expect-pty 0.5.3 → 0.7.1

data/test/edge_case_test.rb

@@ -1,262 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "test_helper"
-require "open3"
-
-class EdgeCaseTest < ExpectTest
-  def test_zero_width_continuation_observes_original_deadline
-    session, = pipe_session
-    session.buffer = "ready"
-    result = bounded(1) do
-      session.expect_result(timeout: 0.01) { on(/(?=ready)/) { Expect.continue(reset_timeout: false) } }
-    end
-    assert result.timeout?
-  end
-
-  def test_zero_width_continuation_waits_for_new_input_before_matching_again
-    session, = pipe_session
-    session.buffer = "ready"
-    calls = 0
-
-    result = bounded(1) do
-      session.expect_result(timeout: 0.01) do
-        on(/(?=ready)/) do
-          calls += 1
-          Expect.continue
-        end
-      end
-    end
-
-    assert result.timeout?
-    assert_equal 1, calls
-  end
-
-  def test_stalled_pattern_can_match_again_after_new_input
-    session, writer = pipe_session
-    session.buffer = "ready"
-    first_match = Queue.new
-    background do
-      first_match.pop
-      writer.write("!")
-    end
-    calls = 0
-
-    result = bounded(1) do
-      session.expect_result(timeout: 0.5) do
-        on(/(?=ready)/) do
-          calls += 1
-          first_match << true if calls == 1
-          calls == 1 ? Expect.continue : nil
-        end
-      end
-    end
-
-    assert result.matched?
-    assert_equal 2, calls
-    assert_equal "ready!", session.buffer
-  end
-
-  def test_stalled_pattern_can_match_again_after_timeout_callback_changes_buffer
-    session, = pipe_session
-    session.buffer = "ready"
-    calls = 0
-    timeouts = 0
-
-    result = bounded(1) do
-      session.expect_result(timeout: 0.01) do
-        on(/(?=ready)/) do
-          calls += 1
-          calls == 1 ? Expect.continue : nil
-        end
-        timeout do
-          timeouts += 1
-          session.buffer = "ready!"
-          timeouts == 1 ? Expect.continue : nil
-        end
-      end
-    end
-
-    assert result.matched?
-    assert_equal 2, calls
-    assert_equal 1, timeouts
-  end
-
-  def test_stdout_works_with_utf8_banner_and_ascii_regexp
-    session, writer = pipe_session
-    writer.write("欢迎登录\nprompt>")
-    assert_equal 1, session.expect(/prompt>/, timeout: 1)
-    assert_equal "欢迎登录\n".b, session.before
-  end
-
-  def test_invalid_fixed_encoding_regexp_data_raises
-    session, = pipe_session
-    session.buffer = "\xffinvalid".b
-    assert_raises(EncodingError) { session.expect(/中文/, timeout: 0) }
-  end
-
-  def test_replacing_log_with_invalid_target_preserves_current_log
-    session, = pipe_session
-    log = StringIO.new
-    session.log_to(log)
-    assert_raises(ArgumentError) { session.log_to(42) }
-    assert_same log, session.log_output
-    session.write_log("still open")
-    assert_equal "still open", log.string
-  end
-
-  def test_new_session_predicates_use_ruby_truthiness
-    Expect.configure(raw_pty: 0, log_stdout: nil)
-    session = Expect.new
-    @sessions << session
-    assert session.raw_pty?
-    refute session.log_stdout?
-  end
-
-  def test_read_only_regular_file
-    Tempfile.create("expect-input") do |file|
-      file.write("first\nsecond\n")
-      file.rewind
-      Expect.open(file) do |session|
-        assert_equal 1, session.expect(/^second$/, timeout: 0)
-        assert_equal "first\n", session.before
-        assert session.expect_result(:eof, timeout: 1).eof?
-      end
-      refute file.closed?
-    end
-  end
-
-  def test_existing_pty_eio_is_eof
-    master, slave = PTY.open
-    @ios.push(master, slave)
-    session = Expect.open(master)
-    @sessions << session
-    slave.write("end")
-    slave.flush
-    assert_equal 1, session.expect("end", timeout: 1)
-    slave.close
-    assert bounded { session.expect_result(:eof, timeout: 1) }.eof?
-  end
-
-  def test_distinct_reader_writer_io
-    incoming, producer = IO.pipe
-    consumer, outgoing = IO.pipe
-    @ios.push(incoming, producer, consumer, outgoing)
-    session = Expect.open(incoming, writer: outgoing)
