typescript-virtual-container 1.3.4 → 1.4.1

package/dist/SSHMimic/index.js

@@ -19,6 +19,9 @@ import { loadOrCreateHostKey } from "./hostKey";
  * - Non-interactive exec sessions
  */
 const perf = createPerfLogger("SshMimic");
+// ── Dev-mode logger ───────────────────────────────────────────────────────────
+const DEV = !!process.env.DEV_MODE;
+const devLog = DEV ? console.log.bind(console) : () => { };
 class SshMimic extends EventEmitter {
     port;
     server;
@@ -114,7 +117,6 @@ class SshMimic extends EventEmitter {
                 // ── Password auth ──────────────────────────────────────
                 if (ctx.method === "password") {
                     if (!shell.users.hasPassword(candidateUser)) {
-                        console.log(`User ${candidateUser} has no password set, allowing login without verification`);
                         authUser = candidateUser;
                         sessionId = shell.users.registerSession(authUser, remoteAddress).id;
                         this.recordSuccess(remoteAddress);
@@ -217,7 +219,7 @@ class SshMimic extends EventEmitter {
         return new Promise((resolve, reject) => {
             this.server?.once("error", (err) => reject(err));
             this.server?.listen(this.port, "0.0.0.0", () => {
-                console.log(`SSH Mimic listening on port ${this.port}`);
+                devLog(`SSH Mimic listening on port ${this.port}`);
                 this.emit("start", { port: this.port });
                 resolve(this.port);
             });
@@ -230,7 +232,7 @@ class SshMimic extends EventEmitter {
         perf.mark("stop");
         if (this.server) {
             this.server.close(() => {
-                console.log("SSH Mimic stopped");
+                devLog("SSH Mimic stopped");
                 this.emit("stop");
             });
         }

package/dist/SSHMimic/sftp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sftp.d.ts","sourceRoot":"","sources":["../../src/SSHMimic/sftp.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAI3C,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AA4HhE,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC3B;AAED,qBAAa,SAAU,SAAQ,YAAY;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,OAAO,CAAiC;gBAEpC,EACX,IAAI,EACJ,QAA0B,EAC1B,KAAK,EACL,GAAG,EACH,KAAK,GACL,EAAE,gBAAgB;IAwBnB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,QAAQ;IAIH,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAwK9B,IAAI,IAAI,IAAI;IAUnB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,kBAAkB;CA6a1B"}
+{"version":3,"file":"sftp.d.ts","sourceRoot":"","sources":["../../src/SSHMimic/sftp.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAI3C,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAmIhE,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC3B;AAED,qBAAa,SAAU,SAAQ,YAAY;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,OAAO,CAAiC;gBAEpC,EACX,IAAI,EACJ,QAA0B,EAC1B,KAAK,EACL,GAAG,EACH,KAAK,GACL,EAAE,gBAAgB;IAwBnB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,QAAQ;IAIH,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAwK9B,IAAI,IAAI,IAAI;IAUnB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,kBAAkB;CA6a1B"}

