@takodotid/circuit 0.27.0 → 0.28.0

package/dist/cli/index.js

@@ -112,6 +112,7 @@ var valueOfReference = valueOf;
 
 // src/transport/console.ts
 import { spawn } from "node:child_process";
+import { EventEmitter } from "node:events";
 import { Duplex } from "node:stream";
 import { Client as Client2 } from "ssh2";
 
@@ -252,6 +253,33 @@ while True:
 `;
 var RELAY_PATH = "/tmp/circuit-console.py";
 var PORT = /^\/dev\/[\w./:+-]+$/;
+var WINDOWS_PORT = /^COM\d+$/i;
+var WINDOWS_RELAY = `
+$port = New-Object System.IO.Ports.SerialPort $env:CIRCUIT_PORT, ([int]$env:CIRCUIT_BAUD), 'None', 8, 'One'
+try { $port.Open() } catch [System.UnauthorizedAccessException] { [Console]::Error.WriteLine("busy: another program holds " + $env:CIRCUIT_PORT); exit 3 } catch { [Console]::Error.WriteLine("cannot open " + $env:CIRCUIT_PORT + ": " + $_.Exception.Message); exit 2 }
+[Console]::Error.WriteLine("ready")
+$in = [Console]::OpenStandardInput()
+$out = [Console]::OpenStandardOutput()
+$buffer = New-Object byte[] 4096
+$reading = $in.ReadAsync($buffer, 0, $buffer.Length)
+while ($true) {
+    if ($reading.IsCompleted) {
+        if ($reading.Result -le 0) { break }
+        $port.Write($buffer, 0, $reading.Result)
+        $reading = $in.ReadAsync($buffer, 0, $buffer.Length)
+    }
+    $waiting = $port.BytesToRead
+    if ($waiting -gt 0) {
+        $data = New-Object byte[] $waiting
+        $got = $port.Read($data, 0, $waiting)
+        $out.Write($data, 0, $got)
+        $out.Flush()
+    } else {
+        Start-Sleep -Milliseconds 10
+    }
+}
+$port.Close()
+`;
 function connectJump(jump) {
   return new Promise((done, fail) => {
     const client = new Client2;
@@ -268,35 +296,33 @@ function connectJump(jump) {
   });
 }
 async function openConsole(console2) {
-  if (!PORT.test(console2.port))
-    throw new Error(`console port ${console2.port} is not a path under /dev`);
+  const windows = !console2.jump && process.platform === "win32";
+  if (windows ? !WINDOWS_PORT.test(console2.port) : !PORT.test(console2.port)) {
+    throw new Error(`console port ${console2.port} is not ${windows ? "a COM port" : "a path under /dev"}`);
+  }
   if (!Number.isInteger(console2.baud) || console2.baud <= 0)
     throw new Error(`console baud ${console2.baud} is not a line speed`);
-  const client = await connectJump(console2.jump);
+  for (let attempt = 1;; attempt++) {
+    try {
+      return await (console2.jump ? openOnJump(console2, console2.jump) : openHere(console2));
+    } catch (error) {
+      if (attempt >= 5 || !/busy:/.test(error.message))
+        throw error;
+      await new Promise((done) => setTimeout(done, 5000));
+    }
+  }
+}
+async function openOnJump(console2, jump) {
+  const client = await connectJump(jump);
   try {
     const encoded = Buffer.from(RELAY).toString("base64");
     await exec(client, `sh -c 'printf %s ${encoded} | base64 -d > ${RELAY_PATH}'`, 30000);
     const channel = await new Promise((done, fail) => {
       client.exec(`python3 ${RELAY_PATH} ${console2.port} ${console2.baud}`, (error, stream) => error ? fail(error) : done(stream));
     });
-    await new Promise((done, fail) => {
-      let said = "";
-      const limit = setTimeout(() => fail(new Error(`the console relay did not start: ${said.trim()}`)), 30000);
-      channel.stderr.on("data", (chunk) => {
-        said += chunk.toString("utf8");
-        if (said.includes(`ready
-`)) {
-          clearTimeout(limit);
-          done();
-        }
-      });
-      channel.on("close", () => {
-        clearTimeout(limit);
-        fail(new Error(`the console relay stopped: ${said.trim() || "no reason given"}`));
-      });
-    });
+    await relayReady(channel);
     return {
-      channel,
+      channel: asTerminal(channel),
       close: () => {
         channel.end();
         client.end();
@@ -307,6 +333,195 @@ async function openConsole(console2) {
     throw error;
   }
 }
+async function openHere(console2) {
+  const child = process.platform === "win32" ? spawn("powershell", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_RELAY], {
+    env: { ...process.env, CIRCUIT_PORT: console2.port, CIRCUIT_BAUD: String(console2.baud) }
+  }) : spawn("python3", ["-c", RELAY, console2.port, String(console2.baud)]);
+  const channel = Object.assign(new EventEmitter, {
+    stderr: child.stderr,