-    @sessions << session
-    producer.write("ready")
-    assert_equal 1, session.expect("ready", timeout: 1)
-    assert_equal 3, session.write("abc")
-    assert_equal "abc", consumer.read(3)
-    session.close
-    refute incoming.closed?
-    refute outgoing.closed?
-  end
-
-  def test_control_character_delivers_signal_to_foreground_child
-    session = child('Signal.trap("INT") { puts "interrupted"; exit 0 }; puts "ready"; sleep 30')
-    session.expect("ready", timeout: 2)
-    session.write("\x03")
-    assert_equal 1, session.expect("interrupted", timeout: 2)
-    assert_equal 0, session.wait(timeout: 1).exitstatus
-  end
-
-  def test_multiple_real_pty_processes
-    first = child('puts "one"')
-    second = child('STDIN.gets; puts "two"', raw_pty: true)
-    seen = []
-    record_session = lambda do |session|
-      seen << session
-      Expect.continue(reset_timeout: false)
-    end
-    result = Expect.expect_result(timeout: 2) do
-      on(/one/, from: first, &record_session)
-      eof(from: first) do
-        # 明确建立两个进程的顺序，不能通过 sleep 推断启动和输出的先后。
-        second.puts("continue")
-        Expect.continue(reset_timeout: false)
-      end
-      on("two", from: second)
-    end
-    assert_equal [first], seen
-    assert_same second, result.session
-    assert_equal 3, result.number
-  end
-
-  def test_signal_interruption_preserves_deadline
-    session, writer = pipe_session
-    old_handler = Signal.trap("USR1") { nil }
-    background do
-      4.times do
-        sleep 0.01
-        Process.kill("USR1", Process.pid)
-      end
-      writer.write("ready")
-    end
-    assert_equal(1, bounded { session.expect("ready", timeout: 1) })
-  ensure
-    Signal.trap("USR1", old_handler) if old_handler
-  end
-
-  def test_gc_reclaims_abandoned_child
-    assert_gc_reclaims_abandoned_child
-  end
-
-  def test_gc_reclaims_abandoned_child_with_log_callback_capturing_session
-    assert_gc_reclaims_abandoned_child(log_callback: true)
-  end
-
-  def test_invalid_options_raise_before_spawning
-    assert_raises(ArgumentError) { Expect.new(typo: true) }
-    session, = pipe_session
-    assert_raises(ArgumentError) { session.expect(0, "x") }
-    assert_raises(ArgumentError) { session.expect(["-unknown", "x"], timeout: 0) }
-    assert_raises(ArgumentError) { session.on_sequence("") }
-  end
-
-  def test_entrypoint_can_coexist_with_standard_library_expect
-    entrypoint = File.expand_path("../lib/expect/pty.rb", __dir__)
-    script = <<~RUBY
-      require "rbconfig"
-      require File.join(RbConfig::CONFIG.fetch("rubylibdir"), "expect.rb")
-      require ARGV.fetch(0)
-      puts [IO.method_defined?(:expect), defined?(Expect), Expect::VERSION].join(":")
-    RUBY
-    environment = { "RUBYOPT" => nil, "RUBYLIB" => nil, "BUNDLE_GEMFILE" => nil }
-    output, status = Open3.capture2e(environment, RbConfig.ruby, "-e", script, entrypoint)
-    assert status.success?, output
-    assert_equal "true:constant:#{Expect::VERSION}\n", output
-  end
-
-  private
-
-  def assert_gc_reclaims_abandoned_child(log_callback: false)
-    script = <<~RUBY
-      require "expect"
-      require "rbconfig"
-      def abandoned
-        session = Expect.spawn(RbConfig.ruby, "--disable-gems", "-e", "sleep 60", log_stdout: false)
-        session.log_to { |bytes| [session.pid, bytes] } if #{log_callback}
-        session.pid
-      end
-      # Ruby 的保守 GC 可能扫描到创建线程栈上残留的引用；先结束该线程，确保会话确实不可达。
-      pid = Thread.new { abandoned }.value
-      20.times do
-        GC.start
-        sleep 0.02
-        begin
-          Process.kill(0, pid)
-        rescue Errno::ESRCH
-          puts "reaped"
-          exit 0
-        end
-      end
-      Process.kill("KILL", pid) rescue nil
-      Process.waitpid(pid) rescue nil
-      abort "abandoned child survived GC"
-    RUBY
-    output, status = Open3.capture2e(RbConfig.ruby, "--disable-gems", "-I", File.expand_path("../lib", __dir__), "-e",
-                                     script)
-    assert status.success?, output
-    assert_equal "reaped\n", output
-  end
-end

