@takodotid/circuit 0.26.2 → 0.28.0

package/dist/cli/index.js

@@ -110,6 +110,12 @@ var MARKER = /<secret:([A-Za-z0-9_./:-]+)>/g;
 var substitute = (text) => text.replace(MARKER, (_, reference) => valueOf(reference));
 var valueOfReference = valueOf;
 
+// src/transport/console.ts
+import { spawn } from "node:child_process";
+import { EventEmitter } from "node:events";
+import { Duplex } from "node:stream";
+import { Client as Client2 } from "ssh2";
+
 // src/transport/ssh.ts
 import { Client } from "ssh2";
 function connect(login) {
@@ -202,6 +208,321 @@ function upload(client, path, content) {
   });
 }
 
+// src/transport/console.ts
+var RELAY = `import fcntl, os, select, sys, termios
+
+port, baud = sys.argv[1], int(sys.argv[2])
+fd = os.open(port, os.O_RDWR | os.O_NOCTTY | os.O_NONBLOCK)
+
+try:
+    fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+except OSError:
+    sys.stderr.write("busy: another session holds " + port + "\\n")
+    sys.exit(3)
+
+attrs = termios.tcgetattr(fd)
+attrs[0] = attrs[1] = attrs[3] = 0
+attrs[2] = termios.CS8 | termios.CREAD | termios.CLOCAL
+attrs[4] = attrs[5] = getattr(termios, "B%d" % baud)
+termios.tcsetattr(fd, termios.TCSANOW, attrs)
+termios.tcflush(fd, termios.TCIOFLUSH)
+
+sys.stderr.write("ready\\n")
+sys.stderr.flush()
+
+while True:
+    ready, _, _ = select.select([0, fd], [], [])
+
+    if 0 in ready:
+        data = os.read(0, 4096)
+        if not data:
+            break
+        while data:
+            try:
+                data = data[os.write(fd, data):]
+            except BlockingIOError:
+                select.select([], [fd], [])
+
+    if fd in ready:
+        try:
+            data = os.read(fd, 4096)
+        except BlockingIOError:
+            continue
+        if data:
+            os.write(1, data)
+`;
+var RELAY_PATH = "/tmp/circuit-console.py";
+var PORT = /^\/dev\/[\w./:+-]+$/;
+var WINDOWS_PORT = /^COM\d+$/i;
+var WINDOWS_RELAY = `
+$port = New-Object System.IO.Ports.SerialPort $env:CIRCUIT_PORT, ([int]$env:CIRCUIT_BAUD), 'None', 8, 'One'
+try { $port.Open() } catch [System.UnauthorizedAccessException] { [Console]::Error.WriteLine("busy: another program holds " + $env:CIRCUIT_PORT); exit 3 } catch { [Console]::Error.WriteLine("cannot open " + $env:CIRCUIT_PORT + ": " + $_.Exception.Message); exit 2 }
+[Console]::Error.WriteLine("ready")
+$in = [Console]::OpenStandardInput()
+$out = [Console]::OpenStandardOutput()
+$buffer = New-Object byte[] 4096
+$reading = $in.ReadAsync($buffer, 0, $buffer.Length)
+while ($true) {
+    if ($reading.IsCompleted) {
+        if ($reading.Result -le 0) { break }
+        $port.Write($buffer, 0, $reading.Result)
+        $reading = $in.ReadAsync($buffer, 0, $buffer.Length)
+    }
+    $waiting = $port.BytesToRead
+    if ($waiting -gt 0) {
+        $data = New-Object byte[] $waiting
+        $got = $port.Read($data, 0, $waiting)
+        $out.Write($data, 0, $got)
+        $out.Flush()
+    } else {
+        Start-Sleep -Milliseconds 10
+    }
+}
+$port.Close()
+`;
+function connectJump(jump) {
+  return new Promise((done, fail) => {
+    const client = new Client2;
+    const login = { username: jump.user, password: resolve(jump.password), readyTimeout: 60000 };
+    client.on("ready", () => done(client)).on("error", fail);
+    if (!jump.cloudflared) {
+      client.connect({ ...login, host: jump.host, port: jump.port ?? 22 });
+      return;
+    }
+    const tunnel = spawn("cloudflared", ["access", "ssh", "--hostname", jump.host], { stdio: ["pipe", "pipe", "ignore"] });
+    tunnel.on("error", (error) => fail(new Error(`cloudflared did not start: ${error.message}`)));
+    client.on("close", () => tunnel.kill());
+    client.connect({ ...login, sock: Duplex.from({ readable: tunnel.stdout, writable: tunnel.stdin }) });
+  });
+}
+async function openConsole(console2) {
+  const windows = !console2.jump && process.platform === "win32";
+  if (windows ? !WINDOWS_PORT.test(console2.port) : !PORT.test(console2.port)) {
+    throw new Error(`console port ${console2.port} is not ${windows ? "a COM port" : "a path under /dev"}`);
+  }
+  if (!Number.isInteger(console2.baud) || console2.baud <= 0)
+    throw new Error(`console baud ${console2.baud} is not a line speed`);
+  for (let attempt = 1;; attempt++) {
+    try {
+      return await (console2.jump ? openOnJump(console2, console2.jump) : openHere(console2));
+    } catch (error) {
+      if (attempt >= 5 || !/busy:/.test(error.message))
+        throw error;
+      await new Promise((done) => setTimeout(done, 5000));
+    }
+  }
+}
+async function openOnJump(console2, jump) {
+  const client = await connectJump(jump);
+  try {
+    const encoded = Buffer.from(RELAY).toString("base64");
+    await exec(client, `sh -c 'printf %s ${encoded} | base64 -d > ${RELAY_PATH}'`, 30000);
+    const channel = await new Promise((done, fail) => {
+      client.exec(`python3 ${RELAY_PATH} ${console2.port} ${console2.baud}`, (error, stream) => error ? fail(error) : done(stream));
+    });
+    await relayReady(channel);
+    return {
+      channel: asTerminal(channel),
+      close: () => {
+        channel.end();
+        client.end();
+      }
+    };
+  } catch (error) {
+    client.end();
+    throw error;
