mcp-for-i 0.1.13 → 0.2.0

package/dist/controlplane/clientIntegrationService.js

@@ -1,4 +1,5 @@
-import fs from "fs/promises";
+import fs from "fs";
+import fsp from "fs/promises";
 import os from "os";
 import path from "path";
 import { spawn } from "child_process";
@@ -229,7 +230,7 @@ export class ClientIntegrationService {
     async isCodeConfigured() {
         const userConfigPath = getVsCodeUserMcpPath();
         try {
-            const raw = await fs.readFile(userConfigPath, "utf8");
+            const raw = await fsp.readFile(userConfigPath, "utf8");
             const parsed = JSON.parse(raw);
             if (Array.isArray(parsed?.servers)) {
                 return parsed.servers.some((entry) => entry?.name === SERVER_NAME);
@@ -263,10 +264,88 @@ async function commandExists(command) {
     const result = await runCommand(command, ["--help"]);
     return result.ok;
 }
-async function runCommand(command, args) {
+/**
+ * Finds a command on PATH the way cmd.exe does (PATHEXT order). Returns the
+ * full path, or undefined when nothing matches.
+ */
+export function resolveWindowsCommand(command, env = process.env) {
+    const pathExt = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD")
+        .split(";")
+        .map(ext => ext.trim().toLowerCase())
+        .filter(Boolean);
+    const hasExt = pathExt.includes(path.extname(command).toLowerCase());
+    const candidates = hasExt ? [command] : pathExt.map(ext => command + ext);
+    const isPath = command.includes("/") || command.includes("\\");
+    const dirs = isPath
+        ? [""]
+        : String(env.PATH || env.Path || "").split(";").map(dir => dir.trim().replace(/^"(.*)"$/, "$1")).filter(Boolean);
+    for (const dir of dirs) {
+        for (const candidate of candidates) {
+            const full = dir ? path.join(dir, candidate) : candidate;
+            try {
+                if (fs.statSync(full).isFile())
+                    return full;
+            }
+            catch {
+                // not here
+            }
+        }
+    }
+    return undefined;
+}
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/** Quotes one argument for cmd.exe, following the MSVCRT argv rules. */
+export function escapeCmdArgument(value, doubleEscapeMeta) {
+    let arg = String(value);
+    // Double the backslashes that precede a quote, then escape the quote.
+    arg = arg.replace(/(\\*)"/g, '$1$1\\"');
+    // Double trailing backslashes so they do not escape the closing quote.
+    arg = arg.replace(/(\\*)$/, "$1$1");
+    arg = `"${arg}"`;
+    arg = arg.replace(CMD_META, "^$1");
+    // .cmd shims re-parse their arguments (%*), so they need a second pass.
+    if (doubleEscapeMeta)
+        arg = arg.replace(CMD_META, "^$1");
+    return arg;
+}
+/**
+ * Builds how to start a command. On Windows, npm-installed CLIs (codex,
+ * claude, code) are .cmd shims that only start through cmd.exe, so they are
+ * resolved via PATHEXT and launched with every argument escaped. The
+ * arguments are fixed by this module, never taken from a request.
+ */
+export function buildSpawnSpec(command, args, platform = process.platform, env = process.env) {
+    if (platform !== "win32") {
+        return { file: command, args, windowsVerbatimArguments: false };
+    }
+    const resolved = resolveWindowsCommand(command, env);
+    if (!resolved)
+        return undefined;
+    if (!/\.(cmd|bat)$/i.test(resolved)) {
+        return { file: resolved, args, windowsVerbatimArguments: false };
+    }
+    const commandLine = [
+        resolved.replace(CMD_META, "^$1"),
+        ...args.map(arg => escapeCmdArgument(arg, true))
+    ].join(" ");
+    return {
+        file: env.ComSpec || env.COMSPEC || "cmd.exe",
+        args: ["/d", "/s", "/c", `"${commandLine}"`],
+        windowsVerbatimArguments: true
+    };
+}
+export async function runCommand(command, args, env = process.env) {
     return new Promise(resolve => {
-        const child = spawn(command, args, {
+        const spec = buildSpawnSpec(command, args, process.platform, env);
+        if (!spec) {
+            resolve({ ok: false, stdout: "", stderr: `${command} was not found on PATH` });
+            return;
+        }
+        const child = spawn(spec.file, spec.args, {
+            env,
             windowsHide: true,
+            windowsVerbatimArguments: spec.windowsVerbatimArguments,
+            timeout: 120000,
             stdio: ["ignore", "pipe", "pipe"]
         });
         const stdout = [];

package/dist/controlplane/commands.js

@@ -29,25 +29,30 @@ export async function runControlCommand(args, options) {
             return;
     }
 }
+/**
+ * Runs the control plane in the foreground. Resolves only after the server has
+ * stopped listening, so a caller that exits when this returns keeps it alive.
