net-connector 0.18.0 → 0.19.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c8e0db79f9b795cc321cb29571f62e0abd559273b7d09c7598be25eb4141c27
-  data.tar.gz: b96f4f50c83bbc8f94a16b43afcd62eae341380342ce975640e03ddabf42132c
+  metadata.gz: fe3f1f3bc71cf02e0007ec892699ea03fb13f30b697f5e318ca256159e77a466
+  data.tar.gz: 7f2ed60b91541c0eb362b1dc1c063661f5f22eac07719f1ed9d56f552a7d175b
 SHA512:
-  metadata.gz: cb6aff24a1892a671e6f6263c6fe1d49894bfdc4748ddd9726db5442bc891cf6fd1bbced58f7fd4d468259e3dd2db88b11e9457f514fb02429061fa6b74bea75
-  data.tar.gz: 468c0dad7b32ee3e1d7f5f7969afecd37a4199d92b117bced55674c748e21fa3550d390427800cbbb8f9c3b0d8ed9008250118c254be54db9d8d24500e572e48
+  metadata.gz: 03ea333dc6fdc10956b58478de7b67d8e3061345b3d96af8601a847dd393b158cd0bdbd7e4ca3ebc69c7cdca03d58ced76e34964b0370d9b2b0dad27c4d1f9dc
+  data.tar.gz: 38784dee207a4b5161add61183ebb49cf7b4a7a843171a29da2effe393105cd9c4bd00f2a0d3780ab296c430149a43792c85b9054375cb1c97269e89b1ad7f96

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 0.19.0 - 2026-10-29
+
+- Extract `Netdisco::Catalog#devices(policy:)` for immutable inventory without credentials or operations; Fleet delegates inventory access. Add live, injected `Credentials#resolve(platform:)` with platform-specific username/password/enable-password precedence and independent secret snapshots.
+
+## 0.18.1 - 2026-10-24
+
+- Stream SSH archive bodies through bounded binary frames and incremental hashes instead of whole-file base64 copies; preserve deadlines, verified server receipts and committed local paths.
+- Retain cleanup ownership across cancellation, failed closes and forked KnownHosts snapshots; reject inherited trust commits before file or lock access.
+- Preserve the primary exception or nonlocal exit when atomic-file and archive-process cleanup also fails.
+- Expose JSON Pointer field provenance through configuration previews and leave runtime dependency versions to host lockfiles.
+
 ## 0.18.0 - 2026-10-23
 
 - Add on_receipt completion callbacks to command, script, save and custom operations, retaining completed responses after later logging, processing, budget or cancellation failures.

data/README.md

@@ -66,3 +66,22 @@ Licensed under [MIT](LICENSE).
 ## ctx_cli 公共入口
 
 宿主配置文件读取、私有文件初始化、公共参数与终端交互由 ctx_cli 维护。原 `Net::Connector::Config`、配置路径、优先级和 backup/TFTP/topology 策略继续保留。源码联调使用 `CTX_CLI_PATH=../ctx_cli`；隔离安装可通过 `CTX_CLI_GEM=/absolute/path/ctx_cli-0.1.0.gem` 传入精确候选。
+
+
+## Inventory and credentials without device operations
+
+```ruby
+require "net/connector/netdisco/catalog"
+require "net/connector/credentials"
+
+settings = Net::Connector::Netdisco::Settings.new(env: ENV)
+policy = settings.snapshot(mode: :inventory)
+catalog = Net::Connector::Netdisco::Catalog.new(settings: settings)
+devices = catalog.devices(policy: policy)
+# Inspect device.issue before selecting targets; duplicate rows are retained.
+credentials = Net::Connector::Credentials.new(env: ENV).resolve(platform: :cisco_nxos)
+```
+
+Catalog owns inventory reading, normalization, duplicate marking and cache status (`#status`). It does not resolve device credentials, log into devices or create operation reports. Pass one policy snapshot throughout a run. Fleet delegates to Catalog and retains operation orchestration.
+
+Credentials reads the injected environment on every `resolve`; it returns an independent frozen hash, or nil when no username is available. Platform-specific `NC_<PLATFORM>_USERNAME`, `_PASSWORD`, and `_ENABLE_PASSWORD` override `NC_DEVICE_USERNAME`, `NC_DEVICE_PASSWORD`, and `NC_ENABLE_PASSWORD` respectively. Blank values fall back. Secrets are never cached or included in object inspection.

data/docs/architecture.md

@@ -88,12 +88,20 @@ Fleet 在规范目标校验、凭据解析及连接器构造之前加同一把
 
 `KnownHosts` 在跨进程锁内重读和合并已认证的会话密钥，条目索引保留原顺序及已有重复行，新增行只登记一次。提交复用 `AtomicFile`；目录同步失败保留已替换文件并报告 `file_persistence_unconfirmed`，不能触发再次登记。不安全的非普通共享信任文件报告 `known_hosts_unsafe`，strict 模式仍由 OpenSSH 管理。写入器仅在实际提交时加载，纯会话引擎加载不引入存储层。
 
+信任快照及其 `.old` 文件由创建进程拥有。fork 副本关闭时只释放继承描述符；提交继承快照（即使没有新增密钥）在读取和加锁前报告 `known_hosts_inherited`。子进程需要重新打开 SSH 连接，取得自己的快照后再认证和登记；父进程的快照与连接继续有效。快照关闭失败时，KnownHosts 和 Ssh 保留清理责任，后续 close/open 重试，清理成功后才释放引用。
+
 提交后的 `BackupPersistenceError` 只携带原 `Backup` 元数据和受控写入回执，Fleet 保留产物并使用已有 saved_with_error 分类。只接受库定义的具体完成错误及匹配产物类型，第三方异常的 backup 属性或自定义 WriteError 子类不作为完成证据。报告保留已提交位置，导出错误说明 committed；设备命令不会自动重放。
 
 直接备份在路径锁退出前保存完成元数据，锁关闭的普通故障转换为 `BackupFinalizeError`，其中 `backup` 保留结果，`underlying_type` 经过类型白名单。该错误只确认备份操作已完成，不制造文件同步回执；未变文件的历史持久性仍未补验。Fleet 的外层路径锁及 TFTP 归档锁同样保存最新结果，退出故障转为 saved_with_error 或 reported_with_error，已有设备诊断优先，中断继续传播。
 
