ai-remote 0.4.2 → 0.4.3

package/dist/protocols/ssh/session.js

@@ -1,608 +1,17 @@
-import { MSG, EXTENDED_DATA_STDERR } from "./messages.js";
-import { SshReader, SshWriter, decodeUtf8, encodeUtf8, toBase64 } from "./wire.js";
-import { SshTransport } from "./transport.js";
-const DEFAULT_PORT = 22;
-const SERVICE = "ssh-connection";
-const TERMINAL_TYPE = "xterm-256color";
-const INITIAL_WINDOW = 2 * 1024 * 1024;
-const MAX_PACKET = 32 * 1024;
-const WINDOW_REFILL_THRESHOLD = INITIAL_WINDOW / 2;
-const PTY_MODES = new Uint8Array([0]);
-const COMMAND_START_MS = 2e4;
-const COMMAND_IDLE_MS = 5 * 6e4;
-const COMMAND_MAX_MS = 60 * 6e4;
-const NO_BYTES = new Uint8Array(0);
-function singleQuote(value) {
-  return `'${String(value).replace(/'/g, `'\\''`)}'`;
-}
-function shellFromPrompt(text) {
-  const tail = text.slice(-400);
-  if (/(?:^|\n)PS [A-Za-z]:\\[^\n]*>\s*$/.test(tail)) return "powershell";
-  if (/(?:^|\n)[^\n]*[A-Za-z]:\\[^\n]*>\s*$/.test(tail)) return "cmd";
-  return "";
-}
-const FRAMING_REJECTED = /is not recognized as an internal or external command|command not found|not recognized as the name of a cmdlet|CommandNotFoundException/i;
-function frameCommand(family, command, id) {
-  if (family === "cmd") {
-    return `echo.&echo CCB${id}&${command}&call echo.CCE${id} %^ERRORLEVEL%\r`;
-  }
-  if (family === "powershell") {
-    const encoded = toBase64(encodeUtf8(command));
-    return `Write-Output ""; Write-Output ("CCB" + "${id}"); $__ccCode = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $global:LASTEXITCODE = $null; . ([ScriptBlock]::Create($__ccCode)); $__ccOk = $?; $__cc = if ($LASTEXITCODE -ne $null) { $LASTEXITCODE } elseif ($__ccOk) { 0 } else { 1 }; Write-Output ("CCE" + "${id} " + $__cc)\r`;
-  }
-  return `printf '\\n%s%s\\n' 'CCB' '${id}'; eval ${singleQuote(command)}; __cc=$?; printf '\\n%s%s %s\\n' 'CCE' '${id}' "$__cc"\r`;
-}
-function stripTerminalCodes(text) {
-  return text.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\u001b[@-Z\\-_]/g, "").replace(/\r\n/g, "\n").replace(/\r/g, "");
-}
-function filterDisplay(session, bytes) {
-  const filter = session.displayFilter;
-  if (!filter) return bytes;
-  filter.pending += decodeUtf8(bytes);
-  let shown = "";
-  if (filter.stage === "before") {
-    const at = filter.pending.indexOf(filter.begin);
-    if (at === -1) return NO_BYTES;
-    filter.pending = filter.pending.slice(at + filter.begin.length).replace(/^\r?\n/, "");
-    filter.stage = "inside";
-  }
-  if (filter.stage === "inside") {
-    const at = filter.pending.indexOf(filter.end);
-    if (at === -1) {
-      shown = filter.pending;
-      filter.pending = "";
-      return shown ? encodeUtf8(shown) : NO_BYTES;
-    }
-    shown = filter.pending.slice(0, at);
-    filter.pending = filter.pending.slice(at);
-    filter.stage = "closing";
-  }
-  const newline = filter.pending.indexOf("\n");
-  if (newline !== -1) {
-    shown += filter.pending.slice(newline + 1);
-    session.displayFilter = null;
-  }
-  return shown ? encodeUtf8(shown) : NO_BYTES;
-}
-function releaseDisplayFilter(session) {
-  const filter = session.displayFilter;
-  session.displayFilter = null;
-  if (!filter || filter.stage !== "before" || !filter.pending) return;
-  session.dispatchEvent(new CustomEvent("data", {
-    detail: { bytes: NO_BYTES, display: encodeUtf8(filter.pending), isStderr: false }
-  }));
-}
-class SshSession extends EventTarget {
-  /**
-   * @param {string} url          gateway WebSocket URL
-   * @param {object} options
-   * @param {string} options.username
-   * @param {string} [options.password]
-   * @param {'powershell'} [options.preferredShell]
-   * @param {(info: object) => Promise<boolean>} [options.verifyHost]
-   * @param {(prompt: object) => Promise<string>} [options.requestInput]
-   */
-  constructor(url, options = {}) {
-    super();
-    this.options = options;
-    this.username = options.username || "";
-    this.password = options.password || "";
-    this.requestInput = options.requestInput || (async () => "");
-    this.columns = options.columns || 80;
-    this.rows = options.rows || 24;
-    this.channelId = 0;
-    this.remoteChannelId = null;
-    this.remoteWindow = 0;
-    this.remoteMaxPacket = MAX_PACKET;
-    this.localWindow = INITIAL_WINDOW;
-    this.pendingWrites = [];
-    this.shellOpen = false;
-    this.commandInFlight = false;
-    this.displayFilter = null;
-    this.readySignaled = false;
-    this.powerShellAttempted = false;
-    this.powerShellTimer = null;
-    this.shellFamily = "";
-    this.promptTail = "";
-    this.exitStatus = null;
-    this.authMethods = [];
-    this.closed = false;
-    this.waiters = /* @__PURE__ */ new Map();
-    this.transport = new SshTransport(url, {
-      verifyHost: options.verifyHost || (async () => true),
-      openTransport: options.openTransport || null,
-      log: (step, detail) => console.info(`[SSH] ${step}`, detail)
-    });
-    this.transport.addEventListener("packet", (event) => {
-      this.#handlePacket(event.detail.type, event.detail.payload);
-    });
-    this.transport.addEventListener("greeting", (event) => {
-      for (const line of event.detail.lines) this.#emitBanner(`${line}\r
-`);
-    });
-    this.transport.addEventListener("banner", (event) => this.#emitBanner(event.detail.text));
-    this.transport.addEventListener("keys", (event) => {
-      this.fingerprint = event.detail.fingerprint;
-      this.#status("secured", `Host key ${event.detail.fingerprint} verified.`);
-      this.dispatchEvent(new CustomEvent("secure", { detail: event.detail }));
-      if (event.detail.firstTime) void this.#authenticate();
-    });
-    this.transport.addEventListener("hostdisconnect", (event) => {
-      this.lastMessage = event.detail.reason;
-    });
-    this.transport.addEventListener("error", (event) => {
-      this.lastMessage = event.detail.message;
-      this.dispatchEvent(new CustomEvent("error", { detail: event.detail }));
-    });
-    this.transport.addEventListener("close", (event) => {
-      if (this.closed) return;
-      this.closed = true;
-      clearTimeout(this.powerShellTimer);
-      this.#abandonWaiters(event.detail.message || "The SSH connection closed.");
-      this.dispatchEvent(new CustomEvent("close", {
-        detail: {
-          ...event.detail,
-          message: event.detail.message || this.lastMessage || "",
-          exitStatus: this.exitStatus
-        }
-      }));
-    });
-  }
-  connect() {
-    this.#status("connecting", "Opening the SSH transport\u2026");
-    this.transport.connect();
-  }
-  disconnect() {
-    if (this.closed) return;
-    clearTimeout(this.powerShellTimer);
-    if (this.shellOpen && this.remoteChannelId !== null) {
-      this.transport.send(new SshWriter(8).u8(MSG.CHANNEL_CLOSE).u32(this.remoteChannelId).take());
-    }
-    this.transport.disconnect("Closed by the user");
-  }
-  /** Send keystrokes, or anything else the terminal produces, to the shell. */
-  write(data) {
-    const bytes = typeof data === "string" ? encodeUtf8(data) : data;
-    if (!bytes.length) return;
-    this.pendingWrites.push(bytes);
-    this.#flushWrites();
-  }
-  /**
-   * Run one command in this shell and return what it printed.
-   *
-   * Deliberately the *same* shell the user is looking at, not a second channel:
-   * a command the assistant runs inherits the working directory, the
-   * environment and the login the user already has, and it appears in their
-   * terminal as it happens. An agent acting on a machine invisibly is worse
-   * than an agent that is slower to read.
-   *
-   * The output is framed by markers rather than measured, because an
-   * interactive shell echoes its input and prints a prompt around it. The
-   * markers are assembled by the shell from two pieces, so the echoed command
-   * line -- which contains the pieces but not the joined marker -- never looks
-   * like the real boundary.
