host-execution-mcp 1.0.0

package/dist/ssh/bastion-client.js

@@ -0,0 +1,423 @@
+import { Client } from "ssh2";
+import { resolveAccessSshIdentity, resolveSshAuthOptions } from "../config.js";
+import { bashSingleQuote, buildBashLcCommand } from "../utils/shell-quote.js";
+import { throwIfAborted, } from "../utils/copy-transfer.js";
+import { transferLocalBastion } from "./hop1-sftp.js";
+import { AccessUnavailableError, isAccessUnavailableError, shouldRetryBastionConnect, toAccessUnavailableError, } from "./bastion-errors.js";
+/** Positive readiness TTL after a successful probe / connect. */
+const READY_TTL_MS = 30_000;
+/** Negative cache after classified connect failure (avoid hammering). */
+const UNAVAILABLE_TTL_MS = 15_000;
+/** SSH readyTimeout + hard deadline for probe / check. */
+const PROBE_READY_TIMEOUT_MS = 5_000;
+/** Shell verify after SSH ready (within overall ?10s probe budget). */
+const PROBE_SHELL_TIMEOUT_MS = 5_000;
+/** Shared exec session connect timeout. */
+const EXEC_CONNECT_TIMEOUT_MS = 20_000;
+/** Max reconnects for transient stream-phase drops during exec. */
+const MAX_RECONNECT_ATTEMPTS = 3;
+export class BastionClient {
+    client = null;
+    connecting = null;
+    /** Serializes ensureBastionReady / check cache updates. */
+    gate = Promise.resolve();
+    config;
+    readyUntil = 0;
+    unavailableUntil = 0;
+    lastUnavailable = null;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Ensure bastion is reachable (TTL-cached). Uses an ephemeral SSH probe ?
+     * never disconnects an in-flight shared exec session on success.
+     */
+    async ensureBastionReady() {
+        await this.withGate(async () => {
+            const now = Date.now();
+            if (now < this.unavailableUntil && this.lastUnavailable) {
+                throw this.lastUnavailable;
+            }
+            if (this.client && now < this.readyUntil) {
+                return;
+            }
+            try {
+                await this.probeEphemeral();
+                this.markReady();
+                if (!this.client) {
+                    await this.ensureConnectedUnlocked();
+                }
+            }
+            catch (error) {
+                throw this.markConnectUnavailable(error);
+            }
+        });
+    }
+    /**
+     * Short-timeout Local to ACCESS probe (ephemeral client; <=10s worst case).
+     * Respects negative TTL (returns cached failure). Does not sever shared exec SSH.
+     */
+    async check() {
+        return this.withGate(async () => {
+            const identity = resolveAccessSshIdentity(this.config);
+            const host = identity.host;
+            const port = identity.port;
+            const now = Date.now();
+            if (now < this.unavailableUntil && this.lastUnavailable) {
+                return this.lastUnavailable.toJSON();
+            }
+            const started = Date.now();
+            try {
+                await this.probeEphemeral();
+                this.markReady();
+                const kindHint = this.config.accessKind === "paradi-gateway"
+                    ? ` (paradi ? ${this.config.targetHost})`
+                    : "";
+                return {
+                    reachable: true,
+                    latencyMs: Date.now() - started,
+                    host,
+                    port,
+                    auth: "ok",
+                    message: `ACCESS OK: ${host}:${port}${kindHint}`,
+                };
+            }
+            catch (error) {
+                return this.markConnectUnavailable(error).toJSON();
+            }
+        });
+    }
+    async exec(command, timeoutMs, cwd, signal) {
+        const effectiveTimeout = timeoutMs ?? this.config.defaultTimeoutMs;
+        const remoteCommand = buildBashLcCommand(command, cwd);
+        const started = Date.now();
+        await this.ensureBastionReady();
+        let lastError;
+        for (let attempt = 1; attempt <= MAX_RECONNECT_ATTEMPTS; attempt++) {
+            try {
+                throwIfAborted(signal);
+                await this.ensureConnected();
+                const result = await this.execOnClient(this.requireClient(), remoteCommand, {
+                    timeoutMs: effectiveTimeout,
+                    signal,
+                });
+                this.markReady();
+                return { ...result, durationMs: Date.now() - started };
+            }
+            catch (error) {
+                lastError = error;
+                const msg = error instanceof Error ? error.message : String(error);
+                if (signal?.aborted || msg === "Copy aborted") {
+                    break;
+                }
+                // Stream-phase: only elevate true bastion-down signals (not ECONNRESET/EPIPE).
