feat!: replace rsyncwrapper with direct child_process.spawn

Remove the outdated rsyncwrapper dependency (unmaintained, uses
deprecated util._extend) and replace with a built-in buildRsyncCommand()
+ spawn implementation. Zero runtime dependencies.

BREAKING CHANGE: rsyncwrapper dependency removed, rsync command is now
constructed and executed directly via child_process.spawn.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package-lock.json

@@ -1,16 +1,13 @@
 {
   "name": "@draganfilipovic/ssh-deploy",
-  "version": "4.1.10",
+  "version": "5.1.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@draganfilipovic/ssh-deploy",
-      "version": "4.1.10",
+      "version": "5.1.1",
       "license": "MIT",
-      "dependencies": {
-        "rsyncwrapper": "^3.0.1"
-      },
       "devDependencies": {
         "@vercel/ncc": "^0.36.0",
         "eslint": "^8.30.0",
@@ -129,6 +126,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.8.1.tgz",
       "integrity": "sha512-7zFpHzhnqYKrkYdUjF1HI1bzd0VygEGX8lFk4k5zVMqHEoES+P+7TKI+EvLO9WVMJ8eekdO0aDEK044xTXwPPA==",
       "dev": true,
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -459,6 +457,7 @@
       "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.31.0.tgz",
       "integrity": "sha512-0tQQEVdmPZ1UtUKXjX7EMm9BlgJ08G90IhWh0PKDCb3ZLsgAOHI8fYSIzYVZej92zsgq+ft0FGsxhJ3xo2tbuA==",
       "dev": true,
+      "peer": true,
       "dependencies": {
         "@eslint/eslintrc": "^1.4.1",
         "@humanwhocodes/config-array": "^0.11.8",
@@ -579,6 +578,7 @@
       "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.26.0.tgz",
       "integrity": "sha512-hYfi3FXaM8WPLf4S1cikh/r4IxnO6zrhZbEGz2b660EJRbuxgpDS5gkCuYgGWg2xxh2rBuIr4Pvhve/7c31koA==",
       "dev": true,
+      "peer": true,
       "dependencies": {
         "array-includes": "^3.1.4",
         "array.prototype.flat": "^1.2.5",
@@ -1698,14 +1698,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/rsyncwrapper": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/rsyncwrapper/-/rsyncwrapper-3.0.1.tgz",
-      "integrity": "sha512-fkGmeEJRbKveT/6bBqTVzzHS1wtbGQwL6qnwT/+1AtMAsEV5dX1fSAiOJVZrDOnVsOr2lFl8ga1MZLoHekV3yg==",
-      "engines": {
-        "node": ">=8.1.3"
-      }
-    },
     "node_modules/run-parallel": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
@@ -2083,7 +2075,8 @@
       "version": "8.8.1",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.8.1.tgz",
       "integrity": "sha512-7zFpHzhnqYKrkYdUjF1HI1bzd0VygEGX8lFk4k5zVMqHEoES+P+7TKI+EvLO9WVMJ8eekdO0aDEK044xTXwPPA==",
-      "dev": true
+      "dev": true,
+      "peer": true
     },
     "acorn-jsx": {
       "version": "5.3.2",
@@ -2328,6 +2321,7 @@
       "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.31.0.tgz",
       "integrity": "sha512-0tQQEVdmPZ1UtUKXjX7EMm9BlgJ08G90IhWh0PKDCb3ZLsgAOHI8fYSIzYVZej92zsgq+ft0FGsxhJ3xo2tbuA==",
       "dev": true,
+      "peer": true,
       "requires": {
         "@eslint/eslintrc": "^1.4.1",
         "@humanwhocodes/config-array": "^0.11.8",
@@ -2428,6 +2422,7 @@
       "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.26.0.tgz",
       "integrity": "sha512-hYfi3FXaM8WPLf4S1cikh/r4IxnO6zrhZbEGz2b660EJRbuxgpDS5gkCuYgGWg2xxh2rBuIr4Pvhve/7c31koA==",
       "dev": true,
+      "peer": true,
       "requires": {
         "array-includes": "^3.1.4",
         "array.prototype.flat": "^1.2.5",
@@ -3221,11 +3216,6 @@
         "glob": "^7.1.3"
       }
     },
-    "rsyncwrapper": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/rsyncwrapper/-/rsyncwrapper-3.0.1.tgz",
-      "integrity": "sha512-fkGmeEJRbKveT/6bBqTVzzHS1wtbGQwL6qnwT/+1AtMAsEV5dX1fSAiOJVZrDOnVsOr2lFl8ga1MZLoHekV3yg=="
-    },
     "run-parallel": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",

