scp-next 1.0.19 → 1.1.2

package/dist/cli/index.js

@@ -11,7 +11,6 @@ import { access as access4, mkdir as mkdir2, stat as stat3 } from "fs/promises";
 import path4 from "path";
 
 // src/client/transport.ts
-import { readFile as readFile2 } from "fs/promises";
 import SftpClient from "ssh2-sftp-client";
 
 // src/security/redact.ts
@@ -26,6 +25,8 @@ var SENSITIVE_KEYS = [
   "secret"
 ];
 var PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+var SECRET_OPTION_PATTERN = /(--(?:password|passphrase|token|secret|authorization|credential)(?:=|\s+))(?:"[^"]*"|'[^']*'|\S+)/gi;
+var SECRET_ASSIGNMENT_PATTERN = /(\b(?:password|passphrase|token|secret|authorization|credential)[A-Z0-9_-]*\s*=\s*)(?:"[^"]*"|'[^']*'|[^\s&]+)/gi;
 function isSensitiveKey(key) {
   const normalized = key.replace(/[-_\s]/g, "").toLowerCase();
   return SENSITIVE_KEYS.some((sensitive) => normalized.includes(sensitive));
@@ -49,9 +50,34 @@ function redactSensitiveValues(value) {
 }
 function formatErrorMessage(error) {
   if (error instanceof Error) {
-    return String(redactSensitiveValues(error.message));
+    return redactKnownSensitiveValues(error.message, {});
+  }
+  return redactKnownSensitiveValues(String(error), {});
+}
+function redactKnownSensitiveValues(text, source) {
+  const sensitiveValues = collectSensitiveValues(source);
+  const redactedKnownValues = sensitiveValues.reduce(
+    (redacted, value) => redacted.split(value).join("[REDACTED]"),
+    String(redactSensitiveValues(text))
+  );
+  return redactedKnownValues.replace(SECRET_OPTION_PATTERN, "$1[REDACTED]").replace(SECRET_ASSIGNMENT_PATTERN, "$1[REDACTED]");
+}
+function collectSensitiveValues(value, key = "") {
+  if (isSensitiveKey(key)) {
+    if (typeof value === "string" && value) {
+      return [value];
+    }
+    if (Buffer.isBuffer(value) && value.length > 0) {
+      return [value.toString("utf8")];
+    }
+    return [];
+  }
+  if (!value || typeof value !== "object") {
+    return [];
   }
-  return String(redactSensitiveValues(error));
+  return Object.entries(value).flatMap(
+    ([nestedKey, nestedValue]) => collectSensitiveValues(nestedValue, nestedKey)
+  );
 }
 
 // src/errors/index.ts
@@ -90,6 +116,23 @@ var TransferError = class extends ScpNextError {
     super(message, { ...options, code: "SCP_NEXT_TRANSFER_ERROR" });
   }
 };
+var RemoteCommandError = class extends ScpNextError {
+  exitCode;
+  signal;
+  stdout;
+  stderr;
+  constructor(message, options) {
+    super(message, {
+      code: "SCP_NEXT_REMOTE_COMMAND_ERROR",
+      ...options.cause !== void 0 ? { cause: options.cause } : {},
+      ...options.context !== void 0 ? { context: options.context } : {}
+    });
+    this.exitCode = options.exitCode;
+    this.signal = options.signal;
+    this.stdout = options.stdout ?? "";
+    this.stderr = options.stderr ?? "";
+  }
+};
 var FileSystemError = class extends ScpNextError {
   constructor(message, options = {}) {
     super(message, { ...options, code: "SCP_NEXT_FILESYSTEM_ERROR" });
@@ -118,6 +161,9 @@ function toScpNextError(error) {
   return new TransferError(String(redactSensitiveValues(message)), { cause: error });
 }
 
+// src/client/ssh-options.ts
+import { readFile as readFile2 } from "fs/promises";
+
 // src/security/host-verification.ts
 import { createHash } from "crypto";
 import { access as access2, readFile } from "fs/promises";
@@ -275,6 +321,34 @@ function createHostVerifier(allowedFingerprints) {
   };
 }
 