+                const unavailable = toAccessUnavailableError(error, this.config.accessHost, this.config.accessPort, "stream");
+                if (unavailable) {
+                    throw this.markConnectUnavailable(unavailable);
+                }
+                if (!shouldRetryBastionConnect(error)) {
+                    break;
+                }
+                this.disconnect();
+                if (attempt === MAX_RECONNECT_ATTEMPTS) {
+                    break;
+                }
+            }
+        }
+        throw lastError instanceof Error ? lastError : new Error(String(lastError));
+    }
+    disconnect() {
+        if (this.client) {
+            this.client.end();
+            this.client = null;
+        }
+        this.connecting = null;
+    }
+    /**
+     * Upload local path (file or directory) ? bastion via independent Hop1 SFTP.
+     * Transfer-phase errors are not reclassified into ACCESS_UNAVAILABLE.
+     */
+    async uploadPath(localPath, remotePath, options) {
+        await this.ensureBastionReady();
+        try {
+            return await transferLocalBastion({
+                direction: "upload",
+                localPath,
+                remotePath,
+                config: this.config,
+                options,
+            }, (remote, timeoutMs) => this.remoteSha256(remote, timeoutMs));
+        }
+        catch (error) {
+            // Only connect-time AccessUnavailableError from Hop1 SFTP connect is cached.
+            if (isAccessUnavailableError(error)) {
+                throw this.markConnectUnavailable(error);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Download bastion path (file or directory) ? local via independent Hop1 SFTP.
+     */
+    async downloadPath(remotePath, localPath, options) {
+        await this.ensureBastionReady();
+        try {
+            return await transferLocalBastion({
+                direction: "download",
+                localPath,
+                remotePath,
+                config: this.config,
+                options,
+            }, (remote, timeoutMs) => this.remoteSha256(remote, timeoutMs));
+        }
+        catch (error) {
+            if (isAccessUnavailableError(error)) {
+                throw this.markConnectUnavailable(error);
+            }
+            throw error;
+        }
+    }
+    async withGate(fn) {
+        const prev = this.gate;
+        let release;
+        this.gate = new Promise((resolve) => {
+            release = resolve;
+        });
+        await prev;
+        try {
+            return await fn();
+        }
+        finally {
+            release();
+        }
+    }
+    markReady() {
+        this.readyUntil = Date.now() + READY_TTL_MS;
+        this.unavailableUntil = 0;
+        this.lastUnavailable = null;
+    }
+    /**
+     * Record a connect-phase failure. Negative TTL only for classified causes
+     * (not UNKNOWN), so transient unknowns are not blackholed for 15s.
+     */
+    markConnectUnavailable(error) {
+        const unavailable = (isAccessUnavailableError(error) ? error : null) ??
+            toAccessUnavailableError(error, this.config.accessHost, this.config.accessPort, "connect") ??
