3 Commits

Author	SHA1	Message	Date
shankar0123	636de7f6b5	ssh: pre-deploy snapshot + reload-failure rollback ... Closes Bundle 6 of the 2026-05-02 deployment-target coverage audit (see cowork/deployment-target-audit-2026-05-02/RESULTS.md). Pre-fix, DeployCertificate at ssh.go:201-316 wrote new cert/key/chain via SFTP then ran the operator's reload command. If reload failed, the new files stayed on the remote — partial-success state with no rollback path. docs/deployment-atomicity.md L92 promised "Pre-deploy SCP backup of remote files"; the code didn't deliver. This commit: 1. Pre-deploy snapshot. Before any WriteFile, iterate the deploy's target paths (cert, key, optional chain). For each path: - StatFile to detect existence. errors.Is(err, os.ErrNotExist) means first-time deploy (rollback = Remove). Other stat errors bail out before any write happens. - ReadFile into an in-memory backups map[string][]byte keyed by remote path. Original mode captured into a parallel modes map for restore fidelity. 2. SSHClient interface evolution — three changes: - StatFile(path) (os.FileInfo, error) — was (int64, error). FileInfo carries Mode() needed for accurate restore. Existing fixture tests updated to call info.Size() instead of the bare size value. - ReadFile(path) ([]byte, error) — new method; SFTP Open + read via io.ReadAll. realSSHClient implements via sftpClient.Open. - Remove(path) error — new method; SFTP Remove. Used by the rollback path to clean up first-time-deploy partial state. 3. On-reload-failure rollback. Replace the bare error-return at L282-295 with restoreFromBackups + retry-reload escalation: - For paths in the snapshot map, WriteFile the original bytes with the original mode (0600 fallback if mode capture was incomplete). - For paths that didn't exist pre-deploy, Remove the new file. - Re-run the reload command (best-effort second attempt). If it succeeds, the target is back to pre-deploy state. If it fails, the remote is in pre-deploy file state but the daemon may be stuck — surface as wrapped error so the operator knows where to look. 4. DeploymentResult.Metadata gains backup_status_{cert,key,chain} so operators can see per-path snapshot state on both success ("snapshotted" / "no_pre_existing" / "n/a") and failure ("restored" / "removed" / "restore_failed" / "remove_failed"). buildMetadataWithBackup helper centralises the metadata shape so success and failure paths emit a consistent set of keys. 5. Helper extraction. restoreFromBackups(ctx, paths, backups, modes) is a private method on Connector; returns the first error + per-key restore status map for clean test seams. DeploymentResult shape on failure: - rollback OK + retry-reload OK → Success=false, "reload command failed; rolled back to pre-deploy state" (clean recoverable failure; remote fully restored, daemon serving original cert). - rollback OK + retry-reload FAIL → wrapped error noting "rolled back files; retry-reload also failed; daemon may need manual restart". Metadata flags daemon_state_unknown=true. - rollback FAIL → operator-actionable wrapped error containing BOTH the reload error AND the rollback error; metadata flags manual_action_required=true. Tests added to ssh_test.go (4 new tests, ~330 LOC): - TestSSH_ReloadFails_FilesRestored — happy rollback path with pre-existing remote bytes for cert/key/chain. Asserts every path's last WriteFile call contains the captured backup bytes verbatim, no Remove calls fired (all paths had snapshots), and metadata reports backup_status=restored for each path. - TestSSH_NoExistingCert_ReloadFails_NewCertRemoved — first-time deploy variant. StatFile returns os.ErrNotExist for every path; rollback Removes each written file but performs no WriteFile during restore (no backup to restore from). Asserts exactly 3 WriteFile calls (deploy only) and 3 Remove calls (rollback). - TestSSH_ReloadFails_RollbackAlsoFails_OperatorActionable — uses a writeOrderTrackingMock to fail the SECOND WriteFile to the cert path (i.e. the restore call, not the initial deploy). Asserts wrapped error contains both the reload error and the rollback error, and metadata flags