agent-relay 6.0.16 → 6.0.18

package/dist/packages/cloud/src/auth.js

@@ -0,0 +1,299 @@
+import fs from 'node:fs/promises';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { buildApiUrl } from './api-client.js';
+import { AUTH_FILE_PATH, REFRESH_WINDOW_MS } from './types.js';
+const envBackedAuth = new WeakSet();
+function markEnvBackedAuth(auth) {
+    envBackedAuth.add(auth);
+    return auth;
+}
+function isEnvBackedAuth(auth) {
+    return envBackedAuth.has(auth);
+}
+function readEnvAuth(env = process.env) {
+    const apiUrl = env.CLOUD_API_URL?.trim();
+    const accessToken = env.CLOUD_API_ACCESS_TOKEN?.trim();
+    const refreshToken = env.CLOUD_API_REFRESH_TOKEN?.trim();
+    const accessTokenExpiresAt = env.CLOUD_API_ACCESS_TOKEN_EXPIRES_AT?.trim();
+    if (!apiUrl || !accessToken || !refreshToken || !accessTokenExpiresAt) {
+        return null;
+    }
+    try {
+        new URL(apiUrl);
+    }
+    catch {
+        return null;
+    }
+    if (Number.isNaN(Date.parse(accessTokenExpiresAt))) {
+        return null;
+    }
+    return markEnvBackedAuth({
+        apiUrl,
+        accessToken,
+        refreshToken,
+        accessTokenExpiresAt,
+    });
+}
+function toEnvAuthRefreshError(error) {
+    const message = error instanceof Error && error.message ? `${error.message}. ` : '';
+    return new Error(`${message}Env-backed cloud auth could not be refreshed interactively; re-provision CLOUD_API_URL, CLOUD_API_ACCESS_TOKEN, CLOUD_API_REFRESH_TOKEN, and CLOUD_API_ACCESS_TOKEN_EXPIRES_AT.`, error instanceof Error ? { cause: error } : undefined);
+}
+function isValidStoredAuth(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const auth = value;
+    return (typeof auth.accessToken === 'string' &&
+        typeof auth.refreshToken === 'string' &&
+        typeof auth.accessTokenExpiresAt === 'string' &&
+        typeof auth.apiUrl === 'string');
+}
+export async function readStoredAuth(env = process.env) {
+    const envAuth = readEnvAuth(env);
+    if (envAuth) {
+        return envAuth;
+    }
+    try {
+        const file = await fs.readFile(AUTH_FILE_PATH, 'utf8');
+        const parsed = JSON.parse(file);
+        return isValidStoredAuth(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeStoredAuth(auth) {
+    await fs.mkdir(path.dirname(AUTH_FILE_PATH), {
+        recursive: true,
+        mode: 0o700,
+    });
+    await fs.writeFile(AUTH_FILE_PATH, `${JSON.stringify(auth, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+}
+export async function clearStoredAuth() {
+    await fs.rm(AUTH_FILE_PATH, { force: true });
+}
+function shouldRefresh(accessTokenExpiresAt) {
+    const expiresAt = Date.parse(accessTokenExpiresAt);
+    if (Number.isNaN(expiresAt)) {
+        return true;
+    }
+    return expiresAt - Date.now() <= REFRESH_WINDOW_MS;
+}
+function openBrowser(url) {
+    const platform = os.platform();
+    if (platform === 'darwin') {
+        return spawn('open', [url], { stdio: 'ignore', detached: true });
+    }
+    if (platform === 'win32') {
+        return spawn('cmd', ['/c', 'start', '', url], { stdio: 'ignore', detached: true });
+    }
+    return spawn('xdg-open', [url], { stdio: 'ignore', detached: true });
+}
+function redirectToHostedCliAuthPage(response, apiUrl, options) {
+    const resultUrl = buildApiUrl(apiUrl, '/cli/auth-result');
+    resultUrl.searchParams.set('status', options.status);
+    if (options.detail) {
+        resultUrl.searchParams.set('detail', options.detail);
+    }
+    response.statusCode = 302;
+    response.setHeader('location', resultUrl.toString());
+    response.end();
+}
+async function beginBrowserLogin(apiUrl) {
+    const state = crypto.randomUUID();
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const server = http.createServer((request, response) => {
+            const requestUrl = new URL(request.url || '/', 'http://127.0.0.1');
+            if (requestUrl.pathname !== '/callback') {
+                response.statusCode = 404;
+                response.end('Not found');
+                return;
+            }
+            const returnedState = requestUrl.searchParams.get('state');
+            // Validate state parameter first (CSRF protection) — this check
+            // must run unconditionally, before any user-controlled values.