-   *
-   * A `command` event brackets the run so the terminal can label it, and the
-   * three deadlines above decide when a command is stuck rather than slow.
-   */
-  runCommand(command, {
-    startMs = COMMAND_START_MS,
-    idleMs = COMMAND_IDLE_MS,
-    maxMs = COMMAND_MAX_MS
-  } = {}) {
-    const text = String(command || "").trim();
-    if (!text) return Promise.reject(new Error("No command was given."));
-    if (!this.shellOpen || this.closed) {
-      return Promise.reject(new Error("The SSH shell is not open."));
-    }
-    if (this.readySignaled === false) {
-      return Promise.reject(new Error("The SSH shell is still starting."));
-    }
-    if (this.commandInFlight) {
-      return Promise.reject(new Error("Another command is still running in this shell."));
-    }
-    const id = Array.from(crypto.getRandomValues(new Uint8Array(6))).map((byte) => byte.toString(16).padStart(2, "0")).join("");
-    const begin = `CCB${id}`;
-    const end = `CCE${id}`;
-    const family = this.shellFamily || "posix";
-    this.commandInFlight = true;
-    const startedAt = Date.now();
-    this.displayFilter = { begin, end, stage: "before", pending: "" };
-    this.dispatchEvent(new CustomEvent("command", {
-      detail: { phase: "start", id, command: text }
-    }));
-    return new Promise((resolve, reject) => {
-      let transcript = "";
-      let started = false;
-      let startTimer = null;
-      let idleTimer = null;
-      let maxTimer = null;
-      const finish = (settle) => {
-        clearTimeout(startTimer);
-        clearTimeout(idleTimer);
-        clearTimeout(maxTimer);
-        this.removeEventListener("data", onData);
-        this.removeEventListener("close", onClose);
-        this.commandInFlight = false;
-        releaseDisplayFilter(this);
-        settle();
-      };
-      const done = (result) => finish(() => {
-        this.dispatchEvent(new CustomEvent("command", {
-          detail: {
-            phase: "end",
-            id,
-            command: text,
-            exitStatus: result.exitStatus,
-            timedOut: result.timedOut,
-            started: result.started !== false,
-            reason: result.reason,
-            durationMs: result.durationMs
-          }
-        }));
-        resolve(result);
-      });
-      const fail = (error) => finish(() => {
-        this.dispatchEvent(new CustomEvent("command", {
-          detail: {
-            phase: "end",
-            id,
-            command: text,
-            exitStatus: null,
-            timedOut: false,
-            started,
-            durationMs: Date.now() - startedAt,
-            error: error.message
-          }
-        }));
-        reject(error);
-      });
-      const partialOutput = () => {
-        const at = transcript.indexOf(begin);
-        return at === -1 ? "" : stripTerminalCodes(transcript.slice(at + begin.length)).replace(/^\r?\n/, "").replace(/\s+$/, "");
-      };
-      const giveUp = (reason) => {
-        this.write("");
-        done({
-          output: partialOutput(),
-          exitStatus: null,
-          timedOut: true,
-          started,
-          reason,
-          durationMs: Date.now() - startedAt
-        });
-      };
-      const onData = (event) => {
-        transcript += decodeUtf8(event.detail.bytes);
-        if (!started && transcript.indexOf(begin) !== -1) {
-          started = true;
-          clearTimeout(startTimer);
-          startTimer = null;
-        }
-        if (started) {
-          clearTimeout(idleTimer);
-          idleTimer = setTimeout(() => giveUp("idle"), idleMs);
-        }
-        const endAt = transcript.indexOf(`${end} `);
-        if (endAt === -1) {
-          if (!started && FRAMING_REJECTED.test(stripTerminalCodes(transcript))) {
-            const guessed = shellFromPrompt(stripTerminalCodes(transcript)) || "cmd";
-            const wrongGuess = family !== guessed;
-            this.shellFamily = guessed;
-            fail(new Error(
-              wrongGuess ? `This shell is ${guessed === "powershell" ? "PowerShell" : "Windows cmd"}, not a POSIX shell, and it rejected the wrapper used to capture output. The shell has been noted; run the command again and it will be framed correctly.` : `The shell rejected the wrapper used to capture output: ${stripTerminalCodes(transcript).split("\n").filter(Boolean).pop() || "no detail"}`
-            ));
-          }
-          return;
-        }
-        const tail = transcript.slice(endAt);
-        const status = parseInt(tail.slice(end.length + 1).trim(), 10);
-        const beginAt = transcript.indexOf(begin);
-        const body = beginAt === -1 ? transcript.slice(0, endAt) : transcript.slice(beginAt + begin.length, endAt);
-        done({
-          output: stripTerminalCodes(body).replace(/^\r?\n/, "").replace(/\s+$/, ""),
-          exitStatus: Number.isInteger(status) ? status : null,
-          timedOut: false,
-          started: true,
-          durationMs: Date.now() - startedAt
-        });
-      };
-      const onClose = () => fail(new Error("The SSH session closed while the command was running."));
-      this.addEventListener("data", onData);
-      this.addEventListener("close", onClose);
-      startTimer = setTimeout(() => giveUp("start"), startMs);
-      idleTimer = setTimeout(() => giveUp("idle"), idleMs);
-      maxTimer = setTimeout(() => giveUp("max"), maxMs);
-      this.write(frameCommand(family, text, id));
-    });
-  }
-  /** Tell the shell its window changed, so full-screen programs redraw. */
-  resize(columns, rows) {
-    const nextColumns = Math.max(1, Math.floor(columns));
-    const nextRows = Math.max(1, Math.floor(rows));
-    if (nextColumns === this.columns && nextRows === this.rows) return;
-    this.columns = nextColumns;
-    this.rows = nextRows;
-    if (!this.shellOpen || this.remoteChannelId === null) return;
-    this.transport.send(new SshWriter(64).u8(MSG.CHANNEL_REQUEST).u32(this.remoteChannelId).string("window-change").boolean(false).u32(nextColumns).u32(nextRows).u32(0).u32(0).take());
-  }
-  // --- plumbing ------------------------------------------------------------
-  #status(phase, message) {
-    this.dispatchEvent(new CustomEvent("status", { detail: { phase, message } }));
-  }
-  #emitBanner(text) {
-    if (text) this.dispatchEvent(new CustomEvent("banner", { detail: { text } }));
-  }
-  /** Wait for one of a few message types: the handshakes read linearly that way. */
-  #expect(...types) {
-    return new Promise((resolve, reject) => {
-      for (const type of types) this.waiters.set(type, { resolve, reject });
-    });
-  }
-  #settle(type, payload) {
-    const waiter = this.waiters.get(type);
-    if (!waiter) return false;
-    this.waiters.clear();
-    waiter.resolve({ type, payload });
-    return true;
-  }
-  /** A closed transport must not leave a handshake waiting forever. */
-  #abandonWaiters(message) {
-    if (this.waiters.size === 0) return;
-    const pending = [...new Set(this.waiters.values())];
-    this.waiters.clear();
-    for (const waiter of pending) waiter.reject(new Error(message));
-  }
-  #handlePacket(type, payload) {
-    if (this.#settle(type, payload)) return;
-    switch (type) {
-      case MSG.USERAUTH_BANNER:
-        this.#emitBanner(new SshReader(payload, 1).string().replaceAll("\n", "\r\n"));
-        return;
-      case MSG.CHANNEL_DATA: {
-        const reader = new SshReader(payload, 1);
-        reader.u32();
-        this.#consume(reader.stringBytes());
-        return;
-      }
-      case MSG.CHANNEL_EXTENDED_DATA: {
-        const reader = new SshReader(payload, 1);
-        reader.u32();
-        const dataType = reader.u32();
-        const bytes = reader.stringBytes();
-        this.#consume(bytes, dataType === EXTENDED_DATA_STDERR);
-        return;
-      }
-      case MSG.CHANNEL_WINDOW_ADJUST: {
-        const reader = new SshReader(payload, 1);
-        reader.u32();
-        this.remoteWindow += reader.u32();
-        this.#flushWrites();
-        return;
-      }
-      case MSG.CHANNEL_REQUEST: {
-        const reader = new SshReader(payload, 1);
-        reader.u32();
-        const request = reader.string();
-        const wantReply = reader.boolean();
-        if (request === "exit-status") this.exitStatus = reader.u32();
-        if (request === "exit-signal") this.exitSignal = reader.string();
-        if (wantReply && this.remoteChannelId !== null) {
-          this.transport.send(new SshWriter(8).u8(MSG.CHANNEL_SUCCESS).u32(this.remoteChannelId).take());
-        }
-        return;
-      }
-      case MSG.CHANNEL_EOF:
-        return;
-      case MSG.CHANNEL_CLOSE:
-        this.shellOpen = false;
-        this.#status("closed", "The remote shell ended.");
-        this.transport.disconnect("Shell closed");
-        return;
-      default:
-        return;
-    }
-  }
-  /**
-   * Watch the prompt for which shell this machine answers with, so the first
-   * command is framed correctly rather than discovering it by failing.
