macOS: SSH ProxyCommand bypasses FIPS wrapper script, causing TLS cipher errors

[kacper1112]

The issue

On macOS, running ssh <host> with a p0-generated SSH config fails silently. Running the proxy command manually with --debug reveals:

TLS 1.2 context failed: error:0A0000A1:SSL routines::library has no ciphers

However, p0 ssh <host> works fine.

Root Cause

The macOS installer creates a wrapper script at /usr/local/bin/p0 that sets required FIPS environment variables before invoking the actual binary at /usr/local/lib/p0/p0:

#!/bin/bash
export OPENSSL_CONF="/usr/local/lib/p0/openssl.cnf"
export OPENSSL_MODULES="/usr/local/lib/p0/ossl-modules"
exec /usr/local/lib/p0/p0 "$@"

The problem is in src/util.ts:

export const getAppPath = () =>
  process.env.P0_APP_PATH ?? process.argv[1] ?? "p0";

When the wrapper runs, process.argv[1] resolves to /usr/local/lib/p0/p0 (the binary), not /usr/local/bin/p0 (the wrapper). This path is written into the SSH config's ProxyCommand, so when SSH invokes it directly, the FIPS environment variables are never set.

Affected Versions

v0.20.0+ (when FIPS support was introduced)

Workaround

Set P0_APP_PATH=/usr/local/bin/p0 in your shell before running p0 commands that generate SSH configs.

Suggested Fix

Either:

1. Have the wrapper script set P0_APP_PATH=/usr/local/bin/p0 before invoking the binary
2. Or detect the macOS installation and hardcode the wrapper path