[junjuny0227]

Summary

Plan 16 Task 3 (docs/plans/2026-11-05-16-ssh-config.md): the desktop app shows SSH config items, CI loads the prepared and restored SSH config with real OpenSSH on each OS, and the READMEs and site list the SSH client config. Core and CLI landed in #109.

Type

• feat
• fix
• refactor / chore
• docs
• ci / build

Changes

• Desktop: Category 'ssh' (sidebar after Shell, key icon), FindingKind keyFile / externalInclude (serde names from model.rs), finding text in strings.ts and all four locales (category.ssh, finding.keyFile, finding.externalInclude). "With warnings only" ignores an externalInclude finding (nothing for the user to do) and still counts keyFile, as the plan says. category.ssh stays "SSH" in every locale (added to the locale test's same-everywhere list).
• ui_fixture.rs scans the plan's example ~/.ssh/config + config.d/work; scan.json regenerated. New Vitest tests: warnings filter (external Include alone vs key path), SSH category order and counts, detail panel text for both findings.
• CI scripts job: render_samples writes samples/ssh-config-{macos,linux,windows} through prepare_config from a macOS source. Each runner runs ssh -G -F <file> github-work on its own copy and expects exit 0; Ubuntu and Windows also run the unprepared macOS file and expect it to fail (control, so the 255 check proves something).
• Smoke tests: smoke_export now restores an SSH config too. Bash checks ~/.ssh is 700 and ~/.ssh/config is 600 via stat, resolves github-work with ssh -G -F, and expects already done: copy ~/.ssh/config on the second run. Windows runs ssh -G github-work on the default path (includes OpenSSH's owner/ACL check) and checks that ssh -v logs identity file under %USERPROFILE%. Win32-OpenSSH 9.5 logs that line only after it connects, so the step gives it a local TcpListener port that accepts and closes the connection.
• Docs: SSH row in the "What it moves" table of the four READMEs (same position), site tools.groups.ssh / tools.ssh in four locales with the same key icon. Plan 16 Task 3 boxes ticked except the tauri dev check.

Deviation, recorded in the plan: ssh -G prints IdentityFile unexpanded (~/.ssh/..., checked with OpenSSH 10.5 here), so the Windows smoke reads the expanded path from ssh -v instead (first CI run showed Win32-OpenSSH needs a connection for that, hence the local listener). The extra samples/ssh-config-macos is the negative control.

Checks

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• pnpm --filter @repot/desktop typecheck / test / build
• Ran the real flow if behavior changed (--example scan / --example export, or tauri dev)
• Not checked locally, CI only (say which, e.g. Windows/Linux providers, shellcheck): Ubuntu and Windows OpenSSH steps (ssh -G on the prepared files and the macOS control), the Windows restored-config step (default path ACL check, identity file under %USERPROFILE%), the Linux bash smoke stat -c branch. All three scripts jobs passed on 3fb0750 (Windows log: identity file C:\\Users\\runneradmin/.ssh/work_ed25519, OpenSSH_for_Windows_9.5p2; Ubuntu OpenSSH 9.6p1).

Also run: cargo test -p repot-core --example e2e_export --example smoke_export --example cross_os_e2e --example render_samples, actionlint, pnpm exec biome ci ., node --test scripts/*.test.mjs scripts/package-map-gen/*.test.mjs, pnpm --filter @repot/site typecheck / test / build.
On this Mac: ssh -G -F exits 0 for all three rendered samples, and the bash smoke steps (restore into a temp HOME, stat 700/600, ssh -G -F … github-work, already done: copy ~/.ssh/config on the second run) pass. Instead of tauri dev, the review screen and the SSH detail panel were rendered with the built CSS in headless Chrome (throwaway test, deleted) in all four locales.

Spec and generated files

• Spec updated in this PR if a product decision changed, or no decision changed
• Generated files regenerated from their source, not edited by hand (scan.json, snapshots/, icons/)
• Snapshot diffs read and intended (no snapshot changes)

Boundaries

• repot-core does not depend on Tauri and does no network calls
• Commands and file reads go through Env; tests use FakeEnv and fixtures, not real tools
• No new crate or npm dependency, or the plan/spec was updated first
• The app still only reads the device; it writes only to the export folder