+            if (returnedState !== state) {
+                redirectToHostedCliAuthPage(response, apiUrl, {
+                    status: 'error',
+                    detail: 'Invalid state parameter',
+                });
+                if (!settled) {
+                    settled = true;
+                    server.close();
+                    reject(new Error('Invalid state parameter in CLI login callback'));
+                }
+                return;
+            }
+            const error = requestUrl.searchParams.get('error');
+            if (error) {
+                redirectToHostedCliAuthPage(response, apiUrl, {
+                    status: 'error',
+                    detail: error,
+                });
+                if (!settled) {
+                    settled = true;
+                    server.close();
+                    reject(new Error(error));
+                }
+                return;
+            }
+            const accessToken = requestUrl.searchParams.get('access_token');
+            const refreshToken = requestUrl.searchParams.get('refresh_token');
+            const accessTokenExpiresAt = requestUrl.searchParams.get('access_token_expires_at');
+            const returnedApiUrl = requestUrl.searchParams.get('api_url');
+            if (!accessToken || !refreshToken || !accessTokenExpiresAt || !returnedApiUrl) {
+                redirectToHostedCliAuthPage(response, apiUrl, {
+                    status: 'error',
+                    detail: 'Expected access token, refresh token, API URL, and expiration timestamp.',
+                });
+                if (!settled) {
+                    settled = true;
+                    server.close();
+                    reject(new Error('CLI login callback was missing required fields'));
+                }
+                return;
+            }
+            redirectToHostedCliAuthPage(response, returnedApiUrl, {
+                status: 'success',
+                detail: `API endpoint: ${returnedApiUrl}`,
+            });
+            if (!settled) {
+                settled = true;
+                server.close();
+                resolve({
+                    accessToken,
+                    refreshToken,
+                    accessTokenExpiresAt,
+                    apiUrl: returnedApiUrl,
+                });
+            }
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                if (!settled) {
+                    settled = true;
+                    server.close();
+                    reject(new Error('Failed to start local callback server'));
+                }
+                return;
+            }
+            const callbackUrl = new URL('/callback', `http://127.0.0.1:${address.port}`);
+            const loginUrl = buildApiUrl(apiUrl, '/api/v1/cli/login');
+            loginUrl.searchParams.set('redirect_uri', callbackUrl.toString());
+            loginUrl.searchParams.set('state', state);
+            console.log(`Opening browser for cloud login: ${loginUrl.toString()}`);
+            console.log('If the browser does not open, paste this URL into your browser.');
+            try {
+                const child = openBrowser(loginUrl.toString());
+                child.unref();
+            }
+            catch {
+                // Browser open failure is non-fatal; user still has the URL.
