fix(ssh): harden keepalive and session lifecycle UX

Author: acmore

infra/sidecar/entrypoint.sh

@@ -37,7 +37,37 @@ if [ -z "$DEV_PID" ]; then
   exit 1
 fi
 
-exec nsenter --target "$DEV_PID" --mount --uts --ipc --pid -- /bin/sh -l
+# Ensure current GID exists in /etc/group inside the target to suppress
+# "groups: cannot find name for group ID ..." warnings from login shells.
+CURRENT_GID="$(id -g 2>/dev/null || true)"
+if [ -n "$CURRENT_GID" ]; then
+  nsenter --target "$DEV_PID" --mount -- sh -c "
+    grep -q \":${CURRENT_GID}:\" /etc/group 2>/dev/null || \
+    echo \"okdev:x:${CURRENT_GID}:\" >> /etc/group 2>/dev/null || true
+  "
+fi
+
+# If a remote command was requested, execute it inside the dev container.
+if [ -n "${SSH_ORIGINAL_COMMAND:-}" ]; then
+  if nsenter --target "$DEV_PID" --mount -- test -x /bin/bash 2>/dev/null; then
+    exec nsenter --target "$DEV_PID" --mount --uts --ipc --pid -- /bin/bash -lc "$SSH_ORIGINAL_COMMAND"
+  else
+    exec nsenter --target "$DEV_PID" --mount --uts --ipc --pid -- /bin/sh -lc "$SSH_ORIGINAL_COMMAND"
+  fi
+fi
+
+# If there is no TTY and no remote command (e.g. SSH master/control session),
+# keep the connection open so forwarding channels stay alive.
+if [ ! -t 0 ]; then
+  exec nsenter --target "$DEV_PID" --mount --uts --ipc --pid -- /bin/sh -lc "while :; do sleep 3600; done"
+fi
+
+# Interactive login shell in dev container.
+if nsenter --target "$DEV_PID" --mount -- test -x /bin/bash 2>/dev/null; then
+  exec nsenter --target "$DEV_PID" --mount --uts --ipc --pid -- /bin/bash -l
+else
+  exec nsenter --target "$DEV_PID" --mount --uts --ipc --pid -- /bin/sh -l
+fi
 SCRIPT
 chmod +x /usr/local/bin/nsenter-dev.sh
 

internal/cli/common.go

@@ -10,6 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"sort"
 	"strings"
 	"time"
 
@@ -54,6 +55,68 @@ func resolveSessionName(opts *Options, cfg *config.DevEnvironment) (string, erro
 	return session.Resolve(opts.Session, cfg.Spec.Session.DefaultNameTemplate)
 }
 
+func resolveSessionNameForUpDown(opts *Options, cfg *config.DevEnvironment, namespace string) (string, error) {
+	if strings.TrimSpace(opts.Session) != "" {
+		return resolveSessionName(opts, cfg)
+	}
+	active, err := session.LoadActiveSession()
+	if err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(active) != "" {
+		return session.Resolve(active, cfg.Spec.Session.DefaultNameTemplate)
+	}
+	inferred, err := inferExistingSessionForRepo(opts, cfg, namespace)
+	if err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(inferred) != "" {
+		return inferred, nil
+	}
+	return session.Resolve("", cfg.Spec.Session.DefaultNameTemplate)
+}
+
+func inferExistingSessionForRepo(opts *Options, cfg *config.DevEnvironment, namespace string) (string, error) {
+	root, err := session.RepoRoot()
+	if err != nil || strings.TrimSpace(root) == "" {
+		return "", nil
+	}
+	repo := filepath.Base(root)
+	if strings.TrimSpace(repo) == "" {
+		return "", nil
+	}
+	label := []string{
+		"okdev.io/managed=true",
+		ownerLabelSelector(opts),
+		"okdev.io/repo=" + repo,
+	}
+	if strings.TrimSpace(cfg.Metadata.Name) != "" {
+		label = append(label, "okdev.io/name="+cfg.Metadata.Name)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	pods, err := newKubeClient(opts).ListPods(ctx, namespace, false, strings.Join(label, ","))
+	if err != nil {
+		return "", err
+	}
+	if len(pods) == 0 {
+		return "", nil
+	}
+	sort.Slice(pods, func(i, j int) bool {
+		return pods[i].CreatedAt.After(pods[j].CreatedAt)
+	})
+	for _, p := range pods {
+		sn := strings.TrimSpace(p.Labels["okdev.io/session"])
+		if sn != "" {
+			return sn, nil
+		}
+		if strings.HasPrefix(p.Name, "okdev-") {
+			return strings.TrimPrefix(p.Name, "okdev-"), nil
+		}
+	}
+	return "", nil
+}
+
 func labelsForSession(opts *Options, cfg *config.DevEnvironment, sessionName string) map[string]string {
 	owner := currentOwner(opts)
 	repo := "unknown"

