scp-next 1.0.4 → 1.0.5

package/dist/cli/index.js

@@ -109,7 +109,7 @@ function toScpNextError(error) {
   if (lowerMessage.includes("authentication") || lowerMessage.includes("permission denied")) {
     return new AuthenticationError("SSH authentication failed.", { cause: error });
   }
-  if (lowerMessage.includes("host verification") || lowerMessage.includes("host key")) {
+  if (lowerMessage.includes("host verification") || lowerMessage.includes("host key") || lowerMessage.includes("fingerprint") || lowerMessage.includes("host") && lowerMessage.includes("denied")) {
     return new HostVerificationError("SSH host verification failed.", { cause: error });
   }
   if (lowerMessage.includes("timed out") || lowerMessage.includes("connection") || lowerMessage.includes("econn")) {
@@ -183,8 +183,39 @@ async function getLocalPathKind(inputPath) {
 function normalizeFingerprint(fingerprint) {
   return fingerprint.trim().replace(/^SHA256:/i, "").replace(/^sha256:/i, "").replace(/=+$/g, "");
 }
+function isHexFingerprint(fingerprint) {
+  return /^[0-9a-f]+$/i.test(fingerprint);
+}
+function fingerprintCandidates(fingerprint) {
+  const normalized = normalizeFingerprint(fingerprint);
+  const candidates = /* @__PURE__ */ new Set([normalized]);
+  if (isHexFingerprint(normalized)) {
+    candidates.add(normalized.toLowerCase());
+  } else {
+    try {
+      candidates.add(Buffer.from(normalized, "base64").toString("hex"));
+    } catch {
+    }
+  }
+  return [...candidates];
+}
 function isFingerprintMatch(actual, expected) {
-  return normalizeFingerprint(actual) === normalizeFingerprint(expected);
+  const normalizedActual = normalizeFingerprint(actual);
+  const normalizedExpected = normalizeFingerprint(expected);
+  if (normalizedActual === normalizedExpected) {
+    return true;
+  }
+  return isHexFingerprint(normalizedActual) && isHexFingerprint(normalizedExpected) && normalizedActual.toLowerCase() === normalizedExpected.toLowerCase();
+}
+function hostVerificationHint(host) {
+  return [
+    "",
+    "Typical fix:",
+    `  ssh ${host}`,
+    "",
+    "If you trust the host key, accept it and retry the scp-next command.",
+    "Alternatively configure hostFingerprint or knownHostsFile explicitly."
+  ].join("\n");
 }
 async function resolveAllowedFingerprints(options) {
   const fingerprints = /* @__PURE__ */ new Set();
@@ -193,7 +224,9 @@ async function resolveAllowedFingerprints(options) {
     throw new HostVerificationError("A host is required for SSH host verification.");
   }
   if (options.hostFingerprint) {
-    fingerprints.add(normalizeFingerprint(options.hostFingerprint));
+    for (const fingerprint of fingerprintCandidates(options.hostFingerprint)) {
+      fingerprints.add(fingerprint);
+    }
   }
   try {
     await access2(expandHome(knownHostsFile));
@@ -204,11 +237,15 @@ async function resolveAllowedFingerprints(options) {
         continue;
       }
       const [hosts, algorithm, key] = trimmed.split(/\s+/);
-      if (!hosts || !algorithm || !key || !hosts.split(",").includes(options.host)) {
+      const hostPatterns = hosts?.split(",") ?? [];
+      const portHost = options.port ? `[${options.host}]:${options.port}` : void 0;
+      const matchesHost = hostPatterns.includes(options.host) || Boolean(portHost && hostPatterns.includes(portHost));
+      if (!hosts || !algorithm || !key || !matchesHost) {
         continue;
       }
-      const fingerprint = createHash("sha256").update(Buffer.from(key, "base64")).digest("base64").replace(/=+$/g, "");
-      fingerprints.add(fingerprint);
+      const keyBuffer = Buffer.from(key, "base64");
+      fingerprints.add(createHash("sha256").update(keyBuffer).digest("base64").replace(/=+$/g, ""));
+      fingerprints.add(createHash("sha256").update(keyBuffer).digest("hex"));
     }
   } catch (error) {
     if (options.knownHostsFile || !options.hostFingerprint) {
@@ -220,7 +257,9 @@ async function resolveAllowedFingerprints(options) {
   }
   if (fingerprints.size === 0) {
     throw new HostVerificationError(
-      "SSH host verification failed before connecting: no matching host fingerprint was configured."
+      `SSH host verification failed before connecting: no matching host fingerprint was configured.${hostVerificationHint(
+        options.host
+      )}`
     );
   }
   return fingerprints;
@@ -247,7 +286,11 @@ function toRemoteFileInfo(info) {
 var Ssh2SftpTransport = class {
   client;
   constructor(name = "scp-next") {
-    this.client = new SftpClient(name);
+    this.client = new SftpClient(name, {
+      error: () => void 0,
+      end: () => void 0,
+      close: () => void 0
+    });
   }
   async connect(options) {
     const allowedFingerprints = await resolveAllowedFingerprints(options);
@@ -277,15 +320,24 @@ var Ssh2SftpTransport = class {
     } catch (error) {
       const converted = toScpNextError(error);
       if (converted instanceof HostVerificationError) {
-        throw converted;
+        throw new HostVerificationError(
+          `SSH host verification failed during connection: ${formatErrorMessage(
+            error
+          )}.${hostVerificationTroubleshooting(options.host)}`,
+          { cause: error, context: connectionContext(options) }
+        );
+      }
+      if (isLikelyHostVerificationFailure(error)) {
+        throw new HostVerificationError(
+          `SSH host verification failed during connection.${hostVerificationTroubleshooting(
+            options.host
+          )}`,
+          { cause: error, context: connectionContext(options) }
+        );
       }
-      throw new ConnectionError("Unable to connect to SSH server.", {
+      throw new ConnectionError(`Unable to connect to SSH server: ${formatErrorMessage(error)}`, {
         cause: error,
-        context: {
-          host: options.host,
-          port: options.port,
-          username: options.username
-        }
+        context: connectionContext(options)
       });
     }
   }
@@ -306,7 +358,7 @@ var Ssh2SftpTransport = class {
     try {
       await this.client.fastPut(localPath, remotePath, this.transferOptions(onStep));
     } catch (error) {
-      throw new TransferError(`Upload failed for ${localPath}.`, {
+      throw new TransferError(`Upload failed for ${localPath}: ${formatErrorMessage(error)}`, {
         cause: error,
         context: { localPath, remotePath }
       });
@@ -316,7 +368,7 @@ var Ssh2SftpTransport = class {
     try {
       await this.client.fastGet(remotePath, localPath, this.transferOptions(onStep));
     } catch (error) {
-      throw new TransferError(`Download failed for ${remotePath}.`, {
+      throw new TransferError(`Download failed for ${remotePath}: ${formatErrorMessage(error)}`, {
         cause: error,
         context: { remotePath, localPath }
       });
@@ -333,6 +385,31 @@ var Ssh2SftpTransport = class {
     };
   }
 };
+function connectionContext(options) {
+  return {
+    host: options.host,
+    port: options.port,
+    username: options.username
+  };
+}
+function isLikelyHostVerificationFailure(error) {
+  const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+  return message.includes("host") && (message.includes("verif") || message.includes("fingerprint") || message.includes("host key") || message.includes("key mismatch") || message.includes("denied"));
+}
+function hostVerificationTroubleshooting(host) {
+  const displayHost = host ?? "<host>";
+  return [
+    "",
+    "",
+    "Typical fix:",
+    `  ssh ${displayHost}`,
+    "",
+    "If plain ssh works but scp-next fails, check that the host entry is available in",
+    "`~/.ssh/known_hosts` for the same host and port used by scp-next. For non-default ports,",
+    "OpenSSH usually stores entries as `[host]:port`.",
+    "You can also configure hostFingerprint or knownHostsFile explicitly."
+  ].join("\n");
+}
 
