@judaharagao/opencode-ssh 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Judah Aragao
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,184 @@
+# opencode-ssh
+
+SSH access plugin for OpenCode — secure remote command execution with command blocking and audit.
+
+## Features
+
+- 🔐 **SSH Session Management** — Connect to multiple remote servers simultaneously
+- ⚡ **Real-time Command Execution** — Execute commands with live output streaming
+- 🛡️ **Security-First Design** — Destructive commands blocked 100%, risky commands require approval every time
+- 📋 **Full Audit Trail** — Every command is logged with timestamps, results, and details
+- 🔒 **Three Security Modes** — Full, Restricted, or Read-Only
+- 📤 **File Transfer** — Upload and download files via SCP/SFTP
+- 🎯 **Command Safety Checker** — Preview command safety before execution
+- ⚙️ **Configurable Policies** — Add custom blocklist/allowlist patterns
+
+## Installation
+
+Add to your `opencode.json`:
+
+```json
+{
+  "plugin": ["@judaharagao/opencode-ssh"]
+}
+```
+
+Or with configuration:
+
+```json
+{
+  "plugin": [
+    ["@judaharagao/opencode-ssh", {
+      "mode": "full",
+      "max_sessions": 5,
+      "default_timeout": 30,
+      "audit_enabled": true
+    }]
+  ]
+}
+```
+
+## Configuration Options
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `mode` | `"full"` \| `"restricted"` \| `"read_only"` | `"full"` | Security mode for command execution |
+| `max_sessions` | number | `5` | Maximum concurrent SSH sessions |
+| `default_timeout` | number | `30` | Default command timeout in seconds |
+| `audit_enabled` | boolean | `true` | Enable audit logging |
+| `blocklist_extra` | string[] | `[]` | Additional regex patterns to block |
+| `allowlist` | string[] | `[]` | Additional allowed patterns (restricted mode) |
+
+## Security Modes
+
+### Full Mode
+All commands are allowed except those in the blocklist. Destructive commands are always blocked. Risky commands require approval.
+
+### Restricted Mode
+Only commands in the allowlist + read-only commands are allowed. Risky and destructive commands are blocked.
+
+### Read-Only Mode
+Only read-only commands (ls, cat, grep, docker ps, etc.) are allowed. No write operations.
+
+## Commands (Tools)
+
+### `ssh.connect`
+Establish an SSH connection to a remote server.
+
+```
+ssh.connect(host="192.168.1.100", username="admin", auth_method="key")
+```
+
+### `ssh.disconnect`
+Close an SSH session.
+
+```
+ssh.disconnect(session_id="ssh-abc123")
+```
+
+### `ssh.list_sessions`
+List all active SSH sessions.
+
+```
+ssh.list_sessions()
+```
+
+### `ssh.exec`
+Execute a command on a remote server.
+
+```
+ssh.exec(session_id="prod-server", command="docker ps -a")
+```
+
+### `ssh.exec_batch`
+Execute multiple commands in sequence.
+
+```
+ssh.exec_batch(session_id="prod-server", commands="cd /app\nls -la\ndocker ps")
+```
+
+### `ssh.upload`
+Upload a file via SCP.
+
+```
+ssh.upload(session_id="prod-server", local_path="./config.yml", remote_path="/app/config.yml")
+```
+
+### `ssh.download`
+Download a file via SCP.
+
+```
+ssh.download(session_id="prod-server", remote_path="/var/log/app.log", local_path="./app.log")
+```
+
+### `ssh.check_command`
+Check if a command is safe (dry-run).
+
+```
+ssh.check_command(command="rm -rf /tmp/cache")
+```
+
+### `ssh.security_policy`
+View or modify the security policy.
+
+```
+ssh.security_policy(action="view")
+ssh.security_policy(action="add_blocklist", pattern="custom-dangerous-.*")
+```
+
+### `ssh.audit_log`
+View the command audit trail.
+
+```
+ssh.audit_log(limit=20)
+ssh.audit_log(session_id="prod-server", command_filter="docker")
+```
+
+## Security
+
+### Destructive Commands (100% Blocked)
+These commands are **permanently blocked** with no exceptions:
+
+- `rm -rf /`, `rm -rf ~`, `rm -rf .*`
+- `mkfs`, `dd if=/dev/zero`
+- Fork bombs (`:(){:|:&};:`)
+- `chmod -R 777 /`, `chmod -R 000 /`
+- `shutdown`, `reboot`, `init 0/6`
+- `kill -9 1`, `killall`
+- `iptables -F`, `ufw disable`
+- `wget/curl | sh|bash`
+
+### Risky Commands (Approval Required Every Time)
+These commands require your explicit approval each time:
+
+- `DROP TABLE`, `DELETE FROM`, `TRUNCATE`
+- `sudo su`, `sudo -i`
+- `systemctl stop/disable`
+- `kill -9`, `kill -15`
+- `npm uninstall -g`, `apt remove/purge`
+- `userdel`, `groupdel`
+- `iptables -A/-D`
+
+### Credential Safety
+- Passwords and SSH keys are **never** stored in logs or output
+- Session info only contains host, username, and port
+- Credentials are held in memory only during the session
+- All sessions are destroyed when the plugin is disposed
+
+## Audit Log
+
+All commands are logged in `.opencode-ssh/audit.jsonl` with:
+
+- Timestamp
+- Session ID (host@user)
+- Command executed
+- Result (success/blocked/approved/error)
+- Exit code
+- Duration
+- Matched security rule (if any)
+
+View the audit log with `ssh.audit_log`.
+
+## License
+
+MIT

