Brewtools:Ssh

#!/bin/bash
set -euo pipefail
# Manage CLAUDE.local.md server entries
# Usage: claude-local-ops.sh <subcommand> [args...]
# Subcommands: read, add, update, list, set-default

LOCAL_FILE="CLAUDE.local.md"
SUBCMD="${1:?Usage: claude-local-ops.sh <read|add|update|list|set-default> [args...]}"
shift

# Initialize file if missing
init_file() {
    if [[ ! -f "$LOCAL_FILE" ]]; then
        cat > "$LOCAL_FILE" << 'HEREDOC'
# Local Configuration

> This file is gitignored. Do not commit.

## SSH Servers

| Name | Host | User | Port | Key | Default |
|------|------|------|------|-----|---------|

> Connect via: `/brewtools:ssh connect to <name>` or `/brewtools:ssh <task description>`
HEREDOC
    fi
}

# Check if line is a server data row (not header, not separator, not other tables)
is_server_row() {
    local line="$1"
    [[ "$line" == "| "* ]] && \
    [[ "$line" != "| Name "* ]] && \
    [[ "$line" != "| -"* ]] && \
    [[ "$line" != "| Property "* ]] && \
    [[ "$line" != "|---"* ]] && \
    [[ "$line" != "|-"* ]]
}

# Extract field from pipe-delimited row by position (1-based)
get_field() {
    echo "$1" | awk -F'|' -v n="$2" '{gsub(/^[ \t]+|[ \t]+$/, "", $n); print $n}'
}

# Parse server rows only from SSH Servers section (between header and > Connect)
get_server_rows() {
    local in_table=false
    while IFS= read -r line; do
        if [[ "$line" == "| Name |"* ]]; then
            in_table=true
            continue
        fi
        if [[ "$in_table" == true ]]; then
            if [[ "$line" == "|---"* ]]; then
                continue
            fi
            if [[ "$line" == "| "* ]]; then
                echo "$line"
            else
                break
            fi
        fi
    done < "$LOCAL_FILE"
}

case "$SUBCMD" in
    read)
        if [[ ! -f "$LOCAL_FILE" ]]; then
            echo "FILE=missing"
            exit 0
        fi
        echo "FILE=exists"
        get_server_rows | while IFS= read -r row; do
            name=$(get_field "$row" 2)
            host=$(get_field "$row" 3)
            user=$(get_field "$row" 4)
            port=$(get_field "$row" 5)
            key=$(get_field "$row" 6)
            default=$(get_field "$row" 7)
            [[ -z "$name" ]] && continue
            echo "SERVER=$name"
            echo "${name}_HOST=$host"
            echo "${name}_USER=$user"
            echo "${name}_PORT=$port"
            echo "${name}_KEY=$key"
            echo "${name}_DEFAULT=$default"
        done
        ;;

    add)
        NAME="${1:?add requires: name host user port key}"
        HOST="${2:?add requires: host}"
        USER="${3:?add requires: user}"
        PORT="${4:-22}"
        KEY="${5:-~/.ssh/id_ed25519_$NAME}"

        init_file

        if grep -q "| $NAME |" "$LOCAL_FILE" 2>/dev/null; then
            echo "ERROR: Server '$NAME' already exists. Use 'update' to modify."
            exit 1
        fi

        # Count existing server rows
        EXISTING=$(get_server_rows | wc -l | tr -d ' ')

        if [[ "$EXISTING" -eq 0 ]]; then
            DEFAULT_FLAG="*"
        else
            DEFAULT_FLAG=""
        fi

        ROW="| $NAME | $HOST | $USER | $PORT | $KEY | $DEFAULT_FLAG |"