package/dist/SSHMimic/sftp.js

@@ -5,6 +5,11 @@ import { Server as SshServer } from "ssh2";
 import { createPerfLogger } from "../utils/perfLogger";
 import { VirtualShell } from "../VirtualShell";
 import { loadOrCreateHostKey } from "./hostKey";
+// ── Dev-mode logger — silent in production ────────────────────────────────────
+const DEV = !!process.env.DEV_MODE;
+const devLog = DEV ? console.log.bind(console) : () => { };
+const devWarn = DEV ? console.warn.bind(console) : () => { };
+const devErr = DEV ? console.error.bind(console) : () => { };
 const SFTP_STATUS_CODE = {
     OK: 0,
     EOF: 1,
@@ -89,7 +94,7 @@ export class SftpMimic extends EventEmitter {
             this.emit("client:connect");
             // Add error handling for the client
             client.on("error", (error) => {
-                console.error(`[SFTP] Client error:`, error);
+                devErr(`[SFTP] Client error:`, error);
             });
             const acceptSession = (username) => {
                 authUser = username;
@@ -108,7 +113,7 @@ export class SftpMimic extends EventEmitter {
             client.on("authentication", (ctx) => {
                 const candidateUser = ctx.username || "root";
                 remoteAddress = ctx.ip ?? remoteAddress;
-                console.log(`[SFTP] Auth attempt: user=${candidateUser}, method=${ctx.method}, ip=${remoteAddress}`);
+                devLog(`[SFTP] Auth attempt: user=${candidateUser}, method=${ctx.method}, ip=${remoteAddress}`);
                 if (ctx.method === "password") {
                     // If no password is set for the user, allow login without verification
                     if (!this.getUsers().hasPassword(candidateUser)) {
@@ -170,7 +175,7 @@ export class SftpMimic extends EventEmitter {
                     const session = accept();
                     // Add error handling for the session
                     session.on("error", (error) => {
-                        console.error(`[SFTP] Session error for user=${authUser}:`, error);
+                        devErr(`[SFTP] Session error for user=${authUser}:`, error);
                     });
                     session.on("sftp", (acceptSftp) => {
                         const sftp = acceptSftp();
@@ -186,7 +191,7 @@ export class SftpMimic extends EventEmitter {
                 const actualPort = address && typeof address === "object" && "port" in address
                     ? address.port
                     : this.port;
-                console.log(`SFTP Mimic listening on port ${actualPort}`);
+                devLog(`SFTP Mimic listening on port ${actualPort}`);
                 this.emit("start", { port: actualPort });
                 resolve(actualPort);
             });
@@ -196,7 +201,7 @@ export class SftpMimic extends EventEmitter {
         perf.mark("stop");
         if (this.server) {
             this.server.close(() => {
-                console.log("SFTP Mimic stopped");
+                devLog("SFTP Mimic stopped");
                 this.emit("stop");
             });
         }
@@ -273,7 +278,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(filename, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -318,7 +323,7 @@ export class SftpMimic extends EventEmitter {
                 sftp.handle(reqid, handle);
             }
             catch (error) {
-                console.error("SFTP OPEN error:", error);
+                devErr("SFTP OPEN error:", error);
                 sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
             }
         });
@@ -377,7 +382,7 @@ export class SftpMimic extends EventEmitter {
                     void getVfs().flushMirror();
                 }
                 catch (error) {
-                    console.error("SFTP CLOSE write error:", error);
+                    devErr("SFTP CLOSE write error:", error);
                     sftp.status(reqid, SFTP_STATUS_CODE.FAILURE);
                     this.closeHandle(handle);
                     return;
@@ -390,7 +395,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -434,7 +439,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -450,7 +455,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -482,7 +487,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -500,7 +505,7 @@ export class SftpMimic extends EventEmitter {
             const normalized = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(normalized, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${normalized}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${normalized}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -523,7 +528,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -540,7 +545,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -557,7 +562,7 @@ export class SftpMimic extends EventEmitter {
             const targetPath = this.resolveRequestPath(requestPath, authUser);
             // Security: Confine to home directory
             if (!this.isPathWithinHome(targetPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, path=${targetPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -576,7 +581,7 @@ export class SftpMimic extends EventEmitter {
             // Security: Confine both source and destination to home directory
             if (!this.isPathWithinHome(fromPath, authUser) ||
                 !this.isPathWithinHome(toPath, authUser)) {
-                console.warn(`[SFTP] Path traversal attempt blocked: user=${authUser}, from=${fromPath}, to=${toPath}`);
+                devWarn(`[SFTP] Path traversal attempt blocked: user=${authUser}, from=${fromPath}, to=${toPath}`);
                 sftp.status(reqid, SFTP_STATUS_CODE.PERMISSION_DENIED);
                 return;
             }
@@ -596,18 +601,18 @@ export class SftpMimic extends EventEmitter {
             sftp.status(reqid, SFTP_STATUS_CODE.OP_UNSUPPORTED);
         });
         sftp.on("error", (error) => {
-            console.error(`[SFTP] Stream error for user=${authUser}:`, error);
+            devErr(`[SFTP] Stream error for user=${authUser}:`, error);
         });
         sftp.on("close", () => {
-            console.log(`[SFTP] Stream closed for user=${authUser}`);
+            devLog(`[SFTP] Stream closed for user=${authUser}`);
             this.handles.clear();
         });
         sftp.on("end", () => {
-            console.log(`[SFTP] end event for user=${authUser}`);
+            devLog(`[SFTP] end event for user=${authUser}`);
             this.handles.clear();
         });
         sftp.on("END", () => {
-            console.log(`[SFTP] END event for user=${authUser}`);
+            devLog(`[SFTP] END event for user=${authUser}`);
             this.handles.clear();
         });
     }