internal/cli/down.go

@@ -6,7 +6,9 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/acmore/okdev/internal/session"
 	"github.com/spf13/cobra"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 )
 
 func newDownCmd(opts *Options) *cobra.Command {
@@ -21,7 +23,7 @@ func newDownCmd(opts *Options) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			sn, err := resolveSessionName(opts, cfg)
+			sn, err := resolveSessionNameForUpDown(opts, cfg, ns)
 			if err != nil {
 				return err
 			}
@@ -42,17 +44,20 @@ func newDownCmd(opts *Options) *cobra.Command {
 				return nil
 			}
 
-			if err := k.Delete(ctx, ns, "pod", podName(sn), true); err != nil {
+			if err := k.Delete(ctx, ns, "pod", podName(sn), true); err != nil && !apierrors.IsNotFound(err) {
 				return fmt.Errorf("delete session pod: %w", err)
 			}
 			if deletePVC && cfg.Spec.Workspace.PVC.ClaimName == "" {
-				if err := k.Delete(ctx, ns, "pvc", pvcName(cfg, sn), true); err != nil {
+				if err := k.Delete(ctx, ns, "pvc", pvcName(cfg, sn), true); err != nil && !apierrors.IsNotFound(err) {
 					return fmt.Errorf("delete workspace pvc: %w", err)
 				}
 			}
 			alias := sshHostAlias(sn)
 			_ = stopManagedSSHForward(alias)
 			_ = removeSSHConfigEntry(alias)
+			if active, err := session.LoadActiveSession(); err == nil && active == sn {
+				_ = session.ClearActiveSession()
+			}
 			fmt.Fprintf(cmd.OutOrStdout(), "Session stopped: %s\n", sn)
 			if !deletePVC && cfg.Spec.Workspace.PVC.ClaimName == "" {
 				fmt.Fprintf(cmd.OutOrStdout(), "Workspace PVC retained: %s (use --delete-pvc to remove)\n", pvcName(cfg, sn))

internal/cli/list.go

@@ -2,8 +2,10 @@ package cli
 
 import (
 	"sort"
+	"strings"
 
 	"github.com/acmore/okdev/internal/config"
+	"github.com/acmore/okdev/internal/kube"
 	"github.com/acmore/okdev/internal/output"
 	"github.com/acmore/okdev/internal/session"
 	"github.com/spf13/cobra"
@@ -55,7 +57,7 @@ func newListCmd(opts *Options) *cobra.Command {
 				}
 				rows := make([]listRow, 0, len(pods))
 				for _, p := range pods {
-					sn := p.Labels["okdev.io/session"]
+					sn := sessionNameFromPodSummary(p)
 					rows = append(rows, listRow{
 						Namespace: p.Namespace,
 						Session:   sn,
@@ -69,7 +71,7 @@ func newListCmd(opts *Options) *cobra.Command {
 			}
 			rows := make([][]string, 0, len(pods))
 			for _, p := range pods {
-				sn := p.Labels["okdev.io/session"]
+				sn := sessionNameFromPodSummary(p)
 				if sn != "" && sn == activeSession {
 					sn = "*" + sn
 				}
@@ -90,3 +92,16 @@ func newListCmd(opts *Options) *cobra.Command {
 	cmd.Flags().BoolVar(&allUsers, "all-users", false, "List sessions for all owners")
 	return cmd
 }
+
+func sessionNameFromPodSummary(p kube.PodSummary) string {
+	if p.Labels != nil {
+		if sn := strings.TrimSpace(p.Labels["okdev.io/session"]); sn != "" {
+			return sn
+		}
+	}
+	name := strings.TrimSpace(p.Name)
+	if strings.HasPrefix(name, "okdev-") {
+		return strings.TrimPrefix(name, "okdev-")
+	}
+	return name
+}

