ysk-server-core 1.0.0

package/dist/skills/task-planner.js

@@ -0,0 +1,172 @@
+/**
+ * AI task pipeline: natural language → planned tool steps → review → execute via allowlist.
+ * LLM text is never executed directly.
+ */
+import { randomUUID } from 'node:crypto';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * Heuristic planner when LLM unavailable — maps common intents to allowlisted tools.
+ */
+export function planStepsFromPrompt(prompt, allowlist) {
+    const p = prompt.toLowerCase();
+    const steps = [];
+    if (/sys\.?info|系統|system info|hostname|uptime/.test(p)) {
+        const e = allowlist.evaluate('sys.info');
+        steps.push({
+            tool: 'sys.info',
+            args: {},
+            risk: e.risk,
+            requiresApproval: e.requiresApproval,
+        });
+    }
+    if (/process|進程|程序/.test(p)) {
+        const e = allowlist.evaluate('process.list');
+        steps.push({
+            tool: 'process.list',
+            args: {},
+            risk: e.risk,
+            requiresApproval: e.requiresApproval,
+        });
+    }
+    if (/nginx|service status|服務狀態/.test(p)) {
+        const name = /nginx/.test(p) ? 'nginx' : 'ysk-server';
+        const e = allowlist.evaluate('service.status');
+        steps.push({
+            tool: 'service.status',
+            args: { name },
+            risk: e.risk,
+            requiresApproval: e.requiresApproval,
+        });
+    }
+    if (/read\s+(\S+)|讀取\s*(\S+)|cat\s+(\S+)/.test(p)) {
+        const m = p.match(/(?:read|讀取|cat)\s+(\S+)/);
+        const path = m?.[1] ?? '/etc/os-release';
+        const e = allowlist.evaluate('fs.read');
+        steps.push({
+            tool: 'fs.read',
+            args: { path },
+            risk: e.risk,
+            requiresApproval: e.requiresApproval,
+        });
+    }
+    if (/restart\s+(\S+)|重啟\s*(\S+)/.test(p)) {
+        const m = p.match(/(?:restart|重啟)\s+(\S+)/);
+        const name = m?.[1] ?? 'nginx';
+        const e = allowlist.evaluate('service.restart');
+        steps.push({
+            tool: 'service.restart',
+            args: { name },
+            risk: e.risk,
+            requiresApproval: e.requiresApproval,
+        });
+    }
+    if (!steps.length) {
+        // Default safe discovery
+        const e = allowlist.evaluate('sys.info');
+        steps.push({
+            tool: 'sys.info',
+            args: {},
+            risk: e.risk,
+            requiresApproval: e.requiresApproval,
+        });
+    }
+    return {
+        summary: `Planned ${steps.length} step(s) for: ${prompt.slice(0, 120)}`,
+        steps,
+    };
+}
+/**
+ * Create a task in awaiting_review (or auto-run dry plan only).
+ */
+export function createAiTask(input) {
+    if (!input.prompt?.trim()) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1427'), { httpStatus: 400 });
+    }
+    const planned = planStepsFromPrompt(input.prompt, input.allowlist);
+    const now = new Date().toISOString();
+    const task = {
+        id: randomUUID(),
+        prompt: input.prompt.trim(),
+        status: 'awaiting_review',
+        planSummary: planned.summary,
+        actor: input.actor,
+        created_at: now,
+        updated_at: now,
+        steps: planned.steps.map((s) => ({
+            ...s,
+            id: randomUUID(),
+            status: 'planned',
+        })),
+    };
+    input.store.save(task);
+    return task;
+}
+/**
+ * Optional LLM enrichment of plan summary (never trusts model for tools list alone).
+ */
+export async function enrichPlanWithLlm(task, llm) {
+    try {
+        const res = await llm.chat({
+            messages: [
+                {
+                    role: 'system',
+                    content: 'You summarize server ops plans. Reply with 2 short sentences. Do not invent shell commands.',
+                },
+                {
+                    role: 'user',
+                    content: `User asked: ${task.prompt}\nSteps: ${task.steps.map((s) => s.tool).join(', ')}`,
+                },
+            ],
+        });
+        llm.assertNotExecutable(res);
+        task.planSummary = `${task.planSummary}\n[LLM untrusted note] ${res.content.slice(0, 400)}`;
+        task.updated_at = new Date().toISOString();
+    }
+    catch {
+        // keep heuristic summary
+    }
+    return task;
+}
+/**
+ * Approve all planned steps (human review).
+ */
+export function approveTaskSteps(task, store) {
+    for (const s of task.steps) {
+        if (s.status === 'planned')
+            s.status = 'approved';
+    }
+    task.status = 'awaiting_review';
+    task.updated_at = new Date().toISOString();
+    store.save(task);
+    return task;
+}
+/**
+ * Build RCA report structure from host facts + optional LLM prose.
+ */
+export function buildRcaReport(input) {
+    const hypotheses = [];
+    const recommendedActions = [];
+    const factsStr = JSON.stringify(input.facts).toLowerCase();
+    if (factsStr.includes('inactive') || factsStr.includes('failed')) {
+        hypotheses.push('A managed service may be down or misconfigured');
+        recommendedActions.push('Check service.status and recent logs before restart');
+    }
+    if (factsStr.includes('enospc') || factsStr.includes('no space')) {
+        hypotheses.push('Disk space exhaustion');
+        recommendedActions.push('Inspect disk usage and prune logs/backups');
+    }
+    if (!hypotheses.length) {
+        hypotheses.push('Insufficient signals — gather sys.info, process.list, and service logs');
+        recommendedActions.push('Run read-only discovery tools, then re-run RCA');
+    }
+    return {
+        id: randomUUID(),
+        title: input.title,
+        facts: input.facts,
+        hypotheses,
+        recommendedActions,
+        untrustedLlmNote: input.llmNote,
+        created_at: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=task-planner.js.map