package.json

@@ -29,9 +29,6 @@
     "url": "https://github.com/easingthemes/ssh-deploy/issues"
   },
   "homepage": "https://github.com/easingthemes/ssh-deploy#readme",
-  "dependencies": {
-    "rsyncwrapper": "^3.0.1"
-  },
   "devDependencies": {
     "@vercel/ncc": "^0.36.0",
     "eslint": "^8.30.0",

src/rsyncCli.js

@@ -1,16 +1,70 @@
-const { execSync } = require('child_process');
-const nodeRsync = require('rsyncwrapper');
+const { execSync, spawn } = require('child_process');
 
-const nodeRsyncPromise = async (config) => new Promise((resolve, reject) => {
-  const logCMD = (cmd) => {
+const escapeSpaces = (str) => (typeof str === 'string' ? str.replace(/\b\s/g, '\\ ') : str);
+
+const buildRsyncCommand = ({ src, dest, excludeFirst, port, privateKey, args, sshCmdArgs }) => {
+  const cmdParts = [];
+
+  // Sources and destination (with space escaping)
+  const sources = (Array.isArray(src) ? src : [src]).map(escapeSpaces);
+  cmdParts.push(...sources);
+  cmdParts.push(escapeSpaces(dest));
+
+  // SSH transport
+  let sshCmd = `ssh -p ${port || 22} -i ${privateKey}`;
+  if (sshCmdArgs && sshCmdArgs.length > 0) {
+    sshCmd += ` ${sshCmdArgs.join(' ')}`;
+  }
+  cmdParts.push('--rsh', `"${sshCmd}"`);
+
+  // Recursive
+  cmdParts.push('--recursive');
+
+  // Exclude-first patterns
+  if (excludeFirst && excludeFirst.length > 0) {
+    excludeFirst.forEach((pattern) => {
+      if (pattern) cmdParts.push(`--exclude=${escapeSpaces(pattern)}`);
+    });
+  }
+
+  // User-provided args
+  if (args && args.length > 0) {
+    cmdParts.push(...args);
+  }
+
+  // Deduplicate while preserving order
+  const dedupedParts = [...new Set(cmdParts)];
+  return `rsync ${dedupedParts.join(' ')}`;
+};
+
+const runRsync = async (config) => new Promise((resolve, reject) => {
+  const cmd = buildRsyncCommand(config);
+  const logCMD = (c) => {
     console.warn('================================================================');
-    console.log(cmd);
+    console.log(c);
     console.warn('================================================================');
   };
 
-  try {
-    nodeRsync(config, (error, stdout, stderr, cmd) => {
-      if (error) {
+  let stdout = '';
+  let stderr = '';
+  const proc = spawn('/bin/sh', ['-c', cmd]);
+
+  proc.stdout.on('data', (data) => {
+    const str = data.toString();
+    console.log(str);
+    stdout += str;
+  });
+
+  proc.stderr.on('data', (data) => {
+    const str = data.toString();
+    console.error(str);
+    stderr += str;
+  });
+
+  proc.on('exit', (code) => {
+    if (code !== 0) {
+      const error = new Error(`rsync exited with code ${code}`);
+      error.code = code;
       console.error('❌ [Rsync] error: ');
       console.error(error);
       console.error('❌ [Rsync] stderr: ');
@@ -26,10 +80,11 @@ const nodeRsyncPromise = async (config) => new Promise((resolve, reject) => {
       resolve(stdout);
     }
   });
-  } catch (error) {
+
+  proc.on('error', (error) => {
     console.error('❌ [Rsync] command error: ', error.message, error.stack);
     reject(error);
-  }
+  });
 });
 
 const validateRsync = async () => {
@@ -57,17 +112,8 @@ const rsyncCli = async ({
   console.log(`[Rsync] Starting Rsync Action: ${source} to ${rsyncServer}`);
   if (exclude && exclude.length > 0) console.log(`[Rsync] excluding folders ${exclude}`);
 
-  const defaultOptions = {
-    ssh: true,
-    recursive: true,
-    onStdout: (data) => console.log(data.toString()),
-    onStderr: (data) => console.error(data.toString())
-  };
-
-  // RSYNC COMMAND
   /* eslint-disable object-property-newline */
-  return nodeRsyncPromise({
-    ...defaultOptions,
+  return runRsync({
     src: source, dest: rsyncServer, excludeFirst: exclude, port: remotePort,
     privateKey: privateKeyPath, args, sshCmdArgs
   });