Add validate, status tools and local transport

config/config.go

@@ -48,6 +48,7 @@ type AutoConnectConfig struct {
 	User         string
 	Port         int
 	IdentityFile string
+	Transport    string
 }
 
 // Config for ShellGuard. Pointer fields; nil = unset.
@@ -218,6 +219,9 @@ func (c *Config) applyEnvOverrides() error {
 		if v, ok := os.LookupEnv("SHELLGUARD_IDENTITY_FILE"); ok {
 			ac.IdentityFile = v
 		}
+		if v, ok := os.LookupEnv("SHELLGUARD_TRANSPORT"); ok {
+			ac.Transport = v
+		}
 		c.AutoConnect = ac
 	}
 

server/local.go

@@ -0,0 +1,78 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os/exec"
+	"time"
+
+	"github.com/fawdyinc/shellguard/ssh"
+)
+
+// LocalExecutor runs commands on the local machine.
+type LocalExecutor struct{}
+
+// NewLocalExecutor returns a new LocalExecutor.
+func NewLocalExecutor() *LocalExecutor {
+	return &LocalExecutor{}
+}
+
+func (l *LocalExecutor) Connect(_ context.Context, _ ssh.ConnectionParams) error {
+	return nil
+}
+
+func (l *LocalExecutor) Execute(ctx context.Context, _, command string, timeout time.Duration) (ssh.ExecResult, error) {
+	return l.run(ctx, command, timeout)
+}
+
+func (l *LocalExecutor) ExecuteRaw(ctx context.Context, _, command string, timeout time.Duration) (ssh.ExecResult, error) {
+	return l.run(ctx, command, timeout)
+}
+
+func (l *LocalExecutor) SFTPSession(_ string) (ssh.SFTPClient, error) {
+	return nil, errors.New("SFTP is not supported for local transport")
+}
+
+func (l *LocalExecutor) Disconnect(_ context.Context, _ string) error {
+	return nil
+}
+
+func (l *LocalExecutor) run(ctx context.Context, command string, timeout time.Duration) (ssh.ExecResult, error) {
+	if timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, timeout)
+		defer cancel()
+	}
+
+	start := time.Now()
+	cmd := exec.CommandContext(ctx, "sh", "-c", command)
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	runtimeMs := int(time.Since(start).Milliseconds())
+
+	if ctx.Err() != nil {
+		return ssh.ExecResult{}, ctx.Err()
+	}
+
+	exitCode := 0
+	if err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			exitCode = exitErr.ExitCode()
+		} else {
+			return ssh.ExecResult{}, err
+		}
+	}
+
+	return ssh.ExecResult{
+		Stdout:    stdout.String(),
+		Stderr:    stderr.String(),
+		ExitCode:  exitCode,
+		RuntimeMs: runtimeMs,
+	}, nil
+}

server/local_test.go

@@ -0,0 +1,60 @@
+package server
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestLocalExecutor_Execute_Success(t *testing.T) {
+	exec := NewLocalExecutor()
+	res, err := exec.Execute(context.Background(), "", "echo hello", 5*time.Second)
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if got := strings.TrimSpace(res.Stdout); got != "hello" {
+		t.Fatalf("stdout = %q, want %q", got, "hello")
+	}
+	if res.ExitCode != 0 {
+		t.Fatalf("exit code = %d, want 0", res.ExitCode)
+	}
+}
+
+func TestLocalExecutor_Execute_NonZeroExit(t *testing.T) {
+	exec := NewLocalExecutor()
+	res, err := exec.Execute(context.Background(), "", "false", 5*time.Second)
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if res.ExitCode == 0 {
+		t.Fatal("expected non-zero exit code")
+	}
+}
+
+func TestLocalExecutor_Execute_Stderr(t *testing.T) {
+	exec := NewLocalExecutor()
+	res, err := exec.Execute(context.Background(), "", "echo err >&2", 5*time.Second)
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if got := strings.TrimSpace(res.Stderr); got != "err" {
+		t.Fatalf("stderr = %q, want %q", got, "err")
+	}
+}
+
+func TestLocalExecutor_Execute_Timeout(t *testing.T) {
+	exec := NewLocalExecutor()
+	_, err := exec.Execute(context.Background(), "", "sleep 10", 100*time.Millisecond)
+	if err == nil {
+		t.Fatal("expected timeout error")
+	}
+}
+
+func TestLocalExecutor_SFTPSession_Error(t *testing.T) {
+	exec := NewLocalExecutor()
+	_, err := exec.SFTPSession("any")
+	if err == nil {
+		t.Fatal("expected error from SFTPSession")
+	}
+}