@judaharagao/opencode-ssh 1.0.0

package/dist/ssh/executor.d.ts

@@ -0,0 +1,49 @@
+import type { SshConnection } from "./connection.js";
+import { type ValidationResult } from "../security/validator.js";
+import type { SecurityMode } from "../config/schema.js";
+export interface ExecOptions {
+    cwd?: string;
+    timeout?: number;
+    sudo?: boolean;
+}
+export interface ExecResult {
+    /** Command that was executed */
+    command: string;
+    /** Standard output */
+    stdout: string;
+    /** Standard error output */
+    stderr: string;
+    /** Exit code */
+    exitCode: number | null;
+    /** Signal that killed the process (if any) */
+    signal?: string;
+    /** Duration in milliseconds */
+    duration: number;
+    /** Session ID */
+    sessionId: string;
+    /** Validation result */
+    validation: ValidationResult;
+}
+export interface ExecStreamCallbacks {
+    onStdout?: (data: string) => void;
+    onStderr?: (data: string) => void;
+    onExit?: (code: number | null) => void;
+    onError?: (error: Error) => void;
+}
+/**
+ * Execute a command on an SSH connection with security validation.
+ *
+ * This is the main execution function that:
+ * 1. Validates the command against the security policy
+ * 2. Sanitizes the input
+ * 3. Executes the command
+ * 4. Logs the result to audit
+ * 5. Returns structured output
+ */
+export declare function executeCommand(connection: SshConnection, command: string, mode: SecurityMode, extraBlocklist: string[], sessionId: string, options?: ExecOptions, projectDir?: string): Promise<ExecResult>;
+/**
+ * Execute a command with real-time streaming output.
+ * Calls the callbacks as data arrives.
+ */
+export declare function executeCommandStream(connection: SshConnection, command: string, mode: SecurityMode, extraBlocklist: string[], sessionId: string, options?: ExecOptions, projectDir?: string, callbacks?: ExecStreamCallbacks): Promise<ExecResult>;
+//# sourceMappingURL=executor.d.ts.map

package/dist/ssh/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/ssh/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB;IACxB,UAAU,EAAE,gBAAgB,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAA;IACtC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAClB,cAAc,EAAE,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,WAAgB,EACzB,UAAU,GAAE,MAAW,GACtB,OAAO,CAAC,UAAU,CAAC,CAgKrB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAClB,cAAc,EAAE,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,WAAgB,EACzB,UAAU,GAAE,MAAW,EACvB,SAAS,GAAE,mBAAwB,GAClC,OAAO,CAAC,UAAU,CAAC,CA4HrB"}

