boxdown 1.0.0 → 1.2.1

package/src/purge.ts

@@ -0,0 +1,216 @@
+import { existsSync, rmSync } from 'node:fs'
+import { basename, dirname, isAbsolute, join, parse, relative, resolve } from 'node:path'
+
+import { claudeSshConfigEntryForWorkspace, uninstallClaudeSshConfigHost } from './claude-app-config.ts'
+import { codexProjectEntryForWorkspace, legacyCodexRemotePathForWorkspace, uninstallCodexAppConfigProject, uninstallCodexGlobalStateProject } from './codex-app-config.ts'
+import { findWorkspaceContainer, inspectContainerImage, removeContainerById, removeDockerImage } from './devcontainer.ts'
+import type { WorkspaceCommandLogger } from './logging.ts'
+import { readWorkspaceMetadata, type WorkspaceMetadata } from './metadata.ts'
+import type { WorkspaceContext } from './paths.ts'
+import { defaultSshAlias, uninstallSshConfig } from './ssh-config.ts'
+import type { ContainerSummary } from './status.ts'
+
+export interface PurgeOptions {
+  alias?: string
+  logger?: WorkspaceCommandLogger
+}
+
+function errorMessage (error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+async function runPurgeStep (label: string, action: () => Promise<void> | void): Promise<boolean> {
+  try {
+    await action()
+    return false
+  } catch (error) {
+    process.stderr.write(`Failed ${label}: ${errorMessage(error)}\n`)
+    return true
+  }
+}
+
+function uniqueAliases (aliases: Array<string | undefined>): string[] {
+  return [...new Set(aliases.filter((alias): alias is string => alias !== undefined))]
+}
+
+function pathIsInsideOrSame (parent: string, candidate: string): boolean {
+  const path = relative(parent, candidate)
+  return path === '' || (!path.startsWith('..') && !isAbsolute(path))
+}
+
+function assertSafeWorkspaceStateDir (
+  context: WorkspaceContext,
+  path: string,
+  root: string
+): void {
+  const resolvedPath = resolve(path)
+  const resolvedRoot = resolve(root)
+  const expectedPath = resolve(join(resolvedRoot, 'workspaces', context.workspaceId))
+
+  if (resolvedPath !== expectedPath) {
+    throw new Error(`Refusing to purge unexpected state path: ${path}`)
+  }
+
+  if (resolvedRoot === parse(resolvedRoot).root) {
+    throw new Error(`Refusing to purge state under filesystem root: ${path}`)
+  }
+
+  if (basename(resolvedPath) !== context.workspaceId || basename(dirname(resolvedPath)) !== 'workspaces') {
+    throw new Error(`Refusing to purge non-workspace state path: ${path}`)
+  }
+
+  if (pathIsInsideOrSame(resolve(context.workspaceFolder), resolvedPath)) {
+    throw new Error(`Refusing to purge state inside the workspace repository: ${path}`)
+  }
+
+  if (!pathIsInsideOrSame(resolvedRoot, resolvedPath)) {
+    throw new Error(`Refusing to purge state outside its root: ${path}`)
+  }
+}
+
+function removeWorkspaceStateDir (
+  context: WorkspaceContext,
+  label: string,
+  path: string,
+  root: string
+): void {
+  assertSafeWorkspaceStateDir(context, path, root)
+
+  if (!existsSync(path)) {
+    process.stdout.write(`${label} absent: ${path}\n`)
+    return
+  }
+
+  rmSync(path, { recursive: true, force: true })
+  process.stdout.write(`Removed ${label}: ${path}\n`)
+}
+
+export function removeWorkspaceRuntimeState (context: WorkspaceContext): void {
+  removeWorkspaceStateDir(context, 'workspace runtime directory', context.workspaceRuntimeDir, context.runtimeRoot)
+}
+
+async function purgeAliasIntegrations (context: WorkspaceContext, alias: string): Promise<boolean> {
+  let failed = false
+
+  failed = await runPurgeStep(`SSH alias ${alias}`, () => {
+    const changed = uninstallSshConfig(alias, { quiet: true })
+    process.stdout.write(changed
+      ? `Removed SSH alias: ${alias}\n`
+      : `SSH alias absent: ${alias}\n`)
+  }) || failed
+
+  const entry = codexProjectEntryForWorkspace(context, alias)
+  const legacyRemotePath = legacyCodexRemotePathForWorkspace(context)
+
+  failed = await runPurgeStep(`Codex app config for ${alias}`, () => {
+    const result = uninstallCodexAppConfigProject(entry, {
+      additionalRemotePaths: [legacyRemotePath]
+    })
+    process.stdout.write(result.changed
+      ? `Removed Codex remote project: ${entry.label} (${alias})\n`