        # Insert row after table separator, before "> Connect" line
        TMPF=$(mktemp)
        AFTER_SEPARATOR=false
        INSERTED=false
        while IFS= read -r line; do
            # Detect table separator
            if [[ "$line" == "|---"* ]] && [[ "$AFTER_SEPARATOR" == false ]]; then
                echo "$line" >> "$TMPF"
                AFTER_SEPARATOR=true
                continue
            fi
            # Insert before "> Connect" or blank line AFTER separator
            if [[ "$AFTER_SEPARATOR" == true ]] && [[ "$INSERTED" == false ]]; then
                if [[ "$line" == "> Connect"* ]] || [[ -z "$line" ]]; then
                    echo "$ROW" >> "$TMPF"
                    INSERTED=true
                    # Write the current line too
                    echo "$line" >> "$TMPF"
                    continue
                fi
            fi
            echo "$line" >> "$TMPF"
        done < "$LOCAL_FILE"

        if [[ "$INSERTED" == false ]]; then
            echo "$ROW" >> "$TMPF"
        fi

        mv "$TMPF" "$LOCAL_FILE"
        echo "ADDED=$NAME"
        echo "DEFAULT=$DEFAULT_FLAG"
        ;;

    update)
        NAME="${1:?update requires: name os kernel docker disk workdir}"
        OS="${2:-unknown}"
        KERNEL="${3:-unknown}"
        DOCKER="${4:-not installed}"
        DISK="${5:-unknown}"
        WORKDIR="${6:-/opt}"

        if [[ ! -f "$LOCAL_FILE" ]]; then
            echo "ERROR: $LOCAL_FILE not found"
            exit 1
        fi

        # Remove existing server details section
        SECTION_START="## Server: $NAME"
        if grep -q "$SECTION_START" "$LOCAL_FILE"; then
            TMPF=$(mktemp)
            IN_SECTION=false
            while IFS= read -r line; do
                if [[ "$line" == "$SECTION_START" ]]; then
                    IN_SECTION=true
                    continue
                fi
                if [[ "$IN_SECTION" == true ]] && [[ "$line" == "## "* ]]; then
                    IN_SECTION=false
                fi
                if [[ "$IN_SECTION" == false ]]; then
                    echo "$line" >> "$TMPF"
                fi
            done < "$LOCAL_FILE"
            mv "$TMPF" "$LOCAL_FILE"
        fi

        cat >> "$LOCAL_FILE" << HEREDOC

## Server: $NAME

| Property | Value |
|----------|-------|
| OS | $OS |
| Kernel | $KERNEL |
| Docker | $DOCKER |
| Data disk | $DISK |
| Working dir | $WORKDIR |
HEREDOC

        echo "UPDATED=$NAME"
        ;;

    list)
        if [[ ! -f "$LOCAL_FILE" ]]; then
            echo "NO_SERVERS"
            exit 0
        fi

        SERVERS=()
        DEFAULTS=()
        while IFS= read -r row; do
            name=$(get_field "$row" 2)
            default=$(get_field "$row" 7)
            [[ -z "$name" ]] && continue
            SERVERS+=("$name")
            DEFAULTS+=("$default")
        done < <(get_server_rows)

        if [[ ${#SERVERS[@]} -eq 0 ]]; then
            echo "NO_SERVERS"
        else
            echo "SERVER_COUNT=${#SERVERS[@]}"
            for i in "${!SERVERS[@]}"; do
                if [[ "${DEFAULTS[$i]}" == "*" ]]; then
                    echo "SERVER=${SERVERS[$i]} (default)"
                else
                    echo "SERVER=${SERVERS[$i]}"
                fi
            done
        fi
        ;;

    set-default)
        NAME="${1:?set-default requires: name}"

        if [[ ! -f "$LOCAL_FILE" ]]; then
            echo "ERROR: $LOCAL_FILE not found"
            exit 1
        fi

        if ! grep -q "| $NAME |" "$LOCAL_FILE"; then
            echo "ERROR: Server '$NAME' not found"
            exit 1
        fi

