host-execution-mcp 1.0.1 → 2.0.0

package/dist/instructions.js

@@ -1,88 +1,90 @@
+import { loadSourceLinks } from "./config-yaml.js";
 function buildSshBaseInstructions() {
-    return `You are connected to host-execution-mcp, a HostExecutionContext-based remote execution MCP.
+    return `You are connected to host-execution-mcp.
 
 Execution model:
-  Access:  MCP client → AccessTransport → HostExecutionContext (landing)
-  Runtime: selected Context → shell / docker / k8s / copy (SessionPool; Runtime never creates SSH)
-  Derive:  context_derive → contextKey (ACCESS_KIND=ssh only). This tool path is ACCESS→host, not laptop SSH.
+  Access: MCP client → SSH → this YAML link's landing (ACCESS_HOST)
+  Runtime: shell / docker / kubectl / copy on that landing
+  Second hop: pass host (IP reachable FROM ACCESS). Omit host = stay on the landing.
+  This tool path is ACCESS→host, not laptop SSH.
 
-Context vs shell:
-- context_derive — create a derived HostExecutionContext; returns contextKey (does not probe reachability)
-- shell_exec — shell on a Context; never creates Context (omit contextKey = AccessTransport landing)
-- ssh_exec — shortcut for context_derive + shell_exec; returns reusable contextKey. Prefer for derive+shell in one call; reuse the key for follow-up docker_*/remote_*/shell_exec
-
-docker_* / context_probe: Runtime on selected Context.
-Omit contextKey = AccessTransport landing (ACCESS under ssh; TARGET under paradi-gateway).
-
-remote_* target=context = HostExecutionContext by contextKey (from context_derive / ssh_exec).
-
-Tool selection:
-- access_check — Local→ACCESS connectivity (≤10s; NOT kubectl). First session / after ACCESS_UNAVAILABLE
-- shell_exec — landing or derived shell (contextKey)
-- context_derive — need a contextKey without running a command yet
-- ssh_exec — one-shot derive+shell (returns contextKey)
-- docker_* — Docker on landing or contextKey
-- k8s_* — kubectl on landing only (by design). kubectl on a derived host: shell_exec(contextKey, "kubectl …")
-- remote_* target=landing|pod|context — files/ps/copy
-- remote_copy_file vs remote_copy_start — sync vs async; never auto-promote; prefer start when size>256MB or ETA>2min
+Tools:
+- access_check — Local→ACCESS probe (≤10s; NOT kubectl). First session / after ACCESS_UNAVAILABLE
+- shell_exec — command on the selected machine (omit host = landing; pass host = hop-2)
+- context_probe / docker_* / k8s_* / remote_* — same pick: description + optional host
+- remote_read_file / remote_ps — path on that machine; add namespace+pod to go into a container via kubectl there
+- remote_copy_* — endpoints target=local|remote|pod; remote/pod use the same selected machine
 
 Hard rules:
-- access_check.reachable=false or code=ACCESS_UNAVAILABLE → stop (VPN / ACCESS_HOST); do not retry these tools
-- SSH success ≠ docker/kubectl; unknown ≠ true — never invent true; never reuse capabilities across Contexts
+- access_check.reachable=false or code=ACCESS_UNAVAILABLE → stop THIS link (VPN / ACCESS_HOST). Other YAML descriptions may still work.
+- SSH success ≠ docker/kubectl; unknown ≠ true — never invent true; never reuse capabilities across machines
 - Before pkill/kill/rm: remote_ps or user confirmation
-- Never assume namespace/paths; never reuse ACCESS_USER as TARGET_USER / derive user
+- Never assume namespace/paths; never reuse ACCESS_USER as hop-2 user
 - success=false: read stdout (stderr merged). truncated → more lines / remote_copy_*
 - Multi-container pods: pass container name
-- Operational cookbook (shell quoting, CRLF, docker login quirks, registry probes): see docs/AGENT_GUIDE.md`;
+- Once per conversation: listResources and read host-execution://guides/user, host-execution://guides/agent, and host-execution://guides/yaml. GUIDE is the capability the user wants; if a tool cannot meet it, tell the user. Reuse for the session — do not look for repo file paths.`;
 }
 function buildParadiBaseInstructions(config) {
-    const target = config.targetHost?.trim() || "<TARGET_HOST>";
-    return `You are connected to host-execution-mcp, a HostExecutionContext-based remote execution MCP (ACCESS_KIND=paradi-gateway).
+    const target = config.targetHost?.trim();
+    const landingHint = target
+        ? `TARGET_HOSTS has one landing (${target}) — omit host on that machine.`
+        : `TARGET_HOSTS has no single default — pass host to select a TARGET landing.`;
+    return `You are connected to host-execution-mcp (ACCESS_KIND=paradi-gateway).
 