-   */
-  #noteShellFamily(bytes) {
-    this.promptTail = (this.promptTail + stripTerminalCodes(decodeUtf8(bytes))).slice(-400);
-    const family = shellFromPrompt(this.promptTail);
-    if (!family) return;
-    if (family === "cmd" && !this.powerShellAttempted) {
-      this.#startPowerShell();
-      return;
-    }
-    if (family === "cmd" && this.powerShellAttempted && !this.readySignaled) return;
-    this.shellFamily = family;
-    if (family === "powershell" && !this.readySignaled) {
-      this.#markReady("Connected \xB7 PowerShell");
-    }
-  }
-  /** Replace Windows OpenSSH's usual cmd.exe with an interactive PowerShell. */
-  #startPowerShell() {
-    if (this.powerShellAttempted || !this.shellOpen) return;
-    this.powerShellAttempted = true;
-    this.readySignaled = false;
-    this.shellFamily = "";
-    this.#status("opening", "Starting PowerShell\u2026");
-    this.write("powershell.exe -NoLogo\r");
-    this.powerShellTimer = setTimeout(() => {
-      if (this.readySignaled || this.closed) return;
-      this.shellFamily = "powershell";
-      this.#markReady("Connected \xB7 PowerShell");
-    }, 2e3);
-  }
-  #markReady(message = "Connected.") {
-    clearTimeout(this.powerShellTimer);
-    this.powerShellTimer = null;
-    this.readySignaled = true;
-    this.#status("ready", message);
-    this.dispatchEvent(new CustomEvent("ready", {
-      detail: { fingerprint: this.fingerprint, shellFamily: this.shellFamily || "posix" }
-    }));
-  }
-  /** Shell output, with the receive window topped up before it runs dry. */
-  #consume(bytes, isStderr = false) {
-    if (!bytes.length) return;
-    this.#noteShellFamily(bytes);
-    this.dispatchEvent(new CustomEvent("data", {
-      detail: { bytes, display: filterDisplay(this, bytes), isStderr }
-    }));
-    this.localWindow -= bytes.length;
-    if (this.localWindow > WINDOW_REFILL_THRESHOLD || this.remoteChannelId === null) return;
-    const increment = INITIAL_WINDOW - this.localWindow;
-    this.localWindow = INITIAL_WINDOW;
-    this.transport.send(new SshWriter(16).u8(MSG.CHANNEL_WINDOW_ADJUST).u32(this.remoteChannelId).u32(increment).take());
-  }
-  #flushWrites() {
-    if (!this.shellOpen || this.remoteChannelId === null) return;
-    while (this.pendingWrites.length > 0) {
-      const next = this.pendingWrites[0];
-      const room = Math.min(this.remoteWindow, this.remoteMaxPacket - 64);
-      if (room <= 0) return;
-      const chunk = next.length <= room ? next : next.subarray(0, room);
-      if (chunk.length === next.length) this.pendingWrites.shift();
-      else this.pendingWrites[0] = next.subarray(chunk.length);
-      this.remoteWindow -= chunk.length;
-      this.transport.send(new SshWriter(chunk.length + 16).u8(MSG.CHANNEL_DATA).u32(this.remoteChannelId).string(chunk).take());
-    }
-  }
-  // --- authentication ------------------------------------------------------
-  async #authenticate() {
-    try {
-      this.#status("authenticating", `Authenticating as ${this.username}\u2026`);
-      this.transport.send(new SshWriter(32).u8(MSG.SERVICE_REQUEST).string("ssh-userauth").take());
-      await this.#expect(MSG.SERVICE_ACCEPT);
-      if (await this.#tryNone()) return void await this.#openShell();
-      if (this.authMethods.includes("password") && this.password) {
-        if (await this.#tryPassword(this.password)) return void await this.#openShell();
-      }
-      if (this.authMethods.includes("keyboard-interactive")) {
-        if (await this.#tryKeyboardInteractive()) return void await this.#openShell();
-        if (this.authMethods.includes("keyboard-interactive")) {
-          if (await this.#tryKeyboardInteractive({ usePassword: false })) {
-            return void await this.#openShell();
-          }
-        }
-      }
-      if (this.authMethods.includes("password")) {
-        const typed = await this.requestInput({
-          prompt: `${this.username}@${this.options.hostLabel || "host"}'s password: `,
-          echo: false
-        });
-        if (typed && await this.#tryPassword(typed)) return void await this.#openShell();
-      }
-      throw new Error(this.authMethods.length ? `SSH: authentication failed. The host accepts ${this.authMethods.join(", ")}.` : "SSH: the host rejected the connection before any authentication method was offered.");
-    } catch (error) {
-      if (!this.closed) this.transport.fail(error);
-    }
-  }
-  async #tryNone() {
-    this.transport.send(new SshWriter(64).u8(MSG.USERAUTH_REQUEST).string(this.username).string(SERVICE).string("none").take());
-    return this.#authResult();
-  }
-  async #tryPassword(password) {
-    this.transport.send(new SshWriter(128).u8(MSG.USERAUTH_REQUEST).string(this.username).string(SERVICE).string("password").boolean(false).string(password).take());
-    return this.#authResult();
-  }
-  /**
-   * keyboard-interactive is how most Linux hosts actually ask for a password,
-   * and the only way a one-time code can be entered. Prompts are answered from
-   * the password when one is obviously being asked for, and by the user
-   * otherwise.
-   */
-  async #tryKeyboardInteractive({ usePassword = true } = {}) {
-    this.transport.send(new SshWriter(96).u8(MSG.USERAUTH_REQUEST).string(this.username).string(SERVICE).string("keyboard-interactive").string("").string("").take());
-    let usedPassword = !usePassword;
-    while (true) {
-      const { type, payload } = await this.#expect(
-        MSG.USERAUTH_SUCCESS,
-        MSG.USERAUTH_FAILURE,
-        MSG.USERAUTH_INFO_REQUEST
-      );
-      if (type === MSG.USERAUTH_SUCCESS) return true;
-      if (type === MSG.USERAUTH_FAILURE) {
-        this.#readFailure(payload);
-        return false;
-      }
-      const reader = new SshReader(payload, 1);
-      const name = reader.string();
-      const instruction = reader.string();
-      reader.string();
-      const promptCount = reader.u32();
-      if (name) this.#emitBanner(`${name.replaceAll("\n", "\r\n")}\r
-`);
-      if (instruction) this.#emitBanner(`${instruction.replaceAll("\n", "\r\n")}\r
-`);
-      const answers = [];
-      for (let index = 0; index < promptCount; index++) {
-        const prompt = reader.string();
-        const echo = reader.boolean();
-        const looksLikePassword = !echo && /pass(word|phrase)/i.test(prompt);
-        if (looksLikePassword && this.password && !usedPassword) {
-          usedPassword = true;
-          answers.push(this.password);
-          continue;
-        }
-        answers.push(await this.requestInput({ prompt, echo }));
-      }
-      const response = new SshWriter(256).u8(MSG.USERAUTH_INFO_RESPONSE).u32(answers.length);
-      for (const answer of answers) response.string(answer);
-      this.transport.send(response.take());
-    }
-  }
-  async #authResult() {
-    const { type, payload } = await this.#expect(MSG.USERAUTH_SUCCESS, MSG.USERAUTH_FAILURE);
-    if (type === MSG.USERAUTH_SUCCESS) return true;
-    this.#readFailure(payload);
