Run every command on the build VM over SSH (M1.3)

execution.SSHHost.execute is now the only way the agent runs anything
(L13). Commands travel as a script on SSH's stdin, so the secrets handed
to a call are never on a command line, and every value handed out is
redacted from the output. Timeouts kill the remote process group, and
an unreachable host is reported as such, not as a failed command.

Workspace and GitRepo run on the build VM. The clone uses the
repository's SSH URL, so no credential is stored in it (#89); fetches
and pushes get the push key over stdin, in a short-lived ssh-agent,
and PRs are still opened from the agent's host with its API token.
The bench runs on the build host too.

Tests reach "the build VM" through a throwaway local sshd (nisse_dev
.testing); CI installs openssh-server. The live push test now pushes
with the sandbox's deploy key (NISSE_PUSH_KEY).

Fixes #89.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_tools.py

@@ -4,12 +4,13 @@ from pathlib import Path
 
 import pytest
 
+from nisse_dev.execution import REDACTED, SSHHost
 from nisse_dev.tools import EXECUTOR_TOOLS, MAX_OUTPUT_CHARS, Workspace
 
 
 @pytest.fixture
-def ws(tmp_path: Path) -> Workspace:
-    return Workspace(tmp_path / "work", timeout_s=10)
+def ws(ssh_host: SSHHost, tmp_path: Path) -> Workspace:
+    return Workspace(ssh_host, tmp_path / "work", timeout_s=10)
 
 
 def test_manifest_is_small_and_flat() -> None:
@@ -71,8 +72,8 @@ def test_command_runs_in_the_workspace(ws: Workspace) -> None:
     assert "marker.txt" in ws.run_command("ls").result
 
 
-def test_command_timeout_is_reported(tmp_path: Path) -> None:
-    ws = Workspace(tmp_path / "work", timeout_s=1)
+def test_command_timeout_is_reported(ssh_host: SSHHost, tmp_path: Path) -> None:
+    ws = Workspace(ssh_host, tmp_path / "work", timeout_s=1)
     outcome = ws.run_command("sleep 30")
     assert not outcome.success
     assert "timed out" in outcome.result
@@ -90,8 +91,10 @@ def _is_running(pid: int) -> bool:
     return stat.rsplit(")", 1)[1].split()[0] != "Z"
 
 
-def test_timeout_kills_the_whole_process_group(tmp_path: Path) -> None:
-    ws = Workspace(tmp_path / "work", timeout_s=1)
+def test_timeout_kills_the_whole_process_group(
+    ssh_host: SSHHost, tmp_path: Path
+) -> None:
+    ws = Workspace(ssh_host, tmp_path / "work", timeout_s=1)
     pidfile = ws.root / "child.pid"
     # A backgrounded grandchild must not outlive the timeout.
     ws.run_command(f"(sleep 30 & echo $! > {pidfile}); sleep 30")
@@ -156,3 +159,45 @@ def test_escaping_via_parent_traversal_is_refused(ws: Workspace) -> None:
 
 def test_describe_names_the_root(ws: Workspace) -> None:
     assert str(ws.root) in ws.describe()
+
+
+# --- on the build VM (L13) -----------------------------------------------------
+
+
+def test_project_secrets_reach_commands_and_are_redacted(
+    ssh_host: SSHHost, tmp_path: Path
+) -> None:
+    value = "tok-" + os.urandom(8).hex()
+    ws = Workspace(ssh_host, tmp_path / "work", secrets={"TEST_TOKEN": value})
+    outcome = ws.run_command('test -n "$TEST_TOKEN" && echo "token=$TEST_TOKEN"')
+    assert outcome.success  # the command had it
+    assert value not in outcome.result
+    assert f"token={REDACTED}" in outcome.result
+
+
+def test_an_unreachable_build_vm_is_a_failed_tool_call(tmp_path: Path) -> None:
+    ws = Workspace.__new__(Workspace)  # no host to create the root on
+    ws.host = SSHHost(
+        "127.0.0.1", key=tmp_path / "no-key", state_dir=tmp_path / "s", port=1
+    )
+    ws.root = tmp_path / "work"
+    ws._timeout_s, ws._max_output_chars, ws._secrets = 5, MAX_OUTPUT_CHARS, {}
+    outcome = ws.dispatch("run_command", {"command": "true"})
+    assert not outcome.success
+    assert "unreachable" in outcome.result
+
+
+def test_upload_tree_copies_a_directory_in(ws: Workspace, tmp_path: Path) -> None:
+    src = tmp_path / "seed"
+    (src / "pkg").mkdir(parents=True)
+    (src / "pkg" / "m.py").write_text("x = 1\n")
+    ws.upload_tree(src)
+    assert (ws.root / "pkg" / "m.py").read_text() == "x = 1\n"
+    ws.upload_tree(src, "copy")
+    assert (ws.root / "copy" / "pkg" / "m.py").exists()
+
+
+def test_non_text_files_read_as_a_failure(ws: Workspace) -> None:
+    (ws.root / "blob.bin").write_bytes(b"\xff\xfe\x00")
+    outcome = ws.read_file("blob.bin")
+    assert not outcome.success