@takodotid/circuit 0.31.0 → 0.32.0

package/dist/cli/index.js

@@ -425,7 +425,7 @@ function expect(channel, write, patterns, timeout = 30000) {
       channel.write(write);
   });
 }
-async function consoleLogin(channel, dialect, user, password) {
+async function consoleLogin(channel, dialect, user, password, passwordOnly = false) {
   const others = dialect.others ?? [];
   const states = [dialect.login, dialect.password, ...others.map(([pattern]) => pattern), dialect.prompt];
   const toward = (index) => {
@@ -438,32 +438,38 @@ async function consoleLogin(channel, dialect, user, password) {
 `;
   };
   await quiet(channel, 1000);
+  const start = passwordOnly ? 1 : 0;
   let state = (await expect(channel, `
 `, states)).index;
-  for (let step = 0;state !== 0; step++) {
+  for (let step = 0;state !== start; step++) {
+    if (passwordOnly && state === 0)
+      throw new Error("the console asks for a name, but its console is set to ask only for a password");
     if (step >= 10)
-      throw new Error("the console never reached a login prompt");
+      throw new Error(`the console never reached a ${passwordOnly ? "password" : "login"} prompt`);
     state = (await expect(channel, toward(state), states)).index;
   }
   await quiet(channel, 1000);
-  const name = dialect.user ? dialect.user(user) : user;
-  if ((await expect(channel, `${name}
+  if (!passwordOnly) {
+    const name = dialect.user ? dialect.user(user) : user;
+    if ((await expect(channel, `${name}
 `, [dialect.password, dialect.login, dialect.prompt])).index !== 0) {
-    throw new Error("the console did not ask for a password");
+      throw new Error("the console did not ask for a password");
+    }
   }
+  const refusal = dialect.refused ? [dialect.refused] : [];
+  const first = 2 + refusal.length;
+  const answers = [dialect.prompt, dialect.login, ...refusal, ...others.map(([pattern]) => pattern)];
   let answer = await expect(channel, `${password}
-`, [dialect.prompt, dialect.login, ...others.map(([pattern]) => pattern)], 60000);
-  for (let step = 0;answer.index >= 2; step++) {
+`, answers, 60000);
+  for (let step = 0;answer.index >= first; step++) {
     if (step >= 5)
       throw new Error("the console kept asking after the login");
-    answer = await expect(channel, others[answer.index - 2][1], [
-      dialect.prompt,
-      dialect.login,
-      ...others.map(([pattern]) => pattern)
-    ]);
+    answer = await expect(channel, others[answer.index - first][1], answers);
   }
   if (answer.index === 1)
     throw new Error(`the console refused the login of ${user}`);
+  if (answer.index === 2 && dialect.refused)
+    throw new Error("the console refused the password");
   await quiet(channel, 800);
 }
 function quiet(channel, silence) {
@@ -1312,7 +1318,7 @@ function ruleGaps(device, where, rule) {
   const set = rule.set ?? {};
   if ((rule.match || rule.set) && !rule.action)
     found.push(`${where}, a rule without action: the platform stops at the first rule that matches`);
-  for (const field of ["as_path_length", "rpki", "large_community"]) {
+  for (const field of ["as_path_length", "through_as", "rpki", "large_community"]) {
     if (match[field] !== undefined)
       found.push(`${where}.match.${field}`);
   }
@@ -2761,9 +2767,9 @@ async function consoleSession(device, work) {
   const { console: console2, user, password } = consoleOf(device);
   const opened = await openConsole(console2);
   try {
-    await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+    await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password, console2.passwordOnly);
     const cli = new Cli(opened.channel);
-    const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+    const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password, console2.passwordOnly);
     const result = await work(cli, relogin);
     await consoleLogout(cli);
     return result;
@@ -4345,6 +4351,11 @@ function term(out, device, term, rule, family, splitFamily) {