package/dist/ssh/executor.js

@@ -0,0 +1,275 @@
+import { validateCommand } from "../security/validator.js";
+import { sanitizeCommand } from "./sanitizer.js";
+import { logCommand } from "./audit.js";
+/**
+ * Execute a command on an SSH connection with security validation.
+ *
+ * This is the main execution function that:
+ * 1. Validates the command against the security policy
+ * 2. Sanitizes the input
+ * 3. Executes the command
+ * 4. Logs the result to audit
+ * 5. Returns structured output
+ */
+export async function executeCommand(connection, command, mode, extraBlocklist, sessionId, options = {}, projectDir = "") {
+    const startTime = Date.now();
+    // ── Step 1: Input sanitization ──
+    const sanitization = sanitizeCommand(command);
+    if (!sanitization.clean) {
+        const result = {
+            command,
+            stdout: "",
+            stderr: sanitization.reason || "Command rejected by sanitizer",
+            exitCode: 1,
+            duration: Date.now() - startTime,
+            sessionId,
+            validation: {
+                safe: false,
+                level: "destructive",
+                reason: sanitization.reason,
+            },
+        };
+        // Log to audit
+        if (projectDir) {
+            logCommand(projectDir, {
+                sessionId,
+                command,
+                result: "blocked",
+                exitCode: 1,
+                duration: result.duration,
+                reason: sanitization.reason,
+            });
+        }
+        return result;
+    }
+    // ── Step 2: Security validation ──
+    const validation = validateCommand(command, mode, extraBlocklist);
+    // Destructive: ALWAYS blocked, no exception
+    if (validation.level === "destructive") {
+        const result = {
+            command,
+            stdout: "",
+            stderr: validation.reason || "Command is destructively blocked",
+            exitCode: 1,
+            duration: Date.now() - startTime,
+            sessionId,
+            validation,
+        };
+        if (projectDir) {
+            logCommand(projectDir, {
+                sessionId,
+                command,
+                result: "blocked",
+                exitCode: 1,
+                duration: result.duration,
+                reason: validation.reason,
+                matchedRule: validation.matched_rule,
+            });
+        }
+        return result;
+    }
+    // Risky: The tool.ts caller handles the permission prompt via ctx.ask()
+    // If we reach here, the permission was already granted by the hook system.
+    // We just log that it was a risky command that was approved.
+    // Not in allowlist: blocked in restricted/read_only mode
+    if (validation.level === "not_in_allowlist") {
+        const result = {
+            command,
+            stdout: "",
+            stderr: validation.reason || "Command not in allowlist",
+            exitCode: 1,
+            duration: Date.now() - startTime,
+            sessionId,
+            validation,
+        };
+        if (projectDir) {
+            logCommand(projectDir, {
+                sessionId,
+                command,
+                result: "blocked",
+                exitCode: 1,
+                duration: result.duration,
+                reason: validation.reason,
+            });
+        }
+        return result;
+    }
+    // ── Step 3: Prepare command ──
+    let execCommand = command;
+    if (options.sudo) {
+        execCommand = `sudo ${command}`;
+    }
+    // ── Step 4: Execute ──
+    try {
+        const execResult = await connection.exec(execCommand, {
+            cwd: options.cwd,
+            timeout: options.timeout,
+        });
+        const duration = Date.now() - startTime;
+        const result = {
+            command: execCommand,
+            stdout: execResult.stdout,
+            stderr: execResult.stderr,
+            exitCode: execResult.code,
+            signal: execResult.signal,
+            duration,
+            sessionId,
+            validation,
+        };
+        // ── Step 5: Audit log ──
+        if (projectDir) {
+            logCommand(projectDir, {
+                sessionId,
+                command: execCommand,
+                result: validation.level === "risky" ? "approved" : "success",
+                exitCode: execResult.code ?? 1,
+                duration,
+                matchedRule: validation.matched_rule,
+            });
+        }
+        return result;
+    }
+    catch (error) {
+        const duration = Date.now() - startTime;
+        const errMsg = error instanceof Error ? error.message : String(error);
+        const result = {
+            command: execCommand,
+            stdout: "",
+            stderr: errMsg,
+            exitCode: 1,
+            duration,
+            sessionId,
+            validation,
+        };
+        if (projectDir) {
