vssh 3.3.10__tar.gz → 3.6.2__tar.gz

{vssh-3.3.10/vssh.egg-info → vssh-3.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vssh
-Version: 3.3.10
+Version: 3.6.2
 Summary: Secure SSH/SCP tool with Tailscale failover, P2P transport, and MCP server
 Author-email: MeshPOP <mpop@mpop.dev>
 License: MIT

{vssh-3.3.10 → vssh-3.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vssh"
-version = "3.3.10"
+version = "3.6.2"
 description = "Secure SSH/SCP tool with Tailscale failover, P2P transport, and MCP server"
 readme = "README.md"
 license = {text = "MIT"}

{vssh-3.3.10 → vssh-3.6.2/vssh.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vssh
-Version: 3.3.10
+Version: 3.6.2
 Summary: Secure SSH/SCP tool with Tailscale failover, P2P transport, and MCP server
 Author-email: MeshPOP <mpop@mpop.dev>
 License: MIT

{vssh-3.3.10 → vssh-3.6.2}/vssh.py

@@ -55,7 +55,9 @@ HMAC_WINDOW = 60  # seconds - allow 60s clock skew
 # Loaded from ~/.vssh/config (TAILSCALE.<wire_ip> = <ts_ip>) or ~/.vssh/tailscale_map
 
 def _load_tailscale_map() -> dict:
-    """Load Wire VPN IP → Tailscale IP mapping"""
+    """Load Wire VPN IP → Tailscale IP mapping.
+    Priority: manual config > tailscale_map file > auto-detect (tailscale + wire server)
+    """
     ts_map = {}
 
     # 1. From config: TAILSCALE.10.99.85.143 = 100.80.191.6
@@ -75,43 +77,81 @@ def _load_tailscale_map() -> dict:
                 parts = line.split()
                 if len(parts) >= 2:
                     ts_map[parts[0]] = parts[1]  # wire_ip tailscale_ip
-        except (OSError, ValueError) as e:
-            pass  # e silenced
+        except (OSError, ValueError):
+            pass
+
+    # 3. Auto-detect: cross-reference `tailscale status --json` + wire /peers
+    if not ts_map:
+        try:
+            import urllib.request as _ur, subprocess as _sp2
+            ts_out = _sp2.run(['tailscale', 'status', '--json'],
+                              capture_output=True, text=True, timeout=5)
+            if ts_out.returncode == 0:
+                ts_data = json.loads(ts_out.stdout)
+                ts_host = {}
+                for peer in list(ts_data.get('Peer', {}).values()) + [ts_data.get('Self', {})]:
+                    if not peer:
+                        continue
+                    name = peer.get('HostName', '').lower().split('.')[0]
+                    ips = [ip for ip in peer.get('TailscaleIPs', []) if ':' not in ip]
+                    if name and ips:
+                        ts_host[name] = ips[0]
+                for srv_ip in ['10.99.85.143', '158.247.247.115']:
+                    try:
+                        with _ur.urlopen(f'http://{srv_ip}:8790/peers', timeout=3) as r:
+                            for p in json.loads(r.read()).get('peers', []):
+                                name = p.get('node_name', '').lower()
+                                wire_ip = p.get('vpn_ip', '')
+                                ts_ip = ts_host.get(name)
+                                if wire_ip and ts_ip:
+                                    ts_map[wire_ip] = ts_ip
+                        break
+                    except Exception:
+                        continue
+        except Exception:
+            pass
 
     return ts_map
 
 TAILSCALE_MAP = _load_tailscale_map()
-_FAILOVER_ACTIVE = {}  # host -> tailscale_ip (cache of active failovers)
+_FAILOVER_ACTIVE = {}  # host -> (tailscale_ip, timestamp) — Wire retry after 60s
+_FAILOVER_RETRY_INTERVAL = 60  # seconds before retrying Wire after failover
 
 def vssh_connect(host: str, timeout: float = 5.0) -> socket.socket:
     """Connect to vssh server with automatic Tailscale failover.
 