package/dist/config/defaults.d.ts

@@ -0,0 +1,11 @@
+import { type SshPluginConfigType } from "./schema.js";
+/**
+ * Get merged configuration with user overrides.
+ */
+export declare function resolveConfig(userConfig?: Record<string, unknown>): SshPluginConfigType;
+/**
+ * Get the SSH data directory path for a project.
+ * Stores sessions, audit logs, and policy files.
+ */
+export declare function getSshDataDir(projectDir: string): string;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/config/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtE;;GAEG;AACH,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB,CAYvF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/dist/config/defaults.js

@@ -0,0 +1,23 @@
+import { DEFAULT_CONFIG } from "./schema.js";
+/**
+ * Get merged configuration with user overrides.
+ */
+export function resolveConfig(userConfig) {
+    if (!userConfig)
+        return { ...DEFAULT_CONFIG };
+    const merged = { ...DEFAULT_CONFIG };
+    for (const [key, value] of Object.entries(userConfig)) {
+        if (value !== undefined && value !== null) {
+            merged[key] = value;
+        }
+    }
+    return merged;
+}
+/**
+ * Get the SSH data directory path for a project.
+ * Stores sessions, audit logs, and policy files.
+ */
+export function getSshDataDir(projectDir) {
+    return `${projectDir}/.opencode-ssh`;
+}
+//# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA4B,MAAM,aAAa,CAAA;AAEtE;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAAoC;IAChE,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAA;IAE7C,MAAM,MAAM,GAA4B,EAAE,GAAG,cAAc,EAAE,CAAA;IAE7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IAED,OAAO,MAA6B,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,GAAG,UAAU,gBAAgB,CAAA;AACtC,CAAC"}