+    write: (data) => child.stdin.write(data),
+    end: () => child.stdin.end()
+  });
+  child.stdout.on("data", (chunk) => channel.emit("data", chunk));
+  child.on("close", () => channel.emit("close"));
+  child.on("error", (error) => channel.emit("close", error));
+  const asChannel = channel;
+  try {
+    await relayReady(asChannel);
+  } catch (error) {
+    child.kill();
+    throw error;
+  }
+  return {
+    channel: asTerminal(asChannel),
+    close: () => {
+      channel.end();
+      setTimeout(() => child.kill(), 2000).unref();
+    }
+  };
+}
+function relayReady(channel) {
+  return new Promise((done, fail) => {
+    let said = "";
+    const limit = setTimeout(() => fail(new Error(`the console relay did not start: ${said.trim()}`)), 30000);
+    channel.stderr.on("data", (chunk) => {
+      said += chunk.toString("utf8");
+      if (said.includes("ready")) {
+        clearTimeout(limit);
+        done();
+      }
+    });
+    channel.on("close", () => {
+      clearTimeout(limit);
+      fail(new Error(`the console relay stopped: ${said.trim() || "no reason given"}`));
+    });
+  });
+}
+function asTerminal(channel) {
+  const write = channel.write.bind(channel);
+  channel.write = (data, ...rest) => write(typeof data === "string" ? data.replace(/\r?\n/g, "\r") : data, ...rest);
+  return channel;
+}
+function consoleOf(device) {
+  const console2 = device.connection.console;
+  if (!console2)
+    throw new Error(`${device.name}: no connection.console`);
+  const user = device.users?.[device.connection.user];
+  if (!user)
+    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
+  return { console: console2, user: device.connection.user, password: resolve(user.password) };
+}
+var ESCAPES = /\u001b(?:\[[0-9;?]*[A-Za-z]|[()][A-Z0-9]|[=>78c])/g;
+function expect(channel, write, patterns, timeout = 30000) {
+  return new Promise((done, fail) => {
+    let text = "";
+    const stop = () => {
+      clearTimeout(limit);
+      channel.removeListener("data", onData);
+    };
+    const onData = (chunk) => {
+      text += chunk.toString("utf8").replace(/\r/g, "").replace(ESCAPES, "");
+      const index = patterns.findIndex((pattern) => pattern.test(text));
+      if (index < 0)
+        return;
+      stop();
+      done({ index, text });
+    };
+    const limit = setTimeout(() => {
+      stop();
+      fail(new Error(`the console did not answer: ${text.slice(-200)}`));
+    }, timeout);
+    channel.on("data", onData);
+    if (write)
+      channel.write(write);
+  });
+}
+async function consoleLogin(channel, dialect, user, password) {
+  const others = dialect.others ?? [];
+  const states = [dialect.login, dialect.password, ...others.map(([pattern]) => pattern), dialect.prompt];
+  const toward = (index) => {
+    if (index === 1)
+      return `
+`;
+    if (index < 2 + others.length)
+      return others[index - 2][1];
+    return `${dialect.logout}
+`;
+  };
+  let state = (await expect(channel, `
+`, states)).index;
+  for (let step = 0;state !== 0; step++) {
+    if (step >= 10)
+      throw new Error("the console never reached a login prompt");
+    state = (await expect(channel, toward(state), states)).index;
+  }
+  const name = dialect.user ? dialect.user(user) : user;
+  if ((await expect(channel, `${name}
+`, [dialect.password, dialect.login, dialect.prompt])).index !== 0) {
+    throw new Error("the console did not ask for a password");
+  }
+  let answer = await expect(channel, `${password}
+`, [dialect.prompt, dialect.login, ...others.map(([pattern]) => pattern)], 60000);
+  for (let step = 0;answer.index >= 2; step++) {
+    if (step >= 5)
+      throw new Error("the console kept asking after the login");
+    answer = await expect(channel, others[answer.index - 2][1], [
+      dialect.prompt,
+      dialect.login,
+      ...others.map(([pattern]) => pattern)
+    ]);
+  }
+  if (answer.index === 1)
+    throw new Error(`the console refused the login of ${user}`);
+  await quiet(channel, 800);
+}
+function quiet(channel, silence) {
+  return new Promise((done) => {
+    let timer = setTimeout(finish, silence);
+    const limit = setTimeout(finish, 5000);
+    function finish() {
+      clearTimeout(timer);
+      clearTimeout(limit);
+      channel.removeListener("data", onData);
+      done();
+    }
+    function onData() {
+      clearTimeout(timer);
