@takodotid/circuit 0.28.0 → 0.29.0

package/dist/chunks/{index-22sbskdx.js → index-47debt16.js}

@@ -117,7 +117,11 @@ function describeDevice(device) {
     const vrf = settings.vrf ? `, VRF ${settings.vrf}` : "";
     return `${name}: ${list.join(", ")}${vrf}`;
   });
-  return [`${device.platform} ${device.model}`, `reached at ${device.connection.host}`, ...addresses];
+  return [
+    `${device.platform} ${device.model}`,
+    device.connection.host ? `reached at ${device.connection.host}` : "reached through its console",
+    ...addresses
+  ];
 }
 function carriedBy(device, settings) {
   const vlan = (name, untagged) => {

package/dist/chunks/{server-1ftkqkx5.js → server-tjbb3rqc.js}

@@ -1,6 +1,6 @@
 import {
   packageRoot
-} from "./index-22sbskdx.js";
+} from "./index-47debt16.js";
 
 // src/studio/server.ts
 import { execFile as execFile2, spawn } from "node:child_process";

package/dist/cli/index.js

@@ -11,7 +11,7 @@ import {
   addressesOf,
   freeOfLength,
   studioData
-} from "../chunks/index-22sbskdx.js";
+} from "../chunks/index-47debt16.js";
 import {
   familyOf2,
   split,
@@ -118,6 +118,11 @@ import { Client as Client2 } from "ssh2";
 
