termify-agent 1.0.50 → 1.0.54

package/dist/ssh/system-ssh.test.js

@@ -0,0 +1,189 @@
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { SystemSSHManager } from './system-ssh.js';
+test('creates local SSH key material and stores issued bootstrap certificates', async (t) => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'termify-agent-system-ssh-'));
+    const manager = new SystemSSHManager(tempDir);
+    t.after(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    const keyPairs = await manager.ensureLocalKeyPairs();
+    assert.ok(keyPairs.userPublicKey.startsWith('ssh-ed25519 '));
+    assert.ok(keyPairs.hostPublicKey.startsWith('ssh-ed25519 '));
+    assert.equal(existsSync(manager.getPaths().userPrivateKeyPath), true);
+    assert.equal(existsSync(manager.getPaths().hostPrivateKeyPath), true);
+    const bootstrap = {
+        accountPrincipal: 'termify-account:user-123',
+        userCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestUserCa termify-user-ca',
+        hostCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestHostCa termify-host-ca',
+        userCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAUserCert termify-user-cert\n',
+        hostCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAHostCert termify-host-cert\n',
+        userValidForSeconds: 3600,
+        hostValidForSeconds: 86400,
+    };
+    await manager.applyBootstrap(bootstrap);
+    assert.equal(manager.readAccountPrincipal(), 'termify-account:user-123');
+    assert.equal(readFileSync(manager.getPaths().userCertificatePath, 'utf8'), bootstrap.userCertificate);
+    assert.equal(readFileSync(manager.getPaths().hostCertificatePath, 'utf8'), bootstrap.hostCertificate);
+    assert.equal(readFileSync(manager.getPaths().userCaPublicKeyPath, 'utf8'), `${bootstrap.userCaPublicKey}\n`);
+    assert.equal(readFileSync(manager.getPaths().hostCaPublicKeyPath, 'utf8'), `${bootstrap.hostCaPublicKey}\n`);
+});
+test('separates client and server SSH state so sshd does not depend on user HOME', async (t) => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'termify-agent-ssh-layout-'));
+    const homeDir = join(tempDir, 'home');
+    const manager = new SystemSSHManager(join(tempDir, 'user-state'), homeDir, {
+        systemRootDir: join(tempDir, 'system-state'),
+        reloadSshd: false,
+    });
+    t.after(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    await manager.ensureLocalKeyPairs();
+    await manager.applyBootstrap({
+        accountPrincipal: 'termify-account:user-123',
+        userCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestUserCa termify-user-ca',
+        hostCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestHostCa termify-host-ca',
+        userCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAUserCert termify-user-cert\n',
+        hostCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAHostCert termify-host-cert\n',
+        userValidForSeconds: 3600,
+        hostValidForSeconds: 86400,
+    });
+    const paths = manager.getPaths();
+    assert.equal(paths.userRootDir, join(tempDir, 'user-state'));
+    assert.equal(paths.systemRootDir, join(tempDir, 'system-state'));
+    assert.equal(paths.userPrivateKeyPath.startsWith(paths.userRootDir), true);
+    assert.equal(paths.userCertificatePath.startsWith(paths.userRootDir), true);
+    assert.equal(paths.hostPrivateKeyPath.startsWith(paths.systemRootDir), true);
+    assert.equal(paths.hostCertificatePath.startsWith(paths.systemRootDir), true);
+    assert.equal(paths.metadataPath.startsWith(paths.systemRootDir), true);
+    assert.equal(manager.readAccountPrincipal(), 'termify-account:user-123');
+});
+test('installs managed OpenSSH blocks into user and server config files', async (t) => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'termify-agent-ssh-install-'));
+    const homeDir = join(tempDir, 'home');
+    const sshdConfigPath = join(tempDir, 'etc', 'ssh', 'sshd_config');
+    const manager = new SystemSSHManager(join(tempDir, 'state'), homeDir, {
+        systemRootDir: join(tempDir, 'system-state'),
+        sshdConfigPath,
+        reloadSshd: false,
+    });
+    t.after(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    await manager.ensureLocalKeyPairs();
+    await manager.applyBootstrap({
+        accountPrincipal: 'termify-account:user-123',
+        userCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestUserCa termify-user-ca',
+        hostCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestHostCa termify-host-ca',
+        userCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAUserCert termify-user-cert\n',
+        hostCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAHostCert termify-host-cert\n',
+        userValidForSeconds: 3600,
+        hostValidForSeconds: 86400,
+    });
+    await manager.installOpenSshIntegration();
+    const userConfig = readFileSync(join(homeDir, '.ssh', 'config'), 'utf8');
+    const sshdConfig = readFileSync(sshdConfigPath, 'utf8');
+    const paths = manager.getPaths();
+    assert.match(userConfig, /# >>> termify:ssh-client >>>/);