+            logCommand(projectDir, {
+                sessionId,
+                command: execCommand,
+                result: "error",
+                exitCode: 1,
+                duration,
+                reason: errMsg,
+            });
+        }
+        return result;
+    }
+}
+/**
+ * Execute a command with real-time streaming output.
+ * Calls the callbacks as data arrives.
+ */
+export async function executeCommandStream(connection, command, mode, extraBlocklist, sessionId, options = {}, projectDir = "", callbacks = {}) {
+    const startTime = Date.now();
+    // ── Step 1 & 2: Validate and sanitize (same as non-streaming) ──
+    const sanitization = sanitizeCommand(command);
+    if (!sanitization.clean) {
+        callbacks.onError?.(new Error(sanitization.reason));
+        return {
+            command,
+            stdout: "",
+            stderr: sanitization.reason || "Command rejected",
+            exitCode: 1,
+            duration: Date.now() - startTime,
+            sessionId,
+            validation: {
+                safe: false,
+                level: "destructive",
+                reason: sanitization.reason,
+            },
+        };
+    }
+    const validation = validateCommand(command, mode, extraBlocklist);
+    if (validation.level === "destructive") {
+        callbacks.onError?.(new Error(validation.reason));
+        return {
+            command,
+            stdout: "",
+            stderr: validation.reason || "Command blocked",
+            exitCode: 1,
+            duration: Date.now() - startTime,
+            sessionId,
+            validation,
+        };
+    }
+    if (validation.level === "not_in_allowlist") {
+        callbacks.onError?.(new Error(validation.reason));
+        return {
+            command,
+            stdout: "",
+            stderr: validation.reason || "Not in allowlist",
+            exitCode: 1,
+            duration: Date.now() - startTime,
+            sessionId,
+            validation,
+        };
+    }
+    // ── Step 3: Execute with streaming ──
+    let execCommand = command;
+    if (options.sudo) {
+        execCommand = `sudo ${command}`;
+    }
+    try {
+        // Use the exec method which returns stdout/stderr
+        // For true streaming, we'd need access to the raw ssh2 stream
+        // This implementation collects output and calls callbacks
+        const execResult = await connection.exec(execCommand, {
+            cwd: options.cwd,
+            timeout: options.timeout,
+        });
+        // Simulate streaming by calling callbacks with the collected output
+        if (execResult.stdout) {
+            callbacks.onStdout?.(execResult.stdout);
+        }
+        if (execResult.stderr) {
+            callbacks.onStderr?.(execResult.stderr);
+        }
+        callbacks.onExit?.(execResult.code);
+        const duration = Date.now() - startTime;
+        if (projectDir) {
+            logCommand(projectDir, {
+                sessionId,
+                command: execCommand,
+                result: validation.level === "risky" ? "approved" : "success",
+                exitCode: execResult.code ?? 1,
+                duration,
+                matchedRule: validation.matched_rule,
+            });
+        }
+        return {
+            command: execCommand,
+            stdout: execResult.stdout,
+            stderr: execResult.stderr,
+            exitCode: execResult.code,
+            signal: execResult.signal,
+            duration,
+            sessionId,
+            validation,
+        };
+    }
+    catch (error) {
+        const duration = Date.now() - startTime;
+        const errMsg = error instanceof Error ? error.message : String(error);
+        callbacks.onError?.(error instanceof Error ? error : new Error(errMsg));
+        callbacks.onExit?.(1);
+        if (projectDir) {
+            logCommand(projectDir, {
+                sessionId,
+                command: execCommand,
+                result: "error",
+                exitCode: 1,
+                duration,
+                reason: errMsg,
+            });
+        }
+        return {
+            command: execCommand,
+            stdout: "",
+            stderr: errMsg,
+            exitCode: 1,
+            duration,
+            sessionId,
+            validation,
+        };