package/dist/VirtualPackageManager/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/VirtualPackageManager/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IACjC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACxE,iEAAiE;IACjE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAqeD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,qBAAqB;IAWhC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAXvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IACjE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAEzD;;;OAGG;gBAEe,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,kBAAkB;IAG3C;;;;;OAKG;IACI,IAAI,IAAI,IAAI;IAyBnB,uDAAuD;IACvD,OAAO,CAAC,OAAO;IAsBf,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,GAAG;IASX,OAAO,CAAC,MAAM;IAed;;;;;OAKG;IACI,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAMlE;;;;OAIG;IACI,aAAa,IAAI,iBAAiB,EAAE;IAI3C;;;;OAIG;IACI,aAAa,IAAI,gBAAgB,EAAE;IAM1C;;;;OAIG;IACI,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;OAIG;IACI,cAAc,IAAI,MAAM;IAI/B;;;;;;;;;;;;;OAaG;IACI,OAAO,CACb,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC5B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAiHvC;;;;;;;;;;;;OAYG;IACI,MAAM,CACZ,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC7C;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IA4DvC;;;;;;OAMG;IACI,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAUhD;;;;;;OAMG;IACI,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAiBxC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/VirtualPackageManager/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IACjC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACxE,iEAAiE;IACjE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAigBD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,qBAAqB;IAWhC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAXvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IACjE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAEzD;;;OAGG;gBAEe,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,kBAAkB;IAG3C;;;;;OAKG;IACI,IAAI,IAAI,IAAI;IAyBnB,uDAAuD;IACvD,OAAO,CAAC,OAAO;IAsBf,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,GAAG;IASX,OAAO,CAAC,MAAM;IAed;;;;;OAKG;IACI,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAMlE;;;;OAIG;IACI,aAAa,IAAI,iBAAiB,EAAE;IAI3C;;;;OAIG;IACI,aAAa,IAAI,gBAAgB,EAAE;IAM1C;;;;OAIG;IACI,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;OAIG;IACI,cAAc,IAAI,MAAM;IAI/B;;;;;;;;;;;;;OAaG;IACI,OAAO,CACb,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC5B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAiHvC;;;;;;;;;;;;OAYG;IACI,MAAM,CACZ,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC7C;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IA4DvC;;;;;;OAMG;IACI,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAUhD;;;;;;OAMG;IACI,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAiBxC"}

package/dist/VirtualPackageManager/index.js

@@ -472,7 +472,35 @@ const PACKAGE_REGISTRY = [
                 mode: 0o755,
             },
         ],
-    },
+    }, {
+        name: "gzip",
+        version: "1.12-2",
+        section: "utils",
+        description: "GNU compression utility",
+        shortDesc: "compression utility",
+        installedSizeKb: 128,
+        files: [
+            {
+                path: "/usr/bin/gzip",
+                content: "#!/bin/sh\necho 'gzip: virtual stub'\n",
+                mode: 0o755,
+            },
+        ]
+    }, {
+        name: "neofetch",
+        version: "7.1.0-1",
+        section: "utils",
+        description: "A command-line system information tool written in bash 3.2+",
+        shortDesc: "command-line system information tool",
+        installedSizeKb: 256,
+        files: [
+            {
+                path: "/usr/bin/neofetch",
+                content: "#!/bin/sh\necho 'neofetch: virtual stub'\n",
+                mode: 0o755,
+            },
+        ],
+    }
 ];
 /**
  * Pure-TypeScript APT/dpkg package manager backed by a built-in registry.

package/dist/VirtualShell/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/VirtualShell/shell.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,CAAC;AAMvD,OAAO,EAGN,KAAK,YAAY,EAEjB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAmBpD,wBAAgB,UAAU,CACzB,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,aAAa,oBAAY,EACzB,YAAY,EAAE,YAAY,YAAyB,EACnD,KAAK,EAAE,YAAY,GACjB,IAAI,CAsmBN"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/VirtualShell/shell.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,CAAC;AAMvD,OAAO,EAGN,KAAK,YAAY,EAEjB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAwBpD,wBAAgB,UAAU,CACzB,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,aAAa,oBAAY,EACzB,YAAY,EAAE,YAAY,YAAyB,EACnD,KAAK,EAAE,YAAY,GACjB,IAAI,CA+nBN"}