package/dist/config/schema.d.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+/**
+ * Security mode for SSH command execution.
+ * - "full": All commands allowed except blocklist
+ * - "restricted": Only allowlist + read-only commands
+ * - "read_only": Only read-only commands (ls, cat, grep, etc.)
+ */
+export declare const SecurityMode: z.ZodEnum<["full", "restricted", "read_only"]>;
+export type SecurityMode = z.infer<typeof SecurityMode>;
+/**
+ * Configuration schema for the opencode-ssh plugin.
+ */
+export declare const SshPluginConfig: z.ZodObject<{
+    /** Security mode for command execution */
+    mode: z.ZodDefault<z.ZodEnum<["full", "restricted", "read_only"]>>;
+    /** Maximum concurrent SSH sessions */
+    max_sessions: z.ZodDefault<z.ZodNumber>;
+    /** Default command timeout in seconds */
+    default_timeout: z.ZodDefault<z.ZodNumber>;
+    /** Whether to enable audit logging */
+    audit_enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Additional command patterns to block (regex strings) */
+    blocklist_extra: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Additional command patterns to allow (used in restricted mode) */
+    allowlist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Path to SSH config file (~/.ssh/config) */
+    ssh_config_path: z.ZodOptional<z.ZodString>;
+    /** Auto-connect on plugin boot (requires saved session) */
+    auto_connect: z.ZodDefault<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    mode: "full" | "restricted" | "read_only";
+    max_sessions: number;
+    default_timeout: number;
+    audit_enabled: boolean;
+    blocklist_extra: string[];
+    allowlist: string[];
+    auto_connect: boolean;
+    ssh_config_path?: string | undefined;
+}, {
+    mode?: "full" | "restricted" | "read_only" | undefined;
+    max_sessions?: number | undefined;
+    default_timeout?: number | undefined;
+    audit_enabled?: boolean | undefined;
+    blocklist_extra?: string[] | undefined;
+    allowlist?: string[] | undefined;
+    ssh_config_path?: string | undefined;
+    auto_connect?: boolean | undefined;
+}>;
+export type SshPluginConfigType = z.infer<typeof SshPluginConfig>;
+export declare const DEFAULT_CONFIG: SshPluginConfigType;
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,eAAO,MAAM,YAAY,gDAA8C,CAAA;AACvE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,eAAe;IAExB,0CAA0C;;IAG1C,sCAAsC;;IAGtC,yCAAyC;;IAGzC,sCAAsC;;IAGtC,2DAA2D;;IAG3D,qEAAqE;;IAGrE,8CAA8C;;IAG9C,2DAA2D;;;;;;;;;;;;;;;;;;;;EAGpD,CAAA;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEjE,eAAO,MAAM,cAAc,EAAE,mBAQ5B,CAAA"}

package/dist/config/schema.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+/**
+ * Security mode for SSH command execution.
+ * - "full": All commands allowed except blocklist
+ * - "restricted": Only allowlist + read-only commands
+ * - "read_only": Only read-only commands (ls, cat, grep, etc.)
+ */
+export const SecurityMode = z.enum(["full", "restricted", "read_only"]);
+/**
+ * Configuration schema for the opencode-ssh plugin.
+ */
+export const SshPluginConfig = z
+    .object({
+    /** Security mode for command execution */
+    mode: SecurityMode.default("full"),
+    /** Maximum concurrent SSH sessions */
+    max_sessions: z.number().int().min(1).max(50).default(5),
+    /** Default command timeout in seconds */
+    default_timeout: z.number().int().min(1).max(600).default(30),
+    /** Whether to enable audit logging */
+    audit_enabled: z.boolean().default(true),
+    /** Additional command patterns to block (regex strings) */
+    blocklist_extra: z.array(z.string()).default([]),
+    /** Additional command patterns to allow (used in restricted mode) */
+    allowlist: z.array(z.string()).default([]),
+    /** Path to SSH config file (~/.ssh/config) */
+    ssh_config_path: z.string().optional(),
+    /** Auto-connect on plugin boot (requires saved session) */
+    auto_connect: z.boolean().default(false),
+})
+    .strict();
+export const DEFAULT_CONFIG = {
+    mode: "full",
+    max_sessions: 5,
+    default_timeout: 30,
+    audit_enabled: true,
+    blocklist_extra: [],
+    allowlist: [],
+    auto_connect: false,
+};
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAGvE;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,0CAA0C;IAC1C,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAElC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAExD,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,sCAAsC;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAExC,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhD,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1C,8CAA8C;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAA;AAIX,MAAM,CAAC,MAAM,cAAc,GAAwB;IACjD,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,CAAC;IACf,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,KAAK;CACpB,CAAA"}