        # Rewrite: clear defaults in SSH Servers table, set new one
        TMPF=$(mktemp)
        IN_TABLE=false
        while IFS= read -r line; do
            if [[ "$line" == "| Name |"* ]]; then
                IN_TABLE=true
                echo "$line" >> "$TMPF"
                continue
            fi
            if [[ "$IN_TABLE" == true ]] && [[ "$line" == "|---"* ]]; then
                echo "$line" >> "$TMPF"
                continue
            fi
            if [[ "$IN_TABLE" == true ]] && [[ "$line" == "| "* ]]; then
                # Parse columns, rewrite Default field
                srv_name=$(get_field "$line" 2)
                srv_host=$(get_field "$line" 3)
                srv_user=$(get_field "$line" 4)
                srv_port=$(get_field "$line" 5)
                srv_key=$(get_field "$line" 6)
                if [[ "$srv_name" == "$NAME" ]]; then
                    echo "| $srv_name | $srv_host | $srv_user | $srv_port | $srv_key | * |" >> "$TMPF"
                else
                    echo "| $srv_name | $srv_host | $srv_user | $srv_port | $srv_key |  |" >> "$TMPF"
                fi
                continue
            fi
            if [[ "$IN_TABLE" == true ]]; then
                IN_TABLE=false
            fi
            echo "$line" >> "$TMPF"
        done < "$LOCAL_FILE"
        mv "$TMPF" "$LOCAL_FILE"

        echo "DEFAULT=$NAME"
        ;;

    *)
        echo "ERROR: Unknown subcommand '$SUBCMD'"
        echo "Usage: claude-local-ops.sh <read|add|update|list|set-default> [args...]"
        exit 1
        ;;
esac

#!/bin/bash
set -euo pipefail
# Detect SSH skill mode from arguments
# Usage: detect-mode.sh "$ARGUMENTS"
# Output: ARGS and MODE for parsing

ARGS="${1:-}"
# Trim whitespace
ARGS=$(echo "$ARGS" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
ARGS_LOWER=$(echo "$ARGS" | tr '[:upper:]' '[:lower:]')

echo "ARGS: [$ARGS]"

MODE=""

# Check keywords (order matters - first match wins)
if [[ "$ARGS_LOWER" =~ (set[[:space:]]*up|setup|new[[:space:]]+server|add[[:space:]]+server) ]]; then
    MODE="setup"
elif [[ "$ARGS_LOWER" =~ (connect\ to|ssh\ to|login\ to|connect) ]]; then
    MODE="connect"
elif [[ "$ARGS_LOWER" =~ (configure|config|harden) ]]; then
    MODE="configure"
elif [[ "$ARGS_LOWER" =~ (update\ agent|refresh\ agent|refresh) ]]; then
    MODE="update-agent"
elif [[ -z "$ARGS" ]]; then
    # No arguments - check if servers are configured
    if [[ -f "CLAUDE.local.md" ]] && grep -q "^|.*|.*|.*|.*|.*|" "CLAUDE.local.md" 2>/dev/null; then
        MODE="execute"
    else
        MODE="setup"
    fi
else
    # Has args but no keyword match - treat as execute (run command/task on server)
    MODE="execute"
fi

echo "MODE: $MODE"

#!/bin/bash
set -euo pipefail
# Discover remote server: OS, disks, Docker, services, users
# Usage: server-discover.sh "user@host" [port]
# Output: structured key=value pairs

CONNECTION="${1:?Usage: server-discover.sh user@host [port]}"
PORT="${2:-22}"

SSH_OPTS="-o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new -p $PORT"

# Fail-fast: verify connectivity before full discovery
if ! ssh $SSH_OPTS "$CONNECTION" true 2>/dev/null; then
    echo "ERROR: Cannot connect to $CONNECTION:$PORT (timeout or auth failure)" >&2
    exit 1
fi

echo "=== Server Discovery: $CONNECTION ==="

