feat: add background key rotation via LaunchAgent by shawntz · Pull Request #7 · shawntz/cassh

shawntz · 2025-12-10T20:23:10Z

Description

Introduces a new LaunchAgent (com.shawnschwartz.cassh.rotate.plist) to run hourly background key rotation using a headless mode (--rotate-keys). Updates uninstall and postinstall scripts to handle the new agent, and refactors key title generation and GitHub key lookup for improved reliability.

Type of Change

Bug fix (non-breaking change that fixes an issue)
New feature (non-breaking change that adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Refactoring (no functional changes)

Related Issues

Closes #

How Has This Been Tested?

Unit tests
Integration tests
Manual testing

Test environment:

OS: macOS 26.2 Beta (25C5037j)
Go version: 1.25.5 darwin/arm64

Checklist

My code follows the project's style guidelines
I have performed a self-review of my code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
Any dependent changes have been merged and published

Security Considerations

This PR does not introduce any security concerns
I have considered the security implications and addressed them

Screenshots (if applicable)

Introduces a new LaunchAgent (com.shawnschwartz.cassh.rotate.plist) to run hourly background key rotation using a headless mode (--rotate-keys). Updates uninstall and postinstall scripts to handle the new agent, and refactors key title generation and GitHub key lookup for improved reliability.

Copilot

Pull request overview

This PR introduces automated background SSH key rotation for personal GitHub connections via a new LaunchAgent that runs hourly. The implementation adds a headless --rotate-keys mode to the cassh application, refactors key title generation to include hostnames for better identification, and updates the installation/uninstallation scripts to handle the new background rotation agent.

Key Changes

Adds hourly background key rotation via new LaunchAgent (com.shawnschwartz.cassh.rotate.plist) running in headless mode
Refactors SSH key title generation from cassh-{connID} to cassh-{connID}@{hostname} format for improved key identification
Updates GitHub CLI key listing parser to handle the newer output format with additional fields

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
packaging/macos/com.shawnschwartz.cassh.rotate.plist	New LaunchAgent configuration for hourly background key rotation with low CPU priority
packaging/macos/scripts/postinstall	Extended to install and load the rotation LaunchAgent alongside the main app agent
cmd/cassh-menubar/main.go	Adds headless rotation mode, refactors key title generation functions, updates GitHub key lookup parsing, and implements runHeadlessKeyRotation function

Comments suppressed due to low confidence (1)

cmd/cassh-menubar/main.go:2283

The rotatePersonalGitHubSSH function attempts to delete the old key from GitHub using conn.GitHubKeyID, but if that deletion fails (and continues anyway per line 2265), followed by local key file deletion, there's a potential issue. If the new key generation or upload subsequently fails after the local files are deleted at lines 2270-2271, the user could end up with neither the old key files locally nor a working setup. Consider keeping the old key files until the new key is successfully uploaded to GitHub, or implementing a rollback mechanism.

	// 2. Delete local key files
	os.Remove(conn.SSHKeyPath)
	os.Remove(conn.SSHKeyPath + ".pub")

	// 3. Generate new key
	if err := generateSSHKeyForPersonal(conn); err != nil {
		return fmt.Errorf("key generation failed: %w", err)
	}

	// 4. Upload new key to GitHub
	keyTitle := getKeyTitle(conn.ID)
	keyID, err := uploadSSHKeyToGitHub(conn.SSHKeyPath, keyTitle)
	if err != nil {
		return fmt.Errorf("key upload failed: %w", err)
	}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-10T20:30:54Z

cmd/cassh-menubar/main.go

+	// Save config if any keys were rotated
+	if rotatedCount > 0 {
+		if err := config.SaveUserConfig(userCfg); err != nil {
+			log.Printf("Failed to save config: %v", err)
+			os.Exit(1)
+		}
+		log.Printf("Rotated %d key(s)", rotatedCount)
+	} else {
+		log.Println("No keys needed rotation")
+	}
+
+	os.Exit(0)
+}


The runHeadlessKeyRotation function modifies user configuration by calling config.SaveUserConfig without any locking mechanism. If the GUI app is running simultaneously and also modifying the configuration (e.g., during user-initiated changes), there could be a race condition leading to lost updates. Consider implementing file locking or using atomic file operations to ensure concurrent modifications don't corrupt the configuration.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-12-10T20:30:54Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <!-- Also run shortly after load (30 seconds delay) -->
+    <key>RunAtLoad</key>
+    <true/>


The combination of RunAtLoad set to true and StartInterval set to 3600 seconds could result in the rotation running immediately on system boot or user login (after a brief delay), and then again every hour. The comment on line 18 mentions "30 seconds delay" but RunAtLoad doesn't specify a delay - it runs as soon as the agent is loaded. If the intention is to wait 30 seconds after load, consider using StartCalendarInterval with a calculated time or removing RunAtLoad if you only want hourly execution.

