host-execution-mcp 1.0.0

package/dist/access/index.d.ts

@@ -0,0 +1,110 @@
+import type { AccessClient, ExecOutput } from "../ssh/access-client.js";
+import type { AppConfig } from "../config.js";
+import { SessionPool } from "./session-pool.js";
+import type { ContextCapabilities, HostExecutionContext } from "./types.js";
+import { type ProbeResult } from "./probe.js";
+export type { ProbeResult };
+export type ContextSummary = {
+    contextKey: string;
+    endpoint: HostExecutionContext["endpoint"];
+    parentKey?: string;
+    capabilities: ContextCapabilities;
+};
+/**
+ * Access + shell/docker Runtime facade.
+ * derive = Access (produces Context); Runtime only consumes Context by contextKey.
+ */
+export declare class AccessRuntime {
+    private readonly config;
+    readonly accessContext: HostExecutionContext;
+    readonly pool: SessionPool;
+    private readonly sshTransport;
+    /** Capability cache by context.key (derive may recreate descriptor objects). */
+    private readonly capsByKey;
+    /** Live Context descriptors by key (landing + derived). */
+    private readonly contexts;
+    constructor(config: AppConfig, accessClient: AccessClient);
+    /** Landing Context key (ACCESS for ssh; TARGET for paradi). */
+    get landingKey(): string;
+    summarize(ctx?: HostExecutionContext): ContextSummary;
+    /**
+     * Resolve Runtime Context by key. Omit / empty → landing.
+     * Unknown keys throw (must context_derive first).
+     */
+    requireContext(contextKey?: string): HostExecutionContext;
+    /** Shell on a Context (default landing). */
+    shellExec(command: string, opts?: {
+        contextKey?: string;
+        timeoutMs?: number;
+        cwd?: string;
+    }): Promise<ExecOutput>;
+    /**
+     * Derive a child Context (ACCESS_KIND=ssh only). Returns summary with contextKey.
+     * Omitting host uses config TARGET_* as default derive selector.
+     */
+    deriveContext(args?: {
+        host?: string;
+        user?: string;
+        password?: string;
+        useTarget?: boolean;
+    }): ContextSummary;
+    /**
+     * deriveContext + shellExec — ACCESS_KIND=ssh only.
+     * Also returns the derived contextKey via summarize after exec (caller should use derive for key-only).
+     */
+    sshExec(args: {
+        host?: string;
+        user?: string;
+        password?: string;
+        command: string;
+        timeoutMs?: number;
+    }): Promise<ExecOutput & {
+        contextKey: string;
+        endpoint: HostExecutionContext["endpoint"];
+    }>;
+    probe(args?: {
+        contextKey?: string;
+        timeoutMs?: number;
+    }): Promise<ProbeResult & ContextSummary>;
+    dockerPs(args?: {
+        contextKey?: string;
+        all?: boolean;
+        quiet?: boolean;
+        filter?: string;
+        timeoutMs?: number;
+    }): Promise<ExecOutput>;
+    dockerExec(args: {
+        container: string;
+        command: string;
+        workdir?: string;
+        contextKey?: string;
+        timeoutMs?: number;
+    }): Promise<ExecOutput>;
+    dockerLogs(args: {
+        container: string;
+        tail?: number;
+        since?: string;
+        timestamps?: boolean;
+        contextKey?: string;
+        timeoutMs?: number;
+    }): Promise<ExecOutput>;
+    /**
+     * Expand a contextKey endpoint into landing or host for copy/scp internals.
+     */
+    materializeFileEndpoint(endpoint: {
+        target: "context";
+        contextKey: string;
+        path: string;
+    }): {
+        target: "landing" | "host";
+        path: string;
+        host?: string;
+        user?: string;
+        password?: string;
+    };
+    private assertDeriveAllowed;
+    private remember;
+    private withCachedCaps;
+    private resolveHostContext;
+    private resolveDeriveSpec;
+}

