Files
orca/src/shared/git-clone-failure-message.test.ts
T
Neil 278f9ee876 fix(ssh): answer every MFA stage, stop dialling an unclaimed alias, and say where a clone failed (#17946)
* fix(ssh): answer every MFA stage, not just the first

ssh2 walks one flat auth-method list exactly once, so keyboard-interactive
could only ever be offered a single time. A host running
`AuthenticationMethods keyboard-interactive,keyboard-interactive` (or any
ladder ending in a second challenge) partial-succeeds the first stage and
then finds the list exhausted, which the user sees as "All configured
authentication methods failed" — the reports in #8622 and #16820.

Orca's own auth handler now runs for every target instead of only multi-key
ones, and rebuilds its queue on each SSH_MSG_USERAUTH_FAILURE that carries
partial success, narrowed to the methods the host still offers. Narrowing
also stops keys being re-offered after the host has moved past publickey,
which is what exhausts MaxAuthTries before the challenge is ever shown.

Covered by a real ssh2 server fixture that stages partial success.

* fix(git): say where a failing clone ran and why nothing could prompt

Clones go through nonInteractiveGitEnv, so `ssh` runs with BatchMode=yes and an
emptied SSH_ASKPASS. On a remote or paired-runtime clone that produces
`fatal: Could not read from remote repository.` while the same `git clone`
typed by hand on that box succeeds — the divergence in #14533. Nothing in the
message said the clone ran on the other machine, under its keys, with the
prompt deliberately disabled.

getGitCloneFailureMessage now appends that fact, and names the two recognisable
shapes: a publickey refusal (load the key into an agent there) and a host-key
failure (record the key in that machine's known_hosts). Unrecognised SSH
failures still get the where-it-ran note; non-SSH failures are untouched.

One builder, so the SSH-target relay path and the runtime path both get it.

* fix(ssh): stop dialling a bare alias no ssh_config block claims

A wildcard `Host *` block supplies ProxyCommand/ProxyJump for every alias, so
shouldUseSystemSshTransport picks the system transport for an alias whose own
Host block was renamed or deleted, and buildSshArgs then dials that alias
verbatim: no -l, no -p, no Hostname. Orca connects as the wildcard's user to
the wildcard's host and discards the endpoint it stored (#11746).

The signal #11746 assumed (hostBlockMatch, from the still-open #11707) does not
exist, and `ssh -G` cannot supply it — it prints the merged config and answers
for unknown aliases too. The config file is the only source of truth, so:

- parseSshConfigAliasClaims retains raw Host patterns and flags Match blocks,
  which parseSshConfig discards because it mints importable targets.
- sshConfigMayClaimAlias is sound in the negative direction only: an unreadable
  file, any Match block, or any non-catch-all pattern that might match all
  answer "claimed", so absence of evidence is never read as evidence of
  absence. Only a proven-unclaimed alias licenses an override.
- buildSshArgs then states Hostname/Port/User, and only those: the wildcard is
  still the route, and -o Hostname does not change block selection, so the
  proxy keeps applying and %h expands to the host we mean.

The verdict is injected rather than read inside buildSshArgs, so an arg builder
does not answer differently per machine. Default is today's behaviour.

Scoped to the system-SSH transport and the connection's own command/transport
path. Port-forward processes and the ssh2 transport (#11707) are unchanged.

* fix(ssh): read a negated Host group as uncertainty, and gate clone SSH guidance

`Host * !prod` applies to every alias but `prod`, yet skipping both the catch-all
and the `!` pattern answered "unclaimed" for `stage` — which licences overriding
Hostname/Port/User against a block the user wrote. Any negation now makes the
whole group uncertain; the function is only sound in the negative direction.

Also require an ssh(1) diagnostic beside "could not read from remote repository"
before appending the SSH clone note: git prints that same line for the HTTP
remote helper, where advice about keys and agents is simply wrong.