 TFTP 归档分别保留本地批次副本与服务器归档副本的提交位置；写入器的原生回执必须与本次目标路径一致。目录同步或收尾失败仍保留已提交路径，成功上传转为 `reported_with_error`，诊断记录归档失败及持久化阶段；设备任务此前已有错误时保留原诊断。报告失败后的 JSON 补写同样保留已提交位置，不覆盖首次报告故障，也不重新执行设备任务。
 
+SSH 归档的 Client 持有事务进程和管道，Protocol 只借用 IO，维护 16 KiB 控制帧、64 KiB 正文片段和阶段截止时间。`archived` 元数据、声明长度的二进制正文与 `delivered` 确认共用 280 秒期限；文件上限仍为 64 MiB，并发槽位仍为 4。Python 工作进程分片读取、复制和摘要核验，复制及交付前后均检查文件身份、大小与目录/锁边界，不保留整份正文或 base64 副本。
+
+`AtomicFile.write_stream` 借出私有临时文件，只有正文长度、SHA-256 和交付确认全部通过后，才允许同步和原子替换。本地准备或写盘失败时，Client 尽可能继续有界读取并核验服务器副本，保留 `server_verified`，随后发送 abort，保持 staging；失败写入和设备上传均不重试。原子替换之后的同步故障保留可信回执中的 `local_path`。启动器只返回管道与等待线程，Client 是唯一清理者，取消和非局部退出不会被普通关闭错误覆盖。
+
+AtomicFile 同样独占临时文件及父目录句柄的清理。取得句柄和登记临时目录项身份共用取消保护边界；清理仍尝试关闭及移除属于本次写入的临时目录项。生产者或目录同步期间的异常、取消及非局部退出优先于普通关闭错误；正常完成后的清理错误继续按原写入回执报告。
+
 TFTP 只确认设备报告的上传结果：策略去掉命令、应答和提示符回显后，检查明确的完成行；文件名或表示“即将上传”的进度文字不算成功。原始输出或终端渲染文本中的失败证据优先于成功文字。
 
 失败证据核对与完成核对共用精确回显过滤。静态应答从已完成步骤的 `Command#interactions` 读取，`Interaction#static_response` 对动态回调返回 nil，核对不会重新执行挑战回调。失败核对逐步读取原文、回车历史和终端画面，不累积全部画面副本；颜色样式只影响显示，不能拆开诊断词或借光标擦除隐藏已经收到的失败。命令诊断及拓扑保存确认同样保留这类失败历史。
@@ -208,7 +216,7 @@ Fleet 可把回执与本地普通文件的时间、稳定性、摘要及目录
 
 传输关闭先撤下活跃信道，使连接不可用；尚未回收的信道由内部 `@closing_channel` 保留。`hard_close` 正常返回且当前进程拥有的子进程已退出后才释放引用；异常、非局部退出及有界等待后仍存活的子进程都保留清理责任，后者明确报告 IOError。后续 `close` 重试原信道，完成后不重复清理。fork 副本仅关闭继承句柄，不要求回收父进程拥有的子进程。
 
-重新打开会先完成旧资源回收，失败时不创建新进程或 SSH 信任快照。私有 `close_resources` 供关闭与打开共用；公开 `close` 停止日志交付，而打开时保留新连接已配置的日志目标。SSH 临时信任快照仍只处置一次。连接恢复只有在旧传输及日志清理成功后才能替换传输对象；失败仍报告原连接错误，保留旧所有者供后续关闭，不重放设备命令。注入信道工厂须遵守现有 Expect 的 `hard_close` / `alive?` 生命周期协议。
+重新打开会先完成旧资源回收，失败时不创建新进程或 SSH 信任快照。私有 `close_resources` 供关闭与打开共用；公开 `close` 停止日志交付，而打开时保留新连接已配置的日志目标。SSH 临时信任快照在成功关闭后释放引用，失败时保留供重试。连接恢复只有在旧传输及日志清理成功后才能替换传输对象；失败仍报告原连接错误，保留旧所有者供后续关闭，不重放设备命令。注入信道工厂须遵守现有 Expect 的 `hard_close` / `alive?` 生命周期协议。
 
 PTY 输出上限直接读取信道公开的 `buffer_bytesize` 标量，避免正常分片反复取得累计正文副本；只有实际超限时才获取错误正文，关闭日志也不会关闭上限检查。传输与 SSH 归档认证统一使用当前 `Session`、`transcript`、`spawn(raw: true)` 和 `expect` 契约，不探测或回退到旧接口。运行要求为 expect-pty 0.9.4+、Ruby 3.4+。
 

data/lib/net/connector/credentials.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Net
+  module Connector
+    # 设备凭据的字段优先级；借用来源，每次解析独立快照，不缓存秘密。
+    class Credentials
+      def initialize(env: ENV)
+        raise ArgumentError, "Credential source must support key lookup" unless env.respond_to?(:[])
+        @env = env
+      end
+
+      # 平台字段优先于通用字段；缺少用户名时由宿主决定跳过或拒绝。
+      def resolve(platform:)
+        unless (platform.is_a?(String) || platform.is_a?(Symbol)) && /\A[a-z][a-z0-9_]*\z/i.match?(platform.to_s)
+          raise ArgumentError, "Credential platform must be a name"
+        end
+        prefix = "NC_#{platform.to_s.upcase}_"
+        username = value(prefix + "USERNAME") || value("NC_DEVICE_USERNAME")
+        return nil unless username
+
+        { username: username, password: value(prefix + "PASSWORD") || value("NC_DEVICE_PASSWORD"),
+          enable_password: value(prefix + "ENABLE_PASSWORD") || value("NC_ENABLE_PASSWORD") }.freeze
+      end
+
+      def inspect = "#<#{self.class}>"
+      alias to_s inspect
+      def pretty_print(printer) = printer.text(inspect)
+
+      private
+
+      # 拒绝非法值而不回显内容，也不冻结调用方的字符串。
+      def value(key)
+        result = @env[key]
+        raise ArgumentError, "#{key} must be a String" unless result.nil? || result.is_a?(String)
+        result.dup.freeze unless result.nil? || result.strip.empty?
+      end
+    end
+  end
+end