package/dist/access/index.js

@@ -0,0 +1,174 @@
+import { SessionPool } from "./session-pool.js";
+import { SshAccessTransport } from "./ssh-transport.js";
+import { ParadiAccessTransport } from "./paradi-transport.js";
+import { resolveRemotePassword, resolveRemoteUser } from "../utils/remote-target.js";
+import { probeCapabilities } from "./probe.js";
+import * as docker from "./docker-runtime.js";
+/**
+ * Access + shell/docker Runtime facade.
+ * derive = Access (produces Context); Runtime only consumes Context by contextKey.
+ */
+export class AccessRuntime {
+    config;
+    accessContext;
+    pool;
+    sshTransport = new SshAccessTransport();
+    /** Capability cache by context.key (derive may recreate descriptor objects). */
+    capsByKey = new Map();
+    /** Live Context descriptors by key (landing + derived). */
+    contexts = new Map();
+    constructor(config, accessClient) {
+        this.config = config;
+        this.pool = new SessionPool(accessClient);
+        this.accessContext =
+            config.accessKind === "paradi-gateway"
+                ? new ParadiAccessTransport().createContext(config)
+                : this.sshTransport.createAccessContext(config);
+        this.pool.bindAccess(this.accessContext);
+        this.remember(this.accessContext);
+    }
+    /** Landing Context key (ACCESS for ssh; TARGET for paradi). */
+    get landingKey() {
+        return this.accessContext.key;
+    }
+    summarize(ctx = this.accessContext) {
+        const withCaps = this.withCachedCaps(ctx);
+        return {
+            contextKey: withCaps.key,
+            endpoint: withCaps.endpoint,
+            parentKey: withCaps.parentKey,
+            capabilities: withCaps.capabilities,
+        };
+    }
+    /**
+     * Resolve Runtime Context by key. Omit / empty → landing.
+     * Unknown keys throw (must context_derive first).
+     */
+    requireContext(contextKey) {
+        const key = contextKey?.trim();
+        if (!key) {
+            return this.withCachedCaps(this.accessContext);
+        }
+        const ctx = this.contexts.get(key);
+        if (!ctx) {
+            throw new Error(`Unknown contextKey=${key}. Call context_derive first (or omit contextKey for landing).`);
+        }
+        return this.withCachedCaps(ctx);
+    }
+    /** Shell on a Context (default landing). */
+    shellExec(command, opts = {}) {
+        const ctx = this.requireContext(opts.contextKey);
+        return this.pool.exec(ctx, command, opts.timeoutMs, opts.cwd);
+    }
+    /**
+     * Derive a child Context (ACCESS_KIND=ssh only). Returns summary with contextKey.
+     * Omitting host uses config TARGET_* as default derive selector.
+     */
+    deriveContext(args = {}) {
+        this.assertDeriveAllowed();
+        const host = args.useTarget ? undefined : args.host;
+        const ctx = this.resolveHostContext(host, args.user, args.password);
+        return this.summarize(ctx);
+    }
+    /**
+     * deriveContext + shellExec — ACCESS_KIND=ssh only.
+     * Also returns the derived contextKey via summarize after exec (caller should use derive for key-only).
+     */
+    async sshExec(args) {
+        this.assertDeriveAllowed();
+        const ctx = this.resolveHostContext(args.host, args.user, args.password);
+        const out = await this.pool.exec(ctx, args.command, args.timeoutMs);
+        return { ...out, contextKey: ctx.key, endpoint: ctx.endpoint };
+    }
+    async probe(args = {}) {
+        const ctx = this.requireContext(args.contextKey);
+        const result = await probeCapabilities(this.pool, ctx, args.timeoutMs);
+        this.capsByKey.set(ctx.key, ctx.capabilities);
+        return {
+            ...result,
+            ...this.summarize(ctx),
+        };
+    }
+    dockerPs(args = {}) {
+        const ctx = this.requireContext(args.contextKey);
+        return docker.dockerPs(this.pool, ctx, args).then((out) => {
+            this.capsByKey.set(ctx.key, ctx.capabilities);
+            return out;
+        });
+    }
+    dockerExec(args) {
+        const ctx = this.requireContext(args.contextKey);
+        return docker.dockerExec(this.pool, ctx, args).then((out) => {
+            this.capsByKey.set(ctx.key, ctx.capabilities);
+            return out;
+        });
+    }
+    dockerLogs(args) {
+        const ctx = this.requireContext(args.contextKey);
+        return docker.dockerLogs(this.pool, ctx, args).then((out) => {
+            this.capsByKey.set(ctx.key, ctx.capabilities);
+            return out;
+        });
+    }
+    /**
+     * Expand a contextKey endpoint into landing or host for copy/scp internals.
+     */
+    materializeFileEndpoint(endpoint) {
+        const ctx = this.requireContext(endpoint.contextKey);
+        const entry = this.pool.getEntry(ctx.key);
+        if (!entry) {
+            throw new Error(`No SessionPool binding for context key=${ctx.key}`);
+        }
+        if (entry.kind === "access") {
+            return { target: "landing", path: endpoint.path };
+        }
+        return {
+            target: "host",
+            path: endpoint.path,
+            host: entry.host,
+            user: entry.user,
+            password: entry.password,
+        };
+    }
+    assertDeriveAllowed() {
+        if (this.config.accessKind === "paradi-gateway") {
+            throw new Error("ACCESS_KIND=paradi-gateway already lands on TARGET - context_derive / ssh_exec are unsupported by current Paradi AccessTransport. Use shell_exec, docker_*, or k8s_* on the landing Context (omit contextKey).");
+        }
+    }
+    remember(ctx) {
+        this.contexts.set(ctx.key, ctx);
+        this.capsByKey.set(ctx.key, ctx.capabilities);
+    }
+    withCachedCaps(ctx) {
+        const cached = this.capsByKey.get(ctx.key);
+        if (cached) {
+            ctx.capabilities = cached;
+        }
+        else {
+            this.capsByKey.set(ctx.key, ctx.capabilities);
+        }
+        this.contexts.set(ctx.key, ctx);
+        return ctx;
+    }
+    resolveHostContext(host, user, password) {
+        const spec = this.resolveDeriveSpec(host, user, password);
+        const child = this.sshTransport.deriveContext(this.accessContext, spec);
+        this.pool.bindDerived(child, spec);
+        return this.withCachedCaps(child);
+    }
+    resolveDeriveSpec(host, user, password) {
+        const defaultSpec = this.sshTransport.defaultDeriveSpec(this.config);
+        const resolvedHost = host?.trim() || defaultSpec?.host;
+        if (!resolvedHost) {
+            throw new Error("host required, or set TARGET_HOST / pass useTarget with TARGET_* configured");
+        }
+        const resolvedUser = resolveRemoteUser(user, this.config.targetUser ?? defaultSpec?.user);
+        const resolvedPassword = resolveRemotePassword(password, this.config.targetPassword ?? defaultSpec?.password);
+        return {
+            host: resolvedHost,
+            user: resolvedUser,
+            password: resolvedPassword,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAW9C;;;GAGG;AACH,MAAM,OAAO,aAAa;IAUL;IATV,aAAa,CAAuB;IACpC,IAAI,CAAc;IACV,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACzD,gFAAgF;IAC/D,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpE,2DAA2D;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,YACmB,MAAiB,EAClC,YAA0B;QADT,WAAM,GAAN,MAAM,CAAW;QAGlC,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,UAAU,KAAK,gBAAgB;gBACpC,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,MAA4B,IAAI,CAAC,aAAa;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,GAAG;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,UAAmB;QAChC,MAAM,GAAG,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,+DAA+D,CACzF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,4CAA4C;IAC5C,SAAS,CACP,OAAe,EACf,OAAkE,EAAE;QAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAKV,EAAE;QACJ,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAMb;QACC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAAoD,EAAE;QAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO;YACL,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SACvB,CAAC;IACJ,CAAC;IAED,QAAQ,CACN,OAMI,EAAE;QAEN,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAMV;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAOV;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,QAIvB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAEO,mBAAmB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,gNAAgN,CACjN,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAyB;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAEO,cAAc,CAAC,GAAyB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,kBAAkB,CACxB,IAAwB,EACxB,IAAwB,EACxB,QAA4B;QAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAEO,iBAAiB,CACvB,IAAwB,EACxB,IAAwB,EACxB,QAA4B;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,IAAI,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1F,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,EAAE,QAAQ,CACpD,CAAC;QACF,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,gBAAgB;SAC3B,CAAC;IACJ,CAAC;CACF"}

