9a302830 — eitri

.golangci.yml

Old		New
@@ -61,6 +61,9 @@ linters:
61	# CAs ARE signers); returning the concrete key type would be worse. A	61	# CAs ARE signers); returning the concrete key type would be worse. A
62	# documented seam, per this tier's policy.	62	# documented seam, per this tier's policy.
63	- golang.org/x/crypto/ssh.Signer	63	- golang.org/x/crypto/ssh.Signer
		64	# ssh.PublicKey is likewise the idiomatic x/crypto/ssh type for a fetched
		65	# CA / host key; the concrete key types are unexported. Same seam.
		66	- golang.org/x/crypto/ssh.PublicKey
64	depguard:	67	depguard:
65	rules:	68	rules:
66	# R1 cross-plane bans apply to production code only; integration tests	69	# R1 cross-plane bans apply to production code only; integration tests

Makefile

Old		New
@@ -27,6 +27,7 @@ build: web
27	go build -o $(BIN)/eitri-agent ./cmd/eitri-agent	27	go build -o $(BIN)/eitri-agent ./cmd/eitri-agent
28	go build -o $(BIN)/eitri-devstack ./cmd/eitri-devstack	28	go build -o $(BIN)/eitri-devstack ./cmd/eitri-devstack
29	go build -o $(BIN)/eitri-sandbox ./cmd/eitri-sandbox	29	go build -o $(BIN)/eitri-sandbox ./cmd/eitri-sandbox
		30	go build -o $(BIN)/eitri-mcp ./cmd/eitri-mcp
30		31
31	test:	32	test:
32	go test -race ./...	33	go test -race ./...

cmd/eitri-mcp/main.go

@@ @@ -0,0 +1,83 @@ @@
+// Command eitri-mcp is an MCP server exposing eitri VM tools to Claude:
+// create/list/info/exec/write_file/read_file/destroy. It is a client of the
+// eitri API plus SSH; it embeds no control-plane code. Wiring only — logic
+// lives in internal/mcpserver.
+package main
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+	"github.com/a73x/eitri/internal/mcpserver"
+	"github.com/a73x/eitri/internal/server/api/client"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+func main() {
+	defaultCfg := "~/.config/eitri-mcp/config.json"
+	if env := os.Getenv("EITRI_MCP_CONFIG"); env != "" {
+		defaultCfg = env
+	}
+	cfgPath := flag.String("config", defaultCfg, "path to eitri-mcp config.json")
+	flag.Parse()
+	if err := run(*cfgPath); err != nil {
+		fmt.Fprintln(os.Stderr, "eitri-mcp:", err)
+		os.Exit(1)
+	}
+}
+func run(cfgPath string) error {
+	cfg, err := mcpserver.LoadConfig(cfgPath)
+	if err != nil {
+		return err
+	}
+	// The Runner reaches VMs by name through the eitri SSH-CA jump gate: it
+	// authenticates with short-lived CA-signed user certs (minted on demand) and
+	// verifies both hops' host certs against the eitri CA. GateAuth is backed by
+	// the same API client.
+	api := &client.Client{BaseURL: cfg.ServerURL, Token: cfg.AdminToken}
+	tools := &mcpserver.Tools{
+		API: mcpserver.API{Client: api},
+		Runner: mcpserver.NewRunner(mcpserver.RunnerConfig{
+			Gate:   cfg.Gate,
+			Auth:   mcpserver.NewGateAuth(api, nil),
+			VMUser: cfg.VMUser,
+		}),
+		Gate:   cfg.Gate,
+		VMUser: cfg.VMUser,
+	}
+	server := mcp.NewServer(&mcp.Implementation{Name: "eitri", Version: "0.1.0"}, nil)
+	register(server, "vm_create", "Create an eitri VM (persistent). Waits for ready+cloud-init by default.", tools.VMCreate)
+	register(server, "vm_list", "List all VMs on the eitri fleet.", tools.VMList)
+	register(server, "vm_info", "Show one VM's state and how to reach it.", tools.VMInfo)
+	register(server, "vm_exec", "Run a shell command in a VM over SSH; returns stdout/stderr/exit code.", tools.VMExec)
+	register(server, "vm_write_file", "Write content to a file in a VM (parents created).", tools.VMWriteFile)
+	register(server, "vm_read_file", "Read a file from a VM (capped at 1 MiB).", tools.VMReadFile)
+	register(server, "vm_destroy", "Destroy a VM by id or EXACT name. Explicit-only; never called automatically.", tools.VMDestroy)
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	return server.Run(ctx, &mcp.StdioTransport{})
+}
+// register adapts a Tools method to the SDK. This is the ONLY place that
+// touches SDK generics; if the SDK's handler signature changes, change it here.
+//
+// Note on the hand-off contract: the SDK drops the Out value when the handler
+// returns a non-nil error — StructuredContent is left unset and only err.Error()
+// reaches the model (as IsError text content). VMCreate's degraded-path errors
+// are self-sufficient (they name the VM id+name), so the model can still find
+// and destroy the VM from the error text.
+func register[In, Out any](s *mcp.Server, name, desc string, fn func(context.Context, In) (Out, error)) {
+	mcp.AddTool(s, &mcp.Tool{Name: name, Description: desc},
+		func(ctx context.Context, req *mcp.CallToolRequest, in In) (*mcp.CallToolResult, Out, error) {
+			out, err := fn(ctx, in)
+			return nil, out, err
+		})
+}

docs/mcp.md

@@ @@ -0,0 +1,125 @@ @@
+# eitri-mcp: Claude ↔ eitri VMs
+`eitri-mcp` (`cmd/eitri-mcp`) is a stdio MCP server that gives Claude seven
+explicit tools for creating and controlling VMs on an eitri fleet. It is an
+API client of the eitri control plane plus SSH — it embeds no control-plane
+or agent code.
+## Tools
+| Tool | Purpose |
+|---|---|
+| `vm_create` | Create a persistent VM; by default waits for `lifecycle=ready` + IP, then for guest SSH and `cloud-init status --wait` to finish. |
+| `vm_list` | List all VMs on the fleet (id, name, lifecycle, IP, size). |
+| `vm_info` | Show one VM's state plus a ready-to-use `ssh` command. |
+| `vm_exec` | Run a shell command in a VM over SSH; returns stdout, stderr, exit code. |
+| `vm_write_file` | Write content to a path in a VM over SFTP (parent dirs created). |
+| `vm_read_file` | Read a file from a VM over SFTP (capped at 1 MiB, truncation flagged). |
+| `vm_destroy` | Destroy a VM by id or exact name. Explicit-only — never called automatically. |
+Deliberately absent: any host or fleet-level operation (enroll, decommission,
+power management, image/firmware knobs). The worst case from a confused model
+is VM churn, never fleet damage — and Claude Code's per-tool permission
+prompts gate every call regardless.
+## Setup
+. Build the binary:
+   ```
+   make build
+   ```
+   (or `go build ./cmd/eitri-mcp`) — this produces `bin/eitri-mcp`.
+. Create `~/.config/eitri-mcp/config.json`:
+   ```json
+   {
+     "server_url": "http://127.0.0.1:8080",
+     "admin_token_file": "~/eitri-deploy/admin-token",
+     "gate": "127.0.0.1:2223",
+     "vm_user": "ubuntu"
+   }
+   ```
+   Fields (see `internal/mcpserver/config.go`):
+   - `server_url` — required, the eitri API base URL.
+   - `admin_token_file` — required, path to a file holding the bearer token
+     (read at startup, held in memory, never surfaced in a tool result or
+     error).
+   - `gate` — the SSH-CA jump gate address, `<gate-domain>:<port>`; the MCP
+     reaches all VMs by name through it. The host part must match the
+     gate's host certificate principal (the server's `ssh_gate_domain`,
+     which defaults to the `ssh_listen` host).
+   - `vm_user` — guest SSH user; defaults to `ubuntu` if omitted.
+   The config path can be overridden with `--config` or `$EITRI_MCP_CONFIG`;
+   it defaults to `~/.config/eitri-mcp/config.json`.
+. Register with Claude Code:
+   ```
+   claude mcp add eitri -- /path/to/repo/bin/eitri-mcp
+   ```
+## Access model
+eitri-mcp reaches VMs by name through eitri's SSH-CA jump gate — there is no
+injected key and no TOFU. On demand, it generates an ephemeral SSH keypair
+in memory (never written to disk) and mints a short-lived user certificate
+for it (principal `ubuntu`, ~10-30 min TTL) by calling
+`POST /api/v1/ssh-certs` with the admin bearer token; the cert is
+auto-refreshed as it nears expiry. It also fetches the eitri SSH CA's public
+key once via `GET /api/v1/ssh-ca` and caches it. To reach a VM, it dials the
+gate (the configured `gate` address), authenticates with the user
+certificate, and opens a tunnel to `<vm-name>:22` — VMs are addressed by
+name, not IP, so recycled IPs and host-key churn are not a concern. Host
+identity is verified on both hops using `ssh.CertChecker` against the eitri
+CA: the gate's host certificate must carry its configured domain as
+principal, and each VM's host certificate must carry the VM's name. The
+guest trusts the CA-signed user certificate via `TrustedUserCAKeys`
+(provisioned server-side when the gate is enabled), so no per-VM
+`authorized_key` injection is needed. The admin token is only ever used to
+mint certificates — actual SSH traffic uses the certificate, and the token
+itself is never surfaced in a tool result or error.
+## Semantics
+- Every VM is created with `persistent: true`. There is **no TTL and no
+  reaper** — VMs live until something explicitly destroys them. `vm_destroy`
+  (exact id or name, no wildcards, no bulk) is the only kill path, and Claude
+  is instructed to treat it as explicit-only, never automatic cleanup.
+- The tool surface has no host or fleet operations by design — see the tools
+  table above.
+- Service exposure (ports, DNS, TLS certs, routing) is out of scope: the
+  tools hand back a host and an `ssh` command; getting a service reachable
+  from outside the VM is the caller's business.
+- The claude.ai connector (streamable HTTP transport + auth + ingress) is
+  phase 2 and not built — today's transport is stdio, for Claude Code only.
+  Phase 2's VM access is expected to reuse the same short-lived-certificate
+  flow through the gate, just with gate ingress reachable from claude.ai
+  instead of only from the MCP's host.
+> **IMPORTANT — "ready" is not "booted."** `vm_create`'s `lifecycle=ready`
+> means cloud-hypervisor is up and the VM has an allocated IP; it does **not**
+> mean the guest has finished booting Linux, brought up its NIC, or started
+> `sshd`. `vm_create` (with the default `wait: true`) accounts for this: it
+> polls for `ready` + IP, then retries SSH until it connects, then runs
+> `cloud-init status --wait` before returning — so a normal `vm_create` call
+> only returns once the guest is genuinely usable. But if you reach a
+> just-created VM some other way (e.g. its IP from `vm_list`/`vm_info`
+> immediately after creation, or `wait: false`), it may still be mid-boot and
+> refuse connections for a short window.
+## Testing this yourself
+Unit tests (`internal/mcpserver/*_test.go`) cover the tools against fake API
+and SSH seams. A tag-gated integration test
+(`internal/integration/mcp_smoke_test.go`) launches the real `eitri-mcp`
+binary as a subprocess speaking stdio MCP and drives create → exec →
+write/read file → destroy against a real VM:
+```
+sudo -v && go test -tags=smoke -timeout=25m -count=1 ./internal/integration -run TestMCPSmoke -v
+```

docs/shape.html

Old		New
@@ -78,6 +78,15 @@
78	]	78	]
79	},	79	},
80	{	80	{
		81	"importPath": "cmd/eitri-mcp",
		82	"plane": "binaries",
		83	"synopsis": "Command eitri-mcp is an MCP server exposing eitri VM tools to Claude: create/list/info/exec/write_file/read_file/destroy.",
		84	"imports": [
		85	"internal/mcpserver",
		86	"internal/server/api/client"
		87	]
		88	},
		89	{
81	"importPath": "cmd/eitri-server",	90	"importPath": "cmd/eitri-server",
82	"plane": "binaries",	91	"plane": "binaries",
83	"synopsis": "eitri-server: single-node control plane (Phase 1: static admin token, no TLS termination here — front with a reverse proxy for TLS).",	92	"synopsis": "eitri-server: single-node control plane (Phase 1: static admin token, no TLS termination here — front with a reverse proxy for TLS).",
@@ -206,6 +215,15 @@
206	"imports": []	215	"imports": []
207	},	216	},
208	{	217	{
		218	"importPath": "internal/mcpserver",
		219	"plane": "tooling",
		220	"synopsis": "Package mcpserver implements the eitri-mcp server: MCP tools that let a model create, control (SSH exec/files), and destroy eitri VMs.",
		221	"imports": [
		222	"internal/random",
		223	"internal/server/api/client"
		224	]
		225	},
		226	{
209	"importPath": "internal/names",	227	"importPath": "internal/names",
210	"plane": "wire",	228	"plane": "wire",
211	"synopsis": "Package names validates the DNS-label shape shared across planes: a VM's name doubles as its guest hostname, so it must be a valid RFC-1123 label.",	229	"synopsis": "Package names validates the DNS-label shape shared across planes: a VM's name doubles as its guest hostname, so it must be a valid RFC-1123 label.",
@@ -241,6 +259,14 @@
241	]	259	]
242	},	260	},
243	{	261	{
		262	"importPath": "internal/server/api/client",
		263	"plane": "control",
		264	"synopsis": "Package client is THE Go client for the eitri control-plane HTTP API — the one consumer every in-repo caller (MCP server) goes through.",
		265	"imports": [
		266	"internal/server/api/types"
		267	]
		268	},
		269	{
244	"importPath": "internal/server/api/spec",	270	"importPath": "internal/server/api/spec",
245	"plane": "control",	271	"plane": "control",
246	"synopsis": "Package spec projects the api route table into an OpenAPI 3.1 document.",	272	"synopsis": "Package spec projects the api route table into an OpenAPI 3.1 document.",