+ */
 async function serve(stderr) {
+    let server;
     try {
-        const server = await startControlPlaneServer();
-        stderr.write(`mcp-for-i control plane running at http://${server.host}:${server.port}\n`);
-        const shutdown = async () => {
-            await server.close();
-            process.exit(0);
-        };
-        process.on("SIGINT", shutdown);
-        process.on("SIGTERM", shutdown);
+        server = await startControlPlaneServer();
     }
     catch (err) {
         if (err?.code === "EADDRINUSE") {
             const url = getControlPlaneUrl();
             stderr.write(`mcp-for-i control plane already running at ${url}\n`);
-            process.exit(0);
+            return;
         }
         throw err;
     }
+    stderr.write(`mcp-for-i control plane running at ${getControlPlaneUrl()}\n`);
+    const shutdown = () => {
+        server.close().catch(() => undefined);
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+    await server.closed;
 }
 async function printStatus(stderr, scriptPath, nodePath) {
     const url = getControlPlaneUrl();

package/dist/controlplane/connectionService.js

@@ -1,16 +1,96 @@
 import { deletePassword, getPassword, setPassword } from "../security/credentialStore.js";
+import { ControlPlaneError } from "./errors.js";
+import { testConnection } from "./connectionTest.js";
+/** True when host, port or username differ (host compared case-insensitively). */
+export function connectionEndpointChanged(before, after) {
+    const host = (value) => String(value ?? "").trim().toLowerCase();
+    const port = (value) => Number(value || 22);
+    const user = (value) => String(value ?? "").trim().toUpperCase();
+    return host(before.host) !== host(after.host)
+        || port(before.port) !== port(after.port)
+        || user(before.username) !== user(after.username);
+}
 export class ConnectionService {
     store;
-    constructor(store) {
+    runTest;
+    /** Last test result per saved connection, kept in memory only. */
+    lastTests = new Map();
+    /** Endpoints with a test in progress, so a double click signs on once. */
+    running = new Set();
+    constructor(store, runTest = testConnection) {
         this.store = store;
+        this.runTest = runTest;
     }
     async list() {
-        return this.store.listConnections();
+        const list = await this.store.listConnections();
+        return list.map(conn => {
+            const lastTest = this.lastTests.get(conn.name);
+            return lastTest ? { ...conn, lastTest } : conn;
+        });
+    }
+    /** Tests a saved connection with its stored details and password. */
+    async testSaved(name) {
+        const stored = await this.store.getConnection(name);
+        if (!stored)
+            throw new ControlPlaneError(404, `Connection ${name} not found`);
+        const password = await getPassword(name).catch(() => undefined);
+        const result = await this.guardedTest({
+            host: stored.host,
+            port: stored.port,
+            username: stored.username,
+            password: password || undefined,
+            privateKeyPath: stored.privateKeyPath
+        });
+        this.lastTests.set(name, result);
+        return result;
+    }
+    /**
+     * Tests details that may not be saved yet (the add and edit form). A saved
+     * password is only used for the same host, port and user it was saved for.
+     */
+    async testDetails(input) {
+        const host = typeof input?.host === "string" ? input.host.trim() : "";
+        const username = typeof input?.username === "string" ? input.username.trim() : "";
+        if (!host || !username)
+            throw new ControlPlaneError(400, "host and username are required");
+        const port = Number(input.port || 22);
+        let password = typeof input.password === "string" && input.password ? input.password : undefined;
+        const name = typeof input.name === "string" ? input.name.trim() : "";
+        const stored = name ? await this.store.getConnection(name) : undefined;
+        if (!password && stored && !connectionEndpointChanged(stored, { host, port, username })) {
+            password = (await getPassword(name).catch(() => undefined)) || undefined;
+        }
+        const privateKeyPath = typeof input.privateKeyPath === "string" && input.privateKeyPath.trim()
+            ? input.privateKeyPath.trim()
+            : undefined;
+        return this.guardedTest({ host, port, username, password, privateKeyPath });
+    }
+    async guardedTest(target) {
+        const key = [target.host.trim().toLowerCase(), Number(target.port || 22), target.username.trim().toUpperCase()].join("|");
+        if (this.running.has(key)) {
+            throw new ControlPlaneError(409, "A test of this connection is already running");
+        }
+        this.running.add(key);
+        try {
+            return await this.runTest(target);
+        }
+        finally {
+            this.running.delete(key);
+        }
     }
     async get(name) {
         return this.store.getConnection(name);
     }
     async add(input) {
+        const name = typeof input?.name === "string" ? input.name.trim() : "";
+        if (!name || !input.host || !input.username) {
+            throw new ControlPlaneError(400, "name, host and username are required");
+        }
+        // Adding must never overwrite an existing entry: that would let a caller
+        // repoint a connection without the checks in update().