-Landing endpoint is TARGET (${target}) — not the gateway OS. Runtime does not know gateway details; never creates SSH.
+${landingHint} Landing is a TARGET OS (encoded at the gateway), not the gateway OS.
+Pass host to select a TARGET landing (gateway re-encodes identity) — not hop-2 SSH from the current machine.
 
-Derive / context_derive / ssh_exec / remote_* target=context / contextKey: unsupported by current Paradi AccessTransport (landing is already TARGET). Handlers throw if called — omit contextKey; use target=landing|pod|local.
-
-Default workflow:
-- Shell: shell_exec or remote_* target=landing
-- Docker / context_probe: omit contextKey (landing = TARGET)
-- Pods: k8s_* / remote_* target=pod (kubectl on landing)
-- Copy: local↔landing or pod/local; SFTP degraded — prefer remote_copy_start for large files
+Workflow:
+- One TARGET_HOSTS: omit host
+- Many or omitted: pass host on shell_exec / docker_* / remote_*
+- Pods / copy: same machine as shell_exec. Copy target=remote = that landing; no hop-2. SFTP degraded — prefer remote_copy_start for large files.
 
 Hard rules:
-- access_check.reachable=false or ACCESS_UNAVAILABLE → stop (VPN / ACCESS_HOST)
-- unknown ≠ true; SSH success ≠ docker/kubectl; never reuse capabilities across Contexts
+- access_check.reachable=false or ACCESS_UNAVAILABLE → stop THIS link (VPN / ACCESS_HOST)
+- unknown ≠ true; SSH success ≠ docker/kubectl; never reuse capabilities across machines
 - Before pkill/kill/rm: remote_ps or user confirmation
 - Never assume namespace/paths
-- Operational cookbook: docs/AGENT_GUIDE.md`;
+- Once per conversation: listResources and read host-execution://guides/user, host-execution://guides/agent, and host-execution://guides/yaml. GUIDE is the capability the user wants; if a tool cannot meet it, tell the user. Reuse for the session — do not look for repo file paths.`;
 }
-/** TARGET_* default derive auth so agents omit configured defaults instead of asking the human. */
+/** TARGET_* default hop-2 / Paradi auth so agents omit configured defaults instead of asking the human. */
 export function buildDerivedHostAuthGuidance(config) {
     if (config.accessKind === "paradi-gateway") {
-        const host = config.targetHost?.trim();
         return `
-Paradi landing: Context endpoint is TARGET${host ? ` (${host})` : ""}. Derive unsupported by current Paradi AccessTransport — omit contextKey; context_derive / ssh_exec / target=context throw if called. Use shell_exec, docker_*, k8s_*, target=landing|pod|local.`;
+Paradi landing select.${formatTargetHostHint(config)} Pass host on tools to pick a TARGET landing (gateway re-encodes identity). Omit user/password when TARGET_USER is set. Do not hop-2 from a Paradi landing.`;
     }
     const user = config.targetUser?.trim();
     const passwordSet = Boolean(config.targetPassword);
-    const host = config.targetHost?.trim();
-    const hostHint = host ? ` TARGET_HOST=${host}.` : "";
-    const noAccessUserFallback = " Never reuse ACCESS_USER as TARGET_USER / derive user — pass TARGET_USER (or tool user) explicitly.";
-    const shortcutHint = " ssh_exec = context_derive + shell_exec shortcut (returns reusable contextKey).";
+    const hostHint = formatTargetHostHint(config);
+    const noAccessUserFallback = " Never reuse ACCESS_USER as hop-2 user — pass TARGET_USER (or tool user) explicitly.";
     if (!user && !passwordSet) {
         return `
-Derive host auth: TARGET_* unset — pass user (password if no key).${hostHint}${noAccessUserFallback}${shortcutHint} Do not invent defaults.`;
+Hop-2 auth: TARGET_* unset — pass user (password if no key) with host.${hostHint}${noAccessUserFallback} Do not invent defaults.`;
     }
     if (user && passwordSet) {
         return `
-Derive host auth: TARGET_* active (user=${user}, password=set)${hostHint} — omit user/password on context_derive / ssh_exec; do not ask the human. Override only for a different account.${noAccessUserFallback}${shortcutHint}`;
+Hop-2 auth: TARGET_* active (user=${user}, password=set)${hostHint} — omit user/password when passing host; do not ask the human. Override only for a different account.${noAccessUserFallback}`;
     }
     if (user) {
         return `
-Derive host auth: TARGET_USER=${user}${hostHint} — omit user on context_derive / ssh_exec; pass password only if no key.${noAccessUserFallback}${shortcutHint}`;
+Hop-2 auth: TARGET_USER=${user}${hostHint} — omit user when passing host; pass password only if no key.${noAccessUserFallback}`;
     }
     return `
-Derive host auth: TARGET_PASSWORD set${hostHint} — omit password on context_derive / ssh_exec; still pass user (TARGET_USER unset). Do not invent a username.${noAccessUserFallback}${shortcutHint}`;
+Hop-2 auth: TARGET_PASSWORD set${hostHint} — omit password when passing host; still pass user (TARGET_USER unset). Do not invent a username.${noAccessUserFallback}`;
+}
+function formatTargetHostHint(config) {
+    const hosts = config.targetHosts?.length
+        ? config.targetHosts
+        : config.targetHost?.trim()
+            ? [config.targetHost.trim()]
+            : [];
+    if (hosts.length === 0) {
+        return "";
+    }
+    const joined = hosts.join(",");
+    if (config.targetHost && hosts.length === 1) {
+        return ` TARGET_HOSTS=${joined} — pass that host to run on the hop-2 machine (omit host = ACCESS landing).`;
+    }
+    return ` TARGET_HOSTS=${joined} — pass host from user context; no single default.`;
 }
 export function buildServerInstructions(config) {
     const base = config.accessKind === "paradi-gateway"
@@ -90,4 +92,24 @@ export function buildServerInstructions(config) {
         : buildSshBaseInstructions();
     return `${base}${buildDerivedHostAuthGuidance(config)}`;
 }
+export function buildYamlRosterGuidance(linkCount) {
+    const pick = linkCount === 0
+        ? " Roster is empty — tell the user to append a link from host-execution://guides/yaml."
+        : linkCount === 1
+            ? " One YAML link — description may be omitted."
+            : " Many YAML links — pass exact description; do not fuzzy-match.";
+    return `
+YAML roster: ~/.agents/host-execution.yaml (Windows %USERPROFILE%\\.agents\\host-execution.yaml). Same link = user+IP. New user+IP in conversation → append unless the user says not to. Same conversation keeps the current link.${pick} description is a scenario label, not a frozen key — if it is misleading, rewrite it in the YAML now and then pass the new exact string. Do not invent fields — copy from host-execution://guides/yaml.`;
+}
+export function buildSourceInstructions(source) {
+    if (source.mode === "json") {
+        return `${buildServerInstructions(source.config)}
+YAML roster file has no real links — JSON env is active. Writing a real link to ~/.agents/host-execution.yaml makes YAML win on the next tool call. Read host-execution://guides/yaml before appending.`;
+    }
+    const links = loadSourceLinks(source);
+    if (links.length === 1) {
+        return `${buildServerInstructions(links[0].config)}${buildYamlRosterGuidance(1)}`;
+    }
+    return `${buildSshBaseInstructions()}${buildYamlRosterGuidance(links.length)}`;
+}
 //# sourceMappingURL=instructions.js.map

