fix(files-eic): silence ssh known-hosts warning that 500'd Hermes config load - #2822
Merged
Merged
Conversation
…fig load
GET /workspaces/:id/files/config.yaml on hongming.moleculesai.app's
Hermes workspace returned 500 with body:
ssh cat: exit status 1 (Warning: Permanently added '[127.0.0.1]:37951'
(ED25519) to the list of known hosts.)
Root cause: ssh emits the "Permanently added" notice on every fresh
tunnel connection, even with UserKnownHostsFile=/dev/null (that
prevents persistence, not the warning). It lands on stderr, fooling
readFileViaEIC's classifier:
if len(out) == 0 && stderr.Len() == 0 {
return nil, os.ErrNotExist
}
return nil, fmt.Errorf("ssh cat: %w (%s)", runErr, ...)
stderr was non-empty (the warning), so we returned the wrapped error
→ 500 from the HTTP layer instead of 404.
Fix: add `-o LogLevel=ERROR` to BOTH writeFileViaEIC and readFileViaEIC
ssh invocations. Silences info+warning while keeping real auth/tunnel
errors visible (those emit at ERROR level).
Test: TestSSHArgs_LogLevelErrorBothSites pins the flag in both blocks.
Mutation-tested: stripping the flag from one site fails the gate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
May 5, 2026 02:59
HongmingWang-Rabbit
enabled auto-merge
May 5, 2026 02:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User-reported bug
`GET /workspaces/cfc1fd02.../files/config.yaml` on hongming.moleculesai.app's Hermes workspace returned 500 with body:
```
ssh cat: exit status 1 (Warning: Permanently added '[127.0.0.1]:37951' (ED25519) to the list of known hosts.)
```
Root cause
ssh emits the "Permanently added" notice on every fresh tunnel connection, even with `UserKnownHostsFile=/dev/null` (that prevents persistence, not the warning). It lands on stderr, fooling `readFileViaEIC`'s file-not-found classifier:
```go
if len(out) == 0 && stderr.Len() == 0 {
return nil, os.ErrNotExist // → 404
}
return nil, fmt.Errorf("ssh cat: %w (%s)", runErr, ...) // → 500
```
stderr was non-empty (the warning), so we returned the wrapped error → 500 from the HTTP layer instead of 404.
Fix
Add `-o LogLevel=ERROR` to BOTH `writeFileViaEIC` and `readFileViaEIC` ssh invocations. Silences info+warning while keeping real auth/tunnel errors visible (those emit at ERROR level).
Test
`TestSSHArgs_LogLevelErrorBothSites` pins the flag in both blocks via source regex match. Mutation-tested: stripping the flag from the source fails the gate.
Sibling to my earlier #2785 (the ReadFile via SSH-EIC PR that introduced the classifier).