package/dist/access/paradi-auth.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Paradi gateway SSH auth encodings (customer never chooses Mode names in mcp.json by default).
+ *
+ * - slash:    username = ACCESS_USER/TARGET_HOST/TARGET_USER, password = ACCESS_PASSWORD
+ * - compound: username = ACCESS_USER, password = ACCESS_PASSWORD@##@TARGET_HOST:SSH:22:TARGET_USER
+ * - auto:     try slash then compound on AUTH_FAILED; pin winner for this MCP process
+ */
+import type { AppConfig } from "../config.js";
+export type ParadiAuthMode = "slash" | "compound";
+export type ParadiAuthSetting = ParadiAuthMode | "auto";
+export type ParadiConnectParams = {
+    host: string;
+    port: number;
+    username: string;
+    /** Effective SSH password for this mode (ACCESS_PASSWORD or compound). */
+    password?: string;
+    mode: ParadiAuthMode;
+};
+export declare function paradiPinKey(config: AppConfig): string;
+export declare function getPinnedParadiAuth(config: AppConfig): ParadiAuthMode | undefined;
+export declare function pinParadiAuth(config: AppConfig, mode: ParadiAuthMode): void;
+/** Test helper — clear all process pins. */
+export declare function clearParadiAuthPins(): void;
+export declare function parseParadiAuthSetting(raw: string | undefined): ParadiAuthSetting;
+/**
+ * Modes to try for this connect. Pinned mode wins for the MCP process lifetime.
+ */
+export declare function resolveParadiAuthModesToTry(config: AppConfig): ParadiAuthMode[];
+export declare function buildParadiCompoundPassword(accessPassword: string, targetHost: string, targetUser: string, targetSshPort?: number): string;
+/** Build username+password for one Paradi auth mode (TCP still to ACCESS_HOST). */
+export declare function resolveParadiConnectParams(config: AppConfig, mode: ParadiAuthMode): ParadiConnectParams;
+/** True when failure is auth-only (safe to try the other Paradi mode). */
+export declare function isParadiAuthFailureMessage(message: string): boolean;

