remo-cli 4.3.0__tar.gz → 4.3.2__tar.gz

{remo_cli-4.3.0 → remo_cli-4.3.2}/.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -48,7 +48,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install dependencies
         run: uv sync --all-extras
@@ -70,7 +70,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Build wheel
         run: uv build --wheel
@@ -98,7 +98,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install fish
         run: |
@@ -124,7 +124,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install dependencies
         run: uv sync --all-extras

{remo_cli-4.3.0 → remo_cli-4.3.2}/.github/workflows/dev-build.yml

@@ -34,7 +34,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Compute dev version
         id: ver

{remo_cli-4.3.0 → remo_cli-4.3.2}/.github/workflows/provision.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install Ansible and dependencies
         run: |

{remo_cli-4.3.0 → remo_cli-4.3.2}/.github/workflows/release-please.yml

@@ -42,7 +42,7 @@ jobs:
           app-id: ${{ vars.RELEASE_PLEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLEASE_APP_KEY }}
 
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         id: release
         with:
           # Token precedence:
@@ -68,16 +68,26 @@ jobs:
       # but this job runs immediately after that refresh on every push to main,
       # so the commit is simply re-made. `tests/unit/test_lockfile_version.py`
       # is the backstop that keeps a drifted lockfile from merging at all.
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         if: ${{ steps.release.outputs.pr }}
 
+      # `pr` is passed through as raw JSON and parsed in the shell rather than
+      # with `fromJSON(...)` here. A step's `env:` expressions are evaluated even
+      # when its `if:` is false, and on the push that MERGES a release there are
+      # no new commits, so release-please emits no PR and `outputs.pr` is the
+      # empty string — `fromJSON('')` then fails the whole job with "Error
+      # reading JToken from JsonReader", after the tag and publish have already
+      # succeeded. That made this workflow red after every single release and
+      # would have masked a real failure. The neighbouring setup-uv step, which
+      # has the same `if:` but no `env:`, skipped correctly throughout.
       - name: Sync uv.lock onto the release PR
         if: ${{ steps.release.outputs.pr }}
         env:
-          RELEASE_BRANCH: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          RELEASE_PR: ${{ steps.release.outputs.pr }}
           GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
+          RELEASE_BRANCH="$(jq -er '.headBranchName' <<<"$RELEASE_PR")"
           git clone --branch "$RELEASE_BRANCH" --depth 1 \
             "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" release-pr
           cd release-pr

{remo_cli-4.3.0 → remo_cli-4.3.2}/.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -155,7 +155,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Build package
         run: uv build

{remo_cli-4.3.0 → remo_cli-4.3.2}/.github/workflows/smoke-test.yml

@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install remo
         run: uv sync
@@ -219,7 +219,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install remo
         run: uv sync
@@ -338,7 +338,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install remo
         run: uv sync

{remo_cli-4.3.0 → remo_cli-4.3.2}/.github/workflows/teardown.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install Ansible and dependencies
         run: |

remo_cli-4.3.2/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "4.3.2"
+}

{remo_cli-4.3.0 → remo_cli-4.3.2}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [4.3.2](https://github.com/get2knowio/remo/compare/v4.3.1...v4.3.2) (2026-08-05)
+
+
+### Bug Fixes
+
+* **ci:** stop release-please failing on every release ([#147](https://github.com/get2knowio/remo/issues/147)) ([1e78e8d](https://github.com/get2knowio/remo/commit/1e78e8dc65f36c8f8f143a7e9eb77dbd5749b69f))
+
+## [4.3.1](https://github.com/get2knowio/remo/compare/v4.3.0...v4.3.1) (2026-08-05)
+
+
+### Bug Fixes
+
+* three defects found while building `remo configure` ([#144](https://github.com/get2knowio/remo/issues/144)) ([608a914](https://github.com/get2knowio/remo/commit/608a9146560b9e1bf0e45811ce76a0c517dafa45))
+
 ## [4.3.0](https://github.com/get2knowio/remo/compare/v4.2.0...v4.3.0) (2026-08-05)
 
 