-    return false;
-  }
-  #readFailure(payload) {
-    const reader = new SshReader(payload, 1);
-    this.authMethods = reader.nameList();
-    const partial = reader.boolean();
-    if (partial) this.#emitBanner("\r\nOne factor accepted; the host wants another.\r\n");
-  }
-  // --- the shell -----------------------------------------------------------
-  async #openShell() {
-    this.#status("opening", "Starting the remote shell\u2026");
-    this.transport.send(new SshWriter(64).u8(MSG.CHANNEL_OPEN).string("session").u32(this.channelId).u32(INITIAL_WINDOW).u32(MAX_PACKET).take());
-    const opened = await this.#expect(MSG.CHANNEL_OPEN_CONFIRMATION, MSG.CHANNEL_OPEN_FAILURE);
-    if (opened.type === MSG.CHANNEL_OPEN_FAILURE) {
-      const reader2 = new SshReader(opened.payload, 1);
-      reader2.u32();
-      reader2.u32();
-      throw new Error(`SSH: the host refused to open a session channel (${reader2.string()}).`);
-    }
-    const reader = new SshReader(opened.payload, 1);
-    reader.u32();
-    this.remoteChannelId = reader.u32();
-    this.remoteWindow = reader.u32();
-    this.remoteMaxPacket = Math.max(1024, Math.min(reader.u32(), MAX_PACKET));
-    this.transport.send(new SshWriter(128).u8(MSG.CHANNEL_REQUEST).u32(this.remoteChannelId).string("pty-req").boolean(true).string(TERMINAL_TYPE).u32(this.columns).u32(this.rows).u32(0).u32(0).string(PTY_MODES).take());
-    const pty = await this.#expect(MSG.CHANNEL_SUCCESS, MSG.CHANNEL_FAILURE);
-    if (pty.type === MSG.CHANNEL_FAILURE) {
-      throw new Error("SSH: the host refused a pseudo-terminal, so there is no interactive shell to show.");
-    }
-    this.transport.send(new SshWriter(32).u8(MSG.CHANNEL_REQUEST).u32(this.remoteChannelId).string("shell").boolean(true).take());
-    const shell = await this.#expect(MSG.CHANNEL_SUCCESS, MSG.CHANNEL_FAILURE);
-    if (shell.type === MSG.CHANNEL_FAILURE) {
-      throw new Error("SSH: the host refused to start a shell for this account.");
-    }
-    this.shellOpen = true;
-    this.#flushWrites();
-    if (this.options.preferredShell === "powershell") this.#startPowerShell();
-    else this.#markReady();
-  }
-}
-export {
-  COMMAND_IDLE_MS,
-  COMMAND_MAX_MS,
-  COMMAND_START_MS,
-  DEFAULT_PORT,
-  SshSession,
-  frameCommand
-};
+var o={DISCONNECT:1,IGNORE:2,UNIMPLEMENTED:3,DEBUG:4,SERVICE_REQUEST:5,SERVICE_ACCEPT:6,EXT_INFO:7,KEXINIT:20,NEWKEYS:21,KEX_ECDH_INIT:30,KEX_ECDH_REPLY:31,USERAUTH_REQUEST:50,USERAUTH_FAILURE:51,USERAUTH_SUCCESS:52,USERAUTH_BANNER:53,USERAUTH_INFO_REQUEST:60,USERAUTH_INFO_RESPONSE:61,GLOBAL_REQUEST:80,REQUEST_SUCCESS:81,REQUEST_FAILURE:82,CHANNEL_OPEN:90,CHANNEL_OPEN_CONFIRMATION:91,CHANNEL_OPEN_FAILURE:92,CHANNEL_WINDOW_ADJUST:93,CHANNEL_DATA:94,CHANNEL_EXTENDED_DATA:95,CHANNEL_EOF:96,CHANNEL_CLOSE:97,CHANNEL_REQUEST:98,CHANNEL_SUCCESS:99,CHANNEL_FAILURE:100},se=1,re={1:"the host reported a protocol error",2:"the host could not agree on a key exchange method",3:"the key exchange failed",5:"the host ran out of resources",6:"the connection was lost below SSH",7:"the host application ended the connection",8:"too many connections",9:"authentication was cancelled by the user",10:"no more authentication methods are available",11:"the host closed the connection",12:"authentication was cancelled by the host",14:"the host refused the authentication attempt",15:"the host closed the connection while authenticating"};var Ue=new TextEncoder,ve=new TextDecoder;function S(s){return Ue.encode(s)}function k(s){return ve.decode(s)}function m(...s){let e=s.reduce((r,i)=>r+i.length,0),t=new Uint8Array(e),n=0;for(let r of s)t.set(r,n),n+=r.length;return t}function x(s){let e="";for(let t of s)e+=String.fromCharCode(t);return btoa(e)}function X(s){return x(s).replaceAll("+","-").replaceAll("/","_").replaceAll("=","")}var c=class{bytes;view;offset=0;constructor(e=256){this.bytes=new Uint8Array(new ArrayBuffer(e)),this.view=new DataView(this.bytes.buffer)}#e(e){if(this.offset+e<=this.bytes.length)return;let t=Math.max(this.bytes.length*2,64);for(;t<this.offset+e;)t*=2;let n=new Uint8Array(new ArrayBuffer(t));n.set(this.bytes.subarray(0,this.offset)),this.bytes=n,this.view=new DataView(n.buffer)}u8(e){return this.#e(1),this.view.setUint8(this.offset,e),this.offset+=1,this}boolean(e){return this.u8(e?1:0)}u32(e){return this.#e(4),this.view.setUint32(this.offset,e>>>0,!1),this.offset+=4,this}raw(e){return this.#e(e.length),this.bytes.set(e,this.offset),this.offset+=e.length,this}string(e){let t=typeof e=="string"?S(e):e;return this.u32(t.length).raw(t)}nameList(e){return this.string(e.join(","))}mpint(e){let t=0;for(;t<e.length&&e[t]===0;)t++;let n=e.subarray(t);return n.length===0?this.u32(0):(n[0]??0)&128?(this.u32(n.length+1).u8(0),this.raw(n)):this.u32(n.length).raw(n)}get length(){return this.offset}take(){return this.bytes.slice(0,this.offset)}},u=class{bytes;view;offset;constructor(e,t=0){this.bytes=e,this.view=new DataView(e.buffer,e.byteOffset,e.byteLength),this.offset=t}get remaining(){return this.bytes.length-this.offset}#e(e){if(e<0||this.remaining<e)throw new Error(`SSH: truncated packet (needed ${e} bytes, ${this.remaining} left)`)}u8(){return this.#e(1),this.view.getUint8(this.offset++)}boolean(){return this.u8()!==0}u32(){this.#e(4);let e=this.view.getUint32(this.offset,!1);return this.offset+=4,e}raw(e){this.#e(e);let t=this.bytes.subarray(this.offset,this.offset+e);return this.offset+=e,t}stringBytes(){return this.raw(this.u32())}string(){return k(this.stringBytes())}nameList(){let e=this.string();return e?e.split(","):[]}mpint(){let e=this.stringBytes(),t=0;for(;t<e.length&&e[t]===0;)t++;return e.subarray(t)}skip(e){return this.#e(e),this.offset+=e,this}rest(){return this.bytes.subarray(this.offset)}};function Q(s,e){if(s.length===e)return s;if(s.length>e)return s.subarray(s.length-e);let t=new Uint8Array(e);return t.set(s,e-s.length),t}var p=globalThis.crypto?.subtle,_e={"curve25519-sha256":{type:"x25519",hash:"SHA-256"},"curve25519-sha256@libssh.org":{type:"x25519",hash:"SHA-256"},"ecdh-sha2-nistp256":{type:"ecdh",curve:"P-256",hash:"SHA-256"}},Y={"ssh-ed25519":{keyType:"ssh-ed25519",kind:"ed25519"},"rsa-sha2-512":{keyType:"ssh-rsa",kind:"rsa",hash:"SHA-512"},"rsa-sha2-256":{keyType:"ssh-rsa",kind:"rsa",hash:"SHA-256"},"ecdsa-sha2-nistp256":{keyType:"ecdsa-sha2-nistp256",kind:"ecdsa",curve:"P-256",hash:"SHA-256"}};async function ie(s,e){if(!p)return!1;try{return await p.generateKey(s,!1,e),!0}catch{return!1}}var P=null;async function oe(){if(P)return P;let[s,e]=await Promise.all([ie({name:"X25519"},["deriveBits"]),ie({name:"Ed25519"},["sign","verify"])]),t=[];s&&t.push("curve25519-sha256","curve25519-sha256@libssh.org"),t.push("ecdh-sha2-nistp256");let n=[];return e&&n.push("ssh-ed25519"),n.push("rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256"),P={kex:t,hostKey:n,x25519:s,ed25519:e},P}async function ae(s){let e=_e[s];if(!e)throw new Error(`SSH: unsupported key exchange ${s}`);if(e.type==="x25519"){let r=await p.generateKey({name:"X25519"},!1,["deriveBits"]),i=new Uint8Array(await p.exportKey("raw",r.publicKey));return{hash:e.hash,publicKey:i,async sharedSecret(a){if(a.length!