+// src/client/ssh-options.ts
+async function createSshConnectOptions(options) {
+  const connectOptions = {};
+  if (options.host !== void 0) connectOptions.host = options.host;
+  if (options.port !== void 0) connectOptions.port = options.port;
+  if (options.username !== void 0) connectOptions.username = options.username;
+  if (options.password !== void 0) connectOptions.password = options.password;
+  if (options.privateKey !== void 0) {
+    connectOptions.privateKey = options.privateKey;
+  } else if (options.privateKeyFile) {
+    connectOptions.privateKey = await readFile2(
+      expandHome(options.privateKeyFile),
+      "utf8"
+    );
+  }
+  if (options.passphrase !== void 0) connectOptions.passphrase = options.passphrase;
+  const agent = options.agent ?? process.env.SSH_AUTH_SOCK;
+  if (agent !== void 0) connectOptions.agent = agent;
+  if (options.timeout !== void 0) connectOptions.readyTimeout = options.timeout;
+  const allowedFingerprints = await resolveAllowedFingerprints(options);
+  const hostVerifier = createHostVerifier(allowedFingerprints);
+  if (hostVerifier) {
+    connectOptions.hostHash = "sha256";
+    connectOptions.hostVerifier = hostVerifier;
+  }
+  return connectOptions;
+}
+
 // src/client/transport.ts
 function toRemoteFileInfo(info) {
   return {
@@ -293,28 +367,7 @@ var Ssh2SftpTransport = class {
     });
   }
   async connect(options) {
-    const allowedFingerprints = await resolveAllowedFingerprints(options);
-    const hostVerifier = createHostVerifier(allowedFingerprints);
-    const connectOptions = {};
-    if (options.host !== void 0) connectOptions.host = options.host;
-    if (options.port !== void 0) connectOptions.port = options.port;
-    if (options.username !== void 0) connectOptions.username = options.username;
-    if (options.password !== void 0) connectOptions.password = options.password;
-    if (options.privateKey !== void 0) {
-      connectOptions.privateKey = options.privateKey;
-    } else if (options.privateKeyFile) {
-      connectOptions.privateKey = await readFile2(expandHome(options.privateKeyFile), "utf8");
-    }
-    if (options.passphrase !== void 0) connectOptions.passphrase = options.passphrase;
-    const agent = options.agent ?? process.env.SSH_AUTH_SOCK;
-    if (agent !== void 0) {
-      connectOptions.agent = agent;
-    }
-    if (options.timeout !== void 0) connectOptions.readyTimeout = options.timeout;
-    if (hostVerifier) {
-      connectOptions.hostHash = "sha256";
-      connectOptions.hostVerifier = hostVerifier;
-    }
+    const connectOptions = await createSshConnectOptions(options);
     try {
       await this.client.connect(connectOptions);
     } catch (error) {
@@ -411,6 +464,210 @@ function hostVerificationTroubleshooting(host) {
   ].join("\n");
 }
 