Suggested change



<key>RunAtLoad</key>

<true/>

@claude please open a new pull request to apply changes and ensure this won't incidentally break other features in its current form

@copilot please open a new pull request to apply changes and ensure this won't incidentally break other features upstream its current form #7 (comment)

Copilot · 2025-12-10T20:30:54Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <key>LaunchOnlyOnce</key>
+    <false/>


The LaunchOnlyOnce key is set to false with the comment "Don't run if already running" which is contradictory. LaunchOnlyOnce set to false means launchd WILL launch the job multiple times if the interval is met, even if a previous instance is still running. If you want to prevent concurrent executions, consider removing this key (defaults to true for jobs with StartInterval), or implement a lock file mechanism in the runHeadlessKeyRotation function.

Suggested change

<key>LaunchOnlyOnce</key>

<false/>

@copilot open a new pull request to apply changes based on #7 (comment)

Copilot · 2025-12-10T20:30:55Z

packaging/macos/scripts/postinstall

+if [ -f "$ROTATE_AGENT_SRC" ]; then
+  cp "$ROTATE_AGENT_SRC" "$ROTATE_AGENT_DST"
+  chmod 644 "$ROTATE_AGENT_DST"
+  chown root:wheel "$ROTATE_AGENT_DST"
+fi


The script sets 'set -e' at line 5 but then uses '|| true' on many commands. While this is intentional for commands that may fail, the issue is that if ROTATE_AGENT_SRC doesn't exist (line 34 check passes but file is somehow unavailable between check and copy), the script would exit due to 'set -e'. Consider adding error handling or removing 'set -e' and explicitly checking return codes for critical operations only.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-12-10T20:30:55Z

cmd/cassh-menubar/main.go

+// getLegacyKeyTitle returns the old key title format without hostname
+// Used for backwards compatibility when looking up existing keys
+func getLegacyKeyTitle(connID string) string {
+	return fmt.Sprintf("cassh-%s", connID)
+}


The getLegacyKeyTitle function is defined but never used in the codebase. If this is intended for backward compatibility with existing keys that were created with the old title format (without hostname), it should be called somewhere in the key rotation or lookup logic. Otherwise, when users upgrade, the system won't be able to find and delete their old keys from GitHub that were created with the legacy format. Consider either using this function in findGitHubKeyIDByTitle as a fallback, or removing it if not needed.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-12-10T20:30:55Z

cmd/cassh-menubar/main.go

 	for _, line := range lines {
 		if strings.Contains(line, title) {
 			fields := strings.Fields(line)
-			if len(fields) >= 4 {
-				// Key ID is typically the last field
-				return fields[len(fields)-1]
+			if len(fields) >= 5 {
+				// Key ID is the second-to-last field (last is "authentication" or "signing")
+				return fields[len(fields)-2]
 			}
 		}


The findGitHubKeyIDByTitle function uses a simple string contains check which could match incorrect keys. For example, if the hostname contains another connection ID, or if there are multiple keys with similar titles. Consider using a more precise matching strategy, such as checking if the line starts with the exact title followed by whitespace, or using strings.HasPrefix after trimming whitespace.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-12-10T20:30:56Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <string>/tmp/cassh-rotate.log</string>
+    <key>StandardErrorPath</key>
+    <string>/tmp/cassh-rotate.log</string>


Logging to /tmp is problematic because /tmp is typically cleared on reboot on macOS, and may have permission issues. Consider using a more appropriate location such as ~/Library/Logs/cassh/ or using the system logging facilities (which would appear in Console.app). The LaunchAgent runs per-user, so a user-specific log location would be more appropriate.