+      : `Codex remote project absent: ${entry.label} (${alias})\n`)
+  }) || failed
+
+  failed = await runPurgeStep(`Codex app state for ${alias}`, () => {
+    const result = uninstallCodexGlobalStateProject(entry, {
+      additionalRemotePaths: [legacyRemotePath]
+    })
+    process.stdout.write(result.changed
+      ? `Removed Codex sidebar state: ${entry.label} (${alias})\n`
+      : `Codex sidebar state absent: ${entry.label} (${alias})\n`)
+  }) || failed
+
+  const claudeEntry = claudeSshConfigEntryForWorkspace(context, alias)
+
+  failed = await runPurgeStep(`Claude SSH config for ${alias}`, () => {
+    const result = uninstallClaudeSshConfigHost(claudeEntry)
+    process.stdout.write(result.changed
+      ? `Removed Claude SSH remote: ${claudeEntry.name} (${alias})\n`
+      : `Claude SSH remote absent: ${claudeEntry.name} (${alias})\n`)
+  }) || failed
+
+  return failed
+}
+
+export async function purgeWorkspace (context: WorkspaceContext, options: PurgeOptions = {}): Promise<number> {
+  let failed = false
+  let metadata: WorkspaceMetadata | undefined
+  let container: ContainerSummary | undefined
+  let dockerImageId: string | undefined
+
+  process.stdout.write(`Purging Boxdown workspace: ${context.workspaceFolder}\n`)
+
+  failed = await runPurgeStep('workspace metadata snapshot', () => {
+    metadata = readWorkspaceMetadata(context)
+    dockerImageId = metadata?.dockerImageId
+    process.stdout.write(metadata === undefined
+      ? `Workspace metadata absent: ${context.workspaceDataDir}\n`
+      : `Snapshot workspace metadata: ${context.workspaceDataDir}\n`)
+  }) || failed
+
+  for (const alias of uniqueAliases([
+    options.alias,
+    metadata?.sshAlias,
+    defaultSshAlias(context.workspaceBasename)
+  ])) {
+    failed = await purgeAliasIntegrations(context, alias) || failed
+  }
+
+  failed = await runPurgeStep('workspace devcontainer lookup', async () => {
+    container = await findWorkspaceContainer(context, { logger: options.logger })
+
+    if (container === undefined) {
+      process.stdout.write(`Devcontainer absent: ${context.workspaceFolder}\n`)
+    } else {
+      process.stdout.write(`Found devcontainer: ${container.id}\n`)
+    }
+  }) || failed
+
+  const currentContainer = container
+
+  if (currentContainer !== undefined) {
+    failed = await runPurgeStep(`Docker image inspect for ${currentContainer.id}`, async () => {
+      const image = await inspectContainerImage(currentContainer.id, { logger: options.logger })
+
+      if (image === undefined) {
+        process.stdout.write(`Docker image not recorded by container inspect: ${currentContainer.id}\n`)
+        return
+      }
+
+      dockerImageId = image.id
+      process.stdout.write(image.name === undefined
+        ? `Resolved Docker image: ${image.id}\n`
+        : `Resolved Docker image: ${image.id} (${image.name})\n`)
+    }) || failed
+
+    failed = await runPurgeStep(`devcontainer ${currentContainer.id}`, async () => {
+      await removeContainerById(currentContainer.id, { volumes: true, logger: options.logger })
+      process.stdout.write(`Removed devcontainer with volumes: ${currentContainer.id}\n`)
+    }) || failed
+  }
+
+  if (dockerImageId === undefined) {
+    process.stdout.write('Docker image absent: no inspected or recorded image ID\n')
+  } else {
+    const removedImageId = dockerImageId
+    failed = await runPurgeStep(`Docker image ${removedImageId}`, async () => {
+      await removeDockerImage(removedImageId, { logger: options.logger })
+    }) || failed
+  }
+
+  failed = await runPurgeStep('workspace runtime directory', () => {
+    removeWorkspaceRuntimeState(context)
+  }) || failed
+
+  failed = await runPurgeStep('workspace cache directory', () => {
+    removeWorkspaceStateDir(context, 'workspace cache', context.workspaceCacheDir, context.cacheRoot)
+  }) || failed
+
+  failed = await runPurgeStep('workspace data directory', () => {
+    options.logger?.boxdown(`Removing workspace data: ${context.workspaceDataDir}\n`)
+    options.logger?.disable()
+    removeWorkspaceStateDir(context, 'workspace data', context.workspaceDataDir, context.dataRoot)
+  }) || failed
+
+  return failed ? 1 : 0
+}