+  }
+}
+async function openHere(console2) {
+  const child = process.platform === "win32" ? spawn("powershell", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_RELAY], {
+    env: { ...process.env, CIRCUIT_PORT: console2.port, CIRCUIT_BAUD: String(console2.baud) }
+  }) : spawn("python3", ["-c", RELAY, console2.port, String(console2.baud)]);
+  const channel = Object.assign(new EventEmitter, {
+    stderr: child.stderr,
+    write: (data) => child.stdin.write(data),
+    end: () => child.stdin.end()
+  });
+  child.stdout.on("data", (chunk) => channel.emit("data", chunk));
+  child.on("close", () => channel.emit("close"));
+  child.on("error", (error) => channel.emit("close", error));
+  const asChannel = channel;
+  try {
+    await relayReady(asChannel);
+  } catch (error) {
+    child.kill();
+    throw error;
+  }
+  return {
+    channel: asTerminal(asChannel),
+    close: () => {
+      channel.end();
+      setTimeout(() => child.kill(), 2000).unref();
+    }
+  };
+}
+function relayReady(channel) {
+  return new Promise((done, fail) => {
+    let said = "";
+    const limit = setTimeout(() => fail(new Error(`the console relay did not start: ${said.trim()}`)), 30000);
+    channel.stderr.on("data", (chunk) => {
+      said += chunk.toString("utf8");
+      if (said.includes("ready")) {
+        clearTimeout(limit);
+        done();
+      }
+    });
+    channel.on("close", () => {
+      clearTimeout(limit);
+      fail(new Error(`the console relay stopped: ${said.trim() || "no reason given"}`));
+    });
+  });
+}
+function asTerminal(channel) {
+  const write = channel.write.bind(channel);
+  channel.write = (data, ...rest) => write(typeof data === "string" ? data.replace(/\r?\n/g, "\r") : data, ...rest);
+  return channel;
+}
+function consoleOf(device) {
+  const console2 = device.connection.console;
+  if (!console2)
+    throw new Error(`${device.name}: no connection.console`);
+  const user = device.users?.[device.connection.user];
+  if (!user)
+    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
+  return { console: console2, user: device.connection.user, password: resolve(user.password) };
+}
+var ESCAPES = /\u001b(?:\[[0-9;?]*[A-Za-z]|[()][A-Z0-9]|[=>78c])/g;
+function expect(channel, write, patterns, timeout = 30000) {
+  return new Promise((done, fail) => {
+    let text = "";
+    const stop = () => {
+      clearTimeout(limit);
+      channel.removeListener("data", onData);
+    };
+    const onData = (chunk) => {
+      text += chunk.toString("utf8").replace(/\r/g, "").replace(ESCAPES, "");
+      const index = patterns.findIndex((pattern) => pattern.test(text));
+      if (index < 0)
+        return;
+      stop();
+      done({ index, text });
+    };
+    const limit = setTimeout(() => {
+      stop();
+      fail(new Error(`the console did not answer: ${text.slice(-200)}`));
+    }, timeout);
+    channel.on("data", onData);
+    if (write)
+      channel.write(write);
+  });
+}
+async function consoleLogin(channel, dialect, user, password) {
+  const others = dialect.others ?? [];
+  const states = [dialect.login, dialect.password, ...others.map(([pattern]) => pattern), dialect.prompt];
+  const toward = (index) => {
+    if (index === 1)
+      return `
+`;
+    if (index < 2 + others.length)
+      return others[index - 2][1];
+    return `${dialect.logout}
+`;
+  };
+  let state = (await expect(channel, `
+`, states)).index;
+  for (let step = 0;state !== 0; step++) {
+    if (step >= 10)
+      throw new Error("the console never reached a login prompt");
+    state = (await expect(channel, toward(state), states)).index;
+  }
+  const name = dialect.user ? dialect.user(user) : user;
+  if ((await expect(channel, `${name}
+`, [dialect.password, dialect.login, dialect.prompt])).index !== 0) {
+    throw new Error("the console did not ask for a password");
+  }
+  let answer = await expect(channel, `${password}
+`, [dialect.prompt, dialect.login, ...others.map(([pattern]) => pattern)], 60000);
+  for (let step = 0;answer.index >= 2; step++) {
+    if (step >= 5)
+      throw new Error("the console kept asking after the login");
+    answer = await expect(channel, others[answer.index - 2][1], [
+      dialect.prompt,
+      dialect.login,
+      ...others.map(([pattern]) => pattern)
+    ]);
+  }
+  if (answer.index === 1)
+    throw new Error(`the console refused the login of ${user}`);
+  await quiet(channel, 800);
+}
+function quiet(channel, silence) {
+  return new Promise((done) => {
+    let timer = setTimeout(finish, silence);
+    const limit = setTimeout(finish, 5000);
+    function finish() {
+      clearTimeout(timer);
+      clearTimeout(limit);
+      channel.removeListener("data", onData);
+      done();
+    }
+    function onData() {
+      clearTimeout(timer);
+      timer = setTimeout(finish, silence);
+    }
+    channel.on("data", onData);
+  });
+}
+function afterEcho(text, command) {
+  for (let start = text.indexOf(command[0] ?? "");start >= 0; start = text.indexOf(command[0], start + 1)) {
+    const end = echoEnd(text, command, start);
+    if (end !== undefined)
+      return text.slice(end).replace(/^\r?\n/, "");
+  }
+  return text;
+}
+function echoEnd(text, command, start) {