 // src/client/walk.ts
 import { readdir, stat as stat2 } from "fs/promises";
@@ -560,10 +637,9 @@ var ScpNextClientImpl = class {
       throw new ValidationError("Uploading a directory requires recursive mode.");
     }
     if (localKind === "file") {
-      await this.ensureRemoteParent(remotePath, options.createDirectories);
-      await this.assertRemoteOverwrite(remotePath, options.overwrite);
+      const destinationFile = await this.resolveRemoteDestinationForLocalFile(options, remotePath);
       const totalBytes2 = void 0;
-      await this.transport.uploadFile(resolveLocalPath(options.localPath), remotePath, (step) => {
+      await this.transport.uploadFile(resolveLocalPath(options.localPath), destinationFile, (step) => {
         options.onProgress?.({
           operation: "upload",
           source: options.localPath,
@@ -616,6 +692,35 @@ var ScpNextClientImpl = class {
       completedFiles += 1;
     }
   }
+  async resolveRemoteDestinationForLocalFile(options, remotePath) {
+    const remoteKind = await this.transport.exists(remotePath);
+    const isDirectoryLikeDestination = remoteKind === "d" || remotePath.endsWith("/");
+    if (!isDirectoryLikeDestination) {
+      await this.ensureRemoteParent(remotePath, options.createDirectories);
+      await this.assertRemoteOverwrite(remotePath, options.overwrite);
+      return remotePath;
+    }
+    if (remoteKind && remoteKind !== "d") {
+      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
+        context: { remotePath }
+      });
+    }
+    const remoteDirectory = remotePath.replace(/\/+$/g, "") || "/";
+    if (!remoteKind) {
+      if (!options.createDirectories) {
+        throw new TransferError(`Remote destination directory does not exist: ${remoteDirectory}`, {
+          context: { remotePath }
+        });
+      }
+      await this.transport.mkdir(remoteDirectory, true);
+    }
+    const destinationFile = remoteJoin(
+      remoteDirectory,
+      path4.basename(resolveLocalPath(options.localPath))
+    );
+    await this.assertRemoteOverwrite(destinationFile, options.overwrite);
+    return destinationFile;
+  }
   async downloadWithTransport(options) {
     const remotePath = normalizeRemotePath(options.remotePath);
     const remoteKind = await this.transport.exists(remotePath);