dsh-remote 0.8.42 → 0.8.45

package/lib/pool.js

@@ -3,11 +3,173 @@ import ssh2 from 'ssh2'
 import { readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
-import { toSftpPath, truncate } from './paths.js'
+import { truncate } from './paths.js'
 import { createHostKeyGuard } from './hostkey.js'
+import { buildSftpSurface } from './sftp-surface.js'
+import { SystemOpenSshPool, isSystemOpenSshBackend } from './openssh.js'
 
 const { Client } = ssh2
 
+/**
+ * Build the pool for a config.
+ *
+ * Two backends exist (issue #51): the native one below, which speaks SSH itself
+ * via ssh2, and the "system OpenSSH" one (lib/openssh.js), which delegates to
+ * the local `ssh` executable so GSSAPI/Kerberos and the rest of the user's
+ * `~/.ssh/config` are honoured. Both expose one identical surface, so every
+ * caller can keep using `new SshPool(...)`-shaped code — this factory only has
+ * to decide which class to instantiate.
+ */
+export function createPool(config, opts) {
+  return isSystemOpenSshBackend(config)
+    ? new SystemOpenSshPool(config, opts)
+    : new SshPool(config, opts)
+}
+
+/**
+ * Run one `forwardOut` and resolve with the resulting channel.
+ *
+ * ssh2 reports a dead connection by THROWING synchronously —
+ * `if (!this._sock || !isWritable(this._sock)) throw new Error('Not connected')`
+ * (ssh2/lib/client.js:1398-1400) — and never calls the callback, so a
+ * callback-only error path cannot guard this call (issue #54). Two further
+ * consequences justify a shared helper rather than an inline try/catch:
+ *
+ *   • inside a `new Promise(executor)` a bare throw rejects nothing: it becomes
+ *     an unhandled REJECTION and leaves the promise pending forever;
+ *   • called from a `net.Server` connection handler the throw escapes to the
+ *     process top level and kills the host.
+ *
+ * The system-OpenSSH backend (lib/openssh.js) throws the same way when its
+ * connection is already closed, so this covers both transports.
+ *
+ * @param {object} client - an ssh2 Client or OpenSshConnection.
+ * @param {object} spec - `srcHost`/`srcPort`/`dstHost`/`dstPort`.
+ * @returns {Promise<object>} the forwarded channel / duplex stream.
+ */
+export function forwardOutChannel(client, { srcHost = '127.0.0.1', srcPort = 0, dstHost, dstPort }) {
+  return new Promise((resolve, reject) => {
+    // `reject` is called at most once: a callback that fires after a successful
+    // throw-path rejection would be a no-op, which Promise guarantees.
+    try {
+      client.forwardOut(srcHost, srcPort, dstHost, dstPort, (err, channel) => (err ? reject(err) : resolve(channel)))
+    } catch (err) {
+      reject(err)
+    }
+  })
+}
+
+/**
+ * The ACTIVE pool: one long-lived object whose concrete implementation can be
+ * swapped when the current machine's transport backend changes.
+ *
+ * Why a delegating facade instead of just constructing the right class once:
+ * `backend` is a PER-MACHINE field (an enterprise Kerberos host needs
+ * `openssh` while every other machine stays on `native`), but the plugin keeps
+ * exactly one active pool for its whole lifetime and hangs `passwordResolver` /
+ * `onReady` / `onCloseHook` off it once at startup. Replacing the object
+ * wholesale on every machine switch would silently drop those hooks — the port
+ * forwards and keychain passwords would stop working after the first switch.
+ *
+ * So the facade owns the hooks and the shared `config` object, and forwards
+ * them to whichever concrete pool is right for the current config. Everything
+ * else is a straight delegation, which is why callers cannot tell the
+ * difference (and why the class is deliberately not part of the public story).
+ */
+export class ActivePool {
+  constructor(config, opts = {}) {
+    this.config = config
+    this.opts = opts
+    // The hooks are assigned by the plugin AFTER construction, so they are
+    // stored here and re-applied to every delegate this facade ever creates.
+    this._passwordResolver = null
+    this._onReady = null
+    this._onCloseHook = null
