fix(reboot): probe all windows99 ssh candidates by default

scripts/reboot-recovery/collect-windows99-vmware-verify.sh

@@ -8,7 +8,7 @@ CONNECT_TIMEOUT="${WINDOWS99_CONNECT_TIMEOUT:-3}"
 SSH_TIMEOUT="${WINDOWS99_SSH_TIMEOUT:-3}"
 REMOTE_VERIFY_TIMEOUT="${WINDOWS99_REMOTE_VERIFY_TIMEOUT:-45}"
 SSH_PORT="${WINDOWS99_SSH_PORT:-22}"
-MAX_AUTH_USERS="${WINDOWS99_MAX_AUTH_USERS:-2}"
+MAX_AUTH_USERS="${WINDOWS99_MAX_AUTH_USERS:-}"
 MAX_AUTH_USERS_EXPLICIT=0
 if [[ -n "${WINDOWS99_MAX_AUTH_USERS:-}" ]]; then
   MAX_AUTH_USERS_EXPLICIT=1
@@ -39,11 +39,11 @@ if ! is_positive_int "${REMOTE_VERIFY_TIMEOUT}"; then
   REMOTE_VERIFY_TIMEOUT=45
 fi
 if ! is_positive_int "${MAX_AUTH_USERS}"; then
-  MAX_AUTH_USERS=2
+  MAX_AUTH_USERS="${#SSH_USERS[@]}"
 fi
 
 usage() {
-  printf '%s\n' "usage: $0 [--check|--collect] [--host HOST] [--users 'u1 u2'] [--timeout SECONDS]"
+  printf '%s\n' "usage: $0 [--check|--collect] [--host HOST] [--users 'u1 u2'] [--timeout SECONDS] [--max-auth-users N]"
 }
 
 while [[ $# -gt 0 ]]; do
@@ -69,6 +69,11 @@ while [[ $# -gt 0 ]]; do
       CONNECT_TIMEOUT="${1:-5}"
       SSH_TIMEOUT="${CONNECT_TIMEOUT}"
       ;;
+    --max-auth-users)
+      shift
+      MAX_AUTH_USERS="${1:-}"
+      MAX_AUTH_USERS_EXPLICIT=1
+      ;;
     --help|-h)
       usage
       exit 0
@@ -92,7 +97,7 @@ if ! is_positive_int "${REMOTE_VERIFY_TIMEOUT}"; then
   REMOTE_VERIFY_TIMEOUT=45
 fi
 if ! is_positive_int "${MAX_AUTH_USERS}"; then
-  MAX_AUTH_USERS=2
+  MAX_AUTH_USERS="${#SSH_USERS[@]}"
 fi
 if [[ "${SSH_USERS_EXPLICIT}" == "1" && "${MAX_AUTH_USERS_EXPLICIT}" != "1" ]]; then
   MAX_AUTH_USERS="${#SSH_USERS[@]}"

scripts/reboot-recovery/tests/test_windows99_vmware_verify_collector.py

@@ -97,13 +97,13 @@ def test_check_mode_reports_open_ports_and_missing_publickey_auth(tmp_path: Path
     values = _key_values(result.stdout)
     assert values["schema_version"] == "windows99_vmware_verify_collector_v1"
     assert values["dry_run"] == "true"
-    assert values["ssh_auth_probe_user_limit"] == "2"
+    assert values["ssh_auth_probe_user_limit"] == "5"
     assert values["port_22_open"] == "1"
     assert values["port_3389_open"] == "1"
     assert values["port_5985_open"] == "0"
     assert values["port_5986_open"] == "0"
     assert values["ssh_batchmode_auth_ready"] == "0"
-    assert values["ssh_auth_probed_users"] == "2"
+    assert values["ssh_auth_probed_users"] == "5"
     assert values["remote_verify_attempted"] == "0"
     assert values["verify_collection_status"] == "blocked_ssh_publickey_auth_missing"
     assert values["secret_value_read"] == "false"
@@ -153,6 +153,41 @@ def test_check_mode_probes_all_explicit_users_without_secret_prompt(tmp_path: Pa
     assert values["password_prompt_allowed"] == "false"
 
 
+def test_check_mode_can_cap_auth_probe_user_count_without_secret_prompt(
+    tmp_path: Path,
+) -> None:
+    fake_bin = tmp_path / "bin"
+    fake_bin.mkdir()
+    _write_executable(
+        fake_bin / "nc",
+        """
+        #!/usr/bin/env bash
+        port="${!#}"
+        if [[ "$port" == "22" || "$port" == "3389" ]]; then
+          exit 0
+        fi
+        exit 1
+        """,
+    )
+    _write_executable(
+        fake_bin / "ssh",
+        """
+        #!/usr/bin/env bash
+        exit 255
+        """,
+    )
+
+    result = _run_collector(fake_bin, "--check", "--max-auth-users", "2")
+
+    assert result.returncode == 0
+    values = _key_values(result.stdout)
+    assert values["ssh_auth_probe_user_limit"] == "2"
+    assert values["ssh_auth_probed_users"] == "2"
+    assert values["ssh_batchmode_auth_ready"] == "0"
+    assert values["secret_value_read"] == "false"
+    assert values["password_prompt_allowed"] == "false"
+
+
 def test_collect_mode_blocks_without_publickey_auth(tmp_path: Path) -> None:
     fake_bin = tmp_path / "bin"
     fake_bin.mkdir()