Enable SSH remotes in CLI, TUI, and desktop while keeping iPhone opt-in #117

New Issue

hugo · 2026-08-24T20:17:07Z

hugo commented

2026-08-24 20:17:07 +00:00

Goal

Ship the optional SSH transport as normal functionality in the CLI, TUI, and Iced desktop application, while the default iPhone/Apple build remains free of SSH code and setup.

Scope

Enable the storage ssh Cargo feature explicitly in apps/cli, apps/tui, and apps/desktop so their ordinary development and release artifacts support SSH without an extra build flag.
Keep crates/apple and the iPhone Xcode/Rust build on storage without ssh by default. Do not add SSH onboarding, key import, host trust, or agent assumptions to the iPhone UI in this milestone.
Make the Apple feature choice explicit enough that a later opt-in is possible without changing the storage protocol contract. A default Apple build that encounters an SSH remote must return/present a typed unsupported-transport state before connection work; HTTPS remains unchanged.
Route existing CLI/TUI/desktop Fetch, Pull, Push, Sync, branch discovery, clone, progress, cancellation, conflict, and status surfaces through storage transport selection without duplicating SSH rules.
Accept and display both ssh:// and scp-like remote spellings in remote/configuration surfaces. Never parse them in a frontend or derive transport from a label.
Add native terminal/desktop flows for encrypted-key passphrase requests and unknown-host fingerprint confirmation. Changed host keys must be a non-bypassable error.
Keep passphrases out of command arguments/history and prevent secret/key bytes from appearing in TUI scrollback, desktop state/debug output, notifications, or clipboard.
Present transport-neutral wording where an action works for HTTPS and SSH, and transport-specific actionable errors only from typed storage state.
Update packaging, help, examples, configuration, synchronization, secure-storage, and frontend testing documentation.

Tests and verification

Add frontend tests for SSH remote selection, progress, cancellation, host confirmation, encrypted-key prompt, authentication failure, changed host key, conflict, and success without frontend-owned protocol logic.
Inspect feature graphs/artifacts to prove CLI/TUI/desktop include russh by default and the default iPhone/Apple static library does not.
Build the normal CLI, TUI, desktop, packaging path, and Apple simulator target. Install over the existing simulator app if runtime validation is needed; do not reset simulator state.
Verify HTTPS flows still work in every affected frontend.
Run all repository-required Rust gates plus required Apple generation/simulator gates for Apple build-graph changes.

Acceptance criteria

Standard CLI, TUI, and desktop builds can configure and use either requested SSH URL spelling with every existing Git remote action.
The default iPhone build contains no SSH dependency/code path or SSH setup UI and continues to support HTTPS.
Host trust and key prompts are explicit, cancellable, secret-safe, and driven by typed storage APIs.
No frontend contains URL parsing, key policy, known-hosts policy, pack protocol, or remote-command construction.

Depends on complete SSH upload-pack and receive-pack support in this milestone.

## Goal Ship the optional SSH transport as normal functionality in the CLI, TUI, and Iced desktop application, while the default iPhone/Apple build remains free of SSH code and setup. ## Scope - Enable the storage `ssh` Cargo feature explicitly in `apps/cli`, `apps/tui`, and `apps/desktop` so their ordinary development and release artifacts support SSH without an extra build flag. - Keep `crates/apple` and the iPhone Xcode/Rust build on storage without `ssh` by default. Do not add SSH onboarding, key import, host trust, or agent assumptions to the iPhone UI in this milestone. - Make the Apple feature choice explicit enough that a later opt-in is possible without changing the storage protocol contract. A default Apple build that encounters an SSH remote must return/present a typed unsupported-transport state before connection work; HTTPS remains unchanged. - Route existing CLI/TUI/desktop Fetch, Pull, Push, Sync, branch discovery, clone, progress, cancellation, conflict, and status surfaces through storage transport selection without duplicating SSH rules. - Accept and display both `ssh://` and scp-like remote spellings in remote/configuration surfaces. Never parse them in a frontend or derive transport from a label. - Add native terminal/desktop flows for encrypted-key passphrase requests and unknown-host fingerprint confirmation. Changed host keys must be a non-bypassable error. - Keep passphrases out of command arguments/history and prevent secret/key bytes from appearing in TUI scrollback, desktop state/debug output, notifications, or clipboard. - Present transport-neutral wording where an action works for HTTPS and SSH, and transport-specific actionable errors only from typed storage state. - Update packaging, help, examples, configuration, synchronization, secure-storage, and frontend testing documentation. ## Tests and verification - Add frontend tests for SSH remote selection, progress, cancellation, host confirmation, encrypted-key prompt, authentication failure, changed host key, conflict, and success without frontend-owned protocol logic. - Inspect feature graphs/artifacts to prove CLI/TUI/desktop include `russh` by default and the default iPhone/Apple static library does not. - Build the normal CLI, TUI, desktop, packaging path, and Apple simulator target. Install over the existing simulator app if runtime validation is needed; do not reset simulator state. - Verify HTTPS flows still work in every affected frontend. - Run all repository-required Rust gates plus required Apple generation/simulator gates for Apple build-graph changes. ## Acceptance criteria - Standard CLI, TUI, and desktop builds can configure and use either requested SSH URL spelling with every existing Git remote action. - The default iPhone build contains no SSH dependency/code path or SSH setup UI and continues to support HTTPS. - Host trust and key prompts are explicit, cancellable, secret-safe, and driven by typed storage APIs. - No frontend contains URL parsing, key policy, known-hosts policy, pack protocol, or remote-command construction. Depends on complete SSH upload-pack and receive-pack support in this milestone.