+    this._delegate = null
+    this._sync()
+  }
+
+  /** Which concrete class the current config asks for. */
+  _wantsSystemOpenSsh() {
+    return isSystemOpenSshBackend(this.config)
+  }
+
+  _delegateIsCurrent() {
+    if (!this._delegate) return false
+    const isOpenssh = this._delegate instanceof SystemOpenSshPool
+    return isOpenssh === this._wantsSystemOpenSsh()
+  }
+
+  /** Create (or replace) the delegate so it matches the current config. */
+  _sync() {
+    if (this._delegateIsCurrent()) return this._delegate
+    const previous = this._delegate
+    const next = createPool(this.config, this.opts)
+    next.passwordResolver = this._passwordResolver
+    next.onReady = this._onReady
+    next.onCloseHook = this._onCloseHook
+    this._delegate = next
+    // Tear the old backend down LAST, and never let a teardown error mask the
+    // new pool: the connection it was holding belongs to the old host anyway.
+    if (previous) { try { previous.close() } catch { /* already gone */ } }
+    return next
+  }
+
+  get delegate() { return this._sync() }
+
+  // ── hooks: stored here, mirrored onto every delegate ──────────────────────
+  get passwordResolver() { return this._passwordResolver }
+  set passwordResolver(fn) {
+    this._passwordResolver = fn
+    if (this._delegate) this._delegate.passwordResolver = fn
+  }
+  get onReady() { return this._onReady }
+  set onReady(fn) {
+    this._onReady = fn
+    if (this._delegate) this._delegate.onReady = fn
+  }
+  get onCloseHook() { return this._onCloseHook }
+  set onCloseHook(fn) {
+    this._onCloseHook = fn
+    if (this._delegate) this._delegate.onCloseHook = fn
+  }
+
+  // ── pass-through state the plugin reads directly ──────────────────────────
+  get client() { return this._delegate ? this._delegate.client : null }
+  // Assignable because the plugin's own tests arm a fake live connection on the
+  // active pool; a getter-only facade would make that assignment a silent
+  // no-op in sloppy mode and a TypeError in the strict-mode ESM tests.
+  set client(v) { if (this._sync()) this._delegate.client = v }
+  get connecting() { return this._delegate ? this._delegate.connecting : null }
+  get proxyPool() { return this._delegate ? this._delegate.proxyPool : null }
+  get epoch() { return this._delegate ? this._delegate.epoch : 0 }
+  get platform() { return this._delegate ? this._delegate.platform : 'unknown' }
+  set platform(v) { if (this._sync()) this._delegate.platform = v }
+  get gitBashPath() { return this._delegate ? this._delegate.gitBashPath : '' }
+  set gitBashPath(v) { if (this._sync()) this._delegate.gitBashPath = v }
+  get shellMode() { return this._delegate ? this._delegate.shellMode : 'native' }
+  set shellMode(v) { if (this._sync()) this._delegate.shellMode = v }
+
+  // ── delegated operations ──────────────────────────────────────────────────
+  /** Re-point at a new target, switching backend first if the machine asks. */
+  setTarget(fields, previous) {
+    // The backend may have changed with the machine, so apply that part of the
+    // request to `config` BEFORE picking the delegate: _sync() chooses the class
+    // from config.backend, and the old backend must not be handed a host it can
+    // no longer reach. The delegate then receives the whole request as usual.
+    if (fields && fields.backend !== undefined) this.config.backend = String(fields.backend)
+    if (fields && fields.sshBinary !== undefined) this.config.sshBinary = String(fields.sshBinary)
+    const d = this._sync()
+    return d.setTarget(fields, previous)
+  }
+  connect() { return this.delegate.connect() }
+  exec(cmd, opts) { return this.delegate.exec(cmd, opts) }
+  sftp() { return this.delegate.sftp() }
+  detect() { return this.delegate.detect() }
+  invalidate() { return this.delegate.invalidate() }
+  close() { return this.delegate.close() }
+}
+
 export class SshPool {
   constructor(config, opts = {}) {
     this.config = config
@@ -41,7 +203,7 @@ export class SshPool {
     return p
   }
 