==32)throw new Error("SSH: the host sent a malformed X25519 key.");let d=await p.importKey("raw",a,{name:"X25519"},!1,[]),l=new Uint8Array(await p.deriveBits({name:"X25519",public:d},r.privateKey,256));if(l.every(h=>h===0))throw new Error("SSH: the host sent a degenerate X25519 key.");return l}}}let t=await p.generateKey({name:"ECDH",namedCurve:e.curve},!1,["deriveBits"]),n=new Uint8Array(await p.exportKey("raw",t.publicKey));return{hash:e.hash,publicKey:n,async sharedSecret(r){let i=await p.importKey("raw",r,{name:"ECDH",namedCurve:e.curve},!1,[]);return new Uint8Array(await p.deriveBits({name:"ECDH",public:i},t.privateKey,256))}}}function he(s){return new u(s).string()}async function ce(s){let e=new Uint8Array(await p.digest("SHA-256",s));return`SHA256:${x(e).replace(/=+$/,"")}`}async function ke(s,e){let t=Y[s];if(!t)throw new Error(`SSH: unsupported host key algorithm ${s}`);let n=new u(e),r=n.string();if(r!==t.keyType)throw new Error(`SSH: the host key is a ${r} but was announced as ${s}.`);if(t.kind==="ed25519")return p.importKey("raw",n.stringBytes(),{name:"Ed25519"},!1,["verify"]);if(t.kind==="rsa"){let i=n.mpint(),a=n.mpint();return p.importKey("jwk",{kty:"RSA",n:X(a),e:X(i),ext:!0},{name:"RSASSA-PKCS1-v1_5",hash:t.hash},!1,["verify"])}return n.string(),p.importKey("raw",n.stringBytes(),{name:"ECDSA",namedCurve:t.curve},!1,["verify"])}function xe(s,e){let t=new u(e),n=t.string();if(n!==s)throw new Error(`SSH: the host signed with ${n} after agreeing on ${s}.`);let r=t.stringBytes();if(Y[s]?.kind!=="ecdsa")return r;let i=new u(r),a=i.mpint(),d=i.mpint();return m(Q(a,32),Q(d,32))}async function le({algorithm:s,keyBlob:e,signatureBlob:t,exchangeHash:n}){let{kind:r,hash:i}=Y[s],a=await ke(s,e),d=xe(s,t),l=r==="ecdsa"?{name:"ECDSA",hash:i}:r==="rsa"?{name:"RSASSA-PKCS1-v1_5"}:{name:"Ed25519"};return p.verify(l,a,d,n)}async function ue({hash:s,clientVersion:e,serverVersion:t,clientKexInit:n,serverKexInit:r,hostKeyBlob:i,clientPublicKey:a,serverPublicKey:d,sharedSecret:l}){let h=new c(1024);return h.string(e),h.string(t),h.string(n),h.string(r),h.string(i),h.string(a),h.string(d),h.mpint(l),new Uint8Array(await p.digest(s,h.take()))}async function N({hash:s,sharedSecret:e,exchangeHash:t,letter:n,sessionId:r,length:i}){let a=new c(64+t.length).mpint(e).take(),d=m(a,t,new Uint8Array([n.charCodeAt(0)]),r),l=new Uint8Array(await p.digest(s,d));for(;l.length<i;){let h=new Uint8Array(await p.digest(s,m(a,t,l)));l=m(l,h)}return l.subarray(0,i)}var de="VNC_GATEWAY_READY_v1",fe="VNC_GATEWAY_KEEPALIVE_v1";var pe="SSH-2.0-CloudflareGateway_1.0",z={"aes256-gcm@openssh.com":{keyLength:32},"aes128-gcm@openssh.com":{keyLength:16}},B=Object.keys(z),ge=["hmac-sha2-256","hmac-sha2-512"],ye=["none"],L=16,q=16,we=12,j=8,me=4,Ee=262144,Le=8192,J=globalThis.crypto?.subtle;function M(s,e){return s.find(t=>e.includes(t))||null}var $=class s{key;fixed;counter;constructor(e,t){this.key=e,this.fixed=t.slice(0,4),this.counter=t.slice(4,12)}static async create(e,t){let n=await J.importKey("raw",e,{name:"AES-GCM"},!1,["encrypt","decrypt"]);return new s(n,t)}nextIv(){let e=m(this.fixed,this.counter);for(let t=this.counter.length-1;t>=0&&(this.counter[t]=this.counter[t]+1&255,this.counter[t]===0);t--);return e}},F=class extends EventTarget{url;verifyHost;log;socket;openTransport;closed;buffer;serverVersion;greeting;sendSequence;receiveSequence;outgoing;incoming;sessionId;kex;kexQueue;keepaliveTimer;bytesSent;bytesReceived;encryptChain;newKeysBarrier;releaseNewKeys;pendingServerKexInit;established;constructor(e,{verifyHost:t,log:n,openTransport:r}={}){super(),this.url=e,this.verifyHost=t||(()=>!0),this.log=n||(()=>{}),this.openTransport=r||null,this.socket=null,this.closed=!1,this.buffer=new Uint8Array(0),this.serverVersion="",this.greeting=[],this.sendSequence=0,this.receiveSequence=0,this.outgoing=null,this.incoming=null,this.sessionId=null,this.kex=null,this.kexQueue=[],this.keepaliveTimer=null,this.bytesSent=0,this.bytesReceived=0}connect(){this.socket=this.openTransport?this.openTransport(this.url):new WebSocket(this.url),this.socket.binaryType="arraybuffer",this.socket.addEventListener("open",()=>{this.socket.send(de),this.#n(S(`${pe}\r
+`)),this.keepaliveTimer=setInterval(()=>{if(this.socket?.readyState===WebSocket.OPEN&&(this.socket.send(fe),this.sessionId))try{this.#t(new c(64).u8(o.GLOBAL_REQUEST).string("keepalive@openssh.com").u8(1).take())}catch{}},25e3)}),this.socket.addEventListener("message",e=>{typeof e.data!="string"&&this.#s(new Uint8Array(e.data))}),this.socket.addEventListener("close",e=>{this.#e({clean:e.code===1e3,code:e.code,message:e.reason||(e.code===1006?"The gateway rejected or could not reach this SSH target. Confirm that SSH is published for this host.":"")})}),this.socket.addEventListener("error",()=>{this.log("The SSH gateway WebSocket reported a transport error; waiting for its close reason.")})}disconnect(e="Client disconnected"){if(this.closed)return;try{let n=new c(64).u8(o.DISCONNECT).u32(11).string(e).string("").take();this.#t(n)}catch{}let t=this.socket;Promise.resolve(this.encryptChain).finally(()=>{try{t?.close(1e3,"Client disconnected")}catch{}}),this.#e({clean:!0,code:1e3,message:""})}#e(e){this.closed||(this.closed=!0,clearInterval(this.keepaliveTimer),this.keepaliveTimer=null,this.dispatchEvent(new CustomEvent("close",{detail:e})))}fail(e){let t=e instanceof Error?e.message:String(e);if(!this.closed){this.dispatchEvent(new CustomEvent("error",{detail:{message:t}})),this.#e({clean:!1,code:4e3,message:t});try{this.socket?.close(4e3,t.slice(0,100))}catch{}}}#n(e){this.socket?.readyState===WebSocket.OPEN&&(this.bytesSent+=e.length,this.socket.send(e))}#s(e){this.bytesReceived+=e.length,this.buffer=this.buffer.length?m(this.buffer,e):e,this.drainChain=(this.drainChain||Promise.resolve()).then(()=>this.#f()).catch(t=>this.fail(t))}async#f(){if(!this.closed&&!(!this.serverVersion&&!this.#p()))for(;!this.closed;){if(this.newKeysBarrier){let t=this.newKeysBarrier;this.newKeysBarrier=null,await t;continue}if(!this.incoming){let t=this.#g();if(!t)return;this.#r(t);continue}let e=this.#y();if(!e)return;this.#r(await this.#c(e))}}#p(){for(;;){let e=this.buffer.indexOf(10);if(e===-1){if(this.buffer.length>Le)throw new Error("SSH: the host sent no version line.");return!1}let t=e;t>0&&this.buffer[t-1]===13&&t--;let n=new TextDecoder().decode(this.buffer.subarray(0,t));if(this.buffer=this.buffer.subarray(e+1),!n.startsWith("SSH-")){n.trim()&&this.greeting.push(n);continue}if(!n.startsWith("SSH-2.0-")&&!n.startsWith("SSH-1.99-"))throw new Error(`SSH: this host speaks ${n.split("-").slice(0,2).join("-")}, which is too old.`);return this.serverVersion=n,this.log("version",{server:n,greeting:this.greeting}),this.dispatchEvent(new CustomEvent("greeting",{detail:{lines:this.greeting.slice()}})),this.