feat: implement credential persistence architecture (stages 1-5) - #57
Open
wentf9 wants to merge 52 commits into
Open
feat: implement credential persistence architecture (stages 1-5)#57wentf9 wants to merge 52 commits into
wentf9 wants to merge 52 commits into
Conversation
…solution - Implement EnsureNodeContext with explicit user/port matching and host reuse - Isolate credentials per identity while inheriting unique host ProxyJump - Detect ambiguous nodes and conflicting proxy jump configurations - Support direct IP, FQDN, and host:port jumps with or without ~/.ssh/config - Unify SSH, SFTP, SCP, and Exec target parsing with flag-over-arg precedence - Sync i18n messages, CLI help texts, README documentation, and unit tests
….0 (#56) Bumps [github.com/charmbracelet/x/conpty](https://github.com/charmbracelet/x) from 0.1.0 to 0.2.0. - [Commits](charmbracelet/x@v0.1.0...ansi/v0.2.0) --- updated-dependencies: - dependency-name: github.com/charmbracelet/x/conpty dependency-version: 0.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…s in target resolution - preserve consistent non-default port and inherited ProxyJump when resolving candidates with changed user - report AmbiguousNodeError when candidate ports are inconsistent upon user change without explicit port - retain unique non-default port when overriding user on jump aliases - preserve OpenSSH resolution semantics for OpenSSH-prefixed jumps to avoid shadowing by local aliases - add comprehensive unit and command-layer tests for edge cases
…rectory sync failure
…cation assertions
…orwarder error handler
…ce detector overhead
…cture - Implement macOS Security framework non-interactive access controls via SecKeychainSetUserInteractionAllowed(0) - Accurately isolate target keychain vs default keychain in search list queries and lock status checks - Preserve non-not-found native query errors (errSecAuthFailed, errSecIO) instead of swallowing as not-found - Implement fail-closed store protection to prevent item shadowing when search list contains locked keychains - Add comprehensive Darwin unit and native integration tests covering lock/unlock, ACL denied, and in-flight timeout/cancel - Align mock search list targets with mocked keychains and assert modify API invocations - Provide Docker-OSX local virtualization environment and native platform verification script
… consistency in stage 5
wentf9
changed the title
…ayer to prevent premature GC
…ref unreferenced state
在 CI headless Linux 环境（无 D-Bus/DISPLAY/WAYLAND_DISPLAY）中， credentialConfigOrDefault 会将默认 store 设为 system，导致 checkPlatformSystemAvailability 检测失败并返回 ErrCredentialStoreUnavailable。 受影响的三个测试： - TestCredentialGC (cmd/credential_test.go) - TestCommands_ExecUsesPerHostSessionPassword (cmd/connection_target_test.go) - TestCommands_ExecTagUsesExplicitSessionCredentials (cmd/connection_target_test.go) 修复：在测试配置中显式设置 Credential 字段使用 none store， 隔离测试对系统凭据库的隐式依赖，确保 CI 环境可复现运行。
… metadata support
Use schema v2 defaults and integrate credential references across CLI and TUI workflows. Defer remember prompts until new credentials are authenticated, make inventory credential creation atomic, and journal asset deletion cleanup for recovery. Add legacy compatibility guidance, authentication diagnostics, and regression coverage.
Implement versioned vault formats, isolated KDF sessions, durable maintenance and recovery, and configuration and CLI integration. Include regression tests, independent vectors, and offline backup verification. Record outstanding deployment and power-loss release validation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements the credential persistence, platform helpers, and lifecycle management architecture across Stages 1 through 5:
• Stage 1 (Provider Separation & Memory Safety):
• Split SSH credential provider contracts (
ssh.CredentialProvider) and decouple credential loading from session execution.• Limit plaintext secret lifetime with bounded memory exposure and explicit zeroing semantics.
• Stage 2 (Reference Model & Registry):
• Add uniform credential reference model (
StoreReference) and store registry.• Characterize persistence behavior with comprehensive unit and regression tests.
• Stage 3 (Journal & In-memory Caching):
• Add atomic credential recovery journal (
journal.go) with directory sync, fsync, and corruption recovery.• Implement bounded concurrency-safe credential caching with generation tracking and inflight read fencing.
• Stage 4 (Controlled Helpers & Platform Isolation):
• Implement controlled subprocess helper protocol (
internal/credentialhelper) with strict JSON frame validation, 64KB I/O bounds, and error classification.• Support cross-platform native storage:
• Linux: Secret Service API with fail-closed headless/no-D-Bus handling.
• macOS: Native Keychain Services via purego/C API bindings, supporting raw binary secrets and trailing newline fidelity without command line leakage.
• Windows: Win32 Credential Manager (
CredReadW/CredWriteW/CredDeleteW) isolated inside suspended Job Objects for guaranteed process-tree cleanup and cancellation support.• Pass / External Helpers: Standard Unix pass store and standard git-credential-style helper integration.
• Introduce
scripts/verify_native_platform.shfor strict native verification with zero-bypass exit code assertions.• Add macOS and Windows CI workflows in
.github/workflows/ci.yml.• Stage 5 (Lifecycle Management, Durability Verification, Crash Recovery & Garbage Collection):
• Safe Credential Rotation & Deletion with strict Durability Verification (
ConfirmRefDurablewith physical directory/storage sync).• Distinguish active vs stale memory snapshots across repository instances in
CheckRefUnreferenced.• Crash recovery and garbage collection protocol preserving cleanup journals upon unconfirmed durability.
• Comprehensive fault injection tests simulating crash at intent, pre-write, written-uncommitted, and committed-unclean states.
User impact
Enables enterprise-grade, secure, transparent, and cross-platform credential storage (System Keychain / Credential Manager / Secret Service / Pass) for SSH/SFTP connections, preventing plaintext passwords and keys from being saved directly in configuration files or lingering indefinitely in memory.
Validation
•
go build ./...•
GOOS=windows go build ./...•
GOOS=darwin go build ./...•
go test -race ./...•
golangci-lint run ./...(0 issues)• GitHub Actions CI: Linux, macOS, and Windows passing