# Helper: run SSH command, return output or fallback
ssh_cmd() {
    local cmd="$1"
    local fallback="${2:-n/a}"
    local result
    result=$(ssh $SSH_OPTS "$CONNECTION" "$cmd" 2>/dev/null) || result="$fallback"
    echo "$result"
}

# OS info
echo "=== OS Info ==="
OS_PRETTY=$(ssh_cmd "cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d= -f2 | tr -d '\"'" "unknown")
echo "OS=$OS_PRETTY"

KERNEL=$(ssh_cmd "uname -r" "unknown")
echo "KERNEL=$KERNEL"

ARCH=$(ssh_cmd "uname -m" "unknown")
echo "ARCH=$ARCH"

HOSTNAME=$(ssh_cmd "hostname" "unknown")
echo "HOSTNAME=$HOSTNAME"

UPTIME=$(ssh_cmd "uptime -p 2>/dev/null || uptime" "unknown")
echo "UPTIME=$UPTIME"

# Memory
echo "=== Memory ==="
MEM_TOTAL=$(ssh_cmd "free -h 2>/dev/null | awk '/^Mem:/{print \$2}'" "unknown")
echo "MEM_TOTAL=$MEM_TOTAL"

MEM_USED=$(ssh_cmd "free -h 2>/dev/null | awk '/^Mem:/{print \$3}'" "unknown")
echo "MEM_USED=$MEM_USED"

# Disks
echo "=== Disks ==="
DISK_INFO=$(ssh_cmd "df -h --output=source,size,used,avail,pcent,target 2>/dev/null | grep -E '^/dev/' || df -h | grep -E '^/dev/'" "unknown")
echo "DISK_INFO<<EOF"
echo "$DISK_INFO"
echo "EOF"

# Docker
echo "=== Docker ==="
DOCKER_VERSION=$(ssh_cmd "docker version --format '{{.Server.Version}}' 2>/dev/null" "not_installed")
echo "DOCKER_VERSION=$DOCKER_VERSION"

DOCKER_COMPOSE=$(ssh_cmd "docker compose version --short 2>/dev/null || docker-compose --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+'" "not_installed")
echo "DOCKER_COMPOSE=$DOCKER_COMPOSE"

if [[ "$DOCKER_VERSION" != "not_installed" ]]; then
    RUNNING_CONTAINERS=$(ssh_cmd "docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}' 2>/dev/null" "none")
    echo "RUNNING_CONTAINERS<<EOF"
    echo "$RUNNING_CONTAINERS"
    echo "EOF"

    DOCKER_IMAGES=$(ssh_cmd "docker images --format '{{.Repository}}:{{.Tag}}\t{{.Size}}' 2>/dev/null | head -20" "none")
    echo "DOCKER_IMAGES<<EOF"
    echo "$DOCKER_IMAGES"
    echo "EOF"
else
    echo "RUNNING_CONTAINERS=n/a"
    echo "DOCKER_IMAGES=n/a"
fi

# Services (systemd)
echo "=== Services ==="
SERVICES=$(ssh_cmd "systemctl list-units --type=service --state=running --no-pager --no-legend 2>/dev/null | awk '{print \$1}' | head -30" "unknown")
echo "SERVICES<<EOF"
echo "$SERVICES"
echo "EOF"

# Listening ports
echo "=== Ports ==="
PORTS=$(ssh_cmd "ss -tlnp 2>/dev/null | tail -n +2 | head -20 || netstat -tlnp 2>/dev/null | tail -n +3 | head -20" "unknown")
echo "PORTS<<EOF"
echo "$PORTS"
echo "EOF"

# Current user info
echo "=== User ==="
CURRENT_USER=$(ssh_cmd "whoami" "unknown")
echo "CURRENT_USER=$CURRENT_USER"

USER_GROUPS=$(ssh_cmd "id" "unknown")
echo "USER_GROUPS=$USER_GROUPS"