internal/cli/ssh.go

@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 
 	"github.com/acmore/okdev/internal/config"
@@ -228,6 +229,7 @@ func ensureSSHConfigEntry(hostAlias, sessionName, namespace, user string, remote
 		"  ServerAliveInterval 30",
 		"  ServerAliveCountMax 10",
 		"  TCPKeepAlive yes",
+		"  LogLevel ERROR",
 		end,
 	)
 	block := strings.Join(blockLines, "\n") + "\n"
@@ -305,7 +307,7 @@ func newSSHProxyCmd(opts *Options) *cobra.Command {
 			var copyErr error
 			var once sync.Once
 			setErr := func(err error) {
-				if err == nil || errors.Is(err, io.EOF) {
+				if err == nil || errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) || errors.Is(err, syscall.EPIPE) || isIgnorableProxyIOError(err) {
 					return
 				}
 				once.Do(func() { copyErr = err })
@@ -315,9 +317,6 @@ func newSSHProxyCmd(opts *Options) *cobra.Command {
 				defer wg.Done()
 				_, err := io.Copy(conn, os.Stdin)
 				setErr(err)
-				if cw, ok := conn.(interface{ CloseWrite() error }); ok {
-					_ = cw.CloseWrite()
-				}
 			}()
 			go func() {
 				defer wg.Done()
@@ -332,6 +331,16 @@ func newSSHProxyCmd(opts *Options) *cobra.Command {
 	return cmd
 }
 
+func isIgnorableProxyIOError(err error) bool {
+	if err == nil {
+		return true
+	}
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "broken pipe") ||
+		strings.Contains(msg, "use of closed network connection") ||
+		strings.Contains(msg, "connection reset by peer")
+}
+
 func waitDialLocal(localPort int, timeout time.Duration) (net.Conn, error) {
 	deadline := time.Now().Add(timeout)
 	addr := fmt.Sprintf("127.0.0.1:%d", localPort)
@@ -377,10 +386,11 @@ func startManagedSSHForward(hostAlias string) error {
 		"-M",
 		"-S", socketPath,
 		"-o", "ControlPersist=600",
-		"-o", "ExitOnForwardFailure=yes",
+		"-o", "ExitOnForwardFailure=no",
 		"-o", "ServerAliveInterval=30",
 		"-o", "ServerAliveCountMax=10",
 		"-o", "TCPKeepAlive=yes",
+		"-o", "LogLevel=ERROR",
 		hostAlias,
 	)
 	if out, err := cmd.CombinedOutput(); err != nil {

internal/cli/sync.go

@@ -8,6 +8,7 @@ import (
 	"strconv"
 	"strings"
 	"syscall"
+	"time"
 
 	syncengine "github.com/acmore/okdev/internal/sync"
 	"github.com/spf13/cobra"
@@ -98,7 +99,7 @@ func startDetachedSyncthingSync(opts *Options, mode, sessionName string) (string
 		return "", false, err
 	}
 	if pid, ok := readSyncthingPID(pidPath); ok {
-		if processAlive(pid) {
+		if processAlive(pid) && processLooksLikeSyncthingSync(pid) {
 			return logPath, false, nil
 		}
 		_ = os.Remove(pidPath)
@@ -131,6 +132,7 @@ func startDetachedSyncthingSync(opts *Options, mode, sessionName string) (string
 	cmd.Stdout = logFile
 	cmd.Stderr = logFile
 	cmd.Stdin = nil
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
 	if err := cmd.Start(); err != nil {
 		_ = logFile.Close()
 		return "", false, err
@@ -139,6 +141,12 @@ func startDetachedSyncthingSync(opts *Options, mode, sessionName string) (string
 		_ = logFile.Close()
 		return "", false, err
 	}
+	// Guard against immediate child exit (common when sync init fails).
+	time.Sleep(300 * time.Millisecond)
+	if !processAlive(cmd.Process.Pid) || !processLooksLikeSyncthingSync(cmd.Process.Pid) {
+		_ = logFile.Close()
+		return "", false, fmt.Errorf("syncthing background process exited early; check logs: %s", logPath)
+	}
 	_ = cmd.Process.Release()
 	_ = logFile.Close()
 	return logPath, true, nil
@@ -173,10 +181,31 @@ func readSyncthingPID(path string) (int, bool) {
 }
 
 func processAlive(pid int) bool {
+	if pid <= 0 {
+		return false
+	}
+	if statOut, err := exec.Command("ps", "-p", strconv.Itoa(pid), "-o", "stat=").CombinedOutput(); err == nil {
+		stat := strings.TrimSpace(string(statOut))
+		if stat == "" || strings.Contains(stat, "Z") {
+			return false
+		}
+	}
 	p, err := os.FindProcess(pid)
 	if err != nil {
 		return false
 	}
 	err = p.Signal(syscall.Signal(0))
 	return err == nil
 }
+
+func processLooksLikeSyncthingSync(pid int) bool {
+	if pid <= 0 {
+		return false
+	}
+	out, err := exec.Command("ps", "-p", strconv.Itoa(pid), "-o", "command=").CombinedOutput()
+	if err != nil {
+		return false
+	}
+	cmdline := string(out)
+	return strings.Contains(cmdline, "okdev") && strings.Contains(cmdline, "sync")
+}