Suggested change

<string>/tmp/cassh-rotate.log</string>

<key>StandardErrorPath</key>

<string>/tmp/cassh-rotate.log</string>

<string>$HOME/Library/Logs/cassh/cassh-rotate.log</string>

<key>StandardErrorPath</key>

<string>$HOME/Library/Logs/cassh/cassh-rotate.log</string>

@copilot open a new pull request to apply changes based on this discussion

shawntz · 2025-12-13T02:30:49Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packaging/macos/scripts/postinstall

Copilot · 2025-12-13T02:40:50Z

cmd/cassh-menubar/main.go

+	// Example: "cassh-personal-123    ssh-ed25519    AAAA...    2025-12-09T02:43:40Z    137889594    authentication"
 	lines := strings.Split(string(output), "\n")
 	for _, line := range lines {
 		if strings.Contains(line, title) {


Using strings.Contains for title matching can lead to false positives. For example, if searching for "cassh-personal-123", it would match "cassh-personal-1234" as well. Consider using exact matching by checking if the title field equals the search term, or at minimum use strings.HasPrefix on the trimmed fields[0].

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-12-13T02:40:50Z

cmd/cassh-menubar/main.go

+func getLegacyKeyTitle(connID string) string {
+	return fmt.Sprintf("cassh-%s", connID)
+}
+


The getLegacyKeyTitle function is defined but never used. For keys created before this change (using the old title format "cassh-{connID}"), the rotation logic in rotatePersonalGitHubSSH will fail to delete the old key from GitHub if conn.GitHubKeyID is empty. Consider adding a fallback in rotatePersonalGitHubSSH to look up the key by legacy title when GitHubKeyID is empty, or remove this function if it's not needed.

Suggested change

// rotatePersonalGitHubSSH rotates the personal GitHub SSH key, deleting the old key if present

func rotatePersonalGitHubSSH(conn *config.Connection, keyPath string) error {

// Delete old key if we have the key ID

keyID := conn.GitHubKeyID

if keyID == "" {

// Try to find by current title

keyID = findGitHubKeyIDByTitle(getKeyTitle(conn.ID))

if keyID == "" {

// Try to find by legacy title

keyID = findGitHubKeyIDByTitle(getLegacyKeyTitle(conn.ID))

}

}

if keyID != "" {

err := deleteGitHubKeyByID(keyID)

if err != nil {

log.Printf("Failed to delete old GitHub SSH key (ID: %s): %v", keyID, err)

} else {

log.Printf("Deleted old GitHub SSH key (ID: %s)", keyID)

}

}

// Upload new key

title := getKeyTitle(conn.ID)

newKeyID, err := uploadSSHKeyToGitHub(keyPath, title)

if err != nil {

return fmt.Errorf("failed to upload new SSH key: %w", err)

}

conn.GitHubKeyID = newKeyID

return nil

}

@copilot please open a new pull request to apply changes based on this feedback

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-13T05:02:17Z

cmd/cassh-menubar/main.go

+	// Example: "cassh-personal-123    ssh-ed25519    AAAA...    2025-12-09T02:43:40Z    137889594    authentication"
 	lines := strings.Split(string(output), "\n")
 	for _, line := range lines {
 		if strings.Contains(line, title) {


Using strings.Contains(line, title) to match key titles is fragile and can produce false positives. For example, if a user has keys titled "cassh-personal" and "cassh-personal-123", searching for "cassh-personal" would match both. This could lead to deleting or misidentifying the wrong key. Consider using exact matching by checking if the first field equals the title, or using a more robust parsing approach that validates the title is a complete token match.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-12-13T05:02:17Z

packaging/macos/scripts/postinstall

+  # Unload old LaunchAgents if exist (ignore errors)
+  if ! sudo -u "$CONSOLE_USER" launchctl bootout "gui/$CONSOLE_UID/$LABEL" 2>/dev/null; then
+    sudo -u "$CONSOLE_USER" launchctl unload "$LAUNCH_AGENT_DST" 2>/dev/null || true
+  fi
+  if ! launchctl bootout "gui/$CONSOLE_UID/$LABEL" 2>/dev/null; then
+    launchctl unload "$LAUNCH_AGENT_DST" 2>/dev/null || true
+  fi
+  if ! sudo -u "$CONSOLE_USER" launchctl bootout "gui/$CONSOLE_UID/$ROTATE_LABEL" 2>/dev/null; then
+    sudo -u "$CONSOLE_USER" launchctl unload "$ROTATE_AGENT_DST" 2>/dev/null || true
+  fi
+  if ! launchctl bootout "gui/$CONSOLE_UID/$ROTATE_LABEL" 2>/dev/null; then
+    launchctl unload "$ROTATE_AGENT_DST" 2>/dev/null || true
+  fi


The LaunchAgent unloading logic is duplicated for both agents with very similar code blocks. This creates maintainability issues as any changes to the unloading logic need to be repeated in multiple places. Consider extracting this into a shell function that takes the label and destination path as parameters to reduce code duplication and make the script easier to maintain.