+            }
+        });
+        server.on('error', (error) => {
+            if (!settled) {
+                settled = true;
+                reject(error);
+            }
+        });
+        setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                server.close();
+                reject(new Error('Timed out waiting for browser login'));
+            }
+        }, 5 * 60_000).unref();
+    });
+}
+export async function refreshStoredAuth(auth) {
+    const response = await fetch(buildApiUrl(auth.apiUrl, '/api/v1/auth/token/refresh'), {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify({ refreshToken: auth.refreshToken }),
+    });
+    const payload = (await response.json().catch(() => null));
+    if (!response.ok || !payload?.accessToken || !payload?.refreshToken || !payload?.accessTokenExpiresAt) {
+        throw new Error('Stored cloud login has expired');
+    }
+    const nextAuth = {
+        apiUrl: auth.apiUrl,
+        accessToken: payload.accessToken,
+        refreshToken: payload.refreshToken,
+        accessTokenExpiresAt: payload.accessTokenExpiresAt,
+    };
+    if (isEnvBackedAuth(auth)) {
+        return markEnvBackedAuth(nextAuth);
+    }
+    await writeStoredAuth(nextAuth);
+    return nextAuth;
+}
+async function loginWithBrowser(apiUrl) {
+    const auth = await beginBrowserLogin(apiUrl);
+    await writeStoredAuth(auth);
+    console.log(`Logged in to ${auth.apiUrl}`);
+    return auth;
+}
+export async function ensureAuthenticated(apiUrl, options) {
+    const force = options?.force === true;
+    const stored = !force ? await readStoredAuth() : null;
+    // Stored auth is authoritative on its own host. A host mismatch between
+    // `apiUrl` (typically defaultApiUrl()) and `stored.apiUrl` is NOT a reason
+    // to force a fresh browser login — the user already linked, and the default
+    // may have drifted (e.g. CLOUD_API_URL env set/unset between sessions).
+    // Only `--force` re-links to a different host.
+    if (!stored) {
+        return loginWithBrowser(apiUrl);
+    }
+    if (!shouldRefresh(stored.accessTokenExpiresAt)) {
+        return stored;
+    }
+    try {
+        return await refreshStoredAuth(stored);
+    }
+    catch (error) {
+        if (isEnvBackedAuth(stored)) {
+            throw toEnvAuthRefreshError(error);
+        }
+        return loginWithBrowser(stored.apiUrl);
+    }
+}
+function apiFetch(apiUrl, accessToken, requestPath, init) {
+    return fetch(buildApiUrl(apiUrl, requestPath), {
+        ...init,
+        headers: {
+            'content-type': 'application/json',
+            authorization: `Bearer ${accessToken}`,
+            ...(init.headers ?? {}),
+        },
+    });
+}
+export async function authorizedApiFetch(auth, requestPath, init) {
+    let activeAuth = auth;
+    let response = await apiFetch(activeAuth.apiUrl, activeAuth.accessToken, requestPath, init);
+    if (response.status !== 401) {
+        return { response, auth: activeAuth };
+    }
+    try {
+        activeAuth = await refreshStoredAuth(activeAuth);
+    }
+    catch (error) {
+        if (isEnvBackedAuth(activeAuth)) {
+            throw toEnvAuthRefreshError(error);
+        }
+        activeAuth = await loginWithBrowser(activeAuth.apiUrl);
+    }
+    response = await apiFetch(activeAuth.apiUrl, activeAuth.accessToken, requestPath, init);
+    return { response, auth: activeAuth };
+}
+//# sourceMappingURL=auth.js.map

package/dist/packages/cloud/src/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../packages/cloud/src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAmB,MAAM,YAAY,CAAC;AAEhF,MAAM,aAAa,GAAG,IAAI,OAAO,EAAc,CAAC;AAEhD,SAAS,iBAAiB,CAAC,IAAgB;IACzC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACvC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,oBAAoB,GAAG,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,CAAC;IAE3E,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,iBAAiB,CAAC;QACvB,MAAM;QACN,WAAW;QACX,YAAY;QACZ,oBAAoB;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpF,OAAO,IAAI,KAAK,CACd,GAAG,OAAO,iLAAiL,EAC3L,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,KAA4B,CAAC;IAC1C,OAAO,CACL,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACrC,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ;QAC7C,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAgB;IACpD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;QAC3C,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACvE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,oBAA4B;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,iBAAiB,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAE/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAmD,EACnD,MAAc,EACd,OAGC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAElC,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAEnE,IAAI,UAAU,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACxC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE3D,gEAAgE;YAChE,+DAA+D;YAC/D,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE;oBAC5C,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