+// src/client/command-executor.ts
+import { Client } from "ssh2";
+var SshCommandExecutor = class {
+  client;
+  connected = false;
+  closed = true;
+  constructor(client = new Client()) {
+    this.client = client;
+    this.client.on("error", () => {
+      this.connected = false;
+    });
+    this.client.on("close", () => {
+      this.connected = false;
+      this.closed = true;
+    });
+  }
+  async connect(options) {
+    const connectOptions = await createSshConnectOptions(options);
+    this.closed = false;
+    await new Promise((resolve2, reject) => {
+      const onReady = () => {
+        cleanup();
+        this.connected = true;
+        resolve2();
+      };
+      const onError = (error) => {
+        cleanup();
+        this.connected = false;
+        this.closed = true;
+        try {
+          this.client.end();
+        } catch {
+        }
+        const converted = toScpNextError(error);
+        if (converted instanceof HostVerificationError) {
+          reject(converted);
+          return;
+        }
+        reject(
+          new ConnectionError(
+            `Unable to connect command executor to SSH server: ${formatErrorMessage(error)}`,
+            {
+              cause: error,
+              context: {
+                host: options.host,
+                port: options.port,
+                username: options.username
+              }
+            }
+          )
+        );
+      };
+      const onClose = () => {
+        cleanup();
+        reject(new ConnectionError("SSH connection closed before it was ready."));
+      };
+      const cleanup = () => {
+        this.client.off("ready", onReady);
+        this.client.off("error", onError);
+        this.client.off("close", onClose);
+      };
+      this.client.once("ready", onReady);
+      this.client.once("error", onError);
+      this.client.once("close", onClose);
+      try {
+        this.client.connect(connectOptions);
+      } catch (error) {
+        cleanup();
+        this.closed = true;
+        reject(
+          new ConnectionError(
+            `Unable to start SSH connection: ${formatErrorMessage(error)}`
+          )
+        );
+      }
+    });
+  }
+  async exec(command, options = {}) {
+    if (!this.connected) {
+      throw new ConnectionError("Command executor is not connected.");
+    }
+    return new Promise((resolve2, reject) => {
+      try {
+        this.client.exec(command, (error, stream) => {
+          if (error) {
+            reject(
+              new RemoteCommandError("Unable to start remote command.", {
+                exitCode: null
+              })
+            );
+            return;
+          }
+          collectCommandResult(command, stream, options, resolve2, reject);
+        });
+      } catch (error) {
+        reject(
+          new ConnectionError(
+            `Unable to start remote command: ${formatErrorMessage(error)}`
+          )
+        );
+      }
+    });
+  }
+  async close() {
+    if (this.closed) {
+      return;
+    }
+    this.connected = false;
+    await new Promise((resolve2) => {
+      this.client.once("close", resolve2);
+      this.client.end();
+    });
+  }
+};
+function collectCommandResult(command, stream, options, resolve2, reject) {
+  let stdout = "";
+  let stderr = "";
+  let outputBytes = 0;
+  let settled = false;
+  const maxBuffer = options.maxBuffer ?? 10 * 1024 * 1024;
+  const cleanup = () => {
+    if (timer) clearTimeout(timer);
+    stream.off("data", onStdoutData);
+    stream.stderr.off("data", onStderrData);
+    stream.off("close", onClose);
+    stream.off("error", onStreamError);
+    stream.stderr.off("error", onStreamError);
+  };
+  const fail = (error) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    try {
+      stream.close();
+    } catch {
+    }
+    reject(error);
+  };
+  const appendOutput = (target, chunk) => {
+    outputBytes += Buffer.byteLength(chunk);
+    if (outputBytes > maxBuffer) {
+      fail(
+        new RemoteCommandError(
+          `Remote command output exceeded maxBuffer of ${maxBuffer} bytes.`,
+          {
+            exitCode: null,
+            stdout,
+            stderr
+          }
+        )
+      );
+      return;
+    }
+    if (target === "stdout") stdout += chunk;
+    else stderr += chunk;
+  };
+  const onStreamError = () => {
+    fail(
+      new RemoteCommandError("Remote command stream failed.", {
+        exitCode: null,
+        stdout,
+        stderr
+      })
+    );
+  };
+  const onStdoutData = (chunk) => {
+    appendOutput("stdout", chunk);
+  };
+  const onStderrData = (chunk) => {
+    appendOutput("stderr", chunk);
+  };
+  const onClose = (exitCode, signal) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    resolve2({
+      command,
+      stdout,
+      stderr,
+      exitCode: typeof exitCode === "number" ? exitCode : null,
+      ...signal ? { signal } : {}
+    });
+  };
+  const timer = options.timeout === void 0 ? void 0 : setTimeout(() => {
+    fail(
+      new RemoteCommandError(
+        `Remote command timed out after ${options.timeout} ms.`,
+        {
+          exitCode: null,
+          stdout,
+          stderr
+        }
+      )
+    );
+  }, options.timeout);
+  stream.setEncoding("utf8");
+  stream.stderr.setEncoding("utf8");
+  stream.on("data", onStdoutData);
+  stream.stderr.on("data", onStderrData);
+  stream.once("error", onStreamError);
+  stream.stderr.once("error", onStreamError);
+  stream.once("close", onClose);
+}
+
 // src/client/walk.ts
 import { readdir, stat as stat2 } from "fs/promises";
 import path3 from "path";
@@ -502,6 +759,36 @@ async function walkRemoteFiles(transport, rootPath) {
 