data/lib/net/connector/engine/error/metadata.rb

@@ -25,7 +25,8 @@ module Net
              Net::Connector::Netdisco::Tftp::Archive::Unavailable Net::Connector::Netdisco::Tftp::Archive::Failure]).freeze
         CODES = (CONNECTOR_TYPES.map { |name| name.gsub(/([a-z])([A-Z])/, '\1_\2').downcase.to_sym } +
           %i[authentication_failed connection_failed connection_refused no_route connection_reset
-             connection_timeout host_key_changed host_key_untrusted known_hosts_busy known_hosts_unsafe rsa_too_small unsupported_cipher
+             connection_timeout host_key_changed host_key_untrusted known_hosts_busy known_hosts_unsafe known_hosts_inherited
+             rsa_too_small unsupported_cipher
              ambiguous_description ambiguous_neighbor confirmation_required description_stages_unsupported
              description_unconfirmed description_unsupported incomplete_configuration interface_missing
              neighbor_discovery_unsupported parse_failed invalid_output_encoding persistence_unconfirmed stale_plan startup_config_missing

data/lib/net/connector/engine/known_hosts.rb

@@ -14,6 +14,7 @@ module Net
 
       # 建立本次连接的私有主机密钥快照，初始化失败时清理已取得的资源。
       def initialize(configuration, replace: false)
+        @owner_pid = Process.pid
         destination = configuration.known_hosts || File.join(Dir.home, ".ssh", "known_hosts")
         FileUtils.mkdir_p(File.dirname(destination), mode: 0o700)
         @destination = File.join(File.realpath(File.dirname(destination)), File.basename(destination))
@@ -35,6 +36,11 @@ module Net
       # 在目标文件锁内合并新增信任；检测并发密钥变化后原子写回。
       # 会话只写私有快照；登记时重读共享信任并检查冲突，避免并发连接覆盖已有主机密钥。
       def commit
+        unless @owner_pid == Process.pid
+          raise ConnectionError.new("inherited known_hosts snapshot cannot be committed; reopen the SSH connection",
+                                    code: :known_hosts_inherited, host: @host, phase: :login), cause: nil
+        end
+
         # 纯会话引擎加载不触及文件业务；实际登记信任时才加载持久化协议。
         require_relative "../storage/atomic_file"
         begin
@@ -60,10 +66,10 @@ module Net
         end
       end
 
-      # 关闭并删除私有密钥快照，延迟取消直至清理完成。
+      # 关闭私有密钥快照，创建进程同时删除文件；延迟取消直至清理完成。
       def close
         failure = nil
-        # 清除引用至删除快照期间延后异步取消，不能留下失去所有者的临时文件。
+        # 关闭句柄和删除快照期间延后异步取消，完成清理后再释放引用。
         Thread.handle_interrupt(Exception => :never) do
           close_snapshot
         rescue Exception => error # rubocop:disable Lint/RescueException -- 保存同步清理故障，退出屏蔽范围后继续传播。
@@ -104,17 +110,24 @@ module Net
         raise failure, cause: nil if failure
       end
 
-      # 清除快照引用并删除临时文件，清理错误不覆盖较早的失败。
+      # 创建进程负责删除文件；fork 副本只关闭继承句柄，失败时保留清理引用。
       def close_snapshot
         file = @file
-        @file = nil
-        File.unlink(@path + ".old") if @path && File.exist?(@path + ".old")
+        owned = @owner_pid == Process.pid
+        File.unlink(@path + ".old") if owned && @path && File.exist?(@path + ".old")
       rescue Exception # rubocop:disable Lint/RescueException -- 删除附属文件失败或中断后仍须关闭私有快照。
         failed = true
         raise
       ensure
         begin
-          file&.close!
+          if owned
+            file&.close!
+            # Tempfile 会吞掉删除时的权限错误；路径仍存在表示删除责任尚未完成。
+            raise IOError, "known_hosts snapshot removal is incomplete" if file&.path
+          else
+            file&.close
+          end
+          @file = nil
         rescue Exception # rubocop:disable Lint/RescueException -- 私有快照清理不能覆盖先发生的删除故障。
           raise unless failed
         end

data/lib/net/connector/engine/transports.rb

@@ -234,7 +234,6 @@ module Net
           # 一次取消须等待信道和信任快照均完成回收；同步故障仍保留首个。
           Thread.handle_interrupt(Exception => :never) do
             known_hosts = @known_hosts
-            @known_hosts = nil
             begin
               super
             rescue Exception => error # rubocop:disable Lint/RescueException -- 全部资源均须尝试关闭，保留首个失败或中断。
@@ -243,6 +242,7 @@ module Net
             ensure
               begin
                 known_hosts&.close
+                @known_hosts = nil
               rescue Exception => error # rubocop:disable Lint/RescueException -- 信任文件收尾不能覆盖传输关闭的原始异常。
                 unless failure
                   failure = error