package/dist/instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAEA,SAAS,wBAAwB;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4GAkCmG,CAAC;AAC7G,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAiB;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;IAC5D,OAAO;;8BAEqB,MAAM;;;;;;;;;;;;;;;4CAeQ,CAAC;AAC7C,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,4BAA4B,CAAC,MAAiB;IAC5D,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QACvC,OAAO;4CACiC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,kMAAkM,CAAC;IACrQ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,oBAAoB,GACxB,qGAAqG,CAAC;IACxG,MAAM,YAAY,GAChB,iFAAiF,CAAC;IAEpF,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO;oEACyD,QAAQ,GAAG,oBAAoB,GAAG,YAAY,0BAA0B,CAAC;IAC3I,CAAC;IAED,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;QACxB,OAAO;0CAC+B,IAAI,kBAAkB,QAAQ,mHAAmH,oBAAoB,GAAG,YAAY,EAAE,CAAC;IAC/N,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;gCACqB,IAAI,GAAG,QAAQ,2EAA2E,oBAAoB,GAAG,YAAY,EAAE,CAAC;IAC9J,CAAC;IAED,OAAO;uCAC8B,QAAQ,gHAAgH,oBAAoB,GAAG,YAAY,EAAE,CAAC;AACrM,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB;IACvD,MAAM,IAAI,GACR,MAAM,CAAC,UAAU,KAAK,gBAAgB;QACpC,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,wBAAwB,EAAE,CAAC;IACjC,OAAO,GAAG,IAAI,GAAG,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAqB,MAAM,kBAAkB,CAAC;AAEtE,SAAS,wBAAwB;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;;;;yRAsBgR,CAAC;AAC1R,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAiB;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM;QACxB,CAAC,CAAC,iCAAiC,MAAM,gCAAgC;QACzE,CAAC,CAAC,4EAA4E,CAAC;IACjF,OAAO;;EAEP,WAAW;;;;;;;;;;;;;yRAa4Q,CAAC;AAC1R,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,4BAA4B,CAAC,MAAiB;IAC5D,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;QAC3C,OAAO;wBACa,oBAAoB,CAAC,MAAM,CAAC,6JAA6J,CAAC;IAChN,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,oBAAoB,GACxB,sFAAsF,CAAC;IAEzF,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO;wEAC6D,QAAQ,GAAG,oBAAoB,0BAA0B,CAAC;IAChI,CAAC;IAED,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;QACxB,OAAO;oCACyB,IAAI,kBAAkB,QAAQ,wGAAwG,oBAAoB,EAAE,CAAC;IAC/L,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;0BACe,IAAI,GAAG,QAAQ,gEAAgE,oBAAoB,EAAE,CAAC;IAC9H,CAAC;IAED,OAAO;iCACwB,QAAQ,qGAAqG,oBAAoB,EAAE,CAAC;AACrK,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAiB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,MAAM;QACtC,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE;YACzB,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC5B,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,iBAAiB,MAAM,6EAA6E,CAAC;IAC9G,CAAC;IACD,OAAO,iBAAiB,MAAM,oDAAoD,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB;IACvD,MAAM,IAAI,GACR,MAAM,CAAC,UAAU,KAAK,gBAAgB;QACpC,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,wBAAwB,EAAE,CAAC;IACjC,OAAO,GAAG,IAAI,GAAG,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,IAAI,GACR,SAAS,KAAK,CAAC;QACb,CAAC,CAAC,sFAAsF;QACxF,CAAC,CAAC,SAAS,KAAK,CAAC;YACf,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,gEAAgE,CAAC;IACzE,OAAO;oOAC2N,IAAI,yMAAyM,CAAC;AAClb,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC;wMACoJ,CAAC;IACvM,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,GAAG,wBAAwB,EAAE,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/kubectl/runner.d.ts