docs/shape.json

Old		New
@@ -27,6 +27,15 @@
27	]	27	]
28	},	28	},
29	{	29	{
		30	"importPath": "cmd/eitri-mcp",
		31	"plane": "binaries",
		32	"synopsis": "Command eitri-mcp is an MCP server exposing eitri VM tools to Claude: create/list/info/exec/write_file/read_file/destroy.",
		33	"imports": [
		34	"internal/mcpserver",
		35	"internal/server/api/client"
		36	]
		37	},
		38	{
30	"importPath": "cmd/eitri-server",	39	"importPath": "cmd/eitri-server",
31	"plane": "binaries",	40	"plane": "binaries",
32	"synopsis": "eitri-server: single-node control plane (Phase 1: static admin token, no TLS termination here — front with a reverse proxy for TLS).",	41	"synopsis": "eitri-server: single-node control plane (Phase 1: static admin token, no TLS termination here — front with a reverse proxy for TLS).",
@@ -155,6 +164,15 @@
155	"imports": []	164	"imports": []
156	},	165	},
157	{	166	{
		167	"importPath": "internal/mcpserver",
		168	"plane": "tooling",
		169	"synopsis": "Package mcpserver implements the eitri-mcp server: MCP tools that let a model create, control (SSH exec/files), and destroy eitri VMs.",
		170	"imports": [
		171	"internal/random",
		172	"internal/server/api/client"
		173	]
		174	},
		175	{
158	"importPath": "internal/names",	176	"importPath": "internal/names",
159	"plane": "wire",	177	"plane": "wire",
160	"synopsis": "Package names validates the DNS-label shape shared across planes: a VM's name doubles as its guest hostname, so it must be a valid RFC-1123 label.",	178	"synopsis": "Package names validates the DNS-label shape shared across planes: a VM's name doubles as its guest hostname, so it must be a valid RFC-1123 label.",
@@ -190,6 +208,14 @@
190	]	208	]
191	},	209	},
192	{	210	{
		211	"importPath": "internal/server/api/client",
		212	"plane": "control",
		213	"synopsis": "Package client is THE Go client for the eitri control-plane HTTP API — the one consumer every in-repo caller (MCP server) goes through.",
		214	"imports": [
		215	"internal/server/api/types"
		216	]
		217	},
		218	{
193	"importPath": "internal/server/api/spec",	219	"importPath": "internal/server/api/spec",
194	"plane": "control",	220	"plane": "control",
195	"synopsis": "Package spec projects the api route table into an OpenAPI 3.1 document.",	221	"synopsis": "Package spec projects the api route table into an OpenAPI 3.1 document.",

go.mod

go.sum

internal/arch/arch_test.go

+// The API contract is consumed through the client. internal/server/api/types
+// is the wire contract, but no package outside internal/server/* may import it —
+// consumers get the wire structs via internal/server/api/client's re-exported
+// aliases (client.Host and friends), so the client is the only door.
+func TestAPIContractIsConsumedThroughTheClient(t *testing.T) {
+	g := internalImports(t)
+	target := module + "/internal/server/api/types"
+	imported := false
+	for pkg, deps := range g {
+		for _, d := range deps {
+			if d != target {
+				continue
+			}
+			imported = true
+			if !has(pkg, "internal/server/") {
+				t.Errorf("package %s must not import %s — consume the API through internal/server/api/client instead", short(pkg), short(target))
+			}
+		}
+	}
+	if !imported {
+		// A rename of the types package would silently pass every sweep; guard it.
+		t.Errorf("sweep found no importer of %s at all — did the contract package move?", short(target))
+	}
+}
+// internal/server/api/types is a leaf — stdlib imports only. The contract
+// is consumed by the spec generator, the client, and the handlers; a single
+// internal import would drag server internals into every consumer at once and

internal/mcpserver/api_test.go

@@ @@ -0,0 +1,184 @@ @@
+package mcpserver
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+	"github.com/a73x/eitri/internal/server/api/client"
+)
+func fakeAPI(t *testing.T, handler http.HandlerFunc) API {
+	t.Helper()
+	srv := httptest.NewServer(handler)
+	t.Cleanup(srv.Close)
+	return API{Client: &client.Client{BaseURL: srv.URL, Token: "tok123"}}
+}
+func TestListVMs(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "GET", r.Method)
+		assert.Equal(t, "/api/v1/vms", r.URL.Path)
+		assert.Equal(t, "Bearer tok123", r.Header.Get("Authorization"))
+		json.NewEncoder(w).Encode([]map[string]any{
+			{"id": "abc", "name": "claude-x", "lifecycle": "ready", "assigned_ip": "10.77.1.5", "host_id": "h1"},
+		})
+	})
+	vms, err := c.ListVMs(t.Context())
+	require.NoError(t, err)
+	require.Len(t, vms, 1)
+	assert.Equal(t, client.VM{ID: "abc", Name: "claude-x", Lifecycle: "ready", AssignedIP: "10.77.1.5", HostID: "h1"}, vms[0])
+}
+func TestCreateVMSendsRequestAndParsesID(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "POST", r.Method)
+		assert.Equal(t, "/api/v1/vms", r.URL.Path)
+		var req map[string]any
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&req))
+		assert.Equal(t, true, req["persistent"])
+		assert.Equal(t, "h1", req["host_id"])
+		assert.Equal(t, "ssh-ed25519 AAA test", req["ssh_authorized_key"])
+		json.NewEncoder(w).Encode(map[string]string{"id": "new1", "name": req["name"].(string)})
+	})
+	got, err := c.CreateVM(t.Context(), client.CreateVMRequest{
+		HostID: "h1", Name: "claude-abc123", VCPUs: 2, MemMB: 2048, DiskGB: 20,
+		SSHAuthorizedKey: "ssh-ed25519 AAA test", Persistent: true,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "new1", got.ID)
+}
+func TestDeleteVM(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "DELETE", r.Method)
+		assert.Equal(t, "/api/v1/vms/abc", r.URL.Path)
+		w.WriteHeader(http.StatusNoContent)
+	})
+	require.NoError(t, c.DeleteVM(t.Context(), "abc"))
+}
+func TestFirstOnlineHost(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode([]map[string]any{
+			{"id": "h0", "name": "down", "online": false},
+			{"id": "h1", "name": "mewtwo", "online": true},
+		})
+	})
+	h, err := c.FirstOnlineHost(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "h1", h.ID)
+}
+func TestAPIErrorSurfacesBodyNotToken(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "invalid name", http.StatusBadRequest)
+	})
+	_, err := c.CreateVM(t.Context(), client.CreateVMRequest{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid name")
+	assert.NotContains(t, err.Error(), "tok123", "token must never leak into errors")
+}
+// genTestKey returns a freshly generated ed25519 ssh.PublicKey.
+func genTestKey(t *testing.T) ssh.PublicKey {
+	t.Helper()
+	pub, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	sshPub, err := ssh.NewPublicKey(pub)
+	require.NoError(t, err)
+	return sshPub
+}
+func TestFetchSSHCA(t *testing.T) {
+	caPub := genTestKey(t)
+	caLine := string(ssh.MarshalAuthorizedKey(caPub))
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "GET", r.Method)
+		assert.Equal(t, "/api/v1/ssh-ca", r.URL.Path)
+		assert.Equal(t, "Bearer tok123", r.Header.Get("Authorization"))
+		json.NewEncoder(w).Encode(map[string]string{"ca": caLine})
+	})
+	got, err := c.FetchSSHCA(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, caPub.Marshal(), got.Marshal())
+}
+func TestFetchSSHCANotEnabled(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "Bearer tok123", r.Header.Get("Authorization"))
+		http.Error(w, "ssh jump gate not enabled", http.StatusNotFound)
+	})
+	_, err := c.FetchSSHCA(t.Context())
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "404", "raw status code must not be surfaced")
+	assert.NotContains(t, err.Error(), "tok123", "token must never leak into errors")
+	assert.Contains(t, err.Error(), "not enabled", "error should clearly explain the gate is off")
+}
+func TestMintUserCert(t *testing.T) {
+	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	_ = caPub
+	caSigner, err := ssh.NewSignerFromKey(caPriv)
+	require.NoError(t, err)
+	userPub := genTestKey(t)
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "POST", r.Method)
+		assert.Equal(t, "/api/v1/ssh-certs", r.URL.Path)
+		assert.Equal(t, "Bearer tok123", r.Header.Get("Authorization"))
+		var req map[string]any
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&req))
+		assert.Equal(t, string(ssh.MarshalAuthorizedKey(userPub)), req["public_key"].(string)+"\n")
+		cert := &ssh.Certificate{
+			Key:             userPub,
+			Serial:          1,
+			CertType:        ssh.UserCert,
+			KeyId:           "ubuntu",
+			ValidPrincipals: []string{"ubuntu"},
+			ValidAfter:      0,
+			ValidBefore:     ssh.CertTimeInfinity,
+		}
+		require.NoError(t, cert.SignCert(rand.Reader, caSigner))
+		json.NewEncoder(w).Encode(map[string]string{
+			"certificate": string(ssh.MarshalAuthorizedKey(cert)),
+		})
+	})
+	got, err := c.MintUserCert(t.Context(), userPub)
+	require.NoError(t, err)
+	require.NotNil(t, got)
+	assert.Equal(t, uint64(1), got.Serial)
+	assert.Equal(t, []string{"ubuntu"}, got.ValidPrincipals)
+	assert.Equal(t, userPub.Marshal(), got.Key.Marshal())
+}
+func TestMintUserCertErrorDoesNotLeakToken(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+	})
+	_, err := c.MintUserCert(t.Context(), genTestKey(t))
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "tok123", "token must never leak into errors")
+}
+func TestMintUserCertRejectsNonCertResponse(t *testing.T) {
+	notACert := genTestKey(t)
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(map[string]string{
+			"certificate": string(ssh.MarshalAuthorizedKey(notACert)),
+		})
+	})
+	_, err := c.MintUserCert(t.Context(), genTestKey(t))
+	require.Error(t, err)
+}

internal/mcpserver/config.go

@@ @@ -0,0 +1,74 @@ @@
+// Package mcpserver implements the eitri-mcp server: MCP tools that let a
+// model create, control (SSH exec/files), and destroy eitri VMs. It is an API
+// CLIENT of the control plane — it must not import internal/server, and the
+// admin token it holds must never appear in tool results or errors.
+package mcpserver
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+// Config is eitri-mcp's on-disk configuration.
+type Config struct {
+	ServerURL      string `json:"server_url"`       // eitri API base, e.g. http://127.0.0.1:8080
+	AdminTokenFile string `json:"admin_token_file"` // file holding the bearer token
+	Gate           string `json:"gate"`             // SSH-CA jump gate address "<gate-domain>:<port>"
+	VMUser         string `json:"vm_user"`          // guest user (default "ubuntu")
+	AdminToken string `json:"-"` // loaded from AdminTokenFile; never serialized
+}
+// LoadConfig reads and validates the config file and loads the admin token.
+func LoadConfig(path string) (*Config, error) {
+	path = expandTilde(path)
+	// Resolve to an absolute path for stable error messages regardless of the
+	// process's cwd — the MCP host launches this server with an unpredictable
+	// working directory.
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return nil, fmt.Errorf("resolve config path: %w", err)
+	}
+	path = abs
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read config: %w", err)
+	}
+	cfg := &Config{}
+	if err := json.Unmarshal(raw, cfg); err != nil {
+		return nil, fmt.Errorf("parse config %s: %w", path, err)
+	}
+	if cfg.VMUser == "" {
+		cfg.VMUser = "ubuntu"
+	}
+	if cfg.ServerURL == "" {
+		return nil, fmt.Errorf("config %s: server_url is required", path)
+	}
+	if cfg.AdminTokenFile == "" {
+		return nil, fmt.Errorf("config %s: admin_token_file is required", path)
+	}
+	tok, err := os.ReadFile(expandTilde(cfg.AdminTokenFile))
+	if err != nil {
+		return nil, fmt.Errorf("read admin token: %w", err)
+	}
+	cfg.AdminToken = strings.TrimSpace(string(tok))
+	if cfg.AdminToken == "" {
+		return nil, fmt.Errorf("admin token file %s is empty", cfg.AdminTokenFile)
+	}
+	return cfg, nil
+}
+// expandTilde expands a leading "~/" only. Bare "~" and "~user/x" forms pass
+// through unchanged; those then fail loudly at file open rather than being
+// silently mishandled here.
+func expandTilde(p string) string {
+	if strings.HasPrefix(p, "~/") {
+		if home, err := os.UserHomeDir(); err == nil {
+			return filepath.Join(home, p[2:])
+		}
+	}
+	return p
+}

internal/mcpserver/config_test.go

@@ @@ -0,0 +1,81 @@ @@
+package mcpserver
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+func TestLoadConfigDefaultsAndExpansion(t *testing.T) {
+	dir := t.TempDir()
+	tok := filepath.Join(dir, "token")
+	require.NoError(t, os.WriteFile(tok, []byte("sekret\n"), 0o600))
+	cfgPath := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{
+		"server_url": "http://127.0.0.1:9999",
+		"admin_token_file": "`+tok+`",
+		"gate": "gate.example.com:2222"
+	}`), 0o600))
+	cfg, err := LoadConfig(cfgPath)
+	require.NoError(t, err)
+	assert.Equal(t, "http://127.0.0.1:9999", cfg.ServerURL)
+	assert.Equal(t, "gate.example.com:2222", cfg.Gate)
+	assert.Equal(t, "ubuntu", cfg.VMUser)     // default
+	assert.Equal(t, "sekret", cfg.AdminToken) // trimmed, loaded from file
+}
+func TestLoadConfigExplicitEmptyVMUserGetsDefault(t *testing.T) {
+	dir := t.TempDir()
+	tok := filepath.Join(dir, "token")
+	require.NoError(t, os.WriteFile(tok, []byte("sekret\n"), 0o600))
+	cfgPath := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{
+		"server_url": "http://127.0.0.1:9999",
+		"admin_token_file": "`+tok+`",
+		"vm_user": ""
+	}`), 0o600))
+	cfg, err := LoadConfig(cfgPath)
+	require.NoError(t, err)
+	assert.Equal(t, "ubuntu", cfg.VMUser, `explicit "vm_user": "" must not erase the default`)
+}
+func TestLoadConfigMissingRequired(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{"server_url": ""}`), 0o600))
+	_, err := LoadConfig(cfgPath)
+	assert.ErrorContains(t, err, "server_url")
+}
+func TestLoadConfigMissingAdminTokenFile(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{"server_url": "http://127.0.0.1:9999"}`), 0o600))
+	_, err := LoadConfig(cfgPath)
+	assert.ErrorContains(t, err, "admin_token_file")
+}
+func TestLoadConfigEmptyAdminTokenFile(t *testing.T) {
+	dir := t.TempDir()
+	tok := filepath.Join(dir, "token")
+	require.NoError(t, os.WriteFile(tok, []byte("   \n"), 0o600))
+	cfgPath := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{
+		"server_url": "http://127.0.0.1:9999",
+		"admin_token_file": "`+tok+`"
+	}`), 0o600))
+	_, err := LoadConfig(cfgPath)
+	assert.ErrorContains(t, err, "empty")
+}
+func TestLoadConfigTildeExpansion(t *testing.T) {
+	home, err := os.UserHomeDir()
+	require.NoError(t, err)
+	assert.Equal(t, home+"/x", expandTilde("~/x"))
+	assert.Equal(t, "/abs/x", expandTilde("/abs/x"))
+}