package/dist/VirtualShell/shell.js

@@ -72,7 +72,9 @@ export function startShell(properties, stream, authUser, hostname, sessionId, re
         }
         if (!challenge.commandLine) {
             authUser = challenge.targetUser;
-            cwd = `/home/${authUser}`;
+            if (challenge.loginShell) {
+                cwd = `/home/${authUser}`;
+            }
             shell.users.updateSession(sessionId, authUser, remoteAddress);
             stream.write("\r\n");
             renderLine();
@@ -300,9 +302,29 @@ export function startShell(properties, stream, authUser, hostname, sessionId, re
                     continue;
                 }
                 if (ch === "\r" || ch === "\n") {
-                    const password = pendingSudo.buffer;
+                    const typed = pendingSudo.buffer;
                     pendingSudo.buffer = "";
-                    const valid = shell.users.verifyPassword(pendingSudo.username, password);
+                    // ── Generic onPassword handler (passwd / confirm modes) ────
+                    if (pendingSudo.onPassword) {
+                        const { result, nextPrompt } = await pendingSudo.onPassword(typed, shell);
+                        stream.write("\r\n");
+                        if (result !== null) {
+                            pendingSudo = null;
+                            if (result.stdout)
+                                stream.write(result.stdout.replace(/\n/g, "\r\n"));
+                            if (result.stderr)
+                                stream.write(result.stderr.replace(/\n/g, "\r\n"));
+                            renderLine();
+                        }
+                        else {
+                            if (nextPrompt)
+                                pendingSudo.prompt = nextPrompt;
+                            stream.write(pendingSudo.prompt);
+                        }
+                        return;
+                    }
+                    // ── Default sudo mode — verify current user's password ─────
+                    const valid = shell.users.verifyPassword(pendingSudo.username, typed);
                     await finishSudoPrompt(valid);
                     return;
                 }

package/dist/VirtualShell/shellParser.d.ts

@@ -5,15 +5,8 @@ import type { Pipeline, Script } from "../types/pipeline";
  * by |).
  */
 export declare function parseScript(rawInput: string): Script;
-/** Legacy compat: parse a single pipeline (no &&/||/;) */
+/** Parse a single pipeline string (no &&/||/;) into a `Pipeline` object. */
 export declare function parseShellPipeline(rawInput: string): Pipeline;
-/**
- * Expand ~ and $VAR / ${VAR} / ${VAR:-default} / $(cmd placeholder) in a
- * token, given the current env vars and home path.
- * Command substitution $(…) is NOT executed here — it's left as a marker so
- * the executor can handle it.
- */
-export declare function expandToken(token: string, env: Record<string, string>, authUser: string, lastExitCode?: number): string;
 /**
  * Expand glob patterns (*, ?, [abc]) against a list of entries.
  * Returns the original pattern if no match.

package/dist/VirtualShell/shellParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shellParser.d.ts","sourceRoot":"","sources":["../../src/VirtualShell/shellParser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EAER,MAAM,EAGN,MAAM,mBAAmB,CAAC;AAI3B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED,0DAA0D;AAC1D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAS7D;AAID;;;;;GAKG;AACH,wBAAgB,WAAW,CAC1B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAChB,YAAY,SAAI,GACd,MAAM,CA8BR;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAKvE"}
+{"version":3,"file":"shellParser.d.ts","sourceRoot":"","sources":["../../src/VirtualShell/shellParser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EAER,MAAM,EAGN,MAAM,mBAAmB,CAAC;AAK3B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAS7D;AAID;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAKvE"}