+  let at = start;
+  for (const character of command) {
+    while (at < text.length && text[at] !== character && /[\r\n]/.test(text[at]))
+      at++;
+    if (text[at] !== character)
+      return;
+    at++;
+  }
+  return at;
+}
+
+class ConsoleShell {
+  channel;
+  dialect;
+  constructor(channel, dialect) {
+    this.channel = channel;
+    this.dialect = dialect;
+  }
+  async run(command, timeout = 120000) {
+    const pagers = (this.dialect.others ?? []).filter(([, reply]) => !reply.endsWith(`
+`));
+    const patterns = [this.dialect.prompt, ...pagers.map(([pattern]) => pattern)];
+    let { index, text } = await expect(this.channel, `${command}
+`, patterns, timeout);
+    let output = "";
+    while (index > 0) {
+      const [pattern, reply] = pagers[index - 1];
+      output += text.replace(pattern, "");
+      ({ index, text } = await expect(this.channel, reply, patterns, timeout));
+    }
+    output += text;
+    const lines = afterEcho(output, command).split(`
+`);
+    return lines.slice(0, -1).join(`
+`);
+  }
+  logout() {
+    this.channel.write(`${this.dialect.logout}
+`);
+  }
+}
+
 // src/adapters/devices/fortios/names.ts
 function nameOf(device, name) {
   if (device.interfaces && name in device.interfaces)
@@ -1134,7 +1455,9 @@ var TABLES = {
   "firewall policy6": ORDERED,
   "firewall local-in-policy": ORDERED,
   "firewall local-in-policy6": ORDERED,
-  "firewall central-snat-map": ORDERED
+  "firewall central-snat-map": ORDERED,
+  "router static": { distinct: true },
+  "router static6": { distinct: true }
 };
 var IGNORED = new Set(["uuid", "snmp-index"]);
 var IGNORED_IN = { "system global": ["cfg-save", "cfg-revert-timeout", "alias"] };
@@ -1271,7 +1594,7 @@ function compare(path, want, have, table, top, context) {
   }
   for (const [header, child] of want.blocks)
     nested(header, child, have.blocks.get(header) ?? new Block);
-  const entries = table?.byContent ? byContent(path, want, have) : byId(path, want, have, table, context);
+  const entries = table?.byContent ? byContent(path, want, have) : table?.distinct ? distinctById(path, want, have, table, context) : byId(path, want, have, table, context);
   send.push(...entries.send);
   show.push(...entries.show);
   if (top) {
@@ -1320,6 +1643,30 @@ function byId(path, want, have, table, context) {
   }
   return { send, show, removals, removed };
 }
+function distinctById(path, want, have, table, context) {
+  const deletes = [];
+  const creates = [];
+  const show = [];
+  for (const [key, entry] of want.entries) {
+    const old = have.entries.get(key);
+    const where = [...path, bare(entry.id)];
+    if (old) {
+      if (!compare(where, entry.block, old.block, undefined, false, context).send.length)
+        continue;
+      deletes.push(`delete ${old.id}`);
+      show.push(...shown("-", where, old.block));
+    }
+    creates.push(...creation(entry, table));
+    show.push(...shown("+", where, entry.block));
+  }
+  for (const [key, entry] of have.entries) {
+    if (want.entries.has(key) || isFactory(table, entry))
+      continue;
+    deletes.push(`delete ${entry.id}`);
+    show.push(...shown("-", [...path, bare(entry.id)], entry.block));
+  }
+  return { send: [...deletes, ...creates], show, removals: [], removed: [] };
+}
 function moves(want, have) {
   const wanted = [...want.entries.keys()];
   const order = [...have.entries.keys()].filter((key) => want.entries.has(key));
@@ -2356,7 +2703,43 @@ async function login(device) {
     password: resolve(user.password)
   });
 }
-async function session(device, work) {
+var FORTIOS_CONSOLE = {
+  login: /login: $/,
+  password: /Password: $/,
+  prompt: /[#$] $/,
+  logout: "exit",
+  others: [
+    [BANNER2, "a"],
+    [/--More-- $/, "q"],
+    [/\([^)\n]*\) [#$] $/, `end
+`]
+  ]
+};
+async function consoleLogout(cli) {
+  await leave(cli).catch(() => {
+    return;
+  });
+  await cli.run("exit", 1e4).catch(() => {
+    return;
+  });
+}
+async function consoleSession(device, work) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  try {
+    await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+    const cli = new Cli(opened.channel);
+    const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+    const result = await work(cli, relogin);
+    await consoleLogout(cli);
+    return result;
+  } finally {
+    opened.close();
+  }
+}
+async function session(device, work, options = {}) {
+  if (options.console)
+    return consoleSession(device, (cli) => work(cli));
   const client = await login(device);
   try {
     const channel = await shell(client, 4000);
@@ -2412,8 +2795,8 @@ async function readConfig(cli, device) {
     throw new Error(`${device.name} returned no configuration`);
   return scrub(clean(text));
 }
-function read(device) {
-  return session(device, (cli) => readConfig(cli, device));
+function read(device, _network = [], options = {}) {
+  return session(device, (cli) => readConfig(cli, device), options);
 }
 function withSecrets(line) {
   const key = line.startsWith("set private-key ");
@@ -2490,7 +2873,7 @@ async function configure(cli, plan, guard) {
 class Reloaded extends Error {
 }
 var RELOAD = { attempts: 20, interval: 15000 };
-async function settle(device) {