package/dist/access/paradi-auth.js

@@ -0,0 +1,89 @@
+import { buildParadiSshUsername } from "./paradi-username.js";
+/** Process-lifetime pin: gateway identity → winning auth mode. */
+const pinnedByGateway = new Map();
+export function paradiPinKey(config) {
+    return `${config.accessHost.trim()}:${config.accessPort}:${config.accessUser.trim()}`;
+}
+export function getPinnedParadiAuth(config) {
+    return pinnedByGateway.get(paradiPinKey(config));
+}
+export function pinParadiAuth(config, mode) {
+    pinnedByGateway.set(paradiPinKey(config), mode);
+}
+/** Test helper — clear all process pins. */
+export function clearParadiAuthPins() {
+    pinnedByGateway.clear();
+}
+export function parseParadiAuthSetting(raw) {
+    const v = (raw?.trim() || "auto").toLowerCase();
+    if (v === "slash" || v === "compound" || v === "auto") {
+        return v;
+    }
+    throw new Error(`ACCESS_PARADI_AUTH must be "auto", "slash", or "compound" (got "${raw}")`);
+}
+/**
+ * Modes to try for this connect. Pinned mode wins for the MCP process lifetime.
+ */
+export function resolveParadiAuthModesToTry(config) {
+    const pinned = getPinnedParadiAuth(config);
+    if (pinned) {
+        return [pinned];
+    }
+    const setting = config.accessParadiAuth ?? "auto";
+    if (setting === "slash") {
+        return ["slash"];
+    }
+    if (setting === "compound") {
+        return ["compound"];
+    }
+    // auto: slash first (existing slash-username gateways), then compound.
+    // Compound needs ACCESS_PASSWORD; without it only slash is attempted.
+    if (!config.accessPassword) {
+        return ["slash"];
+    }
+    return ["slash", "compound"];
+}
+export function buildParadiCompoundPassword(accessPassword, targetHost, targetUser, targetSshPort = 22) {
+    const p = accessPassword;
+    const h = targetHost.trim();
+    const u = targetUser.trim();
+    if (!h || !u) {
+        throw new Error("paradi compound password requires TARGET_HOST and TARGET_USER");
+    }
+    return `${p}@##@${h}:SSH:${targetSshPort}:${u}`;
+}
+/** Build username+password for one Paradi auth mode (TCP still to ACCESS_HOST). */
+export function resolveParadiConnectParams(config, mode) {
+    const targetHost = config.targetHost?.trim();
+    const targetUser = config.targetUser?.trim();
+    if (!targetHost || !targetUser) {
+        throw new Error("paradi-gateway requires TARGET_HOST and TARGET_USER");
+    }
+    const host = config.accessHost;
+    const port = config.accessPort;
+    const accessPassword = config.accessPassword;
+    if (mode === "slash") {
+        return {
+            host,
+            port,
+            username: buildParadiSshUsername(config.accessUser, targetHost, targetUser),
+            password: accessPassword,
+            mode,
+        };
+    }
+    if (!accessPassword) {
+        throw new Error("paradi compound auth requires ACCESS_PASSWORD (password@##@TARGET encoding)");
+    }
+    return {
+        host,
+        port,
+        username: config.accessUser,
+        password: buildParadiCompoundPassword(accessPassword, targetHost, targetUser),
+        mode,
+    };
+}
+/** True when failure is auth-only (safe to try the other Paradi mode). */
+export function isParadiAuthFailureMessage(message) {
+    return /All configured authentication methods failed|Authentication failed|Permission denied \(publickey|password|keyboard-interactive\)/i.test(message);
+}
+//# sourceMappingURL=paradi-auth.js.map

