@eliware/vyops 1.0.5 → 1.0.7

package/README.md

@@ -4,7 +4,7 @@
 
 ## Features
 
-- SSH-key authentication via `ssh2`.
+- SSH-key authentication via `ssh2`, with optional password bootstrap via stdin.
 - Native VyOS curly-brace configuration validation.
 - Candidate load, `compare`, `commit-confirm`, confirmation, and save.
 - Complete `scripts/` tree synchronization, including post-commit hooks,
@@ -40,6 +40,14 @@ vyops   Deploy or dry-run a configuration.
 
 The target must be supplied as `user@host`. The config must use native VyOS curly-brace syntax.
 
+For a router that has not received its SSH key yet, provide the SSH password through stdin:
+
+```sh
+printf '%s\n' "$VYOS_PASSWORD" | vyops --password-stdin vyos@new-router config.boot
+```
+
+Password mode still requires the target host key to be present in `known_hosts`; it does not disable host verification. Passwords are not accepted as command-line arguments or written to logs.
+
 ## Usage
 
 Deploy:
@@ -55,8 +63,13 @@ Console switches:
 ./vyops.mjs --version
 ./vyops.mjs --dry-run vyos@core1 /path/to/config.boot
 ./vyops.mjs --force --debug vyos@core1 /path/to/config.boot
+./vyops.mjs --backup vyos@core1 /path/to/backup
 ```
 
+`--backup` downloads the active `/config/config.boot` and the complete
+`/config/scripts` tree into the destination directory. It does not enter
+configuration mode or modify the router.
+
 `--dry-run` validates the config and skips SSH, commit, save, download, and Git pushback.
 
 The deployment workflow:
@@ -105,7 +118,7 @@ Deployments require existing SSH keys and a reachable VyOS target. The workflow
 
 ## Support
 
-Repository: `git@github.com:eliware/vyops-js.git`
+Repository: `git@github.com:eliware/vyops.git`
 
 Open an issue or provide a focused patch with tests and validation results.
 

package/RELEASE_NOTES.md

@@ -1,5 +1,37 @@
 # Release Notes
 
+## 1.0.7
+
+- Add password-based SSH bootstrap through the secure `--password-stdin` mode.
+- Preserve strict `known_hosts` verification when using password authentication.
+- Handle VyOS return-only pager prompts and disable paging before deployment compares.
+- Add packaged CLI, password-authentication, backup failure, and deployment regression tests.
+- Add opt-in real-VyOS integration test scaffolding for dry-run and backup workflows.
+
+Verification:
+
+- `npm test` (100% coverage across statements, branches, functions, and lines)
+- `npm run lint`
+- `npm run audit`
+- `npm run validate:package`
+
+## 1.0.6
+
+- Add `--backup` to download the active `config.boot` and complete
+  `/config/scripts` tree into a local backup directory.
+- Fail promptly on VyOS load and commit errors instead of waiting indefinitely
+  for confirmation prompts.
+- Preserve synchronized scripts when post-commit local config download fails.
+- Include staged configuration changes in Git pushback detection.
+- Expand CLI, deployment, backup, Git, and SSH regression coverage.
+
+Verification:
+
+- `npm test` (100% coverage across statements, branches, functions, and lines)
+- `npm run lint`
+- `npm run audit`
+- `npm run validate:package`
+
 ## 1.0.5
 
 - Create nested temporary directories before uploading synchronized scripts.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@eliware/vyops",
-    "version": "1.0.5",
+    "version": "1.0.7",
     "description": "Deploy native VyOS configuration files over SSH.",
     "main": "vyops.mjs",
     "scripts": {
@@ -21,12 +21,12 @@
     ],
     "type": "module",
     "dependencies": {
-        "@eliware/common": "^1.1.7",
+        "@eliware/common": "^1.1.8",
         "ssh2": "^1.17.0"
     },
     "devDependencies": {
         "jest": "^30.4.2",
-        "oxlint": "^1.77.0"
+        "oxlint": "^1.79.0"
     },
     "bin": {
         "vyops": "./bin/vyops"
@@ -48,4 +48,4 @@
         "LICENSE",
         "RELEASE_NOTES.md"
     ]
-}
+}

package/src/args.mjs

@@ -1,5 +1,6 @@
 export const usage = `Usage:
-  vyops [--dry-run] [--force] [--debug] <user@hostname-or-ip> <config.boot>
+  vyops [--dry-run] [--force] [--debug] [--password-stdin] <user@hostname-or-ip> <config.boot>
+  vyops --backup [--debug] [--password-stdin] <user@hostname-or-ip> <destination-directory>
   vyops --help
   vyops --version`;
 
@@ -8,8 +9,8 @@ export function parseArgs(argv) {
   if (argv.length === 1 && argv[0] === '--version') return { version: true };
 
   const options = new Set(argv.filter(value => value.startsWith('--')));
-  if ([...options].some(option => !['--dry-run', '--force', '--debug'].includes(option))) throw new Error(usage);
+  if ([...options].some(option => !['--dry-run', '--force', '--debug', '--backup', '--password-stdin'].includes(option))) throw new Error(usage);
   const values = argv.filter(value => !value.startsWith('--'));
