[junjuny0227]

Summary

Plan 16 (docs/plans/2026-11-05-16-ssh-config.md): stage 1 moves the SSH client config ~/.ssh/config and the files it Includes from inside ~/.ssh. Keys, known_hosts and authorized_keys stay out. The export README and the restore summary list the IdentityFile paths the config points to, so the user copies those keys by hand. Stage 2 (keys with encrypted export) is a short future section with no tasks. The spec is updated in the same PR. Not for merge until the user has reviewed the plan.

Type

• feat
• fix
• refactor / chore
• docs
• ci / build

Changes

• New plan with decisions and reasons: config only (no known_hosts), the Include rules (only inside ~/.ssh, so OrbStack/colima includes are not followed), comment-out instead of IgnoreUnknown for UseKeychain and, on Windows, Control*, 0600/0700 permissions on bash and inherited ACLs on Windows, key path notes, SetEnv secret masking, a .ssh/ target check when opening repot.json, and a worked example (sample config, scan item, exported file, bash and PowerShell lines).
• Reuses ItemDetails::ConfigFile + TargetPath::Home + Step::CopyFile, so there is no new step type. Additive v1 values: Category::Ssh and FindingKind::KeyFile.
• Spec: §2 (SSH config is now included, keys are still excluded), §6, §7 (row G), §8, §9, §10, §13, §15, §16.

Checks

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• pnpm --filter @repot/desktop typecheck / test / build
• Ran the real flow if behavior changed (--example scan / --example export, or tauri dev)
• Not checked locally, CI only (say which, e.g. Windows/Linux providers, shellcheck):

Docs only. pnpm exec biome ci . passed (exit 0). OpenSSH behavior that the plan relies on was checked with macOS OpenSSH 10.5 (ssh -G): a missing Include is ignored, an unknown option makes ssh exit with 255, IgnoreUnknown works, and CRLF lines parse. Linux and Windows OpenSSH behavior was not checked locally. Plan Task 3 adds CI checks for it.

Spec and generated files

• Spec updated in this PR if a product decision changed, or no decision changed
• Generated files regenerated from their source, not edited by hand (scan.json, snapshots/, icons/) (not touched)
• Snapshot diffs read and intended (not touched)

Boundaries

• repot-core does not depend on Tauri and does no network calls
• Commands and file reads go through Env; tests use FakeEnv and fixtures, not real tools
• No new crate or npm dependency, or the plan/spec was updated first
• The app still only reads the device; it writes only to the export folder