 // src/config/validation.ts
 import { access as access3 } from "fs/promises";
+
+// src/config/post-upload-commands.ts
+function isPostUploadCommands(value) {
+  return Array.isArray(value) && value.every(
+    (command) => typeof command === "string" && command.trim().length > 0
+  );
+}
+function getPostUploadCommands(source) {
+  const commands = readPostUploadCommands(source);
+  if (commands === void 0) {
+    return void 0;
+  }
+  if (!isPostUploadCommands(commands)) {
+    throw new ValidationError(
+      "postUploadCommands must be an array of non-empty command strings."
+    );
+  }
+  return commands;
+}
+function readPostUploadCommands(source) {
+  if (typeof source !== "object" || source === null) {
+    return void 0;
+  }
+  return source.postUploadCommands;
+}
+function clearPostUploadCommands(source) {
+  source.postUploadCommands = void 0;
+}
+
+// src/config/validation.ts
 function validatePort(port) {
   if (port === void 0) {
     return;
@@ -557,6 +844,7 @@ async function validateUploadOptions(options) {
   }
   assertRemotePath(options.remotePath, "remotePath");
   validateTimeout(options.timeout);
+  getPostUploadCommands(options);
   await assertLocalPathExists(options.localPath);
   if (!options.dryRun) {
     await validateServerOptions(options);
@@ -571,6 +859,9 @@ async function validateDownloadOptions(options) {
   }
   assertRemotePath(options.remotePath, "remotePath");
   validateTimeout(options.timeout);
+  if (getPostUploadCommands(options)?.length) {
+    throw new ValidationError("Post-upload commands are not supported for downloads.");
+  }
   await assertDownloadDestination(options.localPath, options.createDirectories ?? true);
   if (!options.dryRun) {
     await validateServerOptions(options);
@@ -625,10 +916,13 @@ async function ensureLocalDirectory(localPath, createParents = false) {
 var ScpNextClientImpl = class {
   serverOptions;
   transport;
+  commandExecutor;
   connected = false;
+  commandExecutorConnected = false;
   constructor(serverOptions, dependencies = {}) {
     this.serverOptions = serverOptions;
     this.transport = dependencies.transport ?? new Ssh2SftpTransport();
+    this.commandExecutor = dependencies.commandExecutor ?? new SshCommandExecutor();
   }
   async connect() {
     await validateServerOptions(this.serverOptions);
@@ -643,10 +937,15 @@ var ScpNextClientImpl = class {
     };
     await validateUploadOptions(uploadOptions);
     if (options.dryRun) {
-      return;
+      return [];
     }
     await this.ensureConnected();
     await this.uploadWithTransport(uploadOptions);
+    const results = [];
+    for (const command of getPostUploadCommands(options) ?? []) {
+      results.push(await this.exec(command));
+    }
+    return results;
   }
   async download(remotePath, localPath, options = {}) {
     const downloadOptions = {
@@ -661,10 +960,57 @@ var ScpNextClientImpl = class {
     await this.ensureConnected();
     await this.downloadWithTransport(downloadOptions);
   }
+  async exec(command, options = {}) {
+    if (typeof command !== "string" || !command.trim()) {
+      throw new ValidationError("Remote command must not be empty.");
+    }
+    if (options.timeout !== void 0 && (!Number.isFinite(options.timeout) || options.timeout <= 0)) {
+      throw new ValidationError("Command timeout must be a positive number.");
+    }
+    if (options.maxBuffer !== void 0 && (!Number.isInteger(options.maxBuffer) || options.maxBuffer <= 0)) {
+      throw new ValidationError("Command maxBuffer must be a positive integer.");
+    }
+    if (options.failOnStderr !== void 0 && typeof options.failOnStderr !== "boolean") {
+      throw new ValidationError("Command failOnStderr must be a boolean.");
+    }
+    await this.ensureCommandExecutorConnected();
+    let result;
+    try {
+      result = await this.commandExecutor.exec(command, options);
+    } catch (error) {
+      if (error instanceof RemoteCommandError) {
+        throw new RemoteCommandError(error.message, {
+          exitCode: error.exitCode,
+          signal: error.signal,
+          stdout: redactKnownSensitiveValues(error.stdout, this.serverOptions),
+          stderr: redactKnownSensitiveValues(error.stderr, this.serverOptions)
+        });
+      }
+      throw error;
+    }
+    if (result.exitCode !== 0 || options.failOnStderr && result.stderr.length > 0) {
+      const reason = result.exitCode === null ? "Remote command ended without an exit code." : result.exitCode !== 0 ? `Remote command failed with exit code ${String(result.exitCode)}.` : "Remote command wrote to stderr.";
+      throw new RemoteCommandError(reason, {
+        exitCode: result.exitCode,
+        signal: result.signal,
+        stdout: redactKnownSensitiveValues(result.stdout, this.serverOptions),
+        stderr: redactKnownSensitiveValues(result.stderr, this.serverOptions)
+      });
+    }
+    return result;
+  }
   async close() {
-    if (this.connected) {
-      await this.transport.close();
-      this.connected = false;
+    const closures = [];
+    if (this.connected) closures.push(this.transport.close());
+    if (this.commandExecutorConnected) closures.push(this.commandExecutor.close());
+    const results = await Promise.allSettled(closures);
+    this.connected = false;
+    this.commandExecutorConnected = false;
+    const failure = results.find(
+      (result) => result.status === "rejected"
+    );
+    if (failure) {
+      throw failure.reason;
     }
   }
   async ensureConnected() {
@@ -672,6 +1018,13 @@ var ScpNextClientImpl = class {
       await this.connect();
     }
   }
+  async ensureCommandExecutorConnected() {
+    if (!this.commandExecutorConnected) {
+      await validateServerOptions(this.serverOptions);
+      await this.commandExecutor.connect(this.serverOptions);
+      this.commandExecutorConnected = true;
+    }
+  }
   async uploadWithTransport(options) {
     const localKind = await getLocalPathKind(options.localPath);
     const remotePath = normalizeRemotePath(options.remotePath);
@@ -957,11 +1310,18 @@ async function download(options) {
 // src/client/upload.ts
 async function upload(options) {
   const client = new ScpNextClientImpl(options);
+  let result;
   try {
-    await client.upload(options.localPath, options.remotePath, options);
-  } finally {
-    await client.close();
+    result = await client.upload(options.localPath, options.remotePath, options);
+  } catch (error) {
+    try {
+      await client.close();
+    } catch {
+    }
+    throw error;
   }
+  await client.close();
+  return result;
 }
 
