mirror of
https://github.com/alphaXiv/OpenResearch.git
synced 2026-11-12 10:05:24 +08:00
Daniel Kim
af8eed1724
* orx up remote banner: make the SSH commands the readable part The remote-access banner dimmed the very things you need to read and copy: the whole `ssh -N -L …` command was faint gray, and the `<ssh-alias>` placeholder in both commands was dimmed too — so the prose asides and the commands were nearly the same weight, and the one line you'd paste was the hardest to see. Invert the emphasis. Both commands are now bold with a `$` prompt so they read as "type this", the `<ssh-alias>` fill-in-the-blank is cyan (legible, obviously a placeholder) instead of dimmed, and only the prose (intro, the alias note, the trailing `# then open …` comment) is dim. Reworded the intro/option headings so the two paths scan as 1) and 2). Plain-text output (pipes/CI/NO_COLOR) is unchanged in spirit and still carries no escape codes. * orx up remote banner: adapt to boxes with no ~/.ssh/config alias The banner assumed a `~/.ssh/config` alias existed and told the user to type `<ssh-alias>`. On a fresh RunPod / openresearch dev node you connect with a raw `root@<ip> -p <port>` and have no alias at all, so the primary instruction was a dead end. Make the connection target adaptive: - Anchor on `<user@host>` — the one thing every reader has, alias or not — with a concrete example, and say plainly no config alias is needed. - When `SSH_CONNECTION` gives a usable *public* server IP, splice it straight into both commands so they're nearly copy-paste. - Custom SSH ports can't be recovered here (`SSH_CONNECTION` carries sshd's listen port, not the client-dialed one — e.g. RunPod maps :38455 onto sshd :22), and `orx up --remote` has no `-p` flag. So the `[-p PORT]` slot goes only on the manual `ssh` line (which accepts it), and a caveat tells the reader to use option 2 on a non-default port. Tests cover both branches (placeholder vs inlined public IP) and assert the port slot never leaks onto the `orx up --remote` line. * up --remote: security-aware host-key policy + IPv6/port hardening Addresses multi-agent review of the custom-port support: - HostKeyPolicy enum (jobs/ssh.rs) centralizes host-key handling behind SshTarget::host_port, so the '-p'/'-o' opt vector and its rationale live in one place. openresearch_ssh_target now uses it (Ephemeral), replacing its inline vec — behavior byte-identical (guarded by an exact-vector test). - Don't silently disable host-key verification for a user-typed HOSTNAME with a port: a name may be one the user has pinned. Only a raw IP (the freshly-provisioned-box signal) gets accept-new TOFU against the real known_hosts; a hostname gets '-p' only (UserConfig). Neither uses /dev/null — that stays reserved for provider-managed boxes. - Fix raw-IPv6 mis-parse: '2001:db8::5' was split into host + '-p 5'. And fix 'user@[::1]:2222' silently dropping its port (the bracket check now looks past the user@ prefix). Reject port 0. - Be honest in the banner/help/errors: 'orx up --remote' reconstructs only user@host + port, so a custom key / jump host must come from ~/.ssh/config; the reachability error now hints at ssh-keygen -R for a reused-IP key clash. Tests cover the policy dispatch, IPv6 (raw/bracketed/user-prefixed), port 0, >u16, host_is_ip_literal forms, and the exact Ephemeral opt vector. * chore: bump version to 0.1.58 Ships the orx up --remote custom-port support + readable/honest SSH banner.