     out.set(`policy-options as-path ${name}`, quote2(`.{${min},${max ?? ""}}`));
     from.push(["as-path", name]);
   }
+  if (match.through_as !== undefined) {
+    const name = `circuit-through-${match.through_as}`;
+    out.set(`policy-options as-path ${name}`, quote2(`.* ${match.through_as} .*`));
+    from.push(["as-path", name]);
+  }
   if (match.rpki)
     from.push(["validation-database", VALIDATION[match.rpki]]);
   const wanted = [
@@ -4657,7 +4668,7 @@ async function onConsole(device, work) {
   const { console: console2, user, password } = consoleOf(device);
   const opened = await openConsole(console2);
   const login = async () => {
-    await consoleLogin(opened.channel, JUNOS_CONSOLE, user, password);
+    await consoleLogin(opened.channel, JUNOS_CONSOLE, user, password, console2.passwordOnly);
     const ready = openCli(opened.channel);
     opened.channel.write(`
 `);
@@ -5529,7 +5540,7 @@ async function consoleShell(device) {
   const { console: console2, user, password } = consoleOf(device);
   const opened = await openConsole(console2);
   try {
-    await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+    await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password, console2.passwordOnly);
   } catch (error) {
     opened.close();
     throw error;
@@ -5542,7 +5553,7 @@ async function consoleShell(device) {
       opened.close();
     },
     fresh: async () => {
-      await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+      await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password, console2.passwordOnly);
       await send(opened.channel, "terminal page-break disable", 15000, 1000);
       return session;
     }
@@ -7080,6 +7091,8 @@ function conditions(rule) {
     tests.push(`bgp-path-len>${match.as_path_length.min - 1}`);
   if (match.as_path_length?.max !== undefined)
     tests.push(`bgp-path-len<${match.as_path_length.max + 1}`);
+  if (match.through_as !== undefined)
+    tests.push(`bgp-as-path ${match.through_as}`);
   if (match.rpki)
     tests.push(`rpki ${match.rpki}`);
   if (match.community)
@@ -7478,7 +7491,7 @@ async function consoleSession2(device) {
   const { console: console2, user, password } = consoleOf(device);
   const opened = await openConsole(console2);
   try {
-    await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+    await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password, console2.passwordOnly);
   } catch (error) {
     opened.close();
     throw error;
@@ -7487,7 +7500,7 @@ async function consoleSession2(device) {
   const session = {
     run: (command, timeout) => shell.run(command, timeout),
     fresh: async () => {
-      await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+      await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password, console2.passwordOnly);
       return session;
     },
     end: () => {
@@ -7726,7 +7739,7 @@ var DEVICE_FACTS3 = [
   "domain default",
   "Info:"
 ];
-var UNDO_BY_KEYWORD2 = /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance)\b/;
+var UNDO_BY_KEYWORD2 = /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance|ssh server cipher|ssh server hmac|ssh server key-exchange)\b/;
 function undo2(line) {
   if (line.startsWith("undo "))
     return line.slice("undo ".length);
@@ -8176,7 +8189,10 @@ var VRP_CONSOLE = {
   password: /Password:\s*$/i,
   prompt: /<[^>\n]+>\s*$/,
   logout: "quit",
+  refused: /The password is invalid/i,
   others: [
+    [/Please Press ENTER\.?\s*$/i, `
+`],
     [/Change now\? ?\[Y\/N\]:?\s*$/i, `N
 `],
     [/\[~?\*?[^\]\n]+\]\s*$/, `return
@@ -8187,7 +8203,7 @@ async function onConsole2(device, work) {
   const { console: console2, user, password } = consoleOf(device);
   const opened = await openConsole(console2);
   const login = async () => {
-    await consoleLogin(opened.channel, VRP_CONSOLE, user, password);
+    await consoleLogin(opened.channel, VRP_CONSOLE, user, password, console2.passwordOnly);
     await send(opened.channel, "screen-length 0 temporary", 1e4, 1500);
   };
   try {