package/dist/VirtualShell/shellParser.js

@@ -1,3 +1,4 @@
+import { tokenizeCommand } from "../utils/tokenize";
 // ── Public API ───────────────────────────────────────────────────────────────
 /**
  * Parse a shell input line into a Script (sequence of statements connected
@@ -16,7 +17,7 @@ export function parseScript(rawInput) {
         return { statements: [], isValid: false, error: e.message };
     }
 }
-/** Legacy compat: parse a single pipeline (no &&/||/;) */
+/** Parse a single pipeline string (no &&/||/;) into a `Pipeline` object. */
 export function parseShellPipeline(rawInput) {
     const trimmed = rawInput.trim();
     if (!trimmed)
@@ -30,30 +31,6 @@ export function parseShellPipeline(rawInput) {
     }
 }
 // ── Variable & tilde expansion ────────────────────────────────────────────────
-/**
- * Expand ~ and $VAR / ${VAR} / ${VAR:-default} / $(cmd placeholder) in a
- * token, given the current env vars and home path.
- * Command substitution $(…) is NOT executed here — it's left as a marker so
- * the executor can handle it.
- */
-export function expandToken(token, env, authUser, lastExitCode = 0) {
-    // tilde expansion
-    token = token.replace(/^~(\/|$)/, `/home/${authUser}$1`);
-    // $? special var
-    token = token.replace(/\$\?/g, String(lastExitCode));
-    // $$ PID (mock)
-    token = token.replace(/\$\$/g, "1");
-    // $# argc (0 for interactive)
-    token = token.replace(/\$#/g, "0");
-    // ${VAR:-default} and ${VAR:+value}
-    token = token.replace(/\$\{([^}:]+):-([^}]*)\}/g, (_, name, def) => env[name] ?? def);
-    token = token.replace(/\$\{([^}:]+):\+([^}]*)\}/g, (_, name, val) => env[name] ? val : "");
-    // ${VAR}
-    token = token.replace(/\$\{([^}]+)\}/g, (_, name) => env[name] ?? "");
-    // $VAR (greedy: match longest valid identifier)
-    token = token.replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (_, name) => env[name] ?? "");
-    return token;
-}
 /**
  * Expand glob patterns (*, ?, [abc]) against a list of entries.
  * Returns the original pattern if no match.
@@ -258,59 +235,3 @@ function parseCommandWithRedirections(token) {
     const name = (cmdParts[0] ?? "").toLowerCase();
     return { name, args: cmdParts.slice(1), inputFile, outputFile, appendOutput };
 }
-function tokenizeCommand(input) {
-    const tokens = [];
-    let current = "";
-    let inQ = false;
-    let qChar = "";
-    let i = 0;
-    while (i < input.length) {
-        const ch = input[i];
-        const next = input[i + 1];
-        if ((ch === '"' || ch === "'") && !inQ) {
-            inQ = true;
-            qChar = ch;
-            i++;
-            continue;
-        }
-        if (inQ && ch === qChar) {
-            inQ = false;
-            qChar = "";
-            i++;
-            continue;
-        }
-        if (inQ) {
-            current += ch;
-            i++;
-            continue;
-        }
-        if (ch === " ") {
-            if (current) {
-                tokens.push(current);
-                current = "";
-            }
-            i++;
-            continue;
-        }
-        if ((ch === ">" || ch === "<") && !inQ) {
-            if (current) {
-                tokens.push(current);
-                current = "";
-            }
-            if (ch === ">" && next === ">") {
-                tokens.push(">>");
-                i += 2;
-            }
-            else {
-                tokens.push(ch);
-                i++;
-            }
-            continue;
-        }
-        current += ch;
-        i++;
-    }
-    if (current)
-        tokens.push(current);
-    return tokens;
-}

package/dist/VirtualUserManager/index.d.ts

@@ -218,7 +218,13 @@ export declare class VirtualUserManager extends EventEmitter {
      * @param password Plaintext password string.
      * @returns Hex-encoded hash string.
      */
-    hashPassword(password: string): string;
+    /**
+     * Hash a password with an optional salt.
+     * When salt is provided (verify path), the same salt is used for a
+     * deterministic hash. When omitted (create path), an empty salt is used
+     * for backward compat — callers should pass the stored salt on verify.
+     */
+    hashPassword(password: string, salt?: string): string;
     private validateUsername;
     private validatePassword;
     private readonly authorizedKeys;