+async function settle(device, options) {
   for (let attempt = 0;attempt < RELOAD.attempts; attempt++) {
     await new Promise((done) => setTimeout(done, RELOAD.interval));
     const settled = await session(device, async (cli) => {
@@ -2498,18 +2881,26 @@ async function settle(device) {
         return false;
       await saving(cli, "automatic");
       return true;
-    }).catch(() => false);
+    }, options).catch(() => false);
     if (settled)
       return "the device is back and saves changes on its own again";
   }
   return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
 }
 async function apply(device, _network, plan, options) {
+  const seconds = options.rollback * 60;
   try {
+    if (options.console) {
+      await consoleSession(device, async (cli, relogin) => {
+        await checkVersion(cli, device);
+        await configure(cli, plan, { seconds, prove: relogin });
+      });
+      return;
+    }
     await session(device, async (cli) => {
       await checkVersion(cli, device);
       await configure(cli, plan, {
-        seconds: options.rollback * 60,
+        seconds,
         prove: async () => {
           const proof = await login(device);
           proof.end();
@@ -2520,7 +2911,7 @@ async function apply(device, _network, plan, options) {
     if (!(error instanceof Reloaded))
       throw error;
     throw new Error(`${error.message}
-    ${await settle(device)}`);
+    ${await settle(device, options)}`);
   }
 }
 function fillLines(set, family, prefixes) {
@@ -2920,6 +3311,7 @@ function serviceGaps(device) {
 }
 var fortios = {
   extension: ".conf",
+  console: true,
   unsupported,
   render,
   read,
@@ -4129,8 +4521,8 @@ async function login2(device) {
     password: resolve(user.password)
   });
 }
-async function checkVersion2(client, device) {
-  const version = await exec(client, "show version | match Junos:");
+async function checkVersion2(ask, device) {
+  const version = await ask("show version | match Junos:");
   const release = /Junos: (\d+)\.(\S+)/.exec(version);
   if (!release)
     throw new Error(`${device.name} did not say which Junos it runs: ${version.slice(0, 200)}`);
@@ -4138,10 +4530,19 @@ async function checkVersion2(client, device) {
     throw new Error(`${device.name} runs Junos ${release[1]}.${release[2]}; this adapter renders for Junos ${SUPPORTED_MAJOR}`);
   }
 }
-async function read2(device) {
+async function read2(device, _network = [], options = {}) {
+  if (options.console) {
+    return onConsole(device, async (channel) => {
+      await checkVersion2((command) => run(channel, command), device);
+      const output = await run(channel, "show configuration | display set | no-more", 180000);
+      if (!/^set /m.test(output))
+        throw new Error(`${device.name} returned no configuration`);
+      return clean2(output);
+    });
+  }
   const client = await login2(device);
   try {
-    await checkVersion2(client, device);
+    await checkVersion2((command) => exec(client, command), device);
     const output = await exec(client, "show configuration | display set | no-more", 180000);
     if (!/^set /m.test(output))
       throw new Error(`${device.name} returned no configuration`);
@@ -4164,6 +4565,34 @@ async function edit(channel, line, timeout = 60000) {
   const output = await readUntil(channel, (text) => EDIT_PROMPT.test(text.replace(/\r/g, "")), timeout, 300);
   return output.replace(/\r/g, "");
 }
+var JUNOS_CONSOLE = {
+  login: /login: $/,
+  password: /Password:\s*$/,
+  prompt: /[>%] $/,
+  logout: "exit",
+  others: [[/# $/, `exit configuration-mode
+`]]
+};
+async function onConsole(device, work) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  const login = async () => {
+    await consoleLogin(opened.channel, JUNOS_CONSOLE, user, password);
+    const ready = openCli(opened.channel);
+    opened.channel.write(`
+`);
+    await ready;
+  };
+  try {
+    await login();
+    const result = await work(opened.channel, login);
+    opened.channel.write(`${JUNOS_CONSOLE.logout}
+`);
+    return result;
+  } finally {
+    opened.close();
+  }
+}
 async function openCli(channel) {
   const banner = await readUntil(channel, (text) => PROMPT2.test(text.replace(/\r/g, "")), 20000, 500);
   if (/% $/.test(banner.replace(/\r/g, "")))
@@ -4267,9 +4696,23 @@ async function configure2(channel, plan, guard) {
   console.log("  logged in again, commit confirmed");
 }
 async function apply2(device, _network, plan, options) {
+  if (options.console) {
+    await onConsole(device, async (channel, relogin) => {
+      await checkVersion2((command) => run(channel, command), device);
+      await configure2(channel, plan, {
+        minutes: options.rollback,
+        prove: async () => {
+          await run(channel, "exit configuration-mode");
+          await relogin();
+          await run(channel, "configure exclusive");
+        }
+      });
+    });
+    return;
+  }
   const client = await login2(device);
   try {
-    await checkVersion2(client, device);
+    await checkVersion2((command) => exec(client, command), device);
     const channel = await shell(client);
     await openCli(channel);
     await configure2(channel, plan, {
@@ -4527,7 +4970,7 @@ function fillPlan(set, prefixes) {