+      timer = setTimeout(finish, silence);
+    }
+    channel.on("data", onData);
+  });
+}
+function afterEcho(text, command) {
+  for (let start = text.indexOf(command[0] ?? "");start >= 0; start = text.indexOf(command[0], start + 1)) {
+    const end = echoEnd(text, command, start);
+    if (end !== undefined)
+      return text.slice(end).replace(/^\r?\n/, "");
+  }
+  return text;
+}
+function echoEnd(text, command, start) {
+  let at = start;
+  for (const character of command) {
+    while (at < text.length && text[at] !== character && /[\r\n]/.test(text[at]))
+      at++;
+    if (text[at] !== character)
+      return;
+    at++;
+  }
+  return at;
+}
+
+class ConsoleShell {
+  channel;
+  dialect;
+  constructor(channel, dialect) {
+    this.channel = channel;
+    this.dialect = dialect;
+  }
+  async run(command, timeout = 120000) {
+    const pagers = (this.dialect.others ?? []).filter(([, reply]) => !reply.endsWith(`
+`));
+    const patterns = [this.dialect.prompt, ...pagers.map(([pattern]) => pattern)];
+    let { index, text } = await expect(this.channel, `${command}
+`, patterns, timeout);
+    let output = "";
+    while (index > 0) {
+      const [pattern, reply] = pagers[index - 1];
+      output += text.replace(pattern, "");
+      ({ index, text } = await expect(this.channel, reply, patterns, timeout));
+    }
+    output += text;
+    const lines = afterEcho(output, command).split(`
+`);
+    return lines.slice(0, -1).join(`
+`);
+  }
+  logout() {
+    this.channel.write(`${this.dialect.logout}
+`);
+  }
+}
 
 // src/adapters/devices/fortios/names.ts
 function nameOf(device, name) {
@@ -2488,58 +2703,18 @@ async function login(device) {
     password: resolve(user.password)
   });
 }
-var CONSOLE_STATES = [
-  ["login", /login: $/],
-  ["password", /Password: $/],
-  ["banner", BANNER2],
-  ["pager", /--More-- $/],
-  ["context", /\([^)\n]*\) [#$] $/],
-  ["prompt", /[#$] $/]
-];
-function prompted(channel, write, timeout = 30000) {
-  return new Promise((done, fail) => {
-    let text = "";
-    const stop = () => {
-      clearTimeout(limit);
-      channel.removeListener("data", onData);
-    };
-    const onData = (chunk) => {
-      text += chunk.toString("utf8").replace(/\r/g, "");
-      const state = CONSOLE_STATES.find(([, pattern]) => pattern.test(text));
-      if (!state)
-        return;
-      stop();
-      done(state[0]);
-    };
-    const limit = setTimeout(() => {
-      stop();
-      fail(new Error(`the console did not answer: ${text.slice(-200)}`));
-    }, timeout);
-    channel.on("data", onData);
-    channel.write(write);
-  });
-}
-async function consoleLogin(channel, user, password) {
-  const toward = {
-    password: "\r",
-    banner: "a",
-    pager: "q",
-    context: "end\r",
-    prompt: "exit\r"
-  };
-  let state = await prompted(channel, "\r");
-  for (let step = 0;state !== "login"; step++) {
-    if (step >= 10)
-      throw new Error(`the console never reached a login prompt; it is at ${state}`);
-    state = await prompted(channel, toward[state]);
-  }
-  if (await prompted(channel, `${user}\r`) !== "password")
-    throw new Error("the console did not ask for a password");
-  const answer = await prompted(channel, `${password}\r`, 60000);
-  if (answer !== "prompt")
-    throw new Error(`the console refused the login of ${user}`);
-  return new Cli(channel, "\r");
-}
+var FORTIOS_CONSOLE = {
+  login: /login: $/,
+  password: /Password: $/,
+  prompt: /[#$] $/,
+  logout: "exit",
+  others: [
+    [BANNER2, "a"],
+    [/--More-- $/, "q"],
+    [/\([^)\n]*\) [#$] $/, `end
+`]
+  ]
+};
 async function consoleLogout(cli) {
   await leave(cli).catch(() => {
     return;
@@ -2548,23 +2723,13 @@ async function consoleLogout(cli) {
     return;
   });
 }
-function consoleOf(device) {
-  const console2 = device.connection.console;
-  if (!console2)
-    throw new Error(`${device.name}: no connection.console`);
-  const user = device.users?.[device.connection.user];
-  if (!user)
-    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
-  return { console: console2, user: device.connection.user, password: resolve(user.password) };
-}
 async function consoleSession(device, work) {
   const { console: console2, user, password } = consoleOf(device);
   const opened = await openConsole(console2);
   try {
-    const cli = await consoleLogin(opened.channel, user, password);