package/dist/types/adapters/devices/vrp/index.d.ts

@@ -18,7 +18,7 @@ export declare function login(device: Device): Promise<Client>;
  * Every login asks whether to change the password. Answering yes replaces it at once and every stored credential with it, so the answer is always no. Anything sent before the question is answered is taken as the answer.
  */
 export declare function openShell(client: Client): Promise<ClientChannel>;
-/** How the console asks for a login: the same question to change the password, always answered no, and a system view left with `return`. Not yet proved on a device. */
+/** How the console asks for a login: the same question to change the password, always answered no, a system view left with `return`, and the line's banner after a logout or a refused password answered with Enter. Not yet proved on a device. */
 export declare const VRP_CONSOLE: ConsoleDialect;
 /** What the device runs, credentials scrubbed. */
 export declare function read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;

package/dist/types/schema/device.d.ts

@@ -36,6 +36,8 @@ export type Console = {
     port: string;
     /** Line speed in bits per second, such as 9600 or 115200. */
     baud: number;
+    /** The console asks only for a password, with no name first. Circuit then types no name; `connection.user` still picks the password. */
+    passwordOnly?: true;
 };
 /** A separate routing table, with the interfaces that route in it. */
 export type Vrf = {

package/dist/types/schema/policy.d.ts

@@ -33,6 +33,8 @@ export type Match<S extends string> = {
         min?: number;
         max?: number;
     };
+    /** The AS path holds this AS anywhere: the route came from it or through it. */
+    through_as?: number;
     /** The route's origin validation state. */
     rpki?: "valid" | "invalid" | "not-found";
     /** Has this standard community, `asn:value`. */

package/dist/types/transport/console.d.ts

@@ -27,6 +27,8 @@ export type ConsoleDialect = {
     others?: readonly (readonly [RegExp, string])[];
     /** The name typed at the login prompt, when the platform adds to it. */
     user?: (user: string) => string;
+    /** What the console prints when it refuses a password, for a console that then shows no login prompt. */
+    refused?: RegExp;
 };
 /** The channel a console speaks on: an SSH stream from the relay, or anything shaped like one. */
 type Channel = Pick<ClientChannel, "write"> & {
@@ -39,9 +41,9 @@ export declare function expect(channel: Channel, write: string, patterns: readon
     text: string;
 }>;
 /**
- * Log in on a console, whatever state the last session left it in: what `others` names is moved on, a session left open is logged out, so every session starts from a fresh login. Returns once the CLI's prompt shows.
+ * Log in on a console, whatever state the last session left it in: what `others` names is moved on, a session left open is logged out, so every session starts from a fresh login. Returns once the CLI's prompt shows. A console that asks only for a password (`passwordOnly`) is logged in at its password prompt, with no name typed.
  */
-export declare function consoleLogin(channel: Channel, dialect: ConsoleDialect, user: string, password: string): Promise<void>;
+export declare function consoleLogin(channel: Channel, dialect: ConsoleDialect, user: string, password: string, passwordOnly?: boolean): Promise<void>;
 /** The text after a command's echo. A terminal wraps a long echo where it likes, so the echo is matched character by character, line breaks it added skipped. */
 export declare function afterEcho(text: string, command: string): string;
 /** A CLI on a console that runs one command at a time and returns what it printed, as an SSH exec would: no echo, no prompt. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.31.0",
+    "version": "0.32.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/fortios/index.ts

@@ -173,9 +173,9 @@ async function consoleSession<T>(device: Device, work: (cli: Cli, relogin: () =>
     const opened = await openConsole(console);
 
     try {
-        await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+        await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password, console.passwordOnly);
         const cli = new Cli(opened.channel);
-        const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+        const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password, console.passwordOnly);
 
         const result = await work(cli, relogin);
         await consoleLogout(cli);

package/src/adapters/devices/fortios/routing.ts

@@ -418,7 +418,7 @@ function ruleGaps(device: Device, where: string, rule: AnyRule): string[] {
     if ((rule.match || rule.set) && !rule.action)
         found.push(`${where}, a rule without action: the platform stops at the first rule that matches`);
 