package/dist/access/paradi-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paradi-auth.js","sourceRoot":"","sources":["../../src/access/paradi-auth.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAc9D,kEAAkE;AAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE1D,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,OAAO,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,IAAoB;IACnE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,mBAAmB;IACjC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mEAAmE,GAAG,IAAI,CAC3E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAClD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,cAAsB,EACtB,UAAkB,EAClB,UAAkB,EAClB,aAAa,GAAG,EAAE;IAElB,MAAM,CAAC,GAAG,cAAc,CAAC;IACzB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,aAAa,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CACxC,MAAiB,EACjB,IAAoB;IAEpB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAE7C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;YAC3E,QAAQ,EAAE,cAAc;YACxB,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,UAAU;QAC3B,QAAQ,EAAE,2BAA2B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC;QAC7E,IAAI;KACL,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,mIAAmI,CAAC,IAAI,CAC7I,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/access/paradi-transport.d.ts

@@ -0,0 +1,10 @@
+import type { AppConfig } from "../config.js";
+import { type HostExecutionContext } from "./types.js";
+export { buildParadiSshUsername } from "./paradi-username.js";
+/**
+ * Paradi AccessTransport → plain HostExecutionContext (endpoint = TARGET).
+ * Runtime must not branch on Paradi; only Transport encodes gateway identity.
+ */
+export declare class ParadiAccessTransport {
+    createContext(config: AppConfig): HostExecutionContext;
+}

package/dist/access/paradi-transport.js

@@ -0,0 +1,39 @@
+import { buildContextKey, initialCapabilities, } from "./types.js";
+import { buildParadiSshUsername } from "./paradi-username.js";
+export { buildParadiSshUsername } from "./paradi-username.js";
+/**
+ * Paradi AccessTransport → plain HostExecutionContext (endpoint = TARGET).
+ * Runtime must not branch on Paradi; only Transport encodes gateway identity.
+ */
+export class ParadiAccessTransport {
+    createContext(config) {
+        if (config.accessKind !== "paradi-gateway") {
+            throw new Error(`ParadiAccessTransport only supports ACCESS_KIND=paradi-gateway (got ${config.accessKind})`);
+        }
+        const targetHost = config.targetHost?.trim();
+        const targetUser = config.targetUser?.trim();
+        if (!targetHost || !targetUser) {
+            throw new Error("paradi-gateway requires TARGET_HOST and TARGET_USER (landing Context is the target host)");
+        }
+        const sshUsername = buildParadiSshUsername(config.accessUser, targetHost, targetUser);
+        return {
+            key: buildContextKey({
+                transport: "paradi-gateway",
+                host: targetHost,
+                user: targetUser,
+                port: config.accessPort,
+                authIdentity: sshUsername,
+            }),
+            transport: "paradi-gateway",
+            // Landing endpoint is T (what Runtime sees), not the gateway IP.
+            endpoint: { host: targetHost, user: targetUser, port: 22 },
+            capabilities: {
+                ...initialCapabilities(true),
+                // Declared (research): SFTP unreliable; gateway may rate-limit channel opens.
+                sftp: "degraded",
+                channelOpenSensitive: true,
+            },
+        };
+    }
+}
+//# sourceMappingURL=paradi-transport.js.map