package/src/shell.ts

@@ -45,16 +45,41 @@ function interactiveTtySetupScript (): string {
   ].join('\n')
 }
 
+function interactiveTermSetupScript (): string {
+  return [
+    'if ! infocmp "${TERM:-xterm-256color}" >/dev/null 2>&1; then',
+    '  export TERM=xterm-256color',
+    'fi',
+    'export COLORTERM="${COLORTERM:-truecolor}"'
+  ].join('\n')
+}
+
+function interactiveAgentPathScript (): string {
+  return [
+    'codex_home="${CODEX_HOME:-${HOME}/.codex}"',
+    'export PATH="${HOME}/.local/bin:${HOME}/.opencode/bin:${codex_home}/packages/standalone/current/bin:${PATH}"'
+  ].join('\n')
+}
+
+function runtimeSecretEnvironmentScript (): string {
+  return 'source "${BASH_ENV:-/opt/boxdown/devcontainer/utils/secret-env-bootstrap.sh}"'
+}
+
 export function interactiveShellScript (): string {
   return [
+    interactiveTermSetupScript(),
     interactiveTtySetupScript(),
+    runtimeSecretEnvironmentScript(),
     'exec bash -i'
   ].join('\n')
 }
 
 export function interactiveCommandScript (): string {
   return [
+    interactiveTermSetupScript(),
     interactiveTtySetupScript(),
+    interactiveAgentPathScript(),
+    runtimeSecretEnvironmentScript(),
     'exec "$@"'
   ].join('\n')
 }

package/src/ssh-config.ts

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 
 import type { WorkspaceContext } from './paths.ts'
@@ -45,36 +45,121 @@ export function buildSshConfigBlock (context: WorkspaceContext, alias: string):
   ].join('\n')
 }
 
-export function replaceSshConfigBlock (existingConfig: string, alias: string, block: string): string {
-  const begin = `# BEGIN ${alias} boxdown devcontainer ssh`
-  const end = `# END ${alias} boxdown devcontainer ssh`
+interface SshConfigMarkerSet {
+  begin: string
+  end: string
+}
+
+function managedSshConfigMarkerSets (alias: string): SshConfigMarkerSet[] {
+  return [
+    {
+      begin: `# BEGIN ${alias} boxdown devcontainer ssh`,
+      end: `# END ${alias} boxdown devcontainer ssh`
+    },
+    {
+      begin: `# BEGIN ${alias} devcontainer ssh`,
+      end: `# END ${alias} devcontainer ssh`
+    }
+  ]
+}
+
+function malformedSshConfigBlockError (alias: string, markers: SshConfigMarkerSet): Error {
+  return new Error(`Refusing to update SSH config for ${alias}: found "${markers.begin}" without matching "${markers.end}". Repair the config manually before running Boxdown again.`)
+}
+
+function overlappingSshConfigBlockError (alias: string, markers: SshConfigMarkerSet, marker: string): Error {
+  return new Error(`Refusing to update SSH config for ${alias}: found overlapping managed SSH config marker "${marker}" before matching "${markers.end}". Repair the config manually before running Boxdown again.`)
+}
+
+function isManagedSshConfigMarker (line: string): boolean {
+  return /^# (?:BEGIN|END) [A-Za-z0-9_.-]+ (?:boxdown )?devcontainer ssh$/u.test(line)
+}
+
+function stripManagedSshConfigBlocks (existingConfig: string, alias: string): { lines: string[], removed: boolean } {
+  const markerSets = managedSshConfigMarkerSets(alias)
   const lines = existingConfig.split(/\r?\n/)
   const nextLines: string[] = []
-  let skipping = false
+  let removed = false
+
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index]
+    const markers = markerSets.find((candidate) => candidate.begin === line)
 