-    const relogin = async () => {
-      await consoleLogin(opened.channel, user, password);
-    };
+    await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+    const cli = new Cli(opened.channel);
+    const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
     const result = await work(cli, relogin);
     await consoleLogout(cli);
     return result;
@@ -4356,8 +4521,8 @@ async function login2(device) {
     password: resolve(user.password)
   });
 }
-async function checkVersion2(client, device) {
-  const version = await exec(client, "show version | match Junos:");
+async function checkVersion2(ask, device) {
+  const version = await ask("show version | match Junos:");
   const release = /Junos: (\d+)\.(\S+)/.exec(version);
   if (!release)
     throw new Error(`${device.name} did not say which Junos it runs: ${version.slice(0, 200)}`);
@@ -4365,10 +4530,19 @@ async function checkVersion2(client, device) {
     throw new Error(`${device.name} runs Junos ${release[1]}.${release[2]}; this adapter renders for Junos ${SUPPORTED_MAJOR}`);
   }
 }
-async function read2(device) {
+async function read2(device, _network = [], options = {}) {
+  if (options.console) {
+    return onConsole(device, async (channel) => {
+      await checkVersion2((command) => run(channel, command), device);
+      const output = await run(channel, "show configuration | display set | no-more", 180000);
+      if (!/^set /m.test(output))
+        throw new Error(`${device.name} returned no configuration`);
+      return clean2(output);
+    });
+  }
   const client = await login2(device);
   try {
-    await checkVersion2(client, device);
+    await checkVersion2((command) => exec(client, command), device);
     const output = await exec(client, "show configuration | display set | no-more", 180000);
     if (!/^set /m.test(output))
       throw new Error(`${device.name} returned no configuration`);
@@ -4391,6 +4565,34 @@ async function edit(channel, line, timeout = 60000) {
   const output = await readUntil(channel, (text) => EDIT_PROMPT.test(text.replace(/\r/g, "")), timeout, 300);
   return output.replace(/\r/g, "");
 }
+var JUNOS_CONSOLE = {
+  login: /login: $/,
+  password: /Password:\s*$/,
+  prompt: /[>%] $/,
+  logout: "exit",
+  others: [[/# $/, `exit configuration-mode
+`]]
+};
+async function onConsole(device, work) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  const login = async () => {
+    await consoleLogin(opened.channel, JUNOS_CONSOLE, user, password);
+    const ready = openCli(opened.channel);
+    opened.channel.write(`
+`);
+    await ready;
+  };
+  try {
+    await login();
+    const result = await work(opened.channel, login);
+    opened.channel.write(`${JUNOS_CONSOLE.logout}
+`);
+    return result;
+  } finally {
+    opened.close();
+  }
+}
 async function openCli(channel) {
   const banner = await readUntil(channel, (text) => PROMPT2.test(text.replace(/\r/g, "")), 20000, 500);
   if (/% $/.test(banner.replace(/\r/g, "")))
@@ -4494,9 +4696,23 @@ async function configure2(channel, plan, guard) {
   console.log("  logged in again, commit confirmed");
 }
 async function apply2(device, _network, plan, options) {
+  if (options.console) {
+    await onConsole(device, async (channel, relogin) => {
+      await checkVersion2((command) => run(channel, command), device);
+      await configure2(channel, plan, {
+        minutes: options.rollback,
+        prove: async () => {
+          await run(channel, "exit configuration-mode");
+          await relogin();
+          await run(channel, "configure exclusive");
+        }
+      });
+    });
+    return;
+  }
   const client = await login2(device);
   try {
-    await checkVersion2(client, device);
+    await checkVersion2((command) => exec(client, command), device);
     const channel = await shell(client);
     await openCli(channel);
     await configure2(channel, plan, {
@@ -4754,7 +4970,7 @@ function fillPlan(set, prefixes) {
 async function fill2(device, _network, set, _family, prefixes) {
   const client = await login2(device);
   try {
-    await checkVersion2(client, device);
+    await checkVersion2((command) => exec(client, command), device);
     const channel = await shell(client);
     await openCli(channel);
     await configure2(channel, fillPlan(set, prefixes));
