identity: nest the block by tool, and derive the field set from the struct (closes #454)

[vyskocilm]

Closes #454.

[identity] becomes a container of per-tool blocks with no keys of its own:

[profile.work.identity.ssh]
host  = "ghe.corp"
key   = "{home}/.ssh/work.pub"
agent = "proxy"
[profile.work.identity.git]
name        = "Your Name"
email       = "you@work.example"
signing_key = "{home}/.ssh/sign.pub"
[profile.work.identity.gh]
host = "ghe.corp"
user = "work-account"

Scoped by SUBJECT, not consumer: signing_key under git because git signs with it, even though the ssh proxy holds the pin. Each block independently optional, nothing inherited between them.

The field set is derived from the type

identityFields walks Identity's snug:"key,path" tags at package init and drives BOTH sinks — CheckText's forging-rune refusal and Resolve's expand-and-symlink-check loop. The type is the table, so a leaf cannot exist without passing through both. That is #549's stated acceptance criterion, met here; #549 is re-scoped accordingly.

It is also what nesting would otherwise have BROKEN. TestCheckTextCoversEveryIdentityField walked reflect.TypeOf(Identity{}) and skipped non-String kinds; nesting makes all seven fields struct-kinded, so that sweep would have passed vacuously while CheckText silently stopped checking every field — a forging rune back into ~/.gitconfig, ~/.ssh/config and hosts.yml. Now TestCheckTextRefusesAForgingRuneAtEveryIdentityLeaf, driven off identityFields, asserting the enumeration is exactly eight keys.

Nested by value, and == does not guard it

A pointer is comparable, so var _ = Identity{} == Identity{} passes while three things break:

1. *p.Identity != id degrades to pointer identity — byte-identical blocks refuse each other.
2. id := *prof.Identity shares the inner struct with the LOADED profile, so the normalisation write-back mutates the registry: resolve([a,b]) differs from resolve([b,a]) in rendered output. The decisive one — an invariant, not a message.
3. FieldByIndex panics on a nil pointer in the path.

mustIdentityFields refuses any kind but struct/string at init; TestIdentityHasNoReferenceKindedField names all three.

gh_host was one field four consumers read, now two

identity.ssh.host feeds the generated ~/.ssh/config Host line, the known_hosts filter and git's insteadOf — the host you push to. identity.gh.host feeds the token. Unexported host() gone; SSHHost()/GhHost() replace it and collapse six copies of the "github.com" literal into policy.DefaultIdentityHost. identityHost → identitySSHHost, reading ssh.host.

ssh_mode → identity.ssh.agent, and the VALUE changed: "agent-proxy" → "proxy". ParseSSHMode grows no arm for the old spelling — its doc says why the accepted set must read as the whole set — so agent = "agent-proxy" is refused by naming the accepted set: unknown identity.ssh.agent "agent-proxy" (want proxy or none), exit 77.

Three refusals, each naming the fix

• an [identity] block setting nothing. Not inert: a non-nil Identity sets IdentityOwner, relabelling the generated ~/.gitconfig's provenance git:<name> → identity:<name>, so --dry-run and snug profile show claimed a pin that did not exist
• a host named in one block while the other is active and names none, both arms. Without it, [identity.gh] host = "ghe.corp" alone leaves ssh on github.com: every push fails Permission denied (publickey) against generated files that misdescribe the cause. Not the cross-field constraint [identity] Nest the identity block by tool: identity.ssh.key, identity.git.signing_key, identity.gh.user #454 declined — the hosts may DIFFER; this refuses a profile that is INCOMPLETE, the shape of the two refusals already there
• identity.gh.host with no identity.gh.user. That staged the token of whatever account the host's gh was logged into, as user: x-access-token, and showIdentity rendered nothing because its gh row keys on the user. stageGhConfig's gate is now id.Gh.User == "" — fail-closed, so deleting the refusal reverts to "no token" not "unpinned token" — the x-access-token fallback is deleted, and test/guard keeps the literal out of non-test Go

First three in toIdentity (properties of the profile TEXT, so the verdict is host-independent and a refused key cannot reach a generator). Last two in Resolve, the door every Identity passes including one built in Go — which is what both identity goldens are.