data/test/fixtures/ssh_scripts/01_identity.sh

@@ -1,4 +0,0 @@
-set -eu
-printf 'USER=%s\n' "$(id -un)"
-printf 'TTY=%s\n' "$(tty)"
-printf 'IDENTITY_OK\n'

data/test/fixtures/ssh_scripts/02_output.sh

@@ -1,5 +0,0 @@
-set -eu
-printf 'STDOUT_FIRST\n'
-printf 'STDERR_SECOND\n' >&2
-printf '中文输出：日志验证\n'
-printf 'STDOUT_LAST\n'

data/test/fixtures/ssh_scripts/03_delayed.sh

@@ -1,6 +0,0 @@
-set -eu
-printf 'DELAY_BEGIN\n'
-sleep 0.1
-printf 'DELAY_MIDDLE\n'
-sleep 0.1
-printf 'DELAY_END\n'

data/test/fixtures/ssh_scripts/04_failure.sh

@@ -1,2 +0,0 @@
-printf 'EXPECTED_FAILURE\n' >&2
-exit 7

data/test/fixtures/ssh_scripts/05_recovery.sh

@@ -1,3 +0,0 @@
-set -eu
-printf 'RECOVERY_OK\n'
-printf 'VALUE=%s\n' "$((20 + 22))"

