feat(container): show SSH connection information - #1581

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

The pull request adds and registers a container info command. It reports SSH details and, when available, Git checkout root, branch, and commit in JSON or table form. Tests cover command output, setup-result errors, and Git checkout cases.

Changes: Container Info

Layer / File(s)	Summary
Command and setup flow cmd/internal/agentcontainer/info.go, cmd/internal/agentcontainer/container.go, cmd/internal/container.go, cmd/root.go, cmd/container_info_test.go	Adds and registers the info command. The command reads and validates the setup result, then writes SSH and checkout details as JSON or a table. Tests cover both entrypoints, output modes, and setup failures.
Git checkout discovery and validation cmd/internal/agentcontainer/info.go, cmd/internal/agentcontainer/info_test.go	Discovers and validates Git metadata, resolves checkout root, branch, and commit, and tests worktree, detached, unborn, outside-repository, bare-repository, and error cases.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant NewInfoCmd
  participant SetupCommand
  participant Git
  participant OutputWriter
  NewInfoCmd->>SetupCommand: Read container setup result
  SetupCommand-->>NewInfoCmd: Return setup JSON
  NewInfoCmd->>Git: Read checkout metadata
  Git-->>NewInfoCmd: Return checkout fields or no checkout
  NewInfoCmd->>OutputWriter: Write JSON or table

Loading

Suggested reviewers: skevetter

Container info can omit checkout details when launched from a Git-influenced environment. Fix the environment filtering before merging, or accept this bounded reporting risk.

The command reports narrowly selected local information without opening an SSH connection or granting new privileges. No introduced privilege escalation or credential disclosure was established. Deployment permissions and unusual configured-user values remain incompletely verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated reporting scope is the invoking process's environment, selected container-local setup file, and filesystem-accessible checkout. No new cross-container lookup, credential acquisition, or service privilege is present in the added path. Actual mounted-data access remains dependent on deployment permissions.

Trust Boundaries and Controls

• observed — The workspace environment check establishes context, not authenticated identity. Setup selection restricts reads to fixed primary or fallback result paths. The generated shell script quotes those paths, while Git receives fixed argument lists. The displayed SSH command is output text, not a subprocess invocation.

Resilience and Maintainability Implications

• observed — The command rejects malformed, structurally incomplete, or explicitly failed setup results. These checks do not authenticate setup-file provenance or validate remote-user syntax. The existing producer writes its result before later setup operations, so readable metadata is not proof that every setup phase completed.

Hardening Proposals

• proposed — Make the copyable SSH command's destination boundary explicit and define acceptable configured-user representations. Shell quoting and SSH option parsing are separate contracts; this is defense in depth, not a verified command-execution finding.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 4.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 6 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: adding container SSH connection information.
Description check		The description is mostly complete. It explains the feature, classifies the change, documents AI assistance, lists integration and unit tests, records verification results and known failures, and comp…

Full details: Description check

Explanation

The description is mostly complete. It explains the feature, classifies the change, documents AI assistance, lists integration and unit tests, records verification results and known failures, and completes the relevant checklist items. The required reviewer-attestation checkboxes remain unchecked, and the full CLI test suite is reported as failing, but these disclosures do not make the description incomplete.

✨ Simplify code

• Create a new PR

• X
• Mastodon
• Reddit
• LinkedIn