@wrongstack/cli 1.0.19 → 1.0.26

package/dist/remote/remote-session.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `wstack remote user@host:/path`: the agent, its tools and its project
+ * daemons run on the remote machine; the WebUI is opened locally through an
+ * SSH tunnel. WrongStack's own build is uploaded to the remote on first use
+ * (per version, next to nothing the user installed), the WebUI host is started
+ * detached so a dropped connection does not end it, and the tunnel is reopened
+ * when it drops.
+ *
+ * SSH is the system `ssh`, so the user's `~/.ssh/config`, agent and known
+ * hosts apply. Credentials are not copied: the remote WrongStack uses its own
+ * configuration, which the remote WebUI sets up like a local first run.
+ *
+ * @module remote/remote-session
+ */
+import { type ChildProcess } from 'node:child_process';
+import type { Readable } from 'node:stream';
+import { type RemoteTarget } from './remote-target.js';
+export interface SshResult {
+    code: number;
+    stdout: string;
+}
+/** Runs one command on the remote host; `input` is its stdin. */
+export type SshRunner = (remoteCommand: string, input: string | Readable) => Promise<SshResult>;
+/** Opens the tunnel; the returned process lives as long as the tunnel does. */
+export type TunnelOpener = (localPort: number, remotePort: number) => ChildProcess;
+export interface RemoteBinary {
+    file: string;
+    /** Names the build on the remote machine. */
+    version: string;
+}
+export interface RemoteSessionOptions {
+    target: RemoteTarget;
+    /** Preferred local port for the WebUI (the next free one is used). */
+    localPort: number;
+    /** Leave the remote WebUI running after this command ends. */
+    keep: boolean;
+    open: boolean;
+    signal: AbortSignal;
+    log: (line: string) => void;
+    ssh: SshRunner;
+    tunnel: TunnelOpener;
+    /** The build for a remote `buildTarget` (`bun-linux-x64`, …); may download it. */
+    resolveBinary: (buildTarget: string, installed: readonly string[]) => Promise<RemoteBinary>;
+    openUrl?: ((url: string) => void) | undefined;
+    /** Waits before a reconnect attempt; injected in tests. */
+    sleep?: ((ms: number) => Promise<void>) | undefined;
+    /** How long the WebUI gets to answer through a new tunnel. */
+    readyTimeoutMs?: number | undefined;
+}
+export declare function sha256File(file: string): Promise<string>;
+/** The first free port at or above `start` on the local loopback. */
+export declare function freeLocalPort(start: number): Promise<number>;
+export declare function runRemoteSession(opts: RemoteSessionOptions): Promise<number>;
+export declare function systemSsh(target: RemoteTarget, options: {
+    sshConfig?: string | undefined;
+    batch: boolean;
+}): {
+    run: SshRunner;
+    tunnel: TunnelOpener;
+};
+/** Cached download location for release builds. */
+export declare function releaseCacheFile(root: string, version: string, assetName: string): string;
+export declare function cachedFile(file: string): Promise<string | undefined>;
+//# sourceMappingURL=remote-session.d.ts.map

package/dist/remote/remote-target.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The pure half of `wstack remote`: where to connect, which build the remote
+ * machine needs, and the POSIX sh scripts run there. No process is started
+ * here, so all of it is testable without an SSH server.
+ *
+ * @module remote/remote-target
+ */
+export interface RemoteTarget {
+    /** What `ssh` connects to: `user@host`, `host`, or a `~/.ssh/config` alias. */
+    destination: string;
+    port?: number | undefined;
+    /** Project directory on the remote machine. */
+    path: string;
+}
+/**
+ * `user@host:/path`, `host:~/path`, or `ssh://user@host:2222/path`. The path
+ * is required: it is the remote project the agent works in.
+ */
+export declare function parseRemoteTarget(input: string): RemoteTarget;
+/** One argument for a POSIX shell, single-quoted. */
+export declare function shQuote(value: string): string;
+/**
+ * The build for a machine, from `uname -s`, `uname -m` and whether its libc is
+ * musl. Windows hosts are not supported: the remote scripts are POSIX sh.
