@eliware/vyops 1.0.12 → 2.0.0

package/README.md

@@ -4,7 +4,8 @@
 
 ## Features
 
-- SSH-key authentication via `ssh2`, with optional password bootstrap via stdin.
+- SSH-key authentication via the shared `@eliware/ssh-client` library, with
+  optional password bootstrap via stdin.
 - Native VyOS curly-brace configuration validation.
 - Candidate load, `compare`, `commit-confirm`, confirmation, and save.
 - Complete `scripts/` tree synchronization, including post-commit hooks,
@@ -35,7 +36,9 @@ vyops   Deploy or dry-run a configuration.
 | Variable | Required | Default | Purpose |
 |---|---|---|---|
 | `VYOPS_SSH_KEY` | No | `$HOME/.ssh/id_rsa` | Private SSH key path. |
-| `SSH_AUTH_SOCK` | No | unset | SSH agent socket passed to `ssh2`. |
+| `SSH_AUTH_SOCK` | No | unset | SSH agent socket passed to the shared SSH client. |
+| `SSH_KNOWN_HOSTS` | No | `~/.ssh/known_hosts` | Known-hosts file used for host verification. |
+| `SSH_HOST_CA` | No | unset | Trusted SSH host-CA public key for certificate verification. |
 | `LOG_LEVEL` | No | `info` | Winston log level (`error`, `warn`, `info`, `http`, `verbose`, `debug`, or `silly`). |
 
 The target must be supplied as `user@host`. The config must use native VyOS curly-brace syntax.
@@ -53,17 +56,17 @@ Password mode still requires the target host key to be present in `known_hosts`;
 Deploy:
 
 ```sh
-./vyops.mjs vyos@core1 /path/to/config.boot
+vyops vyos@core1 /path/to/config.boot
 ```
 
 Console switches:
 
 ```sh
-./vyops.mjs --help
-./vyops.mjs --version
-./vyops.mjs --dry-run vyos@core1 /path/to/config.boot
-./vyops.mjs --force --debug vyos@core1 /path/to/config.boot
-./vyops.mjs --backup vyos@core1 /path/to/backup
+vyops --help
+vyops --version
+vyops --dry-run vyos@core1 /path/to/config.boot
+vyops --force --debug vyos@core1 /path/to/config.boot
+vyops --backup vyos@core1 /path/to/backup
 ```
 
 `--backup` downloads the active `/config/config.boot` and the complete

package/RELEASE_NOTES.md

@@ -1,5 +1,26 @@
 # Release Notes
 
+## 2.0.0
+
+- **Breaking:** Replace the direct `ssh2` integration with the shared
+  `@eliware/ssh-client` library for SSH, SFTP, interactive sessions, and
+  SSH host-CA verification.
+- Update `@eliware/ssh-client` to 2.0.0 and `@eliware/test` to 2.0.0.
+- Add cross-platform Windows and Ubuntu CI validation, including package,
+  audit, lint, and CLI smoke checks.
+- Close SFTP channels after uploads and downloads to prevent SSH channel exhaustion during script synchronization.
+- Reconnect after interactive deployments before downloading live configuration and cleaning up remote files.
+- Make Git path handling and the `test:gaps` coverage command portable across Windows and Linux.
+- Expand Windows and real-VyOS integration coverage to maintain 100% statements, branches, functions, and lines coverage.
+
+Verification:
+
+- `npm test` (100% coverage across statements, branches, functions, and lines)
+- `npm run lint`
+- `npm audit --omit=dev --audit-level=moderate`
+- `npm run validate:package`
+- CLI smoke test on Ubuntu and Windows
+
 ## 1.0.11
 
