fix: interface_name strategy, instance hosts in sftp/scp, alias rewrites

Found by the new Docker test environment against a real NetBox 4.7:

- The interface_name strategy filtered IP addresses with interface_name
  and vminterface_name, which NetBox ignores, so it returned the first
  address of the host instead of the named interface's. Use the real
  filters interface and vminterface; a missing interface (HTTP 400)
  falls through to the next strategy.
- sftp and scp took instance-qualified hosts (prod/web01:/path) for
  local paths, because a "/" comes before the ":". Such arguments are
  remote when the prefix is a configured NetBox instance.
- Shell aliases of instance-qualified hosts ran the shortcut rules on
  "instance/host", so anchored rewrite rules never matched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/resolver/interface_name.go

@@ -16,13 +16,16 @@ type InterfaceNameStrategy struct {
 func (s *InterfaceNameStrategy) Name() string { return "interface_name" }
 
 func (s *InterfaceNameStrategy) Resolve(ctx context.Context, entry *netbox.HostEntry, client *netbox.Client) (string, error) {
-	// Build filter parameters for IP addresses attached to the named interface.
+	// NetBox filters IP addresses by interface name with interface= (devices)
+	// and vminterface= (VMs); unknown parameters would be ignored silently and
+	// return every address of the host. A missing interface is an HTTP 400,
+	// which lets the chain try the next strategy.
 	var filterParam string
 	switch entry.Kind {
 	case "device":
-		filterParam = fmt.Sprintf("device_id=%d&interface_name=%s", entry.ID, url.QueryEscape(s.name))
+		filterParam = fmt.Sprintf("device_id=%d&interface=%s", entry.ID, url.QueryEscape(s.name))
 	case "vm":
-		filterParam = fmt.Sprintf("virtual_machine_id=%d&vminterface_name=%s", entry.ID, url.QueryEscape(s.name))
+		filterParam = fmt.Sprintf("virtual_machine_id=%d&vminterface=%s", entry.ID, url.QueryEscape(s.name))
 	default:
 		return "", fmt.Errorf("unknown kind %q", entry.Kind)
 	}

internal/resolver/interface_name_test.go

@@ -0,0 +1,56 @@
+package resolver
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"git.zb-server.de/Sebi/ssh-netbox-wrapper/internal/netbox"
+)
+
+// NetBox ignores unknown filters, so the strategy must use the real filter
+// names; otherwise it silently returns the host's first address.
+func TestInterfaceNameStrategyFilters(t *testing.T) {
+	for kind, want := range map[string]string{
+		"device": "device_id=7&interface=mgmt0",
+		"vm":     "virtual_machine_id=7&vminterface=mgmt0",
+	} {
+		var got string
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			q := r.URL.Query()
+			q.Del("limit")
+			q.Del("offset")
+			got = q.Encode()
+			w.Header().Set("Content-Type", "application/json")
+			w.Write([]byte(`{"count":1,"results":[{"address":"10.0.0.7/24"}]}`))
+		}))
+		ip, err := (&InterfaceNameStrategy{name: "mgmt0"}).Resolve(context.Background(), &netbox.HostEntry{ID: 7, Kind: kind}, netbox.NewClient(srv.URL, "t", 1))
+		srv.Close()
+		if err != nil || ip != "10.0.0.7" {
+			t.Fatalf("%s: %q %v", kind, ip, err)
+		}
+		if parsed, _ := urlQuery(want); got != parsed {
+			t.Errorf("%s: query %q, want %q", kind, got, parsed)
+		}
+	}
+}
+
+func TestInterfaceNameStrategyMissingInterfaceFallsThrough(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, `{"vminterface":["Select a valid choice."]}`, http.StatusBadRequest)
+	}))
+	defer srv.Close()
+	client := netbox.NewClient(srv.URL, "t", 1)
+	chain := &Chain{strategies: []Strategy{&InterfaceNameStrategy{name: "mgmt0"}, &PrimaryIPStrategy{}}}
+	ip, err := chain.Resolve(context.Background(), &netbox.HostEntry{ID: 7, Kind: "vm", PrimaryIP4: "10.0.0.9"}, client)
+	if err != nil || ip != "10.0.0.9" {
+		t.Fatalf("got %q %v", ip, err)
+	}
+}
+
+func urlQuery(s string) (string, error) {
+	q, err := url.ParseQuery(s)
+	return q.Encode(), err
+}