Preserve existing SSH connection commands - #14925

Prototype overview and documentation

DO NOT MERGE. This stack is almost entirely vibe coded. These drafts are for handy review and prototyping, not merging as-is.

Expect the code to be really bad in places: highly coupled, handling edge cases that do not really matter, or doing suspiciously fragile things like parsing GraphQL request bodies.

I suspect some of the suspicious code also exposes the complexity of this feature set, because account selection, Git configuration, scope precedence, worktrees, SSH and API requests all interact.

The prototype experience is the purpose, not the code. I want to find out whether the experience is useful, not defend this implementation or treat it as a design to preserve.

Description

Follow on from #14924

Basic SSH routing rejects existing connection commands, including literal OpenSSH options. This PR preserves compatible connection commands while routing to the selected identity alias.

Layer 6 of an eight-part prototype review stack. This is a way to review the design and implementation in smaller pieces, not a proposal to merge the current stack as-is.

How did you test this change?

I read the original and managed Git files before and after applying the identity, then checked that unset exposed the original command. I also cloned and pushed to a private repository over real SSH while retaining the existing compression option.

$ gh auth use --unset && cat ~/.gitconfig
Removed identity binding
[core]
	sshCommand = ssh -o Compression=yes

A personal SSH clone for one command leaves the work identity selected

Work SSH identity: directory inheritance preserves normal OpenSSH options

Key points

The global file retains the original core.sshCommand. Its managed include supplies the effective dispatcher and ssh.variant, while the dispatcher discovers the underlying literal command. This is compatibility with existing options, not the introduction of the dispatcher.

Unknown argument conventions, unsupported variants, recursive dispatch and shell expressions are refused. The recordings use temporary, independently verified keys rather than a simulated connection.

Notes for reviewers

The live recordings use DEMO_SSH_TRACE=1, which is recording infrastructure, not a product flag. It displays selected real OpenSSH diagnostics and the effective compression setting. It does not choose the account or alter identity routing.

I do not know whether this preserves a particular enterprise certificate policy. The recordings do not establish that.

The recordings use the product code at this layer, not a later stack endpoint. The included offline replay scripts are supplementary and do not reproduce the live-account recordings.

make
env -i HOME="$HOME" PATH=/usr/bin:/bin:/opt/homebrew/bin \
  /bin/bash script/multiaccount-review/06-ssh.sh --gh "$PWD/bin/gh"

Authorship and follow-up

Who wrote this:

• A human wrote it.
• An agent wrote it under close human direction.
• An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

• @username will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted.
• Nobody has explicitly committed to replying.

Acceptance Criteria

Prototype behaviour under review:

Given an existing SSH command uses supported literal OpenSSH arguments.

When I select a routed identity or use a one-command override.

Then the connection options are preserved while the declared alias determines the destination.

DO NOT MERGE