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/ssh/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../src/ssh/executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAyB,MAAM,0BAA0B,CAAA;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAmB,MAAM,YAAY,CAAA;AAmCxD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAyB,EACzB,OAAe,EACf,IAAkB,EAClB,cAAwB,EACxB,SAAiB,EACjB,UAAuB,EAAE,EACzB,aAAqB,EAAE;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAE5B,mCAAmC;IACnC,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,GAAe;YACzB,OAAO;YACP,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,+BAA+B;YAC9D,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,SAAS;YACT,UAAU,EAAE;gBACV,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B;SACF,CAAA;QAED,eAAe;QACf,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,UAAU,EAAE;gBACrB,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;IAEjE,4CAA4C;IAC5C,IAAI,UAAU,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACvC,MAAM,MAAM,GAAe;YACzB,OAAO;YACP,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,kCAAkC;YAC/D,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,SAAS;YACT,UAAU;SACX,CAAA;QAED,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,UAAU,EAAE;gBACrB,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,UAAU,CAAC,YAAY;aACrC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,6DAA6D;IAE7D,yDAAyD;IACzD,IAAI,UAAU,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAe;YACzB,OAAO;YACP,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,0BAA0B;YACvD,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,SAAS;YACT,UAAU;SACX,CAAA;QAED,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,UAAU,EAAE;gBACrB,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gCAAgC;IAChC,IAAI,WAAW,GAAG,OAAO,CAAA;IACzB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,WAAW,GAAG,QAAQ,OAAO,EAAE,CAAA;IACjC,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE;YACpD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;QACvC,MAAM,MAAM,GAAe;YACzB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,UAAU,CAAC,IAAI;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ;YACR,SAAS;YACT,UAAU;SACX,CAAA;QAED,0BAA0B;QAC1B,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,UAAU,EAAE;gBACrB,SAAS;gBACT,OAAO,EAAE,WAAW;gBACpB,MAAM,EAAE,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBAC7D,QAAQ,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC;gBAC9B,QAAQ;gBACR,WAAW,EAAE,UAAU,CAAC,YAAY;aACrC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;QACvC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErE,MAAM,MAAM,GAAe;YACzB,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,CAAC;YACX,QAAQ;YACR,SAAS;YACT,UAAU;SACX,CAAA;QAED,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,UAAU,EAAE;gBACrB,SAAS;gBACT,OAAO,EAAE,WAAW;gBACpB,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,CAAC;gBACX,QAAQ;gBACR,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAyB,EACzB,OAAe,EACf,IAAkB,EAClB,cAAwB,EACxB,SAAiB,EACjB,UAAuB,EAAE,EACzB,aAAqB,EAAE,EACvB,YAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAE5B,kEAAkE;IAClE,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;QACnD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,kBAAkB;YACjD,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,SAAS;YACT,UAAU,EAAE;gBACV,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B;SACF,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;IAEjE,IAAI,UAAU,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACvC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QACjD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,iBAAiB;YAC9C,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,SAAS;YACT,UAAU;SACX,CAAA;IACH,CAAC;IAED,IAAI,UAAU,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;QAC5C,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QACjD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,kBAAkB;YAC/C,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,SAAS;YACT,UAAU;SACX,CAAA;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,WAAW,GAAG,OAAO,CAAA;IACzB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,WAAW,GAAG,QAAQ,OAAO,EAAE,CAAA;IACjC,CAAC;IAED,IAAI,CAAC;QACH,kDAAkD;QAClD,8DAA8D;QAC9D,0DAA0D;QAC1D,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE;YACpD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;QAEF,oEAAoE;QACpE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,SAAS,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,SAAS,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;QAEvC,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,UAAU,EAAE;gBACrB,SAAS;gBACT,OAAO,EAAE,WAAW;gBACpB,MAAM,EAAE,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBAC7D,QAAQ,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC;gBAC9B,QAAQ;gBACR,WAAW,EAAE,UAAU,CAAC,YAAY;aACrC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,UAAU,CAAC,IAAI;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ;YACR,SAAS;YACT,UAAU;SACX,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;QACvC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACrE,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;QAErB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,UAAU,EAAE;gBACrB,SAAS;gBACT,OAAO,EAAE,WAAW;gBACpB,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,CAAC;gBACX,QAAQ;gBACR,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,CAAC;YACX,QAAQ;YACR,SAAS;YACT,UAAU;SACX,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/ssh/manager.d.ts