 async function fill2(device, _network, set, _family, prefixes) {
   const client = await login2(device);
   try {
-    await checkVersion2(client, device);
+    await checkVersion2((command) => exec(client, command), device);
     const channel = await shell(client);
     await openCli(channel);
     await configure2(channel, fillPlan(set, prefixes));
@@ -4539,6 +4982,7 @@ async function fill2(device, _network, set, _family, prefixes) {
 }
 var junos = {
   extension: ".conf",
+  console: true,
   unsupported: unsupported2,
   render: render2,
   read: read2,
@@ -4943,7 +5387,25 @@ function physicalPort(settings, vlanId, lagNumbers) {
   return lines;
 }
 var HOST_KEYS = ["ssh-rsa"];
-async function open(device) {
+var RAISECOM_CONSOLE = {
+  login: /login:\s*$/i,
+  password: /password:\s*$/i,
+  prompt: /[#>]\s*$/,
+  logout: "exit",
+  others: [[/\(config[^)\n]*\)#\s*$/, `end
+`]]
+};
+async function open(device, options = {}) {
+  const session = options.console ? await consoleShell(device) : await sshShell(device);
+  const version = await send(session.channel, "show version", 15000, 1500);
+  if (!version.includes("ROS")) {
+    session.close();
+    throw new Error(`${device.name} did not answer as ROS`);
+  }
+  await send(session.channel, "terminal page-break disable", 15000, 1000);
+  return session;
+}
+async function sshShell(device) {
   const user = device.users?.[device.connection.user];
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
@@ -4960,16 +5422,45 @@ async function open(device) {
     client.end();
   };
   const banner = await readUntil(channel, (text) => /[#>]\s*$/.test(text.trimEnd()), 30000);
-  const version = await send(channel, "show version", 15000, 1500);
-  if (!/[#>]\s*$/.test(banner.trimEnd()) || !version.includes("ROS")) {
+  if (!/[#>]\s*$/.test(banner.trimEnd())) {
     close();
     throw new Error(`${device.name} did not answer as ROS`);
   }
-  await send(channel, "terminal page-break disable", 15000, 1000);
-  return { channel, close };
+  return {
+    channel,
+    close,
+    fresh: async () => {
+      close();
+      return open(device);
+    }
+  };
+}
+async function consoleShell(device) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  try {
+    await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+  } catch (error) {
+    opened.close();
+    throw error;
+  }
+  const session = {
+    channel: opened.channel,
+    close: () => {
+      opened.channel.write(`${RAISECOM_CONSOLE.logout}
+`);
+      opened.close();
+    },
+    fresh: async () => {
+      await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+      await send(opened.channel, "terminal page-break disable", 15000, 1000);
+      return session;
+    }
+  };
+  return session;
 }
-async function read3(device) {
-  const { channel, close } = await open(device);
+async function read3(device, _network = [], options = {}) {
+  const { channel, close } = await open(device, options);
   try {
     const dump = await send(channel, "show running-config", 150000, 6000);
     const lines = dump.replace(/\r/g, "").split(`
@@ -5104,8 +5595,9 @@ function unsupported3(device) {
 var REFUSED3 = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
 var CONFIRM = /^(portswitch|switchport trunk allowed vlan|switchport mode)/;
 var RELEASE = /^no (\S+ access-list \d+)$/;
-async function apply3(device, _network, plan) {
-  const { channel, close } = await open(device);
+async function apply3(device, _network, plan, options) {
+  const session = await open(device, options);
+  const { channel } = session;
   const released = [];
   try {
     await send(channel, "config", 1e4);
@@ -5139,11 +5631,10 @@ async function apply3(device, _network, plan) {
       });
     if (released.length)
       console.log(`  bound again: ${released.join(", ")}`);
+    session.close();
     throw error;
-  } finally {
-    close();
   }
-  const proof = await open(device).catch(() => {
+  const proof = await session.fresh().catch(() => {
     return;
   });
   if (!proof)
@@ -5213,7 +5704,7 @@ function plan3(desired, current) {
   }
   return { steps: planned, problems: [] };
 }
-var raisecom = { extension: ".txt", unsupported: unsupported3, render: render3, read: read3, plan: plan3, apply: apply3 };
+var raisecom = { extension: ".txt", console: true, unsupported: unsupported3, render: render3, read: read3, plan: plan3, apply: apply3 };
 
 // src/adapters/devices/routeros/export.ts
 var unwrap = (text) => text.replace(/\r/g, "").replace(/\\\n\s*/g, "");
@@ -6851,8 +7342,56 @@ async function login3(device) {
     password: resolve(user.password)
   });
 }
-async function checkVersion3(client, device) {
-  const version = (await exec(client, ":put [/system resource get version]")).trim();
+var ROUTEROS_CONSOLE = {
+  login: /Login: $/,
+  password: /Password: $/,
+  prompt: /\] > $/,
+  logout: "/quit",
+  others: [
+    [/-- \[Q quit\|D dump\|(?:C-z pause\|)?down\]$/, "D"],
+    [/\[Y\/n\]:? ?$/, "n"]
+  ],
+  user: (user) => `${user}+cwt`
+};
+function sshSession(client, device) {
+  return {
+    run: (command, timeout) => exec(client, command, timeout),
+    upload: (path, content) => upload(client, path, content),
+    fresh: async () => {
