@eliware/vyops 1.0.6 → 1.0.8

package/README.md

@@ -4,7 +4,7 @@
 
 ## Features
 
-- SSH-key authentication via `ssh2`.
+- SSH-key authentication via `ssh2`, with optional password bootstrap via stdin.
 - Native VyOS curly-brace configuration validation.
 - Candidate load, `compare`, `commit-confirm`, confirmation, and save.
 - Complete `scripts/` tree synchronization, including post-commit hooks,
@@ -40,6 +40,14 @@ vyops   Deploy or dry-run a configuration.
 
 The target must be supplied as `user@host`. The config must use native VyOS curly-brace syntax.
 
+For a router that has not received its SSH key yet, provide the SSH password through stdin:
+
+```sh
+printf '%s\n' "$VYOS_PASSWORD" | vyops --password-stdin vyos@new-router config.boot
+```
+
+Password mode still requires the target host key to be present in `known_hosts`; it does not disable host verification. Passwords are not accepted as command-line arguments or written to logs.
+
 ## Usage
 
 Deploy:

package/RELEASE_NOTES.md

@@ -1,5 +1,35 @@
 # Release Notes
 
+## 1.0.8
+
+- Fail immediately with a redacted VyOS error when confirmed commits reject a
+  configuration after the confirmation prompt.
+- Prevent malformed PKI and other validation failures from appearing to hang
+  at the commit-confirm step.
+- Add regression coverage for post-prompt validation errors and structured
+  failures without detail text.
+
+Verification:
+
+- `npm test` (100% coverage across statements, branches, functions, and lines)
+- `npm run lint`
+- `npm run audit`
+
+## 1.0.7
+
+- Add password-based SSH bootstrap through the secure `--password-stdin` mode.
+- Preserve strict `known_hosts` verification when using password authentication.
+- Handle VyOS return-only pager prompts and disable paging before deployment compares.
+- Add packaged CLI, password-authentication, backup failure, and deployment regression tests.
+- Add opt-in real-VyOS integration test scaffolding for dry-run and backup workflows.
+
+Verification:
+
+- `npm test` (100% coverage across statements, branches, functions, and lines)
+- `npm run lint`
+- `npm run audit`
+- `npm run validate:package`
+
 ## 1.0.6
 
 - Add `--backup` to download the active `config.boot` and complete

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@eliware/vyops",
-    "version": "1.0.6",
+    "version": "1.0.8",
     "description": "Deploy native VyOS configuration files over SSH.",
     "main": "vyops.mjs",
     "scripts": {
@@ -48,4 +48,4 @@
         "LICENSE",
         "RELEASE_NOTES.md"
     ]
-}
+}

package/src/args.mjs

@@ -1,6 +1,6 @@
 export const usage = `Usage:
-  vyops [--dry-run] [--force] [--debug] <user@hostname-or-ip> <config.boot>
-  vyops --backup [--debug] <user@hostname-or-ip> <destination-directory>
+  vyops [--dry-run] [--force] [--debug] [--password-stdin] <user@hostname-or-ip> <config.boot>
+  vyops --backup [--debug] [--password-stdin] <user@hostname-or-ip> <destination-directory>
   vyops --help
   vyops --version`;
 
@@ -9,8 +9,8 @@ export function parseArgs(argv) {
   if (argv.length === 1 && argv[0] === '--version') return { version: true };
 
   const options = new Set(argv.filter(value => value.startsWith('--')));
-  if ([...options].some(option => !['--dry-run', '--force', '--debug', '--backup'].includes(option))) throw new Error(usage);
+  if ([...options].some(option => !['--dry-run', '--force', '--debug', '--backup', '--password-stdin'].includes(option))) throw new Error(usage);
   const values = argv.filter(value => !value.startsWith('--'));
   if (values.length !== 2) throw new Error(usage);
-  return { target: values[0], config: values[1], ...(options.has('--backup') ? { backup: true } : {}), ...(options.has('--dry-run') ? { dryRun: true } : {}), ...(options.has('--force') ? { force: true } : {}), ...(options.has('--debug') ? { debug: true } : {}) };
+  return { target: values[0], config: values[1], ...(options.has('--backup') ? { backup: true } : {}), ...(options.has('--dry-run') ? { dryRun: true } : {}), ...(options.has('--force') ? { force: true } : {}), ...(options.has('--debug') ? { debug: true } : {}), ...(options.has('--password-stdin') ? { passwordStdin: true } : {}) };
 }

package/src/backup.mjs

@@ -7,8 +7,8 @@ function remoteScriptPath(value) {
   return name;
 }
 
-export async function backup({ target, config }) {
-  const client = await connect(target);
+export async function backup({ target, config, password }) {
+  const client = password === undefined ? await connect(target) : await connect(target, { password });
   try {
     await fs.promises.mkdir(config, { recursive: true });
     await fs.promises.mkdir(path(config, 'scripts'), { recursive: true });

package/src/deploy.mjs

@@ -76,10 +76,10 @@ async function installScripts(client, config, log, runId) {
   };
 }
 