+ */
+export declare function buildTargetFor(os: string, arch: string, musl: boolean): string;
+export interface ProbeResult {
+    os: string;
+    arch: string;
+    musl: boolean;
+    pathExists: boolean;
+    /** Versions already installed under `~/.wrongstack/remote`. */
+    versions: string[];
+    /** A server a previous run left running for this path. */
+    server?: {
+        pid: number;
+        port: number;
+        version: string;
+        token: string;
+    } | undefined;
+}
+/** Reports the machine, the project path, the builds present and a running server. */
+export declare function probeScript(path: string): string;
+export declare function parseProbe(output: string): ProbeResult;
+/** The remote file a version's build lives in. */
+export declare function remoteBinaryPath(version: string): string;
+/**
+ * Receives a build on stdin, makes it executable, and prints its SHA-256 so
+ * the caller can compare it with what it sent. Run with `sh -c`.
+ */
+export declare function installScript(version: string): string;
+/**
+ * Starts the WebUI host for `path` detached from the SSH session (a dropped
+ * connection must not end it), bound to the remote loopback only, and waits
+ * for it to report its port. The token travels inside this script, which is
+ * sent on stdin: it never appears on a command line another user can see.
+ *
+ * A remote machine WrongStack has not been set up on has no provider it can
+ * use; the host is then started in setup mode, and one is chosen in the WebUI.
+ */
+export declare function startScript(options: {
+    path: string;
+    version: string;
+    token: string;
+    preferredPort: number;
+}): string;
+/** Stops the server a start left for `path`, if it is still running. */
+export declare function stopScript(path: string): string;
+//# sourceMappingURL=remote-target.d.ts.map

package/dist/remote-O5WXHLWV.js

@@ -0,0 +1,561 @@
+import {
+  MAX_BINARY_BYTES,
+  downloadReleaseAssetToFile,
+  findStandaloneRelease,
+  verifyStandaloneDigest
+} from "./chunk-X756ZS72.js";
+import {
+  CLI_VERSION,
+  STANDALONE_TARGET
+} from "./chunk-F5DCFAKI.js";
+import {
+  openBrowser
+} from "./chunk-DAKVBMD4.js";
+
+// src/subcommands/handlers/remote.ts
+import * as fsp2 from "node:fs/promises";
+import * as path2 from "node:path";
+import { isStandaloneBinary, toErrorMessage as toErrorMessage2, wstackGlobalRoot } from "@wrongstack/core/utils";
+
+// src/remote/remote-session.ts
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createReadStream, existsSync } from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as net from "node:net";
+import * as path from "node:path";
+import { buildChildEnv, toErrorMessage } from "@wrongstack/core/utils";
+
+// src/remote/remote-target.ts
+function parseRemoteTarget(input) {
+  const text = input.trim();
+  if (text.startsWith("ssh://")) {
+    let url;
+    try {
+      url = new URL(text);
+    } catch {
+      throw new Error(`Not a valid ssh:// address: ${text}`);
+    }
+    const user = url.username ? `${decodeURIComponent(url.username)}@` : "";
+    const path4 = decodeURIComponent(url.pathname);
+    if (!url.hostname || !path4 || path4 === "/") {
+      throw new Error(`Give the remote project directory: ssh://user@host/path (got ${text})`);
+    }
+    return {
+      destination: `${user}${url.hostname}`,
+      ...url.port ? { port: Number(url.port) } : {},
+      path: path4
+    };
+  }
+  const colon = text.indexOf(":");
+  const destination = colon > 0 ? text.slice(0, colon) : "";
+  const path3 = colon > 0 ? text.slice(colon + 1) : "";
+  if (!destination || !path3 || /\s/.test(destination)) {
+    throw new Error(`Give the remote as user@host:/path/to/project (got ${text || "nothing"})`);
+  }
+  return { destination, path: path3 };