 - Fix VyOS 1.5 `commit-confirm` handling by answering confirmation prompts

package/package.json

@@ -1,16 +1,15 @@
 {
     "name": "@eliware/vyops",
-    "version": "1.0.12",
+    "version": "2.0.0",
     "description": "Deploy native VyOS configuration files over SSH.",
     "main": "vyops.mjs",
     "scripts": {
-        "lint": "npx oxlint .",
-        "test": "npx --node-options=\"--experimental-vm-modules --no-warnings\" jest --detectOpenHandles --silent --coverage",
+        "lint": "eliware-test --lint",
+        "test": "eliware-test",
         "deploy": "./vyops.mjs",
-        "test:gaps": "npm test 2>&1 | grep '|' | grep -vF '|     100 |      100 |     100 |     100 |'",
         "pack": "npm pack --dry-run",
         "validate:package": "npm pack --dry-run --json | node scripts/validate-package.mjs",
-        "audit": "npm audit --omit=dev --audit-level=moderate"
+        "audit": "node scripts/audit.mjs"
     },
     "keywords": [
         "vyos",
@@ -22,11 +21,10 @@
     "type": "module",
     "dependencies": {
         "@eliware/common": "^1.1.8",
-        "ssh2": "^1.17.0"
+        "@eliware/ssh-client": "^2.0.0"
     },
     "devDependencies": {
-        "jest": "^30.4.2",
-        "oxlint": "^1.79.0"
+        "@eliware/test": "^2.0.0"
     },
     "bin": {
         "vyops": "./bin/vyops"

package/src/deploy.mjs

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
 import { fs, path as eliwarePath, log } from '@eliware/common';
 import { close, connect, download, exec, interactive, upload } from './ssh.mjs';
 
@@ -15,7 +16,7 @@ async function listScripts(directory, relative = '') {
   const entries = await fs.promises.readdir(directory, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const path = relative ? eliwarePath(relative, entry.name) : entry.name;
+    const path = (relative ? eliwarePath(relative, entry.name) : entry.name).replaceAll(String.fromCharCode(92), '/');
     if (entry.isDirectory?.()) {
       files.push(...await listScripts(eliwarePath(directory, entry.name), path));
     } else if (entry.isFile?.()) {
@@ -49,14 +50,17 @@ async function installScripts(client, config, log, runId) {
       const remote = `${remoteDir}/${name}`;
       const installed = `${installDir}/${name}`;
       const backup = `${backupDir}/${name}`;
-      const parent = eliwarePath(name, '..');
-      const mode = (await fs.promises.stat(local)).mode & 0o777;
+      const parent = eliwarePath(name, '..').replaceAll(String.fromCharCode(92), '/');
+      const mode = /\.(?:sh|script)$/.test(name)
+        || /^(?:commit[/\\]post-hooks\.d[/\\])/.test(name)
+        ? 0o755
+        : (await fs.promises.stat(local)).mode & 0o777;
       const backedUp = await exec(client, `if sudo test -e ${JSON.stringify(installed)}; then sudo mkdir -p ${JSON.stringify(`${backupDir}/${parent}`)} && sudo cp -p -- ${JSON.stringify(installed)} ${JSON.stringify(backup)}; fi`);
       if (backedUp.code !== 0) throw new Error(`script backup failed (${name}): ${backedUp.stderr || backedUp.stdout}`.trim());
       if (parent !== '.') {
         const remoteParent = `${remoteDir}/${parent}`;
         const remoteParentResult = await exec(client, `mkdir -p ${JSON.stringify(remoteParent)}`);
-        if (remoteParentResult.code !== 0) throw new Error(`script upload directory setup failed (${name}): ${remoteParentResult.stderr || remoteParentResult.stdout}`.trim());
+        if (remoteParentResult.code !== 0) throw new Error(`script upload directory setup failed (${join(parent, name.slice(parent.length + 1))}): ${remoteParentResult.stderr || remoteParentResult.stdout}`.trim());
       }
       await upload(client, local, remote);
       const installedResult = await exec(client, `sudo mkdir -p ${JSON.stringify(`${installDir}/${parent}`)} && sudo install -m ${mode.toString(8)} ${JSON.stringify(remote)} ${JSON.stringify(installed)}`);
@@ -112,6 +116,9 @@ export async function deploy({ target, config, password }) {
     deploymentCommitted = true;
     const compare = extractCompare(output);
     if (compare) log.info(compare);
+    debugLog('reconnecting after interactive deployment sequence');
+    await close(client);
+    client = password === undefined ? await connect(target) : await connect(target, { password });
     debugLog(`syncing live config: /config/config.boot -> ${config}`);
     await download(client, '/config/config.boot', config);
     if (finalizeHooks) {

