ssh re-splits remote command args on spaces, so -- "$PUB" arrived as $1=ssh-ed25519
(the key body and comment became $2/$3). The loose validation passed and grep -qF
matched any ed25519 key -> false '[skip] key present'; the key was never added.
Pass PUB via env (safe inside remote single-quotes) and require 'ssh-ed25519 AAAA*'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Piping a password into ssh -tt's pty raced and hung on the real run (worked in
a fast test, blocked for 14 min in practice). Replace with a temp
/etc/sudoers.d/mac-setup installed by _install_sudoers.sh (validated
before activation), removed on every exit path plus a 40-min on-Mac
self-destruct. setup.sh now fails fast if passwordless sudo is absent
instead of depending on a primed tty ticket.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mortdecai