@@ -1,5 +1,5 @@
+import type { AccessRuntime } from "../access/index.js";
 import type { AppConfig } from "../config.js";
-import type { AccessClient } from "../ssh/access-client.js";
 export type PodOutputFormat = "wide" | "json" | "name";
 export declare function buildListPodsCommand(namespace: string, options: {
     labelSelector?: string;
@@ -12,21 +12,20 @@ export declare function buildKubectlLogsCommand(namespace: string, pod: string,
     tail?: number;
     since?: string;
 }): string;
-export declare function runOnAccess(client: AccessClient, config: AppConfig, command: string, timeoutMs?: number, cwd?: string): Promise<import("../ssh/access-client.js").ExecOutput>;
-export declare function validateNamespace(config: AppConfig, namespace: string): void;
 export declare class KubectlRunner {
-    private readonly client;
+    private readonly access;
     private readonly config;
-    constructor(client: AccessClient, config: AppConfig);
+    constructor(access: AccessRuntime, config: AppConfig);
+    private run;
     listPods(namespace: string, options: {
         labelSelector?: string;
         fieldSelector?: string;
         output?: PodOutputFormat;
-    }, timeoutMs?: number): Promise<import("../ssh/access-client.js").ExecOutput>;
-    exec(namespace: string, pod: string, command: string, container?: string, timeoutMs?: number): Promise<import("../ssh/access-client.js").ExecOutput>;
+    }, timeoutMs?: number, contextKey?: string): Promise<import("../ssh/access-client.js").ExecOutput>;
+    exec(namespace: string, pod: string, command: string, container?: string, timeoutMs?: number, contextKey?: string): Promise<import("../ssh/access-client.js").ExecOutput>;
     logs(namespace: string, pod: string, options: {
         container?: string;
         tail?: number;
         since?: string;
-    }, timeoutMs?: number): Promise<import("../ssh/access-client.js").ExecOutput>;
+    }, timeoutMs?: number, contextKey?: string): Promise<import("../ssh/access-client.js").ExecOutput>;
 }