{remo_cli-4.3.0 → remo_cli-4.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remo-cli
-Version: 4.3.0
+Version: 4.3.2
 Summary: Remote development environment CLI
 License-Expression: MIT
 License-File: LICENSE
@@ -327,6 +327,22 @@ remo configure mybox --skip docker  # everything except Docker
 remo web push                       # authorize the web service on it
 ```
 
+#### Example: an OrbStack VM
+
+[`docs/examples/orbstack-cloud-init.yaml`](docs/examples/orbstack-cloud-init.yaml)
+prepares an [OrbStack](https://orbstack.dev) VM on a Mac so `remo add` and
+`remo configure` work first time:
+
+```bash
+orb create ubuntu remo-mbp -c docs/examples/orbstack-cloud-init.yaml
+```
+
+It installs only what Ansible needs to connect and hand over — `remo configure`
+does the rest. It deliberately creates no user: OrbStack already makes one named
+after your macOS account holding UID 1000, and registering *that* user is what
+puts `remo-host` in the home directory the web service logs into, while skipping
+`user_setup`'s UID-1000 reassignment entirely.
+
 `remo remove NAME [--yes]` deregisters an added host by deleting **only** the
 local registry entry — it makes no connection to and no change on the remote
 environment (unlike a provider `destroy`, which tears down infrastructure). It

{remo_cli-4.3.0 → remo_cli-4.3.2}/README.md

@@ -301,6 +301,22 @@ remo configure mybox --skip docker  # everything except Docker
 remo web push                       # authorize the web service on it
 ```
 
+#### Example: an OrbStack VM
+
+[`docs/examples/orbstack-cloud-init.yaml`](docs/examples/orbstack-cloud-init.yaml)
+prepares an [OrbStack](https://orbstack.dev) VM on a Mac so `remo add` and
+`remo configure` work first time:
+
+```bash
+orb create ubuntu remo-mbp -c docs/examples/orbstack-cloud-init.yaml
+```
+
+It installs only what Ansible needs to connect and hand over — `remo configure`
+does the rest. It deliberately creates no user: OrbStack already makes one named
+after your macOS account holding UID 1000, and registering *that* user is what
+puts `remo-host` in the home directory the web service logs into, while skipping
+`user_setup`'s UID-1000 reassignment entirely.
+
 `remo remove NAME [--yes]` deregisters an added host by deleting **only** the
 local registry entry — it makes no connection to and no change on the remote
 environment (unlike a provider `destroy`, which tears down infrastructure). It

{remo_cli-4.3.0 → remo_cli-4.3.2}/ansible/roles/user_setup/tasks/main.yml

@@ -243,11 +243,25 @@
     - user_setup_cloud_keys.content | default('') | length > 0
 # --- end cloud-injected key bootstrap --------------------------------------
 
+# The docker group only exists if the `docker` role ran. Skipping that role
+# (`--skip docker`, or `configure_docker=false`) previously made the next task
+# fail outright with "Group docker does not exist", taking the whole configure
+# down after it had already changed the host — so `--skip docker` was, in
+# effect, not a supported option on any provider. Gate on the group rather than
+# on `configure_docker` so a host where Docker was installed by other means
+# (or by an earlier run) still gets the membership.
+- name: Check whether a docker group exists
+  ansible.builtin.command: getent group docker
+  register: user_setup_docker_group
+  changed_when: false
+  failed_when: false
+
 - name: Add remo user to docker group
   ansible.builtin.user:
     name: "{{ remo_user }}"
     groups: docker
     append: true
+  when: user_setup_docker_group.rc | default(1) == 0
 
 - name: Configure passwordless sudo for remo user
   ansible.builtin.lineinfile:

remo_cli-4.3.2/docs/examples/orbstack-cloud-init.yaml

@@ -0,0 +1,120 @@
+#cloud-config
+#
+# OrbStack VM prepared for `remo add` + `remo configure` (remo >= 4.3.0).
+#
+#   orb create ubuntu remo-mbp -c orbstack-remo-cloud-init.yaml
+#
+# Deliberately minimal: this installs ONLY what Ansible needs in order to
+# connect and take over. Docker, Node.js, zellij, fzf, the GitHub CLI, the
+# devcontainers CLI and remo-host are all installed by `remo configure`, which
+# is idempotent — duplicating any of that here would only drift.
+#
+# It also does NOT create a user. OrbStack already creates one named after your
+# macOS account, holding UID 1000 with passwordless sudo. `remo configure`
+# binds its workspace account to whichever user you register, so registering
+# that existing user means:
+#   * remo-host lands in the home directory discovery actually logs into, and
+#   * user_setup's UID-1000 reassignment (which rewrites /etc/passwd and drops
+#     the live SSH session) is skipped entirely, because the holder of UID 1000
+#     is already the account being configured.
+# Creating a separate `remo` user here would forfeit both.
+
+# ---------------------------------------------------------------------------
+# EDIT THIS: the public key of the workstation that will run `remo`.
+# ---------------------------------------------------------------------------
+# If remo runs on this same Mac, that is ~/.ssh/id_ed25519.pub.
+# Leave the placeholder in place and cloud-init keeps password auth enabled
+# rather than locking you out (see the guard in runcmd).
+ssh_authorized_keys:
+  - ssh-ed25519 AAAA_REPLACE_WITH_YOUR_PUBLIC_KEY workstation
+
+package_update: true
+packages:
+  # Ansible needs a Python 3 interpreter on the target. ssh_configure.yml
+  # probes for it with `raw` and fails with an actionable message if absent,
+  # but there is no reason to make you see that message.
+  - python3
+  # hwclock. `community.general.timezone` — the first task in remo's shared
+  # role list — hard-fails with 'Failed to find required executable "hwclock"'
+  # without it, and on Ubuntu 24.04 it lives in util-linux-extra, which minimal
+  # images do not install. Found the hard way while testing this feature.
+  - util-linux-extra
+  - openssh-server
+  # remo's configure play installs rsync itself, but having it up front means
+  # `remo cp` works the moment the host is registered.
+  - rsync
+
+# ---------------------------------------------------------------------------
+# SSH port
+# ---------------------------------------------------------------------------
+# 22 is right when remo runs on this Mac: the VM gets its own IP that macOS can
+# reach directly, so nothing needs forwarding.
+#
+# Change it if you are reaching this VM from somewhere else (e.g. your homelab
+# box) via a forwarded port — remo stores the port per host and threads it
+# through `remo shell`, `remo configure` and `remo web push`. Register it with
+#     remo add mbp <user>@<host>:<port>
+# Note this is NOT OrbStack's own SSH (127.0.0.1:32222, Mac-local only); this
+# is a normal sshd inside the VM, which is what remo drives.
+write_files:
+  - path: /etc/ssh/sshd_config.d/10-remo.conf
+    permissions: '0644'
+    content: |
+      # Managed by cloud-init for remo. Ubuntu's sshd_config Includes this dir.
+      Port 22
+      PubkeyAuthentication yes
+
+runcmd:
+  # Put the key on the UID-1000 account explicitly. `ssh_authorized_keys` above
+  # targets cloud-init's notion of the default user, which is not guaranteed to
+  # be the user OrbStack created — this makes it deterministic either way.
+  - |
+    set -eu
+    KEY='ssh-ed25519 AAAA_REPLACE_WITH_YOUR_PUBLIC_KEY workstation'
+    USER_1000="$(getent passwd 1000 | cut -d: -f1)"
+    if [ -z "$USER_1000" ]; then
+      echo "remo-cloud-init: no UID 1000 account; skipping key install" >&2
+      exit 0
+    fi
+    HOME_1000="$(getent passwd 1000 | cut -d: -f6)"
+    install -d -m 700 -o "$USER_1000" -g "$USER_1000" "$HOME_1000/.ssh"
+    touch "$HOME_1000/.ssh/authorized_keys"
+    case "$KEY" in
+      *REPLACE_WITH_YOUR_PUBLIC_KEY*)
+        # Refuse to harden SSH when no real key was supplied — disabling
+        # password auth here would leave the VM unreachable over SSH.
+        echo "remo-cloud-init: placeholder key not replaced; leaving password auth as-is" >&2
+        ;;
+      *)
+        grep -qxF "$KEY" "$HOME_1000/.ssh/authorized_keys" \
+          || echo "$KEY" >> "$HOME_1000/.ssh/authorized_keys"
+        echo 'PasswordAuthentication no' > /etc/ssh/sshd_config.d/20-remo-hardening.conf
+        ;;
+    esac
+    chown -R "$USER_1000:$USER_1000" "$HOME_1000/.ssh"
+    chmod 600 "$HOME_1000/.ssh/authorized_keys"
+
+  # Passwordless sudo: OrbStack already grants it, but an explicit drop-in
+  # makes this file work on a plain cloud image too. remo needs it — the
+  # configure play installs packages and system services, and probes for it
+  # up front rather than failing halfway through.
+  - |
+    set -eu
+    USER_1000="$(getent passwd 1000 | cut -d: -f1)"
+    [ -n "$USER_1000" ] || exit 0
+    echo "$USER_1000 ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/90-remo-$USER_1000"
+    chmod 440 "/etc/sudoers.d/90-remo-$USER_1000"
+
+  - systemctl enable --now ssh
+  - systemctl restart ssh
+
+final_message: |
+  remo-ready after $UPTIME seconds.
+
+  From the workstation running remo:
+    remo add mbp <user>@<this-vm-ip> --verify     # add :PORT if you changed it
+    remo configure mbp
+    remo web push                                 # if you use the web console
+
+  Do not pass `--skip docker` to configure: the shared role list adds the user
+  to the docker group, which only exists if the docker role ran.