 // src/transport/ssh.ts
 import { Client } from "ssh2";
+function managementHost(device) {
+  if (!device.connection.host)
+    throw new Error(`${device.name} has no management address; it is reached through its console`);
+  return device.connection.host;
+}
 function connect(login) {
   return new Promise((resolve, reject) => {
     const client = new Client;
@@ -324,8 +329,10 @@ async function openOnJump(console2, jump) {
     return {
       channel: asTerminal(channel),
       close: () => {
-        channel.end();
-        client.end();
+        quiet(channel, 1000).then(() => {
+          channel.end();
+          client.end();
+        });
       }
     };
   } catch (error) {
@@ -355,8 +362,10 @@ async function openHere(console2) {
   return {
     channel: asTerminal(asChannel),
     close: () => {
-      channel.end();
-      setTimeout(() => child.kill(), 2000).unref();
+      quiet(asChannel, 1000).then(() => {
+        channel.end();
+        setTimeout(() => child.kill(), 2000).unref();
+      });
     }
   };
 }
@@ -428,6 +437,7 @@ async function consoleLogin(channel, dialect, user, password) {
     return `${dialect.logout}
 `;
   };
+  await quiet(channel, 1000);
   let state = (await expect(channel, `
 `, states)).index;
   for (let step = 0;state !== 0; step++) {
@@ -435,6 +445,7 @@ async function consoleLogin(channel, dialect, user, password) {
       throw new Error("the console never reached a login prompt");
     state = (await expect(channel, toward(state), states)).index;
   }
+  await quiet(channel, 1000);
   const name = dialect.user ? dialect.user(user) : user;
   if ((await expect(channel, `${name}
 `, [dialect.password, dialect.login, dialect.prompt])).index !== 0) {
@@ -2697,7 +2708,7 @@ async function login(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password)
@@ -3941,7 +3952,8 @@ function sflow(out, device, names) {
   const flow = device.flow_export;
   if (flow?.protocol !== "sflow")
     return;
-  out.set("protocols sflow agent-id", device.connection.host);
+  if (device.connection.host)
+    out.set("protocols sflow agent-id", device.connection.host);
   if (flow.sampling !== undefined)
     out.set("protocols sflow sample-rate ingress", flow.sampling);
   for (const collector of flow.collectors) {
@@ -4515,7 +4527,7 @@ async function login2(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password)
@@ -4566,7 +4578,7 @@ async function edit(channel, line, timeout = 60000) {
   return output.replace(/\r/g, "");
 }
 var JUNOS_CONSOLE = {
-  login: /login: $/,
+  login: /(?:^|\n)login: $/,
   password: /Password:\s*$/,
   prompt: /[>%] $/,
   logout: "exit",
@@ -4613,7 +4625,7 @@ async function named(channel, line) {
   return [...names].map((name) => `delete ${[...words.slice(0, at), name, ...words.slice(at + 1)].join(" ")}`);
 }
 var REFUSED2 = /^terminal:\d+:\(\d+\) (?!warning)|^error: /m;
-async function configure2(channel, plan, guard) {
+async function configure2(channel, plan, guard, paced = false) {
   const sent = plan.steps.flatMap((step) => step.send);
   const entered = await run(channel, "configure exclusive");
   if (!/Entering configuration mode/.test(entered) || /^error: /m.test(entered)) {
@@ -4639,9 +4651,13 @@ async function configure2(channel, plan, guard) {
   channel.write(`load set terminal
 `);
   await readUntil(channel, (text) => text.includes("[Type ^D at a new line to end input]"), 20000, 300);
-  for (const line of ordered)
-    channel.write(`${substitute(line)}
+  for (const line of ordered) {
+    const statement = substitute(line);
+    channel.write(`${statement}
 `);
+    if (paced)
+      await readUntil(channel, (text) => text.replace(/\r/g, "").includes(statement.slice(-24)), 20000, 50);
+  }
   const loaded = await edit(channel, "\x04", 300000);
   const refused = loaded.split(`
 `).filter((line) => REFUSED2.test(line));
@@ -4706,7 +4722,7 @@ async function apply2(device, _network, plan, options) {
           await relogin();
           await run(channel, "configure exclusive");
         }
-      });
+      }, true);
     });
     return;
   }
@@ -5410,7 +5426,7 @@ async function sshShell(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   const client = await connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password),
@@ -7336,7 +7352,7 @@ async function login3(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password)
@@ -7975,7 +7991,8 @@ function flowExport3(config, device) {
   const flow = device.flow_export;
   if (flow?.protocol !== "sflow")
     return;
-  config.line(`sflow agent ip ${device.connection.host}`);
+  if (device.connection.host)
+    config.line(`sflow agent ip ${device.connection.host}`);
   flow.collectors.forEach((collector, index) => {
     const number = FIRST_COLLECTOR + index;
     config.line(`sflow collector ${number} ip ${collector.address} udp-port ${collector.port ?? 6343}`);
@@ -8041,7 +8058,7 @@ async function login4(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password),
@@ -8347,8 +8364,9 @@ async function planLibreNms(network) {
   if (!response.ok)
     throw new Error(`LibreNMS answered ${response.status} to the device list`);
   const monitored = new Set((await response.json()).devices.map((device) => device.hostname));
-  const ours = new Set(network.devices.map((device) => device.connection.host));
-  const missing = network.devices.filter((device) => !monitored.has(device.connection.host));
+  const polled = network.devices.filter((device) => device.connection.host);
+  const ours = new Set(polled.map((device) => device.connection.host));
+  const missing = polled.filter((device) => !monitored.has(device.connection.host));
   return {
     additions: missing.filter((device) => device.management?.snmp),
     withoutSnmp: missing.filter((device) => !device.management?.snmp),
@@ -8471,7 +8489,7 @@ var AUTH2 = { sha1: "SHA", sha256: "SHA256" };
 var PRIVACY2 = { aes128: "AES", des: "DES" };
 function prometheusTargets(network) {
   return {
-    targets: network.devices.filter((device) => device.management?.snmp).map((device) => ({
+    targets: network.devices.filter((device) => device.management?.snmp && device.connection.host).map((device) => ({
       targets: [device.connection.host],
       labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name }
     })),
@@ -8828,6 +8846,8 @@ function checkDevice(device, report) {
   };
   if (!device.users?.[device.connection.user])
     report(`connection user '${device.connection.user}' is not one of its users`);
+  if (!device.connection.host && !device.connection.console)
+    report("connection has neither a host nor a console to reach the device through");
   checkVlans(device, report);
   checkAddresses2(device, report, cidr, ip);
   checkPorts(device, names, report);
@@ -9333,9 +9353,12 @@ function one() {
   const [device] = selected(false);
   return device ?? fail("name a device");
 }
+function optionsFor(device) {
+  return options.console || !device.connection.host ? { ...options, console: true } : options;
+}
 function adapterOf(device) {
   const adapter = adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
-  if (!options.console)
+  if (!optionsFor(device).console)
     return adapter;
   if (!adapter.console)
     fail(`${device.name}: ${device.platform} cannot be reached through a console yet`);
@@ -9409,7 +9432,7 @@ function diffCommand() {
 }
 async function snapshotCommand() {
   for (const device of selected(true)) {
-    const text = await adapterOf(device).read(device, network3.devices, options);
+    const text = await adapterOf(device).read(device, network3.devices, optionsFor(device));
     writeState(device, text);
     console.log(`${device.name}: ${text.split(`
 `).length} lines`);
@@ -9428,7 +9451,7 @@ async function applyCommand() {
   const device = one();
   guard([device]);
   const adapter = adapterOf(device);
-  const live = await adapter.read(device, network3.devices, options);
+  const live = await adapter.read(device, network3.devices, optionsFor(device));
   writeState(device, live);
   const plan = adapter.plan(adapter.render(device), live, options);
   if (!show(device, plan))
@@ -9441,8 +9464,8 @@ Not sent: resolve the problems first.`);
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await adapter.apply(device, network3.devices, plan, options);
-  writeState(device, await adapter.read(device, network3.devices, options));
+  await adapter.apply(device, network3.devices, plan, optionsFor(device));
+  writeState(device, await adapter.read(device, network3.devices, optionsFor(device)));
   console.log("snapshot updated");
 }
 async function refreshCommand() {
@@ -9731,7 +9754,7 @@ async function studioCommand() {
   const port = Number(flagValue("port") ?? 4600);
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     fail("--port takes a number from 1 to 65535");
-  const { isLoopback, studio } = await import("../chunks/server-1ftkqkx5.js");
+  const { isLoopback, studio } = await import("../chunks/server-tjbb3rqc.js");
   const host = flagValue("host") ?? "127.0.0.1";
   const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
   if (!isLoopback(host) && !allowHosts.length) {

