cmux ssh: security hardening from the ssh audit

.github/workflows/cmux-tui-build-package.yml

@@ -611,9 +611,13 @@ jobs:
       - name: Build npm package directories
         if: inputs.package_npm
         run: |
+          # The build jobs stamp this same checkout's HEAD as
+          # CMUX_TUI_BUILD_COMMIT; the SSH bootstrap accepts the pinned
+          # remote-binary digests only for that build identity.
           python3 cmux-tui/dist/scripts/package_npm.py \
             --binaries-dir dist/binaries \
             --version "$NPM_VERSION" \
+            --build-commit "$(git rev-parse HEAD)" \
             ${{ inputs.include_windows && '--include-windows' || '' }} \
             --out dist/npm-packages
 

CLI/CMUXCLI+SSHStartupScripts.swift

@@ -9,7 +9,8 @@ extension CMUXCLI {
         isShellSnippet: Bool = false,
         passwordCredential: String? = nil,
         controlPathPreflightShellFunction: String? = nil,
-        reconnectLimitDefault: Int = 20
+        reconnectLimitDefault: Int = 20,
+        launchScripts: SSHStartupLaunchScripts
     ) throws -> String {
         let script = buildSSHStartupScriptBody(
             sshCommand: sshCommand,
@@ -21,7 +22,7 @@ extension CMUXCLI {
             oneTimeCommand: nil,
             reconnectLimitDefault: reconnectLimitDefault
         )
-        return try writeSSHStartupScript(script, remoteRelayPort: remoteRelayPort)
+        return try writeSSHStartupScript(script, remoteRelayPort: remoteRelayPort, launchScripts: launchScripts)
     }
 
     func buildReusableSSHStartupCommand(
@@ -423,13 +424,12 @@ extension CMUXCLI {
         ]
         return scriptLines.joined(separator: "\n")
     }
-    private func writeSSHStartupScript(_ scriptBody: String, remoteRelayPort: Int) throws -> String {
-        let scriptURL = FileManager.default.temporaryDirectory.appendingPathComponent(
-            "cmux-ssh-startup-\(remoteRelayPort)-\(UUID().uuidString.lowercased()).sh"
-        )
-        let script = "#!/bin/sh\n\(scriptBody)\n"
-        try script.write(to: scriptURL, atomically: true, encoding: .utf8)
-        try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: scriptURL.path)
+    private func writeSSHStartupScript(
+        _ scriptBody: String,
+        remoteRelayPort: Int,
+        launchScripts: SSHStartupLaunchScripts
+    ) throws -> String {
+        let scriptURL = try launchScripts.write(scriptBody: scriptBody, remoteRelayPort: remoteRelayPort)
         return shellQuote(scriptURL.path)
     }
     private func reusableShellStartupCommand(

CLI/SSHPTYAttachReconnectInputFilter.swift

@@ -104,6 +104,7 @@ final class SSHPTYAttachReconnectInputFilter {
         var reconnectInputFilter = reconnectInputFilterState.map(SSHPTYAttachReconnectInputFilter.init(state:))
         var stopSignalFD = initialStopSignalFD
         var stopAcknowledgementFD = initialStopAcknowledgementFD
+        var reconnectStopAcknowledged = false
         var buffer = [UInt8](repeating: 0, count: 8192)
         defer {
             if let stopSignalFD {
@@ -164,6 +165,15 @@ final class SSHPTYAttachReconnectInputFilter {
             defer {
                 acknowledgeStopFiltering()
                 closeStopSignal()
+                reconnectStopAcknowledged = true
+            }
+            // Callers flush pending probe bytes before stopping, so only a
+            // clipboard reply that is mid-discard can remain. Keep routing
+            // input through the filter until that reply's terminator (or the
+            // reconnect deadline) so its tail never reaches the remote PTY.
+            if let filter = reconnectInputFilter {
+                _ = filter.stopFiltering()
+                if filter.isFilteringActive { return true }
             }
             reconnectInputFilter = nil
             return true
@@ -172,13 +182,14 @@ final class SSHPTYAttachReconnectInputFilter {
         func finishStdin() {
             // Reconnect input can disappear with the old bridge during wake.
             // It is not an intentional EOF for the newly attached remote PTY.
-            guard reconnectInputFilter == nil else { return }
+            guard reconnectInputFilter == nil || reconnectStopAcknowledged else { return }
             _ = shutdown(fd, SHUT_WR)
         }
 
         func stopReconnectFilteringAtDeadline() async -> Bool {
             guard let filter = reconnectInputFilter else { return true }
-            guard await writeOrShutdown(filter.stopFiltering()) else { return false }
+            guard await writeOrShutdown(filter.stopFilteringAtDeadline()) else { return false }
+            reconnectInputFilter = nil
             return stopReconnectFiltering()
         }
 
@@ -273,7 +284,7 @@ final class SSHPTYAttachReconnectInputFilter {
 
     func filter(_ data: Data) -> Data {
         if isDeadlineReached {
-            var output = stopFiltering()
+            var output = stopFilteringAtDeadline()
             output.append(data)
             return output
         }
@@ -288,6 +299,10 @@ final class SSHPTYAttachReconnectInputFilter {
         byteFilter.stopFiltering()
     }
 
+    func stopFilteringAtDeadline() -> Data {
+        byteFilter.stopFilteringAtDeadline()
+    }
+
     var hasPendingInput: Bool {
         byteFilter.hasPendingInput
     }