     1. Try Wire VPN IP (primary)
-    2. If Wire fails → try Tailscale IP (fallback)
-    3. Cache successful failover for subsequent connections
+    2. If Wire fails → try Tailscale IP (fallback), cache for 60s
+    3. After 60s, retry Wire — if Wire recovered, clear failover cache
 
     Returns connected socket or raises ConnectionError.
     """
-    # If this host already failed Wire and succeeded via Tailscale, go direct
+    # If this host recently failed Wire, use cached Tailscale (but retry Wire after 60s)
     if host in _FAILOVER_ACTIVE:
-        ts_ip = _FAILOVER_ACTIVE[host]
-        try:
-            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-            sock.settimeout(timeout)
-            sock.connect((ts_ip, PORT))
-            return sock
-        except (OSError, socket.error):
-            # Tailscale also failed — clear cache, try Wire again
+        ts_ip, failover_time = _FAILOVER_ACTIVE[host]
+        if time.time() - failover_time < _FAILOVER_RETRY_INTERVAL:
+            # Still within retry window — use Tailscale directly
+            try:
+                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                sock.settimeout(timeout)
+                sock.connect((ts_ip, PORT))
+                return sock
+            except (OSError, socket.error):
+                # Tailscale also failed — clear cache, fall through to Wire retry
+                del _FAILOVER_ACTIVE[host]
+        else:
+            # 60s elapsed — try Wire again first (Wire may have recovered)
             del _FAILOVER_ACTIVE[host]
 
     # Primary: try Wire VPN IP
     try:
         sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        sock.settimeout(timeout)
+        sock.settimeout(min(timeout, 2.0))  # 2s: enough for WireGuard handshake
         sock.connect((host, PORT))
+        sock.settimeout(timeout)  # Restore full timeout for I/O
         return sock
-    except (ConnectionRefusedError, ConnectionError, OSError, socket.timeout) as wire_err:
-        pass  # wire_err silenced
+    except (ConnectionRefusedError, ConnectionError, OSError, socket.timeout):
+        pass  # Wire failed, try Tailscale
 
     # Fallback: try Tailscale IP
     ts_ip = TAILSCALE_MAP.get(host)
@@ -122,10 +162,10 @@ def vssh_connect(host: str, timeout: float = 5.0) -> socket.socket:
         sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
         sock.settimeout(timeout)
         sock.connect((ts_ip, PORT))
-        _FAILOVER_ACTIVE[host] = ts_ip
+        _FAILOVER_ACTIVE[host] = (ts_ip, time.time())
         print(f'[FAILOVER] {host} → {ts_ip} (Tailscale)')
         return sock
-    except Exception as ts_err:
+    except Exception:
         raise ConnectionError(
             f'Both Wire ({host}) and Tailscale ({ts_ip}) failed'
         )
@@ -475,40 +515,44 @@ _name_cache = {}  # name -> vpn_ip
 _name_cache_time = 0
 
 def resolve_name(host: str) -> str:
-    """Resolve server name to VPN IP via Wire VPN /peers API (standalone)"""
+    """Resolve server name to VPN IP via Wire VPN /peers API (coordinator-first)
+
+    Priority:
+      1. Fresh in-memory cache (< 60s) — avoids repeated network calls
+      2. Wire coordinator /peers — source of truth (IPs change when nodes move)
+      3. ~/.vssh/config static mapping — fallback when coordinator unreachable
+    """
     global _name_cache, _name_cache_time
     # Strip user@ prefix
     if '@' in host:
         host = host.split('@', 1)[1]
     if not host or host[0].isdigit():
         return host
-    # 1. Check ~/.vssh/config local mapping (instant, no network)
-    if host in VSSH_CONFIG:
-        return VSSH_CONFIG[host]
-    # Use cache if fresh (< 60s)
+    # 1. Use fresh cache — coordinator already queried recently
     if host in _name_cache and time.time() - _name_cache_time < 60:
         return _name_cache[host]
-    # Query Wire VPN server
+    # 2. Query Wire coordinator (source of truth — IPs change when nodes move)
+    import urllib.request
     for srv_ip in WIRE_SERVERS:
         try:
-            import urllib.request
-            req = urllib.request.Request(f"http://{srv_ip}:8786/peers")
+            req = urllib.request.Request(f"http://{srv_ip}:8790/peers")
             with urllib.request.urlopen(req, timeout=3) as resp:
                 data = json.loads(resp.read())
                 peers = data.get("peers", [])
                 _name_cache.clear()
                 for p in peers:
                     vpn_ip = p.get("vpn_ip", "")
-                    dn = p.get("display_name", "")
-                    hn = p.get("hostname", "")
-                    if dn: _name_cache[dn] = vpn_ip
-                    if hn: _name_cache[hn] = vpn_ip
+                    nn = p.get("node_name", "")
+                    if nn: _name_cache[nn] = vpn_ip
                 _name_cache_time = time.time()
                 if host in _name_cache:
                     return _name_cache[host]
-                break  # got peers, just no match
+                break  # got peers from coordinator, just no match for this host
         except (OSError, ValueError, TimeoutError):
             continue
+    # 3. Fall back to static config (useful when all coordinators unreachable)
+    if host in VSSH_CONFIG:
+        return VSSH_CONFIG[host]
     return host
 