+            new AccessUnavailableError({
+                causeCode: "UNKNOWN",
+                host: this.config.accessHost,
+                port: this.config.accessPort,
+                detail: error instanceof Error ? error.message : String(error),
+                cause: error,
+            });
+        this.disconnect();
+        this.readyUntil = 0;
+        if (unavailable.causeCode === "UNKNOWN") {
+            this.unavailableUntil = 0;
+            this.lastUnavailable = null;
+        }
+        else {
+            this.unavailableUntil = Date.now() + UNAVAILABLE_TTL_MS;
+            this.lastUnavailable = unavailable;
+        }
+        return unavailable;
+    }
+    /** Ephemeral SSH + shell probe; never assigns or disconnects `this.client`. */
+    async probeEphemeral() {
+        const client = await this.openSshClient(PROBE_READY_TIMEOUT_MS);
+        try {
+            const result = await this.execOnClient(client, "echo bastion_ok", {
+                timeoutMs: PROBE_SHELL_TIMEOUT_MS,
+            });
+            if (result.exitCode !== 0 || !result.stdout.includes("bastion_ok")) {
+                throw new AccessUnavailableError({
+                    causeCode: "SSH_HANDSHAKE",
+                    host: this.config.accessHost,
+                    port: this.config.accessPort,
+                    detail: `shell probe failed: exit=${result.exitCode} stdout=${result.stdout.trim()}`,
+                });
+            }
+        }
+        finally {
+            try {
+                client.end();
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    async remoteSha256(remotePath, timeoutMs) {
+        const raw = await this.exec(`sha256sum ${bashSingleQuote(remotePath)} | awk '{print $1}'`, timeoutMs);
+        const hash = raw.stdout.trim().split(/\s+/)[0];
+        if (!/^[a-f0-9]{64}$/i.test(hash)) {
+            throw new Error(`Failed to compute remote sha256 for ${remotePath}: ${raw.stdout || raw.stderr}`);
+        }
+        return hash.toLowerCase();
+    }
+    async ensureConnected() {
+        await this.withGate(() => this.ensureConnectedUnlocked());
+    }
+    async ensureConnectedUnlocked() {
+        if (this.client) {
+            return;
+        }
+        if (this.connecting) {
+            await this.connecting;
+            return;
+        }
+        this.connecting = (async () => {
+            try {
+                const client = await this.openSshClient(EXEC_CONNECT_TIMEOUT_MS);
+                this.client = client;
+                client.on("close", () => {
+                    if (this.client === client) {
+                        this.client = null;
+                    }
+                });
+            }
+            catch (error) {
+                throw this.markConnectUnavailable(error);
+            }
+        })();
+        try {
+            await this.connecting;
+        }
+        finally {
+            this.connecting = null;
+        }
+    }
+    requireClient() {
+        if (!this.client) {
+            throw new Error("SSH client is not connected");
+        }
+        return this.client;
+    }
+    /**
+     * Open a dedicated ssh2 Client with readyTimeout + hard deadline
+     * (covers TCP blackhole where ssh2 readyTimeout alone is insufficient).
+     */
+    openSshClient(readyTimeoutMs) {
+        const auth = resolveSshAuthOptions(this.config);
+        const identity = resolveAccessSshIdentity(this.config);
+        const connectConfig = {
+            host: identity.host,
+            port: identity.port,
+            username: identity.username,
+            readyTimeout: readyTimeoutMs,
+        };
+        if (auth.agent) {
+            connectConfig.agent = auth.agent;
+        }
+        if (auth.privateKey) {
+            connectConfig.privateKey = auth.privateKey;
+        }
+        if (auth.password) {
+            connectConfig.password = auth.password;
+        }
+        return new Promise((resolve, reject) => {
+            const client = new Client();
+            let settled = false;
+            const finish = (fn) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                clearTimeout(timer);
+                fn();
+            };
+            const timer = setTimeout(() => {
+                finish(() => {
+                    try {
+                        client.end();
+                    }
+                    catch {
+                        // ignore
+                    }
+                    reject(Object.assign(new Error("Timed out while waiting for handshake"), {
+                        code: "ETIMEDOUT",
+                    }));
+                });
+            }, readyTimeoutMs);
+            client
+                .on("ready", () => {
+                finish(() => resolve(client));
+            })
+                .on("error", (error) => {
+                finish(() => reject(error));
+            })
+                .on("close", () => {
+                finish(() => reject(new Error("SSH closed before ready")));
+            })
+                .connect(connectConfig);
+        });
+    }
+    execOnClient(client, command, options = { timeoutMs: 60_000 }) {
+        throwIfAborted(options.signal);
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            let stream;
+            const cleanup = () => {
+                clearTimeout(timer);
+                options.signal?.removeEventListener("abort", onAbort);
+            };