package/dist/types/adapters/devices/junos/index.d.ts

@@ -32,7 +32,7 @@ export type Guard = {
  *
  * Deletions go before the statements that are set, so a path deleted and set again in one plan ends up set.
  */
-export declare function configure(channel: ClientChannel, plan: Plan, guard?: Guard): Promise<void>;
+export declare function configure(channel: ClientChannel, plan: Plan, guard?: Guard, paced?: boolean): Promise<void>;
 export declare function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
 export declare function unsupported(device: Device): string[];
 /** The plan that replaces a prefix list's entries with what a registry returned. */

package/dist/types/schema/device.d.ts

@@ -6,8 +6,8 @@ import type { Routing } from "./routing";
 import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System, User } from "./system";
 /** How the framework reaches the device. */
 export type Connection<U extends string> = {
-    /** Management address. */
-    host: IP;
+    /** Management address. Absent for a device reached only through its console, `console`. */
+    host?: IP;
     /** One of the device's `users`. Its password is the login. */
     user: U;
     /** SSH port. 22 when absent. */

package/dist/types/transport/ssh.d.ts

@@ -1,4 +1,5 @@
 import { Client, type ClientChannel } from "ssh2";
+import type { Device } from "../schema";
 export type Login = {
     host: string;
     port?: number;
@@ -7,6 +8,8 @@ export type Login = {
     /** Host key algorithms to accept, for a device that negotiates one it then signs wrongly. */
     hostKeys?: string[];
 };
+/** The address SSH reaches a device at. A device without one is reached only through its console. */
+export declare function managementHost(device: Device): string;
 /** Open a session. */
 export declare function connect(login: Login): Promise<Client>;
 /** Run one command and return what it printed, stderr included. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.28.0",
+    "version": "0.29.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/fortios/TRAPS.md

