detssh 0.4.0__tar.gz → 0.6.0__tar.gz

detssh-0.6.0/.github/workflows/tests.yml

@@ -0,0 +1,68 @@
+name: Tests
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12', '3.13', '3.14']
+        os-version: [ubuntu-22.04]
+
+    runs-on: ${{ matrix.os-version }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Run tests (100% coverage required)
+        run: uv run pytest -q
+
+      - name: Run ruff
+        run: uv run ruff check .
+
+      - name: Check formatting
+        run: uv run ruff format --check .
+
+  mutation:
+    needs: test
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Run mutation testing (no unlisted survivors allowed)
+        run: |
+          uv run mutmut run || true
+          uv run mutmut results
+          survivors=$(uv run mutmut results | grep 'survived$' | awk '{print $1}' | sed 's/:$//' | sort)
+          known=$(grep -v '^#' tests/mutmut_known_equivalents.txt | grep -v '^$' | sort)
+          new_survivors=$(comm -23 <(echo "$survivors") <(echo "$known"))
+          if [ -n "$new_survivors" ]; then
+            echo "New surviving mutant(s) not in tests/mutmut_known_equivalents.txt:"
+            echo "$new_survivors"
+            exit 1
+          fi
+          echo "No new survivors."

{detssh-0.4.0 → detssh-0.6.0}/.gitignore

@@ -9,3 +9,5 @@ __pycache__/
 *.egg-info/
 dist/
 build/
+mutants/
+.mutmut-cache

{detssh-0.4.0 → detssh-0.6.0}/CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-09-19
+
+### Added
+
+- Mutation testing via `mutmut`, gating CI: it rewrites the source one small
+  change at a time and reruns the suite, catching cases where 100% line
+  coverage still let a real behavior change through untested. Started at
+  300+ surviving mutants (from a from-scratch first run); closed all but
+  40, each confirmed genuinely equivalent - the mutated code is provably
+  indistinguishable from the original for every input (e.g. `"utf-8"` vs
+  `"UTF-8"` as a codec name, which Python's codec lookup can't tell apart)
+  - and documented one by one in `tests/mutmut_known_equivalents.txt`,
+  which CI diffs new runs against.
+- `ruff format --check` now runs in CI alongside `ruff check`.
+
+No application behavior changed in this release - every one of the ~260
+mutants closed was a test that was missing or checking too loosely (an
+exact-message assertion where only a substring was checked before, an edge
+case like a trailing `--kdf` flag with nothing after it, a permission check
+on a directory that already existed rather than one the call under test
+actually creates). The code they exercise was already correct.
+
+## [0.5.0] - 2026-09-19
+
+### Added
+
+- Interactive mode now offers to create a missing output-path parent
+  directory itself, instead of requiring `--create-parent-dirs` up front.
+  It defaults to yes for a path under `~/.ssh` and to no (with a warning)
+  for one outside it - the same rule `--create-parent-dirs` already used.
+
+### Changed
+
+- Flag mode now fails fast with a clear error when the output path's
+  parent is missing and `--create-parent-dirs` wasn't passed, instead of
+  running key derivation first and then failing on a raw `OSError`.
+
+### Fixed
+
+- `--kdf`/`--salt-algo` backend detection (used to decide which options to
+  show before click's real parsing runs) could misread a flag's own value
+  as a second occurrence of the flag when the value happened to equal the
+  flag string itself (e.g. `--kdf --kdf`).
+
 ## [0.4.0] - 2026-09-09
 
