fix: keep common tools with --no-ssh

[PabloZaiden]

Summary

• Keep the shared container setup running when --no-ssh is used, including gh, Node/npm, Fresh Editor, git, and tmux.
• Gate only OpenSSH package/configuration installation and sshd startup behind the SSH mode.
• Stop existing managed SSH listeners when switching a workspace to --no-ssh.
• Update documentation and regression coverage.

Validation

• bun run typecheck
• DEVBOX_SKIP_LIVE_EXAMPLE_TESTS=1 bun test
• bash -n src/runner/ssh-server.sh
• git diff --check

[Copilot]

🟡 Changes recommended

Four moderate findings remain covering listener cleanup, no-SSH tool-installation coverage, and explicit SSH startup configuration.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates --no-ssh to retain shared development tools while skipping SSH setup and stopping existing managed listeners.

Changes:

• Gates SSH installation, configuration, and startup by mode.
• Preserves common tools including gh, Node/npm, Fresh Editor, git, and tmux.
• Updates orchestration, documentation, and regression coverage.

File summaries

File	Reviewed change	Final review comment
tests/runtime.test.ts	Tests runner command generation.	No final comment.
tests/examples.test.ts	Updates simulated no-SSH workflow coverage.	Moderate (1 vote): The fake exec exits before common setup; add coverage executing the branch with faked tool commands or verify tools in a real container.
tests/examples.live.test.ts	Updates live-workspace expectations.	No final comment.
src/runtime.ts	Passes SSH mode to the bundled runner.	Moderate (1 vote): Explicitly set START_SSH_SERVER=1 in the SSH-enabled command and update the script expectation.
src/runner/ssh-server.sh	Separates common tooling from SSH setup.	Moderate (1 vote): Add real-container assertions that no-SSH installs gh, Node/npm, Fresh Editor, git, and tmux.
src/core.ts	Updates CLI help text.	No final comment.
src/cli.ts	Stops prior SSH listeners and updates orchestration.	Moderate (2 votes): Add coverage switching from SSH-enabled to no-SSH and verify cleanup uses the old managed port.
README.md	Documents revised no-SSH behavior.	No final comment.

Review details

Suppressed comments (3)

src/runner/ssh-server.sh:172

• The no-SSH integration coverage only checks the success message; the simulated runner exits before executing this script, and the live test does not verify any installed tool. A regression that skips the common setup would still pass. Add a real-container assertion for the expected gh, Node/npm, Fresh Editor, git, and tmux installations when --no-ssh is used.

if [[ "$START_SSH_SERVER" != "1" ]]; then
  echo "Bundled SSH server disabled; common container tools installed."
  exit 0
fi

src/runtime.ts:892

• The normal SSH branch leaves START_SSH_SERVER inherited from the devcontainer environment. If a project defines this variable as 0 (or another invalid value), --ssh can silently skip sshd (or fail validation) while handleUpLike still records the workspace as SSH-enabled. Set START_SSH_SERVER=1 explicitly for the SSH-enabled command so the CLI mode cannot be overridden by container configuration, and update the corresponding script expectation.

  if (!startSshServer) {
    return `env START_SSH_SERVER=${quoteShell("0")} bash -s`;

tests/examples.test.ts:327

• This fake devcontainer exec returns as soon as it sees START_SSH_SERVER='0', so it never executes the bundled script's common-setup path. The live test only checks CLI output, and the runtime test only checks source text; a regression that exits before installing gh, Node/npm, Fresh Editor, git, or tmux would still pass. Please add coverage that executes this branch with faked package/tool commands or verifies the resulting tools in a real container.

    if (script.includes("START_SSH_SERVER='0'")) {
      console.log("Bundled SSH server disabled; common container tools installed.");
      return;
    }

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[PabloZaiden]

Addressed in commit 3015ead:

• Explicitly set START_SSH_SERVER=1 for the SSH-enabled runner path.
• Added simulated coverage that executes the no-SSH runner with fake package/tool commands and verifies gh, Node/npm, Fresh Editor, git, and tmux/dtach setup while excluding OpenSSH packages.
• Added live-container assertions for the installed common tools.
• Added regression coverage for switching a running SSH-enabled workspace to --no-ssh and verifying cleanup of the previous managed SSH port.

Validation: bun run test:fast (180 passed, 8 skipped), focused runtime/example tests, typecheck, shell syntax, and diff checks.