-  setTarget({ host, port, username, password, privateKeyPath, passphrase, workspace, useAgent, keyboardInteractive, proxy, hostKeyMode }, previous) {
+  setTarget({ host, port, username, password, privateKeyPath, passphrase, workspace, useAgent, keyboardInteractive, proxy, hostKeyMode, backend, sshBinary }, previous) {
     // Collect the requested changes first: an UNCHANGED target is a no-op. The
     // old behavior closed the live connection and re-ran platform detection
     // even for an identical target, so every picker keystroke
@@ -68,6 +230,10 @@ export class SshPool {
     if (keyboardInteractive !== undefined) wanted.push(['keyboardInteractive', !!keyboardInteractive])
     if (proxy !== undefined) wanted.push(['proxy', proxy])
     if (hostKeyMode !== undefined) wanted.push(['hostKeyMode', String(hostKeyMode)])
+    // Issue #51: the transport backend is part of the target identity — changing
+    // it must close the live connection exactly like changing the host does.
+    if (backend !== undefined) wanted.push(['backend', String(backend)])
+    if (sshBinary !== undefined) wanted.push(['sshBinary', String(sshBinary)])
     const differs = ([k, v]) => (k === 'proxy'
       ? JSON.stringify(base[k] ?? null) !== JSON.stringify(v ?? null)
       : base[k] !== v)
@@ -129,9 +295,11 @@ export class SshPool {
         }, { knownHostsFile: this._knownHostsFile })
         const pclient = await this.proxyPool.connect()
         if (!isCurrent()) throw new Error('ssh target changed during proxy connect')
-        sock = await new Promise((res, rej) => {
-          pclient.forwardOut('127.0.0.1', 0, this.config.host, this.config.port, (e, ch) => (e ? rej(new Error('proxy forward to target failed: ' + ((e && e.message) || e))) : res(ch)))
-        })
+        try {
+          sock = await forwardOutChannel(pclient, { dstHost: this.config.host, dstPort: this.config.port })
+        } catch (e) {
+          throw new Error('proxy forward to target failed: ' + ((e && e.message) || e))
+        }
       } catch (err) {
         return fail(err)
       }
@@ -513,58 +681,10 @@ export class SshPool {
                   }
                   return reject(new Error('ssh sftp failed: ' + ((err && err.message) || err)))
                 }
-                // A dead channel must fail fast. ssh2's own EOF handling only
-                // rejects the requests that were pending at that moment
-                // (SFTP.js cleanupRequests); every request issued afterwards is
-                // registered in `_requests` and never answered. Without the flag
-                // below each such call waits out the full commandTimeoutMs — so a
-                // tree walk over N entries costs N × 2 × timeout, i.e. days on a
-                // large directory (issue #44). Mark the channel dead on EOF/close
-                // and reject immediately from then on.
-                let dead = false
-                const markDead = () => { dead = true }
-                if (typeof sftp.on === 'function') {