internal/mcpserver/gateauth.go

@@ @@ -0,0 +1,152 @@ @@
+package mcpserver
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"fmt"
+	"sync"
+	"time"
+	"golang.org/x/crypto/ssh"
+)
+// CertAuthority is the subset of the eitri API client GateAuth needs: enough
+// to fetch the SSH CA's public key and mint short-lived user certificates.
+// It's declared here (rather than depending on the shared API client
+// directly) so tests can fake it in-memory without spinning up an httptest
+// server.
+type CertAuthority interface {
+	FetchSSHCA(ctx context.Context) (ssh.PublicKey, error)
+	MintUserCert(ctx context.Context, pub ssh.PublicKey) (*ssh.Certificate, error)
+}
+// GateAuth is a concurrency-safe credential cache for authenticating to the
+// eitri SSH-CA jump gate and the VMs behind it. It holds an ephemeral
+// (never-persisted) ed25519 keypair generated once at first use, mints a
+// short-lived user certificate for it on demand (refreshing shortly before
+// expiry), and verifies host certificates against the eitri CA.
+type GateAuth struct {
+	api CertAuthority
+	now func() time.Time
+	mu         sync.Mutex
+	ephemeral  ssh.Signer    // ephemeral SSH keypair; generated lazily, once
+	ca         ssh.PublicKey // eitri SSH CA; fetched lazily, once
+	cert       *ssh.Certificate
+	certSigner ssh.Signer // wraps cert + ephemeral; cached alongside cert
+}
+// NewGateAuth constructs a GateAuth backed by api. If now is nil, time.Now
+// is used. The ephemeral keypair and CA key are NOT fetched here; both are
+// established lazily on first use so construction cannot fail.
+func NewGateAuth(api CertAuthority, now func() time.Time) *GateAuth {
+	if now == nil {
+		now = time.Now
+	}
+	return &GateAuth{api: api, now: now}
+}
+// Signer returns an ssh.Signer backed by a cached, cert-signed identity,
+// minting (or re-minting, if the cached cert is missing or expires within a
+// minute) as needed.
+func (g *GateAuth) Signer(ctx context.Context) (ssh.Signer, error) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.ephemeral == nil {
+		signer, err := newEphemeralSigner()
+		if err != nil {
+			return nil, fmt.Errorf("generating ephemeral SSH key: %w", err)
+		}
+		g.ephemeral = signer
+	}
+	if g.needsMintLocked() {
+		// g.mu is deliberately held across this network call: it single-flights
+		// minting so concurrent Signer callers reuse one in-flight request
+		// rather than stampeding the CA with duplicate mints. Do not "fix" this
+		// into a per-call unlock — that reintroduces a thundering herd.
+		cert, err := g.api.MintUserCert(ctx, g.ephemeral.PublicKey())
+		if err != nil {
+			return nil, fmt.Errorf("minting user certificate: %w", err)
+		}
+		certSigner, err := ssh.NewCertSigner(cert, g.ephemeral)
+		if err != nil {
+			return nil, fmt.Errorf("wrapping minted certificate: %w", err)
+		}
+		g.cert = cert
+		g.certSigner = certSigner
+	}
+	return g.certSigner, nil
+}
+// needsMintLocked reports whether the cached cert is absent or expires
+// within a minute of now(). Callers must hold g.mu.
+func (g *GateAuth) needsMintLocked() bool {
+	if g.cert == nil {
+		return true
+	}
+	if g.cert.ValidBefore == ssh.CertTimeInfinity {
+		return false
+	}
+	return g.now().Add(time.Minute).Unix() >= int64(g.cert.ValidBefore)
+}
+// HostKeyCallback returns an ssh.HostKeyCallback that accepts only host
+// certificates signed by the eitri CA, lazily fetching the CA (once) on
+// first invocation.
+func (g *GateAuth) HostKeyCallback() ssh.HostKeyCallback {
+	checker := &ssh.CertChecker{
+		IsHostAuthority: func(auth ssh.PublicKey, address string) bool {
+			// ssh.HostKeyCallback has no ctx param, so caller cancellation
+			// cannot reach here; the fetch deadline is the API client's HTTP
+			// client timeout (30s), not the SSH handshake context.
+			ca, err := g.caKey(context.Background())
+			if err != nil {
+				return false
+			}
+			return caEquals(auth, ca)
+		},
+	}
+	return checker.CheckHostKey
+}
+// caKey returns the cached eitri CA public key, fetching it (once) if not
+// already cached.
+func (g *GateAuth) caKey(ctx context.Context) (ssh.PublicKey, error) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.ca != nil {
+		return g.ca, nil
+	}
+	// g.mu is deliberately held across this network call: single-flight fetch
+	// so concurrent callbacks share one FetchSSHCA rather than stampeding.
+	ca, err := g.api.FetchSSHCA(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("fetching SSH CA: %w", err)
+	}
+	g.ca = ca
+	return g.ca, nil
+}
+// caEquals reports whether two SSH public keys are the same key, by
+// comparing their wire encodings.
+func caEquals(a, b ssh.PublicKey) bool {
+	if a == nil || b == nil {
+		return false
+	}
+	return bytes.Equal(a.Marshal(), b.Marshal())
+}
+// newEphemeralSigner generates a fresh, never-persisted ed25519 SSH signer.
+func newEphemeralSigner() (ssh.Signer, error) {
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	return ssh.NewSignerFromSigner(priv)
+}

internal/mcpserver/gateauth_test.go

@@ @@ -0,0 +1,252 @@ @@
+package mcpserver
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"net"
+	"sync"
+	"testing"
+	"time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+// fakeCertAuthority is an in-memory CertAuthority backed by a real ed25519
+// CA signer, so tests exercise real cert signing/verification without an
+// httptest server.
+type fakeCertAuthority struct {
+	caSigner ssh.Signer
+	mu              sync.Mutex
+	fetchCACalls    int
+	mintCertCalls   int
+	nextValidBefore uint64 // configurable expiry for the next minted cert
+	fetchErr        error  // if set, FetchSSHCA returns it
+	mintErr         error  // if set, MintUserCert returns it
+}
+func newFakeCertAuthority(t *testing.T) *fakeCertAuthority {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	signer, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	return &fakeCertAuthority{caSigner: signer, nextValidBefore: ssh.CertTimeInfinity}
+}
+func (f *fakeCertAuthority) FetchSSHCA(ctx context.Context) (ssh.PublicKey, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.fetchCACalls++
+	if f.fetchErr != nil {
+		return nil, f.fetchErr
+	}
+	return f.caSigner.PublicKey(), nil
+}
+func (f *fakeCertAuthority) MintUserCert(ctx context.Context, pub ssh.PublicKey) (*ssh.Certificate, error) {
+	f.mu.Lock()
+	validBefore := f.nextValidBefore
+	f.mintCertCalls++
+	mintErr := f.mintErr
+	f.mu.Unlock()
+	if mintErr != nil {
+		return nil, mintErr
+	}
+	cert := &ssh.Certificate{
+		Key:             pub,
+		CertType:        ssh.UserCert,
+		ValidPrincipals: []string{"ubuntu"},
+		ValidAfter:      0,
+		ValidBefore:     validBefore,
+	}
+	if err := cert.SignCert(rand.Reader, f.caSigner); err != nil {
+		return nil, err
+	}
+	return cert, nil
+}
+func (f *fakeCertAuthority) setNextValidBefore(v uint64) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.nextValidBefore = v
+}
+func (f *fakeCertAuthority) setFetchErr(err error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.fetchErr = err
+}
+func (f *fakeCertAuthority) setMintErr(err error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.mintErr = err
+}
+func (f *fakeCertAuthority) counts() (fetchCA, mintCert int) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.fetchCACalls, f.mintCertCalls
+}
+// hostCert builds and signs a host certificate for a fresh ephemeral host
+// key, using ca as the signing authority.
+func hostCert(t *testing.T, ca ssh.Signer) *ssh.Certificate {
+	t.Helper()
+	pub, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	sshPub, err := ssh.NewPublicKey(pub)
+	require.NoError(t, err)
+	cert := &ssh.Certificate{
+		Key:             sshPub,
+		CertType:        ssh.HostCert,
+		ValidPrincipals: []string{"vm-name"},
+		ValidBefore:     ssh.CertTimeInfinity,
+	}
+	require.NoError(t, cert.SignCert(rand.Reader, ca))
+	return cert
+}
+func TestGateAuthSignerMintsOnceAndReuses(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	fake.setNextValidBefore(ssh.CertTimeInfinity)
+	ga := NewGateAuth(fake, nil)
+	s1, err := ga.Signer(t.Context())
+	require.NoError(t, err)
+	s2, err := ga.Signer(t.Context())
+	require.NoError(t, err)
+	_, mintCalls := fake.counts()
+	assert.Equal(t, 1, mintCalls, "expected exactly one mint across two Signer calls")
+	assert.Same(t, s1, s2, "expected the same cached signer to be returned")
+	assert.Regexp(t, `-cert-v01@openssh\.com$`, s1.PublicKey().Type())
+}
+func TestGateAuthSignerRefreshesNearExpiry(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	current := time.Unix(1_700_000_000, 0)
+	clock := func() time.Time { return current }
+	ga := NewGateAuth(fake, clock)
+	// First cert expires in 30s from "now" — within the 1-minute refresh
+	// window on the very next call.
+	fake.setNextValidBefore(uint64(current.Add(30 * time.Second).Unix()))
+	_, err := ga.Signer(t.Context())
+	require.NoError(t, err)
+	_, mintCalls := fake.counts()
+	require.Equal(t, 1, mintCalls)
+	// Second call, same "now": remaining validity (30s) < 1 minute, so this
+	// must re-mint.
+	fake.setNextValidBefore(uint64(current.Add(2 * time.Hour).Unix()))
+	_, err = ga.Signer(t.Context())
+	require.NoError(t, err)
+	_, mintCalls = fake.counts()
+	assert.Equal(t, 2, mintCalls, "expected re-mint when cached cert expires within a minute")
+	// Third call, same "now": remaining validity is now 2h, well beyond a
+	// minute, so this must NOT re-mint.
+	_, err = ga.Signer(t.Context())
+	require.NoError(t, err)
+	_, mintCalls = fake.counts()
+	assert.Equal(t, 2, mintCalls, "expected no re-mint when cached cert has >1min remaining")
+}
+func TestGateAuthHostKeyCallbackAcceptsCASignedHostCert(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	ga := NewGateAuth(fake, nil)
+	cert := hostCert(t, fake.caSigner)
+	err := ga.HostKeyCallback()("vm-name:22", &net.TCPAddr{}, cert)
+	assert.NoError(t, err)
+}
+func TestGateAuthHostKeyCallbackRejectsForeignCAHostCert(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	ga := NewGateAuth(fake, nil)
+	_, foreignPriv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	foreignCA, err := ssh.NewSignerFromSigner(foreignPriv)
+	require.NoError(t, err)
+	cert := hostCert(t, foreignCA)
+	err = ga.HostKeyCallback()("vm-name:22", &net.TCPAddr{}, cert)
+	assert.Error(t, err)
+}
+func TestGateAuthHostKeyCallbackRejectsBareHostKey(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	ga := NewGateAuth(fake, nil)
+	pub, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	sshPub, err := ssh.NewPublicKey(pub)
+	require.NoError(t, err)
+	err = ga.HostKeyCallback()("vm-name:22", &net.TCPAddr{}, sshPub)
+	assert.Error(t, err)
+}
+func TestGateAuthFetchesCAOnlyOnce(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	fake.setNextValidBefore(ssh.CertTimeInfinity)
+	ga := NewGateAuth(fake, nil)
+	cb := ga.HostKeyCallback()
+	cert := hostCert(t, fake.caSigner)
+	require.NoError(t, cb("vm-name:22", &net.TCPAddr{}, cert))
+	require.NoError(t, cb("vm-name:22", &net.TCPAddr{}, cert))
+	_, err := ga.Signer(t.Context())
+	require.NoError(t, err)
+	_, err = ga.Signer(t.Context())
+	require.NoError(t, err)
+	fetchCA, _ := fake.counts()
+	assert.Equal(t, 1, fetchCA, "expected the CA to be fetched exactly once")
+}
+func TestGateAuthHostKeyCallbackRejectsWhenCAFetchFails(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	fake.setFetchErr(errors.New("ssh-ca gate is not enabled"))
+	ga := NewGateAuth(fake, nil)
+	// A perfectly valid, CA-signed host cert must STILL be rejected when we
+	// cannot fetch the CA to verify against it — failing closed, never open.
+	cert := hostCert(t, fake.caSigner)
+	err := ga.HostKeyCallback()("vm-name:22", &net.TCPAddr{}, cert)
+	assert.Error(t, err, "host must be rejected when the CA cannot be fetched")
+}
+func TestGateAuthSignerMintErrorDoesNotPoisonCache(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	fake.setNextValidBefore(ssh.CertTimeInfinity)
+	fake.setMintErr(errors.New("mint boom"))
+	ga := NewGateAuth(fake, nil)
+	// First call: mint fails, error is surfaced, nothing is cached.
+	_, err := ga.Signer(t.Context())
+	require.Error(t, err)
+	// Recovery: with minting working again, a subsequent call must mint fresh
+	// and succeed — proving the failed attempt did not poison the cache with a
+	// broken cert/signer.
+	fake.setMintErr(nil)
+	s, err := ga.Signer(t.Context())
+	require.NoError(t, err)
+	require.NotNil(t, s)
+	assert.Regexp(t, `-cert-v01@openssh\.com$`, s.PublicKey().Type())
+	_, mintCalls := fake.counts()
+	assert.Equal(t, 2, mintCalls, "expected the failed mint to retry, not serve a poisoned cache")
+}

