Repository navigation
fleet(proxy ssh): recovery SSH paths use literal ~ (passwd home) instead of Fleet's HOME — known-hosts, identity and ControlPath resolve to the wrong directory #6680
Description
Finding (from PR review)
fleet proxy ssh (the recovery verb added by PR #6403) builds its known-hosts, identity, and ControlPath arguments from literal ~ paths, which OpenSSH expands from the account database home (getpwuid() / pw_dir), not from Fleet's $HOME-based home — so when the two differ, recovery authentication / strict host-key checking fails and the shared control socket is missed.
Reviewer chatgpt-codex-connector[bot] (Codex, P2) on PR #6403, 2026-11-06T00:49:20Z:
#6403 (comment)
"Resolve recovery SSH paths from Fleet's HOME — When
$HOMEdiffers from the account database home, these literal~paths select the wrong known-hosts and identity files: OpenSSH's tilde expansion implementation usesgetpwuid()andpw_dir, not$HOME. This causes recovery authentication or strict host-key checking to fail even when the required files exist under Fleet's home directory, and the similarly constructed ControlPath misses its shared socket. Fleet configuration already resolves from$HOME(fleet-config/src/lib.rs:225-226), and the existing SSH integration explicitly constructs these paths from$HOME(fleet-search/src/client.rs:182-197). Resolve all three paths consistently before constructing the SSH arguments."
Source PR: #6403 feat(fleet): add proxy ssh recovery verb (open; parent design issue #5697 does not cover this defect — dedupe searched by PR number, "known_hosts_laptop", "proxy ssh", and HOME/tilde keywords: no existing issue covers it).
No-response evidence
- The comment is now over 24 hours old (grace period for open PRs passed; first flagged by pr-comment-review 2026-11-06 15:54 CST, rechecked this run).
- No replies in the thread; the review thread is unresolved (GraphQL
reviewThreadsverified this run). - PR head is unchanged since the review: single commit
2817c11837(2026-11-06T00:42:38Z, before the comment); no fix commit followed.
Still-live evidence (verified on PR head 2817c11837 this run)
pkgs/fleet/crates/fleet/src/main.rs on the PR head, fresh gh api raw read — all three literal tilde paths present verbatim in build_proxy_ssh_argv:
- Line 702:
"UserKnownHostsFile=~/.ssh/known_hosts_laptop" - Line 706:
"~/.ssh/id_ed25519"(the-iidentity argument) - Line 718:
"ControlPath=~/.ssh/cm-%r@%h:%p"
The argv-builder tests on the same head (lines ~1066-1081) assert these literal ~ strings, so the current tests pin the defective behavior.
Acceptance criteria
- All three paths (known-hosts file, identity file, ControlPath) are resolved from Fleet's home (the same
$HOME-based resolutionfleet-configuses) before the SSH arguments are constructed — no literal~is passed to OpenSSH for these. - Tests updated/added: argv built with a Fleet home that differs from the passwd home contains the Fleet-home absolute paths for all three.
- Or: resolve this issue by a documented decision explaining why passwd-home expansion is intentional for the recovery path.
Activity
developing-today commentedon Nov 7, 2026
CODE-2071
dezren39 commentedon Nov 7, 2026
🤖 Agent note · filed
dezren39 commentedon Nov 7, 2026
Picked up by repo-worker-code-t (Lane T, fallback mode — queue backend down, fleet queue health 503 PostgREST PGRST002). Triage of #6680: revalidating the Codex P2 finding against PR #6403 head and current fleet home-resolution code first.
🤖 Agent note · picked up
11 remaining items
dezren39 commentedon Nov 7, 2026
Progress from repo-worker-code-r: verified — PR #6403 still open at head 2817c11, branch worktree ~/git/fleet/fb-6680 created on laptop; build_proxy_ssh_argv literals confirmed at main.rs:702/706/718; fleet-config home_dir() is private ($HOME-based, lib.rs:225-226). Next: implement — public Config::home_dir() accessor, argv builder resolves the three paths from Fleet home, pinned tests updated + differing-home acceptance case.
dezren39 commentedon Nov 7, 2026
Progress from repo-worker-code-r: implementation_complete on laptop worktree ~/git/fleet/fb-6680 (branch queue/10604-5697-proxy-ssh): Config::home_dir() exposed in fleet-config; build_proxy_ssh_argv resolves known-hosts/identity/ControlPath from Fleet home via a home-parameterized builder; unit pinned-argv test and the exec integration test (HOME='home with spaces', not the passwd home) updated to assert Fleet-home absolute paths and zero literal ~ in argv. Targeted tests pass (unit 3/3, integration 1/1). Next: full fleet + fleet-config suites, then commit + push to PR #6403's branch.
fix(fleet): resolve proxy ssh recovery paths from Fleet home, not lit…
dezren39 commentedon Nov 7, 2026
Fixed — commit
bb71f3d97fpushed to PR #6403's branchqueue/10604-5697-proxy-ssh.fleet-config: new publicConfig::home_dir()exposing the existing$HOME-based home resolution (lib.rs).fleet(build_proxy_ssh_argv): all three recovery paths —UserKnownHostsFile, the-iidentity, andControlPath— are now built from Fleet's home via a home-parameterized builder (the samehome.join(".ssh/…")construction fleet-search's client uses). No literal~reaches OpenSSH./fleet-home(≠ passwd home) and asserts the three absolute paths plus zero~in argv; the exec integration test (tests/proxy_ssh.rs, which already ran the verb withHOME=<tmp>/home with spaces) asserts the same against the captured real ssh argv.cargo test -p fleet-config -p fleet— full crates green (proxy_ssh unit 3/3, integration 1/1, fleet-config 16/16); changed files rustfmt-clean. Codex P2 thread dispositioned in place: reply feat(fleet): add proxy ssh recovery verb #6403 (comment)bb71f3d97fwas still pending (basic checks queued) at close-out after a 5-minute poll; the commit is verified by the full local crate suites above. PR feat(fleet): add proxy ssh recovery verb #6403 merges under its own lifecycle.Worked by repo-worker-code-r (lane R), fallback mode (queue backend down).
dezren39 commentedon Nov 7, 2026
Released by repo-worker-code-r (outcome: done). Fix landed as commit bb71f3d on PR #6403's branch queue/10604-5697-proxy-ssh: Config::home_dir() exposed in fleet-config; build_proxy_ssh_argv resolves UserKnownHostsFile / identity / ControlPath from Fleet's $HOME-based home; unit + exec integration tests assert Fleet-home paths with a non-passwd home and zero literal ~. Full fleet-config + fleet suites green on laptop; Codex P2 thread replied (r4499704695). PR #6403 CI still pending at release (queued basic checks); PR merges under its own lifecycle. Issue #6680 closed as completed.