+}
+function shQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function shPath(path3) {
+  if (path3 === "~") return '"$HOME"';
+  if (path3.startsWith("~/")) return `"$HOME"/${shQuote(path3.slice(2))}`;
+  return shQuote(path3);
+}
+function buildTargetFor(os, arch, musl) {
+  const system = os.trim().toLowerCase();
+  const machine = arch.trim().toLowerCase();
+  const cpu = machine === "x86_64" || machine === "amd64" ? "x64" : machine === "aarch64" || machine === "arm64" ? "arm64" : void 0;
+  if (!cpu) throw new Error(`No WrongStack build for a ${arch} remote machine.`);
+  if (system === "linux") return `bun-linux-${cpu}${musl ? "-musl" : ""}`;
+  if (system === "darwin") return `bun-darwin-${cpu}`;
+  throw new Error(`Remote machines running ${os} are not supported (Linux and macOS are).`);
+}
+var REMOTE_BIN_DIR = '"$HOME"/.wrongstack/remote';
+function probeScript(path3) {
+  return `set -u
+printf 'os=%s\\n' "$(uname -s 2>/dev/null)"
+printf 'arch=%s\\n' "$(uname -m 2>/dev/null)"
+if ls /lib/ld-musl-* >/dev/null 2>&1; then echo musl=1; else echo musl=0; fi
+dir=${shPath(path3)}
+if [ -d "$dir" ]; then echo path=1; else echo path=0; fi
+for f in ${REMOTE_BIN_DIR}/wstack-*; do
+  [ -x "$f" ] && printf 'version=%s\\n' "\${f##*/wstack-}"
+done
+state="$dir/.wrongstack/remote-webui.json"
+if [ -f "$state" ] && [ -f "$dir/.wrongstack/remote-webui.token" ]; then
+  pid=$(sed -n 's/.*"pid":\\([0-9]*\\).*/\\1/p' "$state")
+  if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+    printf 'server=%s\\n' "$(tr -d '\\n' < "$state")"
+    printf 'token=%s\\n' "$(cat "$dir/.wrongstack/remote-webui.token")"
+  fi
+fi
+`;
+}
+function parseProbe(output) {
+  const values = /* @__PURE__ */ new Map();
+  for (const line of output.split(/\r?\n/)) {
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq);
+    values.set(key, [...values.get(key) ?? [], line.slice(eq + 1)]);
+  }
+  const one = (key) => values.get(key)?.[0] ?? "";
+  let server;
+  try {
+    const state = JSON.parse(one("server") || "null");
+    const token = one("token");
+    if (state && typeof state.pid === "number" && typeof state.port === "number" && typeof state.version === "string" && token) {
+      server = { pid: state.pid, port: state.port, version: state.version, token };
+    }
+  } catch {
+    server = void 0;
+  }
+  return {
+    os: one("os"),
+    arch: one("arch"),
+    musl: one("musl") === "1",
+    pathExists: one("path") === "1",
+    versions: values.get("version") ?? [],
+    ...server ? { server } : {}
+  };
+}
+function remoteBinaryPath(version) {
+  return `${REMOTE_BIN_DIR}/${shQuote(`wstack-${version}`)}`;
+}
+function installScript(version) {
+  const target = remoteBinaryPath(version);
+  return `set -eu
+mkdir -p ${REMOTE_BIN_DIR}
+chmod 700 ${REMOTE_BIN_DIR}
+part=${REMOTE_BIN_DIR}/.upload-$$
+cat > "$part"
+chmod 700 "$part"
+sum=$( (sha256sum "$part" 2>/dev/null || shasum -a 256 "$part") | cut -d' ' -f1)
+mv -f "$part" ${target}
+echo "sha256=$sum"
+`;
+}
+var NO_PROVIDER = ["No provider or model configured", "Saved provider/model is no longer usable"];
+function startScript(options) {
+  const bin = remoteBinaryPath(options.version);
+  return `set -u
+dir=${shPath(options.path)}
+cd "$dir" || { echo error=path; exit 3; }
+umask 077
+mkdir -p .wrongstack
+printf '%s' ${shQuote(options.token)} > .wrongstack/remote-webui.token
+log=.wrongstack/remote-webui.log
+export WEBUI_TOKEN=${shQuote(options.token)}
+launch() {
+  : > "$log"
+  if command -v setsid >/dev/null 2>&1; then
+    nohup setsid ${bin} --webui --host 127.0.0.1 --port ${options.preferredPort} "$@" > "$log" 2>&1 < /dev/null &
+  else
+    nohup ${bin} --webui --host 127.0.0.1 --port ${options.preferredPort} "$@" > "$log" 2>&1 < /dev/null &
+  fi
+  pid=$!
