sshscript 3.1.5__tar.gz → 4.0.2__tar.gz

sshscript-4.0.2/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,109 @@
+name: Bug report
+description: Report a reproducible problem in a supported SSHScript release
+title: "[Bug] "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for helping improve SSHScript. Do not include credentials,
+        private host details, or production output. Report suspected
+        vulnerabilities through GitHub private vulnerability reporting instead.
+
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight
+      options:
+        - label: I reproduced this with the latest SSHScript 3.1.x release.
+          required: true
+        - label: I searched existing issues and discussions for this problem.
+          required: true
+        - label: This report contains no password, key, token, or private infrastructure detail.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true
+
+  - type: input
+    id: sshscript-version
+    attributes:
+      label: SSHScript version
+      description: Paste the output of `sshscript --version`.
+      placeholder: "3.1.4"
+    validations:
+      required: true
+
+  - type: input
+    id: python-paramiko
+    attributes:
+      label: Python and Paramiko versions
+      placeholder: "Python 3.12.7; Paramiko 4.0.0"
+    validations:
+      required: true
+
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and SSH server
+      description: Include the SSH server implementation/version when relevant.
+      placeholder: "Ubuntu 24.04; OpenSSH_9.6p1"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: interface
+    attributes:
+      label: Interface
+      options:
+        - Python module API
+        - Dollar syntax (.spy)
+        - Both
+        - Command-line interface
+    validations:
+      required: true
+
+  - type: dropdown
+    id: operation
+    attributes:
+      label: Operation
+      options:
+        - Local command
+        - Direct SSH command
+        - Nested SSH command
+        - Persistent or interactive console
+        - sudo or su
+        - Upload or download
+        - Import or source transformation
+        - Installation or packaging
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Use a disposable host or credential-free example and include exact steps.
+      render: python
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include the exit status and a redacted traceback or error message.
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional context
+      description: Add sanitized details that are necessary to understand the issue.

sshscript-4.0.2/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://iapyeh.github.io/sshscript/v3a/
+    about: Read installation, tutorials, how-to guides, and reference material.
+  - name: Usage questions and design discussion
+    url: https://github.com/iapyeh/sshscript/discussions
+    about: Ask for help or discuss an idea before opening an issue.
+  - name: Report a security vulnerability privately
+    url: https://github.com/iapyeh/sshscript/security/advisories/new
+    about: Do not disclose a suspected vulnerability in a public issue.

sshscript-4.0.2/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,57 @@
+name: Feature request
+description: Propose a focused, testable improvement to SSHScript
+title: "[Feature] "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Explain the user problem before the proposed API. For usage questions
+        and early design discussion, use GitHub Discussions.
+
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched existing issues and discussions for this request.
+          required: true
+        - label: This request contains no credentials or private infrastructure detail.
+          required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or use case
+      description: What workflow is difficult today, and who is affected?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Show a small API or `.spy` example when that makes the behavior clearer.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Describe existing SSHScript or Python approaches you tried.
+    validations:
+      required: true
+
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility and security impact
+      description: Note effects on the module API, dollar syntax, platforms, logging, credentials, or host-key handling.
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: List observable behavior that tests and documentation could verify.
+    validations:
+      required: true

sshscript-4.0.2/.github/pull_request_template.md

@@ -0,0 +1,32 @@
+## Summary
+
+<!-- What changes, and what user or maintainer problem does it solve? -->
+
+## Behavior and compatibility
+
+<!-- Describe public API, dollar syntax, CLI, exception, security, or migration impact. -->
+
+## Validation
+
+<!-- List exact commands and results. At minimum, run the credential-free gate. -->
+
+- [ ] `python3 tools/run_checks.py`
+- [ ] `python3 tools/check_release.py --output /tmp/sshscript-candidate-UNIQUE`
+- [ ] A regression test covers the change, or the reason it cannot is explained.
+- [ ] Relevant behavior was checked with and without `python -O`.
+
+## Documentation and release notes
+
+- [ ] README or v3 documentation is updated for user-visible behavior.
+- [ ] `CHANGELOG.md` is updated, or this change has no user-visible effect.
+- [ ] Module API and dollar-syntax descriptions remain aligned.
+
+## Security and hygiene
+
+- [ ] No credential, private key, token, internal hostname, private path, or production output is included.
+- [ ] Host-key, command-injection, privilege, timeout, logging, and cleanup effects were considered.
+- [ ] New dependencies or permissions are justified in the summary.
+
+## Related issue
+
+<!-- Use "Closes #123" when appropriate. -->