package/dist/skills/task-planner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-planner.js","sourceRoot":"","sources":["../../src/skills/task-planner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAkC5D;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,SAAoB;IAItE,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAsC,EAAE,CAAC;IAEpD,IAAI,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QACtD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC;QACzC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,yBAAyB;QACzB,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,WAAW,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;QACvE,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAK5B;IACC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAW;QACnB,EAAE,EAAE,UAAU,EAAE;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,iBAAiB;QACzB,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,GAAG,CAAC;YACJ,EAAE,EAAE,UAAU,EAAE;YAChB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,GAAe;IAEf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;YACzB,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,OAAO,EACL,6FAA6F;iBAChG;gBACD;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,eAAe,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC1F;aACF;SACF,CAAC,CAAC;QACH,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,GAAG,IAAI,CAAC,WAAW,0BAA0B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAgB;IAC7D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC;IAChC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAI9B;IASC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,UAAU,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAClE,kBAAkB,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACzC,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC1F,kBAAkB,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU;QACV,kBAAkB;QAClB,gBAAgB,EAAE,KAAK,CAAC,OAAO;QAC/B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC"}

package/dist/terminal/index.d.ts

@@ -0,0 +1,4 @@
+export { buildRootSpawnPlan, buildProjectSpawnPlan, type TerminalSpawnPlan, type TerminalTargetKind, } from './spawn-plan.js';
+export { createTerminalTicketStore, type TerminalTicketRecord, type TerminalTicketStore, } from './tickets.js';
+export { listTerminalTargets, type TerminalTargetDto, } from './targets.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/terminal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/terminal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC"}

package/dist/terminal/index.js

@@ -0,0 +1,4 @@
+export { buildRootSpawnPlan, buildProjectSpawnPlan, } from './spawn-plan.js';
+export { createTerminalTicketStore, } from './tickets.js';
+export { listTerminalTargets, } from './targets.js';
+//# sourceMappingURL=index.js.map