 // src/cli/commands/download.ts
@@ -1043,7 +1403,8 @@ var transferSchema = z.object({
   overwrite: z.boolean().optional(),
   createDirectories: z.boolean().optional(),
   dryRun: z.boolean().optional(),
-  timeout: z.number().int().optional()
+  timeout: z.number().int().optional(),
+  postUploadCommands: z.array(z.string().refine((command) => command.trim().length > 0)).optional()
 });
 var jobSchema = transferSchema.extend({
   operation: z.enum(["upload", "download"]),
@@ -1115,6 +1476,7 @@ async function loadConfig(explicitPath, cwd = process.cwd()) {
 
 // src/config/resolve-config.ts
 import path6 from "path";
+import { assignDefined } from "mazey";
 
 // src/config/jobs.ts
 function selectJob(config, jobName) {
@@ -1149,17 +1511,6 @@ var DEFAULT_TRANSFER = {
   createDirectories: true,
   dryRun: false
 };
-function assignDefined(target, source) {
-  if (!source) {
-    return target;
-  }
-  for (const [key, value] of Object.entries(source)) {
-    if (value !== void 0) {
-      Object.assign(target, { [key]: value });
-    }
-  }
-  return target;
-}
 function rootServer(config) {
   const result = {};
   assignDefined(result, config.server);
@@ -1188,7 +1539,8 @@ function jobTransfer(job) {
     overwrite: job.overwrite,
     createDirectories: job.createDirectories,
     dryRun: job.dryRun,
-    timeout: job.timeout
+    timeout: job.timeout,
+    postUploadCommands: readPostUploadCommands(job)
   });
 }
 function resolveConfigRelatedPaths(resolved, operation, configDirectory) {
@@ -1240,15 +1592,14 @@ function resolveTransferConfig(input) {
     passphrase: env.passphrase,
     timeout: env.timeout
   });
-  assignDefined(resolved, {
-    source: input.source,
-    destination: input.destination
-  });
+  if (input.source !== void 0) resolved.source = input.source;
+  if (input.destination !== void 0) resolved.destination = input.destination;
   assignDefined(resolved, cli);
   if (selectedProfileName) {
     resolved.profile = selectedProfileName;
   }
   const pathResolved = resolveConfigRelatedPaths(resolved, operation, configDirectory);
+  getPostUploadCommands(pathResolved);
   if (input.source && operation === "upload") {
     pathResolved.source = resolveLocalPath(input.source, cwd);
   }
@@ -1257,6 +1608,10 @@ function resolveTransferConfig(input) {
   }
   if (operation === "download") {
     pathResolved.source = restoreMsysConvertedRemotePath(pathResolved.source);
+    if (getPostUploadCommands(job)?.length || getPostUploadCommands(cli)?.length) {
+      throw new ValidationError("Post-upload commands are not supported for downloads.");
+    }
+    clearPostUploadCommands(pathResolved);
   }
   if (input.destination && operation === "download") {
     pathResolved.destination = resolveLocalPath(input.destination, cwd);
@@ -1265,7 +1620,9 @@ function resolveTransferConfig(input) {
 }
 
