sync: auto-sync from GURU-5070 at 2026-06-15 17:49:06

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-15 17:49:06

.claude/scripts/uos-mongo.sh

@@ -33,7 +33,32 @@ set -euo pipefail
 
 UOS_HOST="${UOS_HOST:-172.16.3.29}"
 UOS_SSH_USER="${UOS_SSH_USER:-root}"
-SSH=(ssh -o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new "${UOS_SSH_USER}@${UOS_HOST}")
+
+# Resolve the SSH key. Prefer $UOS_SSH_KEY; otherwise extract the vaulted dedicated
+# UOS key (infrastructure/uos-server-ssh-key, stored base64 in ssh-private-key-b64
+# because vault-helper can't store multiline) to a temp file so this works on ANY
+# fleet machine, not just one whose personal key happens to be authorized on .29.
+_uos_key=""
+if [ -n "${UOS_SSH_KEY:-}" ]; then
+    _uos_key="$UOS_SSH_KEY"
+else
+    _repo="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
+    _vault="$_repo/.claude/scripts/vault.sh"
+    if [ -f "$_vault" ]; then
+        _uos_key="$(mktemp "${TMPDIR:-/tmp}/uos-key.XXXXXX")"
+        bash "$_vault" get-field infrastructure/uos-server-ssh-key credentials.ssh-private-key-b64 2>/dev/null \
+            | tr -d '\r\n ' | base64 -d > "$_uos_key" 2>/dev/null
+        chmod 600 "$_uos_key" 2>/dev/null || true
+        trap '[ -z "${UOS_SSH_KEY:-}" ] && [ -n "$_uos_key" ] && rm -f "$_uos_key"' EXIT
+        [ -s "$_uos_key" ] || { rm -f "$_uos_key"; _uos_key=""; }   # fall back to default key
+    fi
+fi
+
+if [ -n "$_uos_key" ]; then
+    SSH=(ssh -o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes -i "$_uos_key" "${UOS_SSH_USER}@${UOS_HOST}")
+else
+    SSH=(ssh -o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new "${UOS_SSH_USER}@${UOS_HOST}")
+fi
 REMOTE='su - uosserver -c "XDG_RUNTIME_DIR=/run/user/1000 podman exec -i uosserver mongo --quiet --port 27117 ace"'
 
 run_js() { "${SSH[@]}" "$REMOTE"; }   # reads Mongo JS from this function's stdin