+        if (await this.store.getConnection(input.name)) {
+            throw new ControlPlaneError(409, `Connection ${input.name} already exists`);
+        }
         await this.store.upsertConnection({
             name: input.name,
             host: input.host,
@@ -28,7 +108,7 @@ export class ConnectionService {
     async update(name, input) {
         const existing = await this.store.getConnection(name);
         if (!existing)
-            throw new Error(`Connection ${name} not found`);
+            throw new ControlPlaneError(404, `Connection ${name} not found`);
         const next = {
             ...existing,
             host: input.host ?? existing.host,
@@ -38,9 +118,28 @@ export class ConnectionService {
             settings: input.settings ? { ...(existing.settings || {}), ...input.settings } : existing.settings,
             policy: input.policy ?? existing.policy
         };
+        // A saved password must never follow the connection to a different
+        // endpoint or user. Changing host, port or username therefore needs the
+        // password in the same request.
+        const endpointChanged = connectionEndpointChanged(existing, next);
+        const newPassword = typeof input.password === "string" && input.password ? input.password : undefined;
+        if (endpointChanged && !newPassword && await getPassword(name)) {
+            throw new ControlPlaneError(400, "Changing host, port or username requires entering the password again in the same request");
+        }
         await this.store.upsertConnection(next);
-        if (input.storePassword && input.password) {
-            await setPassword(name, input.password);
+        // An earlier result says nothing about new details or a new password.
+        if (endpointChanged || newPassword || next.privateKeyPath !== existing.privateKeyPath) {
+            this.lastTests.delete(name);
+        }
+        if (newPassword && (input.storePassword || endpointChanged)) {
+            if (input.storePassword === false) {
+                // The caller does not want it stored; drop the old one so it is not
+                // sent to the new endpoint.
+                await deletePassword(name);
+            }
+            else {
+                await setPassword(name, newPassword);
+            }
         }
         return this.get(name);
     }
@@ -64,16 +163,22 @@ export class ConnectionService {
             await setPassword(newName, password);
         }
         await deletePassword(oldName);
+        const lastTest = this.lastTests.get(oldName);
+        this.lastTests.delete(oldName);
+        if (lastTest)
+            this.lastTests.set(newName, lastTest);
         return this.get(newName);
     }
     async delete(name) {
         await this.store.deleteConnection(name);
         await deletePassword(name);
+        this.lastTests.delete(name);
     }
     async setConnectionPassword(name, password) {
         const existing = await this.store.getConnection(name);
         if (!existing)
             throw new Error(`Connection ${name} not found`);
         await setPassword(name, password);
+        this.lastTests.delete(name);
     }
 }

package/dist/controlplane/connectionTest.js

@@ -0,0 +1,329 @@
+import crypto from "crypto";
+import dns from "dns/promises";
+import fs from "fs/promises";
+import net from "net";
+import { createRequire } from "module";
+import { Tools } from "../ibmi/Tools.js";
+import { ACCEPT_NEW_HOSTKEY_ENV, getKnownHostsPath, hostKeyFingerprint, isNewHostKeyAccepted, knownHostId, readKnownHosts } from "../ibmi/knownHosts.js";
+const DNS_TIMEOUT_MS = 5000;
+const PORT_TIMEOUT_MS = 5000;
+const SSH_TIMEOUT_MS = 20000;
+const PROFILE_TIMEOUT_MS = 20000;