,yBAAyB;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;gBACrE,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACV,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE;oBAC5C,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3B,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClE,MAAM,oBAAoB,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACpF,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAE9D,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9E,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE;oBAC5C,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,0EAA0E;iBACnF,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;YACT,CAAC;YAED,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE;gBACpD,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,iBAAiB,cAAc,EAAE;aAC1C,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC;oBACN,WAAW;oBACX,YAAY;oBACZ,oBAAoB;oBACpB,MAAM,EAAE,cAAc;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAC1D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE1C,OAAO,CAAC,GAAG,CAAC,oCAAoC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;YAE/E,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE;QACnF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KAC1D,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAIhD,CAAC;IAET,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAe;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;KACnD,CAAC;IAEF,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAA6B;IAE7B,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,KAAK,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtD,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,MAAc,EACd,WAAmB,EACnB,WAAmB,EACnB,IAAiB;IAEjB,OAAO,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;QAC7C,GAAG,IAAI;QACP,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAgB,EAChB,WAAmB,EACnB,IAAiB;IAEjB,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAE5F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,UAAU,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC"}

package/dist/packages/cloud/src/connect.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Provider connect orchestration — provisions a Daytona sandbox via the
+ * Cloud API, opens an interactive SSH session that runs the provider CLI,
+ * and finalizes the auth state with Cloud.
+ *
+ * The CLI command in `agent-relay cloud connect <provider>` is a thin wrapper
+ * around this function; other tools (e.g. `ricky connect <provider>`) can
+ * import it directly and drive the same flow.
+ */
+import type { AuthSshRuntime } from './lib/ssh-runtime.js';
+export declare function getProviderHelpText(): string;
+export declare function normalizeProvider(providerArg: string): string;
+export interface ConnectProviderIo {
+    log: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+}
+export interface ConnectProviderOptions {
+    /** Provider id or alias (`anthropic`/`claude`, `openai`/`codex`, `google`/`gemini`, …). */
+    provider: string;
+    /** Override the Cloud API URL. Defaults to `defaultApiUrl()`. */
+    apiUrl?: string;
+    /** Sandbox language/image. Defaults to `'typescript'`. */
+    language?: string;
+    /** Auth timeout in milliseconds. Defaults to 5 minutes. */
+    timeoutMs?: number;
+    /** Logger sink. Defaults to `console.log` / `console.error`. */
+    io?: ConnectProviderIo;
+    /** Override SSH/network runtime hooks (used in tests). */
+    runtime?: Partial<AuthSshRuntime>;
+}
+export interface ConnectProviderResult {
+    /** Normalized provider id used for the request. */
+    provider: string;
+    /** Whether the interactive session reported a positive auth pattern match. */
+    success: boolean;
+}
+/**
+ * Connect a provider via interactive SSH session.
+ *
+ * Throws on any failure. Returns `{ provider, success }` when the auth flow
+ * completed successfully — `success` is always `true` on resolved promises;
+ * an unsuccessful auth attempt rejects with a descriptive Error.
+ */
+export declare function connectProvider(options: ConnectProviderOptions): Promise<ConnectProviderResult>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/packages/cloud/src/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../../packages/cloud/src/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQ3D,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAClC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,EAAE,CAAC,EAAE,iBAAiB,CAAC;IACvB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAC;CAClB;AA+BD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4HrG"}

package/dist/packages/cloud/src/connect.js

@@ -0,0 +1,166 @@
+/**
+ * Provider connect orchestration — provisions a Daytona sandbox via the
+ * Cloud API, opens an interactive SSH session that runs the provider CLI,
+ * and finalizes the auth state with Cloud.
+ *
+ * The CLI command in `agent-relay cloud connect <provider>` is a thin wrapper
+ * around this function; other tools (e.g. `ricky connect <provider>`) can
+ * import it directly and drive the same flow.