@@ -0,0 +1,43 @@
+import { SshConnection, type SshConnectionConfig, type SshConnectionInfo } from "./connection.js";
+export interface SessionManagerOptions {
+    maxSessions: number;
+}
+export declare class SshSessionManager {
+    private sessions;
+    private aliases;
+    private options;
+    constructor(options?: SessionManagerOptions);
+    /**
+     * Create a new SSH session.
+     */
+    createSession(config: SshConnectionConfig): Promise<string>;
+    /**
+     * Get a session by ID or alias.
+     */
+    getSession(identifier: string): SshConnection | undefined;
+    /**
+     * Close a session by ID.
+     */
+    closeSession(id: string): Promise<boolean>;
+    /**
+     * Close all sessions.
+     */
+    closeAll(): Promise<void>;
+    /**
+     * List all active sessions.
+     */
+    listSessions(): SshConnectionInfo[];
+    /**
+     * Get the count of active sessions.
+     */
+    get sessionCount(): number;
+    /**
+     * Check if a session exists.
+     */
+    hasSession(id: string): boolean;
+    /**
+     * Generate a unique session ID.
+     */
+    private generateId;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/ssh/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/ssh/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAGjG,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,OAAO,CAAuB;gBAE1B,OAAO,GAAE,qBAA0C;IAI/D;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBjE;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAczD;;OAEG;IACG,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAehD;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAM/B;;OAEG;IACH,YAAY,IAAI,iBAAiB,EAAE;IAQnC;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI/B;;OAEG;IACH,OAAO,CAAC,UAAU;CAGnB"}