data/lib/net/connector/netdisco/catalog.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative "settings"
+require_relative "device"
+
+module Net
+  module Connector
+    module Netdisco
+      # 只读取、归一化及标记清单；凭据、连接、操作和报告由宿主拥有。
+      class Catalog
+        attr_reader :status
+
+        def initialize(settings: Settings.new, inventory: nil, rules: nil)
+          @settings, @inventory, @rules = settings, inventory, rules
+        end
+
+        # 使用调用方固定的同批策略，保留被过滤、无效及重复的记录。
+        def devices(policy:, force_refresh: false)
+          @status = nil
+          raise ArgumentError, "force_refresh must be true or false" unless [true, false].include?(force_refresh)
+
+          inventory = @inventory || @settings.inventory(policy: policy)
+          cache_mode = policy.inventory_cache_mode
+          raise ArgumentError, "cache-only cannot force refresh" if cache_mode == :only && force_refresh
+          if cache_mode == :only && !inventory.is_a?(Inventory::Cache)
+            raise Inventory::Error.new("validated inventory cache is unavailable", code: :cache_unavailable), cause: nil
+          end
+          rows = if inventory.is_a?(Inventory::Cache)
+                   inventory.devices(force_refresh: force_refresh, cache_mode: cache_mode)
+                 else
+                   inventory.devices
+                 end
+          @status = if inventory.is_a?(Inventory::Cache)
+                                { source: inventory.status, fetched_at: inventory.fetched_at,
+                                  refresh_error_code: inventory.refresh_error_code, write_error_type: inventory.write_error_type }.freeze
+                              else
+                                { source: :uncached }.freeze
+                              end
+          raise Inventory::Error, "Netdisco returned an invalid device inventory" unless rows.is_a?(Array)
+
+          rules = @rules || policy.rules
+          devices = rows.map { |row| Device.from_row(row, rules: rules) }
+          host_counts = devices.each_with_object(Hash.new(0)) { |device, counts| counts[device.host] += 1 if device.host }
+          devices.map { |device| host_counts[device.host] > 1 ? device.with(issue: :duplicate_host) : device }.freeze
+        end
+
+        def inspect = "#<#{self.class}>"
+        alias to_s inspect
+        def pretty_print(printer) = printer.text(inspect)
+      end
+    end
+  end
+end

data/lib/net/connector/netdisco/fleet.rb

@@ -4,6 +4,7 @@ require "fileutils"
 require_relative "../storage"
 require_relative "../device/scope"
 require_relative "inventory"
+require_relative "catalog"
 require_relative "settings"
 require_relative "device"
 require_relative "device/access"
@@ -35,8 +36,7 @@ module Net
         def initialize(inventory: nil, settings: Settings.new, rules: nil, credentials: nil, connector_factory: nil,
                        report_store: Report::Store::Json.new)
           @settings = settings
-          @inventory = inventory
-          @rules = rules
+          @catalog = Catalog.new(settings: settings, inventory: inventory, rules: rules)
           @credentials = credentials
           @connector_factory = connector_factory || ->(device, access_options) { device.build_connector(**access_options) }
           @report_store = report_store
@@ -176,32 +176,9 @@ module Net
 
         # 策略在清单请求之前固定；注入的清单来源仍由调用方负责其自身生命周期。
         def inventory(settings_snapshot, force_refresh: false)
-          @inventory_status = nil
-          raise ArgumentError, "force_refresh must be true or false" unless [true, false].include?(force_refresh)
-
-          inventory = @inventory || @settings.inventory(policy: settings_snapshot)
-          cache_mode = settings_snapshot.inventory_cache_mode
-          raise ArgumentError, "cache-only cannot force refresh" if cache_mode == :only && force_refresh
-          if cache_mode == :only && !inventory.is_a?(Inventory::Cache)
-            raise Inventory::Error.new("validated inventory cache is unavailable", code: :cache_unavailable), cause: nil
-          end
-          rows = if inventory.is_a?(Inventory::Cache)
-                   inventory.devices(force_refresh: force_refresh, cache_mode: cache_mode)
-                 else
-                   inventory.devices
-                 end
-          @inventory_status = if inventory.is_a?(Inventory::Cache)
-                                { source: inventory.status, fetched_at: inventory.fetched_at,
-                                  refresh_error_code: inventory.refresh_error_code, write_error_type: inventory.write_error_type }.freeze
-                              else
-                                { source: :uncached }.freeze
-                              end
-          raise Inventory::Error, "Netdisco returned an invalid device inventory" unless rows.is_a?(Array)
-
-          rules = @rules || settings_snapshot.rules
-          devices = rows.map { |row| Device.from_row(row, rules: rules) }
-          host_counts = devices.each_with_object(Hash.new(0)) { |device, counts| counts[device.host] += 1 if device.host }
-          devices.map { |device| host_counts[device.host] > 1 ? device.with(issue: :duplicate_host) : device }.freeze
+          @catalog.devices(policy: settings_snapshot, force_refresh: force_refresh)
+        ensure
+          @inventory_status = @catalog.status
         end
 
         # 在固定清单快照上生成模式对应的计划，规划阶段不读取设备凭据。

data/lib/net/connector/netdisco/settings.rb

@@ -346,13 +346,7 @@ module Net
 
         # 每台任务读取最新厂商凭据，缺失字段回退到通用凭据；无用户名时跳过设备。
         def device_credentials_for(device)
-          prefix = "NC_#{device.vendor.to_s.upcase}_"
-          username = secret_value(prefix + "USERNAME") || secret_value("NC_DEVICE_USERNAME")
-          return nil unless username
-
-          { username: username,
-            password: secret_value(prefix + "PASSWORD") || secret_value("NC_DEVICE_PASSWORD"),
-            enable_password: secret_value(prefix + "ENABLE_PASSWORD") || secret_value("NC_ENABLE_PASSWORD") }
+          Net::Connector::Credentials.new(env: @env).resolve(platform: device.vendor)
         end
 
         # 会话日志目录属于公开策略；调用方和批次入口负责实际创建。

data/lib/net/connector/netdisco/ssh/archive/client.rb

@@ -3,7 +3,6 @@
 require_relative "../../../storage/directory"
 
 require "digest"
-require "json"
 require "open3"
 require "securerandom"
 require "shellwords"
@@ -11,6 +10,7 @@ require "tmpdir"
 require_relative "../../tftp/root"
 require_relative "../authentication"
 require_relative "../../tftp/archive"
+require_relative "protocol"
 
 module Net
   module Connector
@@ -41,12 +41,11 @@ module Net
               end
             end
 
-            MAX_FRAME_BYTES = 90 * 1024 * 1024
             SESSION_LIMIT = 4
             WORKER = File.expand_path("worker.py", __dir__)
             ACTIVE_CLIENTS = {}
             ACTIVE_CLIENTS_MUTEX = Mutex.new
-            private_constant :MAX_FRAME_BYTES, :WORKER, :ACTIVE_CLIENTS, :ACTIVE_CLIENTS_MUTEX
+            private_constant :WORKER, :ACTIVE_CLIENTS, :ACTIVE_CLIENTS_MUTEX
 