+const REJECTED_TTL_MS = 15 * 60 * 1000;
+const PASSWORD_WARNING_DAYS = 14;
+/** Passwords the IBM i rejected recently, by hash of host, port, user and password. */
+const rejected = new Map();
+function rejectionKey(target, port) {
+    return crypto.createHash("sha256")
+        .update([target.host.trim().toLowerCase(), port, target.username.trim().toUpperCase(), target.password || ""].join("\0"))
+        .digest("hex");
+}
+function wasRejected(key, now) {
+    const at = rejected.get(key);
+    if (at === undefined)
+        return false;
+    if (now - at > REJECTED_TTL_MS) {
+        rejected.delete(key);
+        return false;
+    }
+    return true;
+}
+/** Forgets every remembered rejection (for tests). */
+export function clearRejectedPasswords() {
+    rejected.clear();
+}
+export async function testConnection(target, deps = {}) {
+    const d = { ...defaultDeps, ...deps };
+    const started = d.now();
+    const steps = [];
+    const warnings = [];
+    let hostKey;
+    let profile;
+    const finish = (code, message) => ({
+        ok: code === "ok",
+        code,
+        message,
+        steps,
+        warnings,
+        ...(hostKey ? { hostKey } : {}),
+        ...(profile ? { profile } : {}),
+        testedAt: new Date(d.now()).toISOString(),
+        durationMs: Math.max(0, d.now() - started)
+    });
+    const host = String(target?.host ?? "").trim();
+    const username = String(target?.username ?? "").trim();
+    const port = Number(target?.port || 22);
+    if (!host || !username)
+        return finish("invalid-input", "Enter a host and a username to test.");
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return finish("invalid-input", "The SSH port must be between 1 and 65535.");
+    // 1. Name lookup
+    let address;
+    try {
+        address = await withTimeout(d.lookup(host), DNS_TIMEOUT_MS, "lookup");
+        steps.push({ name: "Host lookup", ok: true, detail: address === host ? host : `${host} is ${address}` });
+    }
+    catch (err) {
+        steps.push({ name: "Host lookup", ok: false, detail: err?.code || err?.message || String(err) });
+        return finish("host-not-found", `Host ${host} was not found. Check the spelling, or that this computer can resolve it (VPN or DNS).`);
+    }
+    // 2. SSH port
+    try {
+        const banner = await d.probePort(address, port, PORT_TIMEOUT_MS);
+        if (banner && !banner.startsWith("SSH-")) {
+            steps.push({ name: "SSH port", ok: false, detail: `Port ${port} answered, but not with SSH` });
+            return finish("not-ssh", `Port ${port} on ${host} is open but is not an SSH server. Check the port number.`);
+        }
+        steps.push({ name: "SSH port", ok: true, detail: banner ? banner.trim() : `Port ${port} accepted the connection` });
+    }
+    catch (err) {
+        const code = err?.code;
+        steps.push({ name: "SSH port", ok: false, detail: code || err?.message || String(err) });
+        if (code === "ECONNREFUSED") {
+            return finish("port-closed", `${host} refused a connection on port ${port}. SSH may not be running there (STRTCPSVR SERVER(*SSHD)), or the port is wrong.`);
+        }
+        if (code === "ETIMEDOUT" || code === "TIMEOUT") {
+            return finish("port-timeout", `No answer from ${host} on port ${port}. The system may be down, or a firewall or VPN is blocking the port.`);
+        }
+        if (code === "EHOSTUNREACH" || code === "ENETUNREACH") {
+            return finish("host-unreachable", `${host} cannot be reached from this computer. Check the network or VPN.`);
+        }
+        return finish("error", `Could not open port ${port} on ${host}: ${err?.message || err}`);
+    }
+    // 3. Credentials available?