#l(),!0}}#g(){if(this.buffer.length<5)return null;let t=new DataView(this.buffer.buffer,this.buffer.byteOffset,this.buffer.byteLength).getUint32(0,!1);if(t<8||t>Ee)throw new Error("SSH: the host sent a packet of an impossible size.");if(this.buffer.length<4+t)return null;let n=this.buffer[4];if(n+1>t)throw new Error("SSH: a packet claimed more padding than it had.");let r=this.buffer.slice(5,4+t-n);return this.buffer=this.buffer.subarray(4+t),this.receiveSequence=this.receiveSequence+1>>>0,r}#y(){if(this.buffer.length<4)return null;let t=new DataView(this.buffer.buffer,this.buffer.byteOffset,this.buffer.byteLength).getUint32(0,!1);if(t<L||t%L!==0||t>Ee)throw new Error("SSH: the host sent a packet of an impossible size.");let n=4+t+q;if(this.buffer.length<n)return null;let r=this.buffer.slice(0,n);return this.buffer=this.buffer.subarray(n),r}async#c(e){let t;try{t=new Uint8Array(await J.decrypt({name:"AES-GCM",iv:this.incoming.nextIv(),additionalData:e.subarray(0,4),tagLength:q*8},this.incoming.key,e.subarray(4)))}catch{throw new Error("SSH: a packet failed its integrity check, so the session was dropped.")}let n=t[0];if(n+1>t.length)throw new Error("SSH: a packet claimed more padding than it had.");return this.receiveSequence=this.receiveSequence+1>>>0,t.slice(1,t.length-n)}#r(e){if(e.length===0)return;let t=e[0];switch(t){case o.DISCONNECT:{let n=new u(e,1),r=n.u32(),a=n.string()||re[r]||`reason ${r}`;this.dispatchEvent(new CustomEvent("hostdisconnect",{detail:{code:r,reason:a}})),this.#e({clean:r===11,code:1e3,message:a});try{this.socket?.close(1e3,"Host disconnected")}catch{}return}case o.IGNORE:case o.UNIMPLEMENTED:case o.EXT_INFO:return;case o.DEBUG:{let n=new u(e,1),r=n.boolean(),i=n.string();this.log("debug",{message:i,alwaysDisplay:r}),r&&this.dispatchEvent(new CustomEvent("banner",{detail:{text:`${i}\r
+`}}));return}case o.KEXINIT:this.#w(e);return;case o.NEWKEYS:this.#d();return;case o.GLOBAL_REQUEST:{let n=new u(e,1);n.string(),n.boolean()&&this.#t(new Uint8Array([o.REQUEST_FAILURE]));return}case o.REQUEST_SUCCESS:case o.REQUEST_FAILURE:return;default:break}if(this.kex&&t>=30&&t<=49){this.#i(e);return}this.dispatchEvent(new CustomEvent("packet",{detail:{type:t,payload:e}}))}send(e){return this.closed?!1:this.kex?.running?(this.kexQueue.push(e),!0):(this.#t(e),!0)}#t(e){if(!(this.closed||this.socket?.readyState!==WebSocket.OPEN)){if(!this.outgoing){this.#n(He(e)),this.sendSequence=this.sendSequence+1>>>0;return}this.#a(e)}}async#a(e){let t=this.encryptChain||Promise.resolve();return this.encryptChain=t.then(async()=>{if(this.closed||!this.outgoing)return;let n=Ie(e.length),r=new Uint8Array(1+e.length+n);r[0]=n,r.set(e,1),crypto.getRandomValues(r.subarray(1+e.length));let i=new c(4).u32(r.length).take(),a=new Uint8Array(await J.encrypt({name:"AES-GCM",iv:this.outgoing.nextIv(),additionalData:i,tagLength:q*8},this.outgoing.key,r));this.#n(m(i,a)),this.sendSequence=this.sendSequence+1>>>0}).catch(n=>this.fail(n)),this.encryptChain}async#l(){if(!this.kex?.running){this.kex={running:!0,clientKexInit:null,pending:null,inbox:[]};try{let e=await oe(),t=Re(e);this.kex.clientKexInit=t,this.#t(t);let n=this.pendingServerKexInit||await this.#o(o.KEXINIT);this.pendingServerKexInit=null,await this.#u(e,t,n)}catch(e){this.fail(e)}}}async#w(e){if(this.kex?.running){this.#i(e);return}this.log("rekey",{reason:"the host asked for new keys"}),this.pendingServerKexInit=e,await this.#l()}#i(e){if(this.kex){if(this.kex.pending){let t=this.kex.pending;this.kex.pending=null,t(e);return}this.kex.inbox.push(e)}}#o(e){return new Promise((t,n)=>{let r=a=>{if(e!==void 0&&a[0]!==e){n(new Error(`SSH: expected message ${e} during key exchange but got ${a[0]}.`));return}t(a)},i=this.kex.inbox.shift();if(i){r(i);return}this.kex.pending=a=>{this.kex.pending=null,r(a)}})}async#u(e,t,n){let r=Oe(n),i=M(e.kex,r.kex),a=M(e.hostKey,r.hostKey),d=M(B,r.cipherClientToServer),l=M(B,r.cipherServerToClient);if(!i)throw new Error(`SSH: no shared key exchange method. The host offers ${r.kex.join(", ")}.`);if(!a)throw new Error(`SSH: no host key type this browser can verify. The host offers ${r.hostKey.join(", ")}.`);if(!d||!l)throw new Error(`SSH: the host does not offer AES-GCM, which is the only cipher this client can use. It offers ${r.cipherServerToClient.join(", ")}.`);this.log("negotiated",{kex:i,hostKey:a,cipher:l,rekey:!!this.sessionId});let h=await ae(i);this.#t(new c(128).u8(o.KEX_ECDH_INIT).string(h.publicKey).take());let w=new u(await this.#o(o.KEX_ECDH_REPLY),1),y=w.stringBytes(),C=w.stringBytes(),g=w.stringBytes(),E=await h.sharedSecret(C),A=await ue({hash:h.hash,clientVersion:pe,serverVersion:this.serverVersion,clientKexInit:t,serverKexInit:n,hostKeyBlob:y,clientPublicKey:h.publicKey,serverPublicKey:C,sharedSecret:E});if(!await le({algorithm:a,keyBlob:y,signatureBlob:g,exchangeHash:A}))throw new Error("SSH: the host key signature is invalid, so this is not the machine it claims to be.");let _=await ce(y);if(!this.sessionId){if(!await this.verifyHost({fingerprint:_,keyType:he(y),algorithm:a}))throw new Error("SSH: the host key was not accepted, so the connection was stopped.");this.sessionId=A}this.#t(new Uint8Array([o.NEWKEYS])),await this.#o(o.NEWKEYS);let b={hash:h.hash,sharedSecret:E,exchangeHash:A,sessionId:this.sessionId},[H,R,V,T]=await Promise.all([N({...b,letter:"A",length:we}),N({...b,letter:"B",length:we}),N({...b,letter:"C",length:z[d].keyLength}),N({...b,letter:"D",length:z[l].keyLength})]);this.outgoing=await $.create(V,H),this.incoming=await $.create(T,R),this.kex.running=!1,this.releaseNewKeys?.(),this.releaseNewKeys=null;let O=this.kexQueue;this.kexQueue=[];for(let f of O)this.#t(f);let K=!this.established;this.established=!0,this.dispatchEvent(new CustomEvent("keys",{detail:{fingerprint:_,kexAlgorithm:i,hostKeyAlgorithm:a,cipher:l,firstTime:K}}))}#d(){this.kex&&(this.newKeysBarrier=new Promise(e=>{this.releaseNewKeys=e}),this.#i(new Uint8Array([o.NEWKEYS])))}};function Ie(s){let e=1+s,t=L-e%L;for(;t<me;)t+=L;return t}function He(s){let e=5+s.length,t=j-e%j;t<me&&(t+=j);let n=new c(e+t);n.u32(1+s.length+t),n.u8(t),n.raw(s);let r=n.take(),i=new Uint8Array(t);return crypto.getRandomValues(i),m(r,i)}function Re(s){let e=new Uint8Array(16);crypto.getRandomValues(e);let t=new c(512);return t.u8(o.KEXINIT).raw(e),t.nameList(s.kex),t.nameList(s.hostKey),t.nameList(B),t.nameList(B),t.nameList(ge),t.nameList(ge),t.nameList(ye),t.nameList(ye),t.nameList([]),t.nameList([]),t.boolean(!1),t.u32(0),t.take()}function Oe(s){let e=new u(s,17);return{kex:e.nameList(),hostKey:e.nameList(),cipherClientToServer:e.nameList(),cipherServerToClient:e.nameList(),macClientToServer:e.nameList(),macServerToClient:e.nameList(),compressionClientToServer:e.nameList(),compressionServerToClient:e.nameList()}}var ot=22,Z="ssh-connection",Ke="xterm-256color",I=2*1024*1024,ee=32*1024,De=I/2,Pe=new Uint8Array([0]),Me=2e4,Be=5*6e4,$e=60*6e4,W=new Uint8Array(0);function Fe(s){return`'${String(s).replace(/'/g,"'\\''")}'`}function Se(s){let e=s.slice(-400);return/(?:^|\n)PS [A-Za-z]:\\[^\n]*>\s*$/.test(e)?"powershell":/(?:^|\n)[^\n]*[A-Za-z]:\\[^\n]*>\s*$/.test(e)?"cmd":""}var We=/is not recognized as an internal or external command|command not found|not recognized as the name of a cmdlet|CommandNotFoundException/i;function Ve(s,e,t){if(s==="cmd")return`echo.