-    for (const field of ["as_path_length", "rpki", "large_community"] as const) {
+    for (const field of ["as_path_length", "through_as", "rpki", "large_community"] as const) {
         if (match[field] !== undefined) found.push(`${where}.match.${field}`);
     }
 

package/src/adapters/devices/junos/bgp.ts

@@ -210,6 +210,12 @@ function term(out: Statements, device: Device, term: string, rule: AnyRule, fami
         from.push(["as-path", name]);
     }
 
+    if (match.through_as !== undefined) {
+        const name = `circuit-through-${match.through_as}`;
+        out.set(`policy-options as-path ${name}`, quote(`.* ${match.through_as} .*`));
+        from.push(["as-path", name]);
+    }
+
     if (match.rpki) from.push(["validation-database", VALIDATION[match.rpki]]);
 
     // Members of one named community must all be present, so a rule matching both kinds names them together.

package/src/adapters/devices/junos/index.ts

@@ -375,7 +375,7 @@ async function onConsole<T>(device: Device, work: (channel: ClientChannel, relog
 
     // The CLI is opened on a prompt asked for after the login, since the login's own prompt is already read.
     const login = async () => {
-        await consoleLogin(opened.channel, JUNOS_CONSOLE, user, password);
+        await consoleLogin(opened.channel, JUNOS_CONSOLE, user, password, console.passwordOnly);
         const ready = openCli(opened.channel);
         opened.channel.write("\n");
         await ready;

package/src/adapters/devices/raisecom-ros/index.ts

@@ -371,7 +371,7 @@ async function consoleShell(device: Device): Promise<Session> {
     const opened = await openConsole(console);
 
     try {
-        await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+        await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password, console.passwordOnly);
     } catch (error) {
         opened.close();
         throw error;
@@ -384,7 +384,7 @@ async function consoleShell(device: Device): Promise<Session> {
             opened.close();
         },
         fresh: async () => {
-            await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password);
+            await consoleLogin(opened.channel, RAISECOM_CONSOLE, user, password, console.passwordOnly);
             await send(opened.channel, "terminal page-break disable", 15_000, 1000);
             return session;
         },

package/src/adapters/devices/routeros/index.ts

@@ -68,7 +68,7 @@ async function consoleSession(device: Device): Promise<Session> {
     const opened = await openConsole(console);
 
     try {
-        await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+        await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password, console.passwordOnly);
     } catch (error) {
         opened.close();
         throw error;
@@ -79,7 +79,7 @@ async function consoleSession(device: Device): Promise<Session> {
     const session: Session = {
         run: (command, timeout) => shell.run(command, timeout),
         fresh: async () => {
-            await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password);
+            await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password, console.passwordOnly);
             return session;
         },
         end: () => {

package/src/adapters/devices/routeros/render.ts

@@ -1033,6 +1033,8 @@ function conditions(rule: AnyRule): string[] {
     if (match.prefix_length?.max !== undefined) tests.push(`dst-len<${match.prefix_length.max + 1}`);
     if (match.as_path_length?.min !== undefined) tests.push(`bgp-path-len>${match.as_path_length.min - 1}`);
     if (match.as_path_length?.max !== undefined) tests.push(`bgp-path-len<${match.as_path_length.max + 1}`);
+    // The platform's AS path regexp matches each AS as a whole number, so a bare number is that AS anywhere in the path.
+    if (match.through_as !== undefined) tests.push(`bgp-as-path ${match.through_as}`);
     if (match.rpki) tests.push(`rpki ${match.rpki}`);
     if (match.community) tests.push(`bgp-communities includes ${match.community}`);
     if (match.large_community) tests.push(`bgp-large-communities includes ${match.large_community}`);

