scp-next 1.0.4 → 1.0.6

package/dist/index.cjs

@@ -88,6 +88,12 @@ function redactSensitiveValues(value) {
   }
   return value;
 }
+function formatErrorMessage(error) {
+  if (error instanceof Error) {
+    return String(redactSensitiveValues(error.message));
+  }
+  return String(redactSensitiveValues(error));
+}
 
 // src/errors/index.ts
 var ScpNextError = class extends Error {
@@ -144,7 +150,7 @@ function toScpNextError(error) {
   if (lowerMessage.includes("authentication") || lowerMessage.includes("permission denied")) {
     return new AuthenticationError("SSH authentication failed.", { cause: error });
   }
-  if (lowerMessage.includes("host verification") || lowerMessage.includes("host key")) {
+  if (lowerMessage.includes("host verification") || lowerMessage.includes("host key") || lowerMessage.includes("fingerprint") || lowerMessage.includes("host") && lowerMessage.includes("denied")) {
     return new HostVerificationError("SSH host verification failed.", { cause: error });
   }
   if (lowerMessage.includes("timed out") || lowerMessage.includes("connection") || lowerMessage.includes("econn")) {
@@ -218,8 +224,39 @@ async function getLocalPathKind(inputPath) {
 function normalizeFingerprint(fingerprint) {
   return fingerprint.trim().replace(/^SHA256:/i, "").replace(/^sha256:/i, "").replace(/=+$/g, "");
 }
+function isHexFingerprint(fingerprint) {
+  return /^[0-9a-f]+$/i.test(fingerprint);
+}
+function fingerprintCandidates(fingerprint) {
+  const normalized = normalizeFingerprint(fingerprint);
+  const candidates = /* @__PURE__ */ new Set([normalized]);
+  if (isHexFingerprint(normalized)) {
+    candidates.add(normalized.toLowerCase());
+  } else {
+    try {
+      candidates.add(Buffer.from(normalized, "base64").toString("hex"));
+    } catch {
+    }
+  }
+  return [...candidates];
+}
 function isFingerprintMatch(actual, expected) {
-  return normalizeFingerprint(actual) === normalizeFingerprint(expected);
+  const normalizedActual = normalizeFingerprint(actual);
+  const normalizedExpected = normalizeFingerprint(expected);
+  if (normalizedActual === normalizedExpected) {
+    return true;
+  }
+  return isHexFingerprint(normalizedActual) && isHexFingerprint(normalizedExpected) && normalizedActual.toLowerCase() === normalizedExpected.toLowerCase();
+}
+function hostVerificationHint(host) {
+  return [
+    "",
+    "Typical fix:",
+    `  ssh ${host}`,
+    "",
+    "If you trust the host key, accept it and retry the scp-next command.",
+    "Alternatively configure hostFingerprint or knownHostsFile explicitly."
+  ].join("\n");
 }
 async function resolveAllowedFingerprints(options) {
   const fingerprints = /* @__PURE__ */ new Set();
@@ -228,7 +265,9 @@ async function resolveAllowedFingerprints(options) {
     throw new HostVerificationError("A host is required for SSH host verification.");
   }
   if (options.hostFingerprint) {
-    fingerprints.add(normalizeFingerprint(options.hostFingerprint));
+    for (const fingerprint of fingerprintCandidates(options.hostFingerprint)) {
+      fingerprints.add(fingerprint);
+    }
   }
   try {
     await (0, import_promises2.access)(expandHome(knownHostsFile));
@@ -239,11 +278,15 @@ async function resolveAllowedFingerprints(options) {
         continue;
       }
       const [hosts, algorithm, key] = trimmed.split(/\s+/);
-      if (!hosts || !algorithm || !key || !hosts.split(",").includes(options.host)) {
+      const hostPatterns = hosts?.split(",") ?? [];
+      const portHost = options.port ? `[${options.host}]:${options.port}` : void 0;
+      const matchesHost = hostPatterns.includes(options.host) || Boolean(portHost && hostPatterns.includes(portHost));
+      if (!hosts || !algorithm || !key || !matchesHost) {
         continue;
       }
-      const fingerprint = (0, import_node_crypto.createHash)("sha256").update(Buffer.from(key, "base64")).digest("base64").replace(/=+$/g, "");
-      fingerprints.add(fingerprint);
+      const keyBuffer = Buffer.from(key, "base64");
+      fingerprints.add((0, import_node_crypto.createHash)("sha256").update(keyBuffer).digest("base64").replace(/=+$/g, ""));
+      fingerprints.add((0, import_node_crypto.createHash)("sha256").update(keyBuffer).digest("hex"));
     }
   } catch (error) {
     if (options.knownHostsFile || !options.hostFingerprint) {
@@ -255,7 +298,9 @@ async function resolveAllowedFingerprints(options) {
   }
   if (fingerprints.size === 0) {
     throw new HostVerificationError(
-      "SSH host verification failed before connecting: no matching host fingerprint was configured."
