菜单
Use when sharing a single `~/.ssh/config` across macOS + Linux - apply OpenSSH `IgnoreUnknown` to tolerate macOS-only directives (`UseKeychain`, `AddKeysToAgent`) on Linux where they would otherwise be fatal.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
| name | ssh-ignoreunknown-cross-platform |
| description | Use when sharing a single `~/.ssh/config` across macOS + Linux - apply OpenSSH `IgnoreUnknown` to tolerate macOS-only directives (`UseKeychain`, `AddKeysToAgent`) on Linux where they would otherwise be fatal. |
| type | learned-skill |
| extracted-from | session 2026-04-07e (devcontainer ssh debugging) |
| applicability | any time the host ~/.ssh/config is bind-mounted into a Linux container, or shared across platforms via dotfiles |
You bind-mount the host ~/.ssh/config into a Linux container. The
host ~/.ssh/config contains macOS-only directives:
Host github.com
AddKeysToAgent yes
UseKeychain yes # macOS-only
IdentityFile ~/.ssh/id_ed25519
Inside the Linux container, OpenSSH parses the file at startup and exits fatally:
/home/user/.ssh/config: line 14: Bad configuration option: usekeychain
/home/user/.ssh/config: terminating, 1 bad configuration options
The container can't ssh anywhere because the config never finishes parsing.
Editing the host ~/.ssh/config to remove UseKeychain — breaks the
macOS host's keychain integration.
Editing the container copy — can't, it's a readonly bind mount.
Maintaining two separate config files — drift between platforms, chezmoi or similar templating overhead.
IgnoreUnknownOpenSSH has a built-in directive for exactly this case:
IgnoreUnknown <pattern>. Any subsequent directive matching the
pattern is silently ignored instead of being a fatal parse error.
The directive must appear before the unknown options it covers,
since it only affects subsequent parses. The cleanest delivery is via
-o on the command line, which has the highest precedence and runs
before any file is read:
ssh -o "IgnoreUnknown=UseKeychain,AddKeysToAgent" -T git@github.com
On macOS, UseKeychain and AddKeysToAgent continue to work normally
(IgnoreUnknown doesn't disable known options, it only swallows unknown
ones). On Linux, they're silently dropped and ssh proceeds.
If you control the config file, you can prepend:
# Top of ~/.ssh/config — must come before any Host block
IgnoreUnknown UseKeychain,AddKeysToAgent
Host github.com
AddKeysToAgent yes
UseKeychain yes
IdentityFile ~/.ssh/id_ed25519
This keeps the file portable across platforms with zero per-host templating.
This is a special case of the "use the tool's built-in mechanism
before inventing custom logic" principle from
feedback_use_tool_builtins.md and .claude/rules/use-tool-builtins.md.
Before reaching for chezmoi templating, conditional file generation,
or platform-specific bind mounts, check if the tool has a built-in
escape hatch. OpenSSH has had IgnoreUnknown since version 4.4 (2006).
# Should exit 0 on both Linux and macOS
ssh -o "IgnoreUnknown=UseKeychain,AddKeysToAgent" -F ~/.ssh/config -G github.com >/dev/null && echo OK
-G (config dump) parses the file without connecting — fastest way
to verify the config is no longer fatal.
.agent/wiki/devcontainer-ssh-canonical-pattern.mdfeedback_use_tool_builtins.md (project memory)man ssh_config → IgnoreUnknownPrepare for a /clear: bring all documentation up to date with this session's changes, persist recovery context (memory + handoff), and emit a copy-paste resume prompt so the next session begins the next task with zero context loss. Invoke explicitly as /clear-prep [next-task].
Use when adding or modifying a devcontainer feature in devcontainer.json - fetch its devcontainer-feature.json schema first and verify every option key exists, because features silently drop unknown options.
Use when creating branches, commits, pushes, or PRs with plain git. Branch BEFORE committing — never commit directly onto the default branch. Avoids virtual-branch composition bugs where commits silently depend on other applied branches.
Write a CROSS-SURFACE session handoff to a tracked path and push it, so a session on another surface (web, desktop, or CLI) can continue with zero context loss. Use when ending a session whose work must be picked up on a DIFFERENT machine/surface. For same-machine /clear continuity use /clear-prep instead. Invoke as /handoff [next-task].
Use when running parallel-scientist research - ALWAYS follow with an opus verification stage that re-probes load-bearing claims and surfaces gaps. Skipping the verifier almost shipped a wrong recommendation in session 2026-04-07e.
Use when auditing whether the repo's pinned tools are current AND whether any hand-rolled custom code is now superseded by a native tool feature. Produces a retire/bump report from mise outdated + pkl/pin-vs-latest diff + a cache-first release-note scan.
基于 SOC 职业分类