package/src/adapters/devices/vrp/TRAPS.md

@@ -21,3 +21,5 @@ Behaviour that looks like something else. Each one has been hit on a CE6855 runn
 - sFlow samples per port, `sflow sampling rate N`, N from 4096; the default is 8192 and an explicit 8192 is kept as written. A port can point to a collector only once the collector exists globally; until then it is refused with "collector does not exist".
 - `vlan batch` has every VLAN on one line, and undoing a list that includes a VLAN with an L3 interface is refused. A change sends only the VLANs added and `undo vlan batch` for the ones removed.
 - A VLAN name is unique across VLANs: a new VLAN cannot take a name another still has. VLANs no longer used, and their VLAN interfaces, are removed first, in the same candidate.
+- `undo ssh server key-exchange <algorithms>` is refused with "Too many parameters"; `undo ssh server key-exchange` takes none. `hmac` was proved the same way. `cipher` is undone the same way but was not proved on its own.
+- A console on a password only (`passwordOnly`) shows `Please Press ENTER.` after a logout or a refused password, and `Error: The password is invalid.` for a wrong one.

package/src/adapters/devices/vrp/index.ts

@@ -37,7 +37,7 @@ const DEVICE_FACTS = [
 
 /** Lines whose removal takes only their keyword, not their value. */
 const UNDO_BY_KEYWORD =
-    /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance)\b/;
+    /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance|ssh server cipher|ssh server hmac|ssh server key-exchange)\b/;
 
 function undo(line: string): string {
     // A negated line is undone by stating it.
@@ -571,13 +571,15 @@ export async function openShell(client: Client): Promise<ClientChannel> {
     return channel;
 }
 
-/** How the console asks for a login: the same question to change the password, always answered no, and a system view left with `return`. Not yet proved on a device. */
+/** How the console asks for a login: the same question to change the password, always answered no, a system view left with `return`, and the line's banner after a logout or a refused password answered with Enter. Not yet proved on a device. */
 export const VRP_CONSOLE: ConsoleDialect = {
     login: /Username:\s*$/i,
     password: /Password:\s*$/i,
     prompt: /<[^>\n]+>\s*$/,
     logout: "quit",
+    refused: /The password is invalid/i,
     others: [
+        [/Please Press ENTER\.?\s*$/i, "\n"],
         [/Change now\? ?\[Y\/N\]:?\s*$/i, "N\n"],
         [/\[~?\*?[^\]\n]+\]\s*$/, "return\n"],
     ],
@@ -589,7 +591,7 @@ async function onConsole<T>(device: Device, work: (channel: ClientChannel, relog
     const opened = await openConsole(console);
 
     const login = async () => {
-        await consoleLogin(opened.channel, VRP_CONSOLE, user, password);
+        await consoleLogin(opened.channel, VRP_CONSOLE, user, password, console.passwordOnly);
         await send(opened.channel, "screen-length 0 temporary", 10_000, 1500);
     };
 

package/src/schema/device.ts

@@ -39,6 +39,8 @@ export type Console = {
     port: string;
     /** Line speed in bits per second, such as 9600 or 115200. */
     baud: number;
+    /** The console asks only for a password, with no name first. Circuit then types no name; `connection.user` still picks the password. */
+    passwordOnly?: true;
 };
 
 /** A separate routing table, with the interfaces that route in it. */

package/src/schema/policy.ts

@@ -32,6 +32,8 @@ export type Match<S extends string> = {
     prefix_length?: { min?: number; max?: number };
     /** AS path length within this range, inclusive. Every AS counts, prepends included. */
     as_path_length?: { min?: number; max?: number };
+    /** The AS path holds this AS anywhere: the route came from it or through it. */
+    through_as?: number;
     /** The route's origin validation state. */
     rpki?: "valid" | "invalid" | "not-found";
     /** Has this standard community, `asn:value`. */

package/src/transport/console.ts

@@ -250,6 +250,8 @@ export type ConsoleDialect = {
     others?: readonly (readonly [RegExp, string])[];
     /** The name typed at the login prompt, when the platform adds to it. */
     user?: (user: string) => string;
+    /** What the console prints when it refuses a password, for a console that then shows no login prompt. */
+    refused?: RegExp;
 };
 
 /** Terminal escape sequences: cursor moves, screen clears, character sets and modes. */
@@ -293,9 +295,15 @@ export function expect(channel: Channel, write: string, patterns: readonly RegEx
 }
 
