fix(ssh): deduplicate configured host suggestions

apps/desktop/src/ssh/DesktopSshEnvironment.test.ts

@@ -92,7 +92,7 @@ describe("sshEnvironment", () => {
         },
         {
           alias: "devbox",
-          hostname: "devbox",
+          hostname: "devbox.example.com",
           username: null,
           port: null,
           source: "ssh-config",
@@ -106,7 +106,7 @@ describe("sshEnvironment", () => {
         },
         {
           alias: "staging",
-          hostname: "staging",
+          hostname: "staging.example.com",
           username: null,
           port: null,
           source: "ssh-config",

apps/web/src/components/settings/ConnectionsSettings.tsx

@@ -2273,7 +2273,8 @@ export function ConnectionsSettings() {
         const address = formatDesktopSshTarget(target);
         return (
           !savedDesktopSshEnvironmentKeys.has(target.alias) &&
-          !savedDesktopSshEnvironmentKeys.has(address)
+          // A configured alias keeps its own settings even when its hostname is saved.
+          (target.source === "ssh-config" || !savedDesktopSshEnvironmentKeys.has(address))
         );
       }),
     [discoveredSshHosts, savedDesktopSshEnvironmentKeys],

apps/web/src/state/desktopSshHosts.test.ts

@@ -91,6 +91,10 @@ describe("filterDiscoveredSshHosts", () => {
     expect(filterDiscoveredSshHosts(suggestions, "PINOT")).toEqual([suggestions[1]]);
   });
 
+  it("finds a configured alias by its hostname", () => {
+    expect(filterDiscoveredSshHosts(hosts, "box.LOCAL")).toEqual(hosts);
+  });
+
   it("returns an empty array when no hosts match", () => {
     expect(filterDiscoveredSshHosts(suggestions, "merlot")).toEqual([]);
   });

apps/web/src/state/desktopSshHosts.ts

@@ -19,7 +19,10 @@ export function filterDiscoveredSshHosts(
     const alias = host.alias.toLowerCase();
     if (alias.startsWith(normalizedQuery)) {
       prefixMatches.push(host);
-    } else if (alias.includes(normalizedQuery)) {
+    } else if (
+      alias.includes(normalizedQuery) ||
+      host.hostname.toLowerCase().includes(normalizedQuery)
+    ) {
       substringMatches.push(host);
     }
   }

packages/ssh/src/config.test.ts

@@ -49,6 +49,7 @@ describe("ssh config", () => {
       yield* fs.writeFileString(
         path.join(sshDir, "known_hosts"),
         [
+          "devbox.example.com ssh-ed25519 AAAA",
           "known.example.com ssh-ed25519 AAAA",
           "|1|hashed|entry ssh-ed25519 AAAA",
           "[bastion.example.com]:2222 ssh-ed25519 AAAA",
@@ -67,7 +68,7 @@ describe("ssh config", () => {
         },
         {
           alias: "devbox",
-          hostname: "devbox",
+          hostname: "devbox.example.com",
           username: null,
           port: null,
           source: "ssh-config",
@@ -88,7 +89,7 @@ describe("ssh config", () => {
         },
         {
           alias: "staging",
-          hostname: "staging",
+          hostname: "staging.example.com",
           username: null,
           port: null,
           source: "ssh-config",

packages/ssh/src/config.ts

@@ -89,10 +89,41 @@ const expandGlob = Effect.fnUntraced(function* (pattern: string) {
   return matchedPaths.toSorted((left, right) => left.localeCompare(right));
 });
 
+interface HostNameRule {
+  /** Host patterns of the enclosing block, or null under a Match block. */
+  readonly patterns: ReadonlyArray<string> | null;
+  readonly hostname: string;
+}
+
+function matchesHostPatterns(alias: string, patterns: ReadonlyArray<string>): boolean {
+  let matched = false;
+  for (const pattern of patterns) {
+    const negated = pattern.startsWith("!");
+    if (!globToRegExp(negated ? pattern.slice(1) : pattern).test(alias)) continue;
+    if (negated) return false;
+    matched = true;
+  }
+  return matched;
+}
+
+/** ssh uses the first HostName whose block matches; null when that can't be known statically. */
+function resolveConfiguredHostname(
+  alias: string,
+  rules: ReadonlyArray<HostNameRule>,
+): string | null {
+  const rule = rules.find(
+    ({ patterns }) => patterns === null || matchesHostPatterns(alias, patterns),
+  );
+  if (!rule || rule.patterns === null || /%[^h]/u.test(rule.hostname)) return null;
+  return rule.hostname.replaceAll("%h", alias);
+}
+
 const collectSshConfigAliasesFromFile = Effect.fnUntraced(function* (
   filePath: string,
   visited = new Set<string>(),
   homeDir: string,
+  hostNameRules: Array<HostNameRule>,
+  inheritedPatterns: ReadonlyArray<string> | null,
 ): Effect.fn.Return<
   ReadonlyArray<string>,
   PlatformError.PlatformError,
@@ -109,6 +140,7 @@ const collectSshConfigAliasesFromFile = Effect.fnUntraced(function* (
   const aliases = new Set<string>();
   const directory = path.dirname(resolvedPath);
   const raw = yield* fs.readFileString(resolvedPath);
+  let patterns = inheritedPatterns;
 
   for (const line of raw.split(/\r?\n/u)) {
     const stripped = stripInlineComment(line);
@@ -131,6 +163,8 @@ const collectSshConfigAliasesFromFile = Effect.fnUntraced(function* (
             includedPath,
             visited,
             homeDir,
+            hostNameRules,
+            patterns,
           );
           for (const alias of includedAliases) {
             aliases.add(alias);
@@ -140,10 +174,21 @@ const collectSshConfigAliasesFromFile = Effect.fnUntraced(function* (
       continue;
     }
 
+    if (normalizedDirective === "match") {
+      patterns = null;
+      continue;
+    }
+    if (normalizedDirective === "hostname") {
+      if (rawArgs[0])
+        hostNameRules.push({ patterns, hostname: rawArgs[0].replace(/^"(.*)"$/u, "$1") });
+      continue;
+    }
     if (normalizedDirective !== "host") {
       continue;
     }
 
+    patterns = rawArgs;
+
     for (const alias of rawArgs) {
       if (alias.length === 0 || hasSshPattern(alias)) {
         continue;
@@ -224,26 +269,33 @@ export const discoverSshHosts = Effect.fnUntraced(
     }
 
     const sshDirectory = path.join(homeDir, ".ssh");
+    const hostNameRules: Array<HostNameRule> = [];
     const configAliases = yield* collectSshConfigAliasesFromFile(
       path.join(sshDirectory, "config"),
       new Set<string>(),
       homeDir,
+      hostNameRules,
+      ["*"],
     );
     const knownHosts = yield* readKnownHostsHostnames(path.join(sshDirectory, "known_hosts"));
     const discovered = new Map<string, DesktopDiscoveredSshHost>();
+    const configuredHostnames = new Set<string>();
 
     for (const alias of configAliases) {
+      const hostname = resolveConfiguredHostname(alias, hostNameRules) ?? alias;
+      configuredHostnames.add(hostname.toLowerCase());
       discovered.set(alias, {
         alias,
-        hostname: alias,
+        hostname,
         username: null,
         port: null,
         source: "ssh-config",
       });
     }
 
+    // A raw known_hosts target that a configured alias points at would bypass the alias's settings.
     for (const hostname of knownHosts) {
-      if (discovered.has(hostname)) {
+      if (discovered.has(hostname) || configuredHostnames.has(hostname.toLowerCase())) {
         continue;
       }
       discovered.set(hostname, {