feat(ssh): auth-side SSH preflight - key presence, known_hosts steer, identity probe #333

Merged

hexajon merged 1 commit from issue-296-ssh-preflight-key-knownhosts-identity into main

2026-07-21 23:32:29 +00:00

hexajon commented

2026-07-21 23:32:24 +00:00

(Migrated from codeberg.org)

Summary

Adds the read-and-teach SSH preflight (internal/service/ssh): a usable-key check (ssh-agent or ~/.ssh, directory listing only - no key material read), a known_hosts presence check that teaches first-contact fingerprint verification on absence, and an ssh -T git@host probe that names the authenticated user from the greeting. Wired into auth login (ssh modes, interactive setup) and whoami on both CLI and MCP surfaces; the dir= carve-out skips the probe. No key generation, no known_hosts writes - a structural test guards the no-write promise. The greeting username is control-char-stripped before rendering and the success line names the probe's trust boundary.

Closes #296.

Closes #296

## Summary Adds the read-and-teach SSH preflight (internal/service/ssh): a usable-key check (ssh-agent or ~/.ssh, directory listing only - no key material read), a known_hosts presence check that teaches first-contact fingerprint verification on absence, and an `ssh -T git@host` probe that names the authenticated user from the greeting. Wired into auth login (ssh modes, interactive setup) and whoami on both CLI and MCP surfaces; the dir= carve-out skips the probe. No key generation, no known_hosts writes - a structural test guards the no-write promise. The greeting username is control-char-stripped before rendering and the success line names the probe's trust boundary. Closes #296. Closes #296

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!333

No description provided.

Rows
Columns