 ### Added

{detssh-0.4.0 → detssh-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: detssh
-Version: 0.4.0
+Version: 0.6.0
 Summary: Deterministic Ed25519 SSH key generation from a seed passphrase, via configurable KDF and salt-hash backends.
 Project-URL: Homepage, https://github.com/isik-kaplan/detssh
 Project-URL: Repository, https://github.com/isik-kaplan/detssh
@@ -122,8 +122,33 @@ guarantee starts at 1.0; we're still on 0.x, so it doesn't apply yet (see
 uv sync
 uv run pytest
 uv run ruff check .
+uv run ruff format --check .
 ```
 
 `pytest` runs with coverage on by default (`[tool.pytest.ini_options]` in
 `pyproject.toml`) and fails under 100% line+branch coverage - same gate
 locally and in CI, nothing extra to remember to pass.
+
+100% coverage means every line runs under test, not that every behavior
+change gets caught - a test can execute a line without asserting anything
+meaningful about it. [`mutmut`](https://mutmut.readthedocs.io/) checks the
+second thing: it rewrites the source one small change at a time (flips a
+comparison, drops an argument, tweaks a string) and reruns the tests against
+each mutant, one at a time. A mutant that still passes ("survived") is a
+change the suite wouldn't notice.
+
+```
+uv run mutmut run       # takes a few minutes; ctrl-c-safe, resumes where it left off
+uv run mutmut results   # list survivors by name
+uv run mutmut show <name>   # see what a specific mutant changed
+```
+
+A survivor is either a real test gap (add an assertion that would fail
+against the mutant) or a genuinely equivalent mutant - the mutated code is
+provably indistinguishable from the original for every input (e.g.
+`"utf-8"` vs `"UTF-8"` as a codec name: Python's codec lookup is
+case-insensitive, so no test could tell them apart). CI
+(`.github/workflows/tests.yml`, job `mutation`) fails on any survivor not
+listed in `tests/mutmut_known_equivalents.txt`, which names each one and
+says why - add a confirmed-equivalent mutant there (never to silence a
+failure without doing that check) rather than chasing an unwinnable test.

{detssh-0.4.0 → detssh-0.6.0}/README.md

@@ -101,8 +101,33 @@ guarantee starts at 1.0; we're still on 0.x, so it doesn't apply yet (see
 uv sync
 uv run pytest
 uv run ruff check .
+uv run ruff format --check .
 ```
 
 `pytest` runs with coverage on by default (`[tool.pytest.ini_options]` in
 `pyproject.toml`) and fails under 100% line+branch coverage - same gate
 locally and in CI, nothing extra to remember to pass.
+
+100% coverage means every line runs under test, not that every behavior
+change gets caught - a test can execute a line without asserting anything
+meaningful about it. [`mutmut`](https://mutmut.readthedocs.io/) checks the
+second thing: it rewrites the source one small change at a time (flips a
+comparison, drops an argument, tweaks a string) and reruns the tests against
+each mutant, one at a time. A mutant that still passes ("survived") is a
+change the suite wouldn't notice.
+
+```
+uv run mutmut run       # takes a few minutes; ctrl-c-safe, resumes where it left off
+uv run mutmut results   # list survivors by name
+uv run mutmut show <name>   # see what a specific mutant changed
+```
+
+A survivor is either a real test gap (add an assertion that would fail
+against the mutant) or a genuinely equivalent mutant - the mutated code is
+provably indistinguishable from the original for every input (e.g.
+`"utf-8"` vs `"UTF-8"` as a codec name: Python's codec lookup is
+case-insensitive, so no test could tell them apart). CI
+(`.github/workflows/tests.yml`, job `mutation`) fails on any survivor not
+listed in `tests/mutmut_known_equivalents.txt`, which names each one and
+says why - add a confirmed-equivalent mutant there (never to silence a
+failure without doing that check) rather than chasing an unwinnable test.

{detssh-0.4.0 → detssh-0.6.0}/detssh/__init__.py

@@ -3,7 +3,7 @@ from detssh.backends.salt import ALGOS as SALT_ALGOS
 from detssh.keygen import default_output_path, keypair_from_seed, public_key_path, write_keypair
 
 
-__version__ = "0.4.0"
+__version__ = "0.6.0"
 __all__ = [
     "KDF_BACKENDS",
     "SALT_ALGOS",

{detssh-0.4.0 → detssh-0.6.0}/detssh/backends/base.py

@@ -164,13 +164,36 @@ def confirm_overwrite(output, overwrite_files):
 
 
 def confirm_create_parent_dirs(output, create_parent_dirs, interactive):
+    """Decide whether to create the output path's missing parent directories.
+
+    Returns the (possibly updated) flag for write_keypair_and_recap to act on. Flag
+    mode requires --create-parent-dirs up front and fails fast otherwise, so a typo
+    surfaces before key derivation rather than as a raw OSError after it. Interactive
+    mode prompts for the same decision instead, defaulting to yes under ~/.ssh and to
+    no (with a warning) elsewhere - matching what --create-parent-dirs would have done.
+    """
     parent = Path(output).parent
-    if not create_parent_dirs or parent.exists() or parent == ssh_dir():
-        return
-    if interactive and not parent.is_relative_to(ssh_dir()):
+    if parent.exists() or parent == ssh_dir():
+        return create_parent_dirs
+
+    outside = not parent.is_relative_to(ssh_dir())
+
+    if not interactive:
+        if not create_parent_dirs:
+            raise click.UsageError(f"{_display_path(parent)} doesn't exist. Pass --create-parent-dirs to create it.")
+        return True
+
+    if not create_parent_dirs and not outside:
+        question, default = f"{_display_path(parent)} doesn't exist. Create it?", True
+    elif outside:
         click.echo(f"Warning: {_display_path(parent)} is outside ~/.ssh.")
-        if not click.confirm("Create it anyway?"):
-            raise click.Abort()
+        question, default = "Create it anyway?", False
+    else:
+        return True
+
+    if not click.confirm(question, default=default):
+        raise click.Abort()
+    return True
 