-export async function deploy({ target, config }) {
+export async function deploy({ target, config, password }) {
   const debugLog = message => log.debug(`[vyops] ${message}`);
   debugLog(`connecting: ${target}`);
-  const client = await connect(target);
+  const client = password === undefined ? await connect(target) : await connect(target, { password });
   debugLog('SSH connected');
   let finalizeHooks;
   let hooksFinalized = false;
@@ -95,6 +95,7 @@ export async function deploy({ target, config }) {
     const output = await interactive(client, [
       'configure',
       { command: `load ${remote}`, reject: /(?:load failed|commit failed|commit aborted|cannot commit|configuration (?:commit )?failed|invalid configuration|error|invalid)/i },
+      'run set terminal length 0',
       "printf '%s\\n' '--- compare ---'",
       'compare',
       "printf '%s\\n' '--- end compare ---'",

package/src/main.mjs

@@ -6,6 +6,7 @@ import { readAndValidateConfig } from './validate.mjs';
 import { pushBack, shouldSkip } from './git.mjs';
 import { closeAll } from './ssh.mjs';
 import { log, registerHandlers, registerSignals } from '@eliware/common';
+import { readFile } from 'node:fs/promises';
 
 const errors = registerHandlers({ log });
 const signals = registerSignals({ log, shutdownHook: async () => closeAll() });
@@ -21,6 +22,10 @@ try {
     log.info(packageJson.version);
     process.exit(0);
   }
+  if (args.passwordStdin) {
+    args.password = (await readFile(0, 'utf8')).replace(/\r?\n$/, '');
+    if (!args.password) throw new Error('password-stdin received an empty password');
+  }
   if (args.backup) {
     await backup(args);
     log.info(`Backup successful: ${args.config}`);

package/src/ssh.mjs

@@ -67,10 +67,12 @@ function verifyKnownHost(host, key, knownHosts) {
   return matched;
 }
 
-export async function connect(target) {
+export async function connect(target, { password } = {}) {
   const { username, host } = parseTarget(target);
   log.debug(`[vyops] SSH connecting: ${username}@${host}`);
-  const privateKey = await fs.promises.readFile(process.env.VYOPS_SSH_KEY || `${process.env.HOME}/.ssh/id_rsa`);
+  const privateKey = password === undefined
+    ? await fs.promises.readFile(process.env.VYOPS_SSH_KEY || `${process.env.HOME}/.ssh/id_rsa`)
+    : undefined;
   const knownHostsPath = `${process.env.HOME}/.ssh/known_hosts`;
   const knownHosts = await fs.promises.readFile(knownHostsPath, 'utf8');
   return new Promise((resolve, reject) => {
@@ -84,6 +86,7 @@ export async function connect(target) {
       username,
       agent: process.env.SSH_AUTH_SOCK,
       privateKey,
+      ...(password === undefined ? {} : { password }),
       hostVerifier: (key, callback) => callback(verifyKnownHost(host, key, knownHosts)),
       readyTimeout: CONNECT_TIMEOUT,
       authTimeout: CONNECT_TIMEOUT,
@@ -164,6 +167,12 @@ export function interactive(client, commands, log = () => {}) {
       const ansi = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[ -/]*[@-~]`, 'g');
       const title = new RegExp(`${String.fromCharCode(27)}\\][^${String.fromCharCode(7)}]*(?:${String.fromCharCode(7)}|${String.fromCharCode(27)}\\\\)`, 'g');
       const clean = value => value.replace(ansi, '').replace(title, '').replace(/\r/g, '');
+      const failureDetail = value => value.split('\n')
+        .map(line => line.trim())
+        .find(line => /(?:failed|failure|invalid|error|aborted|pending)/i.test(line))
+        ?.replace(/(certificate|private key|key)\s+"[^"]+"/ig, '$1 "[redacted]"')
+        .replace(/\s+/g, ' ')
+        .slice(0, 240);
       const prompt = value => /(?:^|\n)[A-Za-z0-9._-]+@[A-Za-z0-9._:-]+(?::~\$|#)\s*$/.test(value);
       const sendNext = () => {
         if (waiting || index >= commands.length) return;
@@ -187,15 +196,20 @@ export function interactive(client, commands, log = () => {}) {
           settled = true;
           clearTimeout(timer);
           stream.close();
-          reject(new Error(`interactive command failed: ${currentItem.command}`));
+          const detail = failureDetail(cleaned);
+          reject(new Error(`interactive command failed: ${currentItem.command}${detail ? ` (${detail})` : ''}`));
           return;
         }
-        const pager = /(?:^|\n):\s*$/.test(cleaned) || /--More--\s*$/i.test(cleaned);
+        const pagerReturn = /No next tag\s*\(press RETURN\)/i.test(cleaned);
+        const pager = /(?:^|\n):\s*$/.test(cleaned)
+          || /--More--\s*$/i.test(cleaned)
+          || pagerReturn;
         log(`state after data: index=${index}, waiting=${waiting}, answering=${answering}, prompt=${prompt(cleaned)}, pager=${pager}, bytes=${text.length}`);
         if (pager) {
-          log('pager prompt detected; sending space');
-          stream.write(' ');
-          log('write complete: space');
+          const key = pagerReturn ? '\n' : ' ';
+          log(`pager prompt detected; sending ${pagerReturn ? 'return' : 'space'}`);
+          stream.write(key);
+          log(`write complete: ${pagerReturn ? 'return' : 'space'}`);
           return;
         }
         if (/Proceed\s*\?\s*\[Y\/n\]/i.test(cleaned) && !answering) {