+ */
+import { CLI_AUTH_CONFIG } from '@agent-relay/config/cli-auth-config';
+import { ensureAuthenticated, authorizedApiFetch } from './auth.js';
+import { defaultApiUrl } from './types.js';
+import { runInteractiveSession } from './lib/ssh-interactive.js';
+const PROVIDER_ALIASES = {
+    claude: 'anthropic',
+    codex: 'openai',
+    gemini: 'google',
+};
+export function getProviderHelpText() {
+    return Object.keys(CLI_AUTH_CONFIG)
+        .sort()
+        .map((id) => {
+        const alias = Object.entries(PROVIDER_ALIASES).find(([, target]) => target === id);
+        return alias ? `${id} (alias: ${alias[0]})` : id;
+    })
+        .join(', ');
+}
+export function normalizeProvider(providerArg) {
+    const providerInput = providerArg.toLowerCase().trim();
+    return PROVIDER_ALIASES[providerInput] || providerInput;
+}
+const color = {
+    cyan: (s) => `\x1b[36m${s}\x1b[0m`,
+    green: (s) => `\x1b[32m${s}\x1b[0m`,
+    yellow: (s) => `\x1b[33m${s}\x1b[0m`,
+    red: (s) => `\x1b[31m${s}\x1b[0m`,
+    dim: (s) => `\x1b[2m${s}\x1b[0m`,
+};
+const DEFAULT_IO = {
+    log: (...args) => console.log(...args),
+    error: (...args) => console.error(...args),
+};
+async function getErrorDetails(response) {
+    let body;
+    try {
+        body = await response.text();
+    }
+    catch {
+        return response.statusText;
+    }
+    if (!body)
+        return response.statusText;
+    try {
+        const json = JSON.parse(body);
+        return json.error || json.message || response.statusText;
+    }
+    catch {
+        return body;
+    }
+}
+/**
+ * Connect a provider via interactive SSH session.
+ *
+ * Throws on any failure. Returns `{ provider, success }` when the auth flow
+ * completed successfully — `success` is always `true` on resolved promises;
+ * an unsuccessful auth attempt rejects with a descriptive Error.
+ */
+export async function connectProvider(options) {
+    const io = options.io ?? DEFAULT_IO;
+    const language = options.language ?? 'typescript';
+    const timeoutMs = options.timeoutMs ?? 300_000;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error('connectProvider requires an interactive terminal (TTY).');
+    }
+    const provider = normalizeProvider(options.provider);
+    const providerConfig = CLI_AUTH_CONFIG[provider];
+    if (!providerConfig) {
+        const known = Object.keys(CLI_AUTH_CONFIG).sort();
+        throw new Error(`Unknown provider: ${options.provider}. Supported providers: ${known.join(', ')}`);
+    }
+    const apiUrl = options.apiUrl || defaultApiUrl();
+    io.log('');
+    io.log(color.cyan('═══════════════════════════════════════════════════'));
+    io.log(color.cyan('      Provider Authentication (Daytona Connect)'));
+    io.log(color.cyan('═══════════════════════════════════════════════════'));
+    io.log('');
+    io.log(`Provider: ${providerConfig.displayName} (${provider})`);
+    io.log(`Language: ${color.dim(language)}`);
+    io.log(color.dim(`Cloud: ${apiUrl}`));
+    io.log('');
+    io.log('Requesting sandbox from cloud...');
+    let auth = await ensureAuthenticated(apiUrl);
+    const { response: createResponse, auth: refreshedAuth } = await authorizedApiFetch(auth, '/api/v1/cli/auth', {
+        method: 'POST',
+        body: JSON.stringify({ provider, language }),
+    });
+    auth = refreshedAuth;
+    const start = (await createResponse.json().catch(() => null));
+    if (!createResponse.ok || !start?.sessionId) {
+        const detail = start?.error || start?.message || `${createResponse.status} ${createResponse.statusText}`;
+        throw new Error(detail);
+    }
+    const sshPort = typeof start.ssh?.port === 'string'
+        ? Number.parseInt(start.ssh.port, 10)
+        : start.ssh?.port;
+    if (!start.ssh?.host || !sshPort || !start.ssh.user || !start.ssh.password) {
+        throw new Error('Cloud returned invalid SSH session details.');
+    }
+    io.log(color.green('✓ Sandbox ready'));
+    io.log(color.dim(`  SSH: ${start.ssh.user}@${start.ssh.host}:${sshPort}`));
+    io.log('');
+    io.log(color.yellow('Connecting via SSH...'));
+    io.log(color.dim(`  Running: ${start.remoteCommand}`));
+    io.log('');
+    let sessionResult;
+    try {
+        sessionResult = await runInteractiveSession({
+            ssh: {
+                host: start.ssh.host,
+                port: sshPort,
+                user: start.ssh.user,
+                password: start.ssh.password,
+            },
+            remoteCommand: start.remoteCommand,
+            successPatterns: providerConfig.successPatterns || [],
+            errorPatterns: providerConfig.errorPatterns || [],
+            timeoutMs,