             # 退出处理只持有仍需清理的连接；已关闭的批次与凭据可由 GC 回收。
             at_exit do
@@ -94,30 +93,26 @@ module Net
               acquired = @slots.pop
               filename = TftpTarget.validate_path!(upload_filename(device))
               archive_name = "#{device.backup_filename(style: :hostname_ip).delete_suffix(".txt")}#{File.extname(filename)}"
-              @launcher.call do |input, output, error, process|
-                begin
-                  write_frame(input, root: @root, filename: filename, archive_name: archive_name, batch: @batch)
-                  expect_phase(output, "ready")
-                  outcome = yield filename
-                  receipt = outcome.backup
-                  unless receipt.is_a?(TftpReceipt) && receipt.path == filename
-                    write_frame(input, action: "abort")
-                    next outcome
-                  end
-                  outcome = outcome.with(started_at: started_at)
-                  write_frame(input, action: "verify")
-                  proof = expect_phase(output, "archived")
-                  outcome = retain_upload(outcome, proof, archive_name)
-                  if outcome.success?
-                    write_frame(input, action: "cleanup", sha256: outcome.backup.server_sha256)
-                    expect_phase(output, "complete")
-                  else
-                    write_frame(input, action: "abort")
-                  end
-                  outcome
-                ensure
-                  stop_process(input, output, error, process)
+              with_process do |protocol|
+                protocol.send_frame(root: @root, filename: filename, archive_name: archive_name, batch: @batch)
+                protocol.expect_phase("ready")
+                outcome = yield filename
+                receipt = outcome.backup
+                unless receipt.is_a?(TftpReceipt) && receipt.path == filename
+                  protocol.send_frame(action: "abort")
+                  next outcome
+                end
+                outcome = outcome.with(started_at: started_at)
+                protocol.send_frame(action: "verify")
+                proof = protocol.expect_phase("archived")
+                outcome = retain_upload(outcome, protocol, proof, archive_name)
+                if outcome.success?
+                  protocol.send_frame(action: "cleanup", sha256: outcome.backup.server_sha256)
+                  protocol.expect_phase("complete")
+                else
+                  protocol.send_frame(action: "abort")
                 end
+                outcome
               end
             rescue StandardError
               raise Tftp::Archive::Failure.new(host: device.host), cause: nil unless outcome
@@ -158,33 +153,26 @@ module Net
 
             # 用实际事务进程预检目录与写入边界，不读取或上传任何设备文件。
             def prepare_archive
-              @launcher.call do |input, output, error, process|
-                begin
-                  write_frame(input, root: @root, filename: "preflight.cfg", archive_name: "preflight.cfg", batch: @batch, action: "preflight")
-                  expect_phase(output, "ready")
-                ensure
-                  stop_process(input, output, error, process)
-                end
+              with_process do |protocol|
+                protocol.send_frame(root: @root, filename: "preflight.cfg", archive_name: "preflight.cfg", batch: @batch, action: "preflight")
+                protocol.expect_phase("ready")
               end
             rescue StandardError
               raise PreparationUnavailable, cause: nil
             end
 
             # 先核对服务器正文与摘要，再保留远端归档路径；后续本地写入失败仍保留已有证据。
-            def retain_upload(outcome, proof, archive_name)
-              bytes = proof.fetch("data").unpack1("m0")
-              digest = Digest::SHA256.hexdigest(bytes)
-              unless bytes.bytesize.positive? && bytes.bytesize == proof.fetch("bytes") && digest == proof.fetch("sha256")
-                raise Tftp::Archive::Failure
-              end
-              receipt = outcome.backup.with(verification: :server_verified, server_sha256: digest, server_bytes: bytes.bytesize,
+            def retain_upload(outcome, protocol, proof, archive_name)
+              receipt = outcome.backup.with(verification: :server_verified, server_sha256: proof.fetch("sha256"), server_bytes: proof.fetch("bytes"),
                                           archive_path: remote_path(proof.fetch("archive_path")))
-              outcome = outcome.with(backup: receipt)
               path = File.join(@report_directory, "tftp", archive_name)
-              Storage::Directory.prepare(File.dirname(path))
-              Storage::AtomicFile.write(path, bytes)
+              persist_upload(path) do |file|
+                failure = receive_upload(protocol, receipt, file)
+                outcome = outcome.with(backup: receipt)
+                raise failure if failure
+              end
               outcome = outcome.with(backup: receipt.with(local_path: path))
-              raise Tftp::Archive::Failure unless Storage::FileReader.fingerprint(path).sha256 == digest
+              raise Tftp::Archive::Failure unless Storage::FileReader.fingerprint(path).sha256 == receipt.server_sha256
 
               outcome
             rescue StandardError => error
@@ -194,6 +182,38 @@ module Net
               outcome.success? ? archive_failure(outcome) : outcome
             end
 
+            # 本地准备失败仍接收并核验服务器正文；已经开始接收的失败事务不能重读或重写。
+            def persist_upload(path)
+              received = false
+              Storage::Directory.prepare(File.dirname(path))
+              Storage::AtomicFile.write_stream(path) do |file|
+                received = true
+                yield file
+              end
+            rescue StandardError
+              yield nil unless received
+              raise
+            end
+
+            # 逐块核对摘要，首次写盘错误后只继续读取；完整交付确认后才返回写盘故障。
+            def receive_upload(protocol, receipt, file)
+              digest = Digest::SHA256.new
+              failure = nil
+              protocol.read_payload(receipt.server_bytes) do |chunk|
+                digest << chunk
+                next unless file && !failure
+
+                begin
+                  raise IOError, "incomplete archive write" unless file.write(chunk) == chunk.bytesize
+                rescue StandardError => error
+                  failure = error
+                end
+              end
+              raise Tftp::Archive::Failure unless digest.hexdigest == receipt.server_sha256
+
+              failure
+            end
+
             # 保留设备和服务器回执，将归档收尾异常转换为可诊断的部分成功。
             def archive_failure(outcome)
               failure = Tftp::Archive::Failure.new(host: outcome.device.host)
@@ -251,11 +271,10 @@ module Net
               false
             end
 