{remo_cli-4.3.0 → remo_cli-4.3.2}/frontend/package-lock.json

@@ -1177,9 +1177,9 @@
       "license": "MIT"
     },
     "node_modules/@redocly/openapi-core": {
-      "version": "1.34.17",
-      "resolved": "https://registry.npmjs.org/@redocly/openapi-core/-/openapi-core-1.34.17.tgz",
-      "integrity": "sha512-wsV2keCt6B806XpSdezbWZ9aFJYf14YVh+XQf0ESt7M90yqVuxH9//PxvtC70sgj9OCkRM3nRaLfu4MsGQZRig==",
+      "version": "1.34.18",
+      "resolved": "https://registry.npmjs.org/@redocly/openapi-core/-/openapi-core-1.34.18.tgz",
+      "integrity": "sha512-UyKIm0wTPw5BcY7Z2PkbK1Ma260um96LSBWXHrdSMe+ZV0EPMyDfAcUcjjm3qEiGST9OK/1TriekdPCZkn4Q3A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1188,7 +1188,7 @@
         "colorette": "1.4.0",
         "https-proxy-agent": "7.0.6",
         "js-levenshtein": "1.1.6",
-        "js-yaml": "4.2.0",
+        "js-yaml": "4.3.0",
         "minimatch": "5.1.9",
         "pluralize": "8.0.0",
         "yaml-ast-parser": "0.0.43"
@@ -1206,9 +1206,9 @@
       "license": "MIT"
     },
     "node_modules/@redocly/openapi-core/node_modules/brace-expansion": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
-      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2106,16 +2106,16 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/browserslist": {
@@ -2604,9 +2604,9 @@
       "license": "MIT"
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
-      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2813,9 +2813,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "funding": [
         {
@@ -3274,9 +3274,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.19",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.19.tgz",
-      "integrity": "sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==",
+      "version": "8.5.25",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
+      "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
       "dev": true,
       "funding": [
         {
@@ -3294,7 +3294,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -3823,9 +3823,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
-      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
       "dev": true,
       "license": "MIT",
       "engines": {

{remo_cli-4.3.0 → remo_cli-4.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "remo-cli"
-version = "4.3.0"
+version = "4.3.2"
 description = "Remote development environment CLI"
 readme = "README.md"
 license = "MIT"

{remo_cli-4.3.0 → remo_cli-4.3.2}/src/remo_cli/core/ssh.py

@@ -76,6 +76,7 @@ def build_ssh_opts(
     control_dir: str | None = None,
     identity_file: str | None = None,
     known_hosts_file: str | None = None,
+    use_registry_identity: bool = True,
 ) -> tuple[list[str], str]:
     """Build SSH option flags and target string for the given host.
 
@@ -98,6 +99,15 @@ def build_ssh_opts(
         to ambient ``~/.ssh`` identities or agent keys (adopted-mode web
         service identity, R6). ``None`` (the default) emits nothing, leaving
         the argv byte-identical to before this parameter existed.
+    use_registry_identity:
+        When ``True`` (the default) and *identity_file* is ``None``, fall back
+        to an added host's stored ``ssh_identity``. Set ``False`` when the
+        caller cannot assume that path resolves in *its* filesystem — the
+        registry records a **workstation** path, so the web service running in
+        a container may not have it. Emitting it anyway is not a harmless
+        no-op: it comes with ``IdentitiesOnly=yes``, which suppresses every
+        key that *would* have worked, turning a missing file into a guaranteed
+        auth failure.
     known_hosts_file:
         When set, emit ``-o UserKnownHostsFile=<path>``. ``None`` (the
         default) emits nothing. For SSM hosts the access-mode block's
@@ -152,7 +162,9 @@ def build_ssh_opts(
     # wins; otherwise an added (ssh-type) host's stored identity is used
     # (``ssh_identity`` is None for every other type, so their argv is unchanged).
     # ------------------------------------------------------------------
-    effective_identity = identity_file if identity_file is not None else host.ssh_identity
+    effective_identity = identity_file
+    if effective_identity is None and use_registry_identity:
+        effective_identity = host.ssh_identity
     if effective_identity is not None:
         ssh_opts += [
             "-o", f"IdentityFile={effective_identity}",
@@ -180,6 +192,7 @@ def build_ssh_base_cmd(
     control_dir: str | None = None,
     identity_file: str | None = None,
     known_hosts_file: str | None = None,
+    use_registry_identity: bool = True,
     extra_opts: list[str] | None = None,
 ) -> list[str]:
     """Build the full ``ssh`` argv for connecting to *host*.
@@ -213,6 +226,9 @@ def build_ssh_base_cmd(
         Forwarded to :func:`build_ssh_opts` — emits ``-o
         UserKnownHostsFile=<path>`` when set; ``None`` (the default) leaves
         the argv unchanged.
+    use_registry_identity:
+        Forwarded to :func:`build_ssh_opts`. Leave ``True`` on the CLI, whose
+        filesystem is the one the registry path was recorded against.
     extra_opts:
         Extra argv elements inserted after *ssh_opts* but before the
         ``-tt``/target elements — e.g. ``["-L", "8080:localhost:8080"]``
@@ -233,6 +249,7 @@ def build_ssh_base_cmd(
         control_dir=control_dir,
         identity_file=identity_file,
         known_hosts_file=known_hosts_file,
+        use_registry_identity=use_registry_identity,
     )
 