package/dist/access/paradi-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paradi-transport.js","sourceRoot":"","sources":["../../src/access/paradi-transport.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IAChC,aAAa,CAAC,MAAiB;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,UAAU,GAAG,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CACxC,MAAM,CAAC,UAAU,EACjB,UAAU,EACV,UAAU,CACX,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,eAAe,CAAC;gBACnB,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,MAAM,CAAC,UAAU;gBACvB,YAAY,EAAE,WAAW;aAC1B,CAAC;YACF,SAAS,EAAE,gBAAgB;YAC3B,iEAAiE;YACjE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;YAC1D,YAAY,EAAE;gBACZ,GAAG,mBAAmB,CAAC,IAAI,CAAC;gBAC5B,8EAA8E;gBAC9E,IAAI,EAAE,UAAU;gBAChB,oBAAoB,EAAE,IAAI;aAC3B;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/access/paradi-username.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Paradi Mode A identity encoding (user never puts this string in mcp.json).
+ * sshUsername = ACCESS_USER/TARGET_HOST/TARGET_USER
+ */
+export declare function buildParadiSshUsername(accessUser: string, targetHost: string, targetUser: string): string;

package/dist/access/paradi-username.js

@@ -0,0 +1,14 @@
+/**
+ * Paradi Mode A identity encoding (user never puts this string in mcp.json).
+ * sshUsername = ACCESS_USER/TARGET_HOST/TARGET_USER
+ */
+export function buildParadiSshUsername(accessUser, targetHost, targetUser) {
+    const a = accessUser.trim();
+    const h = targetHost.trim();
+    const u = targetUser.trim();
+    if (!a || !h || !u) {
+        throw new Error("paradi-gateway requires ACCESS_USER, TARGET_HOST, and TARGET_USER to build SSH username");
+    }
+    return `${a}/${h}/${u}`;
+}
+//# sourceMappingURL=paradi-username.js.map

package/dist/access/paradi-username.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paradi-username.js","sourceRoot":"","sources":["../../src/access/paradi-username.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,UAAkB,EAClB,UAAkB;IAElB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1B,CAAC"}

package/dist/access/probe.d.ts

@@ -0,0 +1,14 @@
+import type { SessionPool } from "./session-pool.js";
+import type { ContextCapabilities, HostExecutionContext } from "./types.js";
+export interface ProbeResult {
+    capabilities: ContextCapabilities;
+    raw: string;
+}
+/** Parse `MCP_CAP docker=yes|no kubectl=yes|no` from probe stdout. */
+export declare function parseCapProbeOutput(stdout: string): Pick<ContextCapabilities, "docker" | "kubectl">;
+/**
+ * Probe Runtime capabilities on a Context via SessionPool (never opens SSH itself).
+ * Updates ctx.capabilities in place. Does not treat SSH success as docker/kubectl=true.
+ */
+export declare function probeCapabilities(pool: SessionPool, ctx: HostExecutionContext, timeoutMs?: number): Promise<ProbeResult>;
+export declare function assertCapability(ctx: HostExecutionContext, name: "docker" | "kubectl"): void;