Measured: snug profile show does NOT run Resolve (showCapabilities renders a Profile pre-resolution, which is why its golden shows unexpanded {home}/…). So those two show on --dry-run and on a real run, not on that screen — the same reach ParseSSHMode's unknown-value refusal has always had. No second copy added.

redteam: one confirmed finding, fixed here

A refusal forged snug's own voice. A symlink planted in the writable target by a previous run — underTargetIsLiteral's own stated threat — with control bytes in its destination:

snug: profile "rt": grant .../tgt/vendor resolves to .../real^[[2K^[[1Asnug: policy verified, sandbox is safe: a symlink inside …

^[[2K^[[1A erases the warning and prints that over it. The word "safe", in snug's voice, is the attacker's.

Two arms, and escaping the obvious half would not have closed it: underTargetIsLiteral prints the destination itself, but two sites wrapped an fs.PathError with %w, and for a dangling symlink that error's Path IS the destination — the bytes arrived through the error text while the interpolated path looked handled. visibleErr renders err.Error() through VisibleText and drops %w deliberately (no caller needs the chain; the ErrNotExist branch is taken above on the same error).

A/B on the identical payload: raw ESC on the parent commit, \x1b with the fix. Four golden rows in testdata/refusals.txt pin the escaped form; grep -cP '\x1b' over that file returns 0. Each has a paired unit test through the injected Environ (fakeEnv gains symlinkErrs), and the two symlink arms have positive controls, because a function escaping everything into noise would pass the negatives.

Why it shipped, stated where someone will look: TestNoSnugScreenEmitsARawControlCharacter drives dryRun over a SUCCESSFULLY RESOLVED policy, so it structurally cannot reach a Resolve-time refusal. visible_test.go now says that rather than implying coverage it lacks.

Held under attack: CheckText over all eight leaves against seven rune classes; toIdentity as the only constructor; showIdentity's rows (the show() closure re-escapes the assembled line); the pin in both orders, through include, with byte-identical blocks resolving together; stageGhConfig's gate.

Second round, after the refusal deletions and the token seam. Two findings, both fixed here with named regression tests A/B'd against the unfixed tree.

F1, sev:medium, invariant 5. A gh-only [identity] was silently inert. startIdentity opened with one early return on id.SSH.Agent == SSHNone and stageGhConfig sat at the BOTTOM of the function that return guarded. So [identity.gh] user = "you" alone — the natural spelling once the block is nested by tool, and a shape the maintainer decision on this ticket keeps legal — got no token, no GH_CONFIG_DIR, no GH_HOST, no line saying so, rc=0. Measured with a recording gh stub: env | grep -c '^GH_' → 0, stub log empty, so not even the host touch happened. snug profile show meanwhile printed THE SANDBOX HOLDS A FORGE TOKEN FOR THIS ACCOUNT in capitals. The exact sentence stageGhConfig's own refusal exists to prevent, reached by the gate ABOVE it.

The ssh half moves to startSSHIdentity verbatim; startIdentity gates that on the agent mode and calls stageGhConfig unconditionally. Nothing else belongs behind the agent gate — the staged public key exists so the generated ~/.ssh/config's IdentityFile resolves and resolve.go generates that file for every mode except none; identity.git.signing_key is refused in Resolve without an agent. No builtin defines a gh identity, so nothing previously inert starts staging a credential.

F2, sev:low. profile show rendered a capability row for a profile no run can use. The accepted set of agent modes was checked only in Resolve, and snug profile show does not resolve — it renders a *policy.Profile straight from the registry. agent = "agent-proxy" therefore rendered its ssh key row, the mode verbatim as (agent-proxy) and the blast-radius paragraph, rc=0, while every run exited 77. toIdentity now calls policy.ParseSSHMode as well: not a second LIST of accepted spellings, a second CALL to the one function that owns the list. Both screens now exit 77 naming the file, the profile and the accepted set.