{sshscript-3.1.5 → sshscript-4.0.2}/.github/workflows/ci.yml

@@ -19,9 +19,11 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install test and build dependencies
-        run: python -m pip install 'paramiko>=2.11,<5' 'packaging>=21' build twine
+        run: python -m pip install 'paramiko>=2.11,<5' 'packaging>=21' build twine 'mypy==2.3.1'
       - name: Test source
         run: python tools/run_checks.py
+      - name: Check public type contracts
+        run: python tools/check_public_types.py
       - name: Build and verify installed release
         run: python tools/check_release.py --output '${{ runner.temp }}/verified-artifacts'
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -29,14 +31,40 @@ jobs:
           name: sshscript-${{ matrix.os }}-${{ matrix.python-version }}
           path: ${{ runner.temp }}/verified-artifacts/
 
+  baseline-examples:
+    name: Published 3.1.5 examples
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.11'
+      - run: python -m pip install 'sshscript==3.1.5'
+      - run: python -I tools/check_baseline_examples.py
+
   openssh-integration:
-    name: OpenSSH integration (Python ${{ matrix.python-version }})
+    name: OpenSSH integration (Python ${{ matrix.python-version }}, ${{ matrix.dependency-label }})
     runs-on: ubuntu-latest
     timeout-minutes: 25
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.11', '3.14']
+        include:
+          - python-version: '3.11'
+            paramiko: 'paramiko==2.11.0'
+            dependency-label: minimum
+          - python-version: '3.14'
+            paramiko: 'paramiko==2.11.0'
+            dependency-label: minimum-new-python
+          - python-version: '3.11'
+            paramiko: 'paramiko>=3,<4'
+            dependency-label: 3.x
+          - python-version: '3.14'
+            paramiko: 'paramiko>=4,<5'
+            dependency-label: 4.x
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -45,24 +73,37 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install test and build dependencies
-        run: python -m pip install 'paramiko>=2.11,<5' 'packaging>=21' build twine
+        run: python -m pip install "${{ matrix.paramiko }}" 'packaging>=21' build twine
+      - name: Test source with selected Paramiko
+        run: python tools/run_checks.py
       - name: Build and verify wheel
         run: python tools/check_release.py --output "$RUNNER_TEMP/verified-artifacts"
       - name: Install verified wheel
-        run: python -m pip install --force-reinstall "$RUNNER_TEMP"/verified-artifacts/*.whl
+        run: python -m pip install --force-reinstall "$RUNNER_TEMP"/verified-artifacts/*.whl "${{ matrix.paramiko }}"
       - name: Provision loopback OpenSSH server
         run: bash tools/setup_openssh_ci.sh "$GITHUB_ENV"
       - name: Test installed wheel against OpenSSH
         run: |
           mkdir -p "$RUNNER_TEMP/openssh-tests"
-          cp src/sshscript/unittest/test_openssh_integration.py "$RUNNER_TEMP/openssh-tests/"
+          TEST_SOURCE=unittest/test_openssh_integration.py
+          if [[ -d src/sshscript ]]; then TEST_SOURCE=src/sshscript/unittest/test_openssh_integration.py; fi
+          cp "$TEST_SOURCE" "$RUNNER_TEMP/openssh-tests/"
           cd "$RUNNER_TEMP/openssh-tests"
           python -I test_openssh_integration.py -v
+      - name: Verify native su/sudo contracts on local and SSH backends
+        run: python tools/run_native_auth_ci.py --wheel "$RUNNER_TEMP"/verified-artifacts/*.whl --report "$RUNNER_TEMP/native-auth-report.json"
+      - name: Save native authentication evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: native-auth-python-${{ matrix.python-version }}-${{ matrix.dependency-label }}
+          if-no-files-found: warn
+          path: ${{ runner.temp }}/native-auth-report.json
       - name: Upload OpenSSH server log
         if: ${{ failure() && env.SSHSCRIPT_OPENSSH_LOG != '' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: openssh-log-python-${{ matrix.python-version }}
+          name: openssh-log-python-${{ matrix.python-version }}-${{ matrix.dependency-label }}
           if-no-files-found: warn
           path: ${{ env.SSHSCRIPT_OPENSSH_LOG }}
       - name: Remove disposable OpenSSH state
@@ -83,3 +124,21 @@ jobs:
           if [[ -n "${SSHSCRIPT_OPENSSH_ROOT:-}" && "$SSHSCRIPT_OPENSSH_ROOT" == "$RUNNER_TEMP"/sshscript-openssh.* ]]; then
             sudo rm -rf -- "$SSHSCRIPT_OPENSSH_ROOT"
           fi
+
+  # Preserve the required-check names configured on the protected release branch.
+  # Both gates require every supported Python/Paramiko integration leg to pass.
+  openssh-required-311:
+    name: OpenSSH integration (Python 3.11)
+    needs: openssh-integration
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: test "${{ needs.openssh-integration.result }}" = success
+
+  openssh-required-314:
+    name: OpenSSH integration (Python 3.14)
+    needs: openssh-integration
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: test "${{ needs.openssh-integration.result }}" = success