data/test/initialization_failure_test.rb

@@ -1,92 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "test_helper"
-require "minitest/mock"
-
-class InitializationFailureTest < ExpectTest
-  def test_new_closes_both_pty_ends_before_propagating_the_original_exception
-    initialization_errors.each do |failure|
-      master, slave = PTY.open
-      @ios.push(master, slave)
-      PTY.stub(:open, [master, slave]) do
-        without_ledger(failure) do
-          assert_same failure, assert_raises(failure.class) { Expect.new }
-          assert master.closed?, "master leaked before test cleanup"
-          assert slave.closed?, "slave leaked before test cleanup"
-        end
-      end
-    end
-  end
-
-  def test_open_cleans_owned_handles_and_preserves_borrowed_handles
-    [true, false].product(initialization_errors).each do |own, failure|
-      reader, writer = IO.pipe
-      @ios.push(reader, writer)
-      without_ledger(failure) do
-        assert_same failure, assert_raises(failure.class) { Expect.open(reader, writer: writer, own: own) }
-        assert_equal own, reader.closed?
-        assert_equal own, writer.closed?
-      end
-    end
-  end
-
-  def test_duplicate_owned_handle_is_attempted_once_even_when_close_fails
-    reader, writer = IO.pipe
-    @ios.push(reader, writer)
-    calls = 0
-    reader.stub(:close, lambda {
-      calls += 1
-      raise IOError, "injected close failure"
-    }) do
-      without_ledger(failure = Interrupt.new) do
-        assert_same failure, assert_raises(Interrupt) { Expect.open(reader, own: true) }
-        assert_equal 1, calls
-      end
-    end
-  end
-
-  def test_cleanup_failure_still_attempts_other_handles_and_keeps_primary_exception
-    initialization_errors.each do |failure|
-      reader, writer = IO.pipe
-      @ios.push(reader, writer)
-      reader.stub(:close, -> { raise Errno::EIO }) do
-        without_ledger(failure) do
-          assert_same failure, assert_raises(failure.class) { Expect.open(reader, writer: writer, own: true) }
-          assert writer.closed?
-        end
-      end
-    end
-  end
-
-  def test_new_cleanup_failure_still_closes_slave
-    master, slave = PTY.open
-    @ios.push(master, slave)
-    PTY.stub(:open, [master, slave]) do
-      master.stub(:close, -> { raise IOError, "injected close failure" }) do
-        without_ledger(failure = SystemExit.new(17)) do
-          assert_same failure, assert_raises(SystemExit) { Expect.new }
-          assert slave.closed?
-        end
-      end
-    end
-  end
-
-  def test_invalid_non_io_argument_is_not_closed_by_the_fallback
-    reader, writer = IO.pipe
-    @ios.push(reader, writer)
-    invalid = Object.new
-    invalid.define_singleton_method(:close) { raise "must not close non-IO objects" }
-    without_ledger(failure = Interrupt.new) do
-      assert_same failure, assert_raises(Interrupt) { Expect.open(invalid, writer: writer, own: true) }
-      assert writer.closed?
-    end
-  end
-
-  private
-
-  def initialization_errors = [Interrupt.new("injected initialization interruption"), SystemExit.new(17)]
-
-  def without_ledger(failure, &)
-    Expect::SessionResources.stub(:new, ->(*, **) { raise failure }, &)
-  end
-end