-  for (const line of lines) {
-    if (line === begin) {
-      skipping = true
+    if (markers === undefined) {
+      nextLines.push(line ?? '')
       continue
     }
 
-    if (line === end) {
-      skipping = false
-      continue
+    let endIndex = -1
+    for (let candidateIndex = index + 1; candidateIndex < lines.length; candidateIndex++) {
+      const candidate = lines[candidateIndex] ?? ''
+
+      if (candidate === markers.end) {
+        endIndex = candidateIndex
+        break
+      }
+
+      if (isManagedSshConfigMarker(candidate)) {
+        throw overlappingSshConfigBlockError(alias, markers, candidate)
+      }
     }
 
-    if (!skipping) {
-      nextLines.push(line)
+    if (endIndex === -1) {
+      throw malformedSshConfigBlockError(alias, markers)
     }
+
+    removed = true
+    index = endIndex
+  }
+
+  return { lines: nextLines, removed }
+}
+
+function trimTrailingBlankLines (lines: string[]): void {
+  while (lines.length > 0 && lines[lines.length - 1] === '') {
+    lines.pop()
   }
+}
+
+function trimLeadingBlankLinesBeforeManagedBlock (lines: string[]): void {
+  const firstContentIndex = lines.findIndex((line) => line !== '')
 
-  while (nextLines.length > 0 && nextLines[nextLines.length - 1] === '') {
-    nextLines.pop()
+  if (firstContentIndex > 0 && isManagedSshConfigMarker(lines[firstContentIndex] ?? '')) {
+    lines.splice(0, firstContentIndex)
   }
+}
+
+function writeFileAtomic (path: string, contents: string, mode: number): void {
+  const destinationPath = existsSync(path) ? realpathSync(path) : path
+  const tmpPath = `${destinationPath}.tmp-${process.pid}-${Date.now()}`
+
+  writeFileSync(tmpPath, contents, { mode })
+  chmodSync(tmpPath, mode)
+  renameSync(tmpPath, destinationPath)
+}
+
+export function replaceSshConfigBlock (existingConfig: string, alias: string, block: string): string {
+  const { lines: nextLines } = stripManagedSshConfigBlocks(existingConfig, alias)
+
+  trimTrailingBlankLines(nextLines)
+  trimLeadingBlankLinesBeforeManagedBlock(nextLines)
 
   return `${nextLines.join('\n')}${nextLines.length > 0 ? '\n\n' : ''}${block}`
 }
 
+export function removeSshConfigBlock (existingConfig: string, alias: string): string {
+  const { lines: nextLines, removed } = stripManagedSshConfigBlocks(existingConfig, alias)
+
+  if (!removed) {
+    return existingConfig
+  }
+
+  trimTrailingBlankLines(nextLines)
+  trimLeadingBlankLinesBeforeManagedBlock(nextLines)
+
+  return nextLines.length > 0 ? `${nextLines.join('\n')}\n` : ''
+}
+
 export async function installSshConfig (context: WorkspaceContext, alias: string, options: { quiet?: boolean, configPath?: string } = {}): Promise<void> {
   validateSshAlias(alias)
   await ensureHostSshKey(context, options.quiet ?? false)
@@ -95,7 +180,7 @@ export async function installSshConfig (context: WorkspaceContext, alias: string
   const nextConfig = replaceSshConfigBlock(existingConfig, alias, block)
 