 // src/cli/output.ts
+import { formatByteSize } from "mazey";
 function writeDryRun(output, config) {
+  const postUploadCommands = getPostUploadCommands(config) ?? [];
   const destination = config.operation === "upload" ? `${config.username ?? "user"}@${config.host ?? "host"}:${config.destination}` : config.destination;
   output.stdout.write(`Dry run: ${config.operation}
 `);
@@ -1277,6 +1634,33 @@ function writeDryRun(output, config) {
 `);
   output.stdout.write(`Overwrite: ${config.overwrite ? "yes" : "no"}
 `);
+  if (config.operation === "upload" && postUploadCommands.length > 0) {
+    output.stdout.write("\nPost-upload commands:\n");
+    postUploadCommands.forEach((command, index) => {
+      output.stdout.write(
+        `${index + 1}. ${redactKnownSensitiveValues(command, config)}
+`
+      );
+    });
+  }
+}
+function writeCommandResults(output, results, config) {
+  results.forEach((result, index) => {
+    output.stdout.write(`Remote command ${index + 1} completed successfully.
+`);
+    if (result.stdout) {
+      output.stdout.write(
+        redactKnownSensitiveValues(result.stdout, config)
+      );
+      if (!result.stdout.endsWith("\n")) output.stdout.write("\n");
+    }
+    if (result.stderr) {
+      output.stderr.write(
+        redactKnownSensitiveValues(result.stderr, config)
+      );
+      if (!result.stderr.endsWith("\n")) output.stderr.write("\n");
+    }
+  });
 }
 function createProgressReporter(output, quiet) {
   if (quiet || !output.stderr.isTTY) {
@@ -1298,8 +1682,8 @@ function createProgressReporter(output, quiet) {
     if (!isComplete && !percentageChanged && lastWriteAt !== 0 && now - lastWriteAt < minimumUpdateIntervalMs) {
       return;
     }
-    const total = progress.totalBytes ? formatBytes(progress.totalBytes) : "?";
-    const transferred = formatBytes(progress.transferredBytes);
+    const total = progress.totalBytes ? formatByteSize(progress.totalBytes) : "?";
+    const transferred = formatByteSize(progress.transferredBytes);
     const percentage2 = progress.percentage === void 0 ? "" : ` (${progress.percentage}%)`;
     const currentFile = progress.currentFile ? `: ${progress.currentFile}` : "";
     const line = `${progress.operation === "upload" ? "Uploading" : "Downloading"}${currentFile} ${transferred} / ${total}${percentage2}`;
@@ -1315,6 +1699,7 @@ function createProgressReporter(output, quiet) {
   };
 }
 function verbosePlan(output, config) {
+  const postUploadCommands = getPostUploadCommands(config);
   output.stderr.write(
     `${JSON.stringify(
       redactSensitiveValues({
@@ -1327,7 +1712,10 @@ function verbosePlan(output, config) {
         recursive: config.recursive,
         overwrite: config.overwrite,
         createDirectories: config.createDirectories,
-        dryRun: config.dryRun
+        dryRun: config.dryRun,
+        postUploadCommands: postUploadCommands?.map(
+          (_command, index) => `command-${index + 1}`
+        )
       }),
       null,
       2
@@ -1335,22 +1723,9 @@ function verbosePlan(output, config) {
 `
   );
 }
-function formatBytes(bytes) {
-  if (bytes < 1024) {
-    return `${bytes} B`;
-  }
-  const units = ["KB", "MB", "GB", "TB"];
-  let value = bytes / 1024;
-  let unitIndex = 0;
-  while (value >= 1024 && unitIndex < units.length - 1) {
-    value /= 1024;
-    unitIndex += 1;
-  }
-  return `${value.toFixed(1)} ${units[unitIndex]}`;
-}
 