package/dist/terminal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/terminal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GAGtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,GAEpB,MAAM,cAAc,CAAC"}

package/dist/terminal/spawn-plan.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Pure spawn plan for interactive login shells (web terminal).
+ * Actual PTY is opened by the server (node-pty).
+ */
+export type TerminalTargetKind = 'root' | 'project';
+export type TerminalSpawnPlan = {
+    kind: TerminalTargetKind;
+    /** OS username for the shell */
+    linuxUser: string;
+    file: string;
+    args: string[];
+    cwd: string;
+    env: Record<string, string>;
+    projectId?: string;
+    projectName?: string;
+};
+export declare function buildRootSpawnPlan(opts?: {
+    cols?: number;
+    rows?: number;
+    home?: string;
+}): TerminalSpawnPlan;
+export declare function buildProjectSpawnPlan(input: {
+    linuxUser: string;
+    homeDir: string;
+    projectId: string;
+    projectName: string;
+    cols?: number;
+    rows?: number;
+}): TerminalSpawnPlan;
+//# sourceMappingURL=spawn-plan.d.ts.map

package/dist/terminal/spawn-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-plan.d.ts","sourceRoot":"","sources":["../../src/terminal/spawn-plan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,kBAAkB,CAAC;IACzB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,iBAAiB,CAgBpB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,iBAAiB,CAuBpB"}

package/dist/terminal/spawn-plan.js

@@ -0,0 +1,63 @@
+/**
+ * Pure spawn plan for interactive login shells (web terminal).
+ * Actual PTY is opened by the server (node-pty).
+ */
+export function buildRootSpawnPlan(opts) {
+    const home = opts?.home || process.env.HOME || '/root';
+    return {
+        kind: 'root',
+        linuxUser: 'root',
+        file: 'bash',
+        args: ['-l'],
+        cwd: home,
+        env: baseEnv({
+            USER: 'root',
+            HOME: home,
+            LOGNAME: 'root',
+            cols: opts?.cols,
+            rows: opts?.rows,
+        }),
+    };
+}
+export function buildProjectSpawnPlan(input) {
+    const user = String(input.linuxUser || '').trim();
+    const home = String(input.homeDir || '').trim() || `/home/${user}`;
+    if (!user || user === 'root') {
+        throw new Error('invalid project linux user');
+    }
+    // Isolated login shell as project user (same isolation model as project-user-run)
+    return {
+        kind: 'project',
+        linuxUser: user,
+        file: 'runuser',
+        args: ['-u', user, '--', 'bash', '-l'],
+        cwd: home,
+        env: baseEnv({
+            USER: user,
+            HOME: home,
+            LOGNAME: user,
+            cols: input.cols,
+            rows: input.rows,
+        }),
+        projectId: input.projectId,
+        projectName: input.projectName,
+    };
+}
+function baseEnv(input) {
+    const cols = Math.max(20, Math.min(500, input.cols ?? 120));
+    const rows = Math.max(5, Math.min(200, input.rows ?? 32));
+    return {
+        TERM: 'xterm-256color',
+        COLORTERM: 'truecolor',
+        LANG: process.env.LANG || 'C.UTF-8',
+        USER: input.USER,
+        HOME: input.HOME,
+        LOGNAME: input.LOGNAME,
+        SHELL: '/bin/bash',
+        // Hint for shell prompt tools
+        YSK_TERMINAL: '1',
+        COLUMNS: String(cols),
+        LINES: String(rows),
+    };
+}
+//# sourceMappingURL=spawn-plan.js.map

package/dist/terminal/spawn-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-plan.js","sourceRoot":"","sources":["../../src/terminal/spawn-plan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,MAAM,UAAU,kBAAkB,CAAC,IAIlC;IACC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;IACvD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,OAAO,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,IAAI,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI,EAAE,IAAI;SACjB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,kFAAkF;IAClF,OAAO;QACL,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;QACtC,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,OAAO,CAAC;YACX,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;QACF,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAMhB;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,WAAW;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,WAAW;QAClB,8BAA8B;QAC9B,YAAY,EAAE,GAAG;QACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;KACpB,CAAC;AACJ,CAAC"}