package/dist/kubectl/runner.js

@@ -47,33 +47,30 @@ export function buildKubectlLogsCommand(namespace, pod, options) {
     parts.push(`--tail=${options.tail ?? 200}`);
     return parts.join(" ");
 }
-export async function runOnAccess(client, config, command, timeoutMs, cwd) {
-    return client.exec(command, timeoutMs ?? config.defaultTimeoutMs, cwd);
-}
-export function validateNamespace(config, namespace) {
-    assertNamespaceAllowed(config, namespace);
-}
 export class KubectlRunner {
-    client;
+    access;
     config;
-    constructor(client, config) {
-        this.client = client;
+    constructor(access, config) {
+        this.access = access;
         this.config = config;
     }
-    listPods(namespace, options, timeoutMs) {
-        validateNamespace(this.config, namespace);
-        const command = buildListPodsCommand(namespace, options);
-        return runOnAccess(this.client, this.config, command, timeoutMs);
+    run(command, timeoutMs, contextKey) {
+        return this.access.shellExec(command, {
+            contextKey,
+            timeoutMs: timeoutMs ?? this.config.defaultTimeoutMs,
+        });
+    }
+    listPods(namespace, options, timeoutMs, contextKey) {
+        assertNamespaceAllowed(this.config, namespace);
+        return this.run(buildListPodsCommand(namespace, options), timeoutMs, contextKey);
     }
-    exec(namespace, pod, command, container, timeoutMs) {
-        validateNamespace(this.config, namespace);
-        const kubectlCommand = buildKubectlExecCommand(namespace, pod, command, container);
-        return runOnAccess(this.client, this.config, kubectlCommand, timeoutMs);
+    exec(namespace, pod, command, container, timeoutMs, contextKey) {
+        assertNamespaceAllowed(this.config, namespace);
+        return this.run(buildKubectlExecCommand(namespace, pod, command, container), timeoutMs, contextKey);
     }
-    logs(namespace, pod, options, timeoutMs) {
-        validateNamespace(this.config, namespace);
-        const kubectlCommand = buildKubectlLogsCommand(namespace, pod, options);
-        return runOnAccess(this.client, this.config, kubectlCommand, timeoutMs);
+    logs(namespace, pod, options, timeoutMs, contextKey) {
+        assertNamespaceAllowed(this.config, namespace);
+        return this.run(buildKubectlLogsCommand(namespace, pod, options), timeoutMs, contextKey);
     }
 }
 //# sourceMappingURL=runner.js.map

package/dist/kubectl/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/kubectl/runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAI1E,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,OAIC;IAED,MAAM,KAAK,GAAG,CAAC,kBAAkB,EAAE,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,oBAAoB,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;SAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,GAAW,EACX,OAAe,EACf,SAAkB;IAElB,MAAM,KAAK,GAAG;QACZ,cAAc;QACd,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE;QACjC,cAAc,CAAC,GAAG,CAAC;KACpB,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,GAAW,EACX,OAIC;IAED,MAAM,KAAK,GAAG;QACZ,cAAc;QACd,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE;QACjC,cAAc,CAAC,GAAG,CAAC;KACpB,CAAC;IAEF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,WAAW,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAoB,EACpB,MAAiB,EACjB,OAAe,EACf,SAAkB,EAClB,GAAY;IAEZ,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,SAAiB;IACpE,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,aAAa;IAEL;IACA;IAFnB,YACmB,MAAoB,EACpB,MAAiB;QADjB,WAAM,GAAN,MAAM,CAAc;QACpB,WAAM,GAAN,MAAM,CAAW;IACjC,CAAC;IAEJ,QAAQ,CACN,SAAiB,EACjB,OAIC,EACD,SAAkB;QAElB,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CACF,SAAiB,EACjB,GAAW,EACX,OAAe,EACf,SAAkB,EAClB,SAAkB;QAElB,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnF,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CACF,SAAiB,EACjB,GAAW,EACX,OAIC,EACD,SAAkB;QAElB,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACxE,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;CACF"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/kubectl/runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAI1E,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,OAIC;IAED,MAAM,KAAK,GAAG,CAAC,kBAAkB,EAAE,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,oBAAoB,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;SAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,GAAW,EACX,OAAe,EACf,SAAkB;IAElB,MAAM,KAAK,GAAG;QACZ,cAAc;QACd,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE;QACjC,cAAc,CAAC,GAAG,CAAC;KACpB,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,GAAW,EACX,OAIC;IAED,MAAM,KAAK,GAAG;QACZ,cAAc;QACd,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE;QACjC,cAAc,CAAC,GAAG,CAAC;KACpB,CAAC;IAEF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,WAAW,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,aAAa;IAEL;IACA;IAFnB,YACmB,MAAqB,EACrB,MAAiB;QADjB,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAW;IACjC,CAAC;IAEI,GAAG,CAAC,OAAe,EAAE,SAAkB,EAAE,UAAmB;QAClE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;YACpC,UAAU;YACV,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACrD,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CACN,SAAiB,EACjB,OAIC,EACD,SAAkB,EAClB,UAAmB;QAEnB,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CACF,SAAiB,EACjB,GAAW,EACX,OAAe,EACf,SAAkB,EAClB,SAAkB,EAClB,UAAmB;QAEnB,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CACb,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,EAC3D,SAAS,EACT,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,CACF,SAAiB,EACjB,GAAW,EACX,OAIC,EACD,SAAkB,EAClB,UAAmB;QAEnB,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3F,CAAC;CACF"}