@@ -39,3 +39,4 @@ Behaviour that looks like something else. Each one has been hit on a FortiGate 3
 - `execute backup config flash <comment>` keeps a revision on the device, and `execute restore config flash <id>` restores one.
 - The ports are `port1` to `port4` at 40G and `port5` to `port32` at 10G, then `mgmt1` and `mgmt2`. The factory dedicates both management ports to management and gives them addresses `192.168.1.99` and `192.168.2.99`.
 - On the serial console a line ends at a carriage return. A session left open stays logged in, and one left inside `config` stays there, so the next login must first leave and log out. The console takes 9600 bits per second: reading the sections Circuit manages takes about two minutes.
+- A data port can stay `netdev status: down`, with `rx_carrier: 0` in `diagnose hardware deviceinfo nic`, while the far end reads link-ok and frames reach the port's switch chip. Fixing the speed does not change it, in a LAG or out of one; a reboot does. `link_status: Up` there says nothing: a port with no cable shows it too.

package/src/adapters/devices/fortios/index.ts

@@ -7,7 +7,7 @@ import { familyOf, host, split } from "../../../core/addr";
 import { MARKER, resolve, valueOfReference } from "../../../core/secrets";
 import type { AclRule, Device, Family, FilterRule } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, shell } from "../../../transport/ssh";
+import { connect, managementHost, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 import { acceptsBeforeDrop, familiesOf, isImplied, serviceOf } from "./firewall";
@@ -141,7 +141,7 @@ export async function login(device: Device): Promise<Client> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),

package/src/adapters/devices/junos/TRAPS.md

@@ -29,3 +29,6 @@ Behaviour that looks like something else. Each one has been hit on a QFX5100-48S
 - IPv4 routes over an IPv6 session need a local IPv4 address under the family: `Local IPv4 address must be configured`.
 - A DHCP server and a DHCP relay cannot share an interface: `Interface irb.10 already configured`.
 - A port's MTU counts the Ethernet header. `mtu 9018` carries 9000-byte packets with a VLAN tag, and a VLAN interface's 9000 then commits without a warning.
+- The serial console has no flow control. Statements pasted into `load set terminal` at once overrun it: some arrive garbled, the load reports syntax errors, and the `^D` that ends it can be lost, leaving the console in the load. Circuit sends each statement after the echo of the one before.
+- After a login the console prints `Last login: ...`, which ends in `login: ` like the login prompt; only a `login: ` on a line of its own is the prompt.
+- A factory-default switch runs Auto Image Upgrade, which prints on the console every few seconds until `delete chassis auto-image-upgrade` is committed.

package/src/adapters/devices/junos/index.ts

@@ -7,7 +7,7 @@ import { familyOf, host, isAddress, split } from "../../../core/addr";
 import { resolve, substitute } from "../../../core/secrets";
 import type { Device, Family } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, exec, readUntil, shell } from "../../../transport/ssh";
+import { connect, exec, managementHost, readUntil, shell } from "../../../transport/ssh";
 import { lagIds } from "../derive";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions, Step } from "../types";
 import { GENERATED, settingsOf } from "./bgp";
@@ -296,7 +296,7 @@ export async function login(device: Device): Promise<Client> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),
@@ -360,7 +360,8 @@ async function edit(channel: ClientChannel, line: string, timeout = 60_000): Pro
 
 /** How the console asks for a login. Root lands in a shell, `%`, every other user in the CLI, `>`; a session left in configuration mode, `#`, leaves it first. Not yet proved on a device. */
 export const JUNOS_CONSOLE: ConsoleDialect = {
-    login: /login: $/,
+    // On a line of its own: the banner after a login says `Last login: ...`, and a chunk can end right after it.
+    login: /(?:^|\n)login: $/,
     password: /Password:\s*$/,
     prompt: /[>%] $/,
     logout: "exit",
@@ -434,7 +435,7 @@ export type Guard = { minutes: number; prove: () => Promise<void> };
  *
  * Deletions go before the statements that are set, so a path deleted and set again in one plan ends up set.
  */
-export async function configure(channel: ClientChannel, plan: Plan, guard?: Guard): Promise<void> {
+export async function configure(channel: ClientChannel, plan: Plan, guard?: Guard, paced = false): Promise<void> {
     const sent = plan.steps.flatMap((step) => step.send);
 
     const entered = await run(channel, "configure exclusive");
@@ -460,7 +461,12 @@ export async function configure(channel: ClientChannel, plan: Plan, guard?: Guar
     channel.write("load set terminal\n");
     await readUntil(channel, (text) => text.includes("[Type ^D at a new line to end input]"), 20_000, 300);
 
