The command no longer sends a shell script to the host. It fetches
~/.ssh/authorized_keys with the system sftp in batch mode, adds the key
line here, and writes the file back in a second session: mkdir and chmod
on ~/.ssh, put to authorized_keys.keyfunc-<random>, chmod 600, rename
over authorized_keys. Adding the line connects twice.
The file reads as empty only when sftp reported it as not there, in the
line naming that path; the same wording elsewhere -- ssh writes it about
an identity file it cannot find -- does not count, so a file that cannot
be read is never written over. A failed step removes nothing and names
the uploaded file once sftp's echo shows the put was reached.
Model: opus-5
keyfunc ssh install appends the public line on a host through the system ssh, only when absent, feeding the line on standard input; keyfunc ssh to serves the derived key from an in-process agent on a private socket and runs the system ssh with it, the private key never on disk. Two review rounds; the second passed with no findings.
Model: opus-5 (implementation and review); fable-5-1 (landing)