-                  sftp.on('end', markDead)
-                  sftp.on('close', markDead)
-                  sftp.on('error', markDead)
-                }
-                const withTimeout = (fn) => (...args) =>
-                  new Promise((r2, j2) => {
-                    if (dead) return j2(new Error('sftp channel closed'))
-                    const timer = setTimeout(() => j2(new Error('sftp operation timed out')), this.config.commandTimeoutMs)
-                    const finish = (e, v) => {
-                      clearTimeout(timer)
-                      e ? j2(e) : r2(v)
-                    }
-                    try { fn(...args, finish) } catch (e) { clearTimeout(timer); j2(e) }
-                  })
-                const P = (p) => toSftpPath(p)
-                resolve({
-                  readdir: (dir) => withTimeout((d, cb) => sftp.readdir(d, cb))(P(dir)),
-                  stat: (p) => withTimeout((d, cb) => sftp.stat(d, cb))(P(p)),
-                  lstat: (p) => withTimeout((d, cb) => sftp.lstat(d, cb))(P(p)),
-                  mkdir: (dir) => withTimeout((d, cb) => sftp.mkdir(d, cb))(P(dir)),
-                  rmdir: (dir) => withTimeout((d, cb) => sftp.rmdir(d, cb))(P(dir)),
-                  unlink: (p) => withTimeout((d, cb) => sftp.unlink(d, cb))(P(p)),
-                  rename: (p, d) => withTimeout((a, b, cb) => sftp.rename(a, b, cb))(P(p), P(d)),
-                  realpath: (p) => withTimeout((d, cb) => sftp.realpath(d, cb))(P(p)),
-                  readFile: (p) => withTimeout((d, cb) => sftp.readFile(d, cb))(P(p)),
-                  writeFile: (p, data) => withTimeout((d, data2, cb) => sftp.writeFile(d, data2, cb))(P(p), data),
-                  fastGet: (p, lp) => withTimeout((d, l, cb) => sftp.fastGet(d, l, cb))(P(p), lp),
-                  fastPut: (lp, p) => withTimeout((l, d, cb) => sftp.fastPut(l, d, cb))(lp, P(p)),
-                  // Range read for oversized previews: never downloads the whole file.
-                  readPartial: (p, offset, length) => withTimeout((d, off, len, cb) => {
-                    sftp.open(d, 'r', (e, handle) => {
-                      if (e) return cb(e)
-                      const buf = Buffer.alloc(len)
-                      sftp.read(handle, buf, 0, len, off, (e2, bytesRead, data) => {
-                        sftp.close(handle, () => {})
-                        if (e2) return cb(e2)
-                        cb(null, Buffer.isBuffer(data) ? data.subarray(0, bytesRead) : buf.subarray(0, bytesRead))
-                      })
-                    })
-                  })(P(p), offset, length),
-                })
+                // The promisified surface (timeouts, dead-channel fail-fast,
+                // range reads) is shared verbatim with the system-OpenSSH
+                // backend — see lib/sftp-surface.js for the rules it encodes.
+                resolve(buildSftpSurface(sftp, { commandTimeoutMs: this.config.commandTimeoutMs }))
               })
             } catch (e) {
               clearAttempt()