package/dist/terminal/targets.d.ts

@@ -0,0 +1,39 @@
+/**
+ * List interactive shell targets for the web terminal.
+ */
+import type { HostExecutor } from '../host/executor.js';
+export type TerminalTargetDto = {
+    kind: 'root';
+    id: 'root';
+    label: string;
+    linuxUser: 'root';
+    available: boolean;
+    notes: string[];
+} | {
+    kind: 'project';
+    id: string;
+    label: string;
+    projectId: string;
+    projectName: string;
+    linuxUser: string;
+    homeDir: string;
+    available: boolean;
+    notes: string[];
+};
+export declare function listTerminalTargets(input: {
+    host: HostExecutor;
+    projects: Array<{
+        id: string;
+        name: string;
+        linuxUser: string;
+        homeDir: string;
+        osProvisioned?: boolean;
+    }>;
+}): Promise<{
+    executeEnabled: boolean;
+    isRoot: boolean;
+    canOpen: boolean;
+    items: TerminalTargetDto[];
+    notes: string[];
+}>;
+//# sourceMappingURL=targets.d.ts.map

package/dist/terminal/targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"targets.d.ts","sourceRoot":"","sources":["../../src/terminal/targets.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEN,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;CACJ,GAAG,OAAO,CAAC;IACV,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CA6CD"}

package/dist/terminal/targets.js

@@ -0,0 +1,51 @@
+/**
+ * List interactive shell targets for the web terminal.
+ */
+import { existsSync } from 'node:fs';
+export async function listTerminalTargets(input) {
+    const executeEnabled = input.host.executeEnabled();
+    const isRoot = input.host.isRoot();
+    const canOpen = executeEnabled && isRoot;
+    const notes = [];
+    if (!executeEnabled)
+        notes.push('YSK_EXECUTE required');
+    if (!isRoot)
+        notes.push('control plane must run as root for user shells');
+    const items = [];
+    items.push({
+        kind: 'root',
+        id: 'root',
+        label: 'root',
+        linuxUser: 'root',
+        available: canOpen,
+        notes: canOpen ? [] : [...notes],
+    });
+    for (const p of input.projects) {
+        const user = String(p.linuxUser || '').trim();
+        const home = String(p.homeDir || '').trim();
+        const pNotes = [];
+        if (!canOpen)
+            pNotes.push(...notes);
+        if (!user)
+            pNotes.push('missing linuxUser');
+        if (!p.osProvisioned)
+            pNotes.push('OS user not provisioned');
+        if (home && !existsSync(home))
+            pNotes.push('home dir missing');
+        // Soft availability: canOpen + user name present; provisioned preferred
+        const available = canOpen && Boolean(user) && Boolean(p.osProvisioned);
+        items.push({
+            kind: 'project',
+            id: `project:${p.id}`,
+            label: `${p.name} (${user || '—'})`,
+            projectId: p.id,
+            projectName: p.name,
+            linuxUser: user || '—',
+            homeDir: home || '',
+            available,
+            notes: pNotes,
+        });
+    }
+    return { executeEnabled, isRoot, canOpen, items, notes };
+}
+//# sourceMappingURL=targets.js.map

package/dist/terminal/targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"targets.js","sourceRoot":"","sources":["../../src/terminal/targets.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAwBrC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KASzC;IAOC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,cAAc,IAAI,MAAM,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAE1E,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;KACjC,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,aAAa;YAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE/D,wEAAwE;QACxE,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAEvE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE;YACrB,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG;YACnC,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,WAAW,EAAE,CAAC,CAAC,IAAI;YACnB,SAAS,EAAE,IAAI,IAAI,GAAG;YACtB,OAAO,EAAE,IAAI,IAAI,EAAE;YACnB,SAAS;YACT,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC"}

