sneak f6d613727d Keep the mnemonic out of the ssh and sftp children (closes #16) ...

ssh to and ssh install started the system ssh and sftp with the tool's
whole environment, so a mnemonic taken from KEYFUNC_MNEMONIC stayed in
the child's environment for as long as it ran, readable by the same user
and forwardable to the host through a SendEnv line. ssh to keeps the
private key inside the tool; the mnemonic must not leave it either.

A shared helper in the ssh cli package hands both children the tool's
environment with KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND removed.
The mnemonic command itself still runs with the full environment. The
stand-in ssh and sftp in the tests now record their environment, and two
tests show neither variable reaches them while another one does.

Model: opus-4-8

2026-09-21 08:01:45 +00:00

..

agekey

The age commands: pub, priv, encrypt and decrypt (closes #3)

2026-09-07 18:35:11 +02:00

childmnemonic

The mnemonic command: child mnemonics (closes #4)

2026-09-07 18:05:08 +02:00

cli

Keep the mnemonic out of the ssh and sftp children (closes #16)

2026-09-21 08:01:45 +00:00

derive

The mnemonic command: child mnemonics (closes #4)

2026-09-07 18:05:08 +02:00

mnemonic

Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1)

2026-09-07 17:34:54 +02:00

sshkey

The ssh install and ssh to commands (closes #2)

2026-09-07 18:49:42 +02:00