+}
+# 0: running and "port" is set, 1: the host exited, 2: no port in time.
+await_port() {
+  i=0
+  while [ "$i" -lt 240 ]; do
+    port=$(sed -n 's/.*WebUI running.*127\\.0\\.0\\.1:\\([0-9][0-9]*\\).*/\\1/p' "$log" | head -n 1)
+    [ -n "$port" ] && return 0
+    kill -0 "$pid" 2>/dev/null || return 1
+    sleep 0.5
+    i=$((i + 1))
+  done
+  return 2
+}
+launch
+await_port
+state=$?
+if [ "$state" -eq 1 ] && grep -q ${NO_PROVIDER.map((line) => `-e ${shQuote(line)}`).join(" ")} "$log"; then
+  echo setup=1
+  launch --provider wrongstack-setup --model no-api-key
+  await_port
+  state=$?
+fi
+if [ "$state" -eq 0 ]; then
+  printf '{"pid":%s,"port":%s,"version":"%s"}\\n' "$pid" "$port" ${shQuote(options.version)} > .wrongstack/remote-webui.json
+  echo "port=$port"
+  echo "pid=$pid"
+  exit 0
+fi
+rm -f .wrongstack/remote-webui.token
+if [ "$state" -eq 1 ]; then
+  echo error=exited
+  tail -n 30 "$log" | sed 's/^/log=/'
+  exit 4
+fi
+kill "$pid" 2>/dev/null
+echo error=timeout
+exit 5
+`;
+}
+function stopScript(path3) {
+  return `set -u
+dir=${shPath(path3)}
+state="$dir/.wrongstack/remote-webui.json"
+[ -f "$state" ] || exit 0
+pid=$(sed -n 's/.*"pid":\\([0-9]*\\).*/\\1/p' "$state")
+[ -n "$pid" ] && kill "$pid" 2>/dev/null
+rm -f "$state" "$dir/.wrongstack/remote-webui.token"
+echo stopped=1
+`;
+}
+
+// src/remote/remote-session.ts
+var RECONNECT_DELAYS_MS = [1e3, 2e3, 4e3, 8e3, 15e3, 3e4];
+var READY_TIMEOUT_MS = 3e4;
+async function sha256File(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file)) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function freeLocalPort(start) {
+  for (let port = start; port < start + 200; port++) {
+    const free = await new Promise((resolve2) => {
+      const server = net.createServer();
+      server.once("error", () => resolve2(false));
+      server.listen(port, "127.0.0.1", () => server.close(() => resolve2(true)));
+    });
+    if (free) return port;
+  }
+  throw new Error(`No free local port from ${start} to ${start + 199}.`);
+}
+var REMOTE_ERRORS = {
+  path: "cannot enter the project directory",
+  exited: "the WrongStack host exited",
+  timeout: "the WrongStack host did not report its port within two minutes"
+};
+function sshError(step, result) {
+  const lines = result.stdout.split(/\r?\n/);
+  const code = lines.find((line) => line.startsWith("error="))?.slice("error=".length);
+  const log = lines.filter((line) => line.startsWith("log=")).map((line) => line.slice(4));
+  const reason = code ? REMOTE_ERRORS[code] ?? code : `ssh exited with ${result.code}`;
+  const detail = log.length > 0 ? `:
+${log.join("\n")}` : code ? "." : ". See the ssh message above.";
+  return new Error(`Remote ${step} failed: ${reason}${detail}`);
+}
+async function ensureBinary(opts, probe) {
+  const buildTarget = buildTargetFor(probe.os, probe.arch, probe.musl);
+  const binary = await opts.resolveBinary(buildTarget, probe.versions);
+  if (probe.versions.includes(binary.version)) return binary;
+  opts.log(
+    `Uploading WrongStack ${binary.version} (${buildTarget}) to ${opts.target.destination}\u2026`
+  );
+  const sent = await sha256File(binary.file);
+  const result = await opts.ssh(
+    `sh -c ${shQuote(installScript(binary.version))}`,
+    createReadStream(binary.file)
+  );
+  const received = /^sha256=([a-f0-9]{64})$/m.exec(result.stdout)?.[1];
+  if (result.code !== 0 || !received) throw sshError("upload", result);
+  if (received !== sent) {
+    throw new Error("The build that arrived on the remote machine does not match the one sent.");
+  }
+  return binary;
+}
+async function ensureServer(opts, probe, binary) {