@copilot open a new pull request to apply changes based on this feedback

shawntz · 2025-12-13T08:14:28Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2025-12-13T08:14:37Z

@shawntz I've opened a new pull request, #16, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2025-12-13T08:15:55Z

@shawntz I've opened a new pull request, #17, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2025-12-13T08:16:22Z

@shawntz I've opened a new pull request, #18, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2025-12-13T08:16:32Z

@shawntz I've opened a new pull request, #19, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2025-12-13T08:16:37Z

@shawntz I've opened a new pull request, #20, to work on those changes. Once the pull request is ready, I'll request review from you.

…awntz/cassh into feat/add-headless-launchagent

Remove RunAtLoad from rotation LaunchAgent

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-19T10:03:59Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+
+    <!-- Run every hour (no immediate execution on load) -->
+    <key>StartInterval</key>
+    <integer>3600</integer>


The comment states "no immediate execution on load" but StartInterval alone doesn't guarantee this behavior. By default, without an explicit RunAtLoad key set to false, launchd may run the job immediately when loaded. If you want to ensure the job only runs on the interval schedule and not immediately on load, add "<key>RunAtLoad</key><false/>" after the StartInterval key. Otherwise, update the comment to reflect the actual behavior.

Suggested change

<integer>3600</integer>

<integer>3600</integer>

<key>RunAtLoad</key>

<false/>

Copilot · 2025-12-19T10:04:00Z

cmd/cassh-menubar/main.go

+// getLegacyKeyTitle returns the old key title format without hostname
+// Used for backwards compatibility when looking up existing keys
+func getLegacyKeyTitle(connID string) string {
+	return fmt.Sprintf("cassh-%s", connID)
+}


The getLegacyKeyTitle function is defined but never used. Since the key title format has changed from "cassh-{connID}" to "cassh-{connID}@{hostname}", existing keys with the old format will not be found by findGitHubKeyIDByTitle when rotating keys. This means the old key will not be deleted from GitHub during rotation, leaving orphaned keys. Consider using getLegacyKeyTitle as a fallback in rotatePersonalGitHubSSH when conn.GitHubKeyID is empty, to find and delete keys created with the old format.

Copilot · 2025-12-19T10:04:00Z

cmd/cassh-menubar/main.go

+	// Example: "cassh-personal-123    ssh-ed25519    AAAA...    2025-12-09T02:43:40Z    137889594    authentication"
 	lines := strings.Split(string(output), "\n")
 	for _, line := range lines {
 		if strings.Contains(line, title) {


Using strings.Contains for key title matching could match the wrong key. For example, if you have keys titled "cassh-personal@host" and "cassh-personal-backup@host", searching for "cassh-personal@host" would match both. Consider using exact matching by checking if fields[0] equals the title, or use a more precise matching strategy like checking if the line starts with the title followed by whitespace.

Copilot · 2025-12-19T10:04:00Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <key>StandardOutPath</key>
+    <string>/tmp/cassh-rotate.log</string>
+    <key>StandardErrorPath</key>
+    <string>/tmp/cassh-rotate.log</string>


Logging to /tmp/cassh-rotate.log without rotation or size limits could lead to disk space issues over time. Since this LaunchAgent runs hourly, the log file will grow continuously. Consider either: (1) using a system logging mechanism like os_log on macOS, (2) implementing log rotation, or (3) documenting that users should periodically clean this file. Note that /tmp is cleared on reboot on macOS, but the file could still grow large between reboots.

Copilot · 2025-12-19T10:04:00Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <!-- Don't run if already running -->
+    <key>LaunchOnlyOnce</key>
+    <false/>
+


LaunchOnlyOnce is not a valid launchd plist key. The comment suggests the intention is to prevent overlapping executions, but this key will be ignored by launchd. If the goal is to prevent multiple simultaneous executions, that's already the default behavior for LaunchAgents with StartInterval. Consider removing this invalid key entirely, or if you need more control over concurrent executions, investigate using other mechanisms like a lock file in the script itself.

