[renatoathaydes]

Summary

The github.com/loft-sh Go modules are no longer maintained, so DevPod no longer depends on any of them. Their code now lives in this repository, and the unmaintained libraries they pulled in are gone too.

Module	Replacement
loft-sh/log	pkg/log (copied; Apache 2.0 licence kept in pkg/log/LICENSE)
loft-sh/ssh (fork of gliderlabs/ssh)	pkg/ssh/sshd: gliderlabs/ssh v0.3.8 plus loft-sh's unix socket forwarding, agent listener and port-0 fix (BSD licence kept)
loft-sh/programming-language-detection	pkg/language/detect.go (own code)

Transitive dependencies removed: AlecAivazis/survey (archived), mgutz/ansi, acarl005/stripansi, k0kubun/go-ansi, anmitsu/go-shlex, kballard/go-shellquote, mattn/go-colorable and olekukonko/tablewriter v0.0.5. Replacements:

• Prompts use charmbracelet/huh, which was already a dependency.
• Tables are rendered by our own code in the same layout. tablewriter v1 would have added seven modules, including the unmaintained olekukonko/ts.
• Colours and escape stripping are a few lines of our own code. On Windows, the console's VT processing is enabled through x/sys/windows.
• Session.Command() was removed from sshd; it had no callers, and callers use RawCommand().

Fixes found on the way (see CHANGELOG):

• Language detection now recognizes C++, C# and PHP projects. The old library returned names that never matched devpod's own, and it skipped any file whose name contained env, dist or cache.
• A required provider option without allowed values can be prompted for again. The old survey code got an empty option list and failed with "please provide options to select from".
• The file logger rotates at 10 MB as intended (it was set to 10 TB).

The stripped linux/amd64 binary is about 390 KB smaller. go-licenses now ignores only github.com/loft-sh/devpod, so any future loft-sh dependency gets checked.

Security hardening

A security review of the change found no new high or medium severity issues. It found four low-severity issues inherited from the upstream SSH server code that runs in the dev container, and this PR fixes them (last commit):

• Removed command: the hidden devpod agent container ssh-server command is gone. Only DevPod Pro started it, and it accepted any client without authentication and ran the shell as whichever user the client named.
• Unix socket forwards: a reverse forward (as GPG agent forwarding uses) only replaces a socket that nothing listens on and that belongs to the server's user (any user when the server runs as root), and is refused otherwise. Before, it deleted whatever was at the path, so concurrent sessions forwarding the same socket stole or removed each other's.
• Shared ssh-agent socket directory: /tmp/auth-agent-<id> must not be a symlink, must be owned by the server's user and must have mode 0700, and the socket is 0600. A session removes the directory only when it is empty.
• Forward cancellation: TCP and unix reverse forwards are tracked per connection, so one connection can't cancel another's.

Test plan

• Rebased onto main (after Embed the Linux agents in the CLI instead of downloading them #19); go build ./..., go vet ./..., cross-builds for windows/amd64 and linux/arm64
• go test ./pkg/... ./cmd/..., and -race on the changed packages
• golangci-lint v1.60.1 with the CI flags: clean
• New tests: SSH server hardening (each fix, also run on Linux as root and as a normal user), language detection, unix socket forwarding in both directions, the table renderer, ANSI colours and stripping
• Smoke test: devpod provider add/list/options and devpod list output looks as before
• Interactive prompts (huh select, input and password) were not tried in a real terminal
• e2e tests (CI)

🤖 Generated with Claude Code