{"record":{"id":"67badf277af4e236","repo":"kovidgoyal/kitty","slug":"incorrect-password","errorCode":null,"errorMessage":"Incorrect password","messagePattern":"Incorrect password","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"kittens/ssh/utils.py","lineNumber":195,"sourceCode":"    # Unfortunately we cannot use EOF (\\x04) to flush the kernel line buffer\n    # because ssh with controlmasters mangles EOF replacing it with null bytes\n    from base64 import standard_b64decode\n\n    yield b'\\nKITTY_DATA_START\\n'  # to discard leading data\n    try:\n        msg = standard_b64decode(msgb).decode('utf-8')\n        md = dict(x.split('=', 1) for x in msg.split(':'))\n        pw = md['pw']\n        pwfilename = md['pwfile']\n        rq_id = md['id']\n    except Exception:\n        traceback.print_exc()\n        yield b'invalid ssh data request message\\n'\n    else:\n        try:\n            env_data = read_data_from_shared_memory(pwfilename)\n            if pw != env_data['pw']:\n                raise ValueError('Incorrect password')\n            if rq_id != request_id:\n                raise ValueError(f'Incorrect request id: {rq_id!r} expecting the KITTY_PID-KITTY_WINDOW_ID for the current kitty window')\n        except Exception as e:\n            traceback.print_exc()\n            import re\n\n            msg = re.sub(r'[^a-zA-Z0-9 ]+', '_', str(e))\n            yield f'{msg}\\n'.encode()\n        else:\n            yield b'OK\\n'\n            encoded_data = memoryview(env_data['tarfile'].encode('ascii'))\n            # macOS has a 255 byte limit on its input queue as per man stty.\n            # Not clear if that applies to canonical mode input as well, but\n            # better to be safe.\n            line_sz = 254\n            while encoded_data:\n                yield encoded_data[:line_sz]\n                yield b'\\n'","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/kovidgoyal/kitty/blob/6d5d0c440603ad9bdf6dcd599f73f6dde21acb44/kittens/ssh/utils.py#L177-L213","documentation":"Inside get_ssh_data(), after reading the password blob from shared memory, the 'pw' field of the request is compared against env_data['pw'] recorded by kitty. A mismatch raises ValueError('Incorrect password'). The exception is caught, its traceback printed, and a sanitized message is yielded to the requesting process, which typically makes the ssh kitten wrapper fail/close the connection.","triggerScenarios":"handle_remote_ssh() issues a data request whose pw value doesn't match what kitty stored in the shm pwfile: e.g. a request replayed from a previous session after the shm was recreated, a forged/handcrafted request message, or concurrent kitty sessions mixing up pwfiles. The message format is parsed (msgb) and pw/rq_id extracted before the comparison.","commonSituations":"Two kitty instances or windows racing over the same shm name; leftover state after kitty crashes/restarts while an ssh kitten session is mid-handshake; scripts trying to mimic the ssh kitten IPC protocol manually; memory corruption or truncated request buffers.","solutions":["Close and retry the ssh kitten session in a single, currently-running kitty instance (stale state is the usual cause).","Quit other kitty instances that may be reusing the same shm names, then retry.","If it's reproducible, check for a kitty bug: report with the printed traceback and kitty --version.","If writing your own client for the ssh kitten IPC, make sure you echo the exact pw sent in the request that created the pwfile."],"exampleFix":"// not a code-level error; remediation is environmental\nclose stale ssh kitten sessions; retry `kitten ssh host` in the live kitty window","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"# server side (get_ssh_data already does this):\ntry:\n    env_data = read_data_from_shared_memory(pwfilename)\n    if pw != env_data['pw']:\n        raise ValueError('Incorrect password')\nexcept Exception as e:\n    traceback.print_exc()\n    yield re.sub(r'[^a-zA-Z0-9 ]+', '_', str(e)).encode() + b'\\n'","preventionTips":["Use fresh kitten ssh sessions per kitty instance; don't replay recorded IPC requests.","Don't run concurrent ssh kitten handshakes reusing the same shm name.","Treat this error as an auth failure: log it, don't silently retry in a loop."],"tags":["kitty","ssh","password-mismatch","ipc","security"],"backgroundTag":"ipc-handshake-auth-failed","analyzedSha":"6d5d0c440603ad9bdf6dcd599f73f6dde21acb44","analyzedAt":"2026-08-27T14:20:20.142Z","schemaVersion":2},"datasetVersion":"2026-08-27T19:17:21.184Z"}