data/test/integration/README.md

@@ -1,109 +0,0 @@
-# SSH 多脚本和日志验证
-
-在仓库根目录运行，要求 Ruby 3.2+、SSH 服务，以及能运行 POSIX `/bin/sh` 的目标账户：
-
-```sh
-SSH_HOST=127.0.0.1 SSH_USER=crate ruby test/integration/ssh_scripts.rb
-# 也可以通过 Rake：
-SSH_HOST=127.0.0.1 SSH_USER=crate bundle exec rake test:ssh
-```
-
-脚本隐藏读取密码；也支持由运行环境提供 `EXPECT_PASSWORD`。密码不会作为 SSH 命令行参数传递，日志在认证完成后才开启。默认自动测试不连接
-SSH、不读取密码。
-
-支持 `SSH_PORT`（默认 22）、`EXPECT_LOG_DIR`（日志根目录）、`SSH_KNOWN_HOSTS`。连接非本机主机时，必须提供已有的受信任
-known_hosts，例如：
-
-```sh
-SSH_HOST=192.0.2.10 SSH_USER=operator SSH_PORT=22 \
-  SSH_KNOWN_HOSTS="$HOME/.ssh/known_hosts" \
-  EXPECT_LOG_DIR=tmp/device-check ruby test/integration/ssh_scripts.rb
-```
-
-这是 POSIX shell 脚本测试；厂商专用 CLI（如交换机的 `show` 命令、分页提示符）需要对应设备的命令和预期输出，不能直接使用这些
-shell fixtures。
-
-## 同一个登录会话执行的脚本
-
-| 脚本             | 验证内容                              | 预期退出码    |
-|------------------|---------------------------------------|---------------|
-| `01_identity.sh` | 当前用户、远端 PTY、完成标记          | 0             |
-| `02_output.sh`   | stdout、stderr、中文和输出顺序        | 0             |
-| `03_delayed.sh`  | 分三次延迟输出，确保日志完整          | 0             |
-| `04_failure.sh`  | 明确输出错误并退出                    | 7（预期失败） |
-| `05_recovery.sh` | 上个脚本失败后继续执行，计算结果为 42 | 0             |
-
-fixtures 位于 `test/fixtures/ssh_scripts/`，都不修改目标文件或设备配置。文件内容通过 SSH 的交互 shell 传给独立
-`/bin/sh -c` 执行，不需要上传文件。每个脚本都有随机开始/结束标记，结束标记携带真实 `$?`；脚本输出和退出码都必须符合预期才算通过。
-
-测试关闭终端回显和 shell 行编辑，使用单引号传输完整脚本，保留中文 UTF-8 和引号，避免 C locale 的交互式 readline
-把高位字节当快捷键执行。末尾仍等待 shell 提示符，确认可以继续执行下一项。
-
-另外执行两条日志控制命令：关闭日志后输出 `UNLOGGED_OUTPUT`，再以默认追加模式开启日志并输出 `APPEND_OK`。最后发送延迟输出及退出命令，只调用
-`soft_close`，确认 `SESSION_FINAL_TAIL` 确实在关闭过程中写入日志。
-
-## 检查和输出文件
-
-每次执行在 `tmp/ssh-logs/` 下创建独立目录，目录权限 0700，文件权限 0600：
-
-- `session.log`：收到的原始数据，以及手工添加的 `[SEND] 脚本名 sha256=...` 和 `[EXIT] 脚本名 status=...`。
-- `report.json`：主机、用户、远端 TTY、每项脚本输出和退出码、校验结果、SSH 退出码、日志字节数及 SHA-256。
-
-只有认证后的输出进入日志。Expect 自动记录接收字节，发送的脚本名称和摘要由 `write_log` 明确写入，便于审核执行了哪个
-fixture；fixture 文件中的原文可以用报告内的 SHA-256 核对。
-
-共 11 项日志/流程检查：完整输出、执行顺序、即时
