wish-ssh-code-review

Security code review for Wish SSH servers focuses on host key management, middleware ordering, session handling, and PTY configuration. This Skill analyzes those components to verify they follow security best practices and functional requirements for authentication, authorization, and graceful shutdown.

Middleware order matters for security: logging, authentication, and timeout enforcement must be sequenced correctly. This Skill validates that your middleware configuration ensures proper per-connection session context, applies timeouts consistently, and doesn't bypass security checks.

Secure session handling requires per-connection state isolation, idle and max timeouts, proper PTY allocation, and clean shutdown of active connections. This Skill verifies these mechanisms work together to prevent session leaks and enforce connection limits.

Host keys must be loaded and persisted securely without exposure. This Skill checks that your implementation handles key lifecycle correctly, integrates properly with BubbleTea and charmbracelet/wish, and meets authentication and authorization defaults.

Yes. This Skill is designed specifically for Wish SSH servers built with charmbracelet/wish and BubbleTea integration. It validates middleware, session context, and graceful shutdown patterns that apply to terminal UI SSH implementations.

Graceful shutdown must cleanly close active sessions without data loss or orphaned connections. This Skill confirms your shutdown logic properly drains in-flight requests, respects timeouts, and releases resources before terminating.