+      `SSH host verification failed before connecting: no matching host fingerprint was configured.${hostVerificationHint(
+        options.host
+      )}`
     );
   }
   return fingerprints;
@@ -282,7 +327,11 @@ function toRemoteFileInfo(info) {
 var Ssh2SftpTransport = class {
   client;
   constructor(name = "scp-next") {
-    this.client = new import_ssh2_sftp_client.default(name);
+    this.client = new import_ssh2_sftp_client.default(name, {
+      error: () => void 0,
+      end: () => void 0,
+      close: () => void 0
+    });
   }
   async connect(options) {
     const allowedFingerprints = await resolveAllowedFingerprints(options);
@@ -312,15 +361,24 @@ var Ssh2SftpTransport = class {
     } catch (error) {
       const converted = toScpNextError(error);
       if (converted instanceof HostVerificationError) {
-        throw converted;
+        throw new HostVerificationError(
+          `SSH host verification failed during connection: ${formatErrorMessage(
+            error
+          )}.${hostVerificationTroubleshooting(options.host)}`,
+          { cause: error, context: connectionContext(options) }
+        );
+      }
+      if (isLikelyHostVerificationFailure(error)) {
+        throw new HostVerificationError(
+          `SSH host verification failed during connection.${hostVerificationTroubleshooting(
+            options.host
+          )}`,
+          { cause: error, context: connectionContext(options) }
+        );
       }
-      throw new ConnectionError("Unable to connect to SSH server.", {
+      throw new ConnectionError(`Unable to connect to SSH server: ${formatErrorMessage(error)}`, {
         cause: error,
-        context: {
-          host: options.host,
-          port: options.port,
-          username: options.username
-        }
+        context: connectionContext(options)
       });
     }
   }
@@ -341,7 +399,7 @@ var Ssh2SftpTransport = class {
     try {
       await this.client.fastPut(localPath, remotePath, this.transferOptions(onStep));
     } catch (error) {
-      throw new TransferError(`Upload failed for ${localPath}.`, {
+      throw new TransferError(`Upload failed for ${localPath}: ${formatErrorMessage(error)}`, {
         cause: error,
         context: { localPath, remotePath }
       });
@@ -351,7 +409,7 @@ var Ssh2SftpTransport = class {
     try {
       await this.client.fastGet(remotePath, localPath, this.transferOptions(onStep));
     } catch (error) {
-      throw new TransferError(`Download failed for ${remotePath}.`, {
+      throw new TransferError(`Download failed for ${remotePath}: ${formatErrorMessage(error)}`, {
         cause: error,
         context: { remotePath, localPath }
       });
@@ -368,6 +426,31 @@ var Ssh2SftpTransport = class {
     };
   }
 };
+function connectionContext(options) {
+  return {
+    host: options.host,
+    port: options.port,
+    username: options.username
+  };
+}
+function isLikelyHostVerificationFailure(error) {
+  const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+  return message.includes("host") && (message.includes("verif") || message.includes("fingerprint") || message.includes("host key") || message.includes("key mismatch") || message.includes("denied"));
+}
+function hostVerificationTroubleshooting(host) {
+  const displayHost = host ?? "<host>";
+  return [
+    "",
+    "",
+    "Typical fix:",
+    `  ssh ${displayHost}`,
+    "",
+    "If plain ssh works but scp-next fails, check that the host entry is available in",
+    "`~/.ssh/known_hosts` for the same host and port used by scp-next. For non-default ports,",
+    "OpenSSH usually stores entries as `[host]:port`.",
+    "You can also configure hostFingerprint or knownHostsFile explicitly."