* fix(i18n): restore the activity-options key the rebase dropped

* fix(i18n): union en.json with main so the rebase cannot drop keys
2026-09-02 15:14:53 -07:00

130 lines
5.0 KiB
TypeScript

import { afterEach, describe, expect, it, vi } from 'vitest'
import { getGitCloneFailureMessage } from './git-clone-failure-message'
afterEach(() => {
vi.restoreAllMocks()
})
describe('getGitCloneFailureMessage', () => {
it('turns an existing destination into an actionable message after progress output', () => {
expect(
getGitCloneFailureMessage(
[
'Cloning into \u001b[32morca\u001b[0m...\r',
"fatal: destination path 'orca' already exists and is not an empty directory.\n"
].join(''),
{ clonePath: '/work/orca' }
)
).toBe(
'Destination already exists and is not empty: /work/orca. Choose a different parent folder, delete the existing folder, or add the existing repository instead.'
)
})
it('prefers the last fatal line over a trailing fragment', () => {
expect(
getGitCloneFailureMessage(
"fatal: destination path 'orca' already exists and is not an empty directory.\r\nand the repository exists.\n"
)
).toBe(
'Destination already exists and is not empty: orca. Choose a different parent folder, delete the existing folder, or add the existing repository instead.'
)
})
it('uses the known clone path for relay destination fragments', () => {
expect(
getGitCloneFailureMessage('Clone failed: and the repository exists.', {
clonePath: '/srv/orca'
})
).toBe(
'Destination already exists and is not empty: /srv/orca. Choose a different parent folder, delete the existing folder, or add the existing repository instead.'
)
})
it('falls back to the last non-empty line', () => {
expect(getGitCloneFailureMessage('warning: retrying\nnetwork vanished\n')).toBe(
'network vanished'
)
})
it('scrubs credential-bearing clone URLs before surfacing the fatal line', () => {
// Clone errors echo the URL the user typed — the most likely git error to
// embed a live token — and the message reaches dialogs and bug reports.
const stderr =
'Cloning into repo...\n' +
"fatal: repository 'https://user:ghp_secret123@github.com/org/repo.git/' not found\n"
expect(getGitCloneFailureMessage(stderr)).toBe(
"fatal: repository 'https://github.com/org/repo.git/' not found"
)
})
it('summarizes CRLF-heavy stderr without line-array splitting', () => {
const splitSpy = vi.spyOn(String.prototype, 'split')
const stderr = `${'remote: counting objects\r\n'.repeat(10_000)}fatal: repository not found\r\n`
expect(getGitCloneFailureMessage(stderr)).toBe('fatal: repository not found')
const usedLineSplit = splitSpy.mock.calls.some(
([separator]) =>
(typeof separator === 'string' && separator === '\n') ||
(separator instanceof RegExp && separator.source === '\\r?\\n')
)
expect(usedLineSplit).toBe(false)
})
it('names the non-interactive remote clone when a key could not be offered', () => {
const stderr =
"Cloning into 'repo'...\n" +
'git@github.com: Permission denied (publickey).\n' +
'fatal: Could not read from remote repository.\n'
const message = getGitCloneFailureMessage(stderr)
expect(message).toContain('fatal: Could not read from remote repository.')
expect(message).toContain('BatchMode=yes')
expect(message).toContain('ssh-add')
})
it('points host key failures at the machine that runs the clone', () => {
const stderr = 'Host key verification failed.\nfatal: Could not read from remote repository.\n'
const message = getGitCloneFailureMessage(stderr)
expect(message).toContain('known_hosts')
expect(message).not.toContain('ssh-add')
})
it('still explains where an unrecognised SSH clone failure ran', () => {
const stderr =
'kex_exchange_identification: read: Connection reset by peer\nfatal: Could not read from remote repository.\n'
expect(getGitCloneFailureMessage(stderr)).toContain('BatchMode=yes')
})
it('leaves non-SSH clone failures untouched', () => {
expect(
getGitCloneFailureMessage("fatal: repository 'https://github.com/org/repo.git/' not found")
).toBe("fatal: repository 'https://github.com/org/repo.git/' not found")
})
it('withholds SSH guidance when the failing transport was HTTPS', () => {
// Git reuses this line for the HTTP remote helper, so the string alone does not prove SSH.
const stderr =
'remote: Invalid username or token.\n' +
"fatal: Authentication failed for 'https://github.com/org/repo.git/'\n" +
'fatal: Could not read from remote repository.\n'
expect(getGitCloneFailureMessage(stderr)).not.toContain('BatchMode=yes')
})
it('does not repeat the guidance when a relay message is re-parsed', () => {
const relayMessage = `Clone failed: ${getGitCloneFailureMessage(
'git@github.com: Permission denied (publickey).\nfatal: Could not read from remote repository.\n'
)}`
const reparsed = getGitCloneFailureMessage(relayMessage)
expect(reparsed.match(/BatchMode=yes/g)).toHaveLength(1)
})
})