-flush、stdout/stderr、UTF-8、非零退出后恢复、覆盖模式、暂停记录、追加模式、关闭前尾部输出、密码不出现在日志中。另校验日志条目没有重复，日志句柄在停止记录和关闭会话后正确关闭。
-
-成功返回进程退出码 0。认证失败、超时、脚本输出错误、意外退出码或日志校验失败均返回非零，并在有报告目录时留下 `passed: false`
-的报告。不用仅看到终端输出就判断成功；请查看最终 PASS 和 `report.json` 的 `passed`。
-
-## 无需 SSH 的回归测试
-
-```sh
-bundle exec ruby -Itest test/script_logging_test.rb
-bundle exec rake test
-```
-
-`test/script_logging_test.rb` 使用真实本地 PTY 执行相同 fixtures，另外验证回调日志、借用 File 日志、错误退出/错误输出的反例、引号和
-shell 元字符、日志错误上抛，以及超时后继续收集日志。它和 SSH 脚本共享测试 helper，不依赖远端账户。
-
-## SSH interact 人工和自动验证
-
-```sh
-ruby examples/ssh_interact.rb
-ruby examples/ssh_interact.rb --auto
-# 自动方式也可通过 Rake 运行
-bundle exec rake test:ssh_interact
-```
-
-使用上述同一套 SSH 环境变量和隐藏密码输入。人工模式显示 `EXPECT_SCRIPT_PROMPT>`；输入命令有回显，Ctrl-C 传给远端前台任务。在命令结束、回到
-shell 提示符后按 Ctrl-]，会关闭远端回显，执行 `MANUAL_AUTOMATION_RESUMED` 检查，再正常退出 SSH。也支持直接输入 `exit`：成功退出记为
-`completion: remote_exit`，此路径不执行返回 expect 的检查。非零 SSH 退出仍判为失败。
-
-`--auto` 创建真实本地 PTY，验证两次 `interact` 接管、当前用户和远端 TTY、stdout/stderr/中文、Ctrl-C、Ctrl-]、转义后的本地尾部不进入
-SSH、恢复 `expect` 及终端与监听设置。4 项命令输出和 13 项交互/日志检查全部通过后才返回 0。
-
-日志在认证之后开启；每次在 `tmp/ssh-interact/` 新建 0700 目录，保存 0600 的 `session.log` 和 `report.json`
-。报告包含检查项、命令输出、SSH 退出码及日志摘要。自动模式也校验日志无重复、退出尾部不丢失、密码不出现在日志中。
-
-无需 SSH 的回归位于 `test/interact_test.rb`，覆盖可见输入、Ctrl-C、两次接管、返回自动命令、超时、两端 EOF、回调异常和输出 IO
-故障时的终端恢复。`test/script_logging_test.rb` 另验证 CRLF 输出边界，包括空输出、末尾有/无换行和多个换行。
-
-## `ssh_auto.rb` 环境检查
-
-```sh
-ruby examples/ssh_auto.rb
-# 无人值守执行（密码可以由运行环境提供 EXPECT_PASSWORD）
-ruby examples/ssh_auto.rb --no-interact
-# 或执行 Rake 的自动退出入口
-bundle exec rake test:ssh_auto
-```
-
-该示例自动登录 `SSH_HOST`（默认 `127.0.0.1`），用本库的 `write` / `expect` 顺序执行文件顶部的 `COMMANDS`，显示真实输出并检查退出码。默认命令为
-`id`、`uname -srm`、`sw_vers`、`df -h /` 和 `uptime`，不修改系统设置；可直接修改数组来下发其他 macOS/POSIX shell 命令。它不依赖
-`test/support`，`ScriptProbe.check` 只供测试脚本使用。
-
-执行成功后默认进入 `interact`，输入有回显，Ctrl-C 发给远端前台任务；`exit` 或 Ctrl-] 结束连接。使用 `--no-interact` 则执行完退出。
-`EXPECT_LOG_DIR` 可指定日志目录，默认 `tmp/ssh-auto/`；每次创建独立 0600 日志，记录命令和远端输出，认证前关闭日志。此使用示例不生成
-JSON 测试报告，详细日志断言仍由 `ssh_scripts.rb` 和 `ssh_interact.rb --auto` 验证。