{sshscript-3.1.5 → sshscript-4.0.2}/.github/workflows/release.yml

@@ -39,6 +39,8 @@ jobs:
         run: |
           PACKAGE_VERSION=$(python -c "import runpy; print(runpy.run_path('src/sshscript/_version.py')['__version__'])")
           test "$RELEASE_TAG" = "v$PACKAGE_VERSION"
+      - name: Reject development versions for production publication
+        run: python tools/version_policy.py --production
       - name: Stabilize build timestamps
         run: echo "SOURCE_DATE_EPOCH=$(git show -s --format=%ct HEAD)" >> "$GITHUB_ENV"
       - name: Run release gates and build verified artifacts
@@ -58,14 +60,26 @@ jobs:
           path: ${{ runner.temp }}/sshscript-release/
 
   openssh-integration:
-    name: Release OpenSSH integration (Python ${{ matrix.python-version }})
+    name: Release OpenSSH integration (Python ${{ matrix.python-version }}, ${{ matrix.dependency-label }})
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.11', '3.14']
+        include:
+          - python-version: '3.11'
+            paramiko: 'paramiko==2.11.0'
+            dependency-label: minimum
+          - python-version: '3.14'
+            paramiko: 'paramiko==2.11.0'
+            dependency-label: minimum-new-python
+          - python-version: '3.11'
+            paramiko: 'paramiko>=3,<4'
+            dependency-label: 3.x
+          - python-version: '3.14'
+            paramiko: 'paramiko>=4,<5'
+            dependency-label: 4.x
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -78,20 +92,31 @@ jobs:
           name: python-package-distributions
           path: dist
       - name: Install verified wheel
-        run: python -m pip install dist/*.whl
+        run: python -m pip install dist/*.whl "${{ matrix.paramiko }}"
       - name: Provision loopback OpenSSH server
         run: bash tools/setup_openssh_ci.sh "$GITHUB_ENV"
       - name: Test installed wheel against OpenSSH
         run: |
           mkdir -p "$RUNNER_TEMP/openssh-tests"
-          cp src/sshscript/unittest/test_openssh_integration.py "$RUNNER_TEMP/openssh-tests/"
+          TEST_SOURCE=unittest/test_openssh_integration.py
+          if [[ -d src/sshscript ]]; then TEST_SOURCE=src/sshscript/unittest/test_openssh_integration.py; fi
+          cp "$TEST_SOURCE" "$RUNNER_TEMP/openssh-tests/"
           cd "$RUNNER_TEMP/openssh-tests"
           python -I test_openssh_integration.py -v
+      - name: Verify native su/sudo contracts on local and SSH backends
+        run: python tools/run_native_auth_ci.py --wheel dist/*.whl --report "$RUNNER_TEMP/native-auth-report.json"
+      - name: Save native authentication evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: release-native-auth-python-${{ matrix.python-version }}-${{ matrix.dependency-label }}
+          if-no-files-found: warn
+          path: ${{ runner.temp }}/native-auth-report.json
       - name: Upload OpenSSH server log
         if: ${{ failure() && env.SSHSCRIPT_OPENSSH_LOG != '' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: release-openssh-log-python-${{ matrix.python-version }}
+          name: release-openssh-log-python-${{ matrix.python-version }}-${{ matrix.dependency-label }}
           if-no-files-found: warn
           path: ${{ env.SSHSCRIPT_OPENSSH_LOG }}
       - name: Remove disposable OpenSSH state

