@zincapp/znvault-cli 4.5.0 → 4.6.1

package/dist/lib/ssh-tunnel.js

@@ -0,0 +1,144 @@
+// Path: src/lib/ssh-tunnel.ts
+/**
+ * SSH-CA-authenticated tunnel manager for reaching loopback-bound agents.
+ *
+ * Production agents bind their control/health server (:9100) to 127.0.0.1 only,
+ * so direct `http://<host>:9100` is unreachable from an operator's machine. This
+ * helper opens a local port-forward via `znvault ssh forward --print-port`
+ * (which authenticates with the vault SSH CA and honors the active profile's
+ * configured SSH user), then exposes the agent at `127.0.0.1:<localPort>`.
+ *
+ * Ported from znvault-plugin-payara's ssh-tunnel.ts so the CLI owns its own copy
+ * (the CLI must not import from a plugin package).
+ */
+import { spawn } from 'node:child_process';
+const DEFAULT_REMOTE_PORT = 9100;
+const DEFAULT_READINESS_TIMEOUT_MS = 15000;
+const READINESS_POLL_INTERVAL_MS = 250;
+/**
+ * Resolve the znvault binary to shell out to. The forward runs as a child of the
+ * current process, so the running binary itself is the correct one to re-invoke.
+ */
+function resolveZnvaultBin() {
+    const fromEnv = process.env.ZNVAULT_BIN;
+    if (fromEnv)
+        return fromEnv;
+    // process.argv[1] is the CLI entrypoint when run as `znvault ...`.
+    return process.argv[1] ?? 'znvault';
+}
+/**
+ * Open an SSH-CA-authenticated local forward to `host:remotePort` via
+ * `znvault ssh forward --print-port`. Resolves once the tunnel's local port
+ * answers `GET /health`, or rejects on spawn/exit/readiness failure.
+ *
+ * The caller MUST call `close()` (a `try/finally` is the intended pattern) to
+ * tear the forward down.
+ */
+export async function openTunnel(host, opts = {}) {
+    const bin = resolveZnvaultBin();
+    const remotePort = opts.remotePort ?? DEFAULT_REMOTE_PORT;
+    const readinessTimeoutMs = opts.readinessTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS;
+    const target = opts.user ? `${opts.user}@${host}` : host;
+    const args = [
+        'ssh', 'forward',
+        '--print-port',
+        '-L', `127.0.0.1:0:127.0.0.1:${remotePort}`,
+        target,
+    ];
+    const child = spawn(bin, args, { stdio: ['ignore', 'pipe', 'inherit'], env: process.env });
+    const localPort = await new Promise((resolve, reject) => {
+        let buf = '';
+        let settled = false;
+        const onClose = (code) => {
+            if (!settled) {
+                settled = true;
+                reject(new Error(`ssh forward exited (code ${code ?? 'null'}) before reporting a port`));
+            }
+        };
+        const onError = (err) => {
+            if (!settled) {
+                settled = true;
+                reject(err);
+            }
+        };
+        child.on('close', onClose);
+        child.on('error', onError);
+        child.stdout?.on('data', (chunk) => {
+            if (settled)
+                return;
+            buf += chunk.toString('utf8');
+            let nl;
+            while ((nl = buf.indexOf('\n')) >= 0) {
+                const line = buf.slice(0, nl).trim();
+                buf = buf.slice(nl + 1); // consume the line
+                if (!line)
+                    continue;
+                try {
+                    const parsed = JSON.parse(line);
+                    if (typeof parsed.localPort === 'number') {
+                        settled = true;
+                        child.removeListener('close', onClose);
+                        child.removeListener('error', onError);
+                        resolve(parsed.localPort);
+                        return;
+                    }
+                }
+                catch {
+                    /* not the JSON line; try the next one */
+                }
+            }
+        });
+    });
+    const close = async () => {
+        if (child.pid && !child.killed)
+            child.kill('SIGTERM');
+        // Give it a beat to die; don't hang on a lingering child.
+        await new Promise((r) => setTimeout(r, 100));
+    };
+    // App-level readiness: poll /health through the forward before returning.
+    const deadline = Date.now() + readinessTimeoutMs;
+    let lastErr = '';
+    while (Date.now() < deadline) {
+        try {
+            const res = await fetch(`http://127.0.0.1:${localPort}/health`, {
+                signal: AbortSignal.timeout(Math.max(1, Math.min(2000, deadline - Date.now()))),
+            });
+            if (res.ok)
+                return { host, localPort, pid: child.pid, close };
+            lastErr = `HTTP ${res.status}`;
+        }
+        catch (err) {
+            lastErr = err instanceof Error ? err.message : String(err);
+        }
+        await new Promise((r) => setTimeout(r, READINESS_POLL_INTERVAL_MS));
+    }
+    await close();
+    throw new Error(`Tunnel to ${host} opened (port ${localPort}) but /health never answered: ${lastErr}`);
+}
+/**
+ * Whether a host is loopback (already locally reachable, no tunnel needed).
+ */
+export function isLoopbackHost(host) {
+    return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+/**
+ * Run `fn` against an agent reachable at `host:port`, opening an SSH-CA tunnel
+ * first when needed and tearing it down afterward.
+ *
+ * Tunnel is skipped (direct connection used) when `tunnel` is false or the host
+ * is loopback. When tunneling, `fn` receives `127.0.0.1` + the local forward
+ * port; otherwise it receives the original host/port.
+ */
+export async function withAgentConnection(host, port, opts, fn) {
+    if (!opts.tunnel || isLoopbackHost(host)) {
+        return fn(host, port);
+    }
+    const tunnel = await openTunnel(host, { remotePort: port });
+    try {
+        return await fn('127.0.0.1', tunnel.localPort);
+    }
+    finally {
+        await tunnel.close();
+    }
+}
+//# sourceMappingURL=ssh-tunnel.js.map

package/dist/lib/ssh-tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-tunnel.js","sourceRoot":"","sources":["../../src/lib/ssh-tunnel.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAoB9D,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,mEAAmE;IACnE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAA0B,EAAE;IACzE,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IAEnF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,SAAS;QAChB,cAAc;QACd,IAAI,EAAE,yBAAyB,UAAU,EAAE;QAC3C,MAAM;KACP,CAAC;IAEF,MAAM,KAAK,GAAiB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEzG,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,IAAmB,EAAQ,EAAE;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,IAAI,IAAI,MAAM,2BAA2B,CAAC,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,OAAO;gBAAE,OAAO;YACpB,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB;gBAC5C,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;oBAC1D,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBACzC,OAAO,GAAG,IAAI,CAAC;wBACf,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACvC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACvC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAC1B,OAAO;oBACT,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,yCAAyC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,0DAA0D;QAC1D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,SAAS,SAAS,EAAE;gBAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aAChF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;YAC9D,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,EAAE,CAAC;IACd,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,iBAAiB,SAAS,iCAAiC,OAAO,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,IAAY,EACZ,IAAyB,EACzB,EAAsD;IAEtD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zincapp/znvault-cli",
-  "version": "4.5.0",
+  "version": "4.6.1",
   "description": "Official CLI for ZnVault administration",
   "type": "module",
   "main": "dist/index.js",