package/dist/terminal/tickets.d.ts

@@ -0,0 +1,34 @@
+/**
+ * One-time short-lived tickets for WebSocket terminal auth (avoid long Bearer in query logs).
+ */
+export type TerminalTicketRecord = {
+    ticket: string;
+    sessionId: string;
+    actor: string;
+    actorUserId?: string;
+    /** root | project:<id> */
+    targetKey: string;
+    linuxUser: string;
+    projectId?: string;
+    projectName?: string;
+    cols: number;
+    rows: number;
+    createdAt: number;
+    expiresAt: number;
+    consumed: boolean;
+};
+export type TerminalTicketStore = {
+    issue(input: Omit<TerminalTicketRecord, 'ticket' | 'createdAt' | 'expiresAt' | 'consumed' | 'sessionId'> & {
+        sessionId?: string;
+        ttlMs?: number;
+    }): TerminalTicketRecord;
+    /** Consume once if valid; returns null if missing/expired/used */
+    consume(ticket: string): TerminalTicketRecord | null;
+    purgeExpired(now?: number): number;
+    size(): number;
+};
+export declare function createTerminalTicketStore(opts?: {
+    ttlMs?: number;
+    now?: () => number;
+}): TerminalTicketStore;
+//# sourceMappingURL=tickets.d.ts.map

package/dist/terminal/tickets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tickets.d.ts","sourceRoot":"","sources":["../../src/terminal/tickets.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG;QACzG,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,oBAAoB,CAAC;IACzB,kEAAkE;IAClE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAAC;IACrD,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,IAAI,IAAI,MAAM,CAAC;CAChB,CAAC;AAIF,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,mBAAmB,CAwDtB"}

package/dist/terminal/tickets.js

@@ -0,0 +1,64 @@
+/**
+ * One-time short-lived tickets for WebSocket terminal auth (avoid long Bearer in query logs).
+ */
+import { randomBytes } from 'node:crypto';
+const DEFAULT_TTL_MS = 60_000;
+export function createTerminalTicketStore(opts) {
+    const map = new Map();
+    const ttlDefault = opts?.ttlMs ?? DEFAULT_TTL_MS;
+    const nowFn = opts?.now ?? (() => Date.now());
+    return {
+        issue(input) {
+            const now = nowFn();
+            const ticket = randomBytes(24).toString('base64url');
+            const sessionId = input.sessionId || randomBytes(12).toString('hex');
+            const rec = {
+                ticket,
+                sessionId,
+                actor: input.actor,
+                actorUserId: input.actorUserId,
+                targetKey: input.targetKey,
+                linuxUser: input.linuxUser,
+                projectId: input.projectId,
+                projectName: input.projectName,
+                cols: input.cols,
+                rows: input.rows,
+                createdAt: now,
+                expiresAt: now + (input.ttlMs ?? ttlDefault),
+                consumed: false,
+            };
+            map.set(ticket, rec);
+            // opportunistic purge
+            if (map.size > 200)
+                this.purgeExpired(now);
+            return rec;
+        },
+        consume(ticket) {
+            const now = nowFn();
+            const rec = map.get(ticket);
+            if (!rec)
+                return null;
+            if (rec.consumed || rec.expiresAt < now) {
+                map.delete(ticket);
+                return null;
+            }
+            rec.consumed = true;
+            map.delete(ticket);
+            return rec;
+        },
+        purgeExpired(now = nowFn()) {
+            let n = 0;
+            for (const [k, v] of map) {
+                if (v.expiresAt < now || v.consumed) {
+                    map.delete(k);
+                    n += 1;
+                }
+            }
+            return n;
+        },
+        size() {
+            return map.size;
+        },
+    };
+}
+//# sourceMappingURL=tickets.js.map

package/dist/terminal/tickets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tickets.js","sourceRoot":"","sources":["../../src/terminal/tickets.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA8B1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,UAAU,yBAAyB,CAAC,IAGzC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,IAAI,cAAc,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE9C,OAAO;QACL,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,GAAG,GAAyB;gBAChC,MAAM;gBACN,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;gBAC5C,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACrB,sBAAsB;YACtB,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,CAAC,MAAM;YACZ,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,YAAY,CAAC,GAAG,GAAG,KAAK,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACpC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACd,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/test/host.d.ts

