mirror of
https://github.com/stablyai/orca.git
synced 2026-09-29 08:03:20 +00:00
Neil
278f9ee876
* fix(ssh): answer every MFA stage, not just the first ssh2 walks one flat auth-method list exactly once, so keyboard-interactive could only ever be offered a single time. A host running `AuthenticationMethods keyboard-interactive,keyboard-interactive` (or any ladder ending in a second challenge) partial-succeeds the first stage and then finds the list exhausted, which the user sees as "All configured authentication methods failed" — the reports in #8622 and #16820. Orca's own auth handler now runs for every target instead of only multi-key ones, and rebuilds its queue on each SSH_MSG_USERAUTH_FAILURE that carries partial success, narrowed to the methods the host still offers. Narrowing also stops keys being re-offered after the host has moved past publickey, which is what exhausts MaxAuthTries before the challenge is ever shown. Covered by a real ssh2 server fixture that stages partial success. * fix(git): say where a failing clone ran and why nothing could prompt Clones go through nonInteractiveGitEnv, so `ssh` runs with BatchMode=yes and an emptied SSH_ASKPASS. On a remote or paired-runtime clone that produces `fatal: Could not read from remote repository.` while the same `git clone` typed by hand on that box succeeds — the divergence in #14533. Nothing in the message said the clone ran on the other machine, under its keys, with the prompt deliberately disabled. getGitCloneFailureMessage now appends that fact, and names the two recognisable shapes: a publickey refusal (load the key into an agent there) and a host-key failure (record the key in that machine's known_hosts). Unrecognised SSH failures still get the where-it-ran note; non-SSH failures are untouched. One builder, so the SSH-target relay path and the runtime path both get it. * fix(ssh): stop dialling a bare alias no ssh_config block claims A wildcard `Host *` block supplies ProxyCommand/ProxyJump for every alias, so shouldUseSystemSshTransport picks the system transport for an alias whose own Host block was renamed or deleted, and buildSshArgs then dials that alias verbatim: no -l, no -p, no Hostname. Orca connects as the wildcard's user to the wildcard's host and discards the endpoint it stored (#11746). The signal #11746 assumed (hostBlockMatch, from the still-open #11707) does not exist, and `ssh -G` cannot supply it — it prints the merged config and answers for unknown aliases too. The config file is the only source of truth, so: - parseSshConfigAliasClaims retains raw Host patterns and flags Match blocks, which parseSshConfig discards because it mints importable targets. - sshConfigMayClaimAlias is sound in the negative direction only: an unreadable file, any Match block, or any non-catch-all pattern that might match all answer "claimed", so absence of evidence is never read as evidence of absence. Only a proven-unclaimed alias licenses an override. - buildSshArgs then states Hostname/Port/User, and only those: the wildcard is still the route, and -o Hostname does not change block selection, so the proxy keeps applying and %h expands to the host we mean. The verdict is injected rather than read inside buildSshArgs, so an arg builder does not answer differently per machine. Default is today's behaviour. Scoped to the system-SSH transport and the connection's own command/transport path. Port-forward processes and the ssh2 transport (#11707) are unchanged. * fix(ssh): read a negated Host group as uncertainty, and gate clone SSH guidance `Host * !prod` applies to every alias but `prod`, yet skipping both the catch-all and the `!` pattern answered "unclaimed" for `stage` — which licences overriding Hostname/Port/User against a block the user wrote. Any negation now makes the whole group uncertain; the function is only sound in the negative direction. Also require an ssh(1) diagnostic beside "could not read from remote repository" before appending the SSH clone note: git prints that same line for the HTTP remote helper, where advice about keys and agents is simply wrong. * fix(i18n): restore the activity-options key the rebase dropped * fix(i18n): union en.json with main so the rebase cannot drop keys
81 lines
2.7 KiB
TypeScript
81 lines
2.7 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { parseSshConfigAliasClaims } from './ssh-config-parser'
|
|
import { sshConfigMayClaimAlias } from './ssh-config-alias-claim'
|
|
|
|
function mayClaim(config: string, alias: string): boolean {
|
|
return sshConfigMayClaimAlias(alias, parseSshConfigAliasClaims(config))
|
|
}
|
|
|
|
describe('sshConfigMayClaimAlias', () => {
|
|
it('treats a wildcard-only config as proof that nothing claims the alias', () => {
|
|
const config = `
|
|
Host *
|
|
ProxyCommand nc -X connect -x proxy:8080 %h %p
|
|
ForwardAgent yes
|
|
`
|
|
expect(mayClaim(config, 'prod')).toBe(false)
|
|
})
|
|
|
|
it('keeps a Host block that names the alias authoritative', () => {
|
|
const config = `
|
|
Host *
|
|
ProxyCommand nc %h %p
|
|
Host prod
|
|
HostName prod.internal
|
|
`
|
|
expect(mayClaim(config, 'prod')).toBe(true)
|
|
})
|
|
|
|
it('keeps a glob that reaches the alias authoritative', () => {
|
|
// parseSshConfig drops these, which is why the claim check cannot reuse it.
|
|
const config = `
|
|
Host prod-*
|
|
HostName prod.internal
|
|
`
|
|
expect(mayClaim(config, 'prod-web')).toBe(true)
|
|
expect(mayClaim(config, 'stage-web')).toBe(false)
|
|
})
|
|
|
|
it('matches single-character wildcards the way OpenSSH does', () => {
|
|
expect(mayClaim('Host prod?\n User ops\n', 'prod1')).toBe(true)
|
|
expect(mayClaim('Host prod?\n User ops\n', 'prod12')).toBe(false)
|
|
})
|
|
|
|
it('refuses to answer once any Match block is present', () => {
|
|
const config = `
|
|
Host *
|
|
ProxyCommand nc %h %p
|
|
Match host prod
|
|
User ops
|
|
`
|
|
expect(mayClaim(config, 'prod')).toBe(true)
|
|
})
|
|
|
|
it('reads any negated group as uncertainty, because OpenSSH still applies its positives', () => {
|
|
// `Host * !prod` routes stage; answering false there would licence overriding a block the user
|
|
// wrote. The exempted alias is not worth a second matching rule to recover.
|
|
expect(mayClaim('Host * !prod\n ForwardAgent yes\n', 'stage')).toBe(true)
|
|
expect(mayClaim('Host * !prod\n ForwardAgent yes\n', 'prod')).toBe(true)
|
|
})
|
|
|
|
it('still proves absence when no group negates', () => {
|
|
expect(mayClaim('Host *\n ForwardAgent yes\nHost prod\n User ops\n', 'stage')).toBe(false)
|
|
})
|
|
|
|
it('reads an unreadable config as uncertainty, not absence', () => {
|
|
expect(sshConfigMayClaimAlias('prod', null)).toBe(true)
|
|
})
|
|
|
|
it('reads an empty alias as uncertainty', () => {
|
|
expect(sshConfigMayClaimAlias('', parseSshConfigAliasClaims('Host *\n'))).toBe(true)
|
|
})
|
|
})
|
|
|
|
describe('parseSshConfigAliasClaims', () => {
|
|
it('retains the raw pattern groups and flags Match blocks', () => {
|
|
expect(
|
|
parseSshConfigAliasClaims('Host a b* # comment\n User x\nMatch final\n User y\n')
|
|
).toEqual({ hostPatternGroups: [['a', 'b*']], hasMatchBlock: true })
|
|
})
|
|
})
|