data/test/integration/ssh_scripts.rb

@@ -1,94 +0,0 @@
-# frozen_string_literal: true
-
-# Opt-in: this script makes a real SSH connection. The default rake test does
-# not load it, and no password belongs in fixture files or command arguments.
-require "io/console"
-require "json"
-require "fileutils"
-require "tmpdir"
-require "time"
-require_relative "../support/script_probe"
-
-host = ENV.fetch("SSH_HOST", "127.0.0.1")
-user = ENV.fetch("SSH_USER", ENV.fetch("USER", "crate"))
-port = Integer(ENV.fetch("SSH_PORT", "22"), 10)
-ScriptProbe.check((1..65_535).cover?(port), "SSH_PORT must be between 1 and 65535")
-ScriptProbe.check([host, user].none? do |value|
-  value.empty? || value.start_with?("-") || value.match?(/[\s\x00]/)
-end, "invalid SSH host or user")
-known_hosts = ENV.fetch("SSH_KNOWN_HOSTS", nil)
-ScriptProbe.check(known_hosts || %w[127.0.0.1 ::1 localhost].include?(host),
-                  "SSH_KNOWN_HOSTS is required for remote hosts")
-
-password = ENV.delete("EXPECT_PASSWORD")&.dup
-unless password
-  $stderr.print("SSH password: ")
-  password = ($stdin.tty? ? $stdin.noecho(&:gets) : $stdin.gets)&.chomp
-  $stderr.puts
-end
-ScriptProbe.check(password && !password.empty? && !password.match?(/[\r\n\x00]/), "a single-line password is required")
-
-base = File.expand_path(ENV.fetch("EXPECT_LOG_DIR", File.expand_path("../../tmp/ssh-logs", __dir__)))
-FileUtils.mkdir_p(base)
-directory = Dir.mktmpdir("#{Time.now.utc.strftime("%Y%m%dT%H%M%SZ")}-", base)
-log_path = File.join(directory, "session.log")
-report_path = File.join(directory, "report.json")
-report = { host: host, port: port, user: user, started_at: Time.now.utc.iso8601, passed: false }
-runner = nil
-session = nil
-
-begin
-  Dir.mktmpdir("expect-known-hosts-") do |temporary|
-    policy = known_hosts ? "yes" : "accept-new"
-    hosts_path = known_hosts || File.join(temporary, "known_hosts")
-    args = ["ssh", "-F", "/dev/null", "-tt", "-p", port.to_s,
-            "-o", "ConnectTimeout=5", "-o", "NumberOfPasswordPrompts=1",
-            "-o", "PreferredAuthentications=password", "-o", "PubkeyAuthentication=no",
-            "-o", "StrictHostKeyChecking=#{policy}", "-o", "UserKnownHostsFile=#{hosts_path}",
-            "-l", user, host, "env ENV= PS1=#{Shellwords.escape(ScriptProbe::PROMPT)} /bin/sh -i"]
-    # Authentication is completed before opening any log. Parent defaults
-    # cannot accidentally turn on debug or console logging for this check.
-    session = Expect.spawn(*args, raw_pty: true, log_stdout: false, log_listeners: false,
-                                  debug_level: 0, write_timeout: 5)
-    authentication = session.expect_result(/password:\s*\z/i, /Permission denied/i, timeout: 10)
-    ScriptProbe.check(authentication.number == 1,
-                      "SSH password prompt not received (#{authentication.error || "authentication rejected"})")
-    session.write(password, "\n")
-    runner = ScriptProbe::Runner.new(session, timeout: 10).ready!
-    report.merge!(ScriptProbe.verify_file_session(runner, log_path, user: user))
-    report[:ssh_exit_code] = session.exit_code
-    ScriptProbe.check(!File.binread(log_path).include?(password.b), "password detected in session log")
-    report[:checks] << "password_absent"
-    report[:passed] = true
-  end
-rescue StandardError => error
-  # Error messages identify the failed check; raw authentication output is
-  # deliberately excluded from both the report and the console.
-  report[:error] = "#{error.class}: #{error.message}".gsub(password, "[REDACTED]")
-  report[:cases] ||= runner&.results || []
-ensure
-  session&.close
-  if File.file?(log_path)
-    bytes = File.binread(log_path)
-    if bytes.include?(password.b)
-      File.binwrite(log_path, bytes.gsub(password.b, "[REDACTED]"))
-      report[:passed] = false
-      report[:error] = "password detected and removed from log"
-    end
-    report[:log_sha256] = Digest::SHA256.file(log_path).hexdigest
-    report[:log_bytes] = File.size(log_path)
-  end
-  password.replace("\0" * password.bytesize)
-  report[:finished_at] = Time.now.utc.iso8601
-  report[:log_path] = log_path
-  File.open(report_path, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(JSON.pretty_generate(report)) }
-end
-
-report.fetch(:cases, []).each do |result|
-  puts "#{result[:passed] ? "PASS" : "FAIL"} #{result[:name]} " \
-       "exit=#{result[:status]} expected=#{result[:expected_status]}"
-end
-puts "Log: #{log_path}"
-puts "Report: #{report_path}"
-abort(report[:error]) unless report[:passed]
-puts "PASS SSH multi-script execution and #{report[:checks].length} logging checks; SSH exit=0"