v0.5.5

Added

• quickchr set <name> --package <pkg>[,<pkg>...] installs extra packages on a
  running machine: SCP upload, reboot to activate, wait for REST. Repeatable and
  comma-separated like --add-package. The PROVISIONING_WINDOW_CLOSED refusal
  for --add-package now names this command instead of the library API. (#24)
• doctor reports the configured HTTPS egress proxy (HTTPS_PROXY/https_proxy,
  ALL_PROXY/all_proxy, credentials redacted) or direct egress, and warns when
  acceleration is TCG-only. (#210)

Changed

• The documented minimum Bun version is 1.4.3 (README, MANUAL, CONTRIBUTING,
  and engines.bun in package.json, which Bun does not enforce). Bun 1.4.2
  and older return proxy CONNECT refusals as plain HTTP responses, and the
  proxy diagnostics are verified only on 1.4.3 and newer. The docs said
  Bun 1.1. (#232)

Fixed

• The hedged "HTTP 403 via the egress proxy" error names the right Bun version.
  It said proxy CONNECT refusals arrive as responses on Bun older than 1.4.4.
  Checked against a live refusing proxy, Bun 1.4.3 already throws
  ERR_PROXY_TUNNEL, and only 1.4.2 and older return the proxy's 403 as a
  response, so the message now says "older than 1.4.3". (#232)
• upload(), download(), installPackage() and quickchr set --package work
  on --secure-login machines. They failed with Permission denied (publickey):
  RouterOS refuses password login for a user that has an SSH key, and SCP never
  offered the managed quickchr key. It now does, and still falls back to the
  password for users without a key. (#229)
• Repeated --flag=value options are no longer silently dropped:
  --package=a --package=b, and mixed forms like --add-network user --add-network=socket::lab, keep every value, as the space form always did.
  A single-value flag given twice now takes the last value; --name a --name b
  used to discard both and auto-generate a name. (#231)
• exec's default auto transport now retries refused/unreachable REST
  connections (up to 3 retries, 2 s apart), then falls back to the serial
  console. Resets, timeouts, unknown errors and HTTP failures surface without
  replay: the command may already have executed. Explicit --via=rest still
  sends exactly once. Previously wrapped transport errors prevented any
  console fallback. Console execution and fallback also resolve stored machine
  credentials so reloaded provisioned machines can authenticate. (#135)
• installPackage() enforces the post-boot preconditions instead of failing
  mid-operation: a stopped machine is refused with MACHINE_STOPPED, a machine
  with no user-mode NIC with NETWORK_UNAVAILABLE, and a machine whose REST API
  does not answer with BOOT_TIMEOUT — before anything is uploaded. It also
  throws when the guest rejects the activating reboot (PROCESS_FAILED on
  401/403, REBOOT_FAILED otherwise), when the guest never goes down for it,
  and when the guest does not come back afterwards (all three used to report
  success) — always before anything is recorded, so a failed install never
  reads as applied later. It uploads over SSH with the machine's own
  credentials instead of factory admin: (so --disable-admin machines work),
  and records the packages provisioning step so a later start with the same
  packages is a no-op. (#24)
• SCP transfers with a non-empty password (upload(), download(),
  installPackage() on a machine with a provisioned user) failed with
  "Permission denied": SSH_ASKPASS_REQUIRE=prefer skips askpass when DISPLAY
  is empty, so ssh fell back to stdin and submitted an empty password. Now
  force, which runs askpass regardless of DISPLAY.
• In sandboxed cloud sessions whose egress proxy refuses a MikroTik host,
  downloads and channel resolution fail fast naming the refused host and the
  allowlist fix, instead of retrying or blaming the network. (#210)
• A proxy 407 (missing credentials) gets its own hint; a proxy 5xx keeps its
  retries as the transient failure it is. (#210)
• HTTP 403 verdicts blame the egress proxy only when a proxy is actually
  configured for the URL; direct 403s keep the generic origin verdict. (#210)
• cache key rethrows proxy-attributed channel-resolution failures with their
  remediation hint instead of returning the unresolved sentinel. (#210)