sshscript-4.0.2/.gitignore

@@ -0,0 +1,121 @@
+.DS_Store
+
+# Python bytecode and caches
+__pycache__/
+*.py[cod]
+*$py.class
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+
+# Environments
+.venv/
+venv/
+env/
+
+# Packaging output
+build/
+dist/
+*.egg-info/
+*.egg
+
+# Coverage and local tooling
+.coverage
+.coverage.*
+htmlcov/
+.tox/
+.nox/
+
+# Editors
+.idea/
+.vscode/
+*.swp
+*~
+
+# Local configuration and credentials
+/unittest-v3/hostsall.py
+.env
+.env.*
+*.pem
+*.key
+*secret*
+*credential*
+*password*
+
+# Private host settings and environment-specific tests (kept locally)
+/unittest-v3/A00commonc.py
+/unittest-v3/B00.spy
+/unittest-v3/B03nametest.py
+/unittest-v3/apnic_test.spy
+/unittest-v3/checkiterate.spy
+/unittest-v3/checkproc.spy
+/unittest-v3/checkpty.spy
+/unittest-v3/checktest.spy
+/unittest-v3/checktwodollars.spy
+/unittest-v3/checkupdownload.spy
+/unittest-v3/hosts4iapdev.py
+/unittest-v3/hosts4macpro.py
+/unittest-v3/hosts4rms4.py
+/unittest-v3/hosts4test.py
+/unittest-v3/log/A01onedollar.spy-1791280028.log
+/unittest-v3/log/A01onedollar.spy-1791280318.log
+/unittest-v3/log/A02twodollars.spy-1791280344.log
+/unittest-v3/log/B04withsession.spy-1791280368.log
+/unittest-v3/log/B04withsession.spy-1791288350.log
+/unittest-v3/nonenterpython.spy
+/unittest-v3/test.py
+/unittest-v3/test.spy
+/unittest-v3/usecase/iapdev.spy
+/unittest-v3/usecase/settings.py
+/unittest/README.language-tests.md
+/unittest/a.spy
+/unittest/a2.spy
+/unittest/advance.spy
+/unittest/basic.spy
+/unittest/basic_dollar.spy
+/unittest/language.spy
+
+# Legacy tests are private; public tests require explicit approval.
+/unittest-v3/
+/unittest/*
+!/unittest/README.console-authentication.md
+!/unittest/README.console-results.md
+!/unittest/README.dollar-syntax-tests.md
+!/unittest/README.module-tests.md
+!/unittest/check_package_asserts.py
+!/unittest/dollar_syntax.spy
+!/unittest/dollar_syntax_fixture.spy
+!/unittest/language_fixture.spy
+!/unittest/test_channelgeneric_expect.py
+!/unittest/test_check_file.py
+!/unittest/test_command_api.py
+!/unittest/test_command_job.py
+!/unittest/test_console_authentication.py
+!/unittest/test_native_console_authentication.py
+!/unittest/test_native_auth_runner.py
+!/unittest/test_console_results.py
+!/unittest/test_console_job.py
+!/unittest/test_dollar_command_escapes.py
+!/unittest/test_file_transfer.py
+!/unittest/test_logger_api.py
+!/unittest/test_logger_integration.py
+!/unittest/test_openssh_integration.py
+!/unittest/test_production_contract.py
+!/unittest/test_public_types.py
+!/unittest/test_python_version.py
+!/unittest/test_version_policy.py
+!/unittest/test_release_inputs.py
+!/unittest/test_recommended_examples.py
+!/unittest/test_session_close_reporting.py
+!/unittest/test_session_proxy_cleanup.py
+!/unittest/test_session_settings.py
+!/unittest/test_spy_source_mapping.py
+!/unittest/test_spy_thread_session.py
+!/unittest/test_ssh_config.py
+!/unittest/test_ssh_security.py
+!/unittest/test_sshscript_dollar_syntax.py
+!/unittest/test_sshscript_module.py
+!/unittest/test_stdio_dynamic_string.py
+!/unittest/test_stdin_contract.py
+!/unittest/test_syntax_error.spy
+!/unittest/test_update_check.py