Suggested change



<key>LaunchOnlyOnce</key>

<false/>

Copilot · 2025-12-19T10:04:01Z

cmd/cassh-menubar/main.go

+		log.Println("No keys needed rotation")
+	}
+
+	os.Exit(0)


The function exits with code 0 even when some key rotations fail. If rotation fails for one or more connections (line 2412 continues on error), but succeeds for others, the function still exits with 0 indicating success. This could mask partial failures in monitoring systems. Consider tracking failed rotations and exiting with a non-zero code if any rotations failed, or provide more nuanced exit codes (e.g., 0 for full success, 1 for partial failure, 2 for complete failure).

Copilot · 2025-12-19T10:04:01Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <!-- Logging -->
+    <key>StandardOutPath</key>
+    <string>/tmp/cassh-rotate.log</string>
+    <key>StandardErrorPath</key>
+    <string>/tmp/cassh-rotate.log</string>


Logging to /tmp without secure file creation could expose sensitive information. The /tmp directory is world-readable by default on macOS, and log files created there may contain SSH key paths, GitHub usernames, connection names, or other potentially sensitive information. Consider logging to a user-specific location like ~/Library/Logs/cassh/ with appropriate permissions (0600), or use the macOS unified logging system which handles security automatically.

Suggested change



<key>StandardOutPath</key>

<string>/tmp/cassh-rotate.log</string>

<key>StandardErrorPath</key>

<string>/tmp/cassh-rotate.log</string>

shawntz · 2026-01-01T10:42:37Z

fizzy

…8b-bc6f-e8daec5b1c46 Extract duplicated LaunchAgent unloading logic into reusable function

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…06-8f8f-411296b257da Fix SSH key title matching to prevent false positives

…69-b8f3-42e94d5195ca Add legacy key fallback for personal GitHub SSH key rotation

…19a236-4d18-46c3-be7a-0585366d19df

…c3-be7a-0585366d19df Fix SSH key title matching to prevent false positives

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…d43b7f-7f61-4c4a-ac67-14800ba1b2d5

…4a-ac67-14800ba1b2d5 Fix LaunchAgent log location for key rotation background task

…ease-work

Fix findGitHubKeyIDByTitle to use exact field matching

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…e-more-time

Use getLegacyKeyTitle for backward-compatible key lookup

Fix postinstall script error handling for LaunchAgent operations

…other-one

Fix LaunchOnlyOnce contradiction in key rotation LaunchAgent

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-11T09:01:39Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <!-- Logging -->
+    <key>StandardOutPath</key>
+    <string>~/Library/Logs/cassh/cassh-rotate.log</string>
+    <key>StandardErrorPath</key>
+    <string>~/Library/Logs/cassh/cassh-rotate.log</string>


The logging paths use world-readable /tmp directory which could expose sensitive information. SSH key rotation logs may contain usernames, connection names, or error messages with sensitive details. Consider using a user-specific log directory like ~/Library/Logs/cassh-rotate.log or /var/log/cassh-rotate.log with appropriate permissions.

Copilot · 2026-01-11T09:01:40Z

cmd/cassh-menubar/main.go

+// getLegacyKeyTitle returns the old key title format without hostname
+// Used for backwards compatibility when looking up existing keys
+func getLegacyKeyTitle(connID string) string {
+	return fmt.Sprintf("cassh-%s", connID)
+}
+


The getLegacyKeyTitle function is defined but never used in the codebase. If backward compatibility with old key titles is needed during rotation (to find and delete old keys created before this PR), this function should be called in the rotatePersonalGitHubSSH or deleteSSHKeyFromGitHub functions. Otherwise, this function should be removed as dead code.

Suggested change

// getLegacyKeyTitle returns the old key title format without hostname

// Used for backwards compatibility when looking up existing keys

func getLegacyKeyTitle(connID string) string {

return fmt.Sprintf("cassh-%s", connID)

}

Copilot · 2026-01-11T09:01:40Z

cmd/cassh-menubar/main.go

+	}
+	if keyID != "" {
+		if err := deleteSSHKeyFromGitHub(keyID); err != nil {
+			log.Printf("Warning: failed to delete old key (ID: %s): %v", keyID, err)


The key rotation logic changes the key title format from 'cassh-{connID}' to 'cassh-{connID}@{hostname}', but there's no migration path for existing keys. When rotatePersonalGitHubSSH runs, it attempts to delete the old key using conn.GitHubKeyID, but if that fails or is empty, old keys with the legacy title format will remain orphaned on GitHub. Consider attempting to find and delete legacy-format keys by calling findGitHubKeyIDByTitle with both the new and legacy title formats.