+    let privateKey;
+    if (target.privateKeyPath) {
+        try {
+            privateKey = await d.readKey(target.privateKeyPath);
+        }
+        catch (err) {
+            steps.push({ name: "Private key", ok: false, detail: err?.code || err?.message || String(err) });
+            return finish("key-unreadable", `The private key ${target.privateKeyPath} could not be read on this computer.`);
+        }
+    }
+    if (!target.password && !privateKey) {
+        return finish("no-credentials", "The host and SSH port work. Enter a password or a private key path to test the sign-on.");
+    }
+    const key = rejectionKey(target, port);
+    if (target.password && !privateKey && wasRejected(key, d.now())) {
+        return finish("password-already-rejected", `${host} already rejected this password for ${username.toUpperCase()}. It was not sent again, because every failed sign-on counts toward disabling the profile. Enter a different password.`);
+    }
+    // 4. Host key and sign-on
+    const outcome = await d.ssh({
+        host,
+        port,
+        username,
+        password: target.password,
+        privateKey,
+        timeoutMs: SSH_TIMEOUT_MS,
+        checkHostKey: async (raw) => {
+            const check = await d.checkHostKey(host, port, raw);
+            hostKey = check;
+            return check;
+        }
+    });
+    if (hostKey && hostKey.status !== "changed") {
+        steps.push({
+            name: "Host key",
+            ok: true,
+            detail: hostKey.status === "trusted" ? "Matches the saved key" : `New key ${hostKey.fingerprint}, saved on the first connection`
+        });
+    }
+    if (outcome.kind === "host-key-changed") {
+        hostKey = outcome.hostKey;
+        steps.push({ name: "Host key", ok: false, detail: `Saved ${outcome.hostKey.stored}, server sent ${outcome.hostKey.fingerprint}` });
+        return finish("host-key-changed", `The SSH host key of ${host} has changed, so the password was not sent. If the system was rebuilt or its keys were regenerated, remove its entry from ${getKnownHostsPath()} or set ${ACCEPT_NEW_HOSTKEY_ENV}=${knownHostId(host, port)}.`);
+    }
+    if (outcome.kind === "password-expired") {
+        steps.push({ name: "Sign-on", ok: false, detail: outcome.prompt || "Password change required" });
+        return finish("password-expired", `The password for ${username.toUpperCase()} has expired. Change it on the IBM i (for example with a 5250 sign-on), then save the new one here.`);
+    }
+    if (outcome.kind === "error") {
+        const err = outcome.error;
+        const level = err?.level;
+        const text = String(err?.message || err);
+        steps.push({ name: "Sign-on", ok: false, detail: text });
+        if (level === "client-authentication" || /authentication methods failed/i.test(text)) {
+            if (target.password && !privateKey)
+                rejected.set(key, d.now());
+            return finish("auth-failed", privateKey && !target.password
+                ? `${host} did not accept the private key for ${username.toUpperCase()}. Check that its public key is in the user's ~/.ssh/authorized_keys on the IBM i.`
+                : `${host} rejected the username or password for ${username.toUpperCase()}. A disabled profile or an expired password gets the same answer over SSH, so check those too if the password is right.`);
+        }
+        if (level === "client-timeout" || /timed out/i.test(text)) {
+            return finish("timeout", `${host} did not finish the SSH sign-on in time. The system may be busy; try again.`);
+        }
+        if (/privateKey|private key|Unsupported key format|Cannot parse/i.test(text)) {
+            return finish("key-unreadable", `The private key ${target.privateKeyPath} could not be used: ${text}`);
+        }
+        return finish("error", `The SSH sign-on failed: ${text}`);
+    }
+    rejected.delete(key);
+    steps.push({ name: "Sign-on", ok: true, detail: `Signed on as ${username.toUpperCase()} and signed off` });
+    const days = outcome.profile?.daysUntilPasswordExpires;
+    if (typeof days === "number") {
+        profile = { daysUntilPasswordExpires: days };
+        if (days >= 0 && days <= PASSWORD_WARNING_DAYS) {
+            warnings.push(days === 0 ? "The password expires today." : `The password expires in ${days} day${days === 1 ? "" : "s"}.`);
+        }
+    }
+    return finish("ok", `Connected to ${host} as ${username.toUpperCase()}.`);
+}
+function withTimeout(promise, ms, what) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(Object.assign(new Error(`${what} timed out`), { code: "TIMEOUT" })), ms);
+        promise.then(value => { clearTimeout(timer); resolve(value); }, err => { clearTimeout(timer); reject(err); });
+    });
+}
+async function lookupHost(host) {
+    if (net.isIP(host))
+        return host;
+    const result = await dns.lookup(host);
+    return result.address;
+}
+function probePort(address, port, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const socket = net.connect({ host: address, port });
+        let connected = false;
+        let banner = "";
+        const done = (err) => {
+            clearTimeout(timer);
+            socket.destroy();
+            if (err)
+                reject(err);
+            else
+                resolve(banner);
+        };
+        const timer = setTimeout(() => {
+            // Connected but silent: still a working port, just no banner yet.