package/lib/registry.js

@@ -80,6 +80,12 @@ export function applyMachine(config, m) {
   if (m.hostKeyMode) config.hostKeyMode = m.hostKeyMode
   if (typeof m.useAgent === 'boolean') config.useAgent = m.useAgent
   if (typeof m.keyboardInteractive === 'boolean') config.keyboardInteractive = m.keyboardInteractive
+  // Issue #51: the transport backend is PER MACHINE. An enterprise box that only
+  // accepts Kerberos must go through the system OpenSSH backend while every
+  // other machine can stay on the native one, so this cannot be a purely global
+  // default.
+  if (m.backend) config.backend = m.backend
+  if (typeof m.sshBinary === 'string') config.sshBinary = m.sshBinary
   config.proxy = m.proxy && m.proxy.host ? m.proxy : undefined
 }
 

package/lib/sftp-surface.js

@@ -0,0 +1,76 @@
+// dsh-remote — the promisified SFTP surface every backend presents.
+//
+// Both SSH transports (the native ssh2 pool in lib/pool.js and the
+// system-OpenSSH pool in lib/openssh.js) must expose the SAME object to
+// callers: lib/sync.js, lib/search.js, lib/routes-fs.js, lib/remote-fs.js and
+// the rw_* tools all consume this exact shape. Keeping one implementation
+// matters more than it looks: the timeout, dead-channel and range-read rules
+// below encode failures that were expensive to find (issue #44), and a second
+// hand-copied version would drift away from the fixed one.
+//
+// The two rules that are easy to get wrong:
+//   • A dead channel must fail FAST. ssh2's own EOF handling only rejects the
+//     requests pending at that moment; every later request is registered and
+//     never answered, so each waits out the full commandTimeoutMs. Over a tree
+//     walk that is N × 2 × timeout — days on a large directory.
+//   • `readPartial` exists so an oversized preview never downloads the whole
+//     file to show its head.
+import { toSftpPath } from './paths.js'
+
+/**
+ * Wrap a live SFTP channel (ssh2's SFTP instance) in the promisified surface
+ * the plugin's callers expect.
+ *
+ * @param {object} sftp - an ssh2 SFTP channel (already negotiated/ready).
+ * @param {object} opts
+ * @param {number} opts.commandTimeoutMs - per-operation timeout.
+ * @returns {object} promisified sftp surface.
+ */
+export function buildSftpSurface(sftp, { commandTimeoutMs }) {
+  // A dead channel must fail fast (see the header). ssh2's SFTP instance and the
+  // system-OpenSSH engine both emit these, so one hook covers both backends.
+  let dead = false
+  const markDead = () => { dead = true }
+  if (typeof sftp.on === 'function') {
+    sftp.on('end', markDead)
+    sftp.on('close', markDead)
+    sftp.on('error', markDead)
+  }
+  const withTimeout = (fn) => (...args) =>
+    new Promise((resolve, reject) => {
+      if (dead) return reject(new Error('sftp channel closed'))
+      const timer = setTimeout(() => reject(new Error('sftp operation timed out')), commandTimeoutMs)
+      const finish = (err, value) => {
+        clearTimeout(timer)
+        err ? reject(err) : resolve(value)
+      }
+      try { fn(...args, finish) } catch (err) { clearTimeout(timer); reject(err) }
+    })
+  const P = (p) => toSftpPath(p)
+  return {
+    readdir: (dir) => withTimeout((d, cb) => sftp.readdir(d, cb))(P(dir)),
+    stat: (p) => withTimeout((d, cb) => sftp.stat(d, cb))(P(p)),
+    lstat: (p) => withTimeout((d, cb) => sftp.lstat(d, cb))(P(p)),
+    mkdir: (dir) => withTimeout((d, cb) => sftp.mkdir(d, cb))(P(dir)),
+    rmdir: (dir) => withTimeout((d, cb) => sftp.rmdir(d, cb))(P(dir)),
+    unlink: (p) => withTimeout((d, cb) => sftp.unlink(d, cb))(P(p)),
+    rename: (p, d) => withTimeout((a, b, cb) => sftp.rename(a, b, cb))(P(p), P(d)),
+    realpath: (p) => withTimeout((d, cb) => sftp.realpath(d, cb))(P(p)),
+    readFile: (p) => withTimeout((d, cb) => sftp.readFile(d, cb))(P(p)),
+    writeFile: (p, data) => withTimeout((d, data2, cb) => sftp.writeFile(d, data2, cb))(P(p), data),
+    fastGet: (p, lp) => withTimeout((d, l, cb) => sftp.fastGet(d, l, cb))(P(p), lp),
+    fastPut: (lp, p) => withTimeout((l, d, cb) => sftp.fastPut(l, d, cb))(lp, P(p)),
+    // Range read for oversized previews: never downloads the whole file.
+    readPartial: (p, offset, length) => withTimeout((d, off, len, cb) => {
+      sftp.open(d, 'r', (e, handle) => {
+        if (e) return cb(e)
+        const buf = Buffer.alloc(len)
+        sftp.read(handle, buf, 0, len, off, (e2, bytesRead, data) => {
+          sftp.close(handle, () => {})
+          if (e2) return cb(e2)
+          cb(null, Buffer.isBuffer(data) ? data.subarray(0, bytesRead) : buf.subarray(0, bytesRead))
+        })
+      })
+    })(P(p), offset, length),
+  }
+}