hugo added this to the 07 - Pure-Rust Git-over-SSH remotes milestone 2026-08-24 20:17:07 +00:00

hugo added the enhancement label 2026-08-24 20:17:07 +00:00

hugo referenced this issue

2026-08-25 17:53:16 +00:00

Implement SSH identity authentication and strict host-key verification #114

hugo referenced this issue from a commit

2026-08-25 19:39:42 +00:00

Enable SSH remotes in native frontends (#117)

hugo commented

2026-08-25 19:40:05 +00:00

Implemented and pushed in commit a737e74.

Implementation:

Standard CLI, TUI, and desktop builds now enable the storage ssh feature and route Fetch, Pull, Push, Sync, status, progress, cancellation, and conflicts through typed storage transport selection.
Both ssh:// and scp-like remotes remain storage-parsed and are displayed without frontend URL parsing.
Added native, cancellable unknown-host confirmation and masked encrypted-key passphrase flows. Prompted passphrases are redacted and persisted only after successful SSH authentication. Changed host keys remain non-bypassable.
Host confirmation is storage-owned and now verifies that the observed host and port match the configured endpoint before persisting known-hosts state.
Apple explicitly uses the full storage API without ssh, preserving typed unsupported-transport behavior before connection work and leaving HTTPS unchanged.
Updated packaging, configuration, synchronization, secure-storage, CLI parity, desktop audit, README, and Apple testing documentation.

Verification:

cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace: 58 storage, 17 CLI, 102 TUI, 37 desktop, 5 Apple, and all integration/doc suites passed
Focused no-SSH storage regression passed
Isolated ironstorage-apple check passed; its feature graph contains no russh
CLI, TUI, and desktop feature graphs include russh through the explicit ssh feature
cargo bundle-macos produced the normal release IronStorage.app with CLI, TUI, and desktop binaries
xcodegen generate and the arm64 iPhone simulator build succeeded without resetting or reinstalling simulator state
Actual packaged desktop app was launched with Computer Use; Git Status rendered the transport-neutral safety text and the configured HTTPS remote as typed HTTPS, with a clean repository

Dependency advisory evidence:

cargo audit reports RUSTSEC-2023-0071 for rsa 0.9.10 and 0.10.0-rc.18, both medium severity with no fixed upgrade currently available, plus 15 allowed maintenance/unsoundness warnings. This is recorded for the dedicated compatibility/security audit in #118 rather than concealed or waived here.

No iPhone UI/source behavior changed, so no simulator state mutation or physical-device deployment was needed.

Implemented and pushed in commit a737e74. Implementation: - Standard CLI, TUI, and desktop builds now enable the storage ssh feature and route Fetch, Pull, Push, Sync, status, progress, cancellation, and conflicts through typed storage transport selection. - Both ssh:// and scp-like remotes remain storage-parsed and are displayed without frontend URL parsing. - Added native, cancellable unknown-host confirmation and masked encrypted-key passphrase flows. Prompted passphrases are redacted and persisted only after successful SSH authentication. Changed host keys remain non-bypassable. - Host confirmation is storage-owned and now verifies that the observed host and port match the configured endpoint before persisting known-hosts state. - Apple explicitly uses the full storage API without ssh, preserving typed unsupported-transport behavior before connection work and leaving HTTPS unchanged. - Updated packaging, configuration, synchronization, secure-storage, CLI parity, desktop audit, README, and Apple testing documentation. Verification: - cargo fmt --all -- --check - RUSTFLAGS="-D warnings" cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace: 58 storage, 17 CLI, 102 TUI, 37 desktop, 5 Apple, and all integration/doc suites passed - Focused no-SSH storage regression passed - Isolated ironstorage-apple check passed; its feature graph contains no russh - CLI, TUI, and desktop feature graphs include russh through the explicit ssh feature - cargo bundle-macos produced the normal release IronStorage.app with CLI, TUI, and desktop binaries - xcodegen generate and the arm64 iPhone simulator build succeeded without resetting or reinstalling simulator state - Actual packaged desktop app was launched with Computer Use; Git Status rendered the transport-neutral safety text and the configured HTTPS remote as typed HTTPS, with a clean repository Dependency advisory evidence: - cargo audit reports RUSTSEC-2023-0071 for rsa 0.9.10 and 0.10.0-rc.18, both medium severity with no fixed upgrade currently available, plus 15 allowed maintenance/unsoundness warnings. This is recorded for the dedicated compatibility/security audit in #118 rather than concealed or waived here. No iPhone UI/source behavior changed, so no simulator state mutation or physical-device deployment was needed.

hugo closed this issue

2026-08-25 19:40:05 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#117