package/dist/display/formatter.d.ts

@@ -0,0 +1,41 @@
+import type { ExecResult } from "../ssh/executor.js";
+import type { SshConnectionInfo } from "../ssh/connection.js";
+/**
+ * Format an SSH execution result for display in the terminal.
+ */
+export declare function formatExecResult(result: ExecResult): string;
+/**
+ * Format a session list for display.
+ */
+export declare function formatSessionList(sessions: SshConnectionInfo[]): string;
+/**
+ * Format a connection success message.
+ */
+export declare function formatConnectResult(sessionId: string, host: string, port: number, username: string, alias?: string): string;
+/**
+ * Format a disconnection message.
+ */
+export declare function formatDisconnectResult(sessionId: string): string;
+/**
+ * Format a blocked command message.
+ */
+export declare function formatBlockedCommand(command: string, reason: string, level: "destructive" | "risky"): string;
+/**
+ * Format a command check result (dry-run validation).
+ */
+export declare function formatCheckResult(command: string, validation: {
+    safe: boolean;
+    level: string;
+    reason?: string;
+    matched_rule?: string;
+}): string;
+/**
+ * Format a security policy for display.
+ */
+export declare function formatSecurityPolicy(policy: {
+    mode: string;
+    extraBlocklist: string[];
+    customAllowlist: string[];
+    updatedAt: string;
+}): string;
+//# sourceMappingURL=formatter.d.ts.map

package/dist/display/formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/display/formatter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAE7D;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA+C3D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAsBvE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAWR;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,GAAG,OAAO,GAC7B,MAAM,CAqBR;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACnF,MAAM,CAmBR;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAuCT"}

