# Files changed · PR \#10144 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/10144/diffs)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

[refactor\(ssh\): keep package internals private](https://git.cafe/pingdotgg/t3code/pull/10144.md)

Version: 1

Head commit: 957f823cf58207de7e24f29334213594a5137fae

Base commit: 761d4bac1c238ea7af4dd36b56719ad5e30771c3

Comparison base: 761d4bac1c238ea7af4dd36b56719ad5e30771c3

Showing up to 20 entries from this revision. If the pull request changes, reopen the first page before continuing.

## packages/ssh/src/auth.ts

Status: modified; +24; −26

```diff
@@ -17,7 +17,7 @@
   readonly attempt: number;
 }
 
-export interface SshAskpassFile {
+interface SshAskpassFile {
   readonly path: string;
   readonly contents: string;
   readonly mode?: number;
@@ -71,7 +71,7 @@
   return platform === "win32" ? `${trimmed}\\${fileName}` : `${trimmed}/${fileName}`;
 }
 
-export const ASKPASS_POSIX_SCRIPT = `#!/bin/sh
+const ASKPASS_POSIX_SCRIPT = `#!/bin/sh
 # Invoked by ssh via SSH_ASKPASS when T3 Code re-runs ssh with a cached password
 # from the renderer's in-app prompt. We never expose a native dialog here - if
 # T3_SSH_AUTH_SECRET is missing, that's a caller bug and we fail loudly.
@@ -83,11 +83,11 @@
 exit 1
 `;
 
-export const ASKPASS_WINDOWS_LAUNCHER_SCRIPT = `@echo off\r
+const ASKPASS_WINDOWS_LAUNCHER_SCRIPT = `@echo off\r
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0ssh-askpass.ps1" %*\r
 `;
 
+const ASKPASS_WINDOWS_SCRIPT = `# Invoked by ssh via SSH_ASKPASS (through ssh-askpass.cmd) when T3 Code re-runs\r
-export const ASKPASS_WINDOWS_SCRIPT = `# Invoked by ssh via SSH_ASKPASS (through ssh-askpass.cmd) when T3 Code re-runs\r
 # ssh with a cached password from the renderer's in-app prompt. We never expose\r
 # a native dialog here - if T3_SSH_AUTH_SECRET is missing, that's a caller bug\r
 # and we fail loudly.\r
@@ -99,7 +99,7 @@
 exit 1\r
 `;
 
+const getDefaultSshAskpassDirectory = Effect.fn("ssh/auth.getDefaultSshAskpassDirectory")(
-export const getDefaultSshAskpassDirectory = Effect.fn("ssh/auth.getDefaultSshAskpassDirectory")(
   function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
@@ -146,31 +146,29 @@
   };
 });
 
+const ensureSshAskpassHelpers = Effect.fn("ssh/auth.ensureSshAskpassHelpers")(function* (input: {
+  readonly directory: string;
+}): Effect.fn.Return<string, PlatformError.PlatformError, FileSystem.FileSystem | Path.Path> {
-export const ensureSshAskpassHelpers = Effect.fn("ssh/auth.ensureSshAskpassHelpers")(
-  function* (input: {
-    readonly directory: string;
-  }): Effect.fn.Return<string, PlatformError.PlatformError, FileSystem.FileSystem | Path.Path> {
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const descriptor = yield* buildSshAskpassHelperDescriptor(input);
+  const fs = yield* FileSystem.FileSystem;
-    const platform = yield* HostProcessPlatform;
+  const path = yield* Path.Path;
+  const descriptor = yield* buildSshAskpassHelperDescriptor(input);
+  const platform = yield* HostProcessPlatform;
 
-    yield* fs.makeDirectory(path.dirname(descriptor.launcherPath), { recursive: true });
+  yield* fs.makeDirectory(path.dirname(descriptor.launcherPath), { recursive: true });
 
+  for (const file of descriptor.files) {
+    const existing = yield* fs.exists(file.path);
+    const current = existing ? yield* fs.readFileString(file.path) : null;
+    if (current !== file.contents) {
+      yield* fs.writeFileString(file.path, file.contents);
-    for (const file of descriptor.files) {
-      const existing = yield* fs.exists(file.path);
-      const current = existing ? yield* fs.readFileString(file.path) : null;
+    }
+    if (file.mode !== undefined && platform !== "win32") {
+      yield* fs.chmod(file.path, file.mode);
-      if (current !== file.contents) {
-        yield* fs.writeFileString(file.path, file.contents);
-      }
-      if (file.mode !== undefined && platform !== "win32") {
-        yield* fs.chmod(file.path, file.mode);
-      }
     }
+  }
 
-    return descriptor.launcherPath;
-  },
+  return descriptor.launcherPath;
+});
-);
 
 export const buildSshChildEnvironment = Effect.fn("ssh/auth.buildSshChildEnvironment")(function* (
   input: SshChildEnvironmentOptions = {},
```