@@ -0,0 +1,11 @@
+import { LocalHostExecutor } from '../host/executor.js';
+export declare function makeTempDir(prefix?: string): string;
+export declare function makeHost(opts?: {
+    dir?: string;
+    executeEnabled?: boolean;
+}): {
+    host: LocalHostExecutor;
+    dir: string;
+    cleanup: () => void;
+};
+//# sourceMappingURL=host.d.ts.map

package/dist/test/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/test/host.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,wBAAgB,WAAW,CAAC,MAAM,SAAc,GAAG,MAAM,CAExD;AAED,wBAAgB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAchE"}

package/dist/test/host.js

@@ -0,0 +1,25 @@
+/**
+ * Shared host fixture for core unit tests.
+ */
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { LocalHostExecutor } from '../host/executor.js';
+export function makeTempDir(prefix = 'ysk-core-') {
+    return mkdtempSync(join(tmpdir(), prefix));
+}
+export function makeHost(opts) {
+    const dir = opts?.dir ?? makeTempDir();
+    const host = new LocalHostExecutor({
+        allowedWriteRoots: [dir],
+        // Vitest sandboxes need tar/git/run under write roots; honesty tests pass false.
+        executeEnabled: opts?.executeEnabled ??
+            (process.env.VITEST === 'true' || process.env.VITEST === '1'),
+    });
+    return {
+        host,
+        dir,
+        cleanup: () => rmSync(dir, { recursive: true, force: true }),
+    };
+}
+//# sourceMappingURL=host.js.map

package/dist/test/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/test/host.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,UAAU,WAAW,CAAC,MAAM,GAAG,WAAW;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAGxB;IACC,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC;QACjC,iBAAiB,EAAE,CAAC,GAAG,CAAC;QACxB,iFAAiF;QACjF,cAAc,EACZ,IAAI,EAAE,cAAc;YACpB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;KAChE,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,GAAG;QACH,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC"}

package/dist/update/advisor.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Intelligent software update & vulnerability advice (structured, pure logic).
+ */
+import type { UpdateItemDto } from 'ysk-server-shared';
+export interface PackageInventoryItem {
+    packageName: string;
+    currentVersion: string;
+    candidateVersion?: string;
+    changelogSnippet?: string;
+    knownCves?: string[];
+    hasSecurityFix?: boolean;
+    hasBreakingChange?: boolean;
+}
+/**
+ * Derive structured update advice from inventory + advisory signals.
+ * Policy:
+ * - high/critical risk always requires human approval
+ * - low-risk security patches (no HIGH/CRITICAL CVE, no breaking) may auto-update
+ * - routine medium updates require approval
+ */
+export declare function adviseUpdate(item: PackageInventoryItem): UpdateItemDto;
+/**
+ * Build public advisory lookup query descriptors (NVD / GHSA style).
+ */
+export declare function buildAdvisoryQueries(packageName: string, version: string): Array<{
+    source: string;
+    query: string;
+}>;
+export interface UpdateExecutionPlan {
+    mode: 'auto' | 'approval';
+    commands: string[];
+    rollbackCommands: string[];
+    audit: Record<string, string>;
+}
+/**
+ * Plan package update execution with rollback hints.
+ */
+export declare function planUpdateExecution(item: UpdateItemDto): UpdateExecutionPlan;
+//# sourceMappingURL=advisor.d.ts.map

package/dist/update/advisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisor.d.ts","sourceRoot":"","sources":["../../src/update/advisor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAA0B,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG/E,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,oBAAoB,GAAG,aAAa,CAqEtE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1C;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,mBAAmB,CAkB5E"}