 
 def write_keypair_and_recap(seed_bytes, output, comment, recap, key_passphrase="", create_parent_dirs=False):

{detssh-0.4.0 → detssh-0.6.0}/detssh/cli.py

@@ -47,12 +47,21 @@ DEFAULTS = {
 
 
 def _peek(args, flag, default):
+    """Guess a flag's value before click does the real parsing, so we know which
+    backend's options to register. Skips past a consumed value instead of scanning
+    it as a token in its own right, so a value that happens to equal the flag itself
+    (e.g. `--kdf --kdf`) isn't misread as a second occurrence of the flag."""
     value = default
-    for i, arg in enumerate(args):
+    i = 0
+    while i < len(args):
+        arg = args[i]
         if arg == flag and i + 1 < len(args):
             value = args[i + 1]
-        elif arg.startswith(flag + "="):
+            i += 2
+            continue
+        if arg.startswith(flag + "="):
             value = arg.split("=", 1)[1]
+        i += 1
     return value
 
 
@@ -139,7 +148,8 @@ class KDFSaltCommand(click.Command):
                 ["--create-parent-dirs"],
                 is_flag=True,
                 help="Create the output path's parent directories if missing, even outside ~/.ssh. "
-                "Interactive mode still confirms before creating one outside ~/.ssh.",
+                "Interactive mode prompts for this itself if you don't pass the flag; "
+                "non-interactive mode requires it explicitly.",
             ),
             click.Option(
                 ["--register"],
@@ -227,7 +237,7 @@ def main(overwrite_files, create_parent_dirs, **values):
         raise click.UsageError(f"{kdf_name} {salt_error}")
 
     confirm_overwrite(resolved["output"], overwrite_files)
-    confirm_create_parent_dirs(resolved["output"], create_parent_dirs, interactive)
+    create_parent_dirs = confirm_create_parent_dirs(resolved["output"], create_parent_dirs, interactive)
 
     click.echo("Deriving key...")
     try:

{detssh-0.4.0 → detssh-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "detssh"
-version = "0.4.0"
+version = "0.6.0"
 description = "Deterministic Ed25519 SSH key generation from a seed passphrase, via configurable KDF and salt-hash backends."
 readme = "README.md"
 authors = [
@@ -32,6 +32,7 @@ detssh = "detssh.cli:run"
 [tool.uv]
 dev-dependencies = [
     "hypothesis>=6.156.9",
+    "mutmut>=3.8.0",
     "pytest>=8.0.0",
     "pytest-cov>=5.0.0",
     "ruff>=0.9.0",
@@ -47,6 +48,7 @@ packages = ["detssh"]
 [tool.ruff]
 line-length = 120
 fix = true
+extend-exclude = ["mutants"]
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "UP", "B"]
@@ -71,3 +73,10 @@ show_missing = true
 exclude_lines = [
     "if __name__ == .__main__.:",
 ]
+
+[tool.mutmut]
+source_paths = ["detssh"]
+# --no-cov: mutmut only reruns the subset of tests covering a mutated line, so the
+# --cov-fail-under=100 gate in addopts would fail every mutant run for the wrong
+# reason. -q keeps per-mutant output down to a dot per test.
+pytest_add_cli_args = ["--no-cov", "-q"]

{detssh-0.4.0 → detssh-0.6.0}/tests/golden/README.md

@@ -4,6 +4,13 @@
 seed/key output of every `--kdf` × `--salt-algo` combination at fixed
 inputs. `../test_golden_vectors.py` loads and checks them.
 