package/dist/display/formatter.js

@@ -0,0 +1,179 @@
+/**
+ * Format an SSH execution result for display in the terminal.
+ */
+export function formatExecResult(result) {
+    const lines = [];
+    // ── Header with session and command info ──
+    const durationStr = result.duration < 1000
+        ? `${result.duration}ms`
+        : `${(result.duration / 1000).toFixed(1)}s`;
+    const exitIcon = result.exitCode === 0 ? "✅" : "❌";
+    lines.push(`### SSH Execution [${result.sessionId}]`);
+    lines.push("");
+    // Command
+    lines.push(`**$ ${result.command}**`);
+    if (result.validation.level === "risky") {
+        lines.push(`⚠️ *Risky command — executed with user approval*`);
+    }
+    lines.push("");
+    // stdout
+    if (result.stdout) {
+        const trimmed = result.stdout.trim();
+        if (trimmed.length > 0) {
+            lines.push("**Output:**");
+            lines.push("```");
+            lines.push(trimmed);
+            lines.push("```");
+        }
+    }
+    // stderr
+    if (result.stderr) {
+        const trimmed = result.stderr.trim();
+        if (trimmed.length > 0) {
+            lines.push("**Errors:**");
+            lines.push("```");
+            lines.push(trimmed);
+            lines.push("```");
+        }
+    }
+    // Footer with exit code and duration
+    lines.push(`${exitIcon} Exit: ${result.exitCode ?? "?"} | Duration: ${durationStr}`);
+    return lines.join("\n");
+}
+/**
+ * Format a session list for display.
+ */
+export function formatSessionList(sessions) {
+    if (sessions.length === 0) {
+        return "📋 No active SSH sessions.";
+    }
+    const lines = [`## Active SSH Sessions (${sessions.length})\n`];
+    for (const session of sessions) {
+        const status = session.connected ? "🟢 Connected" : "🔴 Disconnected";
+        const alias = session.config.alias ? ` (${session.config.alias})` : "";
+        const uptime = session.connectedAt
+            ? formatUptime(new Date(session.connectedAt))
+            : "N/A";
+        lines.push(`- **${session.id}**${alias}: ${session.config.username}@${session.config.host}:${session.config.port} — ${status}`);
+        lines.push(`  Uptime: ${uptime} | Auth: ${session.config.authMethod}`);
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+/**
+ * Format a connection success message.
+ */
+export function formatConnectResult(sessionId, host, port, username, alias) {
+    const aliasStr = alias ? ` ("${alias}")` : "";
+    return [
+        `## SSH Connected${aliasStr}`,
+        "",
+        `- **Session:** \`${sessionId}\``,
+        `- **Host:** ${username}@${host}:${port}`,
+        `- **Status:** 🟢 Connected`,
+        "",
+        `Use \`ssh.exec\` with session_id=\`${sessionId}\` to run commands.`,
+    ].join("\n");
+}
+/**
+ * Format a disconnection message.
+ */
+export function formatDisconnectResult(sessionId) {
+    return `## SSH Disconnected\n\nSession \`${sessionId}\` has been closed.`;
+}
+/**
+ * Format a blocked command message.
+ */
+export function formatBlockedCommand(command, reason, level) {
+    if (level === "destructive") {
+        return [
+            "## 🚫 Command Blocked (Destructive)",
+            "",
+            `**Command:** \`${command}\``,
+            `**Reason:** ${reason}`,
+            "",
+            "This command is **permanently blocked** and cannot be overridden.",
+            "Destructive commands are blocked for your safety.",
+        ].join("\n");
+    }
+    return [
+        "## ⚠️ Command Requires Approval",
+        "",
+        `**Command:** \`${command}\``,
+        `**Reason:** ${reason}`,
+        "",
+        "This command has been classified as risky and requires your approval.",
+    ].join("\n");
+}
+/**
+ * Format a command check result (dry-run validation).
+ */
+export function formatCheckResult(command, validation) {
+    const icon = validation.safe ? "✅" : validation.level === "destructive" ? "🚫" : "⚠️";
+    const lines = [
+        `## Command Safety Check`,
+        "",
+        `**Command:** \`${command}\``,
+        `**Status:** ${icon} ${validation.safe ? "Safe" : validation.level === "destructive" ? "BLOCKED" : "Requires Approval"}`,
+    ];
+    if (validation.reason) {
+        lines.push(`**Reason:** ${validation.reason}`);
+    }
+    if (validation.matched_rule) {
+        lines.push(`**Rule:** ${validation.matched_rule}`);
+    }
+    return lines.join("\n");
+}
+/**
+ * Format a security policy for display.
+ */
+export function formatSecurityPolicy(policy) {
+    const lines = [
+        "## SSH Security Policy",
+        "",
+        `**Mode:** \`${policy.mode}\``,
+        `**Last Updated:** ${policy.updatedAt}`,
+        "",
+    ];
+    if (policy.extraBlocklist.length > 0) {
+        lines.push("### Extra Blocklist Patterns");
+        for (const p of policy.extraBlocklist) {
+            lines.push(`- \`${p}\``);
+        }
+        lines.push("");
+    }
+    if (policy.customAllowlist.length > 0) {
+        lines.push("### Custom Allowlist Patterns");
+        for (const p of policy.customAllowlist) {
+            lines.push(`- \`${p}\``);
+        }
+        lines.push("");
+    }
+    lines.push("### Mode Description");
+    switch (policy.mode) {
+        case "full":
+            lines.push("All commands allowed except those in the blocklist.");
+            break;
+        case "restricted":
+            lines.push("Only commands in the allowlist + read-only commands are allowed.");
+            break;
+        case "read_only":
+            lines.push("Only read-only commands are allowed (ls, cat, grep, etc.).");
+            break;
+    }
+    return lines.join("\n");
+}
+// ── Helpers ──
+function formatUptime(connectedAt) {
+    const now = Date.now();
+    const diff = now - connectedAt.getTime();
+    const seconds = Math.floor(diff / 1000);
+    const minutes = Math.floor(seconds / 60);
+    const hours = Math.floor(minutes / 60);
+    if (hours > 0)
+        return `${hours}h ${minutes % 60}m`;
+    if (minutes > 0)
+        return `${minutes}m ${seconds % 60}s`;
+    return `${seconds}s`;
+}
+//# sourceMappingURL=formatter.js.map