+    assert.match(userConfig, /Host 10\.100\.\*/);
+    assert.match(userConfig, /IdentityFile/);
+    assert.match(sshdConfig, /# >>> termify:sshd >>>/);
+    assert.match(sshdConfig, /TrustedUserCAKeys/);
+    assert.match(sshdConfig, new RegExp(`AuthorizedPrincipalsFile ${paths.authorizedPrincipalsPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`));
+    assert.doesNotMatch(sshdConfig, /AuthorizedPrincipalsCommand/);
+    assert.equal(readFileSync(paths.authorizedPrincipalsPath, 'utf8'), 'termify-account:user-123\n');
+});
+test('defaults client state to the invoking user home under sudo', async (t) => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'termify-agent-ssh-sudo-'));
+    const sudoHomeDir = join(tempDir, 'sudo-home');
+    const originalGetuid = process.getuid;
+    const originalHome = process.env.TERMIFY_SSH_HOME_DIR;
+    const originalSudoUser = process.env.SUDO_USER;
+    const originalSudoUid = process.env.SUDO_UID;
+    const originalSudoGid = process.env.SUDO_GID;
+    const ownedPaths = [];
+    process.env.TERMIFY_SSH_HOME_DIR = sudoHomeDir;
+    process.env.SUDO_USER = 'ubuntu';
+    process.env.SUDO_UID = String(originalGetuid?.() ?? 0);
+    process.env.SUDO_GID = String(process.getgid?.() ?? 0);
+    Object.defineProperty(process, 'getuid', { value: () => 0 });
+    t.after(() => {
+        if (originalHome === undefined)
+            delete process.env.TERMIFY_SSH_HOME_DIR;
+        else
+            process.env.TERMIFY_SSH_HOME_DIR = originalHome;
+        if (originalSudoUser === undefined)
+            delete process.env.SUDO_USER;
+        else
+            process.env.SUDO_USER = originalSudoUser;
+        if (originalSudoUid === undefined)
+            delete process.env.SUDO_UID;
+        else
+            process.env.SUDO_UID = originalSudoUid;
+        if (originalSudoGid === undefined)
+            delete process.env.SUDO_GID;
+        else
+            process.env.SUDO_GID = originalSudoGid;
+        Object.defineProperty(process, 'getuid', { value: originalGetuid });
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    const manager = new SystemSSHManager({
+        systemRootDir: join(tempDir, 'system-state'),
+        sshdConfigPath: join(tempDir, 'etc', 'ssh', 'sshd_config'),
+        reloadSshd: false,
+        applyUserOwnership: async (filePath) => {
+            ownedPaths.push(filePath);
+        },
+    });
+    await manager.ensureLocalKeyPairs();
+    await manager.applyBootstrap({
+        accountPrincipal: 'termify-account:user-123',
+        userCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestUserCa termify-user-ca',
+        hostCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestHostCa termify-host-ca',
+        userCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAUserCert termify-user-cert\n',
+        hostCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAHostCert termify-host-cert\n',
+        userValidForSeconds: 3600,
+        hostValidForSeconds: 86400,
+    });
+    await manager.installOpenSshIntegration();
+    const paths = manager.getPaths();
+    assert.equal(paths.userRootDir, join(sudoHomeDir, '.termify', 'ssh'));
+    assert.equal(paths.clientConfigPath, join(sudoHomeDir, '.ssh', 'config'));
+    assert.equal(ownedPaths.includes(paths.userPrivateKeyPath), true);
+    assert.equal(ownedPaths.includes(paths.userCertificatePath), true);
+    assert.equal(ownedPaths.includes(paths.knownHostsPath), true);
+    assert.equal(ownedPaths.includes(paths.clientConfigPath), true);
+});
+test('uses AuthorizedPrincipalsFile on Windows too', async (t) => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'termify-agent-ssh-windows-'));
+    const manager = new SystemSSHManager({
+        homeDir: join(tempDir, 'home'),
+        systemRootDir: join(tempDir, 'programdata', 'Termify', 'ssh'),
+        sshdConfigPath: join(tempDir, 'programdata', 'ssh', 'sshd_config'),
+        platformOverride: 'win32',
+        reloadSshd: false,
+    });
+    t.after(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    await manager.ensureLocalKeyPairs();
+    await manager.applyBootstrap({
+        accountPrincipal: 'termify-account:user-123',
+        userCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestUserCa termify-user-ca',
+        hostCaPublicKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestHostCa termify-host-ca',
+        userCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAUserCert termify-user-cert\n',
+        hostCertificate: 'ssh-ed25519-cert-v01@openssh.com AAAAHostCert termify-host-cert\n',
+        userValidForSeconds: 3600,
+        hostValidForSeconds: 86400,
+    });
+    await manager.installOpenSshIntegration();
+    const paths = manager.getPaths();
+    const sshdConfig = readFileSync(join(tempDir, 'programdata', 'ssh', 'sshd_config'), 'utf8');
+    assert.equal(readFileSync(paths.authorizedPrincipalsPath, 'utf8'), 'termify-account:user-123\n');
+    assert.match(sshdConfig, /AuthorizedPrincipalsFile/);
+    assert.doesNotMatch(sshdConfig, /AuthorizedPrincipalsCommand/);
+});
+//# sourceMappingURL=system-ssh.test.js.map

