pi awaits session_start before the agent loop accepts input, so a blocking
ssh call there presents as "TUI is up but prompts are silently ignored".
The remote pwd probe and ControlMaster start had no ConnectTimeout, no
BatchMode, and no wall-clock cap, so an unreachable host (classic case:
`pi-dev --ssh <lan-host>` runs pi *inside* the devbox container, which has
no route to LAN hosts without a ProxyJump) blocked startup on the OS TCP
timeout (~75s+) while silently swallowing keystrokes.
Hardening:
- CONNECT_OPTS (ConnectTimeout=8 + ServerAlive keepalives) on every ssh
invocation: pwd probe, master start (both key and password paths),
sshExec, and bash exec.
- run() gains a timeoutMs option (kills child + rejects); pwd probe and both
master-start paths bounded by STARTUP_TIMEOUT_MS (15s).
- BATCH_OPTS (BatchMode=yes) on key-auth calls so ssh never waits on a
/dev/tty password/passphrase/host-key prompt behind the TUI; omitted under
--ssh-ask-pass so the SSH_ASKPASS path still works. askPass flag is now
read before the probe to pick the right opts.
- Probe failure sets an "unreachable" status + error toast and returns,
instead of throwing an unhandled rejection from the handler.
Docs: README "How it works" + AGENTS.md technical note updated.
joakimp
aaa7d906df