&echo CCB${t}&${e}&call echo.CCE${t} %^ERRORLEVEL%\r`;if(s==="powershell"){let n=x(S(e));return`Write-Output ""; Write-Output ("CCB" + "${t}"); $__ccCode = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${n}')); $global:LASTEXITCODE = $null; . ([ScriptBlock]::Create($__ccCode)); $__ccOk = $?; $__cc = if ($LASTEXITCODE -ne $null) { $LASTEXITCODE } elseif ($__ccOk) { 0 } else { 1 }; Write-Output ("CCE" + "${t} " + $__cc)\r`}return`printf '\\n%s%s\\n' 'CCB' '${t}'; eval ${Fe(e)}; __cc=$?; printf '\\n%s%s %s\\n' 'CCE' '${t}' "$__cc"\r`}function U(s){return s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g,"").replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g,"").replace(/\u001b[@-Z\\-_]/g,"").replace(/\r\n/g,`
+`).replace(/\r/g,"")}function Ge(s,e){let t=s.displayFilter;if(!t)return e;t.pending+=k(e);let n="";if(t.stage==="before"){let i=t.pending.indexOf(t.begin);if(i===-1)return W;t.pending=t.pending.slice(i+t.begin.length).replace(/^\r?\n/,""),t.stage="inside"}if(t.stage==="inside"){let i=t.pending.indexOf(t.end);if(i===-1)return n=t.pending,t.pending="",n?S(n):W;n=t.pending.slice(0,i),t.pending=t.pending.slice(i),t.stage="closing"}let r=t.pending.indexOf(`
+`);return r!==-1&&(n+=t.pending.slice(r+1),s.displayFilter=null),n?S(n):W}function Xe(s){let e=s.displayFilter;s.displayFilter=null,!(!e||e.stage!=="before"||!e.pending)&&s.dispatchEvent(new CustomEvent("data",{detail:{bytes:W,display:S(e.pending),isStderr:!1}}))}var Ae=class extends EventTarget{constructor(e,t={}){super(),this.options=t,this.username=t.username||"",this.password=t.password||"",this.requestInput=t.requestInput||(async()=>""),this.columns=t.columns||80,this.rows=t.rows||24,this.channelId=0,this.remoteChannelId=null,this.remoteWindow=0,this.remoteMaxPacket=ee,this.localWindow=I,this.pendingWrites=[],this.shellOpen=!1,this.commandInFlight=!1,this.displayFilter=null,this.readySignaled=!1,this.powerShellAttempted=!1,this.powerShellTimer=null,this.shellFamily="",this.promptTail="",this.exitStatus=null,this.authMethods=[],this.closed=!1,this.waiters=new Map,this.transport=new F(e,{verifyHost:t.verifyHost||(async()=>!0),openTransport:t.openTransport||null,log:(n,r)=>console.info(`[SSH] ${n}`,r)}),this.transport.addEventListener("packet",n=>{this.#g(n.detail.type,n.detail.payload)}),this.transport.addEventListener("greeting",n=>{for(let r of n.detail.lines)this.#n(`${r}\r
+`)}),this.transport.addEventListener("banner",n=>this.#n(n.detail.text)),this.transport.addEventListener("keys",n=>{this.fingerprint=n.detail.fingerprint,this.#e("secured",`Host key ${n.detail.fingerprint} verified.`),this.dispatchEvent(new CustomEvent("secure",{detail:n.detail})),n.detail.firstTime&&this.#l()}),this.transport.addEventListener("hostdisconnect",n=>{this.lastMessage=n.detail.reason}),this.transport.addEventListener("error",n=>{this.lastMessage=n.detail.message,this.dispatchEvent(new CustomEvent("error",{detail:n.detail}))}),this.transport.addEventListener("close",n=>{this.closed||(this.closed=!0,clearTimeout(this.powerShellTimer),this.#p(n.detail.message||"The SSH connection closed."),this.dispatchEvent(new CustomEvent("close",{detail:{...n.detail,message:n.detail.message||this.lastMessage||"",exitStatus:this.exitStatus}})))})}connect(){this.#e("connecting","Opening the SSH transport\u2026"),this.transport.connect()}disconnect(){this.closed||(clearTimeout(this.powerShellTimer),this.shellOpen&&this.remoteChannelId!==null&&this.transport.send(new c(8).u8(o.CHANNEL_CLOSE).u32(this.remoteChannelId).take()),this.transport.disconnect("Closed by the user"))}write(e){let t=typeof e=="string"?S(e):e;t.length&&(this.pendingWrites.push(t),this.#a())}runCommand(e,{startMs:t=Me,idleMs:n=Be,maxMs:r=$e}={}){let i=String(e||"").trim();if(!i)return Promise.reject(new Error("No command was given."));if(!this.shellOpen||this.closed)return Promise.reject(new Error("The SSH shell is not open."));if(this.readySignaled===!1)return Promise.reject(new Error("The SSH shell is still starting."));if(this.commandInFlight)return Promise.reject(new Error("Another command is still running in this shell."));let a=Array.from(crypto.getRandomValues(new Uint8Array(6))).map(y=>y.toString(16).padStart(2,"0")).join(""),d=`CCB${a}`,l=`CCE${a}`,h=this.shellFamily||"posix";this.commandInFlight=!0;let w=Date.now();return this.displayFilter={begin:d,end:l,stage:"before",pending:""},this.dispatchEvent(new CustomEvent("command",{detail:{phase:"start",id:a,command:i}})),new Promise((y,C)=>{let g="",E=!1,A=null,v=null,_=null,b=f=>{clearTimeout(A),clearTimeout(v),clearTimeout(_),this.removeEventListener("data",O),this.removeEventListener("close",K),this.commandInFlight=!1,Xe(this),f()},H=f=>b(()=>{this.dispatchEvent(new CustomEvent("command",{detail:{phase:"end",id:a,command:i,exitStatus:f.exitStatus,timedOut:f.timedOut,started:f.started!==!1,reason:f.reason,durationMs:f.durationMs}})),y(f)}),R=f=>b(()=>{this.dispatchEvent(new CustomEvent("command",{detail:{phase:"end",id:a,command:i,exitStatus:null,timedOut:!1,started:E,durationMs:Date.now()-w,error:f.message}})),C(f)}),V=()=>{let f=g.indexOf(d);return f===-1?"":U(g.slice(f+d.length)).replace(/^\r?\n/,"").replace(/\s+$/,"")},T=f=>{this.write(""),H({output:V(),exitStatus:null,timedOut:!0,started:E,reason:f,durationMs:Date.now()-w})},O=f=>{g+=k(f.detail.bytes),!E&&g.indexOf(d)!==-1&&(E=!0,clearTimeout(A),A=null),E&&(clearTimeout(v),v=setTimeout(()=>T("idle"),n));let D=g.indexOf(`${l} `);if(D===-1){if(!E&&We.test(U(g))){let G=Se(U(g))||"cmd",Te=h!==G;this.shellFamily=G,R(new Error(Te?`This shell is ${G==="powershell"?"PowerShell":"Windows cmd"}, not a POSIX shell, and it rejected the wrapper used to capture output. The shell has been noted; run the command again and it will be framed correctly.`:`The shell rejected the wrapper used to capture output: ${U(g).split(`
+`).filter(Boolean).pop()||"no detail"}`))}return}let Ce=g.slice(D),te=parseInt(Ce.slice(l.length+1).trim(),10),ne=g.indexOf(d),be=ne===-1?g.slice(0,D):g.slice(ne+d.length,D);H({output:U(be).replace(/^\r?\n/,"").replace(/\s+$/,""),exitStatus:Number.isInteger(te)?te:null,timedOut:!1,started:!0,durationMs:Date.now()-w})},K=()=>R(new Error("The SSH session closed while the command was running."));this.addEventListener("data",O),this.addEventListener("close",K),A=setTimeout(()=>T("start"),t),v=setTimeout(()=>T("idle"),n),_=setTimeout(()=>T("max"),r),this.write(Ve(h,i,a))})}resize(e,t){let n=Math.max(1,Math.floor(e)),r=Math.max(1,Math.floor(t));n===this.columns&&r===this.rows||(this.columns=n,this.rows=r,!(!this.shellOpen||this.remoteChannelId===null)&&this.transport.send(new c(64).u8(o.CHANNEL_REQUEST).u32(this.remoteChannelId).string("window-change").boolean(!1).u32(n).u32(r).u32(0).u32(0).take()))}#e(e,t){this.dispatchEvent(new CustomEvent("status",{detail:{phase:e,message:t}}))}#n(e){e&&this.dispatchEvent(new CustomEvent("banner",{detail:{text:e}}))}#s(...e){return new Promise((t,n)=>{for(let r of e)this.waiters.set(r,{resolve:t,reject:n})})}#f(e,t){let n=this.waiters.get(e);return n?(this.waiters.clear(),n.resolve({type:e,payload:t}),!0):!1}#p(e){if(this.waiters.size===0)return;let t=[...new Set(this.waiters.values())];this.waiters.clear();for(let n of t)n.reject(new Error(e))}#g(e,t){if(!this.#f(e,t))switch(e){case o.USERAUTH_BANNER:this.#n(new u(t,1).string().replaceAll(`