package/dist/VirtualUserManager/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/VirtualUserManager/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAE1D,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IACjC,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACpC,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CAClB;AAYD;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAqBlD,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGpB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAvBrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAwC;IAC3E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwC;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2C;IAC1E,OAAO,CAAC,OAAO,CAAK;IAEpB;;;;;;OAMG;gBAEe,GAAG,EAAE,iBAAiB,EAGtB,mBAAmB,GAAE,OAAc;IAMrD;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsCxC;;;;;OAKG;IACU,aAAa,CACzB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAehB;;;;OAIG;IACU,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxD;;;;;OAKG;IACI,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD;;;;;OAKG;IACI,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAU9C;;;;;;;;OAQG;IACI,sBAAsB,CAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,IAAI;IAoCP;;;;;;OAMG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAUlE;;;;;OAKG;IACU,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvE;;;;;OAKG;IACI,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAMvD;;;;;;OAMG;IACU,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa3E;;;;;OAKG;IACU,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxD;;;;;OAKG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAK1C;;;;;OAKG;IACU,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWvD;;;;;OAKG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1D;;;;;;;;;OASG;IACI,eAAe,CACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACnB,oBAAoB;IAkBvB;;;;;;OAMG;IACI,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAiBpE;;;;;;;;;;OAUG;IACI,aAAa,CACnB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACnB,IAAI;IAkBP;;;;;;OAMG;IACI,kBAAkB,IAAI,oBAAoB,EAAE;IAOnD;;;;OAIG;IACI,SAAS,IAAI,MAAM,EAAE;IAI5B,OAAO,CAAC,WAAW;IA4BnB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,iBAAiB;YAwBX,OAAO;IA0CrB,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,YAAY;IAkBpB;;;;;;;OAOG;IACI,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAS7C;;;;;;;;OAQG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAQ7C,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG3B;IAEJ;;;;;;OAMG;IACI,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ3E;;;;OAIG;IACI,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKnD;;;;;OAKG;IACI,iBAAiB,CACvB,QAAQ,EAAE,MAAM,GACd,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAGxC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/VirtualUserManager/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAE1D,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IACjC,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACpC,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CAClB;AAYD;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAqBlD,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGpB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAvBrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAwC;IAC3E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwC;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2C;IAC1E,OAAO,CAAC,OAAO,CAAK;IAEpB;;;;;;OAMG;gBAEe,GAAG,EAAE,iBAAiB,EAGtB,mBAAmB,GAAE,OAAc;IAMrD;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsCxC;;;;;OAKG;IACU,aAAa,CACzB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAehB;;;;OAIG;IACU,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxD;;;;;OAKG;IACI,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD;;;;;OAKG;IACI,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAU9C;;;;;;;;OAQG;IACI,sBAAsB,CAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,IAAI;IAoCP;;;;;;OAMG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAsBlE;;;;;OAKG;IACU,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvE;;;;;OAKG;IACI,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAMvD;;;;;;OAMG;IACU,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa3E;;;;;OAKG;IACU,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxD;;;;;OAKG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAK1C;;;;;OAKG;IACU,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWvD;;;;;OAKG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1D;;;;;;;;;OASG;IACI,eAAe,CACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACnB,oBAAoB;IAkBvB;;;;;;OAMG;IACI,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAiBpE;;;;;;;;;;OAUG;IACI,aAAa,CACnB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACnB,IAAI;IAkBP;;;;;;OAMG;IACI,kBAAkB,IAAI,oBAAoB,EAAE;IAOnD;;;;OAIG;IACI,SAAS,IAAI,MAAM,EAAE;IAI5B,OAAO,CAAC,WAAW;IA4BnB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,iBAAiB;YAwBX,OAAO;IA0CrB,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,YAAY;IAoBpB;;;;;;;OAOG;IACI,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAU7C;;;;;;;;OAQG;IACH;;;;;OAKG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM;IAWxD,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG3B;IAEJ;;;;;;OAMG;IACI,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ3E;;;;OAIG;IACI,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKnD;;;;;OAKG;IACI,iBAAiB,CACvB,QAAQ,EAAE,MAAM,GACd,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAGxC"}

