feat: add dynamic per-call SSH connections and secret redaction

- execute-command/upload/download accept host/port/username/password inline
  to open an ephemeral connection for a single call
- add redactSecret/redactSecrets to mask credentials in logs and errors
- logger log()/handleError() accept optional secrets[] for redaction
- add SSH_CONFIG_MISSING error code and --password-from-env CLI flag
- dynamic-mode startup: server runs with no static config

scripts/build.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+
+import { execSync } from "node:child_process";
+import { chmodSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const rootDir = join(__dirname, "..");
+const buildFile = join(rootDir, "build", "index.js");
+
+// Run TypeScript compiler
+console.log("Building TypeScript...");
+execSync("tsc", { stdio: "inherit", cwd: rootDir });
+
+// Make executable on Unix-like systems (Linux, macOS, etc.)
+if (process.platform !== "win32") {
+  try {
+    chmodSync(buildFile, 0o755);
+    console.log("Made build/index.js executable");
+  } catch (error) {
+    console.warn(
+      "Warning: Could not set executable permissions:",
+      error.message
+    );
+  }
+} else {
+  console.log("Skipping chmod on Windows");
+}
+
+console.log("Build complete!");

scripts/run-tests.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+
+/**
+ * 测试运行器
+ * 使用 Node.js 内置的测试框架运行所有测试
+ */
+
+import { execSync } from 'child_process';
+
+console.log('🧪 运行测试...\n');
+
+try {
+  execSync('node scripts/build.js', {
+    stdio: 'inherit',
+    cwd: new URL('..', import.meta.url).pathname
+  });
+  execSync('node --test test/**/*.test.js', {
+    stdio: 'inherit',
+    cwd: new URL('..', import.meta.url).pathname
+  });
+} catch (err) {
+  process.exit(1);
+}