   if (values.length !== 2) throw new Error(usage);
-  return { target: values[0], config: values[1], ...(options.has('--dry-run') ? { dryRun: true } : {}), ...(options.has('--force') ? { force: true } : {}), ...(options.has('--debug') ? { debug: true } : {}) };
+  return { target: values[0], config: values[1], ...(options.has('--backup') ? { backup: true } : {}), ...(options.has('--dry-run') ? { dryRun: true } : {}), ...(options.has('--force') ? { force: true } : {}), ...(options.has('--debug') ? { debug: true } : {}), ...(options.has('--password-stdin') ? { passwordStdin: true } : {}) };
 }

package/src/backup.mjs

@@ -0,0 +1,29 @@
+import { fs, path, log } from '@eliware/common';
+import { close, connect, download, exec } from './ssh.mjs';
+
+function remoteScriptPath(value) {
+  const name = value.replace(/^\/config\/scripts\/?/, '');
+  if (!name || name.startsWith('/') || name.split('/').includes('..')) throw new Error(`unsafe remote script path: ${value}`);
+  return name;
+}
+
+export async function backup({ target, config, password }) {
+  const client = password === undefined ? await connect(target) : await connect(target, { password });
+  try {
+    await fs.promises.mkdir(config, { recursive: true });
+    await fs.promises.mkdir(path(config, 'scripts'), { recursive: true });
+    await download(client, '/config/config.boot', path(config, 'config.boot'));
+    const result = await exec(client, "find /config/scripts -type f -print 2>/dev/null");
+    if (result.code !== 0) throw new Error(`could not list remote scripts: ${result.stderr || result.stdout}`.trim());
+    const files = result.stdout.split(/\r?\n/).map(value => value.trim()).filter(Boolean).map(remoteScriptPath);
+    for (const name of files) {
+      const local = path(config, 'scripts', name);
+      await fs.promises.mkdir(path(local, '..'), { recursive: true });
+      await download(client, `/config/scripts/${name}`, local);
+      log.debug(`[vyops] backed up script: ${name}`);
+    }
+    return 0;
+  } finally {
+    await close(client);
+  }
+}

package/src/deploy.mjs

@@ -76,12 +76,14 @@ async function installScripts(client, config, log, runId) {
   };
 }
 
-export async function deploy({ target, config }) {
+export async function deploy({ target, config, password }) {
   const debugLog = message => log.debug(`[vyops] ${message}`);
   debugLog(`connecting: ${target}`);
-  const client = await connect(target);
+  const client = password === undefined ? await connect(target) : await connect(target, { password });
   debugLog('SSH connected');
   let finalizeHooks;
+  let hooksFinalized = false;
+  let deploymentCommitted = false;
   const runId = randomUUID();
   const remote = `/home/vyos/.config.deploy.${runId}`;
   try {
@@ -92,25 +94,30 @@ export async function deploy({ target, config }) {
     debugLog('starting interactive deployment sequence');
     const output = await interactive(client, [
       'configure',
-      { command: `load ${remote}`, reject: /(?:load failed|error|invalid)/i },
+      { command: `load ${remote}`, reject: /(?:load failed|commit failed|commit aborted|cannot commit|configuration (?:commit )?failed|invalid configuration|error|invalid)/i },
+      'run set terminal length 0',
       "printf '%s\\n' '--- compare ---'",
       'compare',
       "printf '%s\\n' '--- end compare ---'",
-      { command: 'commit-confirm 5', reject: /(?:commit failed|error|invalid)/i },
+      { command: 'commit-confirm 5', reject: /(?:commit failed|commit aborted|cannot commit|configuration (?:commit )?failed|invalid configuration|error|invalid)/i },
       { command: 'confirm', reject: /(?:confirm failed|error|invalid)/i },
       { command: 'save', reject: /(?:save failed|error|invalid)/i },
       'exit',
       'exit',
     ], debugLog);
     debugLog(`interactive sequence returned (${output.length} bytes)`);
+    deploymentCommitted = true;
     const compare = extractCompare(output);
     if (compare) log.info(compare);
-    if (finalizeHooks) await finalizeHooks(true);
     debugLog(`syncing live config: /config/config.boot -> ${config}`);
     await download(client, '/config/config.boot', config);
+    if (finalizeHooks) {
+      hooksFinalized = true;
+      await finalizeHooks(true);
+    }
     return 0;
   } catch (error) {
-    if (finalizeHooks) await finalizeHooks(false);
+    if (finalizeHooks && !hooksFinalized && !deploymentCommitted) await finalizeHooks(false);
     throw error;
   } finally {
     debugLog('cleaning up remote file');

package/src/git.mjs

@@ -75,7 +75,7 @@ export async function pushBack(config, { force = false } = {}) {
   const repo = root.trim();
   return withRepositoryLock(repo, async () => {
