function defaultPrivateKeyPath(userHome: string): string;
+export declare function defaultPublicKeyPath(userHome: string): string;
+/** Expand a leading `~` and resolve to an absolute path. */
+export declare function resolveKeyPath(input: string, base: KeyPathBase): string;
+/**
+ * Resolve the key selector the credential-helper signs with. Honors an explicit
+ * `--key` pointing at either a private key or its `.pub` sibling. A public key path
+ * MUST remain public: `ssh-keygen -Y sign -f <public-key>` delegates to ssh-agent,
+ * avoiding an invisible passphrase prompt in this non-interactive CLI.
+ */
+export declare function resolveSigningKeyPath(keyOpt: string | undefined, base: KeyPathBase): string;
+/**
+ * Resolve the PUBLIC key path for `ssh-key add`. Honors `--key` (a trailing `.pub`
+ * is added when missing), else the default `~/.ssh/id_ed25519.pub`.
+ */
+export declare function resolvePublicKeyPath(keyOpt: string | undefined, base: KeyPathBase): string;
+/** The `.pub` sibling of an already-resolved key selector (a `.pub` path stays as-is). */
+export declare function publicKeyPathOf(keyPath: string): string;
+/** A minimal SSH key shape the resolver matches against (subset of the wire type). */
+export interface SshKeyRef {
+    id: string;
+    name: string;
+    fingerprint: string;
+}
+/**
+ * Resolve a `<key>` ref (id | `SHA256:...` fingerprint | name) to a single key id.
+ * PURE — the caller fetches the owner's keys and passes them in, so this is
+ * directly unit-testable. Throws on no-match and on an ambiguous name (two keys
+ * sharing a label), so a `remove` never deletes the wrong key.
+ */
+export declare function matchSshKey(ref: string, keys: SshKeyRef[]): string;
+/** Read + trim a public key file. Throws a friendly error when it's missing. */
+export declare function readPublicKeyFile(path: string, runtime: VibesRuntime): Promise<string>;
+//# sourceMappingURL=ssh-key-source.d.ts.map

package/dist/cli/lib/ssh-key-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-key-source.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/ssh-key-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE5F;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,yFAAyF;AACzF,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,WAAW,CAE9D;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAG3F;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAG1F;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACpB;AAID;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,CAkBlE;AAED,gFAAgF;AAChF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5F"}

