test: cover SSH-based commands

[pjcdawkins]

Integration tests for commands that run over SSH, using the mock SSH server's ExecHandler with fake remote clients (shell scripts on the remote PATH that print their arguments).

• ssh: --pipe, --all, and app and worker selection in a multi-app project
• ssh-cert:load (--new, --new-key, --refresh-only, SSH config files) and ssh-cert:info (--no-refresh with missing, expired and mismatched certificates, expiry)
• db:dump, db:sql, db:size
• mount:size, and mount:upload/mount:download via rsync (skipped if rsync is missing)
• service:redis-cli and service:mongo:*

Fix: ssh --all selected an app before listing all SSH URLs, so it failed in non-interactive mode in multi-app projects.

The mock auth server's SSH certificate key ID and lifetime are now configurable: the CLI only reuses a certificate whose key ID is the user ID and which expires in more than 2 minutes, which the previous fixed values never satisfied.

SFTP (scp) and port forwarding (tunnel:*, environment:xdebug) need mock SSH server changes, and will follow separately.

🤖 Generated with Claude Code

[upsun-dispatch]

Warning

Changes suggested — 🟡 1 warning · 🔵 1 minor point

🔍 Full review · 9 files reviewed

Verification

• SelectorConfig::$selectRemoteContainer exists (default true), and Selector::getSelection skips container selection only when it is false, so non---all paths still go through getRemoteContainer().
• nextSSHCertificate falls back to "test-key-id" and one minute when unset, so TestSSHCerts and the other existing tests still get the old certificate values.
• remoteEnv appends a second PATH after os.Environ(). ExecHandler passes that to exec.Cmd.Env, whose dedup keeps the last value, so the fake binaries take precedence.
• Certificate counts in TestSSHCertLoad go 1 (--refresh-only), 2 (--new with the wrong key ID), 3 (the regenerating info), then stay at 3 on reuse, then 4 (--new) and 5 (--new-key). Each count matches one issuing step.

The PR consists mostly of new integration tests in integration-tests/, which skip on Windows; the rsync tests also skip when rsync is missing. TestSSHAppSelection covers the PHP --all fix in a multi-app project. No test covers --all on an inactive or paused environment.

Review details

• Commit: 6127436
• Model: claude-opus-5-5

---

Review 1 of 10 for this pull request · View the full run

[upsun-dispatch]

📋 PR Summary

This PR adds integration tests for CLI commands that run over SSH: ssh, ssh-cert:*, db:*, mount:* and service:*. The tests use the mock SSH server's ExecHandler with fake remote clients. It also fixes ssh --all so it no longer selects an app first, which made it fail in non-interactive multi-app projects. The mock auth server's certificate key ID and lifetime can now be configured so the CLI's certificate reuse logic can be tested. The latest push changes the mount:size test's fake df script to use a quoted heredoc, with the app directory filled in on the Go side instead of expanded by the shell.

Changes

Layer / File(s)	Summary
Integration tests
integration-tests/db_ssh_test.go	Tests for db:dump, db:sql and db:size using fake remote clients.
integration-tests/mount_ssh_test.go	Tests for mount:size and for rsync-based mount:upload/mount:download. The fake df output now uses a quoted heredoc, with APP_DIR replaced in Go.
integration-tests/service_ssh_test.go	Tests for service:redis-cli and service:mongo:*.
integration-tests/ssh_cert_test.go	Tests for ssh-cert:load options and for ssh-cert:info with missing, expired and mismatched certificates.
integration-tests/ssh_test.go	Tests for ssh with --pipe, --all, and app/worker selection.
integration-tests/project_setup_test.go	Shared helpers for setting up SSH-enabled projects and the remote environment.
Mock server
pkg/mockapi/auth_server.go	Makes the SSH certificate key ID and lifetime configurable.
Bug fix
legacy/src/Command/Environment/EnvironmentSshCommand.php	ssh --all now lists SSH URLs without selecting an app first.
Docs
CLAUDE.md	Changes one line of the guidance.