-            # 复用主连接启动一次归档事务进程，会话槽位限制由调用作用域管理。
-            def open_ssh(&)
-              prepare_master
+            # 返回事务管道和等待线程，由调用作用域唯一负责关闭、终止及回收。
+            def open_ssh
               command = "python3 -u -c #{Shellwords.escape(File.read(WORKER))}"
-              Open3.popen3(*ssh_arguments, @uri.host, command, &)
+              Open3.popen3(*ssh_arguments, @uri.host, command)
             end
 
             # 将已校验端点组装为独立 SSH 参数，固定严格主机密钥检查与连接超时。
@@ -265,32 +284,24 @@ module Net
                "-p", (@uri.port || 22).to_s, "-l", @uri.user]
             end
 
-            # 将路径或事务动作编码为单行 JSON 并刷新，协议帧不携带认证凭据。
-            def write_frame(input, **values)
-              input.write(JSON.generate(values) + "\n")
-              input.flush
-            end
-
-            # 在总期限和帧大小上限内读取完整响应，拒绝断连、错误阶段及无效协议数据。
-            def expect_phase(output, phase)
-              deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 280
-              frame = +"".b
-              loop do
-                remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-                raise Tftp::Archive::Failure unless remaining.positive? && output.wait_readable(remaining)
-
-                chunk = output.read_nonblock(65_536, exception: false)
-                next if chunk == :wait_readable
-                raise Tftp::Archive::Failure if chunk.nil?
-
-                frame << chunk
-                raise Tftp::Archive::Failure if frame.bytesize > MAX_FRAME_BYTES
-                next unless frame.end_with?("\n")
-
-                value = JSON.parse(frame)
-                raise Tftp::Archive::Failure unless value["ok"] == true && value["phase"] == phase
-
-                return value
+            # 每次事务独占进程与协议状态，主故障或非局部退出不能被普通清理错误覆盖。
+            def with_process
+              handles = nil
+              prepare_master unless @custom_launcher
+              completed = false
+              # 取得资源与登记所有权之间暂缓取消；事务本身仍可立即中断。
+              Thread.handle_interrupt(Exception => :never) { handles = @launcher.call }
+              result = yield Protocol.new(handles[0], handles[1])
+              completed = true
+              result
+            rescue Exception # rubocop:disable Lint/RescueException -- 返回前递送的取消仍属于事务主控制流。
+              completed = false
+              raise
+            ensure
+              begin
+                stop_process(*handles) if handles
+              rescue Exception # rubocop:disable Lint/RescueException -- 取消和非局部退出均保留原始控制流。
+                raise if completed
               end
             end
 
@@ -303,7 +314,26 @@ module Net
 
             # 先关闭事务管道并等待子进程退出，超时后分级终止，促使服务器释放锁。
             def stop_process(input, output, error, process)
-              [input, output, error].each { |io| io.close unless io.closed? }
+              Thread.handle_interrupt(Exception => :never) do
+                failure = nil
+                [input, output, error].each do |io|
+                  begin
+                    io.close unless io.closed?
+                  rescue Exception => caught # rubocop:disable Lint/RescueException -- 单个关闭失败仍须回收其余管道和进程。
+                    failure ||= caught
+                  end
+                end
+                begin
+                  reap_process(process)
+                rescue Exception => caught # rubocop:disable Lint/RescueException -- 保留先发生的清理故障。
+                  failure ||= caught
+                end
+                raise failure if failure
+              end
+            end
+
+            # 为正常退出保留短暂宽限，随后终止仍未退出的事务进程并回收等待线程。
+            def reap_process(process)
               return if process.join(2)
 
               Process.kill("TERM", process.pid)

data/lib/net/connector/netdisco/ssh/archive/protocol.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "../../tftp/archive"
+
+module Net
+  module Connector
+    module Netdisco
+      module SSH
+        module Archive
+          # 仅借用事务管道，维护控制帧与二进制正文的分界、缓冲和绝对期限。
+          class Protocol
+            READ_BYTES = 65_536
+            CONTROL_BYTES = 16_384
+            PAYLOAD_BYTES = 64 * 1024 * 1024
+            private_constant :READ_BYTES, :CONTROL_BYTES, :PAYLOAD_BYTES
+
+            # 每个事务独占自己的协议状态；管道关闭和进程回收仍由客户端负责。
+            def initialize(input, output, timeout: 280)
+              @input, @output = input, output
+              @timeout = timeout
+              @buffer = +"".b
+            end
+
+            # 发送有界单行控制帧，写入不完整不能当作命令已经交付。
+            def send_frame(**values)
+              frame = JSON.generate(values) + "\n"
+              raise Tftp::Archive::Failure if frame.bytesize > CONTROL_BYTES || @input.write(frame) != frame.bytesize
+
+              @input.flush
+            end
+
+            # 开始一个控制阶段；归档元数据取得的期限同时覆盖后续正文及交付确认。
+            def expect_phase(phase)
+              @deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout
+              read_phase(phase)
+            end
+
+            # 按声明长度分片交付二进制正文，随后在同一期限内确认服务器完成交付。
+            def read_payload(length)
+              unless @phase == "archived" && length.is_a?(Integer) && (1..PAYLOAD_BYTES).cover?(length)
+                raise Tftp::Archive::Failure
+              end
+
+              remaining = length
+              while remaining.positive?
+                remaining_time
+                @buffer << read_chunk if @buffer.empty?
+                chunk = @buffer.slice!(0, [remaining, READ_BYTES, @buffer.bytesize].min)
+                remaining -= chunk.bytesize
+                yield chunk
+              end
+              read_phase("delivered")
+            end
+
+            private
+
+            # 缓冲中可能同时含有控制帧和正文，只消费当前行并限制控制帧长度。
+            def read_phase(phase)
+              loop do
+                remaining_time
+                ending = @buffer.index("\n")
+                if ending
+                  raise Tftp::Archive::Failure if ending + 1 > CONTROL_BYTES
+
+                  value = JSON.parse(@buffer.slice!(0, ending + 1))
+                  unless value.is_a?(Hash) && value["ok"] == true && value["phase"] == phase
+                    raise Tftp::Archive::Failure
+                  end
+
+                  @phase = phase
+                  return value
+                end
+                raise Tftp::Archive::Failure if @buffer.bytesize >= CONTROL_BYTES
+
+                @buffer << read_chunk
+              end
+            rescue JSON::ParserError
+              raise Tftp::Archive::Failure, cause: nil
+            end
+
+            # 每次非阻塞读取使用剩余总预算，片段到达不能重新开始计时。
+            def read_chunk
+              loop do
+                raise Tftp::Archive::Failure unless @output.wait_readable(remaining_time)
+
+                chunk = @output.read_nonblock(READ_BYTES, exception: false)
+                next if chunk == :wait_readable
+                raise Tftp::Archive::Failure if chunk.nil?
+
+                return chunk
+              end
+            end
+
+            # 即使数据已经缓冲，也检查绝对期限，避免消费者或确认阶段偷偷延长预算。
+            def remaining_time
+              remaining = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              raise Tftp::Archive::Failure unless remaining.positive?
+
+              remaining
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/netdisco/ssh/archive/worker.py