@@ -4766,6 +4982,7 @@ async function fill2(device, _network, set, _family, prefixes) {
 }
 var junos = {
   extension: ".conf",
+  console: true,
   unsupported: unsupported2,
   render: render2,
   read: read2,
@@ -5170,7 +5387,25 @@ function physicalPort(settings, vlanId, lagNumbers) {
   return lines;
 }
 var HOST_KEYS = ["ssh-rsa"];
-async function open(device) {
+var RAISECOM_CONSOLE = {
+  login: /login:\s*$/i,
+  password: /password:\s*$/i,
+  prompt: /[#>]\s*$/,
+  logout: "exit",
+  others: [[/\(config[^)\n]*\)#\s*$/, `end
+`]]
+};
+async function open(device, options = {}) {
+  const session = options.console ? await consoleShell(device) : await sshShell(device);
+  const version = await send(session.channel, "show version", 15000, 1500);
+  if (!version.includes("ROS")) {
+    session.close();
+    throw new Error(`${device.name} did not answer as ROS`);
+  }
+  await send(session.channel, "terminal page-break disable", 15000, 1000);
+  return session;
+}
+async function sshShell(device) {
   const user = device.users?.[device.connection.user];
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
@@ -5187,16 +5422,45 @@ async function open(device) {
     client.end();
   };
   const banner = await readUntil(channel, (text) => /[#>]\s*$/.test(text.trimEnd()), 30000);
-  const version = await send(channel, "show version", 15000, 1500);
-  if (!/[#>]\s*$/.test(banner.trimEnd()) || !version.includes("ROS")) {
+  if (!/[#>]\s*$/.test(banner.trimEnd())) {
     close();
     throw new Error(`${device.name} did not answer as ROS`);
   }
-  await send(channel, "terminal page-break disable", 15000, 1000);
-  return { channel, close };
+  return {
+    channel,
+    close,
+    fresh: async () => {
+      close();
+      return open(device);
+    }
+  };
 }
-async function read3(device) {
-  const { channel, close } = await open(device);
+async function consoleShell(device) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  try {
+    await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+  } catch (error) {
+    opened.close();
+    throw error;
+  }
+  const session = {
+    channel: opened.channel,
+    close: () => {
+      opened.channel.write(`${RAISECOM_CONSOLE.logout}
+`);
+      opened.close();
+    },
+    fresh: async () => {
+      await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+      await send(opened.channel, "terminal page-break disable", 15000, 1000);
+      return session;
+    }
+  };
+  return session;
+}
+async function read3(device, _network = [], options = {}) {
+  const { channel, close } = await open(device, options);
   try {
     const dump = await send(channel, "show running-config", 150000, 6000);
     const lines = dump.replace(/\r/g, "").split(`
@@ -5331,8 +5595,9 @@ function unsupported3(device) {
 var REFUSED3 = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
 var CONFIRM = /^(portswitch|switchport trunk allowed vlan|switchport mode)/;
 var RELEASE = /^no (\S+ access-list \d+)$/;
-async function apply3(device, _network, plan) {
-  const { channel, close } = await open(device);
+async function apply3(device, _network, plan, options) {
+  const session = await open(device, options);
+  const { channel } = session;
   const released = [];
   try {
     await send(channel, "config", 1e4);
@@ -5366,11 +5631,10 @@ async function apply3(device, _network, plan) {
       });
     if (released.length)
       console.log(`  bound again: ${released.join(", ")}`);
+    session.close();
     throw error;
-  } finally {
-    close();
   }
-  const proof = await open(device).catch(() => {
+  const proof = await session.fresh().catch(() => {
     return;
   });
   if (!proof)
@@ -5440,7 +5704,7 @@ function plan3(desired, current) {
   }
   return { steps: planned, problems: [] };
 }
-var raisecom = { extension: ".txt", unsupported: unsupported3, render: render3, read: read3, plan: plan3, apply: apply3 };
+var raisecom = { extension: ".txt", console: true, unsupported: unsupported3, render: render3, read: read3, plan: plan3, apply: apply3 };
 
 // src/adapters/devices/routeros/export.ts
 var unwrap = (text) => text.replace(/\r/g, "").replace(/\\\n\s*/g, "");
@@ -7078,8 +7342,56 @@ async function login3(device) {
     password: resolve(user.password)
   });
 }
-async function checkVersion3(client, device) {
-  const version = (await exec(client, ":put [/system resource get version]")).trim();