internal/mcpserver/sshrun.go

@@ @@ -0,0 +1,250 @@ @@
+package mcpserver
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net"
+	"os"
+	"path"
+	"time"
+	"github.com/pkg/sftp"
+	"golang.org/x/crypto/ssh"
+)
+// outputCap bounds captured exec/file bytes returned to the model.
+const outputCap = 1 << 20 // 1 MiB
+// GateCredentials provides the cert-backed client signer and the CA host-key
+// verifier the Runner authenticates with. *GateAuth satisfies it.
+type GateCredentials interface {
+	Signer(ctx context.Context) (ssh.Signer, error)
+	HostKeyCallback() ssh.HostKeyCallback
+}
+// RunnerConfig configures SSH access to VMs through the eitri SSH-CA jump gate.
+type RunnerConfig struct {
+	Gate   string          // gate SSH address "<gate-domain>:<port>" (also the host-cert principal host)
+	Auth   GateCredentials // minted user-cert signer + CA host verifier
+	VMUser string          // guest login user, e.g. "ubuntu" (matches the cert principal)
+}
+// ExecResult is a completed remote command.
+type ExecResult struct {
+	Stdout    string
+	Stderr    string
+	ExitCode  int
+	Truncated bool
+}
+// Runner executes commands and transfers files on VMs over SSH, reaching each
+// VM by NAME through eitri's SSH-CA jump gate. There is no TOFU/known_hosts:
+// both hops are verified against the eitri CA — the gate presents a CA-signed
+// host cert for its own domain, the VM a CA-signed host cert for its name — and
+// the client authenticates with a short-lived CA-signed user cert.
+type Runner struct {
+	cfg RunnerConfig
+}
+func NewRunner(cfg RunnerConfig) *Runner { return &Runner{cfg: cfg} }
+// Exec runs cmd on the VM named vmName (reached through the gate). A non-zero
+// remote exit is NOT an error — it's in ExitCode.
+func (r *Runner) Exec(ctx context.Context, vmName, cmd string, timeout time.Duration) (ExecResult, error) {
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	client, err := r.dial(ctx, vmName)
+	if err != nil {
+		return ExecResult{}, err
+	}
+	defer client.Close()
+	sess, err := client.NewSession()
+	if err != nil {
+		return ExecResult{}, fmt.Errorf("ssh session: %w", err)
+	}
+	defer sess.Close()
+	var stdout, stderr cappedBuf
+	sess.Stdout, sess.Stderr = &stdout, &stderr
+	done := make(chan error, 1)
+	go func() { done <- sess.Run(cmd) }()
+	select {
+	case <-ctx.Done():
+		_ = sess.Close()
+		return ExecResult{}, fmt.Errorf("exec timed out after %s", timeout)
+	case err = <-done:
+	}
+	res := ExecResult{Stdout: stdout.String(), Stderr: stderr.String(), Truncated: stdout.truncated || stderr.truncated}
+	var exitErr *ssh.ExitError
+	if errors.As(err, &exitErr) {
+		res.ExitCode = exitErr.ExitStatus()
+		return res, nil
+	}
+	if err != nil {
+		return res, fmt.Errorf("exec: %w", err)
+	}
+	return res, nil
+}
+// dial reaches the VM named vmName through the eitri SSH-CA gate: a client
+// handshake with the gate (CA-verified host cert, CA-signed user cert), a
+// direct-tcpip tunnel to <vmName>:22 (the only port the gate permits), then a
+// second handshake directly with the VM's sshd over that tunnel. Error messages
+// distinguish gate-unreachable/gate-handshake from VM-unreachable/VM-handshake.
+// The caller must Close the returned *ssh.Client.
+func (r *Runner) dial(ctx context.Context, vmName string) (*ssh.Client, error) {
+	signer, err := r.cfg.Auth.Signer(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("minting gate credentials: %w", err)
+	}
+	hostCB := r.cfg.Auth.HostKeyCallback()
+	// Both hops share the same client config: the same CA-signed user cert
+	// authenticates to the gate and to the VM, and the same callback verifies
+	// both host certs against the eitri CA. The gate ignores the outer username,
+	// so using the VM login user throughout is harmless.
+	clientConf := &ssh.ClientConfig{
+		User:            r.cfg.VMUser,
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
+		HostKeyCallback: hostCB,
+		Timeout:         15 * time.Second,
+	}
+	// Gate hop. Dial the gate verbatim and verify its host cert under the SAME
+	// address: the operator sets Gate to "<gate-domain>:<port>", and the gate's
+	// host cert principal is that domain, so ssh.CertChecker (in hostCB) matches.
+	dialer := net.Dialer{Timeout: 15 * time.Second}
+	conn, err := dialer.DialContext(ctx, "tcp", r.cfg.Gate)
+	if err != nil {
+		return nil, fmt.Errorf("gate %s unreachable: %w", r.cfg.Gate, err)
+	}
+	gnc, gchans, greqs, err := ssh.NewClientConn(conn, r.cfg.Gate, clientConf)
+	if err != nil {
+		_ = conn.Close()
+		return nil, fmt.Errorf("gate %s ssh handshake: %w", r.cfg.Gate, err)
+	}
+	gateClient := ssh.NewClient(gnc, gchans, greqs)
+	// VM hop. Open the direct-tcpip tunnel to <vmName>:22 through the gate. A
+	// connection failure here is expected during the vm_create pre-sshd boot
+	// window (the guest hasn't started sshd yet), and the caller retries.
+	vmAddr := vmName + ":22"
+	vmConn, err := gateClient.DialContext(ctx, "tcp", vmAddr)
+	if err != nil {
+		gateClient.Close()
+		return nil, fmt.Errorf("vm %s unreachable through the gate: %w", vmName, err)
+	}
+	// Verify the VM's host cert under <vmName>:22: its host-cert principal is the
+	// VM name, so ssh.CertChecker matches on the host portion of this address.
+	nc, chans, reqs, err := ssh.NewClientConn(vmConn, vmAddr, clientConf)
+	if err != nil {
+		gateClient.Close()
+		return nil, fmt.Errorf("vm %s ssh handshake: %w", vmName, err)
+	}
+	client := ssh.NewClient(nc, chans, reqs)
+	// Tie the gate client's lifetime to the VM client's: when the VM client
+	// closes (or the VM drops), tear down the tunnel and the gate connection.
+	go func() { _ = client.Wait(); gateClient.Close() }()
+	return client, nil
+}
+// cappedBuf captures at most outputCap bytes and records truncation.
+type cappedBuf struct {
+	buf       bytes.Buffer
+	truncated bool
+}
+func (b *cappedBuf) Write(p []byte) (int, error) {
+	room := outputCap - b.buf.Len()
+	if room <= 0 {
+		b.truncated = true
+		return len(p), nil
+	}
+	if len(p) > room {
+		b.buf.Write(p[:room])
+		b.truncated = true
+		return len(p), nil
+	}
+	return b.buf.Write(p)
+}
+func (b *cappedBuf) String() string { return b.buf.String() }
+// WriteFile writes data to remotePath on the VM named vmName over SFTP. Missing
+// parent dirs are created at the server default mode; the file itself is set to
+// mode. The chmod is applied to the freshly-created file BEFORE any bytes are
+// written, so a restrictive mode (e.g. 0600) is never briefly world-readable on
+// the guest during the write (pkg/sftp's OpenFile takes no mode argument).
+func (r *Runner) WriteFile(ctx context.Context, vmName, remotePath string, data []byte, mode fs.FileMode) error {
+	client, sf, err := r.sftp(ctx, vmName)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+	defer sf.Close()
+	if dir := path.Dir(remotePath); dir != "." && dir != "/" {
+		if err := sf.MkdirAll(dir); err != nil {
+			return fmt.Errorf("mkdir %s: %w", dir, err)
+		}
+	}
+	f, err := sf.OpenFile(remotePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC)
+	if err != nil {
+		return fmt.Errorf("create %s: %w", remotePath, err)
+	}
+	if err := f.Chmod(mode); err != nil {
+		f.Close()
+		return fmt.Errorf("chmod %s: %w", remotePath, err)
+	}
+	if _, err := f.Write(data); err != nil {
+		f.Close()
+		return fmt.Errorf("write %s: %w", remotePath, err)
+	}
+	return f.Close()
+}
+// ReadFile reads at most outputCap bytes from remotePath on the VM named
+// vmName; truncated reports whether the file was larger.
+func (r *Runner) ReadFile(ctx context.Context, vmName, remotePath string) (data []byte, truncated bool, err error) {
+	client, sf, err := r.sftp(ctx, vmName)
+	if err != nil {
+		return nil, false, err
+	}
+	defer client.Close()
+	defer sf.Close()
+	f, err := sf.Open(remotePath)
+	if err != nil {
+		return nil, false, fmt.Errorf("open %s: %w", remotePath, err)
+	}
+	defer f.Close()
+	buf := make([]byte, outputCap+1)
+	n, rerr := io.ReadFull(f, buf)
+	if rerr != nil && rerr != io.ErrUnexpectedEOF && rerr != io.EOF {
+		return nil, false, fmt.Errorf("read %s: %w", remotePath, rerr)
+	}
+	if n > outputCap {
+		return buf[:outputCap], true, nil
+	}
+	return buf[:n], false, nil
+}
+// sftp dials the VM named vmName through the gate and wraps the connection in
+// an sftp.Client. The caller must Close both the returned *ssh.Client and
+// *sftp.Client.
+func (r *Runner) sftp(ctx context.Context, vmName string) (*ssh.Client, *sftp.Client, error) {
+	client, err := r.dial(ctx, vmName)
+	if err != nil {
+		return nil, nil, err
+	}
+	sf, err := sftp.NewClient(client)
+	if err != nil {
+		client.Close()
+		return nil, nil, fmt.Errorf("sftp: %w", err)
+	}
+	return client, sf, nil
+}

internal/mcpserver/sshrun_test.go

@@ @@ -0,0 +1,271 @@ @@
+package mcpserver
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"io"
+	"net"
+	"testing"
+	"time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+// ── test SSH-CA scaffolding ──────────────────────────────────────────────────
+// newSigner returns a fresh ed25519 ssh.Signer.
+func newSigner(t *testing.T) ssh.Signer {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	s, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	return s
+}
+// hostCertSigner builds a host-cert-backed signer for principal, signed by ca.
+// A server AddHostKey'd with it presents that host cert during the handshake.
+func hostCertSigner(t *testing.T, ca ssh.Signer, principal string) ssh.Signer {
+	t.Helper()
+	hostKey := newSigner(t)
+	cert := &ssh.Certificate{
+		Key:             hostKey.PublicKey(),
+		CertType:        ssh.HostCert,
+		ValidPrincipals: []string{principal},
+		ValidBefore:     ssh.CertTimeInfinity,
+	}
+	require.NoError(t, cert.SignCert(rand.Reader, ca))
+	cs, err := ssh.NewCertSigner(cert, hostKey)
+	require.NoError(t, err)
+	return cs
+}
+// caUserAuth accepts a client only if it presents a user cert signed by ca —
+// mirroring the gate/VM sshd's TrustedUserCAKeys policy.
+func caUserAuth(ca ssh.PublicKey) func(ssh.ConnMetadata, ssh.PublicKey) (*ssh.Permissions, error) {
+	checker := &ssh.CertChecker{
+		IsUserAuthority: func(auth ssh.PublicKey) bool { return caEquals(auth, ca) },
+	}
+	return func(_ ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+		cert, ok := key.(*ssh.Certificate)
+		if !ok {
+			return nil, errors.New("only certificate authentication is accepted")
+		}
+		if cert.CertType != ssh.UserCert {
+			return nil, errors.New("not a user certificate")
+		}
+		if !checker.IsUserAuthority(cert.SignatureKey) {
+			return nil, errors.New("certificate not signed by the test CA")
+		}
+		if len(cert.ValidPrincipals) == 0 {
+			return nil, errors.New("certificate has no principals")
+		}
+		// Feed CheckCert one of the cert's own principals so only CA-signature +
+		// validity gate authentication, not the arbitrary outer username.
+		if err := checker.CheckCert(cert.ValidPrincipals[0], cert); err != nil {
+			return nil, err
+		}
+		return &ssh.Permissions{}, nil
+	}
+}
+// startBackingVM runs a minimal VM sshd on a random loopback port: it presents
+// hostSigner's host cert, accepts CA-signed user certs, and answers a single
+// "exec" request with out + code. Returns its listen address.
+func startBackingVM(t *testing.T, hostSigner ssh.Signer, userCA ssh.PublicKey, out string, code int) string {
+	t.Helper()
+	conf := &ssh.ServerConfig{PublicKeyCallback: caUserAuth(userCA)}
+	conf.AddHostKey(hostSigner)
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { ln.Close() })
+	go func() {
+		for {
+			nc, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go serveBackingVM(nc, conf, out, code)
+		}
+	}()
+	return ln.Addr().String()
+}
+func serveBackingVM(nc net.Conn, conf *ssh.ServerConfig, out string, code int) {
+	sc, chans, reqs, err := ssh.NewServerConn(nc, conf)
+	if err != nil {
+		nc.Close()
+		return
+	}
+	defer sc.Close()
+	go ssh.DiscardRequests(reqs)
+	for newCh := range chans {
+		if newCh.ChannelType() != "session" {
+			newCh.Reject(ssh.UnknownChannelType, "only session")
+			continue
+		}
+		ch, chReqs, err := newCh.Accept()
+		if err != nil {
+			continue
+		}
+		go handleExecSession(ch, chReqs, out, code)
+	}
+}
+func handleExecSession(ch ssh.Channel, reqs <-chan *ssh.Request, out string, code int) {
+	defer ch.Close()
+	for req := range reqs {
+		if req.Type == "exec" {
+			req.Reply(true, nil)
+			io.WriteString(ch, out)
+			ch.SendRequest("exit-status", false, ssh.Marshal(struct{ Status uint32 }{uint32(code)}))
+			return
+		}
+		if req.WantReply {
+			req.Reply(false, nil)
+		}
+	}
+}
+// startGate runs a minimal SSH-CA gate on a random loopback port: it presents
+// hostSigner's host cert, accepts CA-signed user certs, and on a direct-tcpip
+// channel (the only kind it honors) dials vmAddr and pumps bytes both ways —
+// mirroring sshgate.handleDirectTCPIP. Returns its listen address.
+func startGate(t *testing.T, hostSigner ssh.Signer, userCA ssh.PublicKey, vmAddr string) string {
+	t.Helper()
+	conf := &ssh.ServerConfig{PublicKeyCallback: caUserAuth(userCA)}
+	conf.AddHostKey(hostSigner)
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { ln.Close() })
+	go func() {
+		for {
+			nc, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go serveGate(nc, conf, vmAddr)
+		}
+	}()
+	return ln.Addr().String()
+}
+func serveGate(nc net.Conn, conf *ssh.ServerConfig, vmAddr string) {
+	sc, chans, reqs, err := ssh.NewServerConn(nc, conf)
+	if err != nil {
+		nc.Close()
+		return
+	}
+	defer sc.Close()
+	go ssh.DiscardRequests(reqs)
+	for newCh := range chans {
+		if newCh.ChannelType() != "direct-tcpip" {
+			newCh.Reject(ssh.UnknownChannelType, "only direct-tcpip is permitted")
+			continue
+		}
+		go gatePipe(newCh, vmAddr)
+	}
+}
+func gatePipe(newCh ssh.NewChannel, vmAddr string) {
+	var p struct {
+		HostToConnect  string
+		PortToConnect  uint32
+		OriginatorIP   string
+		OriginatorPort uint32
+	}
+	if err := ssh.Unmarshal(newCh.ExtraData(), &p); err != nil {
+		newCh.Reject(ssh.ConnectionFailed, "malformed direct-tcpip request")
+		return
+	}
+	if p.PortToConnect != 22 {
+		newCh.Reject(ssh.Prohibited, "only port 22 is permitted")
+		return
+	}
+	target, err := net.Dial("tcp", vmAddr)
+	if err != nil {
+		newCh.Reject(ssh.ConnectionFailed, err.Error())
+		return
+	}
+	ch, chReqs, err := newCh.Accept()
+	if err != nil {
+		target.Close()
+		return
+	}
+	go ssh.DiscardRequests(chReqs)
+	go func() { io.Copy(ch, target); ch.Close() }()
+	go func() { io.Copy(target, ch); target.Close() }()
+}
+// fakeGateCreds is a minimal GateCredentials with a caller-chosen client signer
+// and host verifier, for exercising client-auth rejection paths.
+type fakeGateCreds struct {
+	signer ssh.Signer
+	hostCB ssh.HostKeyCallback
+}
+func (f fakeGateCreds) Signer(context.Context) (ssh.Signer, error) { return f.signer, nil }
+func (f fakeGateCreds) HostKeyCallback() ssh.HostKeyCallback       { return f.hostCB }
+// ── tests ────────────────────────────────────────────────────────────────────
+func TestExecThroughGate(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	ga := NewGateAuth(fake, nil)
+	ca := fake.caSigner
+	vmAddr := startBackingVM(t, hostCertSigner(t, ca, "testvm"), ca.PublicKey(), "hi\n", 0)
+	// Gate host cert principal "127.0.0.1" so the runner, dialing 127.0.0.1:<port>,
+	// verifies it under that host.
+	gateAddr := startGate(t, hostCertSigner(t, ca, "127.0.0.1"), ca.PublicKey(), vmAddr)
+	r := NewRunner(RunnerConfig{Gate: gateAddr, Auth: ga, VMUser: "ubuntu"})
+	res, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)
+	require.NoError(t, err)
+	assert.Equal(t, "hi\n", res.Stdout)
+	assert.Equal(t, 0, res.ExitCode)
+}
+func TestExecVMForeignCAHostCertRejected(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	ga := NewGateAuth(fake, nil)
+	ca := fake.caSigner
+	// The VM presents a host cert signed by a DIFFERENT CA. Its user-auth policy
+	// still trusts the real CA, so the gate hop and client auth both succeed and
+	// this isolates the VM host-cert rejection.
+	foreignCA := newSigner(t)
+	vmAddr := startBackingVM(t, hostCertSigner(t, foreignCA, "testvm"), ca.PublicKey(), "hi\n", 0)
+	gateAddr := startGate(t, hostCertSigner(t, ca, "127.0.0.1"), ca.PublicKey(), vmAddr)
+	r := NewRunner(RunnerConfig{Gate: gateAddr, Auth: ga, VMUser: "ubuntu"})
+	_, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "vm testvm ssh handshake", "expected the VM hop to reject the foreign-CA host cert")
+}
+func TestExecGateRejectsNonCAUserKey(t *testing.T) {
+	fake := newFakeCertAuthority(t)
+	ga := NewGateAuth(fake, nil)
+	ca := fake.caSigner
+	vmAddr := startBackingVM(t, hostCertSigner(t, ca, "testvm"), ca.PublicKey(), "hi\n", 0)
+	gateAddr := startGate(t, hostCertSigner(t, ca, "127.0.0.1"), ca.PublicKey(), vmAddr)
+	// A plain (non-cert) client key: the gate only accepts CA-signed user certs,
+	// so its handshake must fail auth. Host verification still uses the real CA,
+	// isolating the client-auth rejection at the gate hop.
+	creds := fakeGateCreds{signer: newSigner(t), hostCB: ga.HostKeyCallback()}
+	r := NewRunner(RunnerConfig{Gate: gateAddr, Auth: creds, VMUser: "ubuntu"})
+	_, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "gate "+gateAddr+" ssh handshake", "expected the gate hop to reject the non-CA user key")
+}