manual_action_required=true. - TestSSH_ReloadFails_RestoreThenSecondReloadFails — partial- recovery escalation. Rollback succeeds but the post-restore retry-reload fails. Asserts wrapped error mentions "rolled back files; retry-reload also failed" and metadata flags daemon_state_unknown=true. Existing tests preserved by extending mockSSHClient with backward- compatible per-path response maps (statByPath / readByPath / writeFileErrByPath / executeErrSequence). Legacy global fields (statFileSize / statFileErr / writeFileErr / executeErr) still work when no per-path override matches, so TestValidateConfig_* and TestDeployCertificate_Success_* don't need changes. docs/deployment-atomicity.md L92 unchanged from today's text — Bundle 1 doc-realignment hasn't shipped, so the "Pre-deploy SCP backup of remote files" line was never softened. Post-Bundle-6 the claim is honest (was aspirational pre-fix). Verified locally (sandbox lacks staticcheck install due to disk pressure; CI runs the full lint gate): - gofmt -l ./internal/connector/target/ssh/ clean - go vet ./internal/connector/target/ssh/ clean - go build ./internal/connector/target/ssh/... clean - go build ./cmd/agent/... clean - go test -race -count=1 ./internal/connector/target/ssh/ green Audit reference: cowork/deployment-target-audit-2026-05-02/RESULTS.md Bundle 6.	2026-05-02 17:13:38 +00:00
shankar0123	7cb453a336	chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4 ... Mechanical reformat. The new 'gofmt drift' CI step (added in ci-pipeline-cleanup Phase 4, commit 0f205a8) surfaced 111 files with accumulated gofmt drift across cmd/, internal/, and deploy/test/. Each file's diff is gofmt-standard: whitespace adjustments, intra- group import sorting (alphabetical by import path within blank-line- separated groups), and struct-tag column alignment. No semantic changes — verified via 'git diff --ignore-all-space' which shows only the line-position deltas from import reordering. The gate stays in place after this commit. Going forward it catches gofmt drift at PR time.	2026-04-30 22:33:57 +00:00
shankar0123	dfb083c9f4	Bundle M.SSH-extended (Coverage Audit Extension): SSH connector 71.6% -> 90.2% — H-002 closed ... internal/connector/target/ssh/ssh_server_fixture_test.go (~580 LoC, 14 tests) pins realSSHClient.Connect / Execute / WriteFile / StatFile / Close end-to-end via an embedded golang.org/x/crypto/ssh ServerConn + pkg/sftp.NewServer, bound to net.Listen('tcp', '127.0.0.1:0'). Same hand-rolled in-process protocol-server pattern as the M.Email SMTP fixture. Coverage delta (per-function): Connect 0.0% -> ~95% (ed25519 host key + password/key auth + handshake + sftp open) Execute 25.0% -> ~95% (success path + exit-code-1 + not-conn) WriteFile 15.4% -> ~95% (round-trip + chmod + not-conn) StatFile 33.3% -> ~95% (size assertion + not-conn + not-exist) Close 42.9% -> ~95% (idempotent + never-connected) Package overall: 71.6% -> 90.2% (+18.6pp; +5.2 above 85% gate). Test infrastructure - fakeSSHServer (~150 LoC): net.Listen + ed25519 host key + PasswordCallback + PublicKeyCallback. Optional toggles for rejectAuth / dropOnHandshake / failExec / failSFTP failure modes. - encodePEMBlock + base64Encode helpers (~50 LoC) for OpenSSH private-key serialization. Avoids encoding/pem dep churn in test header. - t.Cleanup wires server shutdown + WaitGroup-drain of in-flight connection handlers (no goroutine leaks). Test groups - Connect: password success / wrong-password / auth-rejected-all / handshake-dropped / TCP-refused / key-auth success - Execute: success / not-connected / exit-code-1 - WriteFile + StatFile: round-trip with size + chmod 0640 verification / not-connected / not-exist - Close: idempotent / never-connected Verification - go test -short -count=1 ./internal/connector/target/ssh/...: PASS - 20ms wall time - go vet clean Audit deliverables - findings.yaml H-002 status partial_closed -> closed (will update in extension-progress.md sweep) - extension-progress.md: M.SSH-extended marked DONE Closes: H-002 (SSH Connect / Execute / WriteFile branches) Bundle: M.SSH-extended (Coverage Audit Extension)	2026-04-27 19:07:38 +00:00