SUDO_ACCESS=$(ssh_cmd "sudo -n true 2>/dev/null && echo 'yes' || echo 'no'" "unknown")
echo "SUDO_ACCESS=$SUDO_ACCESS"

# Common working directories
echo "=== Working Dirs ==="
for dir in /opt /srv /home /data /var/www; do
    EXISTS=$(ssh_cmd "test -d $dir && ls -la $dir 2>/dev/null | head -5" "not_found")
    if [[ "$EXISTS" != "not_found" ]]; then
        echo "DIR_${dir//\//_}=exists"
    fi
done

echo "=== Discovery Complete ==="

#!/bin/bash
set -euo pipefail
# Check SSH environment: keys, config, ssh-agent
# No args needed
# Output: structured key=value pairs

echo "=== SSH Environment Check ==="

# Check ~/.ssh/ directory
if [[ -d "$HOME/.ssh" ]]; then
    echo "SSH_DIR=exists"
    SSH_DIR_PERMS=$(stat -f "%Lp" "$HOME/.ssh" 2>/dev/null || stat -c "%a" "$HOME/.ssh" 2>/dev/null || echo "unknown")
    echo "SSH_DIR_PERMS=$SSH_DIR_PERMS"
else
    echo "SSH_DIR=missing"
    echo "SSH_DIR_PERMS=n/a"
    # Create with correct permissions
    mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
    echo "SSH_DIR_CREATED=true"
fi

# List available keys
echo "=== Available Keys ==="
ED25519_KEYS=()
RSA_KEYS=()
ECDSA_KEYS=()

for keyfile in "$HOME"/.ssh/id_*; do
    [[ -f "$keyfile" ]] || continue
    # Skip .pub files
    [[ "$keyfile" == *.pub ]] && continue

    basename_key=$(basename "$keyfile")
    if [[ "$basename_key" == id_ed25519* ]]; then
        ED25519_KEYS+=("$keyfile")
        echo "KEY_ED25519=$keyfile"
    elif [[ "$basename_key" == id_rsa* ]]; then
        RSA_KEYS+=("$keyfile")
        echo "KEY_RSA=$keyfile"
    elif [[ "$basename_key" == id_ecdsa* ]]; then
        ECDSA_KEYS+=("$keyfile")
        echo "KEY_ECDSA=$keyfile"
    fi
done

echo "ED25519_COUNT=${#ED25519_KEYS[@]}"
echo "RSA_COUNT=${#RSA_KEYS[@]}"
echo "ECDSA_COUNT=${#ECDSA_KEYS[@]}"
TOTAL_KEYS=$(( ${#ED25519_KEYS[@]} + ${#RSA_KEYS[@]} + ${#ECDSA_KEYS[@]} ))
echo "TOTAL_KEYS=$TOTAL_KEYS"

# Check ssh-agent
echo "=== SSH Agent ==="
if ssh-add -l &>/dev/null; then
    echo "SSH_AGENT=running"
    LOADED_KEYS=$(ssh-add -l 2>/dev/null | wc -l | tr -d ' ')
    echo "AGENT_KEYS_LOADED=$LOADED_KEYS"
elif [[ $? -eq 1 ]]; then
    # Agent running but no keys loaded
    echo "SSH_AGENT=running"
    echo "AGENT_KEYS_LOADED=0"
else
    echo "SSH_AGENT=not_running"
    echo "AGENT_KEYS_LOADED=0"
fi

# Check SSH config
echo "=== SSH Config ==="
if [[ -f "$HOME/.ssh/config" ]]; then
    echo "SSH_CONFIG=exists"
    HOST_COUNT=$(grep -c "^Host " "$HOME/.ssh/config" 2>/dev/null || echo "0")
    echo "SSH_CONFIG_HOSTS=$HOST_COUNT"
else
    echo "SSH_CONFIG=missing"
    echo "SSH_CONFIG_HOSTS=0"
fi

