@xynogen/pix-ssh 0.4.2 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-ssh",
-	"version": "0.4.2",
+	"version": "0.5.1",
 	"description": "Pi tool — ssh_run: run remote commands over SSH with password/key auth and remote sudo",
 	"type": "module",
 	"main": "src/index.ts",
@@ -38,7 +38,7 @@
 	},
 	"dependencies": {
 		"typebox": "^1.1.38",
-		"@xynogen/pix-pretty": "^1.19.0",
+		"@xynogen/pix-pretty": "^1.25.0",
 		"@xynogen/pix-runtime": "^0.8.0"
 	},
 	"peerDependencies": {

package/src/index.ts

@@ -66,6 +66,7 @@ import {
 	MAX_OUTPUT_LINES,
 	parseHost,
 	probeKeyAuth,
+	probePasswordAuth,
 	probeSudoNoPassword,
 	readSshConfigAliases,
 	resolveHostInfo,
@@ -101,6 +102,23 @@ function cacheKey(spec: HostSpec): string {
 	return `${spec.user ?? ""}@${spec.host}:${spec.port ?? 22}`;
 }
 
+/**
+ * Overlay password validator for a prompt stage. The login stage tests the
+ * password against the host (wrong one re-prompts up to MAX_PASSWORD_ATTEMPTS);
+ * the sudo stage can't be probed before login, so it only rejects a blank entry
+ * and surfaces a real failure on the run.
+ */
+export function validatorFor(
+	stage: "login" | "sudo",
+	spec: HostSpec,
+	controlPath: string,
+	sig?: AbortSignal,
+): (pw: string) => Promise<boolean> {
+	if (stage !== "login") return (pw) => Promise.resolve(pw.trim().length > 0);
+	return (pw) =>
+		pw.trim().length === 0 ? Promise.resolve(false) : probePasswordAuth(spec, controlPath, pw, sig);
+}
+
 type SshOutcome =
 	| "awaiting-approval"
 	| "running"
@@ -647,7 +665,11 @@ export default function (pi: ExtensionAPI): void {
 							timeoutMs: PROMPT_TIMEOUT_MS,
 							maxPasswordAttempts: MAX_PASSWORD_ATTEMPTS,
 							passwordLabel: `${label}:`,
-							validatePassword: (pw) => Promise.resolve(pw.trim().length > 0),
+							// Login stage: actually test the password against the host so a
+							// wrong one re-prompts (up to MAX_PASSWORD_ATTEMPTS), mirroring
+							// pix-sudo. Sudo stage can't be validated until login succeeds, so
+							// it keeps the non-empty check and surfaces failures on the run.
+							validatePassword: validatorFor(stage, spec, controlPath, sig),
 							choices: [
 								{
 									value: "yes",

package/src/lib.ts

@@ -454,6 +454,57 @@ export function probeKeyAuth(
 	});
 }
 
+/**
+ * Validate an SSH *login* password by attempting one real password auth. Forces
+ * password auth (no pubkey/agent) with a single prompt, fed via `sshpass -e`
+ * (env, never argv). Returns true only on a clean login; an auth rejection
+ * returns false so the overlay can re-prompt. Unreachable/spawn errors return
+ * true — a password can't fix connectivity, so defer to the real run instead of
+ * burning retry attempts. ponytail: each call is one fresh connection (its own
+ * MaxAuthTries counter, NumberOfPasswordPrompts=1), so retries don't stack
+ * toward a per-connection lockout; a host with fail2ban-style IP banning is the
+ * ceiling — then drop back to a single prompt.
+ */
+export function probePasswordAuth(
+	spec: HostSpec,
+	controlPath: string,
+	password: string,
+	signal?: AbortSignal,
+): Promise<boolean> {
+	const args = [
+		"-e",
+		"ssh",
+		...baseSshArgs(spec, controlPath),
+		"-o",
+		"BatchMode=no",
+		"-o",
+		"PubkeyAuthentication=no",
+		"-o",
+		"PreferredAuthentications=password",
+		"-o",
+		"NumberOfPasswordPrompts=1",
+		hostTarget(spec),
+		"true",
+	];
+	return new Promise((resolve) => {
+		let stderr = "";
+		const proc = spawn("sshpass", args, {
+			stdio: ["ignore", "ignore", "pipe"],
+			env: { ...process.env, SSHPASS: password },
+		});
+		proc.stderr.on("data", (c: Buffer) => {
+			stderr += c.toString();
+		});
+		proc.on("error", () => resolve(true));
+		proc.on("close", (code) => {
+			if (code === 0) return resolve(true);
+			if (isUnreachable(stderr)) return resolve(true);
+			resolve(false);
+		});
+		signal?.addEventListener("abort", () => proc.kill("SIGTERM"), { once: true });
+	});
+}
+
 /**
  * Probe whether remote sudo runs without a password (NOPASSWD sudoers) via
  * `sudo -n true`. Returns true when no sudo password is needed. Requires a