-    for (const line of ordered) channel.write(`${substitute(line)}\n`);
+    // A serial console has no flow control: statements sent at once overrun it and arrive garbled. There, each waits for the echo of the one before.
+    for (const line of ordered) {
+        const statement = substitute(line);
+        channel.write(`${statement}\n`);
+        if (paced) await readUntil(channel, (text) => text.replace(/\r/g, "").includes(statement.slice(-24)), 20_000, 50);
+    }
 
     const loaded = await edit(channel, "\u0004", 300_000);
     const refused = loaded.split("\n").filter((line) => REFUSED.test(line));
@@ -518,14 +524,19 @@ export async function apply(device: Device, _network: readonly Device[], plan: P
             await checkVersion((command) => run(channel, command), device);
 
             // A fresh login on the console ends the session that holds the candidate, so the proof logs in again and takes the candidate back to confirm the commit.
-            await configure(channel, plan, {
-                minutes: options.rollback,
-                prove: async () => {
-                    await run(channel, "exit configuration-mode");
-                    await relogin();
-                    await run(channel, "configure exclusive");
+            await configure(
+                channel,
+                plan,
+                {
+                    minutes: options.rollback,
+                    prove: async () => {
+                        await run(channel, "exit configuration-mode");
+                        await relogin();
+                        await run(channel, "configure exclusive");
+                    },
                 },
-            });
+                true
+            );
         });
         return;
     }

package/src/adapters/devices/junos/render.ts

@@ -675,7 +675,7 @@ function sflow(out: Statements, device: Device, names: Names): void {
     const flow = device.flow_export;
     if (flow?.protocol !== "sflow") return;
 
-    out.set("protocols sflow agent-id", device.connection.host);
+    if (device.connection.host) out.set("protocols sflow agent-id", device.connection.host);
     if (flow.sampling !== undefined) out.set("protocols sflow sample-rate ingress", flow.sampling);
 
     for (const collector of flow.collectors) {

package/src/adapters/devices/raisecom-ros/index.ts

@@ -8,7 +8,7 @@ import { marker, resolve, substitute } from "../../../core/secrets";
 import { offset } from "../../../core/time";
 import type { Device, Port, SnmpUser, Switched, Vrrp } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, readUntil, send, shell } from "../../../transport/ssh";
+import { connect, managementHost, readUntil, send, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import { ipv4Networks, lagIds, switchUnsupported } from "../derive";
 import { compare, type Dialect, entries, type Group, scrub, steps, vlanListChange } from "../lines";
@@ -338,7 +338,7 @@ async function sshShell(device: Device): Promise<Session> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     const client = await connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),

package/src/adapters/devices/routeros/index.ts

@@ -7,7 +7,7 @@ import { familyOf } from "../../../core/addr";
 import { resolve, substitute } from "../../../core/secrets";
 import type { Device, Family } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, ConsoleShell, openConsole } from "../../../transport/console";
-import { connect, exec, upload } from "../../../transport/ssh";
+import { connect, exec, managementHost, upload } from "../../../transport/ssh";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 import { INSTALL_CERTIFICATE, plan } from "./plan";
 import { spell } from "../catalog";
@@ -21,7 +21,7 @@ export async function login(device: Device): Promise<Client> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),

package/src/adapters/devices/vrp/index.ts

@@ -8,7 +8,7 @@ import { marker, resolve, substitute, valueOfReference } from "../../../core/sec
 import { offset } from "../../../core/time";
 import type { Device, Interface, Port, Vrrp } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, readUntil, send, shell } from "../../../transport/ssh";
+import { connect, managementHost, readUntil, send, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import { ipv4Networks, lagIds, switchUnsupported } from "../derive";
 import { compare, type Dialect, scrub, steps, vlanListChange } from "../lines";
@@ -465,7 +465,7 @@ function flowExport(config: Config, device: Device): void {
     const flow = device.flow_export;
     if (flow?.protocol !== "sflow") return;
 