## packages/ssh/src/command.ts

Status: modified; +1; −1

```diff
@@ -80,7 +80,7 @@
     .slice(0, 16);
 }
 
-export function buildSshHostSpec(target: DesktopSshEnvironmentTarget): string {
+function buildSshHostSpec(target: DesktopSshEnvironmentTarget): string {
   const destination = target.alias.trim() || target.hostname.trim();
   if (destination.length === 0) {
     throw new Error("SSH target is missing its alias/hostname.");
```

## packages/ssh/src/config.ts

Status: modified; +1; −1

```diff
@@ -89,7 +89,7 @@
   return matchedPaths.toSorted((left, right) => left.localeCompare(right));
 });
 
-export const collectSshConfigAliasesFromFile = Effect.fnUntraced(function* (
+const collectSshConfigAliasesFromFile = Effect.fnUntraced(function* (
   filePath: string,
   visited = new Set<string>(),
   homeDir: string,
```

## packages/ssh/src/tunnel.ts

Status: modified; +9; −9

```diff
@@ -49,7 +49,7 @@
   SshReadinessError,
 } from "./errors.ts";
 
-export const DEFAULT_REMOTE_PORT = 3773;
+const DEFAULT_REMOTE_PORT = 3773;
 const REMOTE_PORT_SCAN_WINDOW = 200;
 const SSH_READY_TIMEOUT_MS = 20_000;
 const SSH_READY_PROBE_TIMEOUT_MS = 1_000;
@@ -209,7 +209,7 @@
 (${remoteNodeEngineCheckMain.toString()})();`;
 }
 
+function normalizeSshErrorMessage(stderr: string, fallbackMessage: string): string {
-export function normalizeSshErrorMessage(stderr: string, fallbackMessage: string): string {
   const cleaned = stderr.trim();
   return cleaned.length > 0 ? cleaned : fallbackMessage;
 }
@@ -270,7 +270,7 @@
 })().catch(() => process.exit(1));
 `;
 
+const REMOTE_WAIT_READY_SCRIPT = `const http = require("node:http");
-export const REMOTE_WAIT_READY_SCRIPT = `const http = require("node:http");
 const port = Number.parseInt(process.argv[2] ?? "", 10);
 const timeoutMs = Number.parseInt(process.argv[3] ?? "", 10);
 const probeTimeoutMs = Number.parseInt(process.argv[4] ?? "", 10);
@@ -318,7 +318,7 @@
 })().catch(() => process.exit(1));
 `;
 
-export const REMOTE_NODE_ENV_SCRIPT = `prepend_path_if_dir() {
+const REMOTE_NODE_ENV_SCRIPT = `prepend_path_if_dir() {
   if [ -d "$1" ]; then
     case ":$PATH:" in
       *":$1:"*) ;;
@@ -411,7 +411,7 @@
 }
 `;
 
-export const REMOTE_RUNNER_SCRIPT = `#!/bin/sh
+const REMOTE_RUNNER_SCRIPT = `#!/bin/sh
 set -eu
 @@T3_NODE_ENV_SCRIPT@@
 ensure_remote_node_path || true
@@ -456,7 +456,7 @@
 exit 1
 `;
 
+const REMOTE_LAUNCH_SCRIPT = `set -eu
-export const REMOTE_LAUNCH_SCRIPT = `set -eu
 @@T3_NODE_ENV_SCRIPT@@
 STATE_KEY="$1"
 STATE_DIR="$HOME/.t3/ssh-launch/$STATE_KEY"
@@ -615,7 +615,7 @@
 printf '{"remotePort":%s,"serverKind":"%s"}\\n' "$REMOTE_PORT" "\${REMOTE_MANAGED:-managed}"
 `;
 
-export const REMOTE_PAIRING_SCRIPT = `set -eu
+const REMOTE_PAIRING_SCRIPT = `set -eu
 STATE_DIR="$HOME/.t3/ssh-launch/@@T3_STATE_KEY@@"
 DEFAULT_SERVER_HOME="$HOME/.t3"
 RUNNER_FILE="$STATE_DIR/run-t3.sh"
@@ -628,7 +628,7 @@
 "$RUNNER_FILE" auth pairing create --base-dir "$PAIRING_BASE_DIR" --json
 `;
 
-export const REMOTE_STOP_SCRIPT = `set -eu
+const REMOTE_STOP_SCRIPT = `set -eu
 STATE_DIR="$HOME/.t3/ssh-launch/@@T3_STATE_KEY@@"
 PID_FILE="$STATE_DIR/pid"
 PORT_FILE="$STATE_DIR/port"
@@ -823,7 +823,7 @@
   };
 });
 
-export const stopRemoteServer = Effect.fn("ssh/tunnel.stopRemoteServer")(function* (
+const stopRemoteServer = Effect.fn("ssh/tunnel.stopRemoteServer")(function* (
   target: DesktopSshEnvironmentTarget,
   input?: SshAuthOptions,
 ): Effect.fn.Return<
```