internal/mcpserver/tools.go

@@ @@ -0,0 +1,433 @@ @@
+package mcpserver
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"time"
+	"github.com/a73x/eitri/internal/random"
+	"github.com/a73x/eitri/internal/server/api/client"
+)
+// api and runner are the two seams Tools composes; API and Runner satisfy
+// them, fakes replace them in tests.
+type api interface {
+	ListVMs(ctx context.Context) ([]client.VM, error)
+	CreateVM(ctx context.Context, req client.CreateVMRequest) (client.CreateVMResponse, error)
+	DeleteVM(ctx context.Context, id string) error
+	FirstOnlineHost(ctx context.Context) (client.Host, error)
+}
+type runner interface {
+	Exec(ctx context.Context, vmName, cmd string, timeout time.Duration) (ExecResult, error)
+	WriteFile(ctx context.Context, vmName, path string, data []byte, mode fs.FileMode) error
+	ReadFile(ctx context.Context, vmName, path string) ([]byte, bool, error)
+}
+// API is the shared eitri API client plus the one piece of MCP placement
+// policy the raw client doesn't carry: FirstOnlineHost.
+type API struct {
+	*client.Client
+}
+// FirstOnlineHost returns the first online host — the default placement
+// target when the caller doesn't name one. Ordering is server-defined;
+// callers must not assume stability across calls.
+func (a API) FirstOnlineHost(ctx context.Context) (client.Host, error) {
+	hosts, err := a.ListHosts(ctx)
+	if err != nil {
+		return client.Host{}, err
+	}
+	for _, h := range hosts {
+		if h.Online {
+			return h, nil
+		}
+	}
+	return client.Host{}, errors.New("no online hosts")
+}
+// The real client and runner must satisfy the seams unchanged, and the shared
+// API client must keep satisfying the gate's cert-authority seam.
+var (
+	_ api           = API{}
+	_ runner        = (*Runner)(nil)
+	_ CertAuthority = (*client.Client)(nil)
+)
+// Tools implements the seven eitri-mcp tools over the API and SSH seams.
+type Tools struct {
+	API    api
+	Runner runner
+	Gate   string // gate address, for the ssh command hint only
+	VMUser string
+	PollEvery   time.Duration // create-wait poll interval (default 2s)
+	WaitTimeout time.Duration // create-wait ceiling (default 10m)
+}
+func (t *Tools) pollEvery() time.Duration {
+	if t.PollEvery > 0 {
+		return t.PollEvery
+	}
+	return 2 * time.Second
+}
+func (t *Tools) waitTimeout() time.Duration {
+	if t.WaitTimeout > 0 {
+		return t.WaitTimeout
+	}
+	return 10 * time.Minute
+}
+// ── vm_create ────────────────────────────────────────────────────────────────
+type VMCreateIn struct {
+	Name      string `json:"name,omitempty" jsonschema:"VM name (RFC-1123 label); default claude-<hex>"`
+	Host      string `json:"host,omitempty" jsonschema:"host name to place on; default first online host"`
+	VCPUs     int64  `json:"vcpus,omitempty" jsonschema:"default 2"`
+	MemMB     int64  `json:"mem_mb,omitempty" jsonschema:"default 2048"`
+	DiskGB    int64  `json:"disk_gb,omitempty" jsonschema:"default 20"`
+	CloudInit string `json:"cloud_init,omitempty" jsonschema:"optional user cloud-init"`
+	Wait      *bool  `json:"wait,omitempty" jsonschema:"wait for ready+cloud-init (default true)"`
+}
+type VMCreateOut struct {
+	ID         string `json:"id"`
+	Name       string `json:"name"`
+	IP         string `json:"ip,omitempty"`
+	SSHCommand string `json:"ssh_command,omitempty"`
+}
+func (t *Tools) VMCreate(ctx context.Context, in VMCreateIn) (VMCreateOut, error) {
+	req := client.CreateVMRequest{
+		Name:       in.Name,
+		CloudInit:  in.CloudInit,
+		VCPUs:      in.VCPUs,
+		MemMB:      in.MemMB,
+		DiskGB:     in.DiskGB,
+		Persistent: true, // spec: long-lived VMs are first-class; no reaper
+	}
+	if req.Name == "" {
+		req.Name = "claude-" + random.Hex(3)
+	}
+	if req.VCPUs == 0 {
+		req.VCPUs = 2
+	}
+	if req.MemMB == 0 {
+		req.MemMB = 2048
+	}
+	if req.DiskGB == 0 {
+		req.DiskGB = 20
+	}
+	if in.Host != "" {
+		vm, err := t.resolveHost(ctx, in.Host)
+		if err != nil {
+			return VMCreateOut{}, err
+		}
+		req.HostID = vm
+	} else {
+		h, err := t.API.FirstOnlineHost(ctx)
+		if err != nil {
+			return VMCreateOut{}, err
+		}
+		req.HostID = h.ID
+	}
+	created, err := t.API.CreateVM(ctx, req)
+	if err != nil {
+		return VMCreateOut{}, fmt.Errorf("create vm: %w", err)
+	}
+	out := VMCreateOut{ID: created.ID, Name: created.Name}
+	if in.Wait != nil && !*in.Wait {
+		return out, nil
+	}
+	// One shared deadline bounds the whole wait (ready + cloud-init) by
+	// WaitTimeout, rather than letting each phase burn a full budget.
+	deadline := time.Now().Add(t.waitTimeout())
+	ip, err := t.waitReady(ctx, created.ID, created.Name, deadline)
+	if err != nil {
+		// Spec: report state, never auto-destroy — the VM may just be slow.
+		return out, err
+	}
+	out.IP = ip
+	out.SSHCommand = t.sshCommand(created.Name)
+	// "ready" means cloud-hypervisor is up and the IP is ALLOCATED — NOT that the
+	// guest has booted Linux, brought up its NIC, and started sshd. The first SSH
+	// dials can therefore hit "no route to host"/"connection refused" while the
+	// guest is still in firmware/early boot. So retry the cloud-init wait,
+	// tolerating connection-level failures, until the shared deadline. The loop is
+	// purely for the pre-sshd window: once SSH connects, "cloud-init status --wait"
+	// itself blocks until cloud-init finishes, settling packages/runcmd.
+	//
+	// Any Exec error is treated as "guest not SSH-reachable yet" — within
+	// vm_create the only expected transient is the guest booting, and a persistent
+	// non-connection error still terminates cleanly at the deadline with lastErr in
+	// the message. We deliberately do NOT classify error strings.
+	//
+	// Error messages name the VM id AND name so the model can still find and
+	// destroy the degraded VM even if the MCP wrapper drops the structured
+	// result when err != nil.
+	var lastErr error
+	for {
+		// Host identity is now verified against the eitri CA (the VM presents a
+		// CA-signed host cert for its name), so there is no per-IP known_hosts pin
+		// to evict between retries — the guest regenerating its host key during
+		// cloud-init is transparent as long as the new key is a CA-signed cert.
+		// Give the command the time left in the shared budget (floored so a
+		// nearly-exhausted budget still gets a real chance).
+		remaining := time.Until(deadline)
+		if remaining < 30*time.Second {
+			remaining = 30 * time.Second
+		}
+		res, execErr := t.Runner.Exec(ctx, created.Name, "cloud-init status --wait", remaining)
+		if execErr == nil {
+			if res.ExitCode != 0 {
+				return out, fmt.Errorf("vm %s (%s) ready at %s but cloud-init exited %d: %s", created.ID, created.Name, ip, res.ExitCode, res.Stderr)
+			}
+			return out, nil
+		}
+		lastErr = execErr
+		// Stop once we are past the deadline, or the next sleep would carry us
+		// past it — no point sleeping only to give up.
+		if !time.Now().Add(t.pollEvery()).Before(deadline) {
+			return out, fmt.Errorf("vm %s (%s) ready at %s but never became SSH-reachable within %s: %w", created.ID, created.Name, ip, t.waitTimeout(), lastErr)
+		}
+		select {
+		case <-ctx.Done():
+			return out, ctx.Err()
+		case <-time.After(t.pollEvery()):
+		}
+	}
+}
+// waitReady polls until the VM reaches "ready" with an IP, or the shared
+// deadline expires. Transient ListVMs failures (control-plane restart/blip/
+// 5xx) do NOT abort the wait — they are stashed and polling continues, per the
+// tool's "do not assume failure" contract. Only real cancellation (ctx.Done)
+// aborts immediately.
+func (t *Tools) waitReady(ctx context.Context, id, name string, deadline time.Time) (string, error) {
+	last := ""
+	sawListing := false
+	var lastErr error
+	for time.Now().Before(deadline) {
+		vms, err := t.API.ListVMs(ctx)
+		if err != nil {
+			lastErr = err
+		} else {
+			sawListing = true
+			for _, vm := range vms {
+				if vm.ID != id {
+					continue
+				}
+				last = vm.Lifecycle
+				if vm.Lifecycle == "ready" && vm.AssignedIP != "" {
+					return vm.AssignedIP, nil
+				}
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return "", ctx.Err()
+		case <-time.After(t.pollEvery()):
+		}
+	}
+	if sawListing {
+		return "", fmt.Errorf("vm %s (%s) not ready after %s (last lifecycle %q); it may still come up — check vm_info, do not assume failure", id, name, t.waitTimeout(), last)
+	}
+	return "", fmt.Errorf("vm %s (%s) not ready after %s (control-plane never listed successfully; last error: %v); it may still come up — check vm_info, do not assume failure", id, name, t.waitTimeout(), lastErr)
+}
+func (t *Tools) resolveHost(ctx context.Context, name string) (string, error) {
+	// v1 places every VM on the first online host; the api seam exposes only
+	// FirstOnlineHost. A caller-named host must therefore match it. Extend the
+	// seam with real host-by-name lookup when multi-host placement is needed.
+	h, err := t.API.FirstOnlineHost(ctx)
+	if err != nil {
+		return "", err
+	}
+	if h.Name != name && h.ID != name {
+		return "", fmt.Errorf("unknown host %q (v1 places on the first online host %q; pass no host to use it)", name, h.Name)
+	}
+	return h.ID, nil
+}
+func (t *Tools) sshCommand(name string) string {
+	if t.Gate != "" {
+		return fmt.Sprintf("ssh -J %s %s@%s", t.Gate, t.VMUser, name)
+	}
+	return fmt.Sprintf("ssh %s@%s", t.VMUser, name)
+}
+// ── vm_list / vm_info ────────────────────────────────────────────────────────
+type VMListIn struct{}
+type VMListOut struct {
+	VMs []client.VM `json:"vms"`
+}
+func (t *Tools) VMList(ctx context.Context, _ VMListIn) (VMListOut, error) {
+	vms, err := t.API.ListVMs(ctx)
+	if err != nil {
+		return VMListOut{}, err
+	}
+	return VMListOut{VMs: vms}, nil
+}
+type VMInfoIn struct {
+	VM string `json:"vm" jsonschema:"VM id or exact name"`
+}
+type VMInfoOut struct {
+	VM         client.VM `json:"vm"`
+	SSHCommand string    `json:"ssh_command,omitempty"`
+}
+func (t *Tools) VMInfo(ctx context.Context, in VMInfoIn) (VMInfoOut, error) {
+	vm, err := t.resolveVM(ctx, in.VM)
+	if err != nil {
+		return VMInfoOut{}, err
+	}
+	out := VMInfoOut{VM: vm}
+	if vm.Lifecycle == "ready" {
+		out.SSHCommand = t.sshCommand(vm.Name)
+	}
+	return out, nil
+}
+// ── vm_exec ──────────────────────────────────────────────────────────────────
+type VMExecIn struct {
+	VM       string `json:"vm" jsonschema:"VM id or exact name"`
+	Command  string `json:"command" jsonschema:"shell command to run as the VM user"`
+	TimeoutS int    `json:"timeout_s,omitempty" jsonschema:"default 120"`
+}
+type VMExecOut struct {
+	Stdout    string `json:"stdout"`
+	Stderr    string `json:"stderr"`
+	ExitCode  int    `json:"exit_code"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+func (t *Tools) VMExec(ctx context.Context, in VMExecIn) (VMExecOut, error) {
+	vm, err := t.resolveVM(ctx, in.VM)
+	if err != nil {
+		return VMExecOut{}, err
+	}
+	if vm.Lifecycle != "ready" {
+		return VMExecOut{}, fmt.Errorf("vm %s is not ready (lifecycle %q)", vm.Name, vm.Lifecycle)
+	}
+	timeout := 120 * time.Second
+	if in.TimeoutS > 0 {
+		timeout = time.Duration(in.TimeoutS) * time.Second
+	}
+	res, err := t.Runner.Exec(ctx, vm.Name, in.Command, timeout)
+	if err != nil {
+		return VMExecOut{}, err
+	}
+	return VMExecOut(res), nil
+}
+// ── vm_write_file / vm_read_file ─────────────────────────────────────────────
+type VMWriteFileIn struct {
+	VM      string `json:"vm" jsonschema:"VM id or exact name"`
+	Path    string `json:"path" jsonschema:"absolute path in the VM"`
+	Content string `json:"content" jsonschema:"file contents (UTF-8 text)"`
+	Mode    string `json:"mode,omitempty" jsonschema:"octal file mode, default 0644"`
+}
+type VMWriteFileOut struct {
+	Path  string `json:"path"`
+	Bytes int    `json:"bytes"`
+}
+func (t *Tools) VMWriteFile(ctx context.Context, in VMWriteFileIn) (VMWriteFileOut, error) {
+	vm, err := t.resolveVM(ctx, in.VM)
+	if err != nil {
+		return VMWriteFileOut{}, err
+	}
+	if vm.Lifecycle != "ready" {
+		return VMWriteFileOut{}, fmt.Errorf("vm %s is not ready (lifecycle %q)", vm.Name, vm.Lifecycle)
+	}
+	mode := fs.FileMode(0o644)
+	if in.Mode != "" {
+		var m uint32
+		if _, err := fmt.Sscanf(in.Mode, "%o", &m); err != nil {
+			return VMWriteFileOut{}, fmt.Errorf("bad mode %q: %w", in.Mode, err)
+		}
+		mode = fs.FileMode(m)
+	}
+	if err := t.Runner.WriteFile(ctx, vm.Name, in.Path, []byte(in.Content), mode); err != nil {
+		return VMWriteFileOut{}, err
+	}
+	return VMWriteFileOut{Path: in.Path, Bytes: len(in.Content)}, nil
+}
+type VMReadFileIn struct {
+	VM   string `json:"vm" jsonschema:"VM id or exact name"`
+	Path string `json:"path" jsonschema:"absolute path in the VM"`
+}
+type VMReadFileOut struct {
+	Content   string `json:"content"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+func (t *Tools) VMReadFile(ctx context.Context, in VMReadFileIn) (VMReadFileOut, error) {
+	vm, err := t.resolveVM(ctx, in.VM)
+	if err != nil {
+		return VMReadFileOut{}, err
+	}
+	if vm.Lifecycle != "ready" {
+		return VMReadFileOut{}, fmt.Errorf("vm %s is not ready (lifecycle %q)", vm.Name, vm.Lifecycle)
+	}
+	data, truncated, err := t.Runner.ReadFile(ctx, vm.Name, in.Path)
+	if err != nil {
+		return VMReadFileOut{}, err
+	}
+	return VMReadFileOut{Content: string(data), Truncated: truncated}, nil
+}
+// ── vm_destroy ───────────────────────────────────────────────────────────────
+type VMDestroyIn struct {
+	VM string `json:"vm" jsonschema:"VM id or EXACT name; destruction is explicit-only"`
+}
+type VMDestroyOut struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+func (t *Tools) VMDestroy(ctx context.Context, in VMDestroyIn) (VMDestroyOut, error) {
+	vm, err := t.resolveVM(ctx, in.VM)
+	if err != nil {
+		return VMDestroyOut{}, err
+	}
+	if err := t.API.DeleteVM(ctx, vm.ID); err != nil {
+		return VMDestroyOut{}, err
+	}
+	return VMDestroyOut{ID: vm.ID, Name: vm.Name}, nil
+}
+// resolveVM matches id or exact name against the live VM list.
+func (t *Tools) resolveVM(ctx context.Context, idOrName string) (client.VM, error) {
+	if idOrName == "" {
+		return client.VM{}, fmt.Errorf("vm is required (id or exact name)")
+	}
+	vms, err := t.API.ListVMs(ctx)
+	if err != nil {
+		return client.VM{}, err
+	}
+	for _, vm := range vms {
+		if vm.ID == idOrName || vm.Name == idOrName {
+			return vm, nil
+		}
+	}
+	return client.VM{}, fmt.Errorf("no VM with id or name %q", idOrName)
+}