# Check known_hosts
echo "=== Known Hosts ==="
if [[ -f "$HOME/.ssh/known_hosts" ]]; then
    echo "KNOWN_HOSTS=exists"
    KH_COUNT=$(wc -l < "$HOME/.ssh/known_hosts" | tr -d ' ')
    echo "KNOWN_HOSTS_ENTRIES=$KH_COUNT"
else
    echo "KNOWN_HOSTS=missing"
    echo "KNOWN_HOSTS_ENTRIES=0"
fi

echo "=== Check Complete ==="

---
name: ssh-admin
model: opus
# description MUST be <=100 chars, single line
description: "SSH server admin with live inventory. Runs remote commands with safety classification."
allowed-tools: Read, Write, Edit, Bash, Grep, Glob, AskUserQuestion
---

# SSH Admin Agent

> Last updated: {{LAST_UPDATED}}

## Server Inventory

{{SERVER_INVENTORY}}

## Server Details

{{SERVER_DETAILS}}

## Instructions

You are an SSH server administration agent. Execute tasks on remote Linux servers using SSH.

### Connection

Use SSH config aliases when available. Connection format: `ssh ALIAS "command"`

If no alias, use: `ssh -o BatchMode=yes -o ConnectTimeout=15 -p PORT USER@HOST "command"`

### Safety Classification

Before executing any command, classify it:

| Level | Gate | Action |
|-------|------|--------|
| **READ** | free | Execute immediately |
| **CREATE** | free | Execute immediately |
| **MODIFY** | confirm | AskUserQuestion before executing |
| **SERVICE** | confirm | AskUserQuestion before executing |
| **DELETE** | always confirm | AskUserQuestion with explicit warning |
| **PRIVILEGE** | always confirm | AskUserQuestion with explicit warning |

**READ commands** (free): `ls`, `cat`, `head`, `tail`, `df`, `du`, `free`, `top`, `ps`, `docker ps`, `docker logs`, `systemctl status`, `journalctl`, `ip addr`, `ss`, `uname`

**CREATE commands** (free): `mkdir`, `touch`, `docker pull`, `docker network create`, `docker volume create`

**MODIFY commands** (confirm): `chmod`, `chown`, `sed -i`, `cp` (overwrite), `mv`, `systemctl enable/disable`, config edits

**SERVICE commands** (confirm): `systemctl restart/stop/start`, `docker compose up/down/restart`, `docker stop/start`, `nginx -s reload`

**DELETE commands** (always confirm): `rm`, `docker rm`, `docker rmi`, `docker volume rm`, `docker system prune`

**PRIVILEGE commands** (always confirm): `sudo`, `ufw`, `iptables`, `passwd`, `useradd`, `mount`

### Compound Rules

- `sudo` + any command = PRIVILEGE (overrides base level)
- Pipeline `cmd1 | cmd2` = highest of both
- `curl | bash` or `wget && chmod +x` = PRIVILEGE (arbitrary execution)

### Emergency Stop

If any command reveals:
- Wrong server (hostname mismatch)
- Production when expecting staging
- Root filesystem <5% free
- Unexpected critical services

**STOP immediately.** Report findings. Wait for user confirmation.

### Docker Operations

For Docker registry auth, ask user for credentials via AskUserQuestion. Never hardcode tokens.

```bash
# GHCR login
echo "$TOKEN" | ssh ALIAS "docker login ghcr.io -u USERNAME --password-stdin"

# DockerHub login
echo "$TOKEN" | ssh ALIAS "docker login -u USERNAME --password-stdin"
```

### Output Format

```markdown
## SSH Task Report

| Field | Value |
|-------|-------|
| Server | [name] ([host]) |
| Task | [description] |
| Commands | [N] executed |
| Classification | [highest level] |
| Status | success / partial / failed |

### Commands Executed

1. `[command]` -- [result]
2. `[command]` -- [result]

### Changes Made

- [change 1]
- [change 2]
```