   if (nextConfig !== existingConfig) {
-    writeFileSync(sshConfigPath, nextConfig)
+    writeFileAtomic(sshConfigPath, nextConfig, 0o600)
     if (!options.quiet) {
       process.stdout.write(`Installed SSH alias: ${alias}\n`)
     }
@@ -111,3 +196,36 @@ export async function installSshConfig (context: WorkspaceContext, alias: string
     process.stdout.write(`Validate with:\n  ssh ${alias} 'whoami && pwd'\n`)
   }
 }
+
+export function uninstallSshConfig (alias: string, options: { quiet?: boolean, configPath?: string } = {}): boolean {
+  validateSshAlias(alias)
+
+  const sshConfigPath = options.configPath ?? defaultSshConfigPath()
+
+  if (!existsSync(sshConfigPath)) {
+    if (!options.quiet) {
+      process.stdout.write(`SSH alias not installed: ${alias}\n`)
+      process.stdout.write(`SSH config: ${sshConfigPath}\n`)
+    }
+
+    return false
+  }
+
+  const existingConfig = readFileSync(sshConfigPath, 'utf8')
+  const nextConfig = removeSshConfigBlock(existingConfig, alias)
+  const changed = nextConfig !== existingConfig
+
+  if (changed) {
+    writeFileAtomic(sshConfigPath, nextConfig, 0o600)
+    chmodSync(sshConfigPath, 0o600)
+  }
+
+  if (!options.quiet) {
+    process.stdout.write(changed
+      ? `Uninstalled SSH alias: ${alias}\n`
+      : `SSH alias not installed: ${alias}\n`)
+    process.stdout.write(`SSH config: ${sshConfigPath}\n`)
+  }
+
+  return changed
+}

