20261101
- Extracted portable
p_openpty()andp_login_tty()helpers from PTY session setup.
The following issues were discovered by Anthropic's OSS Scanner:
- Detached non-PTY session commands from the supervisor's controlling terminal (ANT-2026-XXAAW4IN).
- Restricted PTY permissions before changing ownership, using the open slave descriptor (ANT-2026-N0CYS4Q7).
- Passed the remaining authentication timeout to the authorized_keys helper (ANT-2026-05XP1SBC).
- Added portable p_closefrom (ANT-2026-6TL7702P).
- Stopped retrying writes after PTY input hangup to prevent a busy loop (ANT-2026-C5CA7S93).
- Checked the home and .ssh directory paths before following authorized_keys symlinks (ANT-2026-1X7WCZO8).
- Rejected non-canonical public key encodings in bundled Ed25519 verification (ANT-2026-WLSFCCD8).
- Rejected embedded NUL bytes in key-exchange algorithm name-lists (ANT-2026-C3S8DE78).
- Preserved the original pre-authentication timeout through initial key exchange (ANT-2026-LAOMU7HO).
- Ignored strict-KEX pseudo-algorithms during rekeying (ANT-2026-W96YNM9A).
- Preserved the original connection addresses when starting a session after a TCP reset (ANT-2026-9WQBV5XI).
- Enforced the unauthenticated message limit across strict-KEX sequence number resets (ANT-2026-J2GQ3C81).
- Validated the expected NEWKEYS message before resetting the receive sequence number (ANT-2026-JG01TJVM).
- Rejected unexpected packets while waiting for NEWKEYS in non-strict key exchange (ANT-2026-ENU881FU).
- Rejected trailing bytes in NEWKEYS and unsigned public-key authentication queries (ANT-2026-XZ9G6LZF).
- Charged discarded channel data to the receive window (ANT-2026-73WWMPXB).
- Discarded input after EOF and stopped sending session output after channel close (ANT-2026-VVQSA6W4).
- Emitted each log message as a single record, truncating oversized messages (ANT-2026-UZM1VY24).
- Preserved the blocking mode of inherited standard error (ANT-2026-SJBW016C).
- Rejected all-zero X25519 shared secrets in hybrid key exchange (ANT-2026-B39U58TI).