+            io,
+            runtime: options.runtime,
+        });
+    }
+    catch (error) {
+        throw new Error(`Failed to connect via SSH: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    io.log('');
+    const authSuccess = sessionResult.authDetected;
+    io.log('Finalizing authentication with cloud...');
+    const { response: completeResponse } = await authorizedApiFetch(auth, '/api/v1/cli/auth/complete', {
+        method: 'POST',
+        body: JSON.stringify({ sessionId: start.sessionId, success: authSuccess }),
+    });
+    if (!completeResponse.ok) {
+        throw new Error(await getErrorDetails(completeResponse));
+    }
+    if (!authSuccess) {
+        const exitCode = sessionResult.exitCode;
+        if (typeof exitCode === 'number' && exitCode !== 0) {
+            io.error(color.red(`Remote auth command exited with code ${exitCode}.`));
+        }
+        if (sessionResult.exitCode === 127) {
+            io.log(color.yellow(`The ${providerConfig.displayName} CLI ("${providerConfig.command}") is not installed on the sandbox.`));
+            io.log(color.dim('Check the sandbox snapshot includes the required CLI tools.'));
+        }
+        throw new Error(`Provider auth for ${provider} did not complete successfully`);
+    }
+    io.log('');
+    io.log(color.green('═══════════════════════════════════════════════════'));
+    io.log(color.green('          Authentication Complete!'));
+    io.log(color.green('═══════════════════════════════════════════════════'));
+    io.log('');
+    io.log(`${providerConfig.displayName} credentials are now stored and encrypted.`);
+    io.log(color.dim('Your workflows will automatically use these credentials.'));
+    io.log('');
+    return { provider, success: true };
+}
+//# sourceMappingURL=connect.js.map

package/dist/packages/cloud/src/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../../packages/cloud/src/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,MAAM,gBAAgB,GAA2B;IAC/C,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACV,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,gBAAgB,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC;AAC1D,CAAC;AA6BD,MAAM,KAAK,GAAG;IACZ,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;IAC1C,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;IAC3C,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;IAC5C,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;IACzC,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;CACzC,CAAC;AAEF,MAAM,UAAU,GAAsB;IACpC,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACjD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;CACtD,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,QAAkB;IAC/C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC;QACtE,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,UAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IAE/C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,CAAC,QAAQ,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IAEjD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC1E,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,CAAC;IACtE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC1E,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,aAAa,cAAc,CAAC,WAAW,KAAK,QAAQ,GAAG,CAAC,CAAC;IAChE,EAAE,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC;IACtC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAE3C,IAAI,IAAI,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,kBAAkB,CAChF,IAAI,EACJ,kBAAkB,EAClB;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;KAC7C,CACF,CAAC;IACF,IAAI,GAAG,aAAa,CAAC;IAErB,MAAM,KAAK,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAEpD,CAAC;IAET,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,OAAO,IAAI,GAAG,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,KAAK,QAAQ;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAyB,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3E,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC9C,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACvD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEX,IAAI,aAAa,CAAC;IAClB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,qBAAqB,CAAC;YAC1C,GAAG,EAAE;gBACH,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;gBACpB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;gBACpB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;aAC7B;YACD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,eAAe,EAAE,cAAc,CAAC,eAAe,IAAI,EAAE;YACrD,aAAa,EAAE,cAAc,CAAC,aAAa,IAAI,EAAE;YACjD,SAAS;YACT,EAAE;YACF,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC;IAE/C,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IAClD,