package/dist/ssh/manager.js

@@ -0,0 +1,98 @@
+import { SshConnection } from "./connection.js";
+import { randomBytes } from "crypto";
+export class SshSessionManager {
+    sessions = new Map();
+    aliases = new Map(); // alias → session id
+    options;
+    constructor(options = { maxSessions: 5 }) {
+        this.options = options;
+    }
+    /**
+     * Create a new SSH session.
+     */
+    async createSession(config) {
+        // Check max sessions limit
+        if (this.sessions.size >= this.options.maxSessions) {
+            // Close the oldest session
+            const oldestId = this.sessions.keys().next().value;
+            if (oldestId) {
+                await this.closeSession(oldestId);
+            }
+        }
+        const id = this.generateId();
+        const connection = new SshConnection(id, config);
+        await connection.connect();
+        this.sessions.set(id, connection);
+        if (config.alias) {
+            this.aliases.set(config.alias.toLowerCase(), id);
+        }
+        return id;
+    }
+    /**
+     * Get a session by ID or alias.
+     */
+    getSession(identifier) {
+        // Try direct ID first
+        const byId = this.sessions.get(identifier);
+        if (byId)
+            return byId;
+        // Try alias
+        const aliasId = this.aliases.get(identifier.toLowerCase());
+        if (aliasId) {
+            return this.sessions.get(aliasId);
+        }
+        return undefined;
+    }
+    /**
+     * Close a session by ID.
+     */
+    async closeSession(id) {
+        const connection = this.sessions.get(id);
+        if (!connection)
+            return false;
+        connection.disconnect();
+        // Remove alias if exists
+        if (connection.config.alias) {
+            this.aliases.delete(connection.config.alias.toLowerCase());
+        }
+        this.sessions.delete(id);
+        return true;
+    }
+    /**
+     * Close all sessions.
+     */
+    async closeAll() {
+        for (const [id] of this.sessions) {
+            await this.closeSession(id);
+        }
+    }
+    /**
+     * List all active sessions.
+     */
+    listSessions() {
+        const list = [];
+        for (const connection of this.sessions.values()) {
+            list.push(connection.getInfo());
+        }
+        return list;
+    }
+    /**
+     * Get the count of active sessions.
+     */
+    get sessionCount() {
+        return this.sessions.size;
+    }
+    /**
+     * Check if a session exists.
+     */
+    hasSession(id) {
+        return this.getSession(id) !== undefined;
+    }
+    /**
+     * Generate a unique session ID.
+     */
+    generateId() {
+        return `ssh-${randomBytes(8).toString("hex")}`;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/ssh/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/ssh/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoD,MAAM,iBAAiB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAMpC,MAAM,OAAO,iBAAiB;IACpB,QAAQ,GAA+B,IAAI,GAAG,EAAE,CAAA;IAChD,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAA,CAAC,qBAAqB;IAC9D,OAAO,CAAuB;IAEtC,YAAY,UAAiC,EAAE,WAAW,EAAE,CAAC,EAAE;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,MAA2B;QAC7C,2BAA2B;QAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACnD,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC5B,MAAM,UAAU,GAAG,IAAI,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAEhD,MAAM,UAAU,CAAC,OAAO,EAAE,CAAA;QAE1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAEjC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QAClD,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,UAAkB;QAC3B,sBAAsB;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAErB,YAAY;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,EAAU;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAA;QAE7B,UAAU,CAAC,UAAU,EAAE,CAAA;QAEvB,yBAAyB;QACzB,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAC5D,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,MAAM,IAAI,GAAwB,EAAE,CAAA;QACpC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,SAAS,CAAA;IAC1C,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAChD,CAAC;CACF"}