+var ROUTEROS_CONSOLE = {
+  login: /Login: $/,
+  password: /Password: $/,
+  prompt: /\] > $/,
+  logout: "/quit",
+  others: [
+    [/-- \[Q quit\|D dump\|(?:C-z pause\|)?down\]$/, "D"],
+    [/\[Y\/n\]:? ?$/, "n"]
+  ],
+  user: (user) => `${user}+cwt`
+};
+function sshSession(client, device) {
+  return {
+    run: (command, timeout) => exec(client, command, timeout),
+    upload: (path, content) => upload(client, path, content),
+    fresh: async () => {
+      client.end();
+      return sshSession(await login3(device), device);
+    },
+    end: () => client.end()
+  };
+}
+async function consoleSession2(device) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  try {
+    await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+  } catch (error) {
+    opened.close();
+    throw error;
+  }
+  const shell = new ConsoleShell(opened.channel, ROUTEROS_CONSOLE);
+  const session = {
+    run: (command, timeout) => shell.run(command, timeout),
+    fresh: async () => {
+      await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+      return session;
+    },
+    end: () => {
+      shell.logout();
+      opened.close();
+    }
+  };
+  return session;
+}
+async function open2(device, options = {}) {
+  return options.console ? consoleSession2(device) : sshSession(await login3(device), device);
+}
+async function checkVersion3(session, device) {
+  const version = (await session.run(":put [/system resource get version]")).trim();
   const major = Number(version.split(".")[0]);
   if (major !== SUPPORTED_MAJOR2) {
     throw new Error(`${device.name} runs RouterOS ${version}; this adapter renders for version ${SUPPORTED_MAJOR2}`);
@@ -7094,13 +7406,13 @@ var LIST_CERTIFICATES = [
   ':put ("add fingerprint=" . [/certificate get $c fingerprint] . " name=" . [/certificate get $c name] . " private-key=" . $key)',
   "}"
 ].join(" ");
-async function read4(device) {
-  const client = await login3(device);
+async function read4(device, _network = [], options = {}) {
+  const session = await open2(device, options);
   try {
-    await checkVersion3(client, device);
-    const config = await exec(client, "/export", 300000);
-    const users = await exec(client, "/user export");
-    const certificates = (await exec(client, LIST_CERTIFICATES)).trim();
+    await checkVersion3(session, device);
+    const config = await session.run("/export", 300000);
+    const users = await session.run("/user export");
+    const certificates = (await session.run(LIST_CERTIFICATES)).trim();
     const listed = certificates.split(`
 `).every((line) => line.trim().startsWith("add fingerprint="));
     if (certificates && !listed) {
@@ -7115,7 +7427,7 @@ ${certificates}` : "";
     return withoutTimestamp(text) + `
 `;
   } finally {
-    client.end();
+    session.end();
   }
 }
 function unsupported4(device) {
@@ -7172,36 +7484,38 @@ function unsupported4(device) {
 }
 var ROLLBACK_SCHEDULER = "apply-rollback";
 var escapeForString = (text) => text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
-async function refusal(client, command) {
-  const compiled = (await exec(client, `:put [:parse "${escapeForString(command)}"]`)).trim();
+async function refusal(session, command) {
+  const compiled = (await session.run(`:put [:parse "${escapeForString(command)}"]`)).trim();
   const refused = !compiled.startsWith("(") || /syntax error|bad parameter|no such|expected/.test(compiled);
   return refused ? compiled.slice(0, 200) : undefined;
 }
-async function installCertificate(client, device, name) {
+async function installCertificate(session, device, name) {
   const certificate = device.certificates?.[name];
   if (!certificate)
     throw new Error(`certificate ${name} is not declared`);
-  await upload(client, `${name}.crt`, certificate.certificate);
-  await exec(client, `/certificate import file-name=${name}.crt name=${name} passphrase=""`);
+  if (!session.upload)
+    throw new Error(`certificate ${name} is installed from a file, which only SSH can write; apply it without --console`);
+  await session.upload(`${name}.crt`, certificate.certificate);
+  await session.run(`/certificate import file-name=${name}.crt name=${name} passphrase=""`);
   if (certificate.private_key) {
     const value = resolve(certificate.private_key);
     const privateKey = value.includes("-----BEGIN") ? `${value}
