meowshell agent: a persistent, multiplexed SSH daemon with general-host support

.github/workflows/ci.yml

@@ -28,7 +28,30 @@ jobs:
         with:
           go-version: stable
 
+      # cmd/meowshell's go.mod replaces github.com/tailscale/tailcat with a
+      # local ./.tailcat-src checkout (see tailcatdial.go's doc comment for
+      # why meowshell imports tailcat's own package at all: forwarding
+      # through a tailcat destination dials via tailcat.Client, the same
+      # way tailcat's own "forward"/"socks" subcommands do), so go vet/go
+      # test need that directory to exist before either can even resolve
+      # imports. A plain, unpatched clone is enough here: the two patches
+      # below only change Android-specific networking behavior, irrelevant
+      # to vetting/testing meowshell on this runner's own host platform.
+      # ./build.sh (further down) later reuses and patches this same
+      # checkout for the real cross-compiled build.
+      - name: Fetch tailcat source (for go.mod's replace directive)
+        env:
+          SRC_REF: ${{ inputs.tailcat_ref || 'main' }}
+        run: |
+          git clone --depth=1 https://github.com/tailscale/tailcat.git .tailcat-src
+          git -C .tailcat-src fetch --depth=1 origin "$SRC_REF"
+          git -C .tailcat-src checkout --detach FETCH_HEAD
+
       - name: Vet and test meowshell
+        env:
+          # tailcat's go.mod asks for a newer Go than setup-go's stable may
+          # be; let the toolchain fetch it rather than pinning a version here.
+          GOTOOLCHAIN: auto
         run: |
           go vet ./...
           go test ./...

README.md

@@ -33,7 +33,11 @@ wrapper around tailcat: an SFTP file service and forced-command sessions
 alongside the shell, a SOCKS5 proxy, TCP port forwarding, native interactive
 sessions and file transfer as a *client* too (no system `ssh`/`scp` needed,
 so this also works from inside an Android app), and one-shot operations for
-key management, address inspection, and connectivity checks. See
+key management, address inspection, and connectivity checks. A persistent
+`MeowshellAgentConnection` goes further still: one login multiplexing a
+shell, the full SFTP verb set, and port forwarding together, and the only
+one of these that also reaches a general (non-tailcat) SSH host, with real
+host-key verification and password/certificate/Keystore-backed auth. See
 [`dotnet/README.md`](dotnet/README.md) for the full surface, every option,
 and the one thing (a console-attached `ssh` client, as opposed to a
 programmatic session) an Android app sandbox can't run.