fix(ssh): let a rejected stored passphrase ask again (#486)

mirror of https://github.com/l0ng-ai/tty7.git synced 2026-09-22 00:02:23 +00:00

Saving the wrong passphrase for an encrypted key locked that key out
permanently. `passphrase_submit` wrote `SetKeyPassphrase` on the
"remember" checkbox alone — before the daemon had tried the secret, since
`apply_keychain_write` runs ahead of `respond_active` — and
`try_identity_file` treated a stored passphrase as final: a decrypt
failure with one went straight to "could not decrypt identity file", with
no prompt and nothing in the UI that could let go of it.

The daemon now says so. `AuthPromptKind::KeyPassphrase` grows a
`rejected` flag, and a stored passphrase that does not open the file
falls through to the interactive prompt carrying it, so the typed answer
still gets its attempt. A passphrase the user typed this time keeps the
hard failure — that is a wrong answer, not stale state. The sheet renders
the warning line the password sheet already had, and a rejected prompt
answered without "remember" now emits `DeleteKeyPassphrase`, mirroring
the password idiom exactly.

The flag is a `#[serde(default)]` field on a struct variant of an
externally tagged enum, which is compatible in both directions: an older
peer never sets it and serde ignores fields it does not know. So
`PROTOCOL_VERSION` deliberately does not move — the remote-server
handshake gates on it, and a bump would turn away older servers over a
field they can safely ignore. `protocol.rs`'s compat test pins both
directions.

Also: deleting an SSH profile now drops the key-passphrase entries no
other profile still references, which is what `delete_profile_confirmed`'s
own comment already claimed to do but only ever did for the password.

This commit is contained in:

l0ng-ai

2026-08-11 20:17:14 +08:00

parent 0f5e63701e

commit d04d104559

11 changed files with 322 additions and 24 deletions

									
										.github/scripts/check-host-boundary.sh
									
		+1
		
												View File
												
				@@ -58,6 +58,7 @@ src/ui/app.rs|std::fs::create_dir_all

				# sees the file, only the resulting auth.

				src/ui/ssh_prompt.rs|std::fs::read

				src/ui/ssh_connect.rs|std::fs::read

				src/ui/settings.rs|std::fs::read

				# Shell history lives in the local user's home (`~/.zsh_history` &co.) and backs

				# this app's own history search. A remote pane's history is the remote shell's