+`help_default.txt` and `help_pbkdf2_sha256.txt` are unrelated: exact
+`detssh --help` snapshots for two `--kdf`/`--salt-algo` combinations, checked
+by `../test_help_text.py`. Regenerate them (see that file's docstring) after
+any deliberate change to an option's `help=` text, `_help_note`, or
+`KDFSaltCommand.format_options`' wrapping - diff before committing, same as
+the vectors below.
+
 Not a correctness test (see `test_properties.py` / `test_determinism.py`) -
 it catches any change that silently makes the same inputs produce a
 *different* key.

detssh-0.6.0/tests/golden/help_default.txt

@@ -0,0 +1,53 @@
+Usage: main [OPTIONS]
+
+Options:
+  --kdf [argon2id|argon2i|argon2d|scrypt|pbkdf2|bcrypt_pbkdf]
+                                  KDF backend
+                                  [default: argon2id]
+  --salt-algo [blake2b|blake2s|sha256|sha384|sha512|sha3_256|sha3_384|sha3_512]
+                                  Salt hash algorithm
+                                  [default: blake2b]
+  --seed TEXT                     Seed passphrase
+  --label TEXT                    Label
+  --iterations INTEGER            Argon2 iterations (soft max 100)
+                                  [default: 10]
+  --memory INTEGER                Argon2 memory, in MiB (soft max 2048)
+                                  [default: 1024]
+  --parallelism INTEGER           Argon2 parallelism (soft max 16)
+                                  [default: 4]
+  --salt-digest-size INTEGER      Salt digest size, in bytes (1-64)
+                                  [default: 16]
+  --output FILE                   Output path for the private key (ssh-keygen
+                                  style, e.g. ~/.ssh/id_ed25519)
+                                  [default: ~/.ssh/id_ed25519]
+  --comment TEXT                  Comment for the public key
+  --key-passphrase TEXT           Passphrase to encrypt the private key file
+                                  with (leave empty for none)
+  --overwrite-files               Overwrite existing output files without
+                                  asking.
+  --create-parent-dirs            Create the output path's parent directories if
+                                  missing, even outside ~/.ssh. Interactive mode
+                                  prompts for this itself if you don't pass the
+                                  flag; non-interactive mode requires it
+                                  explicitly.
+  --register USER@HOST            Register the generated key so plain `ssh
+                                  <label>` connects to USER@HOST, as `detssh ssh
+                                  register` would. Needs --label, which names
+                                  the `Host` block. Interactive mode asks about
+                                  this at the end instead.
+  --register-port PORT            Non-default ssh port to register with
+                                  --register.
+  --force-allow-soft-constraints  Flag mode only: skip the 'this may take a long
+                                  time' confirmation for oversized cost knobs.
+                                  Interactive mode always asks.
+  -h, --help                      Show this message and exit.
+
+  Options below are for --kdf=argon2id --salt-algo=blake2b (defaults, unless you passed both already).
+  --kdf choices:       argon2id, argon2i, argon2d, scrypt, pbkdf2, bcrypt_pbkdf
+  --salt-algo choices: blake2b, blake2s, sha256, sha384, sha512, sha3_256, sha3_384, sha3_512
+  
+  Each combination has its own options. To see another one's:
+    detssh --kdf pbkdf2 --salt-algo sha256 --help
+  
+  To use a generated key with plain `ssh <label>`, see:
+    detssh ssh --help

detssh-0.6.0/tests/golden/help_pbkdf2_sha256.txt

@@ -0,0 +1,47 @@
+Usage: main [OPTIONS]
+
+Options:
+  --kdf [argon2id|argon2i|argon2d|scrypt|pbkdf2|bcrypt_pbkdf]
+                                  KDF backend
+                                  [default: argon2id]
+  --salt-algo [blake2b|blake2s|sha256|sha384|sha512|sha3_256|sha3_384|sha3_512]
+                                  Salt hash algorithm
+                                  [default: blake2b]
+  --seed TEXT                     Seed passphrase
+  --label TEXT                    Label
+  --iterations INTEGER            PBKDF2 iterations (soft max 50000000)
+                                  [default: 600000]
+  --output FILE                   Output path for the private key (ssh-keygen
+                                  style, e.g. ~/.ssh/id_ed25519)
+                                  [default: ~/.ssh/id_ed25519]
+  --comment TEXT                  Comment for the public key
+  --key-passphrase TEXT           Passphrase to encrypt the private key file
+                                  with (leave empty for none)
+  --overwrite-files               Overwrite existing output files without
+                                  asking.
+  --create-parent-dirs            Create the output path's parent directories if
+                                  missing, even outside ~/.ssh. Interactive mode
+                                  prompts for this itself if you don't pass the
+                                  flag; non-interactive mode requires it
+                                  explicitly.
+  --register USER@HOST            Register the generated key so plain `ssh
+                                  <label>` connects to USER@HOST, as `detssh ssh
+                                  register` would. Needs --label, which names
+                                  the `Host` block. Interactive mode asks about
+                                  this at the end instead.
+  --register-port PORT            Non-default ssh port to register with
+                                  --register.
+  --force-allow-soft-constraints  Flag mode only: skip the 'this may take a long
+                                  time' confirmation for oversized cost knobs.
+                                  Interactive mode always asks.
+  -h, --help                      Show this message and exit.
+
+  Options below are for --kdf=pbkdf2 --salt-algo=sha256 (defaults, unless you passed both already).
+  --kdf choices:       argon2id, argon2i, argon2d, scrypt, pbkdf2, bcrypt_pbkdf
+  --salt-algo choices: blake2b, blake2s, sha256, sha384, sha512, sha3_256, sha3_384, sha3_512
+  
+  Each combination has its own options. To see another one's:
+    detssh --kdf pbkdf2 --salt-algo sha256 --help
+  
+  To use a generated key with plain `ssh <label>`, see:
+    detssh ssh --help