package/dist/ssh/system-ssh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-ssh.test.js","sourceRoot":"","sources":["../../src/ssh/system-ssh.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,IAAI,CAAC,yEAAyE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1F,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE9C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACX,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAErD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;IAEtE,MAAM,SAAS,GAA8B;QAC3C,gBAAgB,EAAE,0BAA0B;QAC5C,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,mEAAmE;QACpF,eAAe,EAAE,mEAAmE;QACpF,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,KAAK;KAC3B,CAAC;IAEF,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAExC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IACtG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IACtG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC;IAC7G,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC;AAC/G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE;QACzE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC;QAC5C,UAAU,EAAE,KAAK;KACX,CAAC,CAAC;IAEV,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACX,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,CAAC,cAAc,CAAC;QAC3B,gBAAgB,EAAE,0BAA0B;QAC5C,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,mEAAmE;QACpF,eAAe,EAAE,mEAAmE;QACpF,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAS,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,0BAA0B,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpF,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;QACpE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC;QAC5C,cAAc;QACd,UAAU,EAAE,KAAK;KACX,CAAC,CAAC;IAEV,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACX,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,CAAC,cAAc,CAAC;QAC3B,gBAAgB,EAAE,0BAA0B;QAC5C,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,mEAAmE;QACpF,eAAe,EAAE,mEAAmE;QACpF,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAE1C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAS,CAAC;IAExC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEzC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,MAAM,CAAC,4BAA4B,KAAK,CAAC,wBAAwB,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1I,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,wBAAwB,EAAE,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACtD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC7C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC7C,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,WAAW,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAE7D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACX,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;;YACnE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,YAAY,CAAC;QACrD,IAAI,gBAAgB,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;;YAC5D,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,gBAAgB,CAAC;QAC9C,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;;YAC1D,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,eAAe,CAAC;QAC5C,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;;YAC1D,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,eAAe,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;QACnC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC;QAC5C,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC;QAC1D,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,KAAK,EAAE,QAAgB,EAAE,EAAE;YAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;KACK,CAAC,CAAC;IAEV,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,CAAC,cAAc,CAAC;QAC3B,gBAAgB,EAAE,0BAA0B;QAC5C,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,mEAAmE;QACpF,eAAe,EAAE,mEAAmE;QACpF,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC;QAC7D,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC;QAClE,gBAAgB,EAAE,OAAO;QACzB,UAAU,EAAE,KAAK;KACX,CAAC,CAAC;IAEV,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACX,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,CAAC,cAAc,CAAC;QAC3B,gBAAgB,EAAE,0BAA0B;QAC5C,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,iEAAiE;QAClF,eAAe,EAAE,mEAAmE;QACpF,eAAe,EAAE,mEAAmE;QACpF,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAS,CAAC;IACxC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IAE5F,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,wBAAwB,EAAE,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IACrD,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termify-agent",
-  "version": "1.0.50",
+  "version": "1.0.54",
   "description": "Termify Agent CLI - Connect your local terminal to Termify",
   "type": "module",
   "main": "dist/index.js",

