fix(pseudohome): fix .ssh perm clobbering, prompt on SSH failure

- clone_or_update_repo: move group chgrp/chmod from parent_dir to
  dest_dir post-clone; prevents recursive clobber of .ssh perms
- set_ssh_perms: chmod 600 all .ssh/* before relaxing pub/known_hosts
  to 644, so authorized_keys and private keys always land at 600
- probe_and_fix_ssh: return bool instead of raising on network failure,
  letting the caller prompt rather than abort
- module_pseudohome: prompt to add deploy key when probe returns False;
  wrap clone in try/finally so set_ssh_perms always runs even on failure
- clone_or_update_private_repo_with_key_check: expand is_ssh_error to
  cover timeout/network failures (not just "Permission denied"), so the
  interactive key prompt fires on connection timeout too

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P4Hxvsa529m9F6d6dxLCiG

Author: adamamyl

lib/installer_utils/git_tools.py

@@ -31,16 +31,9 @@ def clone_or_update_repo(exec_obj: Executor,
     """
 
     parent_dir = os.path.dirname(dest_dir)
-    
-    # 1. Ensure parent dir exists and has correct group/permissions
+
+    # 1. Ensure parent dir exists
     exec_obj.run(f"mkdir -p {parent_dir}", force_sudo=True)
-    
-    # Set group ownership and ensure group-writeable; only when a group is explicitly requested.
-    # Never apply to home directories — callers that need a specific group (e.g. docker) pass it.
-    if group:
-        exec_obj.run(f"chgrp -R {group} {parent_dir} || true", force_sudo=True)
-        exec_obj.run(f"chmod -R g+w {parent_dir}", force_sudo=True)
-        exec_obj.run(f"chmod -R -s {parent_dir} || true", force_sudo=True)
 
     # 2. Prepare environment prefix for SSH key usage
     env_prefix = "" 
@@ -89,6 +82,12 @@ def clone_or_update_repo(exec_obj: Executor,
         exec_obj.run(final_cmd, user=user)
         log.success(f"Repository cloned: {dest_dir}")
 
+    # Apply group ownership to the repo dir only (not the parent — avoids clobbering .ssh etc.)
+    if group and os.path.isdir(dest_dir):
+        exec_obj.run(f"chgrp -R {group} {dest_dir} || true", force_sudo=True)
+        exec_obj.run(f"chmod -R g+w {dest_dir}", force_sudo=True)
+        exec_obj.run(f"chmod -R -s {dest_dir} || true", force_sudo=True)
+
 def clone_or_update_private_repo_with_key_check(exec_obj: Executor,
                                                repo_url: str,
                                                dest_dir: str,
@@ -124,9 +123,20 @@ def clone_or_update_private_repo_with_key_check(exec_obj: Executor,
             break # Exit loop on success
 
         except subprocess.CalledProcessError as e:
-            # Check for typical Git/SSH permission error (Exit code 128)
-            is_ssh_error = (e.returncode == 128) and ("Permission denied" in e.stderr)
-            
+            # Treat any git/SSH failure (auth or network) as potentially fixable by adding the key.
+            # Timeout ("Connection timed out") and auth ("Permission denied") both exit 128.
+            is_ssh_error = e.returncode == 128 and any(
+                marker in (e.stderr or "")
+                for marker in [
+                    "Permission denied",
+                    "Connection timed out",
+                    "connect to host",
+                    "Host is unreachable",
+                    "No route to host",
+                    "Network is unreachable",
+                ]
+            )
+
             if attempt == 0 and is_ssh_error:
                 log.warning("Initial clone attempt failed due to possible missing deploy key.")
 
@@ -213,9 +223,10 @@ def set_ssh_perms(exec_obj: Executor, user: str, ssh_dir: str) -> None:
     exec_obj.run(f"chmod 700 {ssh_dir}", force_sudo=True)
     exec_obj.run(f"chown {user}:{user} {ssh_dir}", force_sudo=True)
 
-    # Re-fix ownership in case root generated the keys; _create_if_needed_ssh_key handles 600/644.
+    # Re-fix ownership and enforce 600 on all files; public keys and known_hosts relaxed below.
     exec_obj.run(f"chown {user}:{user} {ssh_dir}/* || true", force_sudo=True)
-    
-    # We explicitly relax permissions on known_hosts and public keys to 644/400, just in case
+    exec_obj.run(f"chmod 600 {ssh_dir}/* || true", force_sudo=True)
+
+    # Relax known_hosts and public keys to 644
     exec_obj.run(f"chmod 644 {ssh_dir}/known_hosts || true", force_sudo=True)
     exec_obj.run(f"chmod 644 {ssh_dir}/*.pub || true", force_sudo=True)

lib/installer_utils/module_pseudohome.py

@@ -7,7 +7,7 @@
     set_homedir_perms_recursively,
     set_ssh_perms,
 )
-from .repo_utils import _create_if_needed_ssh_key
+from .repo_utils import _create_if_needed_ssh_key, _display_key_and_url_for_repo
 from .ssh_utils import probe_and_fix_ssh
 from .tailscale import ensure_tailscale_connected
 