+  if (probe.server && probe.server.version === binary.version) {
+    opts.log(`Reusing the WrongStack host already running on ${opts.target.destination}.`);
+    return { port: probe.server.port, token: probe.server.token };
+  }
+  if (probe.server) await opts.ssh("sh -s", stopScript(opts.target.path));
+  const token = randomBytes(24).toString("base64url");
+  opts.log(`Starting WrongStack on ${opts.target.destination}:${opts.target.path}\u2026`);
+  const result = await opts.ssh(
+    "sh -s",
+    startScript({ path: opts.target.path, version: binary.version, token, preferredPort: 3456 })
+  );
+  if (/^setup=1$/m.test(result.stdout)) {
+    opts.log("No usable provider is set up there yet; choose one in the WebUI.");
+  }
+  const port = Number(/^port=(\d+)$/m.exec(result.stdout)?.[1]);
+  if (result.code !== 0 || !Number.isInteger(port) || port <= 0) {
+    throw sshError("start", result);
+  }
+  return { port, token };
+}
+async function probeRemote(opts) {
+  const result = await opts.ssh("sh -s", probeScript(opts.target.path));
+  if (result.code !== 0) throw sshError("connection", result);
+  const probe = parseProbe(result.stdout);
+  if (!probe.pathExists) {
+    throw new Error(`${opts.target.path} does not exist on ${opts.target.destination}.`);
+  }
+  return probe;
+}
+async function waitForWebui(localPort, token, tunnel, signal, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline && tunnel.exitCode === null && !signal.aborted) {
+    try {
+      const res = await fetch(`http://127.0.0.1:${localPort}/ws-auth`, {
+        headers: { "X-WS-Token": token },
+        signal: AbortSignal.timeout(3e3)
+      });
+      if (res.ok) return true;
+    } catch {
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, 400));
+  }
+  return false;
+}
+function exited(child) {
+  return child.exitCode !== null ? Promise.resolve(child.exitCode) : new Promise((resolve2) => child.once("exit", (code) => resolve2(code ?? 1)));
+}
+async function runRemoteSession(opts) {
+  const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let probe = await probeRemote(opts);
+  const binary = await ensureBinary(opts, probe);
+  let server = await ensureServer(opts, probe, binary);
+  const localPort = await freeLocalPort(opts.localPort);
+  let announced = "";
+  let failures = 0;
+  try {
+    while (!opts.signal.aborted) {
+      const tunnel = opts.tunnel(localPort, server.port);
+      const stopTunnel = () => tunnel.kill();
+      opts.signal.addEventListener("abort", stopTunnel, { once: true });
+      const ready = await waitForWebui(
+        localPort,
+        server.token,
+        tunnel,
+        opts.signal,
+        opts.readyTimeoutMs ?? READY_TIMEOUT_MS
+      );
+      if (!ready && !opts.signal.aborted) {
+        tunnel.kill();
+        if (!announced) {
+          await exited(tunnel);
+          opts.signal.removeEventListener("abort", stopTunnel);
+          throw new Error(
+            `The WebUI on ${opts.target.destination} did not answer through the SSH tunnel. Check that its sshd allows port forwarding (AllowTcpForwarding) and see ${opts.target.path}/.wrongstack/remote-webui.log there.`
+          );
+        }
+      }
+      if (ready) {
+        failures = 0;
+        const url = `http://127.0.0.1:${localPort}/?token=${server.token}`;
+        if (url !== announced) {
+          opts.log(`WebUI for ${opts.target.destination}:${opts.target.path} \u2192 ${url}`);
+          opts.log("Press Ctrl+C to disconnect.");
+          if (opts.open && !announced) opts.openUrl?.(url);
+          announced = url;
+        } else {
+          opts.log("Reconnected.");
+        }
+      }
+      await exited(tunnel);