package/dist/cli/lib/ssh-key-source.js

@@ -0,0 +1,104 @@
+/**
+ * Local SSH key resolution for forge-cli (key add + credential-helper signing).
+ *
+ * The PRIVATE key never leaves the machine. `add` reads the PUBLIC key file and
+ * uploads it; the credential-helper shells out to `ssh-keygen -Y sign` against a
+ * signing-key selector to produce an SSHSIG over the server nonce — only that
+ * signature crosses the wire. A PUBLIC key selector lets OpenSSH use the matching
+ * key already loaded in ssh-agent without reading or prompting for the private key.
+ *
+ * Default key path mirrors OpenSSH's own default public identity,
+ * `~/.ssh/id_ed25519.pub`, under the runtime's path-roots user home. Override
+ * with `--key <path>`.
+ */
+import { isAbsolute, join, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { getPathRoots } from '@vibesdotdev/paths';
+import { requireRuntimeCwd, CapabilityError } from '@vibesdotdev/kernel';
+/** The key path base of `runtime`: `getPathRoots(runtime).userHome` and the host cwd. */
+export function keyPathBase(runtime) {
+    return { userHome: getPathRoots(runtime).userHome, cwd: requireRuntimeCwd(runtime) };
+}
+/** The default OpenSSH Ed25519 identity (private key path; `.pub` = public). */
+export function defaultPrivateKeyPath(userHome) {
+    return join(userHome, '.ssh', 'id_ed25519');
+}
+export function defaultPublicKeyPath(userHome) {
+    return `${defaultPrivateKeyPath(userHome)}.pub`;
+}
+/** Expand a leading `~` and resolve to an absolute path. */
+export function resolveKeyPath(input, base) {
+    if (input.startsWith('~/'))
+        return join(base.userHome, input.slice(2));
+    if (input === '~')
+        return base.userHome;
+    return isAbsolute(input) ? input : join(base.cwd, input);
+}
+/**
+ * Resolve the key selector the credential-helper signs with. Honors an explicit
+ * `--key` pointing at either a private key or its `.pub` sibling. A public key path
+ * MUST remain public: `ssh-keygen -Y sign -f <public-key>` delegates to ssh-agent,
+ * avoiding an invisible passphrase prompt in this non-interactive CLI.
+ */
+export function resolveSigningKeyPath(keyOpt, base) {
+    if (!keyOpt)
+        return defaultPublicKeyPath(base.userHome);
+    return resolveKeyPath(keyOpt, base);
+}
+/**
+ * Resolve the PUBLIC key path for `ssh-key add`. Honors `--key` (a trailing `.pub`
+ * is added when missing), else the default `~/.ssh/id_ed25519.pub`.
+ */
+export function resolvePublicKeyPath(keyOpt, base) {
+    if (!keyOpt)
+        return defaultPublicKeyPath(base.userHome);
+    return publicKeyPathOf(resolveKeyPath(keyOpt, base));
+}
+/** The `.pub` sibling of an already-resolved key selector (a `.pub` path stays as-is). */
+export function publicKeyPathOf(keyPath) {
+    return keyPath.endsWith('.pub') ? keyPath : `${keyPath}.pub`;
+}
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Resolve a `<key>` ref (id | `SHA256:...` fingerprint | name) to a single key id.
+ * PURE — the caller fetches the owner's keys and passes them in, so this is
+ * directly unit-testable. Throws on no-match and on an ambiguous name (two keys
+ * sharing a label), so a `remove` never deletes the wrong key.
+ */
+export function matchSshKey(ref, keys) {
+    const trimmed = ref.trim();
+    if (UUID_RE.test(trimmed))
+        return trimmed; // an id is used as-is
+    if (trimmed.startsWith('SHA256:')) {
+        const byFp = keys.filter((k) => k.fingerprint === trimmed);
+        if (byFp.length === 1)
+            return byFp[0].id;
+        if (byFp.length === 0)
+            throw new Error(`No SSH key with fingerprint "${trimmed}".`);
+        // fingerprints are UNIQUE server-side, so >1 is impossible, but fail safe.
+        throw new Error(`Fingerprint "${trimmed}" matched multiple keys; pass the id.`);
+    }
+    const byName = keys.filter((k) => k.name === trimmed);
+    if (byName.length === 1)
+        return byName[0].id;
+    if (byName.length === 0)
+        throw new Error(`No SSH key named "${trimmed}".`);
+    throw new Error(`Name "${trimmed}" matched ${byName.length} keys; pass the id or fingerprint to disambiguate.`);
+}
+/** Read + trim a public key file. Throws a friendly error when it's missing. */
+export async function readPublicKeyFile(path, runtime) {
+    try {
+        const fs = await resolveFileSystemAdapter(runtime, { binding: false });
+        const raw = await fs.readFile(path, 'utf8');
+        const contents = raw instanceof Uint8Array ? new TextDecoder().decode(raw) : String(raw);
+        const line = contents.trim();
+        if (!line)
+            throw new Error('file is empty');
+        return line;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new CapabilityError(`Could not read SSH public key at ${path}: ${message}. ` +
+            `Pass --key <path> or generate one with \`ssh-keygen -t ed25519\`.`, 'INVALID_INPUT', { cause: err, reason: 'ssh-public-key-unreadable' });
+    }
+}
+//# sourceMappingURL=ssh-key-source.js.map