package/dist/access/probe.js

@@ -0,0 +1,63 @@
+const CAP_PROBE_CMD = [
+    'docker=no; command -v docker >/dev/null 2>&1 && docker=yes',
+    'kubectl=no; command -v kubectl >/dev/null 2>&1 && kubectl=yes',
+    'echo "MCP_CAP docker=$docker kubectl=$kubectl"',
+].join("; ");
+/** Parse `MCP_CAP docker=yes|no kubectl=yes|no` from probe stdout. */
+export function parseCapProbeOutput(stdout) {
+    const line = stdout
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .find((l) => l.startsWith("MCP_CAP "));
+    if (!line) {
+        return { docker: "unknown", kubectl: "unknown" };
+    }
+    const dockerMatch = /\bdocker=(yes|no)\b/.exec(line);
+    const kubectlMatch = /\bkubectl=(yes|no)\b/.exec(line);
+    return {
+        docker: toCap(dockerMatch?.[1]),
+        kubectl: toCap(kubectlMatch?.[1]),
+    };
+}
+function toCap(value) {
+    if (value === "yes") {
+        return true;
+    }
+    if (value === "no") {
+        return false;
+    }
+    return "unknown";
+}
+/**
+ * Probe Runtime capabilities on a Context via SessionPool (never opens SSH itself).
+ * Updates ctx.capabilities in place. Does not treat SSH success as docker/kubectl=true.
+ */
+export async function probeCapabilities(pool, ctx, timeoutMs = 30_000) {
+    const out = await pool.exec(ctx, CAP_PROBE_CMD, timeoutMs);
+    const parsed = parseCapProbeOutput(out.stdout);
+    const execCap = out.exitCode !== 0
+        ? ctx.capabilities.exec
+        : ctx.capabilities.exec === false
+            ? false
+            : true;
+    ctx.capabilities = {
+        exec: execCap,
+        docker: out.exitCode !== 0 ? "unknown" : parsed.docker,
+        kubectl: out.exitCode !== 0 ? "unknown" : parsed.kubectl,
+        // Preserve transport-declared fields
+        sftp: ctx.capabilities.sftp,
+        channelOpenSensitive: ctx.capabilities.channelOpenSensitive,
+    };
+    return { capabilities: { ...ctx.capabilities }, raw: out.stdout.trim() };
+}
+export function assertCapability(ctx, name) {
+    const value = ctx.capabilities[name];
+    if (value === true) {
+        return;
+    }
+    if (value === "unknown") {
+        throw new Error(`capabilities.${name} is unknown after probe (CLI check failed or marker missing). Inspect context_probe/raw output; do not assume ${name} is available.`);
+    }
+    throw new Error(`capabilities.${name}=false on ${ctx.endpoint.host} (user=${ctx.endpoint.user ?? "?"}). ${name} CLI not found on this Context.`);
+}
+//# sourceMappingURL=probe.js.map

package/dist/access/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/access/probe.ts"],"names":[],"mappings":"AAIA,MAAM,aAAa,GAAG;IACpB,4DAA4D;IAC5D,+DAA+D;IAC/D,gDAAgD;CACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAOb,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,IAAI,GAAG,MAAM;SAChB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAyB;IACtC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,GAAyB,EACzB,SAAS,GAAG,MAAM;IAElB,MAAM,GAAG,GAAe,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GACX,GAAG,CAAC,QAAQ,KAAK,CAAC;QAChB,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI;QACvB,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,KAAK;YAC/B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,CAAC;IACb,GAAG,CAAC,YAAY,GAAG;QACjB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QACtD,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;QACxD,qCAAqC;QACrC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI;QAC3B,oBAAoB,EAAE,GAAG,CAAC,YAAY,CAAC,oBAAoB;KAC5D,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,IAA0B;IAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,iHAAiH,IAAI,gBAAgB,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,aAAa,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,iCAAiC,CAChI,CAAC;AACJ,CAAC"}

package/dist/access/session-pool.d.ts

@@ -0,0 +1,25 @@
+import type { AccessClient, ExecOutput } from "../ssh/access-client.js";
+import type { DeriveSpec, HostExecutionContext } from "./types.js";
+type PoolEntry = {
+    kind: "access";
+} | {
+    kind: "derived";
+    parentKey: string;
+    host: string;
+    user: string;
+    password?: string;
+};
+/**
+ * Session pool keyed by context.key. Context itself never holds clients.
+ * Phase 1: access entry ??AccessClient; derived ??parent accessClient + ssh/sshpass.
+ */
+export declare class SessionPool {
+    private readonly accessClient;
+    private readonly entries;
+    constructor(accessClient: AccessClient);
+    bindAccess(ctx: HostExecutionContext): void;
+    bindDerived(ctx: HostExecutionContext, spec: DeriveSpec): void;
+    getEntry(contextKey: string): PoolEntry | undefined;
+    exec(ctx: HostExecutionContext, command: string, timeoutMs?: number, cwd?: string): Promise<ExecOutput>;
+}
+export {};