Repository navigation
fix(sdk): preserve safe SSH profile metadata from host - #76
Conversation
Validate optional profile details while retaining older host compatibility. Exclude credentials and secret references from returned summaries. Align Git profile reuse documentation with current host behavior.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Coverage Report
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0b1c469f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ## SSH | ||
|
|
||
| `ssh.listProfiles()` returns authorized `{ id, label }` summaries. `ssh.exec({ profileId, command, timeoutMs?, maxOutputBytes? })` executes one noninteractive remote shell command. Defaults are a 30-second command deadline and 1 MiB combined stdout/stderr capture. The host may impose lower ceilings. Results contain `stdout`, `stderr`, `exitCode`, `signal`, `durationMs`, and `truncated`. A nonzero remote exit is a successful transport result; transport and service failures reject. | ||
| `ssh.listProfiles()` returns command-authorized profile summaries with `id` and `label`, plus optional `host`, `port`, `username`, `authenticationType` (`password` or `privateKey`) and `trustedHostKey`. Each optional field is validated independently and absent on older hosts. Credentials, secret reference keys, authentication objects and command policies are excluded by the SDK allowlist. Listing still requires only `ssh.use` + `ssh.profiles.list`, with no new permission or secret read grant. The fingerprint is public trust metadata, not a private key. These summaries are not an inventory of Git-only profiles: the current host filters this action to the `ssh.exec` consumer. `ssh.exec({ profileId, command, timeoutMs?, maxOutputBytes? })` executes one noninteractive remote shell command. Defaults are a 30-second command deadline and 1 MiB combined stdout/stderr capture. The host may impose lower ceilings. Results contain `stdout`, `stderr`, `exitCode`, `signal`, `durationMs`, and `truncated`. A nonzero remote exit is a successful transport result; transport and service failures reject. |
There was a problem hiding this comment.
The capability table at docs/SECRETS_AND_SSH.md:21 still defines ssh.profiles.list as returning only profile IDs and labels, while this new contract exposes host, port, username, authentication type, and host-key fingerprint under the same grant. Host implementers and consent UI generated from the concise capability definition can therefore omit the new fields or inaccurately describe the metadata disclosed to plugins; update that capability entry to match the expanded result.
Useful? React with 👍 / 👎.
1 participant
Validate optional profile details while retaining older host compatibility. Exclude credentials and secret references from returned summaries. Align Git profile reuse documentation with current host behavior.