+      client.end();
+      return sshSession(await login3(device), device);
+    },
+    end: () => client.end()
+  };
+}
+async function consoleSession2(device) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  try {
+    await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+  } catch (error) {
+    opened.close();
+    throw error;
+  }
+  const shell = new ConsoleShell(opened.channel, ROUTEROS_CONSOLE);
+  const session = {
+    run: (command, timeout) => shell.run(command, timeout),
+    fresh: async () => {
+      await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+      return session;
+    },
+    end: () => {
+      shell.logout();
+      opened.close();
+    }
+  };
+  return session;
+}
+async function open2(device, options = {}) {
+  return options.console ? consoleSession2(device) : sshSession(await login3(device), device);
+}
+async function checkVersion3(session, device) {
+  const version = (await session.run(":put [/system resource get version]")).trim();
   const major = Number(version.split(".")[0]);
   if (major !== SUPPORTED_MAJOR2) {
     throw new Error(`${device.name} runs RouterOS ${version}; this adapter renders for version ${SUPPORTED_MAJOR2}`);
@@ -6867,13 +7406,13 @@ var LIST_CERTIFICATES = [
   ':put ("add fingerprint=" . [/certificate get $c fingerprint] . " name=" . [/certificate get $c name] . " private-key=" . $key)',
   "}"
 ].join(" ");
-async function read4(device) {
-  const client = await login3(device);
+async function read4(device, _network = [], options = {}) {
+  const session = await open2(device, options);
   try {
-    await checkVersion3(client, device);
-    const config = await exec(client, "/export", 300000);
-    const users = await exec(client, "/user export");
-    const certificates = (await exec(client, LIST_CERTIFICATES)).trim();
+    await checkVersion3(session, device);
+    const config = await session.run("/export", 300000);
+    const users = await session.run("/user export");
+    const certificates = (await session.run(LIST_CERTIFICATES)).trim();
     const listed = certificates.split(`
 `).every((line) => line.trim().startsWith("add fingerprint="));
     if (certificates && !listed) {
@@ -6888,7 +7427,7 @@ ${certificates}` : "";
     return withoutTimestamp(text) + `
 `;
   } finally {
-    client.end();
+    session.end();
   }
 }
 function unsupported4(device) {
@@ -6945,36 +7484,38 @@ function unsupported4(device) {
 }
 var ROLLBACK_SCHEDULER = "apply-rollback";
 var escapeForString = (text) => text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
-async function refusal(client, command) {
-  const compiled = (await exec(client, `:put [:parse "${escapeForString(command)}"]`)).trim();
+async function refusal(session, command) {
+  const compiled = (await session.run(`:put [:parse "${escapeForString(command)}"]`)).trim();
   const refused = !compiled.startsWith("(") || /syntax error|bad parameter|no such|expected/.test(compiled);
   return refused ? compiled.slice(0, 200) : undefined;
 }
-async function installCertificate(client, device, name) {
+async function installCertificate(session, device, name) {
   const certificate = device.certificates?.[name];
   if (!certificate)
     throw new Error(`certificate ${name} is not declared`);
-  await upload(client, `${name}.crt`, certificate.certificate);
-  await exec(client, `/certificate import file-name=${name}.crt name=${name} passphrase=""`);
+  if (!session.upload)
+    throw new Error(`certificate ${name} is installed from a file, which only SSH can write; apply it without --console`);
+  await session.upload(`${name}.crt`, certificate.certificate);
+  await session.run(`/certificate import file-name=${name}.crt name=${name} passphrase=""`);
   if (certificate.private_key) {
     const value = resolve(certificate.private_key);
     const privateKey = value.includes("-----BEGIN") ? `${value}
 ` : Buffer.from(value, "base64").toString("utf8");
-    await upload(client, `${name}.key`, privateKey);
-    await exec(client, `/certificate import file-name=${name}.key name=${name} passphrase=""`);
+    await session.upload(`${name}.key`, privateKey);
+    await session.run(`/certificate import file-name=${name}.key name=${name} passphrase=""`);
   }
-  await exec(client, `/file remove [find name="${name}.crt" or name="${name}.key"]`);
+  await session.run(`/file remove [find name="${name}.crt" or name="${name}.key"]`);
 }
 async function apply4(device, _network, changes, options) {
-  const client = await login3(device);
-  await checkVersion3(client, device);
+  const session = await open2(device, options);
+  await checkVersion3(session, device);
   const commands = changes.steps.flatMap((step) => step.send.map((command) => ({ title: step.title, command })));
   for (const { title, command } of commands) {
     if (command.startsWith(INSTALL_CERTIFICATE))
       continue;
-    const reason = await refusal(client, substitute(command));
+    const reason = await refusal(session, substitute(command));
     if (reason) {
-      client.end();
+      session.end();
       throw new Error(`${title}: the device will not parse ${command.slice(0, 200)}
     ${reason}`);
     }