package/src/ssh-install-targets.ts

@@ -0,0 +1,111 @@
+import { claudeSshConfigEntryForWorkspace, installClaudeSshConfigHost } from './claude-app-config.ts'
+import { codexProjectEntryForWorkspace, installCodexAppConfigProject, installCodexGlobalStateProject, legacyCodexRemotePathForWorkspace } from './codex-app-config.ts'
+import type { WorkspaceContext } from './paths.ts'
+
+export type SshConfigInstallTarget = 'codex' | 'claude'
+
+export interface SshInstallTargetDefinition {
+  value: SshConfigInstallTarget
+  label: string
+  description: string
+  flag: string
+  install: (context: WorkspaceContext, alias: string, options?: SshInstallTargetInstallOptions) => Promise<void> | void
+}
+
+export interface SshInstallTargetInstallOptions {
+  quiet?: boolean
+}
+
+function installCodexTarget (context: WorkspaceContext, alias: string, options: SshInstallTargetInstallOptions = {}): void {
+  const entry = codexProjectEntryForWorkspace(context, alias)
+  const legacyRemotePath = legacyCodexRemotePathForWorkspace(context)
+  const result = installCodexAppConfigProject(entry, { legacyRemotePaths: [legacyRemotePath] })
+  const stateResult = installCodexGlobalStateProject(entry, { legacyRemotePaths: [legacyRemotePath] })
+
+  if (options.quiet === true) {
+    return
+  }
+
+  process.stdout.write(`\nCodex app config: ${result.configPath}\n`)
+  process.stdout.write(result.changed
+    ? `Installed Codex remote project: ${entry.label} (${entry.remotePath})\n`
+    : `Codex remote project already up to date: ${entry.label} (${entry.remotePath})\n`)
+
+  if (result.backupPath !== undefined) {
+    process.stdout.write(`Codex app config backup: ${result.backupPath}\n`)
+  }
+
+  if (stateResult.backupPath !== undefined) {
+    process.stdout.write(`Codex app state backup: ${stateResult.backupPath}\n`)
+  }
+
+  process.stdout.write('Restart Codex to apply the remote project entry.\n')
+}
+
+function installClaudeTarget (context: WorkspaceContext, alias: string, options: SshInstallTargetInstallOptions = {}): void {
+  const entry = claudeSshConfigEntryForWorkspace(context, alias)
+  const result = installClaudeSshConfigHost(entry)
+
+  if (options.quiet === true) {
+    return
+  }
+
+  process.stdout.write(`\nClaude SSH config: ${result.configPath}\n`)
+  process.stdout.write(result.changed
+    ? `Installed Claude SSH remote: ${entry.name} (${entry.sshHost})\n`
+    : `Claude SSH remote already up to date: ${entry.name} (${entry.sshHost})\n`)
+
+  if (result.backupPath !== undefined) {
+    process.stdout.write(`Claude SSH config backup: ${result.backupPath}\n`)
+  }
+
+  process.stdout.write('Restart Claude to apply the SSH remote entry.\n')
+}
+
+export const SSH_INSTALL_TARGETS: readonly SshInstallTargetDefinition[] = [
+  {
+    value: 'codex',
+    label: 'Codex',
+    description: 'Register this SSH alias as a Codex app remote project.',
+    flag: '--target codex',
+    install: installCodexTarget
+  },
+  {
+    value: 'claude',
+    label: 'Claude',
+    description: 'Register this SSH alias as a Claude app SSH remote.',
+    flag: '--target claude',
+    install: installClaudeTarget
+  }
+]
+
+export function supportedSshInstallTargetsText (): string {
+  return SSH_INSTALL_TARGETS.map((target) => target.value).join(', ')
+}
+
+export function sshInstallTargetFlagHintsText (): string {
+  return SSH_INSTALL_TARGETS.map((target) => target.flag).join(' ')
+}
+
+export function isSshConfigInstallTarget (value: string): value is SshConfigInstallTarget {
+  return SSH_INSTALL_TARGETS.some((target) => target.value === value)
+}
+
+export function dedupeSshInstallTargets (targets: readonly SshConfigInstallTarget[]): SshConfigInstallTarget[] {
+  return [...new Set(targets)]
+}
+
+export async function installSshInstallTarget (
+  context: WorkspaceContext,
+  alias: string,
+  targetValue: SshConfigInstallTarget,
+  options: SshInstallTargetInstallOptions = {}
+): Promise<void> {
+  const target = SSH_INSTALL_TARGETS.find((candidate) => candidate.value === targetValue)
+
+  if (target === undefined) {
+    throw new Error(`Unsupported ssh install target: ${targetValue}`)
+  }
+
+  await target.install(context, alias, options)
+}

package/src/ssh-key.ts

@@ -2,16 +2,28 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'n
 
 import type { WorkspaceContext } from './paths.ts'
 import { runBuffered } from './process.ts'
+import { assertProgressCommandSucceeded, type ProgressReporter, runProgressCommand } from './progress.ts'
+
+export interface EnsureHostSshKeyOptions {
+  quiet?: boolean
+  progress?: ProgressReporter
+}
+
+export async function ensureHostSshKey (context: WorkspaceContext, options: boolean | EnsureHostSshKeyOptions = false): Promise<void> {
+  const quiet = typeof options === 'boolean' ? options : options.quiet ?? false
+  const progress = typeof options === 'boolean' ? undefined : options.progress
+  const checklistActive = progress?.isChecklistActive() ?? false
 
-export async function ensureHostSshKey (context: WorkspaceContext, quiet = false): Promise<void> {
   mkdirSync(context.sshKeyDir, { recursive: true, mode: 0o700 })
 
   if (!existsSync(context.sshKeyPath)) {
-    if (!quiet) {
+    if (progress !== undefined && !checklistActive) {
+      progress.detail(context.sshKeyPath)
+    } else if (progress === undefined && !quiet) {
       process.stderr.write(`Generating Boxdown SSH identity: ${context.sshKeyPath}\n`)
     }
 