package/src/git.mjs

@@ -1,5 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promises as fs } from 'node:fs';
+import { relative, resolve } from 'node:path';
 import { promisify } from 'node:util';
 import { path } from '@eliware/common';
 
@@ -59,6 +60,14 @@ function configDirectory(config) {
   return path(config, '..');
 }
 
+async function relativeConfigPath(repo, config) {
+  const [canonicalRepo, canonicalConfig] = await Promise.all([
+    fs.realpath(repo),
+    fs.realpath(resolve(config)),
+  ]);
+  return relative(canonicalRepo, canonicalConfig);
+}
+
 async function repositoryRoot(config) {
   try {
     const { stdout } = await git(['rev-parse', '--show-toplevel'], configDirectory(config));
@@ -72,8 +81,8 @@ async function repositoryRoot(config) {
 export async function shouldSkip(config) {
   const repo = await repositoryRoot(config);
   if (!repo) return false;
-  const relative = config.startsWith(`${repo}/`) ? config.slice(repo.length + 1) : config;
-  const { stdout: status } = await git(['status', '--porcelain', '--', relative], repo);
+  const relativePath = await relativeConfigPath(repo, config);
+  const { stdout: status } = await git(['status', '--porcelain', '--', relativePath], repo);
   if (status.trim()) return false;
   const { stdout: subject } = await git(['log', '-1', '--format=%s'], repo);
   return subject.trim().startsWith('Pushback ');
@@ -83,12 +92,12 @@ export async function pushBack(config, { force = false } = {}) {
   const repo = await repositoryRoot(config);
   if (!repo) return false;
   return withRepositoryLock(repo, async () => {
-    const relative = config.startsWith(`${repo}/`) ? config.slice(repo.length + 1) : config;
-    const { stdout: diff } = await git(['diff', 'HEAD', '--', relative], repo);
+    const relativePath = await relativeConfigPath(repo, config);
+    const { stdout: diff } = await git(['diff', 'HEAD', '--', relativePath], repo);
     if (!diff) return false;
-    await git(['add', '--', relative], repo);
+    await git(['add', '--', relativePath], repo);
     const timestamp = new Date().toISOString().replace('T', ' ').slice(0, 19);
-    await git(['commit', '--only', '-m', `Pushback ${timestamp}`, '--', relative], repo);
+    await git(['commit', '--only', '-m', `Pushback ${timestamp}`, '--', relativePath], repo);
     await git(['push'], repo);
     return true;
   }, force);

package/src/ssh.mjs

@@ -1,8 +1,5 @@
-import { createHmac } from 'node:crypto';
 import { fs, log } from '@eliware/common';
-import ssh2 from 'ssh2';
-
-const { Client, utils } = ssh2;
+import { connect as sharedConnect } from '@eliware/ssh-client';
 
 const CONNECT_TIMEOUT = 30000;
 const OPERATION_TIMEOUT = 60000;
@@ -23,75 +20,17 @@ export function parseTarget(target) {
   return { username, host };
 }
 