+            if (connected)
+                done();
+            else
+                done(Object.assign(new Error("Connection timed out"), { code: "ETIMEDOUT" }));
+        }, timeoutMs);
+        socket.once("connect", () => { connected = true; });
+        socket.on("data", chunk => {
+            banner += chunk.toString("latin1");
+            if (banner.includes("\n") || banner.length >= 255) {
+                banner = banner.split(/\r?\n/)[0];
+                done();
+            }
+        });
+        socket.once("error", err => done(err));
+        socket.once("end", () => done());
+    });
+}
+async function checkStoredHostKey(host, port, key) {
+    const fingerprint = hostKeyFingerprint(key);
+    const data = await readKnownHosts(getKnownHostsPath());
+    const existing = data.hosts[knownHostId(host, port)];
+    if (!existing)
+        return { status: "new", fingerprint };
+    if (existing.fingerprint === fingerprint)
+        return { status: "trusted", fingerprint };
+    if (isNewHostKeyAccepted(process.env[ACCEPT_NEW_HOSTKEY_ENV], host, port, fingerprint)) {
+        return { status: "new", fingerprint, stored: existing.fingerprint };
+    }
+    return { status: "changed", fingerprint, stored: existing.fingerprint };
+}
+/** Days until the password expires (null when it never does). */
+const PROFILE_SQL = "SELECT DAYS_UNTIL_PASSWORD_EXPIRES AS DAYS FROM QSYS2.USER_INFO WHERE AUTHORIZATION_NAME = USER";
+const PROFILE_COMMAND = "LC_ALL=EN_US.UTF-8 /QOpenSys/usr/bin/qsh -c " +
+    Tools.shellQuote(`system "call QSYS/QZDFMDB2 PARM('-d' '-i' '-t')"`);
+function sshAttempt(options) {
+    const require = createRequire(import.meta.url);
+    const { Client } = require("ssh2");
+    return new Promise(resolve => {
+        const client = new Client();
+        let settled = false;
+        let hostKeyChanged;
+        const settle = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                client.end();
+            }
+            catch { /* already closed */ }
+            resolve(outcome);
+        };
+        client.on("change password", (prompt) => {
+            // Never change the password from a test; just report it.
+            settle({ kind: "password-expired", prompt });
+        });
+        client.on("error", (error) => {
+            if (hostKeyChanged)
+                settle({ kind: "host-key-changed", hostKey: hostKeyChanged });
+            else
+                settle({ kind: "error", error });
+        });
+        client.on("close", () => {
+            if (hostKeyChanged)
+                settle({ kind: "host-key-changed", hostKey: hostKeyChanged });
+            else
+                settle({ kind: "error", error: new Error("The server closed the connection") });
+        });
+        client.on("ready", async () => {
+            const profile = await readProfile(client).catch(() => undefined);
+            settle({ kind: "ready", profile });
+        });
+        client.connect({
+            host: options.host,
+            port: options.port,
+            username: options.username,
+            password: options.password,
+            privateKey: options.privateKey,
+            tryKeyboard: false,
+            readyTimeout: options.timeoutMs,
+            hostVerifier: (key, verify) => {
+                options.checkHostKey(key)
+                    .then(check => {
+                    if (check.status === "changed")
+                        hostKeyChanged = check;
+                    verify(check.status !== "changed");
+                })
+                    .catch(() => verify(false));
+            }
+        });
+    });
+}
+function readProfile(client) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error("profile query timed out")), PROFILE_TIMEOUT_MS);
+        client.exec(PROFILE_COMMAND, (err, stream) => {
+            if (err) {
+                clearTimeout(timer);
+                reject(err);
+                return;
+            }
+            let stdout = "";
+            stream.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+            stream.stderr.on("data", () => undefined);
+            stream.on("close", () => {
+                clearTimeout(timer);
+                try {
+                    const rows = Tools.db2Parse(stdout, PROFILE_SQL);
+                    const row = rows[0];
+                    if (!row)
+                        return resolve(undefined);
+                    const days = row.DAYS === null || row.DAYS === undefined || row.DAYS === "" ? undefined : Number(row.DAYS);
+                    resolve({
+                        daysUntilPasswordExpires: Number.isFinite(days) ? days : undefined
+                    });
+                }
+                catch (parseErr) {
+                    reject(parseErr);
+                }
+            });
+            stream.end(`${PROFILE_SQL}\n`);
+        });
+    });
+}
+const defaultDeps = {
+    lookup: lookupHost,
+    probePort,
+    readKey: path => fs.readFile(path, "utf8"),
+    checkHostKey: checkStoredHostKey,
+    ssh: sshAttempt,
+    now: () => Date.now()
+};

package/dist/controlplane/errors.js

@@ -0,0 +1,12 @@
+/**
+ * Error carrying an HTTP status code. The control-plane server maps it to the
+ * response status; any other error becomes a 500.
+ */
+export class ControlPlaneError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "ControlPlaneError";
+    }
+}