-    const result = await runBuffered('ssh-keygen', [
+    const args = [
       '-t',
       'ed25519',
       '-f',
@@ -20,26 +32,54 @@ export async function ensureHostSshKey (context: WorkspaceContext, quiet = false
       '',
       '-C',
       `${context.workspaceBasename}-devcontainer`
-    ], {
-      mirrorStdout: quiet ? false : 'stderr',
-      mirrorStderr: 'stderr'
-    })
+    ]
+    const result = progress === undefined
+      ? await runBuffered('ssh-keygen', args, {
+          mirrorStdout: quiet ? false : 'stderr',
+          mirrorStderr: 'stderr'
+        })
+      : await runProgressCommand('ssh-keygen create identity', 'ssh-keygen', args, {
+          progress,
+          spinnerLabel: checklistActive ? undefined : 'Generating Boxdown SSH identity',
+          verboseStdout: 'stderr',
+          verboseStderr: 'stderr'
+        })
 
-    if (result.code !== 0) {
+    if (progress === undefined && result.code !== 0) {
       throw new Error(`ssh-keygen failed while creating ${context.sshKeyPath}`)
     }
+
+    if (progress !== undefined) {
+      assertProgressCommandSucceeded('ssh-keygen create identity', result, `ssh-keygen failed while creating ${context.sshKeyPath}`)
+    }
   }
 
   if (!existsSync(context.sshPublicKeyPath)) {
-    const result = await runBuffered('ssh-keygen', ['-y', '-f', context.sshKeyPath], {
-      mirrorStdout: false,
-      mirrorStderr: 'stderr'
-    })
+    if (progress !== undefined && !checklistActive) {
+      progress.detail(context.sshPublicKeyPath)
+    }
+
+    const args = ['-y', '-f', context.sshKeyPath]
+    const result = progress === undefined
+      ? await runBuffered('ssh-keygen', args, {
+          mirrorStdout: false,
+          mirrorStderr: 'stderr'
+        })
+      : await runProgressCommand('ssh-keygen derive public key', 'ssh-keygen', args, {
+          progress,
+          spinnerLabel: checklistActive ? undefined : 'Writing Boxdown SSH public key',
+          verboseStdout: false,
+          verboseStderr: 'stderr'
+        })
 
-    if (result.code !== 0) {
+    if (progress === undefined && result.code !== 0) {
       throw new Error(`ssh-keygen failed while deriving ${context.sshPublicKeyPath}`)
     }
 
+    if (progress !== undefined) {
+      assertProgressCommandSucceeded('ssh-keygen derive public key', result, `ssh-keygen failed while deriving ${context.sshPublicKeyPath}`)
+    }
+
     writeFileSync(context.sshPublicKeyPath, result.stdout)
   }
 

package/src/status.ts

@@ -40,6 +40,8 @@ export interface StatusInfo {
     workspaceDataDir: string
     generatedConfigPath: string
     generatedConfigExists: boolean
+    logPath: string
+    logExists: boolean
     assetsDevcontainerDir: string
     assetsDevcontainerExists: boolean
   }
@@ -216,6 +218,8 @@ export function createStatusInfo (
       workspaceDataDir: context.workspaceDataDir,
       generatedConfigPath: context.generatedConfigPath,
       generatedConfigExists: exists(context.generatedConfigPath),
+      logPath: context.workspaceLogPath,
+      logExists: exists(context.workspaceLogPath),
       assetsDevcontainerDir: context.assetsDevcontainerDir,
       assetsDevcontainerExists: exists(context.assetsDevcontainerDir)
     },
@@ -297,6 +301,7 @@ export function formatStatusText (status: StatusInfo, options: { color?: boolean
     `  Workspace cache: ${status.paths.workspaceCacheDir}`,
     `  Workspace data: ${status.paths.workspaceDataDir}`,
     `  Generated config: ${status.paths.generatedConfigPath} (${existenceText(status.paths.generatedConfigExists, colorEnabled)})`,
+    `  Command log: ${status.paths.logPath} (${existenceText(status.paths.logExists, colorEnabled)})`,
     `  Devcontainer assets: ${status.paths.assetsDevcontainerDir} (${existenceText(status.paths.assetsDevcontainerExists, colorEnabled)})`,
     '',
     'SSH:',