+  ].join("\n");
+}
 
 // src/client/walk.ts
 var import_promises4 = require("fs/promises");
@@ -538,6 +621,22 @@ function percentage(transferredBytes, totalBytes) {
 function mergeOptions(serverOptions, transferOptions) {
   return { ...serverOptions, ...transferOptions ?? {} };
 }
+function hasTrailingPathSeparator(inputPath) {
+  return /[\\/]$/.test(inputPath);
+}
+function trimmedRemoteDirectory(remotePath) {
+  return remotePath.replace(/\/+$/g, "") || "/";
+}
+function remoteBasename(remotePath) {
+  return import_node_path4.default.posix.basename(trimmedRemoteDirectory(remotePath));
+}
+async function isExistingLocalDirectory(localPath) {
+  try {
+    return (await (0, import_promises6.stat)(localPath)).isDirectory();
+  } catch {
+    return false;
+  }
+}
 var ScpNextClientImpl = class {
   serverOptions;
   transport;
@@ -595,10 +694,9 @@ var ScpNextClientImpl = class {
       throw new ValidationError("Uploading a directory requires recursive mode.");
     }
     if (localKind === "file") {
-      await this.ensureRemoteParent(remotePath, options.createDirectories);
-      await this.assertRemoteOverwrite(remotePath, options.overwrite);
+      const destinationFile = await this.resolveRemoteDestinationForLocalFile(options, remotePath);
       const totalBytes2 = void 0;
-      await this.transport.uploadFile(resolveLocalPath(options.localPath), remotePath, (step) => {
+      await this.transport.uploadFile(resolveLocalPath(options.localPath), destinationFile, (step) => {
         options.onProgress?.({
           operation: "upload",
           source: options.localPath,
@@ -615,22 +713,15 @@ var ScpNextClientImpl = class {
     const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
     let completedBytes = 0;
     let completedFiles = 0;
-    const destinationExists = await this.transport.exists(remotePath);
-    if (destinationExists && destinationExists !== "d") {
-      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
-        context: { remotePath }
-      });
-    }
-    if (!destinationExists) {
-      if (!options.createDirectories) {
-        throw new TransferError(`Remote destination directory does not exist: ${remotePath}`, {
-          context: { remotePath }
-        });
-      }
-      await this.transport.mkdir(remotePath, true);
-    }
+    const destinationRoot = await this.resolveRemoteDestinationForLocalDirectory(
+      options,
+      remotePath
+    );
     for (const file of files) {
-      const destinationFile = remoteJoin(remotePath, file.relativePath.split(import_node_path4.default.sep).join("/"));
+      const destinationFile = remoteJoin(
+        destinationRoot,
+        file.relativePath.split(import_node_path4.default.sep).join("/")
+      );
       await this.ensureRemoteParent(destinationFile, true);
       await this.assertRemoteOverwrite(destinationFile, options.overwrite);
       await this.transport.uploadFile(file.absolutePath, destinationFile, (step) => {
@@ -651,6 +742,68 @@ var ScpNextClientImpl = class {
       completedFiles += 1;
     }
   }
+  async resolveRemoteDestinationForLocalFile(options, remotePath) {
+    const remoteKind = await this.transport.exists(remotePath);
+    const isDirectoryLikeDestination = remoteKind === "d" || remotePath.endsWith("/");
+    if (!isDirectoryLikeDestination) {
+      await this.ensureRemoteParent(remotePath, options.createDirectories);
+      await this.assertRemoteOverwrite(remotePath, options.overwrite);
+      return remotePath;
+    }
+    if (remoteKind && remoteKind !== "d") {
+      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
+        context: { remotePath }
+      });
+    }
+    const remoteDirectory = remotePath.replace(/\/+$/g, "") || "/";
+    if (!remoteKind) {
+      if (!options.createDirectories) {
+        throw new TransferError(`Remote destination directory does not exist: ${remoteDirectory}`, {
+          context: { remotePath }
+        });
+      }
+      await this.transport.mkdir(remoteDirectory, true);
+    }
+    const destinationFile = remoteJoin(
+      remoteDirectory,
+      import_node_path4.default.basename(resolveLocalPath(options.localPath))
+    );
+    await this.assertRemoteOverwrite(destinationFile, options.overwrite);
+    return destinationFile;
+  }
+  async resolveRemoteDestinationForLocalDirectory(options, remotePath) {
+    const remoteKind = await this.transport.exists(remotePath);
+    const isDirectoryLikeDestination = remoteKind === "d" || remotePath.endsWith("/");
+    const localDirectoryName = import_node_path4.default.basename(resolveLocalPath(options.localPath));