+            const fail = (error) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                cleanup();
+                try {
+                    stream?.close?.();
+                    stream?.destroy?.();
+                }
+                catch {
+                    // ignore
+                }
+                reject(error instanceof Error ? error : new Error(String(error)));
+            };
+            const onAbort = () => {
+                fail(new Error("Copy aborted"));
+            };
+            const timer = setTimeout(() => {
+                fail(new Error(`Operation timed out after ${options.timeoutMs}ms`));
+            }, options.timeoutMs);
+            if (options.signal) {
+                if (options.signal.aborted) {
+                    onAbort();
+                    return;
+                }
+                options.signal.addEventListener("abort", onAbort, { once: true });
+            }
+            client.exec(command, (error, execStream) => {
+                if (error) {
+                    fail(error);
+                    return;
+                }
+                stream = execStream;
+                let stdout = "";
+                let stderr = "";
+                execStream
+                    .on("close", (code) => {
+                    if (settled) {
+                        return;
+                    }
+                    settled = true;
+                    cleanup();
+                    resolve({
+                        stdout,
+                        stderr,
+                        exitCode: code ?? 1,
+                    });
+                })
+                    .on("data", (chunk) => {
+                    stdout += chunk.toString();
+                });
+                execStream.stderr.on("data", (chunk) => {
+                    stderr += chunk.toString();
+                });
+            });
+        });
+    }
+}
+//# sourceMappingURL=bastion-client.js.map

package/dist/ssh/bastion-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bastion-client.js","sourceRoot":"","sources":["../../src/ssh/bastion-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAsB,MAAM,MAAM,CAAC;AAElD,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,cAAc,GAGf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,GAEzB,MAAM,qBAAqB,CAAC;AAS7B,iEAAiE;AACjE,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,2CAA2C;AAC3C,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,mEAAmE;AACnE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,OAAO,aAAa;IAChB,MAAM,GAAkB,IAAI,CAAC;IAC7B,UAAU,GAAyB,IAAI,CAAC;IAChD,2DAA2D;IACnD,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/B,MAAM,CAAY;IAC3B,UAAU,GAAG,CAAC,CAAC;IACf,gBAAgB,GAAG,CAAC,CAAC;IACrB,eAAe,GAAkC,IAAI,CAAC;IAE9D,YAAY,MAAiB;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACxD,MAAM,IAAI,CAAC,eAAe,CAAC;YAC7B,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACxD,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;YACvC,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjB,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB;oBACzC,CAAC,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG;oBACzC,CAAC,CAAC,EAAE,CAAC;gBACT,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAC/B,IAAI;oBACJ,IAAI;oBACJ,IAAI,EAAE,IAAI;oBACV,OAAO,EAAE,cAAc,IAAI,IAAI,IAAI,GAAG,QAAQ,EAAE;iBACjD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,SAAkB,EAClB,GAAY,EACZ,MAAoB;QAEpB,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACnE,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE3B,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAEhC,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,sBAAsB,EAAE,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC;gBACH,cAAc,CAAC,MAAM,CAAC,CAAC;gBACvB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE;oBAC1E,SAAS,EAAE,gBAAgB;oBAC3B,MAAM;iBACP,CAAC,CAAC;gBACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjB,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;YACzD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,MAAM,EAAE,OAAO,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;oBAC9C,MAAM;gBACR,CAAC;gBACD,+EAA+E;gBAC/E,MAAM,WAAW,GAAG,wBAAwB,CAC1C,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,QAAQ,CACT,CAAC;gBACF,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;oBACvC,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,UAAU;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,SAAiB,EACjB,UAAkB,EAClB,OAAyB;QAEzB,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAC/B;gBACE,SAAS,EAAE,QAAQ;gBACnB,SAAS;gBACT,UAAU;gBACV,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO;aACR,EACD,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAC5D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,UAAkB,EAClB,SAAiB,EACjB,OAAyB;QAEzB,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAC/B;gBACE,SAAS,EAAE,UAAU;gBACrB,SAAS;gBACT,UAAU;gBACV,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO;aACR,EACD,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAC5D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,EAAoB;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACxC,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC;QACX,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,KAAc;QAC3C,MAAM,WAAW,GACf,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,wBAAwB,CACtB,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,SAAS,CACV;YACD,IAAI,sBAAsB,CAAC;gBACzB,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC9D,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QAEL,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;YACxD,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC;QACrC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE;gBAChE,SAAS,EAAE,sBAAsB;aAClC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,sBAAsB,CAAC;oBAC/B,SAAS,EAAE,eAAe;oBAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAC5B,MAAM,EAAE,4BAA4B,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBACrF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,SAAiB;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CACzB,aAAa,eAAe,CAAC,UAAU,CAAC,qBAAqB,EAC7D,SAAS,CACV,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACrB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;oBACrB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,cAAsB;QAC1C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,aAAa,GAAkB;YACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,cAAc;SAC7B,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;gBAChC,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,EAAE,CAAC;YACP,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,GAAG,EAAE;oBACV,IAAI,CAAC;wBACH,MAAM,CAAC,GAAG,EAAE,CAAC;oBACf,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,MAAM,CACJ,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAAE;wBAChE,IAAI,EAAE,WAAW;qBAClB,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,cAAc,CAAC,CAAC;YAEnB,MAAM;iBACH,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAChB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC;iBACD,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,CAAC,CAAC;iBACD,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAChB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC;iBACD,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAClB,MAAc,EACd,OAAe,EACf,UAAuD,EAAE,SAAS,EAAE,MAAM,EAAE;QAE5E,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,IAAI,OAAO,CAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrE,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,MAA+F,CAAC;YAEpG,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC,CAAC;YAEF,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE;gBAC9B,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;oBAClB,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;YACtE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAEtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;gBACzC,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC,KAAK,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,UAAU,CAAC;gBAEpB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAEhB,UAAU;qBACP,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;oBACnC,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO;oBACT,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC;wBACN,MAAM;wBACN,MAAM;wBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;qBACpB,CAAC,CAAC;gBACL,CAAC,CAAC;qBACD,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;oBACrC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBAEL,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;oBACtD,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC7B,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/ssh/bastion-errors.d.ts

@@ -0,0 +1,62 @@
+/**
+
+ * Domain errors for Hop1 ACCESS connectivity (environment vs business failure).
+
+ *
+
+ * phase=connect: TCP/SSH handshake / auth — may become ACCESS_UNAVAILABLE + neg-cache
+
+ * phase=stream: mid-session channel/exec — ECONNRESET/EPIPE stay retryable, not access-down
+
+ */
+export type AccessUnavailableCause = "VPN_OR_NETWORK" | "AUTH_FAILED" | "SSH_HANDSHAKE" | "UNKNOWN";
+/** Where the error was observed. */
+export type BastionErrorPhase = "connect" | "stream";
+export interface AccessCheckResult {
+    reachable: boolean;
+    latencyMs?: number;
+    host: string;
+    port: number;
+    auth?: "ok" | "failed";
+    reason?: AccessUnavailableCause;
+    code?: "ACCESS_UNAVAILABLE";
+    retryable?: boolean;
+    message: string;
+    hints?: string[];
+}
+export declare class AccessUnavailableError extends Error {
+    readonly code: "ACCESS_UNAVAILABLE";
+    readonly causeCode: AccessUnavailableCause;
+    /** Always false today — Agents must not auto-retry access-down. */
+    readonly retryable = false;
+    readonly hints: string[];
+    readonly host: string;
+    readonly port: number;
+    constructor(input: {
+        causeCode: AccessUnavailableCause;
+        host: string;
+        port: number;
+        detail?: string;
+        cause?: unknown;
+    });
+    toJSON(): AccessCheckResult;
+}
+export declare function isAccessUnavailableError(error: unknown): error is AccessUnavailableError;
+/** Exec/command wall-clock timeout — not an ACCESS connectivity failure. */
+export declare function isCommandTimeoutError(error: unknown): boolean;
+/**
+
+ * Whether the exec reconnect loop should try again (stream-phase only).
+
+ * Connect failures never enter this path — they become AccessUnavailableError first.
+
+ */
+export declare function shouldRetryBastionConnect(error: unknown): boolean;
+/**
+
+ * Map an error to AccessUnavailableError, or null if it is not an access-down signal.
+
+ * Connect-phase includes ECONNRESET/EPIPE; stream-phase does not (those stay retryable).
+
+ */
+export declare function toAccessUnavailableError(error: unknown, host: string, port: number, phase: BastionErrorPhase): AccessUnavailableError | null;