package/dist/link-runtime.d.ts

@@ -0,0 +1,39 @@
+import type { AppConfig } from "./config.js";
+import { type ConfigSource, type YamlRosterDeps } from "./config-yaml.js";
+import { AccessRuntime } from "./access/index.js";
+import { KubectlRunner } from "./kubectl/runner.js";
+import { AccessClient } from "./ssh/access-client.js";
+import { CopyJobManager } from "./utils/copy-job-manager.js";
+import { RemoteExecutor } from "./utils/remote-executor.js";
+import type { RemoteCopyStartRequest } from "./utils/copy-job-types.js";
+export type ToolSession = {
+    description?: string;
+    config: AppConfig;
+    accessClient: AccessClient;
+    access: AccessRuntime;
+    kubectl: KubectlRunner;
+    remote: RemoteExecutor;
+    copyJobs: CopyJobManager;
+};
+export type LinkPick = {
+    description?: string;
+};
+export declare class LinkRuntimeHub {
+    private readonly source;
+    private readonly rosterDeps;
+    private readonly cached;
+    private readonly copyOwners;
+    private jsonSession?;
+    private reconciledCopyJobs;
+    constructor(source: ConfigSource, rosterDeps?: YamlRosterDeps);
+    hintConfig(): AppConfig | undefined;
+    resolve(pick?: LinkPick): ToolSession;
+    copyStart(session: ToolSession, request: RemoteCopyStartRequest): Promise<import("./utils/copy-job-types.js").RemoteCopyStartResult>;
+    copyStatus(transferId: string): Promise<import("./utils/copy-job-types.js").RemoteCopyStatusResult>;
+    copyCancel(transferId: string): Promise<import("./utils/copy-job-types.js").RemoteCopyCancelResult>;
+    private copyManagerFor;
+    private reloadLinks;
+    private getOrCreate;
+    private build;
+}
+export declare function createLinkRuntimeHub(source: ConfigSource, rosterDeps?: YamlRosterDeps): LinkRuntimeHub;