detssh-0.6.0/tests/mutmut_known_equivalents.txt

@@ -0,0 +1,120 @@
+# Mutants mutmut generates that survive (or time out) for reasons that don't indicate
+# a real test gap - each is a change the *code* cannot behave differently for, or (for
+# the two "timeout" entries) a change that turns the line into an infinite loop, which
+# mutmut correctly reports as non-equivalent but under a status other than "survived".
+#
+# CI (.github/workflows/tests.yml, job "mutation") fails only on a survivor NOT listed
+# here, so this file is the thing to update - after re-verifying the reasoning below
+# still holds - if `uv run mutmut show <name>` shows something new isn't actually
+# equivalent. Never add an entry just to make CI pass without doing that check.
+#
+# Regenerate this exact set with:
+#   uv run mutmut run; uv run mutmut results | awk '{print $1}' | sed 's/:$//'
+# then diff against this file before committing - the diff is your changelog.
+
+# configparser's default optionxform lowercases option names on both write and read, so
+# looking a key up (or storing it) under a different case than the source reads it back
+# identically either way - "user"/"USER", "host"/"HOST", "port"/"PORT" are the same key.
+detssh.registry.x_load_registry__mutmut_12
+detssh.registry.x_load_registry__mutmut_14
+detssh.registry.x_load_registry__mutmut_19
+detssh.registry.x_save_registry__mutmut_4
+detssh.registry.x_save_registry__mutmut_7
+detssh.registry.x_save_registry__mutmut_9
+detssh.registry.x_save_registry__mutmut_12
+
+# _peek(args, "--kdf"/"--salt-algo", DEFAULT_*)'s default argument only ever feeds a
+# dict.get(key, fallback) elsewhere - a dict miss returns the same fallback class no
+# matter what the "default" string itself was, so DEFAULT_KDF and None are the same
+# value for every input. (Not to be confused with the *.get()* call's own fallback
+# argument, mutmut_21/23/26/28 in the same function - those ARE real and are tested via
+# test_invalid_kdf_value_gives_a_clean_error_not_a_traceback and its salt-algo sibling.)
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_4
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_13
+
+# click.Option's own default for the `default=` kwarg is already None for a non-flag
+# option, so passing default=None explicitly vs. omitting it are identical.
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_75
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_94
+
+# format_options' first_col/text_width arithmetic: the 30-char cap and 1-off changes to
+# it (mutmut_13) or to the -4/10 padding (21, 22) only produce a different wrapped line
+# for option-name/help-text/terminal-width combinations that land exactly on the changed
+# boundary - the real --help output (checked byte-for-byte by test_help_text.py) never
+# does, and test_format_options_sizes_the_first_column_from_option_names_not_help_text
+# already pins the one-character-off-by-a-lot case (measure_table()[0] vs [1]) that
+# *does* show up in real output.
+detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_13
+detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_21
+detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_22
+# help_text.split(DEFAULT_TEXT_MARKER, 1) vs rsplit(..., 1) vs split(..., 2) vs
+# split(..., ) (no limit): DEFAULT_TEXT_MARKER ("\x00") is inserted into a help string at
+# most once, by construction in build_options - with a single occurrence, every one of
+# these splits the string identically.
+detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_29
+detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_30
+detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_31
+# `textwrap.wrap(description, text_width) or [""]` - the `or [...]` fallback only fires
+# when wrap() returns an empty list, i.e. description is blank after stripping. No real
