One reusable OpenSSH connection per workspace

[blooop]

Question

Give each workspace one reusable OpenSSH connection instead of a new one per
dl run. Per #390 — read its
resolution comment first, and note the framing that makes this small: dl already
runs OpenSSH into containers, so this adds -o flags to an argv it already
builds. It is not a new transport.

The change:

• ControlMaster=auto, ControlPath=<derived socket>, ControlPersist=60 as
  three -o flags. A ControlPersist constant, so the value is named once.
• A derived ControlSocket whose digest covers the SendEnv permit list and
  SSH_AUTH_SOCK. This is the load-bearing part and the reason it is derived
  rather than a path someone writes: What a devpod ssh trip costs per connection, and whether it can be reused #389 measured that a reused master
  filters SendEnv against its own permit list, silently, at exit 0, so a
  master opened without GH_TOKEN in its list yields an empty GH_TOKEN and an
  unauthenticated gh with no error. Putting the permit list in the socket's
  identity makes that mismatch unrepresentable — a different permit list is a
  different socket, so it cannot be silently reused.
• Reuse::Multiplexed | Reuse::Direct as a sum, not an Option (principle 3).
• The mandatory test is a property test over the permit-list key: two argvs
  whose permit lists differ must never derive one socket.

Expected: ~100x on reuse (#390 measured 2590-3140ms to 16-28ms on a load-21 rig),
and #389's 2s-per-trip concurrency staircase collapses, because non-multiplexed
trips serialize on a per-workspace lock.

Safety is already measured, in #389: a ControlMaster fails closed four ways —
a recreate under a live master leaves the socket gone and -O check at rc=255
(40 trips across a concurrent recreate: 28 to the old container, trip 29 rc=255,
30-40 correctly to the new one), and docker stop/start plus a SIGKILLed
master both recover. Note also that any devpod up rewrites devpod's ssh
config and deletes anything inside its markers, so nothing may be persisted
there.

Spawn counts do not move — auto needs no pre-warm — but the pinned argv
does, so expect the argv pins to change and say so.

Blocked on dl finding devpod's ssh config where devpod writes it.

Notes for the builder

• Cut from origin/main; use your own worktree.
• Guards in rust/: cargo test --workspace, cargo clippy --locked --all-targets -- -D warnings,
  cargo fmt --check.
• Known flake, do not chase: aid's a_pasted_multi_line_prompt_arrives_whole_rather_than_leaking.

[blooop]

The stated blocker is resolved on main, so this is unblocked and claimed (see below). rust/devlaunch-core/src/clients/ssh.rs now resolves devpod's ssh config exactly where devpod writes it: $DEVPOD_SSH_CONFIG, then provider option SSH_CONFIG_PATH, then ~/.ssh/config, against devpod 0.26.1's ConfigureSSHConfig, pinned by devpod_ssh_config_is_where_dl_looks_before_the_home_default (ssh.rs:783). This is the highest-value open ticket for the actual usage: the 2590-3140ms to 16-28ms reuse saving lands on the exact trip that carries every dl <spec> -- <cmd> and every aid, and it collapses #389's per-trip concurrency staircase, which bites hardest with many simultaneous short-lived workspaces.

One interaction rides along: devlaunch-runner/src/lib.rs:489-491 names git's ssh ControlMaster as the production case for a descendant holding a pipe past child exit, and this ticket adds a second ControlMaster on the hottest path, so #501's shared-drain-deadline decision lands in the same PR rather than waiting to be rediscovered as a latency mystery.

[blooop]

Claimed 2026-08-29: build in progress from an interactive session (agent in an isolated worktree), managed by session devlaunch-2b. PR to follow. If you are another session looking at this ticket, pick a different one.

[blooop]

Built: #523. Two commits, the second being #501's decided fix.

The three options land on the argv clients/ssh.rs already built, and ControlMaster=auto keeps the spawn counts where they were. The digest inputs are the three the resolution named: the host alias, the SendEnv permit list, and $SSH_AUTH_SOCK, each field length-prefixed so no two inputs can encode alike, 16 hex characters of SHA-256 under an ssh-control leaf of the cache dir at 0700. The config path is deliberately not in it, and the reason is written down where the function is: the alias carries the workspace id, which is itself a content digest, so two configs publishing one alias are publishing one workspace.

The permit-list property is red without the permit list in the key, checked rather than assumed, at both the digest (two_send_env_permit_lists_never_derive_one_socket) and the flow (a_run_with_a_token_and_a_run_without_never_share_a_master). Reuse::Multiplexed | Reuse::Direct is the sum principle 3 asked for, and both fail-closed causes have a test: a path too long for sun_path, and a directory dl cannot make.

Not merged.

[blooop]

Follow-up on the fail-closed arm, found in self-review after the PR opened and now in the same commit.

Reuse::Direct had two causes; it has three. OpenSSH runs ControlPath through percent_expand before it binds anything, and an unknown key there is fatal() rather than a warning. The derived file name is hex and cannot hold a %, but everything above it is the user's cache directory and dl does not get to say what is in that, so an XDG_CACHE_HOME containing a % would have made every terminal session die. That is the one outcome this ticket is not allowed to cause, so a % anywhere in the socket path now means do not multiplex, on the same footing as a path that will not fit in sun_path. Pinned by a_cache_directory_with_a_percent_in_it_leaves_the_session_direct, red without the guard.

[blooop]

The length limit was wrong, and CI caught it the way it should have. Recording it because it is a fact about OpenSSH that the ticket's "mind ControlPath length limits" constraint does not by itself get you to.

muxserver_listen does not bind the path it was given. It binds <ControlPath>.<16 random characters> and rename(2)s that into place once the socket is listening. So what has to fit in sun_path is 17 bytes longer than what dl composes, and a check against 104 is 17 bytes too generous. The first CI run took the e2e suite down with it: pytest's own scratch directory produced a 96-byte path, which fits in 104 and does not fit once OpenSSH appends .N3IKqcZJ1KbkenKb, and thirteen tests failed at unix_listener: path ... too long for Unix domain socket — exit 255, the session gone. Not a warning, not a fallback: the exact failure mode the Direct arm exists to make impossible.

The limit is now SUN_PATH - 1 - LISTEN_SUFFIX with both named and the reason written where the constant is. Pinned by the_room_openssh_takes_for_its_own_temporary_socket_is_counted_too, whose fixture sits deliberately in the band that fits on its own and does not fit with the suffix, in a directory dl can really create so the only thing under test is the length. The first version of that test passed against the buggy limit because its fixture directory was unwritable and fell to Direct for the wrong reason; that is fixed, and the red check was re-run against the buggy constant.

[blooop]

Green at 8739e57: every check passing, gate included, and the e2e suite that caught the sun_path miscount now passes with the corrected budget. Rebased on current main. Left open, not merged.