package/dist/VirtualUserManager/index.js

@@ -1,4 +1,4 @@
-import { createHash, randomBytes, randomUUID, scryptSync } from "node:crypto";
+import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
 import { EventEmitter } from "node:events";
 import * as path from "node:path";
 import { createPerfLogger } from "../utils/perfLogger";
@@ -66,11 +66,14 @@ export class VirtualUserManager extends EventEmitter {
         // 	this.sudoers.add(currentUser);
         // 	changed = true;
         // }
-        const homePath = `/home/root`;
-        if (!this.vfs.exists(homePath)) {
-            this.vfs.mkdir(homePath, 0o755);
-            this.vfs.writeFile(`${homePath}/README.txt`, `Welcome to the virtual environment, root`);
-        }
+        // const homePath = `/home/root`;
+        // if (!this.vfs.exists(homePath)) {
+        // 	this.vfs.mkdir(homePath, 0o755);
+        // 	this.vfs.writeFile(
+        // 		`${homePath}/README.txt`,
+        // 		`Welcome to the virtual environment, root`,
+        // 	);
+        // }
         if (changed) {
             await this.persist();
         }
@@ -177,9 +180,23 @@ export class VirtualUserManager extends EventEmitter {
         perf.mark("verifyPassword");
         const record = this.users.get(username);
         if (!record) {
+            // Perform a dummy hash to avoid timing leakage on unknown usernames
+            this.hashPassword(password, "");
             return false;
         }
-        return this.hashPassword(password) === record.passwordHash;
+        const computed = this.hashPassword(password, record.salt);
+        const expected = record.passwordHash;
+        // timingSafeEqual prevents timing-based password oracle attacks
+        try {
+            const a = Buffer.from(computed, "hex");
+            const b = Buffer.from(expected, "hex");
+            if (a.length !== b.length)
+                return false;
+            return timingSafeEqual(a, b);
+        }
+        catch {
+            return computed === expected;
+        }
     }
     /**
      * Creates user, home directory, and sudo access entry.
@@ -478,7 +495,8 @@ export class VirtualUserManager extends EventEmitter {
         return true;
     }
     createRecord(username, password) {
-        const cacheKey = `${username}:${password}`;
+        // Cache key is a hash of the inputs — never store plaintext password in memory
+        const cacheKey = createHash("sha256").update(username).update(":").update(password).digest("hex");
         const cached = VirtualUserManager.recordCache.get(cacheKey);
         if (cached) {
             return cached;
@@ -487,7 +505,8 @@ export class VirtualUserManager extends EventEmitter {
         const record = {
             username,
             salt,
-            passwordHash: this.hashPassword(password),
+            // Hash uses the generated salt — verifyPassword must use record.salt
+            passwordHash: this.hashPassword(password, salt),
         };
         VirtualUserManager.recordCache.set(cacheKey, record);
         return record;
@@ -502,11 +521,14 @@ export class VirtualUserManager extends EventEmitter {
      */
     hasPassword(username) {
         perf.mark("hasPassword");
-        if (this.getPasswordHash(username) === this.hashPassword("")) {
-            return false;
-        }
         const record = this.users.get(username);
-        return !!record && !!record.passwordHash;
+        if (!record)
+            return false;
+        // Empty password hash computed with the record's own salt
+        const emptyHash = this.hashPassword("", record.salt);
+        if (record.passwordHash === emptyHash)
+            return false;
+        return !!record.passwordHash;
     }
     /**
      * Hashes a plaintext password using scrypt (or SHA-256 in fast-hash mode).
@@ -517,11 +539,20 @@ export class VirtualUserManager extends EventEmitter {
      * @param password Plaintext password string.
      * @returns Hex-encoded hash string.
      */
-    hashPassword(password) {
+    /**
+     * Hash a password with an optional salt.
+     * When salt is provided (verify path), the same salt is used for a
+     * deterministic hash. When omitted (create path), an empty salt is used
+     * for backward compat — callers should pass the stored salt on verify.
+     */
+    hashPassword(password, salt = "") {
         if (VirtualUserManager.fastPasswordHash) {
-            return createHash("sha256").update(`${password}`).digest("hex");
+            return createHash("sha256")
+                .update(salt)
+                .update(password)
+                .digest("hex");
         }
-        return scryptSync(password, "", 32).toString("hex");
+        return scryptSync(password, salt || "", 32).toString("hex");
     }
     validateUsername(username) {
         if (!username || username.trim() === "") {

package/dist/commands/adduser.d.ts

@@ -1,9 +1,15 @@
 import type { ShellModule } from "../types/commands";
 /**
- * Add a new user to the virtual user database.
- * @category users
- * @params ["<username> <password>"]
- * @returns ShellModule
+ * Add a new user interactively.
+ *
+ * Usage: `adduser <username>`
+ *
+ * Prompts for:
+ *   New password: ****
+ *   Retype new password: ****
+ *
+ * Mirrors the real `adduser` behaviour — password is never passed on the
+ * command line. Root-only.
  */
 export declare const adduserCommand: ShellModule;
 //# sourceMappingURL=adduser.d.ts.map

package/dist/commands/adduser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adduser.d.ts","sourceRoot":"","sources":["../../src/commands/adduser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,WAqB5B,CAAC"}
+{"version":3,"file":"adduser.d.ts","sourceRoot":"","sources":["../../src/commands/adduser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,EAAE,WAuF5B,CAAC"}