 
@@ -3354,7 +3398,7 @@ def _cmd_install(args):
 
     # --- Step 1: Upgrade pip package ---
     print(f"  pip     : upgrading vssh...")
-    pip_args = [python_exe, '-m', 'pip', 'install', 'vssh', '--upgrade', '-q']
+    pip_args = [python_exe, '-m', 'pip', 'install', 'git+https://github.com/meshpop/vssh.git', '--upgrade', '-q']
     if _plat.system() == 'Linux':
         pip_args.append('--break-system-packages')
     r = _sp.run(pip_args, capture_output=True, text=True)
@@ -3363,21 +3407,33 @@ def _cmd_install(args):
     else:
         print(f"  pip     : \u2717 {r.stderr.strip()[:120]}")
 
-    # --- Step 2: Find installed vssh.py (after upgrade) ---
-    import importlib, importlib.util as _ilu
+    # --- Step 2: Find installed vssh.py from pip (not the running script) ---
+    installed_py = None
     try:
-        importlib.invalidate_caches()
-        spec = _ilu.find_spec('vssh')
-        installed_py = spec.origin if (spec and spec.origin) else _os.path.abspath(__file__)
+        r2 = _sp.run([python_exe, '-m', 'pip', 'show', 'vssh'],
+                     capture_output=True, text=True)
+        for _line in r2.stdout.splitlines():
+            if _line.startswith('Location:'):
+                _loc = _line.split(':', 1)[1].strip()
+                _cand = _os.path.join(_loc, 'vssh.py')
+                if _os.path.isfile(_cand):
+                    installed_py = _cand
+                break
     except Exception:
+        pass
+    if not installed_py:
         installed_py = _os.path.abspath(__file__)
 
     # --- Step 3: Copy vssh.py to /usr/local/bin/vssh.py ---
     target_py = '/usr/local/bin/vssh.py'
     try:
-        _sh.copy2(installed_py, target_py)
-        _os.chmod(target_py, 0o755)
-        print(f"  copied  : {installed_py} \u2192 {target_py}")
+        import os.path as _osp
+        if _osp.exists(target_py) and _osp.samefile(installed_py, target_py):
+            print(f"  skipped : already up to date ({target_py})")
+        else:
+            _sh.copy2(installed_py, target_py)
+            _os.chmod(target_py, 0o755)
+            print(f"  copied  : {installed_py} \u2192 {target_py}")
     except PermissionError:
         print(f"  warning : cannot write {target_py} (need root) — using {installed_py}")
         target_py = installed_py
@@ -3823,21 +3879,33 @@ Env: VSSH_SECRET
         import socket as _sock
         import concurrent.futures
         full_mode = '--full' in args or '-f' in args
-        # Use vssh standalone config (no mpop dependency)
+        # Build server list: coordinator first (source of truth), config as supplement
         _servers = {}
+        import urllib.request as _ureq
+        for _srv_ip in WIRE_SERVERS:
+            try:
+                with _ureq.urlopen(f"http://{_srv_ip}:8790/peers", timeout=3) as _r:
+                    _peers = json.loads(_r.read()).get("peers", [])
+                    for _p in _peers:
+                        _nn = _p.get("node_name", "")
+                        _vip = _p.get("vpn_ip", "")
+                        if _nn and _vip:
+                            _servers[_nn] = _vip
+                    break
+            except (OSError, ValueError, TimeoutError):
+                continue
+        # Also include any config entries not in coordinator (offline/static nodes)
         for k, v in VSSH_CONFIG.items():
-            if k in ('SECRET','SSH_PORT','SCP_PORT'): continue
-            if v and v[0].isdigit():
+            if k in ('SECRET', 'SSH_PORT', 'SCP_PORT'): continue
+            if v and v[0].isdigit() and k not in _servers:
                 _servers[k] = v
 
         def _check_node(name, ip):
-            """Check a single node — connect + optional INFO query"""
+            """Check a single node — connect + optional INFO query (Wire VPN → Tailscale fallback)"""
             result = {'name': name, 'ip': ip, 'online': False, 'latency': 0}
             try:
-                s = _sock.socket(_sock.AF_INET, _sock.SOCK_STREAM)
-                s.settimeout(1)
                 t0 = time.time()
-                s.connect((ip, 48291))
+                s = vssh_connect(ip, timeout=3.0)
                 result['latency'] = (time.time() - t0) * 1000
                 result['online'] = True