@@ -6989,16 +7530,16 @@ async function apply4(device, _network, changes, options) {
   ].join(" ");
   try {
     console.log(`  saving ${backup}, arming a ${options.rollback} minute rollback`);
-    await exec(client, `/system backup save name=${backup} dont-encrypt=yes`, 120000);
-    await exec(client, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
-    await exec(client, armRollback);
+    await session.run(`/system backup save name=${backup} dont-encrypt=yes`, 120000);
+    await session.run(`/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
+    await session.run(armRollback);
     for (const { title, command } of commands) {
       if (command.startsWith(INSTALL_CERTIFICATE)) {
         const certificateName = command.slice(INSTALL_CERTIFICATE.length).trim();
-        await installCertificate(client, device, certificateName);
+        await installCertificate(session, device, certificateName);
         continue;
       }
-      const answer = (await exec(client, substitute(command), 120000)).trim();
+      const answer = (await session.run(substitute(command), 120000)).trim();
       if (answer)
         throw new Error(`${title}: ${command.slice(0, 160)}
     device said: ${answer.slice(0, 300)}`);
@@ -7006,20 +7547,19 @@ async function apply4(device, _network, changes, options) {
   } catch (error) {
     console.log(`  FAILED: ${error.message}`);
     console.log(`  restoring ${backup} now; the rollback stays armed in case this does not get through`);
-    await exec(client, `/system backup load name=${backup} password=""`, 30000).catch(() => {
+    await session.run(`/system backup load name=${backup} password=""`, 30000).catch(() => {
       return;
     });
-    client.end();
+    session.end();
     throw new Error("apply failed and the backup is being restored");
   }
-  client.end();
-  const proof = await login3(device).catch(() => {
+  const proof = await session.fresh().catch(() => {
     return;
   });
   if (!proof)
     throw new Error(`could not log in again; the device restores ${backup} within ${options.rollback} minutes`);
-  await exec(proof, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
-  await exec(proof, `/file remove [find name="${backup}.backup"]`);
+  await proof.run(`/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
+  await proof.run(`/file remove [find name="${backup}.backup"]`);
   proof.end();
   console.log("  logged in again, rollback disarmed");
 }
@@ -7043,6 +7583,7 @@ async function fill3(device, _network, set, family, prefixes) {
 }
 var routeros = {
   extension: ".rsc",
+  console: true,
   unsupported: unsupported4,
   render: render4,
   read: read4,
@@ -7515,25 +8056,60 @@ async function openShell(client) {
   await send(channel, "screen-length 0 temporary", 1e4, 1500);
   return channel;
 }
-async function read5(device) {
+var VRP_CONSOLE = {
+  login: /Username:\s*$/i,
+  password: /Password:\s*$/i,
+  prompt: /<[^>\n]+>\s*$/,
+  logout: "quit",
+  others: [
+    [/Change now\? ?\[Y\/N\]:?\s*$/i, `N
+`],
+    [/\[~?\*?[^\]\n]+\]\s*$/, `return
+`]
+  ]
+};
+async function onConsole2(device, work) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  const login = async () => {
+    await consoleLogin(opened.channel, VRP_CONSOLE, user, password);
+    await send(opened.channel, "screen-length 0 temporary", 1e4, 1500);
+  };
+  try {
+    await login();
+    const result = await work(opened.channel, login);
+    opened.channel.write(`${VRP_CONSOLE.logout}
+`);
+    return result;
+  } finally {
+    opened.close();
+  }
+}
+async function read5(device, _network = [], options = {}) {
+  if (options.console) {
+    return onConsole2(device, async (channel) => configurationOf(device, await send(channel, "display current-configuration", 120000, 3000)));
+  }
   const client = await login4(device);
   try {
     const channel = await openShell(client);
     const dump = await send(channel, "display current-configuration", 120000, 3000);
     channel.end();
-    const lines = dump.replace(/\r/g, "").split(`
-`);
-    const start = lines.findIndex((line) => line.startsWith("!Software Version"));
-    if (start < 0)
-      throw new Error(`${device.name} returned no configuration`);
-    const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
-    return scrub3(body.join(`
-`).trim() + `
-`);
+    return configurationOf(device, dump);
   } finally {
     client.end();
   }
 }
+function configurationOf(device, dump) {
+  const lines = dump.replace(/\r/g, "").split(`
+`);
+  const start = lines.findIndex((line) => line.startsWith("!Software Version"));
+  if (start < 0)
+    throw new Error(`${device.name} returned no configuration`);
+  const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
+  return scrub3(body.join(`
+`).trim() + `
+`);
+}
 function unsupported5(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
@@ -7630,9 +8206,7 @@ async function sendLine(channel, line) {
     answer += await send(channel, "Y", 20000, 800);
   return answer;
 }
-async function apply5(device, _network, plan) {
-  const client = await login4(device);
-  const channel = await openShell(client);
+async function commitPlan(channel, plan) {
   try {
     await send(channel, "system-view", 1e4, 1500);
     for (const step of plan.steps) {