package/dist/cli/lib/ssh-key-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-key-source.js","sourceRoot":"","sources":["../../../src/cli/lib/ssh-key-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAY5F,yFAAyF;AACzF,MAAM,UAAU,WAAW,CAAC,OAAqB;IAChD,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACrD,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACpD,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC;AACjD,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAiB;IAC9D,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;IACxC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B,EAAE,IAAiB;IAClF,IAAI,CAAC,MAAM;QAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B,EAAE,IAAiB;IACjF,IAAI,CAAC,MAAM;QAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,eAAe,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAAC,OAAe;IAC9C,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC;AAC9D,CAAC;AASD,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAiB;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,sBAAsB;IAEjE,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,IAAI,CAAC,CAAC;QACpF,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,uCAAuC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,IAAI,CAAC,CAAC;IAC3E,MAAM,IAAI,KAAK,CACd,SAAS,OAAO,aAAa,MAAM,CAAC,MAAM,oDAAoD,CAC9F,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAqB;IAC1E,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,eAAe,CACxB,oCAAoC,IAAI,KAAK,OAAO,IAAI;YACvD,mEAAmE,EACpE,eAAe,EACf,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,2BAA2B,EAAE,CACnD,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/cli/lib/ssh-keygen.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Thin wrappers over the local `ssh-keygen` binary for the credential-helper.
+ *
+ * We deliberately shell out to `ssh-keygen -Y sign` rather than reimplementing
+ * SSHSIG signing in JS: the produced bytes are then BYTE-FOR-BYTE the format the
+ * platform verifier was golden-vector-tested against (`ssh-keygen -Y sign -n
+ * vibes-git`). The fingerprint comes from `ssh-keygen -lf <pub>`, matching the
+ * `SHA256:...` form the server stores and resolves by.
+ *
+ * The `exec` boundary is injectable so the flow is unit-testable without a real
+ * ssh-keygen (and so a CI box without ssh-keygen fails with a clear message rather
+ * than a crash).
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+/** The SSHSIG namespace — MUST match the platform verifier's pin. */
+export declare const SSHSIG_NAMESPACE = "vibes-git";
+export interface ExecResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+/**
+ * Injectable exec: run a command with args + optional stdin, capture output.
+ *
+ * `cwd` sets the spawned process's working directory. It matters for tools that
+ * read config/overrides from the CWD rather than from a flag — notably `npm`,
+ * which resolves a project's `package.json` `overrides` and `.npmrc` hierarchy
+ * from its CWD (so `--prefix` alone does NOT isolate it from a surrounding
+ * repository). `git` callers instead use `git -C <dir>`, so they pass no `cwd`.
+ *
+ * `env` merges additional env vars into the subprocess environment. Used by the
+ * registry smoke to inject the publish token into npm's env without writing it
+ * to disk or passing it via argv (secrets leverage contract).
+ */
+export type ExecLike = (command: string, args: string[], stdin?: string | Record<string, string>, cwd?: string) => Promise<ExecResult>;
+export declare function runtimeExec(runtime: VibesRuntime): ExecLike;
+/**
+ * Compute the `SHA256:...` fingerprint of a public key file via `ssh-keygen -lf`.
+ * Parses the second whitespace field of the output (`<bits> SHA256:... comment`).
+ */
+export declare function fingerprintPublicKey(publicKeyPath: string, exec: ExecLike): Promise<string>;
+/**
+ * Produce an armored SSHSIG over `message` using `signingKeyPath`, with namespace
+ * `vibes-git`. The selector may be a private key or a public key whose private half
+ * is loaded in ssh-agent. Signs stdin (`-Y sign -f key -`) so no temp file is
+ * written. The returned blob is exactly what `/api/git-auth/verify` expects.
+ */
+export declare function signSshSig(signingKeyPath: string, message: string, exec: ExecLike): Promise<string>;
+//# sourceMappingURL=ssh-keygen.d.ts.map

package/dist/cli/lib/ssh-keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-keygen.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/ssh-keygen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAA8D,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKpH,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,QAAQ,GAAG,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,GAAG,CAAC,EAAE,MAAM,KACR,OAAO,CAAC,UAAU,CAAC,CAAC;AAYzB,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,CAsB3D;AAgBD;;;GAGG;AACH,wBAAsB,oBAAoB,CACzC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,QAAQ,GACZ,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC/B,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,QAAQ,GACZ,OAAO,CAAC,MAAM,CAAC,CAcjB"}