+      opts.signal.removeEventListener("abort", stopTunnel);
+      if (opts.signal.aborted) break;
+      const delay = RECONNECT_DELAYS_MS[Math.min(failures, RECONNECT_DELAYS_MS.length - 1)] ?? 3e4;
+      failures += 1;
+      opts.log(
+        `The connection to ${opts.target.destination} dropped; reconnecting in ${delay / 1e3}s\u2026`
+      );
+      await sleep(delay);
+      if (opts.signal.aborted) break;
+      try {
+        probe = await probeRemote(opts);
+        server = await ensureServer(opts, probe, binary);
+      } catch (err) {
+        opts.log(toErrorMessage(err));
+      }
+    }
+  } finally {
+    if (!opts.keep) {
+      await opts.ssh("sh -s", stopScript(opts.target.path)).then(() => opts.log(`Stopped WrongStack on ${opts.target.destination}.`)).catch(() => opts.log("Could not stop the remote WrongStack host; it keeps running."));
+    } else {
+      opts.log(`WrongStack keeps running on ${opts.target.destination} (--keep).`);
+    }
+  }
+  return 0;
+}
+function sshAgentEnv() {
+  const env = {};
+  for (const key of [
+    "SSH_AUTH_SOCK",
+    "SSH_AGENT_PID",
+    "SSH_ASKPASS",
+    "SSH_ASKPASS_REQUIRE",
+    "DISPLAY"
+  ]) {
+    const value = process.env[key];
+    if (value !== void 0) env[key] = value;
+  }
+  return env;
+}
+function sshCommandLine(target, options) {
+  return [
+    ...options.sshConfig ? ["-F", options.sshConfig] : [],
+    ...target.port ? ["-p", String(target.port)] : [],
+    // Without a terminal (or an askpass helper) a password prompt would hang.
+    ...options.batch ? ["-o", "BatchMode=yes"] : [],
+    "-o",
+    "ConnectTimeout=20",
+    "-o",
+    "ServerAliveInterval=15",
+    "-o",
+    "ServerAliveCountMax=3"
+  ];
+}
+function systemSsh(target, options) {
+  const base = sshCommandLine(target, options);
+  const run = (remoteCommand, input) => new Promise((resolve2) => {
+    const child = spawn("ssh", [...base, target.destination, remoteCommand], {
+      stdio: ["pipe", "pipe", "inherit"],
+      env: { ...buildChildEnv(), ...sshAgentEnv() },
+      windowsHide: true
+    });
+    let stdout = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < 1e6) stdout += chunk;
+    });
+    child.on("error", (err) => resolve2({ code: 127, stdout: `error=${err.message}` }));
+    child.on("close", (code) => resolve2({ code: code ?? 1, stdout }));
+    child.stdin?.on("error", () => void 0);
+    if (typeof input === "string") child.stdin?.end(input);
+    else input.pipe(child.stdin);
+  });
+  const tunnel = (localPort, remotePort) => spawn(
+    "ssh",
+    [
+      ...base,
+      "-N",
+      "-o",
+      "ExitOnForwardFailure=yes",
+      "-L",
+      `127.0.0.1:${localPort}:127.0.0.1:${remotePort}`,
+      target.destination
+    ],
+    {
+      stdio: ["ignore", "ignore", "inherit"],
+      env: { ...buildChildEnv(), ...sshAgentEnv() },
+      windowsHide: true
+    }
+  );
+  return { run, tunnel };
+}
+function releaseCacheFile(root, version, assetName) {
+  return path.join(root, "remote-builds", `${version}-${assetName}`);
+}
+async function cachedFile(file) {
+  if (!existsSync(file)) return void 0;
+  const stat2 = await fsp.stat(file);
+  return stat2.size > 0 ? file : void 0;
+}
+
+// src/subcommands/handlers/remote.ts
+var USAGE = `Usage: wstack remote <user@host:/path | ssh://user@host:port/path> [options]
+
+Runs WrongStack on the remote machine, in that project directory, and opens its
+WebUI here through an SSH tunnel. The agent, its tools and its daemons run
+remotely. The system ssh is used, so ~/.ssh/config, your agent and known_hosts
+apply. Nothing from your local configuration is copied; set up a provider in the
+remote WebUI the first time.