@@ -1,7 +1,6 @@
 # 服务器端单次归档事务：锁覆盖上传与核验，客户端断开后退出且不重放设备命令。
 """在一个目标锁内处理单次上传事务，客户端断开后退出且不重放设备操作。"""
 
-import base64
 from contextlib import ExitStack
 import fcntl
 import hashlib
@@ -14,6 +13,7 @@ import sys
 import time
 
 MAX_BYTES = 64 * 1024 * 1024
+CHUNK_BYTES = 64 * 1024
 DIRECTORY_FLAGS = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
 
 
@@ -107,7 +107,7 @@ def fingerprint(s):
 
 
 # 从固定目录安全读取有界普通文件，读前、读后和路径身份必须一致。
-def read_file(parent, name, missing=False):
+def read_file(parent, name, missing=False, consume=None):
     try:
         fd = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent)
     except FileNotFoundError:
@@ -118,13 +118,24 @@ def read_file(parent, name, missing=False):
         before = os.fstat(f.fileno())
         if not stat.S_ISREG(before.st_mode) or before.st_size > MAX_BYTES:
             raise ValueError("unsafe or oversized file")
-        data = f.read(MAX_BYTES + 1)
+        digest = hashlib.sha256()
+        size = 0
+        while True:
+            chunk = f.read(CHUNK_BYTES)
+            if not chunk:
+                break
+            size += len(chunk)
+            if size > MAX_BYTES:
+                raise ValueError("oversized file")
+            digest.update(chunk)
+            if consume is not None and consume(chunk) != len(chunk):
+                raise IOError("incomplete file write")
         after = os.fstat(f.fileno())
-        if len(data) > MAX_BYTES or fingerprint(before) != fingerprint(after):
+        if size != after.st_size or fingerprint(before) != fingerprint(after):
             raise ValueError("file changed while reading")
         if fingerprint(after) != fingerprint(os.stat(name, dir_fd=parent, follow_symlinks=False)):
             raise ValueError("file replaced while reading")
-        return data, fingerprint(after)
+        return digest.hexdigest(), fingerprint(after)
 
 
 # 在固定目录中以随机名称独占创建私有临时文件，碰撞时重新选择名称。
@@ -139,11 +150,13 @@ def temporary(parent, prefix):
 
 
 # 先写全并同步临时文件，再独占链接到归档名并同步目录，已有归档不会被覆盖。
-def persist(parent, name, data):
+def persist(parent, name, source_parent, source_name, expected, digest):
     fd, pending = temporary(parent, ".net-connector-")
     try:
         with os.fdopen(fd, "wb") as f:
-            f.write(data)
+            copied, current = read_file(source_parent, source_name, consume=f.write)
+            if current != expected or copied != digest:
+                raise ValueError("source changed before archive commit")
             f.flush()
             os.fsync(f.fileno())
         # 临时名与最终名均相对固定目录解析，父路径改名也不能将写入重定向。
@@ -218,9 +231,9 @@ def run():
         # 上传前先保留同名历史文件；只有服务器确认就绪后，客户端才允许设备导出。
         verify_boundary()
         old, previous = read_file(root_fd, name, missing=True)
-        if old is not None:
+        if previous is not None:
             previous_fd = directories.private(batch_fd, "previous")
-            persist(previous_fd, archive_name, old)
+            persist(previous_fd, archive_name, root_fd, name, previous, old)
         fd, marker = temporary(root_fd, ".net-connector-upload-")
         try:
             started = os.fstat(fd).st_mtime_ns
@@ -233,26 +246,29 @@ def run():
             return
         verify_boundary()
         # 新文件必须非空、区别于旧基线且不早于本次上传边界，旧文件不能冒充新结果。
-        data, current = read_file(root_fd, name)
-        if not data or current == previous or current[3] < started:
+        digest, current = read_file(root_fd, name)
+        if not current[2] or current == previous or current[3] < started:
             raise ValueError("no new nonempty upload")
-        digest = hashlib.sha256(data).hexdigest()
-        persist(batch_fd, archive_name, data)
-        archived, _ = read_file(batch_fd, archive_name)
-        if hashlib.sha256(archived).hexdigest() != digest:
+        persist(batch_fd, archive_name, root_fd, name, current, digest)
+        archived, saved = read_file(batch_fd, archive_name)
+        if archived != digest or saved[2] != current[2]:
             raise ValueError("archive verification failed")
         verify_boundary()
         destination = os.path.join(root, "archive", batch, archive_name)
-        send(phase="archived", bytes=len(data), sha256=digest, archive_path=destination,
-             data=base64.b64encode(data).decode("ascii"))
+        send(phase="archived", bytes=current[2], sha256=digest, archive_path=destination)
+        delivered, check = read_file(batch_fd, archive_name, consume=sys.stdout.buffer.write)
+        if delivered != digest or check != saved:
+            raise ValueError("archive changed during delivery")
+        verify_boundary()
+        send(phase="delivered")
         # 远端归档及正文已交付客户端；只有收到客户端核验后的明确清理指令才删除 staging。
         action = receive()
         if action.get("action") == "cleanup":
             if action.get("sha256") != digest:
                 raise ValueError("cleanup digest mismatch")
             verify_boundary()
-            data, check = read_file(root_fd, name)
-            if check != current or hashlib.sha256(data).hexdigest() != digest:
+            uploaded, check = read_file(root_fd, name)
+            if check != current or uploaded != digest:
                 raise ValueError("upload changed before cleanup")
             verify_boundary()
             os.unlink(name, dir_fd=root_fd)

data/lib/net/connector/storage/atomic_file.rb

@@ -79,24 +79,30 @@ module Net
 
         # 统一返回写入回执；失败时从异常 receipt 判断目录项是否已经替换。
         def self.write(path, contents)
+          write_stream(path) { |file| file.write(contents) }
+        end
+
+        # 借出私有临时文件供分片写入，生产者正常返回后才同步并替换目标。
+        def self.write_stream(path)
           raise ArgumentError, "path must be a nonempty String" unless path.is_a?(String) && !path.empty?
+          raise ArgumentError, "a streaming writer block is required" unless block_given?
 