 ` : Buffer.from(value, "base64").toString("utf8");
-    await upload(client, `${name}.key`, privateKey);
-    await exec(client, `/certificate import file-name=${name}.key name=${name} passphrase=""`);
+    await session.upload(`${name}.key`, privateKey);
+    await session.run(`/certificate import file-name=${name}.key name=${name} passphrase=""`);
   }
-  await exec(client, `/file remove [find name="${name}.crt" or name="${name}.key"]`);
+  await session.run(`/file remove [find name="${name}.crt" or name="${name}.key"]`);
 }
 async function apply4(device, _network, changes, options) {
-  const client = await login3(device);
-  await checkVersion3(client, device);
+  const session = await open2(device, options);
+  await checkVersion3(session, device);
   const commands = changes.steps.flatMap((step) => step.send.map((command) => ({ title: step.title, command })));
   for (const { title, command } of commands) {
     if (command.startsWith(INSTALL_CERTIFICATE))
       continue;
-    const reason = await refusal(client, substitute(command));
+    const reason = await refusal(session, substitute(command));
     if (reason) {
-      client.end();
+      session.end();
       throw new Error(`${title}: the device will not parse ${command.slice(0, 200)}
     ${reason}`);
     }
@@ -7216,16 +7530,16 @@ async function apply4(device, _network, changes, options) {
   ].join(" ");
   try {
     console.log(`  saving ${backup}, arming a ${options.rollback} minute rollback`);
-    await exec(client, `/system backup save name=${backup} dont-encrypt=yes`, 120000);
-    await exec(client, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
-    await exec(client, armRollback);
+    await session.run(`/system backup save name=${backup} dont-encrypt=yes`, 120000);
+    await session.run(`/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
+    await session.run(armRollback);
     for (const { title, command } of commands) {
       if (command.startsWith(INSTALL_CERTIFICATE)) {
         const certificateName = command.slice(INSTALL_CERTIFICATE.length).trim();
-        await installCertificate(client, device, certificateName);
+        await installCertificate(session, device, certificateName);
         continue;
       }
-      const answer = (await exec(client, substitute(command), 120000)).trim();
+      const answer = (await session.run(substitute(command), 120000)).trim();
       if (answer)
         throw new Error(`${title}: ${command.slice(0, 160)}
     device said: ${answer.slice(0, 300)}`);
@@ -7233,20 +7547,19 @@ async function apply4(device, _network, changes, options) {
   } catch (error) {
     console.log(`  FAILED: ${error.message}`);
     console.log(`  restoring ${backup} now; the rollback stays armed in case this does not get through`);
-    await exec(client, `/system backup load name=${backup} password=""`, 30000).catch(() => {
+    await session.run(`/system backup load name=${backup} password=""`, 30000).catch(() => {
       return;
     });
-    client.end();
+    session.end();
     throw new Error("apply failed and the backup is being restored");
   }
-  client.end();
-  const proof = await login3(device).catch(() => {
+  const proof = await session.fresh().catch(() => {
     return;
   });
   if (!proof)
     throw new Error(`could not log in again; the device restores ${backup} within ${options.rollback} minutes`);
-  await exec(proof, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
-  await exec(proof, `/file remove [find name="${backup}.backup"]`);
+  await proof.run(`/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
+  await proof.run(`/file remove [find name="${backup}.backup"]`);
   proof.end();
   console.log("  logged in again, rollback disarmed");
 }
@@ -7270,6 +7583,7 @@ async function fill3(device, _network, set, family, prefixes) {
 }
 var routeros = {
   extension: ".rsc",
+  console: true,
   unsupported: unsupported4,
   render: render4,
   read: read4,
@@ -7742,25 +8056,60 @@ async function openShell(client) {
   await send(channel, "screen-length 0 temporary", 1e4, 1500);
   return channel;
 }
-async function read5(device) {
+var VRP_CONSOLE = {
+  login: /Username:\s*$/i,
+  password: /Password:\s*$/i,
+  prompt: /<[^>\n]+>\s*$/,
+  logout: "quit",
+  others: [
+    [/Change now\? ?\[Y\/N\]:?\s*$/i, `N
+`],
+    [/\[~?\*?[^\]\n]+\]\s*$/, `return
+`]