Regression tests: TestAGhOnlyIdentityIsNotSilentlyInert (integration), TestUnknownAgentModeIsRefusedAtParseTime (internal/profile). Both fail against the unfixed code.

What the round could NOT break, recorded so it is not re-spent: every deleted key refused at every nesting and spelling (root, inline table, dotted key, inline sub-table); no case-folding collision onto a surviving tag (go-toml matches toml: tags case-insensitively but not Go field names — SigningKey is an unknown field); no downgrade through the BadFile path (run, --dry-run, --json, profile list/show/tree, config all 77, doctor 69); the staged token absent from --dry-run, -v, --json, --explain, /run/user, $HOME and /tmp — the argv carries --file 19, never the bytes; the half-named-host refusal fires BEFORE the gh exec (stub log empty); and every forging class refused at identity.gh.* by CheckText, including U+2028/U+2029/U+0085, which YAML treats as line breaks and which would otherwise have written a second host entry into hosts.yml.

Every retired-key refusal is gone, including the ones that predate this change

snug commits to no configuration compatibility, so a key it no longer has gets no migration arm. Deleted with the struct fields that existed only to keep them decoding: retiredEnvKey (env = [...]), retiredPathKey (path = [...]), retiredAnonKey (address/gateway/address6/gateway6), retiredFlatIdentity (the seven flat identity keys) and retiredAgentProxyValue.

DisallowUnknownFields answers instead, and its answer is not the bare "unknown key" the deleted essay argued against — go-toml quotes the file, the line and underlines the field:

.../p.toml: unknown key (snug decodes profiles strictly, so a key it does not
understand is an error rather than a silently ignored grant):
4| address = "10.13.13.2/24"
 | ~~~~~~~ unknown field

Exit 77 either way. Invariant 5 asks a refusal to say what to write; it never asked it to name the previous spelling. emptyIdentityBlock stays, and the line is why: an empty [identity] PARSES, so it is a shape that is silently wrong rather than a spelling that is gone.

Prose corrected where it lives: ENVIRONMENT-VARIABLES.md §6 and its header, policy/profile.go's Environ comment, VERIFY.md §4b-ter. Four places still spelling the agent mode agent-proxy after the rename are fixed too, including INDEX.md's copy of the const block.

Goldens

• internal/cli/testdata/identity.bwrap.txt — zero-line diff, and the test now says a diff there means staging changed.
• show-identity.capabilities.txt — (agent-proxy) → (proxy), and the gh row becomes a capRows block naming the token's blast radius: admin:public_key lets anything inside add an SSH key to the account, an effect that OUTLIVES the sandbox.
• refusals.txt — the remediation block in the nested spelling, plus the four forging rows.
• testdata/identity-generated.txt is new, and it is the only thing that can ever see the host split. --ro-bind-data carries generated bytes over an fd, so no argv golden contains them — measured: a --dry-run with ssh.host = ssh.example and gh.host = gh.example prints neither string anywhere. It pins ~/.gitconfig, ~/.ssh/config and known_hosts, all three naming ssh.example.

Verification

• make gate green.
• SNUG_REQUIRE_SANDBOX=1 make integration exit 0, 0 failures, engine floor 46/46, 397 passes.
• Every refusal, the one-tool identity, and the nested decode exercised end-to-end with the real binary.
• stageGhConfig gained a tokenMinter parameter so the gh half of the host split — gh auth token --hostname, the hosts.yml top key, GH_HOST — is assertable without a forge account. It was covered by nothing pure before, and swapping the two accessors produced no golden diff anywhere. Four tests in internal/cli/ghhostsplit_test.go; identitygeneratedgolden_test.go now states what it cannot see.
• New tests A/B'd against the unfixed tree: all four forging tests fail without the resolve.go change.

NOT verified: VERIFY.md §13 is rewritten but not walked by hand — it needs two real accounts with two agent-held keys. Its TOML blocks are parsed by docexamples_test.go (green), so the fixtures load; the procedure itself is unexecuted.

Migration is a hard break by design. A profile with the flat keys is refused by the strict decoder, with the offending line quoted and underlined — never silently accepted.

🤖 Generated with Claude Code