-function wildcardMatch(pattern, value) {
-  const expression = `^${pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')}$`;
-  return new RegExp(expression).test(value);
-}
-
-function hostMatches(pattern, hosts) {
-  if (pattern.startsWith('|1|')) {
-    const [, , salt, digest] = pattern.split('|');
-    if (!salt || !digest) return false;
-    return hosts.some(host => createHmac('sha1', Buffer.from(salt, 'base64')).update(host).digest('base64') === digest);
-  }
-  return hosts.some(host => wildcardMatch(pattern, host));
-}
-
-function keyMatches(expected, actual) {
-  try {
-    const parsed = utils.parseKey(`${expected.type} ${expected.data}`);
-    return parsed.getPublicSSH().equals(actual);
-  } catch {
-    return false;
-  }
-}
-
-function verifyKnownHost(host, key, knownHosts) {
-  const hosts = [host, `[${host}]:22`];
-  let matched = false;
-  for (const line of knownHosts.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-    const fields = trimmed.split(/\s+/);
-    if (fields[0].startsWith('@')) {
-      if (fields[0] === '@revoked' && fields[1]?.split(',').some(pattern => hostMatches(pattern, hosts))) return false;
-      continue;
-    }
-    if (fields.length < 3) continue;
-    const [hostList, type, data] = fields;
-    const patterns = hostList.split(',');
-    if (patterns.some(pattern => pattern.startsWith('!') && hostMatches(pattern.slice(1), hosts))) return false;
-    if (patterns.some(pattern => !pattern.startsWith('!') && hostMatches(pattern, hosts))
-      && keyMatches({ type, data }, key)) matched = true;
-  }
-  return matched;
-}
-
 export async function connect(target, { password } = {}) {
   const { username, host } = parseTarget(target);
   log.debug(`[vyops] SSH connecting: ${username}@${host}`);
-  const privateKey = password === undefined
-    ? await fs.promises.readFile(process.env.VYOPS_SSH_KEY || `${process.env.HOME}/.ssh/id_rsa`)
-    : undefined;
-  const knownHostsPath = `${process.env.HOME}/.ssh/known_hosts`;
-  const knownHosts = await fs.promises.readFile(knownHostsPath, 'utf8');
-  return new Promise((resolve, reject) => {
-    const client = new Client();
-    client.once('ready', () => { log.debug(`[vyops] SSH connected: ${username}@${host}`); resolve(client); });
-    client.once('error', reject);
-    client.once('close', () => activeClients.delete(client));
-    activeClients.add(client);
-    client.connect({
-      host,
-      username,
-      agent: process.env.SSH_AUTH_SOCK,
-      privateKey,
-      ...(password === undefined ? {} : { password }),
-      hostVerifier: (key, callback) => callback(verifyKnownHost(host, key, knownHosts)),
-      readyTimeout: CONNECT_TIMEOUT,
-      authTimeout: CONNECT_TIMEOUT,
-    });
-  });
+  const connection = await sharedConnect({ host, username,
+    privateKeyPath: password === undefined ? (process.env.VYOPS_SSH_KEY || undefined) : undefined,
+    agent: process.env.SSH_AUTH_SOCK, knownHostsPath: process.env.SSH_KNOWN_HOSTS || '~/.ssh/known_hosts',
+    hostCaPath: process.env.SSH_HOST_CA, password, connectTimeout: CONNECT_TIMEOUT });
+  const client = connection.raw;
+  activeClients.add(client);
+  log.debug(`[vyops] SSH connected: ${username}@${host}`);
+  return client;
 }
 
 export function exec(client, command) {
@@ -122,6 +61,7 @@ export async function upload(client, local, remote, mode = 0o600) {
       if (error) { clearTimeout(timer); return reject(error); }
       sftp.writeFile(remote, data, { mode }, error2 => {
         clearTimeout(timer);
+        sftp.end?.();
         return error2 ? reject(error2) : resolve();
       });
     });
@@ -136,6 +76,7 @@ export function download(client, remote, local) {
       if (error) { clearTimeout(timer); return reject(error); }
       sftp.fastGet(remote, local, error2 => {
         clearTimeout(timer);
+        sftp.end?.();
         return error2 ? reject(error2) : resolve();
       });
     });