           receipt = Receipt.new(path: File.expand_path(path), state: :not_committed, phase: :resolve_parent)
           directory = File.realpath(File.dirname(receipt.path))
           destination = File.join(directory, File.basename(receipt.path))
           receipt = receipt.with(phase: :temporary_file)
-          Tempfile.create([".net-connector-", ".tmp"], directory) do |file|
+          with_owned_file(-> { Tempfile.create([".net-connector-", ".tmp"], directory) }, temporary: true) do |file|
             file.binmode
             file.chmod(0o600)
             receipt = receipt.with(phase: :write)
-            file.write(contents)
+            yield file
             receipt = receipt.with(phase: :file_sync)
             file.flush
             file.fsync
             receipt = receipt.with(phase: :rename)
             File.rename(file.path, destination)
             receipt = receipt.with(state: :committed, phase: :directory_open)
-            File.open(directory, File::RDONLY | File::NOFOLLOW) do |parent|
+            with_owned_file(-> { File.open(directory, File::RDONLY | File::NOFOLLOW) }) do |parent|
               raise IOError, "parent is not a directory" unless parent.stat.directory?
 
               receipt = receipt.with(phase: :directory_sync)
@@ -118,6 +124,57 @@ module Net
                   end
           raise klass.new(receipt: receipt, underlying_type: error.class.name.to_s), cause: nil
         end
+
+        # 唯一持有本次写入的文件句柄；临时目录项身份在取消递送前登记，退出时保留主控制流。
+        def self.with_owned_file(acquire, temporary: false)
+          file = path = identity = nil
+          completed = false
+          Thread.handle_interrupt(Exception => :never) do
+            file = acquire.call
+            if temporary
+              path = file.path
+              identity = file.stat
+            end
+          end
+          result = yield file
+          completed = true
+          result
+        rescue Exception # rubocop:disable Lint/RescueException -- 正常返回标记之后递送的取消也必须先于清理故障。
+          completed = false
+          raise
+        ensure
+          begin
+            cleanup_file(file, path, identity) if file
+          rescue StandardError, NotImplementedError
+            raise if completed
+          end
+        end
+
+        # 关闭失败仍尝试删除属于本次写入的临时目录项，已替换的同名文件不归本作用域所有。
+        def self.cleanup_file(file, path, identity)
+          Thread.handle_interrupt(Exception => :never) do
+            failure = nil
+            begin
+              file.close unless file.closed?
+            rescue Exception => error # rubocop:disable Lint/RescueException -- 关闭故障不能跳过临时目录项清理。
+              failure = error
+            end
+            begin
+              if path && identity
+                current = File.lstat(path)
+                File.unlink(path) if current.dev == identity.dev && current.ino == identity.ino
+              end
+            rescue Errno::ENOENT
+              # 原子替换已经移走临时目录项，或其他清理已将其删除。
+              nil
+            rescue Exception => error # rubocop:disable Lint/RescueException -- 保留最先发生的清理故障。
+              failure ||= error
+            end
+            raise failure if failure
+          end
+        end
+
+        private_class_method :with_owned_file, :cleanup_file
       end
     end
   end

data/lib/net/connector/version.rb

@@ -3,6 +3,6 @@
 module Net
   module Connector
     # gemspec、CLI 与发布工具共用此版本，运行时读取不触发设备依赖加载。
-    VERSION = "0.18.0"
+    VERSION = "0.19.0"
   end
 end

data/lib/net/connector.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "connector/version"
+require_relative "connector/credentials"
 require_relative "connector/device/base"
 require_relative "connector/vendor"
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: net-connector
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.19.0
 platform: ruby
 authors:
 - net-connector contributors
 bindir: bin
 cert_chain: []
-date: 2026-10-23 00:00:00.000000000 Z
+date: 2026-10-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ctx_cli
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.1
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.1
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: expect-pty
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.4
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.4
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: textfsm
   requirement: !ruby/object:Gem::Requirement
@@ -71,14 +71,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: digest
   requirement: !ruby/object:Gem::Requirement
@@ -375,6 +375,7 @@ files:
 - lib/net/connector.rb
 - lib/net/connector/collect/progress.rb
 - lib/net/connector/config.rb
+- lib/net/connector/credentials.rb
 - lib/net/connector/device/base.rb
 - lib/net/connector/device/interfaces.rb
 - lib/net/connector/device/interfaces/audit.rb
@@ -436,6 +437,7 @@ files:
 - lib/net/connector/inventory/selection.rb
 - lib/net/connector/netdisco.rb
 - lib/net/connector/netdisco/batch.rb
+- lib/net/connector/netdisco/catalog.rb
 - lib/net/connector/netdisco/cli.rb
 - lib/net/connector/netdisco/cli/backup.rb
 - lib/net/connector/netdisco/cli/credentials.rb
@@ -472,6 +474,7 @@ files:
 - lib/net/connector/netdisco/ssh/archive.rb
 - lib/net/connector/netdisco/ssh/archive/client.rb
 - lib/net/connector/netdisco/ssh/archive/pool.rb
+- lib/net/connector/netdisco/ssh/archive/protocol.rb
 - lib/net/connector/netdisco/ssh/archive/worker.py
 - lib/net/connector/netdisco/ssh/authentication.rb
 - lib/net/connector/netdisco/tftp/archive.rb