+  ]
+};
+async function onConsole2(device, work) {
+  const { console: console2, user, password } = consoleOf(device);
+  const opened = await openConsole(console2);
+  const login = async () => {
+    await consoleLogin(opened.channel, VRP_CONSOLE, user, password);
+    await send(opened.channel, "screen-length 0 temporary", 1e4, 1500);
+  };
+  try {
+    await login();
+    const result = await work(opened.channel, login);
+    opened.channel.write(`${VRP_CONSOLE.logout}
+`);
+    return result;
+  } finally {
+    opened.close();
+  }
+}
+async function read5(device, _network = [], options = {}) {
+  if (options.console) {
+    return onConsole2(device, async (channel) => configurationOf(device, await send(channel, "display current-configuration", 120000, 3000)));
+  }
   const client = await login4(device);
   try {
     const channel = await openShell(client);
     const dump = await send(channel, "display current-configuration", 120000, 3000);
     channel.end();
-    const lines = dump.replace(/\r/g, "").split(`
-`);
-    const start = lines.findIndex((line) => line.startsWith("!Software Version"));
-    if (start < 0)
-      throw new Error(`${device.name} returned no configuration`);
-    const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
-    return scrub3(body.join(`
-`).trim() + `
-`);
+    return configurationOf(device, dump);
   } finally {
     client.end();
   }
 }
+function configurationOf(device, dump) {
+  const lines = dump.replace(/\r/g, "").split(`
+`);
+  const start = lines.findIndex((line) => line.startsWith("!Software Version"));
+  if (start < 0)
+    throw new Error(`${device.name} returned no configuration`);
+  const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
+  return scrub3(body.join(`
+`).trim() + `
+`);
+}
 function unsupported5(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
@@ -7857,9 +8206,7 @@ async function sendLine(channel, line) {
     answer += await send(channel, "Y", 20000, 800);
   return answer;
 }
-async function apply5(device, _network, plan) {
-  const client = await login4(device);
-  const channel = await openShell(client);
+async function commitPlan(channel, plan) {
   try {
     await send(channel, "system-view", 1e4, 1500);
     for (const step of plan.steps) {
@@ -7878,24 +8225,42 @@ async function apply5(device, _network, plan) {
     await send(channel, "clear configuration candidate", 1e4).catch(() => {
       return;
     });
-    channel.end();
-    client.end();
     throw error;
   }
-  const proof = await login4(device).catch(() => {
+}
+async function save(channel) {
+  const saving = await send(channel, "save", 20000, 2000);
+  if (/\[Y\/N\]/i.test(saving))
+    await send(channel, "Y", 60000, 5000);
+}
+var NOT_SAVED = "Not saved: a reboot restores the previous configuration.";
+async function apply5(device, _network, plan, options) {
+  if (options.console) {
+    await onConsole2(device, async (channel, relogin) => {
+      await commitPlan(channel, plan);
+      await relogin().catch((error) => {
+        throw new Error(`committed, but a fresh login on the console failed: ${error.message}. ${NOT_SAVED}`);
+      });
+      await save(channel);
+    });
+    console.log("  committed, login proved, saved");
     return;
-  });
-  if (!proof) {
+  }
+  const client = await login4(device);
+  const channel = await openShell(client);
+  try {
+    await commitPlan(channel, plan);
+    const proof = await login4(device).catch(() => {
+      return;
+    });
+    if (!proof)
+      throw new Error(`committed, but a fresh login failed. ${NOT_SAVED} Recover over the open session or the console.`);
+    proof.end();
+    await save(channel);
+  } finally {
     channel.end();
     client.end();
-    throw new Error("committed, but a fresh login failed. Not saved: a reboot restores the previous configuration. Recover over the open session or the console.");
   }
-  proof.end();
-  const saving = await send(channel, "save", 20000, 2000);
-  if (/\[Y\/N\]/i.test(saving))
-    await send(channel, "Y", 60000, 5000);
-  channel.end();
-  client.end();
   console.log("  committed, login proved, saved");
 }
 function plan5(desired, current) {
@@ -7920,6 +8285,7 @@ function plan5(desired, current) {
 }
 var vrp = {
   extension: ".cfg",
+  console: true,
   unsupported: unsupported5,
   render: render5,
   read: read5,