 /**
- * Log in on a console, whatever state the last session left it in: what `others` names is moved on, a session left open is logged out, so every session starts from a fresh login. Returns once the CLI's prompt shows.
+ * Log in on a console, whatever state the last session left it in: what `others` names is moved on, a session left open is logged out, so every session starts from a fresh login. Returns once the CLI's prompt shows. A console that asks only for a password (`passwordOnly`) is logged in at its password prompt, with no name typed.
  */
-export async function consoleLogin(channel: Channel, dialect: ConsoleDialect, user: string, password: string): Promise<void> {
+export async function consoleLogin(
+    channel: Channel,
+    dialect: ConsoleDialect,
+    user: string,
+    password: string,
+    passwordOnly = false
+): Promise<void> {
     const others = dialect.others ?? [];
     const states = [dialect.login, dialect.password, ...others.map(([pattern]) => pattern), dialect.prompt];
 
@@ -309,32 +317,39 @@ export async function consoleLogin(channel: Channel, dialect: ConsoleDialect, us
     // What the last session printed as it left, such as a login prompt after its logout, arrives late; it must not be taken for an answer.
     await quiet(channel, 1_000);
 
+    // The prompt a fresh login starts at: the login prompt, or the password prompt when there is no name to type.
+    const start = passwordOnly ? 1 : 0;
+
     let state = (await expect(channel, "\n", states)).index;
-    for (let step = 0; state !== 0; step++) {
-        if (step >= 10) throw new Error("the console never reached a login prompt");
+    for (let step = 0; state !== start; step++) {
+        if (passwordOnly && state === 0) throw new Error("the console asks for a name, but its console is set to ask only for a password");
+        if (step >= 10) throw new Error(`the console never reached a ${passwordOnly ? "password" : "login"} prompt`);
         state = (await expect(channel, toward(state), states)).index;
     }
 
     // A console can print the login prompt more than once; a name typed while it does is lost.
     await quiet(channel, 1_000);
 
-    const name = dialect.user ? dialect.user(user) : user;
-    if ((await expect(channel, `${name}\n`, [dialect.password, dialect.login, dialect.prompt])).index !== 0) {
-        throw new Error("the console did not ask for a password");
+    if (!passwordOnly) {
+        const name = dialect.user ? dialect.user(user) : user;
+        if ((await expect(channel, `${name}\n`, [dialect.password, dialect.login, dialect.prompt])).index !== 0) {
+            throw new Error("the console did not ask for a password");
+        }
     }
 
-    // A platform may ask something once logged in, such as whether to read a licence; `others` answers it.
-    let answer = await expect(channel, `${password}\n`, [dialect.prompt, dialect.login, ...others.map(([pattern]) => pattern)], 60_000);
-    for (let step = 0; answer.index >= 2; step++) {
+    // A platform may ask something once logged in, such as whether to read a licence; `others` answers it. A refusal is checked before `others`, since the banner that follows it matches one of them.
+    const refusal = dialect.refused ? [dialect.refused] : [];
+    const first = 2 + refusal.length;
+    const answers = [dialect.prompt, dialect.login, ...refusal, ...others.map(([pattern]) => pattern)];
+
+    let answer = await expect(channel, `${password}\n`, answers, 60_000);
+    for (let step = 0; answer.index >= first; step++) {
         if (step >= 5) throw new Error("the console kept asking after the login");
-        answer = await expect(channel, others[answer.index - 2]![1], [
-            dialect.prompt,
-            dialect.login,
-            ...others.map(([pattern]) => pattern),
-        ]);
+        answer = await expect(channel, others[answer.index - first]![1], answers);
     }
 
     if (answer.index === 1) throw new Error(`the console refused the login of ${user}`);
+    if (answer.index === 2 && dialect.refused) throw new Error("the console refused the password");
 
     // Some consoles print the prompt twice after a login; what arrives late must not reach the first command.
     await quiet(channel, 800);