brev exec --host should resolve only the selected environment and fail boundedly

[jyaunches]

Summary

brev exec <selected-environment> --host <command> does not keep transport resolution bounded to the selected environment after SSH fails.

With Brev CLI v0.6.331 on a Brev CPU environment whose inventory reports RUNNING, HEALTHY, SHELL READY, and build complete:

1. Selecting by environment ID makes the fast path try a synthetic <environment-id>-host SSH alias before resolving the environment. That alias does not resolve.
2. Selecting by the adapter-resolved workspace name reaches the published host SSH endpoint but times out.
3. Either failure enters the fallback path, performs a global SSH refresh, and queries/enriches unrelated running legacy workspaces instead of returning a bounded diagnostic for the selected target.

The retries were stopped. The remote command did not run and the selected host was not changed.

Public reproducer

Use any selected Brev CPU environment for which inventory is healthy/ready but host SSH is unavailable. Do not substitute another workspace when it fails.

brev exec <environment-id> --host 'nemoclaw host probe --json'
brev exec <workspace-name> --host 'nemoclaw host probe --json'

Expected: both identifiers resolve to the same selected environment and either run the command once or return one bounded selected-target transport error.

Observed: the ID path first synthesizes an unresolved -host alias; the name path times out at the published endpoint; fallback then scans unrelated workspaces.

Code evidence

This is owned by the Brev CLI adapter:

• pkg/cmd/exec/exec.go constructs the first SSH target directly from the raw argument and appends -host before resolving name or ID.
• On any failed fast-path SSH attempt for a RUNNING workspace, runExecCommand calls refresh.RunRefreshAsync.
• pkg/cmd/refresh/sshaccess.go obtains GetContextWorkspaces(), then calls the environment and network APIs for every running workspace before refresh writes the generated SSH configuration.
• The relevant exec.go and sshaccess.go blobs are identical at tag v0.6.331 and current main, so this is not already fixed there.

Related but not duplicate:

• feat: make brev exec fast with SSH multiplexing #319 introduced the fire-first/global-refresh fallback.
• NetBird reports "Connected" but brev SSH gateway path is stale after a network interruption (requires manual systemctl restart netbird) #426 tracks a stale NetBird gateway path after a network interruption; it does not address ID alias synthesis or selected-target-only fallback.

Expected behavior

For an explicitly supplied name or ID, brev exec --host should:

1. Resolve exactly that environment before choosing a host SSH target.
2. Use the adapter/control-plane SSH access contract for that selected environment.
3. Run the requested command exactly once when transport succeeds.
4. On missing alias, endpoint timeout, or other transport failure, return a bounded diagnostic for the selected environment, including the distinction between inventory readiness and end-to-end SSH reachability.
5. Avoid querying, probing, or rewriting SSH configuration for unrelated workspaces.
6. Avoid executing the remote command when transport admission fails.

A global brev refresh can remain an explicit operator action, but it should not be an implicit fallback for a selected-target read-only exec.

Acceptance criteria

• Name and ID inputs resolve to the same selected environment before SSH target construction.
• --host never blindly treats <raw-environment-id>-host as an SSH alias.
• A failed selected-target connection does not call the all-workspace refresh/enrichment path.
• No unrelated workspace environment/network lookup occurs.
• No SSH configuration file is written by this failure path.
• Timeout and missing-target tests assert a bounded, selected-target-only diagnostic.
• Success tests assert the command runs exactly once against the resolved host target.
• Regression tests cover both environment-ID and workspace-name selectors.

Qualification removal condition

The blocker is removable when an adapter-supported Brev CLI release can run the public read-only nemoclaw host probe --json through brev exec ... --host on the selected environment without scanning unrelated workspaces or requiring brev refresh.

Boundaries

This report intentionally excludes private environment selectors, SSH addresses, credentials, and raw logs. No workflow dispatch, feedback export, SSH-config modification, credential change, or host mutation was performed.