internal/mcpserver/tools_test.go

@@ @@ -0,0 +1,307 @@ @@
+package mcpserver
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"testing"
+	"time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/a73x/eitri/internal/server/api/client"
+)
+type fakeToolsAPI struct {
+	vms     []client.VM
+	created []client.CreateVMRequest
+	deleted []string
+	// lifecycle sequence returned across successive ListVMs calls for the
+	// created VM, letting tests script the create→ready wait.
+	phases []string
+	calls  int
+	// number of leading ListVMs calls that fail (control-plane blip); after
+	// they are exhausted the phases sequence takes over.
+	listErrs int
+}
+func (f *fakeToolsAPI) ListVMs(ctx context.Context) ([]client.VM, error) {
+	if f.listErrs > 0 {
+		f.listErrs--
+		return nil, fmt.Errorf("control plane unavailable")
+	}
+	if len(f.phases) > 0 {
+		i := f.calls
+		if i >= len(f.phases) {
+			i = len(f.phases) - 1
+		}
+		f.calls++
+		vm := client.VM{ID: "new1", Name: "claude-abc", Lifecycle: f.phases[i]}
+		if f.phases[i] == "ready" {
+			vm.AssignedIP = "10.77.1.9"
+		}
+		return append(append([]client.VM{}, f.vms...), vm), nil
+	}
+	return f.vms, nil
+}
+func (f *fakeToolsAPI) CreateVM(ctx context.Context, r client.CreateVMRequest) (client.CreateVMResponse, error) {
+	f.created = append(f.created, r)
+	return client.CreateVMResponse{ID: "new1", Name: "claude-abc"}, nil
+}
+func (f *fakeToolsAPI) DeleteVM(ctx context.Context, id string) error {
+	f.deleted = append(f.deleted, id)
+	return nil
+}
+func (f *fakeToolsAPI) FirstOnlineHost(ctx context.Context) (client.Host, error) {
+	return client.Host{ID: "h1", Name: "mewtwo", Online: true}, nil
+}
+type fakeRunner struct {
+	execs []string
+	out   ExecResult
+	err   error
+	// number of leading Exec calls that fail with a connection-style error (the
+	// guest still booting, pre-sshd); after they are exhausted the configured
+	// out/err takes over. Mirrors fakeToolsAPI.listErrs.
+	execErrs int
+	files    map[string][]byte
+	reads    []string // vmName+"|"+path passed to ReadFile, in order
+}
+func (f *fakeRunner) Exec(ctx context.Context, vmName, cmd string, timeout time.Duration) (ExecResult, error) {
+	f.execs = append(f.execs, vmName+"|"+cmd)
+	if f.execErrs > 0 {
+		f.execErrs--
+		return ExecResult{}, fmt.Errorf("vm %s unreachable: connect: no route to host", vmName)
+	}
+	return f.out, f.err
+}
+func (f *fakeRunner) WriteFile(ctx context.Context, vmName, p string, data []byte, mode fs.FileMode) error {
+	if f.files == nil {
+		f.files = map[string][]byte{}
+	}
+	f.files[p] = data
+	return nil
+}
+func (f *fakeRunner) ReadFile(ctx context.Context, vmName, p string) ([]byte, bool, error) {
+	f.reads = append(f.reads, vmName+"|"+p)
+	d, ok := f.files[p]
+	if !ok {
+		return nil, false, fmt.Errorf("open %s: not found", p)
+	}
+	return d, false, nil
+}
+func newTestTools(api *fakeToolsAPI, r *fakeRunner) *Tools {
+	return &Tools{
+		API: api, Runner: r,
+		Gate:      "localhost:2223",
+		VMUser:    "ubuntu",
+		PollEvery: time.Millisecond, // fast tests
+	}
+}
+func TestCreateWaitsForReadyAndCloudInit(t *testing.T) {
+	api := &fakeToolsAPI{phases: []string{"creating", "creating", "ready"}}
+	run := &fakeRunner{out: ExecResult{ExitCode: 0}}
+	tl := newTestTools(api, run)
+	out, err := tl.VMCreate(t.Context(), VMCreateIn{})
+	require.NoError(t, err)
+	assert.Equal(t, "new1", out.ID)
+	assert.Equal(t, "10.77.1.9", out.IP)
+	assert.Contains(t, out.SSHCommand, "-J localhost:2223")
+	assert.Contains(t, out.SSHCommand, "ubuntu@claude-abc")
+	require.Len(t, api.created, 1)
+	req := api.created[0]
+	assert.True(t, req.Persistent, "spec: persistent always true")
+	assert.Equal(t, int64(2), req.VCPUs)
+	assert.Equal(t, int64(2048), req.MemMB)
+	assert.Equal(t, int64(20), req.DiskGB)
+	assert.Equal(t, "h1", req.HostID)
+	assert.Empty(t, req.SSHAuthorizedKey, "no key injection under the CA model")
+	require.Len(t, run.execs, 1)
+	assert.Equal(t, []string{"claude-abc|cloud-init status --wait"}, run.execs, "addressed by name, not IP")
+}
+func TestCreateRetriesThroughPreSSHDBootWindow(t *testing.T) {
+	// "ready" means the IP is allocated, NOT that the guest has booted sshd, so
+	// the first SSH dials can fail while the guest is still coming up. Fail the
+	// first two Exec attempts (pre-sshd) and succeed on the third; vm_create must
+	// retry through the transient failures rather than give up.
+	api := &fakeToolsAPI{phases: []string{"creating", "ready"}}
+	run := &fakeRunner{out: ExecResult{ExitCode: 0}, execErrs: 2}
+	tl := newTestTools(api, run)
+	out, err := tl.VMCreate(t.Context(), VMCreateIn{})
+	require.NoError(t, err)
+	assert.Equal(t, "10.77.1.9", out.IP)
+	require.Len(t, run.execs, 3, "two transient failures then a success")
+}
+func TestCreateRidesThroughTransientListErrors(t *testing.T) {
+	// First two polls fail (control-plane blip), then the VM reports ready.
+	api := &fakeToolsAPI{listErrs: 2, phases: []string{"creating", "ready"}}
+	run := &fakeRunner{out: ExecResult{ExitCode: 0}}
+	tl := newTestTools(api, run)
+	out, err := tl.VMCreate(t.Context(), VMCreateIn{})
+	require.NoError(t, err, "transient ListVMs errors must not abandon the wait")
+	assert.Equal(t, "new1", out.ID)
+	assert.Equal(t, "10.77.1.9", out.IP)
+	require.Len(t, run.execs, 1)
+	assert.Contains(t, run.execs[0], "cloud-init status --wait")
+}
+func TestCreateRetriesUntilSSHReachable(t *testing.T) {
+	// VM reaches "ready" (IP allocated) but sshd is not up yet: the first two SSH
+	// dials fail with a connection error, the third connects and cloud-init runs.
+	api := &fakeToolsAPI{phases: []string{"creating", "ready"}}
+	run := &fakeRunner{out: ExecResult{ExitCode: 0}, execErrs: 2}
+	tl := newTestTools(api, run)
+	out, err := tl.VMCreate(t.Context(), VMCreateIn{})
+	require.NoError(t, err, "must ride out the pre-sshd window, not fail on the first dial")
+	assert.Equal(t, "10.77.1.9", out.IP)
+	require.Len(t, run.execs, 3, "two connection failures then a success")
+	assert.Contains(t, run.execs[2], "cloud-init status --wait")
+	assert.Empty(t, api.deleted, "spec: never auto-destroy")
+}
+func TestCreateSSHNeverReachableReports(t *testing.T) {
+	// VM is "ready" but never becomes SSH-reachable within the budget.
+	api := &fakeToolsAPI{phases: []string{"ready"}}
+	run := &fakeRunner{err: fmt.Errorf("dial tcp 10.77.1.9:22: connect: no route to host")}
+	tl := newTestTools(api, run)
+	tl.WaitTimeout = 15 * time.Millisecond
+	out, err := tl.VMCreate(t.Context(), VMCreateIn{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "never became SSH-reachable")
+	assert.Contains(t, err.Error(), "new1", "degraded error must name the VM id so the model can destroy it")
+	assert.Equal(t, "10.77.1.9", out.IP, "out stays populated so the model can act on it")
+	assert.Empty(t, api.deleted, "spec: never auto-destroy on unreachable")
+}
+func TestCreateReportsCloudInitFailure(t *testing.T) {
+	// SSH connects and cloud-init RUNS but exits non-zero. Unlike a connection
+	// failure this must NOT be retried: cloud-init already ran, so report the
+	// degraded VM after exactly one Exec.
+	api := &fakeToolsAPI{phases: []string{"creating", "ready"}}
+	run := &fakeRunner{out: ExecResult{ExitCode: 1, Stderr: "boom"}}
+	tl := newTestTools(api, run)
+	out, err := tl.VMCreate(t.Context(), VMCreateIn{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cloud-init exited 1")
+	assert.Contains(t, err.Error(), "new1", "error must name the VM id")
+	assert.Contains(t, err.Error(), "claude-abc", "error must name the VM name")
+	assert.Equal(t, "10.77.1.9", out.IP, "out stays populated so the model can act on it")
+	assert.Empty(t, api.deleted, "spec: never auto-destroy")
+	require.Len(t, run.execs, 1, "a ran-but-failed cloud-init must NOT be retried")
+}
+func TestCreateNoWaitReturnsImmediately(t *testing.T) {
+	api := &fakeToolsAPI{}
+	run := &fakeRunner{}
+	tl := newTestTools(api, run)
+	no := false
+	out, err := tl.VMCreate(t.Context(), VMCreateIn{Wait: &no})
+	require.NoError(t, err)
+	assert.Equal(t, "new1", out.ID)
+	assert.Empty(t, out.IP)
+	assert.Empty(t, run.execs)
+}
+func TestCreateWaitTimeoutDoesNotDestroy(t *testing.T) {
+	api := &fakeToolsAPI{phases: []string{"creating"}} // never ready
+	run := &fakeRunner{}
+	tl := newTestTools(api, run)
+	tl.WaitTimeout = 10 * time.Millisecond
+	_, err := tl.VMCreate(t.Context(), VMCreateIn{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "creating") // current phase reported
+	assert.Empty(t, api.deleted, "spec: never auto-destroy on timeout")
+}
+func TestExecResolvesNameAndFormatsResult(t *testing.T) {
+	api := &fakeToolsAPI{vms: []client.VM{{ID: "abc123", Name: "web-1", Lifecycle: "ready", AssignedIP: "10.77.1.5"}}}
+	run := &fakeRunner{out: ExecResult{Stdout: "ok\n", ExitCode: 0}}
+	tl := newTestTools(api, run)
+	out, err := tl.VMExec(t.Context(), VMExecIn{VM: "web-1", Command: "echo ok"})
+	require.NoError(t, err)
+	assert.Equal(t, 0, out.ExitCode)
+	assert.Equal(t, "ok\n", out.Stdout)
+	assert.Equal(t, []string{"web-1|echo ok"}, run.execs, "addressed by name, not IP")
+}
+func TestExecUnknownVM(t *testing.T) {
+	tl := newTestTools(&fakeToolsAPI{}, &fakeRunner{})
+	_, err := tl.VMExec(t.Context(), VMExecIn{VM: "nope", Command: "x"})
+	assert.ErrorContains(t, err, "no VM with id or name")
+}
+func TestExecNotReadyVMRejectedWithoutCallingRunner(t *testing.T) {
+	for _, lifecycle := range []string{"creating", "stopped", "failed", "deleting", ""} {
+		lifecycle := lifecycle
+		t.Run(lifecycle, func(t *testing.T) {
+			api := &fakeToolsAPI{vms: []client.VM{{ID: "abc123", Name: "web-1", Lifecycle: lifecycle}}}
+			run := &fakeRunner{}
+			tl := newTestTools(api, run)
+			_, err := tl.VMExec(t.Context(), VMExecIn{VM: "web-1", Command: "echo ok"})
+			require.Error(t, err)
+			assert.ErrorContains(t, err, "not ready")
+			assert.Empty(t, run.execs, "runner must not be called on a non-ready VM")
+		})
+	}
+}
+func TestWriteFileNotReadyVMRejectedWithoutCallingRunner(t *testing.T) {
+	api := &fakeToolsAPI{vms: []client.VM{{ID: "abc123", Name: "web-1", Lifecycle: "creating"}}}
+	run := &fakeRunner{}
+	tl := newTestTools(api, run)
+	_, err := tl.VMWriteFile(t.Context(), VMWriteFileIn{VM: "web-1", Path: "/app/x", Content: "data"})
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "not ready")
+	assert.Empty(t, run.files, "runner must not be called on a non-ready VM")
+}
+func TestReadFileNotReadyVMRejectedWithoutCallingRunner(t *testing.T) {
+	api := &fakeToolsAPI{vms: []client.VM{{ID: "abc123", Name: "web-1", Lifecycle: "stopped"}}}
+	run := &fakeRunner{files: map[string][]byte{"/app/x": []byte("data")}}
+	tl := newTestTools(api, run)
+	_, err := tl.VMReadFile(t.Context(), VMReadFileIn{VM: "web-1", Path: "/app/x"})
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "not ready")
+	assert.Empty(t, run.reads, "runner must not be called on a non-ready VM")
+}
+func TestDestroyRequiresExactMatch(t *testing.T) {
+	api := &fakeToolsAPI{vms: []client.VM{{ID: "abc123", Name: "web-1"}}}
+	tl := newTestTools(api, &fakeRunner{})
+	_, err := tl.VMDestroy(t.Context(), VMDestroyIn{VM: "web"})
+	require.Error(t, err)
+	out, err := tl.VMDestroy(t.Context(), VMDestroyIn{VM: "web-1"})
+	require.NoError(t, err)
+	assert.Equal(t, "abc123", out.ID)
+	assert.Equal(t, []string{"abc123"}, api.deleted)
+}
+func TestWriteAndReadFileTools(t *testing.T) {
+	api := &fakeToolsAPI{vms: []client.VM{{ID: "abc123", Name: "web-1", Lifecycle: "ready", AssignedIP: "10.77.1.5"}}}
+	run := &fakeRunner{}
+	tl := newTestTools(api, run)
+	_, err := tl.VMWriteFile(t.Context(), VMWriteFileIn{VM: "abc123", Path: "/app/x", Content: "data"})
+	require.NoError(t, err)
+	rd, err := tl.VMReadFile(t.Context(), VMReadFileIn{VM: "web-1", Path: "/app/x"})
+	require.NoError(t, err)
+	assert.Equal(t, "data", rd.Content)
+}

