run ssh -G for typed hosts so system ProxyCommand still applies - #3136
run ssh -G for typed hosts so system ProxyCommand still applies#3136thedhruvhegde wants to merge 1 commit into
Conversation
Greptile SummaryThis PR resolves effective SSH configuration for typed, non-alias hosts so wildcard and system proxy directives can participate in connection setup while preserving stored endpoint fields.
Confidence Score: 4/5The PR is not safe to merge until explicit stored ProxyJump connections are protected from being silently overridden by wildcard or system ProxyCommand configuration. The new typed-host lookup fixes the reported proxy discovery path, but it changes routing precedence for existing manually configured jump-host connections; duplicate sequential Files Needing Attention: apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.ts, apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.test.ts
|
| Filename | Overview |
|---|---|
| apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.ts | Extends SSH-config resolution to typed hosts, but lets system ProxyCommand override an explicit stored ProxyJump and duplicates resolution for agent authentication. |
| apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.test.ts | Adds typed-host ProxyCommand coverage and updates agent-resolution expectations, but omits the stored-ProxyJump precedence case. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Connection input] --> B{SSH config alias?}
B -->|Yes| C[Run ssh -G for alias]
B -->|No| D[Run ssh -G for typed host]
C --> E[Use resolved endpoint and proxy settings]
D --> F[Keep stored endpoint fields]
D --> G[Read resolved proxy settings]
F --> H[Build proxy tokens]
G --> I{Resolved ProxyCommand?}
I -->|Yes| J[Spawn ProxyCommand]
I -->|No| K{Resolved or stored ProxyJump?}
K -->|Yes| L[Spawn ProxyJump]
K -->|No| M[Connect directly]
Prompt To Fix All With AI
### Issue 1
apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.ts:121
**Stored ProxyJump Is Overridden**
For a typed connection with an explicitly stored `proxyJump`, a wildcard or system `ProxyCommand` returned by the new `ssh -G` lookup now wins because transport selection checks `proxyCommand` first. The connection is routed through the system command instead of the machine-specific jump host. Preserve the explicit connection setting鈥檚 precedence or define and test the intended override behavior.
### Issue 2
apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.ts:88
**SSH Config Resolves Twice**
Agent-authenticated typed hosts now run the same `ssh -G <host>` lookup twice in sequence: once here for proxy settings and again through `resolveManualAgentSshConfig` for authentication. Each subprocess has a ten-second timeout, so a slow or failing resolver can add another full timeout to connection setup. Reuse the first result in the authentication path instead of resolving the same host again.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "run ssh -G for typed hosts so system Pro..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| let cleanup = () => {}; | ||
| const tokens: ProxyTokens = { host, port, username, originalHost: alias ?? base.host }; | ||
| const proxyCommand = alias ? resolved?.proxyCommand : undefined; | ||
| const proxyCommand = resolved?.proxyCommand; |
There was a problem hiding this comment.
For a typed connection with an explicitly stored proxyJump, a wildcard or system ProxyCommand returned by the new ssh -G lookup now wins because transport selection checks proxyCommand first. The connection is routed through the system command instead of the machine-specific jump host. Preserve the explicit connection setting鈥檚 precedence or define and test the intended override behavior.
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.ts
Line: 121
Comment:
**Stored ProxyJump Is Overridden**
For a typed connection with an explicitly stored `proxyJump`, a wildcard or system `ProxyCommand` returned by the new `ssh -G` lookup now wins because transport selection checks `proxyCommand` first. The connection is routed through the system command instead of the machine-specific jump host. Preserve the explicit connection setting鈥檚 precedence or define and test the intended override behavior.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.| const resolved = alias ? await deps.resolveSshConfig(alias) : undefined; | ||
| const resolved = alias | ||
| ? await deps.resolveSshConfig(alias) | ||
| : await deps.resolveSshConfig(base.host).catch(() => undefined); |
There was a problem hiding this comment.
Agent-authenticated typed hosts now run the same ssh -G <host> lookup twice in sequence: once here for proxy settings and again through resolveManualAgentSshConfig for authentication. Each subprocess has a ten-second timeout, so a slow or failing resolver can add another full timeout to connection setup. Reuse the first result in the authentication path instead of resolving the same host again.
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/emdash-desktop/src/core/services/ssh/node/connect/resolve-ssh-connect-config.ts
Line: 88
Comment:
**SSH Config Resolves Twice**
Agent-authenticated typed hosts now run the same `ssh -G <host>` lookup twice in sequence: once here for proxy settings and again through `resolveManualAgentSshConfig` for authentication. Each subprocess has a ten-second timeout, so a slow or failing resolver can add another full timeout to connection setup. Reuse the first result in the authentication path instead of resolving the same host again.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.1 participant
summary
typed ssh hostnames without an sshConfigAlias were skipping
ssh -G, so wildcard / systemProxyCommandnever applied and the client tried to resolve the hostname locally (ENOTFOUND).this still uses the stored host/port/user instead of rewriting them from config.
ssh -Gis only used for proxy settings.closes #2729
test plan
Host */ wildcardProxyCommandin~/.ssh/configand connect-Gpnpm --dir apps/emdash-desktop exec vitest run src/core/services/ssh/node/connect/resolve-ssh-connect-config.test.ts