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,2BAA2B,EAAE;QACjG,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;KAC3E,CAAC,CAAC;IAEH,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,MAAM,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC;QACxC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnD,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACnC,EAAE,CAAC,GAAG,CACJ,KAAK,CAAC,MAAM,CACV,OAAO,cAAc,CAAC,WAAW,UAAU,cAAc,CAAC,OAAO,qCAAqC,CACvG,CACF,CAAC;YACF,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,gCAAgC,CAAC,CAAC;IACjF,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC3E,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAC1D,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC3E,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,WAAW,4CAA4C,CAAC,CAAC;IAClF,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC,CAAC;IAC9E,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEX,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/packages/cloud/src/index.d.ts

@@ -0,0 +1,10 @@
+export { readStoredAuth, writeStoredAuth, clearStoredAuth, refreshStoredAuth, ensureAuthenticated, authorizedApiFetch, } from './auth.js';
+export { CloudApiClient, buildApiUrl, type CloudApiClientOptions, type CloudApiClientSnapshot, } from './api-client.js';
+export { runWorkflow, scheduleWorkflow, listWorkflowSchedules, getRunStatus, getRunLogs, cancelWorkflow, syncWorkflowPatch, resolveWorkflowInput, inferWorkflowFileType, shouldSyncCodeByDefault, } from './workflows.js';
+export { connectProvider, getProviderHelpText, normalizeProvider, type ConnectProviderIo, type ConnectProviderOptions, type ConnectProviderResult, } from './connect.js';
+export { createWorkspace, issueWorkspaceToken } from './workspaces.js';
+export { deployProactiveAgent, listProactiveAgents, inspectProactiveAgent, undeployProactiveAgent, createWorkspaceSecret, getWorkspaceSecret, deleteWorkspaceSecret, } from './proactive-runtime.js';
+export { runInteractiveSession, formatShellInvocation, wrapWithLaunchCheckpoint, type SshConnectionInfo, type InteractiveSessionOptions, type InteractiveSessionResult, } from './lib/ssh-interactive.js';
+export { loadSSH2, createAskpassScript, buildSystemSshArgs, DEFAULT_SSH_RUNTIME, type AuthSshRuntime, } from './lib/ssh-runtime.js';
+export { type StoredAuth, type WhoAmIResponse, type AuthSessionResponse, type WorkspaceCreateResponse, type WorkspaceTokenIssueResponse, type WorkspaceTokenRecord, type ProactiveDeploymentResponse, type ProactiveAgentRecord, type WorkspaceSecretRecord, type WorkflowFileType, type RunWorkflowResponse, type WorkflowSchedule, type ScheduleWorkflowOptions, type WorkflowLogsResponse, type SyncPatchResponse, SUPPORTED_PROVIDERS, REFRESH_WINDOW_MS, AUTH_FILE_PATH, defaultApiUrl, isSupportedProvider, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/packages/cloud/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/cloud/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/packages/cloud/src/index.js

@@ -0,0 +1,10 @@
+export { readStoredAuth, writeStoredAuth, clearStoredAuth, refreshStoredAuth, ensureAuthenticated, authorizedApiFetch, } from './auth.js';
+export { CloudApiClient, buildApiUrl, } from './api-client.js';
+export { runWorkflow, scheduleWorkflow, listWorkflowSchedules, getRunStatus, getRunLogs, cancelWorkflow, syncWorkflowPatch, resolveWorkflowInput, inferWorkflowFileType, shouldSyncCodeByDefault, } from './workflows.js';
+export { connectProvider, getProviderHelpText, normalizeProvider, } from './connect.js';
+export { createWorkspace, issueWorkspaceToken } from './workspaces.js';
+export { deployProactiveAgent, listProactiveAgents, inspectProactiveAgent, undeployProactiveAgent, createWorkspaceSecret, getWorkspaceSecret, deleteWorkspaceSecret, } from './proactive-runtime.js';
+export { runInteractiveSession, formatShellInvocation, wrapWithLaunchCheckpoint, } from './lib/ssh-interactive.js';
+export { loadSSH2, createAskpassScript, buildSystemSshArgs, DEFAULT_SSH_RUNTIME, } from './lib/ssh-runtime.js';
+export { SUPPORTED_PROVIDERS, REFRESH_WINDOW_MS, AUTH_FILE_PATH, defaultApiUrl, isSupportedProvider, } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/packages/cloud/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/cloud/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,cAAc,EACd,WAAW,GAGZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAIlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GAIzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAgBL,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/packages/cloud/src/lib/ssh-interactive.d.ts

@@ -0,0 +1,70 @@
+/**
+ * SSH Interactive Session — reusable SSH+PTY runner.