internal/server/api/client/client.go

@@ @@ -0,0 +1,187 @@ @@
+// Package client is THE Go client for the eitri control-plane HTTP API — the
+// one consumer every in-repo caller (MCP server) goes through. Its method set
+// is exactly what those consumers use, nothing more: a new endpoint call
+// starts by adding a method here (an arch fitness rule enforces that no other
+// package speaks the API's HTTP directly).
+//
+// The wire shapes come from internal/server/api/types; the ones consumers
+// need are re-exported as aliases so callers import only this package.
+package client
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+	"golang.org/x/crypto/ssh"
+	"github.com/a73x/eitri/internal/server/api/types"
+)
+// Wire-contract aliases, so consumers don't import the types package.
+type (
+	Host             = types.Host
+	VM               = types.VM
+	CreateVMRequest  = types.CreateVMRequest
+	CreateVMResponse = types.CreateVMResponse
+)
+// Client calls the eitri API at BaseURL, authenticating with Token (sent as a
+// Bearer header when non-empty). The zero value plus a BaseURL is a working
+// client; a nil HTTP falls back to a 30s-timeout http.Client.
+type Client struct {
+	BaseURL string
+	Token   string
+	HTTP    *http.Client
+}
+// Error is the typed failure for any non-2xx API response, carrying the
+// request identity, the HTTP status, and the (truncated) response body.
+type Error struct {
+	Method string
+	Path   string
+	Status int
+	Body   string
+}
+func (e *Error) Error() string {
+	return fmt.Sprintf("client: %s %s: %d: %s", e.Method, e.Path, e.Status, e.Body)
+}
+// gateOffError is the 404-on-/api/v1/ssh-ca translation: its message says the
+// gate is off (never "404"), while still unwrapping to the underlying *Error
+// so errors.As callers can see the status.
+type gateOffError struct{ cause *Error }
+func (e *gateOffError) Error() string { return "ssh-ca gate is not enabled on this eitri server" }
+func (e *gateOffError) Unwrap() error { return e.cause }
+// do performs one API round trip: method+path against BaseURL, JSON-encoding
+// in when non-nil, decoding the response into out when non-nil. Non-2xx
+// responses become a *Error. The URL is built by plain concatenation — paths
+// here are always well-formed absolute /api/... strings whose variable
+// segments the callers have already PathEscaped.
+func (c *Client) do(ctx context.Context, method, path string, in, out any) error {
+	var body io.Reader
+	if in != nil {
+		b, err := json.Marshal(in)
+		if err != nil {
+			return fmt.Errorf("client: %s %s: encoding request: %w", method, path, err)
+		}
+		body = bytes.NewReader(b)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, strings.TrimRight(c.BaseURL, "/")+path, body)
+	if err != nil {
+		return fmt.Errorf("client: %s %s: %w", method, path, err)
+	}
+	if in != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	if c.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.Token)
+	}
+	httpc := c.HTTP
+	if httpc == nil {
+		httpc = &http.Client{Timeout: 30 * time.Second}
+	}
+	resp, err := httpc.Do(req)
+	if err != nil {
+		return fmt.Errorf("client: %s %s: %w", method, path, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		msg, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		return &Error{Method: method, Path: path, Status: resp.StatusCode, Body: strings.TrimSpace(string(msg))}
+	}
+	if out == nil {
+		return nil
+	}
+	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
+		return fmt.Errorf("client: %s %s: decoding response: %w", method, path, err)
+	}
+	return nil
+}
+// ListHosts returns the fleet's hosts.
+func (c *Client) ListHosts(ctx context.Context) ([]Host, error) {
+	var hosts []Host
+	return hosts, c.do(ctx, http.MethodGet, "/api/v1/hosts", nil, &hosts)
+}
+// ListVMs returns every VM the caller can see.
+func (c *Client) ListVMs(ctx context.Context) ([]VM, error) {
+	var vms []VM
+	return vms, c.do(ctx, http.MethodGet, "/api/v1/vms", nil, &vms)
+}
+// CreateVM asks the server to create a VM; the server fills one-click
+// defaults for everything req leaves zero except host_id.
+func (c *Client) CreateVM(ctx context.Context, req CreateVMRequest) (CreateVMResponse, error) {
+	var out CreateVMResponse
+	return out, c.do(ctx, http.MethodPost, "/api/v1/vms", req, &out)
+}
+// DeleteVM marks the VM for teardown; the agent reaps it asynchronously.
+func (c *Client) DeleteVM(ctx context.Context, id string) error {
+	return c.do(ctx, http.MethodDelete, "/api/v1/vms/"+url.PathEscape(id), nil, nil)
+}
+// FetchSSHCALine retrieves the eitri SSH CA public key as the VERBATIM
+// authorized_keys line the server serves — trailing comment and all — after
+// parse-validating it (never hand back a line ssh can't read). A 404 means
+// the SSH-CA jump gate isn't enabled; that case is surfaced as a clear,
+// gate-specific error rather than a raw HTTP status.
+func (c *Client) FetchSSHCALine(ctx context.Context) (string, error) {
+	var out types.SSHCAResponse
+	if err := c.do(ctx, http.MethodGet, "/api/v1/ssh-ca", nil, &out); err != nil {
+		var apiErr *Error
+		if errors.As(err, &apiErr) && apiErr.Status == http.StatusNotFound {
+			return "", &gateOffError{cause: apiErr}
+		}
+		return "", err
+	}
+	if _, _, _, _, err := ssh.ParseAuthorizedKey([]byte(out.CA)); err != nil {
+		return "", fmt.Errorf("client: parsing ssh CA key: %w", err)
+	}
+	return out.CA, nil
+}
+// FetchSSHCA is FetchSSHCALine, parsed: the CA as an ssh.PublicKey, for
+// callers that verify host certs.
+func (c *Client) FetchSSHCA(ctx context.Context) (ssh.PublicKey, error) {
+	line, err := c.FetchSSHCALine(ctx)
+	if err != nil {
+		return nil, err
+	}
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
+	if err != nil {
+		return nil, fmt.Errorf("client: parsing ssh CA key: %w", err)
+	}
+	return pub, nil
+}
+// MintUserCert asks the eitri server to mint a short-lived SSH user
+// certificate for pub, signed by the server's CA.
+func (c *Client) MintUserCert(ctx context.Context, pub ssh.PublicKey) (*ssh.Certificate, error) {
+	req := types.SSHCertRequest{PublicKey: strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pub)))}
+	var out types.SSHCertResponse
+	if err := c.do(ctx, http.MethodPost, "/api/v1/ssh-certs", req, &out); err != nil {
+		return nil, err
+	}
+	parsed, _, _, _, err := ssh.ParseAuthorizedKey([]byte(out.Certificate))
+	if err != nil {
+		return nil, fmt.Errorf("client: parsing minted certificate: %w", err)
+	}
+	cert, ok := parsed.(*ssh.Certificate)
+	if !ok {
+		return nil, errors.New("client: server response is not an SSH certificate")
+	}
+	return cert, nil
+}