@@ -7651,24 +8225,42 @@ async function apply5(device, _network, plan) {
     await send(channel, "clear configuration candidate", 1e4).catch(() => {
       return;
     });
-    channel.end();
-    client.end();
     throw error;
   }
-  const proof = await login4(device).catch(() => {
+}
+async function save(channel) {
+  const saving = await send(channel, "save", 20000, 2000);
+  if (/\[Y\/N\]/i.test(saving))
+    await send(channel, "Y", 60000, 5000);
+}
+var NOT_SAVED = "Not saved: a reboot restores the previous configuration.";
+async function apply5(device, _network, plan, options) {
+  if (options.console) {
+    await onConsole2(device, async (channel, relogin) => {
+      await commitPlan(channel, plan);
+      await relogin().catch((error) => {
+        throw new Error(`committed, but a fresh login on the console failed: ${error.message}. ${NOT_SAVED}`);
+      });
+      await save(channel);
+    });
+    console.log("  committed, login proved, saved");
     return;
-  });
-  if (!proof) {
+  }
+  const client = await login4(device);
+  const channel = await openShell(client);
+  try {
+    await commitPlan(channel, plan);
+    const proof = await login4(device).catch(() => {
+      return;
+    });
+    if (!proof)
+      throw new Error(`committed, but a fresh login failed. ${NOT_SAVED} Recover over the open session or the console.`);
+    proof.end();
+    await save(channel);
+  } finally {
     channel.end();
     client.end();
-    throw new Error("committed, but a fresh login failed. Not saved: a reboot restores the previous configuration. Recover over the open session or the console.");
   }
-  proof.end();
-  const saving = await send(channel, "save", 20000, 2000);
-  if (/\[Y\/N\]/i.test(saving))
-    await send(channel, "Y", 60000, 5000);
-  channel.end();
-  client.end();
   console.log("  committed, login proved, saved");
 }
 function plan5(desired, current) {
@@ -7693,6 +8285,7 @@ function plan5(desired, current) {
 }
 var vrp = {
   extension: ".cfg",
+  console: true,
   unsupported: unsupported5,
   render: render5,
   read: read5,
@@ -8661,6 +9254,7 @@ var HELP = `usage: circuit <command> [device...] [options]
   apply <device>        read the device, plan against what it runs, and send with --confirm
                           --secrets      also send every secret, to rotate one
                           --rollback=N   minutes before a device that can restore itself does, default 10
+                          --console      through the device's serial console on its jump host, instead of SSH; also for snapshot
   refresh <device>      fetch prefix sets that come from a registry onto the device, with --confirm
   wireguard <device> <interface> <peer>
                         a client config for one peer, its private key left for the peer to fill
@@ -8721,7 +9315,8 @@ var names = rest.filter((arg) => !arg.startsWith("--"));
 var confirmed = flags.includes("--confirm");
 var options = {
   secrets: flags.includes("--secrets"),
-  rollback: Number(flags.find((flag) => flag.startsWith("--rollback="))?.split("=")[1] ?? 10)
+  rollback: Number(flags.find((flag) => flag.startsWith("--rollback="))?.split("=")[1] ?? 10),
+  ...flags.includes("--console") ? { console: true } : {}
 };
 function fail(message) {
   console.error(message);
@@ -8738,7 +9333,16 @@ function one() {
   const [device] = selected(false);
   return device ?? fail("name a device");
 }
-var adapterOf = (device) => adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
+function adapterOf(device) {
+  const adapter = adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
+  if (!options.console)
+    return adapter;
+  if (!adapter.console)
+    fail(`${device.name}: ${device.platform} cannot be reached through a console yet`);
+  if (!device.connection.console)
+    fail(`${device.name}: --console needs connection.console`);
+  return adapter;
+}
 var generated = join4(root2, ".circuit");
 var stateDirectory = join4(generated, "state");
 var statePath = (device) => join4(stateDirectory, device.name + adapterOf(device).extension);
@@ -8805,7 +9409,7 @@ function diffCommand() {
 }
 async function snapshotCommand() {
   for (const device of selected(true)) {
-    const text = await adapterOf(device).read(device, network3.devices);
+    const text = await adapterOf(device).read(device, network3.devices, options);
     writeState(device, text);
     console.log(`${device.name}: ${text.split(`
 `).length} lines`);
@@ -8824,7 +9428,7 @@ async function applyCommand() {
   const device = one();
   guard([device]);
   const adapter = adapterOf(device);
-  const live = await adapter.read(device, network3.devices);
+  const live = await adapter.read(device, network3.devices, options);
   writeState(device, live);
   const plan = adapter.plan(adapter.render(device), live, options);
   if (!show(device, plan))
@@ -8838,7 +9442,7 @@ Nothing sent. Re-run with --confirm.`);
     return;
   }
   await adapter.apply(device, network3.devices, plan, options);
-  writeState(device, await adapter.read(device, network3.devices));
+  writeState(device, await adapter.read(device, network3.devices, options));
   console.log("snapshot updated");
 }
 async function refreshCommand() {