package/dist/link-runtime.js

@@ -0,0 +1,134 @@
+import { loadSourceLinks, pickYamlLink, } from "./config-yaml.js";
+import { AccessRuntime } from "./access/index.js";
+import { KubectlRunner } from "./kubectl/runner.js";
+import { AccessClient } from "./ssh/access-client.js";
+import { CopyJobManager } from "./utils/copy-job-manager.js";
+import { RemoteExecutor } from "./utils/remote-executor.js";
+function fingerprint(config) {
+    return JSON.stringify({
+        accessKind: config.accessKind,
+        accessHost: config.accessHost,
+        accessUser: config.accessUser,
+        accessPort: config.accessPort,
+        accessPrivateKeyPath: config.accessPrivateKeyPath,
+        accessPassword: config.accessPassword,
+        accessParadiAuth: config.accessParadiAuth,
+        targetHosts: config.targetHosts,
+        targetUser: config.targetUser,
+        targetPassword: config.targetPassword,
+        allowedNamespaces: config.allowedNamespaces,
+    });
+}
+function buildSession(link, reconcileOnStart) {
+    const accessClient = new AccessClient(link.config);
+    const access = new AccessRuntime(link.config, accessClient);
+    const kubectl = new KubectlRunner(access, link.config);
+    const remote = new RemoteExecutor(access, kubectl, link.config);
+    const copyJobs = new CopyJobManager({ accessClient, config: link.config }, undefined, undefined, { reconcileOnStart });
+    return {
+        description: link.description || undefined,
+        config: link.config,
+        accessClient,
+        access,
+        kubectl,
+        remote,
+        copyJobs,
+    };
+}
+export class LinkRuntimeHub {
+    source;
+    rosterDeps;
+    cached = [];
+    copyOwners = new Map();
+    jsonSession;
+    reconciledCopyJobs = false;
+    constructor(source, rosterDeps = {}) {
+        this.source = source;
+        this.rosterDeps = rosterDeps;
+        if (source.mode === "json") {
+            this.jsonSession = this.build({ description: "", config: source.config });
+        }
+    }
+    hintConfig() {
+        if (this.source.mode === "json") {
+            return this.source.config;
+        }
+        const links = this.reloadLinks();
+        return links.length === 1 ? links[0]?.config : undefined;
+    }
+    resolve(pick = {}) {
+        if (this.source.mode === "json") {
+            return this.jsonSession;
+        }
+        const selected = pickYamlLink(this.reloadLinks(), pick.description);
+        return this.getOrCreate(selected);
+    }
+    async copyStart(session, request) {
+        const result = await session.copyJobs.start(request);
+        this.copyOwners.set(result.transferId, session.copyJobs);
+        return result;
+    }
+    async copyStatus(transferId) {
+        return (await this.copyManagerFor(transferId)).status(transferId);
+    }
+    async copyCancel(transferId) {
+        return (await this.copyManagerFor(transferId)).cancel(transferId);
+    }
+    async copyManagerFor(transferId) {
+        const owned = this.copyOwners.get(transferId);
+        if (owned) {
+            return owned;
+        }
+        if (this.jsonSession) {
+            return this.jsonSession.copyJobs;
+        }
+        for (const entry of this.cached) {
+            try {
+                await entry.session.copyJobs.status(transferId);
+                return entry.session.copyJobs;
+            }
+            catch {
+                // try next
+            }
+        }
+        if (this.cached[0]) {
+            return this.cached[0].session.copyJobs;
+        }
+        throw new Error(`Unknown transferId: ${transferId}`);
+    }
+    reloadLinks() {
+        return loadSourceLinks(this.source, this.rosterDeps);
+    }
+    getOrCreate(link) {
+        const fp = fingerprint(link.config);
+        const reuse = this.cached.find((entry) => entry.description === link.description && entry.fingerprint === fp);
+        if (reuse) {
+            return reuse.session;
+        }
+        // Drop stale sessions for the same description (config edited in-place).
+        for (let i = this.cached.length - 1; i >= 0; i--) {
+            const entry = this.cached[i];
+            if (entry && entry.description === link.description && entry.fingerprint !== fp) {
+                try {
+                    entry.session.accessClient.disconnect();
+                }
+                catch {
+                    // best-effort
+                }
+                this.cached.splice(i, 1);
+            }
+        }
+        const session = this.build(link);
+        this.cached.push({ fingerprint: fp, description: link.description, session });
+        return session;
+    }
+    build(link) {
+        const session = buildSession(link, !this.reconciledCopyJobs);
+        this.reconciledCopyJobs = true;
+        return session;
+    }
+}
+export function createLinkRuntimeHub(source, rosterDeps) {
+    return new LinkRuntimeHub(source, rosterDeps);
+}
+//# sourceMappingURL=link-runtime.js.map

package/dist/link-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-runtime.js","sourceRoot":"","sources":["../src/link-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,YAAY,GAIb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiB5D,SAAS,WAAW,CAAC,MAAiB;IACpC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAc,EAAE,gBAAyB;IAC7D,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACrC,SAAS,EACT,SAAS,EACT,EAAE,gBAAgB,EAAE,CACrB,CAAC;IACF,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY;QACZ,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IAWN;IACA;IAXF,MAAM,GAIlB,EAAE,CAAC;IACS,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IACxD,WAAW,CAAe;IAC1B,kBAAkB,GAAG,KAAK,CAAC;IAEnC,YACmB,MAAoB,EACpB,aAA6B,EAAE;QAD/B,WAAM,GAAN,MAAM,CAAc;QACpB,eAAU,GAAV,UAAU,CAAqB;QAEhD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,UAAU;QACR,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,OAAiB,EAAE;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,WAAY,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAoB,EAAE,OAA+B;QACnE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IAEO,WAAW;QACjB,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAEO,WAAW,CAAC,IAAc;QAChC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,CAC9E,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QACD,yEAAyE;QACzE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;gBAChF,IAAI,CAAC;oBACH,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,IAAc;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;CAEF;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAoB,EACpB,UAA2B;IAE3B,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAChD,CAAC"}

package/dist/server.d.ts

@@ -1,3 +1,4 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { AppConfig } from "./config.js";
-export declare function createServer(config: AppConfig): McpServer;
+import { type ConfigSource } from "./config-yaml.js";
+export declare function createServer(configOrSource: AppConfig | ConfigSource): McpServer;

