kayg/hermternal-apple
Watch
1
0
Fork
You've already forked hermternal-apple
 0
Code Issues 44 Pull requests Projects Releases 4 Packages Wiki Activity Actions

Add an opt-in SSH operations adapter for capabilities missing from the gateway API #49

New issue
Open
opened 2026-08-23 14:30:15 +00:00 by kayg · 0 comments
kayg commented 2026-08-23 14:30:15 +00:00
Owner
Copy link

Scope

This is explicitly deferred. It is not part of the current mixed-selection/application-purge block.

Requirements

  • The gateway API is always primary. If an API capability exists, SSH is prohibited for that operation.
  • Add an optional plugin/Adapter registered at the composition-root capability seam. If it is omitted, the capability must report an explicit unavailable state.
  • Do not add scattered if sshEnabled checks or global SSH state.
  • The first version supports key-based authentication only. Credentials and private keys must be managed through macOS Keychain or the system SSH agent, never through repository configuration or logs.
  • Enforce strict host-key verification. Never use StrictHostKeyChecking=no.
  • Use a command allowlist and a structured operation interface. Never expose arbitrary shell text to views.
  • Destructive operations require one human-readable confirmation and an audit result containing host, operation, status, and no secret output.
  • Do not use SSH fallback for session purge once the gateway purge API exists.
  • Show UI progress only while a real SSH operation is in flight. Unavailable and static states are not spinners.
  • Do not connect or probe hosts on launch. Connect only when an operation is invoked.

Tests

Cover an in-memory fake Adapter, Adapter omission, host-key failure, authentication failure, command allowlist enforcement, cancellation, and output redaction.

## Scope This is explicitly deferred. It is not part of the current mixed-selection/application-purge block. ## Requirements - The gateway API is always primary. If an API capability exists, SSH is prohibited for that operation. - Add an optional plugin/Adapter registered at the composition-root capability seam. If it is omitted, the capability must report an explicit unavailable state. - Do not add scattered `if sshEnabled` checks or global SSH state. - The first version supports key-based authentication only. Credentials and private keys must be managed through macOS Keychain or the system SSH agent, never through repository configuration or logs. - Enforce strict host-key verification. Never use `StrictHostKeyChecking=no`. - Use a command allowlist and a structured operation interface. Never expose arbitrary shell text to views. - Destructive operations require one human-readable confirmation and an audit result containing host, operation, status, and no secret output. - Do not use SSH fallback for session purge once the gateway purge API exists. - Show UI progress only while a real SSH operation is in flight. Unavailable and static states are not spinners. - Do not connect or probe hosts on launch. Connect only when an operation is invoked. ## Tests Cover an in-memory fake Adapter, Adapter omission, host-key failure, authentication failure, command allowlist enforcement, cancellation, and output redaction.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
dev
feat/sidebar-selection-archive-purge
v0.0.4
v0.0.3
v0.0.2
v0.0.1
Labels
Clear labels   
delivered
Shipped and recorded in project history

  
outstanding
Not yet delivered or blocked

No labels
delivered
outstanding
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/hermternal-apple#49
No description provided.