Suggested change

log.Printf("Warning: failed to delete old key (ID: %s): %v", keyID, err)

log.Printf("Warning: failed to delete old key (ID: %s): %v", keyID, err)

// Attempt migration cleanup: look for keys by both new and legacy titles

if conn.ID != "" {

currentTitle := getKeyTitle(conn.ID)

if currentTitle != "" {

if altID := findGitHubKeyIDByTitle(currentTitle); altID != "" && altID != keyID {

if err := deleteSSHKeyFromGitHub(altID); err != nil {

log.Printf("Warning: failed to delete key found by current title (ID: %s): %v", altID, err)

} else {

log.Printf("Deleted GitHub SSH key found by current title (ID: %s)", altID)

}

}

}

legacyTitle := getLegacyKeyTitle(conn.ID)

if legacyTitle != "" {

if altID := findGitHubKeyIDByTitle(legacyTitle); altID != "" && altID != keyID {

if err := deleteSSHKeyFromGitHub(altID); err != nil {

log.Printf("Warning: failed to delete key found by legacy title (ID: %s): %v", altID, err)

} else {

log.Printf("Deleted GitHub SSH key found by legacy title (ID: %s)", altID)

}

}

}

}

Copilot · 2026-01-11T09:01:40Z

packaging/macos/com.shawnschwartz.cassh.rotate.plist

+    <!-- Run every hour (no immediate execution on load) -->
+    <key>StartInterval</key>
+    <integer>3600</integer>
+


The comment on line 14 states 'Run every hour (no immediate execution on load)', but StartInterval actually triggers immediately on load and then every hour after that according to macOS LaunchAgent documentation. If you truly want to prevent immediate execution on load, you should use StartCalendarInterval instead of StartInterval, or add RunAtLoad set to false explicitly.

Suggested change



<key>RunAtLoad</key>

<false/>

Copilot · 2026-01-11T09:01:41Z

cmd/cassh-menubar/main.go

+		fields := strings.Fields(line)
+		if len(fields) >= 5 {
+			keyTitle := fields[0]
+			keyID := fields[len(fields)-2] // Key ID is the second-to-last field
+			// Check for exact match with new title format
+			if keyTitle == title {
+				return keyID
+			}
+			// Check for exact match with legacy title format (if applicable)
+			if legacyTitle != "" && keyTitle == legacyTitle {
+				log.Printf("Found key with legacy title format: %s", legacyTitle)
+				return keyID
 			}
 		}


The key title parsing logic assumes exactly 6 fields in the output, with the title being everything before the last 5 fields. However, if the gh CLI output format changes in future versions, or if there are edge cases with fewer fields, this could fail silently. Consider adding validation or logging when the field count is unexpected, and handling the case where len(fields) is between 1 and 5 more explicitly.

Suggested change

fields := strings.Fields(line)

if len(fields) >= 5 {

keyTitle := fields[0]

keyID := fields[len(fields)-2] // Key ID is the second-to-last field

// Check for exact match with new title format

if keyTitle == title {

return keyID

}

// Check for exact match with legacy title format (if applicable)

if legacyTitle != "" && keyTitle == legacyTitle {

log.Printf("Found key with legacy title format: %s", legacyTitle)

return keyID

}

}

line = strings.TrimSpace(line)

if line == "" {

continue

}

fields := strings.Fields(line)

// We expect at least 6 fields:

// TITLE (may contain spaces) + TYPE + KEY + ADDED + KEY_ID + KEY_TYPE

if len(fields) < 2 {

log.Printf("Unexpected ssh-key list line (too few fields): %q", line)

continue

}

if len(fields) < 6 {

log.Printf("Unexpected ssh-key list field count (%d) for line: %q", len(fields), line)

continue

}

// Title is everything before the last 5 fields

titleFieldCount := len(fields) - 5

keyTitle := strings.Join(fields[:titleFieldCount], " ")

keyID := fields[len(fields)-2] // Key ID is the second-to-last field

// Check for exact match with new title format

if keyTitle == title {

return keyID

}

// Check for exact match with legacy title format (if applicable)

if legacyTitle != "" && keyTitle == legacyTitle {

log.Printf("Found key with legacy title format: %s", legacyTitle)

return keyID

}

shawntz self-assigned this Dec 10, 2025

Copilot AI review requested due to automatic review settings December 10, 2025 20:23

shawntz added the enhancement New feature or request label Dec 10, 2025

Copilot started reviewing on behalf of shawntz December 10, 2025 20:23 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

shawntz changed the base branch from main to staging December 10, 2025 21:01

shawntz requested a review from Copilot December 13, 2025 02:32

Copilot started reviewing on behalf of shawntz December 13, 2025 02:32 View session

Copilot AI reviewed Dec 13, 2025

View reviewed changes

Update postinstall

7e077a5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings December 13, 2025 04:55

Copilot started reviewing on behalf of shawntz December 13, 2025 04:55 View session

Copilot AI reviewed Dec 13, 2025

View reviewed changes

Copilot AI mentioned this pull request Dec 13, 2025

fix: address code review feedback for background key rotation #16

Open

18 tasks

Initial plan

7243e97

Copilot AI mentioned this pull request Dec 13, 2025

Remove RunAtLoad from rotation LaunchAgent #17

Merged

18 tasks

Initial plan

c127680

Copilot AI mentioned this pull request Dec 13, 2025

Fix LaunchOnlyOnce contradiction in key rotation LaunchAgent #18

Merged

16 tasks

Initial plan

481f3e1

Initial plan

db4be56

Copilot AI mentioned this pull request Dec 13, 2025

Fix postinstall script error handling for LaunchAgent operations #19

Merged

17 tasks

Copilot AI mentioned this pull request Dec 13, 2025

Use getLegacyKeyTitle for backward-compatible key lookup #20

Merged

18 tasks

shawntz added 2 commits December 19, 2025 01:18

Merge branch 'feat/add-headless-launchagent' of https://github.com/sh…

bc06aac

…awntz/cassh into feat/add-headless-launchagent

Merge pull request #17 from shawntz/copilot/sub-pr-7-again

a45e52f

Remove RunAtLoad from rotation LaunchAgent

Copilot AI review requested due to automatic review settings December 19, 2025 09:57

Copilot started reviewing on behalf of shawntz December 19, 2025 09:57 View session

Copilot AI reviewed Dec 19, 2025

View reviewed changes

shawntz and others added 4 commits January 11, 2026 00:54

Merge pull request #26 from shawntz/copilot/sub-pr-7-e1862c20-e1a7-46…

dd4fae1

…8b-bc6f-e8daec5b1c46 Extract duplicated LaunchAgent unloading logic into reusable function

Update cmd/cassh-menubar/main.go

5eb1547

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update cmd/cassh-menubar/main.go

1ed17cd

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge pull request #25 from shawntz/copilot/sub-pr-7-07734849-0bdc-4d…

fe2e9ef

…06-8f8f-411296b257da Fix SSH key title matching to prevent false positives

Copilot AI review requested due to automatic review settings January 11, 2026 08:55

Copilot started reviewing on behalf of shawntz January 11, 2026 08:55 View session

shawntz and others added 17 commits January 11, 2026 00:55

Merge pull request #24 from shawntz/copilot/sub-pr-7-b0705b1b-7749-47…

a858119

…69-b8f3-42e94d5195ca Add legacy key fallback for personal GitHub SSH key rotation

Merge branch 'feat/add-headless-launchagent' into copilot/sub-pr-7-c9…

c557362

…19a236-4d18-46c3-be7a-0585366d19df

Merge pull request #23 from shawntz/copilot/sub-pr-7-c919a236-4d18-46…

1497242

…c3-be7a-0585366d19df Fix SSH key title matching to prevent false positives

Update packaging/macos/scripts/postinstall

a7b27dd

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update packaging/macos/scripts/postinstall

88b5b42

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update packaging/macos/scripts/postinstall

82a269f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update packaging/macos/scripts/postinstall