     cmd: list[str] = ["ssh"] + ssh_opts

{remo_cli-4.3.0 → remo_cli-4.3.2}/src/remo_cli/models/host.py

@@ -126,6 +126,22 @@ class KnownHost:
             return self.region
         return None
 
+    @property
+    def display_region(self) -> str:
+        """``region`` when it really is a region, ``""`` when the slot is reused.
+
+        For an added (``ssh``-type) host the slot holds the operator's *private
+        key path*, so anything that surfaces ``region`` as a label — the web
+        service's discovery snapshot, which the console renders as a badge —
+        was publishing that path to every viewer of the console. Blanking it
+        here fixes it for every consumer at once rather than at one call site.
+
+        Proxmox reuses the same slot for the node login, which is mislabeled as
+        a "region" but is neither secret nor new; it is left alone deliberately
+        so this fix does not silently change what Proxmox users see.
+        """
+        return "" if self.type == "ssh" else (self.region or "")
+
     # ------------------------------------------------------------------
     # Display
     # ------------------------------------------------------------------

{remo_cli-4.3.0 → remo_cli-4.3.2}/src/remo_cli/web/check.py

@@ -273,7 +273,10 @@ def _instance_check(host: KnownHost, settings: WebSettings) -> CheckResult:
     ssh_argv_prefix = build_ssh_base_cmd(
         host,
         control_dir=settings.ssh_control_dir,
-        identity_file=settings.ssh_identity_file,
+        identity_file=settings.ssh_identity_for(host),
+        # The service must not inherit a WORKSTATION key path from the
+        # registry; ssh_identity_for() decides, and only when usable here.
+        use_registry_identity=False,
         known_hosts_file=settings.ssh_known_hosts_file,
     )
 

{remo_cli-4.3.0 → remo_cli-4.3.2}/src/remo_cli/web/config.py

@@ -7,6 +7,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 
 from remo_cli.core.config import get_remo_home_readonly
+from remo_cli.models.host import KnownHost
 
 
 class WebConfigError(ValueError):
@@ -225,6 +226,30 @@ class WebSettings:
             return str(self.service_private_key_path)
         return None
 
+    def ssh_identity_for(self, host: KnownHost) -> str | None:
+        """The identity *this service* should use to reach *host*.
+
+        In adopted mode that is always the service's own key — the one
+        ``remo web push`` authorized. Otherwise (mounted/unconfigured/broken)
+        fall back to an added host's registry identity, but **only when the
+        path resolves here**.
+
+        That guard is the fix for a real failure: the registry records a
+        *workstation* path (``/home/you/.ssh/key``), which a containerized
+        service generally does not have. Passing it anyway is not a harmless
+        no-op — :func:`~remo_cli.core.ssh.build_ssh_opts` pairs an identity
+        with ``IdentitiesOnly=yes``, which suppresses every key that *would*
+        have worked, so a missing file turns into a guaranteed auth failure.
+        Falling back to the mounted ``~/.ssh`` is both safer and what the
+        operator expects in mounted mode.
+        """
+        if self._service_identity_active():
+            return str(self.service_private_key_path)
+        identity = host.ssh_identity
+        if identity and Path(identity).expanduser().is_file():
+            return identity
+        return None
+
     @property
     def ssh_known_hosts_file(self) -> str | None:
         if self._service_identity_active():