internal/server/api/client/client_test.go

@@ @@ -0,0 +1,291 @@ @@
+package client_test
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"golang.org/x/crypto/ssh"
+	"github.com/a73x/eitri/internal/server/api/client"
+	"github.com/a73x/eitri/internal/server/api/types"
+)
+// testCALine is a valid ed25519 authorized_keys line WITH a trailing comment;
+// FetchSSHCALine must return it verbatim.
+const testCALine = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZK1zVJTG0Opn0BktxOpCYhRXRPMFhZDwoT1PVCM1Sq eitri-host-ca"
+// capture records what the handler saw so tests can assert on the request.
+type capture struct {
+	method string
+	path   string // escaped path, so %2F survives inspection
+	auth   string
+	ctype  string
+	body   []byte
+}
+// serve starts an httptest server that records each request into *capture and
+// responds with status and body.
+func serve(t *testing.T, cap *capture, status int, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cap.method = r.Method
+		cap.path = r.URL.EscapedPath()
+		cap.auth = r.Header.Get("Authorization")
+		cap.ctype = r.Header.Get("Content-Type")
+		cap.body, _ = io.ReadAll(r.Body)
+		w.WriteHeader(status)
+		io.WriteString(w, body)
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+func TestListHosts(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusOK, `[{"id":"h1","name":"mewtwo","online":true}]`)
+	c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+	hosts, err := c.ListHosts(context.Background())
+	if err != nil {
+		t.Fatalf("ListHosts: %v", err)
+	}
+	if cap.method != http.MethodGet || cap.path != "/api/v1/hosts" {
+		t.Errorf("request = %s %s, want GET /api/v1/hosts", cap.method, cap.path)
+	}
+	if cap.auth != "Bearer tok" {
+		t.Errorf("Authorization = %q, want %q", cap.auth, "Bearer tok")
+	}
+	if len(hosts) != 1 || hosts[0].ID != "h1" || hosts[0].Name != "mewtwo" || !hosts[0].Online {
+		t.Errorf("hosts = %+v, want one host h1/mewtwo/online", hosts)
+	}
+}
+func TestListVMs(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusOK, `[{"id":"v1","name":"dev","lifecycle":"ready","assigned_ip":"10.77.1.2"}]`)
+	c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+	vms, err := c.ListVMs(context.Background())
+	if err != nil {
+		t.Fatalf("ListVMs: %v", err)
+	}
+	if cap.method != http.MethodGet || cap.path != "/api/v1/vms" {
+		t.Errorf("request = %s %s, want GET /api/v1/vms", cap.method, cap.path)
+	}
+	if cap.auth != "Bearer tok" {
+		t.Errorf("Authorization = %q, want %q", cap.auth, "Bearer tok")
+	}
+	if len(vms) != 1 || vms[0].ID != "v1" || vms[0].Lifecycle != "ready" || vms[0].AssignedIP != "10.77.1.2" {
+		t.Errorf("vms = %+v, want one ready VM v1 at 10.77.1.2", vms)
+	}
+}
+func TestCreateVM(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusCreated, `{"id":"v9","name":"smoke"}`)
+	c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+	out, err := c.CreateVM(context.Background(), client.CreateVMRequest{HostID: "h1", Name: "smoke", VCPUs: 2})
+	if err != nil {
+		t.Fatalf("CreateVM: %v", err)
+	}
+	if cap.method != http.MethodPost || cap.path != "/api/v1/vms" {
+		t.Errorf("request = %s %s, want POST /api/v1/vms", cap.method, cap.path)
+	}
+	if cap.ctype != "application/json" {
+		t.Errorf("Content-Type = %q, want application/json", cap.ctype)
+	}
+	var req types.CreateVMRequest
+	if err := json.Unmarshal(cap.body, &req); err != nil {
+		t.Fatalf("request body did not decode as CreateVMRequest: %v", err)
+	}
+	if req.HostID != "h1" || req.Name != "smoke" || req.VCPUs != 2 {
+		t.Errorf("request body = %+v, want host h1 / name smoke / 2 vcpus", req)
+	}
+	if out.ID != "v9" || out.Name != "smoke" {
+		t.Errorf("response = %+v, want id v9 name smoke", out)
+	}
+}
+func TestDeleteVM(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusNoContent, "")
+	c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+	if err := c.DeleteVM(context.Background(), "vm-123"); err != nil {
+		t.Fatalf("DeleteVM: %v", err)
+	}
+	if cap.method != http.MethodDelete || cap.path != "/api/v1/vms/vm-123" {
+		t.Errorf("request = %s %s, want DELETE /api/v1/vms/vm-123", cap.method, cap.path)
+	}
+}
+func TestDeleteVMEscapesID(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusNoContent, "")
+	c := &client.Client{BaseURL: srv.URL}
+	if err := c.DeleteVM(context.Background(), "a b/c"); err != nil {
+		t.Fatalf("DeleteVM: %v", err)
+	}
+	if want := "/api/v1/vms/a%20b%2Fc"; cap.path != want {
+		t.Errorf("path = %q, want %q", cap.path, want)
+	}
+}
+func TestNoAuthHeaderWhenTokenEmpty(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusOK, `[]`)
+	c := &client.Client{BaseURL: srv.URL}
+	if _, err := c.ListHosts(context.Background()); err != nil {
+		t.Fatalf("ListHosts: %v", err)
+	}
+	if cap.auth != "" {
+		t.Errorf("Authorization = %q, want unset when Token is empty", cap.auth)
+	}
+}
+func TestBaseURLTrailingSlash(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusOK, `[]`)
+	c := &client.Client{BaseURL: srv.URL + "/"}
+	if _, err := c.ListVMs(context.Background()); err != nil {
+		t.Fatalf("ListVMs: %v", err)
+	}
+	if cap.path != "/api/v1/vms" {
+		t.Errorf("path = %q, want /api/v1/vms (trailing BaseURL slash trimmed)", cap.path)
+	}
+}
+func TestNon2xxReturnsTypedError(t *testing.T) {
+	var cap capture
+	srv := serve(t, &cap, http.StatusConflict, "insufficient host capacity")
+	c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+	_, err := c.CreateVM(context.Background(), client.CreateVMRequest{HostID: "h1"})
+	if err == nil {
+		t.Fatal("CreateVM on 409: got nil error")
+	}
+	var apiErr *client.Error
+	if !errors.As(err, &apiErr) {
+		t.Fatalf("errors.As found no *client.Error in %v", err)
+	}
+	if apiErr.Status != http.StatusConflict {
+		t.Errorf("Status = %d, want 409", apiErr.Status)
+	}
+	if apiErr.Method != http.MethodPost || apiErr.Path != "/api/v1/vms" {
+		t.Errorf("Method/Path = %s %s, want POST /api/v1/vms", apiErr.Method, apiErr.Path)
+	}
+	if !strings.Contains(err.Error(), "409") || !strings.Contains(err.Error(), "insufficient host capacity") {
+		t.Errorf("error %q should contain the status code and the response body", err)
+	}
+}
+func TestContextCancellationAborts(t *testing.T) {
+	release := make(chan struct{})
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		<-release
+	}))
+	t.Cleanup(func() { close(release); srv.Close() })
+	c := &client.Client{BaseURL: srv.URL}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, err := c.ListHosts(ctx); !errors.Is(err, context.Canceled) {
+		t.Fatalf("ListHosts with canceled ctx: err = %v, want context.Canceled", err)
+	}
+}
+func TestFetchSSHCALineVerbatim(t *testing.T) {
+	var cap capture
+	body, _ := json.Marshal(map[string]string{"ca": testCALine})
+	srv := serve(t, &cap, http.StatusOK, string(body))
+	c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+	line, err := c.FetchSSHCALine(context.Background())
+	if err != nil {
+		t.Fatalf("FetchSSHCALine: %v", err)
+	}
+	if cap.method != http.MethodGet || cap.path != "/api/v1/ssh-ca" {
+		t.Errorf("request = %s %s, want GET /api/v1/ssh-ca", cap.method, cap.path)
+	}
+	if cap.auth != "Bearer tok" {
+		t.Errorf("Authorization = %q, want %q", cap.auth, "Bearer tok")
+	}
+	if line != testCALine {
+		t.Errorf("line = %q, want the verbatim server line %q (comment preserved)", line, testCALine)
+	}
+}
+func TestFetchSSHCAParsesKey(t *testing.T) {
+	var cap capture
+	body, _ := json.Marshal(map[string]string{"ca": testCALine})
+	srv := serve(t, &cap, http.StatusOK, string(body))
+	c := &client.Client{BaseURL: srv.URL}
+	pub, err := c.FetchSSHCA(context.Background())
+	if err != nil {
+		t.Fatalf("FetchSSHCA: %v", err)
+	}
+	want, _, _, _, err := ssh.ParseAuthorizedKey([]byte(testCALine))
+	if err != nil {
+		t.Fatalf("parsing test fixture: %v", err)
+	}
+	if string(pub.Marshal()) != string(want.Marshal()) {
+		t.Error("FetchSSHCA returned a different key than the server sent")
+	}
+}
+func TestFetchSSHCA404IsGateOff(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		call func(c *client.Client) error
+	}{
+		{"FetchSSHCALine", func(c *client.Client) error { _, err := c.FetchSSHCALine(context.Background()); return err }},
+		{"FetchSSHCA", func(c *client.Client) error { _, err := c.FetchSSHCA(context.Background()); return err }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var cap capture
+			srv := serve(t, &cap, http.StatusNotFound, "not found")
+			err := tc.call(&client.Client{BaseURL: srv.URL})
+			if err == nil {
+				t.Fatal("404: got nil error")
+			}
+			// The full wording is pinned: mcpserver's tests and human eyes
+			// both read this message, so a rewording must be deliberate.
+			if got, want := err.Error(), "ssh-ca gate is not enabled on this eitri server"; got != want {
+				t.Errorf("gate-off message = %q, want %q", got, want)
+			}
+			var apiErr *client.Error
+			if !errors.As(err, &apiErr) || apiErr.Status != http.StatusNotFound {
+				t.Errorf("errors.As should still find the underlying *client.Error with Status 404, got %v", err)
+			}
+		})
+	}
+}
+func TestFetchSSHCAGarbage(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		call func(c *client.Client) error
+	}{
+		{"FetchSSHCALine", func(c *client.Client) error { _, err := c.FetchSSHCALine(context.Background()); return err }},
+		{"FetchSSHCA", func(c *client.Client) error { _, err := c.FetchSSHCA(context.Background()); return err }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var cap capture
+			srv := serve(t, &cap, http.StatusOK, `{"ca":"not an ssh key"}`)
+			if err := tc.call(&client.Client{BaseURL: srv.URL}); err == nil {
+				t.Fatal("garbage CA: got nil error")
+			}
+		})
+	}
+}

internal/shape/classify.go

Old		New
@@ -40,6 +40,7 @@ func classify(rel string) Plane {
40	return PlaneBinaries	40	return PlaneBinaries
41	case strings.HasPrefix(rel, "internal/arch"),	41	case strings.HasPrefix(rel, "internal/arch"),
42	strings.HasPrefix(rel, "internal/integration"),	42	strings.HasPrefix(rel, "internal/integration"),
		43	strings.HasPrefix(rel, "internal/mcpserver"),
43	strings.HasPrefix(rel, "internal/shape"):	44	strings.HasPrefix(rel, "internal/shape"):
44	return PlaneTooling	45	return PlaneTooling
45	default:	46	default:

scripts/coverage.sh

Old		New
@@ -24,6 +24,7 @@ declare -A FLOOR=(
24	[internal/agent/cloudhv]=40	24	[internal/agent/cloudhv]=40
25	[internal/agent/syncclient]=74	25	[internal/agent/syncclient]=74
26	[internal/server/api]=73	26	[internal/server/api]=73
		27	[internal/server/api/client]=73
27	[internal/server/api/spec]=81	28	[internal/server/api/spec]=81
28	[internal/server/store]=73	29	[internal/server/store]=73
29	[internal/server/registry]=95	30	[internal/server/registry]=95

Old		New
@@ -5,9 +5,11 @@ go 1.26.4
5	require (	5	require (
6	github.com/coder/websocket v1.8.15	6	github.com/coder/websocket v1.8.15
7	github.com/diskfs/go-diskfs v1.9.3	7	github.com/diskfs/go-diskfs v1.9.3
		8	github.com/modelcontextprotocol/go-sdk v1.6.1
		9	github.com/pkg/sftp v1.13.11
8	github.com/quic-go/quic-go v0.48.2	10	github.com/quic-go/quic-go v0.48.2
9	github.com/stretchr/testify v1.11.1	11	github.com/stretchr/testify v1.11.1
10	golang.org/x/crypto v0.48.0	12	golang.org/x/crypto v0.54.0
11	google.golang.org/protobuf v1.36.11	13	google.golang.org/protobuf v1.36.11
12	gopkg.in/yaml.v3 v3.0.1	14	gopkg.in/yaml.v3 v3.0.1
13	modernc.org/sqlite v1.52.0	15	modernc.org/sqlite v1.52.0
@@ -22,9 +24,11 @@ require (
22	github.com/go-logr/logr v1.4.3 // indirect	24	github.com/go-logr/logr v1.4.3 // indirect
23	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect	25	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
24	github.com/golang/protobuf v1.5.4 // indirect	26	github.com/golang/protobuf v1.5.4 // indirect
		27	github.com/google/jsonschema-go v0.4.3 // indirect
25	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect	28	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
26	github.com/google/uuid v1.6.0 // indirect	29	github.com/google/uuid v1.6.0 // indirect
27	github.com/klauspost/compress v1.18.5 // indirect	30	github.com/klauspost/compress v1.18.5 // indirect
		31	github.com/kr/fs v0.1.0 // indirect
28	github.com/mattn/go-isatty v0.0.20 // indirect	32	github.com/mattn/go-isatty v0.0.20 // indirect
29	github.com/ncruces/go-strftime v1.0.0 // indirect	33	github.com/ncruces/go-strftime v1.0.0 // indirect
30	github.com/onsi/ginkgo/v2 v2.9.5 // indirect	34	github.com/onsi/ginkgo/v2 v2.9.5 // indirect
@@ -32,14 +36,18 @@ require (
32	github.com/pkg/xattr v0.4.12 // indirect	36	github.com/pkg/xattr v0.4.12 // indirect
33	github.com/pmezard/go-difflib v1.0.0 // indirect	37	github.com/pmezard/go-difflib v1.0.0 // indirect
34	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect	38	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
		39	github.com/segmentio/asm v1.1.3 // indirect
		40	github.com/segmentio/encoding v0.5.4 // indirect
35	github.com/sirupsen/logrus v1.9.4 // indirect	41	github.com/sirupsen/logrus v1.9.4 // indirect
36	github.com/ulikunitz/xz v0.5.15 // indirect	42	github.com/ulikunitz/xz v0.5.15 // indirect
		43	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
37	go.uber.org/mock v0.4.0 // indirect	44	go.uber.org/mock v0.4.0 // indirect
38	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect	45	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
39	golang.org/x/mod v0.33.0 // indirect	46	golang.org/x/mod v0.33.0 // indirect
40	golang.org/x/net v0.51.0 // indirect	47	golang.org/x/net v0.56.0 // indirect
		48	golang.org/x/oauth2 v0.35.0 // indirect
41	golang.org/x/sync v0.20.0 // indirect	49	golang.org/x/sync v0.20.0 // indirect
42	golang.org/x/sys v0.43.0 // indirect	50	golang.org/x/sys v0.47.0 // indirect
43	golang.org/x/tools v0.42.0 // indirect	51	golang.org/x/tools v0.42.0 // indirect
44	modernc.org/libc v1.72.3 // indirect	52	modernc.org/libc v1.72.3 // indirect
45	modernc.org/mathutil v1.7.1 // indirect	53	modernc.org/mathutil v1.7.1 // indirect

Old		New
@@ -19,10 +19,14 @@ github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEe
19	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=	19	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
20	github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=	20	github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
21	github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=	21	github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
		22	github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
		23	github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
22	github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=	24	github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
23	github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=	25	github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
24	github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=	26	github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
25	github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=	27	github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
		28	github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0=
		29	github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
26	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=	30	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
27	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=	31	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
28	github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=	32	github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -31,8 +35,12 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
31	github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=	35	github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
32	github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=	36	github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
33	github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=	37	github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
		38	github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
		39	github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
34	github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=	40	github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
35	github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=	41	github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
		42	github.com/modelcontextprotocol/go-sdk v1.6.1 h1:0zOSupjKUxPKSocPT1Wtago+mUHU2/uZ4xSOY0FGReU=
		43	github.com/modelcontextprotocol/go-sdk v1.6.1/go.mod h1:kzm3kzFL1/+AziGOE0nUs3gvPoNxMCvkxokMkuFapXQ=
36	github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=	44	github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
37	github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=	45	github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
38	github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=	46	github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
@@ -41,6 +49,8 @@ github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
41	github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=	49	github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
42	github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=	50	github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=
43	github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=	51	github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
		52	github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
		53	github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
44	github.com/pkg/xattr v0.4.12 h1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=	54	github.com/pkg/xattr v0.4.12 h1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=
45	github.com/pkg/xattr v0.4.12/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=	55	github.com/pkg/xattr v0.4.12/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
46	github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=	56	github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -49,6 +59,10 @@ github.com/quic-go/quic-go v0.48.2 h1:wsKXZPeGWpMpCGSWqOcqpW2wZYic/8T3aqiOID0/KW
49	github.com/quic-go/quic-go v0.48.2/go.mod h1:yBgs3rWBOADpga7F+jJsb6Ybg1LSYiQvwWlLX+/6HMs=	59	github.com/quic-go/quic-go v0.48.2/go.mod h1:yBgs3rWBOADpga7F+jJsb6Ybg1LSYiQvwWlLX+/6HMs=
50	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=	60	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
51	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=	61	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
		62	github.com/segmentio/asm v1.1.3 h1:WM03sfUOENvvKexOLp+pCqgb/WDjsi7EK8gIsICtzhc=
		63	github.com/segmentio/asm v1.1.3/go.mod h1:Ld3L4ZXGNcSLRg4JBsZ3//1+f/TjYl0Mzen/DQy1EJg=
		64	github.com/segmentio/encoding v0.5.4 h1:OW1VRern8Nw6ITAtwSZ7Idrl3MXCFwXHPgqESYfvNt0=
		65	github.com/segmentio/encoding v0.5.4/go.mod h1:HS1ZKa3kSN32ZHVZ7ZLPLXWvOVIiZtyJnO1gPH1sKt0=
52	github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=	66	github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
53	github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=	67	github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
54	github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=	68	github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -57,27 +71,31 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
57	github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=	71	github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
58	github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=	72	github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
59	github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=	73	github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
		74	github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
		75	github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
60	go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=	76	go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
61	go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=	77	go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
62	golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=	78	golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
63	golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=	79	golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
64	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=	80	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
65	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=	81	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
66	golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=	82	golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
67	golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=	83	golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
68	golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=	84	golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
69	golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=	85	golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
		86	golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
		87	golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
70	golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=	88	golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
71	golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=	89	golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
72	golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=	90	golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
73	golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=	91	golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
74	golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=	92	golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
75	golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=	93	golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
76	golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=	94	golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
77	golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=	95	golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
78	golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=	96	golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
79	golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=	97	golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
80	golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=	98	golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
81	golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=	99	golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
82	golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=	100	golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
83	golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=	101	golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=