2b37caa

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'feat/add-headless-launchagent' into copilot/sub-pr-7-81…

ffa6a85

…d43b7f-7f61-4c4a-ac67-14800ba1b2d5

Merge pull request #22 from shawntz/copilot/sub-pr-7-81d43b7f-7f61-4c…

fc9c04e

…4a-ac67-14800ba1b2d5 Fix LaunchAgent log location for key rotation background task

Merge branch 'feat/add-headless-launchagent' into copilot/sub-pr-7-pl…

de7b7d6

…ease-work

Merge pull request #21 from shawntz/copilot/sub-pr-7-please-work

00d25c6

Fix findGitHubKeyIDByTitle to use exact field matching

Update cmd/cassh-menubar/main.go

1d3b22e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'feat/add-headless-launchagent' into copilot/sub-pr-7-on…

8c2e154

…e-more-time

Merge pull request #20 from shawntz/copilot/sub-pr-7-one-more-time

e67b4c0

Use getLegacyKeyTitle for backward-compatible key lookup

Merge pull request #19 from shawntz/copilot/sub-pr-7-yet-again

fd6e0c1

Fix postinstall script error handling for LaunchAgent operations

Merge branch 'feat/add-headless-launchagent' into copilot/sub-pr-7-an…

48c6da8

…other-one

Merge pull request #18 from shawntz/copilot/sub-pr-7-another-one

5db9d0f

Fix LaunchOnlyOnce contradiction in key rotation LaunchAgent

Copilot AI reviewed Jan 11, 2026

View reviewed changes

+// rotatePersonalGitHubSSH rotates the personal GitHub SSH key, deleting the old key if present
+func rotatePersonalGitHubSSH(conn *config.Connection, keyPath string) error {
+	// Delete old key if we have the key ID
+	keyID := conn.GitHubKeyID
+	if keyID == "" {
+		// Try to find by current title
+		keyID = findGitHubKeyIDByTitle(getKeyTitle(conn.ID))
+		if keyID == "" {
+			// Try to find by legacy title
+			keyID = findGitHubKeyIDByTitle(getLegacyKeyTitle(conn.ID))
+		}
+	}
+	if keyID != "" {
+		err := deleteGitHubKeyByID(keyID)
+		if err != nil {
+			log.Printf("Failed to delete old GitHub SSH key (ID: %s): %v", keyID, err)
+		} else {
+			log.Printf("Deleted old GitHub SSH key (ID: %s)", keyID)
+		}
+	}
+	// Upload new key
+	title := getKeyTitle(conn.ID)
+	newKeyID, err := uploadSSHKeyToGitHub(keyPath, title)
+	if err != nil {
+		return fmt.Errorf("failed to upload new SSH key: %w", err)
+	}
+	conn.GitHubKeyID = newKeyID
+	return nil
+}

	<!-- Don't run if already running -->
	<key>LaunchOnlyOnce</key>
	<false/>

-			log.Printf("Warning: failed to delete old key (ID: %s): %v", keyID, err)
+			log.Printf("Warning: failed to delete old key (ID: %s): %v", keyID, err)
+			// Attempt migration cleanup: look for keys by both new and legacy titles
+			if conn.ID != "" {
+				currentTitle := getKeyTitle(conn.ID)
+				if currentTitle != "" {
+					if altID := findGitHubKeyIDByTitle(currentTitle); altID != "" && altID != keyID {
+						if err := deleteSSHKeyFromGitHub(altID); err != nil {
+							log.Printf("Warning: failed to delete key found by current title (ID: %s): %v", altID, err)
+						} else {
+							log.Printf("Deleted GitHub SSH key found by current title (ID: %s)", altID)
+						}
+					}
+				}
+				legacyTitle := getLegacyKeyTitle(conn.ID)
+				if legacyTitle != "" {
+					if altID := findGitHubKeyIDByTitle(legacyTitle); altID != "" && altID != keyID {
+						if err := deleteSSHKeyFromGitHub(altID); err != nil {
+							log.Printf("Warning: failed to delete key found by legacy title (ID: %s): %v", altID, err)
+						} else {
+							log.Printf("Deleted GitHub SSH key found by legacy title (ID: %s)", altID)
+						}
+					}
+				}
+			}

Uh oh!

Conversation

shawntz commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of Change

Related Issues

How Has This Been Tested?

Checklist

Security Considerations

Screenshots (if applicable)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shawntz commented Dec 13, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

shawntz commented Dec 10, 2025 •

edited

Loading