+`,`\r
+`));return;case o.CHANNEL_DATA:{let n=new u(t,1);n.u32(),this.#t(n.stringBytes());return}case o.CHANNEL_EXTENDED_DATA:{let n=new u(t,1);n.u32();let r=n.u32(),i=n.stringBytes();this.#t(i,r===se);return}case o.CHANNEL_WINDOW_ADJUST:{let n=new u(t,1);n.u32(),this.remoteWindow+=n.u32(),this.#a();return}case o.CHANNEL_REQUEST:{let n=new u(t,1);n.u32();let r=n.string(),i=n.boolean();r==="exit-status"&&(this.exitStatus=n.u32()),r==="exit-signal"&&(this.exitSignal=n.string()),i&&this.remoteChannelId!==null&&this.transport.send(new c(8).u8(o.CHANNEL_SUCCESS).u32(this.remoteChannelId).take());return}case o.CHANNEL_EOF:return;case o.CHANNEL_CLOSE:this.shellOpen=!1,this.#e("closed","The remote shell ended."),this.transport.disconnect("Shell closed");return;default:return}}#y(e){this.promptTail=(this.promptTail+U(k(e))).slice(-400);let t=Se(this.promptTail);if(t){if(t==="cmd"&&!this.powerShellAttempted){this.#c();return}t==="cmd"&&this.powerShellAttempted&&!this.readySignaled||(this.shellFamily=t,t==="powershell"&&!this.readySignaled&&this.#r("Connected \xB7 PowerShell"))}}#c(){this.powerShellAttempted||!this.shellOpen||(this.powerShellAttempted=!0,this.readySignaled=!1,this.shellFamily="",this.#e("opening","Starting PowerShell\u2026"),this.write("powershell.exe -NoLogo\r"),this.powerShellTimer=setTimeout(()=>{this.readySignaled||this.closed||(this.shellFamily="powershell",this.#r("Connected \xB7 PowerShell"))},2e3))}#r(e="Connected."){clearTimeout(this.powerShellTimer),this.powerShellTimer=null,this.readySignaled=!0,this.#e("ready",e),this.dispatchEvent(new CustomEvent("ready",{detail:{fingerprint:this.fingerprint,shellFamily:this.shellFamily||"posix"}}))}#t(e,t=!1){if(!e.length||(this.#y(e),this.dispatchEvent(new CustomEvent("data",{detail:{bytes:e,display:Ge(this,e),isStderr:t}})),this.localWindow-=e.length,this.localWindow>De||this.remoteChannelId===null))return;let n=I-this.localWindow;this.localWindow=I,this.transport.send(new c(16).u8(o.CHANNEL_WINDOW_ADJUST).u32(this.remoteChannelId).u32(n).take())}#a(){if(!(!this.shellOpen||this.remoteChannelId===null))for(;this.pendingWrites.length>0;){let e=this.pendingWrites[0],t=Math.min(this.remoteWindow,this.remoteMaxPacket-64);if(t<=0)return;let n=e.length<=t?e:e.subarray(0,t);n.length===e.length?this.pendingWrites.shift():this.pendingWrites[0]=e.subarray(n.length),this.remoteWindow-=n.length,this.transport.send(new c(n.length+16).u8(o.CHANNEL_DATA).u32(this.remoteChannelId).string(n).take())}}async#l(){try{if(this.#e("authenticating",`Authenticating as ${this.username}\u2026`),this.transport.send(new c(32).u8(o.SERVICE_REQUEST).string("ssh-userauth").take()),await this.#s(o.SERVICE_ACCEPT),await this.#w())return void await this.#h();if(this.authMethods.includes("password")&&this.password&&await this.#i(this.password))return void await this.#h();if(this.authMethods.includes("keyboard-interactive")){if(await this.#o())return void await this.#h();if(this.authMethods.includes("keyboard-interactive")&&await this.#o({usePassword:!1}))return void await this.#h()}if(this.authMethods.includes("password")){let e=await this.requestInput({prompt:`${this.username}@${this.options.hostLabel||"host"}'s password: `,echo:!1});if(e&&await this.#i(e))return void await this.#h()}throw new Error(this.authMethods.length?`SSH: authentication failed. The host accepts ${this.authMethods.join(", ")}.`:"SSH: the host rejected the connection before any authentication method was offered.")}catch(e){this.closed||this.transport.fail(e)}}async#w(){return this.transport.send(new c(64).u8(o.USERAUTH_REQUEST).string(this.username).string(Z).string("none").take()),this.#u()}async#i(e){return this.transport.send(new c(128).u8(o.USERAUTH_REQUEST).string(this.username).string(Z).string("password").boolean(!1).string(e).take()),this.#u()}async#o({usePassword:e=!0}={}){this.transport.send(new c(96).u8(o.USERAUTH_REQUEST).string(this.username).string(Z).string("keyboard-interactive").string("").string("").take());let t=!e;for(;;){let{type:n,payload:r}=await this.#s(o.USERAUTH_SUCCESS,o.USERAUTH_FAILURE,o.USERAUTH_INFO_REQUEST);if(n===o.USERAUTH_SUCCESS)return!0;if(n===o.USERAUTH_FAILURE)return this.#d(r),!1;let i=new u(r,1),a=i.string(),d=i.string();i.string();let l=i.u32();a&&this.#n(`${a.replaceAll(`
+`,`\r
+`)}\r
+`),d&&this.#n(`${d.replaceAll(`
+`,`\r
+`)}\r
+`);let h=[];for(let y=0;y<l;y++){let C=i.string(),g=i.boolean();if(!g&&/pass(word|phrase)/i.test(C)&&this.password&&!t){t=!0,h.push(this.password);continue}h.push(await this.requestInput({prompt:C,echo:g}))}let w=new c(256).u8(o.USERAUTH_INFO_RESPONSE).u32(h.length);for(let y of h)w.string(y);this.transport.send(w.take())}}async#u(){let{type:e,payload:t}=await this.#s(o.USERAUTH_SUCCESS,o.USERAUTH_FAILURE);return e===o.USERAUTH_SUCCESS?!0:(this.#d(t),!1)}#d(e){let t=new u(e,1);this.authMethods=t.nameList(),t.boolean()&&this.#n(`\r
+One factor accepted; the host wants another.\r
+`)}async#h(){this.#e("opening","Starting the remote shell\u2026"),this.transport.send(new c(64).u8(o.CHANNEL_OPEN).string("session").u32(this.channelId).u32(I).u32(ee).take());let e=await this.#s(o.CHANNEL_OPEN_CONFIRMATION,o.CHANNEL_OPEN_FAILURE);if(e.type===o.CHANNEL_OPEN_FAILURE){let i=new u(e.payload,1);throw i.u32(),i.u32(),new Error(`SSH: the host refused to open a session channel (${i.string()}).`)}let t=new u(e.payload,1);if(t.u32(),this.remoteChannelId=t.u32(),this.remoteWindow=t.u32(),this.remoteMaxPacket=Math.max(1024,Math.min(t.u32(),ee)),this.transport.send(new c(128).u8(o.CHANNEL_REQUEST).u32(this.remoteChannelId).string("pty-req").boolean(!0).string(Ke).u32(this.columns).u32(this.rows).u32(0).u32(0).string(Pe).take()),(await this.#s(o.CHANNEL_SUCCESS,o.CHANNEL_FAILURE)).type===o.CHANNEL_FAILURE)throw new Error("SSH: the host refused a pseudo-terminal, so there is no interactive shell to show.");if(this.transport.send(new c(32).u8(o.CHANNEL_REQUEST).u32(this.remoteChannelId).string("shell").boolean(!0).take()),(await this.#s(o.CHANNEL_SUCCESS,o.CHANNEL_FAILURE)).type===o.CHANNEL_FAILURE)throw new Error("SSH: the host refused to start a shell for this account.");this.shellOpen=!0,this.#a(),this.options.preferredShell==="powershell"?this.#c():this.#r()}};export{Be as COMMAND_IDLE_MS,$e as COMMAND_MAX_MS,Me as COMMAND_START_MS,ot as DEFAULT_PORT,Ae as SshSession,Ve as frameCommand};