-    config.line(`sflow agent ip ${device.connection.host}`);
+    if (device.connection.host) config.line(`sflow agent ip ${device.connection.host}`);
 
     flow.collectors.forEach((collector, index) => {
         const number = FIRST_COLLECTOR + index;
@@ -550,7 +550,7 @@ export async function login(device: Device): Promise<Client> {
     const user = device.users?.[device.connection.user];
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),

package/src/adapters/registries/librenms.ts

@@ -57,8 +57,10 @@ export async function planLibreNms(network: Network): Promise<LibreNmsPlan> {
     if (!response.ok) throw new Error(`LibreNMS answered ${response.status} to the device list`);
 
     const monitored = new Set(((await response.json()) as { devices: { hostname: string }[] }).devices.map((device) => device.hostname));
-    const ours = new Set(network.devices.map((device) => device.connection.host));
-    const missing = network.devices.filter((device) => !monitored.has(device.connection.host));
+    // A device reached only through its console has no address to poll.
+    const polled = network.devices.filter((device) => device.connection.host);
+    const ours = new Set(polled.map((device) => device.connection.host));
+    const missing = polled.filter((device) => !monitored.has(device.connection.host!));
 
     return {
         additions: missing.filter((device) => device.management?.snmp),

package/src/adapters/registries/prometheus.ts

@@ -15,9 +15,9 @@ const PRIVACY = { aes128: "AES", des: "DES" } as const;
 export function prometheusTargets(network: Network): { targets: PrometheusTarget[]; withoutSnmp: Device[] } {
     return {
         targets: network.devices
-            .filter((device) => device.management?.snmp)
+            .filter((device) => device.management?.snmp && device.connection.host)
             .map((device) => ({
-                targets: [device.connection.host],
+                targets: [device.connection.host!],
                 // `__param_auth` picks the device's own auth in snmp_exporter.
                 labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name },
             })),

package/src/cli/index.ts

@@ -133,10 +133,15 @@ function one(): Device {
     return device ?? fail("name a device");
 }
 
-/** The adapter of a device, which must be able to use its console when `--console` asks for it. */
+/** How a device is reached: through its console when `--console` asks, or when it has no management address. */
+function optionsFor(device: Device): ApplyOptions {
+    return options.console || !device.connection.host ? { ...options, console: true } : options;
+}
+
+/** The adapter of a device, which must be able to use its console when the device is reached through it. */
 function adapterOf(device: Device): DeviceAdapter {
     const adapter = adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
-    if (!options.console) return adapter;
+    if (!optionsFor(device).console) return adapter;
 
     if (!adapter.console) fail(`${device.name}: ${device.platform} cannot be reached through a console yet`);
     if (!device.connection.console) fail(`${device.name}: --console needs connection.console`);
@@ -225,7 +230,7 @@ function diffCommand(): void {
 
 async function snapshotCommand(): Promise<void> {
     for (const device of selected(true)) {
-        const text = await adapterOf(device).read(device, network.devices, options);
+        const text = await adapterOf(device).read(device, network.devices, optionsFor(device));
         writeState(device, text);
         console.log(`${device.name}: ${text.split("\n").length} lines`);
     }
@@ -248,7 +253,7 @@ async function applyCommand(): Promise<void> {
     const adapter = adapterOf(device);
 
     // The plan is made against what the device runs now, never against an old snapshot.
-    const live = await adapter.read(device, network.devices, options);
+    const live = await adapter.read(device, network.devices, optionsFor(device));
     writeState(device, live);
 
     const plan = adapter.plan(adapter.render(device), live, options);
@@ -261,9 +266,9 @@ async function applyCommand(): Promise<void> {
         return;
     }
 
-    await adapter.apply(device, network.devices, plan, options);
+    await adapter.apply(device, network.devices, plan, optionsFor(device));
 