+
+Options:
+  --port <n>            Local port for the WebUI (default 3456, next free one)
+  --open                Open the WebUI in your browser
+  --keep                Leave WrongStack running remotely when you disconnect
+  --ssh-config <file>   Use this ssh config file (ssh -F)
+  --remote-binary <f>   Upload this WrongStack build instead of the release one
+`;
+function flagString(flags, name) {
+  const value = flags[name];
+  return typeof value === "string" && value ? value : void 0;
+}
+async function resolveBinary(buildTarget, installed, explicit, log) {
+  if (explicit) {
+    const file2 = path2.resolve(explicit);
+    const sha2 = await sha256File(file2);
+    return { file: file2, version: `build-${sha2.slice(0, 16)}` };
+  }
+  if (isStandaloneBinary() && STANDALONE_TARGET === buildTarget) {
+    return { file: process.execPath, version: CLI_VERSION };
+  }
+  const release = await findStandaloneRelease(buildTarget);
+  if (installed.includes(release.version)) return { file: "", version: release.version };
+  const file = releaseCacheFile(wstackGlobalRoot(), release.version, release.assetName);
+  const cached = await cachedFile(file);
+  if (cached) {
+    await verifyStandaloneDigest(release, await sha256File(cached));
+    return { file: cached, version: release.version };
+  }
+  log(`Downloading WrongStack ${release.version} for ${buildTarget}\u2026`);
+  await fsp2.mkdir(path2.dirname(file), { recursive: true });
+  await fsp2.rm(file, { force: true });
+  const sha = await downloadReleaseAssetToFile(release.asset.browser_download_url, file, {
+    timeoutMs: 10 * 6e4,
+    maxBytes: MAX_BINARY_BYTES
+  });
+  try {
+    await verifyStandaloneDigest(release, sha);
+  } catch (err) {
+    await fsp2.rm(file, { force: true });
+    throw err;
+  }
+  return { file, version: release.version };
+}
+async function runRemoteCommand(args, flags, renderer) {
+  const write = (line) => renderer.writeLine(line);
+  const targetText = flagString(flags, "remote") ?? args[0];
+  if (flags["help"] === true || !targetText) {
+    write(USAGE);
+    return flags["help"] === true ? 0 : 2;
+  }
+  let target;
+  try {
+    target = parseRemoteTarget(targetText);
+  } catch (err) {
+    write(toErrorMessage2(err));
+    return 2;
+  }
+  const portText = flagString(flags, "port");
+  const localPort = portText ? Number(portText) : 3456;
+  if (!Number.isInteger(localPort) || localPort < 1 || localPort > 65535) {
+    write(`--port must be a TCP port, got ${portText}`);
+    return 2;
+  }
+  const sshConfig = flagString(flags, "ssh-config");
+  const explicitBinary = flagString(flags, "remote-binary");
+  const ssh = systemSsh(target, {
+    ...sshConfig ? { sshConfig } : {},
+    batch: !process.stdin.isTTY && !process.env["SSH_ASKPASS"]
+  });
+  const controller = new AbortController();
+  const onInterrupt = () => controller.abort();
+  process.once("SIGINT", onInterrupt);
+  process.once("SIGTERM", onInterrupt);
+  try {
+    return await runRemoteSession({
+      target,
+      localPort,
+      keep: flags["keep"] === true,
+      open: flags["open"] === true,
+      signal: controller.signal,
+      log: write,
+      ssh: ssh.run,
+      tunnel: ssh.tunnel,
+      resolveBinary: (buildTarget, installed) => resolveBinary(buildTarget, installed, explicitBinary, write),
+      openUrl: openBrowser
+    });
+  } catch (err) {
+    write(toErrorMessage2(err));
+    return 1;
+  } finally {
+    process.off("SIGINT", onInterrupt);
+    process.off("SIGTERM", onInterrupt);
+  }
+}
+var remoteCmd = (args, deps) => runRemoteCommand(args, deps.flags ?? {}, deps.renderer);
+export {
+  remoteCmd,
+  runRemoteCommand
+};
+//# sourceMappingURL=remote-O5WXHLWV.js.map