+ *
+ * Powers both `agent-relay auth <provider>` and `agent-relay cloud connect <provider>`,
+ * and is published from `@agent-relay/cloud` so other CLIs can drive the same flow.
+ */
+import { type ErrorPattern } from '@agent-relay/config/cli-auth-config';
+import { type AuthSshRuntime } from './ssh-runtime.js';
+export interface SshConnectionInfo {
+    host: string;
+    port: number;
+    user: string;
+    password: string;
+}
+export interface InteractiveSessionOptions {
+    ssh: SshConnectionInfo;
+    remoteCommand: string;
+    successPatterns: RegExp[];
+    errorPatterns: ErrorPattern[];
+    timeoutMs: number;
+    io: {
+        log: (...args: unknown[]) => void;
+        error: (...args: unknown[]) => void;
+    };
+    tunnelPort?: number;
+    runtime?: Partial<AuthSshRuntime>;
+}
+export interface InteractiveSessionResult {
+    exitCode: number | null;
+    exitSignal: string | null;
+    authDetected: boolean;
+}
+/**
+ * Format a remote command for execution inside an ssh2 shell() PTY.
+ *
+ * Wraps the command in `exec sh -c '…'` so the PTY closes cleanly when the
+ * target CLI exits (no shell-teardown race with a TUI's alt-screen flush)
+ * while still letting `sh` parse leading prefix assignments like
+ * `PATH=/foo/bin claude`. A bare `exec PATH=… claude` does not work in zsh
+ * because zsh's exec builtin treats `PATH=…` as the command name instead of
+ * a prefix assignment.
+ *
+ * We intentionally use `shell()` rather than `exec(cmd, { pty })` because
+ * Daytona's sandbox sshd only populates the full login-shell environment
+ * (including nvm-managed PATH entries where `claude` / `codex` actually live)
+ * for interactive shell sessions. An `exec` channel with a PTY gets a
+ * stripped-down environment and the target CLI fails to start silently.
+ */
+export declare function formatShellInvocation(command: string): string;
+/**
+ * Wrap the remote command with a visible checkpoint so the user sees proof
+ * the ssh pipeline reached the sandbox before the provider CLI takes over
+ * the terminal. Without this, claude/codex enter alt-screen immediately and
+ * the user sees zero output — indistinguishable from a hang.
+ *
+ * The printf runs before the exec that launches the provider CLI, so the
+ * user gets one visible line ("launching provider CLI…") right before
+ * alt-screen engages. When the provider CLI later exits and the alt-screen
+ * tears down, this line remains in scrollback as a breadcrumb.
+ */
+export declare function wrapWithLaunchCheckpoint(command: string): string;
+/**
+ * Run an interactive SSH session with PTY.
+ *
+ * Connects via ssh2 (if available) or falls back to system ssh,
+ * sets up a local port tunnel, and runs the remote command in a PTY.
+ * Monitors output for success/error patterns.
+ */
+export declare function runInteractiveSession(options: InteractiveSessionOptions): Promise<InteractiveSessionResult>;
+//# sourceMappingURL=ssh-interactive.d.ts.map