-    writeState(device, await adapter.read(device, network.devices, options));
+    writeState(device, await adapter.read(device, network.devices, optionsFor(device)));
     console.log("snapshot updated");
 }
 

package/src/core/graph.ts

@@ -143,7 +143,11 @@ function describeDevice(device: Device): string[] {
             return `${name}: ${list.join(", ")}${vrf}`;
         });
 
-    return [`${device.platform} ${device.model}`, `reached at ${device.connection.host}`, ...addresses];
+    return [
+        `${device.platform} ${device.model}`,
+        device.connection.host ? `reached at ${device.connection.host}` : "reached through its console",
+        ...addresses,
+    ];
 }
 
 /** The VLANs a port or LAG carries, by id. */

package/src/core/validate.ts

@@ -79,6 +79,8 @@ function checkDevice(device: Device, report: Report): void {
     };
 
     if (!device.users?.[device.connection.user]) report(`connection user '${device.connection.user}' is not one of its users`);
+    if (!device.connection.host && !device.connection.console)
+        report("connection has neither a host nor a console to reach the device through");
 
     checkVlans(device, report);
     checkAddresses(device, report, cidr, ip);

package/src/schema/device.ts

@@ -7,8 +7,8 @@ import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System
 
 /** How the framework reaches the device. */
 export type Connection<U extends string> = {
-    /** Management address. */
-    host: IP;
+    /** Management address. Absent for a device reached only through its console, `console`. */
+    host?: IP;
     /** One of the device's `users`. Its password is the login. */
     user: U;
     /** SSH port. 22 when absent. */

package/src/transport/console.ts

@@ -144,9 +144,12 @@ async function openOnJump(console: Console, jump: Jump): Promise<ConsoleSession>
 
         return {
             channel: asTerminal(channel),
+            // What was written last, such as a logout, is still on its way to the device; the relay ends once the console goes quiet.
             close: () => {
-                channel.end();
-                client.end();
+                void quiet(channel, 1_000).then(() => {
+                    channel.end();
+                    client.end();
+                });
             },
         };
     } catch (error) {
@@ -186,8 +189,10 @@ async function openHere(console: Console): Promise<ConsoleSession> {
     return {
         channel: asTerminal(asChannel),
         close: () => {
-            channel.end();
-            setTimeout(() => child.kill(), 2_000).unref();
+            void quiet(asChannel, 1_000).then(() => {
+                channel.end();
+                setTimeout(() => child.kill(), 2_000).unref();
+            });
         },
     };
 }
@@ -301,12 +306,18 @@ export async function consoleLogin(channel: Channel, dialect: ConsoleDialect, us
         return `${dialect.logout}\n`;
     };
 
+    // What the last session printed as it left, such as a login prompt after its logout, arrives late; it must not be taken for an answer.
+    await quiet(channel, 1_000);
+
     let state = (await expect(channel, "\n", states)).index;
     for (let step = 0; state !== 0; step++) {
         if (step >= 10) throw new Error("the console never reached a login prompt");
         state = (await expect(channel, toward(state), states)).index;
     }
 
+    // A console can print the login prompt more than once; a name typed while it does is lost.
+    await quiet(channel, 1_000);
+
     const name = dialect.user ? dialect.user(user) : user;
     if ((await expect(channel, `${name}\n`, [dialect.password, dialect.login, dialect.prompt])).index !== 0) {
         throw new Error("the console did not ask for a password");

package/src/transport/ssh.ts

@@ -1,6 +1,7 @@
 // SSH sessions to devices. Adapters choose how to talk to their platform; this holds what they share.
 
 import { Client, type ClientChannel } from "ssh2";
+import type { Device } from "../schema";
 
 export type Login = {
     host: string;
@@ -11,6 +12,12 @@ export type Login = {
     hostKeys?: string[];
 };
 
+/** The address SSH reaches a device at. A device without one is reached only through its console. */
+export function managementHost(device: Device): string {
+    if (!device.connection.host) throw new Error(`${device.name} has no management address; it is reached through its console`);
+    return device.connection.host;
+}
+
 /** Open a session. */
 export function connect(login: Login): Promise<Client> {
     return new Promise((resolve, reject) => {