package/scripts/postinstall.js

@@ -15,7 +15,7 @@
  */
 
 import { execSync } from 'child_process';
-import { createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, copyFileSync, rmSync, readFileSync, readlinkSync, writeFileSync, symlinkSync, lstatSync } from 'fs';
+import { createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, copyFileSync, rmSync, readFileSync, readlinkSync, writeFileSync, symlinkSync, lstatSync, readdirSync } from 'fs';
 import { isAbsolute, join, dirname, resolve } from 'path';
 import { homedir, platform, arch } from 'os';
 import { get } from 'https';
@@ -75,6 +75,36 @@ function resolveNodePtyDir() {
   }
 }
 
+/**
+ * Clean up node-pty build artifacts that npm can't remove from staging dirs.
+ * node-gyp creates .target.mk, Makefile, config.gypi etc. that may be owned
+ * by root (when postinstall runs with elevated privileges), causing EACCES
+ * errors during npm's post-install cleanup. We remove these build artifacts
+ * since node-pty only needs build/Release/pty.node at runtime.
+ */
+function cleanNodePtyBuildArtifacts(dir) {
+  if (!dir || !existsSync(dir)) return;
+  try {
+    // Remove node-addon-api build artifacts (*.target.mk, *.Makefile)
+    const nodeAddonApiDir = join(dir, 'node-addon-api');
+    if (existsSync(nodeAddonApiDir)) {
+      rmSync(nodeAddonApiDir, { recursive: true, force: true });
+    }
+    // Remove build directory artifacts except Release/*.node binaries
+    const buildDir = join(dir, 'build');
+    if (existsSync(buildDir)) {
+      const keepPatterns = ['Release'];
+      for (const entry of readdirSync(buildDir)) {
+        if (!keepPatterns.includes(entry)) {
+          rmSync(join(buildDir, entry), { recursive: true, force: true });
+        }
+      }
+    }
+  } catch {
+    // Best effort — if this fails, npm will just show cleanup warnings
+  }
+}
+
 /**
  * Step 1: Rebuild node-pty with improved error handling
  * For Node.js v24+, prebuilds may not be compatible, so we compile from source
@@ -90,6 +120,7 @@ function rebuildNodePty() {
   // Fast path: already works (cached or live test)
   if (testNodePty()) {
     console.log('[termify-agent] node-pty is working.');
+    cleanNodePtyBuildArtifacts(nodePtyDir);
     return true;
   }
 
@@ -111,6 +142,7 @@ function rebuildNodePty() {
 
     if (testNodePty()) {
       console.log('[termify-agent] node-pty rebuilt successfully.');
+      cleanNodePtyBuildArtifacts(nodePtyDir);
       return true;
     }
   } catch (err) {
@@ -132,6 +164,7 @@ function rebuildNodePty() {
 
     if (testNodePty()) {
       console.log('[termify-agent] node-pty rebuilt successfully from module directory.');
+      cleanNodePtyBuildArtifacts(nodePtyDir);
       return true;
     }
   } catch (err) {
@@ -151,6 +184,7 @@ function rebuildNodePty() {
 
     if (testNodePty()) {
       console.log('[termify-agent] node-pty compiled from source successfully.');
+      cleanNodePtyBuildArtifacts(nodePtyDir);
       return true;
     }
   } catch (err) {
@@ -184,12 +218,16 @@ function rebuildNodePty() {
 
     if (testNodePty()) {
       console.log('[termify-agent] node-pty reinstalled and compiled successfully.');
+      cleanNodePtyBuildArtifacts(reinstalledNodePtyDir);
       return true;
     }
   } catch (err2) {
     // Continue to error message
   }
 
+  // Fix permissions even on failure so npm can clean up staging directory
+  cleanNodePtyBuildArtifacts(nodePtyDir);
+
   console.error('[termify-agent] CRITICAL: node-pty installation failed.');
   console.error('[termify-agent] Terminal features will NOT work.');
   console.error('[termify-agent] ');