package/dist/ssh/sanitizer.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Input sanitizer for SSH commands.
+ * Prevents command injection, special character attacks, and encoding tricks.
+ */
+/**
+ * Sanitize a command string before execution.
+ *
+ * This does NOT change the command - it detects and rejects
+ * commands that contain injection attempts.
+ */
+export declare function sanitizeCommand(command: string): {
+    clean: boolean;
+    reason?: string;
+};
+/**
+ * Sanitize a hostname string.
+ */
+export declare function sanitizeHost(host: string): {
+    clean: boolean;
+    reason?: string;
+};
+/**
+ * Sanitize a username string.
+ */
+export declare function sanitizeUsername(username: string): {
+    clean: boolean;
+    reason?: string;
+};
+/**
+ * Sanitize a file path for SCP operations.
+ */
+export declare function sanitizePath(filePath: string): {
+    clean: boolean;
+    reason?: string;
+};
+/**
+ * Escape a string for safe use in shell commands.
+ * Useful when building compound commands.
+ */
+export declare function escapeShellArg(arg: string): string;
+//# sourceMappingURL=sanitizer.d.ts.map

package/dist/ssh/sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../src/ssh/sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BpF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB9E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAetF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAmBlF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGlD"}

package/dist/ssh/sanitizer.js

@@ -0,0 +1,108 @@
+/**
+ * Input sanitizer for SSH commands.
+ * Prevents command injection, special character attacks, and encoding tricks.
+ */
+/**
+ * Dangerous characters/sequences that could be used for injection.
+ */
+const INJECTION_PATTERNS = [
+    // Null byte injection
+    /\x00/,
+    // Command chaining via backticks (when not already in a string context)
+    /`[^`]*`/,
+    // ANSI escape sequences (terminal injection)
+    /\x1b\[[0-9;]*[a-zA-Z]/,
+    // Unicode direction override characters (bidirectional attacks)
+    /[\u202a-\u202e\u2066-\u2069]/,
+    // Unicode homoglyphs for common ASCII (basic detection)
+    // These are often used for visual spoofing
+];
+/**
+ * Sanitize a command string before execution.
+ *
+ * This does NOT change the command - it detects and rejects
+ * commands that contain injection attempts.
+ */
+export function sanitizeCommand(command) {
+    if (!command || command.trim().length === 0) {
+        return { clean: false, reason: "Empty command" };
+    }
+    // Check for null bytes
+    if (command.includes("\x00")) {
+        return { clean: false, reason: "Command contains null bytes (possible injection)" };
+    }
+    // Check for ANSI escape sequences
+    if (/\x1b\[[0-9;]*[a-zA-Z]/.test(command)) {
+        return { clean: false, reason: "Command contains ANSI escape sequences (terminal injection attempt)" };
+    }
+    // Check for Unicode direction overrides
+    if (/[\u202a-\u202e\u2066-\u2069]/.test(command)) {
+        return { clean: false, reason: "Command contains Unicode direction override characters (BIDI attack attempt)" };
+    }
+    // Check for extremely long commands (possible buffer overflow attempt)
+    if (command.length > 10000) {
+        return { clean: false, reason: "Command exceeds maximum length (10,000 chars)" };
+    }
+    return { clean: true };
+}
+/**
+ * Sanitize a hostname string.
+ */
+export function sanitizeHost(host) {
+    if (!host || host.trim().length === 0) {
+        return { clean: false, reason: "Empty hostname" };
+    }
+    // Hostnames should only contain alphanumeric, hyphens, dots, and colons (for IPv6)
+    if (!/^[a-zA-Z0-9.\-:\[\]]+$/.test(host)) {
+        return { clean: false, reason: "Hostname contains invalid characters" };
+    }
+    // Basic length check
+    if (host.length > 253) {
+        return { clean: false, reason: "Hostname exceeds maximum length" };
+    }
+    return { clean: true };
+}
+/**
+ * Sanitize a username string.
+ */
+export function sanitizeUsername(username) {
+    if (!username || username.trim().length === 0) {
+        return { clean: false, reason: "Empty username" };
+    }
+    // Unix usernames typically: lowercase, digits, hyphens, underscores
+    if (!/^[a-zA-Z0-9._\-]+$/.test(username)) {
+        return { clean: false, reason: "Username contains invalid characters" };
+    }
+    if (username.length > 32) {
+        return { clean: false, reason: "Username exceeds maximum length" };
+    }
+    return { clean: true };
+}
+/**
+ * Sanitize a file path for SCP operations.
+ */
+export function sanitizePath(filePath) {
+    if (!filePath || filePath.trim().length === 0) {
+        return { clean: false, reason: "Empty file path" };
+    }
+    // Check for null bytes
+    if (filePath.includes("\x00")) {
+        return { clean: false, reason: "Path contains null bytes" };
+    }
+    // Check for command substitution in paths
+    if (/[`$()]/.test(filePath)) {
+        return { clean: false, reason: "Path contains shell metacharacters (possible injection)" };
+    }
+    // Path traversal is allowed (user might need to navigate), but log it
+    // The blocklist will catch dangerous operations anyway
+    return { clean: true };
+}
+/**
+ * Escape a string for safe use in shell commands.
+ * Useful when building compound commands.
+ */
+export function escapeShellArg(arg) {
+    // Wrap in single quotes, escaping any single quotes within
+    return "'" + arg.replace(/'/g, "'\\''") + "'";
+}
+//# sourceMappingURL=sanitizer.js.map

package/dist/ssh/sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../src/ssh/sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,sBAAsB;IACtB,MAAM;IACN,wEAAwE;IACxE,SAAS;IACT,6CAA6C;IAC7C,uBAAuB;IACvB,gEAAgE;IAChE,8BAA8B;IAC9B,wDAAwD;IACxD,2CAA2C;CAC5C,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAClD,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAA;IACrF,CAAC;IAED,kCAAkC;IAClC,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAA;IACxG,CAAC;IAED,wCAAwC;IACxC,IAAI,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAA;IACjH,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAA;IAClF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IACnD,CAAC;IAED,mFAAmF;IACnF,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;IACzE,CAAC;IAED,qBAAqB;IACrB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;IACpE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IACnD,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;IACzE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;IACpE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,uBAAuB;IACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;IAC7D,CAAC;IAED,0CAA0C;IAC1C,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAA;IAC5F,CAAC;IAED,sEAAsE;IACtE,uDAAuD;IAEvD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,2DAA2D;IAC3D,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAA;AAC/C,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,7 @@
+import { type ToolDefinition } from "@opencode-ai/plugin";
+import type { SecurityMode } from "./config/schema.js";
+/**
+ * Create all SSH tools for the plugin.
+ */
+export declare function createSshTools(mode?: SecurityMode, maxSessions?: number, defaultTimeout?: number, extraBlocklist?: string[]): Record<string, ToolDefinition>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAe/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAatD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,YAAqB,EAC3B,WAAW,GAAE,MAAU,EACvB,cAAc,GAAE,MAAW,EAC3B,cAAc,GAAE,MAAM,EAAO,GAC5B,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAmnBhC"}