@@ -52,30 +52,36 @@ def setup_pseudohome(exec_obj: Executor) -> None:
     # 4. SSH connectivity probe — remediates known_hosts / key perms, prompts if key missing
     ssh_key_path = os.path.join(ssh_dir, repo_name)
     log.info("Probing SSH connectivity to git.amyl.org.uk...")
-    probe_and_fix_ssh(
+    ssh_ok = probe_and_fix_ssh(
         exec_obj,
         host="git.amyl.org.uk",
         ssh_user=user,
         key_path=ssh_key_path,
     )
+    if not ssh_ok and not exec_obj.force:
+        log.warning(
+            "Cannot reach git.amyl.org.uk — the pseudohome deploy key may not be authorised yet."
+        )
+        _display_key_and_url_for_repo(exec_obj, ssh_dir, repo_name, PSEUDOHOME_REPO_URL)
 
-    # 5. Clone/Update Repo (Handles interactive key prompt and retry on failure)
-
-    clone_or_update_private_repo_with_key_check(
-        exec_obj,
-        PSEUDOHOME_REPO_URL,
-        dest_dir,
-        ssh_key_path=ssh_key_path,
-        repo_name=repo_name,
-        extra_git_flags="--recursive",
-        user=user,  # Execute as 'adam'
-    )
+    # 5. Clone/Update Repo — always re-enforce .ssh perms even if clone fails.
+    try:
+        clone_or_update_private_repo_with_key_check(
+            exec_obj,
+            PSEUDOHOME_REPO_URL,
+            dest_dir,
+            ssh_key_path=ssh_key_path,
+            repo_name=repo_name,
+            extra_git_flags="--recursive",
+            user=user,
+        )
 
-    # 6. Fix permissions: home dir ownership (non-recursive — must not clobber .ssh),
-    # then repo contents, then re-enforce .ssh in case anything above touched it.
-    exec_obj.run(f"chown {user}:{user} {os.path.dirname(dest_dir)}", force_sudo=True)
-    set_homedir_perms_recursively(exec_obj, user, dest_dir)
-    set_ssh_perms(exec_obj, user, ssh_dir)
+        # 6. Fix permissions on repo dir; home dir chown is non-recursive.
+        exec_obj.run(f"chown {user}:{user} {os.path.dirname(dest_dir)}", force_sudo=True)
+        set_homedir_perms_recursively(exec_obj, user, dest_dir)
+    finally:
+        # Always re-enforce .ssh regardless of clone outcome — group chmod can clobber these.
+        set_ssh_perms(exec_obj, user, ssh_dir)
 
     # 7. Run installer script (as the user)
     installer_path = os.path.join(dest_dir, PSEUDOHOME_INSTALLER)

lib/installer_utils/ssh_utils.py

@@ -82,17 +82,18 @@ def probe_and_fix_ssh(
     host: str,
     ssh_user: str,
     key_path: str,
-) -> None:
+) -> bool:
     """
     Tests SSH connectivity to host as ssh_user using key_path.
-    Auto-remediates where possible, raises RuntimeError if unresolvable.
+    Auto-remediates where possible (known_hosts, key perms).
+    Returns True if SSH is working, False if not (caller should prompt user to add the key).
 
     Remediations attempted (in order):
-      1. Immediate raise on network-level failure (Tailscale/routing issue)
+      1. Return False on network-level failure (caller will prompt)
       2. ssh-keygen -R to clear any stale host key entry
       3. ssh-keyscan to populate/refresh known_hosts
       4. chmod 700 on .ssh dir and 600 on private key if permissions wrong
-      5. Verbose retry with full diagnostics before giving up
+      5. Verbose retry with full diagnostics before returning False
     """
     _validate_host(host)
     home = _user_homedir(ssh_user)
@@ -101,7 +102,7 @@ def probe_and_fix_ssh(
     ok, stderr = _ssh_probe(exec_obj, host, ssh_user, key_path)
     if ok:
         log.success(f"SSH to {ssh_user}@{host}: OK")
-        return
+        return True
 
     log.warning(f"SSH to {host} failed — diagnosing...")
 
@@ -116,15 +117,13 @@ def probe_and_fix_ssh(
         ]
     )
     if is_network_fail:
-        raise RuntimeError(
-            f"Network failure connecting to {host} — Tailscale connected but host unreachable?\n"
+        log.warning(
+            f"Network failure connecting to {host} — key may not be authorised yet.\n"
             f"SSH said: {stderr.strip()}"
         )
+        return False
 
     # Remediation A: clear stale host key unconditionally before re-scanning.
-    # ssh-keygen -R is harmless when no entry exists; and -q suppresses the
-    # "REMOTE HOST IDENTIFICATION HAS CHANGED" warning so we can't detect it
-    # from the quiet probe — easier to always clean and re-add.
     log.info(f"Clearing any stale known_hosts entry for {host}...")
     exec_obj.run(["ssh-keygen", "-R", host], user=ssh_user, check=False, run_quiet=True)
 
@@ -149,15 +148,12 @@ def probe_and_fix_ssh(
     ok, stderr = _ssh_probe(exec_obj, host, ssh_user, key_path)
     if ok:
         log.success(f"SSH to {ssh_user}@{host}: OK (after remediation)")
-        return
+        return True
 
-    # Verbose diagnostics before giving up
+    # Verbose diagnostics
     log.error(f"SSH to {host} still failing. Verbose output:")
     _, verbose_stderr = _ssh_probe(exec_obj, host, ssh_user, key_path, verbose=True)
     for line in verbose_stderr.splitlines():
         log.error(f"  ssh: {line}")
 
-    raise RuntimeError(
-        f"Cannot SSH to {ssh_user}@{host} — ensure the public key is authorised on the remote.\n"
-        f"Public key to add: {key_path}.pub"
-    )
+    return False