+    if (remoteKind && remoteKind !== "d") {
+      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
+        context: { remotePath }
+      });
+    }
+    if (isDirectoryLikeDestination) {
+      const remoteDirectory = trimmedRemoteDirectory(remotePath);
+      if (!remoteKind) {
+        if (!options.createDirectories) {
+          throw new TransferError(`Remote destination directory does not exist: ${remoteDirectory}`, {
+            context: { remotePath }
+          });
+        }
+        await this.transport.mkdir(remoteDirectory, true);
+      }
+      const destinationRoot = remoteJoin(remoteDirectory, localDirectoryName);
+      await this.ensureRemoteDirectory(destinationRoot);
+      return destinationRoot;
+    }
+    if (!remoteKind) {
+      if (!options.createDirectories) {
+        throw new TransferError(`Remote destination directory does not exist: ${remotePath}`, {
+          context: { remotePath }
+        });
+      }
+      await this.transport.mkdir(remotePath, true);
+    }
+    return remotePath;
+  }
   async downloadWithTransport(options) {
     const remotePath = normalizeRemotePath(options.remotePath);
     const remoteKind = await this.transport.exists(remotePath);
@@ -669,7 +822,7 @@ var ScpNextClientImpl = class {
     await this.downloadSingleFile(options, remotePath);
   }
   async downloadSingleFile(options, remotePath) {
-    const localPath = resolveLocalPath(options.localPath);
+    const localPath = await this.resolveLocalDestinationForRemoteFile(options, remotePath);
     await this.assertLocalOverwrite(localPath, options.overwrite);
     if (options.createDirectories) {
       await (0, import_promises6.mkdir)(import_node_path4.default.dirname(localPath), { recursive: true });
@@ -688,7 +841,7 @@ var ScpNextClientImpl = class {
   }
   async downloadDirectory(options) {
     const remotePath = normalizeRemotePath(options.remotePath);
-    const localRoot = resolveLocalPath(options.localPath);
+    const localRoot = await this.resolveLocalDestinationForRemoteDirectory(options, remotePath);
     const files = await walkRemoteFiles(this.transport, remotePath);
     const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
     let completedBytes = 0;
@@ -716,6 +869,38 @@ var ScpNextClientImpl = class {
       completedFiles += 1;
     }
   }
+  async resolveLocalDestinationForRemoteFile(options, remotePath) {
+    const localDestination = resolveLocalPath(options.localPath);
+    const isDirectoryLikeDestination = hasTrailingPathSeparator(options.localPath) || await isExistingLocalDirectory(localDestination);
+    if (!isDirectoryLikeDestination) {
+      return localDestination;
+    }
+    if (!await isExistingLocalDirectory(localDestination)) {
+      if (!options.createDirectories) {
+        throw new TransferError(`Local destination directory does not exist: ${localDestination}`, {
+          context: { localPath: options.localPath }
+        });
+      }
+      await (0, import_promises6.mkdir)(localDestination, { recursive: true });
+    }
+    return import_node_path4.default.join(localDestination, remoteBasename(remotePath));
+  }
+  async resolveLocalDestinationForRemoteDirectory(options, remotePath) {
+    const localDestination = resolveLocalPath(options.localPath);
+    const isDirectoryLikeDestination = hasTrailingPathSeparator(options.localPath) || await isExistingLocalDirectory(localDestination);
+    if (!isDirectoryLikeDestination) {
+      return localDestination;
+    }
+    if (!await isExistingLocalDirectory(localDestination)) {
+      if (!options.createDirectories) {
+        throw new TransferError(`Local destination directory does not exist: ${localDestination}`, {
+          context: { localPath: options.localPath }
+        });
+      }
+      await (0, import_promises6.mkdir)(localDestination, { recursive: true });
+    }
+    return import_node_path4.default.join(localDestination, remoteBasename(remotePath));
+  }
   async ensureRemoteParent(remotePath, createDirectories = false) {
     const parent = remoteDirname(remotePath);
     if (parent === "." || parent === "/") {
@@ -732,6 +917,17 @@ var ScpNextClientImpl = class {
       });
     }
   }
+  async ensureRemoteDirectory(remotePath) {
+    const exists = await this.transport.exists(remotePath);
+    if (exists && exists !== "d") {
+      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
+        context: { remotePath }
+      });
+    }
+    if (!exists) {
+      await this.transport.mkdir(remotePath, true);
+    }
+  }
   async assertRemoteOverwrite(remotePath, overwrite = false) {
     if (overwrite) {
       return;