     const relative = config.startsWith(`${repo}/`) ? config.slice(repo.length + 1) : config;
-    const { stdout: diff } = await git(['diff', '--', relative], repo);
+    const { stdout: diff } = await git(['diff', 'HEAD', '--', relative], repo);
     if (!diff) return false;
     await git(['add', '--', relative], repo);
     const timestamp = new Date().toISOString().replace('T', ' ').slice(0, 19);

package/src/main.mjs

@@ -1,10 +1,12 @@
 import { parseArgs, usage } from './args.mjs';
 import packageJson from '../package.json' with { type: 'json' };
 import { deploy } from './deploy.mjs';
+import { backup } from './backup.mjs';
 import { readAndValidateConfig } from './validate.mjs';
 import { pushBack, shouldSkip } from './git.mjs';
 import { closeAll } from './ssh.mjs';
 import { log, registerHandlers, registerSignals } from '@eliware/common';
+import { readFile } from 'node:fs/promises';
 
 const errors = registerHandlers({ log });
 const signals = registerSignals({ log, shutdownHook: async () => closeAll() });
@@ -20,6 +22,15 @@ try {
     log.info(packageJson.version);
     process.exit(0);
   }
+  if (args.passwordStdin) {
+    args.password = (await readFile(0, 'utf8')).replace(/\r?\n$/, '');
+    if (!args.password) throw new Error('password-stdin received an empty password');
+  }
+  if (args.backup) {
+    await backup(args);
+    log.info(`Backup successful: ${args.config}`);
+    process.exit(0);
+  }
   log.debug(`[vyops] validating config: ${args.config}`);
   await readAndValidateConfig(args.config);
   log.debug('[vyops] config validation complete');

package/src/ssh.mjs

@@ -67,10 +67,12 @@ function verifyKnownHost(host, key, knownHosts) {
   return matched;
 }
 
-export async function connect(target) {
+export async function connect(target, { password } = {}) {
   const { username, host } = parseTarget(target);
   log.debug(`[vyops] SSH connecting: ${username}@${host}`);
-  const privateKey = await fs.promises.readFile(process.env.VYOPS_SSH_KEY || `${process.env.HOME}/.ssh/id_rsa`);
+  const privateKey = password === undefined
+    ? await fs.promises.readFile(process.env.VYOPS_SSH_KEY || `${process.env.HOME}/.ssh/id_rsa`)
+    : undefined;
   const knownHostsPath = `${process.env.HOME}/.ssh/known_hosts`;
   const knownHosts = await fs.promises.readFile(knownHostsPath, 'utf8');
   return new Promise((resolve, reject) => {
@@ -84,6 +86,7 @@ export async function connect(target) {
       username,
       agent: process.env.SSH_AUTH_SOCK,
       privateKey,
+      ...(password === undefined ? {} : { password }),
       hostVerifier: (key, callback) => callback(verifyKnownHost(host, key, knownHosts)),
       readyTimeout: CONNECT_TIMEOUT,
       authTimeout: CONNECT_TIMEOUT,
@@ -183,12 +186,23 @@ export function interactive(client, commands, log = () => {}) {
         response += text;
         log(`recv (${text.length} bytes): ${JSON.stringify(text)}`);
         const cleaned = clean(response);
-        const pager = /(?:^|\n):\s*$/.test(cleaned) || /--More--\s*$/i.test(cleaned);
+        if (waiting && typeof currentItem !== 'string' && currentItem.reject?.test(cleaned)) {
+          settled = true;
+          clearTimeout(timer);
+          stream.close();
+          reject(new Error(`interactive command failed: ${currentItem.command}`));
+          return;
+        }
+        const pagerReturn = /No next tag\s*\(press RETURN\)/i.test(cleaned);
+        const pager = /(?:^|\n):\s*$/.test(cleaned)
+          || /--More--\s*$/i.test(cleaned)
+          || pagerReturn;
         log(`state after data: index=${index}, waiting=${waiting}, answering=${answering}, prompt=${prompt(cleaned)}, pager=${pager}, bytes=${text.length}`);
         if (pager) {
-          log('pager prompt detected; sending space');
-          stream.write(' ');
-          log('write complete: space');
+          const key = pagerReturn ? '\n' : ' ';
+          log(`pager prompt detected; sending ${pagerReturn ? 'return' : 'space'}`);
+          stream.write(key);
+          log(`write complete: ${pagerReturn ? 'return' : 'space'}`);
           return;
         }
         if (/Proceed\s*\?\s*\[Y\/n\]/i.test(cleaned) && !answering) {
@@ -207,13 +221,6 @@ export function interactive(client, commands, log = () => {}) {
           answering = false;
           waiting = false;
           log(`response [${index}]:\n${cleaned}`);
-          if (typeof currentItem !== 'string' && currentItem.reject?.test(cleaned)) {
-            settled = true;
-            clearTimeout(timer);
-            stream.close();
-            reject(new Error(`interactive command failed: ${currentItem.command}`));
-            return;
-          }
           if (index >= commands.length) {
             settled = true;
             clearTimeout(timer);