 // src/cli/commands/shared.ts
-function addTransferOptions(command) {
+function addTransferOptions(command, options = {}) {
   command.option("--host <host>", "SSH server host");
   command.addOption(new Option("--port <port>", "SSH server port").argParser(parseInteger2));
   command.option("--username <username>", "SSH username");
@@ -1365,9 +1740,20 @@ function addTransferOptions(command) {
   command.option("--create-directories", "Create missing destination directories");
   command.option("--no-create-directories", "Do not create missing destination directories");
   command.option("--dry-run", "Resolve and validate without connecting or transferring");
-  command.addOption(new Option("--timeout <milliseconds>", "Connection/operation timeout").argParser(parseInteger2));
+  command.addOption(
+    new Option("--timeout <milliseconds>", "SSH connection ready timeout").argParser(
+      parseInteger2
+    )
+  );
   command.option("--verbose", "Print verbose diagnostic output");
   command.option("--quiet", "Disable progress and non-error output");
+  if (options.postUploadCommand) {
+    command.option(
+      "--post-upload-command <command>",
+      "Run a remote command after a successful upload (repeatable)",
+      collectValues
+    );
+  }
   return command;
 }
 function parseInteger2(value) {
@@ -1377,6 +1763,9 @@ function parseInteger2(value) {
   }
   return parsed;
 }
+function collectValues(value, previous) {
+  return [...previous ?? [], value];
+}
 function toCliOptions(options) {
   return {
     host: options.host,
@@ -1391,10 +1780,16 @@ function toCliOptions(options) {
     overwrite: options.overwrite,
     createDirectories: options.createDirectories,
     dryRun: options.dryRun,
-    timeout: options.timeout
+    timeout: options.timeout,
+    postUploadCommands: options.postUploadCommand
   };
 }
 async function resolveForCli(input) {
+  if (input.options.postUploadCommand?.some((command) => !command.trim())) {
+    throw new ValidationError(
+      "Each --post-upload-command value must be a non-empty command."
+    );
+  }
   const loaded = await loadConfig(input.options.config, input.cwd);
   return resolveTransferConfig({
     operation: input.operation,
@@ -1426,7 +1821,10 @@ async function executeResolvedTransfer(config, handlers, output, commandOptions)
       remotePath: config.destination
     };
     if (onProgress) uploadOptions.onProgress = onProgress;
-    await handlers.upload(uploadOptions);
+    const results = await handlers.upload(uploadOptions);
+    if (!commandOptions.quiet) {
+      writeCommandResults(output, results, config);
+    }
     return;
   }
   const downloadOptions = {
@@ -1470,7 +1868,7 @@ function createRunCommand(handlers, output, cwd) {
       await executeResolvedTransfer(resolved, handlers, output, options);
     }
   );
-  addTransferOptions(command);
+  addTransferOptions(command, { postUploadCommand: true });
   return command;
 }
 
@@ -1488,7 +1886,7 @@ function createUploadCommand(handlers, output, cwd) {
     });
     await executeResolvedTransfer(resolved, handlers, output, options);
   });
-  addTransferOptions(command);
+  addTransferOptions(command, { postUploadCommand: true });
   return command;
 }
 
@@ -1537,6 +1935,16 @@ async function runCli(options = {}) {
       return error.exitCode || 1;
     }
     const verbose = (options.argv ?? process.argv).includes("--verbose");
+    if (error instanceof RemoteCommandError) {
+      if (error.stdout) {
+        output.stdout.write(redactKnownSensitiveValues(error.stdout, {}));
+        if (!error.stdout.endsWith("\n")) output.stdout.write("\n");
+      }
+      if (error.stderr) {
+        output.stderr.write(redactKnownSensitiveValues(error.stderr, {}));
+        if (!error.stderr.endsWith("\n")) output.stderr.write("\n");
+      }
+    }
     if (error instanceof ScpNextError) {
       output.stderr.write(`Error: ${formatErrorMessage(error.message)}
 `);