package/dist/display/formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/display/formatter.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,6CAA6C;IAC7C,MAAM,WAAW,GACf,MAAM,CAAC,QAAQ,GAAG,IAAI;QACpB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI;QACxB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;IAE/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IAElD,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAA;IACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,UAAU;IACV,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAA;IAChE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,SAAS;IACT,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,SAAS;IACT,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,UAAU,MAAM,CAAC,QAAQ,IAAI,GAAG,gBAAgB,WAAW,EAAE,CAAC,CAAA;IAEpF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA6B;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,4BAA4B,CAAA;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,2BAA2B,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAA;IAE/D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW;YAChC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC7C,CAAC,CAAC,KAAK,CAAA;QAET,KAAK,CAAC,IAAI,CACR,OAAO,OAAO,CAAC,EAAE,KAAK,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,MAAM,EAAE,CACpH,CAAA;QACD,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,YAAY,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;QACtE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,IAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,KAAc;IAEd,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7C,OAAO;QACL,mBAAmB,QAAQ,EAAE;QAC7B,EAAE;QACF,oBAAoB,SAAS,IAAI;QACjC,eAAe,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE;QACzC,4BAA4B;QAC5B,EAAE;QACF,sCAAsC,SAAS,qBAAqB;KACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,oCAAoC,SAAS,qBAAqB,CAAA;AAC3E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,MAAc,EACd,KAA8B;IAE9B,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,OAAO;YACL,qCAAqC;YACrC,EAAE;YACF,kBAAkB,OAAO,IAAI;YAC7B,eAAe,MAAM,EAAE;YACvB,EAAE;YACF,mEAAmE;YACnE,mDAAmD;SACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAED,OAAO;QACL,iCAAiC;QACjC,EAAE;QACF,kBAAkB,OAAO,IAAI;QAC7B,eAAe,MAAM,EAAE;QACvB,EAAE;QACF,uEAAuE;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,UAAoF;IAEpF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAErF,MAAM,KAAK,GAAG;QACZ,yBAAyB;QACzB,EAAE;QACF,kBAAkB,OAAO,IAAI;QAC7B,eAAe,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE;KACzH,CAAA;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAKpC;IACC,MAAM,KAAK,GAAG;QACZ,wBAAwB;QACxB,EAAE;QACF,eAAe,MAAM,CAAC,IAAI,IAAI;QAC9B,qBAAqB,MAAM,CAAC,SAAS,EAAE;QACvC,EAAE;KACH,CAAA;IAED,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAClC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;YACjE,MAAK;QACP,KAAK,YAAY;YACf,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAA;YAC9E,MAAK;QACP,KAAK,WAAW;YACd,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;YACxE,MAAK;IACT,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,gBAAgB;AAEhB,SAAS,YAAY,CAAC,WAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IAEtC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,GAAG,CAAA;IAClD,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,GAAG,CAAA;IACtD,OAAO,GAAG,OAAO,GAAG,CAAA;AACtB,CAAC"}

package/dist/display/stream.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Real-time SSH output stream handler.
+ * Formats and prepares output chunks for display as they arrive.
+ */
+export interface StreamChunk {
+    /** Type of output */
+    type: "stdout" | "stderr" | "info" | "error";
+    /** The data chunk */
+    data: string;
+    /** Timestamp */
+    timestamp: number;
+    /** Session identifier */
+    sessionId: string;
+}
+/**
+ * Create a stream handler that collects and formats output chunks.
+ */
+export declare function createStreamHandler(sessionId: string): {
+    chunks: StreamChunk[];
+    onStdout: (data: string) => void;
+    onStderr: (data: string) => void;
+    onInfo: (data: string) => void;
+    onError: (data: string) => void;
+    getOutput: () => {
+        stdout: string;
+        stderr: string;
+    };
+    formatOutput: () => string;
+};
+/**
+ * Format a progress indicator for long-running commands.
+ */
+export declare function formatProgress(sessionId: string, command: string, elapsed: number): string;
+/**
+ * Format a timeout warning.
+ */
+export declare function formatTimeout(sessionId: string, command: string, timeout: number): string;
+//# sourceMappingURL=stream.d.ts.map

package/dist/display/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/display/stream.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG;IACtD,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,SAAS,EAAE,MAAM;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,YAAY,EAAE,MAAM,MAAM,CAAA;CAC3B,CAgFA;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAO1F;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUzF"}