feat: add headless t3 connect setup for SSH hosts - #3749

💭 Looking at the prior review feedback, I need to check what's been fixed in this PR. The main issues flagged were around using the correct Effect API methods—specifically replacing catchIf and catchTag with catchTags in a few places, and addressing a detail field problem in BootServiceCommandError. I need to adjust how the repo parameter is being formatted. I'm reviewing the code and noticing that two instances of catchTag are still present in the connect.ts file—one around line 108 handling CloudCliCredentialRefreshError and another around line 407 for BootServiceUnsupportedError—both of which I'd flagged in previous runs. Since the code hasn't changed in response to those earlier comments, I shouldn't duplicate the findings. Now I need to check the CliTokenManager.ts file to see if there are any new issues there. I'm noticing the error handling approach shifted from catchIf(Cause.isTimeoutError) to catchTag("TimeoutError", ...) in the updated CliTokenManager.ts file at lines 307 and 414, which is a different pattern than what the earlier feedback suggested. Looking at the current violations across the codebase, I see catchTag being used in four places that were previously flagged—two in CliTokenManager.ts and two in connect.ts—and the guidance is clear that catchTags (plural) should be used instead, even for single tags. The question now is whether these are genuinely new violations or if they're the same issues that were already reported in the prior run. I need to figure out whether there are any new violations in the current head compared to what was already flagged. The Cause import is still being used for Cause.Done at line 64, so that earlier comment about dropping the last use of the import doesn't apply anymore. Let me check what's actually changed between the last reviewed commit and now. The prior commits aren't showing up since the branch was rebased, but the core issues remain—catchTag is still being used throughout the code despite the convention explicitly forbidding it. Since the code hasn't changed in response to the earlier feedback, I should avoid posting duplicate comments and instead focus on whether these violations warrant a fresh flag or if I should hold off. Now I'm checking whether there are genuinely new violations beyond what I've already flagged, examining the current code for any fresh Effect convention issues that weren't caught before. shouldn't duplicate the findings, but the check should still fail since violations exist. The real question is whether to report them as new findings or acknowledge they were already flagged in the prior run. The real issue is that prior comments might be stale if commits were force-pushed, so I need to decide whether to re-post them or just fail the check with a note about the existing findings. Since there are genuine violations that haven't been fixed, I should mark the check as failed and reference the findings that were already reported. I need to check if there are any new violations beyond what I've already flagged, particularly looking for additional catchTag usages. Let me scan through the updated files to see if there's anything else that warrants a fresh comment, or if the existing flags still cover the violations in the current state. I'm realizing catchTag is actually used extensively throughout the codebase in multiple files, which contradicts the convention that says to avoid it. This suggests the existing code doesn't follow that guideline at all, so my earlier analysis about the codebase avoiding catchTag was wrong. The catchTags convention is clearly dominant across the codebase and explicitly preferred even for single tags, so the violations I found in those four files are legitimate style inconsistencies that need fixing. Since these same violations were already flagged in my previous review comments on the force-pushed commits, I need to check whether those comments are still visible on the PR or if they've been marked as outdated. That'll determine whether I should re-flag them or assume the author is aware and chose not to address them. The catchTag issues persist at lines 108 and 407 in connect.ts and lines 307 and 414 in CliTokenManager.ts, even though earlier review comments marked similar issues as resolved in a prior commit. Looking at the current head, the problem is still there. The convention explicitly prohibits catchTag, so it's a clear rule violation. But since these same issues have been flagged repeatedly across prior runs and marked as "no longer relevant," and the guidance says not to duplicate comments unless the code changed in direct response, I shouldn't re-post them. The real question now is whether there's anything genuinely new in the current head that hasn't already been caught. The code changed from catchIf to catchTag in response to my feedback, but it's still not using catchTags as the convention requires. I could re-flag it, but the author clearly understands the issue and made a partial fix. Let me reconsider whether flagging catchTag usage is even the right call here. Looking at the convention more carefully, it's explicit: use catchTags for statically known tagged failures, not catchTag. The codebase overwhelmingly uses catchTags (60+ times versus 14 uses of catchTag), so flagging is legitimate. But I've already reported these violations in prior runs, and posting them again would just be duplicate comments. The guidance says not to repeat myself, so I should skip new inline comments. The real question is what to do about the check state overall—since all the genuine violations have already been flagged in previous passes, I shouldn't duplicate those reports. The prior comments were marked as outdated by the system, but the code still contains the same catchTag violations that were already flagged multiple times. Since the author has engaged with this feedback before and these are repetitive points, posting duplicate comments would be unhelpful. I'll fail the check and summarize the unaddressed catchTag violations in the report without adding inline comments. The guidance is specifically about avoiding duplicate comments on unchanged code. For CliTokenManager.ts, the code did change in response to my feedback, so flagging the new violation is justified. But for connect.ts, the catchTag issues were already there when I flagged them before — they haven't changed, so posting the same comment again would genuinely be repetitive and against the guidance. I'm leaning toward not posting duplicate comments since I've already flagged the catchTag violations multiple times and the author hasn't acted on them. The check should fail to reflect the actual convention violations, but I won't spam with redundant inline feedback—that's just annoying at this point. Wait, I need to check that final instruction again about what to do when there are no new findings. Looking at the specific error handling patterns, the catchTag calls in disconnectCloud are the actual violations since they're catching individual error types when the entire error channel is being handled. Since these are the only convention issues and they've already been flagged, I won't duplicate the findings—I'll just reflect that the check is complete with those previously-reported violations noted. Actually, I think posting a fresh inline comment makes sense here. Since the prior comments are now marked outdated and invisible, a single consolidated comment pointing out the catchTag violations across CliTokenManager and connect.ts would be genuinely helpful—especially since they changed from catchIf to catchTag in direct response to my earlier feedback, which falls under the exception for re-commenting on evolved issues. The author did engage by switching from catchIf to catchTag, but they haven't adopted the catchTags plural form despite seeing this feedback multiple times now. Pushing the same point a fourth time across different files feels like it crosses into spam territory and probably won't change their mind—I should let this one go. I'll mark the check as failed since the violations are real and the check defaults to failure anyway, but I'll keep the report honest by summarizing what's already been communicated rather than piling on new comments. I'm reviewing the four instances where catchTag appears in the changed scope across the codebase—two error types in connect.ts and two timeout errors in CliTokenManager.ts—to finalize my analysis. These violations were flagged in previous runs, and while the prior comments are marked obsolete due to force-pushes, the underlying convention issues remain unresolved. Since the guidance is to avoid posting duplicate comments for already-flagged issues unless the code changed directly in response, and these haven't been addressed, I'll set the check to failure with a summary of the persistent violations rather than adding redundant inline comments. Writing the final JSON output now.