package/dist/server.js

@@ -1,24 +1,22 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { VERSION } from "./version.js";
-import { AccessRuntime } from "./access/index.js";
-import { buildServerInstructions } from "./instructions.js";
-import { KubectlRunner } from "./kubectl/runner.js";
-import { AccessClient } from "./ssh/access-client.js";
+import { asConfigSource } from "./config-yaml.js";
+import { buildSourceInstructions } from "./instructions.js";
+import { createLinkRuntimeHub } from "./link-runtime.js";
+import { registerSources } from "./sources/index.js";
 import { registerPrompts, registerTools } from "./tools/register.js";
-import { RemoteExecutor } from "./utils/remote-executor.js";
-export function createServer(config) {
+export function createServer(configOrSource) {
+    const source = asConfigSource(configOrSource);
+    const hub = createLinkRuntimeHub(source);
     const server = new McpServer({
         name: "host-execution-mcp",
         version: VERSION,
     }, {
-        instructions: buildServerInstructions(config),
+        instructions: buildSourceInstructions(source),
     });
-    const accessClient = new AccessClient(config);
-    const access = new AccessRuntime(config, accessClient);
-    const kubectl = new KubectlRunner(accessClient, config);
-    const remote = new RemoteExecutor(access, kubectl, config);
-    registerTools(server, { config, accessClient, access, kubectl, remote });
+    registerTools(server, { hub });
     registerPrompts(server);
+    registerSources(server);
     return server;
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE,uBAAuB,CAAC,MAAM,CAAC;KAC9C,CACF,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE3D,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAqB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,UAAU,YAAY,CAAC,cAAwC;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE,uBAAuB,CAAC,MAAM,CAAC;KAC9C,CACF,CAAC;IAEF,aAAa,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sources/guides.d.ts

@@ -0,0 +1,34 @@
+/** `src/sources` or `dist/sources` → package `docs/`. */
+export declare function docsDir(): string;
+export type GuideSlug = "user" | "agent";
+export type GuideMeta = {
+    slug: GuideSlug;
+    uri: string;
+    name: string;
+    title: string;
+    description: string;
+    file: string;
+    annotations: {
+        audience: Array<"user" | "assistant">;
+        priority: number;
+    };
+};
+export declare const GUIDES: readonly GuideMeta[];
+export declare function listGuideSources(): Array<{
+    uri: string;
+    name: string;
+    title: string;
+    description: string;
+    mimeType: string;
+    annotations: {
+        audience: Array<"user" | "assistant">;
+        priority: number;
+    };
+}>;
+export declare function readGuideSource(uri: string): {
+    contents: Array<{
+        uri: string;
+        mimeType: string;
+        text: string;
+    }>;
+};

package/dist/sources/guides.js

@@ -0,0 +1,50 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** `src/sources` or `dist/sources` → package `docs/`. */
+export function docsDir() {
+    return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "docs");
+}
+export const GUIDES = [
+    {
+        slug: "user",
+        uri: "host-execution://guides/user",
+        name: "user-guide",
+        title: "User GUIDE",
+        description: "What the user configured this MCP to do: ACCESS_KIND, mcp.json, TARGET_HOSTS, how they will ask the Agent.",
+        file: "GUIDE.md",
+        annotations: { audience: ["user", "assistant"], priority: 0.8 },
+    },
+    {
+        slug: "agent",
+        uri: "host-execution://guides/agent",
+        name: "agent-guide",
+        title: "Agent cookbook",
+        description: "Operational pitfalls: tool returns, quoting, CRLF, docker non-TTY, truncation, large copy. If GUIDE capability is unmet, tell the user.",
+        file: "AGENT_GUIDE.md",
+        annotations: { audience: ["assistant"], priority: 0.7 },
+    },
+];
+export function listGuideSources() {
+    return GUIDES.map((g) => ({
+        uri: g.uri,
+        name: g.name,
+        title: g.title,
+        description: g.description,
+        mimeType: "text/markdown",
+        annotations: g.annotations,
+    }));
+}
+export function readGuideSource(uri) {
+    const guide = GUIDES.find((g) => g.uri === uri);
+    if (!guide) {
+        const err = new Error(`Resource not found: ${uri}`);
+        err.code = -32002;
+        throw err;
+    }
+    const text = readFileSync(join(docsDir(), guide.file), "utf8");
+    return {
+        contents: [{ uri, mimeType: "text/markdown", text }],
+    };
+}
+//# sourceMappingURL=guides.js.map

package/dist/sources/guides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guides.js","sourceRoot":"","sources":["../../src/sources/guides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,yDAAyD;AACzD,MAAM,UAAU,OAAO;IACrB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAcD,MAAM,CAAC,MAAM,MAAM,GAAyB;IAC1C;QACE,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,8BAA8B;QACnC,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,4GAA4G;QAC9G,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE;KAChE;IACD;QACE,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,+BAA+B;QACpC,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,yIAAyI;QAC3I,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE;KACxD;CACF,CAAC;AAEF,MAAM,UAAU,gBAAgB;IAQ9B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IAGzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAA8B,CAAC;QACjF,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;QAClB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}