+# option's message is ever blank, so this branch is unreachable for the actual option
+# set; forcing it would mean asserting against a contrived, not-really-used input.
+detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_38
+
+# run()'s else-branch computes `argv = sys.argv[1:]` and passes `args=argv` unmodified -
+# click.BaseCommand.main() already defaults args=None to sys.argv[1:] itself, so passing
+# that exact value explicitly or omitting it (args=None) are the same call.
+detssh.cli.x_run__mutmut_14
+detssh.cli.x_run__mutmut_16
+
+# write_hosts_file's os.open(..., mode=HOSTS_FILE_MODE) is immediately followed by an
+# unconditional os.fchmod(fd, HOSTS_FILE_MODE) - whatever mode os.open used gets
+# overwritten right after, so dropping the os.open mode argument is a no-op. (ensure_include
+# has no such fchmod call, which is why its equivalent mutant - dropping SSH_CONFIG_FILE_MODE
+# from its own os.open - is NOT in this list: it's real, and is tested by
+# test_ensure_include_creates_a_missing_ssh_dir_with_correct_permissions.)
+detssh.ssh_config.x_write_hosts_file__mutmut_16
+# Same reasoning: write_keypair's os.open(..., PRIVATE_KEY_MODE) is followed by an
+# unconditional os.fchmod(fd, PRIVATE_KEY_MODE).
+detssh.keygen.x_write_keypair__mutmut_48
+
+# Python's codec lookup is case-insensitive ("utf-8" and "UTF-8" resolve to the same
+# codec), and hashlib's hash-algorithm-name lookup is too ("sha256" and "SHA256" give the
+# same digest) - every one of these mutates a hardcoded codec/hash name to a different
+# case, which cannot change what the code does.
+detssh.keygen.x_write_keypair__mutmut_29
+detssh.keygen.x_write_keypair__mutmut_71
+detssh.backends.kdf.scrypt.xǁScryptǁrun__mutmut_35
+detssh.backends.kdf.bcrypt_pbkdf.xǁBcryptPbkdfǁrun__mutmut_13
+detssh.backends.kdf.pbkdf2.xǁPbkdf2ǁrun__mutmut_12
+detssh.backends.kdf.pbkdf2.xǁPbkdf2ǁrun__mutmut_17
+detssh.backends.kdf._argon2.xǁArgon2Baseǁrun__mutmut_19
+detssh.backends.salt.sha512.xǁSha512ǁdigest__mutmut_4
+detssh.backends.salt.sha384.xǁSha384ǁdigest__mutmut_4
+detssh.backends.salt.sha256.xǁSha256ǁdigest__mutmut_4
+detssh.backends.salt.blake2s.xǁBlake2sǁdigest__mutmut_7
+detssh.backends.salt.sha3_512.xǁSha3512ǁdigest__mutmut_4
+detssh.backends.salt.blake2b.xǁBlake2bǁdigest__mutmut_7
+detssh.backends.salt.sha3_256.xǁSha3256ǁdigest__mutmut_4
+detssh.backends.salt.sha3_384.xǁSha3384ǁdigest__mutmut_4
+
+# Field.__init__'s default kind="text" is never explicitly checked anywhere (only
+# "secret"/"int"/"path"/"select" are); "text" is just a sentinel meaning "none of those",
+# so any other string in its place (kind="TEXT", kind="XXtextXX") behaves identically.
+detssh.backends.base.xǁFieldǁ__init____mutmut_1
+detssh.backends.base.xǁFieldǁ__init____mutmut_2
+
+# click.prompt(..., show_default=None) vs show_default=False: with default="" (falsy),
+# click treats both the same - neither shows a "[]" default hint. Confirmed empirically;
+# see the type= mutants on the same line (mutmut_34, 38), which ARE real and are killed
+# by test_wizard_register_prompt_reasks_on_a_non_integer_port.
+detssh.cli.x__register_interactively__mutmut_33
+
+# Two mutants turn a loop into an infinite one (an absolute assignment replacing a += in
+# _peek's index-advance; `name = None` inside `_register_interactively`'s `while not
+# name:` reprompt loop, which can never become truthy again). mutmut correctly reports
+# these as "timeout", not "survived" - CI's grep only matches lines ending in "survived",
+# so they don't need listing here, but are noted for anyone diffing this file against a
+# fresh `mutmut results`.
+# detssh.cli.x__peek__mutmut_14: timeout
+# detssh.cli.x__peek__mutmut_30: timeout
+# detssh.cli.x__register_interactively__mutmut_14: timeout